ci: harden static analysis (strict casts + null/async lints) + FD-limit fix

.github/workflows/pull-request.yaml

@@ -70,15 +70,15 @@ jobs:
       - run: dart run tool/generate_localization.dart
       - run: dart run tool/generate_release_info.dart
       - run: flutter pub run build_runner build
-      - run: flutter analyze
+      - run: flutter analyze --fatal-warnings
       # Excludes the `golden` tag: visual-regression tests live under
       # `test/goldens/` and are validated on the dfx01 self-hosted runner
       # in the parallel `golden-tests` job (Hardware-Determinismus, see
       # `docs/visual-regression-tests.md`). Running them here too would
       # both duplicate work and erroneously red this job on macos-latest
       # where the Skia/font-rendering does not match the committed
       # baselines.
-      - run: flutter test --coverage --exclude-tags golden
+      - run: ulimit -n 16384 && flutter test --coverage --exclude-tags golden
 
       # Narrow the coverage report to the README-defined activated surface:
       #   lib/packages/**             — services, repositories, signers, utils

analysis_options.yaml

@@ -4,9 +4,21 @@ formatter:
   page_width: 100
   trailing_commas: preserve
 
+analyzer:
+  language:
+    strict-casts: true
+    strict-inference: true
+    strict-raw-types: true
+
 linter:
   rules:
     annotate_overrides: true
     avoid_print: true
     prefer_const_constructors: true
     prefer_single_quotes: true
+    unawaited_futures: true
+    avoid_dynamic_calls: true
+    cast_nullable_to_non_nullable: true
+    null_check_on_nullable_type_parameter: true
+    unnecessary_null_checks: true
+    prefer_final_locals: true

lib/main.dart

@@ -41,7 +41,7 @@ Future<void> _initialize() async {
 Future<void> _initializeWithSplashDuration() async {
   await Future.wait([
     _initialize(),
-    Future.delayed(const Duration(seconds: 3)),
+    Future<void>.delayed(const Duration(seconds: 3)),
   ]);
 }
 

lib/packages/repository/supported_fiat_repository.dart

@@ -1,6 +1,7 @@
 import 'dart:developer' as developer;
 
 import 'package:realunit_wallet/packages/service/dfx/dfx_fiat_service.dart';
+import 'package:realunit_wallet/packages/service/dfx/models/fiat/dto/dfx_fiat_dto.dart';
 import 'package:realunit_wallet/styles/currency.dart';
 
 /// Translates the backend's per-user fiat list into the local [Currency]
@@ -23,7 +24,7 @@ class SupportedFiatRepository {
 
   Future<List<Currency>> getAll() => _resolve((_) => true);
 
-  Future<List<Currency>> _resolve(bool Function(dynamic) filter) async {
+  Future<List<Currency>> _resolve(bool Function(DfxFiatDto) filter) async {
     final fiats = await _fiatService.getAllFiats();
     final result = <Currency>[];
     for (final fiat in fiats) {

lib/packages/service/balance_service.dart

@@ -36,7 +36,7 @@ class BalanceService {
       final response = await _appStore.httpClient.get(uri);
 
       if (response.statusCode == 200) {
-        final json = jsonDecode(response.body);
+        final json = jsonDecode(response.body) as Map<String, dynamic>;
         final balanceString = json['balance'] as String?;
 
         if (balanceString != null) {

lib/packages/service/debug_auth_service.dart

@@ -30,7 +30,7 @@ class DebugAuthService {
     );
 
     if (response.statusCode == 200) {
-      final body = jsonDecode(response.body);
+      final body = jsonDecode(response.body) as Map<String, dynamic>;
       return body['message'] as String;
     }
     throw Exception('Failed to fetch sign message (${response.statusCode})');

