[RobotHanzo]

Wires Sentry into the browser app, the SSR webserver on Cloud Run, and the Cloud Functions. Full rationale is in the new Error reporting (Sentry) section of CLAUDE.md.

Runtime	SDK	Entry point	DSN source
Browser	@sentry/vue	src/boot/sentry.ts	Build time, inlined via build.defineEnv
SSR webserver	@sentry/node (src-ssr/package.json)	src-ssr/sentry.ts	Cloud Run env, from .apphosting/service.template.yaml
Cloud Functions	@sentry/node	functions/src/sentry.ts	functions/.env, appended by the deploy workflow

Notable choices

• Inert without a DSN. The client guards fold to constants, so Rolldown drops @sentry/vue out of the bundle entirely — verified: with no DSN the built boot file is literally ({ app, router }) => {}.
• Tracing and Session Replay default to 0, at which they are not merely unsampled but never bundled (~15 KB gz and ~50 KB gz saved).
• SSR capture is explicit in src-ssr/middlewares/render.ts. That middleware catches everything itself and never calls next(err), so an Express error handler would never see a failed render. Redirect and route-not-found rejections are filtered out as normal control flow.
• Functions are instrumented by import, not by editing 16 handlers: functions/src/sentry.ts re-exports onCall / onRequest / onDocumentWritten with identical signatures plus a try/catch. HttpsErrors with caller-fault codes (permission-denied, invalid-argument, …) are deliberately not reported — checkRole() throws those at people who simply are not allowed to do the thing.
• The Sentry lines are appended to functions/.env by the workflow rather than stored inside the FUNCTIONS_ENV secret, so one SENTRY_DSN secret configures all three runtimes and rotating it does not mean hand-editing an opaque blob.

Verification

• yarn build (SSR) and yarn spa-build green — which is the typecheck + lint gate. Built both with and without a DSN.
• cd functions && yarn build && yarn lint green.
• Function wrappers exercised directly: pass-through works, permission-denied rethrows in ~1 ms without flushing, a generic error reports and rethrows.
• Both workflows and the rendered service.yaml parse as valid YAML with the variables set and unset; the generated functions/.env parses with GMAIL_* intact.

Config already applied to this repo

• Secret SENTRY_DSN; variables SENTRY_ORG=cksc, SENTRY_PROJECT=legislation, and the three sample rates at 0.
• Still needed: SENTRY_AUTH_TOKEN (Sentry → Settings → Auth Tokens, scope project:releases). Until it exists, source maps are not uploaded and production stack traces stay minified.

🤖 Generated with Claude Code