chore: back-merge main → dev (SP-153 + hotfixes)

package.json

@@ -12,7 +12,12 @@
         "dev:fallback": "next dev --webpack",
         "postinstall": "node scripts/copy-flags.mjs",
         "copy-flags": "node scripts/copy-flags.mjs",
-        "prebuild": "node scripts/copy-flags.mjs",
+        "generate:legal-versions": "node scripts/generate-legal-versions.mjs",
+        "predev": "pnpm generate:legal-versions",
+        "predev:clean": "pnpm generate:legal-versions",
+        "predev:fallback": "pnpm generate:legal-versions",
+        "preanalyze": "pnpm generate:legal-versions",
+        "prebuild": "node scripts/copy-flags.mjs && pnpm generate:legal-versions",
         "build": "next build --webpack",
         "start": "next start",
         "lint": "eslint .",

redirects.json

@@ -64,6 +64,11 @@
         "destination": "/en/privacy",
         "permanent": false
     },
+    {
+        "source": "/:slug(card-terms-us|card-terms-international|card-esign|card-privacy|card-prohibited-activities)",
+        "destination": "/en/:slug",
+        "permanent": false
+    },
     {
         "source": "/docs",
         "destination": "/en/help",

scripts/generate-legal-versions.mjs

@@ -0,0 +1,65 @@
+// Generates src/constants/legal-versions.generated.ts from the legal content
+// submodule (src/content/content/legal/<slug>/en.md): version = frontmatter
+// `last_updated`, hash = sha256 of the raw en.md bytes. The consent ledger
+// (peanut-api `consent_records`) stores what the user was actually shown, so
+// these values must come from the same files the legal pages render — never
+// hand-edit the generated file. Runs on predev/prebuild; commit the output so
+// CI and static analysis see it without running the generator.
+import { createHash } from 'node:crypto'
+import { readdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const legalDir = join(root, 'src/content/content/legal')
+const outFile = join(root, 'src/constants/legal-versions.generated.ts')
+
+if (!existsSync(legalDir)) {
+    // Submodule not checked out (e.g. a bare CI job) — keep the committed file.
+    console.warn('[legal-versions] src/content submodule missing, keeping committed constants')
+    process.exit(0)
+}
+
+const entries = []
+for (const slug of readdirSync(legalDir).sort()) {
+    const file = join(legalDir, slug, 'en.md')
+    if (!existsSync(file)) continue
+    const raw = readFileSync(file)
+    const match = /^last_updated:\s*["']?(\d{4}-\d{2}-\d{2})["']?\s*$/m.exec(raw.toString('utf8'))
+    if (!match) {
+        console.error(`[legal-versions] ${slug}/en.md has no last_updated frontmatter — refusing to generate`)
+        process.exit(1)
+    }
+    const hash = createHash('sha256').update(raw).digest('hex')
+    entries.push({ slug, version: match[1], hash })
+}
+
+// output must be byte-stable under prettier so predev never dirties the tree:
+// one field per line (printWidth 120), keys quoted only when not identifiers
+const key = (slug) => (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(slug) ? slug : `'${slug}'`)
+const body = entries
+    .map(
+        ({ slug, version, hash }) =>
+            `    ${key(slug)}: {\n        version: '${version}',\n        hash: '${hash}',\n    },`
+    )
+    .join('\n')
+
+writeFileSync(
+    outFile,
+    `// AUTO-GENERATED by scripts/generate-legal-versions.mjs — do not edit.
+// version = frontmatter last_updated; hash = sha256 of the raw en.md in the
+// src/content submodule. Echoed to the consent ledger so the backend records
+// exactly which document revision the user was shown.
+export interface LegalDocumentVersion {
+    version: string
+    hash: string
+}
+
+export const LEGAL_DOCUMENT_VERSIONS = {
+${body}
+} as const
+
+export type LegalDocumentSlug = keyof typeof LEGAL_DOCUMENT_VERSIONS
+`
+)
+console.log(`[legal-versions] wrote ${entries.length} documents to src/constants/legal-versions.generated.ts`)

