@mohasinac/appkit 4.30.18 → 4.30.19

package/dist/features/messages/hooks/useConversations.js

@@ -5,8 +5,18 @@
  * conversations gets a new message.
  */
 import { useCallback, useEffect, useState } from "react";
-import { getClientRealtimeProvider } from "../../../contracts/client-realtime";
 import { acquireRealtimeSession } from "../../../contracts/realtime-session";
+// One scope for both message hooks, deliberately: /api/realtime/token issues a
+// SINGLE token covering all of this user's conversationIds, so a per-id scope
+// would make the list and the detail hook re-sign against each other on the
+// same page for no gain.
+//
+// 🛑 Known limitation, not fixed here: because the scope is constant, a
+// conversation created AFTER sign-in is not in the cached token's claims and
+// its subscription is denied until the token's expiry skew forces a re-sign.
+// The denial is now surfaced (see the error callback below) rather than
+// swallowed. The durable fix is to re-acquire on a permission denial.
+const MESSAGES_SCOPE = "messages";
 import { userConversationsPingPath } from "../realtime";
 import { normalizeError } from "../../../errors/normalize";
 import { apiClient } from "../../../http/ApiClient";
@@ -57,23 +67,30 @@ export function useConversations(userId, opts = {}) {
         // `// ignore`, so the whole live-list channel was inert while looking wired.
         void (async () => {
             try {
-                release = await acquireRealtimeSession("messages", () => apiClient.post(ADMIN_ENDPOINTS.REALTIME_TOKEN, {}));
+                const lease = await acquireRealtimeSession(MESSAGES_SCOPE, () => apiClient.post(ADMIN_ENDPOINTS.REALTIME_TOKEN, {}));
+                release = lease.release;
                 if (cancelled) {
-                    release?.();
+                    release();
                     return;
                 }
-                unsubscribe = getClientRealtimeProvider().subscribe(userConversationsPingPath(userId), () => {
+                // Subscribe through the LEASE's provider — see useConversation.
+                unsubscribe = lease.provider.subscribe(userConversationsPingPath(userId), () => {
                     void refetch();
                 }, (err) => {
-                    // Surfaced, not ignored. A denied subscription is a real defect and
-                    // silence here is what hid it for months.
+                    // A denied subscription is a real defect — silence is what hid this
+                    // channel being dead for months — so it is logged, not swallowed.
+                    // (This comment previously claimed "Surfaced, not ignored" while the
+                    // body only called normalizeError, which classifies without
+                    // reporting. That was the same documentation-that-lies pattern this
+                    // workstream exists to remove, so it now actually logs.)
                     void normalizeError(err);
+                    console.warn("[messages] conversations live-update subscription denied; list falls back to fetch-on-load");
                 });
+                // Provider unregistered or token fetch failed — non-fatal; the list
+                // still works via the one-shot fetch above, just without live updates.
             }
             catch (_err) {
                 void normalizeError(_err);
-                // Provider unregistered or token fetch failed — non-fatal; the list
-                // still works via the one-shot fetch above, just without live updates.
             }
         })();
         return () => {

