ci(release): publish latest release

Author: hello-happy-puppy

RELEASE

@@ -1,6 +1,6 @@
 IPFS hash of the deployment:
-- CIDv0: `QmUKj6FRWbbb9KzXLektsshwBwFpKtNpoAB5SwERR1KWMw`
-- CIDv1: `bafybeicy5f7mprd6hqsd4xo6onxa5fxnroyim6nipgojsda3a55qw47oei`
+- CIDv0: `QmSAWSDEHki5zUxyG1dKGXtgXW7uCbGpfCmKxqce5JSC5x`
+- CIDv1: `bafybeiby2wkyrd3wzpyy5sv3a6bqs2hvlpur5wmzegylv64uylbw3vni4m`
 
 The latest release is always mirrored at [app.uniswap.org](https://app.uniswap.org).
 
@@ -10,5 +10,5 @@ You can also access the Uniswap Interface from an IPFS gateway.
 Your Uniswap settings are never remembered across different URLs.
 
 IPFS gateways:
-- https://bafybeicy5f7mprd6hqsd4xo6onxa5fxnroyim6nipgojsda3a55qw47oei.ipfs.dweb.link/
-- [ipfs://QmUKj6FRWbbb9KzXLektsshwBwFpKtNpoAB5SwERR1KWMw/](ipfs://QmUKj6FRWbbb9KzXLektsshwBwFpKtNpoAB5SwERR1KWMw/)
+- https://bafybeiby2wkyrd3wzpyy5sv3a6bqs2hvlpur5wmzegylv64uylbw3vni4m.ipfs.dweb.link/
+- [ipfs://QmSAWSDEHki5zUxyG1dKGXtgXW7uCbGpfCmKxqce5JSC5x/](ipfs://QmSAWSDEHki5zUxyG1dKGXtgXW7uCbGpfCmKxqce5JSC5x/)

VERSION

@@ -1 +1 @@
-web/5.150.0
+web/5.150.1

apps/mobile/src/components/TokenDetails/TokenDetailsHeader.tsx

@@ -3,6 +3,7 @@ import React, { memo } from 'react'
 import { useSelector } from 'react-redux'
 import { RWAIssuerHeaderDetails } from 'src/components/TokenDetails/rwa/RWAIssuerHeaderDetails'
 import { useTokenDetailsContext } from 'src/components/TokenDetails/TokenDetailsContext'
+import { useFeatureFlaggedProjectTokens } from 'src/components/TokenDetails/useFeatureFlaggedProjectTokens'
 import { useGatedTokenDetailsRWAMatch } from 'src/components/TokenDetails/useTokenDetailsRWAMatch'
 import { EM_DASH, Flex, FlexLoader, flexStyles, Shine, Text, TouchableArea } from 'ui/src'
 import { CopyAlt } from 'ui/src/components/icons'
@@ -31,7 +32,9 @@ export const TokenDetailsHeader = memo(function TokenDetailsHeaderInner(): JSX.E
   const token = useTokenBasicInfoPartsFragment({ currencyId }).data
   const project = useTokenBasicProjectPartsFragment({ currencyId }).data.project
   const projectTokensLoaded = project?.tokens !== undefined
-  const projectIsMultichain = projectTokensLoaded && isMultichainProjectTokens(project.tokens)
+  // Gate out unlaunched chains (e.g. Arc/Robinhood) so they don't drive multichain UI on the header.
+  const featureFlaggedProjectTokens = useFeatureFlaggedProjectTokens(project?.tokens)
+  const projectIsMultichain = projectTokensLoaded && isMultichainProjectTokens(featureFlaggedProjectTokens)
   const isMultichainToken = initialIsMultichainAsset || projectIsMultichain
   // need to wait for the project tokens to load before we can open the multichain address sheet
   const canOpenMultichainAddressSheet = projectIsMultichain

