@mohasinac/appkit 3.8.0 → 3.8.2

package/dist/features/admin/components/AdminCartsView.js

@@ -1,11 +1,9 @@
 "use client";
 import { jsx as _jsx } from "react/jsx-runtime";
-import { sieveFilter, SIEVE_OP } from "@mohasinac/appkit";
 import { sortBy } from "@mohasinac/appkit";
 import React from "react";
-import { FilterChipGroup, ListingLayout } from "../../../ui";
+import { ListingLayout } from "../../../ui";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
-import { ADMIN_CART_OWNERSHIP_TABS } from "../constants/filter-tabs";
 import { toRecordArray, toRelativeDate, toStringValue, } from "../hooks/useAdminListingData";
 import { DataListingView } from "./DataListingView";
 const ADMIN_CARTS_CONFIG = {
@@ -13,7 +11,7 @@ const ADMIN_CARTS_CONFIG = {
     title: "Carts",
     searchPlaceholder: "Search by user ID or session",
     emptyLabel: "No carts found",
-    filterKeys: ["type"],
+    filterKeys: [],
     defaultSort: sortBy("updatedAt", "DESC"),
     queryKey: ["admin", "carts", "listing"],
     endpoint: ADMIN_ENDPOINTS.ADMIN_CARTS,
@@ -36,8 +34,7 @@ const ADMIN_CARTS_CONFIG = {
         };
     }),
     getTotal: (response, mappedRows) => typeof response.total === "number" ? response.total : mappedRows.length,
-    buildFilters: (state) => state.type && state.type !== "All" ? sieveFilter("type", SIEVE_OP.EQ, state.type) : undefined,
-    renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsx(FilterChipGroup, { label: "Type", tabs: ADMIN_CART_OWNERSHIP_TABS, value: pendingFilters.type ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, type: id })) })),
+    buildFilters: () => undefined,
 };
 export function AdminCartsView({ children, ...props }) {
     if (React.Children.count(children) > 0) {

package/dist/features/seller/components/SellerArtView.js

@@ -69,7 +69,7 @@ export function SellerArtView({ onCreateClick, onEditClick, onDelete, onBulkDele
         sortOptions: [
             { value: sortBy("createdAt", "DESC"), label: "Newest" },
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
-            { value: "productTitle", label: "Name A–Z" },
+            { value: "title", label: "Name A–Z" },
             { value: sortBy("price", "ASC"), label: "Price: Low–High" },
             { value: sortBy("price", "DESC"), label: "Price: High–Low" },
         ],

package/dist/features/seller/components/SellerAuctionsView.js

@@ -39,12 +39,12 @@ export function SellerAuctionsView({ children, onEditClick, onDelete, onBulkDele
         searchPlaceholder: "Search auctions by product name",
         emptyLabel: "No auctions found",
         filterKeys: ["status"],
-        defaultSort: sortBy("endsAt", "ASC"),
+        defaultSort: sortBy("auctionEndDate", "ASC"),
         queryKey: ["seller", "auctions", "listing"],
         endpoint: SELLER_ENDPOINTS.AUCTIONS,
         sortOptions: [
-            { value: "endsAt", label: "Ending soon" },
-            { value: sortBy("endsAt", "DESC"), label: "Ending latest" },
+            { value: "auctionEndDate", label: "Ending soon" },
+            { value: sortBy("auctionEndDate", "DESC"), label: "Ending latest" },
             { value: sortBy("createdAt", "DESC"), label: "Newest" },
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
         ],

package/dist/features/seller/components/SellerClassifiedView.js

@@ -70,7 +70,7 @@ export function SellerClassifiedView({ onCreateClick, onEditClick, onDelete, onB
         sortOptions: [
             { value: sortBy("createdAt", "DESC"), label: "Newest" },
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
-            { value: "productTitle", label: "Name A–Z" },
+            { value: "title", label: "Name A–Z" },
             { value: sortBy("price", "ASC"), label: "Price: Low–High" },
             { value: sortBy("price", "DESC"), label: "Price: High–Low" },
         ],

package/dist/features/seller/components/SellerDigitalCodesView.js

@@ -75,7 +75,7 @@ export function SellerDigitalCodesView({ onCreateClick, onEditClick, onDelete, o
         sortOptions: [
             { value: sortBy("createdAt", "DESC"), label: "Newest" },
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
-            { value: "productTitle", label: "Name A–Z" },
+            { value: "title", label: "Name A–Z" },
             { value: sortBy("price", "ASC"), label: "Price: Low–High" },
         ],
         columns: COLUMNS,

