chore(mobile-release): sync main + localization/ESLint cleanup for the next build

android/app/src/main/AndroidManifest.xml

@@ -59,6 +59,14 @@
                 <data android:pathPrefix="/withdraw/" />
                 <data android:path="/receipt" />
                 <data android:pathPrefix="/receipt/" />
+                <data android:path="/history" />
+                <data android:pathPrefix="/history/" />
+                <data android:path="/rewards" />
+                <data android:pathPrefix="/rewards/" />
+                <data android:path="/badges" />
+                <data android:pathPrefix="/badges/" />
+                <data android:path="/profile" />
+                <data android:pathPrefix="/profile/" />
             </intent-filter>
 
         </activity>
@@ -78,6 +86,15 @@
         <meta-data
             android:name="asset_statements"
             android:resource="@string/capacitor_passkey_asset_statements" />
+
+        <!-- Don't let OneSignal fire its own ACTION_VIEW for a notification's
+             launch URL. The tap opens the app and useNativePlugins routes on the
+             deep link in-app instead — which covers destinations outside the App
+             Links filter above, doesn't depend on link verification, and keeps
+             iOS and Android on the same code path. -->
+        <meta-data
+            android:name="com.onesignal.suppressLaunchURLs"
+            android:value="true" />
     </application>
 
     <!-- Phone-only: require a telephony radio so Play filters out Wi-Fi-only

eslint.config.js

@@ -85,6 +85,8 @@ module.exports = [
             'react/prop-types': 'off',
             // Allow unescaped quotes — too noisy and prettier handles spacing
             'react/no-unescaped-entities': 'off',
+            // `jsx`/`global` are styled-jsx's <style> attributes (built into Next), not DOM props.
+            'react/no-unknown-property': ['error', { ignore: ['jsx', 'global'] }],
 
             // Ban barrel imports — see BANNED_BARREL_PATHS above.
             'no-restricted-imports': [
@@ -162,8 +164,37 @@ module.exports = [
     {
         // require() inside test bodies is the Jest idiom for reading mocks after
         // jest.mock()/resetModules(); hoisting them to imports changes semantics.
-        files: ['src/**/__tests__/**/*.{ts,tsx}', 'src/**/*.test.{ts,tsx}'],
-        rules: { '@typescript-eslint/no-require-imports': 'off' },
+        // no-img-element: these files mock next/image down to a raw <img>.
+        // no-explicit-any: mocks and partial fixtures legitimately cast through
+        // `any` — production code keeps the ban.
+        files: ['src/**/__tests__/**/*.{ts,tsx}', 'src/**/*.test.{ts,tsx}', 'src/**/__mocks__/**/*.{ts,tsx}'],
+        rules: {
+            '@typescript-eslint/no-require-imports': 'off',
+            '@next/next/no-img-element': 'off',
+            '@typescript-eslint/no-explicit-any': 'off',
+        },
+    },
+    {
+        // Dev-only tooling: /dev pages, the window.debug console cheats, and the
+        // InvitesGraph debug visualization. The cheat API is intrinsically dynamic
+        // and d3/force-graph mutate node objects at runtime — typing them buys no
+        // user-facing safety. Production code keeps the any ban.
+        files: ['src/app/(mobile-ui)/dev/**', 'src/context/PeanutDebug.tsx', 'src/components/Global/InvitesGraph/**'],
+        rules: { '@typescript-eslint/no-explicit-any': 'off' },
+    },
+    {
+        // OG images render through Satori (next/og ImageResponse), which supports
+        // only a subset of HTML/CSS and cannot render next/image — raw <img> with
+        // explicit width/height is the required form here, not an oversight.
+        files: ['src/components/og/**', 'src/app/api/og/**'],
+        rules: { '@next/next/no-img-element': 'off' },
+    },
+    {
+        // Rasterized to PNG by html-to-image (see share-asset/captureShareAsset.ts).
+        // next/image's lazy loading and wrapper markup break the capture — the same
+        // class of bug as the runtime <canvas> that file already documents.
+        files: ['src/components/Card/share-asset/**', 'src/components/Global/ImageGeneration/**'],
+        rules: { '@next/next/no-img-element': 'off' },
     },
     {
         // Localization guard: product-UI copy must come from next-intl, not JSX
@@ -192,6 +223,9 @@ module.exports = [
             'src/components/Global/{PeanutLoading,Icons,Badges}/**',
             // InvitesGraph is a /dev-only debug visualization, not user-facing UI.
             'src/components/Global/InvitesGraph/**',
+            // Hidden support tool — never linked in-app; support DMs the URL to
+            // affected users, so the copy stays English-only.
+            'src/app/(mobile-ui)/fix-card-signature/**',
         ],
         rules: {
             'react/jsx-no-literals': [

ios/App/App/Info.plist

@@ -49,6 +49,12 @@
 	<string>Peanut may use your location to help verify your identity and prevent fraud during account setup and support.</string>
 	<key>ITSAppUsesNonExemptEncryption</key>
 	<false/>
+	<!-- Stop OneSignal calling openURL for a notification's launch URL. iOS won't
+	     re-enter this app for its own universal link, so without this a tapped push
+	     bounces the user out to Safari. useNativePlugins routes the deep link in-app
+	     from the click listener instead. -->
+	<key>OneSignal_suppress_launch_urls</key>
+	<true/>
 	<key>UILaunchStoryboardName</key>
 	<string>LaunchScreen</string>
 	<key>UIMainStoryboardFile</key>

next.config.js

@@ -5,6 +5,97 @@ const withBundleAnalyzer =
 
 const redirectsConfig = require('./redirects.json')
 
+/**
+ * Sentry's CSP-report ingest endpoint, derived from the browser DSN
+ * (`<protocol>://<publicKey>@<host><path>/<projectId>`). Returns null when the
+ * DSN is absent or malformed, in which case the policy still ships — it just
+ * has nowhere to report, which is better than emitting a broken `report-uri`.
+ *
+ * Protocol and any path prefix are preserved: self-hosted Sentry is commonly
+ * mounted under a sub-path, and flattening one would silently post reports to
+ * an endpoint that doesn't exist.
+ */
+function sentryCspReportUri() {
+    const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN
+    if (!dsn) return null
+    try {
+        const { protocol, host, username, pathname } = new URL(dsn)
+        const segments = pathname.split('/').filter(Boolean)
+        const projectId = segments.pop()
+        if (!host || !username || !projectId) return null
+        const prefix = segments.length ? `/${segments.join('/')}` : ''
+        return `${protocol}//${host}${prefix}/api/${projectId}/security/?sentry_key=${username}`
+    } catch {
+        return null
+    }
+}
+
+/**
+ * First-draft CSP, shipped REPORT-ONLY.
+ *
+ * Nothing here is enforced yet: the app currently has no script-src at all, so
+ * an XSS anywhere is unconstrained. Guessing the allow-list and enforcing it
+ * would blank the app; instead this collects violation reports from real
+ * traffic until the list is known to be complete, then it gets promoted to the
+ * enforcing `Content-Security-Policy` header.
+ *
+ * Known-loose parts, to tighten before promotion:
+ * - `'unsafe-inline'` / `'unsafe-eval'` in script-src: Next's inline bootstrap
+ *   and the wallet SDKs need them today. Moving to nonces is its own change.
+ * - connect-src can't enumerate every chain RPC (they come from env and vary by
+ *   network), so the report stream is what completes this list.
+ */
+function contentSecurityPolicyReportOnly() {
+    const reportUri = sentryCspReportUri()
+    const directives = [
+        "default-src 'self'",
+        // PostHog is same-origin via the /relay rewrite, so it needs no entry here.
+        "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://client.crisp.chat https://static.sumsub.com",
+        "style-src 'self' 'unsafe-inline' https://client.crisp.chat",
+        "img-src 'self' data: blob: https:",
+        "font-src 'self' data: https://client.crisp.chat",
+        [
+            "connect-src 'self'",
+            'https://api.peanut.me',
+            'https://*.peanut.me',
+            'https://*.ingest.sentry.io',
+            'https://*.ingest.us.sentry.io',
+            'https://www.google-analytics.com',
+            'https://rpc.zerodev.app',
+            'https://*.g.alchemy.com',
+            'https://rpc.ankr.com',
+            'https://assets.coingecko.com',
+            'https://coin-images.coingecko.com',
+            'https://api.frankfurter.app',
+            'https://dolarapi.com',
+            'https://client.crisp.chat',
+            'wss://client.relay.crisp.chat',
+            'https://*.sumsub.com',
+            'https://widget.manteca.dev',
+        ].join(' '),
+        "frame-src 'self' https://client.crisp.chat https://*.sumsub.com https://widget.manteca.dev https://mpago.la",
+        "worker-src 'self' blob:",
+        "object-src 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+    ]
+    // Both delivery mechanisms on purpose: `report-uri` is deprecated but what
+    // Firefox/Safari actually send today, `report-to` (backed by the
+    // Reporting-Endpoints header below) is what replaces it in Chromium.
+    // Shipping only one would undercount violations and promote the policy on
+    // a partial picture.
+    if (reportUri) directives.push(`report-uri ${reportUri}`, `report-to ${CSP_REPORT_GROUP}`)
+    return directives.join('; ')
+}
+
+const CSP_REPORT_GROUP = 'csp-endpoint'
+
+function reportingEndpointsHeader() {
+    const reportUri = sentryCspReportUri()
+    if (!reportUri) return []
+    return [{ key: 'Reporting-Endpoints', value: `${CSP_REPORT_GROUP}="${reportUri}"` }]
+}
+
 // Get git commit hash at build time
 let gitCommitHash = 'unknown'
 try {
@@ -186,7 +277,14 @@ let nextConfig = {
                     },
                     // Security headers - prevents clickjacking and other attacks
                     // Using frame-ancestors instead of X-Frame-Options to allow specific domains
-                    { key: 'Content-Security-Policy', value: "frame-ancestors 'self' https://hugo0.com" },
+                    // object-src/base-uri are safe to enforce today: the app embeds no
+                    // plugins and sets no <base>, so neither can break a working page.
+                    {
+                        key: 'Content-Security-Policy',
+                        value: "frame-ancestors 'self' https://hugo0.com; object-src 'none'; base-uri 'self'",
+                    },
+                    { key: 'Content-Security-Policy-Report-Only', value: contentSecurityPolicyReportOnly() },
+                    ...reportingEndpointsHeader(),
                     { key: 'X-Content-Type-Options', value: 'nosniff' },
                     { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
                 ],

package.json

@@ -139,6 +139,7 @@
         "@testing-library/jest-dom": "^6.4.2",
         "@testing-library/react": "^16.1.0",
         "@types/canvas-confetti": "^1.9.0",
+        "@types/d3-force": "^3.0.10",
         "@types/jest": "^29.5.12",
         "@types/js-cookie": "^3.0.6",
         "@types/node": "20.4.2",

scripts/__tests__/native-build-scan.test.js

@@ -0,0 +1,57 @@
+const fs = require('fs')
+const path = require('path')
+const Module = require('module')
+
+const SCRIPT_PATH = path.join(__dirname, '..', 'native-build.js')
+
+// native-build.js is a script, not a module: it calls main() at import time and
+// exports nothing. Load the real source with that call stripped so the scan
+// helpers can be asserted against the actual app tree.
+function loadScriptInternals() {
+    const source = fs.readFileSync(SCRIPT_PATH, 'utf-8')
+    const withoutEntrypoint = source.replace(/\nmain\(\)\s*$/, '\n')
+    expect(withoutEntrypoint).not.toBe(source)
+
+    const exposed =
+        withoutEntrypoint +
+        '\nmodule.exports = { isHandledByTransform, detectUncoveredServerRoutes, P0_TRANSFORMS, APP_DIR }\n'
+
+    const mod = new Module(SCRIPT_PATH, null)
+    mod.filename = SCRIPT_PATH
+    mod.paths = Module._nodeModulePaths(path.dirname(SCRIPT_PATH))
+    mod._compile(exposed, SCRIPT_PATH)
+    return mod.exports
+}
+
+const { isHandledByTransform, detectUncoveredServerRoutes, P0_TRANSFORMS, APP_DIR } = loadScriptInternals()
+
+const toPosix = (p) => p.split(path.sep).join('/')
+
+describe('native build server-route scan', () => {
+    it('treats every P0_TRANSFORMS entry as handled', () => {
+        for (const transform of P0_TRANSFORMS) {
+            expect(isHandledByTransform(transform.path)).toBe(true)
+        }
+    })
+
+    // The scan passes `path.relative(APP_DIR, full)` into the predicate. If the
+    // predicate compared a different path shape it would silently never match.
+    it('matches the relative path shape the scan actually computes', () => {
+        for (const transform of P0_TRANSFORMS) {
+            const absolute = path.join(APP_DIR, transform.path)
+            expect(isHandledByTransform(path.relative(APP_DIR, absolute))).toBe(true)
+        }
+    })
+
+    it('does not suppress routes that are not transformed', () => {
+        expect(isHandledByTransform('some/other/page.tsx')).toBe(false)
+        expect(isHandledByTransform('api/foo/route.ts')).toBe(false)
+        expect(isHandledByTransform('(mobile-ui)/claim/layout.tsx')).toBe(false)
+    })
+
+    it('does not flag transformed pages as uncovered server routes', () => {
+        const transformed = new Set(P0_TRANSFORMS.map((t) => t.path))
+        const offenders = detectUncoveredServerRoutes().filter((o) => transformed.has(toPosix(o.rel)))
+        expect(offenders).toEqual([])
+    })
+})

scripts/native-build.js

@@ -85,7 +85,7 @@ export default function RootRedirect() {
     {
         path: '(mobile-ui)/claim/page.tsx',
         // strip generateMetadata + force-dynamic, keep component render (SEO irrelevant in native)
-        replacement: `import { Claim } from '@/components'
+        replacement: `import { Claim } from '@/components/Claim/Claim'
 
 export default function ClaimPage() {
     return <Claim />
@@ -253,6 +253,14 @@ function isCoveredByDisableList(relPath) {
     return P0_TRANSFORMS.some((item) => relPath === item.path)
 }
 
