@algolia/wizard 0.115.0 → 0.117.0

package/dist/main.js

@@ -1245,7 +1245,7 @@ function SelectPrompt({
   helpText,
   messages,
   table,
-  list,
+  list: list2,
   error,
   multi,
   cancelable,
@@ -1334,7 +1334,7 @@ function SelectPrompt({
       error && /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: error }),
       messages?.map((m, i) => /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: m }, `msg-${i}`)),
       table && /* @__PURE__ */ jsx8(Table, { columns: table.columns, rows: table.rows }),
-      list && list.length > 0 && /* @__PURE__ */ jsx8(Box9, { flexDirection: "column", children: list.map((item, i) => /* @__PURE__ */ jsxs9(Text10, { children: [
+      list2 && list2.length > 0 && /* @__PURE__ */ jsx8(Box9, { flexDirection: "column", children: list2.map((item, i) => /* @__PURE__ */ jsxs9(Text10, { children: [
         /* @__PURE__ */ jsx8(
           Text10,
           {
@@ -1566,7 +1566,7 @@ function PromptInput() {
 }
 
 // src/workflows/default.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 
 // src/core/orchestrator.ts
 import "zod";
@@ -2504,7 +2504,7 @@ async function ensureApplication(resumeAppId) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.115.0",
+  version: "0.117.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {
@@ -6421,9 +6421,9 @@ Output:
 ${JSON.stringify(s.output, null, 2)}`
   ).join("\n\n");
 }
-async function runReviewAgent(request) {
+async function runReviewAgent(request2) {
   try {
-    return await runAgent(request);
+    return await runAgent(request2);
   } catch (err) {
     if (!(err instanceof AgentReportedFailureError)) throw err;
     const parsed = reviewSchema.safeParse(err.output);
@@ -6461,7 +6461,7 @@ ${formatCompletedSteps(ctx.completedSteps)}`,
 };
 
 // src/actions/implement.ts
-import z29 from "zod";
+import z30 from "zod";
 import { access, mkdir as mkdir5, readdir as readdir3, readFile as readFile10 } from "node:fs/promises";
 import {
   basename as basename6,
@@ -6564,6 +6564,271 @@ function copyToClipboard(text, stream = process.stdout) {
   stream.write(`\x1B]52;c;${encoded}\x07`);
 }
 
