@open-mercato/cli 0.10.1-develop.7826.1.5e82b7c668 → 0.10.1-develop.7827.1.5c631908e4

package/dist/agentic/guides/modules/staff/index.md

@@ -1,5 +1,5 @@
 # staff — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/staff
 
 ## Sections

package/dist/agentic/guides/modules/storage_s3/index.md

@@ -1,5 +1,5 @@
 # storage_s3 — module facts (generated, do not edit)
-<!-- generated from @open-mercato/storage-s3 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/storage-s3 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/storage-s3/src/modules/storage_s3
 
 ## Sections

package/dist/agentic/guides/modules/sync_akeneo/index.md

@@ -1,5 +1,5 @@
 # sync_akeneo — module facts (generated, do not edit)
-<!-- generated from @open-mercato/sync-akeneo 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/sync-akeneo 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/sync-akeneo/src/modules/sync_akeneo
 
 ## Sections

package/dist/agentic/guides/modules/sync_excel/index.md

@@ -1,5 +1,5 @@
 # sync_excel — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/sync_excel
 
 ## Sections

package/dist/agentic/guides/modules/system_status_overlays/index.md

@@ -1,5 +1,5 @@
 # system_status_overlays — module facts (generated, do not edit)
-<!-- generated from @open-mercato/enterprise 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/enterprise 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/enterprise/src/modules/system_status_overlays
 
 ## Sections

package/dist/agentic/guides/modules/telemetry/index.md

@@ -1,5 +1,5 @@
 # telemetry — module facts (generated, do not edit)
-<!-- generated from @open-mercato/telemetry 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/telemetry 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/telemetry/src/modules/telemetry
 
 ## Sections

package/dist/agentic/guides/modules/tillio/index.md

@@ -1,5 +1,5 @@
 # tillio — module facts (generated, do not edit)
-<!-- generated from @open-mercato/tillio 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/tillio 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/tillio/src/modules/tillio
 
 ## Sections

package/dist/agentic/guides/modules/translations/index.md

@@ -1,5 +1,5 @@
 # translations — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/translations
 
 ## Sections

package/dist/agentic/guides/modules/warranty_claims/index.md

@@ -1,5 +1,5 @@
 # warranty_claims — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/warranty_claims
 
 ## Sections

package/dist/agentic/guides/modules/webhooks/index.md

@@ -1,5 +1,5 @@
 # webhooks — module facts (generated, do not edit)
-<!-- generated from @open-mercato/webhooks 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/webhooks 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/webhooks/src/modules/webhooks
 
 ## Sections

package/dist/agentic/guides/modules/wms/index.md

@@ -1,5 +1,5 @@
 # wms — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/wms
 
 ## Sections

package/dist/agentic/guides/modules/workflows/index.md

@@ -1,5 +1,5 @@
 # workflows — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7826.1.5e82b7c668; core 0.10.1-develop.7826.1.5e82b7c668 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7827.1.5c631908e4; core 0.10.1-develop.7827.1.5c631908e4 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/workflows
 
 ## Sections

package/dist/agentic/guides/reference-module-facts.json

@@ -4,7 +4,7 @@
     "projectionKind": "activated-reference",
     "sourceKind": "local-reference",
     "runtimeSelected": false,
-    "sourceFingerprint": "2fc1776f1ad64b61fdc0daa2884172ce84f6b5ddb2ab489dcdd42bbea01b11f0",
+    "sourceFingerprint": "7da2b6dd1cbf271bd509629a8092e7e75b4605dba5af3e888f1e980a792af2b1",
     "taxonomyFingerprint": "b6afb1c19fa5325d47cb28db4b5bf6f6e88088a6707d311c322f157230975553",
     "factCoverage": [
       {
@@ -1185,7 +1185,7 @@
     "facts": {
       "title": "Example Module",
       "description": "Demonstrates pages, APIs, entities and DI.",
-      "coreVersion": "0.10.1-develop.7826.1.5e82b7c668",
+      "coreVersion": "0.10.1-develop.7827.1.5c631908e4",
       "sourcePackage": null,
       "sourceVersion": null,
       "sourceRoot": "src/modules/example",

