Guard merchant search delivery and relevance

[next-devin]

Summary

• serve the static /api/search payload explicitly as JSON with MIME-sniffing disabled so the edge can compress it correctly
• retain the 6 MB raw ceiling and add a 750 KB Brotli transfer-size budget, with delivery-header assertions in the same check
• load the real exported Orama database in CI and guard the first-page results for subscription, payment-gateway, and webhook queries
• declare the Orama API used by the check as a direct development dependency

Verification

• npm run build — 286 routes
• npm run check-search-budget — 4.85 MB raw; 0.44 MB local Brotli-11 estimate
• npm run check-search-quality — all three representative queries pass

The edge Content-Encoding header still needs to be confirmed after deployment; the local check intentionally treats Brotli-11 as a deterministic best-case budget estimate rather than proof of Cloudflare behavior.

Closes #35

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nextcommerce-docs	885e7d6	Commit Preview URL Branch Preview URL	Sep 04 2026, 02:15 AM

[next-devin]

Preview verification: /api/search returned HTTP 200 with application/json; charset=utf-8, X-Content-Type-Options: nosniff, Content-Encoding: br, and the intended one-hour cache policy. The measured compressed transfer was 661,553 bytes in 1.75s on a CF cache miss, within the 750 KB guardrail. Production should still be rechecked after merge.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

All 4 issues from the previous review at 0bcabf3 are resolved in 885e7d6:

• @orama/orama is now an explicit devDependency (package.json:30) and locked in package-lock.json.
• The reconstructed Orama placeholder schema is documented (scripts/check-search-quality.mjs:27-28) and confirmed as the same pattern used by the installed Fumadocs static-search client; load() restores the real schema and the three probe queries succeed.
• The delivery-header check now parses _headers into per-route blocks, ignores comments, and requires exactly one /api/search block whose lines match by exact trimmed equality (scripts/check-search-budget.mjs:63-85).
• The Brotli check requests quality 11 explicitly, labels the number a deterministic best-case local estimate, and points readers at the cross-site live-surface check for the production transfer size (scripts/check-search-budget.mjs:11,53-58,91).

No new issues were found in the incremental diff.

Files Reviewed (4 files)

• package.json
• package-lock.json (generated, skipped)
• scripts/check-search-budget.mjs
• scripts/check-search-quality.mjs

Previous Review Summary (commit 0bcabf3)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 0bcabf3)

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
scripts/check-search-quality.mjs	6	@orama/orama is imported but is not declared in package.json; CI's npm ci install will fail if the transitive copy is dropped.
scripts/check-search-quality.mjs	27	Reconstructed Orama schema declares { _: 'string' } (wildcard) but properties: ['content'] is searched; if load() does not restore the schema, all probes return zero hits.
scripts/check-search-budget.mjs	57	Delivery-header check uses raw headers.includes(line) substring matching, so commented lines, more-specific blocks, or unrelated text can silently satisfy the assertion.

SUGGESTION

File	Line	Issue
scripts/check-search-budget.mjs	52	Local Brotli measurement uses zlib's default level (~6), not Cloudflare's Brotli-11; document that the number is an estimate, not the production transfer size.

Files Reviewed (5 files)

• .github/workflows/ci.yml - 0 issues
• package.json - 0 issues
• public/_headers - 0 issues
• scripts/check-search-budget.mjs - 2 issues (WARNING, SUGGESTION)
• scripts/check-search-quality.mjs - 2 issues (WARNING, WARNING)

Fix these issues in Kilo Cloud

---

_{Reviewed by minimax-m3 · Input: 32.6K · Output: 5.9K · Cached: 352.6K}