@open-mercato/core 0.9.1-develop.7474.1.51db10479d → 0.9.1-develop.7475.1.28ca93ed97

package/dist/modules/query_index/lib/indexer.js

@@ -11,6 +11,7 @@ import { createLogger } from "@open-mercato/shared/lib/logger";
 import { resolveSearchConfig } from "@open-mercato/shared/lib/search/config";
 import { replaceSearchTokensForRecord, deleteSearchTokensForRecord } from "./search-tokens.js";
 import { attachAggregateSearchField, rebuildAggregateSearchField } from "./document.js";
+import { applyIndexDocEnrichers } from "./doc-enrichers.js";
 const logger = createLogger("query_index").child({ component: "indexer" });
 async function buildIndexDoc(em, params) {
   const db = em.getKysely();
@@ -138,6 +139,12 @@ async function buildIndexDoc(em, params) {
     }
   } catch {
   }
+  await applyIndexDocEnrichers(db, params.entityType, [{
+    recordId: String(params.recordId),
+    doc,
+    tenantId: params.tenantId ?? null,
+    organizationId: params.organizationId ?? null
+  }]);
   doc = attachAggregateSearchField(doc, { entityType: params.entityType });
   try {
     const encryption = resolveTenantEncryptionService(em);

package/dist/modules/query_index/lib/indexer.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/query_index/lib/indexer.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { decryptIndexDocForSearch, encryptIndexDocForStorage } from '@open-mercato/shared/lib/encryption/indexDoc'\nimport {\n  buildCustomFieldDefinitionIndexFromRows,\n  normalizeDefinitionKey,\n  selectDefinitionForRecord,\n  type CustomFieldDefinitionRow,\n} from '@open-mercato/shared/lib/crud/custom-field-definition-index'\nimport { type Kysely, type Transaction, sql } from 'kysely'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'\nimport { replaceSearchTokensForRecord, deleteSearchTokensForRecord } from './search-tokens'\nimport { attachAggregateSearchField, rebuildAggregateSearchField } from './document'\n\nconst logger = createLogger('query_index').child({ component: 'indexer' })\n\ntype QueryIndexExecutor = Kysely<any> | Transaction<any>\n\ntype BuildDocParams = {\n  entityType: string // '<module>:<entity>'\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport async function buildIndexDoc(em: EntityManager, params: BuildDocParams): Promise<Record<string, any> | null> {\n  const db = (em as any).getKysely()\n  const baseTable = resolveEntityTableName(em, params.entityType)\n\n  // Fetch base row\n  const baseRow = await db\n    .selectFrom(baseTable as any)\n    .selectAll()\n    .where('id' as any, '=', params.recordId)\n    .executeTakeFirst() as Record<string, any> | undefined\n  if (!baseRow) return null\n  const docSources: Array<Record<string, any>> = []\n\n  // Attach the core customer entity when indexing customer profiles so search tokens see the combined row\n  let parentEntityRow: Record<string, any> | null = null\n  if (params.entityType === 'customers:customer_person_profile' || params.entityType === 'customers:customer_company_profile') {\n    const entityId = (baseRow as any).entity_id ?? (baseRow as any).entityId\n    if (entityId) {\n      const entityRow = await db\n        .selectFrom('customer_entities' as any)\n        .selectAll()\n        .where('id' as any, '=', entityId)\n        .executeTakeFirst() as Record<string, any> | undefined\n      if (entityRow) {\n        docSources.push(entityRow)\n        parentEntityRow = entityRow\n      }\n    }\n  }\n  void parentEntityRow\n\n  // Build base document (snake_case keys as in DB)\n  let doc: Record<string, any> = {}\n  docSources.push(baseRow)\n  for (const source of docSources) {\n    for (const [k, v] of Object.entries(source)) doc[k] = v\n  }\n\n  // Attach custom fields under flat keys 'cf:<key>'\n  let cfQuery = db\n    .selectFrom('custom_field_values' as any)\n    .select([\n      'field_key' as any,\n      'value_text' as any,\n      'value_multiline' as any,\n      'value_int' as any,\n      'value_float' as any,\n      'value_bool' as any,\n    ])\n    .where('entity_id' as any, '=', params.entityType)\n    .where('record_id' as any, '=', String(params.recordId))\n\n  if (params.organizationId != null) {\n    cfQuery = cfQuery.where((eb: any) => eb.or([\n      eb('organization_id' as any, '=', params.organizationId),\n      eb('organization_id' as any, 'is', null),\n    ]))\n  } else {\n    cfQuery = cfQuery.where('organization_id' as any, 'is', null)\n  }\n\n  if (params.tenantId != null) {\n    cfQuery = cfQuery.where((eb: any) => eb.or([\n      eb('tenant_id' as any, '=', params.tenantId),\n      eb('tenant_id' as any, 'is', null),\n    ]))\n  } else {\n    cfQuery = cfQuery.where('tenant_id' as any, 'is', null)\n  }\n\n  const cfRows = await cfQuery.execute() as Array<Record<string, any>>\n\n  const cfMap: Record<string, any[]> = {}\n  for (const r of cfRows) {\n    const key = String(r.field_key)\n    const cfKey = `cf:${key}`\n    const val = r.value_bool ?? r.value_int ?? r.value_float ?? r.value_text ?? r.value_multiline ?? null\n    if (!cfMap[cfKey]) cfMap[cfKey] = []\n    cfMap[cfKey].push(val)\n  }\n\n  const multiKeys = new Set<string>()\n  const fieldKeys = Object.keys(cfMap).map((key) => key.slice(3))\n  if (fieldKeys.length > 0) {\n    let defQuery = db\n      .selectFrom('custom_field_defs' as any)\n      .select([\n        'key' as any,\n        'kind' as any,\n        'config_json' as any,\n        'organization_id' as any,\n        'tenant_id' as any,\n        'deleted_at' as any,\n        'updated_at' as any,\n      ])\n      .where('entity_id' as any, '=', params.entityType)\n      .where('key' as any, 'in', fieldKeys)\n      .where('is_active' as any, '=', true)\n      .where('deleted_at' as any, 'is', null)\n\n    if (params.organizationId != null) {\n      defQuery = defQuery.where((eb: any) => eb.or([\n        eb('organization_id' as any, '=', params.organizationId),\n        eb('organization_id' as any, 'is', null),\n      ]))\n    } else {\n      defQuery = defQuery.where('organization_id' as any, 'is', null)\n    }\n\n    if (params.tenantId != null) {\n      defQuery = defQuery.where((eb: any) => eb.or([\n        eb('tenant_id' as any, '=', params.tenantId),\n        eb('tenant_id' as any, 'is', null),\n      ]))\n    } else {\n      defQuery = defQuery.where('tenant_id' as any, 'is', null)\n    }\n\n    const defRows = await defQuery.execute() as Array<Record<string, any>>\n    const definitionIndex = buildCustomFieldDefinitionIndexFromRows(\n      defRows.map((row): CustomFieldDefinitionRow => ({\n        key: String(row.key ?? ''),\n        entityId: params.entityType,\n        kind: typeof row.kind === 'string' ? row.kind : null,\n        configJson: row.config_json,\n        organizationId: row.organization_id ?? null,\n        tenantId: row.tenant_id ?? null,\n        deletedAt: row.deleted_at ?? null,\n        updatedAt: row.updated_at ?? null,\n      })),\n      { organizationIds: params.organizationId ? [params.organizationId] : [] },\n    )\n    for (const key of fieldKeys) {\n      const definitions = definitionIndex.get(normalizeDefinitionKey(key)) ?? []\n      const definition = selectDefinitionForRecord(\n        definitions,\n        params.organizationId ?? null,\n        params.tenantId ?? null,\n      )\n      if (definition?.multi) multiKeys.add(key)\n    }\n  }\n\n  for (const [key, arr] of Object.entries(cfMap)) {\n    // Cardinality belongs to the field definition, not the current row count:\n    // a multi field containing one value must still hydrate as an array.\n    const fieldKey = key.slice(3)\n    doc[key] = multiKeys.has(fieldKey) || arr.length > 1 ? arr : arr[0]\n  }\n\n  // Attach translations under flat keys 'l10n:{locale}:{field}'\n  try {\n    const translationRow = await db\n      .selectFrom('entity_translations' as any)\n      .select(['translations' as any])\n      .where('entity_type' as any, '=', params.entityType)\n      .where('entity_id' as any, '=', String(params.recordId))\n      .where(sql`tenant_id is not distinct from ${params.tenantId ?? null}`)\n      .where(sql`organization_id is not distinct from ${params.organizationId ?? null}`)\n      .executeTakeFirst() as { translations: Record<string, Record<string, unknown>> | null } | undefined\n\n    if (translationRow?.translations && typeof translationRow.translations === 'object') {\n      for (const [locale, fields] of Object.entries(translationRow.translations)) {\n        if (!fields || typeof fields !== 'object') continue\n        for (const [field, value] of Object.entries(fields as Record<string, unknown>)) {\n          if (typeof value === 'string' && value.length > 0) {\n            doc[`l10n:${locale}:${field}`] = value\n          }\n        }\n      }\n    }\n  } catch {}\n\n  // Kept outside the guard below: a failure while building the aggregate search field is a\n  // bug in the aggregation or its configuration, and must surface instead of being mistaken\n  // for an encryption failure and silently skipping encryption.\n  doc = attachAggregateSearchField(doc, { entityType: params.entityType })\n\n  try {\n    const encryption = resolveTenantEncryptionService(em as any)\n    doc = await encryptIndexDocForStorage(\n      params.entityType,\n      doc,\n      { tenantId: params.tenantId ?? null, organizationId: params.organizationId ?? null },\n      encryption,\n    )\n  } catch (error) {\n    // `encryptIndexDocForStorage` already returns the document untouched when encryption is\n    // absent or disabled, so a throw here is always a genuine encryption failure. Returning\n    // `doc` would hand the caller the plaintext document to write into `entity_indexes`,\n    // which must stay encrypted at rest; returning `null` would mean \"record gone\" and make\n    // `upsertIndexRow` delete a healthy index row. Fail loudly instead: the projection keeps\n    // its previous, correctly encrypted contents and the `query_index.upsert_one` subscriber\n    // persists the error via `recordIndexerError`.\n    logger.error('Index document encryption failed; refusing to return an unencrypted document', {\n      entityType: params.entityType,\n      recordId: params.recordId,\n      tenantId: params.tenantId ?? null,\n      organizationId: params.organizationId ?? null,\n      err: error,\n    })\n    throw error\n  }\n\n  return doc\n}\n\nexport type UpsertIndexResult = {\n  doc: Record<string, any> | null\n  existed: boolean\n  wasDeleted: boolean\n  created: boolean\n  revived: boolean\n}\n\nfunction scopeEntityIndexes<QB extends { where: (...args: any[]) => QB }>(\n  q: QB,\n  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null },\n): QB {\n  let chain = q.where('entity_type' as any, '=', args.entityType)\n  chain = chain.where('entity_id' as any, '=', String(args.recordId))\n  chain = args.organizationId == null\n    ? chain.where('organization_id' as any, 'is', null as any)\n    : chain.where('organization_id' as any, '=', args.organizationId)\n  chain = chain.where(sql`tenant_id is not distinct from ${args.tenantId ?? null}`)\n  return chain\n}\n\nexport async function upsertIndexRow(\n  em: EntityManager,\n  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; searchTokenDoc?: Record<string, unknown> | null; deferSearchTokens?: boolean; trx?: QueryIndexExecutor }\n): Promise<UpsertIndexResult> {\n  const db = (em as any).getKysely()\n  const executor = args.trx ?? db\n\n  const existing = await scopeEntityIndexes(\n    executor.selectFrom('entity_indexes' as any).select(['id' as any, 'deleted_at' as any]),\n    args,\n  ).executeTakeFirst() as { id: string; deleted_at: Date | null } | undefined\n\n  const existed = !!existing\n  const wasDeleted = !!existing && existing.deleted_at != null\n\n  const doc = await buildIndexDoc(em, args)\n  if (!doc) {\n    // When the caller defers token work it owns the matching token cleanup; the\n    // projection-row removal below stays synchronous so list reads converge immediately.\n    if (!args.deferSearchTokens) {\n      try {\n        await reindexSearchTokensForRecord(em, {\n          entityType: args.entityType,\n          recordId: args.recordId,\n          organizationId: args.organizationId ?? null,\n          tenantId: args.tenantId ?? null,\n          doc: null,\n          trx: args.trx,\n        })\n      } catch (error) {\n        if (args.trx) throw error\n      }\n    }\n    if (existed) {\n      await scopeEntityIndexes(\n        executor.deleteFrom('entity_indexes' as any) as any,\n        args,\n      ).execute()\n    }\n    return { doc: null, existed, wasDeleted, created: false, revived: false }\n  }\n\n  const payload = {\n    entity_type: args.entityType,\n    entity_id: String(args.recordId),\n    organization_id: args.organizationId ?? null,\n    tenant_id: args.tenantId ?? null,\n    doc: sql`${JSON.stringify(doc)}::jsonb`,\n    index_version: 1,\n    updated_at: sql`now()`,\n    deleted_at: null,\n  }\n\n  // Prefer modern upsert keyed by coalesced org id when available; fallback to update-then-insert\n  try {\n    await executor\n      .insertInto('entity_indexes' as any)\n      .values({ ...payload, created_at: sql`now()` } as any)\n      .onConflict((oc: any) => oc\n        .columns(['entity_type', 'entity_id', 'organization_id_coalesced'])\n        .doUpdateSet({\n          tenant_id: args.tenantId ?? null,\n          doc: sql`${JSON.stringify(doc)}::jsonb`,\n          index_version: 1,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any))\n      .execute()\n  } catch {\n    // Fallback for schemas without organization_id_coalesced column/index\n    const updated = await scopeEntityIndexes(\n      executor.updateTable('entity_indexes' as any).set(payload as any) as any,\n      args,\n    ).executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined\n    if (!updated || Number(updated.numUpdatedRows ?? 0) === 0) {\n      try {\n        await executor\n          .insertInto('entity_indexes' as any)\n          .values({ ...payload, created_at: sql`now()` } as any)\n          .execute()\n      } catch (error) {\n        if (args.trx) throw error\n      }\n    }\n  }\n\n  const created = !existed\n  const revived = existed && wasDeleted\n  // The search-token rebuild (DELETE + chunked INSERT) is the heavy tail of indexing.\n  // Callers that defer it (the upsert subscriber) run `reindexSearchTokensForRecord`\n  // asynchronously after this projection update so write latency stays bounded.\n  if (!args.deferSearchTokens) {\n    try {\n      await reindexSearchTokensForRecord(em, {\n        entityType: args.entityType,\n        recordId: args.recordId,\n        organizationId: args.organizationId ?? null,\n        tenantId: args.tenantId ?? null,\n        doc,\n        searchTokenDoc: args.searchTokenDoc ?? null,\n        trx: args.trx,\n      })\n    } catch (error) {\n      if (args.trx) throw error\n    }\n  }\n  return { doc, existed, wasDeleted, created, revived }\n}\n\n/**\n * Rebuilds (or clears, when `doc` is null) the search-token rows for a single record.\n * This is the asynchronous-friendly tail of `upsertIndexRow`: it does not touch the\n * `entity_indexes` projection that list endpoints read, so it can run out-of-band\n * without making query-index reads inconsistent.\n */\nexport async function reindexSearchTokensForRecord(\n  em: EntityManager,\n  args: {\n    entityType: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    doc: Record<string, any> | null\n    searchTokenDoc?: Record<string, unknown> | null\n    trx?: QueryIndexExecutor\n  },\n): Promise<void> {\n  const db = (em as any).getKysely()\n  if (!args.doc) {\n    await deleteSearchTokensForRecord(db, {\n      entityType: args.entityType,\n      recordId: args.recordId,\n      organizationId: args.organizationId ?? null,\n      tenantId: args.tenantId ?? null,\n    }, { trx: args.trx })\n    return\n  }\n  const tokenDoc = args.searchTokenDoc ?? (() => {\n    const encryption = resolveTenantEncryptionService(em as any)\n    const dekKeyCache = new Map<string | null, string | null>()\n    return decryptIndexDocForSearch(\n      args.entityType,\n      args.doc,\n      { tenantId: args.tenantId ?? null, organizationId: args.organizationId ?? null },\n      encryption,\n      dekKeyCache,\n    )\n  })()\n  // Rebuilt on the decrypted document: the aggregate stored in `entity_indexes` was\n  // composed from the row as it sits at rest, so for every encryption-mapped field it\n  // holds ciphertext no user query can ever match (#5625). `resolveSearchConfig` re-parses\n  // the environment on every call, so it is resolved once and threaded into both the\n  // rebuild and the token writer \u2014 that also makes the aggregate's blocklist filter and\n  // the per-field one provably read the same snapshot, as the batch path already does.\n  const searchConfig = resolveSearchConfig()\n  const searchDoc = rebuildAggregateSearchField(await tokenDoc, {\n    entityType: args.entityType,\n    config: searchConfig,\n  })\n  await replaceSearchTokensForRecord(db, {\n    entityType: args.entityType,\n    recordId: args.recordId,\n    organizationId: args.organizationId ?? null,\n    tenantId: args.tenantId ?? null,\n    doc: searchDoc,\n    config: searchConfig,\n  }, { trx: args.trx })\n}\n\nexport async function markDeleted(\n  em: EntityManager,\n  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; trx?: QueryIndexExecutor }\n): Promise<{ wasActive: boolean }> {\n  const db = (em as any).getKysely()\n  const executor = args.trx ?? db\n  const existing = await scopeEntityIndexes(\n    executor.selectFrom('entity_indexes' as any).select(['deleted_at' as any]),\n    args,\n  ).executeTakeFirst() as { deleted_at: Date | null } | undefined\n\n  const wasActive = !!existing && existing.deleted_at == null\n\n  if (existing) {\n    try {\n      await deleteSearchTokensForRecord(db, {\n        entityType: args.entityType,\n        recordId: args.recordId,\n        organizationId: args.organizationId ?? null,\n        tenantId: args.tenantId ?? null,\n      }, { trx: args.trx })\n    } catch (error) {\n      if (args.trx) throw error\n    }\n    await scopeEntityIndexes(\n      executor.deleteFrom('entity_indexes' as any) as any,\n      args,\n    ).execute()\n  }\n\n  return { wasActive }\n}\n"],
