chore: back-merge main into dev (2026-08-11, signed)

[abalinda]

Replaces #2665, which cannot merge.

Why #2665 is stuck. It carries three unsigned commits from the content-publish bot (Update content submodule to latest main, 10:05/10:22/10:33Z). The repo's All branches ruleset (6457257) requires signed commits on every ref and lists no bypass actors. The ruleset audit log shows the bot reaches main by bypassing that rule; a back-merge PR has no such bypass, so those commits cannot flow into dev through an ordinary merge. Every check on #2665 is green — it was never a CI failure.

This branch is the same back-merge collapsed into one signed commit, off the current dev tip (so it also includes #2662).

Accepted trade-off: squashing loses the merge ancestry, so the next back-merge will present the same delta again. The durable fix is to make the content-publish workflow sign its commits (or author them through the GitHub API, which signs automatically) — filed as a follow-up, not done here.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peanut-wallet	Ready	Preview	Aug 11, 2026 1:40pm

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e581790d-fc31-45b2-b6c3-b055f65aba31

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code-analysis diff

Painscore total: 7164.93 → 7161.3 (-3.63)
Findings: +6 net (+267 new, -261 resolved)

🆕 New findings (267)

• critical complexity — src/components/Invites/InvitesPage.tsx — CC 80, MI 55.27, SLOC 199
• critical complexity — src/hooks/useHomeCarouselCTAs.tsx — CC 69, MI 57.11, SLOC 316
• critical complexity — src/app/m/[slug]/MerchantLandingPage.tsx — CC 51, MI 59.94, SLOC 184
• high structural-dup — types/api.generated.ts:10266 — 83 duplicate lines / 388 tokens with types/api.generated.ts:10854
• high structural-dup — types/api.generated.ts:10276 — 74 duplicate lines / 348 tokens with types/api.generated.ts:10864
• high structural-dup — types/api.generated.ts:5041 — 64 duplicate lines / 198 tokens with types/api.generated.ts:5143
• high structural-dup — types/api.generated.ts:5044 — 61 duplicate lines / 188 tokens with types/api.generated.ts:5248
• high hotspot — src/constants/analytics.consts.ts — 42 commits, +351/-12 lines since 6 months ago
• high hotspot — src/hooks/useHomeCarouselCTAs.tsx — 35 commits, +445/-264 lines since 6 months ago
• high method-complexity — src/hooks/useHomeCarouselCTAs.tsx:147 — CC 30 SLOC 143
• high complexity — src/constants/analytics.consts.ts — CC 1, MI 32.24, SLOC 184
• medium high-mdd — src/hooks/useHomeCarouselCTAs.tsx:82 — useHomeCarouselCTAs: MDD 170.8 (uses across many lines from declarations)
• medium high-mdd — src/hooks/useHomeCarouselCTAs.tsx:147 — : MDD 122.8 (uses across many lines from declarations)
• medium high-mdd — src/components/Invites/InvitesPage.tsx:37 — InvitePageContent: MDD 101.5 (uses across many lines from declarations)
• medium structural-dup — types/api.generated.ts:8149 — 49 duplicate lines / 149 tokens with types/api.generated.ts:8573
• medium high-dlt — src/hooks/useHomeCarouselCTAs.tsx:82 — useHomeCarouselCTAs: DLT 48 (calls 48 distinct functions — high context load)
• medium structural-dup — types/api.generated.ts:7 — 48 duplicate lines / 185 tokens with types/api.generated.ts:10994
• medium high-dlt — src/components/Invites/InvitesPage.tsx:37 — InvitePageContent: DLT 45 (calls 45 distinct functions — high context load)
• medium structural-dup — types/api.generated.ts:8652 — 43 duplicate lines / 123 tokens with types/api.generated.ts:8933
• medium structural-dup — types/api.generated.ts:8652 — 42 duplicate lines / 125 tokens with types/api.generated.ts:9011

…and 247 more.