package/dist/features/orders/components/RefundRequestView.js

@@ -16,6 +16,7 @@ import { Button, Checkbox, Div, Span, Stack, Text, Textarea } from "../../../ui"
 import { REFUND_COPY } from "../../../_internal/shared/features/orders/refund-copy";
 import { formatCurrency } from "../../../utils/number.formatter";
 import { normalizeError } from "../../../errors/normalize";
+import { toUserMessage } from "../../../errors/error-display-map";
 const ACK_COUNT = REFUND_COPY.request.acknowledgments.length;
 const CLS_WARN_PANEL = "rounded-xl border border-warning bg-warning-surface p-[var(--appkit-space-4)] dark:border-warning";
 export function RefundRequestView({ order, onSubmitRequest, isLoading = false, className = "", }) {
@@ -37,8 +38,10 @@ export function RefundRequestView({ order, onSubmitRequest, isLoading = false, c
             await onSubmitRequest(reason.trim());
         }
         catch (err) {
-            void normalizeError(err);
-            setError(err instanceof Error ? err.message : REFUND_COPY.request.errorFallback);
+            const e = normalizeError(err);
+            setError(toUserMessage(e.code, undefined, {
+                fallback: REFUND_COPY.request.errorFallback,
+            }));
         }
     };
     return (_jsxs(Stack, { gap: "md", className: className, children: [_jsxs(Text, { size: "sm", color: "muted", children: [REFUND_COPY.request.orderTotalLabel, " ", _jsx(Span, { weight: "bold", children: formatCurrency(order.totalPrice, order.currency ?? "INR") })] }), _jsxs(Stack, { gap: "xs", children: [_jsxs(Text, { size: "sm", weight: "semibold", children: [REFUND_COPY.request.reasonLabel, " ", _jsx(Span, { "aria-hidden": true, children: "*" })] }), _jsx(Textarea, { value: reason, onChange: (e) => setReason(e.target.value), placeholder: REFUND_COPY.request.reasonPlaceholder, rows: 3, "aria-required": "true", "aria-label": REFUND_COPY.request.reasonLabel })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "semibold", children: REFUND_COPY.request.acknowledgeHeading }), REFUND_COPY.request.acknowledgments.map((text, i) => (_jsx(Checkbox, { checked: acknowledged[i], onChange: () => handleToggle(i), label: _jsx(Text, { size: "sm", className: "leading-snug", children: text }), "aria-label": `Acknowledgment ${i + 1}` }, i)))] }), error && (_jsx(Text, { size: "sm", color: "danger", role: "alert", children: error })), _jsx(Button, { variant: "danger", onClick: handleSubmit, disabled: !canSubmit, "aria-busy": isLoading, children: isLoading ? REFUND_COPY.request.submittingLabel : REFUND_COPY.request.submitLabel })] }));

package/dist/features/pre-orders/components/MarketplacePreorderCard.js

@@ -54,8 +54,10 @@ export function MarketplacePreorderCard({ product, className = "", variant = "gr
             await toggle();
         }
         catch (_err) {
+            // useWishlistToggle rolls back its optimistic state and raises its own
+            // toast on failure, so the heart returns to its true value on screen.
+            // Reporting again here would double-notify for one user action.
             void normalizeError(_err);
-            // The hook rolls back optimistic state when the mutation fails.
         }
     }, [toggle]);
     return (_jsxs(BaseListingCard, { isSelected: isSelected, variant: variant, className: className, onMouseDown: !isSelected ? longPress.onMouseDown : undefined, onMouseUp: !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: !isSelected ? longPress.onTouchCancel : undefined, children: [_jsxs(BaseListingCard.Hero, { aspect: "square", variant: variant, children: [_jsx(TextLink, { href: detailHref, className: "absolute inset-0 block", children: _jsx(MediaImage, { src: product.mainImage, alt: product.title, size: "card", fallback: "Product image" }) }), _jsxs(Stack, { className: "absolute right-2 top-2", align: "end", gap: "xs", children: [_jsx(Span, { layout: "inline-flex", color: "inverse", size: "xs", weight: "medium", className: "bg-cobalt", rounded: "full", padding: "pill-xs", children: mergedLabels.preOrderBadge }), product.featured && (_jsx(Span, { size: "xs", weight: "medium", className: CLS_PREORDER_BADGE, children: mergedLabels.featuredBadge }))] }), _jsxs(Stack, { className: "absolute left-2 top-2 pointer-events-none", gap: "xs", children: [product.partOfBundleIds && product.partOfBundleIds.length > 0 && (_jsx(Span, { className: CLS_SALE_BADGE, title: product.partOfBundleTitles?.[0] ? `In bundle: ${product.partOfBundleTitles[0]}` : "In a bundle", children: "Bundled" })), product.groupId && (_jsx(Span, { className: CLS_TRENDING_BADGE, title: product.groupTitle ? `Part of set: ${product.groupTitle}` : "Part of a set", children: product.isGroupParent ? "Set Parent" : "In Set" })), product.sublistingCategoryId && (_jsx(Span, { className: CLS_LIMITED_BADGE, title: "Has variants or sub-listings", children: "Has Variants" }))] }), onSelect && (_jsx(BaseListingCard.Checkbox, { selected: isSelected, onSelect: (event) => {

package/dist/features/pre-orders/components/PreOrderActionsClient.js

@@ -24,7 +24,7 @@ export function PreOrderActionsClient({ productId, price, currency, depositAmoun
                     setShowLoginModal(true);
                 }
                 else {
-                    setError(err instanceof Error ? err.message : "Failed to reserve. Please try again.");
+                    setError("Failed to reserve. Please try again.");
                 }
             }
         });