-  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,sCAAsC;AAC/C,SAAS,0BAA0B,iCAAiC;AACpE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAwC,WAAW;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA8B,mCAAmC;AAC1E,SAAS,4BAA4B,mCAAmC;AAExE,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAWzE,eAAsB,cAAc,IAAmB,QAA6D;AAClH,QAAM,KAAM,GAAW,UAAU;AACjC,QAAM,YAAY,uBAAuB,IAAI,OAAO,UAAU;AAG9D,QAAM,UAAU,MAAM,GACnB,WAAW,SAAgB,EAC3B,UAAU,EACV,MAAM,MAAa,KAAK,OAAO,QAAQ,EACvC,iBAAiB;AACpB,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAyC,CAAC;AAGhD,MAAI,kBAA8C;AAClD,MAAI,OAAO,eAAe,uCAAuC,OAAO,eAAe,sCAAsC;AAC3H,UAAM,WAAY,QAAgB,aAAc,QAAgB;AAChE,QAAI,UAAU;AACZ,YAAM,YAAY,MAAM,GACrB,WAAW,mBAA0B,EACrC,UAAU,EACV,MAAM,MAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAI,WAAW;AACb,mBAAW,KAAK,SAAS;AACzB,0BAAkB;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACA,OAAK;AAGL,MAAI,MAA2B,CAAC;AAChC,aAAW,KAAK,OAAO;AACvB,aAAW,UAAU,YAAY;AAC/B,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,EAAG,KAAI,CAAC,IAAI;AAAA,EACxD;AAGA,MAAI,UAAU,GACX,WAAW,qBAA4B,EACvC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,MAAM,aAAoB,KAAK,OAAO,UAAU,EAChD,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AAEzD,MAAI,OAAO,kBAAkB,MAAM;AACjC,cAAU,QAAQ,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MACzC,GAAG,mBAA0B,KAAK,OAAO,cAAc;AAAA,MACvD,GAAG,mBAA0B,MAAM,IAAI;AAAA,IACzC,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,cAAU,QAAQ,MAAM,mBAA0B,MAAM,IAAI;AAAA,EAC9D;AAEA,MAAI,OAAO,YAAY,MAAM;AAC3B,cAAU,QAAQ,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MACzC,GAAG,aAAoB,KAAK,OAAO,QAAQ;AAAA,MAC3C,GAAG,aAAoB,MAAM,IAAI;AAAA,IACnC,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,cAAU,QAAQ,MAAM,aAAoB,MAAM,IAAI;AAAA,EACxD;AAEA,QAAM,SAAS,MAAM,QAAQ,QAAQ;AAErC,QAAM,QAA+B,CAAC;AACtC,aAAW,KAAK,QAAQ;AACtB,UAAM,MAAM,OAAO,EAAE,SAAS;AAC9B,UAAM,QAAQ,MAAM,GAAG;AACvB,UAAM,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB;AACjG,QAAI,CAAC,MAAM,KAAK,EAAG,OAAM,KAAK,IAAI,CAAC;AACnC,UAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACvB;AAEA,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,YAAY,OAAO,KAAK,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;AAC9D,MAAI,UAAU,SAAS,GAAG;AACxB,QAAI,WAAW,GACZ,WAAW,mBAA0B,EACrC,OAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EACA,MAAM,aAAoB,KAAK,OAAO,UAAU,EAChD,MAAM,OAAc,MAAM,SAAS,EACnC,MAAM,aAAoB,KAAK,IAAI,EACnC,MAAM,cAAqB,MAAM,IAAI;AAExC,QAAI,OAAO,kBAAkB,MAAM;AACjC,iBAAW,SAAS,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QAC3C,GAAG,mBAA0B,KAAK,OAAO,cAAc;AAAA,QACvD,GAAG,mBAA0B,MAAM,IAAI;AAAA,MACzC,CAAC,CAAC;AAAA,IACJ,OAAO;AACL,iBAAW,SAAS,MAAM,mBAA0B,MAAM,IAAI;AAAA,IAChE;AAEA,QAAI,OAAO,YAAY,MAAM;AAC3B,iBAAW,SAAS,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QAC3C,GAAG,aAAoB,KAAK,OAAO,QAAQ;AAAA,QAC3C,GAAG,aAAoB,MAAM,IAAI;AAAA,MACnC,CAAC,CAAC;AAAA,IACJ,OAAO;AACL,iBAAW,SAAS,MAAM,aAAoB,MAAM,IAAI;AAAA,IAC1D;AAEA,UAAM,UAAU,MAAM,SAAS,QAAQ;AACvC,UAAM,kBAAkB;AAAA,MACtB,QAAQ,IAAI,CAAC,SAAmC;AAAA,QAC9C,KAAK,OAAO,IAAI,OAAO,EAAE;AAAA,QACzB,UAAU,OAAO;AAAA,QACjB,MAAM,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AAAA,QAChD,YAAY,IAAI;AAAA,QAChB,gBAAgB,IAAI,mBAAmB;AAAA,QACvC,UAAU,IAAI,aAAa;AAAA,QAC3B,WAAW,IAAI,cAAc;AAAA,QAC7B,WAAW,IAAI,cAAc;AAAA,MAC/B,EAAE;AAAA,MACF,EAAE,iBAAiB,OAAO,iBAAiB,CAAC,OAAO,cAAc,IAAI,CAAC,EAAE;AAAA,IAC1E;AACA,eAAW,OAAO,WAAW;AAC3B,YAAM,cAAc,gBAAgB,IAAI,uBAAuB,GAAG,CAAC,KAAK,CAAC;AACzE,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,OAAO,kBAAkB;AAAA,QACzB,OAAO,YAAY;AAAA,MACrB;AACA,UAAI,YAAY,MAAO,WAAU,IAAI,GAAG;AAAA,IAC1C;AAAA,EACF;AAEA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AAG9C,UAAM,WAAW,IAAI,MAAM,CAAC;AAC5B,QAAI,GAAG,IAAI,UAAU,IAAI,QAAQ,KAAK,IAAI,SAAS,IAAI,MAAM,IAAI,CAAC;AAAA,EACpE;AAGA,MAAI;AACF,UAAM,iBAAiB,MAAM,GAC1B,WAAW,qBAA4B,EACvC,OAAO,CAAC,cAAqB,CAAC,EAC9B,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC,EACtD,MAAM,qCAAqC,OAAO,YAAY,IAAI,EAAE,EACpE,MAAM,2CAA2C,OAAO,kBAAkB,IAAI,EAAE,EAChF,iBAAiB;AAEpB,QAAI,gBAAgB,gBAAgB,OAAO,eAAe,iBAAiB,UAAU;AACnF,iBAAW,CAAC,QAAQ,MAAM,KAAK,OAAO,QAAQ,eAAe,YAAY,GAAG;AAC1E,YAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAC3C,mBAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAiC,GAAG;AAC9E,cAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,gBAAI,QAAQ,MAAM,IAAI,KAAK,EAAE,IAAI;AAAA,UACnC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAAC;AAKT,QAAM,2BAA2B,KAAK,EAAE,YAAY,OAAO,WAAW,CAAC;AAEvE,MAAI;AACF,UAAM,aAAa,+BAA+B,EAAS;AAC3D,UAAM,MAAM;AAAA,MACV,OAAO;AAAA,MACP;AAAA,MACA,EAAE,UAAU,OAAO,YAAY,MAAM,gBAAgB,OAAO,kBAAkB,KAAK;AAAA,MACnF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AAQd,WAAO,MAAM,gFAAgF;AAAA,MAC3F,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO,YAAY;AAAA,MAC7B,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,KAAK;AAAA,IACP,CAAC;AACD,UAAM;AAAA,EACR;AAEA,SAAO;AACT;AAUA,SAAS,mBACP,GACA,MACI;AACJ,MAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,UAAU;AAC9D,UAAQ,MAAM,MAAM,aAAoB,KAAK,OAAO,KAAK,QAAQ,CAAC;AAClE,UAAQ,KAAK,kBAAkB,OAC3B,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK,cAAc;AAClE,UAAQ,MAAM,MAAM,qCAAqC,KAAK,YAAY,IAAI,EAAE;AAChF,SAAO;AACT;AAEA,eAAsB,eACpB,IACA,MAC4B;AAC5B,QAAM,KAAM,GAAW,UAAU;AACjC,QAAM,WAAW,KAAK,OAAO;AAE7B,QAAM,WAAW,MAAM;AAAA,IACrB,SAAS,WAAW,gBAAuB,EAAE,OAAO,CAAC,MAAa,YAAmB,CAAC;AAAA,IACtF;AAAA,EACF,EAAE,iBAAiB;AAEnB,QAAM,UAAU,CAAC,CAAC;AAClB,QAAM,aAAa,CAAC,CAAC,YAAY,SAAS,cAAc;AAExD,QAAM,MAAM,MAAM,cAAc,IAAI,IAAI;AACxC,MAAI,CAAC,KAAK;AAGR,QAAI,CAAC,KAAK,mBAAmB;AAC3B,UAAI;AACF,cAAM,6BAA6B,IAAI;AAAA,UACrC,YAAY,KAAK;AAAA,UACjB,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,UAAU,KAAK,YAAY;AAAA,UAC3B,KAAK;AAAA,UACL,KAAK,KAAK;AAAA,QACZ,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,KAAK,IAAK,OAAM;AAAA,MACtB;AAAA,IACF;AACA,QAAI,SAAS;AACX,YAAM;AAAA,QACJ,SAAS,WAAW,gBAAuB;AAAA,QAC3C;AAAA,MACF,EAAE,QAAQ;AAAA,IACZ;AACA,WAAO,EAAE,KAAK,MAAM,SAAS,YAAY,SAAS,OAAO,SAAS,MAAM;AAAA,EAC1E;AAEA,QAAM,UAAU;AAAA,IACd,aAAa,KAAK;AAAA,IAClB,WAAW,OAAO,KAAK,QAAQ;AAAA,IAC/B,iBAAiB,KAAK,kBAAkB;AAAA,IACxC,WAAW,KAAK,YAAY;AAAA,IAC5B,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,IAC9B,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AAGA,MAAI;AACF,UAAM,SACH,WAAW,gBAAuB,EAClC,OAAO,EAAE,GAAG,SAAS,YAAY,WAAW,CAAQ,EACpD,WAAW,CAAC,OAAY,GACtB,QAAQ,CAAC,eAAe,aAAa,2BAA2B,CAAC,EACjE,YAAY;AAAA,MACX,WAAW,KAAK,YAAY;AAAA,MAC5B,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9B,eAAe;AAAA,MACf,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAQ,CAAC,EACV,QAAQ;AAAA,EACb,QAAQ;AAEN,UAAM,UAAU,MAAM;AAAA,MACpB,SAAS,YAAY,gBAAuB,EAAE,IAAI,OAAc;AAAA,MAChE;AAAA,IACF,EAAE,iBAAiB;AACnB,QAAI,CAAC,WAAW,OAAO,QAAQ,kBAAkB,CAAC,MAAM,GAAG;AACzD,UAAI;AACF,cAAM,SACH,WAAW,gBAAuB,EAClC,OAAO,EAAE,GAAG,SAAS,YAAY,WAAW,CAAQ,EACpD,QAAQ;AAAA,MACb,SAAS,OAAO;AACd,YAAI,KAAK,IAAK,OAAM;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,CAAC;AACjB,QAAM,UAAU,WAAW;AAI3B,MAAI,CAAC,KAAK,mBAAmB;AAC3B,QAAI;AACF,YAAM,6BAA6B,IAAI;AAAA,QACrC,YAAY,KAAK;AAAA,QACjB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK,kBAAkB;AAAA,QACvC,UAAU,KAAK,YAAY;AAAA,QAC3B;AAAA,QACA,gBAAgB,KAAK,kBAAkB;AAAA,QACvC,KAAK,KAAK;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,IAAK,OAAM;AAAA,IACtB;AAAA,EACF;AACA,SAAO,EAAE,KAAK,SAAS,YAAY,SAAS,QAAQ;AACtD;AAQA,eAAsB,6BACpB,IACA,MASe;AACf,QAAM,KAAM,GAAW,UAAU;AACjC,MAAI,CAAC,KAAK,KAAK;AACb,UAAM,4BAA4B,IAAI;AAAA,MACpC,YAAY,KAAK;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,IAC7B,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;AACpB;AAAA,EACF;AACA,QAAM,WAAW,KAAK,mBAAmB,MAAM;AAC7C,UAAM,aAAa,+BAA+B,EAAS;AAC3D,UAAM,cAAc,oBAAI,IAAkC;AAC1D,WAAO;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,MAC/E;AAAA,MACA;AAAA,IACF;AAAA,EACF,GAAG;AAOH,QAAM,eAAe,oBAAoB;AACzC,QAAM,YAAY,4BAA4B,MAAM,UAAU;AAAA,IAC5D,YAAY,KAAK;AAAA,IACjB,QAAQ;AAAA,EACV,CAAC;AACD,QAAM,6BAA6B,IAAI;AAAA,IACrC,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,UAAU,KAAK,YAAY;AAAA,IAC3B,KAAK;AAAA,IACL,QAAQ;AAAA,EACV,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;AACtB;AAEA,eAAsB,YACpB,IACA,MACiC;AACjC,QAAM,KAAM,GAAW,UAAU;AACjC,QAAM,WAAW,KAAK,OAAO;AAC7B,QAAM,WAAW,MAAM;AAAA,IACrB,SAAS,WAAW,gBAAuB,EAAE,OAAO,CAAC,YAAmB,CAAC;AAAA,IACzE;AAAA,EACF,EAAE,iBAAiB;AAEnB,QAAM,YAAY,CAAC,CAAC,YAAY,SAAS,cAAc;AAEvD,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,4BAA4B,IAAI;AAAA,QACpC,YAAY,KAAK;AAAA,QACjB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK,kBAAkB;AAAA,QACvC,UAAU,KAAK,YAAY;AAAA,MAC7B,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,IACtB,SAAS,OAAO;AACd,UAAI,KAAK,IAAK,OAAM;AAAA,IACtB;AACA,UAAM;AAAA,MACJ,SAAS,WAAW,gBAAuB;AAAA,MAC3C;AAAA,IACF,EAAE,QAAQ;AAAA,EACZ;AAEA,SAAO,EAAE,UAAU;AACrB;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { decryptIndexDocForSearch, encryptIndexDocForStorage } from '@open-mercato/shared/lib/encryption/indexDoc'\nimport {\n  buildCustomFieldDefinitionIndexFromRows,\n  normalizeDefinitionKey,\n  selectDefinitionForRecord,\n  type CustomFieldDefinitionRow,\n} from '@open-mercato/shared/lib/crud/custom-field-definition-index'\nimport { type Kysely, type Transaction, sql } from 'kysely'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'\nimport { replaceSearchTokensForRecord, deleteSearchTokensForRecord } from './search-tokens'\nimport { attachAggregateSearchField, rebuildAggregateSearchField } from './document'\nimport { applyIndexDocEnrichers } from './doc-enrichers'\n\nconst logger = createLogger('query_index').child({ component: 'indexer' })\n\ntype QueryIndexExecutor = Kysely<any> | Transaction<any>\n\ntype BuildDocParams = {\n  entityType: string // '<module>:<entity>'\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport async function buildIndexDoc(em: EntityManager, params: BuildDocParams): Promise<Record<string, any> | null> {\n  const db = (em as any).getKysely()\n  const baseTable = resolveEntityTableName(em, params.entityType)\n\n  // Fetch base row\n  const baseRow = await db\n    .selectFrom(baseTable as any)\n    .selectAll()\n    .where('id' as any, '=', params.recordId)\n    .executeTakeFirst() as Record<string, any> | undefined\n  if (!baseRow) return null\n  const docSources: Array<Record<string, any>> = []\n\n  // Attach the core customer entity when indexing customer profiles so search tokens see the combined row\n  let parentEntityRow: Record<string, any> | null = null\n  if (params.entityType === 'customers:customer_person_profile' || params.entityType === 'customers:customer_company_profile') {\n    const entityId = (baseRow as any).entity_id ?? (baseRow as any).entityId\n    if (entityId) {\n      const entityRow = await db\n        .selectFrom('customer_entities' as any)\n        .selectAll()\n        .where('id' as any, '=', entityId)\n        .executeTakeFirst() as Record<string, any> | undefined\n      if (entityRow) {\n        docSources.push(entityRow)\n        parentEntityRow = entityRow\n      }\n    }\n  }\n  void parentEntityRow\n\n  // Build base document (snake_case keys as in DB)\n  let doc: Record<string, any> = {}\n  docSources.push(baseRow)\n  for (const source of docSources) {\n    for (const [k, v] of Object.entries(source)) doc[k] = v\n  }\n\n  // Attach custom fields under flat keys 'cf:<key>'\n  let cfQuery = db\n    .selectFrom('custom_field_values' as any)\n    .select([\n      'field_key' as any,\n      'value_text' as any,\n      'value_multiline' as any,\n      'value_int' as any,\n      'value_float' as any,\n      'value_bool' as any,\n    ])\n    .where('entity_id' as any, '=', params.entityType)\n    .where('record_id' as any, '=', String(params.recordId))\n\n  if (params.organizationId != null) {\n    cfQuery = cfQuery.where((eb: any) => eb.or([\n      eb('organization_id' as any, '=', params.organizationId),\n      eb('organization_id' as any, 'is', null),\n    ]))\n  } else {\n    cfQuery = cfQuery.where('organization_id' as any, 'is', null)\n  }\n\n  if (params.tenantId != null) {\n    cfQuery = cfQuery.where((eb: any) => eb.or([\n      eb('tenant_id' as any, '=', params.tenantId),\n      eb('tenant_id' as any, 'is', null),\n    ]))\n  } else {\n    cfQuery = cfQuery.where('tenant_id' as any, 'is', null)\n  }\n\n  const cfRows = await cfQuery.execute() as Array<Record<string, any>>\n\n  const cfMap: Record<string, any[]> = {}\n  for (const r of cfRows) {\n    const key = String(r.field_key)\n    const cfKey = `cf:${key}`\n    const val = r.value_bool ?? r.value_int ?? r.value_float ?? r.value_text ?? r.value_multiline ?? null\n    if (!cfMap[cfKey]) cfMap[cfKey] = []\n    cfMap[cfKey].push(val)\n  }\n\n  const multiKeys = new Set<string>()\n  const fieldKeys = Object.keys(cfMap).map((key) => key.slice(3))\n  if (fieldKeys.length > 0) {\n    let defQuery = db\n      .selectFrom('custom_field_defs' as any)\n      .select([\n        'key' as any,\n        'kind' as any,\n        'config_json' as any,\n        'organization_id' as any,\n        'tenant_id' as any,\n        'deleted_at' as any,\n        'updated_at' as any,\n      ])\n      .where('entity_id' as any, '=', params.entityType)\n      .where('key' as any, 'in', fieldKeys)\n      .where('is_active' as any, '=', true)\n      .where('deleted_at' as any, 'is', null)\n\n    if (params.organizationId != null) {\n      defQuery = defQuery.where((eb: any) => eb.or([\n        eb('organization_id' as any, '=', params.organizationId),\n        eb('organization_id' as any, 'is', null),\n      ]))\n    } else {\n      defQuery = defQuery.where('organization_id' as any, 'is', null)\n    }\n\n    if (params.tenantId != null) {\n      defQuery = defQuery.where((eb: any) => eb.or([\n        eb('tenant_id' as any, '=', params.tenantId),\n        eb('tenant_id' as any, 'is', null),\n      ]))\n    } else {\n      defQuery = defQuery.where('tenant_id' as any, 'is', null)\n    }\n\n    const defRows = await defQuery.execute() as Array<Record<string, any>>\n    const definitionIndex = buildCustomFieldDefinitionIndexFromRows(\n      defRows.map((row): CustomFieldDefinitionRow => ({\n        key: String(row.key ?? ''),\n        entityId: params.entityType,\n        kind: typeof row.kind === 'string' ? row.kind : null,\n        configJson: row.config_json,\n        organizationId: row.organization_id ?? null,\n        tenantId: row.tenant_id ?? null,\n        deletedAt: row.deleted_at ?? null,\n        updatedAt: row.updated_at ?? null,\n      })),\n      { organizationIds: params.organizationId ? [params.organizationId] : [] },\n    )\n    for (const key of fieldKeys) {\n      const definitions = definitionIndex.get(normalizeDefinitionKey(key)) ?? []\n      const definition = selectDefinitionForRecord(\n        definitions,\n        params.organizationId ?? null,\n        params.tenantId ?? null,\n      )\n      if (definition?.multi) multiKeys.add(key)\n    }\n  }\n\n  for (const [key, arr] of Object.entries(cfMap)) {\n    // Cardinality belongs to the field definition, not the current row count:\n    // a multi field containing one value must still hydrate as an array.\n    const fieldKey = key.slice(3)\n    doc[key] = multiKeys.has(fieldKey) || arr.length > 1 ? arr : arr[0]\n  }\n\n  // Attach translations under flat keys 'l10n:{locale}:{field}'\n  try {\n    const translationRow = await db\n      .selectFrom('entity_translations' as any)\n      .select(['translations' as any])\n      .where('entity_type' as any, '=', params.entityType)\n      .where('entity_id' as any, '=', String(params.recordId))\n      .where(sql`tenant_id is not distinct from ${params.tenantId ?? null}`)\n      .where(sql`organization_id is not distinct from ${params.organizationId ?? null}`)\n      .executeTakeFirst() as { translations: Record<string, Record<string, unknown>> | null } | undefined\n\n    if (translationRow?.translations && typeof translationRow.translations === 'object') {\n      for (const [locale, fields] of Object.entries(translationRow.translations)) {\n        if (!fields || typeof fields !== 'object') continue\n        for (const [field, value] of Object.entries(fields as Record<string, unknown>)) {\n          if (typeof value === 'string' && value.length > 0) {\n            doc[`l10n:${locale}:${field}`] = value\n          }\n        }\n      }\n    }\n  } catch {}\n\n  await applyIndexDocEnrichers(db, params.entityType, [{\n    recordId: String(params.recordId),\n    doc,\n    tenantId: params.tenantId ?? null,\n    organizationId: params.organizationId ?? null,\n  }])\n\n  // Kept outside the guard below: a failure while building the aggregate search field is a\n  // bug in the aggregation or its configuration, and must surface instead of being mistaken\n  // for an encryption failure and silently skipping encryption.\n  doc = attachAggregateSearchField(doc, { entityType: params.entityType })\n\n  try {\n    const encryption = resolveTenantEncryptionService(em as any)\n    doc = await encryptIndexDocForStorage(\n      params.entityType,\n      doc,\n      { tenantId: params.tenantId ?? null, organizationId: params.organizationId ?? null },\n      encryption,\n    )\n  } catch (error) {\n    // `encryptIndexDocForStorage` already returns the document untouched when encryption is\n    // absent or disabled, so a throw here is always a genuine encryption failure. Returning\n    // `doc` would hand the caller the plaintext document to write into `entity_indexes`,\n    // which must stay encrypted at rest; returning `null` would mean \"record gone\" and make\n    // `upsertIndexRow` delete a healthy index row. Fail loudly instead: the projection keeps\n    // its previous, correctly encrypted contents and the `query_index.upsert_one` subscriber\n    // persists the error via `recordIndexerError`.