lib/packages/service/dfx/dfx_auth_service.dart

@@ -146,8 +146,9 @@ abstract class DFXAuthService {
       final responseBody = jsonDecode(response.body);
       return responseBody as Map<String, dynamic>;
     } else if (response.statusCode == 403) {
-      final responseBody = jsonDecode(response.body);
-      final message = responseBody['message'] ?? 'Service unavailable in your country';
+      final responseBody = jsonDecode(response.body) as Map<String, dynamic>;
+      final message =
+          responseBody['message'] ?? 'Service unavailable in your country';
       throw Exception(message);
     } else {
       throw Exception('Failed to sign up. Status: ${response.statusCode} ${response.body}');

lib/packages/service/dfx/dfx_bank_account_service.dart

@@ -24,8 +24,9 @@ class DfxBankAccountService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    final List<dynamic> jsonList = jsonDecode(response.body);
-    final bankAccounts = jsonList.map((json) => BankAccountDto.fromJson(json)).toList();
+    final jsonList = jsonDecode(response.body) as List<dynamic>;
+    final bankAccounts =
+        jsonList.map((json) => BankAccountDto.fromJson(json as Map<String, dynamic>)).toList();
     return bankAccounts;
   }
 
@@ -47,7 +48,7 @@ class DfxBankAccountService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    return BankAccountDto.fromJson(jsonDecode(response.body));
+    return BankAccountDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
   }
 
   Future<BankAccountDto> updateBankAccount({
@@ -74,6 +75,6 @@ class DfxBankAccountService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    return BankAccountDto.fromJson(jsonDecode(response.body));
+    return BankAccountDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
   }
 }

lib/packages/service/dfx/dfx_brokerbot_service.dart

@@ -34,7 +34,7 @@ class DfxBrokerbotService extends DFXAuthService {
       throw Exception('BuyPrice request failed: ${res.body}');
     }
 
-    return BrokerbotBuyPriceDto.fromJson(jsonDecode(res.body));
+    return BrokerbotBuyPriceDto.fromJson(jsonDecode(res.body) as Map<String, dynamic>);
   }
 
   /// Convert CHF → REALU shares
@@ -54,7 +54,7 @@ class DfxBrokerbotService extends DFXAuthService {
       throw Exception('Shares request failed: ${res.body}');
     }
 
-    return BrokerbotBuySharesDto.fromJson(jsonDecode(res.body));
+    return BrokerbotBuySharesDto.fromJson(jsonDecode(res.body) as Map<String, dynamic>);
   }
 
   /// Convert REALU shares → CHF (with fees)
@@ -75,7 +75,7 @@ class DfxBrokerbotService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: res.statusCode);
     }
 
-    return BrokerbotSellPriceDto.fromJson(jsonDecode(res.body));
+    return BrokerbotSellPriceDto.fromJson(jsonDecode(res.body) as Map<String, dynamic>);
   }
 
   /// Convert CHF → REALU shares (with fees)
@@ -96,6 +96,6 @@ class DfxBrokerbotService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: res.statusCode);
     }
 
-    return BrokerbotSellSharesDto.fromJson(jsonDecode(res.body));
+    return BrokerbotSellSharesDto.fromJson(jsonDecode(res.body) as Map<String, dynamic>);
   }
 }

lib/packages/service/dfx/dfx_country_service.dart

@@ -23,9 +23,9 @@ class DfxCountryService {
     final response = await _appStore.httpClient.get(uri);
 
     if (response.statusCode == 200) {
-      final List<dynamic> jsonList = jsonDecode(response.body);
+      final jsonList = jsonDecode(response.body) as List<dynamic>;
       final countries = jsonList
-          .map((json) => DfxCountryDto.fromJson(json))
+          .map((json) => DfxCountryDto.fromJson(json as Map<String, dynamic>))
           .map((dto) => dto.toCountry())
           .toList();
       cachedCountries = countries;

lib/packages/service/dfx/dfx_fiat_service.dart

@@ -40,8 +40,9 @@ class DfxFiatService {
       throw Exception('Failed to fetch fiats: ${response.statusCode}');
     }
 
