code/cl8y-dex-terraclassic

Fork 0

fix(frontend): restore npm run build (tsc -b) - constrain chart SeriesApi generic + onMutate return #834

Merged

Brouie merged 1 commit from qa/337-build-tsc-fix into main

2026-06-08 05:29:39 +00:00

Brouie commented

2026-06-08 00:20:33 +00:00

(Migrated from gitlab.com)

tsc -b (run by npm run build) was red at 038a457 with two type errors.
vite build alone passes (esbuild ignores types), so the production build
break slipped past CI, which runs vitest + eslint but not tsc -b.

Changes

priceChartLightweightSeriesSync.ts: constrain SeriesApi<T> with T extends SeriesType (matches ISeriesApi<T>).
useTerraBroadcastMutation.ts: return caller onMutate context so react-query forwards it to onError/onSettled.

Rebase / conflict resolution

Rebased onto latest main (f875d53). Dropped accidental doc deletions that were present on the stale branch tip (unrelated #337 cross-links and Cloud Agent E2E notes in docs/testing.md).

Verification checklist

Item	Command	Result
TypeScript project build	`cd frontend-dapp && npm run build`	PASS
Chart sync unit tests	`npx vitest run src/components/charts/__tests__/priceChartLightweightSeriesSync.test.ts`	PASS (8 tests)
Broadcast mutation unit tests	`npx vitest run src/hooks/__tests__/useTerraBroadcastMutation.test.tsx src/hooks/__tests__/useTerraBroadcastMutation.dom.test.tsx`	PASS (4 tests)
Frontend lint	`make lint-frontend`	PASS (0 errors)
Merge with `main`	`git merge main` on branch tip	PASS (clean)

Found via #337 PERF-00-03. Relates to #336, #305. Suggest adding tsc -b to CI so this class of break stops recurring (same shape as #246).

`tsc -b` (run by `npm run build`) was red at 038a457 with two type errors. `vite build` alone passes (esbuild ignores types), so the production build break slipped past CI, which runs vitest + eslint but not `tsc -b`. ## Changes - `priceChartLightweightSeriesSync.ts`: constrain `SeriesApi<T>` with `T extends SeriesType` (matches `ISeriesApi<T>`). - `useTerraBroadcastMutation.ts`: return caller `onMutate` context so react-query forwards it to `onError`/`onSettled`. ## Rebase / conflict resolution Rebased onto latest `main` (f875d53). Dropped accidental doc deletions that were present on the stale branch tip (unrelated #337 cross-links and Cloud Agent E2E notes in `docs/testing.md`). ## Verification checklist | Item | Command | Result | |------|---------|--------| | TypeScript project build | `cd frontend-dapp && npm run build` | **PASS** | | Chart sync unit tests | `npx vitest run src/components/charts/__tests__/priceChartLightweightSeriesSync.test.ts` | **PASS** (8 tests) | | Broadcast mutation unit tests | `npx vitest run src/hooks/__tests__/useTerraBroadcastMutation.test.tsx src/hooks/__tests__/useTerraBroadcastMutation.dom.test.tsx` | **PASS** (4 tests) | | Frontend lint | `make lint-frontend` | **PASS** (0 errors) | | Merge with `main` | `git merge main` on branch tip | **PASS** (clean) | Found via #337 **PERF-00-03**. Relates to #336, #305. Suggest adding `tsc -b` to CI so this class of break stops recurring (same shape as #246).

PlasticDigits commented

2026-06-08 00:21:45 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 6cc9e92faa64d3c89776d9f182eb5bf82346b314
Scope: 2 frontend files — priceChartLightweightSeriesSync.ts (generic constraint) and useTerraBroadcastMutation.ts (onMutate context return).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

File	Change	Security assessment
`priceChartLightweightSeriesSync.ts`	Add `SeriesType` bound to `SeriesApi<T>`	Compile-time-only; no runtime or attack-surface change. Chart data still flows through existing `syncTimedSeries` equality checks; no new user-controlled sinks.
`useTerraBroadcastMutation.ts`	Return caller `onMutate` context to React Query	Restores standard optimistic-update rollback contract. No callers currently pass `onMutate`; context is app-defined, not attacker-controlled. Fix reduces risk of stale optimistic UI after failed broadcasts rather than introducing one.

