feat(widget): add borrowing flows and migrate runtime to Effect

[petar-omni]

Note

High Risk
Large new DeFi borrow path with wallet signing, transaction submission, and LTV validation touches money-moving flows; earn routing/state refactor could regress staking if mis-wired.

Overview
Adds a feature-flagged borrow experience in the dashboard (form → review → steps → complete, plus borrow position management), backed by a new borrow module: Effect Schema domain models, OpenAPI-generated BorrowApi client, and @effect/atom-react atoms for markets/positions, form state, action execution (sign/submit/confirm), and post-tx cache refresh.

Earn flow cleanup: drops EarnPageStateUsageBoundaryProvider / @xstate/store, removes common/get-token-balances.ts and getInitialToken from stake types, and tightens validator handling via a composite Validator.key (address + optional subnet) used in select-validator and position balance keys.

Tooling/config: OpenAPI generator gains BorrowApi (full httpclient + spec prep), optional CLI spec selection, VITE_BORROW_API_URL / VITE_FORCE_BORROW, and root pnpm.patchedDependencies removed; adds skeleton line/circle loaders for borrow UI loading states.

^{Reviewed by Cursor Bugbot for commit 6cf3187. Configure here.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: ae6e6e6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f2d2a83c-e736-49e8-b48f-3041b4042c82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/earn-effect-atom-poc

---

_{Comment @coderabbitai help to get the list of available commands.}

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.d2ribjy8evqo6h.amplifyapp.com

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.df4xyoi0xyeak.amplifyapp.com

[cursor]

Stale comment

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, Cursor Security Agent left an unresolved medium-severity finding, and required checks did not finish on the latest commit (Bugbot cancelled; Security Agent still running). Assigned jdomingos and dnehl for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[dnehl]

Played around with the flow - looks good.

• no console errors
• no "strange" multiple backend calls
• duration looks good

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. No new reviewers assigned; two reviewers are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: this earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. No new reviewers assigned; two reviewers are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: this earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. No new reviewers assigned; two reviewers are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Agentic security review found 1 new medium issue on the current head. Existing reverse-tabnabbing and canary-release threads remain open and were not duplicated.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM

The provider website link uses the raw Yield catalog provider.website string as href, with no scheme allowlist. The dashboard path already routes the same field through formatProviderWebsiteHref, which prefixes non-http(s) values. A catalog value such as javascript: or data: can become an executable link in the host document when this widget is embedded same-origin.

Impact: Poisoned provider metadata can run script in the embedding origin on click, or open an unexpected scheme.

 

^{Reviewed by Cursor Security Reviewer for commit e893af6. Configure here.}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: this earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. No new reviewers assigned; two reviewers are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: this earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. No new reviewers assigned; two reviewers are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: this earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. No new reviewers assigned; two reviewers are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: this earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. No new reviewers assigned; two reviewers are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: Cursor Security Agent did not reach a terminal state within the polling window, and this earn/borrow refactor exceeds the low-risk approval threshold. Human review is needed; reviewers were already assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: Cursor Security Agent did not reach a terminal state within the polling window, and this large earn-flow refactor exceeds the low-risk approval threshold. Reviewers were already assigned, so none were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: Cursor Security Agent did not reach a terminal state within the polling window, and this earn/borrow refactor exceeds the low-risk approval threshold. Reviewers were already assigned, so none were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: Cursor Security Agent did not reach a terminal state within the polling window, and this earn-flow refactor exceeds the low-risk approval threshold. Reviewers were already assigned, so none were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: this earn-flow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high findings that need human review. Reviewers were already assigned, so none were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: Cursor Security Agent did not reach a terminal state within the polling window, and this earn-flow refactor exceeds the low-risk approval threshold. Reviewers were already assigned, so none were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment and did not approve: this large earn-flow refactor exceeds the low-risk threshold, and Cursor Security Agent did not finish within the wait window. Human review is needed; no additional reviewers were assigned because two are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment and did not approve: this earn-flow refactor exceeds the low-risk threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. Reviewers were already assigned, so none were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment and did not approve: this earn-flow refactor exceeds the low-risk threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. Reviewers were already assigned, so none were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Risk: high. Left a non-blocking comment and did not approve: this earn-flow refactor exceeds the low-risk threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. Reviewers were already assigned, so none were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}