-    final List<dynamic> jsonList = jsonDecode(response.body);
-    final fiats = jsonList.map((json) => DfxFiatDto.fromJson(json)).toList();
+    final jsonList = jsonDecode(response.body) as List<dynamic>;
+    final fiats =
+        jsonList.map((json) => DfxFiatDto.fromJson(json as Map<String, dynamic>)).toList();
     _cachedFiats = fiats;
     _cachedAt = clock.now();
     return fiats;

lib/packages/service/dfx/dfx_kyc_service.dart

@@ -53,7 +53,7 @@ class DfxKycService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    final json = jsonDecode(response.body);
+    final json = jsonDecode(response.body) as Map<String, dynamic>;
     return KycLevelDto.fromJson(json);
   }
 
@@ -76,7 +76,7 @@ class DfxKycService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    final json = jsonDecode(response.body);
+    final json = jsonDecode(response.body) as Map<String, dynamic>;
     return KycSessionDto.fromJson(json);
   }
 
@@ -98,7 +98,7 @@ class DfxKycService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    final json = jsonDecode(response.body);
+    final json = jsonDecode(response.body) as Map<String, dynamic>;
     return KycSessionDto.fromJson(json);
   }
 

lib/packages/service/dfx/dfx_language_service.dart

@@ -39,9 +39,9 @@ class DfxLanguageService {
       throw Exception('Failed to fetch languages: ${response.statusCode}');
     }
 
-    final List<dynamic> jsonList = jsonDecode(response.body);
+    final jsonList = jsonDecode(response.body) as List<dynamic>;
     final languages = jsonList
-        .map((json) => DfxLanguageDto.fromJson(json))
+        .map((json) => DfxLanguageDto.fromJson(json as Map<String, dynamic>))
         .toList();
     _cachedLanguages = languages;
     _cachedAt = clock.now();

lib/packages/service/dfx/dfx_price_service.dart

@@ -24,25 +24,26 @@ class DFXPriceService extends APriceService {
 
     if (response.statusCode != 200) throw Exception(response.body);
 
-    final body = jsonDecode(response.body) as List;
+    final body = jsonDecode(response.body) as List<dynamic>;
 
     final result = <PricePoint>[];
 
-    for (final entry in body) {
+    for (final raw in body) {
+      final entry = raw as Map<String, dynamic>;
       BigInt price;
       switch (currency) {
         case Currency.eur:
-          price = BigInt.from(entry['eur'] * 100);
+          price = BigInt.from((entry['eur'] as num) * 100);
           break;
         case Currency.chf:
-          price = BigInt.from(entry['chf'] * 100);
+          price = BigInt.from((entry['chf'] as num) * 100);
           break;
       }
       result.add(
         PricePoint(
           asset: asset,
           price: price,
-          time: DateTime.parse(entry['timestamp']),
+          time: DateTime.parse(entry['timestamp'] as String),
         ),
       );
     }
@@ -57,13 +58,13 @@ class DFXPriceService extends APriceService {
 
     if (response.statusCode != 200) throw Exception(response.body);
 
-    final body = jsonDecode(response.body);
+    final body = jsonDecode(response.body) as Map<String, dynamic>;
 
     switch (currency) {
       case Currency.eur:
-        return BigInt.from(body['eur'] * 100);
+        return BigInt.from((body['eur'] as num) * 100);
       case Currency.chf:
-        return BigInt.from(body['chf'] * 100);
+        return BigInt.from((body['chf'] as num) * 100);
     }
   }
 
@@ -74,7 +75,7 @@ class DFXPriceService extends APriceService {
 
     if (response.statusCode != 200) throw Exception(response.body);
 
-    final body = jsonDecode(response.body);
+    final body = jsonDecode(response.body) as Map<String, dynamic>;
     final chf = (body['chf'] as num).toDouble();
     final eur = (body['eur'] as num).toDouble();
 

lib/packages/service/dfx/real_unit_buy_payment_info_service.dart

@@ -28,7 +28,7 @@ class RealUnitBuyPaymentInfoService extends DFXAuthService {
     );
 
     if (response.statusCode == 200) {
-      final json = jsonDecode(response.body);
+      final json = jsonDecode(response.body) as Map<String, dynamic>;
       final responseDto = RealUnitBuyPaymentInfoDto.fromJson(json);
 
       return BuyPaymentInfo(

lib/packages/service/dfx/real_unit_pdf_service.dart

@@ -43,7 +43,7 @@ class RealUnitPdfService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    return PdfDto.fromJson(jsonDecode(response.body));
+    return PdfDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
   }
 