package/dist/agentic/guides/reference-modules/example/index.md

@@ -1,5 +1,5 @@
 # example — module facts (generated reference projection, do not edit)
-<!-- generated from local reference src/modules/example; source-fingerprint 2fc1776f1ad64b61fdc0daa2884172ce84f6b5ddb2ab489dcdd42bbea01b11f0; taxonomy-fingerprint b6afb1c19fa5325d47cb28db4b5bf6f6e88088a6707d311c322f157230975553 — R1 staleness stamp -->
+<!-- generated from local reference src/modules/example; source-fingerprint 7da2b6dd1cbf271bd509629a8092e7e75b4605dba5af3e888f1e980a792af2b1; taxonomy-fingerprint b6afb1c19fa5325d47cb28db4b5bf6f6e88088a6707d311c322f157230975553 — R1 staleness stamp -->
 > Reference projection: `example` is not selected by the current runtime. Its activations and exact override targets describe behavior only after opt-in in `src/modules.ts`.
 Source root: src/modules/example
 

package/dist/agentic/guides/upstream/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generator": "@open-mercato/cli@0.10.1-develop.7826.1.5e82b7c668",
+  "generator": "@open-mercato/cli@0.10.1-develop.7827.1.5c631908e4",
   "files": {
     "AGENTS.md": "b27342ee5f61e805ba52703fdb7ec822b030490f734b4d80f48dfd1e05fa4cf5",
     "BACKWARD_COMPATIBILITY.md": "d47c2fbbf55f4363511576ac9ad009895afb5f4433c5b1527342e2ea1037b701"

package/dist/agentic/shared/AGENTS.md.template

@@ -1,12 +1,12 @@
 # {{PROJECT_NAME}} — Standalone App Agent Rules
 
-Route first; never probe unmatched context.
+Route first; skip unmatched context.
 
 ## Always
 
 - Route all axes; missing context: `yarn mercato agentic:init --update-harness`.
 - Lessons: scan `.ai/lessons.md` tags; open/update one matching record + row.
-- App code: `src/modules/<id>/`; framework context only for named gaps.
+- App code: `src/modules/<id>/`.
 - Derive trusted `tenantId` + `organizationId` and fail closed. Only an installed contract may use system scope (`organizationId: null`).
 - Use commands/`makeCrudRoute`/`CrudForm`/`DataTable`, DI/events/UMES; effects stay post-commit.
 - Put entities in `src/modules/<id>/data/entities.ts`; API routes need per-method `metadata` + `openApi`.
@@ -34,11 +34,11 @@ Broad: `yarn generate && yarn typecheck && yarn lint && yarn ds:check && yarn te
 
 ## Production Deployment
 
-Route production deployment, go-live, or security-readiness work to `architecture` and read `.ai/guides/production-deployment.md`. During routing, do not open `.env*`; the guide carries the safe configuration inventory. During the later readiness review, inspect only names and comments in the checked-in `.env.example`; never read or report live `.env` values. Ask before touching credentials, billable infrastructure, or a live deployment.
+Route production deployment/go-live/security-readiness to `architecture` + `.ai/guides/production-deployment.md`. During routing, do not open `.env*`; use its inventory. Readiness: only names and comments in checked-in `.env.example`; never read or report live `.env` values. Ask before touching credentials, billable infrastructure, or live deployments.
 
 ## Three-Axis Context Assembler
 
-Routes are additive: ownership says WHO; other axes say WHAT. Select every match.
+Select all matches on all axes.
 
 `debugging` is additive. A scalar-ID/snapshot fix to persisted records or commands linked to an installed record MUST use `module-data` + `umes` and load `om-data-model-design` + `om-system-extension`.
 
@@ -68,7 +68,7 @@ API/command/record/status/event/UI changes/guards = `umes`; app persistence = `m
 
 ### Axis 2 — Work Units
 
-Match every work-unit row; OPEN its skill before selection.
+Open every matched work-unit skill before selection.
 
 | Route | Work unit | Skill/context |
 |---|---|---|
@@ -91,7 +91,7 @@ Match every work-unit row; OPEN its skill before selection.
 | `framework-context` | Exact installed contract still unknown | `.ai/guides/framework-contracts.md`, then bounded `om-framework-context`, last |
 | `debugging` + `testing` | Add/fix recurring harness case/test | `om-evolve-harness` |
 
-`framework-context`: resolve one named fact first. Use bounded source only if the guide leaves current behavior, authorization, dependents, or safest customization seam unresolved; never for “installed contracts” alone.
+`framework-context`: resolve a named fact first; bounded source only for current behavior, authorization, dependents, or safest customization seam gaps left by the guide, never “installed contracts” alone.
 
 ### Axis 3 — SDLC and Delivery
 
@@ -107,8 +107,8 @@ Read `.agents/skills/<id>/SKILL.md` AND any `.ai/skills/<id>/SKILL.md` override.
 
 ### Token-Efficient Assembly Policy
 
-- Load matched guides once, then only needed references/facts.
-- Hard budgets: guide > skill > references; open a reference only for its named subject.
+- Load matched guides once; only needed references/facts.
+- Budget order: guide > skill > references; only subject-matched references.
 - `spec-pr` reads template via spec-delivery.
 - Inspect app call sites before bounded `framework-context`.
 - Additive page/form/table/conflict UI skips it.
@@ -116,14 +116,14 @@ Read `.agents/skills/<id>/SKILL.md` AND any `.ai/skills/<id>/SKILL.md` override.
 
 ## Module-Specific Facts
 
-Mechanisms: events/subscribers→events; long operation/progress→progress; provider settings/health/OAuth→integrations; sync/import→data_sync. Hosts: session/auth→auth; customer/contact/deal/pipeline→customers; product/price/stock/inventory→catalog; currency/money→currencies; cart/checkout/shopper→checkout; portal→portal+customer_accounts; quote/order/invoice/sales assistant→sales; notification→notifications; webhook/callback→webhooks; schedule/reminder→scheduler; workflow/activity/user task→workflows; assistant→ai_assistant; maintained query index/reindex→query_index; search convergence→search. staff/employee≠optional staff; audit/record-who≠audit_logs unless extended. App primitives skip api_docs/search/query_index unless changed. Big fact-sheets: read in sections.
+Mechanisms: events/subscribers→events; long operation/progress→progress; provider settings/health/OAuth→integrations; sync/import→data_sync. Hosts: session/auth→auth; customer/contact/deal/pipeline→customers; product/price/stock/inventory→catalog; currency/money→currencies; cart/checkout/shopper→checkout; portal→portal+customer_accounts; quote/order/invoice/sales assistant→sales; notification→notifications; webhook/callback→webhooks; schedule/reminder→scheduler; workflow/activity/user task→workflows; assistant→ai_assistant; query index/reindex or encrypted search box/filter by name→query_index; search convergence→search. staff/employee≠optional staff; audit/record-who≠audit_logs unless extended. Primitives skip api_docs/search/query_index unless changed or filtering encrypted text. Read big facts by section.
 
 <!-- om:module-guides:start -->
 <!-- om:module-guides:end -->
 
 ## Working Sequence
 
-1. Route, then implement the smallest complete slice through real call sites.
-2. Discovery change: run `yarn generate`; then the smallest gate/integration paths.
+1. Route; implement a minimal complete slice via real call sites.
+2. Discovery: `yarn generate`; then focused gates/integration paths.
 
 Precedence: root→BC→installed `AGENTS.md`→facts; stop on skew/conflict; never guess.

package/dist/agentic/shared/ai/harness/source-link-inventory.json

@@ -3,9 +3,9 @@
   "generatedNote": "Derived asset — the app-facing projection of the repository source-link inventory, regenerated with `yarn workspace create-mercato-app harness:generate-source-link-inventory`. Never hand-edit. Harness cases resolve `context.sourceReferenceIds` against `referenceId` here; a record with `readStatus: \"qa-only\"` is validation evidence only and is refused as a case reference.",
   "derived": {
     "ownerCount": 32,
-    "recordCount": 150,
-    "sourceRequiredCount": 125,
-    "readableCount": 150,
+    "recordCount": 155,
+    "sourceRequiredCount": 130,
+    "readableCount": 155,
     "baselineSha": "f7c941570003f3abe920b1765995cbef98dcad0b"
   },
   "notCovered": [
@@ -2093,6 +2093,99 @@
         "core"
       ]
     },
+    {
+      "referenceId": "om-data-model-design/sensitive-data:api/todos/route.ts",
+      "requirement": "source-required",
+      "originAsset": ".ai/skills/om-data-model-design/references/sensitive-data.md",
+      "heading": "Encrypted list search",
+      "href": "../../../../src/modules/example/api/todos/route.ts",
+      "targetKind": "canonical-example",
+      "readStatus": "readable",
+      "resolvedPath": "src/modules/example/api/todos/route.ts",
+      "moduleId": "example",
+      "capabilityIds": [
+        "api.crud-query-engine-custom-fields",
+        "search.encrypted-column-list-filter"
+      ],
+      "presets": [
+        "classic",
+        "crm",
+        "empty",
+        "wms"
+      ],
+      "tiers": [
+        "core"
+      ]
+    },
+    {
+      "referenceId": "om-data-model-design/sensitive-data:encryption.ts",
+      "requirement": "source-required",
+      "originAsset": ".ai/skills/om-data-model-design/references/sensitive-data.md",
+      "heading": "Encrypted list search",
+      "href": "../../../../src/modules/example/encryption.ts",
+      "targetKind": "canonical-example",
+      "readStatus": "readable",
+      "resolvedPath": "src/modules/example/encryption.ts",
+      "moduleId": "example",
+      "capabilityIds": [
+        "data.encryption-map"
+      ],
+      "presets": [
+        "classic",
+        "crm",
+        "empty",
+        "wms"
+      ],
+      "tiers": [
+        "core"
+      ]
+    },
+    {
+      "referenceId": "om-data-model-design/sensitive-data:node_modules/@open-mercato/shared/src/lib/query/engine.ts",
+      "requirement": "source-required",
+      "originAsset": ".ai/skills/om-data-model-design/references/sensitive-data.md",
+      "heading": "Encrypted list search",
+      "href": "../../../../node_modules/@open-mercato/shared/src/lib/query/engine.ts",
+      "targetKind": "installed-package",
+      "readStatus": "readable",
+      "resolvedPath": "node_modules/@open-mercato/shared/src/lib/query/engine.ts",
+      "moduleId": null,
+      "capabilityIds": [],
+      "packageName": "@open-mercato/shared",
+      "packageRelativePath": "src/lib/query/engine.ts",
+      "presets": [
+        "classic",
+        "crm",
+        "empty",
+        "wms"
+      ],
+      "tiers": [
+        "core"
+      ]
+    },
+    {
+      "referenceId": "om-data-model-design/sensitive-data:search.ts",
+      "requirement": "source-required",
+      "originAsset": ".ai/skills/om-data-model-design/references/sensitive-data.md",
+      "heading": "Encrypted list search",
+      "href": "../../../../src/modules/example/search.ts",
+      "targetKind": "canonical-example",
+      "readStatus": "readable",
+      "resolvedPath": "src/modules/example/search.ts",
+      "moduleId": "example",
+      "capabilityIds": [
+        "search.module-config"
+      ],
+      "presets": [
+        "classic",
+        "crm",
+        "empty",
+        "wms"
+      ],
+      "tiers": [
+        "core"
+      ]
+    },
     {
       "referenceId": "om-data-model-design:references/surface-map.md",
       "requirement": "source-required",
@@ -2369,6 +2462,27 @@
         "core"
       ]
     },
+    {
+      "referenceId": "om-module-scaffold/api-and-domain:.ai/skills/om-data-model-design/references/sensitive-data.md",
+      "requirement": "source-required",
+      "originAsset": ".ai/skills/om-module-scaffold/references/api-and-domain.md",
+      "heading": "API and Domain Writes",
+      "href": "../../om-data-model-design/references/sensitive-data.md#encrypted-list-search",
+      "targetKind": "local-owner",
+      "readStatus": "readable",
+      "resolvedPath": ".ai/skills/om-data-model-design/references/sensitive-data.md",
+      "moduleId": null,
+      "capabilityIds": [],
+      "presets": [
+        "classic",
+        "crm",
+        "empty",
+        "wms"
+      ],
+      "tiers": [
+        "core"
+      ]
+    },
     {
       "referenceId": "om-module-scaffold/api-and-domain:README.md",
       "requirement": "source-required",

package/dist/agentic/shared/ai/skills/om-data-model-design/references/sensitive-data.md

@@ -5,6 +5,18 @@ Load this reference when records contain PII, credentials, addresses, contact in
 1. Classify data sensitivity, lookup needs, retention/deletion, logs/search/export exposure, and access features.
 2. In module `encryption.ts`, import `ModuleEncryptionMap` from `@open-mercato/shared/modules/encryption`, declare `defaultEncryptionMaps: ModuleEncryptionMap[] = [{ entityId: '<module>:<entity>', fields: [{ field: '<database_field>' }] }]`, then `export default defaultEncryptionMaps` for generated registry compatibility. The entries are field-rule objects, not string names. Use a sibling `hashField` only for deterministic equality lookup. Let `TenantDataEncryptionService` populate it during encrypted writes, and query it with `lookupHashCandidates(value)` from `@open-mercato/shared/lib/encryption/aes`; use `hashForLookup(value)` from the same import only when the installed write contract explicitly requires a single keyed value. Never use raw SHA-256 for low-entropy PII such as email or phone values.
 3. Import `findWithDecryption`, `findOneWithDecryption`, or `findAndCountWithDecryption` from `@open-mercato/shared/lib/encryption/find` and make a concrete call in every implemented direct sensitive-record read path; an unused import or encryption map alone is not a decrypted read. For `makeCrudRoute`, its `entityId` + `fields` factory QueryEngine owns list decryption and `list` has no `findAndCount` override key—do not insert a decryption helper as an unsupported option. Put trusted tenant/organization constraints in each direct helper query `where` **and** pass `{ tenantId, organizationId }` as the fifth-argument decryption scope. The scope selects keys; it does not authorize or scope the ORM query. Use a null/global scope only when the installed contract explicitly permits it. Audit detail/export/search/worker/CLI and other direct ORM paths.
-4. Keep secrets out of responses, logs, errors, events, snapshots, cache keys, search documents, vector sources, and test artifacts. Exclude encrypted source values from `search.ts` field policies and indexes; index only an explicitly approved hash-only sibling for exact equality. Never sort or fuzzy-filter ciphertext.
+4. Keep secrets out of responses, logs, errors, events, snapshots, cache keys, search documents, vector sources, and test artifacts. Exclude sensitive plaintext from fulltext/vector `search.ts` policies and exports. A keyed hash-only sibling supports exact equality; encrypted text filtering has a separate scoped token-index contract below. Never sort or fuzzy-filter ciphertext with raw SQL.
 5. Seed/update encryption configuration through the supported command; never hand-roll KMS/AES. For every new or changed map, use an isolated initialized test tenant to reconcile the map, read back its registration, insert a fixture through the real write path, and assert the sensitive database columns are ciphertext before claiming runtime coverage. A fresh test tenant does not prove existing tenants are covered: maps are seeded only when a tenant is created, and nothing re-seeds tenants that already exist. When you add a map, or a field to an existing map, in a module that may already be deployed, ship a backfill migration in the same module: `this.addSql(buildEncryptionMapBackfillSql({ entityId, fields }))` from `@open-mercato/shared/lib/encryption/migration-backfill`. It inserts the map for every existing (tenant, organization) scope that already has active maps (`NOT EXISTS` guard) and appends missing fields to existing maps. Write the entity id and fields literally in the migration and leave `down()` empty. `yarn db:generate` warns when the local database shows an unbackfilled field. Plaintext rows written before the backfill are encrypted by `yarn mercato entities rotate-encryption-key --tenant <id>` without `--old-key`.
 6. Test authorized decryption, cross-scope denial, redaction, missing keys, export/search behavior, and cleanup/retention.
+
+## Encrypted list search
+
+For QueryEngine list filters (`makeCrudRoute` with `entityId` + `fields`), use the normal `$ilike` filter. The engine owns encrypted-field token lookup and tenant/organization scoping; do not duplicate it with manual ID narrowing. For a raw ORM or Kysely read, use `findEntityIdsBySearchTokens` from `@open-mercato/shared/lib/search/tokenLookup` with trusted scope, then constrain IDs before a scoped decrypted read. `matched: false` means the index was not consulted, not a successful empty match; never fall back to SQL ILIKE against ciphertext.
+
+The required invariant is populated `search_tokens` for the filtered entity/field/records in the same tenant and organization scope. Declare `indexer` on the real write path, verify its events/worker run, and reindex existing records when adopting the module. Token generation is independent of `search.ts`: the query index tokenizes decrypted documents into hashes, even when fulltext/vector policies exclude the field. Adding `search.ts` alone cannot populate missing tokens. Search must also be enabled and the query must produce tokens at the configured minimum length.
+
+Prove the pairing against a disposable database: create an encrypted fixture through the real API, wait for its scoped tokens, search that value through the list API, and assert exactly that record is returned; verify a different organization cannot find it. A green build or mocked command suite does not prove token population. Clean up both the record and its indexed state.
+
+A `no-search-tokens` warning means the missing index can make an ordinary empty HTTP 200 misleading. Outside production, QueryEngine-backed list responses also expose `meta.ciphertextSearchWarnings` with safe entity/field/reason/hint metadata on every affected response; production keeps the existing server log only. No diagnostic contains the search text or decrypted value. Inspect that metadata and the query-index worker/reindex status before interpreting an empty search as no matching record.
+
+Canonical installed contract: `@open-mercato/shared/AGENTS.md`, Search Tokens; engine implementation: [`query/engine.ts`](../../../../node_modules/@open-mercato/shared/src/lib/query/engine.ts). Reference implementation: [`api/todos/route.ts`](../../../../src/modules/example/api/todos/route.ts), [`encryption.ts`](../../../../src/modules/example/encryption.ts), and [`search.ts`](../../../../src/modules/example/search.ts).

package/dist/agentic/shared/ai/skills/om-module-scaffold/references/api-and-domain.md

@@ -7,8 +7,9 @@ the authority for this layer's import paths and carries MUST rules that are easy
 by writing something that merely compiles — in particular: use the `badRequest` / `forbidden`
 / `notFound` / `conflict` / `assertFound` helpers from
 `@open-mercato/shared/lib/crud/errors` rather than hand-rolling `new CrudHttpError(404, …)`;
-read encrypted columns through `@open-mercato/shared/lib/encryption/find`; and never `$ilike`
-a column an encryption map covers — use `@open-mercato/shared/lib/search/tokenLookup`.
+read direct ORM results through `@open-mercato/shared/lib/encryption/find`; and follow
+[encrypted list search](../../om-data-model-design/references/sensitive-data.md#encrypted-list-search)
+for the QueryEngine `$ilike` versus raw ORM token-lookup distinction and its populated-index precondition.
 
 There is no `@open-mercato/shared/lib/http/types`. A hand-written route handler takes the
 platform `Request` (`export async function GET(request: Request)`) and returns a platform

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.10.1-develop.7826.1.5e82b7c668",
+  "version": "0.10.1-develop.7827.1.5c631908e4",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.10.1-develop.7826.1.5e82b7c668",
-    "@open-mercato/queue": "0.10.1-develop.7826.1.5e82b7c668",
-    "@open-mercato/shared": "0.10.1-develop.7826.1.5e82b7c668",
-    "@open-mercato/telemetry": "0.10.1-develop.7826.1.5e82b7c668",
+    "@open-mercato/events": "0.10.1-develop.7827.1.5c631908e4",
+    "@open-mercato/queue": "0.10.1-develop.7827.1.5c631908e4",
+    "@open-mercato/shared": "0.10.1-develop.7827.1.5c631908e4",
+    "@open-mercato/telemetry": "0.10.1-develop.7827.1.5c631908e4",
     "cross-spawn": "^7.0.6",
     "minisearch": "7.2.0",
     "pg": "8.23.0",
@@ -75,10 +75,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7826.1.5e82b7c668"
+    "@open-mercato/shared": "0.10.1-develop.7827.1.5c631908e4"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7826.1.5e82b7c668",
+    "@open-mercato/shared": "0.10.1-develop.7827.1.5c631908e4",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"