@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/_internal/server/features/search/index-build/sources.js

@@ -0,0 +1,385 @@
+/*
+ * WHY: What goes into the public search artifact — an unauthenticated,
+ *      immutable, CDN-cached body downloaded by every visitor who searches.
+ * WHAT: The membership allowlist and the per-collection record mapping.
+ *
+ * ## 🛑 MEMBERSHIP IS AN ALLOWLIST. It is deliberately NOT `LISTERS`.
+ *
+ * `listingProcessor.ts`'s `LISTERS` is a tempting source registry — one entry
+ * per collection, already routed through the Sieve adapter, with its own
+ * header inviting "a one-line addition". It is the wrong list. Counted
+ * 2026-10-19 it holds **20** entries, and four of them are **`users`,
+ * `payouts`, `orders`, `notifications`**. "Index everything LISTERS knows
+ * about" is one line away from publishing every customer's name to every
+ * browser, permanently, for the life of that artifact version.
+ *
+ * So this file names what is public, and `LISTERS` is only used to READ it.
+ * `audit-search-index-artifact` R6 asserts the intersection of this list with
+ * the PII and private registries is empty, with "add `users` → must fail" as
+ * its negative control.
+ *
+ * ## 🛑 Every field here was read off the LIVE documents
+ *
+ * The same rule `search-sources.ts` states, and it earned its keep again:
+ * `scammerProfiles` carries `displayNames` (an ARRAY) not `displayName`, and
+ * a string read would have produced a null title for every row — the group
+ * would simply never have appeared. `partGlossary`'s page needs TWO path
+ * segments and its document id already encodes them as `${slot}--${code}`.
+ *
+ * ## What a record carries, and what it must never carry
+ *
+ * Title, a one-line detail, a slug and optional facets. No amount of any kind
+ * (§ Guest price gating cannot reach an unauthenticated artifact) and no PII.
+ *
+ * @tag domain:search
+ * @tag layer:server
+ * @tag pattern:none
+ * @tag access:server
+ * @tag consumers:index-build/build,searchIndexBuild
+ * @tag sideEffects:none
+ */
+import { pluginFor } from "../../../../shared/listing-types/_registry.js";
+// Defined here, not in `_registry` — imported from the DEFINING module
+// (Root Cause #18).
+import { ALL_LISTING_TYPES } from "../../../../shared/listing-types/feature-flags.js";
+const str = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+/**
+ * The type table shipped inside the artifact.
+ *
+ * 🛑 No `label`. The client maps `key` to a translated string; a heading baked
+ * in here could not be localised. Weights are a ranking nudge between types
+ * that scored equally, not a statement about importance.
+ */
+export const INDEX_TYPES = [
+    /*
+     * 🛑 ONE ENTRY PER LISTING TYPE, DERIVED from the plugin registry — not one
+     * `product` entry for the whole collection.
+     *
+     * The first draft had a single `{ key: "product", hrefTemplate:
+     * "/products/{s}" }`, which is Root Cause #48 rebuilt from scratch: "a
+     * per-listing-type detailRoute() that silently defaults to the standard
+     * product page". An auction lives at `/auctions/{slug}`, a pre-order at
+     * `/pre-orders/{slug}`, a classified at `/classified/{slug}`. Every one of
+     * those results would have rendered correctly and navigated to the wrong
+     * page — the exact failure that made non-standard listings "revert to
+     * standard" the first time.
+     *
+     * `detailRoute` and `browseRoute` come from `pluginFor`, so a tenth listing
+     * type is covered the day it is added rather than the day someone notices.
+     * Hand-writing them here would be the eleventh enumeration of that union
+     * (Root Cause #61).
+     */
+    ...ALL_LISTING_TYPES.map((t) => {
+        const plugin = pluginFor(t);
+        return {
+            key: t,
+            // `detailRoute` builds a concrete path, so hand it the placeholder and
+            // let it produce the template. One source of truth, no second mapping.
