@open-mercato/search 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:search] found 98 entry points
+[build:search] found 99 entry points
 [build:search] built successfully

package/dist/di.js

@@ -6,6 +6,8 @@ import { FullTextSearchStrategy } from "./strategies/fulltext.strategy.js";
 import { createFulltextDriver } from "./fulltext/drivers/index.js";
 import { SearchIndexer } from "./indexer/search-indexer.js";
 import { createPresenterEnricher } from "./lib/presenter-enricher.js";
+import { createEncryptionMapResolver } from "./lib/encryption-map-resolver.js";
+import { createEncryptionMapResolver as createEncryptionMapResolver2 } from "./lib/encryption-map-resolver.js";
 const FULLTEXT_DRIVER_KEY = "__omSearchFulltextDriver__";
 function getSearchModuleGlobals() {
   return globalThis;
@@ -14,26 +16,9 @@ function shouldExcludeEncryptedFields() {
   const raw = (process.env.SEARCH_EXCLUDE_ENCRYPTED_FIELDS ?? "").toLowerCase();
   return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
 }
-function createEncryptionMapResolver(db) {
-  const cache = /* @__PURE__ */ new Map();
-  const CACHE_TTL_MS = 5 * 60 * 1e3;
-  return async (entityId) => {
-    const cached = cache.get(entityId);
-    if (cached && cached.expiresAt > Date.now()) {
-      return cached.entries;
-    }
-    try {
-      const row = await db.selectFrom("encryption_maps").select(["fields_json"]).where("entity_id", "=", entityId).where("is_active", "=", true).where("deleted_at", "is", null).executeTakeFirst();
-      const fieldsJson = row?.fields_json;
-      const entries = Array.isArray(fieldsJson) ? fieldsJson.map((f) => ({
-        field: f.field,
-        hashField: f.hashField ?? null
-      })) : [];
-      cache.set(entityId, { entries, expiresAt: Date.now() + CACHE_TTL_MS });
-      return entries;
-    } catch {
-      return [];
-    }
+function createUnavailableEncryptionMapResolver() {
+  return async () => {
+    throw new Error("[internal] Encryption map lookup is unavailable; refusing to index potentially encrypted fields");
   };
 }
 function registerSearchModule(container, options) {
@@ -79,6 +64,7 @@ function registerSearchModule(container, options) {
           const db = em.getKysely();
           encryptionMapResolver = createEncryptionMapResolver(db);
         } catch {
+          encryptionMapResolver = createUnavailableEncryptionMapResolver();
         }
       }
       fulltextDriver = createFulltextDriver({
@@ -166,6 +152,7 @@ function addSearchStrategy(container, strategy) {
 }
 export {
   addSearchStrategy,
+  createEncryptionMapResolver2 as createEncryptionMapResolver,
   registerSearchModule
 };
 //# sourceMappingURL=di.js.map

