Develop

[manishdex25]

Summary by CodeRabbit

• New Features

  • Added analytics tracking for key user flows, including document verification, wallet connections, support form submissions, and asset actions.
  • Added Google Tag Manager and GA4 support, including a fallback for users with scripts disabled.

• Bug Fixes

  • Improved reCAPTCHA handling so expired challenges are detected and can be retried.
  • Strengthened error reporting and app resilience during verification, file upload, and fetch failures.
  • Improved build/runtime stability for local, CI, and deployment environments.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR integrates Sentry error monitoring (init, error boundary, capture/scrub utilities) and GTM/GA4 analytics tracking (component, utility library, event constants) across document verification, wallet connect/disconnect, asset management, and support form flows, plus supporting CI/build/deploy configuration changes.

Changes

Build, CI, and Deploy Configuration

Layer / File(s)	Summary
Env docs and CI/E2E analytics defaults .env.example, .github/workflows/ci.yml, .github/workflows/e2e-verify.yml, .github/workflows/e2e.yml	Documents Sentry/analytics variables and disables analytics with VITE_PLATFORM=local in CI/E2E workflows.
Deploy workflow env injection .github/workflows/deploy-dev.yml, .github/workflows/deploy-prod.yml	Adds job-level Sentry/GTM/GA4/platform env vars, reworks .env generation to filter/append these values, and injects Sentry credentials into build steps.
Package scripts, dependencies, and Sentry build plugin package.json, vite.config.js	Adds memory flag to build scripts, adds Sentry/GA4 dependencies, and wires Sentry sourcemap upload plus vendor chunk splitting.

GTM/GA4 Analytics Tracking

Layer / File(s)	Summary
GTM component and app wiring index.html, src/App.tsx, src/components/common/GoogleTagManager/index.tsx	Adds a static GTM noscript fallback and a GoogleTagManager component wired into App.tsx via env-derived IDs.
Analytics utility library and event constants src/constants/analyticsEvents.ts, src/utils/analytics.ts, src/utils/analytics.test.ts	Adds event name constants and a full analytics utility library with schema detection, GTM/GA4 dispatch, and track* functions.
Wallet connect/disconnect analytics src/components/ConnectToMagicLink/index.tsx, src/components/ConnectToMetamask/index.tsx, src/index.css	Instruments wallet connect/disconnect handlers with tracking calls, converting disconnects to async try/catch.
Asset management action analytics src/components/AssetManagementPanel/AssetManagementApplication/index.tsx	Tracks asset action initiation/completion/failure based on transaction state transitions.
Document verification analytics and error capture src/components/home/VerifySection/useVerify.ts, useVerify.test.ts, useVerify.analytics.test.ts	Instruments verification flow with drop/verify/error/network-selection tracking and Sentry capture for invalid/errored results.
Support form and recaptcha instrumentation src/hooks/useContactForm.ts, src/hooks/useRecaptcha.ts, src/components/common/Recaptcha/Recaptcha.tsx, src/pages/Contact/index.tsx	Adds form submit/fail tracking, index-based presign upload matching with exception capture, and a Recaptcha expiry callback.

Sentry Error Monitoring Core

Layer / File(s)	Summary
Sentry init, error boundary, and app wiring src/lib/sentry/init.ts, SentryErrorBoundary.tsx, index.ts, src/main.tsx	Initializes Sentry with scrubbing hooks and wraps the app render tree in an error boundary.
Capture helpers and document schema labeling src/lib/sentry/capture.ts, capture.test.ts, documentSchema.ts	Adds breadcrumb/exception/message capture helpers and document schema classification.
Event/breadcrumb scrubbing utilities src/lib/sentry/scrub.ts, scrub.test.ts	Redacts sensitive URLs, keys, and payloads from Sentry events and breadcrumbs.
Sanity CMS error reporting src/lib/sanity/news.ts	Reports Sanity fetch failures to Sentry with operation context.
FetchClient Sentry integration src/utils/fetchClient.ts, fetchClient.test.ts	Distinguishes caller vs timeout aborts and reports HTTP errors to Sentry with request context.