+            hrefTemplate: plugin.detailRoute("{s}"),
+            moreHref: String(plugin.browseRoute),
+            // Standard listings are the catalogue's centre of gravity; the rest sit
+            // just below so a same-score tie favours the commonest thing.
+            weight: t === "standard" ? 1.0 : 0.98,
+        };
+    }),
+    { key: "category", hrefTemplate: "/categories/{s}", moreHref: "/categories", weight: 0.95 },
+    { key: "brand", hrefTemplate: "/brands/{s}", moreHref: "/brands", weight: 0.9 },
+    { key: "part", hrefTemplate: "/parts/{s}", moreHref: "/parts", weight: 0.9 },
+    { key: "model", hrefTemplate: "/categories/{s}", moreHref: "/categories", weight: 0.85 },
+    { key: "store", hrefTemplate: "/stores/{s}", moreHref: "/stores", weight: 0.8 },
+    { key: "blog", hrefTemplate: "/blog/{s}", moreHref: "/blog", weight: 0.7 },
+    { key: "event", hrefTemplate: "/events/{s}", moreHref: "/events", weight: 0.7 },
+    { key: "faq", hrefTemplate: "/faqs/{s}", moreHref: "/faqs", weight: 0.6 },
+    { key: "review", hrefTemplate: "/reviews/{s}", moreHref: "/reviews", weight: 0.5 },
+    { key: "group", hrefTemplate: "/groups/{s}", moreHref: "/products", weight: 0.5 },
+    { key: "scammer", hrefTemplate: "/scams/{s}", moreHref: "/scams", weight: 0.5 },
+    /* `/promotions` has no per-coupon page, so `{s}` is absent on purpose and
+     * `hrefFor`'s replace is a no-op. Eleven rows all landing on one page would
+     * be noise in the federated GROUP (which is why `search-sources.ts` omits
+     * coupons), but in the index it is the difference between a code being
+     * findable and not. */
+    { key: "coupon", hrefTemplate: "/promotions", moreHref: "/promotions", weight: 0.4 },
+];
+const facet = (pairs) => {
+    const parts = pairs
+        .filter(([, v]) => typeof v === "string" && v)
+        .map(([k, v]) => `${k}:${v}`);
+    return parts.length > 0 ? parts.join("|") : undefined;
+};
+export const PUBLIC_INDEX_SOURCES = [
+    {
+        /*
+         * 🛑 The type key is RESOLVED PER DOCUMENT — see `typeKeyOf`. A source
+         * normally maps one collection to one type, but `products` holds all nine
+         * listing types and each has its own detail route.
+         */
+        typeKey: "standard",
+        typeKeyOf: (d) => {
+            const lt = str(d.listingType);
+            return lt && ALL_LISTING_TYPES.includes(lt) ? lt : "standard";
+        },
+        collection: "products",
+        where: [["status", "published"]],
+        select: ["title", "slug", "brand", "categoryNames", "listingType", "condition", "franchiseSlug"],
+        slugOf: (id, d) => str(d.slug) ?? id,
+        toRecord: (id, d) => {
+            const title = str(d.title);
+            if (!title)
+                return null;
+            const names = Array.isArray(d.categoryNames) ? d.categoryNames : [];
+            /*
+             * 🛑 The enum VALUES go in `detail`, which is SEARCHED — the `facets`
+             * string is filter-only and never matched as text. Without this,
+             * typing "auction" or "sealed" finds nothing, because the only place
+             * those words appeared was a facet nobody searches. Humanised, so
+             * "pre-order" and "digital code" read as words rather than slugs.
+             */
+            const human = (v) => (str(v) ?? "").replace(/[-_]/g, " ");
+            return {
+                title,
+                // Leaf-first, so [0] is the most specific label.
