@entifix/next-shell 0.1.0-0

package/dist/lib/i18n/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/i18n/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/dist/lib/i18n/index.js

@@ -0,0 +1,3 @@
+export * from './locale-link.js';
+
+//# sourceMappingURL=index.js.map

package/dist/lib/i18n/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/i18n/index.ts"],"sourcesContent":["export * from './locale-link.js';\n"],"names":[],"mappings":"AAAA,cAAc,mBAAmB"}

package/dist/lib/i18n/locale-link.d.ts

@@ -0,0 +1,23 @@
+import { type Locale } from '@entifix/core';
+import Link from 'next/link';
+import type { ComponentPropsWithoutRef } from 'react';
+/**
+ * Prefixes an in-app href with the active locale.
+ *
+ * Every internal link has to go through this. An unprefixed `/catalog` still
+ * works — the middleware negotiates and redirects — but the visitor pays a
+ * round trip and, worse, a visitor reading `/en/...` who follows a bare link
+ * lands back on whatever their cookie says. The helper is idempotent and leaves
+ * absolute URLs alone, so it is safe to apply at every call site.
+ */
+export declare function useLocaleHref(): (href: string) => string;
+/**
+ * The locale the URL is actually on. Reads the browser path rather than the
+ * provider, so it is correct inside `usePathname`-driven code (breadcrumbs)
+ * even before the provider re-renders.
+ */
+export declare function usePathLocale(): Locale | undefined;
+export type LocaleLinkProps = ComponentPropsWithoutRef<typeof Link>;
+/** `next/link` with the active locale already on the href. */
+export declare function LocaleLink({ href, ...props }: LocaleLinkProps): import("react").JSX.Element;
+//# sourceMappingURL=locale-link.d.ts.map

package/dist/lib/i18n/locale-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale-link.d.ts","sourceRoot":"","sources":["../../../src/lib/i18n/locale-link.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,MAAM,EAA+B,MAAM,eAAe,CAAC;AAEzE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,OAAO,CAAC;AAGtD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED,MAAM,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,IAAI,CAAC,CAAC;AAEpE,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,eAAe,+BAK7D"}

package/dist/lib/i18n/locale-link.js

@@ -0,0 +1,43 @@
+'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { localeHref, splitLocalePath } from '@entifix/core';
+import { useLocale } from '@entifix/react-controls';
+import Link from 'next/link';
+import { usePathname } from 'next/navigation';
+import { useCallback } from 'react';
+/**
+ * Prefixes an in-app href with the active locale.
+ *
+ * Every internal link has to go through this. An unprefixed `/catalog` still
+ * works — the middleware negotiates and redirects — but the visitor pays a
+ * round trip and, worse, a visitor reading `/en/...` who follows a bare link
+ * lands back on whatever their cookie says. The helper is idempotent and leaves
+ * absolute URLs alone, so it is safe to apply at every call site.
+ */ export function useLocaleHref() {
+    const locale = useLocale();
+    return useCallback((href)=>localeHref(locale, href), [
+        locale
+    ]);
+}
+/**
+ * The locale the URL is actually on. Reads the browser path rather than the
+ * provider, so it is correct inside `usePathname`-driven code (breadcrumbs)
+ * even before the provider re-renders.
+ */ export function usePathLocale() {
+    var _usePathname;
+    return splitLocalePath((_usePathname = usePathname()) != null ? _usePathname : '/').locale;
+}
+/** `next/link` with the active locale already on the href. */ export function LocaleLink(_0) {
+    let { href } = _0, props = _object_without_properties_loose(_0, [
+        "href"
+    ]);
+    const withLocale = useLocaleHref();
+    const resolved = typeof href === 'string' ? withLocale(href) : href;
+    return /*#__PURE__*/ _jsx(Link, _extends({
+        href: resolved
+    }, props));
+}
+
+//# sourceMappingURL=locale-link.js.map

package/dist/lib/i18n/locale-link.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/i18n/locale-link.tsx"],"sourcesContent":["'use client';\n\nimport { type Locale, localeHref, splitLocalePath } from '@entifix/core';\nimport { useLocale } from '@entifix/react-controls';\nimport Link from 'next/link';\nimport { usePathname } from 'next/navigation';\nimport type { ComponentPropsWithoutRef } from 'react';\nimport { useCallback } from 'react';\n\n/**\n * Prefixes an in-app href with the active locale.\n *\n * Every internal link has to go through this. An unprefixed `/catalog` still\n * works — the middleware negotiates and redirects — but the visitor pays a\n * round trip and, worse, a visitor reading `/en/...` who follows a bare link\n * lands back on whatever their cookie says. The helper is idempotent and leaves\n * absolute URLs alone, so it is safe to apply at every call site.\n */\nexport function useLocaleHref(): (href: string) => string {\n  const locale = useLocale();\n  return useCallback((href: string) => localeHref(locale, href), [locale]);\n}\n\n/**\n * The locale the URL is actually on. Reads the browser path rather than the\n * provider, so it is correct inside `usePathname`-driven code (breadcrumbs)\n * even before the provider re-renders.\n */\nexport function usePathLocale(): Locale | undefined {\n  return splitLocalePath(usePathname() ?? '/').locale;\n}\n\nexport type LocaleLinkProps = ComponentPropsWithoutRef<typeof Link>;\n\n/** `next/link` with the active locale already on the href. */\nexport function LocaleLink({ href, ...props }: LocaleLinkProps) {\n  const withLocale = useLocaleHref();\n  const resolved = typeof href === 'string' ? withLocale(href) : href;\n\n  return <Link href={resolved} {...props} />;\n}\n"],"names":["localeHref","splitLocalePath","useLocale","Link","usePathname","useCallback","useLocaleHref","locale","href","usePathLocale","LocaleLink","props","withLocale","resolved"],"mappings":"AAAA;;;;AAEA,SAAsBA,UAAU,EAAEC,eAAe,QAAQ,gBAAgB;AACzE,SAASC,SAAS,QAAQ,0BAA0B;AACpD,OAAOC,UAAU,YAAY;AAC7B,SAASC,WAAW,QAAQ,kBAAkB;AAE9C,SAASC,WAAW,QAAQ,QAAQ;AAEpC;;;;;;;;CAQC,GACD,OAAO,SAASC;IACd,MAAMC,SAASL;IACf,OAAOG,YAAY,CAACG,OAAiBR,WAAWO,QAAQC,OAAO;QAACD;KAAO;AACzE;AAEA;;;;CAIC,GACD,OAAO,SAASE;QACSL;IAAvB,OAAOH,iBAAgBG,eAAAA,yBAAAA,eAAiB,KAAKG,MAAM;AACrD;AAIA,4DAA4D,GAC5D,OAAO,SAASG,WAAW,EAAmC;QAAnC,EAAEF,IAAI,EAA6B,OAAxBG;;;IACpC,MAAMC,aAAaN;IACnB,MAAMO,WAAW,OAAOL,SAAS,WAAWI,WAAWJ,QAAQA;IAE/D,qBAAO,KAACL;QAAKK,MAAMK;OAAcF;AACnC"}

