@mohasinac/appkit 2.2.0 → 2.3.1

package/dist/providers.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @mohasinac/appkit/providers
+ *
+ * All provider implementations and the registry wiring helpers in one place.
+ *
+ * Import from this entrypoint in server-only setup code such as
+ * `instrumentation.ts` / `providers.config.ts`.
+ *
+ * Client-side providers (FirebaseClientAuthProvider, FirebaseClientRealtimeProvider)
+ * remain in `@mohasinac/appkit/client` because they require a browser environment.
+ */
+export { registerProviders, getProviders } from "./contracts/index";
+export { configureMarketDefaults } from "./core/baseline-resolver";
+export { firebaseAuthProvider, firebaseSessionProvider, createSessionCookieFromToken, createSessionCookie, verifyIdToken, verifySessionCookie, createMiddlewareAuthChain, requireAuth, requireRole, requireAuthUser, requireRoleUser, getUserFromRequest, requireAuthFromRequest, requireRoleFromRequest, revokeUserTokens, } from "./providers/auth-firebase/index";
+export { firebaseDbProvider, getAdminApp, getAdminAuth, getAdminDb, getAdminStorage, getAdminRealtimeDb, _resetAdminSingletons, FirebaseRepository, BaseRepository, FirebaseSieveRepository, FirebaseRealtimeRepository, RTDB_PATHS, firebaseFieldOps, removeUndefined, prepareForFirestore, deserializeTimestamps, } from "./providers/db-firebase/index";
+export type { DocumentSnapshot } from "firebase-admin/firestore";
+export { firebaseStorageProvider } from "./providers/storage-firebase/index";
+export { createResendProvider } from "./providers/email-resend/index";
+export type { ResendProviderOptions } from "./providers/email-resend/index";
+export { RazorpayProvider, rupeesToPaise, paiseToRupees, verifyPaymentSignature, createRazorpayOrder, fetchRazorpayOrder, verifyPaymentSignatureWithKeys, verifyWebhookSignature, createRazorpayRefund, } from "./providers/payment-razorpay/index";
+export type { RazorpayConfig, RazorpayPaymentResult, RazorpayOrderOptions, RazorpayOrder, RazorpayRefundResult, } from "./providers/payment-razorpay/index";
+export { ShiprocketProvider } from "./providers/shipping-shiprocket/index";
+export type { ShiprocketProviderConfig } from "./providers/shipping-shiprocket/index";
+export { tailwindAdapter } from "./style/tailwind/index";
+export { serverLogger } from "./monitoring/index";

package/dist/providers.js

@@ -0,0 +1,31 @@
+/**
+ * @mohasinac/appkit/providers
+ *
+ * All provider implementations and the registry wiring helpers in one place.
+ *
+ * Import from this entrypoint in server-only setup code such as
+ * `instrumentation.ts` / `providers.config.ts`.
+ *
+ * Client-side providers (FirebaseClientAuthProvider, FirebaseClientRealtimeProvider)
+ * remain in `@mohasinac/appkit/client` because they require a browser environment.
+ */
+// Registry and market baseline
+export { registerProviders, getProviders } from "./contracts/index";
+export { configureMarketDefaults } from "./core/baseline-resolver";
+// Auth (Firebase Admin)
+export { firebaseAuthProvider, firebaseSessionProvider, createSessionCookieFromToken, createSessionCookie, verifyIdToken, verifySessionCookie, createMiddlewareAuthChain, requireAuth, requireRole, requireAuthUser, requireRoleUser, getUserFromRequest, requireAuthFromRequest, requireRoleFromRequest, revokeUserTokens, } from "./providers/auth-firebase/index";
+// Database (Firebase Firestore / RTDB)
+export { firebaseDbProvider, getAdminApp, getAdminAuth, getAdminDb, getAdminStorage, getAdminRealtimeDb, _resetAdminSingletons, FirebaseRepository, BaseRepository, FirebaseSieveRepository, FirebaseRealtimeRepository, RTDB_PATHS, firebaseFieldOps, removeUndefined, prepareForFirestore, deserializeTimestamps, } from "./providers/db-firebase/index";
+// Storage (Firebase Admin)
+export { firebaseStorageProvider } from "./providers/storage-firebase/index";
+// Email (Resend)
+export { createResendProvider } from "./providers/email-resend/index";
+// Payment (Razorpay)
+export { RazorpayProvider, rupeesToPaise, paiseToRupees, verifyPaymentSignature, createRazorpayOrder, fetchRazorpayOrder, verifyPaymentSignatureWithKeys, verifyWebhookSignature, createRazorpayRefund, } from "./providers/payment-razorpay/index";
+// Shipping (Shiprocket)
+export { ShiprocketProvider } from "./providers/shipping-shiprocket/index";
+// Style adapter
+export { tailwindAdapter } from "./style/tailwind/index";
+// Monitoring
+// serverLogger - Structured server-side logger (useful in instrumentation / provider setup).
+export { serverLogger } from "./monitoring/index";