Estimated code review effort: 4 (Complex) | ~75 minutes

Possibly related PRs

• TrustVC/trustvc-website#79: Continues the same Sentry integration work across env/CI/deploy wiring and src/lib/sentry/* modules.
• TrustVC/trustvc-website#75: Implements the same GTM/GA4 integration end-to-end with the GoogleTagManager component and analytics tracking.
• TrustVC/trustvc-website#78: Overlaps heavily on the GTM noscript fallback, GoogleTagManager component, and analytics wiring through the verification flow.

Suggested reviewers: rongquan1

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is too vague and does not describe the substantial analytics, Sentry, and workflow changes in this PR.	Replace it with a concise, specific title that names the main change, such as adding analytics and Sentry instrumentation.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch develop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

src/hooks/useContactForm.ts (2)

491-505: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Raw error message sent to analytics as error_code may leak sensitive/PII data.

trackSupportFormFailed(typeOfEnquiry || 'Unknown', msg) forwards the raw exception message (rawMessage, sourced directly from err.message) into the error_code field of the GTM dataLayer/GA4 event (per trackSupportFormFailed contract in src/utils/analytics.ts). If the backend or FetchClientError ever embeds request/response details (e.g. echoed email, validation text) in its message, that data flows into third-party analytics tooling, which is a privacy/compliance concern. Consider mapping to a coarse, allow-listed error code (e.g. HTTP status or a fixed enum) instead of the free-form message.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useContactForm.ts` around lines 491 - 505, The support form failure
handler in useContactForm is passing the free-form exception message into
trackSupportFormFailed as error_code, which can leak sensitive details. Replace
the raw msg input with a coarse, allow-listed failure code (for example a fixed
enum or status-derived code) and keep the user-facing fallback separate; update
the catch block around trackSupportFormFailed and the associated analytics
contract in analytics.ts so only non-PII codes are sent.

---

445-457: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Skip Sentry capture for canceled uploads
uploadToPresignedUrl rejects aborted uploads as Error('Upload aborted'), so this catch still reports a user-initiated cancel. Gate the capture on that abort case instead of only checking AbortError.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useContactForm.ts` around lines 445 - 457, The upload error handler
in useContactForm’s presigned upload catch block is still sending user-canceled
uploads to captureAppException because uploadToPresignedUrl rejects with
Error('Upload aborted') rather than AbortError. Update the catch logic to detect
that abort/abort-message case and skip captureAppException for it, while keeping
the attachment status update and rethrow behavior unchanged.

🧹 Nitpick comments (13)

src/components/ConnectToMagicLink/index.tsx (2)

27-34: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Silent catch swallows disconnect failures with no observability.

If disconnectWallet() throws, the error is discarded entirely — no logging, no user feedback, and no failure tracking (only success is tracked via trackWalletDisconnected). This leaves both the app state and analytics blind to disconnect failures.

🩹 Suggested minimal fix

   const handleDisconnect = async () => {
     try {
       await disconnectWallet()
       trackWalletDisconnected('magic_link')
-    } catch {
-      // Optional: surface a toast/error state
+    } catch (error) {
+      console.error('Error disconnecting Magic Link wallet:', error)
+      // Optional: surface a toast/error state
     }
   }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/ConnectToMagicLink/index.tsx` around lines 27 - 34, The
handleDisconnect flow in ConnectToMagicLink currently swallows disconnect
errors, so failures in disconnectWallet() are invisible to both analytics and
the UI. Update handleDisconnect to catch the thrown error, log or report it with
enough context, and add a failure signal (for example a tracking call or error
state/toast) while keeping trackWalletDisconnected('magic_link') only on
success.