package/dist/lib/i18n/spec-catalog.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spec-catalog.d.ts.map

package/dist/lib/i18n/spec-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-catalog.d.ts","sourceRoot":"","sources":["../../../src/lib/i18n/spec-catalog.ts"],"names":[],"mappings":""}

package/dist/lib/i18n/spec-catalog.js

@@ -0,0 +1,84 @@
+import { registerFallbackCatalog } from '@entifix/react-controls';
+/**
+ * An `entity` catalog for this package's own specs.
+ *
+ * ⚠️ **A fixture, not a shipped catalog.** `entity` names the *host's* entities,
+ * so a framework shipping one would be shipping product copy — which is what
+ * [ADR 0059](../../../../../../docs/adr/0059-entifix-leaves-the-repo.md)
+ * removes. These specs assert that a nav entry, a palette command and a
+ * workspace tab name a record in the catalog's own words; a fixture proves that
+ * as well as r10c's copy did, and keeps the assertions readable as sentences.
+ */ const es = {
+    product: {
+        label: 'Producto',
+        plural: 'Productos'
+    },
+    thing: {
+        label: 'Cosa',
+        plural: 'Cosas'
+    },
+    widget: {
+        label: 'Artilugio',
+        plural: 'Artilugios'
+    },
+    'product-category': {
+        label: 'Categoría',
+        plural: 'Categorías'
+    },
+    'product-brand': {
+        label: 'Marca',
+        plural: 'Marcas',
+        form: {
+            newTitle: 'Nueva marca',
+            editTitle: 'Editar marca'
+        },
+        fields: {
+            id: 'Id',
+            code: 'Código',
+            name: 'Nombre',
+            website: 'Sitio web'
+        },
+        // No `archive` on purpose — a CRUD spec asserts that a verb the
+        // catalog does not name still renders, as its key.
+        useCases: {
+            retire: 'Retirar'
+        }
+    },
+    'product-specification': {
+        label: 'Producto',
+        plural: 'Productos',
+        fields: {
+            id: 'Id',
+            name: 'Nombre',
+            brand: 'Marca'
+        }
+    },
+    'user-identity': {
+        label: 'Usuario',
+        plural: 'Usuarios',
+        useCases: {
+            signOutOthers: 'Cerrar mis otras sesiones',
+            signOutOthersConfirm: 'Se cerrarán todas tus sesiones en otros dispositivos y navegadores. ' + 'Ésta seguirá abierta.',
+            signOutOthersKeywords: 'cerrar sesión, dispositivos, logout'
+        }
+    }
+};
+registerFallbackCatalog('entity', {
+    es,
+    en: es
+});
+/**
+ * The same for `errors` — the code vocabulary a host's services answer with.
+ * The palette renders a scope refusal through it, so it needs the two codes
+ * these specs actually raise.
+ */ const errors = {
+    noActiveOrganization: 'Selecciona una organización para ver estos registros.',
+    alreadyRetired: 'El registro ya estaba retirado.',
+    unexpected: 'Ocurrió un error inesperado.'
+};
+registerFallbackCatalog('errors', {
+    es: errors,
+    en: errors
+});
+
+//# sourceMappingURL=spec-catalog.js.map

