fix(build): biome 2.5.5 schema + siwe install + api node types — make main build green

[irfndi]

Summary

Stabilizes the merged main build (broken after 4 squash-merges) with build/config/type/import fixes only — no product-behavior changes.

The 3 diagnosed failures → fixes

1. Dependency install — siwe

• Diagnosis: siwe@3.0.0 exists and is the published latest (npm view siwe version → 3.0.0); registry reachable (curl -sI https://registry.npmjs.org/siwe → HTTP 200). The original DNSResolveFailed was transient.
• Fix: Re-ran bun install (incl. --force for a canonical clean relink — 1589 packages). siwe@3.0.0 is now installed and resolvable.
• Placement note: Bun 1.4-canary installs single-app deps per-app (apps/api/node_modules/siwe) — identical to hono/viem/effect, which also live in apps/api/node_modules, not the root. It is not root-hoisted; this is the canonical workspace layout. apps/api typecheck/test/build all resolve and run it (proof of the functional gate).
• The siwe v3 import in src/auth/siwe.ts (SiweMessage) is valid for v3 — no import change needed.

2. Biome version mismatch + findings

• biome.json `` bumped 2.5.1 → 2.5.5 to match installed @biomejs/biome@2.5.5 (clears the schema-mismatch error).
• In 2.5.5 the old noUnusedVariables is split into finer rules that default to warn. I fixed the code properly (did not downgrade rules):
  • renovate.json: collapsed the extends array (formatter error → fixed).
  • order-book-do.ts / websocket-hub-do.ts: added a precise // biome-ignore lint/correctness/noUnusedPrivateClassMembers on the env field — the CACHE KV binding is intentionally retained for Phase-0 WebSocket live-data reads. I deliberately did not run biome check --write --unsafe, because its auto-removal would delete the field but leave this.env = env in the constructor, breaking the build.
  • queue-handler.ts: renamed unused chainId → _chainId (signature kept for future per-chain CoinGecko mapping; caller passes positionally — no behavior change).
• bun run lint → exit 0, 0 errors, 0 warnings.

3. API typecheck

• apps/api/tsconfig.json: "types": [] → ["node"] (no Bun globals used) so node:crypto resolves. The siwe module error resolved with the install. @types/node@^26 already present.
• apps/api tsc --noEmit → exit 0 (no Cloudflare/node global conflicts introduced).

Verification matrix (all from repo root, branch fix/foundation-green)

Command	Exit
bun install (siwe@3.0.0 resolvable)	0
bun run typecheck	0
(cd apps/api && bun run typecheck)	0
(cd apps/web && bun run typecheck)	0
bun run lint (0 errors / 0 warnings)	0
bun run test (88 passed)	0
(cd apps/api && bun run test) (10 passed)	0
(cd apps/web && bun run build)	0
(cd apps/api && bun run build) (wrangler dry-run)	0

Constraints honored

No lint-rule downgrades, no @ts-ignore/@ts-expect-error/as any, no runtime-behavior changes (build/config/type/import fixes + targeted unused-code handling only), .beads/, .claude/, packages/contracts/src/** untouched, bun.lock unchanged. Not merged.

Summary by Sourcery

Stabilize the main branch by fixing build, lint, and type configuration issues without changing runtime behavior.

Bug Fixes:

• Resolve API typecheck failures by explicitly including Node types in the apps/api TypeScript configuration.
• Prevent Biome unused-private-member warnings on durable objects by annotating intentionally retained env fields.
• Eliminate unused-parameter lint errors in the queue handler by marking the chainId argument as intentionally unused.
• Fix Biome schema and configuration mismatches by updating biome.json to 2.5.5 and correcting renovate.json formatting.

Build:

• Align tooling and configuration (Biome, Renovate, TypeScript) so that lint, typecheck, test, and build commands all pass cleanly from the repo root.

Summary by CodeRabbit

• Chores

  • Updated development tooling configuration and schema metadata.
  • Improved TypeScript compilation support with Node.js type definitions.
  • Clarified reserved configuration bindings for upcoming live-data functionality.
  • Made internal parameter usage explicit without changing runtime behavior.
  • Reformatted dependency automation settings while preserving existing update policies.