package/dist/features/pre-orders/components/PreOrderDetailPageView.js

@@ -73,7 +73,10 @@ function PreOrderBuyBarPanel({ reserveTarget, reservedCount, progressPct, produc
 export async function PreOrderDetailPageView({ id, initialPreOrder, onReserveNow, productFeatures }) {
     const product = initialPreOrder !== undefined
         ? (initialPreOrder ?? undefined)
-        : await productRepository.findByIdOrSlug(id).catch(() => undefined);
+        // The pre-order IS this page's subject — a read failure must surface rather
+        // than become the same `undefined` a removed listing produces, which the
+        // "Not Found" branch below already handles.
+        : await productRepository.findByIdOrSlug(id);
     if (!product) {
         return (_jsx(Main, { children: _jsx(Section, { padding: "y-5xl", children: _jsx(Container, { size: "md", children: _jsxs(Stack, { align: "start", gap: "md", className: "text-left", children: [_jsx(Heading, { level: 1, size: "2xl", weight: "semibold", color: "primary", children: "Pre-Order Not Found" }), _jsx(Text, { color: "muted", children: "The pre-order item you are looking for may have been removed." }), _jsx(Link, { href: String(ROUTES.PUBLIC.PRE_ORDERS), className: "text-[length:var(--appkit-text-sm)] font-medium text-primary-600 hover:underline", children: "Browse Pre-Orders" })] }) }) }) }));
     }

package/dist/features/products/components/PrizeDrawDetailPageView.js

@@ -68,7 +68,10 @@ function stripIsWon(items) {
 export async function PrizeDrawDetailPageView({ id, initialPrizeDraw, currentUserId, }) {
     const product = initialPrizeDraw !== undefined
         ? initialPrizeDraw ?? undefined
-        : await productRepository.findByIdOrSlug(id).catch(() => undefined);
+        // The prize draw IS this page's subject — a read failure must surface
+        // rather than become the same `undefined` a removed listing produces,
+        // which the "Not Found" branch below already handles.
+        : await productRepository.findByIdOrSlug(id);
     if (!product) {
         return (_jsx(Main, { children: _jsx(Section, { padding: "y-5xl", children: _jsx(Container, { size: "md", children: _jsxs(Stack, { align: "start", gap: "md", className: "text-left", children: [_jsx(Heading, { level: 1, size: "2xl", weight: "semibold", color: "primary", children: "Prize Draw Not Found" }), _jsx(Text, { color: "muted", children: "The prize draw you are looking for may have been removed." }), _jsx(Link, { href: String(ROUTES.PUBLIC.PRIZE_DRAWS), className: "text-[length:var(--appkit-text-sm)] font-medium text-primary-600 hover:underline", children: "Browse Prize Draws" })] }) }) }) }));
     }

package/dist/features/products/components/ProductDetailPageView.js

@@ -41,6 +41,7 @@ import { computeRelatedItems, getReviewPageForProduct } from "../../../_internal
 import { GroupedListingsCarousel } from "../../grouped/components/GroupedListingsCarousel";
 import { getGroupsWithItemsForProduct } from "../../../_internal/server/features/grouped/data";
 import { getSiteSettingsGlobal } from "../../admin/utils/getSiteSettingsGlobal";
+import { safeRead } from "../../../errors/safe-read";
 import { canMakeOffer } from "../../../_internal/shared/listing-types/capabilities";
 import { normalizeListingType } from "../utils/listing-type";
 import { DEFAULT_MIN_OFFER_PERCENT } from "../../../_internal/shared/features/offers/config";
@@ -71,7 +72,10 @@ export async function ProductDetailPageView({ slug, initialProduct, renderOfferA
     // generateMetadata() and this component share the same in-flight promise.
     const product = initialProduct !== undefined
         ? (initialProduct ?? undefined)
-        : await productRepository.findByIdOrSlug(slug).catch(() => undefined);
+        // The product IS this page's subject — a read failure must surface rather
+        // than become the same `undefined` a removed listing produces, which the
+        // "Not Found" branch below already handles.
+        : await productRepository.findByIdOrSlug(slug);
     if (!product) {
         return (_jsx(Main, { children: _jsx(Section, { padding: "y-5xl", children: _jsx(Container, { size: "md", children: _jsxs(Stack, { align: "start", gap: "md", className: "text-left", children: [_jsx(Heading, { level: 1, size: "2xl", weight: "semibold", color: "primary", children: "Product Not Found" }), _jsx(Text, { color: "muted", children: "The product you are looking for may have been removed or the link is incorrect." }), _jsx(Link, { href: String(ROUTES.PUBLIC.PRODUCTS), className: "text-[length:var(--appkit-text-sm)] font-medium text-primary-600 hover:underline", children: "Browse Products" })] }) }) }) }));
     }
@@ -180,7 +184,9 @@ export async function ProductDetailPageView({ slug, initialProduct, renderOfferA
         getReviewPageForProduct(product.id),
         computeRelatedItems(product),
         getGroupsWithItemsForProduct(product.id),
-        getSiteSettingsGlobal().catch(() => null),
+        safeRead(() => getSiteSettingsGlobal(), {
+            route: "/products/[slug]", key: "product.siteSettings", fallback: null,
+        }),
     ]);
     // Site-wide kill switch. Absent/unreadable settings mean ON — a failed
     // settings read must not silently remove a working feature.

