@mohasinac/appkit 3.2.11 → 3.2.14

package/dist/_internal/server/features/checkout/actions.js

@@ -1,4 +1,5 @@
 import { normalizeError } from "../../../../errors/normalize";
+import { safeFireAndForget } from "../../../../utils/safe-fire-forget";
 /**
  * Checkout server actions (appkit).
  *
@@ -29,6 +30,7 @@ import { formatShippingAddress } from "./data";
 import { enforceMaxPerUserForCart, computePrizeRevealDeadline, } from "./prize-bundle-gates";
 import { getListingRule, runSyncPreflight, } from "../../../shared/checkout/rules";
 import { cartIsDigitalOnly } from "../../../shared/listing-types/cart-shipping";
+const AUDIT_LOG_FAIL_MSG = "checkout: audit log failed (non-critical)";
 /**
  * SB-UNI-N — Atomically claim the next available digital code for a confirmed
  * order. Pre-fetches a candidate code outside the transaction then locks and
@@ -264,7 +266,7 @@ export async function createCheckoutOrderAction(input) {
         if (!addressId) {
             failedCheckoutRepository
                 .logCheckout(uid, "address_not_found", "Address required for physical cart", { addressId: "", paymentMethod })
-                .catch(console.error);
+                .catch((err) => { void normalizeError(err); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: err instanceof Error ? err.message : String(err) }); });
             throw new NotFoundError(ERROR_MESSAGES.CHECKOUT.ADDRESS_REQUIRED);
         }
         const addressDoc = await unitOfWork.addresses.findById(addressId);
@@ -275,7 +277,7 @@ export async function createCheckoutOrderAction(input) {
         if (!resolvedAddress) {
             failedCheckoutRepository
                 .logCheckout(uid, "address_not_found", "Address not found", { addressId, paymentMethod })
-                .catch(console.error);
+                .catch((err) => { void normalizeError(err); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: err instanceof Error ? err.message : String(err) }); });
             throw new NotFoundError(ERROR_MESSAGES.CHECKOUT.ADDRESS_REQUIRED);
         }
         shippingAddress = formatShippingAddress(resolvedAddress);
@@ -414,7 +416,7 @@ export async function createCheckoutOrderAction(input) {
             addressId,
             paymentMethod,
         })
-            .catch(console.error);
+            .catch((logErr) => { void normalizeError(logErr); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: logErr instanceof Error ? logErr.message : String(logErr) }); });
         throw err;
     }
     const { available, unavailable, emailOtpUsed } = stockResult;
@@ -425,7 +427,7 @@ export async function createCheckoutOrderAction(input) {
             paymentMethod,
             cartItemCount: cartItems.length,
         })
-            .catch(console.error);
+            .catch((logErr) => { void normalizeError(logErr); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: logErr instanceof Error ? logErr.message : String(logErr) }); });
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.INSUFFICIENT_STOCK);
     }
     const appliedCoupons = cart.appliedCoupons ?? [];
@@ -669,7 +671,7 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             gatewayPaymentId: razorpay_payment_id,
             addressId,
         })
-            .catch(console.error);
+            .catch((logErr) => { void normalizeError(logErr); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: logErr instanceof Error ? logErr.message : String(logErr) }); });
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PAYMENT_FAILED);
     }
     const cart = await unitOfWork.carts.getOrCreate(uid);
@@ -711,7 +713,7 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
                 gatewayPaymentId: razorpay_payment_id,
                 addressId,
             })
-                .catch(console.error);
+                .catch((err) => { void normalizeError(err); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: err instanceof Error ? err.message : String(err) }); });
             throw new ApiError(403, "Order verification required. Please complete OTP verification and retry.");
         }
     }
@@ -762,7 +764,7 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
                 gatewayPaymentId: razorpay_payment_id,
                 addressId,
             })
-                .catch(console.error);
+                .catch((err) => { void normalizeError(err); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: err instanceof Error ? err.message : String(err) }); });
             throw new ValidationError(exists
                 ? ERROR_MESSAGES.CHECKOUT.INSUFFICIENT_STOCK
                 : ERROR_MESSAGES.CHECKOUT.PRODUCT_UNAVAILABLE);
@@ -790,7 +792,7 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
                 amountRs: paidAmountRs,
                 addressId,
             })
-                .catch(console.error);
+                .catch((err) => { void normalizeError(err); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: err instanceof Error ? err.message : String(err) }); });
             throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PAYMENT_FAILED);
         }
     }
@@ -996,7 +998,7 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     });
     if (!isDigitalCartRazorpay && addressId) {
         const otpRefForDelete = consentOtpRef(db, uid, addressId);
-        otpRefForDelete.delete().catch(console.error);
+        safeFireAndForget(otpRefForDelete.delete(), "checkout: delete OTP consent ref after Razorpay payment");
     }
     if (emailsToSend.length > 0) {
         Promise.all(emailsToSend.map((e) => sendOrderConfirmationEmail(e))).catch((err) => serverLogger.error("Order confirmation email error:", err));