---

112-124: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

trackWalletConnectFailed's error_code receives a human-readable message, not a code.

getWalletErrorMessage(error) returns free-text strings (e.g. "Connection request was rejected.", or dynamic fallback text), which is then sent as the error_code field to analytics. This will produce high-cardinality, hard-to-aggregate data in the WALLET_CONNECT_FAILED event instead of a small set of groupable codes.

Consider deriving a stable code (e.g., numeric wallet error code, or an enum like 'user_rejected' | 'pending_request' | 'unknown') for the tracking call, and keep the human-readable message only for the UI (setErrorMessage).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/ConnectToMagicLink/index.tsx` around lines 112 - 124, The
wallet connect failure tracking is sending a free-text message into the
error_code field, which should be a stable, low-cardinality code instead. Update
handleConnectWallet in ConnectToMagicLink to derive a separate normalized error
code for trackWalletConnectFailed (for example from the thrown wallet error or a
small enum like user_rejected/pending_request/unknown), and keep
getWalletErrorMessage(error) only for setErrorMessage. Make sure the tracking
call uses the stable code while the UI still shows the human-readable message.

src/components/ConnectToMetamask/index.tsx (2)

130-140: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

trackWalletConnectFailed's error_code receives a human-readable message, not a code.

Same concern as in ConnectToMagicLink: getWalletErrorMessage(error) returns free-text UI copy (e.g. "Connection request was rejected in MetaMask."), which is sent as error_code to analytics, producing high-cardinality, ungroupable data for WALLET_CONNECT_FAILED. It's also computed twice for the same error (once here, once again inside handleMetamaskError at line 142).

Consider passing a stable error code (numeric MetaMask error code, or an enum) for tracking, and reuse a single computed message for the UI.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/ConnectToMetamask/index.tsx` around lines 130 - 140,
`handleConnectWallet` is sending a free-text wallet error message into
`trackWalletConnectFailed` as `error_code`, which makes `WALLET_CONNECT_FAILED`
analytics high-cardinality and ungroupable. Update `handleConnectWallet` in
`ConnectToMetamask` to derive a stable code from the caught error (for example
the MetaMask numeric error code or an enum) and pass that to
`trackWalletConnectFailed`, while keeping the human-readable message only for UI
handling. Also compute the wallet error message once and reuse it for
`handleMetamaskError` so the same error isn’t parsed twice.

---

32-39: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Silent catch swallows disconnect failures with no observability.

Same as the MagicLink disconnect handler: if disconnectWallet() throws, the failure is discarded with no logging, user feedback, or analytics signal — only the success path is tracked via trackWalletDisconnected.

🩹 Suggested minimal fix

   const handleDisconnect = async () => {
     try {
       await disconnectWallet()
       trackWalletDisconnected('metamask')
-    } catch {
-      // Optional: surface a toast/error state
+    } catch (error) {
+      console.error('Error disconnecting MetaMask wallet:', error)
+      // Optional: surface a toast/error state
     }
   }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/ConnectToMetamask/index.tsx` around lines 32 - 39, The
handleDisconnect flow in ConnectToMetamask silently ignores failures from
disconnectWallet(), so add observability in the catch path instead of swallowing
the error. Update handleDisconnect to capture the thrown error and either log
it, surface user feedback, or emit a failure analytics event alongside the
existing trackWalletDisconnected success call, using the same pattern as the
MagicLink disconnect handler.

src/components/AssetManagementPanel/AssetManagementApplication/index.tsx (1)

166-193: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Verbose per-action switch mapping.