package/dist/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/di.ts"],
-  "sourcesContent": ["import { asValue } from 'awilix'\nimport type { Kysely } from 'kysely'\nimport type { FullTextSearchDriver } from './fulltext/types'\nimport { SearchService } from './service'\nimport { TokenSearchStrategy } from './strategies/token.strategy'\nimport { VectorSearchStrategy, type EmbeddingService } from './strategies/vector.strategy'\nimport { FullTextSearchStrategy } from './strategies/fulltext.strategy'\nimport { createFulltextDriver } from './fulltext/drivers'\nimport { SearchIndexer } from './indexer/search-indexer'\nimport type {\n  SearchStrategy,\n  ResultMergeConfig,\n  SearchModuleConfig,\n  SearchFieldPolicy,\n  SearchEntityConfig,\n  PresenterEnricherFn,\n} from './types'\nimport type { VectorDriver } from './vector/types'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport type { EntityId } from '@open-mercato/shared/modules/entities'\nimport type { SearchStrategyId } from '@open-mercato/shared/modules/search'\nimport type { Queue } from '@open-mercato/queue'\nimport type { FulltextIndexJobPayload } from './queue/fulltext-indexing'\nimport type { VectorIndexJobPayload } from './queue/vector-indexing'\nimport type { EncryptionMapEntry } from './lib/field-policy'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { createPresenterEnricher } from './lib/presenter-enricher'\n\nconst FULLTEXT_DRIVER_KEY = '__omSearchFulltextDriver__'\n\ntype SearchModuleGlobals = {\n  [FULLTEXT_DRIVER_KEY]?: FullTextSearchDriver\n}\n\nfunction getSearchModuleGlobals(): SearchModuleGlobals {\n  return globalThis as unknown as SearchModuleGlobals\n}\n\n/**\n * Check if encrypted fields should be excluded from search indexing.\n * Controlled by SEARCH_EXCLUDE_ENCRYPTED_FIELDS environment variable.\n * Default: false (index all fields including decrypted data)\n */\nfunction shouldExcludeEncryptedFields(): boolean {\n  const raw = (process.env.SEARCH_EXCLUDE_ENCRYPTED_FIELDS ?? '').toLowerCase()\n  return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'on'\n}\n\n/**\n * Create an encryption map resolver that queries the database.\n * Falls back to empty array if query fails.\n */\nfunction createEncryptionMapResolver(\n  db: Kysely<any>,\n): (entityId: EntityId) => Promise<EncryptionMapEntry[]> {\n  // Cache encryption maps per entity to avoid repeated queries\n  const cache = new Map<string, { entries: EncryptionMapEntry[]; expiresAt: number }>()\n  const CACHE_TTL_MS = 5 * 60 * 1000 // 5 minutes\n\n  return async (entityId: EntityId): Promise<EncryptionMapEntry[]> => {\n    const cached = cache.get(entityId)\n    if (cached && cached.expiresAt > Date.now()) {\n      return cached.entries\n    }\n\n    try {\n      const row = await db\n        .selectFrom('encryption_maps' as any)\n        .select(['fields_json' as any])\n        .where('entity_id' as any, '=', entityId)\n        .where('is_active' as any, '=', true)\n        .where('deleted_at' as any, 'is', null)\n        .executeTakeFirst() as { fields_json?: unknown } | undefined\n\n      const fieldsJson = row?.fields_json\n      const entries: EncryptionMapEntry[] = Array.isArray(fieldsJson)\n        ? fieldsJson.map((f: { field: string; hashField?: string | null }) => ({\n            field: f.field,\n            hashField: f.hashField ?? null,\n          }))\n        : []\n\n      cache.set(entityId, { entries, expiresAt: Date.now() + CACHE_TTL_MS })\n      return entries\n    } catch {\n      // Query failed, return empty array (don't exclude any fields)\n      return []\n    }\n  }\n}\n\n/**\n * Container interface - minimal subset needed for registration.\n */\nexport interface SearchContainer {\n  resolve<T = unknown>(name: string): T\n  register(registrations: Record<string, unknown>): void\n}\n\n/**\n * Configuration options for search module registration.\n */\nexport type SearchModuleOptions = {\n  /** Override default strategies to use */\n  defaultStrategies?: SearchStrategyId[]\n  /** Override merge configuration */\n  mergeConfig?: ResultMergeConfig\n  /** Skip token strategy registration */\n  skipTokens?: boolean\n  /** Skip vector strategy registration */\n  skipVector?: boolean\n  /** Skip fulltext strategy registration */\n  skipFulltext?: boolean\n  /** Module configurations (from generated/search.generated.ts) */\n  moduleConfigs?: SearchModuleConfig[]\n}\n\n/**\n * Register the search module in the DI container.\n *\n * This creates and registers:\n * - SearchService instance\n * - All configured search strategies\n *\n * @param container - Awilix container\n * @param options - Optional configuration overrides\n */\nexport function registerSearchModule(\n  container: SearchContainer,\n  options?: SearchModuleOptions,\n): void {\n  const strategies: SearchStrategy[] = []\n\n  // Token strategy (always available unless explicitly skipped)\n  if (!options?.skipTokens) {\n    try {\n      const em = container.resolve<any>('em')\n      const db = em.getKysely() as Kysely<any>\n      strategies.push(new TokenSearchStrategy(db))\n    } catch {\n      // Kysely not available via em, skipping TokenSearchStrategy\n    }\n  }\n\n  // Vector strategy (requires embedding service and driver)\n  // Note: We register even if not currently available - availability is checked at search time\n  // via isAvailable(). The embedding config may be loaded later from the database.\n  if (!options?.skipVector) {\n    try {\n      const embeddingService = container.resolve<EmbeddingService>('vectorEmbeddingService')\n      const drivers = container.resolve<VectorDriver[]>('vectorDrivers')\n      const primaryDriver = drivers?.[0]\n\n      if (embeddingService && primaryDriver) {\n        strategies.push(new VectorSearchStrategy(embeddingService, primaryDriver))\n      }\n    } catch {\n      // Vector module not available, skipping VectorSearchStrategy\n    }\n  }\n\n  // Build entity config map for field policy resolution\n  const entityConfigMap = new Map<EntityId, SearchEntityConfig>()\n  for (const moduleConfig of (options?.moduleConfigs ?? [])) {\n    for (const entityConfig of moduleConfig.entities) {\n      if (entityConfig.enabled !== false) {\n        entityConfigMap.set(entityConfig.entityId as EntityId, entityConfig)\n      }\n    }\n  }\n\n  // Fulltext strategy (requires driver configuration, e.g., MEILISEARCH_HOST)\n  if (!options?.skipFulltext) {\n    const excludeEncrypted = shouldExcludeEncryptedFields()\n    const singletonCacheEnabled = process.env.SEARCH_DISABLE_SINGLETON_CACHE !== '1'\n    const g = getSearchModuleGlobals()\n\n    // The fulltext driver is safe to memoize only when SEARCH_EXCLUDE_ENCRYPTED_FIELDS is\n    // OFF \u2014 in that case the driver holds no request-scoped Kysely reference. When the flag\n    // is ON the encryptionMapResolver captures a per-request db handle and must stay\n    // per-request to avoid cross-request data leaks.\n    const canMemoize = singletonCacheEnabled && !excludeEncrypted\n\n    let fulltextDriver: FullTextSearchDriver | null = canMemoize\n      ? (g[FULLTEXT_DRIVER_KEY] ?? null)\n      : null\n\n    if (!fulltextDriver) {\n      let encryptionMapResolver: ((entityId: EntityId) => Promise<EncryptionMapEntry[]>) | undefined\n      if (excludeEncrypted) {\n        try {\n          const em = container.resolve<any>('em')\n          const db = em.getKysely() as Kysely<any>\n          encryptionMapResolver = createEncryptionMapResolver(db)\n        } catch {\n          // Kysely not available, encrypted field filtering disabled\n        }\n      }\n\n      fulltextDriver = createFulltextDriver({\n        fieldPolicyResolver: (entityId: EntityId): SearchFieldPolicy | undefined => {\n          const config = entityConfigMap.get(entityId)\n          return config?.fieldPolicy\n        },\n        encryptionMapResolver,\n      })\n\n      if (canMemoize && fulltextDriver) {\n        g[FULLTEXT_DRIVER_KEY] = fulltextDriver\n      }\n    }\n\n    if (fulltextDriver) {\n      strategies.push(new FullTextSearchStrategy(fulltextDriver))\n    }\n  }\n\n  // Determine default strategies based on what's available\n  const defaultStrategies = options?.defaultStrategies ?? determineDefaultStrategies(strategies)\n\n  // Try to resolve queryEngine for reindex support and presenter enrichment\n  let queryEngine: QueryEngine | undefined\n  try {\n    queryEngine = container.resolve<QueryEngine>('queryEngine')\n  } catch {\n    // QueryEngine not available, reindex will be disabled\n  }\n\n  // Resolve encryption service for decrypting presenter data\n  let encryptionService: TenantDataEncryptionService | null = null\n  try {\n    encryptionService = container.resolve<TenantDataEncryptionService>('tenantEncryptionService')\n  } catch {\n    // Encryption service not available, presenters won't be decrypted\n  }\n\n  // Create presenter enricher for database-based presenter resolution\n  let presenterEnricher: PresenterEnricherFn | undefined\n  try {\n    const em = container.resolve<any>('em')\n    const db = em.getKysely() as Kysely<any>\n    presenterEnricher = createPresenterEnricher(db, entityConfigMap, queryEngine, encryptionService)\n  } catch {\n    // Kysely not available, presenter enrichment disabled\n  }\n\n  // Create search service\n  const searchService = new SearchService({\n    strategies,\n    defaultStrategies,\n    fallbackStrategy: 'tokens',\n    mergeConfig: options?.mergeConfig ?? {\n      duplicateHandling: 'highest_score',\n      strategyWeights: {\n        fulltext: 1.2,\n        vector: 1.0,\n        tokens: 0.8,\n      },\n    },\n    presenterEnricher,\n  })\n\n  // Create search indexer with module configs\n  const moduleConfigs = options?.moduleConfigs ?? []\n\n  // Try to resolve fulltextIndexQueue for queue-based reindexing\n  let fulltextQueue: Queue<FulltextIndexJobPayload> | undefined\n  try {\n    fulltextQueue = container.resolve<Queue<FulltextIndexJobPayload>>('fulltextIndexQueue')\n  } catch {\n    // Queue not available, queue-based fulltext reindex will be disabled\n  }\n\n  // Try to resolve vectorIndexQueue for queue-based vector reindexing\n  let vectorQueue: Queue<VectorIndexJobPayload> | undefined\n  try {\n    vectorQueue = container.resolve<Queue<VectorIndexJobPayload>>('vectorIndexQueue')\n  } catch {\n    // Queue not available, queue-based vector reindex will be disabled\n  }\n\n  const searchIndexer = new SearchIndexer(searchService, moduleConfigs, {\n    queryEngine,\n    fulltextQueue,\n    vectorQueue,\n  })\n\n  // Register in container\n  container.register({\n    searchService: asValue(searchService),\n    searchStrategies: asValue(strategies),\n    searchIndexer: asValue(searchIndexer),\n  })\n}\n\n/**\n * Determine default strategy order based on available strategies.\n * Prefers fulltext > vector > tokens.\n */\nfunction determineDefaultStrategies(strategies: SearchStrategy[]): SearchStrategyId[] {\n  const available = new Set(strategies.map((s) => s.id))\n  const defaults: SearchStrategyId[] = []\n\n  if (available.has('fulltext')) defaults.push('fulltext')\n  if (available.has('vector')) defaults.push('vector')\n  if (available.has('tokens')) defaults.push('tokens')\n\n  return defaults.length > 0 ? defaults : ['tokens']\n}\n\n/**\n * Helper to add a custom strategy to an existing SearchService.\n *\n * @param container - DI container\n * @param strategy - Strategy to add\n */\nexport function addSearchStrategy(container: SearchContainer, strategy: SearchStrategy): void {\n  const service = container.resolve<SearchService>('searchService')\n  service.registerStrategy(strategy)\n\n  const strategies = container.resolve<SearchStrategy[]>('searchStrategies')\n  strategies.push(strategy)\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAGxB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,4BAAmD;AAC5D,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAkB9B,SAAS,+BAA+B;AAExC,MAAM,sBAAsB;AAM5B,SAAS,yBAA8C;AACrD,SAAO;AACT;AAOA,SAAS,+BAAwC;AAC/C,QAAM,OAAO,QAAQ,IAAI,mCAAmC,IAAI,YAAY;AAC5E,SAAO,QAAQ,OAAO,QAAQ,UAAU,QAAQ,SAAS,QAAQ;AACnE;AAMA,SAAS,4BACP,IACuD;AAEvD,QAAM,QAAQ,oBAAI,IAAkE;AACpF,QAAM,eAAe,IAAI,KAAK;AAE9B,SAAO,OAAO,aAAsD;AAClE,UAAM,SAAS,MAAM,IAAI,QAAQ;AACjC,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,aAAO,OAAO;AAAA,IAChB;AAEA,QAAI;AACF,YAAM,MAAM,MAAM,GACf,WAAW,iBAAwB,EACnC,OAAO,CAAC,aAAoB,CAAC,EAC7B,MAAM,aAAoB,KAAK,QAAQ,EACvC,MAAM,aAAoB,KAAK,IAAI,EACnC,MAAM,cAAqB,MAAM,IAAI,EACrC,iBAAiB;AAEpB,YAAM,aAAa,KAAK;AACxB,YAAM,UAAgC,MAAM,QAAQ,UAAU,IAC1D,WAAW,IAAI,CAAC,OAAqD;AAAA,QACnE,OAAO,EAAE;AAAA,QACT,WAAW,EAAE,aAAa;AAAA,MAC5B,EAAE,IACF,CAAC;AAEL,YAAM,IAAI,UAAU,EAAE,SAAS,WAAW,KAAK,IAAI,IAAI,aAAa,CAAC;AACrE,aAAO;AAAA,IACT,QAAQ;AAEN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACF;AAsCO,SAAS,qBACd,WACA,SACM;AACN,QAAM,aAA+B,CAAC;AAGtC,MAAI,CAAC,SAAS,YAAY;AACxB,QAAI;AACF,YAAM,KAAK,UAAU,QAAa,IAAI;AACtC,YAAM,KAAK,GAAG,UAAU;AACxB,iBAAW,KAAK,IAAI,oBAAoB,EAAE,CAAC;AAAA,IAC7C,QAAQ;AAAA,IAER;AAAA,EACF;AAKA,MAAI,CAAC,SAAS,YAAY;AACxB,QAAI;AACF,YAAM,mBAAmB,UAAU,QAA0B,wBAAwB;AACrF,YAAM,UAAU,UAAU,QAAwB,eAAe;AACjE,YAAM,gBAAgB,UAAU,CAAC;AAEjC,UAAI,oBAAoB,eAAe;AACrC,mBAAW,KAAK,IAAI,qBAAqB,kBAAkB,aAAa,CAAC;AAAA,MAC3E;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,aAAW,gBAAiB,SAAS,iBAAiB,CAAC,GAAI;AACzD,eAAW,gBAAgB,aAAa,UAAU;AAChD,UAAI,aAAa,YAAY,OAAO;AAClC,wBAAgB,IAAI,aAAa,UAAsB,YAAY;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,SAAS,cAAc;AAC1B,UAAM,mBAAmB,6BAA6B;AACtD,UAAM,wBAAwB,QAAQ,IAAI,mCAAmC;AAC7E,UAAM,IAAI,uBAAuB;AAMjC,UAAM,aAAa,yBAAyB,CAAC;AAE7C,QAAI,iBAA8C,aAC7C,EAAE,mBAAmB,KAAK,OAC3B;AAEJ,QAAI,CAAC,gBAAgB;AACnB,UAAI;AACJ,UAAI,kBAAkB;AACpB,YAAI;AACF,gBAAM,KAAK,UAAU,QAAa,IAAI;AACtC,gBAAM,KAAK,GAAG,UAAU;AACxB,kCAAwB,4BAA4B,EAAE;AAAA,QACxD,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,uBAAiB,qBAAqB;AAAA,QACpC,qBAAqB,CAAC,aAAsD;AAC1E,gBAAM,SAAS,gBAAgB,IAAI,QAAQ;AAC3C,iBAAO,QAAQ;AAAA,QACjB;AAAA,QACA;AAAA,MACF,CAAC;AAED,UAAI,cAAc,gBAAgB;AAChC,UAAE,mBAAmB,IAAI;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,gBAAgB;AAClB,iBAAW,KAAK,IAAI,uBAAuB,cAAc,CAAC;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,oBAAoB,SAAS,qBAAqB,2BAA2B,UAAU;AAG7F,MAAI;AACJ,MAAI;AACF,kBAAc,UAAU,QAAqB,aAAa;AAAA,EAC5D,QAAQ;AAAA,EAER;AAGA,MAAI,oBAAwD;AAC5D,MAAI;AACF,wBAAoB,UAAU,QAAqC,yBAAyB;AAAA,EAC9F,QAAQ;AAAA,EAER;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,UAAU,QAAa,IAAI;AACtC,UAAM,KAAK,GAAG,UAAU;AACxB,wBAAoB,wBAAwB,IAAI,iBAAiB,aAAa,iBAAiB;AAAA,EACjG,QAAQ;AAAA,EAER;AAGA,QAAM,gBAAgB,IAAI,cAAc;AAAA,IACtC;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB,aAAa,SAAS,eAAe;AAAA,MACnC,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,QACf,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA;AAAA,EACF,CAAC;AAGD,QAAM,gBAAgB,SAAS,iBAAiB,CAAC;AAGjD,MAAI;AACJ,MAAI;AACF,oBAAgB,UAAU,QAAwC,oBAAoB;AAAA,EACxF,QAAQ;AAAA,EAER;AAGA,MAAI;AACJ,MAAI;AACF,kBAAc,UAAU,QAAsC,kBAAkB;AAAA,EAClF,QAAQ;AAAA,EAER;AAEA,QAAM,gBAAgB,IAAI,cAAc,eAAe,eAAe;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,YAAU,SAAS;AAAA,IACjB,eAAe,QAAQ,aAAa;AAAA,IACpC,kBAAkB,QAAQ,UAAU;AAAA,IACpC,eAAe,QAAQ,aAAa;AAAA,EACtC,CAAC;AACH;AAMA,SAAS,2BAA2B,YAAkD;AACpF,QAAM,YAAY,IAAI,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACrD,QAAM,WAA+B,CAAC;AAEtC,MAAI,UAAU,IAAI,UAAU,EAAG,UAAS,KAAK,UAAU;AACvD,MAAI,UAAU,IAAI,QAAQ,EAAG,UAAS,KAAK,QAAQ;AACnD,MAAI,UAAU,IAAI,QAAQ,EAAG,UAAS,KAAK,QAAQ;AAEnD,SAAO,SAAS,SAAS,IAAI,WAAW,CAAC,QAAQ;AACnD;AAQO,SAAS,kBAAkB,WAA4B,UAAgC;AAC5F,QAAM,UAAU,UAAU,QAAuB,eAAe;AAChE,UAAQ,iBAAiB,QAAQ;AAEjC,QAAM,aAAa,UAAU,QAA0B,kBAAkB;AACzE,aAAW,KAAK,QAAQ;AAC1B;",
-  "names": []
+  "sourcesContent": ["import { asValue } from 'awilix'\nimport type { Kysely } from 'kysely'\nimport type { FullTextSearchDriver } from './fulltext/types'\nimport { SearchService } from './service'\nimport { TokenSearchStrategy } from './strategies/token.strategy'\nimport { VectorSearchStrategy, type EmbeddingService } from './strategies/vector.strategy'\nimport { FullTextSearchStrategy } from './strategies/fulltext.strategy'\nimport { createFulltextDriver } from './fulltext/drivers'\nimport { SearchIndexer } from './indexer/search-indexer'\nimport type {\n  SearchStrategy,\n  ResultMergeConfig,\n  SearchModuleConfig,\n  SearchFieldPolicy,\n  SearchEntityConfig,\n  PresenterEnricherFn,\n} from './types'\nimport type { VectorDriver } from './vector/types'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport type { EntityId } from '@open-mercato/shared/modules/entities'\nimport type { SearchStrategyId } from '@open-mercato/shared/modules/search'\nimport type { Queue } from '@open-mercato/queue'\nimport type { FulltextIndexJobPayload } from './queue/fulltext-indexing'\nimport type { VectorIndexJobPayload } from './queue/vector-indexing'\nimport type { EncryptionMapEntry } from './lib/field-policy'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { createPresenterEnricher } from './lib/presenter-enricher'\nimport { createEncryptionMapResolver } from './lib/encryption-map-resolver'\n\nexport { createEncryptionMapResolver } from './lib/encryption-map-resolver'\n\nconst FULLTEXT_DRIVER_KEY = '__omSearchFulltextDriver__'\n\ntype SearchModuleGlobals = {\n  [FULLTEXT_DRIVER_KEY]?: FullTextSearchDriver\n}\n\nfunction getSearchModuleGlobals(): SearchModuleGlobals {\n  return globalThis as unknown as SearchModuleGlobals\n}\n\n/**\n * Check if encrypted fields should be excluded from search indexing.\n * Controlled by SEARCH_EXCLUDE_ENCRYPTED_FIELDS environment variable.\n * Default: false (index all fields including decrypted data)\n */\nfunction shouldExcludeEncryptedFields(): boolean {\n  const raw = (process.env.SEARCH_EXCLUDE_ENCRYPTED_FIELDS ?? '').toLowerCase()\n  return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'on'\n}\n\nfunction createUnavailableEncryptionMapResolver(): (entityId: EntityId) => Promise<EncryptionMapEntry[]> {\n  return async () => {\n    throw new Error('[internal] Encryption map lookup is unavailable; refusing to index potentially encrypted fields')\n  }\n}\n\n/**\n * Container interface - minimal subset needed for registration.\n */\nexport interface SearchContainer {\n  resolve<T = unknown>(name: string): T\n  register(registrations: Record<string, unknown>): void\n}\n\n/**\n * Configuration options for search module registration.\n */\nexport type SearchModuleOptions = {\n  /** Override default strategies to use */\n  defaultStrategies?: SearchStrategyId[]\n  /** Override merge configuration */\n  mergeConfig?: ResultMergeConfig\n  /** Skip token strategy registration */\n  skipTokens?: boolean\n  /** Skip vector strategy registration */\n  skipVector?: boolean\n  /** Skip fulltext strategy registration */\n  skipFulltext?: boolean\n  /** Module configurations (from generated/search.generated.ts) */\n  moduleConfigs?: SearchModuleConfig[]\n}\n\n/**\n * Register the search module in the DI container.\n *\n * This creates and registers:\n * - SearchService instance\n * - All configured search strategies\n *\n * @param container - Awilix container\n * @param options - Optional configuration overrides\n */\nexport function registerSearchModule(\n  container: SearchContainer,\n  options?: SearchModuleOptions,\n): void {\n  const strategies: SearchStrategy[] = []\n\n  // Token strategy (always available unless explicitly skipped)\n  if (!options?.skipTokens) {\n    try {\n      const em = container.resolve<any>('em')\n      const db = em.getKysely() as Kysely<any>\n      strategies.push(new TokenSearchStrategy(db))\n    } catch {\n      // Kysely not available via em, skipping TokenSearchStrategy\n    }\n  }\n\n  // Vector strategy (requires embedding service and driver)\n  // Note: We register even if not currently available - availability is checked at search time\n  // via isAvailable(). The embedding config may be loaded later from the database.\n  if (!options?.skipVector) {\n    try {\n      const embeddingService = container.resolve<EmbeddingService>('vectorEmbeddingService')\n      const drivers = container.resolve<VectorDriver[]>('vectorDrivers')\n      const primaryDriver = drivers?.[0]\n\n      if (embeddingService && primaryDriver) {\n        strategies.push(new VectorSearchStrategy(embeddingService, primaryDriver))\n      }\n    } catch {\n      // Vector module not available, skipping VectorSearchStrategy\n    }\n  }\n\n  // Build entity config map for field policy resolution\n  const entityConfigMap = new Map<EntityId, SearchEntityConfig>()\n  for (const moduleConfig of (options?.moduleConfigs ?? [])) {\n    for (const entityConfig of moduleConfig.entities) {\n      if (entityConfig.enabled !== false) {\n        entityConfigMap.set(entityConfig.entityId as EntityId, entityConfig)\n      }\n    }\n  }\n\n  // Fulltext strategy (requires driver configuration, e.g., MEILISEARCH_HOST)\n  if (!options?.skipFulltext) {\n    const excludeEncrypted = shouldExcludeEncryptedFields()\n    const singletonCacheEnabled = process.env.SEARCH_DISABLE_SINGLETON_CACHE !== '1'\n    const g = getSearchModuleGlobals()\n\n    // The fulltext driver is safe to memoize only when SEARCH_EXCLUDE_ENCRYPTED_FIELDS is\n    // OFF \u2014 in that case the driver holds no request-scoped Kysely reference. When the flag\n    // is ON the encryptionMapResolver captures a per-request db handle and must stay\n    // per-request to avoid cross-request data leaks.\n    const canMemoize = singletonCacheEnabled && !excludeEncrypted\n\n    let fulltextDriver: FullTextSearchDriver | null = canMemoize\n      ? (g[FULLTEXT_DRIVER_KEY] ?? null)\n      : null\n\n    if (!fulltextDriver) {\n      let encryptionMapResolver: ((entityId: EntityId) => Promise<EncryptionMapEntry[]>) | undefined\n      if (excludeEncrypted) {\n        try {\n          const em = container.resolve<any>('em')\n          const db = em.getKysely() as Kysely<any>\n          encryptionMapResolver = createEncryptionMapResolver(db)\n        } catch {\n          encryptionMapResolver = createUnavailableEncryptionMapResolver()\n        }\n      }\n\n      fulltextDriver = createFulltextDriver({\n        fieldPolicyResolver: (entityId: EntityId): SearchFieldPolicy | undefined => {\n          const config = entityConfigMap.get(entityId)\n          return config?.fieldPolicy\n        },\n        encryptionMapResolver,\n      })\n\n      if (canMemoize && fulltextDriver) {\n        g[FULLTEXT_DRIVER_KEY] = fulltextDriver\n      }\n    }\n\n    if (fulltextDriver) {\n      strategies.push(new FullTextSearchStrategy(fulltextDriver))\n    }\n  }\n\n  // Determine default strategies based on what's available\n  const defaultStrategies = options?.defaultStrategies ?? determineDefaultStrategies(strategies)\n\n  // Try to resolve queryEngine for reindex support and presenter enrichment\n  let queryEngine: QueryEngine | undefined\n  try {\n    queryEngine = container.resolve<QueryEngine>('queryEngine')\n  } catch {\n    // QueryEngine not available, reindex will be disabled\n  }\n\n  // Resolve encryption service for decrypting presenter data\n  let encryptionService: TenantDataEncryptionService | null = null\n  try {\n    encryptionService = container.resolve<TenantDataEncryptionService>('tenantEncryptionService')\n  } catch {\n    // Encryption service not available, presenters won't be decrypted\n  }\n\n  // Create presenter enricher for database-based presenter resolution\n  let presenterEnricher: PresenterEnricherFn | undefined\n  try {\n    const em = container.resolve<any>('em')\n    const db = em.getKysely() as Kysely<any>\n    presenterEnricher = createPresenterEnricher(db, entityConfigMap, queryEngine, encryptionService)\n  } catch {\n    // Kysely not available, presenter enrichment disabled\n  }\n\n  // Create search service\n  const searchService = new SearchService({\n    strategies,\n    defaultStrategies,\n    fallbackStrategy: 'tokens',\n    mergeConfig: options?.mergeConfig ?? {\n      duplicateHandling: 'highest_score',\n      strategyWeights: {\n        fulltext: 1.2,\n        vector: 1.0,\n        tokens: 0.8,\n      },\n    },\n    presenterEnricher,\n  })\n\n  // Create search indexer with module configs\n  const moduleConfigs = options?.moduleConfigs ?? []\n\n  // Try to resolve fulltextIndexQueue for queue-based reindexing\n  let fulltextQueue: Queue<FulltextIndexJobPayload> | undefined\n  try {\n    fulltextQueue = container.resolve<Queue<FulltextIndexJobPayload>>('fulltextIndexQueue')\n  } catch {\n    // Queue not available, queue-based fulltext reindex will be disabled\n  }\n\n  // Try to resolve vectorIndexQueue for queue-based vector reindexing\n  let vectorQueue: Queue<VectorIndexJobPayload> | undefined\n  try {\n    vectorQueue = container.resolve<Queue<VectorIndexJobPayload>>('vectorIndexQueue')\n  } catch {\n    // Queue not available, queue-based vector reindex will be disabled\n  }\n\n  const searchIndexer = new SearchIndexer(searchService, moduleConfigs, {\n    queryEngine,\n    fulltextQueue,\n    vectorQueue,\n  })\n\n  // Register in container\n  container.register({\n    searchService: asValue(searchService),\n    searchStrategies: asValue(strategies),\n    searchIndexer: asValue(searchIndexer),\n  })\n}\n\n/**\n * Determine default strategy order based on available strategies.\n * Prefers fulltext > vector > tokens.\n */\nfunction determineDefaultStrategies(strategies: SearchStrategy[]): SearchStrategyId[] {\n  const available = new Set(strategies.map((s) => s.id))\n  const defaults: SearchStrategyId[] = []\n\n  if (available.has('fulltext')) defaults.push('fulltext')\n  if (available.has('vector')) defaults.push('vector')\n  if (available.has('tokens')) defaults.push('tokens')\n\n  return defaults.length > 0 ? defaults : ['tokens']\n}\n\n/**\n * Helper to add a custom strategy to an existing SearchService.\n *\n * @param container - DI container\n * @param strategy - Strategy to add\n */\nexport function addSearchStrategy(container: SearchContainer, strategy: SearchStrategy): void {\n  const service = container.resolve<SearchService>('searchService')\n  service.registerStrategy(strategy)\n\n  const strategies = container.resolve<SearchStrategy[]>('searchStrategies')\n  strategies.push(strategy)\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAGxB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,4BAAmD;AAC5D,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAkB9B,SAAS,+BAA+B;AACxC,SAAS,mCAAmC;AAE5C,SAAS,+BAAAA,oCAAmC;AAE5C,MAAM,sBAAsB;AAM5B,SAAS,yBAA8C;AACrD,SAAO;AACT;AAOA,SAAS,+BAAwC;AAC/C,QAAM,OAAO,QAAQ,IAAI,mCAAmC,IAAI,YAAY;AAC5E,SAAO,QAAQ,OAAO,QAAQ,UAAU,QAAQ,SAAS,QAAQ;AACnE;AAEA,SAAS,yCAAgG;AACvG,SAAO,YAAY;AACjB,UAAM,IAAI,MAAM,iGAAiG;AAAA,EACnH;AACF;AAsCO,SAAS,qBACd,WACA,SACM;AACN,QAAM,aAA+B,CAAC;AAGtC,MAAI,CAAC,SAAS,YAAY;AACxB,QAAI;AACF,YAAM,KAAK,UAAU,QAAa,IAAI;AACtC,YAAM,KAAK,GAAG,UAAU;AACxB,iBAAW,KAAK,IAAI,oBAAoB,EAAE,CAAC;AAAA,IAC7C,QAAQ;AAAA,IAER;AAAA,EACF;AAKA,MAAI,CAAC,SAAS,YAAY;AACxB,QAAI;AACF,YAAM,mBAAmB,UAAU,QAA0B,wBAAwB;AACrF,YAAM,UAAU,UAAU,QAAwB,eAAe;AACjE,YAAM,gBAAgB,UAAU,CAAC;AAEjC,UAAI,oBAAoB,eAAe;AACrC,mBAAW,KAAK,IAAI,qBAAqB,kBAAkB,aAAa,CAAC;AAAA,MAC3E;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,aAAW,gBAAiB,SAAS,iBAAiB,CAAC,GAAI;AACzD,eAAW,gBAAgB,aAAa,UAAU;AAChD,UAAI,aAAa,YAAY,OAAO;AAClC,wBAAgB,IAAI,aAAa,UAAsB,YAAY;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,SAAS,cAAc;AAC1B,UAAM,mBAAmB,6BAA6B;AACtD,UAAM,wBAAwB,QAAQ,IAAI,mCAAmC;AAC7E,UAAM,IAAI,uBAAuB;AAMjC,UAAM,aAAa,yBAAyB,CAAC;AAE7C,QAAI,iBAA8C,aAC7C,EAAE,mBAAmB,KAAK,OAC3B;AAEJ,QAAI,CAAC,gBAAgB;AACnB,UAAI;AACJ,UAAI,kBAAkB;AACpB,YAAI;AACF,gBAAM,KAAK,UAAU,QAAa,IAAI;AACtC,gBAAM,KAAK,GAAG,UAAU;AACxB,kCAAwB,4BAA4B,EAAE;AAAA,QACxD,QAAQ;AACN,kCAAwB,uCAAuC;AAAA,QACjE;AAAA,MACF;AAEA,uBAAiB,qBAAqB;AAAA,QACpC,qBAAqB,CAAC,aAAsD;AAC1E,gBAAM,SAAS,gBAAgB,IAAI,QAAQ;AAC3C,iBAAO,QAAQ;AAAA,QACjB;AAAA,QACA;AAAA,MACF,CAAC;AAED,UAAI,cAAc,gBAAgB;AAChC,UAAE,mBAAmB,IAAI;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,gBAAgB;AAClB,iBAAW,KAAK,IAAI,uBAAuB,cAAc,CAAC;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,oBAAoB,SAAS,qBAAqB,2BAA2B,UAAU;AAG7F,MAAI;AACJ,MAAI;AACF,kBAAc,UAAU,QAAqB,aAAa;AAAA,EAC5D,QAAQ;AAAA,EAER;AAGA,MAAI,oBAAwD;AAC5D,MAAI;AACF,wBAAoB,UAAU,QAAqC,yBAAyB;AAAA,EAC9F,QAAQ;AAAA,EAER;AAGA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,UAAU,QAAa,IAAI;AACtC,UAAM,KAAK,GAAG,UAAU;AACxB,wBAAoB,wBAAwB,IAAI,iBAAiB,aAAa,iBAAiB;AAAA,EACjG,QAAQ;AAAA,EAER;AAGA,QAAM,gBAAgB,IAAI,cAAc;AAAA,IACtC;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB,aAAa,SAAS,eAAe;AAAA,MACnC,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,QACf,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA;AAAA,EACF,CAAC;AAGD,QAAM,gBAAgB,SAAS,iBAAiB,CAAC;AAGjD,MAAI;AACJ,MAAI;AACF,oBAAgB,UAAU,QAAwC,oBAAoB;AAAA,EACxF,QAAQ;AAAA,EAER;AAGA,MAAI;AACJ,MAAI;AACF,kBAAc,UAAU,QAAsC,kBAAkB;AAAA,EAClF,QAAQ;AAAA,EAER;AAEA,QAAM,gBAAgB,IAAI,cAAc,eAAe,eAAe;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,YAAU,SAAS;AAAA,IACjB,eAAe,QAAQ,aAAa;AAAA,IACpC,kBAAkB,QAAQ,UAAU;AAAA,IACpC,eAAe,QAAQ,aAAa;AAAA,EACtC,CAAC;AACH;AAMA,SAAS,2BAA2B,YAAkD;AACpF,QAAM,YAAY,IAAI,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACrD,QAAM,WAA+B,CAAC;AAEtC,MAAI,UAAU,IAAI,UAAU,EAAG,UAAS,KAAK,UAAU;AACvD,MAAI,UAAU,IAAI,QAAQ,EAAG,UAAS,KAAK,QAAQ;AACnD,MAAI,UAAU,IAAI,QAAQ,EAAG,UAAS,KAAK,QAAQ;AAEnD,SAAO,SAAS,SAAS,IAAI,WAAW,CAAC,QAAQ;AACnD;AAQO,SAAS,kBAAkB,WAA4B,UAAgC;AAC5F,QAAM,UAAU,UAAU,QAAuB,eAAe;AAChE,UAAQ,iBAAiB,QAAQ;AAEjC,QAAM,aAAa,UAAU,QAA0B,kBAAkB;AACzE,aAAW,KAAK,QAAQ;AAC1B;",
+  "names": ["createEncryptionMapResolver"]
 }