package/dist/features/seller/components/SellerLiveView.js

@@ -74,7 +74,7 @@ export function SellerLiveView({ onCreateClick, onEditClick, onDelete, onBulkDel
         sortOptions: [
             { value: sortBy("createdAt", "DESC"), label: "Newest" },
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
-            { value: "productTitle", label: "Name A–Z" },
+            { value: "title", label: "Name A–Z" },
             { value: sortBy("price", "ASC"), label: "Price: Low–High" },
             { value: sortBy("price", "DESC"), label: "Price: High–Low" },
         ],

package/dist/features/seller/components/SellerPreOrdersView.js

@@ -88,7 +88,7 @@ export function SellerPreOrdersView({ children, onDelete, ...props }) {
             { value: sortBy("createdAt", "DESC"), label: "Newest" },
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
             { value: "title", label: "Title A–Z" },
-            { value: "preorderAvailableDate", label: "Delivery Soon" },
+            { value: "preOrderDeliveryDate", label: "Delivery Soon" },
         ],
         columns: PRE_ORDER_COLUMNS,
         mapRows: (response) => toRecordArray(response.products).map((item, index) => {
@@ -99,8 +99,8 @@ export function SellerPreOrdersView({ children, onDelete, ...props }) {
                 secondary: toStringValue(item.condition, ""),
                 status: toStringValue(item.status, "draft"),
                 price: priceRaw ? toRupees(priceRaw) : "—",
-                deliveryDate: item.preorderAvailableDate
-                    ? toRelativeDate(item.preorderAvailableDate)
+                deliveryDate: item.preOrderDeliveryDate
+                    ? toRelativeDate(item.preOrderDeliveryDate)
                     : "TBA",
                 updatedAt: toRelativeDate(item.updatedAt ?? item.createdAt),
                 imageUrl: toStringValue(item.mainImage ?? item.images?.[0], undefined),

package/dist/features/seller/components/SellerPrizeDrawsView.js

@@ -85,7 +85,7 @@ export function SellerPrizeDrawsView({ children, onDelete, ...props }) {
             { value: sortBy("createdAt", "DESC"), label: "Newest" },
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
             { value: "title", label: "Title A–Z" },
-            { value: "prizeDrawEndDate", label: "Draw Date Soon" },
+            { value: "prizeRevealWindowEnd", label: "Draw Date Soon" },
         ],
         columns: PRIZE_DRAW_COLUMNS,
         mapRows: (response) => toRecordArray(response.products).map((item, index) => {
@@ -96,8 +96,8 @@ export function SellerPrizeDrawsView({ children, onDelete, ...props }) {
                 secondary: toStringValue(item.condition, ""),
                 status: toStringValue(item.status, "draft"),
                 entryFee: priceRaw ? toRupees(priceRaw) : "Free",
-                drawDate: item.prizeDrawEndDate
-                    ? toRelativeDate(item.prizeDrawEndDate)
+                drawDate: item.prizeRevealWindowEnd
+                    ? toRelativeDate(item.prizeRevealWindowEnd)
                     : "TBA",
                 updatedAt: toRelativeDate(item.updatedAt ?? item.createdAt),
                 imageUrl: toStringValue(item.mainImage ?? item.images?.[0], undefined),

package/dist/features/seller/components/SellerStickersView.js

@@ -69,7 +69,7 @@ export function SellerStickersView({ onCreateClick, onEditClick, onDelete, onBul
         sortOptions: [
             { value: sortBy("createdAt", "DESC"), label: "Newest" },
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
-            { value: "productTitle", label: "Name A–Z" },
+            { value: "title", label: "Name A–Z" },
             { value: sortBy("price", "ASC"), label: "Price: Low–High" },
             { value: sortBy("price", "DESC"), label: "Price: High–Low" },
         ],

package/dist/index.d.ts

@@ -444,10 +444,8 @@ export { BID_PII_FIELDS } from "./security/index";
 export { CHAT_PII_FIELDS } from "./security/index";
 export { Can } from "./security/index";
 export { DEFAULT_ROLES } from "./security/index";
-export { ENC_PREFIX } from "./security/index";
 export { EVENT_ENTRY_PII_FIELDS } from "./security/index";
 export { LOTTERY_ENTRY_PII_FIELDS } from "./security/index";
-export { HMAC_PREFIX } from "./security/index";
 export { NEWSLETTER_PII_FIELDS } from "./security/index";
 export { NEWSLETTER_PII_INDEX_MAP } from "./security/index";
 export { OFFER_PII_FIELDS } from "./security/index";
@@ -461,7 +459,6 @@ export { TOKEN_PII_FIELDS } from "./security/index";
 export { TOKEN_PII_INDEX_MAP } from "./security/index";
 export { USER_PII_FIELDS } from "./security/index";
 export { USER_PII_INDEX_MAP } from "./security/index";
-export { addPiiIndices } from "./security/index";
 export { applyRateLimit } from "./security/index";
 export { buildCSP } from "./security/index";
 export { canChangeRole } from "./security/index";
@@ -470,42 +467,19 @@ export { createRbacHook } from "./security/index";
 export { createRbacMiddleware } from "./security/index";
 export { createRequirePermission } from "./security/index";
 export { createRequirePermissionSync } from "./security/index";
-export { decryptPayoutBankAccount } from "./security/index";
-export { decryptPayoutDetails } from "./security/index";
-export { decryptPii } from "./security/index";
-export { decryptPiiFields } from "./security/index";
 export { decryptSecret } from "./security/index";
-export { decryptShippingAddress } from "./security/index";
-export { decryptShippingConfig } from "./security/index";
-export { decryptValue } from "./security/index";
-export { encryptPayoutBankAccount } from "./security/index";
-export { encryptPayoutDetails } from "./security/index";
-export { encryptPii } from "./security/index";
-export { encryptPiiFields } from "./security/index";
 export { encryptSecret } from "./security/index";
-export { encryptShippingAddress } from "./security/index";
-export { encryptShippingConfig } from "./security/index";
-export { encryptValue } from "./security/index";
 export { generateNonce } from "./security/index";
-export { getPiiConfigError } from "./security/index";
 export { getRoleLevel } from "./security/index";
 export { hasAllPermissions } from "./security/index";
 export { hasAnyPermission } from "./security/index";
 export { hasPermission } from "./security/index";
-export { hmacBlindIndex } from "./security/index";
-export { isPiiEncrypted } from "./security/index";
 export { isSecretEncrypted } from "./security/index";
-export { maskEmail } from "./security/index";
-export { maskName } from "./security/index";
-export { maskOfferForSeller } from "./security/index";
-export { maskPublicBid } from "./security/index";
-export { maskPublicEventEntry } from "./security/index";
-export { maskPublicReview } from "./security/index";
 export { maskSecret } from "./security/index";
-export { piiBlindIndex } from "./security/index";
 export { rateLimit } from "./security/index";
 export { rateLimitByIdentifier } from "./security/index";
 export { redactPii, safeDisplayName, safeDisplayEmail } from "./security/index";
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./security/index";
 export { requireActiveAccount } from "./security/index";
 export { requireAuth } from "./security/index";
 export { requireEmailVerified } from "./security/index";

package/dist/index.js

@@ -782,17 +782,11 @@ export { Can } from "./security/index";
 // DEFAULT_ROLES - Constant used across modules.
 export { DEFAULT_ROLES } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// ENC_PREFIX - Constant used across modules.
-export { ENC_PREFIX } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // EVENT_ENTRY_PII_FIELDS - Constant used across modules.
 export { EVENT_ENTRY_PII_FIELDS } from "./security/index";
 // LOTTERY_ENTRY_PII_FIELDS - PII fields for lottery entries.
 export { LOTTERY_ENTRY_PII_FIELDS } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// HMAC_PREFIX - Constant used across modules.
-export { HMAC_PREFIX } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // NEWSLETTER_PII_FIELDS - Constant used across modules.
 export { NEWSLETTER_PII_FIELDS } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
@@ -832,9 +826,6 @@ export { USER_PII_FIELDS } from "./security/index";
 // USER_PII_INDEX_MAP - Constant used across modules.
 export { USER_PII_INDEX_MAP } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// addPiiIndices - Helper for add pii indices.
-export { addPiiIndices } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // applyRateLimit - Helper for apply rate limit.
 export { applyRateLimit } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
@@ -859,60 +850,15 @@ export { createRequirePermission } from "./security/index";
 // createRequirePermissionSync - Helper for create require permission sync.
 export { createRequirePermissionSync } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// decryptPayoutBankAccount - Helper for decrypt payout bank account.
-export { decryptPayoutBankAccount } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// decryptPayoutDetails - Helper for decrypt payout details.
-export { decryptPayoutDetails } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// decryptPii - Helper for decrypt pii.
-export { decryptPii } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// decryptPiiFields - Helper for decrypt pii fields.
-export { decryptPiiFields } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // decryptSecret - Helper for decrypt secret.
 export { decryptSecret } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// decryptShippingAddress - Helper for decrypt shipping address.
-export { decryptShippingAddress } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// decryptShippingConfig - Helper for decrypt shipping config.
-export { decryptShippingConfig } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// decryptValue - Helper for decrypt value.
-export { decryptValue } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// encryptPayoutBankAccount - Helper for encrypt payout bank account.
-export { encryptPayoutBankAccount } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// encryptPayoutDetails - Helper for encrypt payout details.
-export { encryptPayoutDetails } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// encryptPii - Helper for encrypt pii.
-export { encryptPii } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// encryptPiiFields - Helper for encrypt pii fields.
-export { encryptPiiFields } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // encryptSecret - Helper for encrypt secret.
 export { encryptSecret } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// encryptShippingAddress - Helper for encrypt shipping address.
-export { encryptShippingAddress } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// encryptShippingConfig - Helper for encrypt shipping config.
-export { encryptShippingConfig } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// encryptValue - Helper for encrypt value.
-export { encryptValue } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // generateNonce - Helper for generate nonce.
 export { generateNonce } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// getPiiConfigError - Helper for get pii config error.
-export { getPiiConfigError } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // getRoleLevel - Helper for get role level.
 export { getRoleLevel } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
@@ -925,39 +871,12 @@ export { hasAnyPermission } from "./security/index";
 // hasPermission - Model for has permission.
 export { hasPermission } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// hmacBlindIndex - Shared export for hmac blind index.
-export { hmacBlindIndex } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// isPiiEncrypted - Shared export for is pii encrypted.
-export { isPiiEncrypted } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // isSecretEncrypted - Shared export for is secret encrypted.
 export { isSecretEncrypted } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// maskEmail - Helper for mask email.
-export { maskEmail } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// maskName - Helper for mask name.
-export { maskName } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// maskOfferForSeller - Helper for mask offer for seller.
-export { maskOfferForSeller } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// maskPublicBid - Helper for mask public bid.
-export { maskPublicBid } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// maskPublicEventEntry - Helper for mask public event entry.
-export { maskPublicEventEntry } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// maskPublicReview - Helper for mask public review.
-export { maskPublicReview } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // maskSecret - Helper for mask secret.
 export { maskSecret } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// piiBlindIndex - Shared export for pii blind index.
-export { piiBlindIndex } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // rateLimit - Shared export for rate limit.
 export { rateLimit } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
@@ -966,6 +885,8 @@ export { rateLimitByIdentifier } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // redactPii - Shared export for redact pii.
 export { redactPii, safeDisplayName, safeDisplayEmail } from "./security/index";
+// [CLIENT-SSR]-Runs in both SSR and browser â€" pure display-masking helpers, no crypto dependency.
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // requireActiveAccount - Shared export for require active account.
 export { requireActiveAccount } from "./security/index";

package/dist/security/index.d.ts

@@ -4,7 +4,8 @@ export type { RateLimitConfig, RateLimitResult } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export type { UserRole } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, isPiiEncrypted, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
 export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";
 export type { Permission, RoleDefinition, RbacConfig, ResolvedUser, RbacHookReturn, } from "./rbac";

package/dist/security/index.js

@@ -2,7 +2,11 @@ export { generateNonce, buildCSP } from "./csp";
 export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, clearRateLimitStore, } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, isPiiEncrypted, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+// Crypto-free display-masking helpers -- sourced from pii-mask.ts (not
+// pii-encrypt.ts) so this barrel stays safe to re-export from the
+// universal client+server index.ts. See pii-mask.ts's header comment.
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
 export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";
 export { DEFAULT_ROLES, resolvePermissions, hasPermission, hasAllPermissions, hasAnyPermission, createRbacHook, Can, createRequirePermission, createRequirePermissionSync, createRbacMiddleware, } from "./rbac";

package/dist/security/pii-encrypt.d.ts

@@ -9,8 +9,8 @@
  * Ciphertext format: "enc:v1:<iv_b64>:<ciphertext_b64>:<authtag_b64>"
  * Blind index format: "hmac-sha256:<sha256_hex>"
  */
-export declare const ENC_PREFIX = "enc:v1:";
-export declare const HMAC_PREFIX = "hmac-sha256:";
+import { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted } from "./pii-mask";
+export { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted };
 export declare function getPiiConfigError(): string | null;
 /** Encrypt a plaintext string with AES-256-GCM. */
 export declare function encryptValue(plaintext: string): string;
@@ -36,8 +36,6 @@ export declare function decryptPiiFields<T extends object>(doc: T, piiFields: st
 export declare function encryptPii(plaintext: string | null | undefined): string | null | undefined;
 /** Alias for decryptValue — decrypts a PII ciphertext. */
 export declare function decryptPii(ciphertext: string | null | undefined): string | null | undefined;
-/** Check if a value is encrypted by our PII system. */
-export declare function isPiiEncrypted(value: string): boolean;
 /** Alias for hmacBlindIndex. */
 export declare function piiBlindIndex(plaintext: string): string;
 /**
@@ -80,52 +78,3 @@ export declare function encryptPayoutBankAccount<T extends object>(bank: T | und
  * Decrypt PII on a payout bankAccount sub-object from the payouts collection.
  */
 export declare function decryptPayoutBankAccount<T extends object>(bank: T | undefined | null): T | undefined | null;
-/**
- * Mask a person's name for public display.
- * Each word is reduced to its first letter followed by "***".
- *
- * "John Doe"  → "J*** D***"
- * "Alice"     → "A***"
- *
- * If the value is still an encrypted blob (e.g. PII_ENCRYPTION_KEY not set),
- * returns "Anonymous" so encrypted ciphertext never leaks to the UI.
- */
-export declare function maskName(name: string | null | undefined): string;
-/**
- * Mask an email address for public display.
- * "john.doe@example.com" → "j***@***.com"
- */
-export declare function maskEmail(email: string | null | undefined): string;
-/**
- * Return a copy of a review document with PII fields masked for public display.
- * Admin/owner endpoints should NOT call this — use the raw document instead.
- */
-export declare function maskPublicReview<T extends {
-    userName: string;
-}>(review: T): T;
-/**
- * Return a copy of a bid document with PII masked for public display
- * (auction product page).
- */
-export declare function maskPublicBid<T extends {
-    userName: string;
-}>(bid: T): T;
-/**
- * Return a copy of an event-entry document with PII masked for the leaderboard.
- * ipAddress and userEmail are never sent to the client;
- * only userDisplayName needs masking for a public leaderboard view.
- */
-export declare function maskPublicEventEntry<T extends {
-    userDisplayName?: string;
-    userEmail?: string;
-    ipAddress?: string;
-}>(entry: T): Omit<T, "userEmail" | "ipAddress">;
-/**
- * Return a copy of an offer document with buyer PII masked for the seller view.
- * The seller needs to know an offer was made and its amount, but the buyer's
- * full name and email should remain private until the order is confirmed.
- */
-export declare function maskOfferForSeller<T extends {
-    buyerName: string;
-    buyerEmail: string;
-}>(offer: T): T;

package/dist/security/pii-encrypt.js

@@ -9,22 +9,26 @@
  * Ciphertext format: "enc:v1:<iv_b64>:<ciphertext_b64>:<authtag_b64>"
  * Blind index format: "hmac-sha256:<sha256_hex>"
  */
-import { createRequire } from "node:module";
-// crypto is a Node.js built-in. Use require() to keep it out of the static
-// import graph so Next.js Edge bundler does not warn about this file. A bare
-// top-level `require(...)` call only works when the compiled dist output is
-// loaded via CommonJS (or a bundler that polyfills `require`) — under a
-// plain Node ESM `import()` (e.g. appkit/scripts/seed-cli.mjs and any other
-// standalone script importing @mohasinac/appkit directly), there is no
-// ambient `require` global, so that call threw `ReferenceError: require is
-// not defined`. createRequire(import.meta.url) works in both: it's still a
-// runtime function call a bundler's static analysis won't follow into the
-// client graph, but it resolves correctly under Node's own ESM loader too.
-const nodeRequire = createRequire(import.meta.url);
-function nodeCrypto() { return nodeRequire("crypto"); }
+import { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted } from "./pii-mask";
+// Re-exported for backward-compat with existing direct imports of these
+// symbols from this file — the actual crypto-free definitions live in
+// pii-mask.ts (see that file's header comment for why the split exists).
+export { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted };
+// crypto is a Node.js built-in. A bare, non-static `require(...)` call
+// (never a top-level `import ... from "node:module"`/"crypto") is
+// deliberate: bundlers targeting the browser (Turbopack in particular)
+// statically resolve every top-level import in a module's chain before any
+// tree-shaking pass, and hard-fail immediately on an unresolvable Node
+// builtin even if the symbol using it is never actually consumed
+// client-side. A bare `require` reference inside a function body is a
+// runtime lookup, not a static import, so it's invisible to that pass.
+// This only works where an ambient `require` global exists: Next.js's own
+// server bundle (webpack/Turbopack) provides one automatically; the one
+// place that doesn't is a standalone pure-ESM script importing
+// @mohasinac/appkit directly (appkit/scripts/seed-cli.mjs), which sets
+// `globalThis.require` itself before importing appkit — see that file.
+function nodeCrypto() { return require("crypto"); }
 const ALGO = "aes-256-gcm";
-export const ENC_PREFIX = "enc:v1:";
-export const HMAC_PREFIX = "hmac-sha256:";
 function normalizePiiSecretValue(raw) {
     return (raw ?? "").replace(/(?:\\r|\\n|\r|\n)+$/g, "").trim();
 }
@@ -139,10 +143,6 @@ export function decryptPii(ciphertext) {
         return ciphertext;
     return decryptValue(ciphertext);
 }
-/** Check if a value is encrypted by our PII system. */
-export function isPiiEncrypted(value) {
-    return typeof value === "string" && value.startsWith(ENC_PREFIX);
-}
 /** Alias for hmacBlindIndex. */
 export function piiBlindIndex(plaintext) {
     return hmacBlindIndex(plaintext);
@@ -278,84 +278,3 @@ export function decryptPayoutBankAccount(bank) {
         return bank;
     return decryptPiiFields({ ...bank }, []);
 }
-// --- Public display masking -------------------------------------------------
-/**
- * Mask a person's name for public display.
- * Each word is reduced to its first letter followed by "***".
- *
- * "John Doe"  → "J*** D***"
- * "Alice"     → "A***"
- *
- * If the value is still an encrypted blob (e.g. PII_ENCRYPTION_KEY not set),
- * returns "Anonymous" so encrypted ciphertext never leaks to the UI.
- */
-export function maskName(name) {
-    if (!name || typeof name !== "string")
-        return "Anonymous";
-    if (isPiiEncrypted(name))
-        return "Anonymous";
-    return name
-        .trim()
-        .split(/\s+/)
-        .filter(Boolean)
-        .map((word) => word[0] + "***")
-        .join(" ");
-}
-/**
- * Mask an email address for public display.
- * "john.doe@example.com" → "j***@***.com"
- */
-export function maskEmail(email) {
-    if (!email || typeof email !== "string")
-        return "***@***.***";
-    if (isPiiEncrypted(email))
-        return "***@***.***";
-    const atIdx = email.indexOf("@");
-    if (atIdx < 0)
-        return "***";
-    const local = email.slice(0, atIdx);
-    const domain = email.slice(atIdx + 1);
-    const dotIdx = domain.lastIndexOf(".");
-    const domainMasked = dotIdx > 0 ? "***" + domain.slice(dotIdx) : "***";
-    return (local[0] ?? "*") + "***@" + domainMasked;
-}
-/**
- * Return a copy of a review document with PII fields masked for public display.
- * Admin/owner endpoints should NOT call this — use the raw document instead.
- */
-export function maskPublicReview(review) {
-    return { ...review, userName: maskName(review.userName) };
-}
-/**
- * Return a copy of a bid document with PII masked for public display
- * (auction product page).
- */
-export function maskPublicBid(bid) {
-    return { ...bid };
-}
-/**
- * Return a copy of an event-entry document with PII masked for the leaderboard.
- * ipAddress and userEmail are never sent to the client;
- * only userDisplayName needs masking for a public leaderboard view.
- */
-export function maskPublicEventEntry(entry) {
-    const { userEmail: _e, ipAddress: _ip, ...rest } = entry;
-    return {
-        ...rest,
-        ...(rest.userDisplayName !== undefined
-            ? { userDisplayName: maskName(rest.userDisplayName) }
-            : {}),
-    };
-}
-/**
- * Return a copy of an offer document with buyer PII masked for the seller view.
- * The seller needs to know an offer was made and its amount, but the buyer's
- * full name and email should remain private until the order is confirmed.
- */
-export function maskOfferForSeller(offer) {
-    return {
-        ...offer,
-        buyerName: maskName(offer.buyerName),
-        buyerEmail: maskEmail(offer.buyerEmail),
-    };
-}

package/dist/security/pii-mask.d.ts

@@ -0,0 +1,67 @@
+/**
+ * PII display-masking helpers — pure string manipulation, zero runtime
+ * dependencies. Split out from pii-encrypt.ts so these can be exported
+ * from the universal client+server barrel (index.ts): pii-encrypt.ts has
+ * a top-level `import { createRequire } from "node:module"` (needed for
+ * the AES-256-GCM/HMAC functions to work under both Next.js's bundler and
+ * a pure-ESM standalone script context) that poisons the whole module for
+ * client bundling — Turbopack statically resolves every export in a file
+ * before tree-shaking, so re-exporting even one crypto-free symbol from
+ * pii-encrypt.ts still pulls `node:module` into the client graph and hard
+ * fails the browser build. This file has no such import and is safe
+ * anywhere `ReviewModal`/`ReviewDetailShell`/`ReviewsList` (client
+ * components displaying masked reviewer names) can reach it.
+ */
+export declare const ENC_PREFIX = "enc:v1:";
+export declare const HMAC_PREFIX = "hmac-sha256:";
+/** Check if a value is encrypted by our PII system. */
+export declare function isPiiEncrypted(value: string): boolean;
+/**
+ * Mask a person's name for public display.
+ * Each word is reduced to its first letter followed by "***".
+ *
+ * "John Doe"  → "J*** D***"
+ * "Alice"     → "A***"
+ *
+ * If the value is still an encrypted blob (e.g. PII_ENCRYPTION_KEY not set),
+ * returns "Anonymous" so encrypted ciphertext never leaks to the UI.
+ */
+export declare function maskName(name: string | null | undefined): string;
+/**
+ * Mask an email address for public display.
+ * "john.doe@example.com" → "j***@***.com"
+ */
+export declare function maskEmail(email: string | null | undefined): string;
+/**
+ * Return a copy of a review document with PII fields masked for public display.
+ * Admin/owner endpoints should NOT call this — use the raw document instead.
+ */
+export declare function maskPublicReview<T extends {
+    userName: string;
+}>(review: T): T;
+/**
+ * Return a copy of a bid document with PII masked for public display
+ * (auction product page).
+ */
+export declare function maskPublicBid<T extends {
+    userName: string;
+}>(bid: T): T;
+/**
+ * Return a copy of an event-entry document with PII masked for the leaderboard.
+ * ipAddress and userEmail are never sent to the client;
+ * only userDisplayName needs masking for a public leaderboard view.
+ */
+export declare function maskPublicEventEntry<T extends {
+    userDisplayName?: string;
+    userEmail?: string;
+    ipAddress?: string;
+}>(entry: T): Omit<T, "userEmail" | "ipAddress">;
+/**
+ * Return a copy of an offer document with buyer PII masked for the seller view.
+ * The seller needs to know an offer was made and its amount, but the buyer's
+ * full name and email should remain private until the order is confirmed.
+ */
+export declare function maskOfferForSeller<T extends {
+    buyerName: string;
+    buyerEmail: string;
+}>(offer: T): T;

package/dist/security/pii-mask.js

@@ -0,0 +1,100 @@
+/**
+ * PII display-masking helpers — pure string manipulation, zero runtime
+ * dependencies. Split out from pii-encrypt.ts so these can be exported
+ * from the universal client+server barrel (index.ts): pii-encrypt.ts has
+ * a top-level `import { createRequire } from "node:module"` (needed for
+ * the AES-256-GCM/HMAC functions to work under both Next.js's bundler and
+ * a pure-ESM standalone script context) that poisons the whole module for
+ * client bundling — Turbopack statically resolves every export in a file
+ * before tree-shaking, so re-exporting even one crypto-free symbol from
+ * pii-encrypt.ts still pulls `node:module` into the client graph and hard
+ * fails the browser build. This file has no such import and is safe
+ * anywhere `ReviewModal`/`ReviewDetailShell`/`ReviewsList` (client
+ * components displaying masked reviewer names) can reach it.
+ */
+export const ENC_PREFIX = "enc:v1:";
+export const HMAC_PREFIX = "hmac-sha256:";
+/** Check if a value is encrypted by our PII system. */
+export function isPiiEncrypted(value) {
+    return typeof value === "string" && value.startsWith(ENC_PREFIX);
+}
+/**
+ * Mask a person's name for public display.
+ * Each word is reduced to its first letter followed by "***".
+ *
+ * "John Doe"  → "J*** D***"
+ * "Alice"     → "A***"
+ *
+ * If the value is still an encrypted blob (e.g. PII_ENCRYPTION_KEY not set),
+ * returns "Anonymous" so encrypted ciphertext never leaks to the UI.
+ */
+export function maskName(name) {
+    if (!name || typeof name !== "string")
+        return "Anonymous";
+    if (isPiiEncrypted(name))
+        return "Anonymous";
+    return name
+        .trim()
+        .split(/\s+/)
+        .filter(Boolean)
+        .map((word) => word[0] + "***")
+        .join(" ");
+}
+/**
+ * Mask an email address for public display.
+ * "john.doe@example.com" → "j***@***.com"
+ */
+export function maskEmail(email) {
+    if (!email || typeof email !== "string")
+        return "***@***.***";
+    if (isPiiEncrypted(email))
+        return "***@***.***";
+    const atIdx = email.indexOf("@");
+    if (atIdx < 0)
+        return "***";
+    const local = email.slice(0, atIdx);
+    const domain = email.slice(atIdx + 1);
+    const dotIdx = domain.lastIndexOf(".");
+    const domainMasked = dotIdx > 0 ? "***" + domain.slice(dotIdx) : "***";
+    return (local[0] ?? "*") + "***@" + domainMasked;
+}
+/**
+ * Return a copy of a review document with PII fields masked for public display.
+ * Admin/owner endpoints should NOT call this — use the raw document instead.
+ */
+export function maskPublicReview(review) {
+    return { ...review, userName: maskName(review.userName) };
+}
+/**
+ * Return a copy of a bid document with PII masked for public display
+ * (auction product page).
+ */
+export function maskPublicBid(bid) {
+    return { ...bid };
+}
+/**
+ * Return a copy of an event-entry document with PII masked for the leaderboard.
+ * ipAddress and userEmail are never sent to the client;
+ * only userDisplayName needs masking for a public leaderboard view.
+ */
+export function maskPublicEventEntry(entry) {
+    const { userEmail: _e, ipAddress: _ip, ...rest } = entry;
+    return {
+        ...rest,
+        ...(rest.userDisplayName !== undefined
+            ? { userDisplayName: maskName(rest.userDisplayName) }
+            : {}),
+    };
+}
+/**
+ * Return a copy of an offer document with buyer PII masked for the seller view.
+ * The seller needs to know an offer was made and its amount, but the buyer's
+ * full name and email should remain private until the order is confirmed.
+ */
+export function maskOfferForSeller(offer) {
+    return {
+        ...offer,
+        buyerName: maskName(offer.buyerName),
+        buyerEmail: maskEmail(offer.buyerEmail),
+    };
+}

