@tokenoftrust/storefront-runner 4.11.0 → 4.11.2

package/apps/storefront/migrations-apps/0021_contact_vault.sql

@@ -3,6 +3,10 @@
 --
 -- The plaintext scrappy_order_addresses table is dropped only when it is empty: the guard row's
 -- CHECK fails on any other count and aborts the whole file.
+--
+-- allow-destructive: the three drops lose no data — _gv_vault_guard is this file's own guard,
+-- scrappy_order_addresses is dropped only after the guard proves it empty, and contact_messages is
+-- dropped only after every row is copied into contact_messages_sealed (migration0021.test.ts).
 CREATE TABLE `_gv_vault_guard` (`n` integer NOT NULL CHECK (`n` = 0));
 --> statement-breakpoint
 INSERT INTO `_gv_vault_guard` (`n`) SELECT COUNT(*) FROM `scrappy_order_addresses`;

package/apps/storefront/migrations-apps/0022_contact_vault_fields.sql

@@ -0,0 +1,342 @@
+-- Field-level contact vault: each personal field is its own AES-256-GCM ciphertext under a
+-- per-tenant data key wrapped by AWS KMS (src/lib/customers/contactVault/). Retention is per
+-- field group: an immutable ceiling bound into every field's AAD, a shrink-only effective expiry,
+-- and an immutable seal-time floor (retentionPolicy.ts). The vault row is also the long-lived
+-- facts row: after its last group is cleared it is detached from the order and keeps only
+-- unlinked month, zip3, region, country and totals.
+--
+-- allow-destructive: order_contact_vault, order_contact_tombstones and contact_access_audit are
+-- dropped and rebuilt only when empty (the guard below aborts the whole file otherwise), and
+-- contact_messages is rebuilt preserving every row; no contact data exists in any of them yet.
+CREATE TABLE `_gv_vault_v2_guard` (`n` integer NOT NULL CHECK (`n` = 0));
+--> statement-breakpoint
+INSERT INTO `_gv_vault_v2_guard` (`n`)
+SELECT (SELECT COUNT(*) FROM `order_contact_vault`)
+     + (SELECT COUNT(*) FROM `order_contact_tombstones`)
+     + (SELECT COUNT(*) FROM `contact_access_audit`)
+     + (SELECT COUNT(*) FROM `contact_messages` WHERE `ciphertext` IS NOT NULL);
+--> statement-breakpoint
+DROP TABLE `_gv_vault_v2_guard`;
+--> statement-breakpoint
+DROP TABLE `order_contact_vault`;
+--> statement-breakpoint
+DROP TABLE `order_contact_tombstones`;
+--> statement-breakpoint
+DROP TABLE `contact_access_audit`;
+--> statement-breakpoint
+CREATE TABLE `contact_vault_data_keys` (
+  `tenant_id` text NOT NULL,
+  `stage` text NOT NULL CHECK (stage IN ('preview', 'publication')),
+  `purpose` text NOT NULL CHECK (`purpose` IN ('order-contact', 'contact-message', 'blind-index')),
+  `kid` text NOT NULL,
+  `wrapped_key` text NOT NULL,
+  `kms_key_arn` text NOT NULL,
+  `created_at` text NOT NULL,
+  `retired_at` text,
+  PRIMARY KEY (`tenant_id`, `stage`, `purpose`, `kid`)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_contact_vault_data_keys_active`
+  ON `contact_vault_data_keys` (`tenant_id`, `stage`, `purpose`) WHERE `retired_at` IS NULL;
+--> statement-breakpoint
+CREATE TRIGGER `contact_vault_data_keys_immutable`
+BEFORE UPDATE ON `contact_vault_data_keys`
+WHEN NEW.`wrapped_key` IS NOT OLD.`wrapped_key`
+  OR NEW.`kms_key_arn` IS NOT OLD.`kms_key_arn`
+  OR NEW.`kid` IS NOT OLD.`kid`
+  OR NEW.`tenant_id` IS NOT OLD.`tenant_id`
+  OR NEW.`stage` IS NOT OLD.`stage`
+  OR NEW.`purpose` IS NOT OLD.`purpose`
+  OR (OLD.`retired_at` IS NOT NULL AND NEW.`retired_at` IS NOT OLD.`retired_at`)
+BEGIN
+  SELECT RAISE(ABORT, 'data-key-immutable');
+END;
+--> statement-breakpoint
+CREATE TABLE `order_contact_vault` (
+  `fact_id` text PRIMARY KEY NOT NULL,
