refactor: earn flow + remove xstate/store by petar-omni · Pull Request #551 · stakekit/widget

petar-omni · 2026-06-26T23:13:26Z

Note

High Risk
Large new DeFi borrow path with wallet signing, transaction submission, and LTV validation touches money-moving flows; earn routing/state refactor could regress staking if mis-wired.

Overview
Adds a feature-flagged borrow experience in the dashboard (form → review → steps → complete, plus borrow position management), backed by a new borrow module: Effect Schema domain models, OpenAPI-generated BorrowApi client, and @effect/atom-react atoms for markets/positions, form state, action execution (sign/submit/confirm), and post-tx cache refresh.

Earn flow cleanup: drops EarnPageStateUsageBoundaryProvider / @xstate/store, removes common/get-token-balances.ts and getInitialToken from stake types, and tightens validator handling via a composite Validator.key (address + optional subnet) used in select-validator and position balance keys.

Tooling/config: OpenAPI generator gains BorrowApi (full httpclient + spec prep), optional CLI spec selection, VITE_BORROW_API_URL / VITE_FORCE_BORROW, and root pnpm.patchedDependencies removed; adds skeleton line/circle loaders for borrow UI loading states.

^{Reviewed by Cursor Bugbot for commit 6cf3187. Configure here.}

changeset-bot · 2026-06-26T23:13:30Z

⚠️ No Changeset found

Latest commit: 9d4d279

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-06-26T23:13:34Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f2d2a83c-e736-49e8-b48f-3041b4042c82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/earn-effect-atom-poc

_{Comment @coderabbitai help to get the list of available commands.}

aws-amplify-eu-central-1 · 2026-06-26T23:15:52Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.d2ribjy8evqo6h.amplifyapp.com

aws-amplify-eu-central-1 · 2026-06-26T23:16:01Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.df4xyoi0xyeak.amplifyapp.com

Key validators by address and subnet so selection keeps distinct validator options. Scope balance and init token options to the selected dashboard category.

cursor

Stale comment

cursor · 2026-07-07T12:26:02Z

+                      {t("dashboard.borrow.success_page.view_transaction")}
+                    </Text>
+                  </Box>
+                ) : null


🔒 Agentic Security Review
Severity: MEDIUM

submission.link is opened via window.open(..., "_blank") without noopener,noreferrer. If this URL is attacker-influenced (e.g., via upstream API data), the opened page can access window.opener and navigate the original tab (reverse-tabnabbing).

Impact: A user can be redirected from the trusted widget host tab to a phishing or malicious page after clicking a transaction link.

^{Reviewed by Cursor Security Reviewer for commit 6cf3187. Configure here.}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, Cursor Security Agent left an unresolved medium-severity finding, and required checks did not finish on the latest commit (Bugbot cancelled; Security Agent still running). Assigned jdomingos and dnehl for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

dnehl

Played around with the flow - looks good.

no console errors
no "strange" multiple backend calls
duration looks good

Split earn intent and view atoms so route and wallet state changes update the resolved view. Keep dispatch separate from view reads and add wallet resolution handling. Cover dashboard tab selection and patch Effect parent tracking.

Use the native TypeScript 7 compiler across the widget and examples. Keep TypeScript 6 API compatibility for Next.js tooling.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Replace legacy context, query, and state-machine integrations with Effect services and atom-backed wallet, API, and workflow state. Split Vitest projects and add AST rules to validate the new architecture.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Define an explicit public API contract for package and bundle consumers. Emit only public declarations instead of the full application type graph.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Standardize ignored files and vendored repository paths. Align editor, TypeScript, pnpm, and agent guidance and remove obsolete files.

Reorganize app composition, services, features, domain, and shared code by ownership. Consolidate runtime state around one Effect Atom runtime. Add architecture checks to prevent dependency leaks.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Project borrow wallet state directly from normalized atom state. Remove the unused bridge-owned chain switching command. Rename the atom runtime provider directory to match its broader role.

Replace separate step and borrow executors with one Effect-backed workflow model. Share the workflow across classic and dashboard flows. Normalize wallet transaction payloads at the domain boundary and align tests and Effect guidance with the new runtime.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Split the workflow graph into direct atom families so mounted consumers retain each atom. Keep derived atoms on one machine and provide the classic workflow key through React context.