package/dist/server.d.ts

@@ -454,6 +454,32 @@ export { applyRateLimit } from "./security/index";
 export { rateLimitByIdentifier } from "./security/index";
 export { RateLimitPresets } from "./security/index";
 export { maskPublicEventEntry } from "./security/index";
+export { encryptValue } from "./security/index";
+export { decryptValue } from "./security/index";
+export { hmacBlindIndex } from "./security/index";
+export { encryptPiiFields } from "./security/index";
+export { decryptPiiFields } from "./security/index";
+export { encryptPii } from "./security/index";
+export { decryptPii } from "./security/index";
+export { isPiiEncrypted } from "./security/index";
+export { piiBlindIndex } from "./security/index";
+export { addPiiIndices } from "./security/index";
+export { getPiiConfigError } from "./security/index";
+export { encryptShippingAddress } from "./security/index";
+export { decryptShippingAddress } from "./security/index";
+export { encryptPayoutDetails } from "./security/index";
+export { decryptPayoutDetails } from "./security/index";
+export { encryptShippingConfig } from "./security/index";
+export { decryptShippingConfig } from "./security/index";
+export { encryptPayoutBankAccount } from "./security/index";
+export { decryptPayoutBankAccount } from "./security/index";
+export { maskName } from "./security/index";
+export { maskEmail } from "./security/index";
+export { maskPublicReview } from "./security/index";
+export { maskPublicBid } from "./security/index";
+export { maskOfferForSeller } from "./security/index";
+export { ENC_PREFIX } from "./security/index";
+export { HMAC_PREFIX } from "./security/index";
 export { createInstrumentation } from "./instrumentation/index";
 export { SEO_CONFIG } from "./seo/index";
 export { createSeoConfig } from "./seo/index";

package/dist/server.js

@@ -1312,6 +1312,33 @@ export { rateLimitByIdentifier } from "./security/index";
 export { RateLimitPresets } from "./security/index";
 // maskPublicEventEntry - Redact PII from event entries before public exposure.
 export { maskPublicEventEntry } from "./security/index";
+// PII encryption/masking (server-only -- crypto module via node:module, must never leak into a client bundle; see appkit Export Rules in CLAUDE.md)
+export { encryptValue } from "./security/index";
+export { decryptValue } from "./security/index";
+export { hmacBlindIndex } from "./security/index";
+export { encryptPiiFields } from "./security/index";
+export { decryptPiiFields } from "./security/index";
+export { encryptPii } from "./security/index";
+export { decryptPii } from "./security/index";
+export { isPiiEncrypted } from "./security/index";
+export { piiBlindIndex } from "./security/index";
+export { addPiiIndices } from "./security/index";
+export { getPiiConfigError } from "./security/index";
+export { encryptShippingAddress } from "./security/index";
+export { decryptShippingAddress } from "./security/index";
+export { encryptPayoutDetails } from "./security/index";
+export { decryptPayoutDetails } from "./security/index";
+export { encryptShippingConfig } from "./security/index";
+export { decryptShippingConfig } from "./security/index";
+export { encryptPayoutBankAccount } from "./security/index";
+export { decryptPayoutBankAccount } from "./security/index";
+export { maskName } from "./security/index";
+export { maskEmail } from "./security/index";
+export { maskPublicReview } from "./security/index";
+export { maskPublicBid } from "./security/index";
+export { maskOfferForSeller } from "./security/index";
+export { ENC_PREFIX } from "./security/index";
+export { HMAC_PREFIX } from "./security/index";
 // -- Instrumentation ---------------------------------------------------------
 // createInstrumentation - Factory for Next.js instrumentation hooks.
 export { createInstrumentation } from "./instrumentation/index";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "3.8.0",
+  "version": "3.8.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"

package/scripts/seed-cli.mjs

@@ -117,6 +117,15 @@ if (ACTION === "load" && !PII_KEY_PRESENT) {
 // firebase-admin init
 // ---------------------------------------------------------------------------
 const require = createRequire(import.meta.url);
+// appkit's pii-encrypt.ts calls a bare `require("crypto")` at runtime (not a
+// static import — deliberately, so bundlers like Turbopack never see a
+// node:module dependency and refuse to build the client bundle). A bare
+// `require` identifier resolves via the global scope in Node ESM, so it must
+// exist as a global before the dynamic `import("@mohasinac/appkit")` below
+// ever triggers that code path. Only this standalone-script environment
+// needs it — Next.js's own server bundle (webpack/Turbopack) provides an
+// ambient `require` automatically.
+globalThis.require = require;
 const admin = require("firebase-admin");
 
 function parsePrivateKey(raw) {