cross-app-connect/src/app/cross-app/transact/transact.module.css-275-282 (1)

275-282: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Replace deprecated word-break: break-word with modern alternative.

Stylelint correctly flags word-break: break-word as deprecated at lines 279, 302, and 332. Use overflow-wrap: break-word for equivalent behavior.

🧹 Proposed fix

 .messageBody {
     font-size: 14px;
     color: var(--text-strong);
     white-space: pre-wrap;
-    word-break: break-word;
+    overflow-wrap: break-word;
     margin: 0;
 }

 .code {
     font-family: ui-monospace, 'SF Mono', Menlo, Consolas, monospace;
     font-size: 12px;
     color: var(--text-strong);
     white-space: pre-wrap;
-    word-break: break-word;
+    overflow-wrap: break-word;
     background: transparent;
     margin: 0;
 }

 .typedFieldValue {
     font-size: 14px;
     color: var(--text-strong);
-    word-break: break-word;
+    overflow-wrap: break-word;
     min-width: 0;
 }

Also applies to: 297-306, 329-335

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/transact/transact.module.css` around
lines 275 - 282, Replace the deprecated CSS property word-break: break-word with
the modern equivalent overflow-wrap: break-word in the affected selectors (e.g.,
.messageBody and the other classes flagged in this diff) to preserve the same
wrapping behavior; locate each occurrence of word-break: break-word and swap it
to overflow-wrap: break-word, removing the deprecated declaration while keeping
the rest of the rules (font-size, color, white-space, margin) unchanged.

cross-app-connect/src/app/cross-app/_lib/decoder.ts-27-32 (1)

27-32: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove unused KnownAction import.

ESLint correctly flags that KnownAction is imported but never used. Only KnownActionCategory and KnownActionData are referenced in the code.

🧹 Proposed fix

 import {
     recognizeKnownAction,
-    type KnownAction,
     type KnownActionCategory,
     type KnownActionData,
 } from './knownActions';

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/_lib/decoder.ts` around lines 27 - 32,
The import list in decoder.ts includes an unused symbol KnownAction; remove
KnownAction from the import statement so only recognizeKnownAction,
KnownActionCategory, and KnownActionData are imported. Locate the import block
that currently references KnownAction and delete that identifier (and any
trailing comma if necessary) to satisfy ESLint and keep the remaining imports
unchanged.

cross-app-connect/src/app/cross-app/_lib/contracts.ts-18-51 (1)

18-51: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Known router contracts are currently unlabelled.

knownContracts includes DEX router addresses, but they’re missing from APP_CONFIG_LABELS, so those known addresses resolve as unverified.

Suggested patch

     stargateContractAddress: 'Stargate',
     stargateNftContractAddress: 'Stargate NFT',
     veDelegate: 'veDelegate',
     veDelegateVotes: 'veDelegate Votes',
+    betterSwapRouterAddress: 'BetterSwap Router',
+    veTradeRouterAddress: 'VeTrade Router',
+    veTradeCustomRouterAddress: 'VeTrade Custom Router',
 };

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/_lib/contracts.ts` around lines 18 - 51,
APP_CONFIG_LABELS is missing human-friendly labels for the DEX router entries
that exist in knownContracts, so those addresses show up as unverified; update
APP_CONFIG_LABELS (the Partial<Record<keyof KnownContracts, string>> constant)
to include entries for each router key present in KnownContracts (any keys like
*RouterAddress or containing "router") and supply descriptive labels (e.g.,
"Uniswap V2 Router", "SushiSwap Router", etc.) matching the router keys so those
known router addresses resolve as verified.

cross-app-connect/src/app/cross-app/connect/PinInput.tsx-128-128 (1)

128-128: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Localize the digit aria-label text.

aria-label={Digit ${i + 1}} is hardcoded in English; route it through i18n so screen-reader text matches the selected locale.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/connect/PinInput.tsx` at line 128, The
aria-label string in the PinInput component is hardcoded ("Digit {i+1}") —
update the input's aria-label to use your i18n system (e.g., t('pin.digitLabel',
{ number: i + 1 }) or intl.formatMessage({ id: 'pin.digitLabel' }, { number: i +
1 })) instead of the literal template; add a translation key like
"pin.digitLabel" with a placeholder (e.g., "Digit {number}") in locale files so
screen-reader text is localized, and replace the current aria-label={`Digit ${i
+ 1}`} in the PinInput render with the i18n call.

cross-app-connect/src/app/cross-app/connect/ConnectClient.tsx-27-27 (1)

27-27: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove unused imports.

OAUTH_PROVIDERS and OAuthProvider are imported but never used in this file.

Proposed fix

-import { OAUTH_PROVIDERS, type OAuthProvider } from '../../components/socials';
+import type { OAuthProvider } from '../../components/socials';

Actually, if OAuthProvider is also unused, remove the entire import:

-import { OAUTH_PROVIDERS, type OAuthProvider } from '../../components/socials';

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/connect/ConnectClient.tsx` at line 27,
The import line bringing in OAUTH_PROVIDERS and OAuthProvider is unused in
ConnectClient (symbols OAUTH_PROVIDERS and OAuthProvider); remove those unused
imports (either delete the entire import statement or remove those identifiers
from the import) so the file no longer imports OAUTH_PROVIDERS and OAuthProvider
unnecessarily.

docs/login-modal.md-35-39 (1)

35-39: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix doc behavior matrix for no-privy mode (email/more).

These lines conflict with the current implementation: email is still rejected without privy, while more is allowed without privy. Please update the defaults/table/migration note accordingly to avoid integration mistakes.

Also applies to: 76-77, 151-151

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/login-modal.md` around lines 35 - 39, The documentation incorrectly
states that Social methods and Email work without a host-supplied privy prop;
update the doc text and any behavior matrix entries referencing "email" and
"more" so they match the implementation: mark "email" as rejected/requires privy
and "more" as allowed/does not require privy (while keeping "passkey" as
requiring privy); search for occurrences of the terms "privy", "email", "more",
and "passkey" in this doc and the other referenced locations and adjust the
defaults/table/migration note to reflect these correct defaults.

examples/playground/tsconfig.json-38-50 (1)

38-50: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

include entries under dist/** are neutralized by exclude: ["dist"].

Line 44 adds dist/dev/types/**/*.ts, but Line 49 excludes the whole dist directory, so these files won't be compiled as a result of the include pattern. (They could still be included if imported by another file, but the direct include glob is ineffective.)

Remove "dist" from the exclude list or restructure to be more specific.

Proposed fix

   "exclude": [
     "node_modules",
-    ".next",
-    "dist"
+    ".next"
   ],

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@examples/playground/tsconfig.json` around lines 38 - 50, The tsconfig.json
has an include pattern "dist/dev/types/**/*.ts" but the exclude array contains
"dist", which prevents those files from being picked up; fix this by either
removing "dist" from the "exclude" array or narrowing the exclude (e.g., exclude
specific folders like "dist/build") so that "dist/dev/types/**/*.ts" remains
included — update the "exclude" entry accordingly to ensure the include pattern
for "dist/dev/types/**/*.ts" is effective.

cross-app-connect/README.md-127-131 (1)

127-131: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a language to the fenced env-vars code block.

Line 127 uses an untyped fenced block, which triggers MD040.

Suggested change

-```
+```dotenv
 NEXT_PUBLIC_PRIVY_APP_ID=...
 NEXT_PUBLIC_PRIVY_CLIENT_ID=...
 NEXT_PUBLIC_PRIVY_DOMAIN=https://privy.your-app.privy.dev

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @cross-app-connect/README.md around lines 127 - 131, The fenced environment
variable block in README.md is missing a language tag (causing MD040); update
the code fence that contains NEXT_PUBLIC_PRIVY_APP_ID,
NEXT_PUBLIC_PRIVY_CLIENT_ID, and NEXT_PUBLIC_PRIVY_DOMAIN so the opening fence
is annotated (e.g., change todotenv) to mark it as a dotenv block and
satisfy the markdown lint rule.

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/i18n/I18nProvider.tsx-32-36 (1)</summary><blockquote>

`32-36`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Await language change before unblocking render.**

`changeLanguage()` returns a Promise and must be awaited to ensure the language is fully applied before `setMounted(true)` allows children to render. Currently, the effect calls `setMounted(true)` immediately after `changeLanguage()`, creating a race condition where the i18n provider renders before translation state is ready.

<details>
<summary>💡 Suggested fix</summary>

```diff
 useEffect(() => {
-    const detected = resolveLanguage();
-    if (detected && i18n.language !== detected) {
-        i18n.changeLanguage(detected);
-    }
-    setMounted(true);
+    let cancelled = false;
+    const run = async () => {
+        const detected = resolveLanguage();
+        if (detected && i18n.language !== detected) {
+            await i18n.changeLanguage(detected);
+        }
+        if (!cancelled) setMounted(true);
+    };
+    void run();
+    return () => {
+        cancelled = true;
+    };
 }, []);
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/i18n/I18nProvider.tsx` around lines 32 - 36, In the
useEffect that checks `detected`, await the Promise returned by
`i18n.changeLanguage(detected)` before calling `setMounted(true)` so children
only render after the language is applied; update the effect body in
I18nProvider (the useEffect that references `detected`, `i18n.changeLanguage`,
and `setMounted`) to either make the inner function async and await
`i18n.changeLanguage(detected)` or chain `.then()`/`.catch()` to handle
success/failure and only call `setMounted(true)` after the change completes
(include error handling/logging on rejection).
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/i18n/locales/hi.json-19-21 (1)</summary><blockquote>

`19-21`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Use a governance-accurate translation for abstain.**

Line 21 currently uses “अनुपस्थित” (absent), which changes the vote meaning. Use an abstention term instead (e.g., “मतदान से विरत” / “तटस्थ” depending on your glossary).  
 
<details>
<summary>💬 Proposed fix</summary>

```diff
-        "abstain": "अनुपस्थित"
+        "abstain": "मतदान से विरत"
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/i18n/locales/hi.json` around lines 19 - 21, The
translation for the "abstain" key is incorrect: replace the current Hindi value
"अनुपस्थित" with a governance-accurate term (e.g., "मतदान से विरत" or "तटस्थ")
so the key "abstain" preserves vote meaning; update the "abstain" entry in the
same JSON object alongside "for" and "against" to use the chosen
glossary-approved string.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/i18n/locales/ja.json-181-183 (1)</summary><blockquote>

`181-183`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Fix mistranslation of “Clause” in transaction details.**

Lines 181-183 use “クローズ”, which means “close,” not “clause.” This can mislead users during signing review.  
 
<details>
<summary>📝 Proposed fix</summary>

```diff
-            "clauseSingular": "クローズ",
-            "clausePlural": "クローズ ({{count}})",
-            "clauseLabel": "クローズ {{index}} / {{total}} · 宛先",
+            "clauseSingular": "条項",
+            "clausePlural": "条項 ({{count}})",
+            "clauseLabel": "条項 {{index}} / {{total}} · 宛先",
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/i18n/locales/ja.json` around lines 181 - 183, The
translations for clauseSingular, clausePlural, and clauseLabel incorrectly use
"クローズ" (meaning "close"); update those keys to use the correct Japanese term for
"Clause" (e.g., "条項") so the UI reads correctly: set clauseSingular to "条項",
clausePlural to "条項（{{count}}）" (or "条項 ({{count}})" to match project
punctuation), and clauseLabel to "条項 {{index}} / {{total}} · 宛先" so the signing
review displays the proper word.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/i18n/locales/ko.json-181-183 (1)</summary><blockquote>

`181-183`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Correct “Clause” terminology in Korean transaction details.**

Lines 181-183 use “클로즈” (close) instead of “clause.” Please replace with a proper legal/transaction term (e.g., “절”).  
 
<details>
<summary>🛠️ Proposed fix</summary>

```diff
-            "clauseSingular": "클로즈",
-            "clausePlural": "클로즈 ({{count}})",
-            "clauseLabel": "클로즈 {{index}} / {{total}} · 대상",
+            "clauseSingular": "절",
+            "clausePlural": "절 ({{count}})",
+            "clauseLabel": "절 {{index}} / {{total}} · 대상",
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/i18n/locales/ko.json` around lines 181 - 183, The
keys clauseSingular, clausePlural, and clauseLabel currently use the
English-derived "클로즈" and should be updated to the proper Korean legal term "절";
replace the values for "clauseSingular" -> "절", "clausePlural" -> "절
({{count}})" and "clauseLabel" -> "절 {{index}} / {{total}} · 대상", preserving all
placeholders ({{count}}, {{index}}, {{total}}) and punctuation exactly as in the
originals.
```

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (15)</summary><blockquote>

<details>
<summary>cross-app-connect/src/app/cross-app/transact/TransactClient.tsx (1)</summary><blockquote>

`451-458`: _💤 Low value_

**Missing `t` in useCallback dependency array.**

The `onApprove` callback uses `t()` for localized strings but doesn't include `t` in the dependency array. While `t` is typically stable, including it follows React best practices.


<details>
<summary>♻️ Proposed fix</summary>

```diff
     }, [
         client,
         verified,
         parsed,
         signMessage,
         signTypedData,
         getAccessToken,
+        t,
     ]);
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/transact/TransactClient.tsx` around lines
451 - 458, The onApprove callback (defined with useCallback) references the
localization function t() but t is missing from the dependency array; update the
dependency array for that useCallback (the onApprove callback in
TransactClient.tsx) to include t so React correctly tracks localization changes
(add t alongside client, verified, parsed, signMessage, signTypedData,
getAccessToken).
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/cross-app/_lib/knownActions.ts (1)</summary><blockquote>

`237-242`: _💤 Low value_

**Inconsistent `endorse` flag for `unendorseApp`.**

`unendorseApp` sets `data: { endorse: true }` which seems semantically incorrect for an un-endorse action. If the intent is to flag "endorsement-related action occurred", consider renaming to `endorseAction: true` or using separate flags.


<details>
<summary>♻️ Suggested fix</summary>

```diff
         unendorseApp: () => ({
             summary: t('action.governance.unendorse'),
             category: 'governance',
-            data: { endorse: true },
+            data: { endorse: false },
         }),
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/_lib/knownActions.ts` around lines 237 -
242, The unendorseApp action currently sets data: { endorse: true } which is
semantically wrong; update the unendorseApp entry in knownActions.ts (the
unendorseApp factory) to use a correctly named flag such as data: {
endorseAction: true } or set endorse: false, depending on intent, and ensure any
consumers reading the data key (e.g., handlers expecting endorse) are updated
accordingly so the flag name/boolean meaning is consistent across the codebase.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/scripts/fetch-app-hub.mjs (1)</summary><blockquote>

`23-33`: _⚡ Quick win_

**Add a timeout to outbound GitHub requests.**

`fetch()` here has no timeout, so a hanging upstream connection can block the workflow indefinitely (Line 24). Add `AbortSignal.timeout(...)` (and optionally a small retry wrapper).

 

<details>
<summary>Suggested patch</summary>

```diff
 async function ghFetch(url) {
     const res = await fetch(url, {
+        signal: AbortSignal.timeout(15_000),
         headers: {
             accept: 'application/vnd.github+json',
             // Optional: GITHUB_TOKEN env var raises the rate limit from
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/scripts/fetch-app-hub.mjs` around lines 23 - 33, The
ghFetch function currently calls fetch without a timeout; update ghFetch to
create an AbortSignal via AbortSignal.timeout(timeoutMs) (e.g., 10_000 ms) and
pass signal to fetch options so hung GitHub requests are aborted, and ensure the
created timer is used only for that request; additionally, wrap the fetch call
in a simple retry loop (2-3 attempts) handling AbortError/temporary network
errors and rethrow other errors so transient failures are retried while
permanent errors bubble up.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/cross-app/_lib/contracts.ts (1)</summary><blockquote>

`11-11`: _⚡ Quick win_

**Prefer alias import in src modules.**

Please use a path alias import here to match repository conventions.

 

As per coding guidelines, `**/src/**/*.{ts,tsx}`: Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/_lib/contracts.ts` at line 11, The import
in contracts.ts currently pulls knownContracts and KnownContracts from a local
relative module; change it to use the repository path-alias convention instead.
Replace the relative import so that knownContracts and KnownContracts are
imported via a '`@/`...' alias (e.g., import { knownContracts, type KnownContracts
} from '`@/`...') to match src module aliasing and coding guidelines; ensure the
aliased path resolves to the same module that exports
knownContracts/KnownContracts and update any surrounding imports if necessary.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/cross-app/_lib/app-hub.ts (1)</summary><blockquote>

`9-9`: _⚡ Quick win_

**Use a src alias import instead of a relative import.**

Please switch this import to the configured alias form to match the repository import policy.

 

As per coding guidelines, `**/src/**/*.{ts,tsx}`: Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/_lib/app-hub.ts` at line 9, Replace the
relative JSON import in app-hub.ts (import data from './app-hub.json') with the
repository path-alias form rooted at src; update the import to use the `@/`...
alias that points to src (e.g. import from '`@/app/cross-app/_lib/app-hub.json`')
so it follows the repo policy for src imports and still resolves JSON modules
via the existing TS/webpack config.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/cross-app/_lib/useAddressInfo.ts (1)</summary><blockquote>

`4-10`: _⚡ Quick win_

**Switch to alias-based import for src code.**

Use the configured src alias instead of relative import in this module.

 

As per coding guidelines, `**/src/**/*.{ts,tsx}`: Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/_lib/useAddressInfo.ts` around lines 4 -
10, Replace the relative import from './thor' with the project alias-based src
import (use the configured `@/` alias) so the same exports — getAvatarForAddress,
getDomainOfAddress, picassoFallback and the DomainInfo type — are imported via
the src alias (e.g. import { getAvatarForAddress, getDomainOfAddress,
picassoFallback, type DomainInfo } from '`@/`.../thor') instead of './thor';
ensure the alias path points to the same thor module in the src tree.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/cross-app/_components/SignInPanel.tsx (1)</summary><blockquote>

`14-17`: _⚡ Quick win_

**Use path aliases for internal imports in `src/`.**

Please replace relative internal imports with `@/*`/`@components`/`@utils` aliases for consistency.
 
As per coding guidelines "Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils".

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/cross-app/_components/SignInPanel.tsx` around lines
14 - 17, Replace the relative internal imports in SignInPanel (the imports of
socials, getRecentProvider/setRecentProvider, PinInput, and connect.module.css)
with the project's path aliases: use `@components` for components (e.g. socials,
PinInput), `@/`* or `@utils` for utility modules (e.g. the recent helpers), and `@/`*
or `@styles` for CSS modules as per the guidelines; update the import specifiers
referencing '../../components/socials', '../_lib/recent', '../connect/PinInput',
and '../connect/connect.module.css' to the corresponding alias paths so the
module resolution uses `@components/`@utils/@/* aliases consistently.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/components/VechainHeader.tsx (1)</summary><blockquote>

`4-5`: _⚡ Quick win_

**Use project path aliases instead of relative imports.**

Please switch these imports to the configured aliases to keep import style consistent across `src/`.
 
As per coding guidelines "Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils".

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/components/VechainHeader.tsx` around lines 4 - 5,
Replace the relative imports with the project's path aliases: change the
RequesterChip import to use the `@components` alias (e.g. import RequesterChip
from '`@components/RequesterChip`') and change the CSS import to use the src-root
alias (e.g. import styles from '`@/app/components/VechainHeader.module.css`');
update the import statements in VechainHeader.tsx so they reference
RequesterChip and VechainHeader.module.css via the configured aliases instead of
relative paths.
```

</details>

</blockquote></details>
<details>
<summary>packages/vechain-kit/src/providers/CrossAppErrorRecovery.tsx (1)</summary><blockquote>

`5-5`: _⚡ Quick win_

**Use src path alias import instead of relative import.**

Prefer alias-based imports in `src` for consistency with project conventions.

 

As per coding guidelines, `**/src/**/*.{ts,tsx}`: Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/vechain-kit/src/providers/CrossAppErrorRecovery.tsx` at line 5,
Replace the relative import of useModal from './ModalProvider' with the project
path-alias import (use the `@components` alias for component/providers): update
the import that references useModal in CrossAppErrorRecovery.tsx to import from
the appropriate alias-based path (e.g. `@components/ModalProvider` or the
project's equivalent) so it follows the src path-alias convention instead of a
relative import.
```

</details>

</blockquote></details>
<details>
<summary>packages/vechain-kit/src/providers/VeChainKitProvider.tsx (1)</summary><blockquote>

`55-55`: _⚡ Quick win_

**Replace relative provider import with alias import.**

Use the configured `src` alias instead of `./CrossAppErrorRecovery`.

 

As per coding guidelines, `**/src/**/*.{ts,tsx}`: Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/vechain-kit/src/providers/VeChainKitProvider.tsx` at line 55, In
VeChainKitProvider.tsx replace the relative import "import {
CrossAppErrorRecovery } from './CrossAppErrorRecovery';" with the configured src
alias form so the module is imported via the project alias (e.g. import {
CrossAppErrorRecovery } from '`@/providers/CrossAppErrorRecovery`';), ensuring you
reference the CrossAppErrorRecovery symbol by the alias instead of a relative
path.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/layout.tsx (2)</summary><blockquote>

`2-4`: _⚡ Quick win_

**Use `@/` aliases for local `src` imports.**

Please replace relative imports with configured path aliases in this layout module.

 

As per coding guidelines, "Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils".

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/layout.tsx` around lines 2 - 4, Replace the
relative imports in this module with the configured path aliases: change the
import of PrivyProviderWrapper to use the src alias (e.g., import
PrivyProviderWrapper from '`@/app/providers/PrivyProviderWrapper`' or the
appropriate `@/` path to the provider), change I18nProvider to use its alias
(e.g., '`@/app/i18n/I18nProvider`' or '`@i18n`' if configured), and update the
globals.css import to use '`@/globals.css`' so all imports (PrivyProviderWrapper,
I18nProvider, and globals.css) use the project's `@/`* alias convention.
```

</details>

---

`25-29`: _⚡ Quick win_

**Move viewport settings to Next.js viewport API.**

In Next.js App Router, use the exported `viewport` object in `app/layout.tsx` instead of a manual `<meta name="viewport">` tag. This prevents duplication with Next.js default viewport handling and ensures consistent configuration.

Example:
```typescript
export const viewport: Viewport = {
    width: 'device-width',
    initialScale: 1,
};
```

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/layout.tsx` around lines 25 - 29, Remove the manual
<meta name="viewport"> tag from app/layout.tsx and instead export a Next.js App
Router viewport configuration by adding an exported constant named viewport
(type Viewport) with width: 'device-width' and initialScale: 1; ensure the
export is at module scope in layout.tsx so Next.js picks it up and avoid
duplicating viewport handling.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/i18n/config.ts (1)</summary><blockquote>

`6-23`: _⚡ Quick win_

**Switch locale imports to `@/` aliases.**

These relative imports should use the project alias convention to keep import patterns consistent.

 

As per coding guidelines, "Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils".

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/i18n/config.ts` around lines 6 - 23, Replace the
relative locale imports in config.ts with the project path-alias form (use
"`@/`..." rooted at src) so all locale modules (en, de, it, fr, es, zh, ja, ru,
ro, vi, nl, ko, sv, tw, tr, hi, pt) are imported via the alias instead of
'./locales/...'; update each import statement (e.g., the en import and the other
locale imports) to use "`@/app/i18n/locales/`<locale>.json" (or the correct alias
path to the i18n locales directory) so the file follows the project's alias
convention.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/i18n/I18nProvider.tsx (1)</summary><blockquote>

`5-5`: _⚡ Quick win_

**Use project path aliases for `src` imports.**

Please replace the relative import with the configured alias pattern for consistency across the app shell code.

 

As per coding guidelines, "Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils".

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/i18n/I18nProvider.tsx` at line 5, Replace the
relative import in I18nProvider.tsx that imports from './config' with the
project path alias that points to the same module (use the '`@/`*' src-root
alias), e.g. import the config module via the alias path (targeting the same
file exported by config) so the line importing i18n and resolveLanguage uses the
configured alias instead of a relative path; update the import statement in the
I18nProvider component accordingly.
```

</details>

</blockquote></details>
<details>
<summary>cross-app-connect/src/app/page.tsx (1)</summary><blockquote>

`4-5`: _⚡ Quick win_

**Use path aliases instead of relative imports.**

Line 4 and Line 5 use relative imports; this violates the src alias rule and makes cross-folder refactors harder.

<details>
<summary>♻️ Proposed fix</summary>

```diff
-import { VechainHeader } from './components/VechainHeader';
-import styles from './page.module.css';
+import { VechainHeader } from '`@/app/components/VechainHeader`';
+import styles from '`@/app/page.module.css`';
```
</details>

 

As per coding guidelines, `**/src/**/*.{ts,tsx}`: "Use path aliases for imports: `@/*` for src root, `@hooks` for hooks, `@components` for components, `@utils` for utils".

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cross-app-connect/src/app/page.tsx` around lines 4 - 5, Replace the relative
imports in page.tsx with path aliases: change the VechainHeader import to use
the `@components` alias (import VechainHeader from '`@components/VechainHeader`')
and change the CSS module import (styles from './page.module.css') to use the
src root alias (e.g., styles from '`@/app/page.module.css`' or the appropriate
path under `@/`* for your repo layout) so both VechainHeader and styles use
configured path aliases instead of relative paths.
```

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🤖 Prompt for all review comments with AI agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cross-app-connect-check.yaml:

• Around line 15-17: The concurrency group currently uses the branch/ref (${ {
  github.head_ref || github.ref_name } }) which lets different PRs with the same
  branch name cancel each other; update the concurrency.group expression in the
  concurrency block to include the pull request identifier (e.g., use
  github.event.pull_request.number when available) so the key is PR-scoped
  (falling back to head_ref/ref_name for non-PR runs), ensuring unrelated PR runs
  do not cancel each other.

In @cross-app-connect/package.json:

• Around line 20-34: The devDependencies eslint-config-next and
  @next/eslint-plugin-next must match the Next.js version used ("next":
  "~16.2.3"); update the package.json entries for "eslint-config-next" and
  "@next/eslint-plugin-next" to the same 16.2.3 release (or a semver range that
  preserves major.minor 16.2) so parser/rule compatibility is ensured, then
  reinstall deps (npm/yarn) and re-run lint to confirm no rule/parser mismatches.

In @cross-app-connect/src/app/components/AddressTag.tsx:

• Around line 5-8: The current relative imports for resolveContractLabel,
  useAddressInfo, and truncateAddress should use repo path aliases instead of ../
  paths; update the three import statements in AddressTag.tsx to use the src-root
  alias (e.g. replace "../cross-app/_lib/contracts" with
  "@/app/cross-app/_lib/contracts", "../cross-app/_lib/useAddressInfo" with
  "@/app/cross-app/_lib/useAddressInfo", and "../cross-app/_lib/format" with
  "@/app/cross-app/_lib/format") so they follow the "@/..." convention per the
  coding guidelines.

In @cross-app-connect/src/app/components/IdentityRow.tsx:

• Line 53: The current walletPending = !walletAddress || isLoading makes the
  pendingLabel/placeholder branch unreachable when walletAddress is absent; change
  walletPending to depend only on isLoading (e.g., walletPending = isLoading) and
  adjust downstream logic that shows the connect/missing-wallet UI to use
  walletAddress/connected state explicitly so the placeholder branch (the code
  around pendingLabel rendering and the UI in the 93-107 block) can execute when
  loading vs when no wallet is present; update any conditionals that reference
  walletPending to use walletAddress checks where appropriate.
• Around line 5-8: Replace relative imports in IdentityRow.tsx with repo path
  aliases: change useAddressInfo import to use the hooks alias (e.g. import {
  useAddressInfo } from '@hooks/cross-app/_lib/useAddressInfo'), change
  truncateAddress to use the utils alias (e.g. import { truncateAddress } from
  '@utils/cross-app/_lib/format'), change linkedSocials to the components alias
  (e.g. import { linkedSocials } from '@components/socials'), and change the CSS
  import to the components alias (e.g. import styles from
  '@components/IdentityRow.module.css'); keep the same exported symbols
  (useAddressInfo, truncateAddress, linkedSocials, styles) and only update the
  module paths to the @/* style.

In @cross-app-connect/src/app/components/RequesterChip.tsx:

• Around line 5-6: Replace the relative imports with path-alias imports: change
  the import of lookupAppByUrl (symbol: lookupAppByUrl) from
  '../cross-app/_lib/app-hub' to the source-root alias (e.g.
  '@/cross-app/_lib/app-hub'), and change the CSS module import (symbol: styles)
  from './RequesterChip.module.css' to the components alias (e.g.
  '@components/RequesterChip.module.css') so imports follow the repo conventions
  (@/*, @components).

In @cross-app-connect/src/app/cross-app/_components/SignInPanel.tsx:

• Around line 245-257: The PinInput.onComplete handler currently calls
  loginWithCode and also calls setCode, causing duplicate OTP submissions with the
  Verify button's onSubmitCode; remove the loginWithCode call (and its .catch)
  from the onComplete callback so it only calls setCode(v) and relies on
  onSubmitCode to perform loginWithCode({ code }) while preserving the
  submittingCode gating in onSubmitCode to prevent concurrent submissions.

In @cross-app-connect/src/app/cross-app/_lib/client.ts:

• Around line 17-18: Replace the non-null assertion on NEXT_PUBLIC_PRIVY_APP_ID
  used when calling createClient by explicitly validating
  process.env.NEXT_PUBLIC_PRIVY_APP_ID beforehand: check that the value exists and
  matches the same pattern/constraints used for privyDomain, and if not throw a
  descriptive Error (e.g., "Missing or invalid NEXT_PUBLIC_PRIVY_APP_ID") before
  calling createClient so initialization fails fast; update the createClient call
  to use the validated appId variable instead of
  process.env.NEXT_PUBLIC_PRIVY_APP_ID!.

In @cross-app-connect/src/app/cross-app/_lib/lastIdentity.ts:

• Around line 2-11: The code currently writes the raw label (email/phone/Privy
  DID) to localStorage indefinitely; change the storage logic used where
  usePrivy().user is non-null so that you store a short-lived, obfuscated record
  instead: add a TTL (expiry timestamp) and store only the provider plus a masked
  hint (e.g., first char + last char or hashed/truncated hint) rather than the
  full label, and ensure reads check the TTL and reject expired entries; update
  the functions/logic that read/write the last-identity (the code paths
  referencing label, usePrivy().user, and localStorage keys) to enforce
  masking and TTL handling.

In @cross-app-connect/src/app/cross-app/_lib/thor.ts:

• Around line 15-32: The code currently asserts NEXT_PUBLIC_NETWORK_TYPE into
  NETWORK_TYPE and immediately indexes NETWORK, which can produce undefined and
  crash; update the logic around NETWORK_TYPE/NETWORK lookup (symbols:
  NETWORK_TYPE, NETWORK, networkConfig, thor, ThorClient.at) to validate that
  process.env.NEXT_PUBLIC_NETWORK_TYPE is one of the allowed keys ('main'|'test')
  before using it to index NETWORK, default to 'main' or throw a clear error if
  invalid, and ensure thor is constructed from a guaranteed non-undefined
  networkConfig.nodeUrl; apply the identical validation/fallback change to the
  corresponding code in appConfig (the same pattern at lines referenced in the
  review).

In @cross-app-connect/src/app/cross-app/transact/TransactClient.tsx:

• Around line 302-322: The JSON.parse call inside TransactClient.tsx's
  eth_signTypedData_v4 branch can throw on malformed input; wrap parsing of raw
  (params[1]) in a try/catch, handle parse errors by returning null (or the
  existing safe fallback) and optionally logging the error, and ensure typedData
  is only used when parsing succeeds (affecting the typedData, primaryType,
  isSmartAccountAuth, and parseClauses logic).
• Around line 400-410: The code is currently signing parsed.message (decoded
  UTF-8) instead of the original bytes; update the call to signMessage to pass
  parsed.raw as the message input and include an encoding option determined from
  parsed.raw (if parsed.raw startsWith("0x") use encoding: "hex", otherwise
  encoding: "utf-8") so Privy signs the exact original bytes per EIP-191; adjust
  the call site in TransactClient.tsx where signMessage is invoked and ensure
  signature = result.signature remains unchanged.

In @cross-app-connect/src/app/page.tsx:

• Around line 1-31: Update the React peer dependencies in the cross-app-connect
  package by changing the declared versions for react and react-dom in
  package.json to "^18.2.0" (currently "^18"), so they meet Next.js 16.2.3's
  requirement; after editing package.json, run your package manager
  (npm/yarn/pnpm) to reinstall/update lockfile and verify the build. Ensure both
  "react" and "react-dom" entries are updated together to the exact same "^18.2.0"
  spec to avoid version mismatches.

In @cross-app-connect/src/app/providers/PrivyProviderWrapper.tsx:

• Around line 22-23: The code uses a non-null assertion for
  NEXT_PUBLIC_PRIVY_APP_ID in PrivyProviderWrapper
  (appId={process.env.NEXT_PUBLIC_PRIVY_APP_ID!}) which can cause an opaque
  runtime failure; update PrivyProviderWrapper to explicitly validate
  process.env.NEXT_PUBLIC_PRIVY_APP_ID (and optionally
  NEXT_PUBLIC_PRIVY_CLIENT_ID) at startup and throw a descriptive Error (e.g.,
  "Missing required env NEXT_PUBLIC_PRIVY_APP_ID") so the app fails fast with a
  clear message rather than using the non-null assertion.

In @examples/playground/src/app/providers/VechainKitProviderWrapper.tsx:

• Around line 240-242: Remove the non-null assertion on
  NEXT_PUBLIC_DELEGATOR_URL and conditionally pass feeDelegation only when the
  environment variable is defined: check process.env.NEXT_PUBLIC_DELEGATOR_URL
  before constructing the feeDelegation object used by the VechainKit provider
  (the feeDelegation prop and its delegatorUrl field), and omit or set
  feeDelegation to undefined/null when the env var is missing so runtime flows
  don't receive an undefined delegatorUrl.

In @packages/vechain-kit/src/providers/CrossAppErrorRecovery.tsx:

• Around line 29-38: The handler currently trusts any postMessage and forces
  disconnect/openConnectModal when event.data.type ===
  'vk:cross-app-no-connection'; update the handler in CrossAppErrorRecovery (the
  block that reads const type = (event.data as { type?: unknown } | null)?.type
  and then calls disconnect() and openConnectModal()) to first verify event.origin
  is an allowed/trusted origin (and if available, that event.source matches the
  expected popup reference) before performing the disconnect and modal flow; if
  the origin/source check fails, silently ignore the message. Ensure the same
  origin/source validation is applied to the other identical handler at lines
  45-46.

---

Outside diff comments:
In @cross-app-connect/src/app/cross-app/_lib/appConfig.ts:

• Around line 107-113: Normalize and validate NEXT_PUBLIC_NETWORK_TYPE at
  runtime before using it in branching: replace the current casted NETWORK_TYPE
  with logic that reads process.env.NEXT_PUBLIC_NETWORK_TYPE, lowercases/trims it,
  and only accepts the literal 'test' (otherwise default to 'main'); then use that
  normalized NETWORK_TYPE when computing knownContracts (so MAINNET is chosen by
  default for any invalid value). Apply the same runtime-normalization change to
  the analogous variable in thor.ts to prevent silent selection of TESTNET
  addresses.

---

Minor comments:
In @cross-app-connect/README.md:

• Around line 127-131: The fenced environment variable block in README.md is
  missing a language tag (causing MD040); update the code fence that contains
  NEXT_PUBLIC_PRIVY_APP_ID, NEXT_PUBLIC_PRIVY_CLIENT_ID, and
  NEXT_PUBLIC_PRIVY_DOMAIN so the opening fence is annotated (e.g., change ``` to

In `@cross-app-connect/src/app/cross-app/_lib/contracts.ts`:
- Around line 18-51: APP_CONFIG_LABELS is missing human-friendly labels for the
DEX router entries that exist in knownContracts, so those addresses show up as
unverified; update APP_CONFIG_LABELS (the Partial<Record<keyof KnownContracts,
string>> constant) to include entries for each router key present in
KnownContracts (any keys like *RouterAddress or containing "router") and supply
descriptive labels (e.g., "Uniswap V2 Router", "SushiSwap Router", etc.)
matching the router keys so those known router addresses resolve as verified.

In `@cross-app-connect/src/app/cross-app/_lib/decoder.ts`:
- Around line 27-32: The import list in decoder.ts includes an unused symbol
KnownAction; remove KnownAction from the import statement so only
recognizeKnownAction, KnownActionCategory, and KnownActionData are imported.
Locate the import block that currently references KnownAction and delete that
identifier (and any trailing comma if necessary) to satisfy ESLint and keep the
remaining imports unchanged.

In `@cross-app-connect/src/app/cross-app/connect/ConnectClient.tsx`:
- Line 27: The import line bringing in OAUTH_PROVIDERS and OAuthProvider is
unused in ConnectClient (symbols OAUTH_PROVIDERS and OAuthProvider); remove
those unused imports (either delete the entire import statement or remove those
identifiers from the import) so the file no longer imports OAUTH_PROVIDERS and
OAuthProvider unnecessarily.

In `@cross-app-connect/src/app/cross-app/connect/PinInput.tsx`:
- Line 128: The aria-label string in the PinInput component is hardcoded ("Digit
{i+1}") — update the input's aria-label to use your i18n system (e.g.,
t('pin.digitLabel', { number: i + 1 }) or intl.formatMessage({ id:
'pin.digitLabel' }, { number: i + 1 })) instead of the literal template; add a
translation key like "pin.digitLabel" with a placeholder (e.g., "Digit
{number}") in locale files so screen-reader text is localized, and replace the
current aria-label={`Digit ${i + 1}`} in the PinInput render with the i18n call.

In `@cross-app-connect/src/app/cross-app/transact/transact.module.css`:
- Around line 275-282: Replace the deprecated CSS property word-break:
break-word with the modern equivalent overflow-wrap: break-word in the affected
selectors (e.g., .messageBody and the other classes flagged in this diff) to
preserve the same wrapping behavior; locate each occurrence of word-break:
break-word and swap it to overflow-wrap: break-word, removing the deprecated
declaration while keeping the rest of the rules (font-size, color, white-space,
margin) unchanged.

In `@cross-app-connect/src/app/i18n/I18nProvider.tsx`:
- Around line 32-36: In the useEffect that checks `detected`, await the Promise
returned by `i18n.changeLanguage(detected)` before calling `setMounted(true)` so
children only render after the language is applied; update the effect body in
I18nProvider (the useEffect that references `detected`, `i18n.changeLanguage`,
and `setMounted`) to either make the inner function async and await
`i18n.changeLanguage(detected)` or chain `.then()`/`.catch()` to handle
success/failure and only call `setMounted(true)` after the change completes
(include error handling/logging on rejection).

In `@cross-app-connect/src/app/i18n/locales/hi.json`:
- Around line 19-21: The translation for the "abstain" key is incorrect: replace
the current Hindi value "अनुपस्थित" with a governance-accurate term (e.g.,
"मतदान से विरत" or "तटस्थ") so the key "abstain" preserves vote meaning; update
the "abstain" entry in the same JSON object alongside "for" and "against" to use
the chosen glossary-approved string.

In `@cross-app-connect/src/app/i18n/locales/ja.json`:
- Around line 181-183: The translations for clauseSingular, clausePlural, and
clauseLabel incorrectly use "クローズ" (meaning "close"); update those keys to use
the correct Japanese term for "Clause" (e.g., "条項") so the UI reads correctly:
set clauseSingular to "条項", clausePlural to "条項（{{count}}）" (or "条項 ({{count}})"
to match project punctuation), and clauseLabel to "条項 {{index}} / {{total}} ·
宛先" so the signing review displays the proper word.

In `@cross-app-connect/src/app/i18n/locales/ko.json`:
- Around line 181-183: The keys clauseSingular, clausePlural, and clauseLabel
currently use the English-derived "클로즈" and should be updated to the proper
Korean legal term "절"; replace the values for "clauseSingular" -> "절",
"clausePlural" -> "절 ({{count}})" and "clauseLabel" -> "절 {{index}} / {{total}}
· 대상", preserving all placeholders ({{count}}, {{index}}, {{total}}) and
punctuation exactly as in the originals.

In `@docs/login-modal.md`:
- Around line 35-39: The documentation incorrectly states that Social methods
and Email work without a host-supplied privy prop; update the doc text and any
behavior matrix entries referencing "email" and "more" so they match the
implementation: mark "email" as rejected/requires privy and "more" as
allowed/does not require privy (while keeping "passkey" as requiring privy);
search for occurrences of the terms "privy", "email", "more", and "passkey" in
this doc and the other referenced locations and adjust the
defaults/table/migration note to reflect these correct defaults.

In `@examples/playground/tsconfig.json`:
- Around line 38-50: The tsconfig.json has an include pattern
"dist/dev/types/**/*.ts" but the exclude array contains "dist", which prevents
those files from being picked up; fix this by either removing "dist" from the
"exclude" array or narrowing the exclude (e.g., exclude specific folders like
"dist/build") so that "dist/dev/types/**/*.ts" remains included — update the
"exclude" entry accordingly to ensure the include pattern for
"dist/dev/types/**/*.ts" is effective.

---

Nitpick comments:
In `@cross-app-connect/scripts/fetch-app-hub.mjs`:
- Around line 23-33: The ghFetch function currently calls fetch without a
timeout; update ghFetch to create an AbortSignal via
AbortSignal.timeout(timeoutMs) (e.g., 10_000 ms) and pass signal to fetch
options so hung GitHub requests are aborted, and ensure the created timer is
used only for that request; additionally, wrap the fetch call in a simple retry
loop (2-3 attempts) handling AbortError/temporary network errors and rethrow
other errors so transient failures are retried while permanent errors bubble up.

In `@cross-app-connect/src/app/components/VechainHeader.tsx`:
- Around line 4-5: Replace the relative imports with the project's path aliases:
change the RequesterChip import to use the `@components` alias (e.g. import
RequesterChip from '`@components/RequesterChip`') and change the CSS import to use
the src-root alias (e.g. import styles from
'`@/app/components/VechainHeader.module.css`'); update the import statements in
VechainHeader.tsx so they reference RequesterChip and VechainHeader.module.css
via the configured aliases instead of relative paths.

In `@cross-app-connect/src/app/cross-app/_components/SignInPanel.tsx`:
- Around line 14-17: Replace the relative internal imports in SignInPanel (the
imports of socials, getRecentProvider/setRecentProvider, PinInput, and
connect.module.css) with the project's path aliases: use `@components` for
components (e.g. socials, PinInput), `@/`* or `@utils` for utility modules (e.g. the
recent helpers), and `@/`* or `@styles` for CSS modules as per the guidelines;
update the import specifiers referencing '../../components/socials',
'../_lib/recent', '../connect/PinInput', and '../connect/connect.module.css' to
the corresponding alias paths so the module resolution uses
`@components/`@utils/@/* aliases consistently.

In `@cross-app-connect/src/app/cross-app/_lib/app-hub.ts`:
- Line 9: Replace the relative JSON import in app-hub.ts (import data from
'./app-hub.json') with the repository path-alias form rooted at src; update the
import to use the `@/`... alias that points to src (e.g. import from
'`@/app/cross-app/_lib/app-hub.json`') so it follows the repo policy for src
imports and still resolves JSON modules via the existing TS/webpack config.

In `@cross-app-connect/src/app/cross-app/_lib/contracts.ts`:
- Line 11: The import in contracts.ts currently pulls knownContracts and
KnownContracts from a local relative module; change it to use the repository
path-alias convention instead. Replace the relative import so that
knownContracts and KnownContracts are imported via a '`@/`...' alias (e.g., import
{ knownContracts, type KnownContracts } from '`@/`...') to match src module
aliasing and coding guidelines; ensure the aliased path resolves to the same
module that exports knownContracts/KnownContracts and update any surrounding
imports if necessary.

In `@cross-app-connect/src/app/cross-app/_lib/knownActions.ts`:
- Around line 237-242: The unendorseApp action currently sets data: { endorse:
true } which is semantically wrong; update the unendorseApp entry in
knownActions.ts (the unendorseApp factory) to use a correctly named flag such as
data: { endorseAction: true } or set endorse: false, depending on intent, and
ensure any consumers reading the data key (e.g., handlers expecting endorse) are
updated accordingly so the flag name/boolean meaning is consistent across the
codebase.

In `@cross-app-connect/src/app/cross-app/_lib/useAddressInfo.ts`:
- Around line 4-10: Replace the relative import from './thor' with the project
alias-based src import (use the configured `@/` alias) so the same exports —
getAvatarForAddress, getDomainOfAddress, picassoFallback and the DomainInfo type
— are imported via the src alias (e.g. import { getAvatarForAddress,
getDomainOfAddress, picassoFallback, type DomainInfo } from '`@/`.../thor')
instead of './thor'; ensure the alias path points to the same thor module in the
src tree.

In `@cross-app-connect/src/app/cross-app/transact/TransactClient.tsx`:
- Around line 451-458: The onApprove callback (defined with useCallback)
references the localization function t() but t is missing from the dependency
array; update the dependency array for that useCallback (the onApprove callback
in TransactClient.tsx) to include t so React correctly tracks localization
changes (add t alongside client, verified, parsed, signMessage, signTypedData,
getAccessToken).

In `@cross-app-connect/src/app/i18n/config.ts`:
- Around line 6-23: Replace the relative locale imports in config.ts with the
project path-alias form (use "`@/`..." rooted at src) so all locale modules (en,
de, it, fr, es, zh, ja, ru, ro, vi, nl, ko, sv, tw, tr, hi, pt) are imported via
the alias instead of './locales/...'; update each import statement (e.g., the en
import and the other locale imports) to use "`@/app/i18n/locales/`<locale>.json"
(or the correct alias path to the i18n locales directory) so the file follows
the project's alias convention.

In `@cross-app-connect/src/app/i18n/I18nProvider.tsx`:
- Line 5: Replace the relative import in I18nProvider.tsx that imports from
'./config' with the project path alias that points to the same module (use the
'`@/`*' src-root alias), e.g. import the config module via the alias path
(targeting the same file exported by config) so the line importing i18n and
resolveLanguage uses the configured alias instead of a relative path; update the
import statement in the I18nProvider component accordingly.

In `@cross-app-connect/src/app/layout.tsx`:
- Around line 2-4: Replace the relative imports in this module with the
configured path aliases: change the import of PrivyProviderWrapper to use the
src alias (e.g., import PrivyProviderWrapper from
'`@/app/providers/PrivyProviderWrapper`' or the appropriate `@/` path to the
provider), change I18nProvider to use its alias (e.g., '`@/app/i18n/I18nProvider`'
or '`@i18n`' if configured), and update the globals.css import to use
'`@/globals.css`' so all imports (PrivyProviderWrapper, I18nProvider, and
globals.css) use the project's `@/`* alias convention.
- Around line 25-29: Remove the manual <meta name="viewport"> tag from
app/layout.tsx and instead export a Next.js App Router viewport configuration by
adding an exported constant named viewport (type Viewport) with width:
'device-width' and initialScale: 1; ensure the export is at module scope in
layout.tsx so Next.js picks it up and avoid duplicating viewport handling.

In `@cross-app-connect/src/app/page.tsx`:
- Around line 4-5: Replace the relative imports in page.tsx with path aliases:
change the VechainHeader import to use the `@components` alias (import
VechainHeader from '`@components/VechainHeader`') and change the CSS module import
(styles from './page.module.css') to use the src root alias (e.g., styles from
'`@/app/page.module.css`' or the appropriate path under `@/`* for your repo layout)
so both VechainHeader and styles use configured path aliases instead of relative
paths.

In `@packages/vechain-kit/src/providers/CrossAppErrorRecovery.tsx`:
- Line 5: Replace the relative import of useModal from './ModalProvider' with
the project path-alias import (use the `@components` alias for
component/providers): update the import that references useModal in
CrossAppErrorRecovery.tsx to import from the appropriate alias-based path (e.g.
`@components/ModalProvider` or the project's equivalent) so it follows the src
path-alias convention instead of a relative import.

In `@packages/vechain-kit/src/providers/VeChainKitProvider.tsx`:
- Line 55: In VeChainKitProvider.tsx replace the relative import "import {
CrossAppErrorRecovery } from './CrossAppErrorRecovery';" with the configured src
alias form so the module is imported via the project alias (e.g. import {
CrossAppErrorRecovery } from '`@/providers/CrossAppErrorRecovery`';), ensuring you
reference the CrossAppErrorRecovery symbol by the alias instead of a relative
path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

packages/vechain-kit/src/components/common/StatusScreen.tsx (1)

16-16: ⚡ Quick win

Switch local relative import to path alias.

Use the @/... alias here for consistency with repository import conventions.

Diff suggestion

-import { StickyHeaderContainer } from './StickyHeaderContainer';
+import { StickyHeaderContainer } from '`@/components/common/StickyHeaderContainer`';

As per coding guidelines, "**/src/**/*.{ts,tsx}: Use path aliases for imports: @/* for src root, @hooks for hooks, @components for components, @utils for utils`."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/vechain-kit/src/components/common/StatusScreen.tsx` at line 16,
Replace the local relative import of StickyHeaderContainer with the repository
path alias; update the import for StickyHeaderContainer in StatusScreen.tsx to
use the components alias (e.g. import { StickyHeaderContainer } from
'`@components/common/StickyHeaderContainer`' or the project’s root alias
'`@/components/common/StickyHeaderContainer`') so it follows the repo convention
instead of a relative './StickyHeaderContainer' import.

packages/vechain-kit/src/components/ConnectModal/Components/LoginWithGithubButton.tsx (1)

6-7: ⚡ Quick win

Use path aliases instead of relative imports.

Please replace the new relative imports with @/... aliases to match repo conventions.

Diff suggestion

-import { RecommendedDot } from './RecommendedDot';
-import { primaryButtonStyle } from './primaryButtonStyle';
+import { RecommendedDot } from '`@/components/ConnectModal/Components/RecommendedDot`';
+import { primaryButtonStyle } from '`@/components/ConnectModal/Components/primaryButtonStyle`';

As per coding guidelines, "**/src/**/*.{ts,tsx}: Use path aliases for imports: @/* for src root, @hooks for hooks, @components for components, @utils for utils`."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@packages/vechain-kit/src/components/ConnectModal/Components/LoginWithGithubButton.tsx`
around lines 6 - 7, Replace the relative imports for RecommendedDot and
primaryButtonStyle with the repo path aliases: change the import of
RecommendedDot (symbol RecommendedDot) and primaryButtonStyle (symbol
primaryButtonStyle) from their current "./..." relative paths to the
corresponding alias paths (e.g. use `@components/`... or `@/`... per convention) so
they import via the path-alias (for example
`@components/ConnectModal/Components/RecommendedDot` and
`@components/ConnectModal/Components/primaryButtonStyle` or the equivalent alias
that maps to those files) instead of relative paths.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes