@memberjunction/search-engine 5.49.0 → 5.50.0

package/dist/generic/ScopeValueEscaper.d.ts

@@ -0,0 +1,112 @@
+/**
+ * @fileoverview Per-lane value escapers — §5.4, "the security core".
+ *
+ * A scope filter is a string template. Every dimension value that reaches it is interpolated into
+ * a syntax with its own quoting rules, and until now nothing escaped anything: an author was
+ * expected to remember. That is the wrong default in both directions — it puts the obligation on
+ * the person least likely to be thinking about injection, and it fails silently when forgotten.
+ *
+ * So escaping here is **automatic and keyed off the lane**, with an explicit, greppable opt-out.
+ * The renderer escapes every interpolated context value for the lane it is rendering into; an
+ * author who genuinely needs a raw value writes `contextRaw.…` instead of `context.…`, which shows
+ * up in a grep and in review.
+ *
+ * WHY DEFAULT-ON IS SAFE TO ADD TO AN EXISTING SYSTEM
+ *
+ * Because §5.4 also prohibits `freetext` in any filter position, a value that reaches a restricting
+ * filter is a uuid, enum, int, iso-date or bool. **None of those grammars can contain a character
+ * any of these escapers would change.** So for every legitimate value the escaper is a no-op, and
+ * existing templates keep rendering byte-for-byte what they rendered before. The escaper only alters
+ * output when a value contains a quote, a backslash or a control character — that is, when something
+ * has already gone wrong. That is what makes this deployable without touching a single template.
+ *
+ * WHY THE EXISTING `json` / `jsoninline` FILTERS CANNOT SERVE
+ *
+ * They escape `"` and `\` — they do not escape `'`, which is the quote character both the SQL and
+ * the OData lanes use. A value passed through `jsoninline` is still perfectly capable of closing a
+ * single-quoted SQL literal.
+ *
+ * @module @memberjunction/search-engine
+ */
+/**
+ * The filter dialect a lane consumes, which determines how a value must be escaped.
+ *
+ * `none` is for positions that are NOT filters — `UserSearchString`, query transforms — where the
+ * value becomes search text rather than syntax, and escaping would corrupt the query rather than
+ * protect it.
+ */
+export type ScopeLaneKind = 'sql' | 'odata' | 'json' | 'filter_by' | 'esdsl' | 'path' | 'none';
+/**
+ * Escape a value for a single-quoted **T-SQL** literal.
+ *
+ * Doubling `'` is the whole of it — SQL Server has no backslash escape, so a backslash is data.
+ * Control characters are stripped rather than encoded: they cannot appear in any permitted value
+ * grammar, and leaving them in a predicate invites parser-level surprises.
+ */
+export declare function EscapeSqlLiteral(value: string): string;
+/**
+ * Escape a value for a single-quoted **OData** string literal (Azure AI Search `$filter`).
+ *
+ * OData v4 also escapes `'` by doubling. Azure additionally treats a backslash as an escape inside
+ * some function arguments, so it is doubled too — harmless for values that contain none, which is
+ * every legitimate value.
+ */
+export declare function EscapeODataLiteral(value: string): string;
+/**
+ * Escape a value for placement inside a double-quoted **JSON** string.
+ *
+ * Deliberately escapes only what JSON requires, without adding the surrounding quotes: templates
+ * write `"{{ context.X }}"` and supply their own. Returning a quoted string here would produce
+ * `""value""` in every existing template.
+ */
+export declare function EscapeJsonValue(value: string): string;
+/**
+ * Escape a value for a **Typesense `filter_by`** clause.
+ *
+ * Neutralises the value delimiter (backtick — Typesense has no documented escape for it, so it is
+ * removed) and the boolean operator sequences `&&` / `||`. Everything else is left alone.
+ *
+ * An earlier version also stripped the character class `[&|:[]()]`, which **corrupted legitimate
+ * values**: an `iso-date` dimension carrying a time (`2026-07-28T10:30:00Z`) came back as
+ * `2026-07-28T103000Z`, so the filter silently matched nothing. Found by probing the "no-op on
+ * legitimate values" claim rather than by review. The contract here mirrors the SQL escaper's:
+ * neutralise the delimiter and assume the template quoted the value, exactly as a SQL template must
+ * supply its own single quotes.
+ */
+export declare function EscapeFilterByLiteral(value: string): string;
+/**
+ * Escape a value for a **storage path segment** (`FolderPath`).
+ *
+ * Path traversal is the risk, not quoting: `..` and both separators are removed so a dimension can
+ * never climb out of the folder its scope confined it to. This is the one escaper that is NOT a
+ * no-op on an otherwise-valid value — a legitimate value simply must not contain a separator.