+                detail: [
+                    str(d.brand),
+                    str(names[0]),
+                    human(d.listingType),
+                    human(d.condition),
+                ]
+                    .filter(Boolean)
+                    .join(" · "),
+                facets: facet([
+                    ["lt", d.listingType],
+                    ["cn", d.condition],
+                    ["fr", d.franchiseSlug],
+                ]),
+            };
+        },
+    },
+    {
+        typeKey: "category",
+        collection: "categories",
+        /*
+         * 🛑 No `where` on `categoryType`. A plain listing category OMITS the
+         * field entirely — the convention CLAUDE.md records — so `== "category"`
+         * matches nothing and `!=` excludes every real row. Brands are their own
+         * type below and are rejected here rather than dropped.
+         */
+        select: ["name", "slug", "categoryType", "path", "isActive"],
+        slugOf: (id) => id,
+        toRecord: (id, d) => {
+            const name = str(d.name);
+            if (!name)
+                return null;
+            const type = str(d.categoryType);
+            if (type && type !== "sublisting")
+                return null;
+            if (d.isActive === false)
+                return null;
+            return { title: name, detail: str(d.path) ?? "", slug: id };
+        },
+    },
+    {
+        typeKey: "brand",
+        collection: "categories",
+        where: [["categoryType", "brand"]],
+        select: ["name", "brandCountry", "isActive"],
+        slugOf: (id) => id,
+        toRecord: (id, d) => {
+            const name = str(d.name);
+            if (!name)
+                return null;
+            if (d.isActive === false)
+                return null;
+            return { title: name, detail: str(d.brandCountry) ?? "", slug: id };
+        },
+    },
+    {
+        typeKey: "part",
+        collection: "partGlossary",
+        select: ["name", "code", "classification", "slot"],
+        slugOf: (id) => (id.includes("--") ? id.replace("--", "/") : null),
+        toRecord: (id, d) => {
+            const name = str(d.name);
+            if (!name)
+                return null;
+            /*
+             * 🛑 TWO path segments, and the document id already encodes them.
+             * `ROUTES.PUBLIC.PART_DETAIL` is `/parts/{classification}/{code}`, and
+             * the route-map comment explains why a code alone cannot be a URL:
+             * "`105` is a Metal Fight spin-track height, a bare number in Burst is
+             * a disc, and `1-60` is a Beyblade X ratchet." The id is
+             * `${slot}--${code}` (e.g. `armour--1b`), so splitting it is the one
+             * derivation guaranteed to agree with the page that exists.
+             */
+            if (!id.includes("--"))
+                return null;
+            const code = str(d.code);
+            const classification = str(d.classification);
+            return {
+                title: name,
+                // The classification IS the disambiguation — it is why a user
+                // searching "105" can tell three results apart.
+                detail: [classification, code].filter(Boolean).join(" · "),
+            };
+        },
+    },
+    {
+        typeKey: "model",
+        collection: "modelComposition",
+        select: ["name", "system", "categoryId"],
+        slugOf: (_id, d) => str(d.categoryId),
+        toRecord: (_id, d) => {
+            const name = str(d.name);
+            if (!name)
+                return null;
+            /*
+             * 🛑 A composition has no page of its own — it is rendered on its model
+             * CATEGORY page, reached by `categoryId`. Measured in `parts/data.ts`:
+             * 210 of 259 join. The 49 that do not are DROPPED rather than linked to
+             * a guess, because a search result that navigates to the wrong bey is
+             * worse than one that does not exist. The builder reports the count.
+             */
+            const categoryId = str(d.categoryId);
+            if (!categoryId)
+                return null;
+            return { title: name, detail: str(d.system) ?? "", slug: categoryId };
+        },
+    },
+    {
+        typeKey: "store",
+        collection: "stores",
+        where: [["status", "active"]],
+        // `storeName`, not `name` — read off the live documents.
