@mohasinac/appkit 3.0.0 → 3.0.2

package/dist/utils/action-response.js

@@ -1,6 +1,5 @@
 import { serverLogger } from "../monitoring";
 import { AuthorizationError, NotFoundError, ValidationError, } from "../errors";
-// audit-unknown-ok: type-narrowing entry point — accepts any value, narrows by typeof/Array.isArray
 export function handleActionError(err) {
     const devDebug = process.env.NODE_ENV === "development"
         ? { stack: err instanceof Error ? err.stack : String(err) }

package/dist/utils/date.formatter.js

@@ -6,7 +6,6 @@ import { getDefaultLocale } from "../core/baseline-resolver";
  * Resolve any date-like value (Date, ISO string, number, or Firestore Timestamp JSON)
  * into a native Date object. Returns null for falsy or unparseable input.
  */
-// audit-unknown-ok: type-narrowing entry point — accepts any value, narrows by typeof/Array.isArray
 export function resolveDate(value) {
     if (!value)
         return null;

package/dist/utils/object.helper.js

@@ -44,7 +44,6 @@ export function deepClone(obj) {
     if (obj === null || typeof obj !== "object")
         return obj;
     if (Array.isArray(obj))
-        // audit-unknown-ok: TS structural escape — generic param
         return obj.map((item) => deepClone(item));
     const cloned = {};
     const objectRecord = obj;
@@ -53,7 +52,6 @@ export function deepClone(obj) {
     });
     return cloned;
 }
-// audit-unknown-ok: type-narrowing entry point — accepts any value, narrows by typeof/Array.isArray
 export function isEqual(obj1, obj2) {
     if (obj1 === obj2)
         return true;

package/dist/utils/schema-ui.js

@@ -112,9 +112,7 @@ const DEFAULT_OMIT = ["id", "createdAt", "updatedAt", "deletedAt"];
  * @param options  Optional config: `omit`, `include`.
  * @returns        Array of `DerivedField` descriptors, one per schema property.
  */
-export function deriveFormFields(
-// audit-unknown-ok: Zod schema UI introspection — schema is caller-defined
-schema, options = {}) {
+export function deriveFormFields(schema, options = {}) {
     const zodLike = schema;
     // Unwrap ZodEffects to reach the ZodObject
     const unwrapped = unwrapZodType(zodLike);

package/dist/validation/input.validator.js

@@ -1,7 +1,6 @@
 /**
  * General Input Validation Utilities
  */
-// audit-unknown-ok: type-narrowing entry point — accepts any value, narrows by typeof/Array.isArray
 export function isRequired(value) {
     if (value === null || value === undefined)
         return false;

package/dist/validation/schemas.js

@@ -185,9 +185,7 @@ export const trimDataSchema = z
 // ============================================
 // REQUEST VALIDATION HELPERS
 // ============================================
-export function validateRequestBody(schema, 
-// audit-unknown-ok: callback entry point — accepts arbitrary payload value
-body) {
+export function validateRequestBody(schema, body) {
     const result = schema.safeParse(body);
     if (result.success) {
         return { success: true, data: result.data };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
@@ -124,7 +124,10 @@
     "scripts/init-config.mjs",
     "scripts/labels-extract.mjs",
     "scripts/seed-cli.mjs",
-    "scripts/seed-cli-loader.mjs"
+    "scripts/seed-cli-loader.mjs",
+    "scripts/dedupe-peer-deps.mjs",
+    "scripts/copy-assets.mjs",
+    "scripts/bundle-css.mjs"
   ],
   "bin": {
     "appkit-sieve-audit": "./scripts/sieve-audit.mjs",

package/scripts/bundle-css.mjs

@@ -0,0 +1,47 @@
+/**
+ * bundle-css.mjs — Flatten all @import chains in dist/styles.css into a single
+ * concatenated file. Turbopack (Next.js 16+) does not reliably resolve nested
+ * CSS @import chains from node_modules, so shipping a flat file is the safest
+ * approach for both webpack and Turbopack consumers.
+ *
+ * Runs after copy-assets.mjs + tailwindcss build, so dist/ already has every
+ * individual .style.css and tokens.css file.
+ */
+import { readFileSync, writeFileSync } from "fs";
+import { join, dirname, resolve } from "path";
+
+const DIST = new URL("../dist", import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, "$1");
+const ENTRY = join(DIST, "styles.css");
+
+const seen = new Set();
+
+function stripComments(css) {
+  return css.replace(/\/\*[\s\S]*?\*\//g, match => " ".repeat(match.length));
+}
+
+function inlineImports(filePath) {
+  if (seen.has(filePath)) return "";
+  seen.add(filePath);
+
+  const css = readFileSync(filePath, "utf8");
+  const dir = dirname(filePath);
+  const stripped = stripComments(css);
+
+  return css.replace(/@import\s+["']([^"']+)["']\s*;/g, (_match, relPath, offset) => {
+    if (stripped.substring(offset, offset + _match.length).trim() === "") return _match;
+    const resolved = resolve(dir, relPath);
+    try {
+      return inlineImports(resolved);
+    } catch (err) {
+      console.error(`[bundle-css] WARNING: could not resolve @import "${relPath}" from ${filePath}`);
+      return _match;
+    }
+  });
+}
+
+const bundled = inlineImports(ENTRY);
+writeFileSync(ENTRY, bundled, "utf8");
+
+const lines = bundled.split("\n").length;
+const bytes = Buffer.byteLength(bundled, "utf8");
+console.log(`[bundle-css] Bundled ${seen.size} CSS files into dist/styles.css (${lines} lines, ${(bytes / 1024).toFixed(1)} KB)`);

package/scripts/copy-assets.mjs

@@ -0,0 +1,34 @@
+/**
+ * Post-build: copy non-TypeScript assets (CSS, etc.) from src/ to dist/
+ * preserving the directory structure.
+ */
+import { readdir, copyFile, mkdir, stat } from "fs/promises";
+import { join, relative, dirname, extname } from "path";
+
+const ASSET_EXTENSIONS = new Set([".css", ".json", ".svg", ".png"]);
+const SRC = new URL("../src", import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, "$1");
+const DIST = new URL("../dist", import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, "$1");
+
+async function walk(dir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...(await walk(full)));
+    } else if (ASSET_EXTENSIONS.has(extname(entry.name))) {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+const assets = await walk(SRC);
+for (const src of assets) {
+  const rel = relative(SRC, src);
+  const dst = join(DIST, rel);
+  await mkdir(dirname(dst), { recursive: true });
+  await copyFile(src, dst);
+}
+
+console.log(`Copied ${assets.length} asset file(s) to dist/`);

package/scripts/dedupe-peer-deps.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/*
+ * dedupe-peer-deps.mjs — postinstall hook
+ *
+ * Prevents the Turbopack "dual-instance" SSR crash that bit prod on 2026-06-10
+ * (appkit 2.8.8 → "No QueryClient set" on every server-rendered route).
+ *
+ * Root cause: when appkit is used as a local-file/submodule dependency
+ * (consumer's `package.json` uses `"@mohasinac/appkit": "file:./appkit"`),
+ * running `cd appkit && npm install` populates `appkit/node_modules/` with
+ * the same peerDependencies that the consumer already has at its root
+ * `node_modules/`. Turbopack 16 then resolves appkit-internal imports of those
+ * packages to the *appkit-local* copy while the consumer's imports resolve to
+ * the root copy — producing two separate `QueryClientContext` instances (and
+ * two of every other React context the peer deps use). useContext mismatches
+ * crash SSR.
+ *
+ * Fix: after any `npm install` inside appkit, delete the peer-dep duplicates.
+ * Node's module resolution walks up to the consumer's `node_modules/`, so all
+ * imports — both from appkit's own tsc and from Turbopack — land on the single
+ * consumer copy.
+ *
+ * This is idempotent and silent when there's nothing to delete (e.g. when
+ * appkit is consumed from npm where peerDeps were never installed).
+ */
+import { readFileSync, readdirSync, rmSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgPath = resolve(here, "..", "package.json");
+const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+const peers = Object.keys(pkg.peerDependencies || {});
+
+// Packages to remove:
+//   1. Every entry in peerDependencies.
+//   2. Transitive runtime deps of peers that ship their own React context (or any
+//      other top-level singleton). Pruning the peer alone is not enough — the
+//      transitive carries the duplicate context. List them explicitly so we
+//      never accidentally prune type-only packages.
+const TRANSITIVE_RUNTIME_DUPS = [
+  // @tanstack/react-query (peer) → bundles @tanstack/query-core, which owns
+  // QueryClientContext. Without this prune, Turbopack picks up the appkit-local
+  // query-core and a parallel QueryClientContext instance ships in the SSR
+  // bundle, producing the "No QueryClient set" crash on every page (2026-06-11).
+  "@tanstack/query-core",
+];
+
+// Peer deps that have NO React context / module-scope singleton and that the
+// consumer may not install at the root (e.g. firebase-functions ships only in
+// the Firebase Cloud Functions deploy, not the Next.js consumer). Keeping them
+// in appkit/node_modules lets `tsc -p appkit` resolve their types when the
+// consumer-root copy is absent. The dual-instance crash (2026-06-10) cannot
+// occur here because none of these packages own a top-level React context.
+const SAFE_TO_KEEP = new Set([
+  "firebase-functions",
+]);
+
+const removed = [];
+
+function removeIfPresent(absPath, label) {
+  if (existsSync(absPath)) {
+    rmSync(absPath, { recursive: true, force: true });
+    removed.push(label);
+  }
+}
+
+for (const dep of [...peers, ...TRANSITIVE_RUNTIME_DUPS]) {
+  if (SAFE_TO_KEEP.has(dep)) continue;
+  removeIfPresent(resolve(here, "..", "node_modules", dep), dep);
+}
+
+// Clean up now-empty scope dirs (e.g. @tanstack/) so subsequent `npm install`
+// doesn't trip on a phantom entry.
+const scopesTouched = new Set();
+for (const dep of [...peers, ...TRANSITIVE_RUNTIME_DUPS]) {
+  if (dep.startsWith("@")) scopesTouched.add(dep.split("/")[0]);
+}
+for (const scope of scopesTouched) {
+  const scopeDir = resolve(here, "..", "node_modules", scope);
+  try {
+    if (existsSync(scopeDir) && readdirSync(scopeDir).length === 0) {
+      rmSync(scopeDir, { recursive: true, force: true });
+    }
+  } catch {}
+}
+
+if (removed.length > 0) {
+  console.log(
+    `[appkit/postinstall] removed ${removed.length} peer-dep duplicate(s) from appkit/node_modules: ${removed.join(", ")}`,
+  );
+}