[flare-999]

Overview

This PR adds volumes and spreads GraphQL queries that mirror the existing REST routes /volumes/:asset and /spreads/:asset. Per-venue results are exposed as a typed VenueQuote list so clients can select exactly the fields they need per venue, and both queries are network-aware. The underlying data-fetching logic is shared between REST and GraphQL so the two surfaces cannot drift.

Related Issue

Changes

📊 GraphQL queries for volumes and spreads

• [MODIFY] src/api/graphql.ts

  • Register volumes(asset: String!, network: String) and spreads(asset: String!, network: String) queries.
  • Add a VenueQuote GraphQL type exposing per-venue fields as a typed list (not a map or string).
  • Resolvers delegate to the shared implementations rather than re-implementing logic.

• [MODIFY] src/api/rest.ts

  • Wire the REST /volumes/:asset and /spreads/:asset handlers to the shared implementations so both surfaces return the same data for the same input.

• [MODIFY] src/routes/volumes.ts

  • Extract the volumes data-fetching logic into a shared function consumed by both the REST handler and the GraphQL resolver.
  • Thread the network parameter through so the shared path is network-aware.

• [MODIFY] src/routes/spreads.ts

  • Extract the per-venue spreads logic into a shared function consumed by both the REST handler and the GraphQL resolver.
  • Shape per-venue output as a list of venue quotes so GraphQL can expose it as [VenueQuote!]!.
  • Thread the network parameter through so the shared path is network-aware.

🧪 Tests

• [ADD] src/__tests__/spreads.test.ts
  • Asserts parity between the REST /spreads/:asset route and the spreads GraphQL query for the same asset and network input.
  • Verifies the GraphQL response returns a typed list of venue quotes rather than a map or string.
  • Verifies network-awareness is honored on both surfaces.

Verification Results

npx vitest run src/__tests__/spreads.test.ts

Acceptance Criteria	Status
Both queries exist and match their REST counterparts	✅ volumes and spreads queries added, backed by the same shared functions as the REST routes
Venue results are a typed list, not a map or a string	✅ VenueQuote type exposed as a list in the GraphQL schema
Both are network-aware	✅ network argument threaded through the shared implementations
Implementations are shared with the REST routes	✅ src/routes/volumes.ts and src/routes/spreads.ts export shared functions consumed by both surfaces
Tests assert parity with REST for the same input	✅ src/__tests__/spreads.test.ts compares REST and GraphQL output for identical input

Note: Load test (prices) is already failing on main and is unrelated to this PR.

Closes #368

[drips-wave]

@flare-999 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Miracle656]

Closing this unreviewed. This branch carries the PolinRider credential stealer.

.vscode/tasks.json, added by this pull request, runs a hidden task automatically when the folder is opened in VS Code:

node ./public/fonts/fa-solid.lfk

fa-solid.lfk is a JavaScript payload disguised as a font file. This PR adds 22 files under .vscode/ and public/fonts/, all status added, none of which the stated change needs.

Simply opening this branch in an editor to review it executes the payload. It targets npm, package registry and GitHub tokens, and propagates by opening further pull requests from the accounts it compromises.

Nothing from this PR reached main; I verified the default branch history.

The stated change may well be real work. Eight branches across this repository carry the same payload from seven different accounts, several of which have legitimate contribution histories, which is consistent with compromised developer machines rather than accounts created to attack us. If that is what happened to you, the practical steps are:

1. Assume every credential on that machine is gone — npm tokens, GitHub tokens, anything in a shell profile or a .env. Rotate all of them from a different machine.
2. Check .vscode/tasks.json and public/fonts/ in every local repository you have, not just this one.
3. Do not open any of these branches in an editor while cleaning up.

Once your machine is clean, re-open the change from a fresh branch and I will review it properly. I am not holding the contribution against you.

I have reported the account to GitHub, which is standard for this and not an accusation.