Key runtime generations by API configuration while keeping host callbacks reactive. Bind workflows, selections, and resource invalidation to semantic wallet scopes. Prevent account and network changes from reusing stale state. Route classic and dashboard flows through scoped guards. Cover lifecycle behavior with unit, DOM, and browser tests.

Capture one immutable wallet bootstrap snapshot per app runtime. Construct one service-owned Wagmi config with observable lifecycle phases. Keep watchers, initialization, reconnect ordering, and cleanup scope-owned. Preserve the legacy consumer path for the later authoritative handoff.

Own modern Wallet Standard discovery, readiness, mobile parity, and cleanup. Keep dynamic adapters out of Wagmi until the later membership cutover.

Route the Wagmi React boundary and core wallet projections through the scoped WalletService runtime. Keep one config across wallet-setting changes and surface terminal failures through typed adapters.

Move live external-provider snapshots and connector notifications into the scoped WalletService runtime. Enforce fixed connector mode with terminal, log-once invariants without rebuilding Wagmi.

Move connection enrichment and private command-routing context into the scoped wallet runtime. Publish atomic, deduplicated service projections and replace feature state owners with read-only adapters.

Run connection tracking and unsupported-chain disconnects from serialized WalletService state. Remove atom lifecycle ownership and scope recoverable effects to the wallet runtime.

Capture one service-owned routing snapshot when each command begins. Fail terminal runtime phases deterministically while preserving immediate pre-ready capability failures and active-command stability.

Drive Solana connector discovery and readiness from the scoped wallet runtime. Keep the Wagmi config authoritative and stable. Remove the React Solana bootstrap bridge and unused adapter dependency.

Remove keyed wallet controller and root-input compatibility paths. Keep React as a read-only adapter for the service-owned Wagmi config. Declare the missing Fractal Solana peer required by distributable builds.

Make wallet service acquisition define readiness through a top-down bootstrap. Replace the public runtime event protocol with Effect-native state, streams, and dependency injection. Keep wallet readiness isolated from unrelated app services while sharing their constructed service context through the wallet runtime.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Import values and types directly from their defining modules to make dependency boundaries explicit. Add Biome rules that prevent internal barrels and type re-exports while preserving the public entrypoints.

cursor

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

petar-omni added 2 commits June 27, 2026 01:10

feat(widget): add effect atom earn flow

8f6710c

refactor(widget): replace xstate stores with effect atoms

15d72af

fix(widget): stabilize earn option resolution

3127f0d

Key validators by address and subnet so selection keeps distinct validator options. Scope balance and init token options to the selected dashboard category.

petar-omni marked this pull request as ready for review July 7, 2026 12:22

Philippoes previously approved these changes Jul 7, 2026

View reviewed changes

cursor Bot reviewed Jul 7, 2026

View reviewed changes

feat: borrow init

5dac944

petar-omni dismissed Philippoes’s stale review via 5dac944 July 7, 2026 12:27

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 6cf3187 to 5dac944 Compare July 7, 2026 12:27

petar-omni requested a review from Philippoes July 7, 2026 12:27

Philippoes previously approved these changes Jul 7, 2026

View reviewed changes

feat: temp

2110846

petar-omni dismissed Philippoes’s stale review via 2110846 July 7, 2026 12:31

cursor Bot requested a review from dnehl July 7, 2026 12:31

cursor Bot reviewed Jul 7, 2026

View reviewed changes

cursor Bot requested a review from jdomingos July 7, 2026 12:31

cursor Bot reviewed Jul 7, 2026

View reviewed changes

dnehl previously approved these changes Jul 7, 2026

View reviewed changes

dnehl self-requested a review July 7, 2026 14:11

petar-omni added 3 commits July 9, 2026 16:56

fix(widget): stabilize earn atom subscriptions

90a2b21

Split earn intent and view atoms so route and wallet state changes update the resolved view. Keep dispatch separate from view reads and add wallet resolution handling. Cover dashboard tab selection and patch Effect parent tracking.

feat: schema decoding, query to atoms migration

b2043f0

build(typescript): migrate to typescript 7

3c5bfdc

Use the native TypeScript 7 compiler across the widget and examples. Keep TypeScript 6 API compatibility for Next.js tooling.

petar-omni dismissed dnehl’s stale review via 16d2bb4 July 14, 2026 23:49

cursor Bot reviewed Jul 14, 2026

View reviewed changes

refactor(widget): migrate runtime state to effect atoms

67eb76f

Replace legacy context, query, and state-machine integrations with Effect services and atom-backed wallet, API, and workflow state. Split Vitest projects and add AST rules to validate the new architecture.