package/dist/react/ErrorBoundary.d.ts

@@ -26,6 +26,6 @@ export declare class ErrorBoundary extends Component<ErrorBoundaryProps, State>
     static getDerivedStateFromError(error: Error): State;
     componentDidCatch(error: Error, errorInfo: ErrorInfo): void;
     handleReset: () => void;
-    render(): string | number | bigint | boolean | import("react/jsx-runtime").JSX.Element | Iterable<ReactNode> | Promise<string | number | bigint | boolean | import("react").ReactPortal | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | null | undefined;
+    render(): string | number | bigint | boolean | Iterable<ReactNode> | Promise<string | number | bigint | boolean | import("react").ReactPortal | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | import("react/jsx-runtime").JSX.Element | null | undefined;
 }
 export {};

package/dist/react/ErrorBoundary.js

@@ -20,7 +20,7 @@ function DefaultFallback({ error, onReset, }) {
             minHeight: "100vh",
             padding: "2rem",
             textAlign: "center",
-        }, children: [_jsx("h1", { style: { fontSize: "1.5rem", marginBottom: "0.5rem" }, children: "Something went wrong" }), _jsx("p", { style: { marginBottom: "1.5rem", opacity: 0.7 }, children: "An unexpected error occurred. Please try again." }), process.env.NODE_ENV === "development" && error && (_jsx("pre", { style: {
+        }, "data-section": "errorboundary-div-446", children: [_jsx("h1", { style: { fontSize: "1.5rem", marginBottom: "0.5rem" }, children: "Something went wrong" }), _jsx("p", { style: { marginBottom: "1.5rem", opacity: 0.7 }, children: "An unexpected error occurred. Please try again." }), process.env.NODE_ENV === "development" && error && (_jsx("pre", { style: {
                     fontSize: "0.75rem",
                     padding: "1rem",
                     background: "#f3f4f6",

package/dist/react/contexts/SessionContext.d.ts

@@ -1,4 +1,3 @@
-import "client-only";
 import React from "react";
 /** Minimal avatar metadata shape shared across consumers. */
 export interface AvatarMetadataShape {

package/dist/react/contexts/SessionContext.js

@@ -1,6 +1,5 @@
 "use client";
 import { jsx as _jsx } from "react/jsx-runtime";
-import "client-only";
 import { createContext, useContext, useState, useEffect, useCallback, useRef, useMemo, } from "react";
 import { logger } from "../../core/Logger";
 import { apiClient } from "../../http";

package/dist/react/contexts/ThemeContext.d.ts

@@ -1,4 +1,3 @@
-import "client-only";
 import React from "react";
 export type ThemeMode = "light" | "dark";
 interface ThemeContextType {