+// src/lib/publicSearchSettings.ts
+var SETTINGS_TIMEOUT_MS = 15e3;
+var WRAPPER = /^(unordered|searchable|filterOnly|afterDistinct)\((.*)\)$/;
+function attributeKey(value) {
+  return attributeKeys(value)[0] ?? "";
+}
+function attributeKeys(value) {
+  const wrapped = WRAPPER.exec(value.trim());
+  const inner = (wrapped?.[2] ?? value).trim();
+  return inner.split(",").map((part) => part.trim().split(":")[0]?.trim()).filter((part) => Boolean(part));
+}
+function settingsThatHideAttributes(current, hide, searchableFallback) {
+  if (hide.length === 0) return null;
+  const hidden = unique(hide);
+  const safeSearchableFallback = filterSettingsValues(
+    searchableFallback,
+    hidden
+  );
+  const drop = (value) => hasHiddenAttribute(value, hidden);
+  const patch = {
+    unretrievableAttributes: unique([
+      ...(current.unretrievableAttributes ?? []).filter((value) => !drop(value)),
+      ...hide
+    ])
+  };
+  const currentSearchable = list(current.searchableAttributes);
+  const filteredCurrent = currentSearchable ? filterSettingsValues(currentSearchable, hidden) : void 0;
+  patch.searchableAttributes = filteredCurrent && filteredCurrent.length > 0 ? filteredCurrent : safeSearchableFallback;
+  if (patch.searchableAttributes.length === 0) {
+    throw new Error(
+      `Cannot make public search safe: no searchable attributes remain after hiding ${hidden.join(", ")}.`
+    );
+  }
+  const facets = list(current.attributesForFaceting);
+  if (facets) patch.attributesForFaceting = filterSettingsValues(facets, hidden);
+  const highlight = list(current.attributesToHighlight);
+  if (highlight) {
+    patch.attributesToHighlight = filterSettingsValues(highlight, hidden);
+  }
+  const snippet = list(current.attributesToSnippet);
+  if (snippet) {
+    patch.attributesToSnippet = filterSettingsValues(snippet, hidden);
+  }
+  return patch;
+}
+async function hideAttributesFromPublicSearch(args) {
+  const patch = settingsThatHideAttributes(
+    await readSettings(args),
+    args.hide,
+    args.searchableFallback
+  );
+  if (!patch) return;
+  await writeSettings(args, patch);
+}
+async function readSettings(args) {
+  const response = await request(args, "GET");
+  if (response.status === 404 && args.createIfMissing) return {};
+  assertOk(response, args.apiKey);
+  const body = await response.json();
+  if (!body || typeof body !== "object") return {};
+  const record = body;
+  return {
+    searchableAttributes: record.searchableAttributes,
+    attributesForFaceting: record.attributesForFaceting,
+    unretrievableAttributes: record.unretrievableAttributes,
+    attributesToHighlight: record.attributesToHighlight,
+    attributesToSnippet: record.attributesToSnippet
+  };
+}
+async function writeSettings(args, patch) {
+  const response = await request(args, "PUT", patch);
+  assertOk(response, args.apiKey);
+}
+async function request(args, method, body) {
+  const fetchImpl = args.fetch ?? fetch;
+  try {
+    return await fetchImpl(settingsUrl(args.appId, args.indexName), {
+      method,
+      headers: {
+        "X-Algolia-Application-Id": args.appId,
+        "X-Algolia-API-Key": args.apiKey,
+        "Content-Type": "application/json"
+      },
+      ...body ? { body: JSON.stringify(body) } : {},
+      signal: AbortSignal.timeout(SETTINGS_TIMEOUT_MS)
+    });
+  } catch (err) {
+    throw settingsError(err.message, args.apiKey);
+  }
+}
+function assertOk(response, apiKey) {
+  if (!response.ok) throw settingsError(String(response.status), apiKey);
+}
+function settingsError(detail, apiKey) {
+  return new Error(
+    `Algolia index settings request failed (${detail.replaceAll(apiKey, "***")})`
+  );
+}
+function settingsUrl(appId, indexName) {
+  return `https://${appId}.algolia.net/1/indexes/${encodeURIComponent(indexName)}/settings`;
+}
+function list(value) {
+  if (!value || value.length === 0) return void 0;
+  return value;
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+function filterSettingsValues(values, hidden) {
+  return values.map((value) => filterSettingsValue(value, hidden)).filter((value) => value !== void 0);
+}
+function filterSettingsValue(value, hidden) {
+  const trimmed = value.trim();
+  const wrapped = WRAPPER.exec(trimmed);
+  const wrapper = wrapped?.[1];
+  const inner = (wrapped?.[2] ?? trimmed).trim();
+  const parts = inner.split(",").map((part) => part.trim()).filter(Boolean);
+  const kept = parts.filter(
+    (part) => !attributeIsHidden(attributeKey(part), hidden)
+  );
+  if (kept.length === 0) return void 0;
+  if (kept.length === parts.length) return value;
+  return wrapper ? `${wrapper}(${kept.join(",")})` : kept.join(",");
+}
+function hasHiddenAttribute(value, hidden) {
+  return attributeKeys(value).some((key) => attributeIsHidden(key, hidden));
+}
+function attributeIsHidden(key, hidden) {
+  return hidden.some(
+    (hiddenKey) => key === hiddenKey || key.startsWith(`${hiddenKey}.`) || hiddenKey.startsWith(`${key}.`)
+  );
+}
+
+// src/lib/sensitiveAttributes.ts
+import { z as z29 } from "zod";
+var TOKEN_SPLIT = /[^a-z0-9]+/;
+var recordExposureSchema = z29.object({
+  omittedAttributes: z29.array(z29.string()),
+  hiddenAttributes: z29.array(z29.string()),
+  publicSearchSafe: z29.boolean()
+});
+function publicSearchKeyIsSafe(exposure) {
+  return exposure?.publicSearchSafe === true;
+}
+function classifyAttributes(names) {
+  const blocked = [];
+  const personal = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    if (seen.has(name)) continue;
+    seen.add(name);
+    const kind = classifyAttribute(name);
+    if (kind === "blocked") blocked.push(name);
+    else if (kind === "personal") personal.push(name);
+  }
+  return { blocked, personal };
+}
+function withheldAttributes(exposure) {
+  if (!exposure) return [];
+  return [
+    .../* @__PURE__ */ new Set([...exposure.omittedAttributes, ...exposure.hiddenAttributes])
+  ];
+}
+function visibleAttributes(attributes, exposure) {
+  if (!exposure) return [...attributes];
+  const drop = new Set(withheldAttributes(exposure));
+  return attributes.filter((name) => !drop.has(name));
+}
+function ingestionExposureInstructions(exposure) {
+  if (!exposure) return [];
+  const lines = [];
+  if (exposure.omittedAttributes.length > 0) {
+    lines.push(
+      `Do not write these attributes into records, sample data, or index settings: ${exposure.omittedAttributes.join(", ")}. Omit them even if the source has them.`
+    );
+  }
+  if (exposure.hiddenAttributes.length > 0) {
+    lines.push(
+      `The user chose to index these personal attributes: ${exposure.hiddenAttributes.join(", ")}. Write them on the records, but do not add them to searchableAttributes, attributesForFaceting, attributesToHighlight, or attributesToSnippet. Wizard applies the public-search settings that hide them from browser search.`
+    );
+  }
+  return lines;
+}
+function searchExposureInstructions(exposure) {
+  const withheld = withheldAttributes(exposure);
+  if (!exposure || withheld.length === 0) return [];
+  const lines = [
+    `Do not display, highlight, snippet, filter, or facet these attributes, even if a source file mentions them: ${withheld.join(", ")}.`
+  ];
+  if (exposure.hiddenAttributes.length > 0) {
+    const names = exposure.hiddenAttributes.join(", ");
+    lines.push(
+      exposure.publicSearchSafe ? `These personal attributes may be stored on records, but a public hit does not include them: ${names}.` : `These personal attributes may be stored on records, and Wizard could not confirm that public search hides them: ${names}. Do not edit the ingestion script, the records, or the index settings to change that; it is outside the search step.`
+    );
+  }
+  return lines;
+}
+function classifyAttribute(name) {
+  const tokens = attributeTokens(name);
+  if (tokens.length === 0) return null;
+  if (isBlocked(tokens)) return "blocked";
+  if (isPersonal(tokens)) return "personal";
+  return null;
+}
+function attributeTokens(name) {
+  const spaced = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase();
+  return spaced.split(TOKEN_SPLIT).filter(Boolean);
+}
+function has(tokens, ...options) {
+  return options.some((option) => tokens.includes(option));
+}
+function hasAll(tokens, ...need) {
+  return need.every((token) => tokens.includes(token));
+}
+function isBlocked(tokens) {
+  if (has(tokens, "ssn", "itin", "cvv", "cvc", "passport")) return true;
+  if (has(tokens, "password", "secret", "token", "iban")) return true;
+  if (has(tokens, "api", "private") && has(tokens, "key", "keys")) return true;
+  if (hasAll(tokens, "account", "number")) return true;
+  if (hasAll(tokens, "social", "security")) return true;
+  if (hasAll(tokens, "social", "insurance")) return true;
+  if (tokens.length === 1 && tokens[0] === "sin") return true;
+  if (hasAll(tokens, "sin", "number")) return true;
+  if (hasAll(tokens, "national", "id") || hasAll(tokens, "government", "id")) {
+    return true;
+  }
+  if (has(tokens, "driver", "drivers", "driving") && has(tokens, "license", "licence")) {
+    return true;
+  }
+  if (hasAll(tokens, "tax", "id") || hasAll(tokens, "taxpayer", "id")) {
+    return true;
+  }
+  if (has(tokens, "tin") && (tokens.length === 1 || has(tokens, "number", "tax"))) {
+    return true;
+  }
+  if (hasAll(tokens, "credit", "card") || hasAll(tokens, "card", "number")) {
+    return true;
+  }
+  return false;
+}
+function isPersonal(tokens) {
+  if (has(tokens, "email", "emails")) return true;
+  if (hasAll(tokens, "e", "mail")) return true;
+  if (has(tokens, "phone", "phones", "telephone", "tel")) return true;
+  if (hasAll(tokens, "mobile", "phone") || hasAll(tokens, "mobile", "number")) {
+    return true;
+  }
+  if (has(tokens, "stripe") && !has(tokens, "price", "product", "plan", "sku")) {
+    return true;
+  }
+  if (["address", "addresses"].includes(tokens.at(-1) ?? "") || tokens.length === 1 && tokens[0] === "zip" || has(tokens, "street", "postcode", "zipcode") || hasAll(tokens, "address", "line") || hasAll(tokens, "address", "city") || hasAll(tokens, "address", "postal")) {
+    return true;
+  }
+  if (hasAll(tokens, "postal", "code") || hasAll(tokens, "zip", "code")) {
+    return true;
+  }
+  if (has(tokens, "dob", "birthday", "birthdate")) return true;
+  if (hasAll(tokens, "birth", "date")) return true;
+  if (has(tokens, "ip", "ipaddress")) return true;
+  if (has(tokens, "lat", "lng", "latitude", "longitude") || hasAll(tokens, "geo", "point")) {
+    return true;
+  }
+  return false;
+}
+
 // src/lib/algoliaDocs.ts
 import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { dirname as dirname4, join as join10 } from "node:path";
@@ -6623,51 +6888,52 @@ function getFrameworkSpecificDoc(frameworks) {
 }
 
