@memberjunction/search-engine 6.1.0-edge.4 → 6.1.0-edge.6

package/dist/permissions/SearchScopePermissionResolver.js

@@ -5,7 +5,8 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { RunView } from '@memberjunction/core';
-import { MJGlobal, RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { EscapeSQLString, MJGlobal, RegisterClass, UUIDsEqual } from '@memberjunction/global';
+import { AIEngine } from '@memberjunction/aiengine';
 const LEVEL_RANK = {
     None: 0,
     Read: 1,
@@ -46,6 +47,11 @@ function highestLevel(a, b) {
  * }
  * ```
  *
+ * One caution on that pattern: a stock denial whose Source is 'PrincipalNotActivatable' means
+ * the CALLER may not wield the named principal. An override that widens past it re-opens the
+ * wieldability gate — widen from the user's own entitlements, never on the strength of a
+ * principal the stock resolver just refused.
+ *
  * **Do not pass a priority.** Subclassing the stock resolver is what orders the registration, and
  * it does so more reliably than a number can. `ClassFactory.Register` treats an omitted priority as
  * "one higher than the highest already registered for this (base, key)" — and a subclass cannot be
@@ -73,13 +79,23 @@ export class SearchScopePermissionResolverBase {
  */
 export const SEARCH_SCOPE_PERMISSION_RESOLVER_KEY = 'SearchScopePermissionResolver';
 /**
- * Resolves the effective SearchScope permission for a (user, scope, agent)
- * triple.
+ * Resolves the effective SearchScope permission for a (user, scope, agent, skill)
+ * tuple — plus the caller's tenant (`PrimaryScopeRecordID`), which narrows tenant-scoped grants.
  *
  * Resolution order (later steps only run if the earlier did not produce a
  * definitive answer):
  *
- *   1. Agent.SearchScopeAccess === 'None' → reject (explicit agent-side deny).
+ *   1.  Agent.SearchScopeAccess === 'None' → reject (explicit agent-side deny).
+ *   1b. Agent.SearchScopeAccess === 'Assigned' and this scope is not in its list → reject.
+ *   1c/1d. The SAME two rules for a SKILL principal, deliberately identical in shape.
+ *   1e. A supplied SKILL must be ACTIVATABLE by the caller → otherwise reject.
+ *       This one surprises people, so it is worth stating here rather than only at the code.
+ *       A skill is judged wherever it is NAMED, not only where it grants, because it steers the
+ *       bound through a surface this verdict never sees: SearchParams.AISkillID binds into
+ *       Principals.SkillID, and for a `restricts: true` dimension the expansion query's output IS
+ *       the enforced bound. Judging it only at step 4b would let a user holding their own grant
+ *       (steps 2/3) name any skill and widen with it.
+ *       The AGENT is deliberately NOT judged here — see step 4.
  *   2. Direct grant: a SearchScopePermission row with UserID = user.ID and
  *      SearchScopeID = scope.ID. PermissionLevel = 'None' is an explicit
  *      deny that short-circuits and rejects regardless of role grants.
@@ -87,8 +103,18 @@ export const SEARCH_SCOPE_PERMISSION_RESOLVER_KEY = 'SearchScopePermissionResolv
  *      user's UserRoles. The highest non-None level wins. None entries are
  *      ignored at the role level (see comment below).
  *   4. Agent.SearchScopeAccess === 'All' → allow at Search level (lets
- *      trusted agents act across all scopes when no user-side grant exists).
- *   5. No grant → reject.
+ *      trusted agents act across all scopes when no user-side grant exists), but ONLY if the
+ *      caller may actually run that agent. The agent is judged HERE and not at supply because
+ *      elsewhere AIAgentID is attribution — pre-execution RAG threads it purely for
+ *      SearchExecutionLog — and gating attribution turns an analytics field into an outage.
+ *      A DENIAL here rejects (for the message — 4b would refuse it too). A merely unevaluable agent
+ *      falls through, and is then rejected by 4b if an 'All' skill follows, or by step 5 if not.
+ *      Either way the outcome is a rejection; the distinction survives in the message.
+ *   4b. Skill.SearchScopeAccess === 'All' → allow at Search level, but ONLY with the agent
+ *      positively confirmed. Step 1e is not sufficient here: it vouches for the SKILL, and
+ *      GetSkillsForAgent reads SKILL permissions, which say nothing about whether this caller may
+ *      run the agent the skill would activate on. Both a denial and an unevaluable agent refuse.
+ *   5. No grant → reject, naming the unwieldable 'All' agent if that was the only candidate.
  *
  * The user-direct-None rule (step 2) is intentional: an admin who explicitly
  * denies a user on a scope should not have that decision overridden by a
@@ -135,6 +161,25 @@ let SearchScopePermissionResolver = class SearchScopePermissionResolver extends
             }
             // Restricts but does not grant — the user still needs a per-scope grant below.
         }
+        // Step 1e: A SUPPLIED SKILL MUST BE ACTIVATABLE, WHOEVER ENDS UP GRANTING.
+        //
+        // The agent is judged at step 4, where it widens, because elsewhere it is pure attribution:
+        // the pre-execution RAG path threads AIAgentID only so SearchExecutionLog can attribute the
+        // search, and gating that turns an analytics field into an outage.
+        //
+        // A skill has no such second life. It is supplied for exactly one reason — to STEER — and it
+        // steers through a second surface the permission verdict never sees: `SearchParams.AISkillID`
+        // is bound into `Principals.SkillID` and, for a `restricts: true` dimension, the expansion
+        // query's output IS the enforced bound. Judging it only in the 'All' fallback would leave a
+        // user who holds their own DirectGrant or RoleGrant free to name any skill and widen the bound
+        // with it — the exact "an id a caller merely NAMED" case this gate exists to close, and
+        // perversely the case where a stricter skill is judged and an 'All' skill is not.
+        if (Skill) {
+            const activatable = await this.skillIsActivatable(Agent, Skill, User);
+            if (activatable.ok === false) {
+                return this.buildResult(false, 'None', 'PrincipalNotActivatable', `${activatable.reason} — a skill steers the bound, so it is judged wherever it is named.`);
+            }
+        }
         // Load all SearchScopePermission rows for this scope. We pull the
         // whole set (typically small per scope) and filter in JS so we can
         // apply the user-direct-None short-circuit deterministically.
@@ -161,16 +206,74 @@ let SearchScopePermissionResolver = class SearchScopePermissionResolver extends
             const level = roleGrants.reduce((acc, r) => highestLevel(acc, r.PermissionLevel), 'None');
             return this.buildResult(true, level, 'RoleGrant', `User '${User.Name}' inherits level '${level}' on this scope through role membership.`);
         }
+        // JUDGE THE AGENT ONCE, FOR BOTH FALLBACKS.
+        //
+        // Both 'All' arms widen THROUGH this agent, so both need its verdict — step 4b included,
+        // because a skill that widens does so on the agent it would activate on. Step 1e does NOT
+        // cover that: `GetSkillsForAgent` filters the user's rights on the SKILL, never on the agent.
+        // Without this, an 'All' skill launders an agent the caller may not run.
+        const agentFallbackInPlay = !!Agent
+            && (Agent.SearchScopeAccess === 'All' || Skill?.SearchScopeAccess === 'All');
+        const agentVerdict = agentFallbackInPlay
+            ? await this.agentIsWieldable(Agent, User)
+            : null;
+        // A WIDENING FALLBACK REQUIRES A POSITIVE CONFIRMATION, NOT MERELY THE ABSENCE OF A DENIAL.
+        //
+        // An earlier revision let `kind: 'unavailable'` (agent missing from the metadata cache) fall
+        // through to the skill fallback, reasoning that a cache blip should not refuse a user whose
+        // own grant covered the scope. That reasoning is impossible: steps 2 and 3 RETURN, so a user
+        // with a direct or role grant never reaches a fallback at all. What it actually did was grant
+        // 'Search' on any scope, to a user with NO grant, whenever an agent was absent from the cache
+        // — an admin creating an agent after boot was enough. Fail-open in the one place the module's
+        // own docblock says must fail closed.
+        //
+        // The distinction still earns its keep in the MESSAGE (a load problem reads differently from a
+        // denial) and at step 4, where falling through only ever ends in a refusal anyway.
+        const agentUnconfirmed = agentVerdict && agentVerdict.ok === false ? agentVerdict.reason : null;
+        const agentDenied = agentVerdict && agentVerdict.ok === false && agentVerdict.kind === 'denied'
+            ? agentVerdict.reason : null;
         // Step 4: agent fallback. SearchScopeAccess='All' lets trusted agents
         // operate across scopes when the user has no per-scope grant.
         if (Agent && Agent.SearchScopeAccess === 'All') {
-            return this.buildResult(true, 'Search', 'AgentUnscopedAll', `Agent '${Agent.Name}' has SearchScopeAccess='All'; granting 'Search' as a fallback for this scope.`);
+            // A PRINCIPAL MAY ONLY WIDEN IF THE CALLER MAY WIELD IT.
+            //
+            // This is the one place an agent GRANTS an outcome: by here the user has no direct or
+            // role grant, and 'All' is about to supply one. Elsewhere `Agent` is attribution — the
+            // pre-execution RAG path threads AIAgentID purely so SearchExecutionLog can attribute
+            // the search — so the check belongs HERE and not at the point the id is supplied.
+            // Gating supply instead of grant is what turns an analytics field into an outage.
+            if (agentVerdict?.ok) {
+                return this.buildResult(true, 'Search', 'AgentUnscopedAll', `Agent '${Agent.Name}' has SearchScopeAccess='All'; granting 'Search' as a fallback for this scope.`);
+            }
+            // THIS EARLY RETURN EXISTS FOR THE MESSAGE, NOT FOR THE OUTCOME. A fallen-through
+            // denial is refused anyway — by step 4b when an 'All' skill follows, otherwise by
+            // step 5 — so deleting this block changes no verdict in any combination of agent
+            // access, skill access, wieldability and user grant; only the wording moves. It stays
+            // because "this user may not run agent X" is a better answer than either of those
+            // phrasings.
