From f567913d508fc8aa576991b9df51a30fe4dd558d Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Thu, 12 Mar 2026 10:48:47 +0000
Subject: [PATCH 01/22] fix: prevent duplicate Crisp conversations with session
 continuity tokens
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds CRISP_TOKEN_ID support using a deterministic SHA-256 hash of the
user's ID. This ensures the same user always resumes the same Crisp
conversation, even if cookies are cleared or they switch devices.

Previously, Crisp relied solely on browser cookies for session identity.
When cookies were lost (cleared, incognito, iframe cookie partitioning
in Safari/Firefox), a new anonymous session was created — leading to
duplicate conversations for the same user.

Changes:
- New hook: useCrispTokenId — generates stable token from SHA-256(userId)
- crisp-proxy/page.tsx — sets CRISP_TOKEN_ID before Crisp script loads
- useCrispProxyUrl — passes token as URL param to proxy page
- SupportDrawer — wires up the token hook
- crisp.ts — clears CRISP_TOKEN_ID on logout/session reset
- global.d.ts — adds CRISP_TOKEN_ID and CRISP_WEBSITE_ID to Window type

Ref: https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/
---
 src/app/crisp-proxy/page.tsx                  | 11 ++++-
 src/components/Global/SupportDrawer/index.tsx |  4 +-
 src/hooks/useCrispProxyUrl.ts                 |  8 +++-
 src/hooks/useCrispTokenId.ts                  | 48 +++++++++++++++++++
 src/types/global.d.ts                         |  2 +
 src/utils/crisp.ts                            |  5 ++
 6 files changed, 75 insertions(+), 3 deletions(-)
 create mode 100644 src/hooks/useCrispTokenId.ts

diff --git a/src/app/crisp-proxy/page.tsx b/src/app/crisp-proxy/page.tsx
index 37e9c8c22f..70a7003a2c 100644
--- a/src/app/crisp-proxy/page.tsx
+++ b/src/app/crisp-proxy/page.tsx
@@ -25,8 +25,17 @@ function CrispProxyContent() {
                 lock_full_view: true,
                 cross_origin_cookies: true, // Essential for session persistence in iframes
             }
+
+            // Set CRISP_TOKEN_ID for session continuity — must be set before Crisp loads.
+            // This ensures the same user always gets the same conversation, even if
+            // cookies are cleared or they switch devices/browsers.
+            // @see https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/
+            const crispTokenId = searchParams.get('crisp_token_id')
+            if (crispTokenId) {
+                ;(window as any).CRISP_TOKEN_ID = crispTokenId
+            }
         }
-    }, [])
+    }, [searchParams])
 
     useEffect(() => {
         if (typeof window === 'undefined') return
diff --git a/src/components/Global/SupportDrawer/index.tsx b/src/components/Global/SupportDrawer/index.tsx
index 74e2eb5a7d..bc4aeb6ec0 100644
--- a/src/components/Global/SupportDrawer/index.tsx
+++ b/src/components/Global/SupportDrawer/index.tsx
@@ -3,6 +3,7 @@
 import { useState, useEffect } from 'react'
 import { useModalsContext } from '@/context/ModalsContext'
 import { useCrispUserData } from '@/hooks/useCrispUserData'
+import { useCrispTokenId } from '@/hooks/useCrispTokenId'
 import { useCrispProxyUrl } from '@/hooks/useCrispProxyUrl'
 import { Drawer, DrawerContent, DrawerTitle } from '../Drawer'
 import PeanutLoading from '../PeanutLoading'
@@ -10,9 +11,10 @@ import PeanutLoading from '../PeanutLoading'
 const SupportDrawer = () => {
     const { isSupportModalOpen, setIsSupportModalOpen, supportPrefilledMessage: prefilledMessage } = useModalsContext()
     const userData = useCrispUserData()
+    const crispTokenId = useCrispTokenId()
     const [isLoading, setIsLoading] = useState(true)
 
-    const crispProxyUrl = useCrispProxyUrl(userData, prefilledMessage)
+    const crispProxyUrl = useCrispProxyUrl(userData, prefilledMessage, crispTokenId)
 
     useEffect(() => {
         // Listen for ready message from proxy iframe
diff --git a/src/hooks/useCrispProxyUrl.ts b/src/hooks/useCrispProxyUrl.ts
index 29b9b739fc..971fd34f7e 100644
--- a/src/hooks/useCrispProxyUrl.ts
+++ b/src/hooks/useCrispProxyUrl.ts
@@ -10,12 +10,17 @@ import { type CrispUserData } from '@/hooks/useCrispUserData'
  *
  * @param userData - User data to encode in URL
  * @param prefilledMessage - Optional message to prefill in chat
+ * @param crispTokenId - Stable token for Crisp session continuity (prevents duplicate conversations)
  * @returns URL path to crisp-proxy page with encoded parameters
  */
-export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: string): string {
+export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: string, crispTokenId?: string): string {
     return useMemo(() => {
         const params = new URLSearchParams()
 
+        if (crispTokenId) {
+            params.append('crisp_token_id', crispTokenId)
+        }
+
         if (userData.email) {
             params.append('user_email', userData.email)
         }
@@ -55,6 +60,7 @@ export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: str
         const queryString = params.toString()
         return queryString ? `/crisp-proxy?${queryString}` : '/crisp-proxy'
     }, [
+        crispTokenId,
         userData.email,
         userData.fullName,
         userData.username,
diff --git a/src/hooks/useCrispTokenId.ts b/src/hooks/useCrispTokenId.ts
new file mode 100644
index 0000000000..d30506b72a
--- /dev/null
+++ b/src/hooks/useCrispTokenId.ts
@@ -0,0 +1,48 @@
+import { useState, useEffect } from 'react'
+import { useAuth } from '@/context/authContext'
+
+/**
+ * Salt for Crisp token generation.
+ * This prevents raw userId from being used as the Crisp token,
+ * adding a layer of separation between internal IDs and external services.
+ */
+const CRISP_TOKEN_SALT = 'peanut-crisp-session-v1'
+
+/**
+ * Generates a deterministic Crisp session token from a userId using SHA-256.
+ *
+ * This ensures the same user always gets the same Crisp conversation,
+ * preventing duplicate sessions when cookies are cleared or devices change.
+ *
+ * @see https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/
+ */
+async function generateCrispToken(userId: string): Promise<string> {
+    const data = new TextEncoder().encode(`${CRISP_TOKEN_SALT}:${userId}`)
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data)
+    const hashArray = Array.from(new Uint8Array(hashBuffer))
+    const hashHex = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('')
+
+    // Format as UUID v4-like string for Crisp compatibility
+    // (Crisp docs recommend UUID format for tokens)
+    return [hashHex.slice(0, 8), hashHex.slice(8, 12), hashHex.slice(12, 16), hashHex.slice(16, 20), hashHex.slice(20, 32)].join('-')
+}
+
+/**
+ * Hook that returns a stable Crisp token ID derived from the current user's ID.
+ * Returns undefined when not authenticated or still computing.
+ */
+export function useCrispTokenId(): string | undefined {
+    const { userId } = useAuth()
+    const [tokenId, setTokenId] = useState<string | undefined>(undefined)
+
+    useEffect(() => {
+        if (!userId) {
+            setTokenId(undefined)
+            return
+        }
+
+        generateCrispToken(userId).then(setTokenId).catch(() => setTokenId(undefined))
+    }, [userId])
+
+    return tokenId
+}
diff --git a/src/types/global.d.ts b/src/types/global.d.ts
index 790eb5e5b0..9b6bf210b6 100644
--- a/src/types/global.d.ts
+++ b/src/types/global.d.ts
@@ -1,4 +1,6 @@
 interface Window {
     gtag?: (command: string, ...args: unknown[]) => void
     $crisp?: Array<unknown[]>
+    CRISP_TOKEN_ID?: string | null
+    CRISP_WEBSITE_ID?: string
 }
diff --git a/src/utils/crisp.ts b/src/utils/crisp.ts
index 289fd3ba25..41f1a57e8e 100644
--- a/src/utils/crisp.ts
+++ b/src/utils/crisp.ts
@@ -61,6 +61,11 @@ export function resetCrispSession(crispInstance: any): void {
     if (!crispInstance || typeof window === 'undefined') return
 
     try {
+        // Clear CRISP_TOKEN_ID before resetting session to fully unbind the user.
+        // This prevents the next anonymous session from inheriting the previous user's conversation.
+        // @see https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/
+        ;(window as any).CRISP_TOKEN_ID = null
+
         crispInstance.push(['do', 'session:reset'])
     } catch (e) {
         console.debug('[Crisp] Could not reset session:', e)

From 57af5ee5b8bfaba26f1819f953cbf537f68b022f Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Thu, 12 Mar 2026 11:07:21 +0000
Subject: [PATCH 02/22] fix: set CRISP_TOKEN_ID in inline script to prevent
 race condition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Move token setting from useEffect into inline <Script> tag so it's
  guaranteed to be set before Crisp's l.js loads
- Cache generated tokens in memory to prevent undefined→resolved state
  change that caused iframe reloads
- Use proper Window typing instead of (window as any) casts
- Revert first useEffect deps back to [] (CRISP_RUNTIME_CONFIG is static)
---
 src/app/crisp-proxy/page.tsx | 15 +++++---------
 src/hooks/useCrispTokenId.ts | 40 +++++++++++++++++++++++-------------
 src/utils/crisp.ts           |  2 +-
 3 files changed, 32 insertions(+), 25 deletions(-)

diff --git a/src/app/crisp-proxy/page.tsx b/src/app/crisp-proxy/page.tsx
index 70a7003a2c..8a360b0c89 100644
--- a/src/app/crisp-proxy/page.tsx
+++ b/src/app/crisp-proxy/page.tsx
@@ -25,17 +25,8 @@ function CrispProxyContent() {
                 lock_full_view: true,
                 cross_origin_cookies: true, // Essential for session persistence in iframes
             }
-
-            // Set CRISP_TOKEN_ID for session continuity — must be set before Crisp loads.
-            // This ensures the same user always gets the same conversation, even if
-            // cookies are cleared or they switch devices/browsers.
-            // @see https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/
-            const crispTokenId = searchParams.get('crisp_token_id')
-            if (crispTokenId) {
-                ;(window as any).CRISP_TOKEN_ID = crispTokenId
-            }
         }
-    }, [searchParams])
+    }, [])
 
     useEffect(() => {
         if (typeof window === 'undefined') return
@@ -145,6 +136,10 @@ function CrispProxyContent() {
                 {`
                     window.$crisp=[];
                     window.CRISP_WEBSITE_ID="${CRISP_WEBSITE_ID}";
+                    (function(){
+                        var t=new URLSearchParams(window.location.search).get("crisp_token_id");
+                        if(t) window.CRISP_TOKEN_ID=t;
+                    })();
                     (function(){
                         d=document;
                         s=d.createElement("script");
diff --git a/src/hooks/useCrispTokenId.ts b/src/hooks/useCrispTokenId.ts
index d30506b72a..f4815d8a1a 100644
--- a/src/hooks/useCrispTokenId.ts
+++ b/src/hooks/useCrispTokenId.ts
@@ -1,18 +1,11 @@
 import { useState, useEffect } from 'react'
 import { useAuth } from '@/context/authContext'
 
-/**
- * Salt for Crisp token generation.
- * This prevents raw userId from being used as the Crisp token,
- * adding a layer of separation between internal IDs and external services.
- */
 const CRISP_TOKEN_SALT = 'peanut-crisp-session-v1'
 
 /**
  * Generates a deterministic Crisp session token from a userId using SHA-256.
- *
- * This ensures the same user always gets the same Crisp conversation,
- * preventing duplicate sessions when cookies are cleared or devices change.
+ * Formatted as UUID-like string for Crisp compatibility.
  *
  * @see https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/
  */
@@ -22,18 +15,26 @@ async function generateCrispToken(userId: string): Promise<string> {
     const hashArray = Array.from(new Uint8Array(hashBuffer))
     const hashHex = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('')
 
-    // Format as UUID v4-like string for Crisp compatibility
-    // (Crisp docs recommend UUID format for tokens)
-    return [hashHex.slice(0, 8), hashHex.slice(8, 12), hashHex.slice(12, 16), hashHex.slice(16, 20), hashHex.slice(20, 32)].join('-')
+    return [
+        hashHex.slice(0, 8),
+        hashHex.slice(8, 12),
+        hashHex.slice(12, 16),
+        hashHex.slice(16, 20),
+        hashHex.slice(20, 32),
+    ].join('-')
 }
 