The switch statement mapping each AssetManagementActions to its tx-state could be replaced with a lookup object for conciseness, but this is purely stylistic given the modest number of cases.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/AssetManagementPanel/AssetManagementApplication/index.tsx`
around lines 166 - 193, Replace the verbose tx-state switch in
AssetManagementApplication by using a lookup object keyed by
AssetManagementActions instead of the inline IIFE switch. Map each action to its
corresponding state variable (nominateState, changeHolderState,
endorseBeneficiaryState, transferOwnerHoldersState, returnToIssuerState,
destroyTokenState, restoreTokenState, rejectTransferOwnerState,
rejectTransferHolderState, rejectTransferOwnerHolderState) and have txState read
from that map with an undefined fallback. Keep the mapping local to the
AssetManagementApplication component so the behavior stays the same while making
the AssetManagementActions-to-state association more concise and easier to
maintain.

src/components/home/VerifySection/useVerify.analytics.test.ts (1)

219-234: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Prefer waitFor over fixed setTimeout for async assertions.

These tests await completion via await new Promise(r => setTimeout(r, 0)) while other tests in this same file (e.g. line 289-291) correctly use waitFor. The fixed-delay pattern is more prone to flakiness under slower CI environments.

Also applies to: 236-249

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/home/VerifySection/useVerify.analytics.test.ts` around lines
219 - 234, The async assertion in useVerify.analytics.test.ts is using a fixed
setTimeout after handleDrop, which is flaky; update the handleDrop test to use
waitFor like the other tests in this file. Keep the same expectation on
analytics.trackDocumentDropped, but wait for the call to occur through waitFor
instead of manually sleeping, and apply the same change to the related test
blocks in this section.

src/components/home/VerifySection/useVerify.ts (1)

538-538: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Local variables shadow outer hook state of the same name.

errorType (538), errorMessage (540, in the !isValid block), and isExpired (568) all shadow the useState variables of the same names declared earlier in useVerify. This appears intentional — using the freshly computed value avoids reading stale state inside the same synchronous closure — but the identical naming makes the function harder to scan and easy to misread on future edits.

Consider renaming the locals (e.g. computedErrorType, computedIsExpired) for clarity.

Also applies to: 568-569

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/home/VerifySection/useVerify.ts` at line 538, The local
variables inside useVerify are shadowing the hook state fields with the same
names, which makes the logic harder to read and easy to confuse during future
edits. Rename the locally computed values in the !isValid block and the later
expiration check to distinct names such as computedErrorType,
computedErrorMessage, and computedIsExpired, and update the surrounding
references so it’s clear they are fresh derived values rather than the useState
variables.

package.json (1)

8-10: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Inline NODE_OPTIONS=... prefix breaks on native Windows.

NODE_OPTIONS=--max-old-space-size=6144 vite build ... uses POSIX-only env-assignment syntax. On native Windows (cmd.exe, which is npm's default shell there), this fails outright rather than setting the variable. Consider cross-env for portability, matching common practice for cross-platform npm scripts.

♻️ Proposed fix using cross-env

-    "build:dev": "NODE_OPTIONS=--max-old-space-size=6144 vite build --mode development",
-    "build:prod": "NODE_OPTIONS=--max-old-space-size=6144 vite build --mode production",
-    "build": "NODE_OPTIONS=--max-old-space-size=6144 vite build --mode production",
+    "build:dev": "cross-env NODE_OPTIONS=--max-old-space-size=6144 vite build --mode development",
+    "build:prod": "cross-env NODE_OPTIONS=--max-old-space-size=6144 vite build --mode production",
+    "build": "cross-env NODE_OPTIONS=--max-old-space-size=6144 vite build --mode production",

(requires adding cross-env to devDependencies)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 8 - 10, Update the npm scripts in package.json so
the NODE_OPTIONS setting is cross-platform instead of using POSIX-only inline
env assignment. Adjust build:dev, build:prod, and build to use a portable
approach such as cross-env, and make sure the package’s devDependencies include
the required cross-env entry so the scripts work in native Windows shells as
well as Unix shells.

src/hooks/useContactForm.ts (1)

121-132: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Reconsider reporting reCAPTCHA expiration as a Sentry exception.

