fix: review findings

Author: bradjin8

.github/workflows/tests.yml

@@ -149,7 +149,9 @@ jobs:
       - name: Install runtime deps + mypy
         # Install from the pinned lock file for deterministic resolution,
         # then add mypy (dev-only; not in requirements-lock.txt).
-        # Flask 3.1+ ships inline types — do not install types-Flask (conflicts).
+        # Flask 3.1+ includes inline type hints — do not add or install types-Flask
+        # (it will conflict with our pip installs). Preventative guidance for future
+        # maintainers editing the steps below.
         run: |
           python -m pip install --upgrade pip
           python -m pip install -r requirements-lock.txt

.gitignore

@@ -9,7 +9,6 @@ __pycache__/
 venv/
 .venv/
 env/
-.mypy-ci-test/
 
 # Packaging
 *.egg-info/

api/export_api.py

@@ -12,7 +12,7 @@
 import zipfile
 from datetime import datetime
 from pathlib import Path
-from typing import Any, cast
+from typing import Any
 
 from flask import Blueprint, Response, request
 
@@ -45,7 +45,14 @@ def _get_export_state() -> dict[str, Any]:
     if os.path.isfile(state_path):
         try:
             with open(state_path, "r", encoding="utf-8") as f:
-                return cast(dict[str, Any], json.load(f))
+                parsed = json.load(f)
+            if isinstance(parsed, dict):
+                return parsed
+            _logger.warning(
+                "Export state in %s is not a JSON object (got %s); ignoring",
+                state_path,
+                type(parsed).__name__,
+            )
         except (json.JSONDecodeError, ValueError, OSError) as e:
             _logger.warning(
                 "Could not read export state from %s: %s",