package/dist/lib/encryption-map-resolver.js

@@ -0,0 +1,64 @@
+function compareNullableScope(left, right) {
+  if (left == null && right == null) return 0;
+  if (left == null) return -1;
+  if (right == null) return 1;
+  return String(left).localeCompare(String(right));
+}
+function compareCreatedAt(left, right) {
+  const leftTime = left instanceof Date ? left.getTime() : Date.parse(String(left ?? ""));
+  const rightTime = right instanceof Date ? right.getTime() : Date.parse(String(right ?? ""));
+  if (Number.isFinite(leftTime) && Number.isFinite(rightTime)) return leftTime - rightTime;
+  return String(left ?? "").localeCompare(String(right ?? ""));
+}
+function compareEncryptionMapRows(left, right) {
+  return compareNullableScope(left.tenant_id, right.tenant_id) || compareNullableScope(left.organization_id, right.organization_id) || compareCreatedAt(left.created_at, right.created_at) || String(left.id ?? "").localeCompare(String(right.id ?? ""));
+}
+function parseEncryptionMapFields(value) {
+  if (Array.isArray(value)) return value;
+  if (typeof value !== "string") return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+function mergeEncryptionMapEntries(rows) {
+  const merged = [];
+  const byField = /* @__PURE__ */ new Map();
+  for (const row of [...rows].sort(compareEncryptionMapRows)) {
+    for (const candidate of parseEncryptionMapFields(row.fields_json)) {
+      if (!candidate || typeof candidate !== "object") continue;
+      const rule = candidate;
+      const field = typeof rule.field === "string" ? rule.field.trim() : "";
+      if (!field) continue;
+      const hashField = typeof rule.hashField === "string" && rule.hashField.length > 0 ? rule.hashField : null;
+      const existing = byField.get(field);
+      if (!existing) {
+        const entry = { field, hashField };
+        byField.set(field, entry);
+        merged.push(entry);
+      } else if (!existing.hashField && hashField) {
+        existing.hashField = hashField;
+      }
+    }
+  }
+  return merged;
+}
+function createEncryptionMapResolver(db, legacyPolicyVersionCache) {
+  void legacyPolicyVersionCache;
+  return async (entityId) => {
+    const rows = await db.selectFrom("encryption_maps").select([
+      "id",
+      "tenant_id",
+      "organization_id",
+      "fields_json",
+      "created_at"
+    ]).where("entity_id", "=", entityId).where("is_active", "=", true).where("deleted_at", "is", null).orderBy("tenant_id", "asc").orderBy("organization_id", "asc").orderBy("created_at", "asc").orderBy("id", "asc").execute();
+    return mergeEncryptionMapEntries(Array.isArray(rows) ? rows : []);
+  };
+}
+export {
+  createEncryptionMapResolver
+};
+//# sourceMappingURL=encryption-map-resolver.js.map