package/dist/react/contexts/ThemeContext.js

@@ -1,6 +1,5 @@
 "use client";
 import { jsx as _jsx } from "react/jsx-runtime";
-import "client-only";
 import { createContext, useContext, useEffect, useState, useCallback, useMemo, } from "react";
 const ThemeContext = createContext(undefined);
 const THEME_STORAGE_KEY = "theme";

package/dist/react/hooks/useBreakpoint.js

@@ -1,4 +1,3 @@
-"use client";
 import { useMediaQuery } from "./useMediaQuery";
 /**
  * useBreakpoint Hook

package/dist/react/hooks/useCamera.d.ts

@@ -1,4 +1,3 @@
-import "client-only";
 export interface UseCameraOptions {
     facingMode?: "user" | "environment";
     video?: boolean | MediaTrackConstraints;

package/dist/react/hooks/useCamera.js

@@ -1,5 +1,4 @@
 "use client";
-import "client-only";
 import { useCallback, useEffect, useRef, useState } from "react";
 /**
  * useCamera

package/dist/react/hooks/useClickOutside.d.ts

@@ -1,4 +1,3 @@
-import "client-only";
 import { RefObject } from "react";
 /**
  * Configuration options for useClickOutside hook

package/dist/react/hooks/useClickOutside.js

@@ -1,5 +1,4 @@
 "use client";
-import "client-only";
 import { useEffect, useRef } from "react";
 const EMPTY_REFS = [];
 /**

package/dist/react/hooks/useContainerGrid.js

@@ -1,5 +1,5 @@
-// appkit/src/react/hooks/useContainerGrid.ts
 "use client";
+// appkit/src/react/hooks/useContainerGrid.ts
 import { useRef, useState, useEffect } from "react";
 /**
  * `useContainerGrid` — compute the number of columns that fit in a container

package/dist/react/hooks/useCountdown.js

@@ -1,3 +1,4 @@
+"use client";
 import { useState, useEffect } from "react";
 /** Resolve any date-like value into a ms timestamp. */
 function resolveMs(endDate) {

package/dist/react/hooks/useMediaQuery.d.ts

@@ -1,4 +1,3 @@
-import "client-only";
 /**
  * useMediaQuery Hook
  *

package/dist/react/hooks/useMediaQuery.js

@@ -1,5 +1,4 @@
 "use client";
-import "client-only";
 import { useState, useEffect } from "react";
 /**
  * useMediaQuery Hook

package/dist/react/hooks/useSwipe.d.ts

@@ -1,4 +1,3 @@
-import "client-only";
 import { RefObject } from "react";
 /**
  * Swipe direction types

package/dist/react/hooks/useSwipe.js

@@ -1,5 +1,4 @@
 "use client";
-import "client-only";
 import { useRef, useEffect } from "react";
 /**
  * useSwipe Hook

package/dist/react/hooks/useUnsavedChanges.d.ts

@@ -1,4 +1,3 @@
-import "client-only";
 export declare const UNSAVED_CHANGES_EVENT = "unsaved-changes:confirm";
 export interface UseUnsavedChangesOptions {
     /** Current form values to compare against initial */

package/dist/react/hooks/useUnsavedChanges.js

@@ -1,6 +1,6 @@
 "use client";
-import "client-only";
 import { useState, useEffect, useCallback, useRef } from "react";
+import { ERROR_MESSAGES } from "../../errors/messages";
 export const UNSAVED_CHANGES_EVENT = "unsaved-changes:confirm";
 /**
  * useUnsavedChanges
@@ -14,7 +14,7 @@ export const UNSAVED_CHANGES_EVENT = "unsaved-changes:confirm";
  *   to `window.confirm`) to handle navigation guards
  * - `markClean()` resets the snapshot after a successful save
  */
-export function useUnsavedChanges({ formValues, initialValues, extraDirty = false, confirmFn, beforeUnloadWarning = "You have unsaved changes. Leave?", }) {
+export function useUnsavedChanges({ formValues, initialValues, extraDirty = false, confirmFn, beforeUnloadWarning = ERROR_MESSAGES.GENERIC.UNSAVED_CHANGES, }) {
     const [savedSnapshot, setSavedSnapshot] = useState(initialValues);
     const savedSnapshotRef = useRef(savedSnapshot);
     savedSnapshotRef.current = savedSnapshot;
@@ -49,7 +49,7 @@ export function useUnsavedChanges({ formValues, initialValues, extraDirty = fals
             return Promise.resolve(true);
         if (confirmFn)
             return confirmFn();
-        return Promise.resolve(window.confirm("You have unsaved changes. Leave without saving?"));
+        return Promise.resolve(window.confirm(beforeUnloadWarning));
     }, [isDirty, confirmFn]);
     return { isDirty, isFormDirty, markClean, confirmLeave };
 }

