refactor: earn flow + remove xstate/store by petar-omni · Pull Request #551 · stakekit/widget

petar-omni · 2026-06-26T23:13:26Z

Note

High Risk
Large new DeFi borrow path with wallet signing, transaction submission, and LTV validation touches money-moving flows; earn routing/state refactor could regress staking if mis-wired.

Overview
Adds a feature-flagged borrow experience in the dashboard (form → review → steps → complete, plus borrow position management), backed by a new borrow module: Effect Schema domain models, OpenAPI-generated BorrowApi client, and @effect/atom-react atoms for markets/positions, form state, action execution (sign/submit/confirm), and post-tx cache refresh.

Earn flow cleanup: drops EarnPageStateUsageBoundaryProvider / @xstate/store, removes common/get-token-balances.ts and getInitialToken from stake types, and tightens validator handling via a composite Validator.key (address + optional subnet) used in select-validator and position balance keys.

Tooling/config: OpenAPI generator gains BorrowApi (full httpclient + spec prep), optional CLI spec selection, VITE_BORROW_API_URL / VITE_FORCE_BORROW, and root pnpm.patchedDependencies removed; adds skeleton line/circle loaders for borrow UI loading states.

^{Reviewed by Cursor Bugbot for commit 6cf3187. Configure here.}

changeset-bot · 2026-06-26T23:13:30Z

⚠️ No Changeset found

Latest commit: d3f8b07

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-06-26T23:13:34Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f2d2a83c-e736-49e8-b48f-3041b4042c82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/earn-effect-atom-poc

_{Comment @coderabbitai help to get the list of available commands.}

aws-amplify-eu-central-1 · 2026-06-26T23:15:52Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.d2ribjy8evqo6h.amplifyapp.com

aws-amplify-eu-central-1 · 2026-06-26T23:16:01Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.df4xyoi0xyeak.amplifyapp.com

Key validators by address and subnet so selection keeps distinct validator options. Scope balance and init token options to the selected dashboard category.

cursor

Stale comment

cursor

Stale comment

cursor

Stale comment

dnehl

Played around with the flow - looks good.

no console errors
no "strange" multiple backend calls
duration looks good

Split earn intent and view atoms so route and wallet state changes update the resolved view. Keep dispatch separate from view reads and add wallet resolution handling. Cover dashboard tab selection and patch Effect parent tracking.

Use the native TypeScript 7 compiler across the widget and examples. Keep TypeScript 6 API compatibility for Next.js tooling.

cursor

Stale comment

Replace legacy context, query, and state-machine integrations with Effect services and atom-backed wallet, API, and workflow state. Split Vitest projects and add AST rules to validate the new architecture.

Publish each feature through at most state/ui/components entries and keep internals private, so vertical feature boundaries are enforced by tooling. Move borrow intent into atoms, shared UI out of widget-shell, and route matchers into owning features; tighten the domain rev-dep rule and add a public-api conformance test.

Move workflows, resources, routing, and mount sequencing into Effect Atom runtimes. Add generation-scoped borrow configuration and lazy connector setup for stable startup.

cursor

Stale comment

cursor

Stale comment

cursor

Stale comment

Restore detected browser language when a new widget omits an explicit language. Serialize browser files and await async unmounts so tests respect the single-instance lifecycle.

Use balance data only to enrich canonical token amounts instead of expanding the yield catalog. Preserve valid automatic selections and fall back to a positive-balance token before the first token.

cursor

Stale comment

Move Classic journey phase routes, pages, and flow scopes behind one feature-owned route factory. Keep app-owned mount paths and wallet guards while preserving distinct activity presentations.

cursor

Stale comment

Restore classic transaction metadata to the stable public shape. Add explicit Borrow provider capabilities and route each family through its matching callback. Preserve typed wallet failures through transaction workflow projections.

Model account snapshots, market positions, and risk projections as distinct domain concepts. Keep pool and isolated collateral behavior explicit. Reset stale forms when markets disappear or change capability. Retain disabled-market positions and surface uncertain risk without blocking execution.

Enforce mount-time runtime identity and preserve one-shot Earn initialization. Keep activity, position, disconnect, and renderer flows aligned with their owners. Record the audit findings and add regression coverage for each resolved case.

cursor

Stale comment

Keep runtime providers and feature atoms aligned with production composition. Move test substitution into test-owned registries and Effect layers. Expose the canonical yield summary family directly.

cursor

Stale comment

Consolidate selection state, resources, and projections behind one entry point. Expose provider-enriched yields so the facade no longer relies on unsafe casts.

cursor

Stale comment

cursor

Stale comment

cursor · 2026-07-30T16:13:30Z

+                            background="transparent"
+                            data-rk="borrow-steps-transaction-link"
+                            onClick={() =>
+                              window.open(submission.link ?? "", "_blank")


🔒 Agentic Security Review
Severity: MEDIUM

submission.link from transaction metadata is opened with window.open(..., "_blank") without opener isolation (noopener,noreferrer) and without URL allowlisting. If upstream link data is malicious or compromised, the new tab can perform reverse-tabnabbing (window.opener) and redirect the trusted original tab.

Impact: Users can be navigated from a trusted widget flow to attacker-controlled phishing content after clicking a transaction link.

