[ojuotimi932]

Summary

This pull request resolves four related backend and frontend issues:

• [api] Validate export date ranges before starting the response #1707 — Validate transaction export date ranges before streaming. The export controller now validates each supplied bound and checks ordering before either CSV or JSON exporter can set download headers or write a response prefix. Invalid start and end values receive specific 400 error codes, and reversed ranges receive INVALID_DATE_RANGE. Missing bounds remain optional; equal endpoints are accepted.
• [fix] Reconcile token lists with the persisted verified registry #1706 — Use one persisted verified-token registry for list and detail APIs. GET /v1/tokens now reads the same database-backed verified registry used by token detail and GraphQL. The public response shape remains consistent (symbol, name, decimals, contractAddress, type, optional icon, description, and verified) across list and detail responses. The list retains its one-hour cache policy, stale-while-revalidate behavior, and conditional ETag responses. Registry database results take precedence over Redis so stale cache entries cannot override updated metadata; Redis remains a fallback during database outages.
• [test] Cover recipient-step address validation #1796 — Expand RecipientStep address-validation regression coverage. Added deterministic cases for immediate malformed-address feedback and whitespace-only paste handling, alongside existing coverage for valid addresses, invalid checksums, whitespace-padded values, paste trimming, and blur trimming.
• [test] Cover create-wizard draft restoration #1793 — Validate persisted create-stream drafts and cover restoration edges. Draft payloads written now carry version 1. Restoration rejects malformed JSON, unsupported explicit versions, missing or invalid required fields, invalid timestamps, and invalid optional fields. Earlier unversioned drafts remain compatible when their required fields are valid, and omitted optional fields continue to use form defaults.

Implementation details

Export date validation

The controller checks dates after validating the requested format and direction and before constructing the export options or invoking either streaming function. This ordering ensures malformed values cannot reach getTime() and become BigInt(NaN) after a partial CSV/JSON response has begun. The endpoint documentation now specifies optional inclusive ISO 8601 bounds and the 400 behavior.

Regression coverage exercises both formats for omitted bounds, malformed dates, reversed ranges, and valid date ranges. Invalid ranges assert that neither exporter starts.

Token registry consistency

The versioned list endpoint now queries TokenRegistry and derives its ETag from the public payload and latest row update timestamp. The existing cache headers and If-None-Match handling are retained. List and detail controllers share one serializer so token metadata and verification status agree at both endpoints. Detail lookup checks PostgreSQL before Redis and only uses the Redis entry if PostgreSQL is unavailable; a successful lookup with no row does not return a stale cached record.

The token-route regression fixture now models persisted registry rows and verifies list/detail parity and ETag invalidation after an update.

Draft and recipient regression coverage

Draft loading safely rejects parse errors and malformed payloads, including unsupported future versions, while accepting valid unversioned drafts for backward compatibility. New UI tests cover malformed recipient feedback and whitespace-only clipboard input. New restoration cases cover malformed JSON, an unsupported version, and a partial legacy draft that relies on defaults for optional fields.

Validation

• git diff --check — passed.
• Frontend lint was attempted, but this checkout has no installed project dependencies. The command resolved to a global, incompatible ESLint CLI that displayed its generic help instead of linting the project.
• Backend build was attempted and stopped because prisma is unavailable (prisma: not found).
• Frontend build was attempted and stopped because next is unavailable (next: not found).
• Tests, dependency installation, and contract checks were not run, as requested.

CI should run the backend and frontend test suites, lint/type checks, builds, and contract checks in the PR environment.

Issues closed

Closes #1707
Closes #1706
Closes #1796
Closes #1793