package/dist/features/products/components/ShareButton.js

@@ -11,10 +11,12 @@ export function ShareButton({ title, text, className = "" }) {
             try {
                 await navigator.share({ title: title ?? document.title, text, url });
                 return;
+                // navigator.share rejects on user cancellation exactly as it does on a
+                // real failure, so this is unreportable by construction — either way the
+                // clipboard fallback below still gives the user the link.
             }
             catch (_err) {
                 void normalizeError(_err);
-                // user cancelled or browser blocked — fall through to clipboard
             }
         }
         navigator.clipboard.writeText(url).catch(console.error);

package/dist/features/products/repository/loadProductFeatures.js

@@ -4,11 +4,19 @@
  * pages to hand `productFeatures` down as a prop and avoid per-card waterfalls.
  */
 import { productFeaturesRepository } from "./product-features.repository";
+import { safeRead } from "../../../errors/safe-read";
 export async function loadProductFeaturesForStore(storeId) {
+    // Feature badges decorate a card; a page without them is still correct, so
+    // both reads degrade — but a failure here silently strips "Free shipping" /
+    // "Authenticity guaranteed" from every card, which nobody would notice.
     const [platform, store] = await Promise.all([
-        productFeaturesRepository.listPlatform().catch(() => []),
+        safeRead(() => productFeaturesRepository.listPlatform(), {
+            route: "productFeatures", key: "productFeatures.platform", fallback: [],
+        }),
         storeId
-            ? productFeaturesRepository.listForStore(storeId).catch(() => [])
+            ? safeRead(() => productFeaturesRepository.listForStore(storeId), {
+                route: "productFeatures", key: "productFeatures.store", fallback: [],
+            })
             : Promise.resolve([]),
     ]);
     const seen = new Set();

package/dist/features/products/repository/products.repository.js

@@ -452,10 +452,11 @@ export class ProductRepository extends BaseRepository {
                 .update({
                 [PRODUCT_FIELDS.VIEW_COUNT]: increment(1),
             });
+            // Fire-and-forget analytics: a lost view increment changes no rendered
+            // content, so it must never break the product read path it rides with.
         }
         catch (_err) {
             void normalizeError(_err);
-            // View analytics must not break product read path.
         }
     }
     /**

package/dist/features/promotions/components/CouponCard.js

@@ -131,10 +131,12 @@ export function CouponCard({ coupon, labels: labelsProp, onCopy, className = "",
                     credentials: "include",
                     body: JSON.stringify({ couponCode: n.code, source: claimSource }),
                 });
+                // An anonymous visitor gets a 401 here by design, so a failure cannot
+                // be distinguished from the expected case. The redirect below still
+                // pre-fills the code, which is what the user actually asked for.
             }
             catch (_err) {
                 void normalizeError(_err);
-                /* anon/network — non-fatal */
             }
             if (typeof window !== "undefined") {
                 window.location.href = `/cart?coupon=${encodeURIComponent(n.code)}`;