package/dist/_internal/server/features/grouped/data.js

@@ -1,5 +1,7 @@
 import { cache } from "react";
 import { getAdminDb } from "../../../../providers/db-firebase";
+import { normalizeError } from "../../../../errors/normalize";
+import { serverLogger } from "../../../../monitoring/server-logger";
 import { GROUPED_LISTINGS_COLLECTION, } from "../../../../features/grouped/schemas/firestore";
 import { productRepository } from "../../../../repositories";
 import { PRODUCT_FIELDS, CATEGORY_FIELDS } from "../../../../constants/field-names";
@@ -55,7 +57,9 @@ export const getGroupedListingForDetail = cache(async (slug) => {
         }
         return mapDoc(snap.docs[0]);
     }
-    catch {
+    catch (err) {
+        void normalizeError(err);
+        serverLogger.warn("grouped-data: getGroupedListingForDetail failed — returning null", { slug, error: err instanceof Error ? err.message : String(err) });
         return null;
     }
 });
@@ -93,7 +97,9 @@ export async function listGroupedListings(params = {}) {
             .get();
         return snap.docs.map(mapDoc);
     }
-    catch {
+    catch (err) {
+        void normalizeError(err);
+        serverLogger.warn("grouped-data: listGroupedListings failed — returning empty", { params, error: err instanceof Error ? err.message : String(err) });
         return [];
     }
 }
@@ -118,7 +124,9 @@ export async function listSitemapGroupedListings() {
             };
         });
     }
-    catch {
+    catch (err) {
+        void normalizeError(err);
+        serverLogger.warn("grouped-data: listSitemapGroupedListings failed — returning empty", { error: err instanceof Error ? err.message : String(err) });
         return [];
     }
 }

package/dist/_internal/server/features/products/data.js

@@ -2,6 +2,8 @@ import { cache } from "react";
 import { productRepository } from "../../../../repositories";
 import { reviewRepository } from "../../../../repositories";
 import { getAdminDb } from "../../../../providers/db-firebase";
+import { normalizeError } from "../../../../errors/normalize";
+import { serverLogger } from "../../../../monitoring/server-logger";
 import { PRODUCT_COLLECTION } from "../../../../features/products/schemas/firestore";
 import { PRODUCTS_SITEMAP_LIMIT } from "../../../shared/features/products/config";
 import { PRODUCT_FIELDS } from "../../../../constants/field-names";
@@ -46,7 +48,9 @@ export async function listSitemapProducts() {
             };
         });
     }
-    catch {
+    catch (err) {
+        void normalizeError(err);
+        serverLogger.warn("products-data: listSitemapProducts failed — returning empty", { error: err instanceof Error ? err.message : String(err) });
         return [];
     }
 }

package/dist/_internal/server/jobs/core/listingProcessor.js

@@ -83,7 +83,8 @@ function decodeCursor(cursor) {
         const page = Number(parsed.page);
         return Number.isFinite(page) && page > 0 ? page : null;
     }
-    catch {
+    catch (_err) {
+        // Malformed base64 or JSON — treat as no cursor (start from first page)
         return null;
     }
 }

package/dist/_internal/server/jobs/core/wrapJobHandler.js

@@ -21,8 +21,8 @@ async function persist(name, err, ctxLike) {
             occurredAt: (ctxLike?.now ?? new Date()).getTime(),
         });
     }
-    catch {
-        /* logging-the-logging-failure is forbidden */
+    catch (_err) {
+        // Logging the logging failure would cause infinite recursion — intentionally swallowed
     }
 }
 export function wrapScheduleHandler(name, handler) {

package/dist/_internal/shared/listing-types/action-tracker.js

@@ -36,8 +36,8 @@ export const actionTracker = {
                 result.catch((err) => { void normalizeError(err); });
             }
         }
-        catch {
-            // Intentionally swallowed — telemetry must never break callers.
+        catch (_err) {
+            // Telemetry sink threw synchronously — swallowed so the caller action always completes
         }
     },
 };

package/dist/features/admin/actions/notification-actions.js

@@ -62,8 +62,9 @@ export async function sendNotification(input) {
         userChannelPrefs = fetchedUserDoc?.notificationPreferences?.channels ?? {};
         userTypePrefs = fetchedUserDoc?.notificationPreferences?.types ?? {};
     }
-    catch {
-        // non-fatal: fall through with empty prefs (all enabled)
+    catch (err) {
+        void normalizeError(err);
+        serverLogger.warn("notification-actions: user prefs lookup failed — defaulting to all channels enabled", { userId: input.userId, error: err instanceof Error ? err.message : String(err) });
     }
     // If caller didn't supply userEmail, try to decrypt it from the already-fetched user doc.
     const resolvedEmail = userEmail ??

