Reject unknown browser column dtypes

[Alek99]

Summary

• centralize browser wire-column dtype decoding for packed and split payloads
• accept the existing default/explicit f32, u8, and u32 encodings
• reject unknown dtypes with contextual errors before first-paint or incremental state/GL mutations
• cover initial render, animation updates, append, LOD/drill, and density-sample paths
• document the exhaustive wire contract and add regression/structural coverage

Why

Unknown four-byte dtype metadata previously fell through to Float32Array, allowing future or malformed values such as i32 or f64 to be silently misdecoded. The browser now fails loudly at the decode boundary instead.

Impact

Valid payload behavior is unchanged. Unsupported dtypes produce an actionable error containing the dtype and column/update context.

Fixes #434.

Validation

• node js/build.mjs
• npm run typecheck
• Ruff lint and formatting checks
• full pytest suite
• make check-security — 54 passed
• make check-errors — 303 passed
• real Chromium rendering smoke test

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b1dd2ab9-2485-4bb6-95f9-a0ea3d9d5e0a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed]

Merging this PR will not alter performance

✅ 109 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing fix/reject-unknown-browser-dtypes-434 (e711f78) with main (0101535)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