package/dist/features/reviews/actions/review-actions.js

@@ -10,6 +10,7 @@ import { serverLogger } from "../../../monitoring";
 import { maskPublicReview } from "../../../security";
 import { finalizeStagedMediaArray, finalizeStagedMediaUrl, } from "../../media/finalize";
 import { reviewRepository } from "../repository/reviews.repository";
+import { safeRead } from "../../../errors/safe-read";
 import { productRepository } from "../../products/repository/products.repository";
 import { ProductStatusValues } from "../../products/schemas";
 import { userRepository } from "../../auth/repository/user.repository";
@@ -185,7 +186,13 @@ export async function listReviewsBySeller(sellerId) {
     }
     const reviewBatches = await Promise.all(productIds
         .slice(0, 20)
-        .map((id) => reviewRepository.findApprovedByProduct(id, 50).catch(() => [])));
+        // One product's reviews failing must not empty the whole seller feed —
+        // but it silently thins it, so each miss is recorded.
+        .map((id) => safeRead(() => reviewRepository.findApprovedByProduct(id, 50), {
+        route: "reviews.bySeller",
+        key: "reviews.findApprovedByProduct",
+        fallback: [],
+    })));
     // Each per-product batch is newest-first, but concatenating them yields product order,
     // not chronological order — the flattened list has to be re-sorted or callers get an
     // arbitrarily interleaved "latest reviews" list.

package/dist/features/reviews/components/ReviewDetailPageView.js

@@ -1,12 +1,16 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import Link from "next/link";
 import { reviewRepository } from "../../../repositories";
+import { safeRead } from "../../../errors/safe-read";
 import { Container, Div, Grid, Heading, Main, Nav, Section, Span, Text } from "../../../ui";
 import { ROUTES } from "../../../next";
 import { ReviewDetailShell } from "./ReviewDetailShell";
 import { ReviewCard } from "./ReviewsList";
 export async function ReviewDetailPageView({ id }) {
-    const doc = await reviewRepository.findById(id).catch(() => null);
+    // The review IS this page's subject — a read failure must surface rather than
+    // become the same `null` a removed review produces, which the "Review not
+    // found" branch below already handles.
+    const doc = await reviewRepository.findById(id);
     const review = doc;
     // storeId === storeSlug for stores in this project (pure slug IDs)
     const storeSlug = doc?.storeId ?? null;
@@ -15,8 +19,14 @@ export async function ReviewDetailPageView({ id }) {
     }
     const [sameProductDocs, sameStoreDocs] = await Promise.all([
         // 12 = the 6 rendered below, with headroom for the current review + any filtered out.
-        reviewRepository.findApprovedByProduct(review.productId, 12).catch(() => []),
-        storeSlug ? reviewRepository.findApprovedByStore(storeSlug).catch(() => []) : Promise.resolve([]),
+        safeRead(() => reviewRepository.findApprovedByProduct(review.productId, 12), {
+            route: "/reviews/[id]", key: "review.sameProduct", fallback: [],
+        }),
+        storeSlug
+            ? safeRead(() => reviewRepository.findApprovedByStore(storeSlug), {
+                route: "/reviews/[id]", key: "review.sameStore", fallback: [],
+            })
+            : Promise.resolve([]),
     ]);
     const sameProductReviews = sameProductDocs.filter((r) => r.id !== review.id).slice(0, 6);
     const sameStoreReviews = sameStoreDocs.filter((r) => r.id !== review.id).slice(0, 6);

package/dist/features/reviews/components/ReviewDetailShell.js

@@ -80,10 +80,12 @@ export function ReviewDetailShell({ review, storeHref }) {
             }
             setVoted(true);
             localStorage.setItem(storageKey, "1");
+            // The button stays un-voted and the count unchanged, so the user can
+            // simply press it again — this shell has no toast host of its own, and a
+            // failed helpful-vote costs nothing.
         }
         catch (_err) {
             void normalizeError(_err);
-            // silently fail
         }
         finally {
             setVoting(false);

package/dist/features/scams/actions/scam-actions.d.ts

@@ -30,7 +30,15 @@ export declare function getPublicScammerById(id: string): Promise<ScammerDocumen
  * Returns null if not found or not verified.
  */
 export declare function getScammerProfilePageData(id: string): Promise<ScammerProfilePageData | null>;
-export type SellerTrustStatus = "clear" | "flagged";
+/**
+ * `unknown` exists because `clear` is a POSITIVE SAFETY CLAIM — it renders as
+ * "✓ Verified Safe" next to a seller's name. Every read in
+ * `getSellerTrustStatus` used to fail open to `clear`, so a scam-registry
+ * outage actively endorsed a seller nobody had checked. Failing open is still
+ * right (an outage must not brand a legitimate seller a scammer), but the
+ * honest failure state is "we could not check", not "we checked and it's fine".
+ */
+export type SellerTrustStatus = "clear" | "flagged" | "unknown";
 export interface SellerTrustResult {
     status: SellerTrustStatus;
     /** seoSlug of matched verified scammer profiles — links to /scams/[slug]. Empty when clear. */