reCAPTCHA tokens routinely expire after ~2 minutes of inactivity; this is expected user behavior, not an application error. Routing it through captureAppException will generate a steady stream of low-value Sentry events, diluting signal for real errors and consuming quota. Consider tracking this via the analytics layer (e.g. a dedicated trackRecaptchaExpired event) or a breadcrumb instead of a captured exception.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useContactForm.ts` around lines 121 - 132, The
handleRecaptchaExpired callback in useContactForm should not report expected
token expiration through captureAppException because it creates noisy Sentry
exceptions. Replace the exception capture with a lower-severity tracking
approach such as a dedicated analytics event or breadcrumb, while keeping the
existing state reset and recaptcha field error update intact. Use the
handleRecaptchaExpired symbol to locate the callback and route the expired
reCAPTCHA signal through the app’s analytics layer instead.

src/components/common/Recaptcha/Recaptcha.tsx (1)

5-22: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicate Window.grecaptcha global type declaration across files.

This exact grecaptcha global augmentation (including the newly extended render params) also exists in src/lib/sentry/init.ts. Maintaining two copies of the same ambient type risks drift if one is updated without the other. Consider extracting it into a single shared .d.ts file (e.g. src/types/grecaptcha.d.ts) imported/referenced by both.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/common/Recaptcha/Recaptcha.tsx` around lines 5 - 22, The
Window.grecaptcha ambient type is duplicated in Recaptcha.tsx and
src/lib/sentry/init.ts, so consolidate it into one shared declaration instead of
keeping two copies. Move the grecaptcha global augmentation into a single shared
.d.ts file such as src/types/grecaptcha.d.ts, then remove the local Window
interface from Recaptcha and update init.ts to rely on the shared declaration so
both use the same render signature and stay in sync.

src/utils/analytics.ts (1)

11-11: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Utils module depends on a feature component for a type.

VerificationFragment is imported from ../components/home/VerifySection/useVerify into a generic utils/analytics.ts. Since this is a shared analytics utility (also consumed by wallet, asset, and support flows per the PR stack), consider relocating shared types like VerificationFragment to a neutral module (e.g. src/types/verification.ts) so utils doesn't depend on a specific feature component's file.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/utils/analytics.ts` at line 11, The utils/analytics.ts module currently
imports VerificationFragment from a feature-specific VerifySection hook,
creating an unwanted dependency from shared utilities into a component feature.
Move VerificationFragment to a neutral shared types module such as a
verification types file under src/types, then update analytics.ts and any other
consumers to import the type from that shared location instead of
../components/home/VerifySection/useVerify.

src/lib/sentry/SentryErrorBoundary.tsx (1)

8-29: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider an interactive fallback with resetError.

Sentry's fallback prop supports a function receiving resetError, allowing users to retry without a full page reload instead of only suggesting a manual refresh.

♻️ Optional interactive fallback

 export const SentryErrorBoundary = ({ children }: SentryErrorBoundaryProps) => (
   <Sentry.ErrorBoundary
-    fallback={
-      <div
-        className="app-shell app-shell--bg-light"
-        style={{ padding: '2rem' }}
-      >
-        <h1>Something went wrong</h1>
-        <p>
-          An unexpected error occurred. Please refresh the page or try again
-          later.
-        </p>
-      </div>
-    }
+    fallback={({ resetError }) => (
+      <div
+        className="app-shell app-shell--bg-light"
+        style={{ padding: '2rem' }}
+      >
+        <h1>Something went wrong</h1>
+        <p>An unexpected error occurred. Please try again or refresh the page.</p>
+        <button onClick={resetError}>Try again</button>
+      </div>
+    )}
     beforeCapture={scope => {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/sentry/SentryErrorBoundary.tsx` around lines 8 - 29, The
SentryErrorBoundary fallback is currently static and only tells users to
refresh, so update the Sentry.ErrorBoundary usage in SentryErrorBoundary to use
the functional fallback form that receives resetError. Add a retry action in the
fallback UI that calls resetError so users can recover without a full page
reload, while keeping the existing error message and beforeCapture tagging
behavior intact.