package/dist/features/admin/repository/chat.repository.js

@@ -181,8 +181,8 @@ class ChatRepository extends BaseRepository {
                 try {
                     await getAdminRealtimeDb().ref(`/chat/${chatId}`).remove();
                 }
-                catch {
-                    // Non-fatal — RTDB subtree cleanup is best-effort
+                catch (_err) {
+                    // RTDB cleanup is best-effort — Firestore doc already deleted, messages will be orphaned until TTL cleanup
                 }
                 return "deleted";
             }
@@ -210,8 +210,8 @@ class ChatRepository extends BaseRepository {
             try {
                 await getAdminRealtimeDb().ref(`/chat/${chatId}`).remove();
             }
-            catch {
-                // Non-fatal
+            catch (_err) {
+                // RTDB cleanup is best-effort — adminDeleted flag in Firestore already revokes access
             }
         }
         catch (error) {

package/dist/features/admin/repository/site-settings.repository.js

@@ -1,4 +1,5 @@
 import { normalizeError } from "../../../errors/normalize";
+import { serverLogger } from "../../../monitoring/server-logger";
 /**
  * Site Settings Repository
  *
@@ -131,8 +132,9 @@ export class SiteSettingsRepository extends BaseRepository {
                 try {
                     result[key] = decryptSecret(value);
                 }
-                catch {
-                    result[key] = ""; // auth-tag mismatch or malformed blob → treat as missing
+                catch (_err) {
+                    // Auth-tag mismatch or malformed ciphertext (e.g., key rotation) — treat as missing credential
+                    result[key] = "";
                 }
             }
         }
@@ -210,8 +212,10 @@ export class SiteSettingsRepository extends BaseRepository {
                 .get();
             return doc.exists;
         }
-        catch {
-            return false;
+        catch (err) {
+            void normalizeError(err);
+            serverLogger.error("site-settings-repo: exists() Firestore read failed — rethrowing to avoid masking missing settings", { error: err instanceof Error ? err.message : String(err) });
+            throw err;
         }
     }
     /**

package/dist/features/cron/jobs/auction-expiry.job.js

@@ -1,5 +1,7 @@
 import { sieveFilter, sieveAnd, SIEVE_OP } from "@mohasinac/appkit";
 import { createCronJob } from "../registry";
+import { normalizeError } from "../../../errors/normalize";
+import { serverLogger } from "../../../monitoring/server-logger";
 export function createAuctionExpiryJob(auctionRepo) {
     return createCronJob({
         name: "auctions_expire",
@@ -26,7 +28,9 @@ export function createAuctionExpiryJob(auctionRepo) {
                 });
                 processed++;
             }
-            catch {
+            catch (err) {
+                void normalizeError(err);
+                serverLogger.warn("auction-expiry: per-auction close failed", { auctionId: auction.id, error: err instanceof Error ? err.message : String(err) });
                 errors++;
             }
         }

package/dist/features/cron/jobs/preorder-reminder.job.js

@@ -1,5 +1,7 @@
 import { sieveFilter, sieveAnd, SIEVE_OP } from "@mohasinac/appkit";
 import { createCronJob } from "../registry";
+import { normalizeError } from "../../../errors/normalize";
+import { serverLogger } from "../../../monitoring/server-logger";
 export function createPreOrderReminderJob(preOrderRepo) {
     const sevenDaysFromNow = () => {
         const d = new Date();
@@ -28,7 +30,9 @@ export function createPreOrderReminderJob(preOrderRepo) {
                 });
                 processed++;
             }
-            catch {
+            catch (err) {
+                void normalizeError(err);
+                serverLogger.warn("preorder-reminder: per-order update failed", { orderId: order.id, error: err instanceof Error ? err.message : String(err) });
                 errors++;
             }
         }

