refactor(fx): consume the shared backend rate policy — FX-only cutover to main

[Hugo0]

FX only. The FX half of #2607 replayed onto main. dev also carries the support-reply badge and a websocket log fix; neither belongs in an FX-only cutover, so they stay for the next release.

Pairs with peanut-api-ts #1312.

⚠️ Deploy order is not optional

peanut-api-ts #1312 must be merged and deployed first. This PR drops api.frankfurter.app from CSP, so if the FE ships while /fx/* is absent from prod, every rate surface blanks and the old path cannot be hot-restored.

Why the cutover is clean

proxy.ts, api-fetch.ts, sentry.utils.ts and demo-api.ts differ from main on FX lines only. No badge file is touched. api.openapi.json is the FX-hotfix backend's spec and api.generated.ts was regenerated from it — /fx/rate and the badge paths are both present, rather than hand-merged.

What it fixes

• Drifted device clocks. The freshness check compared backend timestamps against the device clock with a 5-minute tolerance, so a phone more than 5 minutes out rejected every response the backend could send — permanently, with no local fallback left. Now 6 hours. The checks that actually bound staleness compare two backend timestamps and stay tight.
• 503 added to the Sentry skip list for /fx/rate — peanut-api already reports the upstream cause; reporting it client-side multiplies one incident by every mounted hook and its retries.
• /fx/rate gets a real demo-api handler; without one a failed passthrough answered 200 {}.

Verification

Typecheck clean, 2873 tests green. FX behaviour verified on staging as part of dev: 43/43 on the backend shadow-compare.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peanut-wallet	Ready	Preview	Aug 7, 2026 5:42pm

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 5 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 13b20754-be1b-4340-aa90-cb5df4db5519

📥 Commits

Reviewing files that changed from the base of the PR and between 9eb694d and d1c3124.

⛔ Files ignored due to path filters (1)

• src/types/api.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing (19)

• docs/api-types.md
• next.config.js
• src/__tests__/proxy.test.ts
• src/app/(mobile-ui)/add-money/[country]/bank/page.tsx
• src/app/api/exchange-rate/__tests__/route.test.ts
• src/app/api/exchange-rate/route.ts
• src/app/m/[slug]/MerchantLandingPage.tsx
• src/hooks/__tests__/useExchangeRate.test.tsx
• src/hooks/useExchangeRate.ts
• src/proxy.ts
• src/types/api.openapi.json
• src/utils/__tests__/api-fetch.test.ts
• src/utils/__tests__/demo-api.test.ts
• src/utils/__tests__/fx.utils.test.ts
• src/utils/__tests__/sentry.utils.test.ts
• src/utils/api-fetch.ts
• src/utils/demo-api.ts
• src/utils/fx.utils.ts
• src/utils/sentry.utils.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🧪 UI test report — ✅ all green

Suites

• ✅ unit: 2876 ran, 0 failed, 0 skipped, 46.9s

📊 Coverage (unit)

metric	%
statements	65.9%
branches	50.8%
functions	55.8%
lines	66.7%

⏱ 10 slowest test cases

time	test
3.7s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › never places two stickers in heavy overlap (broad seed sweep)
1.1s	src/utils/__tests__/demo-api.test.ts › isDemoMode() is false when not running under Capacitor
0.3s	src/utils/__tests__/sentry.utils.test.ts › defaults to the client budget under a browser global
0.3s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › every sticker stays within canvas at any count
0.3s	src/app/(mobile-ui)/withdraw/__tests__/withdraw-states.test.tsx › Bank withdrawal keeps the $1 minimum for sub-$1 amounts
0.3s	src/app/actions/__tests__/api-headers.test.ts › should include Content-Type in validateInviteCode
0.3s	src/utils/__tests__/sentry.utils.test.ts › still lets a per-call timeoutMs win over the default
0.3s	src/utils/__tests__/auth-token.test.ts › authReady does not park — hydrates the plain token without an unlock
0.2s	src/utils/__tests__/auth-token.test.ts › is none — never guarded — when only the guarded marker is present
0.2s	src/app/actions/__tests__/api-headers-extended.test.ts › should not include apiKey in validateInviteCode body

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}

[github-actions]

Code-analysis diff

Painscore total: 7127.92 → 7126.24 (-1.68)
Findings: 0 net (+380 new, -380 resolved)

🆕 New findings (380)

• critical complexity — src/utils/demo-api.ts — CC 109, MI 59.48, SLOC 934
• high structural-dup — types/api.generated.ts:10133 — 83 duplicate lines / 388 tokens with types/api.generated.ts:10721
• high structural-dup — types/api.generated.ts:267 — 75 duplicate lines / 269 tokens with types/api.generated.ts:2489
• high structural-dup — types/api.generated.ts:10143 — 74 duplicate lines / 348 tokens with types/api.generated.ts:10731
• high structural-dup — types/api.generated.ts:267 — 73 duplicate lines / 264 tokens with types/api.generated.ts:2318
• high structural-dup — types/api.generated.ts:267 — 68 duplicate lines / 249 tokens with types/api.generated.ts:2156
• high structural-dup — types/api.generated.ts:5013 — 61 duplicate lines / 188 tokens with types/api.generated.ts:5115
• high hotspot — src/app/(mobile-ui)/add-money/[country]/bank/page.tsx — 60 commits, +588/-497 lines since 6 months ago
• high structural-dup — types/api.generated.ts:2101 — 55 duplicate lines / 162 tokens with types/api.generated.ts:2434
• high structural-dup — types/api.generated.ts:2101 — 55 duplicate lines / 162 tokens with types/api.generated.ts:2596
• high structural-dup — types/api.generated.ts:2101 — 55 duplicate lines / 165 tokens with types/api.generated.ts:2683
• high complexity — src/proxy.ts — CC 36, MI 57.21, SLOC 116
• medium high-mdd — src/hooks/useExchangeRate.ts:27 — useExchangeRate: MDD 57.2 (uses across many lines from declarations)
• medium high-mdd — src/utils/sentry.utils.ts:389 — fetchWithSentry: MDD 53.8 (uses across many lines from declarations)
• medium structural-dup — types/api.generated.ts:8016 — 49 duplicate lines / 149 tokens with types/api.generated.ts:8440
• medium structural-dup — types/api.generated.ts:7 — 48 duplicate lines / 185 tokens with types/api.generated.ts:10861
• medium structural-dup — types/api.generated.ts:8519 — 43 duplicate lines / 123 tokens with types/api.generated.ts:8800
• medium structural-dup — types/api.generated.ts:8519 — 42 duplicate lines / 125 tokens with types/api.generated.ts:8878
• medium structural-dup — types/api.generated.ts:267 — 41 duplicate lines / 147 tokens with types/api.generated.ts:2403
• medium structural-dup — types/api.generated.ts:2116 — 40 duplicate lines / 120 tokens with types/api.generated.ts:2278

…and 360 more.

✅ Resolved (380)

• src/utils/demo-api.ts — CC 107, MI 59.5, SLOC 917
• types/api.generated.ts:383 — 83 duplicate lines / 388 tokens with types/api.generated.ts:1096
• types/api.generated.ts:393 — 74 duplicate lines / 348 tokens with types/api.generated.ts:1106
• types/api.generated.ts:139 — 72 duplicate lines / 269 tokens with types/api.generated.ts:9926
• types/api.generated.ts:139 — 70 duplicate lines / 264 tokens with types/api.generated.ts:10012
• types/api.generated.ts:139 — 67 duplicate lines / 249 tokens with types/api.generated.ts:9603
• src/app/(mobile-ui)/add-money/[country]/bank/page.tsx — 59 commits, +587/-496 lines since 6 months ago
• types/api.generated.ts:9548 — 55 duplicate lines / 162 tokens with types/api.generated.ts:9700
• types/api.generated.ts:9548 — 55 duplicate lines / 162 tokens with types/api.generated.ts:9871
• types/api.generated.ts:9548 — 55 duplicate lines / 165 tokens with types/api.generated.ts:10129
• src/proxy.ts — CC 35, MI 57.26, SLOC 116
• src/utils/sentry.utils.ts:382 — fetchWithSentry: MDD 53.8 (uses across many lines from declarations)
• src/hooks/useExchangeRate.ts:28 — useExchangeRate: MDD 49.1 (uses across many lines from declarations)
• types/api.generated.ts:3379 — 49 duplicate lines / 139 tokens with types/api.generated.ts:6992
• types/api.generated.ts:3379 — 49 duplicate lines / 137 tokens with types/api.generated.ts:7567
• types/api.generated.ts:704 — 42 duplicate lines / 152 tokens with types/api.generated.ts:2415
• types/api.generated.ts:7644 — 40 duplicate lines / 108 tokens with types/api.generated.ts:7716
• types/api.generated.ts:9563 — 40 duplicate lines / 120 tokens with types/api.generated.ts:9800
• types/api.generated.ts:893 — 39 duplicate lines / 137 tokens with types/api.generated.ts:2801
• types/api.generated.ts:7644 — 39 duplicate lines / 109 tokens with types/api.generated.ts:7790

…and 360 more.

📈 Painscore deltas (top movers)

File	Before	After	Δ
src/app/api/exchange-rate/route.ts	8.1	9.7	+1.6
src/utils/fx.utils.ts	6.0	1.6	-4.4