+// In-memory cache so the token is available synchronously after first computation,
+// preventing an undefined→resolved state change that would cause iframe reloads.
+const tokenCache = new Map<string, string>()
+
 /**
  * Hook that returns a stable Crisp token ID derived from the current user's ID.
- * Returns undefined when not authenticated or still computing.
+ * Returns undefined when not authenticated.
  */
 export function useCrispTokenId(): string | undefined {
     const { userId } = useAuth()
-    const [tokenId, setTokenId] = useState<string | undefined>(undefined)
+    const [tokenId, setTokenId] = useState<string | undefined>(userId ? tokenCache.get(userId) : undefined)
 
     useEffect(() => {
         if (!userId) {
@@ -41,7 +42,18 @@ export function useCrispTokenId(): string | undefined {
             return
         }
 
-        generateCrispToken(userId).then(setTokenId).catch(() => setTokenId(undefined))
+        const cached = tokenCache.get(userId)
+        if (cached) {
+            setTokenId(cached)
+            return
+        }
+
+        generateCrispToken(userId)
+            .then((token) => {
+                tokenCache.set(userId, token)
+                setTokenId(token)
+            })
+            .catch(() => setTokenId(undefined))
     }, [userId])
 
     return tokenId
diff --git a/src/utils/crisp.ts b/src/utils/crisp.ts
index 41f1a57e8e..27b1b877bf 100644
--- a/src/utils/crisp.ts
+++ b/src/utils/crisp.ts
@@ -64,7 +64,7 @@ export function resetCrispSession(crispInstance: any): void {
         // Clear CRISP_TOKEN_ID before resetting session to fully unbind the user.
         // This prevents the next anonymous session from inheriting the previous user's conversation.
         // @see https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/
-        ;(window as any).CRISP_TOKEN_ID = null
+        window.CRISP_TOKEN_ID = null
 
         crispInstance.push(['do', 'session:reset'])
     } catch (e) {

From 866876d3ef9480a05e63c8225353fa06330d468e Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Thu, 12 Mar 2026 10:53:56 +0000
Subject: [PATCH 03/22] fix: show dollar amounts instead of misleading
 percentages in cashback banners
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously the QR payment flow showed "You're getting 10% cashback!" based on
the perk campaign's discountPercentage. But the actual amount is capped by the
user's points balance (dynamicCapFormula), so users often received far less than
10% — creating confusion and support tickets.

Now we show the actual dollar amount (amountSponsored) which already accounts
for all caps. Users see "Peanut's got you! $0.50 back" instead of a misleading
percentage.

Changes:
- Pre-claim banner: shows "$X.XX back" instead of "X% cashback"
- Post-claim banner: shows "$X.XX back" with invite CTA
- 100%+ perks still get special messaging ("We paid for this bill!")
- Fallback copy when amount isn't available yet
---
 src/app/(mobile-ui)/qr-pay/page.tsx | 45 +++++++++++------------------
 1 file changed, 17 insertions(+), 28 deletions(-)

diff --git a/src/app/(mobile-ui)/qr-pay/page.tsx b/src/app/(mobile-ui)/qr-pay/page.tsx
index 6b4a7805c7..91b4b15076 100644
--- a/src/app/(mobile-ui)/qr-pay/page.tsx
+++ b/src/app/(mobile-ui)/qr-pay/page.tsx
@@ -1234,31 +1234,21 @@ export default function QRPayPage() {
                                 <h2 className="text-lg font-bold">Eligible for a Peanut Perk!</h2>
                                 <p className="text-sm text-gray-600">
                                     {(() => {
-                                        const percentage = qrPayment?.perk?.discountPercentage || 100
                                         const amountSponsored = qrPayment?.perk?.amountSponsored
+                                        const percentage = qrPayment?.perk?.discountPercentage || 100
                                         const transactionUsd =
                                             parseFloat(qrPayment?.details?.paymentAgainstAmount || '0') || 0
 
-                                        // Check if percentage matches the actual math (within 1% tolerance)
-                                        let percentageMatches = false
-                                        if (amountSponsored && transactionUsd > 0) {
-                                            const actualPercentage = (amountSponsored / transactionUsd) * 100
-                                            percentageMatches = Math.abs(actualPercentage - percentage) < 1
-                                        }
-
-                                        if (percentageMatches) {
-                                            if (percentage === 100) {
-                                                return 'This bill can be covered by Peanut. Claim it now to unlock your reward.'
-                                            } else if (percentage > 100) {
-                                                return `You're getting ${percentage}% back — that's more than you paid! Claim it now.`
-                                            } else {
-                                                return `You're getting ${percentage}% cashback! Claim it now to unlock your reward.`
+                                        // Always prefer showing the actual dollar amount
+                                        if (amountSponsored && typeof amountSponsored === 'number') {
+                                            if (percentage >= 100 && transactionUsd > 0 && amountSponsored >= transactionUsd) {
+                                                return `This bill can be covered by Peanut! $${amountSponsored.toFixed(2)} back. Claim it now.`
                                             }
+                                            return `Peanut's got you! $${amountSponsored.toFixed(2)} back on this payment. Claim it now.`
                                         }
 
-                                        return amountSponsored && typeof amountSponsored === 'number'
-                                            ? `Get $${amountSponsored.toFixed(2)} back!`
-                                            : 'Claim it now to unlock your reward.'
+                                        // Fallback: no amount available yet
+                                        return 'You earned a Peanut Perk! Claim it now to unlock your reward.'
                                     })()}
                                 </p>
                             </div>
@@ -1278,17 +1268,16 @@ export default function QRPayPage() {
                                         const amountSponsored = qrPayment?.perk?.amountSponsored
                                         const transactionUsd =
                                             parseFloat(qrPayment?.details?.paymentAgainstAmount || '0') || 0
-                                        const percentage =
-                                            amountSponsored && transactionUsd > 0
-                                                ? Math.round((amountSponsored / transactionUsd) * 100)
-                                                : qrPayment?.perk?.discountPercentage || 100
-                                        if (percentage === 100) {
-                                            return 'We paid for this bill! Earn points, climb tiers and unlock even better perks.'
-                                        } else if (percentage > 100) {
-                                            return `We gave you ${percentage}% back — that's more than you paid! Earn points, climb tiers and unlock even better perks.`
-                                        } else {
-                                            return `We gave you ${percentage}% cashback! Earn points, climb tiers and unlock even better perks.`
+
+                                        // Always show actual dollar amount
+                                        if (amountSponsored && typeof amountSponsored === 'number') {
+                                            if (transactionUsd > 0 && amountSponsored >= transactionUsd) {
+                                                return 'We paid for this bill! Earn points, climb tiers and unlock even better perks.'
+                                            }
+                                            return `We gave you $${amountSponsored.toFixed(2)} back! Invite friends to unlock bigger rewards.`
                                         }
+
+                                        return 'We gave you cashback! Earn points, climb tiers and unlock even better perks.'
                                     })()}
                                 </p>
                             </div>

From 73e61f517b93ff4a41dda3331d1f25b3c6000f0c Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Thu, 12 Mar 2026 11:08:51 +0000
Subject: [PATCH 04/22] fix: remove misleading percentage from perk messaging,
 show dollar amounts consistently

Remove unused percentage variable from pre-claim banner and align full-coverage
detection logic between pre-claim and post-claim banners. Also update
TransactionDetailsReceipt to use dollar-amount messaging instead of percentage-based,
keeping perk messaging consistent across the app.
---
 src/app/(mobile-ui)/qr-pay/page.tsx           |  5 ++--
 .../TransactionDetailsReceipt.tsx             | 25 +++++--------------
 2 files changed, 8 insertions(+), 22 deletions(-)

diff --git a/src/app/(mobile-ui)/qr-pay/page.tsx b/src/app/(mobile-ui)/qr-pay/page.tsx
index 91b4b15076..c6109f6561 100644
--- a/src/app/(mobile-ui)/qr-pay/page.tsx
+++ b/src/app/(mobile-ui)/qr-pay/page.tsx
@@ -1235,13 +1235,12 @@ export default function QRPayPage() {
                                 <p className="text-sm text-gray-600">
                                     {(() => {
                                         const amountSponsored = qrPayment?.perk?.amountSponsored
-                                        const percentage = qrPayment?.perk?.discountPercentage || 100
                                         const transactionUsd =
                                             parseFloat(qrPayment?.details?.paymentAgainstAmount || '0') || 0
 
-                                        // Always prefer showing the actual dollar amount
+                                        // Always show actual dollar amount — never percentage (misleading due to dynamic caps)
                                         if (amountSponsored && typeof amountSponsored === 'number') {
-                                            if (percentage >= 100 && transactionUsd > 0 && amountSponsored >= transactionUsd) {
+                                            if (transactionUsd > 0 && amountSponsored >= transactionUsd) {
                                                 return `This bill can be covered by Peanut! $${amountSponsored.toFixed(2)} back. Claim it now.`
                                             }
                                             return `Peanut's got you! $${amountSponsored.toFixed(2)} back on this payment. Claim it now.`
diff --git a/src/components/TransactionDetails/TransactionDetailsReceipt.tsx b/src/components/TransactionDetails/TransactionDetailsReceipt.tsx
index 92b95b4c33..102f7db0bc 100644
--- a/src/components/TransactionDetails/TransactionDetailsReceipt.tsx
+++ b/src/components/TransactionDetails/TransactionDetailsReceipt.tsx
@@ -610,30 +610,17 @@ export const TransactionDetailsReceipt = ({
                             <span className="text-sm text-gray-600">
                                 {(() => {
                                     const perk = transaction.extraDataForDrawer.perk
-                                    const percentage = perk.discountPercentage
                                     const amount = perk.amountSponsored
-                                    const isCapped = perk.isCapped
-                                    const campaignCap = perk.campaignCapUsd
 
-                                    // If user hit their campaign cap, show special message
-                                    if (isCapped && campaignCap) {
-                                        if (amount !== undefined && amount !== null) {
-                                            return `$${amount.toFixed(2)} cashback — campaign limit reached! 🎉`
+                                    // Always show actual dollar amount — never percentage (misleading due to dynamic caps)
+                                    if (amount !== undefined && amount !== null) {
+                                        if (perk.isCapped && perk.campaignCapUsd) {
+                                            return `$${amount.toFixed(2)} cashback — campaign limit reached!`
                                         }
-                                        return `Campaign limit reached! 🎉`
+                                        return `You received $${amount.toFixed(2)} cashback!`
                                     }
 
-                                    // For non-capped messages, use amountStr
-                                    const amountStr =
-                                        amount !== undefined && amount !== null ? `$${amount.toFixed(2)}` : ''
-
-                                    if (percentage === 100) {
-                                        return `You received a full refund${amount ? ` (${amountStr})` : ''} as a Peanut Perk.`
-                                    } else if (percentage > 100) {
-                                        return `You received back${amount ? ` (${amountStr})` : ''} — that's more than you paid!`
-                                    } else {
-                                        return `You received a Peanut Perk! ${amount ? ` ${amountStr}` : ''} cashback.`
-                                    }
+                                    return 'You received a Peanut Perk!'
                                 })()}
                             </span>
                         </div>

From fcc7810e804a9f6dcec26a84840cbfbfd111db64 Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Thu, 12 Mar 2026 11:38:05 +0000
Subject: [PATCH 05/22] fix: clear token on iframe reset, fix implicit globals
 in Crisp script

---
 src/app/crisp-proxy/page.tsx | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/app/crisp-proxy/page.tsx b/src/app/crisp-proxy/page.tsx
index 8a360b0c89..8df4741ef6 100644
--- a/src/app/crisp-proxy/page.tsx
+++ b/src/app/crisp-proxy/page.tsx
@@ -122,6 +122,7 @@ function CrispProxyContent() {
             if (event.origin !== window.location.origin) return
 
             if (event.data.type === 'CRISP_RESET_SESSION' && window.$crisp) {
+                window.CRISP_TOKEN_ID = null
                 window.$crisp.push(['do', 'session:reset'])
             }
         }
@@ -141,8 +142,8 @@ function CrispProxyContent() {
                         if(t) window.CRISP_TOKEN_ID=t;
                     })();
                     (function(){
-                        d=document;
-                        s=d.createElement("script");
+                        var d=document;
+                        var s=d.createElement("script");
                         s.src="https://client.crisp.chat/l.js";
                         s.async=1;
                         d.getElementsByTagName("head")[0].appendChild(s);