src/app/(mobile-ui)/card/page.tsx

@@ -24,6 +24,7 @@ import PageContainer from '@/components/0_Bruddle/PageContainer'
 import { SumsubKycWrapper } from '@/components/Kyc/SumsubKycWrapper'
 import { initiateSelfHealResubmission } from '@/app/actions/sumsub'
 import { rainApi, type ApplyForCardResponse } from '@/services/rain'
+import { cardConsentDocuments } from '@/services/consent'
 import { useGrantSessionKey } from '@/hooks/wallet/useGrantSessionKey'
 import { useCapabilities } from '@/hooks/useCapabilities'
 import { useModalsContext } from '@/context/ModalsContext'
@@ -349,7 +350,12 @@ const CardPage: FC = () => {
                 with_session_key: !!serializedApproval,
             })
             try {
-                const res = await rainApi.applyForCard({ termsAccepted, serializedApproval })
+                // Consent-ledger echo: on acceptance, send the exact documents
+                // CardTermsScreen displayed for this region (version + hash).
+                const acceptedDocuments = termsAccepted
+                    ? cardConsentDocuments(pendingTerms?.isUsResident ?? false)
+                    : undefined
+                const res = await rainApi.applyForCard({ termsAccepted, serializedApproval, acceptedDocuments })
                 posthog.capture(ANALYTICS_EVENTS.CARD_APPLY_SUCCEEDED, { outcome: res.status })
                 if (res.status === 'incomplete' && 'sumsubAccessToken' in res) {
                     setSumsubToken(res.sumsubAccessToken)
@@ -364,7 +370,7 @@ const CardPage: FC = () => {
                 posthog.capture(ANALYTICS_EVENTS.CARD_APPLY_FAILED, { error_message: message })
             }
         },
-        [advanceFromApplyResponse, t]
+        [advanceFromApplyResponse, pendingTerms, t]
     )
 
     const handleAcceptTerms = useCallback(async () => {

src/app/(mobile-ui)/layout.tsx

@@ -1,6 +1,7 @@
 'use client'
 
 import GuestLoginModal from '@/components/Global/GuestLoginModal'
+import ReConsentModal from '@/components/Global/ReConsentModal'
 import PeanutLoading from '@/components/Global/PeanutLoading'
 import TopNavbar from '@/components/Global/TopNavbar'
 import WalletNavigation from '@/components/Global/WalletNavigation'
@@ -235,6 +236,8 @@ const Layout = ({ children }: { children: React.ReactNode }) => {
             {/* Modal */}
             <GuestLoginModal />
 
+            <ReConsentModal />
+
             <SupportDrawer />
 
             <QRScannerOverlay />

src/app/(mobile-ui)/withdraw/crypto/page.tsx

@@ -623,6 +623,9 @@ export default function WithdrawCryptoPage() {
                 description={
                     <div className="space-y-2">
                         <p>{t('compatibilityModal.description')}</p>
+                        {/* Show the concrete destination so the user confirms a real
+                            address, not an abstract warning — for ENS recipients this
+                            is the first time the resolved address is visible. */}
                         {!!withdrawData?.address && (
                             <p>
                                 {t('compatibilityModal.sendingTo')}{' '}

src/components/Card/CancelCardModal.tsx

@@ -60,6 +60,12 @@ const CancelCardModal: FC<Props> = ({ cardId, isOpen, onClose }) => {
         setPhase('canceling')
         setError(null)
         try {
+            // An unloaded overview reads as zero spending power below, which
+            // would skip the withdrawal and get the cancel rejected by the
+            // backend ("Withdrawal signature required"). Fail closed instead.
+            if (!overview) {
+                throw new Error('Card details still loading — please retry in a moment')
+            }
             // Cancel can be terminal on Rain's side (collateral contract may
             // become unreachable), so we MUST drain it BEFORE the cancel.
             // Backend enforces order — this just delivers the signed body.
@@ -75,6 +81,7 @@ const CancelCardModal: FC<Props> = ({ cardId, isOpen, onClose }) => {
                     recipient: smartWalletAddress as `0x${string}`,
                     rainSpendingPower: spendingPowerUnits,
                     kind: 'CRYPTO_WITHDRAW',
+                    forceStrategy: 'collateral-only',
                 })
                 if (artifact.strategy !== 'collateral-only') {
                     throw new Error(t('errors.unexpectedStrategy'))

src/components/Card/LockCardModal.tsx

@@ -66,6 +66,12 @@ const LockCardModal: FC<Props> = ({ cardId, mode, isOpen, onClose }) => {
         setError(null)
         try {
             if (mode === 'lock') {
+                // An unloaded overview reads as zero spending power below, which
+                // would skip the withdrawal and get the lock rejected by the
+                // backend ("Withdrawal signature required"). Fail closed instead.
+                if (!overview) {
+                    throw new Error('Card details still loading — please retry in a moment')
+                }
                 // If the user has spending power, return collateral to their
                 // smart wallet BEFORE locking so funds stay liquid. The
                 // backend gates the lock on a successful withdrawal — order
@@ -76,15 +82,17 @@ const LockCardModal: FC<Props> = ({ cardId, mode, isOpen, onClose }) => {
                     if (!smartWalletAddress) {
                         throw new Error(t('errors.walletNotReady'))
                     }
-                    // Force collateral-only routing: smart=0n eliminates the
-                    // smart-only and mixed branches, so the strategy resolver
-                    // picks 'collateral-only' and signs a Rain withdrawal
-                    // straight to the user's smart wallet (1 passkey tap).
+                    // Routing MUST NOT pick smart-only here: the point of this
+                    // spend is to drain Rain collateral back to the wallet, so a
+                    // smart-account transfer would be a self-transfer no-op that
+                    // leaves the collateral behind. (The `smartBalance: 0n` that
+                    // used to force this was removed in cb302d35a.)
                     const artifact = await signSpend({
                         requiredUsdcAmount: spendingPowerUnits,
                         recipient: smartWalletAddress as `0x${string}`,
                         rainSpendingPower: spendingPowerUnits,
                         kind: 'CRYPTO_WITHDRAW',
+                        forceStrategy: 'collateral-only',
                     })
                     if (artifact.strategy !== 'collateral-only') {
                         throw new Error(t('errors.unexpectedStrategy'))

src/components/Card/__tests__/LockCardModal.test.tsx

@@ -0,0 +1,165 @@
+/**
+ * Regression tests for the lock/cancel collateral withdrawal (prod incident
+ * 2026-07-24): both modals MUST force collateral-only routing when returning
+ * spending power. Without `forceStrategy`, live routing picks smart-only
+ * whenever the smart wallet covers the amount (spendPreflight), and the
+ * modals then reject their own artifact ("Unexpected withdrawal strategy"),
+ * so users with wallet balance ≥ card balance could neither lock nor cancel.
+ *
+ * Contracts locked down here, for BOTH modals:
+ *  1. spendingPower > 0 → signSpend is called WITH forceStrategy:
+ *     'collateral-only' (the assertion that catches the regression) and the
+ *     signed withdrawal is delivered to the backend call,
+ *  2. an unloaded overview fails closed BEFORE signing — undefined reads as
+ *     zero spending power, which would silently skip the withdrawal and get
+ *     the action rejected server-side,
+ *  3. a loaded overview with zero spending power proceeds without signing
+ *     (no passkey prompt when there is nothing to return).
+ */
+import React, { type ReactNode } from 'react'
+import { render, screen, fireEvent } from '@testing-library/react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { NextIntlClientProvider } from 'next-intl'
+import en from '@/i18n/app/messages/en.json'
+import LockCardModal from '@/components/Card/LockCardModal'
+import CancelCardModal from '@/components/Card/CancelCardModal'
+import { useRainCardOverview } from '@/hooks/useRainCardOverview'
+import { useWallet } from '@/hooks/wallet/useWallet'
+import { useSignSpendBundle } from '@/hooks/wallet/useSignSpendBundle'
+import { rainApi } from '@/services/rain'
+
+const WALLET = '0xafbea1a6a6036d7d827e08072cd4315248b77352'
+
+jest.mock('posthog-js', () => ({ __esModule: true, default: { capture: jest.fn() } }))
+jest.mock('@/hooks/useRainCardOverview', () => ({
+    useRainCardOverview: jest.fn(),
+    RAIN_CARD_OVERVIEW_QUERY_KEY: 'rain-card-overview',
+}))
+jest.mock('@/hooks/wallet/useWallet', () => ({ useWallet: jest.fn() }))
+jest.mock('@/hooks/wallet/useSignSpendBundle', () => ({ useSignSpendBundle: jest.fn() }))
+jest.mock('@/services/rain', () => ({
+    rainApi: {
+        lockCard: jest.fn(),
+        activateCard: jest.fn(),
+        cancelCard: jest.fn(),
+        submitCancellationFeedback: jest.fn(),
+    },
+}))
+// Modal chrome and the slide gesture are not under test — render passthroughs.
+jest.mock('@/components/Global/Modal', () => ({
+    __esModule: true,
+    default: ({ visible, children }: { visible: boolean; children: React.ReactNode }) =>
+        visible ? <div>{children}</div> : null,
+}))
+jest.mock('@/components/Card/SlideToAction', () => ({
+    __esModule: true,
+    default: ({ label, onComplete, disabled }: { label: string; onComplete: () => void; disabled?: boolean }) => (
+        <button onClick={onComplete} disabled={disabled}>
+            {label}
+        </button>
+    ),
+}))
+
+const mockOverview = useRainCardOverview as jest.Mock
+const mockUseWallet = useWallet as jest.Mock
+const mockUseSignSpendBundle = useSignSpendBundle as jest.Mock
+const mockLockCard = rainApi.lockCard as jest.Mock
+const mockCancelCard = rainApi.cancelCard as jest.Mock
+const mockSignSpend = jest.fn()
+
+const RAIN_WITHDRAWAL = { preparationId: 'prep-1', amount: '10060000' }
+// $10.06 spending power — the reporting user's exact state.
+const OVERVIEW = { balance: { spendingPower: 1006 } }
+const FORCED_SIGN_ARGS = {
+    requiredUsdcAmount: 10_060_000n, // 1006 cents → 6dp USDC units
+    recipient: WALLET,
+    rainSpendingPower: 10_060_000n,
+    kind: 'CRYPTO_WITHDRAW',
+    forceStrategy: 'collateral-only',
+}
+
+// Real `en.json`, not a key-echoing stub: the assertions below match on the
+// user-visible strings ("Slide to Lock", "Card locked"), so the messages have to
+// be the published ones. Both modals call useTranslations('card').
+const Wrapper = ({ children }: { children: ReactNode }) => (
+    <NextIntlClientProvider locale="en" messages={en} timeZone="UTC">
