chore: development to master promotion

[Seranged]

Critical: required before production deployment

Production will refuse to start unless EDGE_PROVIDER is explicitly set and DEV_GEO_COUNTRY is unset. Complete these configuration changes before deploying this release.

For the existing Cloudflare production deployment (DOPPLER_ENVIRONMENT=prd):

1. Set EDGE_PROVIDER=cloudflare in the production environment.
2. Remove DEV_GEO_COUNTRY from the production environment.
3. Verify both settings before deploying the release.

These are required deployment prerequisites; completion has not been verified as part of this release-list update.

Conditional: other providers and origin authentication

• Google and CloudFront require EDGE_ORIGIN_SECRET or startup fails. Google also requires the load balancer to stamp x-client-geo: {client_region} for trustworthy country information.
• Origin authentication is optional for Cloudflare. If enabling it, configure the edge to stamp x-edge-origin-auth and strip client-supplied x-edge-internal before setting EDGE_ORIGIN_SECRET in the application environment. Setting the application secret first causes requests without the matching edge header to fail the applicable geo and identity checks.
• Environment examples and architecture/geo-blocking documentation cover provider configuration and trust requirements (feat: generic edge-provider abstraction #825).

Features and security

• Add configurable Cloudflare, Google, CloudFront, and no-edge presets for geo-blocking, rate limiting, and screening (feat: generic edge-provider abstraction #825) @kasperpawlowski
• Add origin-secret verification and authenticated internal requests, replacing the spoofable loopback-header bypass (feat: generic edge-provider abstraction #825) @kasperpawlowski
• Skip client VPN probes when the deployment has no edge VPN evidence (feat: generic edge-provider abstraction #825) @kasperpawlowski

Fixes

• Treat VPN usage as audit metadata: continue address screening without independently disconnecting wallets for a positive VPN result or a failed probe. Country restrictions and fail-closed address screening remain enforced (fix: keep VPN usage as audit metadata #861) @Seranged
• Report failed, missing, invalid, or unsupported client VPN measurements as null, preserving measured true and false values in screening audit payloads (fix: keep VPN usage as audit metadata #861) @Seranged
• Fix Morpho v1/v2 migration reviews failing with “Vault snapshot is unavailable” in direct and batch flows, while preserving Euler vault and asset requirements (Fix Morpho vault migration review preparation #856) @dglowinski
• Use a dedicated /healthz container liveness probe independent of edge authentication and API gates (feat: generic edge-provider abstraction #825) @kasperpawlowski

Dependencies

• Update SVGO from 3.3.4 to 3.3.5 and 4.0.2 to 4.1.0 (chore(deps): bump svgo #855) @dependabot[bot]
• Update js-yaml from 4.3.1 to 4.3.2 (chore(deps): bump js-yaml from 4.3.1 to 4.3.2 #860) @dependabot[bot]

Validation

• Release list checked against the promotion diff at head 67d01d4c7231a6799bae752731dd62c4e03eb64e and the contributing PRs.
• Tests were not rerun while preparing this release list.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: euler-xyz/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: d4e316e4-e0e6-40e6-80f9-801fa1cffddd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[LeonardEulerXYZ]

Promotion review: approved code; production cutover prerequisites remain unverified

Reviewed exact head 2ee0fa676f6fb70e41ae5aa0536820fa68dd72d0 against master 9824996f9b7fdd0ea6a96ab8a4940f29023c393d (ancestor). No blocking code finding after full-diff review and independent edge-security and migration/release-composition passes.

Scope and findings

• Reviewed the 36-file promotion: edge presets/context, origin authentication, internal marker and callers, CORS/geo/rate limiting, screening/VPN capability, startup guard, healthcheck, migration requirement collection, tests, documentation, recorder and lockfile.
• Morpho v1/v2 external positionRef subtrees no longer demand Euler vault snapshots. Asset/account dependencies, Euler destinations, explicit constraints, and independent Euler requirements in mixed batches are retained. The SDK remains pinned to 3.1.0; this collector fix does not require a producer release.
• Final #825 and #856 heads are included. The previous #825 composition gap is resolved.
• No malicious-code/supply-chain indicator found in the reviewed delta. The Cloudflare origin-secret opt-in and explicit none preset's weaker identity model are documented design choices, not newly invented blockers.

Validation actually run

Fresh private install with Node 24.20.0 / npm 11.10.0:

• npm ci --ignore-scripts and npm run postinstall: passed.
• npm run test:run: 220 files passed, 1 skipped; 2,146 tests passed, 1 skipped.
• npm run typecheck: passed.
• npm run lint: 0 errors; 6 warnings in unchanged files.
• npm run build: passed.
• git diff --check: passed; tracked worktree and anchor clean.

