@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/_internal/server/features/search/search-everything.d.ts

@@ -43,7 +43,56 @@ export interface SearchSource {
     moreHref: (q: string) => string;
     /** Extra equality narrowing, e.g. `status == published`. */
     where?: ReadonlyArray<readonly [string, unknown]>;
+    /**
+     * The bounded window this source reads before the in-memory refine.
+     *
+     * Defaults to `SCAN` (60). Scoped sources pass 20: an owner clause
+     * (`userId == uid`) has already collapsed the candidate set, so a 60-doc
+     * window is 40 reads spent proving there was nothing else.
+     */
+    scanLimit?: number;
+    /**
+     * How this source FINDS rows. Discriminated so TypeScript forces every
+     * source to answer, which is what makes `audit-scoped-search-ownership`
+     * R2 checkable rather than advisory.
+     *
+     *   `search-txt`      the `array-contains` push-down. Requires the
+     *                     collection to carry `searchTxt`.
+     *   `bounded-memory`  read the owner's bounded window and filter in
+     *                     memory, with no token push-down at all.
+     *
+     * 🛑 A PII-bearing collection must be `bounded-memory`. `searchTxt` is
+     * plaintext, edge-n-gram-expanded and stored on the document — giving
+     * `addresses` a token push-down would write a prefix-expanded index over
+     * a person's name and street, which is the precise thing § Searching PII
+     * refuses (a 1-character prefix has 36 possible values; the frequency
+     * distribution unpicks from there). Decrypting a bounded owner-scoped
+     * window in memory re-derives a bound ownership already gives, and adds
+     * no leak surface.
+     */
+    mode?: "search-txt" | "bounded-memory";
+    /**
+     * For `bounded-memory`: does this row match? Receives the DECRYPTED
+     * document, so a repository that decrypts on read is the intended caller.
+     * Every term must match (AND), consistent with the push-down path.
+     */
+    matches?: (data: SearchDocData, terms: readonly string[]) => boolean;
+    /** Ordering for `bounded-memory`, since there is no token clause to sort by. */
+    orderBy?: readonly [string, "asc" | "desc"];
 }
+/**
+ * 🛑 The ceiling on what ONE viewer's scoped search may read.
+ *
+ * Σ `scanLimit` across the widest role, checked by
+ * `audit-scoped-search-ownership` R4 — which PRINTS THE ARITHMETIC on
+ * failure, because "the budget is exceeded" is useless without knowing by
+ * which source and how much.
+ *
+ * 400 against Rule #6's ~3-round-trip guidance is defensible because the
+ * sources run in ONE `Promise.all`: it is one round trip of fan-out, not
+ * twelve sequential ones. The number that matters is documents read.
+ */
+export declare const SCOPED_SCAN_BUDGET = 400;
 /** A projected Firestore document's fields. */
 export type SearchDocData = Record<string, FirestoreValue>;
 /** A projected document — the only shape this module reads. */
@@ -55,6 +104,14 @@ interface SearchQueryRef {
     where(field: string, op: string, value: unknown): SearchQueryRef;
     select(...fields: string[]): SearchQueryRef;
     limit(n: number): SearchQueryRef;
+    /**
+     * Only `bounded-memory` sources use this. The push-down path deliberately
+     * does not order: an `orderBy` beside an `array-contains` demands a
+     * composite index per source, and a missing one throws
+     * `FAILED_PRECONDITION` into the per-source catch, where it renders as an
+     * empty group — i.e. silently (Root Cause #59).
+     */
+    orderBy(field: string, direction: "asc" | "desc"): SearchQueryRef;
     get(): Promise<{
         docs: SearchDoc[];
     }>;