package/dist/lib/encryption-map-resolver.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/lib/encryption-map-resolver.ts"],
+  "sourcesContent": ["import type { Kysely } from 'kysely'\nimport type { EntityId } from '@open-mercato/shared/modules/entities'\nimport type { EncryptionMapEntry } from './field-policy'\n\ntype EncryptionMapRow = {\n  id?: unknown\n  tenant_id?: unknown\n  organization_id?: unknown\n  fields_json?: unknown\n  created_at?: unknown\n}\n\ntype LegacyEncryptionMapPolicyVersionCache = {\n  get(key: string): Promise<unknown | null>\n}\n\nfunction compareNullableScope(left: unknown, right: unknown): number {\n  if (left == null && right == null) return 0\n  if (left == null) return -1\n  if (right == null) return 1\n  return String(left).localeCompare(String(right))\n}\n\nfunction compareCreatedAt(left: unknown, right: unknown): number {\n  const leftTime = left instanceof Date ? left.getTime() : Date.parse(String(left ?? ''))\n  const rightTime = right instanceof Date ? right.getTime() : Date.parse(String(right ?? ''))\n  if (Number.isFinite(leftTime) && Number.isFinite(rightTime)) return leftTime - rightTime\n  return String(left ?? '').localeCompare(String(right ?? ''))\n}\n\nfunction compareEncryptionMapRows(left: EncryptionMapRow, right: EncryptionMapRow): number {\n  return compareNullableScope(left.tenant_id, right.tenant_id)\n    || compareNullableScope(left.organization_id, right.organization_id)\n    || compareCreatedAt(left.created_at, right.created_at)\n    || String(left.id ?? '').localeCompare(String(right.id ?? ''))\n}\n\nfunction parseEncryptionMapFields(value: unknown): unknown[] {\n  if (Array.isArray(value)) return value\n  if (typeof value !== 'string') return []\n  try {\n    const parsed = JSON.parse(value) as unknown\n    return Array.isArray(parsed) ? parsed : []\n  } catch {\n    return []\n  }\n}\n\nfunction mergeEncryptionMapEntries(rows: readonly EncryptionMapRow[]): EncryptionMapEntry[] {\n  const merged: EncryptionMapEntry[] = []\n  const byField = new Map<string, EncryptionMapEntry>()\n  for (const row of [...rows].sort(compareEncryptionMapRows)) {\n    for (const candidate of parseEncryptionMapFields(row.fields_json)) {\n      if (!candidate || typeof candidate !== 'object') continue\n      const rule = candidate as { field?: unknown; hashField?: unknown }\n      const field = typeof rule.field === 'string' ? rule.field.trim() : ''\n      if (!field) continue\n      const hashField = typeof rule.hashField === 'string' && rule.hashField.length > 0\n        ? rule.hashField\n        : null\n      const existing = byField.get(field)\n      if (!existing) {\n        const entry = { field, hashField }\n        byField.set(field, entry)\n        merged.push(entry)\n      } else if (!existing.hashField && hashField) {\n        existing.hashField = hashField\n      }\n    }\n  }\n  return merged\n}\n\n/**\n * Resolve every active live declaration for an entity. Search indexing has no\n * tenant/scope argument at this boundary, so the safe policy is the union of\n * all scopes: over-excluding a field is preferable to publishing plaintext.\n *\n * The legacy version-cache argument remains optional for call-site compatibility but is\n * intentionally ignored. A version publication can fail after the database commit, so neither\n * that channel nor process-local positive memory can authorize reuse of an older policy.\n */\nexport function createEncryptionMapResolver(\n  db: Kysely<any>,\n  legacyPolicyVersionCache?: LegacyEncryptionMapPolicyVersionCache,\n): (entityId: EntityId) => Promise<EncryptionMapEntry[]> {\n  void legacyPolicyVersionCache\n\n  return async (entityId: EntityId): Promise<EncryptionMapEntry[]> => {\n    const rows = await db\n      .selectFrom('encryption_maps' as any)\n      .select([\n        'id' as any,\n        'tenant_id' as any,\n        'organization_id' as any,\n        'fields_json' as any,\n        'created_at' as any,\n      ])\n      .where('entity_id' as any, '=', entityId)\n      .where('is_active' as any, '=', true)\n      .where('deleted_at' as any, 'is', null)\n      .orderBy('tenant_id' as any, 'asc')\n      .orderBy('organization_id' as any, 'asc')\n      .orderBy('created_at' as any, 'asc')\n      .orderBy('id' as any, 'asc')\n      .execute() as EncryptionMapRow[]\n\n    return mergeEncryptionMapEntries(Array.isArray(rows) ? rows : [])\n  }\n}\n"],
+  "mappings": "AAgBA,SAAS,qBAAqB,MAAe,OAAwB;AACnE,MAAI,QAAQ,QAAQ,SAAS,KAAM,QAAO;AAC1C,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI,SAAS,KAAM,QAAO;AAC1B,SAAO,OAAO,IAAI,EAAE,cAAc,OAAO,KAAK,CAAC;AACjD;AAEA,SAAS,iBAAiB,MAAe,OAAwB;AAC/D,QAAM,WAAW,gBAAgB,OAAO,KAAK,QAAQ,IAAI,KAAK,MAAM,OAAO,QAAQ,EAAE,CAAC;AACtF,QAAM,YAAY,iBAAiB,OAAO,MAAM,QAAQ,IAAI,KAAK,MAAM,OAAO,SAAS,EAAE,CAAC;AAC1F,MAAI,OAAO,SAAS,QAAQ,KAAK,OAAO,SAAS,SAAS,EAAG,QAAO,WAAW;AAC/E,SAAO,OAAO,QAAQ,EAAE,EAAE,cAAc,OAAO,SAAS,EAAE,CAAC;AAC7D;AAEA,SAAS,yBAAyB,MAAwB,OAAiC;AACzF,SAAO,qBAAqB,KAAK,WAAW,MAAM,SAAS,KACtD,qBAAqB,KAAK,iBAAiB,MAAM,eAAe,KAChE,iBAAiB,KAAK,YAAY,MAAM,UAAU,KAClD,OAAO,KAAK,MAAM,EAAE,EAAE,cAAc,OAAO,MAAM,MAAM,EAAE,CAAC;AACjE;AAEA,SAAS,yBAAyB,OAA2B;AAC3D,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,WAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC;AAAA,EAC3C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,0BAA0B,MAAyD;AAC1F,QAAM,SAA+B,CAAC;AACtC,QAAM,UAAU,oBAAI,IAAgC;AACpD,aAAW,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,wBAAwB,GAAG;AAC1D,eAAW,aAAa,yBAAyB,IAAI,WAAW,GAAG;AACjE,UAAI,CAAC,aAAa,OAAO,cAAc,SAAU;AACjD,YAAM,OAAO;AACb,YAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACnE,UAAI,CAAC,MAAO;AACZ,YAAM,YAAY,OAAO,KAAK,cAAc,YAAY,KAAK,UAAU,SAAS,IAC5E,KAAK,YACL;AACJ,YAAM,WAAW,QAAQ,IAAI,KAAK;AAClC,UAAI,CAAC,UAAU;AACb,cAAM,QAAQ,EAAE,OAAO,UAAU;AACjC,gBAAQ,IAAI,OAAO,KAAK;AACxB,eAAO,KAAK,KAAK;AAAA,MACnB,WAAW,CAAC,SAAS,aAAa,WAAW;AAC3C,iBAAS,YAAY;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAWO,SAAS,4BACd,IACA,0BACuD;AACvD,OAAK;AAEL,SAAO,OAAO,aAAsD;AAClE,UAAM,OAAO,MAAM,GAChB,WAAW,iBAAwB,EACnC,OAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EACA,MAAM,aAAoB,KAAK,QAAQ,EACvC,MAAM,aAAoB,KAAK,IAAI,EACnC,MAAM,cAAqB,MAAM,IAAI,EACrC,QAAQ,aAAoB,KAAK,EACjC,QAAQ,mBAA0B,KAAK,EACvC,QAAQ,cAAqB,KAAK,EAClC,QAAQ,MAAa,KAAK,EAC1B,QAAQ;AAEX,WAAO,0BAA0B,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,EAClE;AACF;",
+  "names": []
+}

package/dist/modules/search/subscribers/fulltext_upsert.js

@@ -18,7 +18,8 @@ async function handle(payload, ctx) {
   }
   if ((organizationId == null || tenantId == null) && em) {
     try {
-      const db = em.getKysely();
+      const lookupEm = typeof em.fork === "function" ? em.fork() : em;
+      const db = lookupEm.getKysely();
       const table = resolveEntityTableName(em, entityType);
       const row = await db.selectFrom(table).select(["organization_id", "tenant_id"]).where("id", "=", recordId).executeTakeFirst();
       if (organizationId == null) organizationId = row?.organization_id ?? organizationId;