 // src/actions/implement.ts
-var implementSchema = z29.object({
-  summary: z29.string(),
-  ingestCommand: z29.string().optional(),
-  ingestScriptRan: z29.boolean().optional(),
-  ingestRecordCount: z29.number().optional(),
-  ingestDurationMs: z29.number().optional(),
-  ingestionSource: z29.enum(["local", "fileUpload", "generated"]),
-  searchConfig: z29.object({
-    filePath: z29.string().optional(),
-    vars: z29.array(
-      z29.object({
-        name: z29.string(),
-        value: z29.string()
+var implementSchema = z30.object({
+  summary: z30.string(),
+  ingestCommand: z30.string().optional(),
+  ingestScriptRan: z30.boolean().optional(),
+  ingestRecordCount: z30.number().optional(),
+  ingestDurationMs: z30.number().optional(),
+  ingestionSource: z30.enum(["local", "fileUpload", "generated"]),
+  recordExposure: recordExposureSchema.optional(),
+  searchConfig: z30.object({
+    filePath: z30.string().optional(),
+    vars: z30.array(
+      z30.object({
+        name: z30.string(),
+        value: z30.string()
       })
     )
   }).optional(),
-  uiReport: z29.object({
-    files: z29.array(
-      z29.object({
-        label: z29.string(),
-        path: z29.string()
+  uiReport: z30.object({
+    files: z30.array(
+      z30.object({
+        label: z30.string(),
+        path: z30.string()
       })
     ),
-    checkPassed: z29.boolean(),
-    typecheckCommand: z29.string().optional(),
-    devCommand: z29.string().optional()
+    checkPassed: z30.boolean(),
+    typecheckCommand: z30.string().optional(),
+    devCommand: z30.string().optional()
   }).optional()
 });
-var implementationOutputSchema = z29.object({
-  summary: z29.string(),
-  ingestCommand: z29.string().optional(),
+var implementationOutputSchema = z30.object({
+  summary: z30.string(),
+  ingestCommand: z30.string().optional(),
   // Only for the search use case: the path of whatever module the agent
   // defined the Algolia config constants in, so the wizard can check it
   // won't end up gitignored (it's public, meant to be committed).
-  searchConfigFile: z29.string().optional(),
-  uiFiles: z29.array(z29.object({ label: z29.string(), path: z29.string() })).optional(),
-  devCommand: z29.string().optional()
+  searchConfigFile: z30.string().optional(),
+  uiFiles: z30.array(z30.object({ label: z30.string(), path: z30.string() })).optional(),
+  devCommand: z30.string().optional()
 });
-var validationOutputSchema = z29.object({
-  summary: z29.string(),
-  sufficient: z29.boolean(),
-  additionalInstructions: z29.string().optional(),
-  unrelatedFailure: z29.string().optional(),
-  styleOnly: z29.boolean().optional(),
-  typecheckCommand: z29.string().optional()
+var validationOutputSchema = z30.object({
+  summary: z30.string(),
+  sufficient: z30.boolean(),
+  additionalInstructions: z30.string().optional(),
+  unrelatedFailure: z30.string().optional(),
+  styleOnly: z30.boolean().optional(),
+  typecheckCommand: z30.string().optional()
 });
 var MAX_IMPLEMENT_VALIDATION_ATTEMPTS = 3;
 var INGESTION_MAX_STEPS = 96;
@@ -6689,6 +6955,16 @@ var INGEST_RETRY = {
   skip: "Continue without records"
 };
 var INGEST_AGENT_RETRY_PROMPT = "Retry to let the wizard write and run the ingestion script again.";
+var PERSONAL_DATA_PROMPT = "Index this personal data?";
+var PERSONAL_DATA = {
+  omit: "No, do not index personal data",
+  ingest: "Yes, index personal data, but hide it from public search"
+};
+var HIDE_PERSONAL_DATA_RETRY_PROMPT = "Fix the cause (for example, check that the write key can edit index settings), then retry.";
+var HIDE_PERSONAL_DATA_RETRY = {
+  retry: "Retry hiding personal data",
+  skip: "Continue with a placeholder search key"
+};
 var FILE_UPLOAD_PATH_PROMPT = "Enter the path to your JSON, CSV, or TSV file (relative to the project root, or absolute):";
 var JS_LANGUAGES = ["javascript", "typescript", "jsx", "tsx", "node"];
 function lower(entries) {
@@ -6703,6 +6979,171 @@ var SEARCH_CONFIG_APP_ID = "ALGOLIA_APP_ID";
 var SEARCH_CONFIG_SEARCH_KEY = "ALGOLIA_SEARCH_API_KEY";
 var SEARCH_CONFIG_INDEX_NAME = "ALGOLIA_INDEX_NAME";
 var SEARCH_KEY_PLACEHOLDER = "<your-algolia-search-only-api-key>";
+function clientKeySentence(safe) {
+  const placement = "never read them from an environment variable or a .env* file, and never hardcode them anywhere except in that one module (import them wherever the search client needs them).";
+  if (safe) {
+    return `These are PUBLIC values, safe to commit and expose client-side: ${placement}`;
+  }
+  const never = `${placement[0].toUpperCase()}${placement.slice(1)}`;
+  return `Do not describe these values as safe to commit or safe to expose. Public search can still return personal data. ${never}`;
+}
+function hiddenAttributeSummary(exposure) {
+  if (exposure.publicSearchSafe) {
+    if (exposure.hiddenAttributes.length === 0) return void 0;
+    return `Public hits cannot return ${exposure.hiddenAttributes.join(", ")}, so the search key is safe to commit.`;
+  }
+  const names = withheldAttributes(exposure);
+  if (names.length === 0) return void 0;
+  return `The search key is not safe to commit until public search cannot return ${names.join(", ")}.`;
+}
+function createdSearchKeySummary(index, appId, safe) {
+  const base = `Created a new search-only Algolia API key for the "${index}" index in app ${appId}`;
+  return safe ? `${base} \u2014 safe to expose in frontend code.` : `${base}.`;
+}
+function exposureWarning(classified) {
+  const lines = [];
+  if (classified.personal.length > 0) {
+    lines.push(
+      `These attributes look like personal data: ${classified.personal.join(", ")}.`,
+      "Search runs in the browser with a public key, so anything it can return is visible to anyone."
+    );
+  }
+  if (classified.blocked.length > 0) {
+    lines.push(
+      `These attributes look like identity or payment-card numbers and will not be indexed: ${classified.blocked.join(", ")}.`
+    );
+  }
+  return lines;
+}
+async function resolveRecordExposure(ctx, attributes) {
+  const classified = classifyAttributes(attributes);
+  if (classified.blocked.length === 0 && classified.personal.length === 0) {
+    return {
+      omittedAttributes: [],
+      hiddenAttributes: [],
+      publicSearchSafe: true
+    };
+  }
+  const messages = exposureWarning(classified);
+  if (classified.personal.length === 0) {
+    await ctx.requestUserInput({
+      prompt: "Continue",
+      promptType: "notice",
+      options: [],
+      messages
+    });
+    return {
+      omittedAttributes: classified.blocked,
+      hiddenAttributes: [],
+      publicSearchSafe: true
+    };
+  }
+  const choice = await ctx.requestUserInput({
+    prompt: PERSONAL_DATA_PROMPT,
+    promptType: "multipleChoice",
+    options: [PERSONAL_DATA.omit, PERSONAL_DATA.ingest],
+    messages
+  });
+  if (choice !== PERSONAL_DATA.omit && choice !== PERSONAL_DATA.ingest) {
+    throw new Error("User cancelled personal-data selection. Wizard halted.");
+  }
+  const ingestPersonal = choice === PERSONAL_DATA.ingest;
+  return {
+    omittedAttributes: ingestPersonal ? classified.blocked : [...classified.blocked, ...classified.personal],
+    hiddenAttributes: ingestPersonal ? classified.personal : [],
+    publicSearchSafe: !ingestPersonal
+  };
+}
+async function restrictPublicSearch(exposure, args) {
+  const hide = withheldAttributes(exposure);
+  let applied;
+  let failure;
+  if (args.wroteRecords && hide.length > 0 && args.writeKey && args.appId) {
+    try {
+      await hideAttributesFromPublicSearch({
+        appId: args.appId,
+        indexName: args.indexName,
+        apiKey: args.writeKey,
+        hide,
+        searchableFallback: searchableFallbackAttributes(
+          args.attributes,
+          exposure,
+          args.recordSample
+        ),
+        ...args.createIndexSettings ? { createIfMissing: true } : {}
+      });
+      applied = true;
+    } catch (err) {
+      applied = false;
+      failure = err.message;
+      logger.warn(
+        { err: failure, index: args.indexName },
+        "implement: could not hide attributes from public search"
+      );
+    }
+  }
+  if (hide.length === 0) return {};
+  if (applied === false) {
+    exposure.publicSearchSafe = false;
+    const names = hide.join(", ");
+    const reason = failure ?? "unknown error";
+    return {
+      note: `Could not hide ${names} from public search (${reason}). The search key is not safe to commit.`,
+      failure: reason
+    };
+  }
+  if (applied === true) exposure.publicSearchSafe = true;
+  const note = hiddenAttributeSummary(exposure);
+  return note ? { note } : {};
+}
+function exposedPersonalAttributes(exposure, recordsWritten) {
+  if (!exposure || !recordsWritten || exposure.publicSearchSafe) return [];
+  return withheldAttributes(exposure);
+}
+function withheldSearchKeySummary(names) {
+  return `\u26A0\uFE0F Used a placeholder search key in client code because public search can still return ${names.join(", ")}. Hide those attributes from public search, then replace the placeholder with a search-only key.`;
+}
+function searchKeyInstruction(input, target) {
+  if (input.searchKey) return `Set ${target} to "${input.searchKey}".`;
+  if (input.searchKeyWithheldFor?.length) {
+    return `Public search can still return ${input.searchKeyWithheldFor.join(", ")}, so the wizard withheld the real search key \u2014 set ${target} to the placeholder "${SEARCH_KEY_PLACEHOLDER}" and add a prominent TODO for the developer to fill in a search-only key once those attributes are hidden from public search. Do not edit the ingestion script, the records, or the index settings to work around this.`;
+  }
+  return `A real search-only key could not be provisioned${input.searchKeyError ? ` (${input.searchKeyError})` : ""} \u2014 set ${target} to the placeholder "${SEARCH_KEY_PLACEHOLDER}" and add a prominent TODO for the developer to fill in a real one.`;
+}
+function placeholderKeyValidationInstruction(input) {
+  if (input.searchKey) return null;
+  const reason = input.searchKeyWithheldFor?.length ? `the wizard withheld the real key because public search can still return ${input.searchKeyWithheldFor.join(", ")}` : "the wizard could not provision a real search-only key";
+  return `${SEARCH_CONFIG_SEARCH_KEY} is intentionally the placeholder "${SEARCH_KEY_PLACEHOLDER}": ${reason}. Confirm the placeholder and a TODO to replace it are present and that no other Algolia API key is hardcoded. Do not set sufficient=false because of the placeholder, and do not ask for a real key.`;
+}
+function searchableFallbackAttributes(attributes, exposure, sample) {
+  const visible = visibleAttributes(attributes, exposure);
+  if (sample) {
+    return visible.filter(
+      (attribute) => isSearchableSampleValue(sample[attribute])
+    );
+  }
+  return visible.filter((attribute) => !looksNonTextAttribute(attribute));
+}
+function isSearchableSampleValue(value) {
+  if (typeof value === "string") return true;
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function looksNonTextAttribute(attribute) {
+  const tokens = attribute.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+  if (tokens.length === 0) return true;
+  if (tokens.includes("id") || tokens.at(-1) === "id") return true;
+  if (tokens.some(
+    (token) => ["count", "price", "amount", "total"].includes(token)
+  )) {
+    return true;
+  }
+  if (tokens.some(
+    (token) => ["is", "has", "enabled", "available"].includes(token)
+  )) {
+    return true;
+  }
+  return false;
+}
 var UI_FRAMEWORKS = [
   { match: ["vue", "nuxt"], target: "Vue", doc: "vue" },
   { match: ["react", "next"], target: "React", doc: "react" },
@@ -6777,6 +7218,7 @@ function ingestionInstructions(input) {
       `Create an ingestion script under "${input.ingestDir}/" at the repo root. That directory already exists \u2014 writeFile creates any nested path itself, so never run a shell command just to create a directory.`,
       FILE_EDIT_INSTRUCTION,
       `Ingest only the confirmed entity (name, source paths, attributes): ${JSON.stringify(input.confirmed)}.`,
+      ...ingestionExposureInstructions(input.exposure),
       `Ingesting writes to Algolia, so the script needs a write API key and App ID \u2014 read them from the ${API_KEY_VAR} and ${APP_ID_VAR} environment variables rather than hardcoding them. The wizard sets these when it runs the script.`,
       `Read the index name from the ${INDEX_NAME_VAR} environment variable, which the wizard sets to "${input.targetIndex}". Never hardcode an index name or derive one from the project, file, or entity name \u2014 the write key only works for that exact index. Exit with an error if ${INDEX_NAME_VAR} is unset.`,
       "Write the script in the project's primary language, using Algolia's official client for that language. Do not use the raw HTTP API.",
@@ -6807,8 +7249,16 @@ function ingestionInstructions(input) {
     ] : []
   ];
 }
+function searchIndexedEntity(input) {
+  const entity = input.findings.confirmedEntities?.[0];
+  if (!entity) return void 0;
+  return {
+    ...entity,
+    attributes: visibleAttributes(entity.attributes, input.exposure)
+  };
+}
 function searchInstructions(input) {
-  const indexedEntity = input.findings.confirmedEntities?.[0];
+  const indexedEntity = searchIndexedEntity(input);
   const templateMessage = input.uiTemplate ? `UI template: ${JSON.stringify(input.uiTemplate)}. Implement its layout, search placeholder, hit fields, filters, and sort controls. Use only the template's index attributes. Do not infer or invent record fields from the project.` : null;
   const indexedEntityMessage = indexedEntity ? `Indexed content context: ${JSON.stringify({
     entity: indexedEntity.name,
@@ -6830,6 +7280,7 @@ function searchInstructions(input) {
   return [
     "Implement an in-app Algolia search experience.",
     indexedContentMessage ?? "",
+    ...searchExposureInstructions(input.exposure),
     `Build the search UI for ${input.searchUiTarget}.`,
     "Create search UI only. Do not create or modify ingestion scripts, rake/manage/CLI tasks, migrations, seeders, or other data-loading code, even if the data looks incomplete.",
     "Prefer Highlight (or the plain attribute) for titles and short fields. Use Snippet only for longer text, and only when attributesToSnippet is set for that attribute \u2014 via the index searchParameters (for example attributesToSnippet: ['body:20']) or index settings. Without it, _snippetResult is missing and the result panel looks empty even though search returns hits.",
@@ -6908,9 +7359,10 @@ function packageSearchInstructions(input) {
     `Create the search experience as its own component in a new file, following the project's existing component conventions (location, naming, styling approach). Do not write it inline into an existing file.`,
     "When rendering results with an existing shared component (e.g. a card), import and reuse that component rather than inlining its markup \u2014 inlining silently drops the styles and behavior its own file provides.",
     "Vendor theme CSS, and any CSS you write against vendor class names, must be global: put overrides in a global block (Astro <style is:global>, an unscoped Vue block, a plain global CSS file). Never a framework-scoped style block or a CSS Module \u2014 scoping rewrites the vendor selectors and the widget's runtime DOM carries no scope attribute, so not one rule matches: styling silently does nothing and the build still passes. Import the theme and those global overrides only where the framework allows first-party global CSS: Next.js Pages Router only from pages/_app (or _app.tsx), Next.js App Router only from the root layout, otherwise from the app's global stylesheet or the component module when that is valid. Do not import a plain .css file from a Next.js component \u2014 that fails the build.",
-    `Define ${SEARCH_CONFIG_APP_ID}, ${SEARCH_CONFIG_SEARCH_KEY}, and ${SEARCH_CONFIG_INDEX_NAME} as exported constants in a module that fits this project's existing conventions for shared client-side config \u2014 reuse an existing one if it already holds config like this, or add a small new one otherwise. These are PUBLIC values, safe to commit and expose client-side: never read them from an environment variable or a .env* file, and never hardcode them anywhere except in that one module (import them wherever the search client needs them).`,
+    `Define ${SEARCH_CONFIG_APP_ID}, ${SEARCH_CONFIG_SEARCH_KEY}, and ${SEARCH_CONFIG_INDEX_NAME} as exported constants in a module that fits this project's existing conventions for shared client-side config \u2014 reuse an existing one if it already holds config like this, or add a small new one otherwise.`,
+    clientKeySentence(publicSearchKeyIsSafe(input.exposure)),
     `Set ${SEARCH_CONFIG_APP_ID} to "${input.appId}" and ${SEARCH_CONFIG_INDEX_NAME} to "${input.targetIndex}".`,
-    input.searchKey ? `Set ${SEARCH_CONFIG_SEARCH_KEY} to "${input.searchKey}".` : `A real search-only key could not be provisioned${input.searchKeyError ? ` (${input.searchKeyError})` : ""} \u2014 set ${SEARCH_CONFIG_SEARCH_KEY} to the placeholder "${SEARCH_KEY_PLACEHOLDER}" and add a prominent TODO for the developer to fill in a real one.`,
+    searchKeyInstruction(input, SEARCH_CONFIG_SEARCH_KEY),
     'Report the repo-relative path of that module as "searchConfigFile" in your final status.',
     "Install any Algolia packages you import with the project's own package manager via runShell, and declare them in the project's dependency manifest."
   ];
@@ -6944,7 +7396,10 @@ function cdnSearchInstructions(input) {
   return [
     `The target frontend has no package.json. Add the search container to its existing HTML or template, create separate classic config and search scripts, define window.${SEARCH_CONFIG_APP_ID}, window.${SEARCH_CONFIG_SEARCH_KEY}, and window.${SEARCH_CONFIG_INDEX_NAME} in the config script, and report that script as "searchConfigFile". Never create package.json, create a component, use imports or exports, or run npm, pnpm, yarn, or bun.`,
     `Set window.${SEARCH_CONFIG_APP_ID} to "${input.appId}" and window.${SEARCH_CONFIG_INDEX_NAME} to "${input.targetIndex}".`,
-    input.searchKey ? `Set window.${SEARCH_CONFIG_SEARCH_KEY} to "${input.searchKey}".` : `A real search-only key could not be provisioned${input.searchKeyError ? ` (${input.searchKeyError})` : ""} \u2014 set window.${SEARCH_CONFIG_SEARCH_KEY} to the placeholder "${SEARCH_KEY_PLACEHOLDER}" and add a prominent TODO for the developer to fill in a real one.`,
+    searchKeyInstruction(input, `window.${SEARCH_CONFIG_SEARCH_KEY}`),
+    ...publicSearchKeyIsSafe(input.exposure) ? [] : [
+      `Do not describe window.${SEARCH_CONFIG_SEARCH_KEY} as safe to commit or safe to expose. Public search can still return personal data.`
+    ],
     'Load these exact pinned tags in order before the config and search scripts: <script src="https://cdn.jsdelivr.net/npm/algoliasearch@5.59.0/dist/lite/builds/browser.umd.js" integrity="sha256-pduQHl1jn0IaN/BIpSotQm7Y5THdpKcX3Bw6xdRteRw=" crossorigin="anonymous"></script> then <script src="https://cdn.jsdelivr.net/npm/instantsearch.js@4.117.0/dist/instantsearch.production.min.js" integrity="sha256-5zhKxAGeH7ThWfnmdD4pS1gsmafE2b8aWRsq8set/dc=" crossorigin="anonymous"></script>.',
     'When using the InstantSearch theme, load this exact tag before the application styles: <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/instantsearch.css@8.22.1/themes/satellite-min.css" integrity="sha256-5/eHPZl63VYJSDVOKrOgGe/5+owUkX3uPAW6+XYeLNc=" crossorigin="anonymous">. Never use an unversioned or differently versioned theme URL, and never omit its integrity attribute.',
     `In that classic search script, use window['algoliasearch/lite'].liteClient and window.instantsearch. Add window.instantsearch.widgets.autocomplete as the only search widget. Configure it with container '#autocomplete', the content-specific placeholder ${JSON.stringify(placeholder)}, and an indices array containing one object whose indexName is window.${SEARCH_CONFIG_INDEX_NAME}. Put the item and noResults functions in the templates option of that indices entry, implement getURL only for an existing route, and match the item template to the entity schema. Keep insights: true and call search.start(). Do not substitute searchBox or hits, omit indices, use imports or exports, or use type="module".`,
@@ -6953,11 +7408,19 @@ function cdnSearchInstructions(input) {
 }
 function validationInstructions(input) {
   const templateMessage = input.uiTemplate ? `UI template: ${JSON.stringify(input.uiTemplate)}. Confirm the implementation uses its layout, search placeholder, hit fields, filters, and sort controls with the template's exact index attributes.` : null;
-  const indexedEntityMessage = input.findings.confirmedEntities?.[0] ? `Indexed content context: ${JSON.stringify(input.findings.confirmedEntities?.[0] ?? null)}.` : null;
+  const indexedEntity = searchIndexedEntity(input);
+  const indexedEntityMessage = indexedEntity ? `Indexed content context: ${JSON.stringify(indexedEntity)}.` : null;
   const contentMessage = (templateMessage || indexedEntityMessage) ?? "";
+  const withheld = searchExposureInstructions(input.exposure);
+  const placeholderKey = placeholderKeyValidationInstruction(input);
   return [
     "Validate the Algolia search implementation by inspecting the project source.",
     contentMessage,
+    ...placeholderKey ? [placeholderKey] : [],
+    ...withheld,
+    ...withheld.length > 0 ? [
+      "Do not set sufficient=false because the UI omits the personal or blocked attributes named above."
+    ] : [],
     `The confirmed placement candidate was "${input.searchLocation ?? "unknown"}", but verify the actual mount rather than assuming the candidate was used.`,
     "Inspect the generated search component, its actual mount file, that file's parent layout and sibling controls, and the relevant content UI. Do not rely only on type checks or tests.",
     `Confirm that the application renders exactly one search control for the indexed content, and that the new component is not mounted twice. ${SEARCH_SCOPE_RULE} If a same-scope search control is still mounted, set sufficient=false and name the file that mounts it. Do not set sufficient=false for a differently scoped search control.`,
@@ -7393,6 +7856,23 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
   });
   const confirmed2 = findings.confirmedEntities;
   const searchLocation = findings.searchImplementationAnalysis;
+  let exposure;
+  let searchKeyWithheldFor = [];
+  if (useCases.includes("ingestion")) {
+    exposure = await resolveRecordExposure(
+      ctx,
+      (confirmed2 ?? []).flatMap((entity) => entity.attributes)
+    );
+  } else if (useCases.includes("search")) {
+    const ingestion2 = ctx.getStepOutput(
+      "ingestion"
+    );
+    exposure = ingestion2?.recordExposure;
+    searchKeyWithheldFor = exposedPersonalAttributes(
+      exposure,
+      Boolean(ingestion2?.ingestScriptRan) || (ingestion2?.ingestRecordCount ?? 0) > 0
+    );
+  }
   let appId;
   let ingestAppId;
   let appPlan;
@@ -7413,13 +7893,33 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
   const summaries = [];
   let searchKey;
   let searchKeyError;
-  if (useCases.includes("search") && appId) {
+  let createdSearchKey;
+  const pushCreatedSearchKeySummary = () => {
+    if (!createdSearchKey) return;
+    summaries.unshift(
+      createdSearchKeySummary(
+        createdSearchKey.index,
+        createdSearchKey.appId,
+        publicSearchKeyIsSafe(exposure)
+      )
+    );
+    createdSearchKey = void 0;
+  };
+  if (searchKeyWithheldFor.length > 0) {
+    summaries.push(withheldSearchKeySummary(searchKeyWithheldFor));
+  } else if (useCases.includes("search") && appId) {
     try {
       const resolved2 = await resolveSearchOnlyKey(targetIndex, appId);
       searchKey = resolved2.key;
-      summaries.push(
-        resolved2.source === "created" ? `Created a new search-only Algolia API key for the "${targetIndex}" index in app ${appId} \u2014 safe to expose in frontend code.` : `Reused the existing search-only Algolia API key for the "${targetIndex}" index in app ${appId}.`
-      );
+      if (resolved2.source === "created") {
+        createdSearchKey = { index: targetIndex, appId };
+      } else {
+        summaries.push(
+          `Reused the existing search-only Algolia API key for the "${targetIndex}" index in app ${appId}.`
+        );
+      }
+      const exposureNote = !useCases.includes("ingestion") && exposure ? hiddenAttributeSummary(exposure) : void 0;
+      if (exposureNote) summaries.push(exposureNote);
     } catch (err) {
       searchKeyError = err.message;
       summaries.push(
@@ -7431,6 +7931,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
       );
     }
   }
+  if (!useCases.includes("ingestion")) pushCreatedSearchKeySummary();
   const input = {
     findings,
     confirmed: confirmed2,
@@ -7441,6 +7942,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
     appPlan,
     searchKey,
     searchKeyError,
+    searchKeyWithheldFor,
     ingestDir: INGEST_DIR,
     ingestionSource,
     uploadFilePath,
@@ -7449,7 +7951,8 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
       repoRoot,
       searchLocation
     ),
-    uiTemplate: options.uiTemplate
+    uiTemplate: options.uiTemplate,
+    exposure
   };
   let agentRuns = 0;
   let ingestCommand;
@@ -7458,6 +7961,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
   let ingestRecordCount;
   let ingestDurationMs;
   let ingestOutcomeMessage;
+  let ingestRecordSample;
   const ingestKeyAppId = ingestAppId;
   const ingestionTools = ingestKeyAppId && ingestWriteKey ? makeToolContext(
     repoRoot,
@@ -7570,6 +8074,16 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
       )
     });
     const ingestStartedAt = Date.now();
+    if (exposure && withheldAttributes(exposure).length && ingestAppId && ingestWriteKey) {
+      await restrictPublicSearch(exposure, {
+        wroteRecords: true,
+        appId: ingestAppId,
+        writeKey: ingestWriteKey,
+        indexName: targetIndex,
+        attributes: (confirmed2 ?? []).flatMap((entity) => entity.attributes),
+        createIndexSettings: true
+      });
+    }
     await runIngestionAgent();
     let outcome = ingestOutcome(executions, repoRoot, ingestCommand);
     let failureAcknowledged = false;
@@ -7659,7 +8173,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
       }
       if (ingestRecordCount != null) {
         const data_model = confirmed2?.[0]?.name ?? "unknown";
-        const sample = await ingestedRecordSample(
+        ingestRecordSample = await ingestedRecordSample(
           repoRoot,
           confirmed2?.[0]?.name,
           uploadFilePath
@@ -7669,7 +8183,10 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, options =
           record_count: ingestRecordCount,
           duration_ms: Date.now() - ingestStartedAt,
           index_name: targetIndex,
-          record_schema: recordSchema(sample, confirmed2?.[0]?.attributes ?? []),
+          record_schema: recordSchema(
+            ingestRecordSample,
+            confirmed2?.[0]?.attributes ?? []
+          ),
           attempts: ingestRunAttempts
         });
       } else {
@@ -7711,6 +8228,40 @@ ${detail}` : ""}`
         ...ingestAttempt?.exitCode != null ? { error_code: String(ingestAttempt.exitCode) } : {}
       });
     }
+    if (exposure) {
+      const wroteRecords = ingestScriptRan || (ingestRecordCount ?? 0) > 0;
+      const restrictArgs = {
+        wroteRecords,
+        appId: ingestAppId,
+        writeKey: ingestWriteKey,
+        indexName: targetIndex,
+        attributes: (confirmed2 ?? []).flatMap((entity) => entity.attributes),
+        recordSample: ingestRecordSample
+      };
+      let restricted = await restrictPublicSearch(exposure, restrictArgs);
+      while (restricted.failure) {
+        const choice = await ctx.requestUserInput({
+          prompt: HIDE_PERSONAL_DATA_RETRY_PROMPT,
+          promptType: "multipleChoice",
+          options: [HIDE_PERSONAL_DATA_RETRY.retry, HIDE_PERSONAL_DATA_RETRY.skip],
+          messages: [
+            `\u26A0\uFE0F Could not hide ${withheldAttributes(exposure).join(", ")} from public search \u2014 ${restricted.failure}.`,
+            "These attributes may already be in the index, so until they are hidden the wizard will put a placeholder search key in client code instead of the real one."
+          ]
+        });
+        if (choice !== HIDE_PERSONAL_DATA_RETRY.retry) break;
+        restricted = await restrictPublicSearch(exposure, restrictArgs);
+      }
+      if (restricted.note) summaries.push(restricted.note);
+      searchKeyWithheldFor = exposedPersonalAttributes(exposure, wroteRecords);
+      if (searchKeyWithheldFor.length > 0 && useCases.includes("search")) {
+        searchKey = void 0;
+        input.searchKey = void 0;
+        input.searchKeyWithheldFor = searchKeyWithheldFor;
+        summaries.push(withheldSearchKeySummary(searchKeyWithheldFor));
+      }
+    }
+    pushCreatedSearchKeySummary();
     if (ingestScriptRan) {
       await ctx.requestUserInput({
         prompt: "Continue",
@@ -7873,7 +8424,7 @@ ${detail}` : ""}`
       );
       if (ignoreStatus === "covered") {
         summaries.push(
-          `\u26A0\uFE0F ${searchConfigFile} is gitignored, so this public, safe-to-share search config won't reach teammates or CI. Remove whatever .gitignore rule covers it.`
+          publicSearchKeyIsSafe(input.exposure) ? `\u26A0\uFE0F ${searchConfigFile} is gitignored, so this public, safe-to-share search config won't reach teammates or CI. Remove whatever .gitignore rule covers it.` : `\u26A0\uFE0F ${searchConfigFile} is gitignored. This search key is not safe to commit. Remove whatever .gitignore rule covers it once public search cannot return personal data.`
         );
       }
     }
@@ -7883,6 +8434,7 @@ ${detail}` : ""}`
   return {
     ingestionSource,
     summary: summaries.join("\n\n"),
+    ...exposure ? { recordExposure: exposure } : {},
     ...useCases.includes("ingestion") && ingestCommand ? {
       ingestCommand,
       ingestScriptRan,
@@ -7955,8 +8507,8 @@ var defaultWorkflow = {
     defineStep({
       id: "select-index",
       title: "Set up index",
-      outputSchema: z30.object({
-        selection: z30.string()
+      outputSchema: z31.object({
+        selection: z31.string()
       }),
       run: (ctx) => selectIndexStep(ctx)
     }),
@@ -8025,7 +8577,7 @@ function ingestionGuidance(ingestion2) {
 }
 
 // src/actions/playbookSteps/selectPlaybook.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 
 // src/lib/dashboardApi/client.ts
 import "zod";
@@ -8084,80 +8636,80 @@ async function dashboardError(res) {
 }
 
 // src/lib/dashboardApi/schemas.ts
-import { z as z32 } from "zod";
-var messageResponseSchema = z32.object({
-  message: z32.string()
+import { z as z33 } from "zod";
+var messageResponseSchema = z33.object({
+  message: z33.string()
 });
-var playbookSchema = z32.object({
-  slug: z32.string(),
-  category: z32.string().optional(),
-  title: z32.string(),
-  description: z32.string().optional()
+var playbookSchema = z33.object({
+  slug: z33.string(),
+  category: z33.string().optional(),
+  title: z33.string(),
+  description: z33.string().optional()
 });
-var playbooksListSchema = z32.array(playbookSchema);
-var playbookExecutionStepSchema = z32.enum([
+var playbooksListSchema = z33.array(playbookSchema);
+var playbookExecutionStepSchema = z33.enum([
   "assessment",
   "optimization",
   "implement"
 ]);
-var playbookExecutionStepStatusSchema = z32.enum([
+var playbookExecutionStepStatusSchema = z33.enum([
   "not_started",
   "in_progress",
   "done",
   "error"
 ]);
-var schemaComparisonEntrySchema = z32.object({
-  canonical_attr: z32.string(),
-  canonical_type: z32.array(z32.string()),
-  canonical_roles: z32.array(z32.string()),
-  canonical_required: z32.boolean(),
-  index_attr: z32.string().nullable(),
-  index_type: z32.array(z32.string()).nullable(),
-  index_required: z32.boolean().nullable(),
-  status: z32.string(),
-  mapping_confidence: z32.number()
+var schemaComparisonEntrySchema = z33.object({
+  canonical_attr: z33.string(),
+  canonical_type: z33.array(z33.string()),
+  canonical_roles: z33.array(z33.string()),
+  canonical_required: z33.boolean(),
+  index_attr: z33.string().nullable(),
+  index_type: z33.array(z33.string()).nullable(),
+  index_required: z33.boolean().nullable(),
+  status: z33.string(),
+  mapping_confidence: z33.number()
 });
-var settingRecommendationSchema = z32.object({
-  current: z32.any(),
-  recommended: z32.any()
+var settingRecommendationSchema = z33.object({
+  current: z33.any(),
+  recommended: z33.any()
 });
-var settingsRecommendationEntriesSchema = z32.record(
-  z32.string(),
+var settingsRecommendationEntriesSchema = z33.record(
+  z33.string(),
   settingRecommendationSchema
 );
-var assessmentResultSchema = z32.object({
-  ready: z32.boolean(),
-  schema_comparison: z32.array(schemaComparisonEntrySchema),
+var assessmentResultSchema = z33.object({
+  ready: z33.boolean(),
+  schema_comparison: z33.array(schemaComparisonEntrySchema),
   settings_recommendation: settingsRecommendationEntriesSchema
 });
-var playbookExecutionSchema = z32.object({
-  uuid: z32.string(),
-  playbook_slug: z32.string(),
-  application_id: z32.string(),
-  source_index_name: z32.string(),
+var playbookExecutionSchema = z33.object({
+  uuid: z33.string(),
+  playbook_slug: z33.string(),
+  application_id: z33.string(),
+  source_index_name: z33.string(),
   current_step: playbookExecutionStepSchema,
   step_status: playbookExecutionStepStatusSchema,
-  status_reason: z32.string().nullable(),
-  completed: z32.boolean(),
+  status_reason: z33.string().nullable(),
+  completed: z33.boolean(),
   assessment_result: assessmentResultSchema.nullable(),
-  settings_snapshot: z32.json().nullable(),
-  created_at: z32.iso.datetime()
+  settings_snapshot: z33.json().nullable(),
+  created_at: z33.iso.datetime()
 });
 var playbookExecutionCreateResponseSchema = playbookExecutionSchema.extend({
-  resumed: z32.boolean(),
-  sample_data: z32.boolean()
+  resumed: z33.boolean(),
+  sample_data: z33.boolean()
 });
-var uiTemplateFieldSchema = z32.record(z32.string(), z32.unknown());
-var uiTemplateSchema = z32.looseObject({
-  layout: z32.string(),
-  record_label: z32.object({
-    singular: z32.string(),
-    plural: z32.string()
+var uiTemplateFieldSchema = z33.record(z33.string(), z33.unknown());
+var uiTemplateSchema = z33.looseObject({
+  layout: z33.string(),
+  record_label: z33.object({
+    singular: z33.string(),
+    plural: z33.string()
   }),
-  search_placeholder: z32.string().optional(),
+  search_placeholder: z33.string().optional(),
   hit: uiTemplateFieldSchema,
-  filters: z32.array(uiTemplateFieldSchema),
-  sort_by: z32.array(uiTemplateFieldSchema)
+  filters: z33.array(uiTemplateFieldSchema),
+  sort_by: z33.array(uiTemplateFieldSchema)
 });
 
 // src/lib/dashboardApi/api.ts
@@ -8247,8 +8799,8 @@ async function getPlaybookUiTemplate(uuid) {
 }
 
 // src/actions/playbookSteps/selectPlaybook.ts
-var selectPlaybookSchema = z33.object({
-  slug: z33.string()
+var selectPlaybookSchema = z34.object({
+  slug: z34.string()
 });
 function persistSlug(ctx, slug2) {
   ctx.setUserInput("playbookSlug", slug2);
@@ -8287,10 +8839,10 @@ async function selectPlaybookStep(ctx, requestedSlug) {
 }
 
 // src/actions/playbookSteps/selectIndex.ts
-import { z as z34 } from "zod";
-var selectIndexSchema = z34.object({
-  indexName: z34.string(),
-  sampleIndex: z34.boolean()
+import { z as z35 } from "zod";
+var selectIndexSchema = z35.object({
+  indexName: z35.string(),
+  sampleIndex: z35.boolean()
 });
 var CREATE_SAMPLE_INDEX = "Create a sample index";
 var GO_BACK_OPTION = "Go back to playbook selection";
@@ -8967,7 +9519,7 @@ function requestFailureMessage2(err) {
 }
 
 // src/actions/playbookSteps/generateUi.ts
-import z36 from "zod";
+import z37 from "zod";
 
 // src/actions/playbookSteps/generateUiPrompts.ts
 var SWITCH_APPLICATION_OPTION3 = "Switch application";
@@ -8975,24 +9527,24 @@ var SWITCH_INDEX_OPTION3 = "Switch index";
 var RETRY_OPTION3 = "Retry";
 async function promptUiGenerated(ctx, report) {
   const { files, checkPassed, devCommand } = report ?? {};
-  const list = [];
+  const list2 = [];
   if (files) {
     const editedFiles = files.map((file) => ({
       label: file.label,
       helpText: file.path,
       color: "success"
     }));
-    list.push(...editedFiles);
+    list2.push(...editedFiles);
   }
   if (checkPassed) {
-    list.push({ label: "build & typecheck passed", color: "success" });
+    list2.push({ label: "build & typecheck passed", color: "success" });
   }
-  list.push({
+  list2.push({
     label: "playbook UI completed",
     color: "success"
   });
   if (devCommand) {
-    list.push({
+    list2.push({
       label: "view it locally",
       helpText: devCommand,
       color: "success"
@@ -9003,7 +9555,7 @@ async function promptUiGenerated(ctx, report) {
     promptType: "notice",
     options: [],
     messages: ["implemented the playbook UI"],
-    list
+    list: list2
   });
 }
 async function promptUiRecovery(ctx, message) {
@@ -9025,10 +9577,10 @@ async function promptUiRecovery(ctx, message) {
 }
 
 // src/actions/playbookSteps/generateUi.ts
-var generatePlaybookUiSchema = z36.object({
-  summary: z36.string(),
-  framework: z36.string().optional(),
-  layoutName: z36.string().optional()
+var generatePlaybookUiSchema = z37.object({
+  summary: z37.string(),
+  framework: z37.string().optional(),
+  layoutName: z37.string().optional()
 });
 async function generatePlaybookUiStep(ctx) {
   const execution = await requireExecution2(ctx);
@@ -9105,20 +9657,20 @@ function isUiEligible(execution) {
   return current_step === "optimization" && step_status === "done" || current_step === "implement" && step_status !== "done";
 }
 async function loadTemplateWithRecovery(ctx, uuid) {
-  const request = () => getPlaybookUiTemplate(uuid);
+  const request2 = () => getPlaybookUiTemplate(uuid);
   const requestRecoveryPrompt = (err) => promptUiRecovery(
     ctx,
     requestFailureMessage3(err, "Couldn't load the playbook UI template.")
   );
-  return retryOnDashboardError(request, requestRecoveryPrompt);
+  return retryOnDashboardError(request2, requestRecoveryPrompt);
 }
 async function markDoneWithRecovery(ctx, uuid) {
-  const request = () => updatePlaybookStepStatus(uuid, "done");
+  const request2 = () => updatePlaybookStepStatus(uuid, "done");
   const requestRecoveryPrompt = (err) => promptUiRecovery(
     ctx,
     requestFailureMessage3(err, "Couldn't update the playbook UI step.")
   );
-  await retryOnDashboardError(request, requestRecoveryPrompt);
+  await retryOnDashboardError(request2, requestRecoveryPrompt);
 }
 async function markPlaybookUiStepFailed(execution, err) {
   const reason = err instanceof Error ? err.message : String(err);
@@ -9138,12 +9690,12 @@ function requestFailureMessage3(err, fallback) {
 }
 
 // src/actions/playbookSteps/summary.ts
-import { z as z37 } from "zod";
-var playbookSummarySchema = z37.object({
-  slug: z37.string(),
-  applicationId: z37.string(),
-  indexName: z37.string(),
-  writtenFileCount: z37.number().int().nonnegative()
+import { z as z38 } from "zod";
+var playbookSummarySchema = z38.object({
+  slug: z38.string(),
+  applicationId: z38.string(),
+  indexName: z38.string(),
+  writtenFileCount: z38.number().int().nonnegative()
 });
 async function playbookSummaryStep(ctx) {
   const { slug: slug2 } = ctx.getStepOutput("select-playbook");
@@ -9585,7 +10137,7 @@ var accessItems = [
   {
     tag: "KEY",
     title: "Credentials",
-    description: "writes your Algolia app id and a search-only key (safe to expose) to .env in your project."
+    description: "writes the Algolia app id, index name, and write key to a gitignored env file. A search-only key goes in client code only when results cannot include personal data."
   }
 ];
 var neverItems = [
@@ -10953,7 +11505,7 @@ async function promptResumeOrStartNew(session, next) {
 // package.json with { type: 'json' }
 var package_default2 = {
   name: "@algolia/wizard",
-  version: "0.115.0",
+  version: "0.117.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {

package/docs/algolia-sdk/README.md

@@ -18,11 +18,10 @@ Always install the **latest stable** within the major (use a caret range like `^
 
 ## Golden rules
 
-- Use a **search-only API key** in any browser/client code. It is safe to expose.
-  NEVER ship an admin or any write-capable key to the client.
+- Use a **search-only API key** in any browser or client code. Commit it only when a public search hit cannot return personal data.
+  Never ship an admin or write-capable key to the client.
 - Import the Application ID and search-only key from the project's shared client-side
-  config module as plain exported constants. They are public, safe to commit — never read
-  them from an env var or `.env*` file, and never hardcode them elsewhere.
+  config module as plain exported constants. Never read them from an env var or a `.env*` file, and never hardcode them anywhere else.
 - Instantiate the search client **once, outside your components**, and pass a stable
   reference. Do not inline `algoliasearch(...)` as a prop value — it breaks the
   client cache and causes re-renders.

package/docs/algolia-sdk/instantsearch-setup-js.md

@@ -5,10 +5,10 @@ Install `instantsearch.js` (v4)
 ## Search client: always use the lite client
 
 Import the client from `algoliasearch/lite` and alias it to `algoliasearch`.
-`ALGOLIA_APP_ID`, `ALGOLIA_SEARCH_API_KEY`, and `ALGOLIA_INDEX_NAME` below are
-the constants exported from the project's shared client-side config module —
-these are public values, safe to commit; never hardcode them inline or read
-them from an env var.
+`ALGOLIA_APP_ID`, `ALGOLIA_SEARCH_API_KEY`, and `ALGOLIA_INDEX_NAME` are exported
+constants in the project's shared client-side config module. Commit them only
+when a public search hit cannot return personal data. Never hardcode them inline
+or read them from an env var.
 
 ```ts
 import { liteClient as algoliasearch } from 'algoliasearch/lite'

package/docs/algolia-sdk/instantsearch-setup-react.md

@@ -5,10 +5,10 @@ Install `react-instantsearch` (v7)
 ## Search client: always use the lite client
 
 Import the client from `algoliasearch/lite` and alias it to `algoliasearch`.
-`ALGOLIA_APP_ID`, `ALGOLIA_SEARCH_API_KEY`, and `ALGOLIA_INDEX_NAME` below are
-the constants exported from the project's shared client-side config module —
-these are public values, safe to commit; never hardcode them inline or read
-them from an env var.
+`ALGOLIA_APP_ID`, `ALGOLIA_SEARCH_API_KEY`, and `ALGOLIA_INDEX_NAME` are exported
+constants in the project's shared client-side config module. Commit them only
+when a public search hit cannot return personal data. Never hardcode them inline
+or read them from an env var.
 
 ```ts
 import { liteClient as algoliasearch } from 'algoliasearch/lite'

package/docs/algolia-sdk/instantsearch-setup-vue.md

@@ -5,10 +5,10 @@ Install `vue-instantsearch` (v4)
 ## Search client: always use the lite client
 
 Import the client from `algoliasearch/lite` and alias it to `algoliasearch`.
-`ALGOLIA_APP_ID`, `ALGOLIA_SEARCH_API_KEY`, and `ALGOLIA_INDEX_NAME` below are
-the constants exported from the project's shared client-side config module —
-these are public values, safe to commit; never hardcode them inline or read
-them from an env var.
+`ALGOLIA_APP_ID`, `ALGOLIA_SEARCH_API_KEY`, and `ALGOLIA_INDEX_NAME` are exported
+constants in the project's shared client-side config module. Commit them only
+when a public search hit cannot return personal data. Never hardcode them inline
+or read them from an env var.
 
 ```ts
 import { liteClient as algoliasearch } from 'algoliasearch/lite'

package/docs/algolia-sdk/search-single-index.md

@@ -5,10 +5,10 @@ route, or programmatic queries). For UI, prefer `instantsearch-setup-<framework>
 
 ## Client
 
-`ALGOLIA_APP_ID`, `ALGOLIA_SEARCH_API_KEY`, and `ALGOLIA_INDEX_NAME` below are
-the constants exported from the project's shared client-side config module —
-these are public values, safe to commit; never hardcode them inline or read
-them from an env var.
+`ALGOLIA_APP_ID`, `ALGOLIA_SEARCH_API_KEY`, and `ALGOLIA_INDEX_NAME` are exported
+constants in the project's shared client-side config module. Commit them only
+when a public search hit cannot return personal data. Never hardcode them inline
+or read them from an env var.
 
 ```ts
 import { algoliasearch } from 'algoliasearch'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algolia/wizard",
-  "version": "0.115.0",
+  "version": "0.117.0",
   "description": "Magically implement Algolia functionality in your codebase",
   "type": "module",
   "engines": {