\n    logger.error('Index document encryption failed; refusing to return an unencrypted document', {\n      entityType: params.entityType,\n      recordId: params.recordId,\n      tenantId: params.tenantId ?? null,\n      organizationId: params.organizationId ?? null,\n      err: error,\n    })\n    throw error\n  }\n\n  return doc\n}\n\nexport type UpsertIndexResult = {\n  doc: Record<string, any> | null\n  existed: boolean\n  wasDeleted: boolean\n  created: boolean\n  revived: boolean\n}\n\nfunction scopeEntityIndexes<QB extends { where: (...args: any[]) => QB }>(\n  q: QB,\n  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null },\n): QB {\n  let chain = q.where('entity_type' as any, '=', args.entityType)\n  chain = chain.where('entity_id' as any, '=', String(args.recordId))\n  chain = args.organizationId == null\n    ? chain.where('organization_id' as any, 'is', null as any)\n    : chain.where('organization_id' as any, '=', args.organizationId)\n  chain = chain.where(sql`tenant_id is not distinct from ${args.tenantId ?? null}`)\n  return chain\n}\n\nexport async function upsertIndexRow(\n  em: EntityManager,\n  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; searchTokenDoc?: Record<string, unknown> | null; deferSearchTokens?: boolean; trx?: QueryIndexExecutor }\n): Promise<UpsertIndexResult> {\n  const db = (em as any).getKysely()\n  const executor = args.trx ?? db\n\n  const existing = await scopeEntityIndexes(\n    executor.selectFrom('entity_indexes' as any).select(['id' as any, 'deleted_at' as any]),\n    args,\n  ).executeTakeFirst() as { id: string; deleted_at: Date | null } | undefined\n\n  const existed = !!existing\n  const wasDeleted = !!existing && existing.deleted_at != null\n\n  const doc = await buildIndexDoc(em, args)\n  if (!doc) {\n    // When the caller defers token work it owns the matching token cleanup; the\n    // projection-row removal below stays synchronous so list reads converge immediately.\n    if (!args.deferSearchTokens) {\n      try {\n        await reindexSearchTokensForRecord(em, {\n          entityType: args.entityType,\n          recordId: args.recordId,\n          organizationId: args.organizationId ?? null,\n          tenantId: args.tenantId ?? null,\n          doc: null,\n          trx: args.trx,\n        })\n      } catch (error) {\n        if (args.trx) throw error\n      }\n    }\n    if (existed) {\n      await scopeEntityIndexes(\n        executor.deleteFrom('entity_indexes' as any) as any,\n        args,\n      ).execute()\n    }\n    return { doc: null, existed, wasDeleted, created: false, revived: false }\n  }\n\n  const payload = {\n    entity_type: args.entityType,\n    entity_id: String(args.recordId),\n    organization_id: args.organizationId ?? null,\n    tenant_id: args.tenantId ?? null,\n    doc: sql`${JSON.stringify(doc)}::jsonb`,\n    index_version: 1,\n    updated_at: sql`now()`,\n    deleted_at: null,\n  }\n\n  // Prefer modern upsert keyed by coalesced org id when available; fallback to update-then-insert\n  try {\n    await executor\n      .insertInto('entity_indexes' as any)\n      .values({ ...payload, created_at: sql`now()` } as any)\n      .onConflict((oc: any) => oc\n        .columns(['entity_type', 'entity_id', 'organization_id_coalesced'])\n        .doUpdateSet({\n          tenant_id: args.tenantId ?? null,\n          doc: sql`${JSON.stringify(doc)}::jsonb`,\n          index_version: 1,\n          updated_at: sql`now()`,\n          deleted_at: null,\n        } as any))\n      .execute()\n  } catch {\n    // Fallback for schemas without organization_id_coalesced column/index\n    const updated = await scopeEntityIndexes(\n      executor.updateTable('entity_indexes' as any).set(payload as any) as any,\n      args,\n    ).executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined\n    if (!updated || Number(updated.numUpdatedRows ?? 0) === 0) {\n      try {\n        await executor\n          .insertInto('entity_indexes' as any)\n          .values({ ...payload, created_at: sql`now()` } as any)\n          .execute()\n      } catch (error) {\n        if (args.trx) throw error\n      }\n    }\n  }\n\n  const created = !existed\n  const revived = existed && wasDeleted\n  // The search-token rebuild (DELETE + chunked INSERT) is the heavy tail of indexing.\n  // Callers that defer it (the upsert subscriber) run `reindexSearchTokensForRecord`\n  // asynchronously after this projection update so write latency stays bounded.\n  if (!args.deferSearchTokens) {\n    try {\n      await reindexSearchTokensForRecord(em, {\n        entityType: args.entityType,\n        recordId: args.recordId,\n        organizationId: args.organizationId ?? null,\n        tenantId: args.tenantId ?? null,\n        doc,\n        searchTokenDoc: args.searchTokenDoc ?? null,\n        trx: args.trx,\n      })\n    } catch (error) {\n      if (args.trx) throw error\n    }\n  }\n  return { doc, existed, wasDeleted, created, revived }\n}\n\n/**\n * Rebuilds (or clears, when `doc` is null) the search-token rows for a single record.\n * This is the asynchronous-friendly tail of `upsertIndexRow`: it does not touch the\n * `entity_indexes` projection that list endpoints read, so it can run out-of-band\n * without making query-index reads inconsistent.\n */\nexport async function reindexSearchTokensForRecord(\n  em: EntityManager,\n  args: {\n    entityType: string\n    recordId: string\n    organizationId?: string | null\n    tenantId?: string | null\n    doc: Record<string, any> | null\n    searchTokenDoc?: Record<string, unknown> | null\n    trx?: QueryIndexExecutor\n  },\n): Promise<void> {\n  const db = (em as any).getKysely()\n  if (!args.doc) {\n    await deleteSearchTokensForRecord(db, {\n      entityType: args.entityType,\n      recordId: args.recordId,\n      organizationId: args.organizationId ?? null,\n      tenantId: args.tenantId ?? null,\n    }, { trx: args.trx })\n    return\n  }\n  const tokenDoc = args.searchTokenDoc ?? (() => {\n    const encryption = resolveTenantEncryptionService(em as any)\n    const dekKeyCache = new Map<string | null, string | null>()\n    return decryptIndexDocForSearch(\n      args.entityType,\n      args.doc,\n      { tenantId: args.tenantId ?? null, organizationId: args.organizationId ?? null },\n      encryption,\n      dekKeyCache,\n    )\n  })()\n  // Rebuilt on the decrypted document: the aggregate stored in `entity_indexes` was\n  // composed from the row as it sits at rest, so for every encryption-mapped field it\n  // holds ciphertext no user query can ever match (#5625). `resolveSearchConfig` re-parses\n  // the environment on every call, so it is resolved once and threaded into both the\n  // rebuild and the token writer \u2014 that also makes the aggregate's blocklist filter and\n  // the per-field one provably read the same snapshot, as the batch path already does.\n  const searchConfig = resolveSearchConfig()\n  const searchDoc = rebuildAggregateSearchField(await tokenDoc, {\n    entityType: args.entityType,\n    config: searchConfig,\n  })\n  await replaceSearchTokensForRecord(db, {\n    entityType: args.entityType,\n    recordId: args.recordId,\n    organizationId: args.organizationId ?? null,\n    tenantId: args.tenantId ?? null,\n    doc: searchDoc,\n    config: searchConfig,\n  }, { trx: args.trx })\n}\n\nexport async function markDeleted(\n  em: EntityManager,\n  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; trx?: QueryIndexExecutor }\n): Promise<{ wasActive: boolean }> {\n  const db = (em as any).getKysely()\n  const executor = args.trx ?? db\n  const existing = await scopeEntityIndexes(\n    executor.selectFrom('entity_indexes' as any).select(['deleted_at' as any]),\n    args,\n  ).executeTakeFirst() as { deleted_at: Date | null } | undefined\n\n  const wasActive = !!existing && existing.deleted_at == null\n\n  if (existing) {\n    try {\n      await deleteSearchTokensForRecord(db, {\n        entityType: args.entityType,\n        recordId: args.recordId,\n        organizationId: args.organizationId ?? null,\n        tenantId: args.tenantId ?? null,\n      }, { trx: args.trx })\n    } catch (error) {\n      if (args.trx) throw error\n    }\n    await scopeEntityIndexes(\n      executor.deleteFrom('entity_indexes' as any) as any,\n      args,\n    ).execute()\n  }\n\n  return { wasActive }\n}\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,sCAAsC;AAC/C,SAAS,0BAA0B,iCAAiC;AACpE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAwC,WAAW;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA8B,mCAAmC;AAC1E,SAAS,4BAA4B,mCAAmC;AACxE,SAAS,8BAA8B;AAEvC,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAWzE,eAAsB,cAAc,IAAmB,QAA6D;AAClH,QAAM,KAAM,GAAW,UAAU;AACjC,QAAM,YAAY,uBAAuB,IAAI,OAAO,UAAU;AAG9D,QAAM,UAAU,MAAM,GACnB,WAAW,SAAgB,EAC3B,UAAU,EACV,MAAM,MAAa,KAAK,OAAO,QAAQ,EACvC,iBAAiB;AACpB,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAyC,CAAC;AAGhD,MAAI,kBAA8C;AAClD,MAAI,OAAO,eAAe,uCAAuC,OAAO,eAAe,sCAAsC;AAC3H,UAAM,WAAY,QAAgB,aAAc,QAAgB;AAChE,QAAI,UAAU;AACZ,YAAM,YAAY,MAAM,GACrB,WAAW,mBAA0B,EACrC,UAAU,EACV,MAAM,MAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAI,WAAW;AACb,mBAAW,KAAK,SAAS;AACzB,0BAAkB;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACA,OAAK;AAGL,MAAI,MAA2B,CAAC;AAChC,aAAW,KAAK,OAAO;AACvB,aAAW,UAAU,YAAY;AAC/B,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,EAAG,KAAI,CAAC,IAAI;AAAA,EACxD;AAGA,MAAI,UAAU,GACX,WAAW,qBAA4B,EACvC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,MAAM,aAAoB,KAAK,OAAO,UAAU,EAChD,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AAEzD,MAAI,OAAO,kBAAkB,MAAM;AACjC,cAAU,QAAQ,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MACzC,GAAG,mBAA0B,KAAK,OAAO,cAAc;AAAA,MACvD,GAAG,mBAA0B,MAAM,IAAI;AAAA,IACzC,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,cAAU,QAAQ,MAAM,mBAA0B,MAAM,IAAI;AAAA,EAC9D;AAEA,MAAI,OAAO,YAAY,MAAM;AAC3B,cAAU,QAAQ,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,MACzC,GAAG,aAAoB,KAAK,OAAO,QAAQ;AAAA,MAC3C,GAAG,aAAoB,MAAM,IAAI;AAAA,IACnC,CAAC,CAAC;AAAA,EACJ,OAAO;AACL,cAAU,QAAQ,MAAM,aAAoB,MAAM,IAAI;AAAA,EACxD;AAEA,QAAM,SAAS,MAAM,QAAQ,QAAQ;AAErC,QAAM,QAA+B,CAAC;AACtC,aAAW,KAAK,QAAQ;AACtB,UAAM,MAAM,OAAO,EAAE,SAAS;AAC9B,UAAM,QAAQ,MAAM,GAAG;AACvB,UAAM,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB;AACjG,QAAI,CAAC,MAAM,KAAK,EAAG,OAAM,KAAK,IAAI,CAAC;AACnC,UAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EACvB;AAEA,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,YAAY,OAAO,KAAK,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;AAC9D,MAAI,UAAU,SAAS,GAAG;AACxB,QAAI,WAAW,GACZ,WAAW,mBAA0B,EACrC,OAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EACA,MAAM,aAAoB,KAAK,OAAO,UAAU,EAChD,MAAM,OAAc,MAAM,SAAS,EACnC,MAAM,aAAoB,KAAK,IAAI,EACnC,MAAM,cAAqB,MAAM,IAAI;AAExC,QAAI,OAAO,kBAAkB,MAAM;AACjC,iBAAW,SAAS,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QAC3C,GAAG,mBAA0B,KAAK,OAAO,cAAc;AAAA,QACvD,GAAG,mBAA0B,MAAM,IAAI;AAAA,MACzC,CAAC,CAAC;AAAA,IACJ,OAAO;AACL,iBAAW,SAAS,MAAM,mBAA0B,MAAM,IAAI;AAAA,IAChE;AAEA,QAAI,OAAO,YAAY,MAAM;AAC3B,iBAAW,SAAS,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,QAC3C,GAAG,aAAoB,KAAK,OAAO,QAAQ;AAAA,QAC3C,GAAG,aAAoB,MAAM,IAAI;AAAA,MACnC,CAAC,CAAC;AAAA,IACJ,OAAO;AACL,iBAAW,SAAS,MAAM,aAAoB,MAAM,IAAI;AAAA,IAC1D;AAEA,UAAM,UAAU,MAAM,SAAS,QAAQ;AACvC,UAAM,kBAAkB;AAAA,MACtB,QAAQ,IAAI,CAAC,SAAmC;AAAA,QAC9C,KAAK,OAAO,IAAI,OAAO,EAAE;AAAA,QACzB,UAAU,OAAO;AAAA,QACjB,MAAM,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AAAA,QAChD,YAAY,IAAI;AAAA,QAChB,gBAAgB,IAAI,mBAAmB;AAAA,QACvC,UAAU,IAAI,aAAa;AAAA,QAC3B,WAAW,IAAI,cAAc;AAAA,QAC7B,WAAW,IAAI,cAAc;AAAA,MAC/B,EAAE;AAAA,MACF,EAAE,iBAAiB,OAAO,iBAAiB,CAAC,OAAO,cAAc,IAAI,CAAC,EAAE;AAAA,IAC1E;AACA,eAAW,OAAO,WAAW;AAC3B,YAAM,cAAc,gBAAgB,IAAI,uBAAuB,GAAG,CAAC,KAAK,CAAC;AACzE,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,OAAO,kBAAkB;AAAA,QACzB,OAAO,YAAY;AAAA,MACrB;AACA,UAAI,YAAY,MAAO,WAAU,IAAI,GAAG;AAAA,IAC1C;AAAA,EACF;AAEA,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AAG9C,UAAM,WAAW,IAAI,MAAM,CAAC;AAC5B,QAAI,GAAG,IAAI,UAAU,IAAI,QAAQ,KAAK,IAAI,SAAS,IAAI,MAAM,IAAI,CAAC;AAAA,EACpE;AAGA,MAAI;AACF,UAAM,iBAAiB,MAAM,GAC1B,WAAW,qBAA4B,EACvC,OAAO,CAAC,cAAqB,CAAC,EAC9B,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC,EACtD,MAAM,qCAAqC,OAAO,YAAY,IAAI,EAAE,EACpE,MAAM,2CAA2C,OAAO,kBAAkB,IAAI,EAAE,EAChF,iBAAiB;AAEpB,QAAI,gBAAgB,gBAAgB,OAAO,eAAe,iBAAiB,UAAU;AACnF,iBAAW,CAAC,QAAQ,MAAM,KAAK,OAAO,QAAQ,eAAe,YAAY,GAAG;AAC1E,YAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAC3C,mBAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAiC,GAAG;AAC9E,cAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,gBAAI,QAAQ,MAAM,IAAI,KAAK,EAAE,IAAI;AAAA,UACnC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAAC;AAET,QAAM,uBAAuB,IAAI,OAAO,YAAY,CAAC;AAAA,IACnD,UAAU,OAAO,OAAO,QAAQ;AAAA,IAChC;AAAA,IACA,UAAU,OAAO,YAAY;AAAA,IAC7B,gBAAgB,OAAO,kBAAkB;AAAA,EAC3C,CAAC,CAAC;AAKF,QAAM,2BAA2B,KAAK,EAAE,YAAY,OAAO,WAAW,CAAC;AAEvE,MAAI;AACF,UAAM,aAAa,+BAA+B,EAAS;AAC3D,UAAM,MAAM;AAAA,MACV,OAAO;AAAA,MACP;AAAA,MACA,EAAE,UAAU,OAAO,YAAY,MAAM,gBAAgB,OAAO,kBAAkB,KAAK;AAAA,MACnF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AAQd,WAAO,MAAM,gFAAgF;AAAA,MAC3F,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO,YAAY;AAAA,MAC7B,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,KAAK;AAAA,IACP,CAAC;AACD,UAAM;AAAA,EACR;AAEA,SAAO;AACT;AAUA,SAAS,mBACP,GACA,MACI;AACJ,MAAI,QAAQ,EAAE,MAAM,eAAsB,KAAK,KAAK,UAAU;AAC9D,UAAQ,MAAM,MAAM,aAAoB,KAAK,OAAO,KAAK,QAAQ,CAAC;AAClE,UAAQ,KAAK,kBAAkB,OAC3B,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,KAAK,cAAc;AAClE,UAAQ,MAAM,MAAM,qCAAqC,KAAK,YAAY,IAAI,EAAE;AAChF,SAAO;AACT;AAEA,eAAsB,eACpB,IACA,MAC4B;AAC5B,QAAM,KAAM,GAAW,UAAU;AACjC,QAAM,WAAW,KAAK,OAAO;AAE7B,QAAM,WAAW,MAAM;AAAA,IACrB,SAAS,WAAW,gBAAuB,EAAE,OAAO,CAAC,MAAa,YAAmB,CAAC;AAAA,IACtF;AAAA,EACF,EAAE,iBAAiB;AAEnB,QAAM,UAAU,CAAC,CAAC;AAClB,QAAM,aAAa,CAAC,CAAC,YAAY,SAAS,cAAc;AAExD,QAAM,MAAM,MAAM,cAAc,IAAI,IAAI;AACxC,MAAI,CAAC,KAAK;AAGR,QAAI,CAAC,KAAK,mBAAmB;AAC3B,UAAI;AACF,cAAM,6BAA6B,IAAI;AAAA,UACrC,YAAY,KAAK;AAAA,UACjB,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK,kBAAkB;AAAA,UACvC,UAAU,KAAK,YAAY;AAAA,UAC3B,KAAK;AAAA,UACL,KAAK,KAAK;AAAA,QACZ,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,KAAK,IAAK,OAAM;AAAA,MACtB;AAAA,IACF;AACA,QAAI,SAAS;AACX,YAAM;AAAA,QACJ,SAAS,WAAW,gBAAuB;AAAA,QAC3C;AAAA,MACF,EAAE,QAAQ;AAAA,IACZ;AACA,WAAO,EAAE,KAAK,MAAM,SAAS,YAAY,SAAS,OAAO,SAAS,MAAM;AAAA,EAC1E;AAEA,QAAM,UAAU;AAAA,IACd,aAAa,KAAK;AAAA,IAClB,WAAW,OAAO,KAAK,QAAQ;AAAA,IAC/B,iBAAiB,KAAK,kBAAkB;AAAA,IACxC,WAAW,KAAK,YAAY;AAAA,IAC5B,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,IAC9B,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AAGA,MAAI;AACF,UAAM,SACH,WAAW,gBAAuB,EAClC,OAAO,EAAE,GAAG,SAAS,YAAY,WAAW,CAAQ,EACpD,WAAW,CAAC,OAAY,GACtB,QAAQ,CAAC,eAAe,aAAa,2BAA2B,CAAC,EACjE,YAAY;AAAA,MACX,WAAW,KAAK,YAAY;AAAA,MAC5B,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9B,eAAe;AAAA,MACf,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAQ,CAAC,EACV,QAAQ;AAAA,EACb,QAAQ;AAEN,UAAM,UAAU,MAAM;AAAA,MACpB,SAAS,YAAY,gBAAuB,EAAE,IAAI,OAAc;AAAA,MAChE;AAAA,IACF,EAAE,iBAAiB;AACnB,QAAI,CAAC,WAAW,OAAO,QAAQ,kBAAkB,CAAC,MAAM,GAAG;AACzD,UAAI;AACF,cAAM,SACH,WAAW,gBAAuB,EAClC,OAAO,EAAE,GAAG,SAAS,YAAY,WAAW,CAAQ,EACpD,QAAQ;AAAA,MACb,SAAS,OAAO;AACd,YAAI,KAAK,IAAK,OAAM;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,CAAC;AACjB,QAAM,UAAU,WAAW;AAI3B,MAAI,CAAC,KAAK,mBAAmB;AAC3B,QAAI;AACF,YAAM,6BAA6B,IAAI;AAAA,QACrC,YAAY,KAAK;AAAA,QACjB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK,kBAAkB;AAAA,QACvC,UAAU,KAAK,YAAY;AAAA,QAC3B;AAAA,QACA,gBAAgB,KAAK,kBAAkB;AAAA,QACvC,KAAK,KAAK;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,IAAK,OAAM;AAAA,IACtB;AAAA,EACF;AACA,SAAO,EAAE,KAAK,SAAS,YAAY,SAAS,QAAQ;AACtD;AAQA,eAAsB,6BACpB,IACA,MASe;AACf,QAAM,KAAM,GAAW,UAAU;AACjC,MAAI,CAAC,KAAK,KAAK;AACb,UAAM,4BAA4B,IAAI;AAAA,MACpC,YAAY,KAAK;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK,kBAAkB;AAAA,MACvC,UAAU,KAAK,YAAY;AAAA,IAC7B,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;AACpB;AAAA,EACF;AACA,QAAM,WAAW,KAAK,mBAAmB,MAAM;AAC7C,UAAM,aAAa,+BAA+B,EAAS;AAC3D,UAAM,cAAc,oBAAI,IAAkC;AAC1D,WAAO;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,MAC/E;AAAA,MACA;AAAA,IACF;AAAA,EACF,GAAG;AAOH,QAAM,eAAe,oBAAoB;AACzC,QAAM,YAAY,4BAA4B,MAAM,UAAU;AAAA,IAC5D,YAAY,KAAK;AAAA,IACjB,QAAQ;AAAA,EACV,CAAC;AACD,QAAM,6BAA6B,IAAI;AAAA,IACrC,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,UAAU,KAAK,YAAY;AAAA,IAC3B,KAAK;AAAA,IACL,QAAQ;AAAA,EACV,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;AACtB;AAEA,eAAsB,YACpB,IACA,MACiC;AACjC,QAAM,KAAM,GAAW,UAAU;AACjC,QAAM,WAAW,KAAK,OAAO;AAC7B,QAAM,WAAW,MAAM;AAAA,IACrB,SAAS,WAAW,gBAAuB,EAAE,OAAO,CAAC,YAAmB,CAAC;AAAA,IACzE;AAAA,EACF,EAAE,iBAAiB;AAEnB,QAAM,YAAY,CAAC,CAAC,YAAY,SAAS,cAAc;AAEvD,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,4BAA4B,IAAI;AAAA,QACpC,YAAY,KAAK;AAAA,QACjB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK,kBAAkB;AAAA,QACvC,UAAU,KAAK,YAAY;AAAA,MAC7B,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,IACtB,SAAS,OAAO;AACd,UAAI,KAAK,IAAK,OAAM;AAAA,IACtB;AACA,UAAM;AAAA,MACJ,SAAS,WAAW,gBAAuB;AAAA,MAC3C;AAAA,IACF,EAAE,QAAQ;AAAA,EACZ;AAEA,SAAO,EAAE,UAAU;AACrB;",
   "names": []
 }

package/dist/modules/query_index/lib/search-tokens.js

@@ -9,6 +9,7 @@ import { looksLikeEncryptedPayload } from "@open-mercato/shared/lib/encryption/a
 import { createKmsService, resolveEncryptionMode } from "@open-mercato/shared/lib/encryption/kms";
 import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isIndexDocEnrichedKey } from "./doc-enrichers.js";
 const logger = createLogger("query_index").child({ component: "search-tokens" });
 const INSERT_BATCH_SIZE = 500;
 const TOKEN_EXCLUDED_ENTITY_TYPES = /* @__PURE__ */ new Set(["audit_logs:action_log", "audit_logs:access_log"]);
@@ -76,6 +77,7 @@ function shouldIndexField(field, value, config, entityType) {
   if (lower.endsWith("_at")) return false;
   if (["created_at", "updated_at", "deleted_at", "tenant_id", "organization_id"].includes(lower)) return false;
   if (isSearchFieldBlocklisted(field, entityType, config)) return false;
+  if (isIndexDocEnrichedKey(entityType, field)) return false;
   return collectTextValues(value).some((text) => text.length > 0);
 }
 function buildSearchTokenRows(params) {

package/dist/modules/query_index/lib/search-tokens.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/query_index/lib/search-tokens.ts"],
-  "sourcesContent": ["import { type Kysely, type Transaction, sql } from 'kysely'\nimport {\n  isSearchFieldBlocklisted,\n  resolveSearchConfig,\n  resolveSearchTokenLimits,\n  type SearchConfig,\n} from '@open-mercato/shared/lib/search/config'\nimport { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'\nimport { looksLikeEncryptedPayload } from '@open-mercato/shared/lib/encryption/aes'\nimport { createKmsService, resolveEncryptionMode, type KmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('query_index').child({ component: 'search-tokens' })\n\nconst INSERT_BATCH_SIZE = 500\nconst TOKEN_EXCLUDED_ENTITY_TYPES = new Set(['audit_logs:action_log', 'audit_logs:access_log'])\n\nfunction chunk<T>(items: T[], size: number): T[][] {\n  if (size <= 0) return [items]\n  const out: T[][] = []\n  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size))\n  return out\n}\n\nexport type SearchTokenRow = {\n  entity_type: string\n  entity_id: string\n  organization_id: string | null\n  tenant_id: string | null\n  field: string\n  token_hash: string\n  token?: string | null\n}\n\ntype BuildTokenOptions = {\n  entityType: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  doc?: Record<string, unknown> | null\n  config?: SearchConfig\n  /** Resolved once per write by the exported entry points; see {@link shouldGuardCiphertext}. */\n  guardCiphertext?: boolean\n}\n\nconst DEFAULT_SCOPE = { organizationId: null, tenantId: null }\ntype EntityFieldPair = [string, string]\ntype SearchTokenExecutor = Kysely<any> | Transaction<any>\n\nexport const isSearchDebugEnabled = (): boolean => {\n  return parseBooleanToken(process.env.OM_SEARCH_DEBUG ?? '') === true\n}\n\nconst debug = (event: string, payload: Record<string, unknown>) => {\n  if (!isSearchDebugEnabled()) return\n  try {\n    logger.debug('Search token event', { event, payload })\n  } catch {\n    // ignore\n  }\n}\n\nfunction collectTextValues(value: unknown): string[] {\n  if (typeof value === 'string') return [value]\n  if (Array.isArray(value)) {\n    const out: string[] = []\n    for (const entry of value) {\n      if (typeof entry === 'string') out.push(entry)\n    }\n    return out\n  }\n  return []\n}\n\nlet guardKmsService: KmsService | null = null\n\n/**\n * Whether the ciphertext guard below is allowed to run for this write.\n *\n * The guard recognises an envelope by its SHAPE, which is forgeable: `<16 b64>:<b64>:<24 b64>:v1`\n * is a string any user can type into a searchable field. `tenantDataEncryptionService` removed the\n * same structural test for that reason (#2720). So the guard may only run where the shape is the\n * ONLY test available -- which is exactly where no DEK is reachable:\n *\n * - `active`      -- the indexer decrypted the document before handing it here, so a value still\n *                    shaped like an envelope is plaintext somebody typed. Indexing it is correct,\n *                    and skipping it would let that person freeze their own record's tokens at a\n *                    past state. The guard stays off, which also keeps it off the hot path of\n *                    every normal deployment.\n * - `disabled`    -- `decryptIndexDocForSearch` is a no-op, so ciphertext arrives undecrypted.\n * - `unavailable` -- the decrypt was attempted and could not complete, same outcome.\n *\n * Resolved once per write rather than per document, over a KMS built once per process:\n * {@link createKmsService} logs when it falls back, and a reindex calls this once per record. The\n * toggle itself is still re-read every call by {@link resolveEncryptionMode}; only the KMS is\n * cached, and it already requires a restart to change, since DEK and map caches are in-process.\n */\nfunction shouldGuardCiphertext(): boolean {\n  guardKmsService ??= createKmsService()\n  return resolveEncryptionMode(guardKmsService) !== 'active'\n}\n\n/**\n * Fields whose value is an AES-GCM envelope rather than the text it is supposed to hold.\n *\n * Search tokens are hashes of PLAINTEXT: the indexer decrypts a document before tokenising it\n * (`indexer.ts` -> `decryptIndexDocForSearch`), which is what lets the token index survive\n * encryption being switched on or off. That decrypt step is a no-op once\n * `TENANT_DATA_ENCRYPTION=no`, so an operator who flips the toggle before running\n * `mercato entities decrypt-database` starts feeding ciphertext into the tokeniser. The tokens\n * that come out are hashes of base64 noise and match nothing, and because a write REPLACES a\n * record's tokens, the good plaintext tokens already in the table would be deleted to make room\n * for them -- turning a recoverable misordering into permanent search loss.\n *\n * Detecting the envelope by shape lets the write skip those fields and leave what is already\n * indexed alone. `guard` gates that detection; see {@link shouldGuardCiphertext} for why it is not\n * unconditional.\n */\nfunction ciphertextFieldsOf(\n  doc: Record<string, unknown> | null | undefined,\n  guard: boolean,\n): Set<string> {\n  const fields = new Set<string>()\n  if (!guard || !doc) return fields\n  for (const [field, value] of Object.entries(doc)) {\n    const values = collectTextValues(value)\n    if (values.length && values.some((text) => looksLikeEncryptedPayload(text))) fields.add(field)\n  }\n  return fields\n}\n\nconst warnedCiphertextEntities = new Set<string>()\n\nfunction warnCiphertextSkipped(entityType: string, tenantId: string | null, fields: Set<string>): void {\n  if (!fields.size) return\n  // Once per entity type per tenant per process: a full reindex would otherwise emit this per\n  // record, while keying on the entity type alone would let the first affected tenant in a shared\n  // process consume the one warning every other tenant's operator needed.\n  const key = `${entityType}|${tenantId ?? ''}`\n  if (warnedCiphertextEntities.has(key)) return\n  warnedCiphertextEntities.add(key)\n  logger.warn(\n    'Search indexing skipped ciphertext fields and preserved their existing tokens. '\n      + 'This means TENANT_DATA_ENCRYPTION was switched off while encrypted data was still at rest. '\n      + 'Run `mercato entities decrypt-database` and reindex; until then these fields are not searchable.',\n    { entityType, tenantId, fields: Array.from(fields).sort((left, right) => left.localeCompare(right)) },\n  )\n}\n\n/** Test seam: both the warning above and the KMS behind the guard are once-per-process. */\nexport function resetCiphertextGuardState(): void {\n  warnedCiphertextEntities.clear()\n  guardKmsService = null\n}\n\nfunction shouldIndexField(\n  field: string,\n  value: unknown,\n  config: SearchConfig,\n  entityType: string | null,\n): boolean {\n  if (typeof value !== 'string' && !Array.isArray(value)) return false\n  const lower = field.toLowerCase()\n  if (lower === 'id' || lower.endsWith('_id') || lower.endsWith('.id')) return false\n  if (lower.endsWith('_at')) return false\n  if (['created_at', 'updated_at', 'deleted_at', 'tenant_id', 'organization_id'].includes(lower)) return false\n  if (isSearchFieldBlocklisted(field, entityType, config)) return false\n  return collectTextValues(value).some((text) => text.length > 0)\n}\n\n/**\n * Builds the `search_tokens` rows for one document.\n *\n * `maxTokensPerRecord` is spent in the iteration order of `params.doc`'s own keys: fields are\n * tokenized one after another and the loop stops at the first field that exhausts the budget, so\n * on an over-budget record the surviving fields are whichever ones come first. That order is a\n * property of the object handed in, not of the entity, and the two write-path builders order it\n * differently: `buildIndexDocument` (`lib/document.ts`, the batch reindex path) appends `cf:*` keys\n * after the base columns and the aggregate `search_text` field last. `buildIndexDoc` (`lib/indexer.ts`,\n * the incremental single-record write path \u2014 `upsertIndexRow` \u2192 `reindexSearchTokensForRecord`) adds\n * `l10n:{locale}:{field}` translation keys between the `cf:*` keys and `search_text`. The budget is\n * spent front-to-back, so the fields nearest the end of that order are starved first: `search_text`\n * is last on both paths and starves first either way, but starves sooner on the incremental path,\n * because the `l10n:*` keys ahead of it there consume budget the batch path would have spent on it.\n * Those translation fields starve next, before any `cf:*` key or base column. The two paths can\n * therefore keep different fields searchable for an otherwise equivalent record.\n *\n * Every write path tokenizes an in-memory document it is about to write \u2014 `TokenSearchStrategy.index`\n * writes only `search_tokens` rows and never touches `entity_indexes.doc` \u2014 which keeps each path\n * self-consistent on its own. A document read back out of the `entity_indexes.doc` `jsonb` column is\n * not the same object: Postgres stores `jsonb` keys in a canonical order (by key length, then byte\n * order), not in insertion order. Re-tokenizing such a document can therefore truncate at a different\n * field than the write did, so code that verifies or recomputes a record's expected tokens must\n * rebuild the document through the builder that matches the write path being checked \u2014 `buildIndexDoc`\n * for incrementally-written records, `buildIndexDocument` for batch-reindexed ones \u2014 rather than\n * reading it back from the database.\n *\n * Making truncation reproducible from a `jsonb` read \u2014 by sorting fields before tokenization \u2014\n * would change which terms stay searchable on over-budget records, so it is a behavior decision\n * rather than a clarification (#5971).\n */\nexport function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[] {\n  if (TOKEN_EXCLUDED_ENTITY_TYPES.has(params.entityType)) return []\n  const config = params.config ?? resolveSearchConfig()\n  if (!config.enabled) return []\n  if (!params.doc) return []\n  const tokens: SearchTokenRow[] = []\n  const capturePairs = isSearchDebugEnabled() && params.entityType === 'customers:customer_deal'\n  const debugPairs: Array<{ field: string; hash: string }> = []\n  const scope = {\n    organizationId: params.organizationId ?? DEFAULT_SCOPE.organizationId,\n    tenantId: params.tenantId ?? DEFAULT_SCOPE.tenantId,\n  }\n  const limits = resolveSearchTokenLimits(config)\n  const recordLimit = limits.maxTokensPerRecord > 0 ? limits.maxTokensPerRecord : Number.POSITIVE_INFINITY\n  const fieldLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY\n  const ciphertextFields = ciphertextFieldsOf(params.doc, params.guardCiphertext ?? shouldGuardCiphertext())\n  warnCiphertextSkipped(params.entityType, scope.tenantId, ciphertextFields)\n\n  for (const [field, rawValue] of Object.entries(params.doc)) {\n    if (tokens.length >= recordLimit) break\n    if (ciphertextFields.has(field)) continue\n    if (!shouldIndexField(field, rawValue, config, params.entityType)) continue\n    const values = collectTextValues(rawValue)\n    const seen = new Set<string>()\n    let fieldTokenCount = 0\n    for (const text of values) {\n      if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break\n      const remainingLimit = Math.min(recordLimit - tokens.length, fieldLimit - fieldTokenCount)\n      const candidateLimit = fieldTokenCount + remainingLimit\n      const tokenConfig = Number.isFinite(candidateLimit)\n        ? { ...config, maxTokensPerField: candidateLimit }\n        : config\n      const { tokens: textTokens, hashes } = tokenizeText(text, tokenConfig)\n      for (let i = 0; i < textTokens.length; i += 1) {\n        if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break\n        const token = textTokens[i]\n        const hash = hashes[i]\n        const dedupeKey = `${field}|${hash}`\n        if (seen.has(dedupeKey)) continue\n        seen.add(dedupeKey)\n        fieldTokenCount += 1\n        debug('token.generated', { entityType: params.entityType, recordId: params.recordId, field, hash })\n        tokens.push({\n          entity_type: params.entityType,\n          entity_id: String(params.recordId),\n          organization_id: scope.organizationId,\n          tenant_id: scope.tenantId,\n          field,\n          token_hash: hash,\n          token: config.storeRawTokens ? token : null,\n        })\n        if (capturePairs) {\n          debugPairs.push({ field, hash })\n        }\n      }\n    }\n  }\n  if (capturePairs) {\n    debug('deal.tokens', {\n      entityType: params.entityType,\n      recordId: params.recordId,\n      tokenCount: debugPairs.length,\n      tokens: debugPairs,\n    })\n  }\n  debug('doc.completed', { entityType: params.entityType, recordId: params.recordId, tokenCount: tokens.length })\n\n  return tokens\n}\n\nfunction buildFieldPairs(\n  recordId: string,\n  doc?: Record<string, unknown> | null,\n  skipFields?: Set<string>,\n): EntityFieldPair[] {\n  if (!doc) return []\n  const pairs: EntityFieldPair[] = []\n  const dedupe = new Set<string>()\n  for (const field of Object.keys(doc)) {\n    // The delete below is scoped to these pairs, so omitting a field here is what preserves the\n    // tokens already stored for it rather than merely declining to write new ones.\n    if (skipFields?.has(field)) continue\n    const key = `${recordId}|${field}`\n    if (dedupe.has(key)) continue\n    dedupe.add(key)\n    pairs.push([recordId, field])\n  }\n  return pairs\n}\n\ntype TokenRowLike = { field?: unknown; token_hash?: unknown; token?: unknown }\n\n// NUL, not a printable separator: a field name may itself contain a space, so `a b` + hash `c`\n// would otherwise sign identically to field `a` + hash `b c`.\nconst SIGNATURE_SEPARATOR = String.fromCharCode(0)\n\n// Identifies one token row for comparison. `token` is NULL unless `storeRawTokens` is on, and a\n// stored NULL has to sign the same as the `null` a freshly built row carries \u2014 otherwise every\n// record compares as changed and the skip never fires.\nfunction tokenSignature(row: TokenRowLike): string {\n  return [\n    String(row.field ?? ''),\n    String(row.token_hash ?? ''),\n    row.token == null ? '' : String(row.token),\n  ].join(SIGNATURE_SEPARATOR)\n}\n\n// Multiplicities, not sets: #4681 reports token rows duplicated by the concurrent-replacement\n// defect, and a set comparison reads such a record as already correct and preserves the duplicates\n// forever. Counting sends it through a full rewrite, which collapses them.\nfunction tallyOf(rows: Iterable<TokenRowLike>): Map<string, number> {\n  const tally = new Map<string, number>()\n  for (const row of rows) {\n    const signature = tokenSignature(row)\n    tally.set(signature, (tally.get(signature) ?? 0) + 1)\n  }\n  return tally\n}\n\nfunction tallyEquals(a: Map<string, number> | undefined, b: Map<string, number> | undefined): boolean {\n  const left = a ?? new Map<string, number>()\n  const right = b ?? new Map<string, number>()\n  if (left.size !== right.size) return false\n  for (const [key, count] of left.entries()) {\n    if (right.get(key) !== count) return false\n  }\n  return true\n}\n\nfunction tallyTokenRows<TRow extends TokenRowLike>(\n  rows: Iterable<TRow>,\n  keyOf: (row: TRow) => string\n): Map<string, Map<string, number>> {\n  const tallies = new Map<string, Map<string, number>>()\n  for (const row of rows) {\n    const key = keyOf(row)\n    const tally = tallies.get(key) ?? new Map<string, number>()\n    const signature = tokenSignature(row)\n    tally.set(signature, (tally.get(signature) ?? 0) + 1)\n    tallies.set(key, tally)\n  }\n  return tallies\n}\n\nexport async function replaceSearchTokensForRecord(\n  db: Kysely<any>,\n  params: BuildTokenOptions,\n  options?: { trx?: SearchTokenExecutor },\n): Promise<void> {\n  if (TOKEN_EXCLUDED_ENTITY_TYPES.has(params.entityType)) {\n    await deleteSearchTokensForRecord(db, params, options)\n    return\n  }\n  const guardCiphertext = params.guardCiphertext ?? shouldGuardCiphertext()\n  const rows = buildSearchTokenRows({ ...params, guardCiphertext })\n  const config = params.config ?? resolveSearchConfig()\n  if (!config.enabled) return\n  const organizationId = params.organizationId ?? null\n  const tenantId = params.tenantId ?? null\n  const ciphertextFields = ciphertextFieldsOf(params.doc, guardCiphertext)\n  const fieldPairs = buildFieldPairs(String(params.recordId), params.doc, ciphertextFields)\n\n  // An empty pair list normally means the document is gone, and the delete below then purges the\n  // record wholesale. It can now also mean every field was skipped as ciphertext, where a purge\n  // would destroy precisely the tokens the skip exists to protect. Distinguish the two.\n  if (params.doc && ciphertextFields.size && !fieldPairs.length) {\n    debug('record.preserve-ciphertext', { entityType: params.entityType, recordId: params.recordId })\n    return\n  }\n\n  // Same comparison #5402 gave the batch path, over the scope this path actually writes: the\n  // delete below is narrowed to the document's own `(entity_id, field)` pairs, so the comparison\n  // has to be narrowed the same way. Reading wider would let a token row under a field this\n  // document does not carry \u2014 the `cf_` twin the search module used to write, say \u2014 read as a\n  // difference forever and defeat the skip on every write.\n  const scopeTokenQuery = (query: any): any => {\n    let scoped = query\n      .where('entity_type' as any, '=', params.entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n      .where('entity_id' as any, '=', String(params.recordId))\n    if (fieldPairs.length) {\n      scoped = scoped.where('field' as any, 'in', fieldPairs.map(([, field]) => field))\n    }\n    return scoped\n  }\n\n  // Read through the caller's transaction when there is one. A separate connection cannot see that\n  // transaction's own uncommitted writes, so it could report rows a pending delete has already\n  // removed and talk this call out of re-inserting them.