+  `tenant_id` text NOT NULL,
+  `stage` text NOT NULL CHECK (stage IN ('preview', 'publication')),
+  `order_id` text,
+  `placed_month` text NOT NULL CHECK (length(`placed_month`) = 6),
+  `currency` text,
+  `order_total_minor` integer,
+  `item_count` integer,
+  `ship_region` text,
+  `ship_country` text,
+  `ship_zip3` text,
+  `bill_region` text,
+  `bill_country` text,
+  `bill_zip3` text,
+  `time_scale` integer,
+  `rule_version` text,
+  `order_kid` text,
+  `bidx_kid` text,
+  `sealed_at` text,
+  `sealed_jti` text,
+  `erased_at` text,
+  `name_ct` text,
+  `company_ct` text,
+  `identity_ceiling` text,
+  `identity_expires_at` text,
+  `identity_floor_until` text,
+  `identity_rule` text,
+  `email_ct` text,
+  `email_bidx` text,
+  `email_ceiling` text,
+  `email_expires_at` text,
+  `email_floor_until` text,
+  `email_rule` text,
+  `phone_ct` text,
+  `phone_bidx` text,
+  `phone_ceiling` text,
+  `phone_expires_at` text,
+  `phone_floor_until` text,
+  `phone_rule` text,
+  `ship_name_ct` text,
+  `ship_company_ct` text,
+  `ship_line1_ct` text,
+  `ship_line2_ct` text,
+  `ship_city` text,
+  `ship_postal_code` text,
+  `ship_ceiling` text,
+  `ship_expires_at` text,
+  `ship_floor_until` text,
+  `ship_rule` text,
+  `bill_name_ct` text,
+  `bill_company_ct` text,
+  `bill_line1_ct` text,
+  `bill_line2_ct` text,
+  `bill_city` text,
+  `bill_postal_code` text,
+  `bill_ceiling` text,
+  `bill_expires_at` text,
+  `bill_floor_until` text,
+  `bill_rule` text,
+  CHECK (`identity_expires_at` IS NULL OR `identity_expires_at` <= `identity_ceiling`),
+  CHECK (`email_expires_at` IS NULL OR `email_expires_at` <= `email_ceiling`),
+  CHECK (`phone_expires_at` IS NULL OR `phone_expires_at` <= `phone_ceiling`),
+  CHECK (`ship_expires_at` IS NULL OR `ship_expires_at` <= `ship_ceiling`),
+  CHECK (`bill_expires_at` IS NULL OR `bill_expires_at` <= `bill_ceiling`),
+  FOREIGN KEY (`tenant_id`, `stage`, `order_id`) REFERENCES `scrappy_commerce_orders` (`tenant_id`, `stage`, `order_id`)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_order_contact_vault_order`
+  ON `order_contact_vault` (`tenant_id`, `stage`, `order_id`) WHERE `order_id` IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX `idx_order_contact_vault_email_bidx`
+  ON `order_contact_vault` (`tenant_id`, `stage`, `email_bidx`) WHERE `email_bidx` IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX `idx_order_contact_vault_phone_bidx`
+  ON `order_contact_vault` (`tenant_id`, `stage`, `phone_bidx`) WHERE `phone_bidx` IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX `idx_order_contact_vault_order_kid` ON `order_contact_vault` (`order_kid`) WHERE `order_kid` IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX `idx_order_contact_vault_bidx_kid` ON `order_contact_vault` (`bidx_kid`) WHERE `bidx_kid` IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX `idx_order_contact_vault_linked` ON `order_contact_vault` (`tenant_id`, `stage`) WHERE `order_id` IS NOT NULL;
+--> statement-breakpoint
+-- A group may only expire sooner (to a non-NULL value) and may only be cleared, never refilled;
+-- its ceiling, floor and rule never change. The one exception is the detach statement (the order
+-- link goes to NULL with every group already empty), which nulls all of them. A blind index takes
+-- a new value only as a rotation recompute: its group still sealed with the same ciphertext and
+-- bidx_kid moving to another kid in the same statement, replacing every index the row holds;
+-- bidx_kid goes to NULL only with both indexes. The order link only ever goes to NULL.