package/dist/_internal/server/features/search/search-everything.js

@@ -1,11 +1,21 @@
 /**
  * D2 Fix 4 — CROSS-RESOURCE search.
  *
- * 🛑 `/search` is a pure REDIRECT today: it maps each of 15
- * `SearchResourceType` values to a browse route and `redirect()`s, `noindex`.
- * So there is **no cross-resource search at all** — the dropdown picks which
- * single listing page to send you to, and a buyer searching "dranzer" cannot
- * see that we have a product, an auction, a blog post and an FAQ about it.
+ * 🛑 CORRECTED 2026-10-19 — this header asserted the opposite of the truth.
+ *
+ * It read: "`/search` is a pure REDIRECT today … there is no cross-resource
+ * search at all." That described the state this module was WRITTEN to fix,
+ * and it stayed on the file after the fix shipped — so the one document
+ * explaining the feature told every later reader the feature did not exist.
+ *
+ * What is true now: `/search` is a real grouped results page, the header
+ * reaches it, and this module is TIER 2 — the authenticated, server-side
+ * half. The public half is a prebuilt artifact searched in the browser at
+ * zero Firestore reads, and this one is what serves a viewer's OWN records
+ * (`scoped-sources.ts`) and what the kill switch falls back to when the
+ * artifact is unavailable.
+ *
+ * That fallback is the reason this file is not deleted.
  *
  * ── WHY THIS IS AFFORDABLE ─────────────────────────────────────────────────
  *
@@ -30,11 +40,15 @@
  *
  * ── 🛑 WHAT IT DOES NOT REUSE, AND WHY ─────────────────────────────────────
  *
- * NOT `SearchRepository`. That class builds `title_=${q}` — a case-sensitive
+ * NOT `SearchRepository`. That class built `title_=${q}` — a case-sensitive
  * STARTS-WITH on `title` alone — so "dranzer" would not find "Beyblade
- * Original Dranzer S" and "flat" would find nothing at all. It is reachable
- * only through `/api/search`, whose own hook (`useSearch`) has zero consumers
- * outside barrel re-exports. Recorded rather than deleted here; see F1.
+ * Original Dranzer S" and "flat" would find nothing at all. It was reachable
+ * only through `/api/search`, whose own hook (`useSearch`) had zero consumers
+ * outside barrel re-exports. The whole dead subsystem — `SearchRepository`,
+ * `/api/search`, `useSearch`, `SearchView`/`SearchFiltersRow`/
+ * `SearchResultsSection`, the legacy `search-actions.ts`/`data.ts`/
+ * `actions.ts` chain — was deleted in the Wave 10 cleanup, kept only as this
+ * historical note on why `searchEverything` never called it.
  */
 import { planSearchTxt } from "../../../../utils/search-txt-query.js";
 import { parseSearchTxtQuery, SEARCH_TXT_FIELD } from "../../../../utils/search-txt.js";
@@ -44,6 +58,19 @@ import { normalizeError } from "../../../../errors/normalize.js";
 const PER_GROUP = 6;
 /** The bounded window each push-down reads before the in-memory refine. */
 const SCAN = 60;
+/**
+ * 🛑 The ceiling on what ONE viewer's scoped search may read.
+ *
+ * Σ `scanLimit` across the widest role, checked by
+ * `audit-scoped-search-ownership` R4 — which PRINTS THE ARITHMETIC on
+ * failure, because "the budget is exceeded" is useless without knowing by
+ * which source and how much.
+ *
+ * 400 against Rule #6's ~3-round-trip guidance is defensible because the
+ * sources run in ONE `Promise.all`: it is one round trip of fan-out, not
+ * twelve sequential ones. The number that matters is documents read.
+ */
+export const SCOPED_SCAN_BUDGET = 400;
 /**
  * Run every source in parallel and group the results.
  *
@@ -75,20 +102,41 @@ export async function searchEverything(db, q, sources) {
             moreHref: src.moreHref(q),
         };
         try {
+            const scan = src.scanLimit ?? SCAN;
+            const boundedMemory = src.mode === "bounded-memory";
             let ref = db.collection(src.collection);
             for (const [field, value] of src.where ?? [])
                 ref = ref.where(field, "==", value);
-            const snap = await ref
-                .where(SEARCH_TXT_FIELD, "array-contains", plan.head)
-                .select(...src.select, SEARCH_TXT_FIELD)
-                .limit(SCAN)
-                .get();
+            /*
+             * 🛑 The two modes differ in ONE clause and in nothing else.
+             *
+             * `bounded-memory` omits the `array-contains` push-down and does not
+             * project `searchTxt` — because the collections that use it do not
+             * have one, deliberately (see `mode`). Everything downstream —
+             * `toHit`, the PER_GROUP slice, the `truncated` floor — is shared, so
+             * the two paths cannot drift in how they REPORT, only in how they
+             * find.
+             */
+            const snap = boundedMemory
+                ? await (src.orderBy
+                    ? ref.orderBy(src.orderBy[0], src.orderBy[1])
+                    : ref)
+                    .select(...src.select)
+                    .limit(scan)
+                    .get()
+                : await ref
+                    .where(SEARCH_TXT_FIELD, "array-contains", plan.head)
+                    .select(...src.select, SEARCH_TXT_FIELD)
+                    .limit(scan)
+                    .get();
             // AND-refine the remaining terms in memory — one push-down per query is
             // all Firestore gives, so the rest is a filter over a bounded window.
-            const matched = snap.docs.filter((d) => {
-                const txt = d.data()[SEARCH_TXT_FIELD] ?? [];
-                return plan.rest.every((t) => txt.includes(t));
-            });
+            const matched = boundedMemory
+                ? snap.docs.filter((d) => src.matches?.(d.data(), terms) ?? false)
+                : snap.docs.filter((d) => {
+                    const txt = d.data()[SEARCH_TXT_FIELD] ?? [];
+                    return plan.rest.every((t) => txt.includes(t));
+                });
             const hits = matched
                 .map((d) => src.toHit(d.id, d.data()))
                 .filter((h) => h !== null);
@@ -96,8 +144,10 @@ export async function searchEverything(db, q, sources) {
                 ...base,
                 hits: hits.slice(0, PER_GROUP),
                 // Saturated window OR more matches than we show — either way the
-                // count on screen is a floor.
-                truncated: snap.docs.length >= SCAN || hits.length > PER_GROUP,
+                // count on screen is a floor. Compared against THIS source's own
+                // limit, not the module default: a scoped source scanning 20 that
+                // returned 20 is saturated even though 20 < SCAN.
+                truncated: snap.docs.length >= scan || hits.length > PER_GROUP,
             };
         }
         catch (err) {

package/dist/_internal/server/features/search/search-sources.d.ts

@@ -1,17 +1,2 @@
-/**
- * D2 Fix 4 — which collections `/search` spans, and how each row becomes a hit.
- *
- * 🛑 SIX SOURCES, not fifteen. The redirect page maps 15 `SearchResourceType`
- * values, but nine of them are LISTING TYPES inside `products` — auctions,
- * pre-orders, prize-draws, classified, digital-codes, live, art, bundles. One
- * `products` query covers all of them, and a per-type query would be nine
- * fan-outs returning overlapping rows from one collection.
- *
- * 🛑 Every field here was read off the live documents, not assumed. `stores`
- * uses `storeName` (not `name`), `faqs` uses `question` + `seo.slug`, and
- * `categories` must be filtered to listing rows because brands and bundles
- * share the collection — the same trap that made the `/products` category
- * facet offer "Takara-Tomy" as a browsable category (A1 item 4).
- */
 import type { SearchSource } from "./search-everything";
 export declare const SEARCH_SOURCES: readonly SearchSource[];

package/dist/_internal/server/features/search/search-sources.js

@@ -1,3 +1,39 @@
+/**
+ * D2 Fix 4 — which collections `/search` spans, and how each row becomes a hit.
+ *
+ * 🛑 NINE SOURCES, not fifteen. The redirect page maps 15 `SearchResourceType`
+ * values, but nine of them are LISTING TYPES inside `products` — auctions,
+ * pre-orders, prize-draws, classified, digital-codes, live, art, bundles. One
+ * `products` query covers all of them, and a per-type query would be nine
+ * fan-outs returning overlapping rows from one collection.
+ *
+ * 🛑 THREE MORE WERE PLANNED FOR THIS PASS AND DELIBERATELY LEFT OUT. Each
+ * would have been a source that renders as a working group and matches
+ * nothing, which is worse than an absent one:
+ *
+ *   partGlossary (752 rows) and groupedListings (10) — **0% `searchTxt`
+ *     coverage**, measured 2026-10-19. This file's mechanism is a single
+ *     `array-contains` push-down on that field, so a source over either
+ *     returns zero rows for every query, forever, with a 200. They are the
+ *     headline gap and they are answered by the prebuilt client index, which
+ *     needs a title and a slug rather than tokens — not by adding a token
+ *     writer for 762 documents to serve a query path that index replaces.
+ *
+ *   coupons — 100% token coverage, but there is no per-coupon public route.
+ *     Every hit would link to `/promotions`, which is already this group's
+ *     `moreHref`, so eleven rows would all point at one page. The code is
+ *     worth finding; a group of identical links is not the way.
+ *
+ * 🛑 Every field here was read off the live documents, not assumed. `stores`
+ * uses `storeName` (not `name`), `faqs` uses `question` + `seo.slug`, and
+ * `categories` must be filtered to listing rows because brands and bundles
+ * share the collection — the same trap that made the `/products` category
+ * facet offer "Takara-Tomy" as a browsable category (A1 item 4).
+ */
+// Imported from the DEFINING module, not a barrel (Root Cause #18) — and
+// never from `@mohasinac/appkit/client`, which is `"use client"` and would
+// make ROUTES a client-reference proxy in this server file (Root Cause #76).
+import { ROUTES } from "../../../../next/routing/route-map.js";
 const str = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
 const withQ = (base, q) => q.trim() ? `${base}?q=${encodeURIComponent(q.trim())}` : base;
 export const SEARCH_SOURCES = [
@@ -28,7 +64,7 @@ export const SEARCH_SOURCES = [
                 ...(detail ? { detail } : {}),
             };
         },
-        moreHref: (q) => withQ("/products", q),
+        moreHref: (q) => withQ(ROUTES.PUBLIC.PRODUCTS, q),
     },
     {
         key: "categories",
@@ -55,7 +91,7 @@ export const SEARCH_SOURCES = [
                 return null;
             return { id, title: name, href: `/categories/${id}` };
         },
-        moreHref: (q) => withQ("/categories", q),
+        moreHref: (q) => withQ(ROUTES.PUBLIC.CATEGORIES, q),
     },
     {
         key: "brands",
@@ -71,7 +107,7 @@ export const SEARCH_SOURCES = [
             const detail = str(d.brandCountry);
             return { id, title: name, href: `/brands/${id}`, ...(detail ? { detail } : {}) };
         },
-        moreHref: (q) => withQ("/brands", q),
+        moreHref: (q) => withQ(ROUTES.PUBLIC.BRANDS, q),
     },
     {
         key: "stores",
@@ -86,7 +122,7 @@ export const SEARCH_SOURCES = [
                 return null;
             return { id, title: name, href: `/stores/${id}` };
         },
-        moreHref: (q) => withQ("/stores", q),
+        moreHref: (q) => withQ(ROUTES.PUBLIC.STORES, q),
     },
     {
         key: "blog",
@@ -106,7 +142,7 @@ export const SEARCH_SOURCES = [
                 ...(detail ? { detail } : {}),
             };
         },
-        moreHref: (q) => withQ("/blog", q),
+        moreHref: (q) => withQ(ROUTES.BLOG.LIST, q),
     },
     {
         key: "faqs",
@@ -129,10 +165,109 @@ export const SEARCH_SOURCES = [
             return {
                 id,
                 title: question,
-                href: category ? `/faqs/${category}` : "/faqs",
+                href: category ? ROUTES.PUBLIC.FAQ_CATEGORY(category) : ROUTES.PUBLIC.FAQS,
                 ...(category ? { detail: category.replace(/_/g, " ") } : {}),
             };
         },
-        moreHref: (q) => withQ("/faqs", q),
+        moreHref: (q) => withQ(ROUTES.PUBLIC.FAQS, q),
+    },
+    {
+        key: "events",
+        label: "Events",
+        collection: "events",
+        /*
+         * 🛑 No `where` clause, and that is forced rather than lazy. Measured on
+         * the live collection: `active` 8, `draft` 1, `paused` 1, `ended` 1,
+         * `cancelled` 1. The public set is "not draft, not cancelled" — three
+         * values — and `where` here applies `==` only, so a single clause would
+         * either publish drafts or hide every paused and ended event. Firestore
+         * cannot express the negation either (Root Cause #59). Same in-memory
+         * shape the `categories` source uses, for the same reason.
+         *
+         * `ended` stays visible deliberately: a search answers "do you have this",
+         * and an event that happened is a real answer with a real page.
+         */
+        select: ["title", "slug", "type", "status"],
+        toHit: (id, d) => {
+            const title = str(d.title);
+            if (!title)
+                return null;
+            const status = str(d.status);
+            if (status === "draft" || status === "cancelled")
+                return null;
+            const detail = str(d.type);
+            return {
+                id,
+                title,
+                href: ROUTES.PUBLIC.EVENT_DETAIL(str(d.slug) ?? id),
+                ...(detail ? { detail: detail.replace(/_/g, " ") } : {}),
+            };
+        },
+        moreHref: (q) => withQ(ROUTES.PUBLIC.EVENTS, q),
+    },
+    {
+        key: "reviews",
+        label: "Reviews",
+        collection: "reviews",
+        // All 79 live rows are `approved`; the clause is still explicit, because a
+        // rejected review surfacing publicly is the failure that matters here.
+        where: [["status", "approved"]],
+        /*
+         * 🛑 `productTitle` as the detail, NEVER `userName`. The field exists on
+         * the document and is deliberately absent from `buildReviewSearchTxt`
+         * because it is encrypted; `maskPublicReview` is what the public read path
+         * uses. A search hit is a public surface and has no business carrying a
+         * reviewer's name even in a subtitle.
+         */
+        select: ["title", "productTitle", "status"],
+        toHit: (id, d) => {
+            const title = str(d.title);
+            if (!title)
+                return null;
+            const detail = str(d.productTitle);
+            return {
+                id,
+                title,
+                href: ROUTES.PUBLIC.REVIEW_DETAIL(id),
+                ...(detail ? { detail } : {}),
+            };
+        },
+        moreHref: (q) => withQ(ROUTES.PUBLIC.REVIEWS, q),
+    },
+    {
+        key: "scammers",
+        label: "Scam reports",
+        collection: "scammerProfiles",
+        /*
+         * 🛑 `verified` ONLY, and this clause is the whole point of the source.
+         * Measured live: `verified` 3, `pending_review` 1, `rejected` 1. Surfacing
+         * an unverified or rejected accusation in site-wide search publishes an
+         * allegation the moderation queue has not accepted — against a named
+         * person, with their phone and UPI on the page. The scam registry is
+         * deliberately public and plaintext-indexed for SEO, which makes getting
+         * this clause right more load-bearing here than anywhere else, not less.
+         */
+        where: [["status", "verified"]],
+        /*
+         * 🛑 `displayNames` is an ARRAY, not a string — read off the live
+         * documents, which is what this file's header asks for and what caught it.
+         * A `str(d.displayName)` would have returned null for every row and the
+         * group would simply never have appeared.
+         */
+        select: ["displayNames", "scamType", "slug"],
+        toHit: (id, d) => {
+            const names = Array.isArray(d.displayNames) ? d.displayNames : [];
+            const title = str(names[0]);
+            if (!title)
+                return null;
+            const detail = str(d.scamType);
+            return {
+                id,
+                title,
+                href: ROUTES.PUBLIC.SCAM_DETAIL(str(d.slug) ?? id),
+                ...(detail ? { detail: detail.replace(/_/g, " ") } : {}),
+            };
+        },
+        moreHref: (q) => withQ(ROUTES.PUBLIC.SCAMS, q),
     },
 ];

package/dist/_internal/server/features/seo/robots.js

@@ -1,3 +1,6 @@
+// The defining module, not the `/client` entry — this is reached from
+// server-only metadata paths (Root Cause #76).
+import { ROUTES } from "../../../../next/routing/route-map.js";
 export function buildRobots({ siteUrl }) {
     return {
         rules: [
@@ -12,7 +15,24 @@ export function buildRobots({ siteUrl }) {
                     "/auth/",
                     "/checkout/",
                     "/cart/",
-                    "/wishlist",
+                    /*
+                     * The one entry here that is a PAGE rather than a subtree prefix —
+                     * its twelve siblings end in "/" because they disallow a whole tree,
+                     * and `/wishlist` is a single route. So it genuinely is a route
+                     * reference and takes the constant; the earlier
+                     * eslint-disable here was treating a real finding as noise.
+                     */
+                    ROUTES.USER.WISHLIST,
+                    /*
+                     * Admin-only tool under a public prefix. Belongs here for the same
+                     * reason /admin/ does, and takes the CONSTANT rather than a literal
+                     * so a route rename cannot leave this entry pointing at nothing.
+                     *
+                     * 🛑 A Disallow stops the crawl, which means the page's own
+                     * `noindex` is never read — the layout's server-side redirect is
+                     * what actually guarantees there is no indexable content here.
+                     */
+                    ROUTES.PUBLIC.TOOL_STICKER_TRACER,
                     "/preview/",
                     "/track/",
                     "/unauthorized/",

package/dist/_internal/server/features/seo/sitemap.js

@@ -117,7 +117,7 @@ function staticPages(baseUrl) {
         page(String(ROUTES.PUBLIC.AUCTIONS), "daily", 0.9),
         page(String(ROUTES.PUBLIC.CATEGORIES), "weekly", 0.8),
         page(String(ROUTES.PUBLIC.BRANDS), "weekly", 0.7),
-        page(String(ROUTES.PUBLIC.BLOG), "daily", 0.7),
+        page(String(ROUTES.BLOG.LIST), "daily", 0.7),
         page(String(ROUTES.PUBLIC.EVENTS), "daily", 0.7),
         page(String(ROUTES.PUBLIC.SELLERS), "weekly", 0.6),
         page(String(ROUTES.PUBLIC.ABOUT), "monthly", 0.5),
@@ -141,6 +141,12 @@ function staticPages(baseUrl) {
         page(String(ROUTES.PUBLIC.DIGITAL_CODES), "daily", 0.6),
         page(String(ROUTES.PUBLIC.LIVE), "hourly", 0.7),
         page(String(ROUTES.PUBLIC.ART), "weekly", 0.6),
+        /*
+         * `daily`, matching the other one-of-a-kind types rather than `/art`'s
+         * weekly: most spares are quantity 1, so the page turns over as fast as
+         * classifieds do.
+         */
+        page(String(ROUTES.PUBLIC.SPARES), "daily", 0.6),
         page(String(ROUTES.PUBLIC.FEES), "monthly", 0.4),
         page(String(ROUTES.PUBLIC.HOW_AUCTIONS_WORK), "monthly", 0.4),
         page(String(ROUTES.PUBLIC.HOW_PRE_ORDERS_WORK), "monthly", 0.4),

package/dist/_internal/server/features/shared/listing-adapters.js

@@ -1,3 +1,4 @@
+import { productImageUrls } from "../../../../features/products/schemas/firestore.js";
 /** Maps the shared fields from a raw Firestore ProductDocument. */
 export function mapBaseListingFields(doc) {
     return {
@@ -10,8 +11,9 @@ export function mapBaseListingFields(doc) {
         // bypassing <GatedPrice> entirely — and it had zero readers, so it was
         // pure exposure. Clients format from `price` through the gate.
         currency: doc.currency ?? "INR",
-        mainImage: doc.mainImage || doc.images?.[0] || null,
-        images: doc.images ?? [],
+        mainImage: doc.mainImage || doc.images?.[0]?.url || null,
+        // A6: the client listing shape is still `string[]`; project, never mirror.
+        images: productImageUrls(doc.images),
         storeId: doc.storeId,
         storeName: doc.storeName ?? null,
         category: doc.categorySlugs?.[0] ?? doc.category ?? "",

package/dist/_internal/server/features/shared/listing-data-factory.js

@@ -55,14 +55,26 @@ export const getProductFeaturesForStore = cache(async (storeId) => safeRead(() =
 // Export names in stores/data.ts stay identical so consumers need no changes.
 export function makeGetStoreListingsInitial(type, pageSize) {
     return cache(async (storeId, page = 1) => {
-        const result = await productRepository
-            .list({
+        /*
+         * 🛑 `safeRead`, not `.catch(() => null)`. This factory backs every
+         * per-type store listing tab, so a swallowed failure renders a seller's
+         * page as "no listings" — which is Root Cause #59's exact shape, where a
+         * `FAILED_PRECONDITION` from a missing composite index was indistinguishable
+         * from an empty catalogue and stayed invisible for weeks.
+         *
+         * Same `null` fallback and same empty render; the difference is that the
+         * failure now lands in `serverErrors` as a `DEGRADED_READ`.
+         */
+        const result = await safeRead(() => productRepository.list({
             filters: `storeId==${storeId},status==published,listingType==${type}`,
             sorts: "-createdAt",
             page,
             pageSize,
-        })
-            .catch(() => null);
+        }), {
+            route: `store-listing:${type}`,
+            key: "products.listByStoreAndType",
+            fallback: null,
+        });
         return { items: result?.items ?? [], total: result?.total ?? 0 };
     });
 }

package/dist/_internal/server/features/site-settings/adapters.d.ts

@@ -37,7 +37,7 @@ import type { PublicSiteSettings } from "../../../shared/features/site-settings/
  * was traced to a call site; anything without one belongs in the private list,
  * because an unused public field is pure attack surface.
  */
-export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark", "disabledRoutes", "chat"];
+export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark", "disabledRoutes", "chat", "search"];
 /** Everything else, with the reason it stays server-side. */
 export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults", "messaging"];
 export interface ToPublicSiteSettingsOptions {

package/dist/_internal/server/features/site-settings/adapters.js

@@ -37,6 +37,20 @@ export const PUBLIC_SITE_SETTINGS_FIELDS = [
     // render a "Message seller" CTA at all. Narrowed to `enabled` only; there is
     // nothing else in the group.
     "chat",
+    /*
+     * useSearchIndex — the kill switch for the browser-side search artifact.
+     *
+     * Public because the reader is a GUEST's search box: search is the one
+     * surface that must work before anyone signs in, so a server-only flag
+     * could not reach the visitor it governs. Publishing it discloses one
+     * boolean meaning "site search currently falls back to the server path",
+     * which is observable from the outside anyway by watching which request
+     * the page makes.
+     *
+     * 🛑 It fails OPEN on absence (`!== false`), so a settings fetch that fails
+     * leaves search working rather than dark — see the schema note.
+     */
+    "search",
 ];
 /** Everything else, with the reason it stays server-side. */
 export const PRIVATE_SITE_SETTINGS_FIELDS = [
@@ -112,5 +126,17 @@ export function toPublicSiteSettings(doc, opts) {
         effectiveWatermark: opts?.effectiveWatermark,
         // D9 — undefined reads as OFF, never a default-true `??`.
         chat: { enabled: doc.chat?.enabled === true },
+        /*
+         * 🛑 `!== false`, the opposite of the line above it, and the two sit
+         * together deliberately so the difference is visible rather than looking
+         * like one of them is a mistake.
+         *
+         * `chat` is a feature nobody has turned on yet; absent means off. This is
+         * a kill switch on a path that is already the primary one; absent means
+         * ON, and only an explicit `false` disables it. Normalised here rather
+         * than at the reader so there is one place that decides, and a client
+         * cannot accidentally re-derive it with `??`.
+         */
+        search: { indexEnabled: doc.search?.indexEnabled !== false },
     };
 }