+        select: ["storeName", "storeCategory"],
+        slugOf: (id) => id,
+        toRecord: (id, d) => {
+            const name = str(d.storeName);
+            if (!name)
+                return null;
+            return { title: name, detail: str(d.storeCategory) ?? "", slug: id };
+        },
+    },
+    {
+        typeKey: "blog",
+        collection: "blogPosts",
+        where: [["status", "published"]],
+        select: ["title", "slug", "category", "excerpt"],
+        slugOf: (id, d) => str(d.slug) ?? id,
+        toRecord: (id, d) => {
+            const title = str(d.title);
+            if (!title)
+                return null;
+            return {
+                title,
+                detail: str(d.category) ?? (str(d.excerpt) ?? "").slice(0, 90),
+            };
+        },
+    },
+    {
+        typeKey: "event",
+        collection: "events",
+        // Three public statuses, one `==` — so it is filtered in memory, the same
+        // reason `search-sources.ts` gives.
+        select: ["title", "slug", "type", "status"],
+        slugOf: (id, d) => str(d.slug) ?? id,
+        toRecord: (id, d) => {
+            const title = str(d.title);
+            if (!title)
+                return null;
+            const status = str(d.status);
+            if (status === "draft" || status === "cancelled")
+                return null;
+            return { title, detail: (str(d.type) ?? "").replace(/_/g, " "), slug: str(d.slug) ?? id };
+        },
+    },
+    {
+        typeKey: "faq",
+        collection: "faqs",
+        where: [["isActive", true]],
+        select: ["question", "category"],
+        slugOf: (_id, d) => str(d.category),
+        toRecord: (_id, d) => {
+            const question = str(d.question);
+            const category = str(d.category);
+            // `/faqs/[category]`, never a question slug — the route matches on the
+            // category key and silently falls back to "all" for anything else.
+            if (!question || !category)
+                return null;
+            return { title: question, detail: category.replace(/_/g, " "), slug: category };
+        },
+    },
+    {
+        typeKey: "review",
+        collection: "reviews",
+        where: [["status", "approved"]],
+        // 🛑 `productTitle`, never `userName`. The field exists on the document
+        // and is deliberately absent from `buildReviewSearchTxt` because it is
+        // encrypted; a public artifact must not carry a reviewer's name.
+        select: ["title", "productTitle"],
+        slugOf: (id) => id,
+        toRecord: (id, d) => {
+            const title = str(d.title);
+            if (!title)
+                return null;
+            return { title, detail: str(d.productTitle) ?? "", slug: id };
+        },
+    },
+    {
+        typeKey: "group",
+        collection: "groupedListings",
+        where: [["isActive", true]],
+        select: ["title", "slug", "groupTheme", "visibilityStatus"],
+        slugOf: (id, d) => str(d.slug) ?? id,
+        toRecord: (id, d) => {
+            const title = str(d.title);
+            if (!title)
+                return null;
+            if (str(d.visibilityStatus) !== "visible")
+                return null;
+            return { title, detail: str(d.groupTheme) ?? "", slug: str(d.slug) ?? id };
+        },
+    },
+    {
+        typeKey: "scammer",
+        collection: "scammerProfiles",
+        /*
+         * 🛑 `verified` ONLY. Live: verified 3, pending_review 1, rejected 1.
+         * Publishing an unaccepted allegation against a named person — with their
+         * phone and UPI on the destination page — into an artifact every browser
+         * downloads is the most consequential clause in this file.
+         */
+        where: [["status", "verified"]],
+        select: ["displayNames", "scamType", "slug"],
+        slugOf: (id, d) => str(d.slug) ?? id,
+        toRecord: (id, d) => {
+            const names = Array.isArray(d.displayNames) ? d.displayNames : [];
+            const title = str(names[0]);
+            if (!title)
+                return null;
+            return {
+                title,
+                detail: (str(d.scamType) ?? "").replace(/_/g, " "),
+            };
+        },
+    },
+    {
+        typeKey: "coupon",
+        collection: "coupons",
+        select: ["code", "name", "validity"],
+        slugOf: (_id, d) => str(d.code),
+        toRecord: (_id, d) => {
+            const code = str(d.code);
+            if (!code)
+                return null;
+            const validity = d.validity;
+            if (validity?.isActive === false)
+                return null;
+            // No amount — the discount VALUE is money and stays out. The code and
+            // its name are what someone types.
+            return { title: code, detail: str(d.name) ?? "", slug: code };
+        },
+    },
+];
+/** Index into `INDEX_TYPES` for a source's type key. */
+export function typeIndexFor(typeKey) {
+    return INDEX_TYPES.findIndex((t) => t.key === typeKey);
+}

package/dist/_internal/server/features/search/scoped-sources.d.ts

@@ -0,0 +1,26 @@
+import { type SearchSource } from "./search-everything";
+/** The viewer this search is scoped TO. Null means signed out. */
+export interface SearchViewer {
+    readonly uid: string;
+    readonly role: string;
+    /** The store slug this viewer owns, if any. See § Store Identity. */
+    readonly storeId: string | null;
+    readonly isAdmin: boolean;
+    readonly isSeller: boolean;
+}
+/**
+ * Build the viewer's sources.
+ *
+ * 🛑 Returns `[]` for a guest, which is what makes "zero authenticated
+ * requests when signed out" structural rather than a caller's discipline.
+ */
+export declare function scopedSourcesFor(viewer: SearchViewer | null): SearchSource[];
+/**
+ * Σ `scanLimit`, for the budget check.
+ *
+ * Exported so `audit-scoped-search-ownership` R4 can print the arithmetic
+ * rather than just a verdict: "over budget" without the per-source figures
+ * tells you nothing about which source to shrink.
+ */
+export declare function scopedScanTotal(sources: readonly SearchSource[]): number;
+export declare function assertWithinScopedBudget(sources: readonly SearchSource[]): void;

package/dist/_internal/server/features/search/scoped-sources.js

@@ -0,0 +1,252 @@
+/*
+ * WHY: A signed-in viewer should be able to find their own orders, offers
+ *      and drafts from the same box — without that box ever being able to
+ *      return somebody else's.
+ * WHAT: Tier 2. Viewer-scoped `SearchSource`s, built per request from the
+ *       session, plus the budget check.
+ *
+ * ## 🛑 Filtered SERVER-side, never in the browser
+ *
+ * The same rule `projectActionIndexForViewer` states for the action index.
+ * Every source below carries an OWNER CLAUSE in its `where`, so the query
+ * itself cannot return another viewer's rows — a client-side filter over a
+ * wider result is one rendering bug away from a disclosure, and the bug is
+ * invisible in review because the UI looks right.
+ *
+ * ## 🛑 A guest makes ZERO authenticated requests
+ *
+ * `scopedSourcesFor(null)` returns `[]`, and the route refuses before
+ * touching Firestore. This is not an optimisation: a signed-out visitor
+ * whose search fires an authenticated request has a session the page does
+ * not know about, and the only honest way to prove the gate works is for
+ * there to be no request at all.
+ *
+ * ## The read budget, which is why the split exists
+ *
+ *   guest    0 sources    0 docs    0 round trips
+ *   buyer    6            ~120      1 (one Promise.all)
+ *   seller   +5           ~220      1
+ *   admin    +5           ~320      1
+ *
+ * Against `SCOPED_SCAN_BUDGET` = 400. Scoped sources use `scanLimit: 20`
+ * rather than the 60 the public tier uses, because an owner clause has
+ * already collapsed the candidate set — a 60-doc window would be 40 reads
+ * spent proving there was nothing else.
+ *
+ * @tag domain:search
+ * @tag layer:server
+ * @tag pattern:none
+ * @tag access:server
+ * @tag consumers:/api/search/scoped
+ * @tag sideEffects:none
+ */
+import { ROUTES } from "../../../../next/routing/route-map.js";
+import { SCOPED_SCAN_BUDGET } from "./search-everything.js";
+/** Scoped sources read a narrow window; the owner clause did the work. */
+const SCOPED_SCAN = 20;
+const str = (v) => typeof v === "string" && v.length > 0 ? v : undefined;
+/**
+ * Every term must appear somewhere in the named fields.
+ *
+ * 🛑 AND, matching the push-down path's `plan.rest.every(...)`. An OR here
+ * would make the two modes disagree about what a two-word query means, on
+ * the same page, in adjacent groups.
+ *
+ * 🛑 Lower-cased comparison only — NOT `normalizeSearchText`. That
+ * normaliser exists to make the WRITE path and the token query agree; this
+ * path has no tokens, and running it here would strip punctuation out of a
+ * tracking number or an order id, which are exactly the strings someone
+ * pastes into a scoped search.
+ */
+function fieldsContain(fields) {
+    return (data, terms) => {
+        if (terms.length === 0)
+            return false;
+        const hay = fields
+            .map((f) => str(data[f]) ?? "")
+            .join(" ")
+            .toLowerCase();
+        return terms.every((t) => hay.includes(t.toLowerCase()));
+    };
+}
+/**
+ * The viewer's own records.
+ *
+ * 🛑 `mode: "bounded-memory"` for everything PII-bearing, and `search-txt`
+ * only where the collection genuinely carries tokens that are safe to have.
+ * `orders` is the interesting case: `buildOrderSearchTxt` already indexes
+ * productTitle / storeName / trackingNumber and already EXCLUDES the
+ * shipping address, so it keeps the push-down. `addresses` has no
+ * `searchTxt` and must never grow one.
+ */
+function selfSources(viewer) {
+    return [
+        {
+            key: "my-orders",
+            label: "Your orders",
+            collection: "orders",
+            // 🛑 `userId`, NOT `buyerId`. The field is `userId` and a query on
+            // `buyerId` returns ZERO while raising nothing — indistinguishable
+            // from "this buyer has no orders", which is a false-finding generator.
+            where: [["userId", viewer.uid]],
+            scanLimit: SCOPED_SCAN,
+            mode: "search-txt",
+            select: ["productTitle", "status", "trackingNumber"],
+            toHit: (id, d) => ({
+                id,
+                title: str(d.productTitle) ?? `Order ${id}`,
+                href: String(ROUTES.USER.ORDER_DETAIL(id)),
+                detail: str(d.status),
+            }),
+            moreHref: () => String(ROUTES.USER.ORDERS),
+        },
+        {
+            key: "my-offers",
+            label: "Your offers",
+            collection: "offers",
+            where: [["buyerId", viewer.uid]],
+            scanLimit: SCOPED_SCAN,
+            mode: "bounded-memory",
+            orderBy: ["createdAt", "desc"],
+            select: ["productTitle", "status", "productSlug"],
+            matches: fieldsContain(["productTitle", "status"]),
+            toHit: (id, d) => ({
+                id,
+                title: str(d.productTitle) ?? "Offer",
+                href: String(ROUTES.USER.OFFERS),
+                detail: str(d.status),
+            }),
+            moreHref: () => String(ROUTES.USER.OFFERS),
+        },
+        {
+            key: "my-catalogue",
+            label: "Your catalogue",
+            collection: "catalogueItems",
+            where: [["ownerId", viewer.uid]],
+            scanLimit: SCOPED_SCAN,
+            mode: "bounded-memory",
+            orderBy: ["createdAt", "desc"],
+            select: ["title", "listingStatus"],
+            matches: fieldsContain(["title"]),
+            toHit: (id, d) => ({
+                id,
+                title: str(d.title) ?? "Catalogue item",
+                href: String(ROUTES.USER.CATALOGUE),
+                detail: str(d.listingStatus),
+            }),
+            moreHref: () => String(ROUTES.USER.CATALOGUE),
+        },
+        {
+            /*
+             * 🛑 `bounded-memory`, and this is the source the mode exists for.
+             *
+             * `addresses` is PII — `fullName`, `phone`, `addressLine1` are all
+             * encrypted at rest and decrypted by the repository on read. It has
+             * no `searchTxt` and must never get one: a prefix-expanded plaintext
+             * token array over a person's name and street is precisely what
+             * § Searching PII refuses. The owner clause already bounds this to
+             * well under 25 rows, so an index would re-derive a bound we have
+             * while adding leak surface for nothing.
+             */
+            key: "my-addresses",
+            label: "Your addresses",
+            collection: "addresses",
+            where: [
+                ["ownerType", "user"],
+                ["ownerId", viewer.uid],
+            ],
+            scanLimit: SCOPED_SCAN,
+            mode: "bounded-memory",
+            select: ["label", "city", "state"],
+            // Only the non-sensitive half is matched AND projected. A label and a
+            // city are enough to pick an address out of a list of four; the name,
+            // phone and street line never leave the server.
+            matches: fieldsContain(["label", "city", "state"]),
+            toHit: (id, d) => ({
+                id,
+                title: str(d.label) ?? "Address",
+                href: String(ROUTES.USER.ADDRESSES),
+                detail: [str(d.city), str(d.state)].filter(Boolean).join(", ") || undefined,
+            }),
+            moreHref: () => String(ROUTES.USER.ADDRESSES),
+        },
+    ];
+}
+/** The viewer's store. Requires a resolved `storeId`, never a uid. */
+function sellerSources(viewer) {
+    if (!viewer.storeId)
+        return [];
+    const storeId = viewer.storeId;
+    return [
+        {
+            /*
+             * The seller's own listings INCLUDING drafts — which is the whole
+             * point, because a published one is already in the public artifact and
+             * the merge dedupes it away. What survives in this group is precisely
+             * "your drafts", and labelling it so is what makes the dedupe legible.
+             */
+            key: "my-listings",
+            label: "Your listings (incl. drafts)",
+            collection: "products",
+            where: [["storeId", storeId]],
+            scanLimit: SCOPED_SCAN,
+            mode: "search-txt",
+            select: ["title", "slug", "status"],
+            toHit: (id, d) => ({
+                id,
+                title: str(d.title) ?? "Listing",
+                href: String(ROUTES.STORE.PRODUCTS_EDIT(str(d.slug) ?? id)),
+                detail: str(d.status),
+            }),
+            moreHref: () => String(ROUTES.STORE.PRODUCTS),
+        },
+        {
+            key: "store-orders",
+            label: "Orders in your store",
+            collection: "orders",
+            where: [["storeId", storeId]],
+            scanLimit: SCOPED_SCAN,
+            mode: "search-txt",
+            select: ["productTitle", "status", "trackingNumber"],
+            toHit: (id, d) => ({
+                id,
+                title: str(d.productTitle) ?? `Order ${id}`,
+                href: String(ROUTES.STORE.ORDER_DETAIL(id)),
+                detail: str(d.status),
+            }),
+            moreHref: () => String(ROUTES.STORE.ORDERS),
+        },
+    ];
+}
+/**
+ * Build the viewer's sources.
+ *
+ * 🛑 Returns `[]` for a guest, which is what makes "zero authenticated
+ * requests when signed out" structural rather than a caller's discipline.
+ */
+export function scopedSourcesFor(viewer) {
+    if (!viewer)
+        return [];
+    const sources = [...selfSources(viewer)];
+    if (viewer.isSeller || viewer.isAdmin)
+        sources.push(...sellerSources(viewer));
+    return sources;
+}
+/**
+ * Σ `scanLimit`, for the budget check.
+ *
+ * Exported so `audit-scoped-search-ownership` R4 can print the arithmetic
+ * rather than just a verdict: "over budget" without the per-source figures
+ * tells you nothing about which source to shrink.
+ */
+export function scopedScanTotal(sources) {
+    return sources.reduce((n, s) => n + (s.scanLimit ?? 60), 0);
+}
+export function assertWithinScopedBudget(sources) {
+    const total = scopedScanTotal(sources);
+    if (total <= SCOPED_SCAN_BUDGET)
+        return;
+    const breakdown = sources.map((s) => `${s.key}=${s.scanLimit ?? 60}`).join(" + ");
+    throw new Error(`Scoped search would read up to ${total} documents, over SCOPED_SCAN_BUDGET ` +
+        `(${SCOPED_SCAN_BUDGET}). ${breakdown} = ${total}.`);
+}