src/lib/sentry/capture.test.ts (1)

1-119: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add coverage for the disabled-Sentry branches and untested exports.

addBreadcrumb, captureAppException, and captureFetchError have no dedicated tests, and none of the functions are tested with isSentryEnabled() mocked to false (the early-return/no-op path used in local dev without VITE_SENTRY_DSN). Given this is a new cross-cutting utility, exercising the disabled path would guard against accidental Sentry calls when disabled.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/sentry/capture.test.ts` around lines 1 - 119, Add tests for the
disabled-Sentry no-op path and the untested exports in capture.test.ts: mock
isSentryEnabled() to return false and verify captureAppException,
captureFetchError, and addBreadcrumb exit without calling any `@sentry/react`
methods. Use the existing capture*, triggerSentryTestError, and Sentry mocks in
this spec to cover the early-return branch and ensure no breadcrumb, exception,
or message is sent when Sentry is disabled.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy-dev.yml:
- Around line 42-47: The Sentry release variable is always populated in the
deploy-dev workflow, which prevents the empty-env skip path from being used.
Update the deploy-dev job’s VITE_SENTRY_RELEASE assignment so it is conditional
and can be empty when Sentry upload should be skipped, matching the behavior
expected by vite.config.js; keep the surrounding VITE_SENTRY_* env block
consistent with the existing workflow variable names.

In `@src/lib/sentry/scrub.ts`:
- Around line 25-26: The string scrubbing in scrubString and
looksLikeCredentialPayload is over-redacting any value longer than
MAX_STRING_LENGTH, which wipes useful diagnostic text from
event.exception.values[].value, event.message, and breadcrumb messages. Update
the long-string handling so benign long strings are truncated or partially
preserved instead of fully replaced, while still fully redacting clearly
credential-like payloads. Keep the behavior localized in the scrub.ts helpers
and preserve the existing redaction path for genuinely sensitive content.

In `@src/utils/fetchClient.ts`:
- Around line 72-77: The JSON parsing path in fetchClient’s response handling is
swallowing failures for successful application/json responses, causing malformed
2xx payloads to appear as null and skip error reporting. Update the
response.json() handling in fetchClient so parse errors are not caught and
converted to null; instead let the failure surface (or explicitly throw with
context) while keeping the existing success flow for valid JSON responses.

In `@vite.config.js`:
- Around line 14-45: The Sentry build gate in the Vite config is incorrectly
treating VITE_SENTRY_RELEASE as required, which causes deploys to fail when only
the three Sentry secrets are missing. Update the logic around sentryBuildVars,
allSentryBuildVarsEmpty, allSentryBuildVarsSet, and the incomplete-configuration
throw so the all-or-nothing check applies only to SENTRY_AUTH_TOKEN, SENTRY_ORG,
and SENTRY_PROJECT, while VITE_SENTRY_RELEASE is excluded from that validation
but still used later for source map upload.

---

Outside diff comments:
In `@src/hooks/useContactForm.ts`:
- Around line 491-505: The support form failure handler in useContactForm is
passing the free-form exception message into trackSupportFormFailed as
error_code, which can leak sensitive details. Replace the raw msg input with a
coarse, allow-listed failure code (for example a fixed enum or status-derived
code) and keep the user-facing fallback separate; update the catch block around
trackSupportFormFailed and the associated analytics contract in analytics.ts so
only non-PII codes are sent.
- Around line 445-457: The upload error handler in useContactForm’s presigned
upload catch block is still sending user-canceled uploads to captureAppException
because uploadToPresignedUrl rejects with Error('Upload aborted') rather than
AbortError. Update the catch logic to detect that abort/abort-message case and
skip captureAppException for it, while keeping the attachment status update and
rethrow behavior unchanged.

