create-mercato-app 0.6.8-develop.6917.1.af45bc96e2 → 0.6.8-develop.6924.1.a8d208fcdc

package/agentic/shared/ai/review-checklist.md

@@ -23,7 +23,7 @@ Apply this checklist in addition to the installed `om-code-review` checklist whe
 ## Encryption, custom fields, search, and extension hosts
 
 - Sensitive fields are declared in `defaultEncryptionMaps`. Reads use `findWithDecryption`, `findOneWithDecryption`, or `findAndCountWithDecryption` with both scoped query filters and the decryption scope; responses, logs, events, exports, cache keys, and indexes do not expose ciphertext or plaintext secrets.
-- Equality lookup uses an explicitly approved hash-only sibling populated by `TenantDataEncryptionService`; direct queries use `lookupHashCandidates(value)` from `@open-mercato/shared/lib/encryption/aes` (or `hashForLookup(value)` only where the installed write contract requires one keyed value), never raw SHA-256 for low-entropy PII. New or changed encryption maps have isolated runtime evidence that reconciliation registered the map and the real write path stored ciphertext. `search.ts` uses a stable entity ID and safe `fieldPolicy`; searchable CRUD writes index after commit, bulk paths reindex deterministically, vector sources have `checksumSource`, token results have `formatResult`, and tests do not wait with arbitrary sleeps.
+- Equality lookup uses an explicitly approved hash-only sibling populated by `TenantDataEncryptionService`; direct queries use `lookupHashCandidates(value)` from `@open-mercato/shared/lib/encryption/aes` (or `hashForLookup(value)` only where the installed write contract requires one keyed value), never raw SHA-256 for low-entropy PII. New or changed encryption maps have isolated runtime evidence that reconciliation registered the map and the real write path stored ciphertext. `search.ts` uses a stable entity ID, safe `fieldPolicy`, and `aclFeatures` naming the owning module's view feature(s) so global search can authorize reads per entity; searchable CRUD writes index after commit, bulk paths reindex deterministically, vector sources have `checksumSource`, token results have `formatResult`, and tests do not wait with arbitrary sleeps.
 - `CrudForm` uses shared helpers, `initialValues.updatedAt`, localized fields/groups/errors, `collectCustomFieldValues`/`entityIds`, explicit null clearing, and conflict surfacing. `DataTable` owns pagination/loading/empty/error/export and uses stable column/action/row-action IDs plus `extensionTableId`.
 - An intentional extensible API host declares an aligned colon-form `enrichers` entity ID. UI injection spots, widgets, interceptors, guards, enrichers, component handles, and menu entries keep stable IDs and demonstrate the complete render/read/save/reload/clear or execute/undo path they claim to support.
 - When AI behavior is requested, use the installed AI framework's discovered agent/tool surfaces rather than a bespoke model client. Tools declare non-empty feature gates, validate inputs, remove transport-only session tokens, handle expired sessions, return serializable data, and route mutations through the same scoped commands, confirmation, optimistic-lock, audit, undo, and post-commit contracts as the API/UI.

package/agentic/shared/ai/skills/om-module-scaffold/references/module-surfaces.md

@@ -9,7 +9,7 @@ Load only the rows the brief requires.
 | ACL/setup | Declare stable resource features such as `<module>.<resources>.view`/`manage` and dependencies as the named `export const features = [...]` in `acl.ts`, followed by `export default features`; generated registry code expects both exports. Export `setup: ModuleSetupConfig = { defaultRoleFeatures, ... }` (plus default when useful) from `setup.ts`; do not rename the `features` export or export `defaultRoleFeatures` as a disconnected top-level map. Keep tenant/default/example seeds idempotent and run ACL sync. |
 | Events | `events.ts` imports `createModuleEvents` from `@open-mercato/shared/modules/events`, declares `const events = [{ id, label, category: 'crud' }] as const` (`category` is `crud`, `lifecycle`, `system`, or `custom`), then exports `createModuleEvents({ moduleId, events })`. It receives one options object, not positional module/event arguments. Use typed stable past-tense IDs before emission and idempotent subscribers; do not invent a shared `lib/events` entrypoint. |
 | Worker/progress | Load `runtime-cache-and-queues.md`; use discovered metadata, scoped/idempotent payloads, bounded concurrency/retry, command writes, and `ProgressJob`. |
-| Search | `search.ts` imports `SearchModuleConfig`/`SearchBuildContext`/`SearchIndexSource`/`SearchResultPresenter` from `@open-mercato/shared/modules/search` and exports `searchConfig`. Its stable colon-form entity uses the exact `entityId` key and declares `fieldPolicy: { searchable: [...], excluded: [...] }`; sensitive values remain excluded and only approved hash siblings support exact lookup. `buildSource(ctx)` returns `{ text: string[], presenter, checksumSource: { record: ctx.record, customFields: ctx.customFields } }`; `formatResult(ctx)` independently derives its presenter from `ctx.record`, and `resolveUrl(ctx)` reads the ID from `ctx.record.id`. `SearchResultPresenter` permits only `title`/`subtitle`/`icon`/`badge` and has no `metadata`; indexed structured values belong in `SearchIndexSource.fields`. CRUD uses `indexer: { entityType }`; bulk writes use the SearchIndexer reindex path. Do not invent `entityType` in `search.ts`, `ctx.presenter`, `ctx.id`, `convergenceKey`, `result`, per-field policy keys, `body`, or `href` aliases. Tests prove delete/reindex deterministic convergence without sleeps. |
+| Search | `search.ts` imports `SearchModuleConfig`/`SearchBuildContext`/`SearchIndexSource`/`SearchResultPresenter` from `@open-mercato/shared/modules/search` and exports `searchConfig`. Its stable colon-form entity uses the exact `entityId` key and declares `fieldPolicy: { searchable: [...], excluded: [...] }`; sensitive values remain excluded and only approved hash siblings support exact lookup. `buildSource(ctx)` returns `{ text: string[], presenter, checksumSource: { record: ctx.record, customFields: ctx.customFields } }`; `formatResult(ctx)` independently derives its presenter from `ctx.record`, and `resolveUrl(ctx)` reads the ID from `ctx.record.id`. Every entity declares `aclFeatures` naming the owning module's view feature(s) — global search and the search AI tools fail closed, so an entity without it is invisible to every non-superadmin. `SearchResultPresenter` permits only `title`/`subtitle`/`icon`/`badge` and has no `metadata`; indexed structured values belong in `SearchIndexSource.fields`. CRUD uses `indexer: { entityType }`; bulk writes use the SearchIndexer reindex path. Do not invent `entityType` in `search.ts`, `ctx.presenter`, `ctx.id`, `convergenceKey`, `result`, per-field policy keys, `body`, or `href` aliases. Tests prove delete/reindex deterministic convergence without sleeps. |
 | Cache | Load `runtime-cache-and-queues.md`; use the DI cache, tenant/org/entity tags, and post-commit invalidation including undo/sub-resource paths. |
 | Notifications | type, renderer, subscriber/handler, ACL, client reactive behavior when needed. |
 | CLI | discovered command, scoped inputs, compiled-package test. |