+ */
+export declare function EscapePathSegment(value: string): string;
+/**
+ * Escape one value for a lane. Non-strings are returned untouched — numbers and booleans have no
+ * syntax to break, and re-typing them to strings here would change how templates render them.
+ */
+export declare function EscapeScopeValue(value: unknown, kind: ScopeLaneKind): unknown;
+/**
+ * Recursively escape every string inside a context value for a lane.
+ *
+ * Arrays are mapped element-wise, which is what makes `{{ ids | join("','") }}` safe: each member
+ * is escaped before the join, so a member cannot terminate the literal and inject a clause.
+ */
+export declare function EscapeScopeValueDeep(value: unknown, kind: ScopeLaneKind): unknown;
+/**
+ * Map a lane's existing `IndexType` to the dialect its filter is written in.
+ *
+ * §5.5 proposed a new `MetadataFilterKind` column for this. It turned out to be unnecessary:
+ * `IndexType` already carries the information — every provider dispatches on it to decide whether a
+ * lane is even theirs — so a second column would be a redundant field to keep in sync, wrong on
+ * every pre-existing row until backfilled, and a new thing for authors to get wrong. Deriving is
+ * strictly better. If a deployment ever needs to override the derivation, THEN add the column as an
+ * override rather than as the source of truth.
+ *
+ * `Other` maps to `json` rather than to `none`: an unknown external index is the case we know least
+ * about, so it gets escaping rather than a pass. Choosing `none` there would mean the least-understood
+ * lane is the only unprotected one.
+ */
+export declare function LaneKindForIndexType(indexType: string | null | undefined): ScopeLaneKind;
+//# sourceMappingURL=ScopeValueEscaper.d.ts.map

package/dist/generic/ScopeValueEscaper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopeValueEscaper.d.ts","sourceRoot":"","sources":["../../src/generic/ScopeValueEscaper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/F;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAeD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAG7E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAQjF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,CASxF"}

package/dist/generic/ScopeValueEscaper.js

@@ -0,0 +1,152 @@
+/**
+ * @fileoverview Per-lane value escapers — §5.4, "the security core".
+ *
+ * A scope filter is a string template. Every dimension value that reaches it is interpolated into
+ * a syntax with its own quoting rules, and until now nothing escaped anything: an author was
+ * expected to remember. That is the wrong default in both directions — it puts the obligation on
+ * the person least likely to be thinking about injection, and it fails silently when forgotten.
+ *
+ * So escaping here is **automatic and keyed off the lane**, with an explicit, greppable opt-out.
+ * The renderer escapes every interpolated context value for the lane it is rendering into; an
+ * author who genuinely needs a raw value writes `contextRaw.…` instead of `context.…`, which shows
+ * up in a grep and in review.
+ *
+ * WHY DEFAULT-ON IS SAFE TO ADD TO AN EXISTING SYSTEM
+ *
+ * Because §5.4 also prohibits `freetext` in any filter position, a value that reaches a restricting
+ * filter is a uuid, enum, int, iso-date or bool. **None of those grammars can contain a character
+ * any of these escapers would change.** So for every legitimate value the escaper is a no-op, and
+ * existing templates keep rendering byte-for-byte what they rendered before. The escaper only alters
+ * output when a value contains a quote, a backslash or a control character — that is, when something
+ * has already gone wrong. That is what makes this deployable without touching a single template.
+ *
+ * WHY THE EXISTING `json` / `jsoninline` FILTERS CANNOT SERVE
+ *
+ * They escape `"` and `\` — they do not escape `'`, which is the quote character both the SQL and
+ * the OData lanes use. A value passed through `jsoninline` is still perfectly capable of closing a
+ * single-quoted SQL literal.
+ *
+ * @module @memberjunction/search-engine
+ */
+/**
+ * Escape a value for a single-quoted **T-SQL** literal.
+ *
+ * Doubling `'` is the whole of it — SQL Server has no backslash escape, so a backslash is data.
+ * Control characters are stripped rather than encoded: they cannot appear in any permitted value
+ * grammar, and leaving them in a predicate invites parser-level surprises.
+ */
+export function EscapeSqlLiteral(value) {
+    return value.replace(/'/g, "''").replace(/[\0\b\n\r\t\x1a]/g, '');
+}
+/**
+ * Escape a value for a single-quoted **OData** string literal (Azure AI Search `$filter`).
+ *
+ * OData v4 also escapes `'` by doubling. Azure additionally treats a backslash as an escape inside
+ * some function arguments, so it is doubled too — harmless for values that contain none, which is
+ * every legitimate value.
+ */
+export function EscapeODataLiteral(value) {
+    return value.replace(/\\/g, '\\\\').replace(/'/g, "''").replace(/[\0\b\n\r\t\x1a]/g, '');
+}
+/**
+ * Escape a value for placement inside a double-quoted **JSON** string.