^{Reviewed by Cursor Security Reviewer for commit e4062a9. Configure here.}

cursor

Stale comment

cursor

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high remote-script execution in release.yml). jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

petar-omni added 2 commits June 27, 2026 01:10

feat(widget): add effect atom earn flow

8f6710c

refactor(widget): replace xstate stores with effect atoms

15d72af

fix(widget): stabilize earn option resolution

3127f0d

Key validators by address and subnet so selection keeps distinct validator options. Scope balance and init token options to the selected dashboard category.

petar-omni marked this pull request as ready for review July 7, 2026 12:22

Philippoes previously approved these changes Jul 7, 2026

View reviewed changes

cursor Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread packages/widget/src/features/borrow-transaction-flow/ui/complete.tsx

feat: borrow init

5dac944

petar-omni dismissed Philippoes’s stale review via 5dac944 July 7, 2026 12:27

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 6cf3187 to 5dac944 Compare July 7, 2026 12:27

petar-omni requested a review from Philippoes July 7, 2026 12:27

Philippoes previously approved these changes Jul 7, 2026

View reviewed changes

feat: temp

2110846

petar-omni dismissed Philippoes’s stale review via 2110846 July 7, 2026 12:31

cursor Bot requested a review from dnehl July 7, 2026 12:31

cursor Bot reviewed Jul 7, 2026

View reviewed changes

cursor Bot requested a review from jdomingos July 7, 2026 12:31

cursor Bot reviewed Jul 7, 2026

View reviewed changes

dnehl previously approved these changes Jul 7, 2026

View reviewed changes

dnehl self-requested a review July 7, 2026 14:11

petar-omni added 3 commits July 9, 2026 16:56

fix(widget): stabilize earn atom subscriptions

90a2b21

Split earn intent and view atoms so route and wallet state changes update the resolved view. Keep dispatch separate from view reads and add wallet resolution handling. Cover dashboard tab selection and patch Effect parent tracking.

feat: schema decoding, query to atoms migration

b2043f0

build(typescript): migrate to typescript 7

3c5bfdc

Use the native TypeScript 7 compiler across the widget and examples. Keep TypeScript 6 API compatibility for Next.js tooling.

petar-omni dismissed dnehl’s stale review via 16d2bb4 July 14, 2026 23:49

cursor Bot reviewed Jul 14, 2026

View reviewed changes

refactor(widget): migrate runtime state to effect atoms

67eb76f

Replace legacy context, query, and state-machine integrations with Effect services and atom-backed wallet, API, and workflow state. Split Vitest projects and add AST rules to validate the new architecture.

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 16d2bb4 to 67eb76f Compare July 15, 2026 08:42

petar-omni added 2 commits July 27, 2026 09:47

feat(widget): complete effect atom runtime migration

048ebb5

Move workflows, resources, routing, and mount sequencing into Effect Atom runtimes. Add generation-scoped borrow configuration and lazy connector setup for stable startup.

cursor Bot reviewed Jul 27, 2026

View reviewed changes

fix(widget): restore yield directory page size

649e8fe

cursor Bot reviewed Jul 27, 2026

View reviewed changes

test(widget): harden staking flow timeout

3ede7fb

cursor Bot reviewed Jul 27, 2026

View reviewed changes

petar-omni added 2 commits July 27, 2026 18:29

fix(widget): reset language across sequential remounts

f7fe641

Restore detected browser language when a new widget omits an explicit language. Serialize browser files and await async unmounts so tests respect the single-instance lifecycle.

perf(widget): defer earn yields until token selection

8bddeea

Use balance data only to enrich canonical token amounts instead of expanding the yield catalog. Preserve valid automatic selections and fall back to a positive-balance token before the first token.

cursor Bot reviewed Jul 27, 2026

View reviewed changes

petar-omni added 3 commits July 28, 2026 13:48

feat: deps

12dd4a6

feat(widget): add headless activity page view

67c27d0

refactor(widget): publish classic journey as route module

44e816c

Move Classic journey phase routes, pages, and flow scopes behind one feature-owned route factory. Keep app-owned mount paths and wallet guards while preserving distinct activity presentations.

cursor Bot reviewed Jul 28, 2026

View reviewed changes

petar-omni added 4 commits July 28, 2026 22:57

fix(widget): correct flow retries and resource error policy

f71768d

fix(widget): preserve transaction provider contracts

3b2d96c

Restore classic transaction metadata to the stable public shape. Add explicit Borrow provider capabilities and route each family through its matching callback. Preserve typed wallet failures through transaction workflow projections.

cursor Bot reviewed Jul 29, 2026

View reviewed changes

refactor(widget): remove test-only atom seams

18cb589

Keep runtime providers and feature atoms aligned with production composition. Move test substitution into test-owned registries and Effect layers. Expose the canonical yield summary family directly.

cursor Bot reviewed Jul 30, 2026

View reviewed changes

petar-omni added 3 commits July 30, 2026 14:45

refactor(widget): deepen classic transaction flow interface

6d96ac4

refactor(widget): deepen earn selection module

dcaac32

Consolidate selection state, resources, and projections behind one entry point. Expose provider-enriched yields so the facade no longer relies on unsafe casts.

refactor(borrow): deepen action preparation

2cbfeec

cursor Bot reviewed Jul 30, 2026

View reviewed changes

refactor(borrow): organize journeys and domain

e4062a9

cursor Bot reviewed Jul 30, 2026

View reviewed changes

fix(widget): resolve wallet and borrow audit findings

d3f8b07

cursor Bot reviewed Jul 30, 2026

View reviewed changes

Uh oh!

Conversation

petar-omni commented Jun 26, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Jun 26, 2026

Review skipped

Uh oh!

aws-amplify-eu-central-1 Bot commented Jun 26, 2026

Uh oh!

aws-amplify-eu-central-1 Bot commented Jun 26, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dnehl left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

petar-omni commented Jun 26, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Jun 26, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

dnehl left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading