@mohasinac/appkit 3.8.1 → 3.8.2

package/dist/index.d.ts

@@ -479,6 +479,7 @@ export { maskSecret } from "./security/index";
 export { rateLimit } from "./security/index";
 export { rateLimitByIdentifier } from "./security/index";
 export { redactPii, safeDisplayName, safeDisplayEmail } from "./security/index";
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./security/index";
 export { requireActiveAccount } from "./security/index";
 export { requireAuth } from "./security/index";
 export { requireEmailVerified } from "./security/index";

package/dist/index.js

@@ -885,6 +885,8 @@ export { rateLimitByIdentifier } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // redactPii - Shared export for redact pii.
 export { redactPii, safeDisplayName, safeDisplayEmail } from "./security/index";
+// [CLIENT-SSR]-Runs in both SSR and browser â€" pure display-masking helpers, no crypto dependency.
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // requireActiveAccount - Shared export for require active account.
 export { requireActiveAccount } from "./security/index";

package/dist/security/index.d.ts

@@ -4,7 +4,8 @@ export type { RateLimitConfig, RateLimitResult } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export type { UserRole } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, isPiiEncrypted, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
 export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";
 export type { Permission, RoleDefinition, RbacConfig, ResolvedUser, RbacHookReturn, } from "./rbac";

package/dist/security/index.js

@@ -2,7 +2,11 @@ export { generateNonce, buildCSP } from "./csp";
 export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, clearRateLimitStore, } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, isPiiEncrypted, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+// Crypto-free display-masking helpers -- sourced from pii-mask.ts (not
+// pii-encrypt.ts) so this barrel stays safe to re-export from the
+// universal client+server index.ts. See pii-mask.ts's header comment.
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
 export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";
 export { DEFAULT_ROLES, resolvePermissions, hasPermission, hasAllPermissions, hasAnyPermission, createRbacHook, Can, createRequirePermission, createRequirePermissionSync, createRbacMiddleware, } from "./rbac";

package/dist/security/pii-encrypt.d.ts

@@ -9,8 +9,8 @@
  * Ciphertext format: "enc:v1:<iv_b64>:<ciphertext_b64>:<authtag_b64>"
  * Blind index format: "hmac-sha256:<sha256_hex>"
  */
-export declare const ENC_PREFIX = "enc:v1:";
-export declare const HMAC_PREFIX = "hmac-sha256:";
+import { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted } from "./pii-mask";
+export { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted };
 export declare function getPiiConfigError(): string | null;
 /** Encrypt a plaintext string with AES-256-GCM. */
 export declare function encryptValue(plaintext: string): string;
@@ -36,8 +36,6 @@ export declare function decryptPiiFields<T extends object>(doc: T, piiFields: st
 export declare function encryptPii(plaintext: string | null | undefined): string | null | undefined;
 /** Alias for decryptValue — decrypts a PII ciphertext. */
 export declare function decryptPii(ciphertext: string | null | undefined): string | null | undefined;
-/** Check if a value is encrypted by our PII system. */
-export declare function isPiiEncrypted(value: string): boolean;
 /** Alias for hmacBlindIndex. */
 export declare function piiBlindIndex(plaintext: string): string;
 /**
@@ -80,52 +78,3 @@ export declare function encryptPayoutBankAccount<T extends object>(bank: T | und
  * Decrypt PII on a payout bankAccount sub-object from the payouts collection.
  */
 export declare function decryptPayoutBankAccount<T extends object>(bank: T | undefined | null): T | undefined | null;
-/**
- * Mask a person's name for public display.
- * Each word is reduced to its first letter followed by "***".
- *
- * "John Doe"  → "J*** D***"
- * "Alice"     → "A***"
- *
- * If the value is still an encrypted blob (e.g. PII_ENCRYPTION_KEY not set),
- * returns "Anonymous" so encrypted ciphertext never leaks to the UI.
- */
-export declare function maskName(name: string | null | undefined): string;
-/**
- * Mask an email address for public display.
- * "john.doe@example.com" → "j***@***.com"
- */
-export declare function maskEmail(email: string | null | undefined): string;
-/**
- * Return a copy of a review document with PII fields masked for public display.
- * Admin/owner endpoints should NOT call this — use the raw document instead.
- */
-export declare function maskPublicReview<T extends {
-    userName: string;
-}>(review: T): T;
-/**
- * Return a copy of a bid document with PII masked for public display
- * (auction product page).
- */
-export declare function maskPublicBid<T extends {
-    userName: string;
-}>(bid: T): T;
-/**
- * Return a copy of an event-entry document with PII masked for the leaderboard.
- * ipAddress and userEmail are never sent to the client;
- * only userDisplayName needs masking for a public leaderboard view.
- */
-export declare function maskPublicEventEntry<T extends {
-    userDisplayName?: string;
-    userEmail?: string;
-    ipAddress?: string;
-}>(entry: T): Omit<T, "userEmail" | "ipAddress">;
-/**
- * Return a copy of an offer document with buyer PII masked for the seller view.
- * The seller needs to know an offer was made and its amount, but the buyer's
- * full name and email should remain private until the order is confirmed.
- */
-export declare function maskOfferForSeller<T extends {
-    buyerName: string;
-    buyerEmail: string;
-}>(offer: T): T;