apps/mobile/src/components/TokenDetails/TokenDetailsLinks.tsx

@@ -18,6 +18,7 @@ import { useOrderedMultichainEntries } from 'uniswap/src/components/MultichainTo
 import type { MultichainTokenEntry } from 'uniswap/src/components/MultichainTokenDetails/useOrderedMultichainEntries'
 import { useTokenProjectUrlsPartsFragment } from 'uniswap/src/data/graphql/uniswap-data-api/fragments'
 import { getChainInfo } from 'uniswap/src/features/chains/chainInfo'
+import { useFeatureFlaggedChainIds } from 'uniswap/src/features/chains/hooks/useFeatureFlaggedChainIds'
 import type { UniverseChainId } from 'uniswap/src/features/chains/types'
 import { fromGraphQLChain } from 'uniswap/src/features/chains/utils'
 import { currencyIdToContractInput } from 'uniswap/src/features/dataApi/utils/currencyIdToContractInput'
@@ -47,6 +48,7 @@ function useMultichainTokenEntries(currencyId: string): MultichainTokenEntry[] {
   const { data } = GraphQLApi.useTokenProjectsQuery({
     variables: { contracts: [contractInput] },
   })
+  const featureFlaggedChainIds = useFeatureFlaggedChainIds()
 
   const entries = useMemo(() => {
     const tokens = data?.tokenProjects?.[0]?.tokens
@@ -56,12 +58,13 @@ function useMultichainTokenEntries(currencyId: string): MultichainTokenEntry[] {
     const result: MultichainTokenEntry[] = []
     for (const token of tokens) {
       const chainId = fromGraphQLChain(token.chain)
-      if (chainId && token.address) {
+      // Exclude feature-gated chains (e.g. unlaunched Arc/Robinhood) so they don't appear in the network selector.
+      if (chainId && token.address && featureFlaggedChainIds.includes(chainId)) {
         result.push({ chainId, address: token.address, isNative: false })
       }
     }
     return result
-  }, [data])
+  }, [data, featureFlaggedChainIds])
 
   return useOrderedMultichainEntries(entries)
 }

apps/mobile/src/components/TokenDetails/TokenDetailsStats/TokenDetailsMarketData.tsx

@@ -4,6 +4,7 @@ import { useTranslation } from 'react-i18next'
 import { useSelector } from 'react-redux'
 import { useTokenDetailsContext } from 'src/components/TokenDetails/TokenDetailsContext'
 import { StatsRow } from 'src/components/TokenDetails/TokenDetailsStats/StatsRow'
+import { useFeatureFlaggedProjectTokens } from 'src/components/TokenDetails/useFeatureFlaggedProjectTokens'
 import { useTokenDetailsPreferProjectMarketData } from 'src/components/TokenDetails/useTokenDetailsRWAMatch'
 import { Flex, Text, TouchableArea, useSporeColors } from 'ui/src'
 import type { IconProps } from 'ui/src/components/factories/createIcon'
@@ -67,13 +68,17 @@ export const TokenDetailsMarketData = memo(function TokenDetailsMarketDataInner(
     }
   }, [screenData?.token?.multichainMarket, screenData?.token?.project?.markets])
 
+  // Gate out unlaunched chains (e.g. Arc/Robinhood) so they don't appear in the Networks row or
+  // make the token look multichain.
+  const featureFlaggedScreenTokens = useFeatureFlaggedProjectTokens(screenData?.token?.project?.tokens)
+  const featureFlaggedProjectTokens = useFeatureFlaggedProjectTokens(project?.tokens)
+
   const networkChainIds = useMemo((): UniverseChainId[] => {
-    const projectTokens = screenData?.token?.project?.tokens
-    if (!projectTokens?.length) {
+    if (!featureFlaggedScreenTokens.length) {
       return [chainId]
     }
     const chainIds = new Set<UniverseChainId>()
-    for (const projectToken of projectTokens) {
+    for (const projectToken of featureFlaggedScreenTokens) {
       const id = fromGraphQLChain(projectToken.chain)
       if (id !== null) {
         chainIds.add(id)
@@ -83,11 +88,11 @@ export const TokenDetailsMarketData = memo(function TokenDetailsMarketDataInner(
       return [chainId]
     }
     return Array.from(chainIds)
-  }, [chainId, screenData?.token?.project?.tokens])
+  }, [chainId, featureFlaggedScreenTokens])
 
   const singleNetworkChainId = networkChainIds.length === 1 ? networkChainIds[0] : undefined
 