package/dist/features/scams/actions/scam-actions.js

@@ -1,6 +1,7 @@
 "use server";
 import { sieveFilter, SIEVE_OP } from "@mohasinac/appkit";
 import { scammerRepository } from "../repository/scammer.repository";
+import { safeRead } from "../../../errors/safe-read";
 import { userRepository } from "../../auth/repository/user.repository";
 import { storeRepository } from "../../stores/repository/store.repository";
 import { safeFireAndForget } from "../../../utils/safe-fire-forget";
@@ -39,9 +40,12 @@ export async function listVerifiedScammers(searchParams) {
  */
 export async function getPublicScammerById(id) {
     // Try direct id lookup first; fall back to seoSlug query.
-    let doc = await scammerRepository.findById(id).catch(() => null);
+    // The profile IS the caller's subject, and both lookups already return null
+    // for "no such id/slug" — swallowing a read failure into that same null would
+    // report a real outage as a missing profile.
+    let doc = await scammerRepository.findById(id);
     if (!doc) {
-        doc = await scammerRepository.findBySeoSlug(id).catch(() => null);
+        doc = await scammerRepository.findBySeoSlug(id);
     }
     if (!doc || doc.status !== "verified")
         return null;
@@ -66,27 +70,63 @@ export async function getScammerProfilePageData(id) {
     return { scammer, incidents, comments, relatedScammers, similarScamReports };
 }
 const TRUST_STATUS_CLEAR = { status: "clear", matchedProfileSlugs: [] };
+const TRUST_STATUS_UNKNOWN = { status: "unknown", matchedProfileSlugs: [] };
+/**
+ * Wrap a read so a FAILURE is distinguishable from a legitimate empty result.
+ *
+ * `safeRead` alone cannot express this: its fallback has the same type as a
+ * successful read, so `null` from a failed store lookup and `null` from a store
+ * that does not exist are the same value. Tagging the outcome is what lets the
+ * caller answer "unknown" instead of "clear".
+ */
+async function readTagged(fn, key) {
+    return safeRead(async () => ({ ok: true, value: await fn() }), {
+        route: "sellerTrust",
+        key,
+        fallback: { ok: false, value: null },
+    });
+}
 /**
  * P-12 — resolves a store owner's phone/email against the verified (admin-published)
  * scammer registry only. Never surfaces "under review" reports to buyers — a report
  * that hasn't been verified must not damage a seller's storefront reputation.
  */
 export async function getSellerTrustStatus(storeId) {
-    const store = await storeRepository.findById(storeId).catch(() => null);
-    if (!store?.ownerId)
+    // Every read below fails OPEN to "clear" — a deliberate choice, because a
+    // registry outage must not brand a legitimate seller a scammer. But "clear"
+    // is a positive safety claim, so a failure that produces one has to be
+    // recorded rather than inferred from a silent null.
+    const store = await readTagged(() => storeRepository.findById(storeId), "sellerTrust.store");
+    if (!store.ok)
+        return TRUST_STATUS_UNKNOWN;
+    if (!store.value?.ownerId)
         return TRUST_STATUS_CLEAR;
-    const owner = await userRepository.findById(store.ownerId).catch(() => null);
-    if (!owner)
+    const ownerId = store.value.ownerId;
+    const owner = await readTagged(() => userRepository.findById(ownerId), "sellerTrust.owner");
+    if (!owner.ok)
+        return TRUST_STATUS_UNKNOWN;
+    if (!owner.value)
         return TRUST_STATUS_CLEAR;
+    const ownerDoc = owner.value;
     const lookups = [];
-    if (owner.phoneNumber)
-        lookups.push(scammerRepository.findByContactField("phones", owner.phoneNumber));
-    if (owner.email)
-        lookups.push(scammerRepository.findByContactField("emails", owner.email));
+    if (ownerDoc.phoneNumber) {
+        const phone = ownerDoc.phoneNumber;
+        lookups.push(() => scammerRepository.findByContactField("phones", phone));
+    }
+    if (ownerDoc.email) {
+        const email = ownerDoc.email;
+        lookups.push(() => scammerRepository.findByContactField("emails", email));
+    }
     if (lookups.length === 0)
         return TRUST_STATUS_CLEAR;
-    const results = await Promise.all(lookups.map((p) => p.catch(() => [])));
-    const verified = results.flat().filter((s) => s.status === "verified");
+    const results = await Promise.all(lookups.map((fn) => readTagged(fn, "sellerTrust.registryLookup")));
+    // A partial answer is not an answer: if ANY registry lookup failed we cannot
+    // say the seller is clear, only that we could not check.
+    if (results.some((r) => !r.ok))
+        return TRUST_STATUS_UNKNOWN;
+    const verified = results
+        .flatMap((r) => r.value ?? [])
+        .filter((s) => s.status === "verified");
     if (verified.length === 0)
         return TRUST_STATUS_CLEAR;
     return {