+CREATE TRIGGER `order_contact_vault_shrink_only`
+BEFORE UPDATE ON `order_contact_vault`
+WHEN NEW.`tenant_id` IS NOT OLD.`tenant_id`
+  OR NEW.`stage` IS NOT OLD.`stage`
+  OR NEW.`fact_id` IS NOT OLD.`fact_id`
+  OR NEW.`placed_month` IS NOT OLD.`placed_month`
+  OR (NEW.`order_id` IS NOT NULL AND NEW.`order_id` IS NOT OLD.`order_id`)
+  OR (NEW.`identity_ceiling` IS NOT OLD.`identity_ceiling` AND (NEW.`identity_ceiling` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`identity_floor_until` IS NOT OLD.`identity_floor_until` AND (NEW.`identity_floor_until` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`identity_rule` IS NOT OLD.`identity_rule` AND (NEW.`identity_rule` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`identity_expires_at` IS NOT OLD.`identity_expires_at` AND NOT ((NEW.`identity_expires_at` IS NULL AND (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)) OR (NEW.`identity_expires_at` IS NOT NULL AND OLD.`identity_expires_at` IS NOT NULL AND NEW.`identity_expires_at` < OLD.`identity_expires_at`)))
+  OR (NEW.`email_ceiling` IS NOT OLD.`email_ceiling` AND (NEW.`email_ceiling` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`email_floor_until` IS NOT OLD.`email_floor_until` AND (NEW.`email_floor_until` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`email_rule` IS NOT OLD.`email_rule` AND (NEW.`email_rule` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`email_expires_at` IS NOT OLD.`email_expires_at` AND NOT ((NEW.`email_expires_at` IS NULL AND (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)) OR (NEW.`email_expires_at` IS NOT NULL AND OLD.`email_expires_at` IS NOT NULL AND NEW.`email_expires_at` < OLD.`email_expires_at`)))
+  OR (NEW.`phone_ceiling` IS NOT OLD.`phone_ceiling` AND (NEW.`phone_ceiling` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`phone_floor_until` IS NOT OLD.`phone_floor_until` AND (NEW.`phone_floor_until` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`phone_rule` IS NOT OLD.`phone_rule` AND (NEW.`phone_rule` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`phone_expires_at` IS NOT OLD.`phone_expires_at` AND NOT ((NEW.`phone_expires_at` IS NULL AND (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)) OR (NEW.`phone_expires_at` IS NOT NULL AND OLD.`phone_expires_at` IS NOT NULL AND NEW.`phone_expires_at` < OLD.`phone_expires_at`)))
+  OR (NEW.`ship_ceiling` IS NOT OLD.`ship_ceiling` AND (NEW.`ship_ceiling` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`ship_floor_until` IS NOT OLD.`ship_floor_until` AND (NEW.`ship_floor_until` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`ship_rule` IS NOT OLD.`ship_rule` AND (NEW.`ship_rule` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`ship_expires_at` IS NOT OLD.`ship_expires_at` AND NOT ((NEW.`ship_expires_at` IS NULL AND (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)) OR (NEW.`ship_expires_at` IS NOT NULL AND OLD.`ship_expires_at` IS NOT NULL AND NEW.`ship_expires_at` < OLD.`ship_expires_at`)))