package/dist/security/pii-encrypt.js

@@ -9,22 +9,26 @@
  * Ciphertext format: "enc:v1:<iv_b64>:<ciphertext_b64>:<authtag_b64>"
  * Blind index format: "hmac-sha256:<sha256_hex>"
  */
-import { createRequire } from "node:module";
-// crypto is a Node.js built-in. Use require() to keep it out of the static
-// import graph so Next.js Edge bundler does not warn about this file. A bare
-// top-level `require(...)` call only works when the compiled dist output is
-// loaded via CommonJS (or a bundler that polyfills `require`) — under a
-// plain Node ESM `import()` (e.g. appkit/scripts/seed-cli.mjs and any other
-// standalone script importing @mohasinac/appkit directly), there is no
-// ambient `require` global, so that call threw `ReferenceError: require is
-// not defined`. createRequire(import.meta.url) works in both: it's still a
-// runtime function call a bundler's static analysis won't follow into the
-// client graph, but it resolves correctly under Node's own ESM loader too.
-const nodeRequire = createRequire(import.meta.url);
-function nodeCrypto() { return nodeRequire("crypto"); }
+import { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted } from "./pii-mask";
+// Re-exported for backward-compat with existing direct imports of these
+// symbols from this file — the actual crypto-free definitions live in
+// pii-mask.ts (see that file's header comment for why the split exists).
+export { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted };
+// crypto is a Node.js built-in. A bare, non-static `require(...)` call
+// (never a top-level `import ... from "node:module"`/"crypto") is
+// deliberate: bundlers targeting the browser (Turbopack in particular)
+// statically resolve every top-level import in a module's chain before any
+// tree-shaking pass, and hard-fail immediately on an unresolvable Node
+// builtin even if the symbol using it is never actually consumed
+// client-side. A bare `require` reference inside a function body is a
+// runtime lookup, not a static import, so it's invisible to that pass.
+// This only works where an ambient `require` global exists: Next.js's own
+// server bundle (webpack/Turbopack) provides one automatically; the one
+// place that doesn't is a standalone pure-ESM script importing
+// @mohasinac/appkit directly (appkit/scripts/seed-cli.mjs), which sets
+// `globalThis.require` itself before importing appkit — see that file.
+function nodeCrypto() { return require("crypto"); }
 const ALGO = "aes-256-gcm";
-export const ENC_PREFIX = "enc:v1:";
-export const HMAC_PREFIX = "hmac-sha256:";
 function normalizePiiSecretValue(raw) {
     return (raw ?? "").replace(/(?:\\r|\\n|\r|\n)+$/g, "").trim();
 }
@@ -139,10 +143,6 @@ export function decryptPii(ciphertext) {
         return ciphertext;
     return decryptValue(ciphertext);
 }
-/** Check if a value is encrypted by our PII system. */
-export function isPiiEncrypted(value) {
-    return typeof value === "string" && value.startsWith(ENC_PREFIX);
-}
 /** Alias for hmacBlindIndex. */
 export function piiBlindIndex(plaintext) {
     return hmacBlindIndex(plaintext);
@@ -278,84 +278,3 @@ export function decryptPayoutBankAccount(bank) {
         return bank;
     return decryptPiiFields({ ...bank }, []);
 }
-// --- Public display masking -------------------------------------------------
-/**
- * Mask a person's name for public display.
- * Each word is reduced to its first letter followed by "***".
- *
- * "John Doe"  → "J*** D***"
- * "Alice"     → "A***"
- *
- * If the value is still an encrypted blob (e.g. PII_ENCRYPTION_KEY not set),
- * returns "Anonymous" so encrypted ciphertext never leaks to the UI.
- */
-export function maskName(name) {
-    if (!name || typeof name !== "string")
-        return "Anonymous";
-    if (isPiiEncrypted(name))
-        return "Anonymous";
-    return name
-        .trim()
-        .split(/\s+/)
-        .filter(Boolean)
-        .map((word) => word[0] + "***")
-        .join(" ");
-}
-/**
- * Mask an email address for public display.
- * "john.doe@example.com" → "j***@***.com"
- */
-export function maskEmail(email) {
-    if (!email || typeof email !== "string")
-        return "***@***.***";
-    if (isPiiEncrypted(email))
-        return "***@***.***";
-    const atIdx = email.indexOf("@");
-    if (atIdx < 0)
-        return "***";
-    const local = email.slice(0, atIdx);
-    const domain = email.slice(atIdx + 1);
-    const dotIdx = domain.lastIndexOf(".");
-    const domainMasked = dotIdx > 0 ? "***" + domain.slice(dotIdx) : "***";
-    return (local[0] ?? "*") + "***@" + domainMasked;
-}
-/**
- * Return a copy of a review document with PII fields masked for public display.
- * Admin/owner endpoints should NOT call this — use the raw document instead.
- */
-export function maskPublicReview(review) {
-    return { ...review, userName: maskName(review.userName) };
-}
-/**
- * Return a copy of a bid document with PII masked for public display
- * (auction product page).
- */
-export function maskPublicBid(bid) {
-    return { ...bid };
-}
-/**
- * Return a copy of an event-entry document with PII masked for the leaderboard.
- * ipAddress and userEmail are never sent to the client;
- * only userDisplayName needs masking for a public leaderboard view.
- */
-export function maskPublicEventEntry(entry) {
-    const { userEmail: _e, ipAddress: _ip, ...rest } = entry;
-    return {
-        ...rest,
-        ...(rest.userDisplayName !== undefined
-            ? { userDisplayName: maskName(rest.userDisplayName) }
-            : {}),
-    };
-}
-/**
- * Return a copy of an offer document with buyer PII masked for the seller view.
- * The seller needs to know an offer was made and its amount, but the buyer's
- * full name and email should remain private until the order is confirmed.
- */
-export function maskOfferForSeller(offer) {
-    return {
-        ...offer,
-        buyerName: maskName(offer.buyerName),
-        buyerEmail: maskEmail(offer.buyerEmail),
-    };
-}

package/dist/security/pii-mask.d.ts

@@ -0,0 +1,67 @@
+/**
+ * PII display-masking helpers — pure string manipulation, zero runtime
+ * dependencies. Split out from pii-encrypt.ts so these can be exported
+ * from the universal client+server barrel (index.ts): pii-encrypt.ts has
+ * a top-level `import { createRequire } from "node:module"` (needed for
+ * the AES-256-GCM/HMAC functions to work under both Next.js's bundler and
+ * a pure-ESM standalone script context) that poisons the whole module for
+ * client bundling — Turbopack statically resolves every export in a file
+ * before tree-shaking, so re-exporting even one crypto-free symbol from
+ * pii-encrypt.ts still pulls `node:module` into the client graph and hard
+ * fails the browser build. This file has no such import and is safe
+ * anywhere `ReviewModal`/`ReviewDetailShell`/`ReviewsList` (client
+ * components displaying masked reviewer names) can reach it.
+ */
+export declare const ENC_PREFIX = "enc:v1:";
+export declare const HMAC_PREFIX = "hmac-sha256:";
+/** Check if a value is encrypted by our PII system. */
+export declare function isPiiEncrypted(value: string): boolean;
+/**
+ * Mask a person's name for public display.
+ * Each word is reduced to its first letter followed by "***".
+ *
+ * "John Doe"  → "J*** D***"
+ * "Alice"     → "A***"
+ *
+ * If the value is still an encrypted blob (e.g. PII_ENCRYPTION_KEY not set),
+ * returns "Anonymous" so encrypted ciphertext never leaks to the UI.
+ */
+export declare function maskName(name: string | null | undefined): string;
+/**
+ * Mask an email address for public display.
+ * "john.doe@example.com" → "j***@***.com"
+ */
+export declare function maskEmail(email: string | null | undefined): string;
+/**
+ * Return a copy of a review document with PII fields masked for public display.
+ * Admin/owner endpoints should NOT call this — use the raw document instead.
+ */
+export declare function maskPublicReview<T extends {
+    userName: string;
+}>(review: T): T;
+/**
+ * Return a copy of a bid document with PII masked for public display
+ * (auction product page).
+ */
+export declare function maskPublicBid<T extends {
+    userName: string;
+}>(bid: T): T;
+/**
+ * Return a copy of an event-entry document with PII masked for the leaderboard.
+ * ipAddress and userEmail are never sent to the client;
+ * only userDisplayName needs masking for a public leaderboard view.
+ */
+export declare function maskPublicEventEntry<T extends {
+    userDisplayName?: string;
+    userEmail?: string;
+    ipAddress?: string;
+}>(entry: T): Omit<T, "userEmail" | "ipAddress">;
+/**
+ * Return a copy of an offer document with buyer PII masked for the seller view.
+ * The seller needs to know an offer was made and its amount, but the buyer's
+ * full name and email should remain private until the order is confirmed.
+ */
+export declare function maskOfferForSeller<T extends {
+    buyerName: string;
+    buyerEmail: string;
+}>(offer: T): T;

package/dist/security/pii-mask.js

@@ -0,0 +1,100 @@
+/**
+ * PII display-masking helpers — pure string manipulation, zero runtime
+ * dependencies. Split out from pii-encrypt.ts so these can be exported
+ * from the universal client+server barrel (index.ts): pii-encrypt.ts has
+ * a top-level `import { createRequire } from "node:module"` (needed for
+ * the AES-256-GCM/HMAC functions to work under both Next.js's bundler and
+ * a pure-ESM standalone script context) that poisons the whole module for
+ * client bundling — Turbopack statically resolves every export in a file
+ * before tree-shaking, so re-exporting even one crypto-free symbol from
+ * pii-encrypt.ts still pulls `node:module` into the client graph and hard
+ * fails the browser build. This file has no such import and is safe
+ * anywhere `ReviewModal`/`ReviewDetailShell`/`ReviewsList` (client
+ * components displaying masked reviewer names) can reach it.
+ */
+export const ENC_PREFIX = "enc:v1:";
+export const HMAC_PREFIX = "hmac-sha256:";
+/** Check if a value is encrypted by our PII system. */
+export function isPiiEncrypted(value) {
+    return typeof value === "string" && value.startsWith(ENC_PREFIX);
+}
+/**
+ * Mask a person's name for public display.
+ * Each word is reduced to its first letter followed by "***".
+ *
+ * "John Doe"  → "J*** D***"
+ * "Alice"     → "A***"
+ *
+ * If the value is still an encrypted blob (e.g. PII_ENCRYPTION_KEY not set),
+ * returns "Anonymous" so encrypted ciphertext never leaks to the UI.
+ */
+export function maskName(name) {
+    if (!name || typeof name !== "string")
+        return "Anonymous";
+    if (isPiiEncrypted(name))
+        return "Anonymous";
+    return name
+        .trim()
+        .split(/\s+/)
+        .filter(Boolean)
+        .map((word) => word[0] + "***")
+        .join(" ");
+}
+/**
+ * Mask an email address for public display.
+ * "john.doe@example.com" → "j***@***.com"
+ */
+export function maskEmail(email) {
+    if (!email || typeof email !== "string")
+        return "***@***.***";
+    if (isPiiEncrypted(email))
+        return "***@***.***";
+    const atIdx = email.indexOf("@");
+    if (atIdx < 0)
+        return "***";
+    const local = email.slice(0, atIdx);
+    const domain = email.slice(atIdx + 1);
+    const dotIdx = domain.lastIndexOf(".");
+    const domainMasked = dotIdx > 0 ? "***" + domain.slice(dotIdx) : "***";
+    return (local[0] ?? "*") + "***@" + domainMasked;
+}
+/**
+ * Return a copy of a review document with PII fields masked for public display.
+ * Admin/owner endpoints should NOT call this — use the raw document instead.
+ */
+export function maskPublicReview(review) {
+    return { ...review, userName: maskName(review.userName) };
+}
+/**
+ * Return a copy of a bid document with PII masked for public display
+ * (auction product page).
+ */
+export function maskPublicBid(bid) {
+    return { ...bid };
+}
+/**
+ * Return a copy of an event-entry document with PII masked for the leaderboard.
+ * ipAddress and userEmail are never sent to the client;
+ * only userDisplayName needs masking for a public leaderboard view.
+ */
+export function maskPublicEventEntry(entry) {
+    const { userEmail: _e, ipAddress: _ip, ...rest } = entry;
+    return {
+        ...rest,
+        ...(rest.userDisplayName !== undefined
+            ? { userDisplayName: maskName(rest.userDisplayName) }
+            : {}),
+    };
+}
+/**
+ * Return a copy of an offer document with buyer PII masked for the seller view.
+ * The seller needs to know an offer was made and its amount, but the buyer's
+ * full name and email should remain private until the order is confirmed.
+ */
+export function maskOfferForSeller(offer) {
+    return {
+        ...offer,
+        buyerName: maskName(offer.buyerName),
+        buyerEmail: maskEmail(offer.buyerEmail),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "3.8.1",
+  "version": "3.8.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"

package/scripts/seed-cli.mjs

@@ -117,6 +117,15 @@ if (ACTION === "load" && !PII_KEY_PRESENT) {
 // firebase-admin init
 // ---------------------------------------------------------------------------
 const require = createRequire(import.meta.url);
+// appkit's pii-encrypt.ts calls a bare `require("crypto")` at runtime (not a
+// static import — deliberately, so bundlers like Turbopack never see a
+// node:module dependency and refuse to build the client bundle). A bare
+// `require` identifier resolves via the global scope in Node ESM, so it must
+// exist as a global before the dynamic `import("@mohasinac/appkit")` below
+// ever triggers that code path. Only this standalone-script environment
+// needs it — Next.js's own server bundle (webpack/Turbopack) provides an
+// ambient `require` automatically.
+globalThis.require = require;
 const admin = require("firebase-admin");
 
 function parsePrivateKey(raw) {