+ *
+ * Deliberately escapes only what JSON requires, without adding the surrounding quotes: templates
+ * write `"{{ context.X }}"` and supply their own. Returning a quoted string here would produce
+ * `""value""` in every existing template.
+ */
+export function EscapeJsonValue(value) {
+    // JSON.stringify handles quotes, backslashes, control chars and unicode correctly; strip the
+    // quotes it adds so the result drops into an author-supplied pair.
+    const quoted = JSON.stringify(value);
+    return quoted.slice(1, -1);
+}
+/**
+ * Escape a value for a **Typesense `filter_by`** clause.
+ *
+ * Neutralises the value delimiter (backtick — Typesense has no documented escape for it, so it is
+ * removed) and the boolean operator sequences `&&` / `||`. Everything else is left alone.
+ *
+ * An earlier version also stripped the character class `[&|:[]()]`, which **corrupted legitimate
+ * values**: an `iso-date` dimension carrying a time (`2026-07-28T10:30:00Z`) came back as
+ * `2026-07-28T103000Z`, so the filter silently matched nothing. Found by probing the "no-op on
+ * legitimate values" claim rather than by review. The contract here mirrors the SQL escaper's:
+ * neutralise the delimiter and assume the template quoted the value, exactly as a SQL template must
+ * supply its own single quotes.
+ */
+export function EscapeFilterByLiteral(value) {
+    return value.replace(/`/g, '').replace(/&&/g, '').replace(/\|\|/g, '').replace(/[\0\b\n\r\t\x1a]/g, '');
+}
+/**
+ * Escape a value for a **storage path segment** (`FolderPath`).
+ *
+ * Path traversal is the risk, not quoting: `..` and both separators are removed so a dimension can
+ * never climb out of the folder its scope confined it to. This is the one escaper that is NOT a
+ * no-op on an otherwise-valid value — a legitimate value simply must not contain a separator.
+ */
+export function EscapePathSegment(value) {
+    return value.replace(/\.\./g, '').replace(/[/\\]/g, '').replace(/[\0\b\n\r\t\x1a]/g, '');
+}
+/** Escaper for each lane kind. `none`/`esdsl` pass through — see below. */
+const ESCAPERS = {
+    sql: EscapeSqlLiteral,
+    odata: EscapeODataLiteral,
+    json: EscapeJsonValue,
+    filter_by: EscapeFilterByLiteral,
+    path: EscapePathSegment,
+    // Elasticsearch/OpenSearch DSL is JSON, so JSON escaping is the correct rule for it.
+    esdsl: EscapeJsonValue,
+    // Not a filter position: the value becomes query text, and escaping would corrupt the search.
+    none: (v) => v,
+};
+/**
+ * Escape one value for a lane. Non-strings are returned untouched — numbers and booleans have no
+ * syntax to break, and re-typing them to strings here would change how templates render them.
+ */
+export function EscapeScopeValue(value, kind) {
+    if (typeof value !== 'string')
+        return value;
+    return ESCAPERS[kind](value);
+}
+/**
+ * Recursively escape every string inside a context value for a lane.
+ *
+ * Arrays are mapped element-wise, which is what makes `{{ ids | join("','") }}` safe: each member
+ * is escaped before the join, so a member cannot terminate the literal and inject a clause.
+ */
+export function EscapeScopeValueDeep(value, kind) {
+    if (Array.isArray(value))
+        return value.map((v) => EscapeScopeValueDeep(v, kind));
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = EscapeScopeValueDeep(v, kind);
+        return out;
+    }
+    return EscapeScopeValue(value, kind);
+}
+/**
+ * Map a lane's existing `IndexType` to the dialect its filter is written in.
+ *
+ * §5.5 proposed a new `MetadataFilterKind` column for this. It turned out to be unnecessary:
+ * `IndexType` already carries the information — every provider dispatches on it to decide whether a
+ * lane is even theirs — so a second column would be a redundant field to keep in sync, wrong on
+ * every pre-existing row until backfilled, and a new thing for authors to get wrong. Deriving is
+ * strictly better. If a deployment ever needs to override the derivation, THEN add the column as an
+ * override rather than as the source of truth.
+ *
+ * `Other` maps to `json` rather than to `none`: an unknown external index is the case we know least
+ * about, so it gets escaping rather than a pass. Choosing `none` there would mean the least-understood
+ * lane is the only unprotected one.
+ */
+export function LaneKindForIndexType(indexType) {
+    switch (indexType) {
+        case 'AzureAISearch': return 'odata';
+        case 'Typesense': return 'filter_by';
+        case 'Elasticsearch':
+        case 'OpenSearch': return 'esdsl';
+        case 'Vector': return 'json';
+        default: return 'json';
+    }
+}
+//# sourceMappingURL=ScopeValueEscaper.js.map

package/dist/generic/ScopeValueEscaper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopeValueEscaper.js","sourceRoot":"","sources":["../../src/generic/ScopeValueEscaper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAWH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IACzC,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,2EAA2E;AAC3E,MAAM,QAAQ,GAAiD;IAC3D,GAAG,EAAE,gBAAgB;IACrB,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,eAAe;IACrB,SAAS,EAAE,qBAAqB;IAChC,IAAI,EAAE,iBAAiB;IACvB,qFAAqF;IACrF,KAAK,EAAE,eAAe;IACtB,8FAA8F;IAC9F,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,IAAmB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,IAAmB;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,OAAO,GAAG,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAoC;IACrE,QAAQ,SAAS,EAAE,CAAC;QAChB,KAAK,eAAe,CAAC,CAAC,OAAO,OAAO,CAAC;QACrC,KAAK,WAAW,CAAC,CAAC,OAAO,WAAW,CAAC;QACrC,KAAK,eAAe,CAAC;QACrB,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC;QAClC,KAAK,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC;QAC7B,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;IAC3B,CAAC;AACL,CAAC"}

package/dist/generic/SearchEngine.d.ts

@@ -22,7 +22,21 @@
 import { IMetadataProvider, UserInfo } from '@memberjunction/core';
 import { SearchEngineBase } from '@memberjunction/core-entities';
 import { BaseSingleton } from '@memberjunction/global';
-import { SearchParams, SearchResult, SearchResultItem, SearchStreamEvent } from './search.types.js';
+import { SearchParams, SearchResult, SearchResultItem, SearchStreamEvent, ScopePrincipals } from './search.types.js';
+import { ScopeDimensionResolver } from './ScopeDimensionResolver.js';
+import { ScopeExplanation, ExplainScopeInput } from './ScopeExplanation.js';
+/**
+ * Collects lane problems keyed by the lane's **row ID** instead of throwing.
+ *
+ * Present ⇒ the caller is EXPLAINING a hypothetical search and wants every broken lane in one
+ * pass. Absent ⇒ the caller is RUNNING a real search and the first unusable restriction must
+ * abort it, because the alternative is querying that lane unfiltered.
+ *
+ * Keyed by row ID rather than by display name: two `SearchScopeEntity` rows over the SAME
+ * entity is a legitimate configuration (two different `ExtraFilter`s), and keying by the entity
+ * name made them collide — one broken lane then reported its sibling as skipped too.
+ */
+type LaneProblemCollector = Map<string, string>;
 /**
  * Configuration options for the SearchEngine.
  */
@@ -93,10 +107,12 @@ export declare class SearchEngine extends BaseSingleton<SearchEngine> {
     private _defaultMaxResults;
     private _defaultOverfetchFactor;
     /**
-     * Minimum trimmed query length we accept. One- and two-character queries against
-     * a `LIKE '%term%'` fan-out are essentially full-database scans with negligible
+     * Minimum trimmed query length we accept. A single-character query against a
+     * `LIKE '%term%'` fan-out is essentially a full-database scan with negligible
      * relevance — the providers also enforce this, but we short-circuit here to
-     * avoid the cache lookup and provider dispatch overhead too.
+     * avoid the cache lookup and provider dispatch overhead too. Set to 2 (was 3) so
+     * legitimate short queries aren't silently dropped (bug C3); must stay in lockstep
+     * with the providers' MIN_TERM_LENGTH.
      */
     private static readonly MIN_TERM_LENGTH;
     /**
@@ -108,6 +124,12 @@ export declare class SearchEngine extends BaseSingleton<SearchEngine> {
     /** Maximum cached entries across all users. LRU-evicted on overflow. */
     private static readonly CACHE_MAX_ENTRIES;
     private _cache;
+    private _dimensionResolver;
+    /**
+     * Resolver for a scope's declared Search Context dimensions. Overridable so a host can
+     * supply additional derivation sources (e.g. an external signal) without forking the engine.
+     */
+    protected get dimensionResolver(): ScopeDimensionResolver;
     /** Access the cached provider metadata from SearchEngineBase */
     protected get Base(): SearchEngineBase;
     /** Resolve the metadata provider via SearchEngineBase (which extends BaseEngine and tracks ProviderToUse). */
@@ -180,11 +202,50 @@ export declare class SearchEngine extends BaseSingleton<SearchEngine> {
      */
     streamSearch(params: SearchParams, contextUser: UserInfo): AsyncIterable<SearchStreamEvent>;
     /**
-     * Build a stable cache key for a search. Includes the user identity so RLS
-     * scopes never bleed across users, plus the trimmed query, MaxResults,
-     * MinScore, and a deterministic projection of Filters.
+     * Deterministically serialize a value with object keys sorted, so that two
+     * logically-identical inputs always produce the same string.
+     *
+     * `JSON.stringify` preserves *insertion* order, which means a caller that builds
+     * `SecondaryScopes` by spreading (a common pattern) can emit the same dimensions in
+     * different orders across calls. Left unsorted that causes avoidable cache misses;
+     * sorted, identity is stable. Array order is PRESERVED — see buildCacheKey for why
+     * `ScopeIDs` order is significant.
+     */
+    protected stableStringify(value: unknown): string;
+    /**
+     * Build a stable cache key for a search.
+     *
+     * The key must include EVERY input that can change the result set, or the cache
+     * will serve one caller's results to another. Two of those inputs were previously
+     * missing and both are tenancy/authorization-relevant:
+     *
+     *  - `SearchContext` — carries `PrimaryScopeRecordID` (the TENANT) and the
+     *    `SecondaryScopes` dimensions. Omitting it meant a user with access to two
+     *    tenants could be served the other tenant's results for up to the cache TTL,
+     *    and that two searches differing only by dimension (channel, skill, …)
+     *    collided. This is the reason for the fix.
+     *  - `ScopeIDs` — determines which corpora are searched at all.
+     *
+     * Also folded in: `Mode`, `FusionWeightsOverride` and `PermissionOverfetchFactor`
+     * (all change ranking or the candidate pool, so they change results) and
+     * `AIAgentID` (conservative: agent identity participates in scope resolution and
+     * per-agent overrides upstream; including it can only cost a miss, never leak).
+     *
+     * `ScopeIDs` order is deliberately NOT sorted: it is behaviourally significant,
+     * because cross-scope reranker config and budget are taken from the first scope in
+     * the array that supplies one. Two different orderings can therefore produce
+     * different results and must not share a key.
+     *
+     * The whole projection is emitted through `stableStringify` so key-order variation
+     * in `SecondaryScopes` doesn't fragment the cache. The user ID stays as a readable
+     * prefix for debuggability.
+     *
+     * Note this runs AFTER scope resolution in `searchInternal`, so nothing here is
+     * circular. Entitlement is resolved by the CALLERS (`__Scoped_Search`, the
+     * GraphQL resolvers), which deny before reaching the engine; the engine therefore
+     * never caches across an allow/deny boundary.
      */
-    private buildCacheKey;
+    protected buildCacheKey(trimmed: string, params: SearchParams, contextUser: UserInfo): string;
     /** Insert into the LRU cache, evicting oldest entries when over capacity. */
     private cachePut;
     /** Test / admin hook: clear the result cache. */
@@ -200,6 +261,92 @@ export declare class SearchEngine extends BaseSingleton<SearchEngine> {
      * @returns Search result in preview mode
      */
     PreviewSearch(query: string, maxResults: number, contextUser: UserInfo): Promise<SearchResult>;
+    /**
+     * Resolve the entire access chain for one or more scopes and report what a search WOULD be
+     * able to reach — **without querying any provider**.
+     *
+     * This is the answer to a question the platform previously could not answer at all: *"as
+     * this user, with this skill active, for this tenant — what is in bounds?"* Every input to
+     * that decision is transient. A grant applies because a time window is open right now; a
+     * dimension is discarded because it was caller-authored on a `ServerDerived` key; a lane is
+     * skipped because its filter lost an `{% if %}` clause. Afterwards, none of it is visible:
+     * a correctly-bounded result set and an accidentally-widened one look identical.
+     *
+     * Note the distinction from {@link PreviewSearch}, which is a real search capped at a few
+     * results. This runs **no** search — it reports the bound, not a sample of what is inside
+     * it. A sample cannot show you an over-broad bound, because the extra documents it would
+     * newly permit are exactly the ones you did not think to look for.
+     *
+     * Two properties make the output trustworthy:
+     *
+     *  - It takes the **same untrusted `SearchContext` a real caller would send**, so the
+     *    preview shows the anti-spoof discard actually happening. A dry run that only accepted
+     *    pre-sanitized input would hide the one thing worth previewing.
+     *  - It reports **every** broken lane in one pass rather than throwing on the first, so a
+     *    misconfigured scope can be fixed in one sitting instead of one error per re-run.
+     *
+     * Unlike a real search this never throws for a scope-level problem; a scope that would fail
+     * closed comes back with `Reachable: false` and the reason, since "it would have failed"
+     * is precisely the finding the caller asked for.
+     *
+     * @param input   scopes to explain plus the hypothetical caller context and principals
+     * @param contextUser the user to evaluate entitlement for
+     * @returns one explanation per requested scope, in the order requested
+     */
+    ExplainScope(input: ExplainScopeInput, contextUser: UserInfo): Promise<ScopeExplanation[]>;
+    /**
+     * Build the principal set a dimension's expansion query may bind.
+     *
+     * Exists so the real search path and the `ExplainScope` dry run cannot construct principals
+     * differently. They already did once: `ExplainScope` passed the agent and the search path
+     * passed nothing, so any scope deriving its bound from `AgentID` previewed one bound and
+     * searched with another. A single conversion site makes that class of drift unrepresentable
+     * rather than merely fixed.
+     *
+     * Accepts anything carrying the two principal IDs, which both `SearchParams` and
+     * `ExplainScopeInput` do.
+     */
+    protected principalsFrom(source: {
+        AIAgentID?: string | null;
+        AISkillID?: string | null;
+    }): ScopePrincipals;
+    /** Explain a single scope. Never throws — a failure to resolve IS the explanation. */
+    private explainOneScope;
+    /** Resolve entitlement for the dry run, including the skill and tenant principals. */
+    private explainEntitlement;
+    /** Load an agent or skill principal by ID; null when no ID was supplied. */
+    private loadPrincipal;
+    /**
+     * Render every lane and report which would run.
+     *
+     * Reuses `buildScopeConstraints` with a collector rather than duplicating the render logic.
+     * That matters more than it looks: a separate "explain" renderer would be a second
+     * implementation of the guard rules, free to drift from the enforcing one, and a preview
+     * that disagrees with what actually runs is worse than having no preview.
+     */
+    /**
+     * Turn already-built constraints plus a problem map into per-lane explanations.
+     *
+     * Takes the constraints rather than rebuilding them. The previous version called
+     * `buildScopeConstraints` itself, which meant the SEARCH path re-rendered every Nunjucks
+     * template a second time on every scope of every query purely to produce a log record —
+     * pure waste on the hottest path in the engine.
+     *
+     * Both callers still share one rendering pass, which is what keeps the dry run honest:
+     * a separate explain-only renderer would be a second implementation of the guard rules,
+     * free to drift from the enforcing one.
+     */
+    private buildLaneExplanations;
+    /** Render every lane for a DRY RUN, collecting problems instead of throwing on the first. */
+    private explainLanes;
+    /** Every lane, reported as skipped for one shared reason. */
+    private buildAllLanesSkipped;
+    /** Explanation for a scope that is inactive, missing, or otherwise not loadable. */
+    private buildUnresolvableExplanation;
+    /** Parse a lane's required-key contract for display; a malformed one reports as empty. */
+    private safeRequiredKeys;
+    /** Render a filter of unknown shape as a display string. */
+    private stringifyFilter;
     /**
      * Load `ScopeBundle`s for each requested scope ID, filtering out inactive / expired.
      * Returns an empty array when no scope IDs are supplied (caller treats as Global).
@@ -213,6 +360,36 @@ export declare class SearchEngine extends BaseSingleton<SearchEngine> {
      * Assemble a `ScopeConstraints` for a single scope: Nunjucks-render each template
      * field against the `SearchContext`, then hand the rendered values to providers.
      */
+    /**
+     * Fail a search CLOSED when a scope field that RESTRICTS was authored but did not render
+     * usably (see `CheckRenderedTemplate`).
+     *
+     * Throwing rather than dropping the offending row is deliberate. Dropping it would empty
+     * the row collection, and `buildScopeConstraints` collapses an empty collection to
+     * `undefined` — which every provider reads as "unscoped", i.e. all entities / all indexes
+     * with no filter. So the surgical-looking fix is the one that widens; failing the search
+     * is the one that doesn't. A broken restricting template is a misconfiguration and should
+     * be loud and actionable, never silently degraded into a wider search.
+     */
+    protected assertRestrictingTemplateRendered(source: string | null | undefined, rendered: unknown, fieldName: string, scopeLabel: string, rowLabel: string, laneID: string, collector?: LaneProblemCollector): void;
+    /**
+     * Enforce a lane's `RequiredMetadataKeys` contract (Phase E).
+     *
+     * The rendered filter must mention every key the author declared. This is the only guard
+     * that catches a filter which rendered *partially* — where an optional `{% if %}` clause
+     * disappeared because its dimension was absent or discarded, leaving a non-empty filter
+     * that passes every other check while restricting on strictly less than intended.
+     */
+    protected assertRequiredMetadataKeys(declaration: string | null | undefined, laneID: string, rendered: unknown, scopeLabel: string, rowLabel: string, collector?: LaneProblemCollector): void;
+    /**
+     * Route a lane problem to the right place: throw when enforcing a real search, record when
+     * explaining a hypothetical one.
+     *
+     * A dry run must be able to report *every* broken lane in one pass. If it threw on the first
+     * one, an administrator would fix a scope one error at a time, re-running after each — and
+     * the whole point of the preview is to see the entire picture before anything runs.
+     */
+    private reportLaneProblem;
     private buildScopeConstraints;
     /** Resolve the EntityID → EntityName via MJ Metadata (for passing to providers that key by name). */
     private lookupEntityName;
@@ -289,6 +466,8 @@ export declare class SearchEngine extends BaseSingleton<SearchEngine> {
         StartTime: number;
         ContextUser: UserInfo;
         AIAgentID?: string | null;
+        AISkillID?: string | null;
+        PrimaryScopeRecordID?: string | null;
     }): Promise<void>;
     /**
      * Best-effort hook (P3.2) that writes one MJSearchExecutionLog row per
@@ -307,4 +486,5 @@ export declare class SearchEngine extends BaseSingleton<SearchEngine> {
     /** Defensive JSON parse that never throws. Returns `null` on any failure. */
     private parseJson;
 }
+export {};
 //# sourceMappingURL=SearchEngine.d.ts.map

package/dist/generic/SearchEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SearchEngine.d.ts","sourceRoot":"","sources":["../../src/generic/SearchEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAoC,iBAAiB,EAA0C,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAC7I,OAAO,EACH,gBAAgB,EAKnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,aAAa,EAAuC,MAAM,wBAAwB,CAAC;AAC5F,OAAO,EACH,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EASpB,MAAM,gBAAgB,CAAC;AAaxB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gCAAgC,CAAC,EAAE,MAAM,CAAC;CAC7C;AA4BD;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACrC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,KAAK,IAAI,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,YAAa,SAAQ,aAAa,CAAC,YAAY,CAAC;;IAMzD,wDAAwD;IACxD,WAAkB,QAAQ,IAAI,YAAY,CAEzC;IAED,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,kBAAkB,CAAM;IAChC,OAAO,CAAC,uBAAuB,CAAK;IAEpC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAK;IAE5C;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAU;IAE9C,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAO;IAEhD,OAAO,CAAC,MAAM,CAAqE;IAEnF,gEAAgE;IAChE,SAAS,KAAK,IAAI,IAAI,gBAAgB,CAErC;IAED,8GAA8G;IAC9G,SAAS,KAAK,aAAa,IAAI,iBAAiB,CAE/C;IAED;;;;;;;;;;OAUG;IACU,MAAM,CACf,MAAM,EAAE,kBAAuB,EAC/B,WAAW,EAAE,QAAQ,EACrB,YAAY,GAAE,OAAe,GAC9B,OAAO,CAAC,IAAI,CAAC;IAkChB;;;;;;;;;OASG;IACU,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;IAIvF;;;;;OAKG;YACW,cAAc;IAwO5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACW,YAAY,CACtB,MAAM,EAAE,YAAY,EACpB,WAAW,EAAE,QAAQ,GACtB,aAAa,CAAC,iBAAiB,CAAC;IA8GnC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAWrB,6EAA6E;IAC7E,OAAO,CAAC,QAAQ;IAShB,iDAAiD;IAC1C,gBAAgB,IAAI,IAAI;IAI/B;;;;;;;;;OASG;IACU,aAAa,CACtB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAU,EACtB,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,YAAY,CAAC;IAYxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAerB;;OAEG;YACW,kBAAkB;IAmHhC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IA+C7B,qGAAqG;IACrG,OAAO,CAAC,gBAAgB;IAaxB;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;YAQjB,WAAW;IAgDzB;;;OAGG;YACW,kBAAkB;IA6EhC;;;OAGG;YACW,gBAAgB;IAgE9B;;OAEG;IACH,OAAO,CAAC,YAAY;IAyBpB;;;;;;;;;;;;;OAaG;cACa,mBAAmB,CAC/B,OAAO,EAAE,gBAAgB,EAAE,EAC3B,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,gBAAgB,EAAE,CAAC;IA6B9B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAa5B;;;;OAIG;YACW,mBAAmB;IA0CjC;;;OAGG;YACW,wBAAwB;IA2CtC,kCAAkC;IAClC;;;;;;OAMG;IACU,kBAAkB,CAAC,KAAK,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,QAAQ,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBjB;;;;;;;;;OASG;YACW,kBAAkB;IAoDhC,OAAO,CAAC,gBAAgB;IAYxB,kEAAkE;IAClE,OAAO,CAAC,qBAAqB;IAW7B,6EAA6E;IAC7E,OAAO,CAAC,SAAS;CAUpB"}