+        <QueryClientProvider client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}>
+            {children}
+        </QueryClientProvider>
+    </NextIntlClientProvider>
+)
+
+const setup = (overview?: { balance: { spendingPower: number } }) => {
+    mockOverview.mockReturnValue({ overview })
+    mockUseWallet.mockReturnValue({ address: WALLET })
+    mockUseSignSpendBundle.mockReturnValue({ signSpend: mockSignSpend })
+}
+
+const renderLock = () =>
+    render(<LockCardModal cardId="card-1" mode="lock" isOpen onClose={jest.fn()} />, { wrapper: Wrapper })
+const renderCancel = () => render(<CancelCardModal cardId="card-1" isOpen onClose={jest.fn()} />, { wrapper: Wrapper })
+
+beforeEach(() => {
+    jest.clearAllMocks()
+    mockSignSpend.mockResolvedValue({ strategy: 'collateral-only', rainWithdrawal: RAIN_WITHDRAWAL })
+    mockLockCard.mockResolvedValue({})
+    mockCancelCard.mockResolvedValue({})
+})
+
+describe('LockCardModal — lock with spending power', () => {
+    it('forces collateral-only routing and delivers the withdrawal to the lock call', async () => {
+        setup(OVERVIEW)
+        renderLock()
+        fireEvent.click(screen.getByText('Slide to Lock'))
+        expect(await screen.findByText('Card locked')).toBeInTheDocument()
+        expect(mockSignSpend).toHaveBeenCalledWith(FORCED_SIGN_ARGS)
+        expect(mockLockCard).toHaveBeenCalledWith('card-1', RAIN_WITHDRAWAL)
+    })
+
+    it('fails closed before signing when the overview has not loaded', async () => {
+        setup(undefined)
+        renderLock()
+        fireEvent.click(screen.getByText('Slide to Lock'))
+        expect(await screen.findByText(/still loading/)).toBeInTheDocument()
+        expect(mockSignSpend).not.toHaveBeenCalled()
+        expect(mockLockCard).not.toHaveBeenCalled()
+    })
+
+    it('locks without signing when there is no spending power to return', async () => {
+        setup({ balance: { spendingPower: 0 } })
+        renderLock()
+        fireEvent.click(screen.getByText('Slide to Lock'))
+        expect(await screen.findByText('Card locked')).toBeInTheDocument()
+        expect(mockSignSpend).not.toHaveBeenCalled()
+        expect(mockLockCard).toHaveBeenCalledWith('card-1', undefined)
+    })
+})
+
+describe('CancelCardModal', () => {
+    it('forces collateral-only routing and delivers the withdrawal to the cancel call', async () => {
+        setup(OVERVIEW)
+        renderCancel()
+        fireEvent.click(screen.getByText('Slide to Cancel'))
+        expect(await screen.findByText('Card canceled')).toBeInTheDocument()
+        expect(mockSignSpend).toHaveBeenCalledWith(FORCED_SIGN_ARGS)
+        expect(mockCancelCard).toHaveBeenCalledWith('card-1', { verifiedWithdrawal: RAIN_WITHDRAWAL })
+    })
+
+    it('fails closed before signing when the overview has not loaded', async () => {
+        setup(undefined)
+        renderCancel()
+        fireEvent.click(screen.getByText('Slide to Cancel'))
+        expect(await screen.findByText(/still loading/)).toBeInTheDocument()
+        expect(mockSignSpend).not.toHaveBeenCalled()
+        expect(mockCancelCard).not.toHaveBeenCalled()
+    })
+
+    it('cancels without signing when there is no spending power to return', async () => {
+        setup({ balance: { spendingPower: 0 } })
+        renderCancel()
+        fireEvent.click(screen.getByText('Slide to Cancel'))
+        expect(await screen.findByText('Card canceled')).toBeInTheDocument()
+        expect(mockSignSpend).not.toHaveBeenCalled()
+        expect(mockCancelCard).toHaveBeenCalledWith('card-1', { verifiedWithdrawal: undefined })
+    })
+})

src/components/Global/AddressLink/index.tsx

@@ -29,6 +29,9 @@ const AddressLink = ({ address, className = '', isLink = true }: AddressLinkProp
             setUrlAddress(normalizedEnsName)
         } else {
             setDisplayAddress(isCryptoAddress(address) ? printableAddress(address) : address)
+            // keep the link target in sync — a cached/evicted ens name must not
+            // leave the href pointing at a name this address may no longer own
+            setUrlAddress(address)
         }
     }, [address, ensName])