From a0dfbc58bd5548f8c123ffa9082ac9906e500d3a Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Thu, 12 Mar 2026 12:13:00 +0000
Subject: [PATCH 06/22] fix: tier cashback messaging tone by amount

Small amounts (<$0.50) get factual tone + invite nudge instead of
celebratory "Peanut's got you!" framing that feels patronizing for
pocket change. Large amounts ($5+) get "your points are paying off"
to reinforce the gamification loop.
---
 src/app/(mobile-ui)/qr-pay/page.tsx | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/app/(mobile-ui)/qr-pay/page.tsx b/src/app/(mobile-ui)/qr-pay/page.tsx
index c6109f6561..5585479949 100644
--- a/src/app/(mobile-ui)/qr-pay/page.tsx
+++ b/src/app/(mobile-ui)/qr-pay/page.tsx
@@ -1239,10 +1239,14 @@ export default function QRPayPage() {
                                             parseFloat(qrPayment?.details?.paymentAgainstAmount || '0') || 0
 
                                         // Always show actual dollar amount — never percentage (misleading due to dynamic caps)
+                                        // Tone scales with amount: small = factual + growth nudge, large = celebratory
                                         if (amountSponsored && typeof amountSponsored === 'number') {
                                             if (transactionUsd > 0 && amountSponsored >= transactionUsd) {
                                                 return `This bill can be covered by Peanut! $${amountSponsored.toFixed(2)} back. Claim it now.`
                                             }
+                                            if (amountSponsored < 0.5) {
+                                                return `You earned $${amountSponsored.toFixed(2)} back. Invite friends to unlock bigger cashback!`
+                                            }
                                             return `Peanut's got you! $${amountSponsored.toFixed(2)} back on this payment. Claim it now.`
                                         }
 
@@ -1268,11 +1272,17 @@ export default function QRPayPage() {
                                         const transactionUsd =
                                             parseFloat(qrPayment?.details?.paymentAgainstAmount || '0') || 0
 
-                                        // Always show actual dollar amount
+                                        // Tone scales with amount: small = growth nudge, large = celebratory
                                         if (amountSponsored && typeof amountSponsored === 'number') {
                                             if (transactionUsd > 0 && amountSponsored >= transactionUsd) {
                                                 return 'We paid for this bill! Earn points, climb tiers and unlock even better perks.'
                                             }
+                                            if (amountSponsored < 0.5) {
+                                                return `You got $${amountSponsored.toFixed(2)} back. The more friends you invite, the more you earn!`
+                                            }
+                                            if (amountSponsored >= 5) {
+                                                return `We gave you $${amountSponsored.toFixed(2)} back! Your points are paying off.`
+                                            }
                                             return `We gave you $${amountSponsored.toFixed(2)} back! Invite friends to unlock bigger rewards.`
                                         }
 

From 4268f96c598b3c42a0f6c38c7af85bbd1f37bb95 Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Thu, 12 Mar 2026 12:14:22 +0000
Subject: [PATCH 07/22] fix: enable session_merge for smooth migration of
 existing users

Adds session_merge: true to CRISP_RUNTIME_CONFIG. This tells Crisp to
automatically merge messages from old cookie-based sessions into the new
token-based session when a user first opens chat after deploy.

Without this, existing users who still have Crisp cookies would get a
fresh empty session. With session_merge, their conversation history
carries over seamlessly.

Ref: https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/#how-to-merge-messages-from-anonymous-sessions-to-token-sessions
---
 src/app/crisp-proxy/page.tsx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/app/crisp-proxy/page.tsx b/src/app/crisp-proxy/page.tsx
index 8df4741ef6..1e399dec7c 100644
--- a/src/app/crisp-proxy/page.tsx
+++ b/src/app/crisp-proxy/page.tsx
@@ -24,6 +24,7 @@ function CrispProxyContent() {
                 lock_maximized: true,
                 lock_full_view: true,
                 cross_origin_cookies: true, // Essential for session persistence in iframes
+                session_merge: true, // Merge old cookie-based sessions into new token-based sessions
             }
         }
     }, [])

From ffdc9adf1e15dac1e4a2c9fcfeab8de2c2d8556e Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Thu, 12 Mar 2026 12:38:26 +0000
Subject: [PATCH 08/22] fix: move CRISP_RUNTIME_CONFIG into inline script to
 prevent race condition

---
 src/app/crisp-proxy/page.tsx | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/src/app/crisp-proxy/page.tsx b/src/app/crisp-proxy/page.tsx
index 1e399dec7c..4c6a5a223c 100644
--- a/src/app/crisp-proxy/page.tsx
+++ b/src/app/crisp-proxy/page.tsx
@@ -18,17 +18,6 @@ import { CRISP_WEBSITE_ID } from '@/constants/crisp'
 function CrispProxyContent() {
     const searchParams = useSearchParams()
 
-    useEffect(() => {
-        if (typeof window !== 'undefined') {
-            ;(window as any).CRISP_RUNTIME_CONFIG = {
-                lock_maximized: true,
-                lock_full_view: true,
-                cross_origin_cookies: true, // Essential for session persistence in iframes
-                session_merge: true, // Merge old cookie-based sessions into new token-based sessions
-            }
-        }
-    }, [])
-
     useEffect(() => {
         if (typeof window === 'undefined') return
 
@@ -138,6 +127,7 @@ function CrispProxyContent() {
                 {`
                     window.$crisp=[];
                     window.CRISP_WEBSITE_ID="${CRISP_WEBSITE_ID}";
+                    window.CRISP_RUNTIME_CONFIG={lock_maximized:true,lock_full_view:true,cross_origin_cookies:true,session_merge:true};
                     (function(){
                         var t=new URLSearchParams(window.location.search).get("crisp_token_id");
                         if(t) window.CRISP_TOKEN_ID=t;

From b4f75cfdec14a478bddb7e3c98946b4b1af4f97c Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 15:39:05 +0000
Subject: [PATCH 09/22] feat: add PostHog person link to Crisp support metadata

Support agents can now click through to PostHog person page directly
from Crisp sidebar to view session recordings and user events.
Uses the same userId that PostHog identifies users with.
---
 src/app/crisp-proxy/page.tsx  |  1 +
 src/constants/support.ts      |  3 +++
 src/hooks/useCrispProxyUrl.ts |  5 ++++-
 src/hooks/useCrispUserData.ts |  6 +++++-
 src/utils/crisp.ts            | 15 +++++++++++++--
 5 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/src/app/crisp-proxy/page.tsx b/src/app/crisp-proxy/page.tsx
index 4c6a5a223c..eea0814c0f 100644
--- a/src/app/crisp-proxy/page.tsx
+++ b/src/app/crisp-proxy/page.tsx
@@ -72,6 +72,7 @@ function CrispProxyContent() {
                             ['wallet_address', data.wallet_address || ''],
                             ['bridge_user_id', data.bridge_user_id || ''],
                             ['manteca_user_id', data.manteca_user_id || ''],
+                            ['posthog_person', data.posthog_person || ''],
                         ],
                     ]
                     window.$crisp.push(['set', 'session:data', sessionDataArray])
diff --git a/src/constants/support.ts b/src/constants/support.ts
index f7cb4afefa..c3613cb065 100644
--- a/src/constants/support.ts
+++ b/src/constants/support.ts
@@ -8,3 +8,6 @@ export const GRAFANA_DASHBOARD_BASE_URL =
 
 /** Arbiscan block explorer for viewing wallet addresses on Arbitrum */
 export const ARBISCAN_ADDRESS_BASE_URL = 'https://arbiscan.io/address'
+
+/** PostHog person page for viewing session recordings and events */
+export const POSTHOG_PERSON_BASE_URL = 'https://eu.posthog.com/project/138913/person'
diff --git a/src/hooks/useCrispProxyUrl.ts b/src/hooks/useCrispProxyUrl.ts
index 971fd34f7e..af79a4bec9 100644
--- a/src/hooks/useCrispProxyUrl.ts
+++ b/src/hooks/useCrispProxyUrl.ts
@@ -39,7 +39,8 @@ export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: str
             userData.grafanaLink ||
             userData.walletAddressLink ||
             userData.bridgeUserId ||
-            userData.mantecaUserId
+            userData.mantecaUserId ||
+            userData.posthogPersonLink
         ) {
             const sessionData = JSON.stringify({
                 username: userData.username || '',
@@ -49,6 +50,7 @@ export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: str
                 wallet_address: userData.walletAddressLink || '',
                 bridge_user_id: userData.bridgeUserId || '',
                 manteca_user_id: userData.mantecaUserId || '',
+                posthog_person: userData.posthogPersonLink || '',
             })
             params.append('session_data', sessionData)
         }
@@ -70,6 +72,7 @@ export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: str
         userData.walletAddressLink,
         userData.bridgeUserId,
         userData.mantecaUserId,
+        userData.posthogPersonLink,
         prefilledMessage,
     ])
 }
diff --git a/src/hooks/useCrispUserData.ts b/src/hooks/useCrispUserData.ts
index 938f8424bf..d1ae22532f 100644
--- a/src/hooks/useCrispUserData.ts
+++ b/src/hooks/useCrispUserData.ts
@@ -1,7 +1,7 @@
 import { useAuth } from '@/context/authContext'
 import { AccountType } from '@/interfaces'
 import { useMemo } from 'react'
-import { GRAFANA_DASHBOARD_BASE_URL, ARBISCAN_ADDRESS_BASE_URL } from '@/constants/support'
+import { GRAFANA_DASHBOARD_BASE_URL, ARBISCAN_ADDRESS_BASE_URL, POSTHOG_PERSON_BASE_URL } from '@/constants/support'
 
 export interface CrispUserData {
     username: string | undefined
@@ -14,6 +14,7 @@ export interface CrispUserData {
     walletAddressLink: string | undefined
     bridgeUserId: string | undefined
     mantecaUserId: string | undefined
+    posthogPersonLink: string | undefined
 }
 
 /**
@@ -40,6 +41,8 @@ export function useCrispUserData(): CrispUserData {
         const mantecaUserId =
             user?.user?.kycVerifications?.find((kyc) => kyc.provider === 'MANTECA')?.providerUserId || undefined
 
+        const posthogPersonLink = userId ? `${POSTHOG_PERSON_BASE_URL}/${userId}` : undefined
+
         return {
             username,
             userId,
@@ -51,6 +54,7 @@ export function useCrispUserData(): CrispUserData {
             walletAddressLink,
             bridgeUserId,
             mantecaUserId,
+            posthogPersonLink,
         }
     }, [username, userId, user])
 }
diff --git a/src/utils/crisp.ts b/src/utils/crisp.ts
index 27b1b877bf..83da6056c8 100644
--- a/src/utils/crisp.ts
+++ b/src/utils/crisp.ts
@@ -14,8 +14,18 @@ import { type CrispUserData } from '@/hooks/useCrispUserData'
 export function setCrispUserData(crispInstance: any, userData: CrispUserData, prefilledMessage?: string): void {
     if (!crispInstance) return
 
-    const { username, userId, email, fullName, avatar, grafanaLink, walletAddressLink, bridgeUserId, mantecaUserId } =
-        userData
+    const {
+        username,
+        userId,
+        email,
+        fullName,
+        avatar,
+        grafanaLink,
+        walletAddressLink,
+        bridgeUserId,
+        mantecaUserId,
+        posthogPersonLink,
+    } = userData
 
     if (email) {
         crispInstance.push(['set', 'user:email', [email]])
@@ -43,6 +53,7 @@ export function setCrispUserData(crispInstance: any, userData: CrispUserData, pr
                 ['wallet_address', walletAddressLink || ''],
                 ['bridge_user_id', bridgeUserId || ''],
                 ['manteca_user_id', mantecaUserId || ''],
+                ['posthog_person', posthogPersonLink || ''],
             ],
         ],
     ])

From f985f2e0c4e19bf19f3855c1ca3f7f87e14aa83b Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Tue, 17 Mar 2026 17:48:45 +0000
Subject: [PATCH 10/22] Update content submodule to latest main (35 commits)