package/dist/lib/i18n/spec-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/i18n/spec-catalog.ts"],"sourcesContent":["import { registerFallbackCatalog } from '@entifix/react-controls';\n\n/**\n * An `entity` catalog for this package's own specs.\n *\n * ⚠️ **A fixture, not a shipped catalog.** `entity` names the *host's* entities,\n * so a framework shipping one would be shipping product copy — which is what\n * [ADR 0059](../../../../../../docs/adr/0059-entifix-leaves-the-repo.md)\n * removes. These specs assert that a nav entry, a palette command and a\n * workspace tab name a record in the catalog's own words; a fixture proves that\n * as well as r10c's copy did, and keeps the assertions readable as sentences.\n */\nconst es = {\n  product: { label: 'Producto', plural: 'Productos' },\n  thing: { label: 'Cosa', plural: 'Cosas' },\n  widget: { label: 'Artilugio', plural: 'Artilugios' },\n  'product-category': { label: 'Categoría', plural: 'Categorías' },\n  'product-brand': {\n    label: 'Marca',\n    plural: 'Marcas',\n    form: { newTitle: 'Nueva marca', editTitle: 'Editar marca' },\n    fields: {\n      id: 'Id',\n      code: 'Código',\n      name: 'Nombre',\n      website: 'Sitio web',\n    },\n    // No `archive` on purpose — a CRUD spec asserts that a verb the\n    // catalog does not name still renders, as its key.\n    useCases: { retire: 'Retirar' },\n  },\n  'product-specification': {\n    label: 'Producto',\n    plural: 'Productos',\n    fields: { id: 'Id', name: 'Nombre', brand: 'Marca' },\n  },\n  'user-identity': {\n    label: 'Usuario',\n    plural: 'Usuarios',\n    useCases: {\n      signOutOthers: 'Cerrar mis otras sesiones',\n      signOutOthersConfirm:\n        'Se cerrarán todas tus sesiones en otros dispositivos y navegadores. ' +\n        'Ésta seguirá abierta.',\n      signOutOthersKeywords: 'cerrar sesión, dispositivos, logout',\n    },\n  },\n} as const;\n\nregisterFallbackCatalog('entity', { es, en: es });\n\n/**\n * The same for `errors` — the code vocabulary a host's services answer with.\n * The palette renders a scope refusal through it, so it needs the two codes\n * these specs actually raise.\n */\nconst errors = {\n  noActiveOrganization: 'Selecciona una organización para ver estos registros.',\n  alreadyRetired: 'El registro ya estaba retirado.',\n  unexpected: 'Ocurrió un error inesperado.',\n} as const;\n\nregisterFallbackCatalog('errors', { es: errors, en: errors });\n"],"names":["registerFallbackCatalog","es","product","label","plural","thing","widget","form","newTitle","editTitle","fields","id","code","name","website","useCases","retire","brand","signOutOthers","signOutOthersConfirm","signOutOthersKeywords","en","errors","noActiveOrganization","alreadyRetired","unexpected"],"mappings":"AAAA,SAASA,uBAAuB,QAAQ,0BAA0B;AAElE;;;;;;;;;CASC,GACD,MAAMC,KAAK;IACTC,SAAS;QAAEC,OAAO;QAAYC,QAAQ;IAAY;IAClDC,OAAO;QAAEF,OAAO;QAAQC,QAAQ;IAAQ;IACxCE,QAAQ;QAAEH,OAAO;QAAaC,QAAQ;IAAa;IACnD,oBAAoB;QAAED,OAAO;QAAaC,QAAQ;IAAa;IAC/D,iBAAiB;QACfD,OAAO;QACPC,QAAQ;QACRG,MAAM;YAAEC,UAAU;YAAeC,WAAW;QAAe;QAC3DC,QAAQ;YACNC,IAAI;YACJC,MAAM;YACNC,MAAM;YACNC,SAAS;QACX;QACA,gEAAgE;QAChE,mDAAmD;QACnDC,UAAU;YAAEC,QAAQ;QAAU;IAChC;IACA,yBAAyB;QACvBb,OAAO;QACPC,QAAQ;QACRM,QAAQ;YAAEC,IAAI;YAAME,MAAM;YAAUI,OAAO;QAAQ;IACrD;IACA,iBAAiB;QACfd,OAAO;QACPC,QAAQ;QACRW,UAAU;YACRG,eAAe;YACfC,sBACE,yEACA;YACFC,uBAAuB;QACzB;IACF;AACF;AAEApB,wBAAwB,UAAU;IAAEC;IAAIoB,IAAIpB;AAAG;AAE/C;;;;CAIC,GACD,MAAMqB,SAAS;IACbC,sBAAsB;IACtBC,gBAAgB;IAChBC,YAAY;AACd;AAEAzB,wBAAwB,UAAU;IAAEC,IAAIqB;IAAQD,IAAIC;AAAO"}

package/dist/lib/search/record-search-route.d.ts

@@ -0,0 +1,44 @@
+import type { RecordSearchSource } from './record-search-source.js';
+export declare const SEARCH_TERM_PARAM = "q";
+export declare const SEARCH_SOURCES_PARAM = "sources";
+export declare const SEARCH_LIMIT_PARAM = "limit";
+/**
+ * Below this, nothing is queried at all.
+ *
+ * A `like` becomes an unanchored, case-insensitive `$regex`, which no index can
+ * serve — so this endpoint is a collection scan by construction. One character
+ * matches most of every collection and is worth nothing to the person typing, so
+ * the floor costs them nothing and saves four scans per keystroke.
+ */
+export declare const MIN_TERM_LENGTH = 2;
+export declare const DEFAULT_GROUP_LIMIT = 5;
+export declare const MAX_GROUP_LIMIT = 20;
+export declare const DEFAULT_SOURCE_TIMEOUT_MS = 1500;
+export interface RecordSearchRouteOptions {
+    /**
+     * The sources to fan out over, **in the order results are presented**. That
+     * order is the ranking: an operator learns where a kind of record lands, which
+     * a relevance score across four unrelated entities cannot offer.
+     */
+    readonly sources: readonly RecordSearchSource[];
+    /** Per-source budget. Concurrent, so this also bounds the whole request. */
+    readonly timeoutMs?: number;
+    /** Records per group. */
+    readonly limit?: number;
+}
+/**
+ * `GET /api/search` — records matching a term, across every source this host
+ * mounts (ADR 0040).
+ *
+ * The caller's own session is the only credential that crosses: each source is
+ * asked over the same guarded route its screens use, so what comes back is
+ * already authorized for this principal and this organization. There is no
+ * index, and there must never be one — a prefetched index is a tenant leak, and
+ * it is the reason this is a fan-out rather than a search service.
+ *
+ * A source that fails is **named** in `unavailable` rather than dropped. An
+ * absent group renders as "no matches", which is a confident claim the server is
+ * in no position to make about a service it could not reach.
+ */
+export declare const createRecordSearchRoute: ({ sources, timeoutMs, limit: defaultLimit, }: RecordSearchRouteOptions) => (request: Request) => Promise<Response>;
+//# sourceMappingURL=record-search-route.d.ts.map

package/dist/lib/search/record-search-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-search-route.d.ts","sourceRoot":"","sources":["../../../src/lib/search/record-search-route.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAC9C,eAAO,MAAM,kBAAkB,UAAU,CAAC;AAE1C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAa/C,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yBAAyB;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAmFD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GAAI,8CAIrC,wBAAwB,MAGC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CA+D9D,CAAC"}