package/dist/features/scams/components/SellerTrustBadge.d.ts

@@ -13,4 +13,4 @@ export interface SellerTrustBadgeProps {
  * unrelated homepage-section `TrustBadge` config type in
  * features/homepage/index.ts (marketing trust-badge icons row).
  */
-export declare function SellerTrustBadge({ trust, className }: SellerTrustBadgeProps): import("react").JSX.Element;
+export declare function SellerTrustBadge({ trust, className }: SellerTrustBadgeProps): import("react").JSX.Element | null;

package/dist/features/scams/components/SellerTrustBadge.js

@@ -13,6 +13,19 @@ import { ROUTES } from "../../../next";
  * features/homepage/index.ts (marketing trust-badge icons row).
  */
 export function SellerTrustBadge({ trust, className = "" }) {
+    // 🛑 `unknown` MUST be handled before the flagged fallthrough below, and must
+    // never render as "Verified Safe".
+    //
+    // Every read in getSellerTrustStatus used to fail open to "clear", so a
+    // scam-registry outage produced an explicit safety endorsement for a seller
+    // nobody had checked. Failing open is still right — an outage must not brand
+    // a legitimate seller a scammer — but the honest failure state is "we could
+    // not check", which is neither of the two claims this badge otherwise makes.
+    // Rendering nothing is deliberate: a neutral badge would still be a statement,
+    // and the absence of a badge already means "no verified match" everywhere the
+    // registry is not consulted.
+    if (trust.status === "unknown")
+        return null;
     if (trust.status === "clear") {
         return (_jsx(Badge, { variant: "success", className: className, children: "\u2713 Verified Safe" }));
     }

package/dist/features/scams/repository/scammer.repository.js

@@ -122,10 +122,11 @@ class ScammerRepository extends BaseRepository {
             await this.getCollection()
                 .doc(id)
                 .update({ [SCAMMER_FIELDS.VIEWS]: increment(1) });
+            // Fire-and-forget analytics: a lost view increment changes no rendered
+            // content, so it must never break the profile read it rides along with.
         }
         catch (_err) {
             void normalizeError(_err);
-            // Fire-and-forget by design.
         }
     }
     /**

package/dist/features/seller/actions/offer-actions.js

@@ -15,6 +15,7 @@ import { cartRepository } from "../../cart/repository/cart.repository";
 import { maskOfferForSeller } from "../../../security";
 import { ERROR_MESSAGES, AuthorizationError, ValidationError, NotFoundError, OFFER_ERROR_CODES, } from "../../../errors";
 import { siteSettingsRepository } from "../../admin/repository/site-settings.repository";
+import { safeRead } from "../../../errors/safe-read";
 import { canMakeOffer } from "../../../_internal/shared/listing-types/capabilities";
 import { normalizeListingType } from "../../products/utils/listing-type";
 import { OfferStatusValues } from "../schemas";
@@ -36,7 +37,11 @@ export async function makeOffer(userId, userEmail, input) {
      * without stranding in-flight ones, so accept/decline/counter/withdraw and
      * `checkoutOffer` deliberately stay open.
      */
-    const settings = await siteSettingsRepository.getSingleton().catch(() => null);
+    // Fails OPEN — a settings read that dies must not block offers site-wide. But
+    // `null` here is indistinguishable from "the flag is on", so it is recorded.
+    const settings = await safeRead(() => siteSettingsRepository.getSingleton(), {
+        route: "offers.makeOffer", key: "makeOffer.siteSettings", fallback: null,
+    });
     if (settings?.featureFlags?.offers === false) {
         throw new ValidationError(ERROR_MESSAGES.OFFER.DISABLED, {
             code: OFFER_ERROR_CODES.DISABLED,