+  OR (NEW.`bill_ceiling` IS NOT OLD.`bill_ceiling` AND (NEW.`bill_ceiling` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`bill_floor_until` IS NOT OLD.`bill_floor_until` AND (NEW.`bill_floor_until` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`bill_rule` IS NOT OLD.`bill_rule` AND (NEW.`bill_rule` IS NOT NULL OR NOT (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)))
+  OR (NEW.`bill_expires_at` IS NOT OLD.`bill_expires_at` AND NOT ((NEW.`bill_expires_at` IS NULL AND (NEW.`order_id` IS NULL AND NEW.`name_ct` IS NULL AND NEW.`company_ct` IS NULL AND NEW.`email_ct` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_ct` IS NULL AND NEW.`phone_bidx` IS NULL AND NEW.`ship_name_ct` IS NULL AND NEW.`ship_company_ct` IS NULL AND NEW.`ship_line1_ct` IS NULL AND NEW.`ship_line2_ct` IS NULL AND NEW.`ship_city` IS NULL AND NEW.`ship_postal_code` IS NULL AND NEW.`bill_name_ct` IS NULL AND NEW.`bill_company_ct` IS NULL AND NEW.`bill_line1_ct` IS NULL AND NEW.`bill_line2_ct` IS NULL AND NEW.`bill_city` IS NULL AND NEW.`bill_postal_code` IS NULL)) OR (NEW.`bill_expires_at` IS NOT NULL AND OLD.`bill_expires_at` IS NOT NULL AND NEW.`bill_expires_at` < OLD.`bill_expires_at`)))
+  OR (NEW.`name_ct` IS NOT NULL AND NEW.`name_ct` IS NOT OLD.`name_ct`)
+  OR (NEW.`company_ct` IS NOT NULL AND NEW.`company_ct` IS NOT OLD.`company_ct`)
+  OR (NEW.`email_ct` IS NOT NULL AND NEW.`email_ct` IS NOT OLD.`email_ct`)
+  OR (NEW.`phone_ct` IS NOT NULL AND NEW.`phone_ct` IS NOT OLD.`phone_ct`)
+  OR (NEW.`ship_name_ct` IS NOT NULL AND NEW.`ship_name_ct` IS NOT OLD.`ship_name_ct`)
+  OR (NEW.`ship_company_ct` IS NOT NULL AND NEW.`ship_company_ct` IS NOT OLD.`ship_company_ct`)
+  OR (NEW.`ship_line1_ct` IS NOT NULL AND NEW.`ship_line1_ct` IS NOT OLD.`ship_line1_ct`)
+  OR (NEW.`ship_line2_ct` IS NOT NULL AND NEW.`ship_line2_ct` IS NOT OLD.`ship_line2_ct`)
+  OR (NEW.`ship_city` IS NOT NULL AND NEW.`ship_city` IS NOT OLD.`ship_city`)
+  OR (NEW.`ship_postal_code` IS NOT NULL AND NEW.`ship_postal_code` IS NOT OLD.`ship_postal_code`)
+  OR (NEW.`bill_name_ct` IS NOT NULL AND NEW.`bill_name_ct` IS NOT OLD.`bill_name_ct`)
+  OR (NEW.`bill_company_ct` IS NOT NULL AND NEW.`bill_company_ct` IS NOT OLD.`bill_company_ct`)
+  OR (NEW.`bill_line1_ct` IS NOT NULL AND NEW.`bill_line1_ct` IS NOT OLD.`bill_line1_ct`)
+  OR (NEW.`bill_line2_ct` IS NOT NULL AND NEW.`bill_line2_ct` IS NOT OLD.`bill_line2_ct`)
+  OR (NEW.`bill_city` IS NOT NULL AND NEW.`bill_city` IS NOT OLD.`bill_city`)
+  OR (NEW.`bill_postal_code` IS NOT NULL AND NEW.`bill_postal_code` IS NOT OLD.`bill_postal_code`)
+  OR (NEW.`email_bidx` IS NOT NULL AND NEW.`email_bidx` IS NOT OLD.`email_bidx` AND NOT (
+       OLD.`email_bidx` IS NOT NULL AND OLD.`email_ct` IS NOT NULL AND NEW.`email_ct` IS OLD.`email_ct`