package/dist/lib/search/record-search-route.js

@@ -0,0 +1,158 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { NextResponse } from 'next/server';
+import { bearerHeader, sessionToken } from '../session/bearer.js';
+export const SEARCH_TERM_PARAM = 'q';
+export const SEARCH_SOURCES_PARAM = 'sources';
+export const SEARCH_LIMIT_PARAM = 'limit';
+/**
+ * Below this, nothing is queried at all.
+ *
+ * A `like` becomes an unanchored, case-insensitive `$regex`, which no index can
+ * serve — so this endpoint is a collection scan by construction. One character
+ * matches most of every collection and is worth nothing to the person typing, so
+ * the floor costs them nothing and saves four scans per keystroke.
+ */ export const MIN_TERM_LENGTH = 2;
+export const DEFAULT_GROUP_LIMIT = 5;
+export const MAX_GROUP_LIMIT = 20;
+export const DEFAULT_SOURCE_TIMEOUT_MS = 1500;
+/** Upstream statuses that mean something other than "we could not reach it". */ const REASON_FOR_STATUS = {
+    400: 'invalidQuery',
+    401: 'unauthenticated',
+    403: 'forbidden',
+    404: 'notFound',
+    409: 'noActiveOrganization'
+};
+const unavailable = (source, reason, status)=>({
+        ok: false,
+        unavailable: _extends({
+            source: source.key,
+            entity: source.entity,
+            reason
+        }, status === undefined ? {} : {
+            status
+        })
+    });
+/**
+ * Ask one source, and **never reject**.
+ *
+ * Returning a typed outcome rather than throwing is what makes the fan-out a
+ * plain `Promise.all`: isolation comes from this catch, not from
+ * `allSettled` — whose rejected arm would then be unreachable and untestable.
+ */ const runSource = async (source, term, limit, token, timeoutMs)=>{
+    let upstream;
+    try {
+        upstream = await fetch(source.url(term, limit), {
+            headers: bearerHeader(token),
+            cache: 'no-store',
+            signal: AbortSignal.timeout(timeoutMs)
+        });
+    } catch (error) {
+        // `AbortSignal.timeout` rejects with a `DOMException` named `TimeoutError`;
+        // branching on the name rather than the class keeps this reachable from a
+        // test without fabricating a platform error.
+        return unavailable(source, error.name === 'TimeoutError' ? 'timeout' : 'network');
+    }
+    if (!upstream.ok) {
+        var _REASON_FOR_STATUS_upstream_status;
+        return unavailable(source, (_REASON_FOR_STATUS_upstream_status = REASON_FOR_STATUS[upstream.status]) != null ? _REASON_FOR_STATUS_upstream_status : 'unexpected', upstream.status);
+    }
+    const body = await upstream.json().catch(()=>undefined);
+    const page = source.read(body);
+    return page === undefined ? unavailable(source, 'unexpected', upstream.status) : {
+        ok: true,
+        group: {
+            source: source.key,
+            entity: source.entity,
+            labelKey: source.labelKey,
+            items: page.items,
+            total: page.total
+        }
+    };
+};
+const clampLimit = (raw, fallback)=>{
+    const asked = Number(raw);
+    if (!Number.isInteger(asked) || asked < 1) return fallback;
+    return Math.min(asked, MAX_GROUP_LIMIT);
+};
+/**
+ * `GET /api/search` — records matching a term, across every source this host
+ * mounts (ADR 0040).
+ *
+ * The caller's own session is the only credential that crosses: each source is
+ * asked over the same guarded route its screens use, so what comes back is
+ * already authorized for this principal and this organization. There is no
+ * index, and there must never be one — a prefetched index is a tenant leak, and
+ * it is the reason this is a fan-out rather than a search service.
+ *
+ * A source that fails is **named** in `unavailable` rather than dropped. An
+ * absent group renders as "no matches", which is a confident claim the server is
+ * in no position to make about a service it could not reach.
+ */ export const createRecordSearchRoute = ({ sources, timeoutMs = DEFAULT_SOURCE_TIMEOUT_MS, limit: defaultLimit = DEFAULT_GROUP_LIMIT })=>{
+    const byKey = new Map(sources.map((source)=>[
+            source.key,
+            source
+        ]));
+    return async function GET(request) {
+        var _params_get, _params_get1;
+        // The services decide what this caller may read; this only carries the
+        // token. But the gate is not redundant: `catalog-reference` reads are
+        // unauthenticated at the service by design, so without it a signed-out
+        // caller gets brand matches back and the answer reads as a real search —
+        // and the endpoint becomes an anonymous amplifier against that service.
+        const token = await sessionToken();
+        if (token === undefined) {
+            return NextResponse.json({
+                error: 'unauthenticated',
+                code: 'unauthenticated'
+            }, {
+                status: 401
+            });
+        }
+        const params = new URL(request.url).searchParams;
+        const asked = ((_params_get = params.get(SEARCH_SOURCES_PARAM)) != null ? _params_get : '').split(',').filter((name)=>name !== '');
+        const unknown = asked.find((name)=>!byKey.has(name));
+        if (unknown !== undefined) {
+            // Loud rather than ignored: no keystroke can produce this, only a caller
+            // naming a source that does not exist — and silently searching everything
+            // instead would answer a question nobody asked.
+            return NextResponse.json({
+                error: 'invalid query',
+                code: 'invalidQuery',
+                detail: `unknown search source "${unknown}"`
+            }, {
+                status: 400
+            });
+        }
+        const selected = asked.length === 0 ? sources : sources.filter((source)=>asked.includes(source.key));
+        const term = ((_params_get1 = params.get(SEARCH_TERM_PARAM)) != null ? _params_get1 : '').trim();
+        const answer = (body)=>// The body is scoped to one principal and one organization. `no-store` is
+            // correctness here, not tuning.
+            NextResponse.json(body, {
+                headers: {
+                    'cache-control': 'no-store'
+                }
+            });
+        if (term.length < MIN_TERM_LENGTH) {
+            return answer({
+                term,
+                groups: [],
+                unavailable: []
+            });
+        }
+        const limit = clampLimit(params.get(SEARCH_LIMIT_PARAM), defaultLimit);
+        const outcomes = await Promise.all(selected.map((source)=>runSource(source, term, limit, token, timeoutMs)));
+        return answer({
+            term,
+            // Declared order, never completion order — otherwise the list reshuffles
+            // with the network and nobody can learn where anything lands.
+            groups: outcomes.flatMap((outcome)=>outcome.ok ? [
+                    outcome.group
+                ] : []),
+            unavailable: outcomes.flatMap((outcome)=>outcome.ok ? [] : [
+                    outcome.unavailable
+                ])
+        });
+    };
+};
+
+//# sourceMappingURL=record-search-route.js.map

package/dist/lib/search/record-search-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/search/record-search-route.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\n\nimport { bearerHeader, sessionToken } from '../session/bearer.js';\nimport type {\n  RecordSearchGroup,\n  RecordSearchResponse,\n  RecordSearchUnavailable,\n  RecordSearchUnavailableReason,\n} from './record-search.types.js';\nimport type { RecordSearchSource } from './record-search-source.js';\n\nexport const SEARCH_TERM_PARAM = 'q';\nexport const SEARCH_SOURCES_PARAM = 'sources';\nexport const SEARCH_LIMIT_PARAM = 'limit';\n\n/**\n * Below this, nothing is queried at all.\n *\n * A `like` becomes an unanchored, case-insensitive `$regex`, which no index can\n * serve — so this endpoint is a collection scan by construction. One character\n * matches most of every collection and is worth nothing to the person typing, so\n * the floor costs them nothing and saves four scans per keystroke.\n */\nexport const MIN_TERM_LENGTH = 2;\nexport const DEFAULT_GROUP_LIMIT = 5;\nexport const MAX_GROUP_LIMIT = 20;\nexport const DEFAULT_SOURCE_TIMEOUT_MS = 1_500;\n\n/** Upstream statuses that mean something other than \"we could not reach it\". */\nconst REASON_FOR_STATUS: Readonly<\n  Record<number, RecordSearchUnavailableReason>\n> = {\n  400: 'invalidQuery',\n  401: 'unauthenticated',\n  403: 'forbidden',\n  404: 'notFound',\n  409: 'noActiveOrganization',\n};\n\nexport interface RecordSearchRouteOptions {\n  /**\n   * The sources to fan out over, **in the order results are presented**. That\n   * order is the ranking: an operator learns where a kind of record lands, which\n   * a relevance score across four unrelated entities cannot offer.\n   */\n  readonly sources: readonly RecordSearchSource[];\n  /** Per-source budget. Concurrent, so this also bounds the whole request. */\n  readonly timeoutMs?: number;\n  /** Records per group. */\n  readonly limit?: number;\n}\n\ntype SourceOutcome =\n  | { readonly ok: true; readonly group: RecordSearchGroup }\n  | { readonly ok: false; readonly unavailable: RecordSearchUnavailable };\n\nconst unavailable = (\n  source: RecordSearchSource,\n  reason: RecordSearchUnavailableReason,\n  status?: number,\n): SourceOutcome => ({\n  ok: false,\n  unavailable: {\n    source: source.key,\n    entity: source.entity,\n    reason,\n    ...(status === undefined ? {} : { status }),\n  },\n});\n\n/**\n * Ask one source, and **never reject**.\n *\n * Returning a typed outcome rather than throwing is what makes the fan-out a\n * plain `Promise.all`: isolation comes from this catch, not from\n * `allSettled` — whose rejected arm would then be unreachable and untestable.\n */\nconst runSource = async (\n  source: RecordSearchSource,\n  term: string,\n  limit: number,\n  token: string | undefined,\n  timeoutMs: number,\n): Promise<SourceOutcome> => {\n  let upstream: Response;\n  try {\n    upstream = await fetch(source.url(term, limit), {\n      headers: bearerHeader(token),\n      cache: 'no-store',\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n  } catch (error) {\n    // `AbortSignal.timeout` rejects with a `DOMException` named `TimeoutError`;\n    // branching on the name rather than the class keeps this reachable from a\n    // test without fabricating a platform error.\n    return unavailable(\n      source,\n      (error as { name?: string }).name === 'TimeoutError'\n        ? 'timeout'\n        : 'network',\n    );\n  }\n\n  if (!upstream.ok) {\n    return unavailable(\n      source,\n      REASON_FOR_STATUS[upstream.status] ?? 'unexpected',\n      upstream.status,\n    );\n  }\n\n  const body = await upstream.json().catch(() => undefined);\n  const page = source.read(body);\n  return page === undefined\n    ? unavailable(source, 'unexpected', upstream.status)\n    : {\n        ok: true,\n        group: {\n          source: source.key,\n          entity: source.entity,\n          labelKey: source.labelKey,\n          items: page.items,\n          total: page.total,\n        },\n      };\n};\n\nconst clampLimit = (raw: string | null, fallback: number): number => {\n  const asked = Number(raw);\n  if (!Number.isInteger(asked) || asked < 1) return fallback;\n  return Math.min(asked, MAX_GROUP_LIMIT);\n};\n\n/**\n * `GET /api/search` — records matching a term, across every source this host\n * mounts (ADR 0040).\n *\n * The caller's own session is the only credential that crosses: each source is\n * asked over the same guarded route its screens use, so what comes back is\n * already authorized for this principal and this organization. There is no\n * index, and there must never be one — a prefetched index is a tenant leak, and\n * it is the reason this is a fan-out rather than a search service.\n *\n * A source that fails is **named** in `unavailable` rather than dropped. An\n * absent group renders as \"no matches\", which is a confident claim the server is\n * in no position to make about a service it could not reach.\n */\nexport const createRecordSearchRoute = ({\n  sources,\n  timeoutMs = DEFAULT_SOURCE_TIMEOUT_MS,\n  limit: defaultLimit = DEFAULT_GROUP_LIMIT,\n}: RecordSearchRouteOptions) => {\n  const byKey = new Map(sources.map(source => [source.key, source]));\n\n  return async function GET(request: Request): Promise<Response> {\n    // The services decide what this caller may read; this only carries the\n    // token. But the gate is not redundant: `catalog-reference` reads are\n    // unauthenticated at the service by design, so without it a signed-out\n    // caller gets brand matches back and the answer reads as a real search —\n    // and the endpoint becomes an anonymous amplifier against that service.\n    const token = await sessionToken();\n    if (token === undefined) {\n      return NextResponse.json(\n        { error: 'unauthenticated', code: 'unauthenticated' },\n        { status: 401 },\n      );\n    }\n\n    const params = new URL(request.url).searchParams;\n\n    const asked = (params.get(SEARCH_SOURCES_PARAM) ?? '')\n      .split(',')\n      .filter(name => name !== '');\n    const unknown = asked.find(name => !byKey.has(name));\n    if (unknown !== undefined) {\n      // Loud rather than ignored: no keystroke can produce this, only a caller\n      // naming a source that does not exist — and silently searching everything\n      // instead would answer a question nobody asked.\n      return NextResponse.json(\n        {\n          error: 'invalid query',\n          code: 'invalidQuery',\n          detail: `unknown search source \"${unknown}\"`,\n        },\n        { status: 400 },\n      );\n    }\n    const selected =\n      asked.length === 0\n        ? sources\n        : sources.filter(source => asked.includes(source.key));\n\n    const term = (params.get(SEARCH_TERM_PARAM) ?? '').trim();\n    const answer = (body: RecordSearchResponse) =>\n      // The body is scoped to one principal and one organization. `no-store` is\n      // correctness here, not tuning.\n      NextResponse.json(body, { headers: { 'cache-control': 'no-store' } });\n\n    if (term.length < MIN_TERM_LENGTH) {\n      return answer({ term, groups: [], unavailable: [] });\n    }\n\n    const limit = clampLimit(params.get(SEARCH_LIMIT_PARAM), defaultLimit);\n    const outcomes = await Promise.all(\n      selected.map(source => runSource(source, term, limit, token, timeoutMs)),\n    );\n\n    return answer({\n      term,\n      // Declared order, never completion order — otherwise the list reshuffles\n      // with the network and nobody can learn where anything lands.\n      groups: outcomes.flatMap(outcome => (outcome.ok ? [outcome.group] : [])),\n      unavailable: outcomes.flatMap(outcome =>\n        outcome.ok ? [] : [outcome.unavailable],\n      ),\n    });\n  };\n};\n"],"names":["NextResponse","bearerHeader","sessionToken","SEARCH_TERM_PARAM","SEARCH_SOURCES_PARAM","SEARCH_LIMIT_PARAM","MIN_TERM_LENGTH","DEFAULT_GROUP_LIMIT","MAX_GROUP_LIMIT","DEFAULT_SOURCE_TIMEOUT_MS","REASON_FOR_STATUS","unavailable","source","reason","status","ok","key","entity","undefined","runSource","term","limit","token","timeoutMs","upstream","fetch","url","headers","cache","signal","AbortSignal","timeout","error","name","body","json","catch","page","read","group","labelKey","items","total","clampLimit","raw","fallback","asked","Number","isInteger","Math","min","createRecordSearchRoute","sources","defaultLimit","byKey","Map","map","GET","request","params","code","URL","searchParams","get","split","filter","unknown","find","has","detail","selected","length","includes","trim","answer","groups","outcomes","Promise","all","flatMap","outcome"],"mappings":";AAAA,SAASA,YAAY,QAAQ,cAAc;AAE3C,SAASC,YAAY,EAAEC,YAAY,QAAQ,uBAAuB;AASlE,OAAO,MAAMC,oBAAoB,IAAI;AACrC,OAAO,MAAMC,uBAAuB,UAAU;AAC9C,OAAO,MAAMC,qBAAqB,QAAQ;AAE1C;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAAkB,EAAE;AACjC,OAAO,MAAMC,sBAAsB,EAAE;AACrC,OAAO,MAAMC,kBAAkB,GAAG;AAClC,OAAO,MAAMC,4BAA4B,KAAM;AAE/C,8EAA8E,GAC9E,MAAMC,oBAEF;IACF,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACP;AAmBA,MAAMC,cAAc,CAClBC,QACAC,QACAC,SACmB,CAAA;QACnBC,IAAI;QACJJ,aAAa;YACXC,QAAQA,OAAOI,GAAG;YAClBC,QAAQL,OAAOK,MAAM;YACrBJ;WACIC,WAAWI,YAAY,CAAC,IAAI;YAAEJ;QAAO;IAE7C,CAAA;AAEA;;;;;;CAMC,GACD,MAAMK,YAAY,OAChBP,QACAQ,MACAC,OACAC,OACAC;IAEA,IAAIC;IACJ,IAAI;QACFA,WAAW,MAAMC,MAAMb,OAAOc,GAAG,CAACN,MAAMC,QAAQ;YAC9CM,SAAS1B,aAAaqB;YACtBM,OAAO;YACPC,QAAQC,YAAYC,OAAO,CAACR;QAC9B;IACF,EAAE,OAAOS,OAAO;QACd,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7C,OAAOrB,YACLC,QACA,AAACoB,MAA4BC,IAAI,KAAK,iBAClC,YACA;IAER;IAEA,IAAI,CAACT,SAAST,EAAE,EAAE;YAGdL;QAFF,OAAOC,YACLC,SACAF,qCAAAA,iBAAiB,CAACc,SAASV,MAAM,CAAC,YAAlCJ,qCAAsC,cACtCc,SAASV,MAAM;IAEnB;IAEA,MAAMoB,OAAO,MAAMV,SAASW,IAAI,GAAGC,KAAK,CAAC,IAAMlB;IAC/C,MAAMmB,OAAOzB,OAAO0B,IAAI,CAACJ;IACzB,OAAOG,SAASnB,YACZP,YAAYC,QAAQ,cAAcY,SAASV,MAAM,IACjD;QACEC,IAAI;QACJwB,OAAO;YACL3B,QAAQA,OAAOI,GAAG;YAClBC,QAAQL,OAAOK,MAAM;YACrBuB,UAAU5B,OAAO4B,QAAQ;YACzBC,OAAOJ,KAAKI,KAAK;YACjBC,OAAOL,KAAKK,KAAK;QACnB;IACF;AACN;AAEA,MAAMC,aAAa,CAACC,KAAoBC;IACtC,MAAMC,QAAQC,OAAOH;IACrB,IAAI,CAACG,OAAOC,SAAS,CAACF,UAAUA,QAAQ,GAAG,OAAOD;IAClD,OAAOI,KAAKC,GAAG,CAACJ,OAAOtC;AACzB;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAM2C,0BAA0B,CAAC,EACtCC,OAAO,EACP7B,YAAYd,yBAAyB,EACrCY,OAAOgC,eAAe9C,mBAAmB,EAChB;IACzB,MAAM+C,QAAQ,IAAIC,IAAIH,QAAQI,GAAG,CAAC5C,CAAAA,SAAU;YAACA,OAAOI,GAAG;YAAEJ;SAAO;IAEhE,OAAO,eAAe6C,IAAIC,OAAgB;YAgBzBC,aAsBDA;QArCd,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,MAAMrC,QAAQ,MAAMpB;QACpB,IAAIoB,UAAUJ,WAAW;YACvB,OAAOlB,aAAamC,IAAI,CACtB;gBAAEH,OAAO;gBAAmB4B,MAAM;YAAkB,GACpD;gBAAE9C,QAAQ;YAAI;QAElB;QAEA,MAAM6C,SAAS,IAAIE,IAAIH,QAAQhC,GAAG,EAAEoC,YAAY;QAEhD,MAAMhB,QAAQ,EAACa,cAAAA,OAAOI,GAAG,CAAC3D,iCAAXuD,cAAoC,IAChDK,KAAK,CAAC,KACNC,MAAM,CAAChC,CAAAA,OAAQA,SAAS;QAC3B,MAAMiC,UAAUpB,MAAMqB,IAAI,CAAClC,CAAAA,OAAQ,CAACqB,MAAMc,GAAG,CAACnC;QAC9C,IAAIiC,YAAYhD,WAAW;YACzB,yEAAyE;YACzE,0EAA0E;YAC1E,gDAAgD;YAChD,OAAOlB,aAAamC,IAAI,CACtB;gBACEH,OAAO;gBACP4B,MAAM;gBACNS,QAAQ,CAAC,uBAAuB,EAAEH,QAAQ,CAAC,CAAC;YAC9C,GACA;gBAAEpD,QAAQ;YAAI;QAElB;QACA,MAAMwD,WACJxB,MAAMyB,MAAM,KAAK,IACbnB,UACAA,QAAQa,MAAM,CAACrD,CAAAA,SAAUkC,MAAM0B,QAAQ,CAAC5D,OAAOI,GAAG;QAExD,MAAMI,OAAO,EAACuC,eAAAA,OAAOI,GAAG,CAAC5D,8BAAXwD,eAAiC,IAAIc,IAAI;QACvD,MAAMC,SAAS,CAACxC,OACd,0EAA0E;YAC1E,gCAAgC;YAChClC,aAAamC,IAAI,CAACD,MAAM;gBAAEP,SAAS;oBAAE,iBAAiB;gBAAW;YAAE;QAErE,IAAIP,KAAKmD,MAAM,GAAGjE,iBAAiB;YACjC,OAAOoE,OAAO;gBAAEtD;gBAAMuD,QAAQ,EAAE;gBAAEhE,aAAa,EAAE;YAAC;QACpD;QAEA,MAAMU,QAAQsB,WAAWgB,OAAOI,GAAG,CAAC1D,qBAAqBgD;QACzD,MAAMuB,WAAW,MAAMC,QAAQC,GAAG,CAChCR,SAASd,GAAG,CAAC5C,CAAAA,SAAUO,UAAUP,QAAQQ,MAAMC,OAAOC,OAAOC;QAG/D,OAAOmD,OAAO;YACZtD;YACA,yEAAyE;YACzE,8DAA8D;YAC9DuD,QAAQC,SAASG,OAAO,CAACC,CAAAA,UAAYA,QAAQjE,EAAE,GAAG;oBAACiE,QAAQzC,KAAK;iBAAC,GAAG,EAAE;YACtE5B,aAAaiE,SAASG,OAAO,CAACC,CAAAA,UAC5BA,QAAQjE,EAAE,GAAG,EAAE,GAAG;oBAACiE,QAAQrE,WAAW;iBAAC;QAE3C;IACF;AACF,EAAE"}

package/dist/lib/search/record-search-source.d.ts

@@ -0,0 +1,59 @@
+import { type Entity, type EntityConstructor } from '@entifix/core';
+import type { RecordSearchOption } from './record-search.types.js';
+/**
+ * What a host declares in order to make one entity searchable from the palette
+ * (ADR 0040).
+ *
+ * The search and label members are **declared**, not derived, and that is not an
+ * oversight in the metadata: `linkSearchProperty`/`linkLabelProperty` are
+ * properties of a *referring* accessor — they say how the owner of a relation
+ * looks up its target — and an entity has no member that says "this is what I am
+ * called". So the host that mounts the screens says it, next to the route those
+ * screens live at.
+ */
+export interface RecordSearchSourceConfig<TEntity extends Entity> {
+    /** Stable id, unique per host. Defaults to the entity's wire name. */
+    readonly key?: string;
+    readonly entityConstructor: EntityConstructor<TEntity>;
+    /** Where the owning service listens, **without** the `/api` suffix. */
+    readonly baseUrl: string;
+    /** The `filterable` string member a term is matched against with `like`. */
+    readonly searchProperty: string;
+    /** The `sortable` member read as a record's label. */
+    readonly labelProperty: string;
+    /** An optional secondary line — a code, a role. */
+    readonly sublabelProperty?: string;
+    /** The group heading, as the entity's own `pluralKey`. */
+    readonly labelKey: string;
+    /** Where selecting a record lands. Locale-free; the caller prefixes it. */
+    readonly href: (id: string) => string;
+}
+/** A declared source, reduced to what the fan-out actually calls. */
+export interface RecordSearchSource {
+    readonly key: string;
+    readonly entity: string;
+    readonly labelKey: string;
+    /** The upstream URL for one term. */
+    readonly url: (term: string, limit: number) => string;
+    /** `undefined` when the body is not a readable `entityPage` envelope. */
+    readonly read: (body: unknown) => {
+        items: RecordSearchOption[];
+        total: number;
+    } | undefined;
+}
+/**
+ * Declare a record search source, validating it against the entity's own
+ * metadata **now** rather than on the first keystroke.
+ *
+ * Every check here guards a failure that is otherwise silent at both ends: the
+ * service answers `400`, and a caller renders that as a group it could not
+ * reach — which reads as "there are no products". `assertSearchable` took the
+ * same posture for the relation picker, for the same reason.
+ *
+ * ⚠️ This throws at **module load**, so a bad declaration fails the whole app at
+ * boot rather than just search. That is deliberate — a source silently missing
+ * from a palette is indistinguishable from a permission the caller lacks — but
+ * the blast radius is wider than the picker's, which fails only its own render.
+ */
+export declare const defineRecordSearchSource: <TEntity extends Entity>({ key, entityConstructor, baseUrl, searchProperty, labelProperty, sublabelProperty, labelKey, href, }: RecordSearchSourceConfig<TEntity>) => RecordSearchSource;
+//# sourceMappingURL=record-search-source.d.ts.map

package/dist/lib/search/record-search-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-search-source.d.ts","sourceRoot":"","sources":["../../../src/lib/search/record-search-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,iBAAiB,EAMvB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB,CAAC,OAAO,SAAS,MAAM;IAC9D,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC;AAED,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACtD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,CACb,IAAI,EAAE,OAAO,KACV;QAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACjE;AAoBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,SAAS,MAAM,EAAE,uGAS9D,wBAAwB,CAAC,OAAO,CAAC,KAAG,kBAiItC,CAAC"}

package/dist/lib/search/record-search-source.js

@@ -0,0 +1,118 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { describeEntityColumns, EntifixLogicError, envelopeEntityName, readEntityPageEnvelope, serializeLoadRequestParams } from '@entifix/core';
+import { Effect, Exit } from 'effect';
+const descriptorOf = (columns, name)=>columns.find((column)=>column.name === name);
+const rejection = (entityName, member, because, fix)=>new EntifixLogicError(`Cannot search ${entityName} by "${member}": ${because} ${fix}`, undefined, {
+        entity: entityName,
+        member
+    });
+/**
+ * Declare a record search source, validating it against the entity's own
+ * metadata **now** rather than on the first keystroke.
+ *
+ * Every check here guards a failure that is otherwise silent at both ends: the
+ * service answers `400`, and a caller renders that as a group it could not
+ * reach — which reads as "there are no products". `assertSearchable` took the
+ * same posture for the relation picker, for the same reason.
+ *
+ * ⚠️ This throws at **module load**, so a bad declaration fails the whole app at
+ * boot rather than just search. That is deliberate — a source silently missing
+ * from a palette is indistinguishable from a permission the caller lacks — but
+ * the blast radius is wider than the picker's, which fails only its own render.
+ */ export const defineRecordSearchSource = ({ key, entityConstructor, baseUrl, searchProperty, labelProperty, sublabelProperty, labelKey, href })=>{
+    const entity = envelopeEntityName(entityConstructor);
+    const entityName = entityConstructor.name;
+    const columns = describeEntityColumns(entityConstructor);
+    const search = descriptorOf(columns, searchProperty);
+    if (search === undefined) {
+        throw rejection(entityName, searchProperty, 'the entity declares no such member.', 'Name a member the entity actually has.');
+    }
+    // `filterable` is simultaneously the server-side RSQL allowlist.
+    if (!search.filterable) {
+        throw rejection(entityName, searchProperty, 'the member is not filterable, so the service would reject the query.', 'Declare it `filterable` on the entity, or search another member.');
+    }
+    // A `like` against anything else reaches `coerceValue`, which rejects a
+    // partial term — so an enum member reads as declarable and is permanently
+    // broken: every keystroke short of a whole value answers `400`.
+    if (search.type !== 'string') {
+        throw rejection(entityName, searchProperty, `the member is a ${search.type}, and a partial term is not a valid value for it.`, 'Search a string member instead.');
+    }
+    const label = descriptorOf(columns, labelProperty);
+    if (label === undefined) {
+        throw rejection(entityName, labelProperty, 'the entity declares no such label member.', 'Name a member the entity actually has.');
+    }
+    // The group is sorted by the label, so the flag is load-bearing: without it
+    // the service rejects the sort and the group degrades whole. Unsorted was the
+    // alternative and is worse — the services apply no default order, so results
+    // would arrive in storage order and shuffle as records are rewritten.
+    if (!label.sortable) {
+        throw rejection(entityName, labelProperty, 'the label member is not sortable, so the service would reject the sort.', 'Declare it `sortable` on the entity, or label records by another member.');
+    }
+    let sublabel;
+    if (sublabelProperty !== undefined) {
+        sublabel = descriptorOf(columns, sublabelProperty);
+        if (sublabel === undefined) {
+            throw rejection(entityName, sublabelProperty, 'the entity declares no such sublabel member.', 'Name a member the entity actually has, or drop `sublabelProperty`.');
+        }
+    }
+    const read = (body)=>{
+        const page = Effect.runSyncExit(readEntityPageEnvelope(entityConstructor, body));
+        if (Exit.isFailure(page)) return undefined;
+        const items = page.value.items.filter((record)=>record.id != null).map((record)=>{
+            const row = record;
+            const raw = row[labelProperty];
+            const id = String(record.id);
+            return _extends({
+                id,
+                // A blank label is as useless as a missing one, so both fall back to
+                // the id — an unnamed record must stay distinguishable from the one
+                // above it. Same rule the relation picker's `labelOf` applies.
+                label: raw == null || raw === '' ? id : String(raw)
+            }, sublabel !== undefined && row[sublabel.name] != null ? {
+                sublabel: String(row[sublabel.name])
+            } : {}, {
+                entity,
+                href: href(id)
+            });
+        });
+        return {
+            items,
+            total: page.value.total
+        };
+    };
+    return {
+        key: key != null ? key : entity,
+        entity,
+        labelKey,
+        /**
+     * Built through `serializeLoadRequestParams`, never by hand. That is
+     * correctness rather than tidiness: `encodeRsqlValue` quotes a term carrying
+     * any of `;,()'"=!<>\` or whitespace, so `Acme, Inc.` stays one value
+     * instead of splitting the expression into two comparisons.
+     */ url: (term, limit)=>{
+            const request = {
+                filtering: [
+                    {
+                        property: search.key,
+                        operator: 'like',
+                        value: term
+                    }
+                ],
+                sorting: [
+                    {
+                        0: {
+                            property: label.key,
+                            type: 'asc'
+                        }
+                    }
+                ],
+                page: 1,
+                pageSize: limit
+            };
+            return `${baseUrl}/api/${entity}?${serializeLoadRequestParams(request).toString()}`;
+        },
+        read
+    };
+};
+
+//# sourceMappingURL=record-search-source.js.map