---

Nitpick comments:
In `@package.json`:
- Around line 8-10: Update the npm scripts in package.json so the NODE_OPTIONS
setting is cross-platform instead of using POSIX-only inline env assignment.
Adjust build:dev, build:prod, and build to use a portable approach such as
cross-env, and make sure the package’s devDependencies include the required
cross-env entry so the scripts work in native Windows shells as well as Unix
shells.

In `@src/components/AssetManagementPanel/AssetManagementApplication/index.tsx`:
- Around line 166-193: Replace the verbose tx-state switch in
AssetManagementApplication by using a lookup object keyed by
AssetManagementActions instead of the inline IIFE switch. Map each action to its
corresponding state variable (nominateState, changeHolderState,
endorseBeneficiaryState, transferOwnerHoldersState, returnToIssuerState,
destroyTokenState, restoreTokenState, rejectTransferOwnerState,
rejectTransferHolderState, rejectTransferOwnerHolderState) and have txState read
from that map with an undefined fallback. Keep the mapping local to the
AssetManagementApplication component so the behavior stays the same while making
the AssetManagementActions-to-state association more concise and easier to
maintain.

In `@src/components/common/Recaptcha/Recaptcha.tsx`:
- Around line 5-22: The Window.grecaptcha ambient type is duplicated in
Recaptcha.tsx and src/lib/sentry/init.ts, so consolidate it into one shared
declaration instead of keeping two copies. Move the grecaptcha global
augmentation into a single shared .d.ts file such as src/types/grecaptcha.d.ts,
then remove the local Window interface from Recaptcha and update init.ts to rely
on the shared declaration so both use the same render signature and stay in
sync.

In `@src/components/ConnectToMagicLink/index.tsx`:
- Around line 27-34: The handleDisconnect flow in ConnectToMagicLink currently
swallows disconnect errors, so failures in disconnectWallet() are invisible to
both analytics and the UI. Update handleDisconnect to catch the thrown error,
log or report it with enough context, and add a failure signal (for example a
tracking call or error state/toast) while keeping
trackWalletDisconnected('magic_link') only on success.
- Around line 112-124: The wallet connect failure tracking is sending a
free-text message into the error_code field, which should be a stable,
low-cardinality code instead. Update handleConnectWallet in ConnectToMagicLink
to derive a separate normalized error code for trackWalletConnectFailed (for
example from the thrown wallet error or a small enum like
user_rejected/pending_request/unknown), and keep getWalletErrorMessage(error)
only for setErrorMessage. Make sure the tracking call uses the stable code while
the UI still shows the human-readable message.

In `@src/components/ConnectToMetamask/index.tsx`:
- Around line 130-140: `handleConnectWallet` is sending a free-text wallet error
message into `trackWalletConnectFailed` as `error_code`, which makes
`WALLET_CONNECT_FAILED` analytics high-cardinality and ungroupable. Update
`handleConnectWallet` in `ConnectToMetamask` to derive a stable code from the
caught error (for example the MetaMask numeric error code or an enum) and pass
that to `trackWalletConnectFailed`, while keeping the human-readable message
only for UI handling. Also compute the wallet error message once and reuse it
for `handleMetamaskError` so the same error isn’t parsed twice.
- Around line 32-39: The handleDisconnect flow in ConnectToMetamask silently
ignores failures from disconnectWallet(), so add observability in the catch path
instead of swallowing the error. Update handleDisconnect to capture the thrown
error and either log it, surface user feedback, or emit a failure analytics
event alongside the existing trackWalletDisconnected success call, using the
same pattern as the MagicLink disconnect handler.

In `@src/components/home/VerifySection/useVerify.analytics.test.ts`:
- Around line 219-234: The async assertion in useVerify.analytics.test.ts is
using a fixed setTimeout after handleDrop, which is flaky; update the handleDrop
test to use waitFor like the other tests in this file. Keep the same expectation
on analytics.trackDocumentDropped, but wait for the call to occur through
waitFor instead of manually sleeping, and apply the same change to the related
test blocks in this section.