+       AND OLD.`bidx_kid` IS NOT NULL AND NEW.`bidx_kid` IS NOT NULL AND NEW.`bidx_kid` IS NOT OLD.`bidx_kid`))
+  OR (NEW.`phone_bidx` IS NOT NULL AND NEW.`phone_bidx` IS NOT OLD.`phone_bidx` AND NOT (
+       OLD.`phone_bidx` IS NOT NULL AND OLD.`phone_ct` IS NOT NULL AND NEW.`phone_ct` IS OLD.`phone_ct`
+       AND OLD.`bidx_kid` IS NOT NULL AND NEW.`bidx_kid` IS NOT NULL AND NEW.`bidx_kid` IS NOT OLD.`bidx_kid`))
+  OR (NEW.`order_kid` IS NOT NULL AND NEW.`order_kid` IS NOT OLD.`order_kid`)
+  OR (NEW.`bidx_kid` IS NOT OLD.`bidx_kid` AND NOT (
+       (NEW.`bidx_kid` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_bidx` IS NULL)
+    OR (NEW.`bidx_kid` IS NOT NULL AND OLD.`bidx_kid` IS NOT NULL
+        AND (OLD.`email_bidx` IS NULL OR NEW.`email_bidx` IS NOT OLD.`email_bidx`)
+        AND (OLD.`phone_bidx` IS NULL OR NEW.`phone_bidx` IS NOT OLD.`phone_bidx`)
+        AND (NEW.`email_bidx` IS NOT NULL OR NEW.`phone_bidx` IS NOT NULL))))
+BEGIN
+  SELECT RAISE(ABORT, 'vault-immutable');
+END;
+--> statement-breakpoint
+CREATE TABLE `order_contact_markers` (
+  `tenant_id` text NOT NULL,
+  `stage` text NOT NULL CHECK (stage IN ('preview', 'publication')),
+  `order_id` text NOT NULL,
+  PRIMARY KEY (`tenant_id`, `stage`, `order_id`),
+  FOREIGN KEY (`tenant_id`, `stage`, `order_id`) REFERENCES `scrappy_commerce_orders` (`tenant_id`, `stage`, `order_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `contact_access_audit` (
+  `audit_id` text NOT NULL PRIMARY KEY,
+  `tenant_id` text NOT NULL,
+  `stage` text NOT NULL CHECK (stage IN ('preview', 'publication')),
+  `record_kind` text NOT NULL CHECK (`record_kind` IN ('order-contact', 'contact-message')),
+  `record_id` text,
+  `record_count` integer,
+  `at` text NOT NULL,
+  `actor_id` text NOT NULL,
+  `actor_role` text NOT NULL CHECK (`actor_role` IN ('owner', 'staff')),
+  `reason_code` text,
+  `ticket_ref` text,
+  `action` text NOT NULL CHECK (`action` IN ('read', 'list', 'erase', 'search')),
+  `groups` text,
+  `outcome` text NOT NULL CHECK (`outcome` = 'admitted'),
+  CHECK (`actor_role` = 'owner' OR (`reason_code` IS NOT NULL AND `ticket_ref` IS NOT NULL))
+);
+--> statement-breakpoint
+CREATE INDEX `idx_contact_access_audit_quota` ON `contact_access_audit` (`tenant_id`, `actor_id`, `actor_role`, `at`);
+--> statement-breakpoint
+CREATE TRIGGER `contact_access_audit_no_update`
+BEFORE UPDATE ON `contact_access_audit`
+BEGIN
+  SELECT RAISE(ABORT, 'append-only');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `contact_access_audit_no_delete`
+BEFORE DELETE ON `contact_access_audit`
+BEGIN
+  SELECT RAISE(ABORT, 'append-only');
+END;
+--> statement-breakpoint
+-- contact_messages: every row is kept; legacy plaintext rows stay in legacy_* until the rollout
+-- seals them field by field. New rows are written sealed only.