package/dist/react/hooks/useVisibleItems.js

@@ -1,5 +1,5 @@
-// appkit/src/react/hooks/useVisibleItems.ts
 "use client";
+// appkit/src/react/hooks/useVisibleItems.ts
 import { useRef, useState, useEffect, useCallback } from "react";
 /**
  * `useVisibleItems` — compute how many items fit in a container, handling

package/dist/react/useModalStack.js

@@ -1,6 +1,6 @@
 "use client";
 import { useCallback, useRef, useState } from "react";
-// ─── useModalStack ────────────────────────────────────────────────────────────
+// --- useModalStack ------------------------------------------------------------
 /**
  * useModalStack — manages a LIFO stack of modal/drawer instances.
  *

package/dist/repositories/index.d.ts

@@ -4,7 +4,6 @@
  * Canonical repository entrypoint for consumer apps.
  * Server-only — all repository instances use firebase-admin.
  */
-import "server-only";
 export { BaseRepository } from "../providers/db-firebase";
 export { unitOfWork } from "../core";
 export type { UnitOfWork } from "../core";

package/dist/repositories/index.js

@@ -4,7 +4,6 @@
  * Canonical repository entrypoint for consumer apps.
  * Server-only — all repository instances use firebase-admin.
  */
-import "server-only";
 // Shared repository foundations
 export { BaseRepository } from "../providers/db-firebase";
 // Unit of Work - atomic multi-collection operations

package/dist/security/authorization.js

@@ -9,50 +9,45 @@
  * app layer using these primitives.
  */
 import { AuthenticationError, AuthorizationError } from "../errors";
+import { ERROR_MESSAGES } from "../errors/messages";
 const ROLE_HIERARCHY = {
     admin: 4,
     moderator: 3,
     seller: 2,
     user: 1,
 };
-const MSG = {
-    NOT_AUTHENTICATED: "Please log in to continue",
-    FORBIDDEN: "You do not have permission to perform this action",
-    EMAIL_NOT_VERIFIED: "Please verify your email address before logging in",
-    ACCOUNT_DISABLED: "Your account has been disabled. Please contact support",
-};
 export function requireAuth(user) {
     if (!user) {
-        throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
+        throw new AuthenticationError(ERROR_MESSAGES.AUTH.UNAUTHORIZED);
     }
 }
 export function requireRole(user, roles) {
     if (!user)
-        throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
+        throw new AuthenticationError(ERROR_MESSAGES.AUTH.UNAUTHORIZED);
     const requiredRoles = Array.isArray(roles) ? roles : [roles];
     const userRole = user.role || "user";
     if (!requiredRoles.includes(userRole)) {
-        throw new AuthorizationError(MSG.FORBIDDEN);
+        throw new AuthorizationError(ERROR_MESSAGES.AUTH.FORBIDDEN);
     }
 }
 export function requireOwnership(user, resourceOwnerId) {
     if (!user)
-        throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
+        throw new AuthenticationError(ERROR_MESSAGES.AUTH.UNAUTHORIZED);
     if (user.uid !== resourceOwnerId) {
-        throw new AuthorizationError(MSG.FORBIDDEN);
+        throw new AuthorizationError(ERROR_MESSAGES.AUTH.FORBIDDEN);
     }
 }
 export function requireEmailVerified(user) {
     if (!user)
-        throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
+        throw new AuthenticationError(ERROR_MESSAGES.AUTH.UNAUTHORIZED);
     if (!user.emailVerified)
-        throw new AuthorizationError(MSG.EMAIL_NOT_VERIFIED);
+        throw new AuthorizationError(ERROR_MESSAGES.AUTH.EMAIL_NOT_VERIFIED);
 }
 export function requireActiveAccount(user) {
     if (!user)
-        throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
+        throw new AuthenticationError(ERROR_MESSAGES.AUTH.UNAUTHORIZED);
     if (user.disabled)
-        throw new AuthorizationError(MSG.ACCOUNT_DISABLED);
+        throw new AuthorizationError(ERROR_MESSAGES.AUTH.ACCOUNT_DISABLED);
 }
 /**
  * Check if currentUserRole is allowed to change a target user's role.