\n  const reader = options?.trx ?? db\n\n  // Count probe first, as in the batch path: it returns one row whatever the table holds, so a\n  // record whose stored rows have run away (#4681) is settled without materializing them.\n  const storedCountRows = await scopeTokenQuery(\n    reader.selectFrom('search_tokens' as any).select(sql<number>`count(*)`.as('token_count') as any),\n  ).execute()\n  const storedCount = Number((storedCountRows as any[])[0]?.token_count ?? 0)\n\n  let unchanged = storedCount === rows.length\n  if (unchanged && rows.length) {\n    const stored = await scopeTokenQuery(\n      reader.selectFrom('search_tokens' as any).select(['field' as any, 'token_hash' as any, 'token' as any]),\n    )\n      // Counts already match, so this cannot truncate. It bounds the read if a concurrent writer\n      // inserts between the probe and here; a truncated read compares as changed, which costs a\n      // rewrite rather than a wrong skip.\n      .limit(rows.length)\n      .execute()\n    unchanged = tallyEquals(tallyOf(rows), tallyOf(stored as any[]))\n  }\n  if (unchanged) {\n    debug('record.skip', { entityType: params.entityType, recordId: params.recordId, tokenCount: rows.length })\n    return\n  }\n\n  const writeTokens = async (executor: SearchTokenExecutor): Promise<void> => {\n    let deleteQuery = executor\n      .deleteFrom('search_tokens' as any)\n      .where('entity_type' as any, '=', params.entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n    if (fieldPairs.length) {\n      deleteQuery = deleteQuery.where((eb: any) => eb.or(\n        fieldPairs.map(([rid, field]) => eb.and([\n          eb('entity_id' as any, '=', rid),\n          eb('field' as any, '=', field),\n        ])),\n      ))\n    } else {\n      deleteQuery = deleteQuery.where('entity_id' as any, '=', String(params.recordId))\n    }\n    await deleteQuery.execute()\n    if (!rows.length) return\n    const payloads = rows.map((row) => ({ ...row, created_at: sql`now()` }))\n    for (const batch of chunk(payloads, INSERT_BATCH_SIZE)) {\n      await executor.insertInto('search_tokens' as any).values(batch as any).execute()\n    }\n  }\n\n  if (options?.trx) {\n    await writeTokens(options.trx)\n    return\n  }\n\n  await db.transaction().execute(writeTokens)\n}\n\nexport async function deleteSearchTokensForRecord(\n  db: Kysely<any>,\n  params: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null },\n  options?: { trx?: SearchTokenExecutor },\n): Promise<void> {\n  const organizationId = params.organizationId ?? null\n  const tenantId = params.tenantId ?? null\n  const executor = options?.trx ?? db\n  await executor\n    .deleteFrom('search_tokens' as any)\n    .where('entity_type' as any, '=', params.entityType)\n    .where('entity_id' as any, '=', String(params.recordId))\n    .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n    .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n    .execute()\n}\n\nexport async function replaceSearchTokensForBatch(\n  db: Kysely<any>,\n  allPayloads: Array<BuildTokenOptions & { doc: Record<string, unknown> }>\n): Promise<void> {\n  if (!allPayloads.length) return\n  const excludedBuckets = new Map<string, {\n    entityType: string\n    organizationId: string | null\n    tenantId: string | null\n    ids: Set<string>\n  }>()\n  const indexablePayloads = allPayloads.filter((payload) => {\n    if (!TOKEN_EXCLUDED_ENTITY_TYPES.has(payload.entityType)) return true\n    const organizationId = payload.organizationId ?? null\n    const tenantId = payload.tenantId ?? null\n    const key = JSON.stringify([payload.entityType, organizationId, tenantId])\n    const bucket = excludedBuckets.get(key) ?? {\n      entityType: payload.entityType,\n      organizationId,\n      tenantId,\n      ids: new Set<string>(),\n    }\n    bucket.ids.add(String(payload.recordId))\n    excludedBuckets.set(key, bucket)\n    return false\n  })\n  if (excludedBuckets.size) {\n    await db.transaction().execute(async (trx) => {\n      for (const bucket of excludedBuckets.values()) {\n        await trx\n          .deleteFrom('search_tokens')\n          .where('entity_type', '=', bucket.entityType)\n          .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n          .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n          .where('entity_id', 'in', Array.from(bucket.ids))\n          .execute()\n      }\n    })\n  }\n  if (!indexablePayloads.length) return\n  const config = resolveSearchConfig()\n  if (!config.enabled) return\n\n  // A record carrying ciphertext drops out of the batch entirely, rather than being rewritten\n  // without its encrypted fields. This path deletes by `entity_id` -- it cannot express \"replace\n  // these fields and leave those alone\" the way the per-record path can -- so partial handling\n  // here would still delete the tokens we are trying to protect. Skipping the record leaves every\n  // one of its tokens, encrypted-field and plaintext-field alike, exactly as it was. The state is\n  // transient by construction: `decrypt-database` followed by a reindex rebuilds all of it.\n  const guardCiphertext = shouldGuardCiphertext()\n  const preservedRecordIds = new Set<string>()\n  const payloads = indexablePayloads.filter((payload) => {\n    const ciphertextFields = ciphertextFieldsOf(payload.doc, guardCiphertext)\n    if (!ciphertextFields.size) return true\n    warnCiphertextSkipped(payload.entityType, payload.tenantId ?? null, ciphertextFields)\n    preservedRecordIds.add(String(payload.recordId))\n    return false\n  })\n  if (!payloads.length) return\n\n  const rows = payloads.flatMap((payload) => buildSearchTokenRows({ ...payload, config, guardCiphertext }))\n  if (!rows.length) {\n    const entityType = payloads[0]?.entityType\n    if (!entityType) return\n    const ids = payloads.map((p) => String(p.recordId))\n    await db\n      .deleteFrom('search_tokens' as any)\n      .where('entity_type' as any, '=', entityType)\n      .where('entity_id' as any, 'in', ids)\n      .execute()\n    return\n  }\n\n  const scopeKey = (org: string | null, tenant: string | null) => `${org ?? '__null__'}|${tenant ?? '__null__'}`\n  const scopeBuckets = new Map<string, { organizationId: string | null; tenantId: string | null; ids: Set<string> }>()\n\n  for (const payload of payloads) {\n    const org = payload.organizationId ?? null\n    const tenant = payload.tenantId ?? null\n    const key = scopeKey(org, tenant)\n    const bucket = scopeBuckets.get(key) ?? { organizationId: org, tenantId: tenant, ids: new Set<string>() }\n    bucket.ids.add(String(payload.recordId))\n    scopeBuckets.set(key, bucket)\n  }\n\n  const recordKeyOf = (row: SearchTokenRow) =>\n    `${scopeKey(row.organization_id ?? null, row.tenant_id ?? null)}|${String(row.entity_id)}`\n  const builtTally = tallyTokenRows(rows, recordKeyOf)\n\n  // Read outside the transaction, deliberately. The comparison decides only whether to skip a\n  // rewrite, so a concurrent writer costs us at most a rewrite we declined \u2014 declined because the\n  // table already held exactly the rows this call wanted to write. One ordering is worth naming\n  // though: if the read matches and a concurrent writer then commits tokens built from a *staler*\n  // doc, the unconditional rewrite this call used to perform would have overwritten them by\n  // accident. It no longer does, so those stale rows survive until the record's next write. That\n  // is a repair we lose, not a guarantee we break.\n  const changedIdsByBucket = new Map<string, Set<string>>()\n  for (const [key, bucket] of scopeBuckets.entries()) {\n    const ids = Array.from(bucket.ids)\n    const builtCountById = new Map<string, number>()\n    for (const id of ids) {\n      let total = 0\n      const tally = builtTally.get(`${key}|${id}`)\n      if (tally) for (const count of tally.values()) total += count\n      builtCountById.set(id, total)\n    }\n\n    // Count probe first. Its result is one row per record in the batch, so it is bounded by the\n    // batch size \u2014 unlike a bare row read, which would be bounded only by how many token rows the\n    // table already holds for these ids, a quantity this function does not control and (per #4681)\n    // has no reason to trust.\n    const storedCounts = await db\n      .selectFrom('search_tokens' as any)\n      .select(['entity_id' as any, sql<number>`count(*)`.as('token_count') as any])\n      .where('entity_type' as any, '=', payloads[0].entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n      .where('entity_id' as any, 'in', ids)\n      .groupBy('entity_id' as any)\n      .execute()\n    const storedCountById = new Map<string, number>()\n    for (const row of storedCounts as any[]) {\n      storedCountById.set(String(row.entity_id), Number(row.token_count))\n    }\n\n    const changed = new Set<string>()\n    // A record whose stored row count already differs is changed, whatever the rows say \u2014 the\n    // duplicate case from #4681 resolves here without ever materializing the duplicated rows.\n    const contentCandidates = ids.filter((id) => {\n      const builtCount = builtCountById.get(id) ?? 0\n      if ((storedCountById.get(id) ?? 0) !== builtCount) {\n        changed.add(id)\n        return false\n      }\n      return builtCount > 0\n    })\n\n    if (contentCandidates.length) {\n      const rowBudget = contentCandidates.reduce((sum, id) => sum + (builtCountById.get(id) ?? 0), 0)\n      const stored = await db\n        .selectFrom('search_tokens' as any)\n        .select(['entity_id' as any, 'field' as any, 'token_hash' as any, 'token' as any])\n        .where('entity_type' as any, '=', payloads[0].entityType)\n        .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n        .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n        .where('entity_id' as any, 'in', contentCandidates)\n        // Counts already match, so this cannot truncate \u2014 it bounds the damage if a concurrent\n        // writer inserts between the probe and this read. A truncated read compares as changed,\n        // which costs a rewrite rather than a wrong skip.\n        .limit(rowBudget)\n        .execute()\n      const storedTally = tallyTokenRows(stored as any[], (row) => String(row.entity_id))\n      for (const id of contentCandidates) {\n        if (!tallyEquals(builtTally.get(`${key}|${id}`), storedTally.get(id))) changed.add(id)\n      }\n    }\n    changedIdsByBucket.set(key, changed)\n  }\n\n  const changedRecordKeys = new Set<string>()\n  for (const [key, changed] of changedIdsByBucket.entries()) {\n    for (const id of changed) changedRecordKeys.add(`${key}|${id}`)\n  }\n  debug('batch.skip', {\n    entityType: payloads[0].entityType,\n    recordCount: payloads.length,\n    changedCount: changedRecordKeys.size,\n    preservedCiphertextRecordCount: preservedRecordIds.size,\n  })\n  if (!changedRecordKeys.size) return\n\n  await db.transaction().execute(async (trx) => {\n    for (const [key, bucket] of scopeBuckets.entries()) {\n      const changed = changedIdsByBucket.get(key)\n      if (!changed?.size) continue\n      // Delete by entity_id: a batch replaces all of a record's tokens, and a per-field OR over the\n      // whole batch overflows the query compiler's call stack on large batches.\n      const deleteQuery = trx\n        .deleteFrom('search_tokens' as any)\n        .where('entity_type' as any, '=', payloads[0].entityType)\n        .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n        .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n        .where('entity_id' as any, 'in', Array.from(changed))\n      await deleteQuery.execute()\n    }\n    const payloadWithTimestamps = rows\n      .filter((row) => changedRecordKeys.has(recordKeyOf(row)))\n      .map((row) => ({ ...row, created_at: sql`now()` }))\n    for (const batch of chunk(payloadWithTimestamps, INSERT_BATCH_SIZE)) {\n      await trx.insertInto('search_tokens' as any).values(batch as any).execute()\n    }\n  })\n}\n"],
-  "mappings": "AAAA,SAAwC,WAAW;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,kBAAkB,6BAA8C;AACzE,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE/E,MAAM,oBAAoB;AAC1B,MAAM,8BAA8B,oBAAI,IAAI,CAAC,yBAAyB,uBAAuB,CAAC;AAE9F,SAAS,MAAS,OAAY,MAAqB;AACjD,MAAI,QAAQ,EAAG,QAAO,CAAC,KAAK;AAC5B,QAAM,MAAa,CAAC;AACpB,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAM,KAAI,KAAK,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC;AAC9E,SAAO;AACT;AAuBA,MAAM,gBAAgB,EAAE,gBAAgB,MAAM,UAAU,KAAK;AAItD,MAAM,uBAAuB,MAAe;AACjD,SAAO,kBAAkB,QAAQ,IAAI,mBAAmB,EAAE,MAAM;AAClE;AAEA,MAAM,QAAQ,CAAC,OAAe,YAAqC;AACjE,MAAI,CAAC,qBAAqB,EAAG;AAC7B,MAAI;AACF,WAAO,MAAM,sBAAsB,EAAE,OAAO,QAAQ,CAAC;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,kBAAkB,OAA0B;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC,KAAK;AAC5C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,MAAgB,CAAC;AACvB,eAAW,SAAS,OAAO;AACzB,UAAI,OAAO,UAAU,SAAU,KAAI,KAAK,KAAK;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AACA,SAAO,CAAC;AACV;AAEA,IAAI,kBAAqC;AAuBzC,SAAS,wBAAiC;AACxC,sBAAoB,iBAAiB;AACrC,SAAO,sBAAsB,eAAe,MAAM;AACpD;AAkBA,SAAS,mBACP,KACA,OACa;AACb,QAAM,SAAS,oBAAI,IAAY;AAC/B,MAAI,CAAC,SAAS,CAAC,IAAK,QAAO;AAC3B,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,UAAM,SAAS,kBAAkB,KAAK;AACtC,QAAI,OAAO,UAAU,OAAO,KAAK,CAAC,SAAS,0BAA0B,IAAI,CAAC,EAAG,QAAO,IAAI,KAAK;AAAA,EAC/F;AACA,SAAO;AACT;AAEA,MAAM,2BAA2B,oBAAI,IAAY;AAEjD,SAAS,sBAAsB,YAAoB,UAAyB,QAA2B;AACrG,MAAI,CAAC,OAAO,KAAM;AAIlB,QAAM,MAAM,GAAG,UAAU,IAAI,YAAY,EAAE;AAC3C,MAAI,yBAAyB,IAAI,GAAG,EAAG;AACvC,2BAAyB,IAAI,GAAG;AAChC,SAAO;AAAA,IACL;AAAA,IAGA,EAAE,YAAY,UAAU,QAAQ,MAAM,KAAK,MAAM,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC,EAAE;AAAA,EACtG;AACF;AAGO,SAAS,4BAAkC;AAChD,2BAAyB,MAAM;AAC/B,oBAAkB;AACpB;AAEA,SAAS,iBACP,OACA,OACA,QACA,YACS;AACT,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAC/D,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,UAAU,QAAQ,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,KAAK,EAAG,QAAO;AAC7E,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO;AAClC,MAAI,CAAC,cAAc,cAAc,cAAc,aAAa,iBAAiB,EAAE,SAAS,KAAK,EAAG,QAAO;AACvG,MAAI,yBAAyB,OAAO,YAAY,MAAM,EAAG,QAAO;AAChE,SAAO,kBAAkB,KAAK,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;AAChE;AAiCO,SAAS,qBAAqB,QAA6C;AAChF,MAAI,4BAA4B,IAAI,OAAO,UAAU,EAAG,QAAO,CAAC;AAChE,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC;AAC7B,MAAI,CAAC,OAAO,IAAK,QAAO,CAAC;AACzB,QAAM,SAA2B,CAAC;AAClC,QAAM,eAAe,qBAAqB,KAAK,OAAO,eAAe;AACrE,QAAM,aAAqD,CAAC;AAC5D,QAAM,QAAQ;AAAA,IACZ,gBAAgB,OAAO,kBAAkB,cAAc;AAAA,IACvD,UAAU,OAAO,YAAY,cAAc;AAAA,EAC7C;AACA,QAAM,SAAS,yBAAyB,MAAM;AAC9C,QAAM,cAAc,OAAO,qBAAqB,IAAI,OAAO,qBAAqB,OAAO;AACvF,QAAM,aAAa,OAAO,oBAAoB,IAAI,OAAO,oBAAoB,OAAO;AACpF,QAAM,mBAAmB,mBAAmB,OAAO,KAAK,OAAO,mBAAmB,sBAAsB,CAAC;AACzG,wBAAsB,OAAO,YAAY,MAAM,UAAU,gBAAgB;AAEzE,aAAW,CAAC,OAAO,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG,GAAG;AAC1D,QAAI,OAAO,UAAU,YAAa;AAClC,QAAI,iBAAiB,IAAI,KAAK,EAAG;AACjC,QAAI,CAAC,iBAAiB,OAAO,UAAU,QAAQ,OAAO,UAAU,EAAG;AACnE,UAAM,SAAS,kBAAkB,QAAQ;AACzC,UAAM,OAAO,oBAAI,IAAY;AAC7B,QAAI,kBAAkB;AACtB,eAAW,QAAQ,QAAQ;AACzB,UAAI,OAAO,UAAU,eAAe,mBAAmB,WAAY;AACnE,YAAM,iBAAiB,KAAK,IAAI,cAAc,OAAO,QAAQ,aAAa,eAAe;AACzF,YAAM,iBAAiB,kBAAkB;AACzC,YAAM,cAAc,OAAO,SAAS,cAAc,IAC9C,EAAE,GAAG,QAAQ,mBAAmB,eAAe,IAC/C;AACJ,YAAM,EAAE,QAAQ,YAAY,OAAO,IAAI,aAAa,MAAM,WAAW;AACrE,eAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK,GAAG;AAC7C,YAAI,OAAO,UAAU,eAAe,mBAAmB,WAAY;AACnE,cAAM,QAAQ,WAAW,CAAC;AAC1B,cAAM,OAAO,OAAO,CAAC;AACrB,cAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,YAAI,KAAK,IAAI,SAAS,EAAG;AACzB,aAAK,IAAI,SAAS;AAClB,2BAAmB;AACnB,cAAM,mBAAmB,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,OAAO,KAAK,CAAC;AAClG,eAAO,KAAK;AAAA,UACV,aAAa,OAAO;AAAA,UACpB,WAAW,OAAO,OAAO,QAAQ;AAAA,UACjC,iBAAiB,MAAM;AAAA,UACvB,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,YAAY;AAAA,UACZ,OAAO,OAAO,iBAAiB,QAAQ;AAAA,QACzC,CAAC;AACD,YAAI,cAAc;AAChB,qBAAW,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,cAAc;AAChB,UAAM,eAAe;AAAA,MACnB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,YAAY,WAAW;AAAA,MACvB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,QAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,YAAY,OAAO,OAAO,CAAC;AAE9G,SAAO;AACT;AAEA,SAAS,gBACP,UACA,KACA,YACmB;AACnB,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,QAA2B,CAAC;AAClC,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,OAAO,KAAK,GAAG,GAAG;AAGpC,QAAI,YAAY,IAAI,KAAK,EAAG;AAC5B,UAAM,MAAM,GAAG,QAAQ,IAAI,KAAK;AAChC,QAAI,OAAO,IAAI,GAAG,EAAG;AACrB,WAAO,IAAI,GAAG;AACd,UAAM,KAAK,CAAC,UAAU,KAAK,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAMA,MAAM,sBAAsB,OAAO,aAAa,CAAC;AAKjD,SAAS,eAAe,KAA2B;AACjD,SAAO;AAAA,IACL,OAAO,IAAI,SAAS,EAAE;AAAA,IACtB,OAAO,IAAI,cAAc,EAAE;AAAA,IAC3B,IAAI,SAAS,OAAO,KAAK,OAAO,IAAI,KAAK;AAAA,EAC3C,EAAE,KAAK,mBAAmB;AAC5B;AAKA,SAAS,QAAQ,MAAmD;AAClE,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,OAAO,MAAM;AACtB,UAAM,YAAY,eAAe,GAAG;AACpC,UAAM,IAAI,YAAY,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,YAAY,GAAoC,GAA6C;AACpG,QAAM,OAAO,KAAK,oBAAI,IAAoB;AAC1C,QAAM,QAAQ,KAAK,oBAAI,IAAoB;AAC3C,MAAI,KAAK,SAAS,MAAM,KAAM,QAAO;AACrC,aAAW,CAAC,KAAK,KAAK,KAAK,KAAK,QAAQ,GAAG;AACzC,QAAI,MAAM,IAAI,GAAG,MAAM,MAAO,QAAO;AAAA,EACvC;AACA,SAAO;AACT;AAEA,SAAS,eACP,MACA,OACkC;AAClC,QAAM,UAAU,oBAAI,IAAiC;AACrD,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,MAAM,GAAG;AACrB,UAAM,QAAQ,QAAQ,IAAI,GAAG,KAAK,oBAAI,IAAoB;AAC1D,UAAM,YAAY,eAAe,GAAG;AACpC,UAAM,IAAI,YAAY,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;AACpD,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,eAAsB,6BACpB,IACA,QACA,SACe;AACf,MAAI,4BAA4B,IAAI,OAAO,UAAU,GAAG;AACtD,UAAM,4BAA4B,IAAI,QAAQ,OAAO;AACrD;AAAA,EACF;AACA,QAAM,kBAAkB,OAAO,mBAAmB,sBAAsB;AACxE,QAAM,OAAO,qBAAqB,EAAE,GAAG,QAAQ,gBAAgB,CAAC;AAChE,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,MAAI,CAAC,OAAO,QAAS;AACrB,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,mBAAmB,mBAAmB,OAAO,KAAK,eAAe;AACvE,QAAM,aAAa,gBAAgB,OAAO,OAAO,QAAQ,GAAG,OAAO,KAAK,gBAAgB;AAKxF,MAAI,OAAO,OAAO,iBAAiB,QAAQ,CAAC,WAAW,QAAQ;AAC7D,UAAM,8BAA8B,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,SAAS,CAAC;AAChG;AAAA,EACF;AAOA,QAAM,kBAAkB,CAAC,UAAoB;AAC3C,QAAI,SAAS,MACV,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE,EAC9D,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AACzD,QAAI,WAAW,QAAQ;AACrB,eAAS,OAAO,MAAM,SAAgB,MAAM,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAKA,QAAM,SAAS,SAAS,OAAO;AAI/B,QAAM,kBAAkB,MAAM;AAAA,IAC5B,OAAO,WAAW,eAAsB,EAAE,OAAO,cAAsB,GAAG,aAAa,CAAQ;AAAA,EACjG,EAAE,QAAQ;AACV,QAAM,cAAc,OAAQ,gBAA0B,CAAC,GAAG,eAAe,CAAC;AAE1E,MAAI,YAAY,gBAAgB,KAAK;AACrC,MAAI,aAAa,KAAK,QAAQ;AAC5B,UAAM,SAAS,MAAM;AAAA,MACnB,OAAO,WAAW,eAAsB,EAAE,OAAO,CAAC,SAAgB,cAAqB,OAAc,CAAC;AAAA,IACxG,EAIG,MAAM,KAAK,MAAM,EACjB,QAAQ;AACX,gBAAY,YAAY,QAAQ,IAAI,GAAG,QAAQ,MAAe,CAAC;AAAA,EACjE;AACA,MAAI,WAAW;AACb,UAAM,eAAe,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,YAAY,KAAK,OAAO,CAAC;AAC1G;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,aAAiD;AAC1E,QAAI,cAAc,SACf,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE;AACjE,QAAI,WAAW,QAAQ;AACrB,oBAAc,YAAY,MAAM,CAAC,OAAY,GAAG;AAAA,QAC9C,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI;AAAA,UACtC,GAAG,aAAoB,KAAK,GAAG;AAAA,UAC/B,GAAG,SAAgB,KAAK,KAAK;AAAA,QAC/B,CAAC,CAAC;AAAA,MACJ,CAAC;AAAA,IACH,OAAO;AACL,oBAAc,YAAY,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AAAA,IAClF;AACA,UAAM,YAAY,QAAQ;AAC1B,QAAI,CAAC,KAAK,OAAQ;AAClB,UAAM,WAAW,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,WAAW,EAAE;AACvE,eAAW,SAAS,MAAM,UAAU,iBAAiB,GAAG;AACtD,YAAM,SAAS,WAAW,eAAsB,EAAE,OAAO,KAAY,EAAE,QAAQ;AAAA,IACjF;AAAA,EACF;AAEA,MAAI,SAAS,KAAK;AAChB,UAAM,YAAY,QAAQ,GAAG;AAC7B;AAAA,EACF;AAEA,QAAM,GAAG,YAAY,EAAE,QAAQ,WAAW;AAC5C;AAEA,eAAsB,4BACpB,IACA,QACA,SACe;AACf,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,WAAW,SAAS,OAAO;AACjC,QAAM,SACH,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC,EACtD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE,EAC9D,QAAQ;AACb;AAEA,eAAsB,4BACpB,IACA,aACe;AACf,MAAI,CAAC,YAAY,OAAQ;AACzB,QAAM,kBAAkB,oBAAI,IAKzB;AACH,QAAM,oBAAoB,YAAY,OAAO,CAAC,YAAY;AACxD,QAAI,CAAC,4BAA4B,IAAI,QAAQ,UAAU,EAAG,QAAO;AACjE,UAAM,iBAAiB,QAAQ,kBAAkB;AACjD,UAAM,WAAW,QAAQ,YAAY;AACrC,UAAM,MAAM,KAAK,UAAU,CAAC,QAAQ,YAAY,gBAAgB,QAAQ,CAAC;AACzE,UAAM,SAAS,gBAAgB,IAAI,GAAG,KAAK;AAAA,MACzC,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA;AAAA,MACA,KAAK,oBAAI,IAAY;AAAA,IACvB;AACA,WAAO,IAAI,IAAI,OAAO,QAAQ,QAAQ,CAAC;AACvC,oBAAgB,IAAI,KAAK,MAAM;AAC/B,WAAO;AAAA,EACT,CAAC;AACD,MAAI,gBAAgB,MAAM;AACxB,UAAM,GAAG,YAAY,EAAE,QAAQ,OAAO,QAAQ;AAC5C,iBAAW,UAAU,gBAAgB,OAAO,GAAG;AAC7C,cAAM,IACH,WAAW,eAAe,EAC1B,MAAM,eAAe,KAAK,OAAO,UAAU,EAC3C,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAa,MAAM,MAAM,KAAK,OAAO,GAAG,CAAC,EAC/C,QAAQ;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,CAAC,kBAAkB,OAAQ;AAC/B,QAAM,SAAS,oBAAoB;AACnC,MAAI,CAAC,OAAO,QAAS;AAQrB,QAAM,kBAAkB,sBAAsB;AAC9C,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,WAAW,kBAAkB,OAAO,CAAC,YAAY;AACrD,UAAM,mBAAmB,mBAAmB,QAAQ,KAAK,eAAe;AACxE,QAAI,CAAC,iBAAiB,KAAM,QAAO;AACnC,0BAAsB,QAAQ,YAAY,QAAQ,YAAY,MAAM,gBAAgB;AACpF,uBAAmB,IAAI,OAAO,QAAQ,QAAQ,CAAC;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,MAAI,CAAC,SAAS,OAAQ;AAEtB,QAAM,OAAO,SAAS,QAAQ,CAAC,YAAY,qBAAqB,EAAE,GAAG,SAAS,QAAQ,gBAAgB,CAAC,CAAC;AACxG,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,aAAa,SAAS,CAAC,GAAG;AAChC,QAAI,CAAC,WAAY;AACjB,UAAM,MAAM,SAAS,IAAI,CAAC,MAAM,OAAO,EAAE,QAAQ,CAAC;AAClD,UAAM,GACH,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,UAAU,EAC3C,MAAM,aAAoB,MAAM,GAAG,EACnC,QAAQ;AACX;AAAA,EACF;AAEA,QAAM,WAAW,CAAC,KAAoB,WAA0B,GAAG,OAAO,UAAU,IAAI,UAAU,UAAU;AAC5G,QAAM,eAAe,oBAAI,IAA0F;AAEnH,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAM,QAAQ,kBAAkB;AACtC,UAAM,SAAS,QAAQ,YAAY;AACnC,UAAM,MAAM,SAAS,KAAK,MAAM;AAChC,UAAM,SAAS,aAAa,IAAI,GAAG,KAAK,EAAE,gBAAgB,KAAK,UAAU,QAAQ,KAAK,oBAAI,IAAY,EAAE;AACxG,WAAO,IAAI,IAAI,OAAO,QAAQ,QAAQ,CAAC;AACvC,iBAAa,IAAI,KAAK,MAAM;AAAA,EAC9B;AAEA,QAAM,cAAc,CAAC,QACnB,GAAG,SAAS,IAAI,mBAAmB,MAAM,IAAI,aAAa,IAAI,CAAC,IAAI,OAAO,IAAI,SAAS,CAAC;AAC1F,QAAM,aAAa,eAAe,MAAM,WAAW;AASnD,QAAM,qBAAqB,oBAAI,IAAyB;AACxD,aAAW,CAAC,KAAK,MAAM,KAAK,aAAa,QAAQ,GAAG;AAClD,UAAM,MAAM,MAAM,KAAK,OAAO,GAAG;AACjC,UAAM,iBAAiB,oBAAI,IAAoB;AAC/C,eAAW,MAAM,KAAK;AACpB,UAAI,QAAQ;AACZ,YAAM,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE;AAC3C,UAAI,MAAO,YAAW,SAAS,MAAM,OAAO,EAAG,UAAS;AACxD,qBAAe,IAAI,IAAI,KAAK;AAAA,IAC9B;AAMA,UAAM,eAAe,MAAM,GACxB,WAAW,eAAsB,EACjC,OAAO,CAAC,aAAoB,cAAsB,GAAG,aAAa,CAAQ,CAAC,EAC3E,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,GAAG,EACnC,QAAQ,WAAkB,EAC1B,QAAQ;AACX,UAAM,kBAAkB,oBAAI,IAAoB;AAChD,eAAW,OAAO,cAAuB;AACvC,sBAAgB,IAAI,OAAO,IAAI,SAAS,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,IACpE;AAEA,UAAM,UAAU,oBAAI,IAAY;AAGhC,UAAM,oBAAoB,IAAI,OAAO,CAAC,OAAO;AAC3C,YAAM,aAAa,eAAe,IAAI,EAAE,KAAK;AAC7C,WAAK,gBAAgB,IAAI,EAAE,KAAK,OAAO,YAAY;AACjD,gBAAQ,IAAI,EAAE;AACd,eAAO;AAAA,MACT;AACA,aAAO,aAAa;AAAA,IACtB,CAAC;AAED,QAAI,kBAAkB,QAAQ;AAC5B,YAAM,YAAY,kBAAkB,OAAO,CAAC,KAAK,OAAO,OAAO,eAAe,IAAI,EAAE,KAAK,IAAI,CAAC;AAC9F,YAAM,SAAS,MAAM,GAClB,WAAW,eAAsB,EACjC,OAAO,CAAC,aAAoB,SAAgB,cAAqB,OAAc,CAAC,EAChF,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,iBAAiB,EAIjD,MAAM,SAAS,EACf,QAAQ;AACX,YAAM,cAAc,eAAe,QAAiB,CAAC,QAAQ,OAAO,IAAI,SAAS,CAAC;AAClF,iBAAW,MAAM,mBAAmB;AAClC,YAAI,CAAC,YAAY,WAAW,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE,GAAG,YAAY,IAAI,EAAE,CAAC,EAAG,SAAQ,IAAI,EAAE;AAAA,MACvF;AAAA,IACF;AACA,uBAAmB,IAAI,KAAK,OAAO;AAAA,EACrC;AAEA,QAAM,oBAAoB,oBAAI,IAAY;AAC1C,aAAW,CAAC,KAAK,OAAO,KAAK,mBAAmB,QAAQ,GAAG;AACzD,eAAW,MAAM,QAAS,mBAAkB,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE;AAAA,EAChE;AACA,QAAM,cAAc;AAAA,IAClB,YAAY,SAAS,CAAC,EAAE;AAAA,IACxB,aAAa,SAAS;AAAA,IACtB,cAAc,kBAAkB;AAAA,IAChC,gCAAgC,mBAAmB;AAAA,EACrD,CAAC;AACD,MAAI,CAAC,kBAAkB,KAAM;AAE7B,QAAM,GAAG,YAAY,EAAE,QAAQ,OAAO,QAAQ;AAC5C,eAAW,CAAC,KAAK,MAAM,KAAK,aAAa,QAAQ,GAAG;AAClD,YAAM,UAAU,mBAAmB,IAAI,GAAG;AAC1C,UAAI,CAAC,SAAS,KAAM;AAGpB,YAAM,cAAc,IACjB,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,MAAM,KAAK,OAAO,CAAC;AACtD,YAAM,YAAY,QAAQ;AAAA,IAC5B;AACA,UAAM,wBAAwB,KAC3B,OAAO,CAAC,QAAQ,kBAAkB,IAAI,YAAY,GAAG,CAAC,CAAC,EACvD,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,WAAW,EAAE;AACpD,eAAW,SAAS,MAAM,uBAAuB,iBAAiB,GAAG;AACnE,YAAM,IAAI,WAAW,eAAsB,EAAE,OAAO,KAAY,EAAE,QAAQ;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import { type Kysely, type Transaction, sql } from 'kysely'\nimport {\n  isSearchFieldBlocklisted,\n  resolveSearchConfig,\n  resolveSearchTokenLimits,\n  type SearchConfig,\n} from '@open-mercato/shared/lib/search/config'\nimport { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'\nimport { looksLikeEncryptedPayload } from '@open-mercato/shared/lib/encryption/aes'\nimport { createKmsService, resolveEncryptionMode, type KmsService } from '@open-mercato/shared/lib/encryption/kms'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isIndexDocEnrichedKey } from './doc-enrichers'\n\nconst logger = createLogger('query_index').child({ component: 'search-tokens' })\n\nconst INSERT_BATCH_SIZE = 500\nconst TOKEN_EXCLUDED_ENTITY_TYPES = new Set(['audit_logs:action_log', 'audit_logs:access_log'])\n\nfunction chunk<T>(items: T[], size: number): T[][] {\n  if (size <= 0) return [items]\n  const out: T[][] = []\n  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size))\n  return out\n}\n\nexport type SearchTokenRow = {\n  entity_type: string\n  entity_id: string\n  organization_id: string | null\n  tenant_id: string | null\n  field: string\n  token_hash: string\n  token?: string | null\n}\n\ntype BuildTokenOptions = {\n  entityType: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  doc?: Record<string, unknown> | null\n  config?: SearchConfig\n  /** Resolved once per write by the exported entry points; see {@link shouldGuardCiphertext}. */\n  guardCiphertext?: boolean\n}\n\nconst DEFAULT_SCOPE = { organizationId: null, tenantId: null }\ntype EntityFieldPair = [string, string]\ntype SearchTokenExecutor = Kysely<any> | Transaction<any>\n\nexport const isSearchDebugEnabled = (): boolean => {\n  return parseBooleanToken(process.env.OM_SEARCH_DEBUG ?? '') === true\n}\n\nconst debug = (event: string, payload: Record<string, unknown>) => {\n  if (!isSearchDebugEnabled()) return\n  try {\n    logger.debug('Search token event', { event, payload })\n  } catch {\n    // ignore\n  }\n}\n\nfunction collectTextValues(value: unknown): string[] {\n  if (typeof value === 'string') return [value]\n  if (Array.isArray(value)) {\n    const out: string[] = []\n    for (const entry of value) {\n      if (typeof entry === 'string') out.push(entry)\n    }\n    return out\n  }\n  return []\n}\n\nlet guardKmsService: KmsService | null = null\n\n/**\n * Whether the ciphertext guard below is allowed to run for this write.\n *\n * The guard recognises an envelope by its SHAPE, which is forgeable: `<16 b64>:<b64>:<24 b64>:v1`\n * is a string any user can type into a searchable field. `tenantDataEncryptionService` removed the\n * same structural test for that reason (#2720). So the guard may only run where the shape is the\n * ONLY test available -- which is exactly where no DEK is reachable:\n *\n * - `active`      -- the indexer decrypted the document before handing it here, so a value still\n *                    shaped like an envelope is plaintext somebody typed. Indexing it is correct,\n *                    and skipping it would let that person freeze their own record's tokens at a\n *                    past state. The guard stays off, which also keeps it off the hot path of\n *                    every normal deployment.\n * - `disabled`    -- `decryptIndexDocForSearch` is a no-op, so ciphertext arrives undecrypted.\n * - `unavailable` -- the decrypt was attempted and could not complete, same outcome.\n *\n * Resolved once per write rather than per document, over a KMS built once per process:\n * {@link createKmsService} logs when it falls back, and a reindex calls this once per record. The\n * toggle itself is still re-read every call by {@link resolveEncryptionMode}; only the KMS is\n * cached, and it already requires a restart to change, since DEK and map caches are in-process.\n */\nfunction shouldGuardCiphertext(): boolean {\n  guardKmsService ??= createKmsService()\n  return resolveEncryptionMode(guardKmsService) !== 'active'\n}\n\n/**\n * Fields whose value is an AES-GCM envelope rather than the text it is supposed to hold.\n *\n * Search tokens are hashes of PLAINTEXT: the indexer decrypts a document before tokenising it\n * (`indexer.ts` -> `decryptIndexDocForSearch`), which is what lets the token index survive\n * encryption being switched on or off. That decrypt step is a no-op once\n * `TENANT_DATA_ENCRYPTION=no`, so an operator who flips the toggle before running\n * `mercato entities decrypt-database` starts feeding ciphertext into the tokeniser. The tokens\n * that come out are hashes of base64 noise and match nothing, and because a write REPLACES a\n * record's tokens, the good plaintext tokens already in the table would be deleted to make room\n * for them -- turning a recoverable misordering into permanent search loss.\n *\n * Detecting the envelope by shape lets the write skip those fields and leave what is already\n * indexed alone. `guard` gates that detection; see {@link shouldGuardCiphertext} for why it is not\n * unconditional.\n */\nfunction ciphertextFieldsOf(\n  doc: Record<string, unknown> | null | undefined,\n  guard: boolean,\n): Set<string> {\n  const fields = new Set<string>()\n  if (!guard || !doc) return fields\n  for (const [field, value] of Object.entries(doc)) {\n    const values = collectTextValues(value)\n    if (values.length && values.some((text) => looksLikeEncryptedPayload(text))) fields.add(field)\n  }\n  return fields\n}\n\nconst warnedCiphertextEntities = new Set<string>()\n\nfunction warnCiphertextSkipped(entityType: string, tenantId: string | null, fields: Set<string>): void {\n  if (!fields.size) return\n  // Once per entity type per tenant per process: a full reindex would otherwise emit this per\n  // record, while keying on the entity type alone would let the first affected tenant in a shared\n  // process consume the one warning every other tenant's operator needed.\n  const key = `${entityType}|${tenantId ?? ''}`\n  if (warnedCiphertextEntities.has(key)) return\n  warnedCiphertextEntities.add(key)\n  logger.warn(\n    'Search indexing skipped ciphertext fields and preserved their existing tokens. '\n      + 'This means TENANT_DATA_ENCRYPTION was switched off while encrypted data was still at rest. '\n      + 'Run `mercato entities decrypt-database` and reindex; until then these fields are not searchable.',\n    { entityType, tenantId, fields: Array.from(fields).sort((left, right) => left.localeCompare(right)) },\n  )\n}\n\n/** Test seam: both the warning above and the KMS behind the guard are once-per-process. */\nexport function resetCiphertextGuardState(): void {\n  warnedCiphertextEntities.clear()\n  guardKmsService = null\n}\n\nfunction shouldIndexField(\n  field: string,\n  value: unknown,\n  config: SearchConfig,\n  entityType: string | null,\n): boolean {\n  if (typeof value !== 'string' && !Array.isArray(value)) return false\n  const lower = field.toLowerCase()\n  if (lower === 'id' || lower.endsWith('_id') || lower.endsWith('.id')) return false\n  if (lower.endsWith('_at')) return false\n  if (['created_at', 'updated_at', 'deleted_at', 'tenant_id', 'organization_id'].includes(lower)) return false\n  if (isSearchFieldBlocklisted(field, entityType, config)) return false\n  if (isIndexDocEnrichedKey(entityType, field)) return false\n  return collectTextValues(value).some((text) => text.length > 0)\n}\n\n/**\n * Builds the `search_tokens` rows for one document.\n *\n * `maxTokensPerRecord` is spent in the iteration order of `params.doc`'s own keys: fields are\n * tokenized one after another and the loop stops at the first field that exhausts the budget, so\n * on an over-budget record the surviving fields are whichever ones come first. That order is a\n * property of the object handed in, not of the entity, and the two write-path builders order it\n * differently: `buildIndexDocument` (`lib/document.ts`, the batch reindex path) appends `cf:*` keys\n * after the base columns and the aggregate `search_text` field last. `buildIndexDoc` (`lib/indexer.ts`,\n * the incremental single-record write path \u2014 `upsertIndexRow` \u2192 `reindexSearchTokensForRecord`) adds\n * `l10n:{locale}:{field}` translation keys between the `cf:*` keys and `search_text`. The budget is\n * spent front-to-back, so the fields nearest the end of that order are starved first: `search_text`\n * is last on both paths and starves first either way, but starves sooner on the incremental path,\n * because the `l10n:*` keys ahead of it there consume budget the batch path would have spent on it.\n * Those translation fields starve next, before any `cf:*` key or base column. The two paths can\n * therefore keep different fields searchable for an otherwise equivalent record.\n *\n * Every write path tokenizes an in-memory document it is about to write \u2014 `TokenSearchStrategy.index`\n * writes only `search_tokens` rows and never touches `entity_indexes.doc` \u2014 which keeps each path\n * self-consistent on its own. A document read back out of the `entity_indexes.doc` `jsonb` column is\n * not the same object: Postgres stores `jsonb` keys in a canonical order (by key length, then byte\n * order), not in insertion order. Re-tokenizing such a document can therefore truncate at a different\n * field than the write did, so code that verifies or recomputes a record's expected tokens must\n * rebuild the document through the builder that matches the write path being checked \u2014 `buildIndexDoc`\n * for incrementally-written records, `buildIndexDocument` for batch-reindexed ones \u2014 rather than\n * reading it back from the database.\n *\n * Making truncation reproducible from a `jsonb` read \u2014 by sorting fields before tokenization \u2014\n * would change which terms stay searchable on over-budget records, so it is a behavior decision\n * rather than a clarification (#5971).