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 16d2bb4 to 67eb76f Compare July 15, 2026 08:42

cursor Bot reviewed Jul 15, 2026

View reviewed changes

refactor(widget): narrow published type declarations

0d6ed5f

Define an explicit public API contract for package and bundle consumers. Emit only public declarations instead of the full application type graph.

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 66cee96 to 0d6ed5f Compare July 15, 2026 10:13

cursor Bot reviewed Jul 15, 2026

View reviewed changes

petar-omni added 2 commits July 15, 2026 17:35

chore(repo): align workspace tooling configuration

98e4c72

Standardize ignored files and vendored repository paths. Align editor, TypeScript, pnpm, and agent guidance and remove obsolete files.

refactor(widget): reorganize modules by ownership

7f4ea37

Reorganize app composition, services, features, domain, and shared code by ownership. Consolidate runtime state around one Effect Atom runtime. Add architecture checks to prevent dependency leaks.

cursor Bot reviewed Jul 15, 2026

View reviewed changes

petar-omni added 3 commits July 16, 2026 11:57

refactor(widget): simplify borrow wallet state projection

d00f44e

Project borrow wallet state directly from normalized atom state. Remove the unused bridge-owned chain switching command. Rename the atom runtime provider directory to match its broader role.

fix(widget): stabilize transaction workflow execution

3dabf4a

cursor Bot reviewed Jul 16, 2026

View reviewed changes

petar-omni added 13 commits July 16, 2026 22:33

fix(widget): stabilize transaction workflow atom identity

9714f3d

Split the workflow graph into direct atom families so mounted consumers retain each atom. Keep derived atoms on one machine and provide the classic workflow key through React context.

test(widget): stabilize asynchronous hook tests

df4abba

feat(widget): add scoped headless solana runtime

17b8feb

Own modern Wallet Standard discovery, readiness, mobile parity, and cleanup. Keep dynamic adapters out of Wagmi until the later membership cutover.

feat(widget): make wallet service config authoritative

2771fb0

Route the Wagmi React boundary and core wallet projections through the scoped WalletService runtime. Keep one config across wallet-setting changes and surface terminal failures through typed adapters.

feat(widget): own external provider synchronization

e5a8a8b

Move live external-provider snapshots and connector notifications into the scoped WalletService runtime. Enforce fixed connector mode with terminal, log-once invariants without rebuilding Wagmi.

feat(widget): publish canonical wallet state

835a450

Move connection enrichment and private command-routing context into the scoped wallet runtime. Publish atomic, deduplicated service projections and replace feature state owners with read-only adapters.

feat(widget): move wallet lifecycle policies

d1b6eb5

Run connection tracking and unsupported-chain disconnects from serialized WalletService state. Remove atom lifecycle ownership and scope recoverable effects to the wallet runtime.

feat(widget): route commands from wallet state

d10d4fb

Capture one service-owned routing snapshot when each command begins. Fail terminal runtime phases deterministically while preserving immediate pre-ready capability failures and active-command stability.

feat(widget): integrate dynamic solana membership

a77564b

Drive Solana connector discovery and readiness from the scoped wallet runtime. Keep the Wagmi config authoritative and stable. Remove the React Solana bootstrap bridge and unused adapter dependency.

refactor(widget): remove legacy wallet ownership

e43ea7d

Remove keyed wallet controller and root-input compatibility paths. Keep React as a read-only adapter for the service-owned Wagmi config. Declare the missing Fractal Solana peer required by distributable builds.

cursor Bot reviewed Jul 19, 2026

View reviewed changes

refactor(widget): remove internal barrel exports

9d4d279

Import values and types directly from their defining modules to make dependency boundaries explicit. Add Biome rules that prevent internal barrels and type re-exports while preserving the public entrypoints.

cursor Bot reviewed Jul 19, 2026

View reviewed changes

Uh oh!

Conversation

petar-omni commented Jun 26, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Jun 26, 2026

Review skipped

Uh oh!

aws-amplify-eu-central-1 Bot commented Jun 26, 2026

Uh oh!

aws-amplify-eu-central-1 Bot commented Jun 26, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dnehl left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

petar-omni commented Jun 26, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Jun 26, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

dnehl left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading