@mohasinac/appkit 2.8.9 → 3.0.0

package/dist/next/api/parseJsonBody.js

@@ -0,0 +1,36 @@
+import { ValidationError } from "../../errors";
+/**
+ * Strict JSON body parser for createRouteHandler handlers that need a body
+ * but don't yet use the wrapper's `schema` option. Replaces the silent
+ * `.catch(() => ({}))` pattern.
+ *
+ * On parse failure: throws ValidationError which the route wrapper maps to
+ * 400 / VALIDATION_FAILED. NEVER returns `{}` on failure.
+ *
+ * @example
+ *   const body = await parseJsonBody<{ name: string }>(request);
+ *   const body = await parseJsonBody<{ name?: string }>(request, { allowEmpty: true });
+ */
+export async function parseJsonBody(request, options) {
+    // audit-unknown-ok: callback entry point — accepts arbitrary payload value
+    let raw;
+    try {
+        const text = await request.text();
+        if (!text) {
+            if (options?.allowEmpty) {
+                return {};
+            }
+            throw new ValidationError("Request body is required");
+        }
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        if (err instanceof ValidationError)
+            throw err;
+        throw new ValidationError("Invalid JSON body");
+    }
+    if (raw === null || typeof raw !== "object") {
+        throw new ValidationError("Request body must be a JSON object");
+    }
+    return raw;
+}

package/dist/next/api/routeHandler.d.ts

@@ -1,20 +1,4 @@
-/**
- * createRouteHandler — provider-aware API route handler factory for feat-* packages.
- *
- * Works like letitrip.in's local `createApiHandler` but uses `getProviders().session`
- * for auth instead of a hardwired Firebase Admin call. This makes it portable across
- * all consumer projects that register an `ISessionProvider`.
- *
- * @example
- * ```ts
- * export const POST = createRouteHandler({
- *   auth: true,
- *   roles: ["admin"],
- *   schema: mySchema,
- *   handler: async ({ user, body }) => { ... },
- * });
- * ```
- */
+import type { ApiRouteKey, FirestoreValue } from "../../schemas/types";
 /** Minimal schema interface compatible with Zod v3 and v4. */
 interface ParseableSchema<TOutput> {
     safeParse(data: unknown): {
@@ -31,53 +15,52 @@ export interface RouteUser {
     uid: string;
     email?: string | null;
     displayName?: string;
+    name?: string | null;
     role?: string;
-    [key: string]: unknown;
+    [key: string]: FirestoreValue;
 }
 interface RouteHandlerOptions<TInput = unknown, TParams = Record<string, string>> {
-    /** Require a valid session cookie. Implied when `roles` is set. */
     auth?: boolean;
-    /**
-     * Read the session cookie if present and attach the user, but do not
-     * require authentication. Useful for routes that serve both anonymous
-     * and authenticated callers (e.g. public event participation).
-     */
     authOptional?: boolean;
+    roles?: readonly string[];
+    permission?: string;
     /**
-     * If provided, the verified user's `role` must be in this list.
-     * Implies `auth: true`.
+     * Body validator. Accepts either:
+     *  - A Zod-compatible schema with `safeParse` (existing usage)
+     *  - A registered API route key like `"POST /api/wishlist"` — the helper
+     *    looks up `SCHEMAS.api[key].body` from the central registry (W4).
+     *    Keys must be registered in `appkit/src/schemas/registry.ts`.
+     *
+     * When a key is used, the parsed body is still typed via TInput; provide
+     * the inferred type as the generic for end-to-end safety.
      */
-    roles?: readonly string[];
+    schema?: ParseableSchema<TInput> | ApiRouteKey;
     /**
-     * Fine-grained permission required for this route.
-     * When set: also allows `"employee"` role through the role check, then
-     * verifies the permission via the registered `rbac` provider.
-     * Admin role always bypasses. Requires `rbac` provider to be registered.
-     * Implies `auth: true`.
+     * When `true`, the wrapper allows requests with no body or empty/malformed body
+     * to reach the handler (body will be `undefined`). Only valid when `schema` is
+     * not set. The default is "no body parsing attempted" — handlers that need a body
+     * MUST use `schema`. This option exists for genuine no-content PATCH/DELETE routes.
      */
-    permission?: string;
-    /** Zod schema to validate + parse the JSON request body. */
-    schema?: ParseableSchema<TInput>;
+    bodyOptional?: boolean;
     /**
-     * Response cache policy for unauthenticated GET routes.
-     * Use `false` to disable default public cache headers.
+     * When `true`, requires a parseable JSON body even without a schema. Raw JSON
+     * parse failure → 400 VALIDATION_FAILED. Mutually exclusive with `bodyOptional`.
+     * Useful for routes that accept arbitrary JSON forwarded to a downstream service.
      */
+    bodyRequired?: boolean;
     cache?: false | {
         maxAge?: number;
         sMaxAge?: number;
         staleWhileRevalidate?: number;
     };
-    /** Route handler. `user` is present when `auth: true`. */
     handler: (ctx: {
         request: Request;
         user?: RouteUser;
         body?: TInput;
         params?: TParams;
+        requestId: string;
     }) => Promise<Response>;
 }
-/**
- * Create a typed Next.js App Router handler with built-in auth + Zod validation.
- */
 export declare function createRouteHandler<TInput = unknown, TParams = Record<string, string>>(options: RouteHandlerOptions<TInput, TParams>): (request: Request, context: {
     params: Promise<TParams>;
 }) => Promise<Response>;

package/dist/next/api/routeHandler.js

@@ -1,38 +1,50 @@
+import { normalizeError } from "../../errors/normalize";
 /**
  * createRouteHandler — provider-aware API route handler factory for feat-* packages.
  *
- * Works like letitrip.in's local `createApiHandler` but uses `getProviders().session`
- * for auth instead of a hardwired Firebase Admin call. This makes it portable across
- * all consumer projects that register an `ISessionProvider`.
+ * Owns:
+ *  - Auth (session cookie verify via the registered ISessionProvider).
+ *  - Role + permission gates (admin bypass; employee fine-grained via rbac provider).
+ *  - Body parsing (strict JSON; Zod safe-parse when schema is provided).
+ *  - Default public Cache-Control on unauthenticated GET success responses.
+ *  - The uniform error envelope `{ ok, code, error, issues?, requestId }`.
+ *  - Persisted server-error log (writes 5xx + selected 4xx to `serverErrors`).
+ *
+ * Body parsing rules (workstream 1):
+ *  - With `schema`: body is parsed and safe-parsed once; failure → 400 VALIDATION_FAILED.
+ *  - Without `schema`, default behavior is "no body expected". Set `bodyOptional: true`
+ *    to opt into accepting an empty body for PATCH/DELETE without content. Use
+ *    `bodyRequired: true` to demand a body (raw JSON parse error → 400).
+ *  - The `.catch(() => ({}))` pattern in callers is BANNED. The wrapper handles
+ *    parse errors uniformly so callers receive a parsed value or never reach the handler.
  *
  * @example
  * ```ts
  * export const POST = createRouteHandler({
- *   auth: true,
- *   roles: ["admin"],
- *   schema: mySchema,
- *   handler: async ({ user, body }) => { ... },
+ * auth: true,
+ * roles: ["admin"],
+ * schema: mySchema,
+ * handler: async ({ user, body }) => { ... },
  * });
  * ```
  */
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../contracts";
+import { isAdminUser } from "../../features/auth/role-predicates";
+import { mapToHttpError, HTTP_ERROR_CODES } from "../../errors/error-mapping";
+import { serverErrorsRepository } from "../../features/server-errors/repository/server-errors.repository";
+import { SCHEMAS } from "../../schemas/registry";
 function buildPublicCacheControl(policy) {
     const maxAge = policy?.maxAge ?? 30;
     const sMaxAge = policy?.sMaxAge ?? 300;
     const staleWhileRevalidate = policy?.staleWhileRevalidate ?? 600;
     return `public, max-age=${maxAge}, s-maxage=${sMaxAge}, stale-while-revalidate=${staleWhileRevalidate}`;
 }
-/** Read the `__session` HTTP-only cookie from request headers. */
 function readSessionCookie(request) {
     const cookieHeader = request.headers.get("cookie") ?? "";
     const match = cookieHeader.match(/(?:^|;\s*)__session=([^;]+)/);
     return match ? decodeURIComponent(match[1]) : null;
 }
-/**
- * Verify the session cookie using `getProviders().session`.
- * Returns a `RouteUser` on success, or throws for invalid credentials.
- */
 async function verifySession(request) {
     const { session } = getProviders();
     if (!session) {
@@ -60,14 +72,77 @@ async function verifySession(request) {
         });
     }
 }
+/** RFC4122-ish v4 ID without taking a dep on the runtime crypto module. */
+function generateRequestId() {
+    if (typeof globalThis.crypto?.randomUUID === "function") {
+        return globalThis.crypto.randomUUID();
+    }
+    // Fallback for older runtimes — short random hex
+    return `req_${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+}
+/** Persisted-log codes that warrant a serverErrors row even when status < 500. */
+const LOG_AS_INCIDENT_CODES = new Set([
+    HTTP_ERROR_CODES.INTERNAL,
+    HTTP_ERROR_CODES.UPSTREAM_UNAVAILABLE,
+    HTTP_ERROR_CODES.CONCURRENT_MODIFICATION,
+    HTTP_ERROR_CODES.PRECONDITION_FAILED,
+    HTTP_ERROR_CODES.UNAVAILABLE,
+    HTTP_ERROR_CODES.PAYMENT_ROLLBACK_ATTEMPTED,
+    HTTP_ERROR_CODES.PAYMENT_ROLLBACK_FAILED,
+]);
+function shouldPersist(status, code) {
+    if (status >= 500)
+        return true;
+    return LOG_AS_INCIDENT_CODES.has(code);
+}
 /**
- * Create a typed Next.js App Router handler with built-in auth + Zod validation.
+ * Resolve the body schema for a createRouteHandler call. Accepts either a
+ * direct ParseableSchema or a registered ApiRouteKey string; returns the
+ * resolved schema, or null when the key isn't registered / has no `body`.
+ * Pulls the registry lookup out of the request hot path so the body parsing
+ * branch in createRouteHandler stays flat (audit-code-quality:DEEP_NESTING).
  */
+function resolveBodySchema(schema) {
+    if (typeof schema !== "string")
+        return schema;
+    const entry = SCHEMAS.api[schema];
+    if (!entry || !("body" in entry) || !entry.body)
+        return null;
+    // audit-unknown-ok: TS structural escape — ParseableSchema
+    return entry.body;
+}
+/**
+ * Emit a uniform error envelope. Currently emits BOTH `ok` (new canonical) and
+ * `success` (deprecated, kept until the 211-fetch sweep finishes) so consumers
+ * that still read `body.success` don't break mid-migration. The
+ * audit-server-action-envelope.mjs script in workstream 6 will fail CI as
+ * soon as every consumer is updated, after which `success` is removed from
+ * this helper and the audit re-runs to enforce the cleanup.
+ */
+function errorJson(status, code, message, requestId, 
+// audit-unknown-ok: Route handler body schema parse boundary
+issues) {
+    return NextResponse.json({
+        ok: false,
+        success: false, // deprecated — for compat during the migration sweep
+        code,
+        error: message,
+        ...(issues ? { issues } : {}),
+        requestId,
+    }, { status, headers: { "X-Request-Id": requestId } });
+}
 export function createRouteHandler(options) {
+    if (options.bodyOptional && options.bodyRequired) {
+        throw new Error("createRouteHandler: bodyOptional and bodyRequired are mutually exclusive");
+    }
+    if (options.schema && options.bodyOptional) {
+        throw new Error("createRouteHandler: bodyOptional is invalid when schema is set (schema is always required)");
+    }
     return async (request, context) => {
+        const requestId = generateRequestId();
+        let user;
         try {
             // -- Auth --------------------------------------------------------------
-            let user;
             const needsAuth = options.auth ||
                 (options.roles && options.roles.length > 0) ||
                 !!options.permission;
@@ -79,10 +154,10 @@ export function createRouteHandler(options) {
                     user = await verifySession(request);
                 }
                 catch {
-                    // No valid session — continue as anonymous
+                    // anonymous
                 }
             }
-            // Role check — when `permission` is set, also allow "employee" through
+            // -- Role check --------------------------------------------------------
             const effectiveRoles = options.roles
                 ? options.permission
                     ? [...new Set([...options.roles, "employee"])]
@@ -92,49 +167,75 @@ export function createRouteHandler(options) {
                     : [];
             if (effectiveRoles.length > 0) {
                 if (!user || !effectiveRoles.includes(user.role ?? "")) {
-                    return NextResponse.json({ success: false, error: "Insufficient permissions" }, { status: 403 });
+                    return errorJson(403, HTTP_ERROR_CODES.FORBIDDEN, "Insufficient permissions", requestId);
                 }
             }
             // -- Permission check (employee fine-grained) --------------------------
-            if (options.permission && user && user.role !== "admin") {
+            if (options.permission && user && !isAdminUser(user)) {
                 const { rbac } = getProviders();
                 if (!rbac) {
-                    return NextResponse.json({ success: false, error: "RBAC provider not configured" }, { status: 503 });
+                    return errorJson(503, HTTP_ERROR_CODES.UNAVAILABLE, "RBAC provider not configured", requestId);
                 }
                 const perms = await rbac.getPermissions(user.uid);
                 if (!perms.includes(options.permission)) {
-                    return NextResponse.json({ success: false, error: "Insufficient permissions" }, { status: 403 });
+                    return errorJson(403, HTTP_ERROR_CODES.PERMISSION_DENIED, "Insufficient permissions", requestId);
                 }
             }
-            // -- Body validation ---------------------------------------------------
+            // -- Body parsing ------------------------------------------------------
             let body;
-            if (options.schema) {
+            const resolvedSchema = options.schema
+                ? resolveBodySchema(options.schema)
+                : undefined;
+            if (options.schema && !resolvedSchema) {
+                return errorJson(500, HTTP_ERROR_CODES.INTERNAL, `Route schema not registered: ${String(options.schema)}`, requestId);
+            }
+            if (resolvedSchema) {
+                // audit-unknown-ok: callback entry point — accepts arbitrary payload value
                 let raw;
                 try {
                     raw = await request.json();
                 }
                 catch {
-                    return NextResponse.json({ success: false, error: "Invalid JSON body" }, { status: 400 });
+                    return errorJson(400, HTTP_ERROR_CODES.VALIDATION_FAILED, "Invalid JSON body", requestId);
                 }
-                const result = options.schema.safeParse(raw);
+                const result = resolvedSchema.safeParse(raw);
                 if (!result.success) {
-                    return NextResponse.json({
-                        success: false,
-                        error: "Validation failed",
-                        issues: result.error.issues ?? [],
-                    }, { status: 400 });
+                    return errorJson(400, HTTP_ERROR_CODES.VALIDATION_FAILED, "Validation failed", requestId, result.error.issues ?? []);
                 }
                 body = result.data;
             }
-            // -- Params ------------------------------------------------------------
+            else if (options.bodyRequired) {
+                try {
+                    body = (await request.json());
+                }
+                catch {
+                    return errorJson(400, HTTP_ERROR_CODES.VALIDATION_FAILED, "Invalid JSON body", requestId);
+                }
+            }
+            else if (options.bodyOptional) {
+                // Best-effort parse; tolerate empty/malformed body.
+                try {
+                    const text = await request.text();
+                    body = text ? JSON.parse(text) : undefined;
+                }
+                catch {
+                    body = undefined;
+                }
+            }
+            // -- Params + handler --------------------------------------------------
             const params = context?.params ? await context.params : undefined;
             const response = await options.handler({
                 request,
                 user,
                 body,
                 params: params,
+                requestId,
             });
-            const hasCredentialHeaders = !!request.headers.get("authorization") || !!request.headers.get("cookie");
+            // Always tag the response with the request id for traceability.
+            response.headers.set("X-Request-Id", requestId);
+            // -- Default public cache (unauth GET success) -------------------------
+            const hasCredentialHeaders = !!request.headers.get("authorization") ||
+                !!request.headers.get("cookie");
             const canApplyDefaultPublicCache = request.method === "GET" &&
                 !needsAuth &&
                 options.cache !== false &&
@@ -147,23 +248,35 @@ export function createRouteHandler(options) {
                 response.headers.set("Cache-Control", buildPublicCacheControl(policy));
             }
             return response;
+            // audit-unknown-ok: error-handler entry point — accepts thrown values of any shape
         }
         catch (err) {
-            const e = err;
-            const status = typeof e?.statusCode === "number"
-                ? e.statusCode
-                : typeof e?.status === "number"
-                    ? e.status
-                    : 500;
-            const message = err instanceof Error ? err.message : "Internal server error";
-            // 401/403 are expected for protected routes and should not be error-noisy.
-            if (status >= 500) {
-                console.error(`[createRouteHandler] ${request.method} failed`, err);
+            void normalizeError(err);
+            const mapped = mapToHttpError(err, {
+                isProduction: process.env.NODE_ENV === "production",
+            });
+            // -- Persisted log (5xx + selected 4xx) --------------------------------
+            if (shouldPersist(mapped.status, mapped.code)) {
+                void serverErrorsRepository().record({
+                    source: "vercel",
+                    route: new URL(request.url).pathname,
+                    method: request.method,
+                    ...(user?.uid ? { userId: user.uid } : {}),
+                    code: mapped.code,
+                    message: mapped.message,
+                    stack: err instanceof Error ? err.stack : undefined,
+                    requestId,
+                    userAgent: request.headers.get("user-agent") ?? undefined,
+                });
+            }
+            // -- console-side surface ---------------------------------------------
+            if (mapped.status >= 500) {
+                console.error(`[createRouteHandler] ${request.method} ${new URL(request.url).pathname} failed [${requestId}]`, err);
             }
-            else if (status >= 400 && status !== 401 && status !== 403) {
-                console.warn(`[createRouteHandler] ${request.method} failed (${status})`, err);
+            else if (mapped.status >= 400 && mapped.status !== 401 && mapped.status !== 403) {
+                console.warn(`[createRouteHandler] ${request.method} ${new URL(request.url).pathname} failed (${mapped.status}) [${requestId}]`, mapped.code, mapped.message);
             }
-            return NextResponse.json({ success: false, error: message }, { status });
+            return errorJson(mapped.status, mapped.code, mapped.message, requestId, mapped.issues);
         }
     };
 }

package/dist/next/cache-middleware.d.ts

@@ -6,8 +6,8 @@
  * @example
  * ```ts
  * export const GET = withCache(
- *   async (request) => { ... return NextResponse.json(data); },
- *   { ttl: 5 * 60 * 1000 }
+ * async (request) => { ... return NextResponse.json(data); },
+ * { ttl: 5 * 60 * 1000 }
  * );
  * ```
  */

package/dist/next/cache-middleware.js

@@ -6,8 +6,8 @@
  * @example
  * ```ts
  * export const GET = withCache(
- *   async (request) => { ... return NextResponse.json(data); },
- *   { ttl: 5 * 60 * 1000 }
+ * async (request) => { ... return NextResponse.json(data); },
+ * { ttl: 5 * 60 * 1000 }
  * );
  * ```
  */
@@ -30,7 +30,9 @@ function isCacheable(request, config) {
     return methods.includes(request.method);
 }
 export function withCache(handler, config = {}) {
-    return async (request, ...args) => {
+    return async (request, 
+    // audit-unknown-ok: Next.js middleware boundary
+    ...args) => {
         if (!isCacheable(request, config)) {
             return handler(request, ...args);
         }

package/dist/next/components/ErrorView.js

@@ -17,16 +17,16 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  *   }
  */
 import { useEffect } from "react";
-import { Div } from "../../ui/components/Div";
 import { Heading, Text } from "../../ui/components/Typography";
 import { Button } from "../../ui/components/Button";
+import { Stack } from "@mohasinac/appkit";
 import { trackError, ErrorCategory, ErrorSeverity, } from "../../monitoring/error-tracking";
 export function ErrorView({ error, reset, heading = "Something went wrong", description = "An unexpected error occurred. Please try again.", retryLabel = "Try again", }) {
     useEffect(() => {
         trackError(error, ErrorCategory.UNKNOWN, ErrorSeverity.HIGH, {
             component: "ErrorView",
-            metadata: { digest: error.digest },
+            metadata: { digest: error.digest ?? null },
         });
     }, [error]);
-    return (_jsxs(Div, { role: "alert", className: "flex flex-col items-center justify-center min-h-[50vh] px-8 text-center", children: [_jsx(Heading, { level: 2, className: "mb-2", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-6", children: description }), process.env.NODE_ENV === "development" && error.digest && (_jsxs(Text, { variant: "muted", size: "xs", className: "mb-4", children: ["digest: ", error.digest] })), _jsx(Button, { type: "button", variant: "primary", onClick: reset, children: retryLabel })] }));
+    return (_jsxs(Stack, { justify: "center", role: "alert", className: "min-h-[50vh] text-center", padding: "x-xl", align: "center", children: [_jsx(Heading, { level: 2, className: "mb-2", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-6", children: description }), process.env.NODE_ENV === "development" && error.digest && (_jsxs(Text, { variant: "muted", size: "xs", className: "mb-4", children: ["digest: ", error.digest] })), _jsx(Button, { type: "button", variant: "primary", onClick: reset, children: retryLabel })] }));
 }

package/dist/next/components/GlobalError.js

@@ -12,13 +12,13 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  *   export { GlobalError as default } from "@mohasinac/appkit/next";
  */
 import { useEffect } from "react";
-import { Button, Heading, Text } from "../../ui";
+import { Button, Heading, Pre, Text } from "../../ui";
 import { trackError, ErrorCategory, ErrorSeverity, } from "../../monitoring/error-tracking";
 export function GlobalError({ error, reset }) {
     useEffect(() => {
         trackError(error, ErrorCategory.UNKNOWN, ErrorSeverity.CRITICAL, {
             component: "GlobalError",
-            metadata: { digest: error.digest },
+            metadata: { digest: error.digest ?? null },
         });
     }, [error]);
     return (_jsx("html", { children: _jsxs("body", { style: {
@@ -31,7 +31,7 @@ export function GlobalError({ error, reset }) {
                 fontFamily: "system-ui, sans-serif",
                 padding: "2rem",
                 textAlign: "center",
-            }, children: [_jsx(Heading, { level: 1, style: { fontSize: "2rem", marginBottom: "0.5rem" }, children: "Something went wrong" }), _jsx(Text, { style: { opacity: 0.7, marginBottom: "1.5rem" }, children: "A critical error occurred. We're working on it." }), process.env.NODE_ENV === "development" && (_jsxs("pre", { style: {
+            }, children: [_jsx(Heading, { level: 1, style: { fontSize: "2rem", marginBottom: "0.5rem" }, children: "Something went wrong" }), _jsx(Text, { style: { opacity: 0.7, marginBottom: "1.5rem" }, children: "A critical error occurred. We're working on it." }), process.env.NODE_ENV === "development" && (_jsxs(Pre, { style: {
                         fontSize: "0.75rem",
                         padding: "1rem",
                         background: "#f3f4f6",

package/dist/next/components/NotFoundView.js

@@ -1,25 +1,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-/**
- * NotFoundView — Next.js not-found.tsx template.
- *
- * Rendered when `notFound()` is called inside a route segment, or when a
- * route is not matched.
- * @see https://nextjs.org/docs/app/api-reference/file-conventions/not-found
- *
- * Usage in your app:
- *   // app/[locale]/not-found.tsx
- *   export { NotFoundView as default } from "@mohasinac/appkit/next";
- *
- *   // Or with customisation:
- *   import { NotFoundView } from "@mohasinac/appkit/next";
- *   export default function NotFound() {
- *     return <NotFoundView heading="Page not found" homeHref="/en" />;
- *   }
- */
-import { Div } from "../../ui/components/Div";
 import { Heading, Text } from "../../ui/components/Typography";
 import { TextLink } from "../../ui/components/TextLink";
 import { DEFAULT_ROUTE_MAP } from "../routing/route-map";
+import { Stack } from "@mohasinac/appkit";
 export function NotFoundView({ heading = "404 — Page not found", description = "The page you are looking for does not exist.", homeLabel = "Go home", homeHref = DEFAULT_ROUTE_MAP.HOME, }) {
-    return (_jsxs(Div, { className: "flex flex-col items-center justify-center min-h-[60vh] px-8 text-center", children: [_jsx(Heading, { level: 1, variant: "primary", className: "text-7xl font-bold mb-2", children: "404" }), _jsx(Heading, { level: 2, className: "mb-3", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-8", children: description }), _jsx(TextLink, { href: homeHref, children: homeLabel })] }));
+    return (_jsxs(Stack, { justify: "center", className: "min-h-[60vh] text-center", padding: "x-xl", align: "center", children: [_jsx(Heading, { level: 1, variant: "primary", size: "7xl", className: "mb-2", weight: "bold", children: "404" }), _jsx(Heading, { level: 2, className: "mb-3", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-8", children: description }), _jsx(TextLink, { href: homeHref, children: homeLabel })] }));
 }

package/dist/next/components/UnauthorizedView.js

@@ -1,22 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-/**
- * UnauthorizedView — 401 page template.
- *
- * Render this when a user tries to access a resource they are not
- * authenticated for. Wire up the `loginHref` prop to your sign-in route.
- *
- * Usage in your app:
- *   // app/[locale]/unauthorized/page.tsx
- *   import { UnauthorizedView } from "@mohasinac/appkit/next";
- *   export default function UnauthorizedPage() {
- *     return <UnauthorizedView loginHref="/en/auth/login" />;
- *   }
- */
-import { Div } from "../../ui/components/Div";
 import { Row } from "../../ui/components/Layout";
 import { Heading, Text } from "../../ui/components/Typography";
 import { TextLink } from "../../ui/components/TextLink";
 import { DEFAULT_ROUTE_MAP } from "../routing/route-map";
+import { Stack } from "@mohasinac/appkit";
 export function UnauthorizedView({ heading = "401 — Unauthorized", description = "You need to be signed in to view this page.", loginLabel = "Sign in", loginHref = DEFAULT_ROUTE_MAP.AUTH.LOGIN, homeLabel = "Go home", homeHref = DEFAULT_ROUTE_MAP.HOME, }) {
-    return (_jsxs(Div, { className: "flex flex-col items-center justify-center min-h-[60vh] px-8 text-center", children: [_jsx(Heading, { level: 1, variant: "primary", className: "text-7xl font-bold mb-2", children: "401" }), _jsx(Heading, { level: 2, className: "mb-3", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-8", children: description }), _jsxs(Row, { gap: "md", children: [_jsx(TextLink, { href: loginHref, children: loginLabel }), _jsx(TextLink, { href: homeHref, children: homeLabel })] })] }));
+    return (_jsxs(Stack, { justify: "center", className: "min-h-[60vh] text-center", padding: "x-xl", align: "center", children: [_jsx(Heading, { level: 1, variant: "primary", size: "7xl", className: "mb-2", weight: "bold", children: "401" }), _jsx(Heading, { level: 2, className: "mb-3", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-8", children: description }), _jsxs(Row, { gap: "md", children: [_jsx(TextLink, { href: loginHref, children: loginLabel }), _jsx(TextLink, { href: homeHref, children: homeLabel })] })] }));
 }

package/dist/next/middleware/chain.d.ts

@@ -31,16 +31,16 @@ export interface CreateApiMiddlewareConfig<TCtx extends BaseRequestContext> {
  * ```ts
  * // Simple route with scrubber only
  * export const GET = createApiMiddleware({})(async (_input, _ctx, req) => {
- *   const data = await getProducts();
- *   return NextResponse.json({ data });
+ * const data = await getProducts();
+ * return NextResponse.json({ data });
  * });
  *
  * // Route with auth context + custom middleware
  * export const GET = createApiMiddleware({
- *   middlewares: [myCustomMiddleware],
+ * middlewares: [myCustomMiddleware],
  * })(async (_input, ctx, _req) => {
- *   // ctx is AuthRequestContext
- *   return NextResponse.json({ uid: ctx.user.uid });
+ * // ctx is AuthRequestContext
+ * return NextResponse.json({ uid: ctx.user.uid });
  * });
  * ```
  */

package/dist/next/middleware/chain.js

@@ -1,3 +1,4 @@
+import { normalizeError } from "../../errors/normalize";
 import { NextResponse } from "next/server";
 import { piiScrubberMiddleware } from "./pii-scrubber";
 /**
@@ -41,16 +42,16 @@ export function buildBaseContext(request) {
  * ```ts
  * // Simple route with scrubber only
  * export const GET = createApiMiddleware({})(async (_input, _ctx, req) => {
- *   const data = await getProducts();
- *   return NextResponse.json({ data });
+ * const data = await getProducts();
+ * return NextResponse.json({ data });
  * });
  *
  * // Route with auth context + custom middleware
  * export const GET = createApiMiddleware({
- *   middlewares: [myCustomMiddleware],
+ * middlewares: [myCustomMiddleware],
  * })(async (_input, ctx, _req) => {
- *   // ctx is AuthRequestContext
- *   return NextResponse.json({ uid: ctx.user.uid });
+ * // ctx is AuthRequestContext
+ * return NextResponse.json({ uid: ctx.user.uid });
  * });
  * ```
  */
@@ -63,6 +64,7 @@ export function createApiMiddleware(config = {}) {
                 ...middlewares,
                 // Apply PII scrubber last (wraps all other middleware output)
                 ...(scrubPii
+                    // audit-unknown-ok: TS structural escape — Middleware
                     ? [piiScrubberMiddleware]
                     : []),
             ];
@@ -71,6 +73,7 @@ export function createApiMiddleware(config = {}) {
                     return await routeFn({}, ctx, request);
                 }
                 catch (err) {
+                    void normalizeError(err);
                     const message = err instanceof Error ? err.message : "Internal server error";
                     return NextResponse.json({ error: message }, { status: 500 });
                 }