Built Nitro HTTP/subprocess smoke (Node 24): production with no provider, production with DEV_GEO_COUNTRY, and Google without the required origin secret each exited before listening. Under Cloudflare + a disposable local origin secret, unauthenticated /healthz returned 200; API requests missing origin auth, country, or carrying a sanctioned country returned 451; correctly authenticated allowed-country requests returned 200. The old loopback sentinel without Origin returned 403. Explicit none served first-party API requests with the -- country hint and still rejected the old sentinel.

Deployment and browser evidence

Railway deployment 9cb69ce1-bf88-4399-9c09-7d291271a781 is SUCCESS/RUNNING, with commitHash matching this head, serving https://dev-lite.euler.finance. This is development evidence, not stage/prod deployment proof. GitHub CI and security checks passed.

Headed Chromium under Xvfb rendered populated dev /lend?network=1, /borrow?network=1, and disconnected /portfolio?network=1 without uncaught page errors. Production Lend rendered as a comparator. The author-provided Gauntlet USDC Prime v1 spy fixture loaded its live source position on dev. Subsequent requests hit Cloudflare 1015 on dev and production; remote probing was stopped. No completed migration review-modal, wallet signature, or transaction submission is claimed. Direct/batch v1/v2 fix confidence comes from code and preparation-layer regression tests, not live execution.

The captured Lend comparator has a data/label mismatch: dev shows Sentora PYUSD/RLUSD with Unknown risk managers where prod shows K3 Capital. No label/rendering change in this promotion explains that difference; its environment/upstream cause was not proven. Screenshots are supplied with the Slack review, not hosted in this GitHub review. Other production route comparisons and mobile coverage remain incomplete.

Required before production deploy

The PR correctly calls these out, but this review did not verify production Doppler/edge configuration:

1. Set EDGE_PROVIDER=cloudflare for the existing Cloudflare production topology.
2. Remove DEV_GEO_COUNTRY from production.
3. If enabling origin authentication, deploy edge stamping/stripping before setting the application origin secret.

Dev currently injects vpnDetection:false; it cannot establish Cloudflare VPN-header parity. Live Cloudflare staging parity, Google/CloudFront infrastructure and the external production deployment pipeline were not exercised. Do not treat this code approval as confirmation those deployment gates are complete. No production configuration, branch, or deployment was changed.

[LeonardEulerXYZ]

Promotion re-review: approved at 67d01d4

Reviewed current head 67d01d4c7231a6799bae752731dd62c4e03eb64e, including merged #861 (40834da9f0fbc8904962466df1c69d94ce587f5a). Master remains an ancestor. No blocking findings.

Incremental and composition review

Read all seven files changed since the previous approved head 2ee0fa676f6fb70e41ae5aa0536820fa68dd72d0, and checked their interaction with the previously reviewed edge-provider/screening promotion:

• VPN true/false/null all continue into address screening; VPN evidence no longer independently disconnects an eligible wallet.
• Failed, missing, malformed and unsupported client VPN measurements become unknown/null, not fabricated observations.
• Only an explicit clean address-screening verdict allows access. HTTP failures, malformed bodies and timeouts remain fail-closed; restricted addresses disconnect across all three VPN evidence values.
• Pending-state and generation guards survive both awaited stages and disconnect. Independent country restrictions and server edge-auth boundaries are unchanged.
• Trusted positive edge evidence cannot be erased by client false/null. Checked Data v3 main ad660989a3c342312a2696ed8c067edae8f413aa: nullable input is accepted and VPN evidence is recorded on completed, cached and failed audit paths, not used as eligibility policy. No SDK/package/schema release is needed.
• The updated promotion changelist matches the addition. No new dependency, credential, deployment-setting, or outbound-destination changes. Previously reviewed Morpho, healthcheck and edge-auth changes are untouched by this increment.

Fresh validation on this head

Private managed worktree; Node 24.21.0 / npm 11.10.0, clean install/preparation:

• Focused VPN/address-screening/edge/geo tests: 6 files, 86 tests passed.
• npm run test:run: 220 files passed, 1 skipped; 2,160 tests passed, 1 skipped (the actual local count, rather than the contributing PR's historical count).
• npm run typecheck: passed.
• npm run lint: passed, 0 errors / 6 warnings in unchanged files.
• npm run build: passed.
• git diff --check: passed; tracked worktree clean.
• Current-head hosted lint/typecheck/test and Railway dev-build checks are successful. The Cursor security check was still running at the last check.

Coverage and release boundary

This is an incremental source/test/build re-review; no new wallet-browser or live provider smoke was run. Generic route smoke would not establish the changed wallet-screening invariant. Earlier browser/runtime evidence remains attached to the earlier head, not relabeled as a fresh run. Previous production-label/comparator and migration-execution caveats remain unresolved by this review.

Production prerequisites are unchanged and still unverified: set EDGE_PROVIDER=cloudflare, remove DEV_GEO_COUNTRY; if opting into origin auth, configure edge stamping/stripping before setting the application secret. Code approval is not production configuration/deployment confirmation. No branch, deployment or production configuration changes were made.