+CREATE TABLE `contact_messages_v2` (
+  `id` text PRIMARY KEY NOT NULL,
+  `tenant_id` text NOT NULL,
+  `stage` text NOT NULL CHECK (stage IN ('preview', 'publication')),
+  `msg_kid` text,
+  `bidx_kid` text,
+  `name_ct` text,
+  `email_ct` text,
+  `email_bidx` text,
+  `phone_ct` text,
+  `phone_bidx` text,
+  `message_ct` text,
+  `ceiling` text NOT NULL,
+  `expires_at` text NOT NULL CHECK (`expires_at` <= `ceiling`),
+  `time_scale` integer,
+  `rule_version` text,
+  `page_path` text,
+  `status` text NOT NULL DEFAULT 'unread' CHECK (`status` IN ('unread', 'read')),
+  `created_at` text NOT NULL,
+  `read_at` text,
+  `notify_status` text NOT NULL DEFAULT 'pending' CHECK (`notify_status` IN ('pending', 'sent', 'failed')),
+  `notify_attempts` integer NOT NULL DEFAULT 0,
+  `legacy_name` text,
+  `legacy_email` text,
+  `legacy_phone` text,
+  `legacy_message` text,
+  CHECK (`msg_kid` IS NULL OR (`legacy_name` IS NULL AND `legacy_email` IS NULL AND `legacy_phone` IS NULL AND `legacy_message` IS NULL))
+);
+--> statement-breakpoint
+INSERT INTO `contact_messages_v2`
+  (`id`, `tenant_id`, `stage`, `ceiling`, `expires_at`, `page_path`, `status`, `created_at`, `read_at`,
+   `notify_status`, `notify_attempts`, `legacy_name`, `legacy_email`, `legacy_phone`, `legacy_message`)
+SELECT `id`, `tenant_id`, `stage`, `not_after`, `expires_at`, `page_path`, `status`, `created_at`, `read_at`,
+       `notify_status`, `notify_attempts`, `legacy_name`, `legacy_email`, `legacy_phone`, `legacy_message`
+FROM `contact_messages`;
+--> statement-breakpoint
+DROP TABLE `contact_messages`;
+--> statement-breakpoint
+ALTER TABLE `contact_messages_v2` RENAME TO `contact_messages`;
+--> statement-breakpoint
+CREATE INDEX `idx_contact_messages_tenant_stage_created` ON `contact_messages` (`tenant_id`, `stage`, `created_at`);
+--> statement-breakpoint
+CREATE INDEX `idx_contact_messages_tenant_stage_status` ON `contact_messages` (`tenant_id`, `stage`, `status`);
+--> statement-breakpoint
+CREATE INDEX `idx_contact_messages_expires` ON `contact_messages` (`expires_at`);
+--> statement-breakpoint
+CREATE INDEX `idx_contact_messages_legacy` ON `contact_messages` (`id`) WHERE `msg_kid` IS NULL AND `legacy_message` IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX `idx_contact_messages_email_bidx`
+  ON `contact_messages` (`tenant_id`, `stage`, `email_bidx`) WHERE `email_bidx` IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX `idx_contact_messages_phone_bidx`
+  ON `contact_messages` (`tenant_id`, `stage`, `phone_bidx`) WHERE `phone_bidx` IS NOT NULL;
+--> statement-breakpoint
+CREATE TRIGGER `contact_messages_no_plaintext_insert`
+BEFORE INSERT ON `contact_messages`
+WHEN NEW.`legacy_name` IS NOT NULL OR NEW.`legacy_email` IS NOT NULL
+  OR NEW.`legacy_phone` IS NOT NULL OR NEW.`legacy_message` IS NOT NULL
+BEGIN
+  SELECT RAISE(ABORT, 'plaintext-refused');
+END;
+--> statement-breakpoint
+-- Once a row is sealed (msg_kid set) its kid never changes, not even to NULL; its ciphertexts only
+-- go to NULL; a blind index takes a new value only as a rotation recompute (bidx_kid moving to
+-- another kid in the same statement, replacing every index the row holds); and bidx_kid goes to
+-- NULL only with both indexes.
+CREATE TRIGGER `contact_messages_no_plaintext_update`
+BEFORE UPDATE ON `contact_messages`
+WHEN (NEW.`legacy_name` IS NOT NULL AND NEW.`legacy_name` IS NOT OLD.`legacy_name`)
+  OR (NEW.`legacy_email` IS NOT NULL AND NEW.`legacy_email` IS NOT OLD.`legacy_email`)
+  OR (NEW.`legacy_phone` IS NOT NULL AND NEW.`legacy_phone` IS NOT OLD.`legacy_phone`)