In `@src/components/home/VerifySection/useVerify.ts`:
- Line 538: The local variables inside useVerify are shadowing the hook state
fields with the same names, which makes the logic harder to read and easy to
confuse during future edits. Rename the locally computed values in the !isValid
block and the later expiration check to distinct names such as
computedErrorType, computedErrorMessage, and computedIsExpired, and update the
surrounding references so it’s clear they are fresh derived values rather than
the useState variables.

In `@src/hooks/useContactForm.ts`:
- Around line 121-132: The handleRecaptchaExpired callback in useContactForm
should not report expected token expiration through captureAppException because
it creates noisy Sentry exceptions. Replace the exception capture with a
lower-severity tracking approach such as a dedicated analytics event or
breadcrumb, while keeping the existing state reset and recaptcha field error
update intact. Use the handleRecaptchaExpired symbol to locate the callback and
route the expired reCAPTCHA signal through the app’s analytics layer instead.

In `@src/lib/sentry/capture.test.ts`:
- Around line 1-119: Add tests for the disabled-Sentry no-op path and the
untested exports in capture.test.ts: mock isSentryEnabled() to return false and
verify captureAppException, captureFetchError, and addBreadcrumb exit without
calling any `@sentry/react` methods. Use the existing capture*,
triggerSentryTestError, and Sentry mocks in this spec to cover the early-return
branch and ensure no breadcrumb, exception, or message is sent when Sentry is
disabled.

In `@src/lib/sentry/SentryErrorBoundary.tsx`:
- Around line 8-29: The SentryErrorBoundary fallback is currently static and
only tells users to refresh, so update the Sentry.ErrorBoundary usage in
SentryErrorBoundary to use the functional fallback form that receives
resetError. Add a retry action in the fallback UI that calls resetError so users
can recover without a full page reload, while keeping the existing error message
and beforeCapture tagging behavior intact.

In `@src/utils/analytics.ts`:
- Line 11: The utils/analytics.ts module currently imports VerificationFragment
from a feature-specific VerifySection hook, creating an unwanted dependency from
shared utilities into a component feature. Move VerificationFragment to a
neutral shared types module such as a verification types file under src/types,
then update analytics.ts and any other consumers to import the type from that
shared location instead of ../components/home/VerifySection/useVerify.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2b5f3e89-71f9-49f9-9aef-65f045fc8425

📥 Commits

Reviewing files that changed from the base of the PR and between 85689f0 and 85bec0d.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (37)

• .env.example
• .github/workflows/ci.yml
• .github/workflows/deploy-dev.yml
• .github/workflows/deploy-prod.yml
• .github/workflows/e2e-verify.yml
• .github/workflows/e2e.yml
• index.html
• package.json
• src/App.tsx
• src/components/AssetManagementPanel/AssetManagementApplication/index.tsx
• src/components/ConnectToMagicLink/index.tsx
• src/components/ConnectToMetamask/index.tsx
• src/components/common/GoogleTagManager/index.tsx
• src/components/common/Recaptcha/Recaptcha.tsx
• src/components/home/VerifySection/useVerify.analytics.test.ts
• src/components/home/VerifySection/useVerify.test.ts
• src/components/home/VerifySection/useVerify.ts
• src/constants/analyticsEvents.ts
• src/hooks/useContactForm.ts
• src/hooks/useRecaptcha.ts
• src/index.css
• src/lib/sanity/news.ts
• src/lib/sentry/SentryErrorBoundary.tsx
• src/lib/sentry/capture.test.ts
• src/lib/sentry/capture.ts
• src/lib/sentry/documentSchema.ts
• src/lib/sentry/index.ts
• src/lib/sentry/init.ts
• src/lib/sentry/scrub.test.ts
• src/lib/sentry/scrub.ts
• src/main.tsx
• src/pages/Contact/index.tsx
• src/utils/analytics.test.ts
• src/utils/analytics.ts
• src/utils/fetchClient.test.ts
• src/utils/fetchClient.ts
• vite.config.js