Production Release: Peanut Card UI + Decomplexify + Native app + Manteca collateral

.cursorrules

@@ -1 +1 @@
-CONTRIBUTING.md
+../AGENTS.md

.env.example

@@ -1,8 +1,17 @@
+# ⚠  LOCAL DEV: start from mono root with ./scripts/dev — NOT `pnpm dev` here.
+#    The harness (engineering/qa/lib/servers.sh) overrides PEANUT_API_URL,
+#    NEXT_PUBLIC_PEANUT_API_URL, ports, chain IDs, bundler URLs, and the passkey
+#    check flag at process-start. Values below are ONLY used when you run
+#    `pnpm dev` in this subrepo directly (escape hatch — points at staging).
+#    Full docs: ../GETTING-STARTED.md → "Running the app locally"
+
 export PEANUT_API_URL="https://api.staging.peanut.me"
 export NEXT_PUBLIC_PEANUT_API_URL="https://api.staging.peanut.me"
 export NEXT_PUBLIC_PEANUT_WS_URL="wss://api.staging.peanut.me"
-# export PEANUT_API_URL="http://127.0.0.1:5000/" # If running api locally
-# export NEXT_PUBLIC_PEANUT_API_URL="http://127.0.0.1:5000/" # If running api locally
+# For local API (via mono/scripts/manual-test.sh the harness sets these itself):
+# export PEANUT_API_URL="http://localhost:5050"
+# export NEXT_PUBLIC_PEANUT_API_URL="http://localhost:5050"
+# export NEXT_PUBLIC_PEANUT_WS_URL="ws://localhost:5050"
 
 export PEANUT_API_KEY="" # See in docs.peanut.me
 
@@ -44,6 +53,14 @@ export NEXT_PUBLIC_ZERO_DEV_PASSKEY_SERVER_URL=""
 export NEXT_PUBLIC_ZERO_DEV_RECOVERY_BUNDLER_URL=""
 export NEXT_PUBLIC_POLYGON_PAYMASTER_URL=""
 export NEXT_PUBLIC_POLYGON_BUNDLER_URL=""
+
+# Peanut wallet chain & token (defaults to Arbitrum mainnet USDC)
+# Override for testnets/other chains. Token values in raw units (USDC = 6 decimals)
+export NEXT_PUBLIC_PEANUT_WALLET_CHAIN_ID=""
+export NEXT_PUBLIC_PEANUT_WALLET_TOKEN=""
+export NEXT_PUBLIC_PEANUT_WALLET_TOKEN_DECIMALS=""
+export NEXT_PUBLIC_PEANUT_WALLET_TOKEN_SYMBOL=""
+export NEXT_PUBLIC_PEANUT_WALLET_TOKEN_NAME=""
 export NEXT_PUBLIC_BALANCE_WARNING_THRESHOLD=1
 export NEXT_PUBLIC_BALANCE_WARNING_EXPIRY=15
 

.gitattributes

@@ -0,0 +1,5 @@
+# Snapshot baseline for the FE render contract — generated by the
+# render-snapshot test in SNAPSHOT_MODE=write. Marking as
+# linguist-generated collapses it in GitHub PR diffs (still tracked,
+# still git-history-preserved).
+src/components/TransactionDetails/__tests__/fixtures/render-baseline.json linguist-generated=true

.github/workflows/capgo-deploy.yml

@@ -0,0 +1,76 @@
+name: Deploy OTA Update (Capgo)
+
+on:
+    push:
+        branches: [main, dev]
+    workflow_dispatch:
+        inputs:
+            channel:
+                description: 'Capgo channel to deploy to'
+                required: true
+                default: 'staging'
+                type: choice
+                options:
+                    - development
+                    - staging
+                    - production
+
+concurrency:
+    group: capgo-deploy-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    deploy:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  submodules: true
+                  token: ${{ secrets.SUBMODULE_TOKEN }}
+
+            - uses: pnpm/action-setup@v4
+              with:
+                  version: 10
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version: '21.1.0'
+                  cache: 'pnpm'
+
+            - name: Install dependencies
+              run: pnpm install
+
+            - name: Build native static export
+              run: node scripts/native-build.js
+
+            - name: Verify build output
+              run: |
+                  test -d out && test -f out/index.html || (echo "ERROR: out/ directory missing or incomplete" && exit 1)
+                  echo "Bundle ready. File count: $(find out -type f | wc -l)"
+
+            - name: Determine channel
+              id: channel
+              run: |
+                  if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+                    echo "name=${{ github.event.inputs.channel }}" >> $GITHUB_OUTPUT
+                  elif [ "${{ github.ref }}" = "refs/heads/main" ]; then
+                    echo "name=production" >> $GITHUB_OUTPUT
+                  else
+                    echo "name=staging" >> $GITHUB_OUTPUT
+                  fi
+
+            - name: Upload bundle to Capgo
+              run: |
+                  npx @capgo/cli@latest bundle upload \
+                    --channel ${{ steps.channel.outputs.name }} \
+                    --apikey ${{ secrets.CAPGO_API_KEY }} \
+                    --path ./out \
+                    --auto-min-update-version \
+                    --comment "${{ github.event.head_commit.message || 'Manual deploy' }}"
+
+            - name: Deployment summary
+              run: |
+                  echo "## OTA Deployment" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Channel:** ${{ steps.channel.outputs.name }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/code-analysis.yml

@@ -0,0 +1,160 @@
+name: Code analysis
+
+# Static-analysis diff comment on every PR. Runs the painscore +
+# complexity + dup + churn analyzers on HEAD and base, posts the diff
+# as an idempotent PR comment.
+#
+# Tool lives in mono/engineering/code-analysis. CI clones mono using
+# SUBMODULE_TOKEN (same secret used for peanut-content sync) at the
+# ref pinned by the MONO_REF repo variable (default 'main').
+#
+# Threshold gate is advisory for the first 2 weeks (continue-on-error).
+# Tighten by removing continue-on-error once the team is acclimatised.
+
+on:
+    pull_request:
+        branches: [main, master, dev]
+        # Skip code-analysis on doc-only commits — pure overhead. Not a
+        # required gate (just a comment), so paths-ignore is safe here.
+        paths-ignore:
+            - '**/*.md'
+            - 'docs/**'
+            - '.gitignore'
+            - '.editorconfig'
+            - 'src/content/**'
+    workflow_dispatch:
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+    pull-requests: write
+
+env:
+    MONO_REF: ${{ vars.MONO_REF || 'main' }}
+
+jobs:
+    analyze:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout PR head
+              uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+                  submodules: false
+
+            - uses: pnpm/action-setup@v4
+              with:
+                  version: 10
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version: '20'
+                  cache: 'pnpm'
+
+            - name: Clone mono (for analyzer)
+              env:
+                  TOKEN: ${{ secrets.MONO_READ_TOKEN }}
+              run: |
+                  git clone --depth 1 --branch "$MONO_REF" \
+                    "https://x-access-token:${TOKEN}@github.com/peanutprotocol/mono.git" /tmp/mono
+
+            - name: Install analyzer deps
+              working-directory: /tmp/mono/engineering/code-analysis
+              run: pnpm install --frozen-lockfile
+
+            # ---- HEAD analysis
+            - name: Analyze HEAD
+              run: |
+                  node /tmp/mono/engineering/code-analysis/bin/analyze.mjs \
+                    --root . \
+                    --include src \
+                    --extensions .ts,.tsx \
+                    --analyzers complexity,cognitive,structural-dup,dead-code,import-graph,churn,type-errors,ts-quality,react,nextjs \
+                    --filter jsx-aware \
+                    --use-ast \
+                    --parallel \
+                    --label peanut-ui-head \
+                    --out-dir analysis-head
+
+            # ---- BASE analysis (fetch + worktree the PR base ref)
+            - name: Checkout base ref into a worktree
+              run: |
+                  git fetch origin "${{ github.base_ref }}":base-ref
+                  git worktree add ../base-tree base-ref
+
+            - name: Analyze base
+              run: |
+                  node /tmp/mono/engineering/code-analysis/bin/analyze.mjs \
+                    --root ../base-tree \
+                    --include src \
+                    --extensions .ts,.tsx \
+                    --analyzers complexity,cognitive,structural-dup,dead-code,import-graph,churn,type-errors,ts-quality,react,nextjs \
+                    --filter jsx-aware \
+                    --use-ast \
+                    --parallel \
+                    --label peanut-ui-base \
+                    --out-dir analysis-base
+
+            # ---- Diff
+            - name: Diff
+              run: |
+                  node /tmp/mono/engineering/code-analysis/bin/diff.mjs \
+                    --base analysis-base \
+                    --head analysis-head \
+                    --out diff.md \
+                    --out-json diff.json
+
+            - name: Upload artifacts
+              uses: actions/upload-artifact@v4
+              with:
+                  name: code-analysis-${{ github.event.pull_request.number }}
+                  path: |
+                      analysis-head/
+                      diff.md
+                      diff.json
+                  retention-days: 14
+
+            # ---- PR comment (idempotent — re-edits prior comment)
+            - name: Comment on PR
+              uses: actions/github-script@v7
+              with:
+                  script: |
+                      const fs = require('fs');
+                      const body = fs.readFileSync('diff.md', 'utf-8');
+                      const { data: comments } = await github.rest.issues.listComments({
+                        issue_number: context.issue.number,
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                      });
+                      const tag = '<!-- code-analysis -->';
+                      const existing = comments.find(c => c.body && c.body.includes(tag));
+                      const final = tag + '\n' + body;
+                      if (existing) {
+                        await github.rest.issues.updateComment({
+                          comment_id: existing.id,
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          body: final,
+                        });
+                      } else {
+                        await github.rest.issues.createComment({
+                          issue_number: context.issue.number,
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          body: final,
+                        });
+                      }
+
+            # ---- Regression gate (advisory for first 2 weeks)
+            - name: Fail if regression > 50 net findings
+              continue-on-error: true
+              run: |
+                  NET=$(node -e "console.log(require('./diff.json').counts.net)")
+                  echo "Net new findings: $NET"
+                  if [ "$NET" -gt 50 ]; then
+                      echo "::warning::+$NET net findings (threshold: 50)"
+                      exit 1
+                  fi

.github/workflows/indexnow.yml

@@ -25,7 +25,7 @@ jobs:
                   submodules: true
                   token: ${{ secrets.SUBMODULE_TOKEN }}
 
-            - uses: pnpm/action-setup@v4
+            - uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1.0
             - uses: actions/setup-node@v4
               with:
                   node-version-file: '.node-version'

.github/workflows/preview.yaml

@@ -4,6 +4,14 @@ on:
         branches:
             - main
             - dev
+    workflow_dispatch:
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
 
 jobs:
     Deploy-Preview:

.github/workflows/supply-chain-check.yml

@@ -0,0 +1,47 @@
+name: Supply-chain freshness
+
+# Blocks PRs that add or upgrade a dependency to a version published less than
+# 14 days ago. Defense against compromised npm packages that get yanked within
+# hours of publish. Policy doc: AGENTS.md → "Supply chain".
+
+on:
+    pull_request:
+        branches: ['**']
+        paths:
+            - 'package.json'
+            - 'pnpm-lock.yaml'
+            - '.npmrc'
+            - 'scripts/check-min-release-age.mjs'
+            - '.github/workflows/supply-chain-check.yml'
+    workflow_dispatch:
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    check-min-release-age:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version: '21.1.0'
+
+            - uses: pnpm/action-setup@v4
+              with:
+                  version: 10
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Resolve base package.json
+              run: |
+                  git fetch origin "${{ github.base_ref }}"
+                  git show "origin/${{ github.base_ref }}:package.json" > /tmp/base-package.json
+
+            - name: Check min release age
+              run: node scripts/check-min-release-age.mjs --base /tmp/base-package.json