package/dist/modules/search/subscribers/fulltext_upsert.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/search/subscribers/fulltext_upsert.ts"],
-  "sourcesContent": ["import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport type { Queue } from '@open-mercato/queue'\nimport type { FulltextIndexJobPayload } from '../../../queue/fulltext-indexing'\nimport { resolveAutoIndexingEnabled } from '../lib/auto-indexing'\nimport { searchDebugWarn, searchError } from '../../../lib/debug'\n\nexport const metadata = { event: 'search.index_record', persistent: false }\n\ntype Payload = {\n  entityId?: string\n  recordId?: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\n\nexport default async function handle(payload: Payload, ctx: HandlerContext) {\n  const entityType = String(payload?.entityId ?? '')\n  const recordId = String(payload?.recordId ?? '')\n\n  if (!entityType || !recordId) {\n    return\n  }\n\n  let organizationId = payload?.organizationId ?? null\n  let tenantId = payload?.tenantId ?? null\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let em: any | null = null\n  try {\n    em = ctx.resolve('em')\n  } catch {\n    em = null\n  }\n\n  // Resolve missing scope from DB if needed (same pattern as vector_upsert.ts)\n  if ((organizationId == null || tenantId == null) && em) {\n    try {\n      const db = em.getKysely()\n      const table = resolveEntityTableName(em, entityType)\n      const row = await db\n        .selectFrom(table as any)\n        .select(['organization_id' as any, 'tenant_id' as any])\n        .where('id' as any, '=', recordId)\n        .executeTakeFirst() as { organization_id?: string | null; tenant_id?: string | null } | undefined\n      if (organizationId == null) organizationId = row?.organization_id ?? organizationId\n      if (tenantId == null) tenantId = row?.tenant_id ?? tenantId\n    } catch {\n      // Ignore lookup errors\n    }\n  }\n\n  if (!tenantId) {\n    return\n  }\n\n  const autoIndexingEnabled = await resolveAutoIndexingEnabled(ctx, { defaultValue: true })\n  if (!autoIndexingEnabled) {\n    return\n  }\n\n  let queue: Queue<FulltextIndexJobPayload>\n  try {\n    queue = ctx.resolve<Queue<FulltextIndexJobPayload>>('fulltextIndexQueue')\n  } catch {\n    searchDebugWarn('search.fulltext', 'fulltextIndexQueue not available, skipping fulltext indexing')\n    return\n  }\n\n  try {\n    await queue.enqueue({\n      jobType: 'index',\n      entityType,\n      recordId,\n      tenantId: String(tenantId),\n      organizationId: organizationId ? String(organizationId) : null,\n    })\n  } catch (error) {\n    searchError('search.fulltext', 'Failed to enqueue fulltext index job', {\n      entityType,\n      recordId,\n      error: error instanceof Error ? error.message : error,\n    })\n    throw error\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,8BAA8B;AAGvC,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB,mBAAmB;AAEtC,MAAM,WAAW,EAAE,OAAO,uBAAuB,YAAY,MAAM;AAW1E,eAAO,OAA8B,SAAkB,KAAqB;AAC1E,QAAM,aAAa,OAAO,SAAS,YAAY,EAAE;AACjD,QAAM,WAAW,OAAO,SAAS,YAAY,EAAE;AAE/C,MAAI,CAAC,cAAc,CAAC,UAAU;AAC5B;AAAA,EACF;AAEA,MAAI,iBAAiB,SAAS,kBAAkB;AAChD,MAAI,WAAW,SAAS,YAAY;AAGpC,MAAI,KAAiB;AACrB,MAAI;AACF,SAAK,IAAI,QAAQ,IAAI;AAAA,EACvB,QAAQ;AACN,SAAK;AAAA,EACP;AAGA,OAAK,kBAAkB,QAAQ,YAAY,SAAS,IAAI;AACtD,QAAI;AACF,YAAM,KAAK,GAAG,UAAU;AACxB,YAAM,QAAQ,uBAAuB,IAAI,UAAU;AACnD,YAAM,MAAM,MAAM,GACf,WAAW,KAAY,EACvB,OAAO,CAAC,mBAA0B,WAAkB,CAAC,EACrD,MAAM,MAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAI,kBAAkB,KAAM,kBAAiB,KAAK,mBAAmB;AACrE,UAAI,YAAY,KAAM,YAAW,KAAK,aAAa;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AAEA,QAAM,sBAAsB,MAAM,2BAA2B,KAAK,EAAE,cAAc,KAAK,CAAC;AACxF,MAAI,CAAC,qBAAqB;AACxB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,YAAQ,IAAI,QAAwC,oBAAoB;AAAA,EAC1E,QAAQ;AACN,oBAAgB,mBAAmB,8DAA8D;AACjG;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ;AAAA,MAClB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,UAAU,OAAO,QAAQ;AAAA,MACzB,gBAAgB,iBAAiB,OAAO,cAAc,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH,SAAS,OAAO;AACd,gBAAY,mBAAmB,wCAAwC;AAAA,MACrE;AAAA,MACA;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD,CAAC;AACD,UAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport type { Queue } from '@open-mercato/queue'\nimport type { FulltextIndexJobPayload } from '../../../queue/fulltext-indexing'\nimport { resolveAutoIndexingEnabled } from '../lib/auto-indexing'\nimport { searchDebugWarn, searchError } from '../../../lib/debug'\n\nexport const metadata = { event: 'search.index_record', persistent: false }\n\ntype Payload = {\n  entityId?: string\n  recordId?: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\n\nexport default async function handle(payload: Payload, ctx: HandlerContext) {\n  const entityType = String(payload?.entityId ?? '')\n  const recordId = String(payload?.recordId ?? '')\n\n  if (!entityType || !recordId) {\n    return\n  }\n\n  let organizationId = payload?.organizationId ?? null\n  let tenantId = payload?.tenantId ?? null\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let em: any | null = null\n  try {\n    em = ctx.resolve('em')\n  } catch {\n    em = null\n  }\n\n  // Resolve missing scope from DB if needed (same pattern as vector_upsert.ts)\n  if ((organizationId == null || tenantId == null) && em) {\n    try {\n      const lookupEm = typeof em.fork === 'function' ? em.fork() : em\n      const db = lookupEm.getKysely()\n      const table = resolveEntityTableName(em, entityType)\n      const row = await db\n        .selectFrom(table as any)\n        .select(['organization_id' as any, 'tenant_id' as any])\n        .where('id' as any, '=', recordId)\n        .executeTakeFirst() as { organization_id?: string | null; tenant_id?: string | null } | undefined\n      if (organizationId == null) organizationId = row?.organization_id ?? organizationId\n      if (tenantId == null) tenantId = row?.tenant_id ?? tenantId\n    } catch {\n      // Ignore lookup errors\n    }\n  }\n\n  if (!tenantId) {\n    return\n  }\n\n  const autoIndexingEnabled = await resolveAutoIndexingEnabled(ctx, { defaultValue: true })\n  if (!autoIndexingEnabled) {\n    return\n  }\n\n  let queue: Queue<FulltextIndexJobPayload>\n  try {\n    queue = ctx.resolve<Queue<FulltextIndexJobPayload>>('fulltextIndexQueue')\n  } catch {\n    searchDebugWarn('search.fulltext', 'fulltextIndexQueue not available, skipping fulltext indexing')\n    return\n  }\n\n  try {\n    await queue.enqueue({\n      jobType: 'index',\n      entityType,\n      recordId,\n      tenantId: String(tenantId),\n      organizationId: organizationId ? String(organizationId) : null,\n    })\n  } catch (error) {\n    searchError('search.fulltext', 'Failed to enqueue fulltext index job', {\n      entityType,\n      recordId,\n      error: error instanceof Error ? error.message : error,\n    })\n    throw error\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AAGvC,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB,mBAAmB;AAEtC,MAAM,WAAW,EAAE,OAAO,uBAAuB,YAAY,MAAM;AAW1E,eAAO,OAA8B,SAAkB,KAAqB;AAC1E,QAAM,aAAa,OAAO,SAAS,YAAY,EAAE;AACjD,QAAM,WAAW,OAAO,SAAS,YAAY,EAAE;AAE/C,MAAI,CAAC,cAAc,CAAC,UAAU;AAC5B;AAAA,EACF;AAEA,MAAI,iBAAiB,SAAS,kBAAkB;AAChD,MAAI,WAAW,SAAS,YAAY;AAGpC,MAAI,KAAiB;AACrB,MAAI;AACF,SAAK,IAAI,QAAQ,IAAI;AAAA,EACvB,QAAQ;AACN,SAAK;AAAA,EACP;AAGA,OAAK,kBAAkB,QAAQ,YAAY,SAAS,IAAI;AACtD,QAAI;AACF,YAAM,WAAW,OAAO,GAAG,SAAS,aAAa,GAAG,KAAK,IAAI;AAC7D,YAAM,KAAK,SAAS,UAAU;AAC9B,YAAM,QAAQ,uBAAuB,IAAI,UAAU;AACnD,YAAM,MAAM,MAAM,GACf,WAAW,KAAY,EACvB,OAAO,CAAC,mBAA0B,WAAkB,CAAC,EACrD,MAAM,MAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAI,kBAAkB,KAAM,kBAAiB,KAAK,mBAAmB;AACrE,UAAI,YAAY,KAAM,YAAW,KAAK,aAAa;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,UAAU;AACb;AAAA,EACF;AAEA,QAAM,sBAAsB,MAAM,2BAA2B,KAAK,EAAE,cAAc,KAAK,CAAC;AACxF,MAAI,CAAC,qBAAqB;AACxB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,YAAQ,IAAI,QAAwC,oBAAoB;AAAA,EAC1E,QAAQ;AACN,oBAAgB,mBAAmB,8DAA8D;AACjG;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ;AAAA,MAClB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,UAAU,OAAO,QAAQ;AAAA,MACzB,gBAAgB,iBAAiB,OAAO,cAAc,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH,SAAS,OAAO;AACd,gBAAY,mBAAmB,wCAAwC;AAAA,MACrE;AAAA,MACA;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD,CAAC;AACD,UAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/search/subscribers/vector_delete.js

@@ -16,7 +16,8 @@ async function handle(payload, ctx) {
   }
   if ((organizationId == null || tenantId == null) && em) {
     try {
-      const db = em.getKysely();
+      const lookupEm = typeof em.fork === "function" ? em.fork() : em;
+      const db = lookupEm.getKysely();
       const table = resolveEntityTableName(em, entityType);
       const row = await db.selectFrom(table).select(["organization_id", "tenant_id"]).where("id", "=", recordId).executeTakeFirst();
       if (organizationId == null) organizationId = row?.organization_id ?? organizationId;

package/dist/modules/search/subscribers/vector_delete.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/search/subscribers/vector_delete.ts"],
-  "sourcesContent": ["import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport type { Queue } from '@open-mercato/queue'\nimport type { VectorIndexJobPayload } from '../../../queue/vector-indexing'\nimport { resolveAutoIndexingEnabled } from '../lib/auto-indexing'\nimport { searchDebugWarn, searchError } from '../../../lib/debug'\n\nexport const metadata = { event: 'query_index.delete_one', persistent: false }\n\ntype Payload = {\n  entityType?: string\n  recordId?: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\n\nexport default async function handle(payload: Payload, ctx: HandlerContext) {\n  const entityType = String(payload?.entityType ?? '')\n  const recordId = String(payload?.recordId ?? '')\n  if (!entityType || !recordId) return\n\n  let organizationId = payload?.organizationId ?? null\n  let tenantId = payload?.tenantId ?? null\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let em: any | null = null\n  try {\n    em = ctx.resolve('em')\n  } catch {\n    em = null\n  }\n\n  if ((organizationId == null || tenantId == null) && em) {\n    try {\n      const db = em.getKysely()\n      const table = resolveEntityTableName(em, entityType)\n      const row = await db\n        .selectFrom(table as any)\n        .select(['organization_id' as any, 'tenant_id' as any])\n        .where('id' as any, '=', recordId)\n        .executeTakeFirst() as { organization_id?: string | null; tenant_id?: string | null } | undefined\n      if (organizationId == null) organizationId = row?.organization_id ?? organizationId\n      if (tenantId == null) tenantId = row?.tenant_id ?? tenantId\n    } catch {\n      // Ignore lookup errors\n    }\n  }\n\n  if (!tenantId) return\n\n  const autoIndexingEnabled = await resolveAutoIndexingEnabled(ctx, { defaultValue: true })\n  if (!autoIndexingEnabled) return\n\n  let queue: Queue<VectorIndexJobPayload>\n  try {\n    queue = ctx.resolve<Queue<VectorIndexJobPayload>>('vectorIndexQueue')\n  } catch {\n    searchDebugWarn('search.vector', 'vectorIndexQueue not available, skipping vector delete')\n    return\n  }\n\n  try {\n    await queue.enqueue({\n      jobType: 'delete',\n      entityType,\n      recordId,\n      tenantId: String(tenantId),\n      organizationId: organizationId ? String(organizationId) : null,\n    })\n  } catch (error) {\n    searchError('search.vector', 'Failed to enqueue vector delete job', {\n      entityType,\n      recordId,\n      error: error instanceof Error ? error.message : error,\n    })\n    throw error // Propagate to caller so failure is visible\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,8BAA8B;AAGvC,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB,mBAAmB;AAEtC,MAAM,WAAW,EAAE,OAAO,0BAA0B,YAAY,MAAM;AAW7E,eAAO,OAA8B,SAAkB,KAAqB;AAC1E,QAAM,aAAa,OAAO,SAAS,cAAc,EAAE;AACnD,QAAM,WAAW,OAAO,SAAS,YAAY,EAAE;AAC/C,MAAI,CAAC,cAAc,CAAC,SAAU;AAE9B,MAAI,iBAAiB,SAAS,kBAAkB;AAChD,MAAI,WAAW,SAAS,YAAY;AAGpC,MAAI,KAAiB;AACrB,MAAI;AACF,SAAK,IAAI,QAAQ,IAAI;AAAA,EACvB,QAAQ;AACN,SAAK;AAAA,EACP;AAEA,OAAK,kBAAkB,QAAQ,YAAY,SAAS,IAAI;AACtD,QAAI;AACF,YAAM,KAAK,GAAG,UAAU;AACxB,YAAM,QAAQ,uBAAuB,IAAI,UAAU;AACnD,YAAM,MAAM,MAAM,GACf,WAAW,KAAY,EACvB,OAAO,CAAC,mBAA0B,WAAkB,CAAC,EACrD,MAAM,MAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAI,kBAAkB,KAAM,kBAAiB,KAAK,mBAAmB;AACrE,UAAI,YAAY,KAAM,YAAW,KAAK,aAAa;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,SAAU;AAEf,QAAM,sBAAsB,MAAM,2BAA2B,KAAK,EAAE,cAAc,KAAK,CAAC;AACxF,MAAI,CAAC,oBAAqB;AAE1B,MAAI;AACJ,MAAI;AACF,YAAQ,IAAI,QAAsC,kBAAkB;AAAA,EACtE,QAAQ;AACN,oBAAgB,iBAAiB,wDAAwD;AACzF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ;AAAA,MAClB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,UAAU,OAAO,QAAQ;AAAA,MACzB,gBAAgB,iBAAiB,OAAO,cAAc,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH,SAAS,OAAO;AACd,gBAAY,iBAAiB,uCAAuC;AAAA,MAClE;AAAA,MACA;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD,CAAC;AACD,UAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport type { Queue } from '@open-mercato/queue'\nimport type { VectorIndexJobPayload } from '../../../queue/vector-indexing'\nimport { resolveAutoIndexingEnabled } from '../lib/auto-indexing'\nimport { searchDebugWarn, searchError } from '../../../lib/debug'\n\nexport const metadata = { event: 'query_index.delete_one', persistent: false }\n\ntype Payload = {\n  entityType?: string\n  recordId?: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\n\nexport default async function handle(payload: Payload, ctx: HandlerContext) {\n  const entityType = String(payload?.entityType ?? '')\n  const recordId = String(payload?.recordId ?? '')\n  if (!entityType || !recordId) return\n\n  let organizationId = payload?.organizationId ?? null\n  let tenantId = payload?.tenantId ?? null\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let em: any | null = null\n  try {\n    em = ctx.resolve('em')\n  } catch {\n    em = null\n  }\n\n  if ((organizationId == null || tenantId == null) && em) {\n    try {\n      const lookupEm = typeof em.fork === 'function' ? em.fork() : em\n      const db = lookupEm.getKysely()\n      const table = resolveEntityTableName(em, entityType)\n      const row = await db\n        .selectFrom(table as any)\n        .select(['organization_id' as any, 'tenant_id' as any])\n        .where('id' as any, '=', recordId)\n        .executeTakeFirst() as { organization_id?: string | null; tenant_id?: string | null } | undefined\n      if (organizationId == null) organizationId = row?.organization_id ?? organizationId\n      if (tenantId == null) tenantId = row?.tenant_id ?? tenantId\n    } catch {\n      // Ignore lookup errors\n    }\n  }\n\n  if (!tenantId) return\n\n  const autoIndexingEnabled = await resolveAutoIndexingEnabled(ctx, { defaultValue: true })\n  if (!autoIndexingEnabled) return\n\n  let queue: Queue<VectorIndexJobPayload>\n  try {\n    queue = ctx.resolve<Queue<VectorIndexJobPayload>>('vectorIndexQueue')\n  } catch {\n    searchDebugWarn('search.vector', 'vectorIndexQueue not available, skipping vector delete')\n    return\n  }\n\n  try {\n    await queue.enqueue({\n      jobType: 'delete',\n      entityType,\n      recordId,\n      tenantId: String(tenantId),\n      organizationId: organizationId ? String(organizationId) : null,\n    })\n  } catch (error) {\n    searchError('search.vector', 'Failed to enqueue vector delete job', {\n      entityType,\n      recordId,\n      error: error instanceof Error ? error.message : error,\n    })\n    throw error // Propagate to caller so failure is visible\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AAGvC,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB,mBAAmB;AAEtC,MAAM,WAAW,EAAE,OAAO,0BAA0B,YAAY,MAAM;AAW7E,eAAO,OAA8B,SAAkB,KAAqB;AAC1E,QAAM,aAAa,OAAO,SAAS,cAAc,EAAE;AACnD,QAAM,WAAW,OAAO,SAAS,YAAY,EAAE;AAC/C,MAAI,CAAC,cAAc,CAAC,SAAU;AAE9B,MAAI,iBAAiB,SAAS,kBAAkB;AAChD,MAAI,WAAW,SAAS,YAAY;AAGpC,MAAI,KAAiB;AACrB,MAAI;AACF,SAAK,IAAI,QAAQ,IAAI;AAAA,EACvB,QAAQ;AACN,SAAK;AAAA,EACP;AAEA,OAAK,kBAAkB,QAAQ,YAAY,SAAS,IAAI;AACtD,QAAI;AACF,YAAM,WAAW,OAAO,GAAG,SAAS,aAAa,GAAG,KAAK,IAAI;AAC7D,YAAM,KAAK,SAAS,UAAU;AAC9B,YAAM,QAAQ,uBAAuB,IAAI,UAAU;AACnD,YAAM,MAAM,MAAM,GACf,WAAW,KAAY,EACvB,OAAO,CAAC,mBAA0B,WAAkB,CAAC,EACrD,MAAM,MAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAI,kBAAkB,KAAM,kBAAiB,KAAK,mBAAmB;AACrE,UAAI,YAAY,KAAM,YAAW,KAAK,aAAa;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,SAAU;AAEf,QAAM,sBAAsB,MAAM,2BAA2B,KAAK,EAAE,cAAc,KAAK,CAAC;AACxF,MAAI,CAAC,oBAAqB;AAE1B,MAAI;AACJ,MAAI;AACF,YAAQ,IAAI,QAAsC,kBAAkB;AAAA,EACtE,QAAQ;AACN,oBAAgB,iBAAiB,wDAAwD;AACzF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ;AAAA,MAClB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,UAAU,OAAO,QAAQ;AAAA,MACzB,gBAAgB,iBAAiB,OAAO,cAAc,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH,SAAS,OAAO;AACd,gBAAY,iBAAiB,uCAAuC;AAAA,MAClE;AAAA,MACA;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD,CAAC;AACD,UAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/search/subscribers/vector_upsert.js