+  OR (NEW.`legacy_message` IS NOT NULL AND NEW.`legacy_message` IS NOT OLD.`legacy_message`)
+  OR NEW.`expires_at` > OLD.`expires_at`
+  OR NEW.`ceiling` IS NOT OLD.`ceiling`
+  OR (OLD.`msg_kid` IS NOT NULL AND NEW.`msg_kid` IS NOT OLD.`msg_kid`)
+  OR (OLD.`msg_kid` IS NOT NULL AND (
+       (NEW.`name_ct` IS NOT NULL AND NEW.`name_ct` IS NOT OLD.`name_ct`)
+    OR (NEW.`email_ct` IS NOT NULL AND NEW.`email_ct` IS NOT OLD.`email_ct`)
+    OR (NEW.`phone_ct` IS NOT NULL AND NEW.`phone_ct` IS NOT OLD.`phone_ct`)
+    OR (NEW.`message_ct` IS NOT NULL AND NEW.`message_ct` IS NOT OLD.`message_ct`)
+    OR (NEW.`email_bidx` IS NOT NULL AND NEW.`email_bidx` IS NOT OLD.`email_bidx` AND NOT (
+         OLD.`email_bidx` IS NOT NULL AND OLD.`email_ct` IS NOT NULL AND NEW.`email_ct` IS OLD.`email_ct`
+         AND OLD.`bidx_kid` IS NOT NULL AND NEW.`bidx_kid` IS NOT NULL AND NEW.`bidx_kid` IS NOT OLD.`bidx_kid`))
+    OR (NEW.`phone_bidx` IS NOT NULL AND NEW.`phone_bidx` IS NOT OLD.`phone_bidx` AND NOT (
+         OLD.`phone_bidx` IS NOT NULL AND OLD.`phone_ct` IS NOT NULL AND NEW.`phone_ct` IS OLD.`phone_ct`
+         AND OLD.`bidx_kid` IS NOT NULL AND NEW.`bidx_kid` IS NOT NULL AND NEW.`bidx_kid` IS NOT OLD.`bidx_kid`))
+    OR (NEW.`bidx_kid` IS NOT OLD.`bidx_kid` AND NOT (
+         (NEW.`bidx_kid` IS NULL AND NEW.`email_bidx` IS NULL AND NEW.`phone_bidx` IS NULL)
+      OR (NEW.`bidx_kid` IS NOT NULL AND OLD.`bidx_kid` IS NOT NULL
+          AND (OLD.`email_bidx` IS NULL OR NEW.`email_bidx` IS NOT OLD.`email_bidx`)
+          AND (OLD.`phone_bidx` IS NULL OR NEW.`phone_bidx` IS NOT OLD.`phone_bidx`)
+          AND (NEW.`email_bidx` IS NOT NULL OR NEW.`phone_bidx` IS NOT NULL))))))
+  OR NEW.`tenant_id` IS NOT OLD.`tenant_id`
+  OR NEW.`stage` IS NOT OLD.`stage`
+BEGIN
+  SELECT RAISE(ABORT, 'vault-immutable');
+END;

package/apps/storefront/package.json

@@ -14,7 +14,7 @@
     "preview": "wrangler dev",
     "typecheck": "astro check && tsc --noEmit",
     "astro": "astro",
-    "test": "NODE_OPTIONS=--experimental-sqlite node ../../scripts/vitest-run.mjs run --exclude src/lib/integrations/apps/v84CleanCloneReplay.test.ts --exclude src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts --exclude src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts && NODE_OPTIONS=--experimental-sqlite node ../../scripts/vitest-run.mjs run src/lib/integrations/apps/v84CleanCloneReplay.test.ts src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts --fileParallelism=false && pnpm run test:pipeline && pnpm run test:pipeline-faults",
+    "test": "NODE_OPTIONS=--experimental-sqlite tot-gate vitest run --exclude src/lib/integrations/apps/v84CleanCloneReplay.test.ts --exclude src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts --exclude src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts && NODE_OPTIONS=--experimental-sqlite tot-gate vitest run src/lib/integrations/apps/v84CleanCloneReplay.test.ts src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts --fileParallelism=false && pnpm run test:pipeline && pnpm run test:pipeline-faults",
     "depcruise": "depcruise src --config .runner-dependency-cruiser.cjs"
   },
   "dependencies": {

package/apps/storefront/src/lib/customers/contactVault/blindIndex.ts

@@ -0,0 +1,28 @@
+/**
+ * Blind indexes for exact-match contact search: base64url HMAC-SHA256 of a normalized value under
+ * the tenant's blind-index data key, so equal values match within one tenant and stage and never
+ * across tenants. Normalization is part of the index contract: changing it orphans every stored
+ * index.