+{"version":3,"file":"SearchEngine.d.ts","sourceRoot":"","sources":["../../src/generic/SearchEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAoC,iBAAiB,EAA0C,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAC7I,OAAO,EACH,gBAAgB,EAOnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,aAAa,EAAuC,MAAM,wBAAwB,CAAC;AAC5F,OAAO,EACH,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EAUjB,eAAe,EAClB,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACH,gBAAgB,EAChB,iBAAiB,EAGpB,MAAM,oBAAoB,CAAC;AAG5B;;;;;;;;;;GAUG;AACH,KAAK,oBAAoB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAchD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gCAAgC,CAAC,EAAE,MAAM,CAAC;CAC7C;AA4BD;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACrC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,KAAK,IAAI,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,YAAa,SAAQ,aAAa,CAAC,YAAY,CAAC;;IAMzD,wDAAwD;IACxD,WAAkB,QAAQ,IAAI,YAAY,CAEzC;IAED,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,kBAAkB,CAAM;IAChC,OAAO,CAAC,uBAAuB,CAAK;IAEpC;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAK;IAE5C;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAU;IAE9C,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAO;IAEhD,OAAO,CAAC,MAAM,CAAqE;IAEnF,OAAO,CAAC,kBAAkB,CAAgC;IAE1D;;;OAGG;IACH,SAAS,KAAK,iBAAiB,IAAI,sBAAsB,CAExD;IAED,gEAAgE;IAChE,SAAS,KAAK,IAAI,IAAI,gBAAgB,CAErC;IAED,8GAA8G;IAC9G,SAAS,KAAK,aAAa,IAAI,iBAAiB,CAE/C;IAED;;;;;;;;;;OAUG;IACU,MAAM,CACf,MAAM,EAAE,kBAAuB,EAC/B,WAAW,EAAE,QAAQ,EACrB,YAAY,GAAE,OAAe,GAC9B,OAAO,CAAC,IAAI,CAAC;IAkChB;;;;;;;;;OASG;IACU,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;IAIvF;;;;;OAKG;YACW,cAAc;IAoP5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACW,YAAY,CACtB,MAAM,EAAE,YAAY,EACpB,WAAW,EAAE,QAAQ,GACtB,aAAa,CAAC,iBAAiB,CAAC;IA8GnC;;;;;;;;;OASG;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IASjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,GAAG,MAAM;IAkC7F,6EAA6E;IAC7E,OAAO,CAAC,QAAQ;IAShB,iDAAiD;IAC1C,gBAAgB,IAAI,IAAI;IAI/B;;;;;;;;;OASG;IACU,aAAa,CACtB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAU,EACtB,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,YAAY,CAAC;IAYxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAQvG;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,eAAe;IAI3G,sFAAsF;YACxE,eAAe;IAiE7B,sFAAsF;YACxE,kBAAkB;IA6ChC,4EAA4E;YAC9D,aAAa;IAW3B;;;;;;;OAOG;IACH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAiD7B,6FAA6F;IAC7F,OAAO,CAAC,YAAY;IAapB,6DAA6D;IAC7D,OAAO,CAAC,oBAAoB;IA+B5B,oFAAoF;IACpF,OAAO,CAAC,4BAA4B;IA8BpC,0FAA0F;IAC1F,OAAO,CAAC,gBAAgB;IAUxB,4DAA4D;IAC5D,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAerB;;OAEG;YACW,kBAAkB;IA6KhC;;;OAGG;IACH;;;;;;;;;;OAUG;IACH,SAAS,CAAC,iCAAiC,CACvC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,oBAAoB,GACjC,IAAI;IAUP;;;;;;;OAOG;IACH,SAAS,CAAC,0BAA0B,CAChC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,oBAAoB,GACjC,IAAI;IAyBP;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,qBAAqB;IA+E7B,qGAAqG;IACrG,OAAO,CAAC,gBAAgB;IAaxB;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;YAQjB,WAAW;IAgDzB;;;OAGG;YACW,kBAAkB;IA6EhC;;;OAGG;YACW,gBAAgB;IAgE9B;;OAEG;IACH,OAAO,CAAC,YAAY;IAyBpB;;;;;;;;;;;;;OAaG;cACa,mBAAmB,CAC/B,OAAO,EAAE,gBAAgB,EAAE,EAC3B,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,gBAAgB,EAAE,CAAC;IA6B9B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAa5B;;;;OAIG;YACW,mBAAmB;IA0CjC;;;OAGG;YACW,wBAAwB;IA2CtC,kCAAkC;IAClC;;;;;;OAMG;IACU,kBAAkB,CAAC,KAAK,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,QAAQ,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxC,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBjB;;;;;;;;;OASG;YACW,kBAAkB;IAiEhC,OAAO,CAAC,gBAAgB;IAYxB,kEAAkE;IAClE,OAAO,CAAC,qBAAqB;IAW7B,6EAA6E;IAC7E,OAAO,CAAC,SAAS;CAUpB"}