+// P0_TRANSFORMS files are replaced with static-export-safe stubs before `next
+// build`, so their server-only exports (generateMetadata, force-dynamic) never
+// reach the export — the scan must not flag them.
+function isHandledByTransform(relPath) {
+    const normalized = relPath.split(path.sep).join('/')
+    return P0_TRANSFORMS.some((t) => t.path === normalized)
+}
+
 function detectUncoveredServerRoutes(dir = APP_DIR, found = []) {
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
         if (entry.name.includes('.disabled') || entry.name.startsWith('_')) continue
@@ -263,7 +271,7 @@ function detectUncoveredServerRoutes(dir = APP_DIR, found = []) {
             detectUncoveredServerRoutes(full, found)
             continue
         }
-        if (isCoveredByDisableList(rel)) continue
+        if (isCoveredByDisableList(rel) || isHandledByTransform(rel)) continue
         if (entry.name === 'route.ts' || entry.name === 'route.js') {
             found.push({ rel, reason: 'route handler (cannot be statically exported)' })
             continue

sentry.utils.test.ts

@@ -0,0 +1,19 @@
+import type { ErrorEvent } from '@sentry/nextjs'
+import { shouldIgnoreError } from './sentry.utils'
+
+function eventWith(partial: { message?: string; type?: string; value?: string }): ErrorEvent {
+    return {
+        message: partial.message,
+        exception: { values: [{ type: partial.type, value: partial.value }] },
+    } as unknown as ErrorEvent
+}
+
+describe('shouldIgnoreError — alreadyReported (fetchWithSentry wrapper)', () => {
+    it('ignores a re-thrown ServiceUnavailableError (already captured at the fetch site)', () => {
+        expect(shouldIgnoreError(eventWith({ type: 'ServiceUnavailableError', value: 'upstream 503' }))).toBe(true)
+    })
+
+    it('does not ignore an unrelated application error', () => {
+        expect(shouldIgnoreError(eventWith({ type: 'TypeError', value: 'x is not a function' }))).toBe(false)
+    })
+})

sentry.utils.ts

@@ -38,6 +38,15 @@ const IGNORED_ERRORS = {
     // Third-party scripts we don't control
     thirdParty: ['googletagmanager', 'gtag', 'analytics', 'hotjar', 'clarity', 'intercom', 'crisp'],
 
+    // fetchWithSentry wrapper errors: the underlying timeout/network/HTTP
+    // failure is already captured at the fetch site with full context, so the
+    // re-thrown ServiceUnavailableError bubbling to global handlers (or being
+    // console.error'd by a consumer) would only double-count it (PEANUT-UI-QDJ).
+    // Substring-matching this pattern is safe only because ServiceUnavailableError
+    // is our own internal fetchWithSentry wrapper name, not a generic string that
+    // could appear in an unrelated third-party error message.
+    alreadyReported: ['ServiceUnavailableError'],
+
     // Third-party SDK internal errors (not actionable)
     thirdPartySdkErrors: [
         'IndexedDB:Set:InternalError', // Vercel Analytics storage - fails in private browsing, not actionable
@@ -58,12 +67,14 @@ export function shouldIgnoreError(event: ErrorEvent): boolean {
     const exceptionType = event.exception?.values?.[0]?.type || ''
     const culprit = (event as any).culprit || ''
 
-    const searchText = `${message} ${exceptionValue} ${exceptionType} ${culprit}`.toLowerCase()
+    // Match each field independently — concatenating them would let a pattern
+    // match across unrelated fields and suppress a legitimate event.
+    const searchTexts = [message, exceptionValue, exceptionType, culprit]
 
     // Check all ignore patterns
     for (const patterns of Object.values(IGNORED_ERRORS)) {
         for (const pattern of patterns) {
-            if (searchText.includes(pattern.toLowerCase())) {
+            if (searchTexts.some((text) => text.toLowerCase().includes(pattern.toLowerCase()))) {
                 return true
             }
         }