# GESTOR X PRO — FLOW username search correction (isolated)

## Implemented in source

- `src/lib/connectors/flow-reseller-search.server.ts` implements the verified **GET /api/users?username=...&email=&owner_id=** request contract via an injected `authorizedGet` callback.
- Parses `count/page/pages/results`, extracts inert username text from display HTML, strips the `SR` badge, validates numeric ID and ignores contact/action HTML.
- `src/test/flow-reseller-search.test.ts` contains isolated tests with local fixtures.

## Integration boundary — NOT authorized for automatic deployment

This project already has a **Speed Live** import under `https://speedlivem.painelr.top` with separate purpose-bound authorization, fixed transport routes, audit records and access control. The observed FILTER request is for **FLOW** `https://flow.painelr.top`, a *different origin*. It is NOT safe to silently reuse Speed Live session cookies, its authorization grants, origin allowlists or SQL selection logic on FLOW. Accordingly, **no existing Speed Live code, auth workflow, route, DB migrations, UI or production settings was modified**.

To enable live FLOW search, a separately approved, purpose-scoped FLOW backend session and transport must be bound to `authorizedGet(pathAndQuery)`, restricted to read-only `/api/users` with the three observed query parameters; verify the account's authority over the returned record before any manual selection or save. Keep credentials only on server; forbid redirects and cross-origin access, and enforce timeouts/response-size limits. Neither the browser's 200 response nor this module proves backend connectivity. Do not turn on bulk import or WhatsApp charges implicitly.

## How to validate

Run the isolated test with the project's existing Vitest tooling (`vitest run src/test/flow-reseller-search.test.ts`) after installing dependencies. This package is **source-ready, not evidence of successful production authentication**. Do not publish without user approval.