\n */\nexport function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[] {\n  if (TOKEN_EXCLUDED_ENTITY_TYPES.has(params.entityType)) return []\n  const config = params.config ?? resolveSearchConfig()\n  if (!config.enabled) return []\n  if (!params.doc) return []\n  const tokens: SearchTokenRow[] = []\n  const capturePairs = isSearchDebugEnabled() && params.entityType === 'customers:customer_deal'\n  const debugPairs: Array<{ field: string; hash: string }> = []\n  const scope = {\n    organizationId: params.organizationId ?? DEFAULT_SCOPE.organizationId,\n    tenantId: params.tenantId ?? DEFAULT_SCOPE.tenantId,\n  }\n  const limits = resolveSearchTokenLimits(config)\n  const recordLimit = limits.maxTokensPerRecord > 0 ? limits.maxTokensPerRecord : Number.POSITIVE_INFINITY\n  const fieldLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY\n  const ciphertextFields = ciphertextFieldsOf(params.doc, params.guardCiphertext ?? shouldGuardCiphertext())\n  warnCiphertextSkipped(params.entityType, scope.tenantId, ciphertextFields)\n\n  for (const [field, rawValue] of Object.entries(params.doc)) {\n    if (tokens.length >= recordLimit) break\n    if (ciphertextFields.has(field)) continue\n    if (!shouldIndexField(field, rawValue, config, params.entityType)) continue\n    const values = collectTextValues(rawValue)\n    const seen = new Set<string>()\n    let fieldTokenCount = 0\n    for (const text of values) {\n      if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break\n      const remainingLimit = Math.min(recordLimit - tokens.length, fieldLimit - fieldTokenCount)\n      const candidateLimit = fieldTokenCount + remainingLimit\n      const tokenConfig = Number.isFinite(candidateLimit)\n        ? { ...config, maxTokensPerField: candidateLimit }\n        : config\n      const { tokens: textTokens, hashes } = tokenizeText(text, tokenConfig)\n      for (let i = 0; i < textTokens.length; i += 1) {\n        if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break\n        const token = textTokens[i]\n        const hash = hashes[i]\n        const dedupeKey = `${field}|${hash}`\n        if (seen.has(dedupeKey)) continue\n        seen.add(dedupeKey)\n        fieldTokenCount += 1\n        debug('token.generated', { entityType: params.entityType, recordId: params.recordId, field, hash })\n        tokens.push({\n          entity_type: params.entityType,\n          entity_id: String(params.recordId),\n          organization_id: scope.organizationId,\n          tenant_id: scope.tenantId,\n          field,\n          token_hash: hash,\n          token: config.storeRawTokens ? token : null,\n        })\n        if (capturePairs) {\n          debugPairs.push({ field, hash })\n        }\n      }\n    }\n  }\n  if (capturePairs) {\n    debug('deal.tokens', {\n      entityType: params.entityType,\n      recordId: params.recordId,\n      tokenCount: debugPairs.length,\n      tokens: debugPairs,\n    })\n  }\n  debug('doc.completed', { entityType: params.entityType, recordId: params.recordId, tokenCount: tokens.length })\n\n  return tokens\n}\n\nfunction buildFieldPairs(\n  recordId: string,\n  doc?: Record<string, unknown> | null,\n  skipFields?: Set<string>,\n): EntityFieldPair[] {\n  if (!doc) return []\n  const pairs: EntityFieldPair[] = []\n  const dedupe = new Set<string>()\n  for (const field of Object.keys(doc)) {\n    // The delete below is scoped to these pairs, so omitting a field here is what preserves the\n    // tokens already stored for it rather than merely declining to write new ones.\n    if (skipFields?.has(field)) continue\n    const key = `${recordId}|${field}`\n    if (dedupe.has(key)) continue\n    dedupe.add(key)\n    pairs.push([recordId, field])\n  }\n  return pairs\n}\n\ntype TokenRowLike = { field?: unknown; token_hash?: unknown; token?: unknown }\n\n// NUL, not a printable separator: a field name may itself contain a space, so `a b` + hash `c`\n// would otherwise sign identically to field `a` + hash `b c`.\nconst SIGNATURE_SEPARATOR = String.fromCharCode(0)\n\n// Identifies one token row for comparison. `token` is NULL unless `storeRawTokens` is on, and a\n// stored NULL has to sign the same as the `null` a freshly built row carries \u2014 otherwise every\n// record compares as changed and the skip never fires.\nfunction tokenSignature(row: TokenRowLike): string {\n  return [\n    String(row.field ?? ''),\n    String(row.token_hash ?? ''),\n    row.token == null ? '' : String(row.token),\n  ].join(SIGNATURE_SEPARATOR)\n}\n\n// Multiplicities, not sets: #4681 reports token rows duplicated by the concurrent-replacement\n// defect, and a set comparison reads such a record as already correct and preserves the duplicates\n// forever. Counting sends it through a full rewrite, which collapses them.\nfunction tallyOf(rows: Iterable<TokenRowLike>): Map<string, number> {\n  const tally = new Map<string, number>()\n  for (const row of rows) {\n    const signature = tokenSignature(row)\n    tally.set(signature, (tally.get(signature) ?? 0) + 1)\n  }\n  return tally\n}\n\nfunction tallyEquals(a: Map<string, number> | undefined, b: Map<string, number> | undefined): boolean {\n  const left = a ?? new Map<string, number>()\n  const right = b ?? new Map<string, number>()\n  if (left.size !== right.size) return false\n  for (const [key, count] of left.entries()) {\n    if (right.get(key) !== count) return false\n  }\n  return true\n}\n\nfunction tallyTokenRows<TRow extends TokenRowLike>(\n  rows: Iterable<TRow>,\n  keyOf: (row: TRow) => string\n): Map<string, Map<string, number>> {\n  const tallies = new Map<string, Map<string, number>>()\n  for (const row of rows) {\n    const key = keyOf(row)\n    const tally = tallies.get(key) ?? new Map<string, number>()\n    const signature = tokenSignature(row)\n    tally.set(signature, (tally.get(signature) ?? 0) + 1)\n    tallies.set(key, tally)\n  }\n  return tallies\n}\n\nexport async function replaceSearchTokensForRecord(\n  db: Kysely<any>,\n  params: BuildTokenOptions,\n  options?: { trx?: SearchTokenExecutor },\n): Promise<void> {\n  if (TOKEN_EXCLUDED_ENTITY_TYPES.has(params.entityType)) {\n    await deleteSearchTokensForRecord(db, params, options)\n    return\n  }\n  const guardCiphertext = params.guardCiphertext ?? shouldGuardCiphertext()\n  const rows = buildSearchTokenRows({ ...params, guardCiphertext })\n  const config = params.config ?? resolveSearchConfig()\n  if (!config.enabled) return\n  const organizationId = params.organizationId ?? null\n  const tenantId = params.tenantId ?? null\n  const ciphertextFields = ciphertextFieldsOf(params.doc, guardCiphertext)\n  const fieldPairs = buildFieldPairs(String(params.recordId), params.doc, ciphertextFields)\n\n  // An empty pair list normally means the document is gone, and the delete below then purges the\n  // record wholesale. It can now also mean every field was skipped as ciphertext, where a purge\n  // would destroy precisely the tokens the skip exists to protect. Distinguish the two.\n  if (params.doc && ciphertextFields.size && !fieldPairs.length) {\n    debug('record.preserve-ciphertext', { entityType: params.entityType, recordId: params.recordId })\n    return\n  }\n\n  // Same comparison #5402 gave the batch path, over the scope this path actually writes: the\n  // delete below is narrowed to the document's own `(entity_id, field)` pairs, so the comparison\n  // has to be narrowed the same way. Reading wider would let a token row under a field this\n  // document does not carry \u2014 the `cf_` twin the search module used to write, say \u2014 read as a\n  // difference forever and defeat the skip on every write.\n  const scopeTokenQuery = (query: any): any => {\n    let scoped = query\n      .where('entity_type' as any, '=', params.entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n      .where('entity_id' as any, '=', String(params.recordId))\n    if (fieldPairs.length) {\n      scoped = scoped.where('field' as any, 'in', fieldPairs.map(([, field]) => field))\n    }\n    return scoped\n  }\n\n  // Read through the caller's transaction when there is one. A separate connection cannot see that\n  // transaction's own uncommitted writes, so it could report rows a pending delete has already\n  // removed and talk this call out of re-inserting them.\n  const reader = options?.trx ?? db\n\n  // Count probe first, as in the batch path: it returns one row whatever the table holds, so a\n  // record whose stored rows have run away (#4681) is settled without materializing them.\n  const storedCountRows = await scopeTokenQuery(\n    reader.selectFrom('search_tokens' as any).select(sql<number>`count(*)`.as('token_count') as any),\n  ).execute()\n  const storedCount = Number((storedCountRows as any[])[0]?.token_count ?? 0)\n\n  let unchanged = storedCount === rows.length\n  if (unchanged && rows.length) {\n    const stored = await scopeTokenQuery(\n      reader.selectFrom('search_tokens' as any).select(['field' as any, 'token_hash' as any, 'token' as any]),\n    )\n      // Counts already match, so this cannot truncate. It bounds the read if a concurrent writer\n      // inserts between the probe and here; a truncated read compares as changed, which costs a\n      // rewrite rather than a wrong skip.\n      .limit(rows.length)\n      .execute()\n    unchanged = tallyEquals(tallyOf(rows), tallyOf(stored as any[]))\n  }\n  if (unchanged) {\n    debug('record.skip', { entityType: params.entityType, recordId: params.recordId, tokenCount: rows.length })\n    return\n  }\n\n  const writeTokens = async (executor: SearchTokenExecutor): Promise<void> => {\n    let deleteQuery = executor\n      .deleteFrom('search_tokens' as any)\n      .where('entity_type' as any, '=', params.entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n    if (fieldPairs.length) {\n      deleteQuery = deleteQuery.where((eb: any) => eb.or(\n        fieldPairs.map(([rid, field]) => eb.and([\n          eb('entity_id' as any, '=', rid),\n          eb('field' as any, '=', field),\n        ])),\n      ))\n    } else {\n      deleteQuery = deleteQuery.where('entity_id' as any, '=', String(params.recordId))\n    }\n    await deleteQuery.execute()\n    if (!rows.length) return\n    const payloads = rows.map((row) => ({ ...row, created_at: sql`now()` }))\n    for (const batch of chunk(payloads, INSERT_BATCH_SIZE)) {\n      await executor.insertInto('search_tokens' as any).values(batch as any).execute()\n    }\n  }\n\n  if (options?.trx) {\n    await writeTokens(options.trx)\n    return\n  }\n\n  await db.transaction().execute(writeTokens)\n}\n\nexport async function deleteSearchTokensForRecord(\n  db: Kysely<any>,\n  params: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null },\n  options?: { trx?: SearchTokenExecutor },\n): Promise<void> {\n  const organizationId = params.organizationId ?? null\n  const tenantId = params.tenantId ?? null\n  const executor = options?.trx ?? db\n  await executor\n    .deleteFrom('search_tokens' as any)\n    .where('entity_type' as any, '=', params.entityType)\n    .where('entity_id' as any, '=', String(params.recordId))\n    .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)\n    .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)\n    .execute()\n}\n\nexport async function replaceSearchTokensForBatch(\n  db: Kysely<any>,\n  allPayloads: Array<BuildTokenOptions & { doc: Record<string, unknown> }>\n): Promise<void> {\n  if (!allPayloads.length) return\n  const excludedBuckets = new Map<string, {\n    entityType: string\n    organizationId: string | null\n    tenantId: string | null\n    ids: Set<string>\n  }>()\n  const indexablePayloads = allPayloads.filter((payload) => {\n    if (!TOKEN_EXCLUDED_ENTITY_TYPES.has(payload.entityType)) return true\n    const organizationId = payload.organizationId ?? null\n    const tenantId = payload.tenantId ?? null\n    const key = JSON.stringify([payload.entityType, organizationId, tenantId])\n    const bucket = excludedBuckets.get(key) ?? {\n      entityType: payload.entityType,\n      organizationId,\n      tenantId,\n      ids: new Set<string>(),\n    }\n    bucket.ids.add(String(payload.recordId))\n    excludedBuckets.set(key, bucket)\n    return false\n  })\n  if (excludedBuckets.size) {\n    await db.transaction().execute(async (trx) => {\n      for (const bucket of excludedBuckets.values()) {\n        await trx\n          .deleteFrom('search_tokens')\n          .where('entity_type', '=', bucket.entityType)\n          .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n          .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n          .where('entity_id', 'in', Array.from(bucket.ids))\n          .execute()\n      }\n    })\n  }\n  if (!indexablePayloads.length) return\n  const config = resolveSearchConfig()\n  if (!config.enabled) return\n\n  // A record carrying ciphertext drops out of the batch entirely, rather than being rewritten\n  // without its encrypted fields. This path deletes by `entity_id` -- it cannot express \"replace\n  // these fields and leave those alone\" the way the per-record path can -- so partial handling\n  // here would still delete the tokens we are trying to protect. Skipping the record leaves every\n  // one of its tokens, encrypted-field and plaintext-field alike, exactly as it was. The state is\n  // transient by construction: `decrypt-database` followed by a reindex rebuilds all of it.\n  const guardCiphertext = shouldGuardCiphertext()\n  const preservedRecordIds = new Set<string>()\n  const payloads = indexablePayloads.filter((payload) => {\n    const ciphertextFields = ciphertextFieldsOf(payload.doc, guardCiphertext)\n    if (!ciphertextFields.size) return true\n    warnCiphertextSkipped(payload.entityType, payload.tenantId ?? null, ciphertextFields)\n    preservedRecordIds.add(String(payload.recordId))\n    return false\n  })\n  if (!payloads.length) return\n\n  const rows = payloads.flatMap((payload) => buildSearchTokenRows({ ...payload, config, guardCiphertext }))\n  if (!rows.length) {\n    const entityType = payloads[0]?.entityType\n    if (!entityType) return\n    const ids = payloads.map((p) => String(p.recordId))\n    await db\n      .deleteFrom('search_tokens' as any)\n      .where('entity_type' as any, '=', entityType)\n      .where('entity_id' as any, 'in', ids)\n      .execute()\n    return\n  }\n\n  const scopeKey = (org: string | null, tenant: string | null) => `${org ?? '__null__'}|${tenant ?? '__null__'}`\n  const scopeBuckets = new Map<string, { organizationId: string | null; tenantId: string | null; ids: Set<string> }>()\n\n  for (const payload of payloads) {\n    const org = payload.organizationId ?? null\n    const tenant = payload.tenantId ?? null\n    const key = scopeKey(org, tenant)\n    const bucket = scopeBuckets.get(key) ?? { organizationId: org, tenantId: tenant, ids: new Set<string>() }\n    bucket.ids.add(String(payload.recordId))\n    scopeBuckets.set(key, bucket)\n  }\n\n  const recordKeyOf = (row: SearchTokenRow) =>\n    `${scopeKey(row.organization_id ?? null, row.tenant_id ?? null)}|${String(row.entity_id)}`\n  const builtTally = tallyTokenRows(rows, recordKeyOf)\n\n  // Read outside the transaction, deliberately. The comparison decides only whether to skip a\n  // rewrite, so a concurrent writer costs us at most a rewrite we declined \u2014 declined because the\n  // table already held exactly the rows this call wanted to write. One ordering is worth naming\n  // though: if the read matches and a concurrent writer then commits tokens built from a *staler*\n  // doc, the unconditional rewrite this call used to perform would have overwritten them by\n  // accident. It no longer does, so those stale rows survive until the record's next write. That\n  // is a repair we lose, not a guarantee we break.\n  const changedIdsByBucket = new Map<string, Set<string>>()\n  for (const [key, bucket] of scopeBuckets.entries()) {\n    const ids = Array.from(bucket.ids)\n    const builtCountById = new Map<string, number>()\n    for (const id of ids) {\n      let total = 0\n      const tally = builtTally.get(`${key}|${id}`)\n      if (tally) for (const count of tally.values()) total += count\n      builtCountById.set(id, total)\n    }\n\n    // Count probe first. Its result is one row per record in the batch, so it is bounded by the\n    // batch size \u2014 unlike a bare row read, which would be bounded only by how many token rows the\n    // table already holds for these ids, a quantity this function does not control and (per #4681)\n    // has no reason to trust.\n    const storedCounts = await db\n      .selectFrom('search_tokens' as any)\n      .select(['entity_id' as any, sql<number>`count(*)`.as('token_count') as any])\n      .where('entity_type' as any, '=', payloads[0].entityType)\n      .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n      .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n      .where('entity_id' as any, 'in', ids)\n      .groupBy('entity_id' as any)\n      .execute()\n    const storedCountById = new Map<string, number>()\n    for (const row of storedCounts as any[]) {\n      storedCountById.set(String(row.entity_id), Number(row.token_count))\n    }\n\n    const changed = new Set<string>()\n    // A record whose stored row count already differs is changed, whatever the rows say \u2014 the\n    // duplicate case from #4681 resolves here without ever materializing the duplicated rows.\n    const contentCandidates = ids.filter((id) => {\n      const builtCount = builtCountById.get(id) ?? 0\n      if ((storedCountById.get(id) ?? 0) !== builtCount) {\n        changed.add(id)\n        return false\n      }\n      return builtCount > 0\n    })\n\n    if (contentCandidates.length) {\n      const rowBudget = contentCandidates.reduce((sum, id) => sum + (builtCountById.get(id) ?? 0), 0)\n      const stored = await db\n        .selectFrom('search_tokens' as any)\n        .select(['entity_id' as any, 'field' as any, 'token_hash' as any, 'token' as any])\n        .where('entity_type' as any, '=', payloads[0].entityType)\n        .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n        .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n        .where('entity_id' as any, 'in', contentCandidates)\n        // Counts already match, so this cannot truncate \u2014 it bounds the damage if a concurrent\n        // writer inserts between the probe and this read. A truncated read compares as changed,\n        // which costs a rewrite rather than a wrong skip.\n        .limit(rowBudget)\n        .execute()\n      const storedTally = tallyTokenRows(stored as any[], (row) => String(row.entity_id))\n      for (const id of contentCandidates) {\n        if (!tallyEquals(builtTally.get(`${key}|${id}`), storedTally.get(id))) changed.add(id)\n      }\n    }\n    changedIdsByBucket.set(key, changed)\n  }\n\n  const changedRecordKeys = new Set<string>()\n  for (const [key, changed] of changedIdsByBucket.entries()) {\n    for (const id of changed) changedRecordKeys.add(`${key}|${id}`)\n  }\n  debug('batch.skip', {\n    entityType: payloads[0].entityType,\n    recordCount: payloads.length,\n    changedCount: changedRecordKeys.size,\n    preservedCiphertextRecordCount: preservedRecordIds.size,\n  })\n  if (!changedRecordKeys.size) return\n\n  await db.transaction().execute(async (trx) => {\n    for (const [key, bucket] of scopeBuckets.entries()) {\n      const changed = changedIdsByBucket.get(key)\n      if (!changed?.size) continue\n      // Delete by entity_id: a batch replaces all of a record's tokens, and a per-field OR over the\n      // whole batch overflows the query compiler's call stack on large batches.\n      const deleteQuery = trx\n        .deleteFrom('search_tokens' as any)\n        .where('entity_type' as any, '=', payloads[0].entityType)\n        .where(sql<boolean>`organization_id is not distinct from ${bucket.organizationId}`)\n        .where(sql<boolean>`tenant_id is not distinct from ${bucket.tenantId}`)\n        .where('entity_id' as any, 'in', Array.from(changed))\n      await deleteQuery.execute()\n    }\n    const payloadWithTimestamps = rows\n      .filter((row) => changedRecordKeys.has(recordKeyOf(row)))\n      .map((row) => ({ ...row, created_at: sql`now()` }))\n    for (const batch of chunk(payloadWithTimestamps, INSERT_BATCH_SIZE)) {\n      await trx.insertInto('search_tokens' as any).values(batch as any).execute()\n    }\n  })\n}\n"],
+  "mappings": "AAAA,SAAwC,WAAW;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,kBAAkB,6BAA8C;AACzE,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AAEtC,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE/E,MAAM,oBAAoB;AAC1B,MAAM,8BAA8B,oBAAI,IAAI,CAAC,yBAAyB,uBAAuB,CAAC;AAE9F,SAAS,MAAS,OAAY,MAAqB;AACjD,MAAI,QAAQ,EAAG,QAAO,CAAC,KAAK;AAC5B,QAAM,MAAa,CAAC;AACpB,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAM,KAAI,KAAK,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC;AAC9E,SAAO;AACT;AAuBA,MAAM,gBAAgB,EAAE,gBAAgB,MAAM,UAAU,KAAK;AAItD,MAAM,uBAAuB,MAAe;AACjD,SAAO,kBAAkB,QAAQ,IAAI,mBAAmB,EAAE,MAAM;AAClE;AAEA,MAAM,QAAQ,CAAC,OAAe,YAAqC;AACjE,MAAI,CAAC,qBAAqB,EAAG;AAC7B,MAAI;AACF,WAAO,MAAM,sBAAsB,EAAE,OAAO,QAAQ,CAAC;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,kBAAkB,OAA0B;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC,KAAK;AAC5C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,MAAgB,CAAC;AACvB,eAAW,SAAS,OAAO;AACzB,UAAI,OAAO,UAAU,SAAU,KAAI,KAAK,KAAK;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AACA,SAAO,CAAC;AACV;AAEA,IAAI,kBAAqC;AAuBzC,SAAS,wBAAiC;AACxC,sBAAoB,iBAAiB;AACrC,SAAO,sBAAsB,eAAe,MAAM;AACpD;AAkBA,SAAS,mBACP,KACA,OACa;AACb,QAAM,SAAS,oBAAI,IAAY;AAC/B,MAAI,CAAC,SAAS,CAAC,IAAK,QAAO;AAC3B,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,UAAM,SAAS,kBAAkB,KAAK;AACtC,QAAI,OAAO,UAAU,OAAO,KAAK,CAAC,SAAS,0BAA0B,IAAI,CAAC,EAAG,QAAO,IAAI,KAAK;AAAA,EAC/F;AACA,SAAO;AACT;AAEA,MAAM,2BAA2B,oBAAI,IAAY;AAEjD,SAAS,sBAAsB,YAAoB,UAAyB,QAA2B;AACrG,MAAI,CAAC,OAAO,KAAM;AAIlB,QAAM,MAAM,GAAG,UAAU,IAAI,YAAY,EAAE;AAC3C,MAAI,yBAAyB,IAAI,GAAG,EAAG;AACvC,2BAAyB,IAAI,GAAG;AAChC,SAAO;AAAA,IACL;AAAA,IAGA,EAAE,YAAY,UAAU,QAAQ,MAAM,KAAK,MAAM,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC,EAAE;AAAA,EACtG;AACF;AAGO,SAAS,4BAAkC;AAChD,2BAAyB,MAAM;AAC/B,oBAAkB;AACpB;AAEA,SAAS,iBACP,OACA,OACA,QACA,YACS;AACT,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAC/D,QAAM,QAAQ,MAAM,YAAY;AAChC,MAAI,UAAU,QAAQ,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,KAAK,EAAG,QAAO;AAC7E,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO;AAClC,MAAI,CAAC,cAAc,cAAc,cAAc,aAAa,iBAAiB,EAAE,SAAS,KAAK,EAAG,QAAO;AACvG,MAAI,yBAAyB,OAAO,YAAY,MAAM,EAAG,QAAO;AAChE,MAAI,sBAAsB,YAAY,KAAK,EAAG,QAAO;AACrD,SAAO,kBAAkB,KAAK,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;AAChE;AAiCO,SAAS,qBAAqB,QAA6C;AAChF,MAAI,4BAA4B,IAAI,OAAO,UAAU,EAAG,QAAO,CAAC;AAChE,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC;AAC7B,MAAI,CAAC,OAAO,IAAK,QAAO,CAAC;AACzB,QAAM,SAA2B,CAAC;AAClC,QAAM,eAAe,qBAAqB,KAAK,OAAO,eAAe;AACrE,QAAM,aAAqD,CAAC;AAC5D,QAAM,QAAQ;AAAA,IACZ,gBAAgB,OAAO,kBAAkB,cAAc;AAAA,IACvD,UAAU,OAAO,YAAY,cAAc;AAAA,EAC7C;AACA,QAAM,SAAS,yBAAyB,MAAM;AAC9C,QAAM,cAAc,OAAO,qBAAqB,IAAI,OAAO,qBAAqB,OAAO;AACvF,QAAM,aAAa,OAAO,oBAAoB,IAAI,OAAO,oBAAoB,OAAO;AACpF,QAAM,mBAAmB,mBAAmB,OAAO,KAAK,OAAO,mBAAmB,sBAAsB,CAAC;AACzG,wBAAsB,OAAO,YAAY,MAAM,UAAU,gBAAgB;AAEzE,aAAW,CAAC,OAAO,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG,GAAG;AAC1D,QAAI,OAAO,UAAU,YAAa;AAClC,QAAI,iBAAiB,IAAI,KAAK,EAAG;AACjC,QAAI,CAAC,iBAAiB,OAAO,UAAU,QAAQ,OAAO,UAAU,EAAG;AACnE,UAAM,SAAS,kBAAkB,QAAQ;AACzC,UAAM,OAAO,oBAAI,IAAY;AAC7B,QAAI,kBAAkB;AACtB,eAAW,QAAQ,QAAQ;AACzB,UAAI,OAAO,UAAU,eAAe,mBAAmB,WAAY;AACnE,YAAM,iBAAiB,KAAK,IAAI,cAAc,OAAO,QAAQ,aAAa,eAAe;AACzF,YAAM,iBAAiB,kBAAkB;AACzC,YAAM,cAAc,OAAO,SAAS,cAAc,IAC9C,EAAE,GAAG,QAAQ,mBAAmB,eAAe,IAC/C;AACJ,YAAM,EAAE,QAAQ,YAAY,OAAO,IAAI,aAAa,MAAM,WAAW;AACrE,eAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK,GAAG;AAC7C,YAAI,OAAO,UAAU,eAAe,mBAAmB,WAAY;AACnE,cAAM,QAAQ,WAAW,CAAC;AAC1B,cAAM,OAAO,OAAO,CAAC;AACrB,cAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,YAAI,KAAK,IAAI,SAAS,EAAG;AACzB,aAAK,IAAI,SAAS;AAClB,2BAAmB;AACnB,cAAM,mBAAmB,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,OAAO,KAAK,CAAC;AAClG,eAAO,KAAK;AAAA,UACV,aAAa,OAAO;AAAA,UACpB,WAAW,OAAO,OAAO,QAAQ;AAAA,UACjC,iBAAiB,MAAM;AAAA,UACvB,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,YAAY;AAAA,UACZ,OAAO,OAAO,iBAAiB,QAAQ;AAAA,QACzC,CAAC;AACD,YAAI,cAAc;AAChB,qBAAW,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,cAAc;AAChB,UAAM,eAAe;AAAA,MACnB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,YAAY,WAAW;AAAA,MACvB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,QAAM,iBAAiB,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,YAAY,OAAO,OAAO,CAAC;AAE9G,SAAO;AACT;AAEA,SAAS,gBACP,UACA,KACA,YACmB;AACnB,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,QAA2B,CAAC;AAClC,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,OAAO,KAAK,GAAG,GAAG;AAGpC,QAAI,YAAY,IAAI,KAAK,EAAG;AAC5B,UAAM,MAAM,GAAG,QAAQ,IAAI,KAAK;AAChC,QAAI,OAAO,IAAI,GAAG,EAAG;AACrB,WAAO,IAAI,GAAG;AACd,UAAM,KAAK,CAAC,UAAU,KAAK,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAMA,MAAM,sBAAsB,OAAO,aAAa,CAAC;AAKjD,SAAS,eAAe,KAA2B;AACjD,SAAO;AAAA,IACL,OAAO,IAAI,SAAS,EAAE;AAAA,IACtB,OAAO,IAAI,cAAc,EAAE;AAAA,IAC3B,IAAI,SAAS,OAAO,KAAK,OAAO,IAAI,KAAK;AAAA,EAC3C,EAAE,KAAK,mBAAmB;AAC5B;AAKA,SAAS,QAAQ,MAAmD;AAClE,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,OAAO,MAAM;AACtB,UAAM,YAAY,eAAe,GAAG;AACpC,UAAM,IAAI,YAAY,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,YAAY,GAAoC,GAA6C;AACpG,QAAM,OAAO,KAAK,oBAAI,IAAoB;AAC1C,QAAM,QAAQ,KAAK,oBAAI,IAAoB;AAC3C,MAAI,KAAK,SAAS,MAAM,KAAM,QAAO;AACrC,aAAW,CAAC,KAAK,KAAK,KAAK,KAAK,QAAQ,GAAG;AACzC,QAAI,MAAM,IAAI,GAAG,MAAM,MAAO,QAAO;AAAA,EACvC;AACA,SAAO;AACT;AAEA,SAAS,eACP,MACA,OACkC;AAClC,QAAM,UAAU,oBAAI,IAAiC;AACrD,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,MAAM,GAAG;AACrB,UAAM,QAAQ,QAAQ,IAAI,GAAG,KAAK,oBAAI,IAAoB;AAC1D,UAAM,YAAY,eAAe,GAAG;AACpC,UAAM,IAAI,YAAY,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;AACpD,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,eAAsB,6BACpB,IACA,QACA,SACe;AACf,MAAI,4BAA4B,IAAI,OAAO,UAAU,GAAG;AACtD,UAAM,4BAA4B,IAAI,QAAQ,OAAO;AACrD;AAAA,EACF;AACA,QAAM,kBAAkB,OAAO,mBAAmB,sBAAsB;AACxE,QAAM,OAAO,qBAAqB,EAAE,GAAG,QAAQ,gBAAgB,CAAC;AAChE,QAAM,SAAS,OAAO,UAAU,oBAAoB;AACpD,MAAI,CAAC,OAAO,QAAS;AACrB,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,mBAAmB,mBAAmB,OAAO,KAAK,eAAe;AACvE,QAAM,aAAa,gBAAgB,OAAO,OAAO,QAAQ,GAAG,OAAO,KAAK,gBAAgB;AAKxF,MAAI,OAAO,OAAO,iBAAiB,QAAQ,CAAC,WAAW,QAAQ;AAC7D,UAAM,8BAA8B,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,SAAS,CAAC;AAChG;AAAA,EACF;AAOA,QAAM,kBAAkB,CAAC,UAAoB;AAC3C,QAAI,SAAS,MACV,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE,EAC9D,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AACzD,QAAI,WAAW,QAAQ;AACrB,eAAS,OAAO,MAAM,SAAgB,MAAM,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAKA,QAAM,SAAS,SAAS,OAAO;AAI/B,QAAM,kBAAkB,MAAM;AAAA,IAC5B,OAAO,WAAW,eAAsB,EAAE,OAAO,cAAsB,GAAG,aAAa,CAAQ;AAAA,EACjG,EAAE,QAAQ;AACV,QAAM,cAAc,OAAQ,gBAA0B,CAAC,GAAG,eAAe,CAAC;AAE1E,MAAI,YAAY,gBAAgB,KAAK;AACrC,MAAI,aAAa,KAAK,QAAQ;AAC5B,UAAM,SAAS,MAAM;AAAA,MACnB,OAAO,WAAW,eAAsB,EAAE,OAAO,CAAC,SAAgB,cAAqB,OAAc,CAAC;AAAA,IACxG,EAIG,MAAM,KAAK,MAAM,EACjB,QAAQ;AACX,gBAAY,YAAY,QAAQ,IAAI,GAAG,QAAQ,MAAe,CAAC;AAAA,EACjE;AACA,MAAI,WAAW;AACb,UAAM,eAAe,EAAE,YAAY,OAAO,YAAY,UAAU,OAAO,UAAU,YAAY,KAAK,OAAO,CAAC;AAC1G;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,aAAiD;AAC1E,QAAI,cAAc,SACf,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE;AACjE,QAAI,WAAW,QAAQ;AACrB,oBAAc,YAAY,MAAM,CAAC,OAAY,GAAG;AAAA,QAC9C,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI;AAAA,UACtC,GAAG,aAAoB,KAAK,GAAG;AAAA,UAC/B,GAAG,SAAgB,KAAK,KAAK;AAAA,QAC/B,CAAC,CAAC;AAAA,MACJ,CAAC;AAAA,IACH,OAAO;AACL,oBAAc,YAAY,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC;AAAA,IAClF;AACA,UAAM,YAAY,QAAQ;AAC1B,QAAI,CAAC,KAAK,OAAQ;AAClB,UAAM,WAAW,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,WAAW,EAAE;AACvE,eAAW,SAAS,MAAM,UAAU,iBAAiB,GAAG;AACtD,YAAM,SAAS,WAAW,eAAsB,EAAE,OAAO,KAAY,EAAE,QAAQ;AAAA,IACjF;AAAA,EACF;AAEA,MAAI,SAAS,KAAK;AAChB,UAAM,YAAY,QAAQ,GAAG;AAC7B;AAAA,EACF;AAEA,QAAM,GAAG,YAAY,EAAE,QAAQ,WAAW;AAC5C;AAEA,eAAsB,4BACpB,IACA,QACA,SACe;AACf,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,WAAW,SAAS,OAAO;AACjC,QAAM,SACH,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,OAAO,UAAU,EAClD,MAAM,aAAoB,KAAK,OAAO,OAAO,QAAQ,CAAC,EACtD,MAAM,2CAAoD,cAAc,EAAE,EAC1E,MAAM,qCAA8C,QAAQ,EAAE,EAC9D,QAAQ;AACb;AAEA,eAAsB,4BACpB,IACA,aACe;AACf,MAAI,CAAC,YAAY,OAAQ;AACzB,QAAM,kBAAkB,oBAAI,IAKzB;AACH,QAAM,oBAAoB,YAAY,OAAO,CAAC,YAAY;AACxD,QAAI,CAAC,4BAA4B,IAAI,QAAQ,UAAU,EAAG,QAAO;AACjE,UAAM,iBAAiB,QAAQ,kBAAkB;AACjD,UAAM,WAAW,QAAQ,YAAY;AACrC,UAAM,MAAM,KAAK,UAAU,CAAC,QAAQ,YAAY,gBAAgB,QAAQ,CAAC;AACzE,UAAM,SAAS,gBAAgB,IAAI,GAAG,KAAK;AAAA,MACzC,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA;AAAA,MACA,KAAK,oBAAI,IAAY;AAAA,IACvB;AACA,WAAO,IAAI,IAAI,OAAO,QAAQ,QAAQ,CAAC;AACvC,oBAAgB,IAAI,KAAK,MAAM;AAC/B,WAAO;AAAA,EACT,CAAC;AACD,MAAI,gBAAgB,MAAM;AACxB,UAAM,GAAG,YAAY,EAAE,QAAQ,OAAO,QAAQ;AAC5C,iBAAW,UAAU,gBAAgB,OAAO,GAAG;AAC7C,cAAM,IACH,WAAW,eAAe,EAC1B,MAAM,eAAe,KAAK,OAAO,UAAU,EAC3C,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAa,MAAM,MAAM,KAAK,OAAO,GAAG,CAAC,EAC/C,QAAQ;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,CAAC,kBAAkB,OAAQ;AAC/B,QAAM,SAAS,oBAAoB;AACnC,MAAI,CAAC,OAAO,QAAS;AAQrB,QAAM,kBAAkB,sBAAsB;AAC9C,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,WAAW,kBAAkB,OAAO,CAAC,YAAY;AACrD,UAAM,mBAAmB,mBAAmB,QAAQ,KAAK,eAAe;AACxE,QAAI,CAAC,iBAAiB,KAAM,QAAO;AACnC,0BAAsB,QAAQ,YAAY,QAAQ,YAAY,MAAM,gBAAgB;AACpF,uBAAmB,IAAI,OAAO,QAAQ,QAAQ,CAAC;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,MAAI,CAAC,SAAS,OAAQ;AAEtB,QAAM,OAAO,SAAS,QAAQ,CAAC,YAAY,qBAAqB,EAAE,GAAG,SAAS,QAAQ,gBAAgB,CAAC,CAAC;AACxG,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,aAAa,SAAS,CAAC,GAAG;AAChC,QAAI,CAAC,WAAY;AACjB,UAAM,MAAM,SAAS,IAAI,CAAC,MAAM,OAAO,EAAE,QAAQ,CAAC;AAClD,UAAM,GACH,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,UAAU,EAC3C,MAAM,aAAoB,MAAM,GAAG,EACnC,QAAQ;AACX;AAAA,EACF;AAEA,QAAM,WAAW,CAAC,KAAoB,WAA0B,GAAG,OAAO,UAAU,IAAI,UAAU,UAAU;AAC5G,QAAM,eAAe,oBAAI,IAA0F;AAEnH,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAM,QAAQ,kBAAkB;AACtC,UAAM,SAAS,QAAQ,YAAY;AACnC,UAAM,MAAM,SAAS,KAAK,MAAM;AAChC,UAAM,SAAS,aAAa,IAAI,GAAG,KAAK,EAAE,gBAAgB,KAAK,UAAU,QAAQ,KAAK,oBAAI,IAAY,EAAE;AACxG,WAAO,IAAI,IAAI,OAAO,QAAQ,QAAQ,CAAC;AACvC,iBAAa,IAAI,KAAK,MAAM;AAAA,EAC9B;AAEA,QAAM,cAAc,CAAC,QACnB,GAAG,SAAS,IAAI,mBAAmB,MAAM,IAAI,aAAa,IAAI,CAAC,IAAI,OAAO,IAAI,SAAS,CAAC;AAC1F,QAAM,aAAa,eAAe,MAAM,WAAW;AASnD,QAAM,qBAAqB,oBAAI,IAAyB;AACxD,aAAW,CAAC,KAAK,MAAM,KAAK,aAAa,QAAQ,GAAG;AAClD,UAAM,MAAM,MAAM,KAAK,OAAO,GAAG;AACjC,UAAM,iBAAiB,oBAAI,IAAoB;AAC/C,eAAW,MAAM,KAAK;AACpB,UAAI,QAAQ;AACZ,YAAM,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE;AAC3C,UAAI,MAAO,YAAW,SAAS,MAAM,OAAO,EAAG,UAAS;AACxD,qBAAe,IAAI,IAAI,KAAK;AAAA,IAC9B;AAMA,UAAM,eAAe,MAAM,GACxB,WAAW,eAAsB,EACjC,OAAO,CAAC,aAAoB,cAAsB,GAAG,aAAa,CAAQ,CAAC,EAC3E,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,GAAG,EACnC,QAAQ,WAAkB,EAC1B,QAAQ;AACX,UAAM,kBAAkB,oBAAI,IAAoB;AAChD,eAAW,OAAO,cAAuB;AACvC,sBAAgB,IAAI,OAAO,IAAI,SAAS,GAAG,OAAO,IAAI,WAAW,CAAC;AAAA,IACpE;AAEA,UAAM,UAAU,oBAAI,IAAY;AAGhC,UAAM,oBAAoB,IAAI,OAAO,CAAC,OAAO;AAC3C,YAAM,aAAa,eAAe,IAAI,EAAE,KAAK;AAC7C,WAAK,gBAAgB,IAAI,EAAE,KAAK,OAAO,YAAY;AACjD,gBAAQ,IAAI,EAAE;AACd,eAAO;AAAA,MACT;AACA,aAAO,aAAa;AAAA,IACtB,CAAC;AAED,QAAI,kBAAkB,QAAQ;AAC5B,YAAM,YAAY,kBAAkB,OAAO,CAAC,KAAK,OAAO,OAAO,eAAe,IAAI,EAAE,KAAK,IAAI,CAAC;AAC9F,YAAM,SAAS,MAAM,GAClB,WAAW,eAAsB,EACjC,OAAO,CAAC,aAAoB,SAAgB,cAAqB,OAAc,CAAC,EAChF,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,iBAAiB,EAIjD,MAAM,SAAS,EACf,QAAQ;AACX,YAAM,cAAc,eAAe,QAAiB,CAAC,QAAQ,OAAO,IAAI,SAAS,CAAC;AAClF,iBAAW,MAAM,mBAAmB;AAClC,YAAI,CAAC,YAAY,WAAW,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE,GAAG,YAAY,IAAI,EAAE,CAAC,EAAG,SAAQ,IAAI,EAAE;AAAA,MACvF;AAAA,IACF;AACA,uBAAmB,IAAI,KAAK,OAAO;AAAA,EACrC;AAEA,QAAM,oBAAoB,oBAAI,IAAY;AAC1C,aAAW,CAAC,KAAK,OAAO,KAAK,mBAAmB,QAAQ,GAAG;AACzD,eAAW,MAAM,QAAS,mBAAkB,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE;AAAA,EAChE;AACA,QAAM,cAAc;AAAA,IAClB,YAAY,SAAS,CAAC,EAAE;AAAA,IACxB,aAAa,SAAS;AAAA,IACtB,cAAc,kBAAkB;AAAA,IAChC,gCAAgC,mBAAmB;AAAA,EACrD,CAAC;AACD,MAAI,CAAC,kBAAkB,KAAM;AAE7B,QAAM,GAAG,YAAY,EAAE,QAAQ,OAAO,QAAQ;AAC5C,eAAW,CAAC,KAAK,MAAM,KAAK,aAAa,QAAQ,GAAG;AAClD,YAAM,UAAU,mBAAmB,IAAI,GAAG;AAC1C,UAAI,CAAC,SAAS,KAAM;AAGpB,YAAM,cAAc,IACjB,WAAW,eAAsB,EACjC,MAAM,eAAsB,KAAK,SAAS,CAAC,EAAE,UAAU,EACvD,MAAM,2CAAoD,OAAO,cAAc,EAAE,EACjF,MAAM,qCAA8C,OAAO,QAAQ,EAAE,EACrE,MAAM,aAAoB,MAAM,MAAM,KAAK,OAAO,CAAC;AACtD,YAAM,YAAY,QAAQ;AAAA,IAC5B;AACA,UAAM,wBAAwB,KAC3B,OAAO,CAAC,QAAQ,kBAAkB,IAAI,YAAY,GAAG,CAAC,CAAC,EACvD,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,WAAW,EAAE;AACpD,eAAW,SAAS,MAAM,uBAAuB,iBAAiB,GAAG;AACnE,YAAM,IAAI,WAAW,eAAsB,EAAE,OAAO,KAAY,EAAE,QAAQ;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/modules/query_index/migrations/Migration20261005201500_query_index.js

@@ -0,0 +1,17 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20261005201500_query_index extends Migration {
+  isTransactional() {
+    return false;
+  }
+  up() {
+    this.addSql(`drop index concurrently if exists "entity_indexes_catalog_product_scope_keys_gin_idx";`);
+    this.addSql(`create index concurrently "entity_indexes_catalog_product_scope_keys_gin_idx" on "entity_indexes" using gin (("doc" -> 'scope_keys')) where "entity_type" = 'catalog:catalog_product';`);
+  }
+  down() {
+    this.addSql(`drop index concurrently if exists "entity_indexes_catalog_product_scope_keys_gin_idx";`);
+  }
+}
+export {
+  Migration20261005201500_query_index
+};
+//# sourceMappingURL=Migration20261005201500_query_index.js.map

package/dist/modules/query_index/migrations/Migration20261005201500_query_index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/query_index/migrations/Migration20261005201500_query_index.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\n// GIN expression index serving the storefront assortment predicate (Storefront Public API\n// \u00A73.3, D9): `(doc -> 'scope_keys') ?| $n::text[]` on catalog:catalog_product index documents,\n// whose `scope_keys` key the catalog contributes through its doc enricher\n// (catalog/lib/productScopeKeys.ts).\n//\n// Ownership: query_index owns the migration (as the spec's \u00A73.3 table assigns it) because it\n// owns `entity_indexes`; a catalog migration cannot do it, since modules migrate in\n// alphabetical order and on a fresh database catalog's migrations run before query_index\n// creates the table. MANUAL DDL: a partial expression index keyed on another module's entity\n// type is not modelled on the EntityIndexRow entity, so `.snapshot-open-mercato.json` does not\n// record it; `yarn db:generate` diffs entity metadata against the snapshot, so it never emits a\n// drop for it (same approach as the Omnibus trigger DDL in catalog's\n// Migration20261005150824_catalog).\n//\n// The expression must be spelled exactly as the query engine emits it\n// (`jsonbDocKeyExpression` in @open-mercato/shared/lib/query/overlap emits the key as a\n// literal) or PostgreSQL silently falls back to a sequential scan; the catalog\n// product-scope-keys-index test pins both sides. Default `jsonb_ops` (not `jsonb_path_ops`),\n// because only `jsonb_ops` supports `?|`.\n//\n// entity_indexes is high-churn, so the index is built CONCURRENTLY, which cannot run inside a\n// transaction (isTransactional() => false; the runner applies migrations one-by-one). Drop\n// first so retrying an interrupted build removes PostgreSQL's INVALID index stub. Same shape as\n// Migration20260731105052_query_index.\nexport class Migration20261005201500_query_index extends Migration {\n\n  override isTransactional(): boolean {\n    return false;\n  }\n\n  override up(): void | Promise<void> {\n    this.addSql(`drop index concurrently if exists \"entity_indexes_catalog_product_scope_keys_gin_idx\";`);\n    this.addSql(`create index concurrently \"entity_indexes_catalog_product_scope_keys_gin_idx\" on \"entity_indexes\" using gin ((\"doc\" -> 'scope_keys')) where \"entity_type\" = 'catalog:catalog_product';`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`drop index concurrently if exists \"entity_indexes_catalog_product_scope_keys_gin_idx\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AA0BnB,MAAM,4CAA4C,UAAU;AAAA,EAExD,kBAA2B;AAClC,WAAO;AAAA,EACT;AAAA,EAES,KAA2B;AAClC,SAAK,OAAO,wFAAwF;AACpG,SAAK,OAAO,wLAAwL;AAAA,EACtM;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,wFAAwF;AAAA,EACtG;AAEF;",
+  "names": []
+}

package/dist/modules/translations/components/TranslationManager.js

@@ -135,8 +135,8 @@ function TranslationManager({
     enabled: !!entityType
   });
   const fieldList = React.useMemo(
-    () => resolveFieldList(entityType, propTranslatableFields, fieldDefs),
-    [entityType, propTranslatableFields, fieldDefs]
+    () => resolveFieldList(entityType, propTranslatableFields, fieldDefs, baseValues),
+    [entityType, propTranslatableFields, fieldDefs, baseValues]
   );
   const {
     data: translationData,
@@ -326,7 +326,7 @@ function TranslationManager({
         ] })
       ] }) }),
       /* @__PURE__ */ jsx("tbody", { children: fieldList.map((field) => {
-        const baseVal = getBaseValue(field.key);
+        const baseVal = field.baseValue ?? getBaseValue(field.key);
         const translatedVal = localeTranslations[field.key] ?? "";
         return /* @__PURE__ */ jsxs("tr", { className: "border-t", children: [
           /* @__PURE__ */ jsx("td", { className: "px-3 py-2 align-top text-xs font-medium text-muted-foreground", children: field.label }),