-  const isMultichainToken = isMultichainProjectTokens(project?.tokens)
+  const isMultichainToken = isMultichainProjectTokens(featureFlaggedProjectTokens)
 
   /** Native currency pages have no contract address to copy / multichain address sheet (see TokenDetailsLinks). */
   const hasCopyableContractAddress = useMemo(() => {

apps/mobile/src/components/TokenDetails/useFeatureFlaggedProjectTokens.ts

@@ -0,0 +1,31 @@
+import { GraphQLApi } from '@universe/api'
+import { useMemo } from 'react'
+import { useFeatureFlaggedChainIds } from 'uniswap/src/features/chains/hooks/useFeatureFlaggedChainIds'
+import { fromGraphQLChain } from 'uniswap/src/features/chains/utils'
+
+/**
+ * Filters a token project's on-chain deployments down to feature-flag-enabled chains, so unlaunched
+ * gated chains (e.g. Arc/Robinhood) don't surface in the mobile TDP multichain UI — header multichain
+ * state, the market-data Networks row, cross-chain balances, and the address/explorer sheets.
+ *
+ * Accepts the loosely-typed GraphQL fragment shape (elements may be undefined, `chain` may be absent)
+ * and preserves the element type so callers keep fields like `address`.
+ */
+export function useFeatureFlaggedProjectTokens<T extends { chain?: GraphQLApi.Chain | null }>(
+  tokens: readonly (T | null | undefined)[] | null | undefined,
+): T[] {
+  const featureFlaggedChainIds = useFeatureFlaggedChainIds()
+  return useMemo(() => {
+    const result: T[] = []
+    for (const token of tokens ?? []) {
+      if (!token) {
+        continue
+      }
+      const chainId = fromGraphQLChain(token.chain ?? undefined)
+      if (chainId !== null && featureFlaggedChainIds.includes(chainId)) {
+        result.push(token)
+      }
+    }
+    return result
+  }, [tokens, featureFlaggedChainIds])
+}

apps/mobile/src/components/TokenDetails/useTokenDetailsCrossChainBalances.ts

@@ -1,6 +1,7 @@
 import { GraphQLApi } from '@universe/api'
 import { useMemo } from 'react'
 import { useTokenDetailsContext } from 'src/components/TokenDetails/TokenDetailsContext'
+import { useFeatureFlaggedProjectTokens } from 'src/components/TokenDetails/useFeatureFlaggedProjectTokens'
 import { useCrossChainBalances } from 'uniswap/src/data/balances/hooks/useCrossChainBalances'
 import { useTokenBasicProjectPartsFragment } from 'uniswap/src/data/graphql/uniswap-data-api/fragments'
 import type { DataApiOutageState, PortfolioBalance } from 'uniswap/src/features/dataApi/types'
@@ -13,11 +14,14 @@ export function useTokenDetailsCrossChainBalances({ evmAddress }: { evmAddress:
   otherChainBalances: PortfolioBalance[] | null
 } & DataApiOutageState {
   const { currencyId } = useTokenDetailsContext()
-  const projectTokens = useTokenBasicProjectPartsFragment({ currencyId }).data.project?.tokens
+  // Gate out unlaunched chains (e.g. Arc/Robinhood) so they don't surface as cross-chain balances.
+  const projectTokens = useFeatureFlaggedProjectTokens(
+    useTokenBasicProjectPartsFragment({ currencyId }).data.project?.tokens,
+  )
 
   const crossChainTokens = useMemo<CrossChainToken[]>(() => {
-    return (projectTokens ?? []).flatMap((token) => {
-      if (!token || !token.chain || token.address === undefined) {
+    return projectTokens.flatMap((token) => {
+      if (!token.chain || token.address === undefined) {
         return []
       }
       return [{ address: token.address, chain: token.chain }]