Checks performed

Traced both hunks for injection, authz, secret leakage, XSS, and unsafe deserialization paths — none introduced.
Verified no new dependencies or CI/config changes in this MR.
No prior security-review threads on this MR to re-validate.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `6cc9e92faa64d3c89776d9f182eb5bf82346b314` **Scope:** 2 frontend files — `priceChartLightweightSeriesSync.ts` (generic constraint) and `useTerraBroadcastMutation.ts` (`onMutate` context return). **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. ### Summary | File | Change | Security assessment | |------|--------|---------------------| | `priceChartLightweightSeriesSync.ts` | Add `SeriesType` bound to `SeriesApi<T>` | Compile-time-only; no runtime or attack-surface change. Chart data still flows through existing `syncTimedSeries` equality checks; no new user-controlled sinks. | | `useTerraBroadcastMutation.ts` | Return caller `onMutate` context to React Query | Restores standard optimistic-update rollback contract. No callers currently pass `onMutate`; context is app-defined, not attacker-controlled. Fix reduces risk of stale optimistic UI after failed broadcasts rather than introducing one. | ### Checks performed - Traced both hunks for injection, authz, secret leakage, XSS, and unsafe deserialization paths — none introduced. - Verified no new dependencies or CI/config changes in this MR. - No prior security-review threads on this MR to re-validate. **Inline threads:** none (no medium+ findings).

Brouie commented

2026-06-08 00:32:39 +00:00

(Migrated from gitlab.com)

mentioned in issue #337

PlasticDigits commented

2026-06-08 05:26:20 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-08 05:27:43 +00:00

(Migrated from gitlab.com)

added 4 commits

6cc9e92f...9d3bf713 - 3 commits from branch PlasticDigits:main
f875d538 - fix(frontend): restore `npm run build` — constrain chart SeriesApi generic + onMutate return

Compare with previous version

added 4 commits <ul><li>6cc9e92f...9d3bf713 - 3 commits from branch <code>PlasticDigits:main</code></li><li>f875d538 - fix(frontend): restore `npm run build` — constrain chart SeriesApi generic + onMutate return</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/116/diffs?diff_id=1838908278&start_sha=6cc9e92faa64d3c89776d9f182eb5bf82346b314)

PlasticDigits commented

2026-06-08 05:29:39 +00:00

(Migrated from gitlab.com)

mentioned in commit 732a0e9b58

mentioned in commit 732a0e9b58a0ad07a91466d068667a648ed311c1

PlasticDigits (Migrated from gitlab.com) merged commit 732a0e9b58 into main

2026-06-08 05:29:39 +00:00

PlasticDigits commented

2026-06-08 05:30:54 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: f875d5388a17e2467de35f7dc805ee7d77e6cea7
Scope: 2 frontend files — priceChartLightweightSeriesSync.ts (generic constraint) and useTerraBroadcastMutation.ts (onMutate context return). Re-reviewed after rebase onto main (9d3bf71).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

File	Change	Security assessment
`priceChartLightweightSeriesSync.ts`	Add `SeriesType` bound to `SeriesApi<T>`	Compile-time-only; no runtime or attack-surface change. Chart data still flows through existing `syncTimedSeries` equality checks; no new user-controlled sinks.
`useTerraBroadcastMutation.ts`	Return caller `onMutate` context to React Query	Restores standard optimistic-update rollback contract. No callers currently pass `onMutate`; context is app-defined, not attacker-controlled. Fix reduces risk of stale optimistic UI after failed broadcasts rather than introducing one.

Checks performed

Traced both hunks for injection, authz, secret leakage, XSS, and unsafe deserialization paths — none introduced.
Verified no new dependencies or CI/config changes in this MR (diff is still 2 files only).
Re-validated prior review on 6cc9e92 — same functional hunks after rebase; no new medium+ issues.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `f875d5388a17e2467de35f7dc805ee7d77e6cea7` **Scope:** 2 frontend files — `priceChartLightweightSeriesSync.ts` (generic constraint) and `useTerraBroadcastMutation.ts` (`onMutate` context return). Re-reviewed after rebase onto `main` (`9d3bf71`). **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. ### Summary | File | Change | Security assessment | |------|--------|---------------------| | `priceChartLightweightSeriesSync.ts` | Add `SeriesType` bound to `SeriesApi<T>` | Compile-time-only; no runtime or attack-surface change. Chart data still flows through existing `syncTimedSeries` equality checks; no new user-controlled sinks. | | `useTerraBroadcastMutation.ts` | Return caller `onMutate` context to React Query | Restores standard optimistic-update rollback contract. No callers currently pass `onMutate`; context is app-defined, not attacker-controlled. Fix reduces risk of stale optimistic UI after failed broadcasts rather than introducing one. | ### Checks performed - Traced both hunks for injection, authz, secret leakage, XSS, and unsafe deserialization paths — none introduced. - Verified no new dependencies or CI/config changes in this MR (diff is still 2 files only). - Re-validated prior review on `6cc9e92` — same functional hunks after rebase; no new medium+ issues. **Inline threads:** none (no medium+ findings).

PlasticDigits commented

2026-06-08 08:43:13 +00:00

(Migrated from gitlab.com)

mentioned in commit 34af36f9ba

mentioned in commit 34af36f9baefd098bbae437052e8e0a0df807194

PlasticDigits commented

2026-06-08 13:42:28 +00:00

(Migrated from gitlab.com)

mentioned in commit 7fdd341c9c

mentioned in commit 7fdd341c9caaa72b4853a5b317b35906f932e998