package/dist/security/index.d.ts

@@ -3,7 +3,7 @@ export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, cle
 export type { RateLimitConfig, RateLimitResult } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export type { UserRole } from "./authorization";
-export { redactPii } from "./pii-redact";
+export { redactPii, safeDisplayName, safeDisplayEmail } from "./pii-redact";
 export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, isPiiEncrypted, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-encrypt";
 export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";

package/dist/security/index.js

@@ -1,7 +1,7 @@
 export { generateNonce, buildCSP } from "./csp";
 export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, clearRateLimitStore, } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
-export { redactPii } from "./pii-redact";
+export { redactPii, safeDisplayName, safeDisplayEmail } from "./pii-redact";
 export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, isPiiEncrypted, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-encrypt";
 export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";

package/dist/security/pii-encrypt.d.ts

@@ -1,4 +1,14 @@
-import "server-only";
+/**
+ * PII Encryption Utilities — AES-256-GCM with HMAC-SHA256 blind indexes.
+ *
+ * Environment variables required (server-side only):
+ *   PII_ENCRYPTION_KEY — 32-byte hex string (64 chars) for AES-256-GCM
+ *   PII_HMAC_KEY       — 32-byte hex string (64 chars) for HMAC-SHA256
+ *                        (defaults to PII_ENCRYPTION_KEY if absent)
+ *
+ * Ciphertext format: "enc:v1:<iv_b64>:<ciphertext_b64>:<authtag_b64>"
+ * Blind index format: "hmac-sha256:<sha256_hex>"
+ */
 export declare const ENC_PREFIX = "enc:v1:";
 export declare const HMAC_PREFIX = "hmac-sha256:";
 export declare function getPiiConfigError(): string | null;

package/dist/security/pii-encrypt.js

@@ -1,4 +1,3 @@
-import "server-only";
 /**
  * PII Encryption Utilities — AES-256-GCM with HMAC-SHA256 blind indexes.
  *
@@ -10,7 +9,11 @@ import "server-only";
  * Ciphertext format: "enc:v1:<iv_b64>:<ciphertext_b64>:<authtag_b64>"
  * Blind index format: "hmac-sha256:<sha256_hex>"
  */
-import { createCipheriv, createDecipheriv, randomBytes, createHmac, } from "crypto";
+// crypto is a Node.js built-in. Use require() to keep it out of the static
+// import graph so Next.js Edge bundler does not warn about this file.
+/* eslint-disable @typescript-eslint/no-require-imports */
+function nodeCrypto() { return require("crypto"); }
+/* eslint-enable @typescript-eslint/no-require-imports */
 const ALGO = "aes-256-gcm";
 export const ENC_PREFIX = "enc:v1:";
 export const HMAC_PREFIX = "hmac-sha256:";
@@ -43,6 +46,7 @@ function getHmacKey() {
 }
 /** Encrypt a plaintext string with AES-256-GCM. */
 export function encryptValue(plaintext) {
+    const { randomBytes, createCipheriv } = nodeCrypto();
     const key = getEncKey();
     const iv = randomBytes(12);
     const cipher = createCipheriv(ALGO, key, iv);
@@ -59,6 +63,7 @@ export function decryptValue(ciphertext) {
     if (parts.length !== 3)
         throw new Error(`Invalid PII ciphertext: ${ciphertext}`);
     const [ivB64, encB64, tagB64] = parts;
+    const { createDecipheriv } = nodeCrypto();
     const key = getEncKey();
     const iv = Buffer.from(ivB64, "base64");
     const encrypted = Buffer.from(encB64, "base64");
@@ -72,6 +77,7 @@ export function decryptValue(ciphertext) {
  * Used for equality lookups without decrypting (e.g. find-by-email).
  */
 export function hmacBlindIndex(value) {
+    const { createHmac } = nodeCrypto();
     const key = getHmacKey();
     const hash = createHmac("sha256", key).update(value).digest("hex");
     return `${HMAC_PREFIX}${hash}`;
@@ -108,7 +114,7 @@ export function decryptPiiFields(doc, piiFields) {
     }
     return result;
 }
-// ─── Aliases for compatibility with existing code ───────────────────────────
+// --- Aliases for compatibility with existing code ---------------------------
 /** Alias for encryptValue — encrypts a PII plaintext string. */
 export function encryptPii(plaintext) {
     if (!plaintext || typeof plaintext !== "string")
@@ -146,7 +152,7 @@ export function addPiiIndices(obj, mapping) {
     }
     return result;
 }
-// ─── Nested-object PII helpers ──────────────────────────────────────────────
+// --- Nested-object PII helpers ----------------------------------------------
 /**
  * Encrypt PII inside a shipping address stored in an order.
  * Supports string and object address shapes.
@@ -268,7 +274,7 @@ export function decryptPayoutBankAccount(bank) {
         return bank;
     return decryptPiiFields({ ...bank }, []);
 }
-// ─── Public display masking ─────────────────────────────────────────────────
+// --- Public display masking -------------------------------------------------
 /**
  * Mask a person's name for public display.
  * Each word is reduced to its first letter followed by "***".

package/dist/security/pii-redact.d.ts

@@ -18,3 +18,19 @@
  * never mutated.
  */
 export declare function redactPii(data: unknown, depth?: number): unknown;
+/**
+ * Safe display name for untrusted / possibly-encrypted PII fields.
+ *
+ * When a field value is an encrypted token (`enc:v1:...`) — i.e. the server
+ * forgot to decrypt before serialising — it must never be shown to the user.
+ * This function returns a readable `fallback` string instead.
+ *
+ * @example
+ * safeDisplayName(product.sellerName)        // → "John" or "Seller"
+ * safeDisplayName("enc:v1:abc...", "Seller") // → "Seller"
+ */
+export declare function safeDisplayName(value: string | null | undefined, fallback?: string): string;
+/**
+ * Safe display email — returns fallback if encrypted or missing.
+ */
+export declare function safeDisplayEmail(value: string | null | undefined, fallback?: string): string;

package/dist/security/pii-redact.js

@@ -127,3 +127,35 @@ export function redactPii(data, depth = 0) {
     }
     return result;
 }
+// ---------------------------------------------------------------------------
+// UI display helpers
+// ---------------------------------------------------------------------------
+const ENC_TOKEN_PREFIX = "enc:v1:";
+/**
+ * Safe display name for untrusted / possibly-encrypted PII fields.
+ *
+ * When a field value is an encrypted token (`enc:v1:...`) — i.e. the server
+ * forgot to decrypt before serialising — it must never be shown to the user.
+ * This function returns a readable `fallback` string instead.
+ *
+ * @example
+ * safeDisplayName(product.sellerName)        // → "John" or "Seller"
+ * safeDisplayName("enc:v1:abc...", "Seller") // → "Seller"
+ */
+export function safeDisplayName(value, fallback = "Seller") {
+    if (!value)
+        return fallback;
+    if (value.startsWith(ENC_TOKEN_PREFIX))
+        return fallback;
+    return value;
+}
+/**
+ * Safe display email — returns fallback if encrypted or missing.
+ */
+export function safeDisplayEmail(value, fallback = "—") {
+    if (!value)
+        return fallback;
+    if (value.startsWith(ENC_TOKEN_PREFIX))
+        return fallback;
+    return value;
+}

package/dist/security/rate-limit.d.ts

@@ -1,4 +1,3 @@
-import "server-only";
 /**
  * Rate Limiting
  *

package/dist/security/rate-limit.js

@@ -1,5 +1,17 @@
-import "server-only";
-// ─── IP extraction ────────────────────────────────────────────────────────────
+/**
+ * Rate Limiting
+ *
+ * Sliding-window rate limiter. Designed for free tier:
+ * - Defaults to in-memory rate limiting (no external service required)
+ * - Upstash Redis optional for distributed deployments (removed from free tier)
+ *
+ * On Vercel Free + Firebase Blaze free tier: uses in-memory only
+ *
+ * Legacy Upstash support (if UPSTASH_REDIS_REST_URL/TOKEN set):
+ *   UPSTASH_REDIS_REST_URL
+ *   UPSTASH_REDIS_REST_TOKEN
+ */
+// --- IP extraction ------------------------------------------------------------
 function getClientIP(request) {
     const forwarded = request.headers.get("x-forwarded-for");
     if (forwarded)
@@ -9,7 +21,7 @@ function getClientIP(request) {
         return realIP;
     return "unknown";
 }
-// ─── Upstash-backed limiter ───────────────────────────────────────────────────
+// --- Upstash-backed limiter ---------------------------------------------------
 let upstashLimiter = null;
 async function getUpstashLimiter() {
     if (upstashLimiter)
@@ -45,7 +57,7 @@ async function getUpstashLimiter() {
     };
     return upstashLimiter;
 }
-// ─── In-memory fallback ───────────────────────────────────────────────────────
+// --- In-memory fallback -------------------------------------------------------
 const memStore = new Map();
 function inMemoryLimit(identifier, limit, window) {
     const now = Date.now();
@@ -69,7 +81,7 @@ function inMemoryLimit(identifier, limit, window) {
     }
     return { success: true, limit, remaining, reset };
 }
-// ─── Public API ───────────────────────────────────────────────────────────────
+// --- Public API ---------------------------------------------------------------
 /**
  * Rate limit by request. Uses Upstash Redis when configured, in-memory otherwise.
  */

package/dist/security/rbac/Can.js

@@ -1,5 +1,3 @@
-// appkit/src/security/rbac/Can.tsx
-"use client";
 import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 /**
  * Conditionally renders children based on RBAC permissions.

package/dist/security/rbac/hook.js

@@ -1,5 +1,5 @@
-// appkit/src/security/rbac/hook.ts
 "use client";
+// appkit/src/security/rbac/hook.ts
 import { useMemo } from "react";
 import { resolvePermissions, hasPermission, hasAllPermissions, hasAnyPermission, } from "./resolver";
 /**

package/dist/security/settings-encryption.d.ts

@@ -1,4 +1,3 @@
-import "server-only";
 export declare function encryptSecret(plaintext: string): string;
 export declare function decryptSecret(encrypted: string): string;
 export declare function isSecretEncrypted(value: string): boolean;