✅ Resolved (261)

• src/components/Invites/InvitesPage.tsx — CC 79, MI 54.61, SLOC 196
• src/hooks/useHomeCarouselCTAs.tsx — CC 67, MI 57.4, SLOC 295
• src/app/m/[slug]/MerchantLandingPage.tsx — CC 53, MI 60.34, SLOC 196
• types/api.generated.ts:10166 — 83 duplicate lines / 388 tokens with types/api.generated.ts:10754
• types/api.generated.ts:10176 — 74 duplicate lines / 348 tokens with types/api.generated.ts:10764
• types/api.generated.ts:5046 — 61 duplicate lines / 188 tokens with types/api.generated.ts:5148
• src/constants/analytics.consts.ts — 41 commits, +345/-12 lines since 6 months ago
• src/hooks/useHomeCarouselCTAs.tsx — 34 commits, +405/-262 lines since 6 months ago
• src/constants/analytics.consts.ts — CC 1, MI 32.3, SLOC 183
• src/hooks/useHomeCarouselCTAs.tsx:78 — useHomeCarouselCTAs: MDD 150.9 (uses across many lines from declarations)
• src/hooks/useHomeCarouselCTAs.tsx:137 — : MDD 106.1 (uses across many lines from declarations)
• src/components/Invites/InvitesPage.tsx:37 — InvitePageContent: MDD 98.7 (uses across many lines from declarations)
• types/api.generated.ts:8049 — 49 duplicate lines / 149 tokens with types/api.generated.ts:8473
• types/api.generated.ts:7 — 48 duplicate lines / 185 tokens with types/api.generated.ts:10894
• src/components/Invites/InvitesPage.tsx:37 — InvitePageContent: DLT 44 (calls 44 distinct functions — high context load)
• src/hooks/useHomeCarouselCTAs.tsx:78 — useHomeCarouselCTAs: DLT 44 (calls 44 distinct functions — high context load)
• types/api.generated.ts:8552 — 43 duplicate lines / 123 tokens with types/api.generated.ts:8833
• types/api.generated.ts:8552 — 42 duplicate lines / 125 tokens with types/api.generated.ts:8911
• types/api.generated.ts:7471 — 40 duplicate lines / 116 tokens with types/api.generated.ts:8049
• types/api.generated.ts:8049 — 40 duplicate lines / 118 tokens with types/api.generated.ts:8887

…and 241 more.

📈 Painscore deltas (top movers)

File	Before	After	Δ
src/components/Marketing/mdx/CompareSavings.tsx	0.0	8.4	+8.4
src/hooks/useCardMarkupRate.ts	3.9	5.4	+1.5
src/app/m/[slug]/card-comparison.ts	7.5	0.0	-7.5
src/app/actions/card-comparison.ts	8.3	0.0	-8.3

[github-actions]

🧪 UI test report — ✅ all green

Suites

• ✅ unit: 2928 ran, 0 failed, 0 skipped, 52.2s

📊 Coverage (unit)

metric	%
statements	66.3%
branches	51.2%
functions	56.4%
lines	67.0%

⏱ 10 slowest test cases

time	test
4.1s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › never places two stickers in heavy overlap (broad seed sweep)
1.1s	src/utils/__tests__/demo-api.test.ts › isDemoMode() is false when not running under Capacitor
0.4s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › every sticker stays within canvas at any count
0.4s	src/utils/__tests__/auth-token.test.ts › is none — never guarded — when only the guarded marker is present
0.4s	src/utils/__tests__/auth-token.test.ts › authReady does not park — hydrates the plain token without an unlock
0.4s	src/app/actions/__tests__/api-headers.test.ts › should include Content-Type in validateInviteCode
0.4s	src/utils/__tests__/auth-token.test.ts › ignores the guarded marker and falls back to the plain token
0.3s	src/utils/__tests__/sentry.utils.test.ts › defaults to the client budget under a browser global
0.3s	src/app/(mobile-ui)/withdraw/__tests__/withdraw-states.test.tsx › Bank withdrawal keeps the $1 minimum for sub-$1 amounts
0.3s	src/utils/__tests__/sentry.utils.test.ts › still lets a per-call timeoutMs win over the default

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}