package/dist/features/promotions/repository/coupons.repository.js

@@ -1,4 +1,5 @@
 import { normalizeError } from "../../../errors/normalize";
+import { serverLogger } from "../../../monitoring/server-logger";
 /**
  * Coupons Repository
  *
@@ -270,8 +271,10 @@ export class CouponsRepository extends BaseRepository {
             const data = doc.data();
             return data.usageCount ?? 1;
         }
-        catch {
-            return 0;
+        catch (err) {
+            void normalizeError(err);
+            serverLogger.error("coupons-repo: getUserCouponUsageCount failed — rethrowing to prevent coupon limit bypass", { userId, couponId, error: err instanceof Error ? err.message : String(err) });
+            throw err;
         }
     }
     /**

package/dist/features/scams/repository/scammer.repository.js

@@ -1,6 +1,7 @@
 import { DatabaseError } from "../../../errors";
 import { BaseRepository, prepareForFirestore, } from "../../../providers/db-firebase";
 import { normalizeError } from "../../../errors/normalize";
+import { serverLogger } from "../../../monitoring/server-logger";
 import { increment } from "../../../contracts/field-ops";
 import { SCAMMER_COLLECTION, SCAMMER_FIELDS, SCAMMER_INCIDENTS_SUBCOLLECTION, SCAMMER_COMMENTS_SUBCOLLECTION, DEFAULT_SCAMMER_DATA, } from "../schemas/firestore";
 class ScammerRepository extends BaseRepository {
@@ -116,7 +117,9 @@ class ScammerRepository extends BaseRepository {
                 .get();
             return snap.docs.map((d) => this.mapDoc(d));
         }
-        catch {
+        catch (err) {
+            void normalizeError(err);
+            serverLogger.warn("scammer-repo: listPublicIncidents failed — returning empty", { scammerId, error: err instanceof Error ? err.message : String(err) });
             return [];
         }
     }
@@ -132,7 +135,9 @@ class ScammerRepository extends BaseRepository {
                 .get();
             return snap.docs.map((d) => this.mapDoc(d));
         }
-        catch {
+        catch (err) {
+            void normalizeError(err);
+            serverLogger.warn("scammer-repo: listPublicComments failed — returning empty", { scammerId, error: err instanceof Error ? err.message : String(err) });
             return [];
         }
     }
@@ -143,7 +148,9 @@ class ScammerRepository extends BaseRepository {
             const results = await Promise.all(ids.slice(0, 5).map((id) => this.findById(id).catch(() => null)));
             return results.filter((d) => d !== null && d.status === "verified");
         }
-        catch {
+        catch (err) {
+            void normalizeError(err);
+            serverLogger.warn("scammer-repo: findManyById failed — returning empty", { ids, error: err instanceof Error ? err.message : String(err) });
             return [];
         }
     }

package/dist/utils/media-url.js

@@ -1,4 +1,5 @@
 import { MEDIA_ENDPOINTS } from "../constants/api-endpoints";
+import { normalizeError } from "../errors/normalize";
 /**
  * Single source of truth for the Firebase Storage host literal. Every other
  * appkit + consumer module that needs to detect or allowlist this host
@@ -31,7 +32,8 @@ export function resolveMediaUrl(url) {
         }
         return MEDIA_ENDPOINTS.EXT_URL(url);
     }
-    catch {
+    catch (_err) {
+        void normalizeError(_err); // URL constructor throws for non-URL strings (e.g., relative paths) — return original
         return url;
     }
 }

package/dist/validation/url.validator.js

@@ -1,12 +1,14 @@
 /**
  * URL Validation Utilities
  */
+import { normalizeError } from "../errors/normalize";
 export function isValidUrl(url) {
     try {
         new URL(url);
         return true;
     }
-    catch {
+    catch (_err) {
+        void normalizeError(_err); // URL constructor throws TypeError for invalid URL syntax
         return false;
     }
 }
@@ -17,7 +19,8 @@ export function isValidUrlWithProtocol(url, protocols = ["http", "https"]) {
         const urlObj = new URL(url);
         return protocols.includes(urlObj.protocol.replace(":", ""));
     }
-    catch {
+    catch (_err) {
+        void normalizeError(_err); // URL constructor throws TypeError for invalid URL syntax
         return false;
     }
 }
@@ -30,7 +33,8 @@ export function isExternalUrl(url, currentDomain) {
             (typeof window !== "undefined" ? window.location.hostname : "");
         return urlObj.hostname !== currentHost;
     }
-    catch {
+    catch (_err) {
+        void normalizeError(_err); // URL constructor throws TypeError for invalid URL syntax
         return false;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "3.2.11",
+  "version": "3.2.14",
   "license": "MIT",
   "publishConfig": {
     "access": "public"