package/dist/security/settings-encryption.js

@@ -1,5 +1,8 @@
-import "server-only";
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+// crypto is a Node.js built-in. Use require() to keep it out of the static
+// import graph so Next.js Edge bundler does not warn about this file.
+/* eslint-disable @typescript-eslint/no-require-imports */
+function nodeCrypto() { return require("crypto"); }
+/* eslint-enable @typescript-eslint/no-require-imports */
 const ALGORITHM = "aes-256-gcm";
 const IV_BYTES = 12;
 const PREFIX = "enc:v1:";
@@ -12,6 +15,7 @@ function getMasterKey() {
 }
 export function encryptSecret(plaintext) {
     const key = getMasterKey();
+    const { randomBytes, createCipheriv } = nodeCrypto();
     const iv = randomBytes(IV_BYTES);
     const cipher = createCipheriv(ALGORITHM, key, iv);
     const ciphertext = Buffer.concat([
@@ -30,6 +34,7 @@ export function decryptSecret(encrypted) {
         throw new Error("Invalid encrypted value - expected 3 parts");
     }
     const [ivB64, tagB64, ciphertextB64] = parts;
+    const { createDecipheriv } = nodeCrypto();
     const decipher = createDecipheriv(ALGORITHM, getMasterKey(), Buffer.from(ivB64, "base64"));
     decipher.setAuthTag(Buffer.from(tagB64, "base64"));
     return Buffer.concat([

package/dist/seed/actions/demo-seed-actions.d.ts

@@ -6,8 +6,9 @@
  * the actual collection-specific seeding logic (800+ lines with PII encryption,
  * Auth user creation, subcollection handling, etc.).
  */
-export type SeedCollectionName = "users" | "addresses" | "categories" | "stores" | "products" | "orders" | "reviews" | "bids" | "coupons" | "carouselSlides" | "homepageSections" | "siteSettings" | "faqs" | "notifications" | "payouts" | "blogPosts" | "events" | "eventEntries" | "sessions" | "carts";
+export type SeedCollectionName = "users" | "addresses" | "categories" | "stores" | "products" | "orders" | "reviews" | "bids" | "coupons" | "carouselSlides" | "homepageSections" | "siteSettings" | "faqs" | "notifications" | "payouts" | "blogPosts" | "events" | "eventEntries" | "sessions" | "storeAddresses" | "carts" | "wishlists";
 export interface SeedOperationResult {
+    success?: boolean;
     message: string;
     details: {
         created?: number;
@@ -16,6 +17,15 @@ export interface SeedOperationResult {
         skipped?: number;
         errors?: number;
         collections?: string[];
+        dryRun?: boolean;
+        collectionPlans?: Array<{
+            name: string;
+            seedCount: number;
+            existingCount: number;
+            wouldCreate?: number;
+            wouldDelete?: number;
+            wouldSkip?: number;
+        }>;
     };
 }
 /**
@@ -28,4 +38,5 @@ export interface SeedOperationResult {
 export declare function demoSeed(vars: {
     action: "load" | "delete";
     collections?: SeedCollectionName[];
+    dryRun?: boolean;
 }, apiBaseUrl: string): Promise<SeedOperationResult>;

package/dist/seed/addresses-seed-data.d.ts

@@ -1,4 +1,3 @@
-import "server-only";
 export interface AddressSeedData {
     id: string;
     label: string;

package/dist/seed/addresses-seed-data.js

@@ -1,4 +1,3 @@
-import "server-only";
 import { getSeedLocale, getDefaultPhonePrefix } from "./seed-market-config";
 const _locale = getSeedLocale();
 const _phonePrefix = getDefaultPhonePrefix();
@@ -9,7 +8,7 @@ const _phonePrefix = getDefaultPhonePrefix();
  * Addresses stored as subcollection: users/{userId}/addresses/{addressId}
  * All address documents mapped to users that exist in users-seed-data.ts.
  */
-// ─── Dynamic date helpers ───────────────────────────────────────────────────
+// --- Dynamic date helpers ---------------------------------------------------
 const NOW = new Date();
 const daysAgo = (n) => new Date(NOW.getTime() - n * 86400000);
 export const addressesSeedData = [