---
 src/content | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/content b/src/content
index ffc4bdd8ac..9a36535bdc 160000
--- a/src/content
+++ b/src/content
@@ -1 +1 @@
-Subproject commit ffc4bdd8ac3925b9f80d77bb5bb6e5f85a3d45b4
+Subproject commit 9a36535bdc9ae3ab3064056ca544fb43085b1c57

From 9fc02d04bc30d5d07adec4bef7265fe9002632ca Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Wed, 18 Mar 2026 16:49:57 +0000
Subject: [PATCH 11/22] fix: auto-claim small perks and map sponsoredUsd field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two fixes:
1. Map backend sponsoredUsd → frontend amountSponsored on initial
   payment response. Previously amountSponsored was always undefined
   at pre-claim time due to field name mismatch, so the banner always
   hit the fallback copy.
2. Auto-claim perks under $0.50 — skip the hold-to-claim ceremony
   for small amounts. Backend already claims at payment time, so this
   is purely a UI shortcut that avoids making users hold a button for
   pocket change.
---
 src/app/(mobile-ui)/qr-pay/page.tsx | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/app/(mobile-ui)/qr-pay/page.tsx b/src/app/(mobile-ui)/qr-pay/page.tsx
index 5585479949..5b66b0524b 100644
--- a/src/app/(mobile-ui)/qr-pay/page.tsx
+++ b/src/app/(mobile-ui)/qr-pay/page.tsx
@@ -700,7 +700,24 @@ export default function QRPayPage() {
                 clearTimeout(payingStateTimerRef.current)
                 payingStateTimerRef.current = null
             }
+            // Map backend field name (sponsoredUsd) to frontend field name (amountSponsored)
+            const perkResponse = qrPayment.perk as Record<string, unknown> | undefined
+            if (qrPayment.perk && perkResponse?.sponsoredUsd !== undefined) {
+                qrPayment.perk.amountSponsored = perkResponse.sponsoredUsd as number
+            }
+
             setQrPayment(qrPayment)
+
+            // Auto-claim small perks (<$0.50) — skip the hold-to-claim ceremony.
+            // The backend already claimed the perk at payment time, so this is just a UI shortcut.
+            if (
+                qrPayment.perk?.eligible &&
+                qrPayment.perk.amountSponsored !== undefined &&
+                qrPayment.perk.amountSponsored < 0.5
+            ) {
+                setPerkClaimed(true)
+            }
+
             setIsSuccess(true)
         } catch (error) {
             // clear the timer on error to prevent race condition

From e9185018893933667cb6cd74834c36935ef8a9ae Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Wed, 18 Mar 2026 16:53:30 +0000
Subject: [PATCH 12/22] chore: remove dead pre-claim branch for <$0.50 perks

These perks are auto-claimed now and skip the pre-claim banner
entirely, so the small-amount messaging branch was unreachable.
---
 src/app/(mobile-ui)/qr-pay/page.tsx | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/app/(mobile-ui)/qr-pay/page.tsx b/src/app/(mobile-ui)/qr-pay/page.tsx
index 5b66b0524b..acb6a99af1 100644
--- a/src/app/(mobile-ui)/qr-pay/page.tsx
+++ b/src/app/(mobile-ui)/qr-pay/page.tsx
@@ -1256,14 +1256,11 @@ export default function QRPayPage() {
                                             parseFloat(qrPayment?.details?.paymentAgainstAmount || '0') || 0
 
                                         // Always show actual dollar amount — never percentage (misleading due to dynamic caps)
-                                        // Tone scales with amount: small = factual + growth nudge, large = celebratory
+                                        // Note: perks <$0.50 are auto-claimed and skip this banner entirely
                                         if (amountSponsored && typeof amountSponsored === 'number') {
                                             if (transactionUsd > 0 && amountSponsored >= transactionUsd) {
                                                 return `This bill can be covered by Peanut! $${amountSponsored.toFixed(2)} back. Claim it now.`
                                             }
-                                            if (amountSponsored < 0.5) {
-                                                return `You earned $${amountSponsored.toFixed(2)} back. Invite friends to unlock bigger cashback!`
-                                            }
                                             return `Peanut's got you! $${amountSponsored.toFixed(2)} back on this payment. Claim it now.`
                                         }
 

From 637b0c67d45cd4bdcd159824c5f3816c358d164d Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Wed, 18 Mar 2026 17:15:30 +0000
Subject: [PATCH 13/22] fix: use typeof guard for sponsoredUsd mapping and
 auto-claim check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prevents null from passing through — null < 0.5 is true in JS,
which would cause unintended auto-claims.
---
 src/app/(mobile-ui)/qr-pay/page.tsx | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/app/(mobile-ui)/qr-pay/page.tsx b/src/app/(mobile-ui)/qr-pay/page.tsx
index acb6a99af1..0f2d599871 100644
--- a/src/app/(mobile-ui)/qr-pay/page.tsx
+++ b/src/app/(mobile-ui)/qr-pay/page.tsx
@@ -702,8 +702,8 @@ export default function QRPayPage() {
             }
             // Map backend field name (sponsoredUsd) to frontend field name (amountSponsored)
             const perkResponse = qrPayment.perk as Record<string, unknown> | undefined
-            if (qrPayment.perk && perkResponse?.sponsoredUsd !== undefined) {
-                qrPayment.perk.amountSponsored = perkResponse.sponsoredUsd as number
+            if (qrPayment.perk && typeof perkResponse?.sponsoredUsd === 'number') {
+                qrPayment.perk.amountSponsored = perkResponse.sponsoredUsd
             }
 
             setQrPayment(qrPayment)
@@ -712,7 +712,7 @@ export default function QRPayPage() {
             // The backend already claimed the perk at payment time, so this is just a UI shortcut.
             if (
                 qrPayment.perk?.eligible &&
-                qrPayment.perk.amountSponsored !== undefined &&
+                typeof qrPayment.perk.amountSponsored === 'number' &&
                 qrPayment.perk.amountSponsored < 0.5
             ) {
                 setPerkClaimed(true)

From 327570c39ec506a9a5af86887452f62f5cbb8c69 Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Wed, 18 Mar 2026 17:48:00 +0000
Subject: [PATCH 14/22] feat: add Bridge dashboard link to Crisp session data

---
 src/constants/support.ts      |  3 +++
 src/hooks/useCrispProxyUrl.ts |  6 +++---
 src/hooks/useCrispUserData.ts | 14 ++++++++++----
 src/utils/crisp.ts            |  4 ++--
 4 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/src/constants/support.ts b/src/constants/support.ts
index c3613cb065..20f7ebb048 100644
--- a/src/constants/support.ts
+++ b/src/constants/support.ts
@@ -11,3 +11,6 @@ export const ARBISCAN_ADDRESS_BASE_URL = 'https://arbiscan.io/address'
 
 /** PostHog person page for viewing session recordings and events */
 export const POSTHOG_PERSON_BASE_URL = 'https://eu.posthog.com/project/138913/person'
+
+/** Bridge dashboard for viewing customer KYC and compliance details */
+export const BRIDGE_DASHBOARD_BASE_URL = 'https://dashboard.bridge.xyz/app/customers'
diff --git a/src/hooks/useCrispProxyUrl.ts b/src/hooks/useCrispProxyUrl.ts
index af79a4bec9..76366bb67d 100644
--- a/src/hooks/useCrispProxyUrl.ts
+++ b/src/hooks/useCrispProxyUrl.ts
@@ -38,7 +38,7 @@ export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: str
             userData.fullName ||
             userData.grafanaLink ||
             userData.walletAddressLink ||
-            userData.bridgeUserId ||
+            userData.bridgeCustomerLink ||
             userData.mantecaUserId ||
             userData.posthogPersonLink
         ) {
@@ -48,7 +48,7 @@ export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: str
                 full_name: userData.fullName || '',
                 grafana_dashboard: userData.grafanaLink || '',
                 wallet_address: userData.walletAddressLink || '',
-                bridge_user_id: userData.bridgeUserId || '',
+                bridge_user_id: userData.bridgeCustomerLink || '',
                 manteca_user_id: userData.mantecaUserId || '',
                 posthog_person: userData.posthogPersonLink || '',
             })
@@ -70,7 +70,7 @@ export function useCrispProxyUrl(userData: CrispUserData, prefilledMessage?: str
         userData.userId,
         userData.grafanaLink,
         userData.walletAddressLink,
-        userData.bridgeUserId,
+        userData.bridgeCustomerLink,
         userData.mantecaUserId,
         userData.posthogPersonLink,
         prefilledMessage,
diff --git a/src/hooks/useCrispUserData.ts b/src/hooks/useCrispUserData.ts
index d1ae22532f..922ccc3ccb 100644
--- a/src/hooks/useCrispUserData.ts
+++ b/src/hooks/useCrispUserData.ts
@@ -1,7 +1,12 @@
 import { useAuth } from '@/context/authContext'
 import { AccountType } from '@/interfaces'
 import { useMemo } from 'react'
-import { GRAFANA_DASHBOARD_BASE_URL, ARBISCAN_ADDRESS_BASE_URL, POSTHOG_PERSON_BASE_URL } from '@/constants/support'
+import {
+    GRAFANA_DASHBOARD_BASE_URL,
+    ARBISCAN_ADDRESS_BASE_URL,
+    POSTHOG_PERSON_BASE_URL,
+    BRIDGE_DASHBOARD_BASE_URL,
+} from '@/constants/support'
 
 export interface CrispUserData {
     username: string | undefined
@@ -12,7 +17,7 @@ export interface CrispUserData {
     grafanaLink: string | undefined
     walletAddress: string | undefined
     walletAddressLink: string | undefined
-    bridgeUserId: string | undefined
+    bridgeCustomerLink: string | undefined
     mantecaUserId: string | undefined
     posthogPersonLink: string | undefined
 }
@@ -37,7 +42,8 @@ export function useCrispUserData(): CrispUserData {
             user?.accounts?.find((account) => account.type === AccountType.PEANUT_WALLET)?.identifier || undefined
         const walletAddressLink = walletAddress ? `${ARBISCAN_ADDRESS_BASE_URL}/${walletAddress}` : undefined
 
-        const bridgeUserId = user?.user?.bridgeCustomerId || undefined
+        const bridgeCustomerId = user?.user?.bridgeCustomerId || undefined
+        const bridgeCustomerLink = bridgeCustomerId ? `${BRIDGE_DASHBOARD_BASE_URL}/${bridgeCustomerId}` : undefined
         const mantecaUserId =
             user?.user?.kycVerifications?.find((kyc) => kyc.provider === 'MANTECA')?.providerUserId || undefined
 
@@ -52,7 +58,7 @@ export function useCrispUserData(): CrispUserData {
             grafanaLink,
             walletAddress,
             walletAddressLink,
-            bridgeUserId,
+            bridgeCustomerLink,
             mantecaUserId,
             posthogPersonLink,
         }
diff --git a/src/utils/crisp.ts b/src/utils/crisp.ts
index 83da6056c8..eb14beb5f9 100644
--- a/src/utils/crisp.ts
+++ b/src/utils/crisp.ts
@@ -22,7 +22,7 @@ export function setCrispUserData(crispInstance: any, userData: CrispUserData, pr
         avatar,
         grafanaLink,
         walletAddressLink,
-        bridgeUserId,
+        bridgeCustomerLink,
         mantecaUserId,
         posthogPersonLink,
     } = userData
@@ -51,7 +51,7 @@ export function setCrispUserData(crispInstance: any, userData: CrispUserData, pr
                 ['full_name', fullName || ''],
                 ['grafana_dashboard', grafanaLink || ''],
                 ['wallet_address', walletAddressLink || ''],
-                ['bridge_user_id', bridgeUserId || ''],
+                ['bridge_user_id', bridgeCustomerLink || ''],
                 ['manteca_user_id', mantecaUserId || ''],
                 ['posthog_person', posthogPersonLink || ''],
             ],

From f7f1abfddb88daf6be7a5569d09abbe2e34ae1b2 Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Wed, 18 Mar 2026 17:53:34 +0000
Subject: [PATCH 15/22] chore: add TODOs for iframe perf and Manteca dashboard
 link

---
 src/components/Global/SupportDrawer/index.tsx | 2 ++
 src/hooks/useCrispUserData.ts                 | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/src/components/Global/SupportDrawer/index.tsx b/src/components/Global/SupportDrawer/index.tsx
index bc4aeb6ec0..aff8b90782 100644
--- a/src/components/Global/SupportDrawer/index.tsx
+++ b/src/components/Global/SupportDrawer/index.tsx
@@ -47,6 +47,8 @@ const SupportDrawer = () => {
                             <PeanutLoading />
                         </div>
                     )}
+                    {/* TODO: Keep iframe alive between drawer open/close (hide with CSS instead of unmounting) */}
+                    {/* to avoid re-initializing Crisp on every open. Currently causes noticeable load delay. */}
                     <iframe
                         src={crispProxyUrl}
                         className="h-full w-full"
diff --git a/src/hooks/useCrispUserData.ts b/src/hooks/useCrispUserData.ts
index 922ccc3ccb..fe95cfa728 100644
--- a/src/hooks/useCrispUserData.ts
+++ b/src/hooks/useCrispUserData.ts
@@ -44,6 +44,9 @@ export function useCrispUserData(): CrispUserData {
 
         const bridgeCustomerId = user?.user?.bridgeCustomerId || undefined
         const bridgeCustomerLink = bridgeCustomerId ? `${BRIDGE_DASHBOARD_BASE_URL}/${bridgeCustomerId}` : undefined
+        // TODO: Manteca dashboard uses a numeric short ID (e.g. 2685955), but we only store
+        // the long UUID (providerUserId). Converting requires an extra API call to Manteca.
+        // When/if we add that, change this to a full link like bridgeCustomerLink.
         const mantecaUserId =
             user?.user?.kycVerifications?.find((kyc) => kyc.provider === 'MANTECA')?.providerUserId || undefined
 

From 990d3009aaf72a14f0d82ded843bc603afb1a785 Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Thu, 19 Mar 2026 15:02:16 +0000
Subject: [PATCH 16/22] feat: add Chainstack as primary RPC for Polygon, Base,
 and BSC

Reduces dependency on Infura/Alchemy (both near quota limits) by adding
Chainstack nodes as the primary provider for three more chains.
Chainstack was already primary for Ethereum and Arbitrum.
---
 src/constants/general.consts.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/constants/general.consts.ts b/src/constants/general.consts.ts
index 01c9601761..074820bc60 100644
--- a/src/constants/general.consts.ts
+++ b/src/constants/general.consts.ts
@@ -38,6 +38,7 @@ export const rpcUrls: Record<number, string[]> = {
         'https://sepolia-rollup.arbitrum.io/rpc', // Official Arbitrum Sepolia
     ].filter(Boolean) as string[],
     [polygon.id]: [
+        'https://polygon-mainnet.core.chainstack.com/e8d733c7341e28d98e4cf66c61c42aa6', // Chainstack (primary)
         infuraUrl('polygon-mainnet'),
         alchemyUrl('polygon-mainnet'),
         'https://polygon-rpc.com', // Official public RPC
@@ -48,11 +49,13 @@ export const rpcUrls: Record<number, string[]> = {
         'https://mainnet.optimism.io', // Official Optimism RPC
     ].filter(Boolean) as string[],
     [base.id]: [
+        'https://base-mainnet.core.chainstack.com/01f0761d79d1b6e9d234d7ab69a90b19', // Chainstack (primary)
         infuraUrl('base-mainnet'),
         alchemyUrl('base-mainnet'),
         'https://mainnet.base.org', // Official Base RPC
     ].filter(Boolean) as string[],
     [bsc.id]: [
+        'https://bsc-mainnet.core.chainstack.com/2d9b1537fa4555562f8e15fd08bf8ed5', // Chainstack (primary)
         'https://bsc-dataseed.bnbchain.org', // Official BSC RPC
         infuraUrl('bsc-mainnet'),
         alchemyUrl('bsc-mainnet'),

From 5f9224fa2213d2583ddba53e400bf8650f7b338d Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Thu, 19 Mar 2026 14:14:02 +0000
Subject: [PATCH 17/22] =?UTF-8?q?fix:=20improve=20health=20checks=20?=
 =?UTF-8?q?=E2=80=94=20zerodev,=20rpc=20critical=20chain=20logic,=20webhoo?=
 =?UTF-8?q?k=20cooldown?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- ZeroDev: Remove Polygon check (not used in prod), use eth_supportedEntryPoints
  instead of eth_chainId for bundler (mandatory ERC-4337 method)
- RPC: Critical vs non-critical chain distinction (Polygon down = degraded, not unhealthy).
  Added public fallback RPCs for Polygon. Parallel provider testing.
- Main orchestrator: 30-min Discord webhook cooldown to prevent notification spam.
  Use plain fetch instead of fetchWithSentry to stop health check errors polluting Sentry.
- Backend: Use /healthz endpoint instead of /users/username/hugo
---
 src/app/api/health/backend/route.ts |  62 +++----
 src/app/api/health/route.ts         | 205 +++++++++++------------
 src/app/api/health/rpc/route.ts     | 246 ++++++++++++++++------------
 src/app/api/health/zerodev/route.ts | 214 ++++++++++++------------
 src/constants/general.consts.ts     |   2 +
 5 files changed, 366 insertions(+), 363 deletions(-)

diff --git a/src/app/api/health/backend/route.ts b/src/app/api/health/backend/route.ts
index 10bf1e40de..892e0d504a 100644
--- a/src/app/api/health/backend/route.ts
+++ b/src/app/api/health/backend/route.ts
@@ -1,14 +1,21 @@
 import { NextResponse } from 'next/server'
-import { fetchWithSentry } from '@/utils/sentry.utils'
 import { PEANUT_API_URL } from '@/constants/general.consts'
 
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 export const fetchCache = 'force-no-store'
 
+const NO_CACHE_HEADERS = {
+    'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
+    Pragma: 'no-cache',
+    Expires: '0',
+    'Surrogate-Control': 'no-store',
+}
+
 /**
- * Health check for Peanut API backend
- * Tests connectivity to the main peanut-api-ts backend service
+ * Health check for Peanut API backend.
+ * Uses the backend's dedicated /healthz endpoint (checks DB connectivity).
+ * Uses plain fetch to avoid health check errors polluting Sentry.
  */
 export async function GET() {
     const startTime = Date.now()
@@ -23,28 +30,28 @@ export async function GET() {
                     error: 'PEANUT_API_URL not configured',
                     responseTime: Date.now() - startTime,
                 },
-                { status: 500 }
+                { status: 500, headers: NO_CACHE_HEADERS }
             )
         }
 
-        // Test backend connectivity by fetching a specific user endpoint
         const backendTestStart = Date.now()
-        const backendResponse = await fetchWithSentry(`${PEANUT_API_URL}/users/username/hugo`, {
+        const backendResponse = await fetch(`${PEANUT_API_URL}/healthz`, {
             method: 'GET',
-            headers: {
-                'Content-Type': 'application/json',
-            },
+            headers: { 'Content-Type': 'application/json' },
             cache: 'no-store',
-            next: { revalidate: 0 },
+            signal: AbortSignal.timeout(8000),
         })
 
         const backendResponseTime = Date.now() - backendTestStart
 
-        // Backend is healthy if we get any response (200, 404, etc.) - what matters is connectivity
-        if (!backendResponse.ok && backendResponse.status >= 500) {
-            throw new Error(`Backend API returned server error ${backendResponse.status}`)
+        if (!backendResponse.ok) {
+            const errorData = await backendResponse.json().catch(() => null)
+            throw new Error(
+                errorData?.error || `Backend /healthz returned ${backendResponse.status}`
+            )
         }
 
+        const healthData = await backendResponse.json()
         const totalResponseTime = Date.now() - startTime
 
         return NextResponse.json(
@@ -54,29 +61,16 @@ export async function GET() {
                 timestamp: new Date().toISOString(),
                 responseTime: totalResponseTime,
                 details: {
-                    apiConnectivity: {
+                    healthz: {
                         status: 'healthy',
                         responseTime: backendResponseTime,
                         httpStatus: backendResponse.status,
                         apiUrl: PEANUT_API_URL,
-                        testEndpoint: '/users/username/hugo',
-                        message: backendResponse.ok
-                            ? 'Backend responding normally'
-                            : backendResponse.status === 404
-                              ? 'Backend accessible (user not found as expected)'
-                              : 'Backend accessible',
+                        dbConnected: healthData.dbConnected ?? true,
                     },
                 },
             },
-            {
-                status: 200,
-                headers: {
-                    'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
-                    Pragma: 'no-cache',
-                    Expires: '0',
-                    'Surrogate-Control': 'no-store',
-                },
-            }
+            { status: 200, headers: NO_CACHE_HEADERS }
         )
     } catch (error) {
         const totalResponseTime = Date.now() - startTime
@@ -89,15 +83,7 @@ export async function GET() {
                 error: error instanceof Error ? error.message : 'Unknown error',
                 responseTime: totalResponseTime,
             },
-            {
-                status: 500,
-                headers: {
-                    'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
-                    Pragma: 'no-cache',
-                    Expires: '0',
-                    'Surrogate-Control': 'no-store',
-                },
-            }
+            { status: 500, headers: NO_CACHE_HEADERS }
         )
     }
 }
diff --git a/src/app/api/health/route.ts b/src/app/api/health/route.ts
index 89c696bd02..35de0e57df 100644
--- a/src/app/api/health/route.ts
+++ b/src/app/api/health/route.ts
@@ -1,5 +1,4 @@
 import { NextResponse } from 'next/server'
-import { fetchWithSentry } from '@/utils/sentry.utils'
 import { SELF_URL } from '@/constants/general.consts'
 
 export const dynamic = 'force-dynamic'
@@ -7,13 +6,24 @@ export const revalidate = 0
 export const fetchCache = 'force-no-store'
 
 /**
- * Overall health check endpoint
- * Aggregates health status from all individual service health checks
- * This is the main endpoint that should be monitored by UptimeRobot
+ * Overall health check endpoint.
+ * Aggregates health status from all individual service health checks.
+ * Monitored by UptimeRobot → status.peanut.me
+ *
+ * Discord webhook has a 30-minute cooldown to avoid spam when UptimeRobot
+ * polls every few minutes during an ongoing incident.
+ *
+ * Uses plain fetch for sub-checks to avoid health check errors polluting Sentry.
  */
 
+// In-memory cooldown for Discord notifications.
+// Vercel serverless functions are ephemeral, so this resets on cold starts —
+// that's acceptable since cold starts are infrequent enough to not cause spam.
+let lastNotificationTime = 0
+const NOTIFICATION_COOLDOWN_MS = 30 * 60 * 1000 // 30 minutes
+
 /**
- * Send Discord notification when system is unhealthy
+ * Send Discord notification when system is unhealthy (with cooldown).
  */
 async function sendDiscordNotification(healthData: any) {
     try {
@@ -23,12 +33,25 @@ async function sendDiscordNotification(healthData: any) {
             return
         }
 
-        // Create a detailed message about what's failing
+        // Cooldown check — don't spam Discord
+        const now = Date.now()
+        if (now - lastNotificationTime < NOTIFICATION_COOLDOWN_MS) {
+            console.log(
+                `Discord notification skipped (cooldown). Last sent ${Math.round((now - lastNotificationTime) / 1000)}s ago.`
+            )
+            return
+        }
+        lastNotificationTime = now
+
         const failedServices = Object.entries(healthData.services)
             .filter(([_, service]: [string, any]) => service.status === 'unhealthy')
             .map(([name, service]: [string, any]) => `• ${name}: ${service.error || 'unhealthy'}`)
 
-        // Only mention role in production or peanut.me
+        const degradedServices = Object.entries(healthData.services)
+            .filter(([_, service]: [string, any]) => service.status === 'degraded')
+            .map(([name, service]: [string, any]) => `• ${name}: ${service.error || 'degraded'}`)
+
+        // Only @mention the role in production
         const isProduction = process.env.NODE_ENV === 'production'
         const isPeanutDomain =
             (process.env.NEXT_PUBLIC_BASE_URL?.includes('peanut.me') &&
@@ -38,78 +61,77 @@ async function sendDiscordNotification(healthData: any) {
 
         const roleMention = shouldMentionRole ? '<@&1187109195389083739> ' : ''
 
-        const message = `${roleMention}🚨 **Peanut Health Alert** 🚨
+        let message = `${roleMention}🚨 **Peanut Health Alert** 🚨
 
 System Status: **${healthData.status.toUpperCase()}**
 Health Score: ${healthData.healthScore}%
 Environment: ${healthData.systemInfo?.environment || 'unknown'}
 
 **Failed Services:**
-${failedServices.length > 0 ? failedServices.join('\n') : 'No specific failures detected'}
+${failedServices.length > 0 ? failedServices.join('\n') : 'No specific failures detected'}`
+
+        if (degradedServices.length > 0) {
+            message += `\n\n**Degraded Services:**\n${degradedServices.join('\n')}`
+        }
 
-**Summary:**
+        message += `\n\n**Summary:**
 • Healthy: ${healthData.summary.healthy}
 • Degraded: ${healthData.summary.degraded}
 • Unhealthy: ${healthData.summary.unhealthy}
 
 Timestamp: ${healthData.timestamp}`
 
-        await fetchWithSentry(webhookUrl, {
+        await fetch(webhookUrl, {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                content: message,
-            }),
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ content: message }),
         })
 
         console.log('Discord notification sent for unhealthy system status')
     } catch (error) {
         console.error('Failed to send Discord notification:', error)
-        // Don't throw - we don't want notification failures to break the health check
     }
 }
 
+const NO_CACHE_HEADERS = {
+    'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
+    Pragma: 'no-cache',
+    Expires: '0',
+    'Surrogate-Control': 'no-store',
+}
+
 export async function GET() {
     const startTime = Date.now()
 
     try {
         const services = ['mobula', 'squid', 'zerodev', 'rpc', 'justaname', 'backend', 'manteca']
-        const HEALTH_CHECK_TIMEOUT = 8000 // 8 seconds per service
+        const HEALTH_CHECK_TIMEOUT = 8000
 
         const healthChecks = await Promise.allSettled(
             services.map(async (service) => {
-                const timeoutPromise = new Promise((_, reject) => {
-                    setTimeout(
-                        () => reject(new Error(`${service} health check timeout after ${HEALTH_CHECK_TIMEOUT}ms`)),
-                        HEALTH_CHECK_TIMEOUT
-                    )
-                })
-
-                // Race the fetch against the timeout
-                const healthCheckPromise = (async () => {
-                    const response = await fetchWithSentry(`${SELF_URL}/api/health/${service}`, {
+                const controller = new AbortController()
+                const timeoutId = setTimeout(() => controller.abort(), HEALTH_CHECK_TIMEOUT)
+
+                try {
+                    // Use plain fetch — health check errors are expected, not Sentry-worthy
+                    const response = await fetch(`${SELF_URL}/api/health/${service}`, {
                         method: 'GET',
-                        headers: {
-                            'Content-Type': 'application/json',
-                        },
+                        headers: { 'Content-Type': 'application/json' },
                         cache: 'no-store',
-                        next: { revalidate: 0 },
+                        signal: controller.signal,
                     })
 
-                    if (!response.ok) {
-                        throw new Error(`Health check failed with status ${response.status}`)
-                    }
+                    clearTimeout(timeoutId)
 
                     const data = await response.json()
-                    return {
-                        service,
-                        ...data,
-                    }
-                })()
 
-                return Promise.race([healthCheckPromise, timeoutPromise])
+                    // Pass through the sub-check's own status rather than only trusting HTTP status.
+                    // Sub-checks now return degraded (HTTP 200) for non-critical partial failures.
+                    return { service, ...data }
+                } catch (error) {
+                    clearTimeout(timeoutId)
+                    throw error
+                }
             })
         )
 
@@ -128,31 +150,37 @@ export async function GET() {
             const serviceName = services[index]
 
             if (result.status === 'fulfilled') {
-                const serviceData = result.value
+                const serviceData = result.value as any
+                const serviceStatus = serviceData.status || 'unhealthy'
+
                 results.services[serviceName] = {
-                    status: serviceData.status,
+                    status: serviceStatus,
                     responseTime: serviceData.responseTime,
                     timestamp: serviceData.timestamp,
                     details: serviceData.details || {},
+                    ...(serviceData.error ? { error: serviceData.error } : {}),
                 }
 
-                // Update summary counts
-                switch (serviceData.status) {
+                switch (serviceStatus) {
                     case 'healthy':
                         results.summary.healthy++
                         break
                     case 'degraded':
                         results.summary.degraded++
                         break
-                    case 'unhealthy':
                     default:
                         results.summary.unhealthy++
                         break
                 }
             } else {
+                const errorMessage =
+                    result.reason?.name === 'AbortError'
+                        ? `${serviceName} health check timeout after ${HEALTH_CHECK_TIMEOUT}ms`
+                        : result.reason?.message || 'Health check failed'
+
                 results.services[serviceName] = {
                     status: 'unhealthy',
-                    error: result.reason?.message || 'Health check failed',
+                    error: errorMessage,
                     timestamp: new Date().toISOString(),
                 }
                 results.summary.unhealthy++
@@ -162,7 +190,6 @@ export async function GET() {
         // Determine overall system health
         let overallStatus = 'healthy'
         if (results.summary.unhealthy > 0) {
-            // If any critical services are down, mark as unhealthy
             const criticalServices = ['backend', 'rpc']
             const criticalServicesDown = criticalServices.some(
                 (service) => results.services[service]?.status === 'unhealthy'
@@ -179,67 +206,31 @@ export async function GET() {
 
         const totalResponseTime = Date.now() - startTime
 
-        // Calculate health score (0-100)
         const healthScore = Math.round(
             ((results.summary.healthy + results.summary.degraded * 0.5) / results.summary.total) * 100
         )
 
-        // If overall status is unhealthy, return HTTP 500
-        if (overallStatus === 'unhealthy') {
-            const responseData = {
-                status: overallStatus,
-                service: 'peanut-protocol',
-                timestamp: new Date().toISOString(),
-                responseTime: totalResponseTime,
-                healthScore,
-                summary: results.summary,
-                services: results.services,
-                systemInfo: {
-                    environment: process.env.NODE_ENV,
-                    version: process.env.npm_package_version || 'unknown',
-                    region: process.env.VERCEL_REGION || 'unknown',
-                },
-            }
+        const responseData = {
+            status: overallStatus,
+            service: 'peanut-protocol',
+            timestamp: new Date().toISOString(),
+            responseTime: totalResponseTime,
+            healthScore,
+            summary: results.summary,
+            services: results.services,
+            systemInfo: {
+                environment: process.env.NODE_ENV,
+                version: process.env.npm_package_version || 'unknown',
+                region: process.env.VERCEL_REGION || 'unknown',
+            },
+        }
 
-            // Send Discord notification asynchronously (don't await to avoid delaying the response)
+        if (overallStatus === 'unhealthy') {
             sendDiscordNotification(responseData).catch(console.error)
-
-            return NextResponse.json(responseData, {
-                status: 500,
-                headers: {
-                    'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
-                    Pragma: 'no-cache',
-                    Expires: '0',
-                    'Surrogate-Control': 'no-store',
-                },
-            })
+            return NextResponse.json(responseData, { status: 500, headers: NO_CACHE_HEADERS })
         }
 
-        return NextResponse.json(
-            {
-                status: overallStatus,
-                service: 'peanut-protocol',
-                timestamp: new Date().toISOString(),
-                responseTime: totalResponseTime,
-                healthScore,
-                summary: results.summary,
-                services: results.services,
-                systemInfo: {
-                    environment: process.env.NODE_ENV,
-                    version: process.env.npm_package_version || 'unknown',
-                    region: process.env.VERCEL_REGION || 'unknown',
-                },
-            },
-            {
-                status: 200,
-                headers: {
-                    'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
-                    Pragma: 'no-cache',
-                    Expires: '0',
-                    'Surrogate-Control': 'no-store',
-                },
-            }
-        )
+        return NextResponse.json(responseData, { status: 200, headers: NO_CACHE_HEADERS })
     } catch (error) {
         const totalResponseTime = Date.now() - startTime
 
@@ -252,15 +243,7 @@ export async function GET() {
                 responseTime: totalResponseTime,
                 healthScore: 0,
             },
-            {
-                status: 500,
-                headers: {
-                    'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
-                    Pragma: 'no-cache',
-                    Expires: '0',
-                    'Surrogate-Control': 'no-store',
-                },
-            }
+            { status: 500, headers: NO_CACHE_HEADERS }
         )
     }
 }
diff --git a/src/app/api/health/rpc/route.ts b/src/app/api/health/rpc/route.ts
index 3f06a4196f..59a57691c2 100644
--- a/src/app/api/health/rpc/route.ts
+++ b/src/app/api/health/rpc/route.ts
@@ -1,4 +1,3 @@
-import { fetchWithSentry } from '@/utils/sentry.utils'
 import { NextResponse } from 'next/server'
 import { rpcUrls } from '@/constants/general.consts'
 
@@ -6,9 +5,18 @@ const INFURA_API_KEY = process.env.NEXT_PUBLIC_INFURA_API_KEY
 const ALCHEMY_API_KEY = process.env.NEXT_PUBLIC_ALCHEMY_API_KEY
 
 /**
- * Health check for RPC providers (Infura, Alchemy)
- * Tests connectivity across multiple chains
+ * Health check for RPC providers across key chains.
+ *
+ * Critical chains (Ethereum, Arbitrum) failing → system unhealthy.
+ * Non-critical chains (Polygon) failing → system degraded (not unhealthy).
+ *
+ * Uses plain fetch to avoid polluting Sentry with expected health check failures.
  */
+
+// Chains that must be healthy for the system to be considered healthy.
+// If a critical chain has zero healthy providers, overall status = unhealthy.
+const CRITICAL_CHAINS = new Set([1, 42161]) // Ethereum, Arbitrum
+
 export async function GET() {
     const startTime = Date.now()
 
@@ -28,130 +36,151 @@ export async function GET() {
 
         const chainResults: any = {}
 
-        // Test key chains: Ethereum mainnet, Arbitrum, Polygon
         const chainsToTest = [
             { id: 1, name: 'ethereum' },
             { id: 42161, name: 'arbitrum' },
             { id: 137, name: 'polygon' },
         ]
 
-        for (const chain of chainsToTest) {
-            const chainRpcs = rpcUrls[chain.id] || []
-            chainResults[chain.name] = {
-                chainId: chain.id,
-                providers: {},
-                overallStatus: 'unknown',
-            }
+        // Test all chains in parallel for faster response
+        await Promise.all(
+            chainsToTest.map(async (chain) => {
+                const chainRpcs = rpcUrls[chain.id] || []
+                chainResults[chain.name] = {
+                    chainId: chain.id,
+                    critical: CRITICAL_CHAINS.has(chain.id),
+                    providers: {},
+                    overallStatus: 'unknown',
+                }
 
-            for (let i = 0; i < chainRpcs.length; i++) {
-                const rpcUrl = chainRpcs[i]
-                const providerName = rpcUrl.includes('infura')
-                    ? 'infura'
-                    : rpcUrl.includes('alchemy')
-                      ? 'alchemy'
-                      : rpcUrl.includes('bnbchain')
-                        ? 'binance'
-                        : `provider_${i}`
-
-                const rpcTestStart = Date.now()
-
-                try {
-                    const response = await fetchWithSentry(rpcUrl, {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json',
-                        },
-                        body: JSON.stringify({
-                            jsonrpc: '2.0',
-                            method: 'eth_blockNumber',
-                            params: [],
-                            id: 1,
-                        }),
+                // Test all providers for this chain in parallel
+                await Promise.all(
+                    chainRpcs.map(async (rpcUrl, i) => {
+                        const providerName = rpcUrl.includes('infura')
+                            ? 'infura'
+                            : rpcUrl.includes('alchemy')
+                              ? 'alchemy'
+                              : rpcUrl.includes('chainstack')
+                                ? 'chainstack'
+                                : rpcUrl.includes('publicnode')
+                                  ? 'publicnode'
+                                  : rpcUrl.includes('ankr')
+                                    ? 'ankr'
+                                    : rpcUrl.includes('bnbchain')
+                                      ? 'binance'
+                                      : `provider_${i}`
+
+                        const rpcTestStart = Date.now()
+
+                        try {
+                            const response = await fetch(rpcUrl, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({
+                                    jsonrpc: '2.0',
+                                    method: 'eth_blockNumber',
+                                    params: [],
+                                    id: 1,
+                                }),
+                                signal: AbortSignal.timeout(5000), // 5s per provider
+                            })
+
+                            const responseTime = Date.now() - rpcTestStart
+
+                            if (response.ok) {
+                                const data = await response.json()
+                                const blockNumber = data?.result ? parseInt(data.result, 16) : null
+
+                                chainResults[chain.name].providers[providerName] = {
+                                    status: blockNumber ? 'healthy' : 'degraded',
+                                    responseTime,
+                                    blockNumber,
+                                    url: sanitizeUrl(rpcUrl),
+                                }
+                            } else {
+                                chainResults[chain.name].providers[providerName] = {
+                                    status: 'unhealthy',
+                                    responseTime,
+                                    httpStatus: response.status,
+                                    url: sanitizeUrl(rpcUrl),
+                                }
+                            }
+                        } catch (error) {
+                            chainResults[chain.name].providers[providerName] = {
+                                status: 'unhealthy',
+                                responseTime: Date.now() - rpcTestStart,
+                                error: error instanceof Error ? error.message : 'Unknown error',
+                                url: sanitizeUrl(rpcUrl),
+                            }
+                        }
                     })
+                )
+
+                // Determine chain overall status
+                const chainProviders = Object.values(chainResults[chain.name].providers) as any[]
+                const healthyCount = chainProviders.filter((p) => p.status === 'healthy').length
+                const degradedCount = chainProviders.filter((p) => p.status === 'degraded').length
+                const unhealthyCount = chainProviders.length - healthyCount - degradedCount
+
+                if (healthyCount > 0) {
+                    chainResults[chain.name].overallStatus = 'healthy'
+                } else if (degradedCount > 0) {
+                    chainResults[chain.name].overallStatus = 'degraded'
+                } else {
+                    chainResults[chain.name].overallStatus = 'unhealthy'
+                }
 
-                    const responseTime = Date.now() - rpcTestStart
-
-                    if (response.ok) {
-                        const data = await response.json()
-                        const blockNumber = data?.result ? parseInt(data.result, 16) : null
-
-                        chainResults[chain.name].providers[providerName] = {
-                            status: blockNumber ? 'healthy' : 'degraded',
-                            responseTime,
-                            blockNumber,
-                            url: rpcUrl.replace(/(api_key|api-key)=[^&]+/g, 'api_key=***'), // Hide API key
-                        }
-                    } else {
-                        chainResults[chain.name].providers[providerName] = {
-                            status: 'unhealthy',
-                            responseTime,
-                            httpStatus: response.status,
-                            url: rpcUrl.replace(/(api_key|api-key)=[^&]+/g, 'api_key=***'),
-                        }
-                    }
-                } catch (error) {
-                    chainResults[chain.name].providers[providerName] = {
-                        status: 'unhealthy',
-                        responseTime: Date.now() - rpcTestStart,
-                        error: error instanceof Error ? error.message : 'Unknown error',
-                        url: rpcUrl.replace(/(api_key|api-key)=[^&]+/g, 'api_key=***'),
-                    }
+                chainResults[chain.name].summary = {
+                    total: chainProviders.length,
+                    healthy: healthyCount,
+                    degraded: degradedCount,
+                    unhealthy: unhealthyCount,
                 }
-            }
+            })
+        )
 
-            // Determine chain overall status
-            const chainProviders = Object.values(chainResults[chain.name].providers)
-            const healthyProviders = chainProviders.filter((p: any) => p.status === 'healthy')
-            const degradedProviders = chainProviders.filter((p: any) => p.status === 'degraded')
-
-            if (healthyProviders.length > 0) {
-                chainResults[chain.name].overallStatus = 'healthy'
-            } else if (degradedProviders.length > 0) {
-                chainResults[chain.name].overallStatus = 'degraded'
-            } else {
-                chainResults[chain.name].overallStatus = 'unhealthy'
-            }
+        // Determine overall status with critical vs non-critical distinction
+        let overallStatus = 'healthy'
+        let hasCriticalFailure = false
+        let hasNonCriticalFailure = false
 
-            chainResults[chain.name].summary = {
-                total: chainProviders.length,
-                healthy: healthyProviders.length,
-                degraded: degradedProviders.length,
-                unhealthy: chainProviders.length - healthyProviders.length - degradedProviders.length,
+        for (const chain of chainsToTest) {
+            const status = chainResults[chain.name].overallStatus
+            if (status === 'unhealthy') {
+                if (CRITICAL_CHAINS.has(chain.id)) {
+                    hasCriticalFailure = true
+                } else {
+                    hasNonCriticalFailure = true
+                }
             }
         }
 
-        // Determine overall RPC health
-        const chainStatuses = Object.values(chainResults).map((chain: any) => chain.overallStatus)
-        const hasUnhealthyChain = chainStatuses.includes('unhealthy')
-        const hasDegradedChain = chainStatuses.includes('degraded')
-
-        let overallStatus = 'healthy'
-        if (hasUnhealthyChain) {
+        if (hasCriticalFailure) {
             overallStatus = 'unhealthy'
-        } else if (hasDegradedChain) {
+        } else if (hasNonCriticalFailure) {
             overallStatus = 'degraded'
         }
 
-        // If any critical chain is unhealthy, return HTTP 500
-        if (overallStatus === 'unhealthy') {
-            throw new Error(`Critical RPC providers unavailable. Chains status: ${chainStatuses.join(', ')}`)
-        }
-
         const totalResponseTime = Date.now() - startTime
 
-        return NextResponse.json({
-            status: overallStatus,
-            service: 'rpc',
-            timestamp: new Date().toISOString(),
-            responseTime: totalResponseTime,
-            details: {
-                chains: chainResults,
-                configuration: {
-                    infuraConfigured: !!INFURA_API_KEY,
-                    alchemyConfigured: !!ALCHEMY_API_KEY,
+        const responseCode = overallStatus === 'unhealthy' ? 500 : 200
+
+        return NextResponse.json(
+            {
+                status: overallStatus,
+                service: 'rpc',
+                timestamp: new Date().toISOString(),
+                responseTime: totalResponseTime,
+                details: {
+                    chains: chainResults,
+                    configuration: {
+                        infuraConfigured: !!INFURA_API_KEY,
+                        alchemyConfigured: !!ALCHEMY_API_KEY,
+                    },
                 },
             },
-        })
+            { status: responseCode }
+        )
     } catch (error) {
         const totalResponseTime = Date.now() - startTime
 
@@ -167,3 +196,12 @@ export async function GET() {
         )
     }
 }
+
+/** Strip API keys from URLs for safe logging */
+function sanitizeUrl(url: string): string {
+    return url
+        .replace(/\/v3\/[a-f0-9]+/g, '/v3/***') // Infura
+        .replace(/\/v2\/[a-zA-Z0-9_-]+/g, '/v2/***') // Alchemy
+        .replace(/\/[a-f0-9]{32,}/g, '/***') // Chainstack and other hex keys
+        .replace(/(api_key|api-key|apikey)=[^&]+/g, '$1=***')
+}
diff --git a/src/app/api/health/zerodev/route.ts b/src/app/api/health/zerodev/route.ts
index de604d3dca..bc7c33fbcf 100644
--- a/src/app/api/health/zerodev/route.ts
+++ b/src/app/api/health/zerodev/route.ts
@@ -1,22 +1,26 @@
 import { NextResponse } from 'next/server'
-import { fetchWithSentry } from '@/utils/sentry.utils'
 
 /**
  * ZeroDev health check endpoint
- * Tests bundler and paymaster services for supported chains
+ * Tests bundler and paymaster services for Arbitrum (the only chain using ZeroDev in production).
+ *
+ * Uses `eth_supportedEntryPoints` for the bundler — this is a mandatory ERC-4337 method
+ * that all compliant bundlers must support. Previous `eth_chainId` calls returned 400 on
+ * some bundlers since it's not part of the ERC-4337 spec.
+ *
+ * Paymaster is tested with `eth_chainId` and treats any response < 503 as healthy,
+ * since paymasters may return 400/500 for bare RPC calls while still being operational.
+ *
+ * Uses plain fetch (not fetchWithSentry) to avoid health check failures polluting Sentry.
  */
 export async function GET() {
     const startTime = Date.now()
 
     try {
-        // Get configuration from environment variables (same as zerodev.consts.ts)
         const BUNDLER_URL = process.env.NEXT_PUBLIC_ZERO_DEV_BUNDLER_URL
         const PAYMASTER_URL = process.env.NEXT_PUBLIC_ZERO_DEV_PAYMASTER_URL
         const PROJECT_ID = process.env.NEXT_PUBLIC_ZERO_DEV_PASSKEY_PROJECT_ID
-        const POLYGON_BUNDLER_URL = process.env.NEXT_PUBLIC_POLYGON_BUNDLER_URL
-        const POLYGON_PAYMASTER_URL = process.env.NEXT_PUBLIC_POLYGON_PAYMASTER_URL
 
-        // Check configuration
         if (!BUNDLER_URL || !PAYMASTER_URL || !PROJECT_ID) {
             return NextResponse.json(
                 {
@@ -31,46 +35,113 @@ export async function GET() {
         }
 
         const results: any = {
-            arbitrum: {},
-            polygon: {},
+            arbitrum: { bundler: {}, paymaster: {} },
             configuration: {
-                projectId: PROJECT_ID ? 'configured' : 'missing',
-                bundlerUrl: BUNDLER_URL ? 'configured' : 'missing',
-                paymasterUrl: PAYMASTER_URL ? 'configured' : 'missing',
-                polygonBundlerUrl: POLYGON_BUNDLER_URL ? 'configured' : 'missing',
-                polygonPaymasterUrl: POLYGON_PAYMASTER_URL ? 'configured' : 'missing',
+                projectId: 'configured',
+                bundlerUrl: 'configured',
+                paymasterUrl: 'configured',
             },
         }
 
-        // Test Arbitrum endpoints
-        await testChainEndpoints('arbitrum', BUNDLER_URL, PAYMASTER_URL, results)
+        // Test Arbitrum bundler with eth_supportedEntryPoints (mandatory ERC-4337 method)
+        const bundlerTestStart = Date.now()
+        try {
+            const bundlerResponse = await fetch(BUNDLER_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    method: 'eth_supportedEntryPoints',
+                    params: [],
+                    id: 1,
+                }),
+            })
+
+            const bundlerResponseTime = Date.now() - bundlerTestStart
+
+            // Any HTTP response means the bundler is reachable.
+            // 200 = fully healthy, 4xx = reachable but method issue (still alive), 5xx = server error
+            if (bundlerResponse.ok) {
+                const bundlerData = await bundlerResponse.json()
+                results.arbitrum.bundler = {
+                    status: 'healthy',
+                    responseTime: bundlerResponseTime,
+                    httpStatus: bundlerResponse.status,
+                    entryPoints: bundlerData?.result,
+                }
+            } else if (bundlerResponse.status < 500) {
+                // 4xx means the endpoint is reachable but rejected the call — degraded, not dead
+                results.arbitrum.bundler = {
+                    status: 'degraded',
+                    responseTime: bundlerResponseTime,
+                    httpStatus: bundlerResponse.status,
+                    message: 'Bundler reachable but returned client error',
+                }
+            } else {
+                results.arbitrum.bundler = {
+                    status: 'unhealthy',
+                    responseTime: bundlerResponseTime,
+                    httpStatus: bundlerResponse.status,
+                }
+            }
+        } catch (error) {
+            results.arbitrum.bundler = {
+                status: 'unhealthy',
+                responseTime: Date.now() - bundlerTestStart,
+                error: error instanceof Error ? error.message : 'Unknown error',
+            }
+        }
+
+        // Test Arbitrum paymaster
+        const paymasterTestStart = Date.now()
+        try {
+            const paymasterResponse = await fetch(PAYMASTER_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    method: 'eth_chainId',
+                    params: [],
+                    id: 1,
+                }),
+            })
+
+            const paymasterResponseTime = Date.now() - paymasterTestStart
+
+            // Paymaster often returns 400/500 for basic RPC calls — that's expected.
+            // Only mark unhealthy if we can't reach it at all (503+) or network error.
+            results.arbitrum.paymaster = {
+                status: paymasterResponse.status < 503 ? 'healthy' : 'unhealthy',
+                responseTime: paymasterResponseTime,
+                httpStatus: paymasterResponse.status,
+            }
 