@@ -16,7 +16,8 @@ async function handle(payload, ctx) {
   }
   if ((organizationId == null || tenantId == null) && em) {
     try {
-      const db = em.getKysely();
+      const lookupEm = typeof em.fork === "function" ? em.fork() : em;
+      const db = lookupEm.getKysely();
       const table = resolveEntityTableName(em, entityType);
       const row = await db.selectFrom(table).select(["organization_id", "tenant_id"]).where("id", "=", recordId).executeTakeFirst();
       if (organizationId == null) organizationId = row?.organization_id ?? organizationId;

package/dist/modules/search/subscribers/vector_upsert.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/search/subscribers/vector_upsert.ts"],
-  "sourcesContent": ["import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport type { Queue } from '@open-mercato/queue'\nimport type { VectorIndexJobPayload } from '../../../queue/vector-indexing'\nimport { resolveAutoIndexingEnabled } from '../lib/auto-indexing'\nimport { searchDebugWarn, searchError } from '../../../lib/debug'\n\nexport const metadata = { event: 'query_index.vectorize_one', persistent: false }\n\ntype Payload = {\n  entityType?: string\n  recordId?: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\n\nexport default async function handle(payload: Payload, ctx: HandlerContext) {\n  const entityType = String(payload?.entityType ?? '')\n  const recordId = String(payload?.recordId ?? '')\n  if (!entityType || !recordId) return\n\n  let organizationId = payload?.organizationId ?? null\n  let tenantId = payload?.tenantId ?? null\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let em: any | null = null\n  try {\n    em = ctx.resolve('em')\n  } catch {\n    em = null\n  }\n\n  if ((organizationId == null || tenantId == null) && em) {\n    try {\n      const db = em.getKysely()\n      const table = resolveEntityTableName(em, entityType)\n      const row = await db\n        .selectFrom(table as any)\n        .select(['organization_id' as any, 'tenant_id' as any])\n        .where('id' as any, '=', recordId)\n        .executeTakeFirst() as { organization_id?: string | null; tenant_id?: string | null } | undefined\n      if (organizationId == null) organizationId = row?.organization_id ?? organizationId\n      if (tenantId == null) tenantId = row?.tenant_id ?? tenantId\n    } catch {\n      // Ignore lookup errors\n    }\n  }\n\n  if (!tenantId) return\n\n  const autoIndexingEnabled = await resolveAutoIndexingEnabled(ctx, { defaultValue: true })\n  if (!autoIndexingEnabled) return\n\n  let queue: Queue<VectorIndexJobPayload>\n  try {\n    queue = ctx.resolve<Queue<VectorIndexJobPayload>>('vectorIndexQueue')\n  } catch {\n    searchDebugWarn('search.vector', 'vectorIndexQueue not available, skipping vector indexing')\n    return\n  }\n\n  try {\n    await queue.enqueue({\n      jobType: 'index',\n      entityType,\n      recordId,\n      tenantId: String(tenantId),\n      organizationId: organizationId ? String(organizationId) : null,\n    })\n  } catch (error) {\n    searchError('search.vector', 'Failed to enqueue vector index job', {\n      entityType,\n      recordId,\n      error: error instanceof Error ? error.message : error,\n    })\n    throw error // Propagate to caller so failure is visible\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,8BAA8B;AAGvC,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB,mBAAmB;AAEtC,MAAM,WAAW,EAAE,OAAO,6BAA6B,YAAY,MAAM;AAWhF,eAAO,OAA8B,SAAkB,KAAqB;AAC1E,QAAM,aAAa,OAAO,SAAS,cAAc,EAAE;AACnD,QAAM,WAAW,OAAO,SAAS,YAAY,EAAE;AAC/C,MAAI,CAAC,cAAc,CAAC,SAAU;AAE9B,MAAI,iBAAiB,SAAS,kBAAkB;AAChD,MAAI,WAAW,SAAS,YAAY;AAGpC,MAAI,KAAiB;AACrB,MAAI;AACF,SAAK,IAAI,QAAQ,IAAI;AAAA,EACvB,QAAQ;AACN,SAAK;AAAA,EACP;AAEA,OAAK,kBAAkB,QAAQ,YAAY,SAAS,IAAI;AACtD,QAAI;AACF,YAAM,KAAK,GAAG,UAAU;AACxB,YAAM,QAAQ,uBAAuB,IAAI,UAAU;AACnD,YAAM,MAAM,MAAM,GACf,WAAW,KAAY,EACvB,OAAO,CAAC,mBAA0B,WAAkB,CAAC,EACrD,MAAM,MAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAI,kBAAkB,KAAM,kBAAiB,KAAK,mBAAmB;AACrE,UAAI,YAAY,KAAM,YAAW,KAAK,aAAa;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,SAAU;AAEf,QAAM,sBAAsB,MAAM,2BAA2B,KAAK,EAAE,cAAc,KAAK,CAAC;AACxF,MAAI,CAAC,oBAAqB;AAE1B,MAAI;AACJ,MAAI;AACF,YAAQ,IAAI,QAAsC,kBAAkB;AAAA,EACtE,QAAQ;AACN,oBAAgB,iBAAiB,0DAA0D;AAC3F;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ;AAAA,MAClB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,UAAU,OAAO,QAAQ;AAAA,MACzB,gBAAgB,iBAAiB,OAAO,cAAc,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH,SAAS,OAAO;AACd,gBAAY,iBAAiB,sCAAsC;AAAA,MACjE;AAAA,MACA;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD,CAAC;AACD,UAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport type { Queue } from '@open-mercato/queue'\nimport type { VectorIndexJobPayload } from '../../../queue/vector-indexing'\nimport { resolveAutoIndexingEnabled } from '../lib/auto-indexing'\nimport { searchDebugWarn, searchError } from '../../../lib/debug'\n\nexport const metadata = { event: 'query_index.vectorize_one', persistent: false }\n\ntype Payload = {\n  entityType?: string\n  recordId?: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\n\nexport default async function handle(payload: Payload, ctx: HandlerContext) {\n  const entityType = String(payload?.entityType ?? '')\n  const recordId = String(payload?.recordId ?? '')\n  if (!entityType || !recordId) return\n\n  let organizationId = payload?.organizationId ?? null\n  let tenantId = payload?.tenantId ?? null\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let em: any | null = null\n  try {\n    em = ctx.resolve('em')\n  } catch {\n    em = null\n  }\n\n  if ((organizationId == null || tenantId == null) && em) {\n    try {\n      const lookupEm = typeof em.fork === 'function' ? em.fork() : em\n      const db = lookupEm.getKysely()\n      const table = resolveEntityTableName(em, entityType)\n      const row = await db\n        .selectFrom(table as any)\n        .select(['organization_id' as any, 'tenant_id' as any])\n        .where('id' as any, '=', recordId)\n        .executeTakeFirst() as { organization_id?: string | null; tenant_id?: string | null } | undefined\n      if (organizationId == null) organizationId = row?.organization_id ?? organizationId\n      if (tenantId == null) tenantId = row?.tenant_id ?? tenantId\n    } catch {\n      // Ignore lookup errors\n    }\n  }\n\n  if (!tenantId) return\n\n  const autoIndexingEnabled = await resolveAutoIndexingEnabled(ctx, { defaultValue: true })\n  if (!autoIndexingEnabled) return\n\n  let queue: Queue<VectorIndexJobPayload>\n  try {\n    queue = ctx.resolve<Queue<VectorIndexJobPayload>>('vectorIndexQueue')\n  } catch {\n    searchDebugWarn('search.vector', 'vectorIndexQueue not available, skipping vector indexing')\n    return\n  }\n\n  try {\n    await queue.enqueue({\n      jobType: 'index',\n      entityType,\n      recordId,\n      tenantId: String(tenantId),\n      organizationId: organizationId ? String(organizationId) : null,\n    })\n  } catch (error) {\n    searchError('search.vector', 'Failed to enqueue vector index job', {\n      entityType,\n      recordId,\n      error: error instanceof Error ? error.message : error,\n    })\n    throw error // Propagate to caller so failure is visible\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AAGvC,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB,mBAAmB;AAEtC,MAAM,WAAW,EAAE,OAAO,6BAA6B,YAAY,MAAM;AAWhF,eAAO,OAA8B,SAAkB,KAAqB;AAC1E,QAAM,aAAa,OAAO,SAAS,cAAc,EAAE;AACnD,QAAM,WAAW,OAAO,SAAS,YAAY,EAAE;AAC/C,MAAI,CAAC,cAAc,CAAC,SAAU;AAE9B,MAAI,iBAAiB,SAAS,kBAAkB;AAChD,MAAI,WAAW,SAAS,YAAY;AAGpC,MAAI,KAAiB;AACrB,MAAI;AACF,SAAK,IAAI,QAAQ,IAAI;AAAA,EACvB,QAAQ;AACN,SAAK;AAAA,EACP;AAEA,OAAK,kBAAkB,QAAQ,YAAY,SAAS,IAAI;AACtD,QAAI;AACF,YAAM,WAAW,OAAO,GAAG,SAAS,aAAa,GAAG,KAAK,IAAI;AAC7D,YAAM,KAAK,SAAS,UAAU;AAC9B,YAAM,QAAQ,uBAAuB,IAAI,UAAU;AACnD,YAAM,MAAM,MAAM,GACf,WAAW,KAAY,EACvB,OAAO,CAAC,mBAA0B,WAAkB,CAAC,EACrD,MAAM,MAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAI,kBAAkB,KAAM,kBAAiB,KAAK,mBAAmB;AACrE,UAAI,YAAY,KAAM,YAAW,KAAK,aAAa;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,SAAU;AAEf,QAAM,sBAAsB,MAAM,2BAA2B,KAAK,EAAE,cAAc,KAAK,CAAC;AACxF,MAAI,CAAC,oBAAqB;AAE1B,MAAI;AACJ,MAAI;AACF,YAAQ,IAAI,QAAsC,kBAAkB;AAAA,EACtE,QAAQ;AACN,oBAAgB,iBAAiB,0DAA0D;AAC3F;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ;AAAA,MAClB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,UAAU,OAAO,QAAQ;AAAA,MACzB,gBAAgB,iBAAiB,OAAO,cAAc,IAAI;AAAA,IAC5D,CAAC;AAAA,EACH,SAAS,OAAO;AACd,gBAAY,iBAAiB,sCAAsC;AAAA,MACjE;AAAA,MACA;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD,CAAC;AACD,UAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/search",
-  "version": "0.8.1-develop.7296.1.2111d779db",
+  "version": "0.9.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -127,9 +127,9 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/core": "0.8.1-develop.7296.1.2111d779db",
-    "@open-mercato/queue": "0.8.1-develop.7296.1.2111d779db",
-    "@open-mercato/shared": "0.8.1-develop.7296.1.2111d779db"
+    "@open-mercato/core": "0.9.0",
+    "@open-mercato/queue": "0.9.0",
+    "@open-mercato/shared": "0.9.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
@@ -144,6 +144,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/search"
-  },
-  "stableVersion": "0.8.0"
+  }
 }

package/src/__tests__/di-singletons.test.ts

@@ -164,4 +164,19 @@ describe('registerSearchModule — fulltext driver canMemoize guard', () => {
 
     expect(jest.mocked(createFulltextDriver)).toHaveBeenCalledTimes(2)
   })
+
+  it('installs a fail-closed resolver when encrypted-field filtering cannot reach the database', async () => {
+    process.env.SEARCH_EXCLUDE_ENCRYPTED_FIELDS = 'true'
+    const container = makeMockContainer()
+
+    registerSearchModule(container as never, { skipVector: true, skipTokens: true })
+
+    const options = jest.mocked(createFulltextDriver).mock.calls[0]?.[0] as {
+      encryptionMapResolver?: (entityId: string) => Promise<unknown>
+    }
+    expect(options.encryptionMapResolver).toEqual(expect.any(Function))
+    await expect(options.encryptionMapResolver?.('demo:item') as Promise<unknown>).rejects.toThrow(
+      'refusing to index potentially encrypted fields',
+    )
+  })
 })

package/src/__tests__/encryption-map-resolver.test.ts

@@ -0,0 +1,200 @@
+jest.mock('../fulltext/drivers', () => ({
+  createFulltextDriver: jest.fn(),
+}))
+
+import { createEncryptionMapResolver } from '../di'
+import { encryptionMapPolicyVersionCacheKey } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
+
+type QueryResult = Array<Record<string, unknown>> | Error
+
+function createDatabase(results: QueryResult[]) {
+  const queue = [...results]
+  const query: Record<string, jest.Mock> = {}
+  for (const method of ['select', 'where', 'orderBy']) {
+    query[method] = jest.fn(() => query)
+  }
+  query.execute = jest.fn(async () => {
+    const result = queue.shift() ?? []
+    if (result instanceof Error) throw result
+    return result
+  })
+  return {
+    db: { selectFrom: jest.fn(() => query) },
+    query,
+  }
+}
+
+function createPolicyVersionCache(entityId: string) {
+  const storage = new Map<string, unknown>([
+    [encryptionMapPolicyVersionCacheKey(entityId), 'version-1'],
+  ])
+  const cache = {
+    get: jest.fn(async (key: string) => storage.get(key) ?? null),
+    set: jest.fn(async (key: string, value: unknown) => { storage.set(key, value) }),
+    delete: jest.fn(async (key: string) => storage.delete(key)),
+  }
+  return { cache, storage }
+}
+
+describe('search encryption-map resolver', () => {
+  it('deterministically unions legacy duplicate rows and completes a missing hash target', async () => {
+    const { db } = createDatabase([[
+      {
+        id: 'b',
+        tenant_id: 'tenant-1',
+        organization_id: 'org-1',
+        created_at: '2026-01-02T00:00:00.000Z',
+        fields_json: [{ field: 'email', hashField: 'email_hash' }, { field: 'phone' }],
+      },
+      {
+        id: 'a',
+        tenant_id: 'tenant-1',
+        organization_id: 'org-1',
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'email' }, { field: 'display_name' }],
+      },
+    ]])
+
+    await expect(createEncryptionMapResolver(db as never)('customers:person')).resolves.toEqual([
+      { field: 'email', hashField: 'email_hash' },
+      { field: 'display_name', hashField: null },
+      { field: 'phone', hashField: null },
+    ])
+  })
+
+  it('unions global, tenant-global, and organization-scoped declarations fail-safe', async () => {
+    const { db, query } = createDatabase([[
+      {
+        id: 'org',
+        tenant_id: 'tenant-1',
+        organization_id: 'org-1',
+        created_at: '2026-01-03T00:00:00.000Z',
+        fields_json: [{ field: 'organization_secret' }],
+      },
+      {
+        id: 'global',
+        tenant_id: null,
+        organization_id: null,
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: '[{"field":"global_secret"}]',
+      },
+      {
+        id: 'tenant',
+        tenant_id: 'tenant-1',
+        organization_id: null,
+        created_at: '2026-01-02T00:00:00.000Z',
+        fields_json: [{ field: 'tenant_secret' }],
+      },
+    ]])
+
+    await expect(createEncryptionMapResolver(db as never)('demo:item')).resolves.toEqual([
+      { field: 'global_secret', hashField: null },
+      { field: 'tenant_secret', hashField: null },
+      { field: 'organization_secret', hashField: null },
+    ])
+    expect(query.where).toHaveBeenCalledWith('is_active', '=', true)
+    expect(query.where).toHaveBeenCalledWith('deleted_at', 'is', null)
+    expect(query.orderBy).toHaveBeenCalledTimes(4)
+  })
+
+  it('fails closed on lookup errors and retries instead of caching an empty policy', async () => {
+    const { db, query } = createDatabase([
+      new Error('database unavailable'),
+      [{
+        id: 'recovered',
+        tenant_id: null,
+        organization_id: null,
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'secret' }],
+      }],
+    ])
+    const resolveMap = createEncryptionMapResolver(db as never)
+
+    await expect(resolveMap('demo:item')).rejects.toThrow('database unavailable')
+    await expect(resolveMap('demo:item')).resolves.toEqual([{ field: 'secret', hashField: null }])
+    expect(query.execute).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not retain a successful empty lookup for five minutes', async () => {
+    const entityId = 'demo:item'
+    const { db, query } = createDatabase([
+      [],
+      [{
+        id: 'created-later',
+        tenant_id: 'tenant-1',
+        organization_id: null,
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'new_secret' }],
+      }],
+      [{
+        id: 'created-later',
+        tenant_id: 'tenant-1',
+        organization_id: null,
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'new_secret' }],
+      }],
+    ])
+    const { cache } = createPolicyVersionCache(entityId)
+    const resolveMap = createEncryptionMapResolver(db as never, cache)
+
+    await expect(resolveMap(entityId)).resolves.toEqual([])
+    await expect(resolveMap(entityId)).resolves.toEqual([{ field: 'new_secret', hashField: null }])
+    await expect(resolveMap(entityId)).resolves.toEqual([{ field: 'new_secret', hashField: null }])
+    expect(query.execute).toHaveBeenCalledTimes(3)
+    expect(cache.get).not.toHaveBeenCalled()
+  })
+
+  it('re-reads a positive policy when a protected field is added without a published version', async () => {
+    const entityId = 'demo:versioned_policy'
+    const { db, query } = createDatabase([
+      [{
+        id: 'existing',
+        tenant_id: 'tenant-1',
+        organization_id: 'org-1',
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'old_secret' }],
+      }],
+      [{
+        id: 'existing',
+        tenant_id: 'tenant-1',
+        organization_id: 'org-1',
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'old_secret' }, { field: 'new_secret' }],
+      }],
+    ])
+    const { cache } = createPolicyVersionCache(entityId)
+    const resolveMap = createEncryptionMapResolver(db as never, cache)
+
+    await expect(resolveMap(entityId)).resolves.toEqual([
+      { field: 'old_secret', hashField: null },
+    ])
+    await expect(resolveMap(entityId)).resolves.toEqual([
+      { field: 'old_secret', hashField: null },
+      { field: 'new_secret', hashField: null },
+    ])
+    expect(query.execute).toHaveBeenCalledTimes(2)
+    expect(cache.get).not.toHaveBeenCalled()
+  })
+
+  it('re-reads canonical policy while the legacy version cache is unavailable', async () => {
+    const { db, query } = createDatabase([[
+      {
+        id: 'current',
+        tenant_id: null,
+        organization_id: null,
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'protected' }],
+      },
+    ]])
+    const cache = {
+      get: jest.fn(async () => { throw new Error('cache unavailable') }),
+    }
+    const resolveMap = createEncryptionMapResolver(db as never, cache)
+
+    await expect(resolveMap('demo:cache_outage')).resolves.toEqual([
+      { field: 'protected', hashField: null },
+    ])
+    expect(query.execute).toHaveBeenCalledTimes(1)
+    expect(cache.get).not.toHaveBeenCalled()
+  })
+})

package/src/__tests__/encryption-policy-process-coherence.test.ts

@@ -0,0 +1,108 @@
+import { fork, type ChildProcess } from 'node:child_process'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+type WorkerResponse = {
+  id?: number
+  ready?: boolean
+  ok?: boolean
+  value?: unknown
+}
+
+function waitForMessage(worker: ChildProcess, predicate: (message: WorkerResponse) => boolean): Promise<WorkerResponse> {
+  return new Promise((resolve, reject) => {
+    const onMessage = (message: WorkerResponse) => {
+      if (!predicate(message)) return
+      cleanup()
+      resolve(message)
+    }
+    const onExit = (code: number | null) => {
+      cleanup()
+      reject(new Error(`[internal] Search policy worker exited with code ${String(code)}`))
+    }
+    const cleanup = () => {
+      worker.off('message', onMessage)
+      worker.off('exit', onExit)
+    }
+    worker.on('message', onMessage)
+    worker.on('exit', onExit)
+  })
+}
+
+async function startWorker(statePath: string, cacheStatePath: string): Promise<ChildProcess> {
+  const worker = fork(join(__dirname, 'fixtures/encryption-policy-process-worker.ts'), [], {
+    execArgv: ['--import', require.resolve('tsx')],
+    env: {
+      ...process.env,
+      SEARCH_POLICY_STATE_PATH: statePath,
+      SEARCH_POLICY_CACHE_STATE_PATH: cacheStatePath,
+    },
+    stdio: ['ignore', 'ignore', 'inherit', 'ipc'],
+  })
+  await waitForMessage(worker, (message) => message.ready === true)
+  return worker
+}
+
+let commandId = 0
+
+async function resolvePolicy(worker: ChildProcess, entityId: string) {
+  const id = ++commandId
+  const response = waitForMessage(worker, (message) => message.id === id)
+  worker.send({ id, entityId })
+  return response
+}
+
+describe('Search encryption policy coherence across processes', () => {
+  it('re-reads positive policy after mutation, failed publication, and cache recovery', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'om-search-policy-'))
+    const statePath = join(directory, 'policy.json')
+    const cacheStatePath = join(directory, 'cache.json')
+    const entityId = 'demo:process_policy'
+    let worker: ChildProcess | undefined
+    try {
+      await writeFile(statePath, JSON.stringify([{
+        id: 'map',
+        tenant_id: 'tenant-1',
+        organization_id: 'org-1',
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'old_secret' }],
+      }]))
+      await writeFile(cacheStatePath, JSON.stringify({ available: true, version: 'version-1' }))
+      worker = await startWorker(statePath, cacheStatePath)
+
+      await expect(resolvePolicy(worker, entityId)).resolves.toMatchObject({
+        ok: true,
+        value: [{ field: 'old_secret', hashField: null }],
+      })
+
+      await writeFile(statePath, JSON.stringify([{
+        id: 'map',
+        tenant_id: 'tenant-1',
+        organization_id: 'org-1',
+        created_at: '2026-01-01T00:00:00.000Z',
+        fields_json: [{ field: 'old_secret' }, { field: 'new_secret' }],
+      }]))
+      await writeFile(cacheStatePath, JSON.stringify({ available: false, version: 'version-1' }))
+      await expect(resolvePolicy(worker, entityId)).resolves.toMatchObject({
+        ok: true,
+        value: [
+          { field: 'old_secret', hashField: null },
+          { field: 'new_secret', hashField: null },
+        ],
+      })
+
+      await writeFile(cacheStatePath, JSON.stringify({ available: true, version: 'version-2' }))
+      await expect(resolvePolicy(worker, entityId)).resolves.toMatchObject({
+        ok: true,
+        value: [
+          { field: 'old_secret', hashField: null },
+          { field: 'new_secret', hashField: null },
+        ],
+      })
+    } finally {
+      worker?.kill()
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+})

package/src/__tests__/fixtures/encryption-policy-process-worker.ts

@@ -0,0 +1,51 @@
+import { readFile } from 'node:fs/promises'
+import { createEncryptionMapResolver } from '../../lib/encryption-map-resolver'
+
+type WorkerCommand = {
+  id: number
+  entityId: string
+}
+
+const statePath = process.env.SEARCH_POLICY_STATE_PATH
+const cacheStatePath = process.env.SEARCH_POLICY_CACHE_STATE_PATH
+
+if (!statePath || !cacheStatePath) {
+  throw new Error('[internal] Search policy fixture paths are required')
+}
+
+const query: Record<string, unknown> = {}
+for (const method of ['select', 'where', 'orderBy']) {
+  query[method] = () => query
+}
+query.execute = async () => JSON.parse(await readFile(statePath, 'utf8')) as unknown[]
+
+const legacyPolicyVersionCache = {
+  get: async () => {
+    const state = JSON.parse(await readFile(cacheStatePath, 'utf8')) as {
+      available: boolean
+      version: string
+    }
+    if (!state.available) throw new Error('policy version cache unavailable')
+    return state.version
+  },
+}
+
+const resolveMap = createEncryptionMapResolver(
+  { selectFrom: () => query } as never,
+  legacyPolicyVersionCache,
+)
+
+process.on('message', async (command: WorkerCommand) => {
+  try {
+    const value = await resolveMap(command.entityId as never)
+    process.send?.({ id: command.id, ok: true, value })
+  } catch (error) {
+    process.send?.({
+      id: command.id,
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+    })
+  }
+})
+
+process.send?.({ ready: true })

package/src/di.ts

@@ -25,6 +25,9 @@ import type { VectorIndexJobPayload } from './queue/vector-indexing'
 import type { EncryptionMapEntry } from './lib/field-policy'
 import type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { createPresenterEnricher } from './lib/presenter-enricher'
+import { createEncryptionMapResolver } from './lib/encryption-map-resolver'
+
+export { createEncryptionMapResolver } from './lib/encryption-map-resolver'
 
 const FULLTEXT_DRIVER_KEY = '__omSearchFulltextDriver__'
 
@@ -46,46 +49,9 @@ function shouldExcludeEncryptedFields(): boolean {
   return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'on'
 }
 
-/**
- * Create an encryption map resolver that queries the database.
- * Falls back to empty array if query fails.
- */
-function createEncryptionMapResolver(
-  db: Kysely<any>,
-): (entityId: EntityId) => Promise<EncryptionMapEntry[]> {
-  // Cache encryption maps per entity to avoid repeated queries
-  const cache = new Map<string, { entries: EncryptionMapEntry[]; expiresAt: number }>()
-  const CACHE_TTL_MS = 5 * 60 * 1000 // 5 minutes
-
-  return async (entityId: EntityId): Promise<EncryptionMapEntry[]> => {
-    const cached = cache.get(entityId)
-    if (cached && cached.expiresAt > Date.now()) {
-      return cached.entries
-    }
-
-    try {
-      const row = await db
-        .selectFrom('encryption_maps' as any)
-        .select(['fields_json' as any])
-        .where('entity_id' as any, '=', entityId)
-        .where('is_active' as any, '=', true)
-        .where('deleted_at' as any, 'is', null)
-        .executeTakeFirst() as { fields_json?: unknown } | undefined
-
-      const fieldsJson = row?.fields_json
-      const entries: EncryptionMapEntry[] = Array.isArray(fieldsJson)
-        ? fieldsJson.map((f: { field: string; hashField?: string | null }) => ({
-            field: f.field,
-            hashField: f.hashField ?? null,
-          }))
-        : []
-
-      cache.set(entityId, { entries, expiresAt: Date.now() + CACHE_TTL_MS })
-      return entries
-    } catch {
-      // Query failed, return empty array (don't exclude any fields)
-      return []
-    }
+function createUnavailableEncryptionMapResolver(): (entityId: EntityId) => Promise<EncryptionMapEntry[]> {
+  return async () => {
+    throw new Error('[internal] Encryption map lookup is unavailable; refusing to index potentially encrypted fields')
   }
 }
 
@@ -193,7 +159,7 @@ export function registerSearchModule(
           const db = em.getKysely() as Kysely<any>
           encryptionMapResolver = createEncryptionMapResolver(db)
         } catch {
-          // Kysely not available, encrypted field filtering disabled
+          encryptionMapResolver = createUnavailableEncryptionMapResolver()
         }
       }
 

package/src/lib/encryption-map-resolver.ts

@@ -0,0 +1,110 @@
+import type { Kysely } from 'kysely'
+import type { EntityId } from '@open-mercato/shared/modules/entities'
+import type { EncryptionMapEntry } from './field-policy'
+
+type EncryptionMapRow = {
+  id?: unknown
+  tenant_id?: unknown
+  organization_id?: unknown
+  fields_json?: unknown
+  created_at?: unknown
+}
+
+type LegacyEncryptionMapPolicyVersionCache = {
+  get(key: string): Promise<unknown | null>
+}
+
+function compareNullableScope(left: unknown, right: unknown): number {
+  if (left == null && right == null) return 0
+  if (left == null) return -1
+  if (right == null) return 1
+  return String(left).localeCompare(String(right))
+}
+
+function compareCreatedAt(left: unknown, right: unknown): number {
+  const leftTime = left instanceof Date ? left.getTime() : Date.parse(String(left ?? ''))
+  const rightTime = right instanceof Date ? right.getTime() : Date.parse(String(right ?? ''))
+  if (Number.isFinite(leftTime) && Number.isFinite(rightTime)) return leftTime - rightTime
+  return String(left ?? '').localeCompare(String(right ?? ''))
+}
+
+function compareEncryptionMapRows(left: EncryptionMapRow, right: EncryptionMapRow): number {
+  return compareNullableScope(left.tenant_id, right.tenant_id)
+    || compareNullableScope(left.organization_id, right.organization_id)
+    || compareCreatedAt(left.created_at, right.created_at)
+    || String(left.id ?? '').localeCompare(String(right.id ?? ''))
+}
+
+function parseEncryptionMapFields(value: unknown): unknown[] {
+  if (Array.isArray(value)) return value
+  if (typeof value !== 'string') return []
+  try {
+    const parsed = JSON.parse(value) as unknown
+    return Array.isArray(parsed) ? parsed : []
+  } catch {
+    return []
+  }
+}
+
+function mergeEncryptionMapEntries(rows: readonly EncryptionMapRow[]): EncryptionMapEntry[] {
+  const merged: EncryptionMapEntry[] = []
+  const byField = new Map<string, EncryptionMapEntry>()
+  for (const row of [...rows].sort(compareEncryptionMapRows)) {
+    for (const candidate of parseEncryptionMapFields(row.fields_json)) {
+      if (!candidate || typeof candidate !== 'object') continue
+      const rule = candidate as { field?: unknown; hashField?: unknown }
+      const field = typeof rule.field === 'string' ? rule.field.trim() : ''
+      if (!field) continue
+      const hashField = typeof rule.hashField === 'string' && rule.hashField.length > 0
+        ? rule.hashField
+        : null
+      const existing = byField.get(field)
+      if (!existing) {
+        const entry = { field, hashField }
+        byField.set(field, entry)
+        merged.push(entry)
+      } else if (!existing.hashField && hashField) {
+        existing.hashField = hashField
+      }
+    }
+  }
+  return merged
+}
+
+/**
+ * Resolve every active live declaration for an entity. Search indexing has no
+ * tenant/scope argument at this boundary, so the safe policy is the union of
+ * all scopes: over-excluding a field is preferable to publishing plaintext.
+ *
+ * The legacy version-cache argument remains optional for call-site compatibility but is
+ * intentionally ignored. A version publication can fail after the database commit, so neither
+ * that channel nor process-local positive memory can authorize reuse of an older policy.
+ */
+export function createEncryptionMapResolver(
+  db: Kysely<any>,
+  legacyPolicyVersionCache?: LegacyEncryptionMapPolicyVersionCache,
+): (entityId: EntityId) => Promise<EncryptionMapEntry[]> {
+  void legacyPolicyVersionCache
+
+  return async (entityId: EntityId): Promise<EncryptionMapEntry[]> => {
+    const rows = await db
+      .selectFrom('encryption_maps' as any)
+      .select([
+        'id' as any,
+        'tenant_id' as any,
+        'organization_id' as any,
+        'fields_json' as any,
+        'created_at' as any,
+      ])
+      .where('entity_id' as any, '=', entityId)
+      .where('is_active' as any, '=', true)
+      .where('deleted_at' as any, 'is', null)
+      .orderBy('tenant_id' as any, 'asc')
+      .orderBy('organization_id' as any, 'asc')
+      .orderBy('created_at' as any, 'asc')
+      .orderBy('id' as any, 'asc')
+      .execute() as EncryptionMapRow[]
+
+    return mergeEncryptionMapEntries(Array.isArray(rows) ? rows : [])
+  }
+}

package/src/modules/search/subscribers/__tests__/scope-lookup-isolation.test.ts

@@ -0,0 +1,53 @@
+jest.mock('@open-mercato/shared/lib/query/engine', () => ({
+  resolveEntityTableName: jest.fn(() => 'feature_toggles'),
+}))
+jest.mock('../../lib/auto-indexing', () => ({
+  resolveAutoIndexingEnabled: jest.fn().mockResolvedValue(false),
+}))
+
+import vectorUpsert from '../vector_upsert'
+import vectorDelete from '../vector_delete'
+import fulltextUpsert from '../fulltext_upsert'
+
+/**
+ * The unscoped-record lookup reads `organization_id`/`tenant_id` from the
+ * entity table and swallows failures (global tables such as `feature_toggles`
+ * lack those columns). Running it on the shared request EntityManager let the
+ * failed statement land inside whatever write transaction that EM currently
+ * held (e.g. the audit redo finalization flush), aborting it. The lookup must
+ * run on a fork so a swallowed error can never poison a caller's transaction.
+ */
+function buildContext() {
+  const executeTakeFirst = jest.fn().mockRejectedValue(new Error('column "organization_id" does not exist'))
+  const where = jest.fn(() => ({ executeTakeFirst }))
+  const select = jest.fn(() => ({ where }))
+  const forkKysely = { selectFrom: jest.fn(() => ({ select })) }
+  const forkEm = { getKysely: jest.fn(() => forkKysely) }
+  const requestEm = { getKysely: jest.fn(), fork: jest.fn(() => forkEm) }
+  const ctx = {
+    resolve: jest.fn((name: string) => {
+      if (name === 'em') return requestEm
+      throw new Error(`[internal] not registered: ${name}`)
+    }),
+  }
+  return { ctx, requestEm, forkEm, executeTakeFirst }
+}
+
+type SubscriberHandler = (payload: Record<string, unknown>, ctx: unknown) => Promise<void>
+
+describe('search subscriber scope lookup isolation', () => {
+  it.each<[string, SubscriberHandler, Record<string, unknown>]>([
+    ['query_index.vectorize_one', vectorUpsert as SubscriberHandler, { entityType: 'feature_toggles:feature_toggle', recordId: 'r1', tenantId: null, organizationId: null }],
+    ['query_index.delete_one', vectorDelete as SubscriberHandler, { entityType: 'feature_toggles:feature_toggle', recordId: 'r1', tenantId: null, organizationId: null }],
+    ['search.index_record', fulltextUpsert as SubscriberHandler, { entityId: 'feature_toggles:feature_toggle', recordId: 'r1', tenantId: null, organizationId: null }],
+  ])('%s never runs the unscoped lookup on the request EntityManager', async (_event, handler, payload) => {
+    const { ctx, requestEm, forkEm, executeTakeFirst } = buildContext()
+
+    await expect(handler(payload, ctx)).resolves.toBeUndefined()
+
+    expect(requestEm.getKysely).not.toHaveBeenCalled()
+    expect(requestEm.fork).toHaveBeenCalledTimes(1)
+    expect(forkEm.getKysely).toHaveBeenCalledTimes(1)
+    expect(executeTakeFirst).toHaveBeenCalledTimes(1)
+  })
+})

package/src/modules/search/subscribers/fulltext_upsert.ts

@@ -37,7 +37,8 @@ export default async function handle(payload: Payload, ctx: HandlerContext) {
   // Resolve missing scope from DB if needed (same pattern as vector_upsert.ts)
   if ((organizationId == null || tenantId == null) && em) {
     try {
-      const db = em.getKysely()
+      const lookupEm = typeof em.fork === 'function' ? em.fork() : em
+      const db = lookupEm.getKysely()
       const table = resolveEntityTableName(em, entityType)
       const row = await db
         .selectFrom(table as any)

package/src/modules/search/subscribers/vector_delete.ts

@@ -33,7 +33,8 @@ export default async function handle(payload: Payload, ctx: HandlerContext) {
 
   if ((organizationId == null || tenantId == null) && em) {
     try {
-      const db = em.getKysely()
+      const lookupEm = typeof em.fork === 'function' ? em.fork() : em
+      const db = lookupEm.getKysely()
       const table = resolveEntityTableName(em, entityType)
       const row = await db
         .selectFrom(table as any)

package/src/modules/search/subscribers/vector_upsert.ts

@@ -33,7 +33,8 @@ export default async function handle(payload: Payload, ctx: HandlerContext) {
 
   if ((organizationId == null || tenantId == null) && em) {
     try {
-      const db = em.getKysely()
+      const lookupEm = typeof em.fork === 'function' ? em.fork() : em
+      const db = lookupEm.getKysely()
       const table = resolveEntityTableName(em, entityType)
       const row = await db
         .selectFrom(table as any)