apps/web/src/pages/Liquidity/CreateAuction/XOAuthCallbackPage.tsx

@@ -26,8 +26,10 @@ export function XOAuthCallbackPage() {
       return
     }
 
-    const storedState = sessionStorage.getItem('x_oauth_state')
-    sessionStorage.removeItem('x_oauth_state')
+    // Paired with the localStorage write in useXOAuthFlow — sessionStorage isn't shared with this popup
+    // when it runs in an isolated browsing-context group under COOP (see the comment there).
+    const storedState = localStorage.getItem('x_oauth_state')
+    localStorage.removeItem('x_oauth_state')
 
     if (state !== storedState) {
       const message = 'State mismatch — possible CSRF attack'

apps/web/src/pages/Liquidity/CreateAuction/hooks/useXOAuthFlow.ts

@@ -18,12 +18,12 @@ export function useXOAuthFlow(): { connectX: () => void; isLoading: boolean; err
   const [error, setError] = useState<string | null>(null)
   const popupRef = useRef<Window | null>(null)
 
-  // Poll for popup closed without a message (user dismissed), and manage the BroadcastChannel lifetime.
+  // Listen for the OAuth result on a channel that outlives the popup. The callback posts its result and
+  // then immediately closes the popup; under COOP `same-origin-allow-popups` (e.g. app.corn-staging.com)
+  // the popup is in a separate browsing-context group and its message is delivered *after* the popup-closed
+  // poller below fires. So this listener must NOT be torn down on popup close / loading end, or the late
+  // cross-group message is dropped and the verification silently never lands.
   useEffect(() => {
-    if (!isLoading) {
-      return undefined
-    }
-
     const channel = new BroadcastChannel('x_oauth')
 
     const handler = (event: MessageEvent<XOAuthMessage>) => {
@@ -37,18 +37,27 @@ export function useXOAuthFlow(): { connectX: () => void; isLoading: boolean; err
 
     channel.addEventListener('message', handler)
 
+    return () => {
+      channel.removeEventListener('message', handler)
+      channel.close()
+    }
+  }, [setXVerification])
+
+  // Reset loading if the user dismisses the popup without completing the flow. Deliberately does not touch
+  // the channel above — a late success/error message can still arrive after the popup window closes.
+  useEffect(() => {
+    if (!isLoading) {
+      return undefined
+    }
+
     const interval = setInterval(() => {
       if (popupRef.current?.closed) {
         setIsLoading(false)
       }
     }, 500)
 
-    return () => {
-      clearInterval(interval)
-      channel.removeEventListener('message', handler)
-      channel.close()
-    }
-  }, [isLoading, setXVerification])
+    return () => clearInterval(interval)
+  }, [isLoading])
 
   const connectX = useCallback(() => {
     if (!address) {
@@ -60,7 +69,11 @@ export function useXOAuthFlow(): { connectX: () => void; isLoading: boolean; err
 
     XVerificationClient.getXAuthUrl(new GetXAuthUrlRequest({ walletAddress: address }))
       .then(({ authUrl, state }) => {
-        sessionStorage.setItem('x_oauth_state', state)
+        // Use localStorage, not sessionStorage: the OAuth popup opens cross-origin (x.com), and under
+        // COOP `same-origin-allow-popups` (set on some deploys, e.g. app.corn-staging.com) it lands in a
+        // separate browsing-context group with a fresh, unshared sessionStorage. localStorage is shared
+        // across that boundary, so the callback can read the state back. Cleared on read in the callback.
+        localStorage.setItem('x_oauth_state', state)
 
         const popup = window.open(authUrl, 'x_oauth', 'width=600,height=700')
         popupRef.current = popup

apps/web/src/pages/TokenDetails/TokenDetails.e2e.test.ts

@@ -88,5 +88,11 @@ test.describe(
       await page.goto('/explore/tokens/ethereum/0x123')
       await expect(page).toHaveURL('/explore')
     })
+
+    test('redirect to explore for a feature-gated chain (Arc)', async ({ page }) => {
+      // Arc is gated behind FeatureFlags.Arc (off by default), so the TDP must not load.
+      await page.goto('/explore/tokens/arc/0xbef5f6d51cb62b58e6a8f77868681825c6fe21c1')
+      await expect(page).toHaveURL('/explore')
+    })
   },
 )