-        // Test Polygon endpoints (if configured)
-        if (POLYGON_BUNDLER_URL && POLYGON_PAYMASTER_URL) {
-            await testChainEndpoints('polygon', POLYGON_BUNDLER_URL, POLYGON_PAYMASTER_URL, results)
-        } else {
-            results.polygon = {
-                status: 'not_configured',
-                message: 'Polygon ZeroDev services not configured',
+            if (paymasterResponse.ok) {
+                const paymasterData = await paymasterResponse.json()
+                results.arbitrum.paymaster.chainId = paymasterData?.result
+            }
+        } catch (error) {
+            results.arbitrum.paymaster = {
+                status: 'unhealthy',
+                responseTime: Date.now() - paymasterTestStart,
+                error: error instanceof Error ? error.message : 'Unknown error',
             }
         }
 
-        // Determine overall status
+        // Determine overall status — only Arbitrum matters for production
+        const bundlerOk =
+            results.arbitrum.bundler.status === 'healthy' || results.arbitrum.bundler.status === 'degraded'
+        const paymasterOk = results.arbitrum.paymaster.status === 'healthy'
+
         let overallStatus = 'healthy'
-        const arbitrumHealthy =
-            results.arbitrum.bundler?.status === 'healthy' && results.arbitrum.paymaster?.status === 'healthy'
-        const polygonHealthy =
-            results.polygon.status === 'not_configured' ||
-            (results.polygon.bundler?.status === 'healthy' && results.polygon.paymaster?.status === 'healthy')
-
-        if (!arbitrumHealthy || !polygonHealthy) {
-            // If any critical service is down, mark as unhealthy
+        if (!bundlerOk || !paymasterOk) {
             overallStatus = 'unhealthy'
+        } else if (results.arbitrum.bundler.status === 'degraded') {
+            overallStatus = 'degraded'
         }
 
         const responseTime = Date.now() - startTime
 
-        // Return 500 if unhealthy
         if (overallStatus === 'unhealthy') {
             return NextResponse.json(
                 {
@@ -92,92 +163,15 @@ export async function GET() {
             details: results,
         })
     } catch (error) {
-        const responseTime = Date.now() - startTime
-
         return NextResponse.json(
             {
                 status: 'unhealthy',
                 service: 'zerodev',
                 timestamp: new Date().toISOString(),
                 error: error instanceof Error ? error.message : 'Unknown error',
-                responseTime,
+                responseTime: Date.now() - startTime,
             },
             { status: 500 }
         )
     }
 }
-
-async function testChainEndpoints(chainName: string, bundlerUrl: string, paymasterUrl: string, results: any) {
-    results[chainName] = {
-        bundler: {},
-        paymaster: {},
-    }
-
-    // Test Bundler - using a simple JSON-RPC call that bundlers should support
-    const bundlerTestStart = Date.now()
-    try {
-        const bundlerResponse = await fetchWithSentry(bundlerUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                method: 'eth_chainId',
-                params: [],
-                id: 1,
-            }),
-        })
-
-        results[chainName].bundler = {
-            status: bundlerResponse.ok ? 'healthy' : 'unhealthy',
-            responseTime: Date.now() - bundlerTestStart,
-            httpStatus: bundlerResponse.status,
-        }
-
-        if (bundlerResponse.ok) {
-            const bundlerData = await bundlerResponse.json()
-            results[chainName].bundler.chainId = bundlerData?.result
-        }
-    } catch (error) {
-        results[chainName].bundler = {
-            status: 'unhealthy',
-            responseTime: Date.now() - bundlerTestStart,
-            error: error instanceof Error ? error.message : 'Unknown error',
-        }
-    }
-
-    // Test Paymaster - using a simple JSON-RPC call
-    const paymasterTestStart = Date.now()
-    try {
-        const paymasterResponse = await fetchWithSentry(paymasterUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                method: 'eth_chainId',
-                params: [],
-                id: 1,
-            }),
-        })
-
-        results[chainName].paymaster = {
-            status: paymasterResponse.status >= 200 && paymasterResponse.status < 503 ? 'healthy' : 'unhealthy', // 500 is expected for basic calls
-            responseTime: Date.now() - paymasterTestStart,
-            httpStatus: paymasterResponse.status,
-        }
-
-        if (paymasterResponse.ok) {
-            const paymasterData = await paymasterResponse.json()
-            results[chainName].paymaster.chainId = paymasterData?.result
-        }
-    } catch (error) {
-        results[chainName].paymaster = {
-            status: 'unhealthy',
-            responseTime: Date.now() - paymasterTestStart,
-            error: error instanceof Error ? error.message : 'Unknown error',
-        }
-    }
-}
diff --git a/src/constants/general.consts.ts b/src/constants/general.consts.ts
index 074820bc60..c997c2ea9a 100644
--- a/src/constants/general.consts.ts
+++ b/src/constants/general.consts.ts
@@ -42,6 +42,8 @@ export const rpcUrls: Record<number, string[]> = {
         infuraUrl('polygon-mainnet'),
         alchemyUrl('polygon-mainnet'),
         'https://polygon-rpc.com', // Official public RPC
+        'https://polygon-bor-rpc.publicnode.com', // Public fallback
+        'https://rpc.ankr.com/polygon', // Public fallback
     ].filter(Boolean) as string[],
     [optimism.id]: [
         infuraUrl('optimism-mainnet'),

From e30efbeab3be837b0473c16442c7f711c1d255bd Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Thu, 19 Mar 2026 14:26:55 +0000
Subject: [PATCH 18/22] style: fix prettier formatting on backend health check

---
 src/app/api/health/backend/route.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/app/api/health/backend/route.ts b/src/app/api/health/backend/route.ts
index 892e0d504a..b4d2cd9f0f 100644
--- a/src/app/api/health/backend/route.ts
+++ b/src/app/api/health/backend/route.ts
@@ -46,9 +46,7 @@ export async function GET() {
 
         if (!backendResponse.ok) {
             const errorData = await backendResponse.json().catch(() => null)
-            throw new Error(
-                errorData?.error || `Backend /healthz returned ${backendResponse.status}`
-            )
+            throw new Error(errorData?.error || `Backend /healthz returned ${backendResponse.status}`)
         }
 
         const healthData = await backendResponse.json()

From 815d005875fdd174038034ee11288e246d12ce10 Mon Sep 17 00:00:00 2001
From: Hugo Montenegro <h@hugo0.com>
Date: Thu, 19 Mar 2026 15:26:38 +0000
Subject: [PATCH 19/22] fix: add 5s timeout to ZeroDev health check fetches

Bundler and paymaster fetch calls had no timeout, unlike other health
routes (backend 8s, RPC 5s). A hanging ZeroDev endpoint could stall
the entire health check until the Vercel function timeout.
---
 src/app/api/health/zerodev/route.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/app/api/health/zerodev/route.ts b/src/app/api/health/zerodev/route.ts
index bc7c33fbcf..c360c8f1a2 100644
--- a/src/app/api/health/zerodev/route.ts
+++ b/src/app/api/health/zerodev/route.ts
@@ -49,6 +49,7 @@ export async function GET() {
             const bundlerResponse = await fetch(BUNDLER_URL, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
+                signal: AbortSignal.timeout(5000),
                 body: JSON.stringify({
                     jsonrpc: '2.0',
                     method: 'eth_supportedEntryPoints',
@@ -98,6 +99,7 @@ export async function GET() {
             const paymasterResponse = await fetch(PAYMASTER_URL, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
+                signal: AbortSignal.timeout(5000),
                 body: JSON.stringify({
                     jsonrpc: '2.0',
                     method: 'eth_chainId',

From f1f0db64ef17131fb3cb6f3c6708d410eefd38f8 Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Fri, 20 Mar 2026 06:10:08 +0000
Subject: [PATCH 20/22] feat: add /presskit and /press-kit redirect to Notion
 press kit

---
 redirects.json | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/redirects.json b/redirects.json
index 7d110d33c2..edac41e567 100644
--- a/redirects.json
+++ b/redirects.json
@@ -21,7 +21,12 @@
     },
     {
         "source": "/:path*",
-        "has": [{ "type": "host", "value": "docs.peanut.me" }],
+        "has": [
+            {
+                "type": "host",
+                "value": "docs.peanut.me"
+            }
+        ],
         "destination": "https://peanut.me/en/help",
         "permanent": true
     },
@@ -74,5 +79,15 @@
         "source": "/seedlings",
         "destination": "https://peanutprotocol.notion.site/Influencer-information-form-2af8381175798067b271cd95a04d922a",
         "permanent": false
+    },
+    {
+        "source": "/presskit",
+        "destination": "https://peanutprotocol.notion.site/Press-Kit-12f83811757981fc9ca5de581b20f50d",
+        "permanent": true
+    },
+    {
+        "source": "/press-kit",
+        "destination": "https://peanutprotocol.notion.site/Press-Kit-12f83811757981fc9ca5de581b20f50d",
+        "permanent": true
     }
 ]

From f8c3190ec5b76646655d71357698c60de1157f3f Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Fri, 20 Mar 2026 10:55:09 +0000
Subject: [PATCH 21/22] fix: add app routes to link validator allowlist

---
 scripts/validate-links.ts | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/scripts/validate-links.ts b/scripts/validate-links.ts
index 430868946b..8f732bdd4e 100644
--- a/scripts/validate-links.ts
+++ b/scripts/validate-links.ts
@@ -42,6 +42,24 @@ function buildValidPaths(): Set<string> {
         paths.add(p)
     }
 
+    // App routes (behind auth / mobile-ui) — content may link to these
+    for (const p of [
+        '/profile',
+        '/profile/backup',
+        '/profile/edit',
+        '/profile/exchange-rate',
+        '/profile/identity-verification',
+        '/home',
+        '/send',
+        '/request',
+        '/settings',
+        '/history',
+        '/points',
+        '/recover-funds',
+    ]) {
+        paths.add(p)
+    }
+
     const countrySlugs = listDirs(path.join(CONTENT_DIR, 'countries'))
     const competitorSlugs = listDirs(path.join(CONTENT_DIR, 'compare'))
     const payWithSlugs = listDirs(path.join(CONTENT_DIR, 'pay-with'))

From d4ec4d7dd6921ba1ed3fc7e8152d10b6c14ee4c4 Mon Sep 17 00:00:00 2001
From: "chip-peanut-bot[bot]"
 <262992217+chip-peanut-bot[bot]@users.noreply.github.com>
Date: Fri, 20 Mar 2026 19:36:42 +0000
Subject: [PATCH 22/22] fix: add stories routes to link validator

The validate-links script had no knowledge of /stories/ routes.
Since peanut-content PR #16 added story pages with internal links
to /stories/{slug}, every content PR now fails CI.

Adds /{locale}/stories and /{locale}/stories/{slug} patterns,
derived from content/stories/ directory like other route types.
---
 scripts/validate-links.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/scripts/validate-links.ts b/scripts/validate-links.ts
index 430868946b..3a04b4a077 100644
--- a/scripts/validate-links.ts
+++ b/scripts/validate-links.ts
@@ -48,6 +48,7 @@ function buildValidPaths(): Set<string> {
     const depositSlugs = listDirs(path.join(CONTENT_DIR, 'deposit'))
     const helpSlugs = listDirs(path.join(CONTENT_DIR, 'help'))
     const useCaseSlugs = listDirs(path.join(CONTENT_DIR, 'use-cases'))
+    const storySlugs = listDirs(path.join(CONTENT_DIR, 'stories')).filter((s) => s !== 'index')
     const withdrawSlugs = listDirs(path.join(CONTENT_DIR, 'withdraw'))
     const exchangeSlugs = listEntitySlugs('exchanges')
 
@@ -117,6 +118,14 @@ function buildValidPaths(): Set<string> {
             paths.add(`/${locale}/use-cases/${slug}`)
         }
 
+        // Stories: /{locale}/stories and /{locale}/stories/{slug}
+        if (storySlugs.length > 0) {
+            paths.add(`/${locale}/stories`)
+            for (const slug of storySlugs) {
+                paths.add(`/${locale}/stories/${slug}`)
+            }
+        }
+
         // Withdraw: /{locale}/withdraw/{slug}
         for (const slug of withdrawSlugs) {
             paths.add(`/${locale}/withdraw/to-${slug}`)