• Documentation

  • Added inline notes to clarify configuration intent for future maintenance.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR stabilizes the main branch build by aligning Biome config with the installed version, tightening TypeScript node typings for the API app, and making small, targeted code tweaks to satisfy new lint rules and type checks without altering runtime behavior.

File-Level Changes

Change	Details	Files
Update API TypeScript configuration to include Node types so node:crypto and related APIs resolve cleanly during typecheck.	Set compilerOptions.types to ["node"] instead of an empty array in the API tsconfig Confirmed no Bun-specific globals are relied upon in the API codebase	apps/api/tsconfig.json
Adjust API worker and durable object classes to satisfy Biome 2.5.5 lint rules while preserving future/useful bindings.	Rename an unused chainId parameter to _chainId in the token price fetch helper to mark it intentionally unused Annotate env fields in durable object classes with biome-ignore comments to retain the CACHE KV binding for future WebSocket live-data reads	apps/api/src/workers/queue-handler.ts apps/api/src/durable-objects/order-book-do.ts apps/api/src/durable-objects/websocket-hub-do.ts
Align Biome configuration and Renovate config with Biome 2.5.5 schema and formatter expectations.	Bump Biome configuration version from 2.5.1 to 2.5.5 to match the installed CLI version Simplify/normalize the extends array in the Renovate configuration to satisfy the Biome formatter	biome.json renovate.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f4cbdb4d-55c1-4024-8a96-36c9db7d98ed

📥 Commits

Reviewing files that changed from the base of the PR and between a6c8e52 and 115cfd6.

📒 Files selected for processing (6)

• apps/api/src/durable-objects/order-book-do.ts
• apps/api/src/durable-objects/websocket-hub-do.ts
• apps/api/src/workers/queue-handler.ts
• apps/api/tsconfig.json
• biome.json
• renovate.json

---

Walkthrough

The change updates lint annotations, marks an unused function parameter, enables Node.js TypeScript types, updates the Biome schema reference, and reformats Renovate presets. Runtime behavior is unchanged.

Changes

Lint and tooling alignment

Layer / File(s)	Summary
Lint annotations and compiler configuration apps/api/src/durable-objects/*, apps/api/src/workers/queue-handler.ts, apps/api/tsconfig.json	Reserved environment bindings and an unused parameter are explicitly annotated, and Node.js type definitions are enabled for TypeScript compilation.
Tool metadata formatting biome.json, renovate.json	The Biome schema reference is updated to version 2.5.5, and the unchanged Renovate presets are reformatted onto one line.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

A rabbit checks the linting trail,
With tidy notes beside each pail.
Node types hop into the scheme,
Biome shines with newer gleam.
Renovate folds its presets neat—
No runtime carrots moved their feet!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the build-focused fixes, including Biome schema updates, SIWE reinstall, and Node types for the API.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/foundation-green

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

apps/api/tsconfig.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

biome.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

renovate.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've left some high level feedback:

• In fetchTokenPrice, since _chainId is intentionally unused but expected to matter later, consider adding a brief TODO or comment about the planned per-chain CoinGecko mapping so future changes don’t accidentally drop the parameter or overlook the need for multi-chain support.
• For the durable objects’ env fields, you might consider encapsulating the planned CACHE KV usage (e.g., via a dedicated method or minimal stub that references env) instead of a bare biome-ignore, so the build intent is encoded directly in executable code rather than only in a linter suppression comment.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `fetchTokenPrice`, since `_chainId` is intentionally unused but expected to matter later, consider adding a brief TODO or comment about the planned per-chain CoinGecko mapping so future changes don’t accidentally drop the parameter or overlook the need for multi-chain support.
- For the durable objects’ `env` fields, you might consider encapsulating the planned CACHE KV usage (e.g., via a dedicated method or minimal stub that references `env`) instead of a bare `biome-ignore`, so the build intent is encoded directly in executable code rather than only in a linter suppression comment.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}