package/dist/features/seller/components/FulfillmentView.js

@@ -37,12 +37,15 @@ export function FulfillmentView({ currentUserId, }) {
             setOrders(res.orders ?? []);
         }
         catch (err) {
-            void normalizeError(err);
+            // An empty fulfilment queue is a normal, expected state, so a swallowed
+            // failure here reads as "nothing to pack" — matching the rest of this
+            // file, surface it instead.
+            showToast(normalizeError(err).message, "error");
         }
         finally {
             setIsLoadingOrders(false);
         }
-    }, []);
+    }, [showToast]);
     useEffect(() => {
         void fetchOrders();
     }, [fetchOrders]);

package/dist/features/seller/components/PhysicalLocationModal.js

@@ -22,7 +22,7 @@ export function PhysicalLocationModal({ count, onSave, onClose }) {
         }
         catch (e) {
             void normalizeError(e);
-            setError(e instanceof Error ? e.message : "Failed to save location");
+            setError("Failed to save location");
         }
         finally {
             setSaving(false);

package/dist/features/seller/components/PrintCenterView.js

@@ -20,10 +20,12 @@ function ProductLabel({ product }) {
                     fontSize: 12,
                     margin: 8,
                 });
+                // JsBarcode throws on a value CODE128 cannot encode. The <svg> is left
+                // empty and the label still prints its title and price — there is no
+                // recovery beyond fixing the barcodeId on the product itself.
             }
             catch (_err) {
                 void normalizeError(_err);
-                // Invalid barcode value — render nothing
             }
         }
     }, [product.barcodeId]);

package/dist/features/seller/components/SellerBidsView.js

@@ -88,7 +88,7 @@ export function SellerBidsView({ endpoint = SELLER_ENDPOINTS.BIDS }) {
         }
         catch (err) {
             void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to cancel bids.", "error");
+            showToast("Failed to cancel bids.", "error");
         }
     }, [showToast]);
     const config = {

package/dist/features/seller/components/SellerCouponsView.js

@@ -32,7 +32,7 @@ export function SellerCouponsView({ onCreateClick, onEditClick, onToggle, onDele
         }
         catch (err) {
             void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to update coupon.", "error");
+            showToast("Failed to update coupon.", "error");
         }
         finally {
             setTogglingId(null);

package/dist/features/seller/components/SellerGoogleReviewsView.js

@@ -76,7 +76,7 @@ export function SellerGoogleReviewsView({ onSave, onSync, }) {
         catch (err) {
             void normalizeError(err);
             setSaveMessage({ text: "Save failed. Please try again.", ok: false });
-            showToast(err instanceof Error ? err.message : "Failed to save settings.", "error");
+            showToast("Failed to save settings.", "error");
         }
         finally {
             setSaving(false);
@@ -101,7 +101,7 @@ export function SellerGoogleReviewsView({ onSave, onSync, }) {
         catch (err) {
             void normalizeError(err);
             setSaveMessage({ text: "Sync failed. Please try again.", ok: false });
-            showToast(err instanceof Error ? err.message : "Failed to sync reviews.", "error");
+            showToast("Failed to sync reviews.", "error");
         }
         finally {
             setSyncing(false);

package/dist/features/seller/components/SellerOrdersView.js

@@ -210,7 +210,7 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
         }
         catch (err) {
             void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to mark order shipped.", "error");
+            showToast("Failed to mark order shipped.", "error");
         }
         finally {
             setShippingRowId(null);
@@ -232,7 +232,7 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
         }
         catch (err) {
             void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to update location.", "error");
+            showToast("Failed to update location.", "error");
         }
     }, [showToast]);
     const requestPayoutForSelection = useCallback(async (selection) => {
@@ -253,7 +253,7 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
         }
         catch (err) {
             void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to request payout.", "error");
+            showToast("Failed to request payout.", "error");
         }
     }, [showToast]);
     const [selectedIdsForLocation, setSelectedIdsForLocation] = useState([]);

package/dist/features/seller/components/SellerPayoutMethodsView.js

@@ -57,7 +57,7 @@ export function SellerPayoutMethodsView({ onCreateClick, onEditClick, onDelete,
         }
         catch (err) {
             void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to delete payout method", "error");
+            showToast("Failed to delete payout method", "error");
         }
         setDeleteTargetId(null);
     }, [performDelete, showToast]);
@@ -79,7 +79,7 @@ export function SellerPayoutMethodsView({ onCreateClick, onEditClick, onDelete,
         }
         catch (err) {
             void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to update default.", "error");
+            showToast("Failed to update default.", "error");
         }
         finally {
             setSettingDefaultId(null);