   Future<PdfDto> getTransactionsReceipt(
@@ -64,7 +64,7 @@ class RealUnitPdfService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    return PdfDto.fromJson(jsonDecode(response.body));
+    return PdfDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
   }
 
   Future<PdfDto> getTransactionReceipt(String id, {Currency currency = Currency.chf}) async {
@@ -82,6 +82,6 @@ class RealUnitPdfService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    return PdfDto.fromJson(jsonDecode(response.body));
+    return PdfDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
   }
 }

lib/packages/service/dfx/real_unit_registration_service.dart

@@ -45,7 +45,7 @@ class RealUnitRegistrationService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    return RealUnitRegistrationInfoDto.fromJson(jsonDecode(response.body));
+    return RealUnitRegistrationInfoDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
   }
 
   /// registers an email on the wallet. Should always be called first when registering
@@ -67,7 +67,8 @@ class RealUnitRegistrationService extends DFXAuthService {
       final errorJson = jsonDecode(response.body) as Map<String, dynamic>;
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
-    final responseDto = RealUnitRegistrationEmailResponseDto.fromJson(jsonDecode(response.body));
+    final responseDto =
+        RealUnitRegistrationEmailResponseDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
     return responseDto.status;
   }
 
@@ -166,7 +167,8 @@ class RealUnitRegistrationService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    final responseDto = RealUnitRegistrationResponseDto.fromJson(jsonDecode(response.body));
+    final responseDto =
+        RealUnitRegistrationResponseDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
     return responseDto.status;
   }
 
@@ -223,7 +225,8 @@ class RealUnitRegistrationService extends DFXAuthService {
       throw ApiException.fromJson(errorJson, httpStatusCode: response.statusCode);
     }
 
-    final responseDto = RealUnitRegistrationResponseDto.fromJson(jsonDecode(response.body));
+    final responseDto =
+        RealUnitRegistrationResponseDto.fromJson(jsonDecode(response.body) as Map<String, dynamic>);
     return responseDto.status;
   }
 }

lib/packages/service/dfx/real_unit_sell_payment_info_service.dart

@@ -49,7 +49,7 @@ class RealUnitSellPaymentInfoService extends DFXAuthService {
     );
 
     if (response.statusCode == 200) {
-      final json = jsonDecode(response.body);
+      final json = jsonDecode(response.body) as Map<String, dynamic>;
       final responseDto = RealUnitSellPaymentInfoDto.fromJson(json);
 
       return SellPaymentInfo(

lib/packages/service/transaction_history_service.dart

@@ -25,7 +25,7 @@ class TransactionHistoryService extends DFXAuthService {
     ]);
 
     final accountHistory = results.elementAt(0) as AccountHistoryDto?;
-    final transactions = results.elementAt(1) as List<TransactionDto>;
+    final transactions = results.elementAt(1)! as List<TransactionDto>;
 
     if (accountHistory == null) return;
 
@@ -105,7 +105,7 @@ class TransactionHistoryService extends DFXAuthService {
     final response = await appStore.httpClient.get(uri);
     if (response.statusCode != 200) return [];
 
-    final List<dynamic> json = jsonDecode(response.body);
+    final json = jsonDecode(response.body) as List<dynamic>;
     return json.map((e) => TransactionDto.fromJson(e as Map<String, dynamic>)).toList();
   }
 
@@ -115,7 +115,7 @@ class TransactionHistoryService extends DFXAuthService {
 
     if (response.statusCode != 200) return [];
 
-    final List<dynamic> json = jsonDecode(response.body);
+    final json = jsonDecode(response.body) as List<dynamic>;
     final transactions = json
         .map((e) => TransactionDto.fromJson(e as Map<String, dynamic>))
         .toList();