+ */
+
+/** Trim, NFKC, lowercase. Null when nothing remains. */
+export function normalizeEmail(value: string): string | null {
+  const normalized = value.trim().normalize("NFKC").toLowerCase();
+  return normalized === "" ? null : normalized;
+}
+
+/** NFKC, then a leading '+' (if the trimmed value starts with one) and ASCII digits only. Null when no digit remains. */
+export function normalizePhone(value: string): string | null {
+  const folded = value.normalize("NFKC").trim();
+  const digits = folded.replace(/[^0-9]/g, "");
+  if (digits === "") return null;
+  return folded.startsWith("+") ? `+${digits}` : digits;
+}
+
+/** base64url (no padding) HMAC-SHA256 of an already-normalized value. */
+export async function blindIndex(hmacKey: CryptoKey, normalized: string): Promise<string> {
+  const mac = new Uint8Array(await crypto.subtle.sign("HMAC", hmacKey, new TextEncoder().encode(normalized) as BufferSource));
+  let binary = "";
+  for (const byte of mac) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}

package/apps/storefront/src/lib/customers/contactVault/contactAudit.ts

@@ -2,12 +2,22 @@
  * The contact access audit (`contact_access_audit`, append-only): every read, list and erase of
  * sealed customer contact writes its row BEFORE anything is decrypted. Staff rows carry the
  * 30-per-hour quota in the same statement, so concurrent reads can never pass it together.
- * Rows hold opaque ids, codes and times only — never a contact field.
+ * Rows hold opaque ids, codes and times only — never a contact field or a searched value. A list
+ * or search row names the record ids it returned (comma-joined in record_id, at most
+ * {@link AUDIT_RECORD_IDS_MAX}) and their count; an erase row names the field groups it cleared.
  */
 
 export type VaultStage = "preview" | "publication";
 
 export const STAFF_READS_PER_HOUR = 30;
+/** The most ids one list or search audit row names; every list and search is capped at or below it. */
+export const AUDIT_RECORD_IDS_MAX = 200;
+
+/** A list or search row's record_id: the returned ids comma-joined, or null when it returned none. */
+export function auditRecordIds(ids: readonly string[]): string | null {
+  if (ids.length > AUDIT_RECORD_IDS_MAX) throw new Error("contact audit: too many record ids");
+  return ids.length === 0 ? null : ids.join(",");
+}
 const HOUR_MS = 3_600_000;
 
 export interface ContactActor {
@@ -36,27 +46,31 @@ export function auditStatement(input: {
   tenantId: string;
   stage: VaultStage;
   recordKind: "order-contact" | "contact-message";
-  recordId: string;
+  recordId: string | null;
+  recordCount?: number;
+  groups?: readonly string[];
   actor: ContactActor;
-  action: "read" | "list" | "erase";
+  action: "read" | "list" | "erase" | "search";
   now: Date;
   requireRow?: AuditStatement;
 }): AuditStatement {
   const { auditId, tenantId, stage, recordKind, recordId, actor, action, now } = input;
+  const recordCount = input.recordCount ?? null;
+  const groups = input.groups && input.groups.length > 0 ? [...input.groups].sort().join(",") : null;
   const hourAgo = new Date(now.getTime() - HOUR_MS).toISOString();
   const params: unknown[] = [
-    auditId, tenantId, stage, recordKind, recordId, now.toISOString(), actor.actorId, actor.role,
+    auditId, tenantId, stage, recordKind, recordId, recordCount, now.toISOString(), actor.actorId, actor.role,
     actor.role === "staff" ? actor.reasonCode ?? null : null,
     actor.role === "staff" ? actor.ticketRef ?? null : null,
-    action,
+    action, groups,
     actor.role, tenantId, actor.actorId, hourAgo, STAFF_READS_PER_HOUR,
   ];
   const requireRow = input.requireRow ? ` AND EXISTS (${input.requireRow.sql})` : "";
   if (input.requireRow) params.push(...input.requireRow.params);
   return {
     sql: `INSERT INTO contact_access_audit
-            (audit_id, tenant_id, stage, record_kind, record_id, at, actor_id, actor_role, reason_code, ticket_ref, action, outcome)
-          SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'admitted'
+            (audit_id, tenant_id, stage, record_kind, record_id, record_count, at, actor_id, actor_role, reason_code, ticket_ref, action, groups, outcome)
+          SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'admitted'
           WHERE (? = 'owner' OR (SELECT COUNT(*) FROM contact_access_audit
                   WHERE tenant_id = ? AND actor_id = ? AND actor_role = 'staff' AND at > ?) < ?)${requireRow}
           RETURNING audit_id`,