+            if (agentDenied) {
+                return this.buildResult(false, 'None', 'PrincipalNotActivatable', `Agent '${Agent.Name}' has SearchScopeAccess='All', but ${agentDenied} — the fallback does not apply.`);
+            }
         }
-        // Step 4b: skill fallback, mirroring the agent's 'All'.
+        // Step 4b: skill fallback, mirroring the agent's 'All'. Step 1e already judged the SKILL —
+        // a skill is judged wherever it is named, not only where it grants — but that is not the whole
+        // question here, because this arm WIDENS, and it widens through the agent.
         if (Skill && Skill.SearchScopeAccess === 'All') {
+            // The skill widens through the agent it would activate on, so this fallback needs that
+            // agent positively confirmed. Both an outright denial and an unevaluable one refuse:
+            // step 1e vouches for the SKILL (GetSkillsForAgent reads skill permissions), which says
+            // nothing about whether this caller may run the agent it would activate on.
+            if (agentUnconfirmed) {
+                return this.buildResult(false, 'None', 'PrincipalNotActivatable', `Skill '${Skill.Name}' has SearchScopeAccess='All', but ${agentUnconfirmed} — a skill widens through its agent, so it cannot grant what the agent has not been confirmed to allow.`);
+            }
             return this.buildResult(true, 'Search', 'SkillUnscopedAll', `Skill '${Skill.Name}' has SearchScopeAccess='All'; granting 'Search' as a fallback for this scope.`);
         }
-        // Step 5: no grant.
+        // Step 5: no grant. When an 'All' agent was the only thing that could have granted and it
+        // was refused, say so — otherwise the caller sees a bare 'NoGrant' and cannot tell a missing
+        // permission from an agent that could not be evaluated.
+        if (agentUnconfirmed) {
+            return this.buildResult(false, 'None', 'PrincipalNotActivatable', `Agent '${Agent?.Name}' has SearchScopeAccess='All', but ${agentUnconfirmed} — the fallback does not apply, and no direct or role grant covers this scope.`);
+        }
         return this.buildResult(false, 'None', 'NoGrant', `User '${User.Name}' has no direct grant, no qualifying role grant, and no agent- or skill-side fallback for this scope.`);
     }
     /**
@@ -212,7 +315,7 @@ let SearchScopePermissionResolver = class SearchScopePermissionResolver extends
         const rv = new RunView();
         const result = await rv.RunView({
             EntityName: 'MJ: AI Skill Search Scopes',
-            ExtraFilter: `SkillID='${skillID}' AND SearchScopeID='${searchScopeID}' AND Status='Active'`,
+            ExtraFilter: `SkillID='${EscapeSQLString(skillID)}' AND SearchScopeID='${EscapeSQLString(searchScopeID)}' AND Status='Active'`,
             ResultType: 'simple',
             // Same reasoning as loadPermissionsForScope: a permission decision must never read
             // a stale cache.
@@ -234,7 +337,7 @@ let SearchScopePermissionResolver = class SearchScopePermissionResolver extends
         const rv = new RunView();
         const result = await rv.RunView({
             EntityName: 'MJ: AI Agent Search Scopes',
-            ExtraFilter: `AgentID='${agentID}' AND SearchScopeID='${searchScopeID}' AND Status='Active'`,
+            ExtraFilter: `AgentID='${EscapeSQLString(agentID)}' AND SearchScopeID='${EscapeSQLString(searchScopeID)}' AND Status='Active'`,
             Fields: ['ID'],
             ResultType: 'simple',
             // Same fail-closed semantics as loadPermissionsForScope: a stale
@@ -256,7 +359,7 @@ let SearchScopePermissionResolver = class SearchScopePermissionResolver extends
         const rv = new RunView();
         const result = await rv.RunView({
             EntityName: 'MJ: Search Scope Permissions',
-            ExtraFilter: `SearchScopeID='${searchScopeID}'`,
+            ExtraFilter: `SearchScopeID='${EscapeSQLString(searchScopeID)}'`,
             ResultType: 'simple',
             // Permission decisions must NEVER read stale cache — a freshly-revoked grant
             // or a freshly-granted permission must take effect immediately. Skipping
@@ -271,6 +374,77 @@ let SearchScopePermissionResolver = class SearchScopePermissionResolver extends
         }
         return result.Results ?? [];
     }
+    /**
+     * May this user run this agent? Asked at the WIDENING FALLBACKS — the agent's own
+     * `SearchScopeAccess='All'` arm (step 4) and, because a skill widens through the agent it would
+     * activate on, the skill's `'All'` arm too (step 4b). Not only the agent's own arm: a non-`'All'`
+     * agent still reaches this check when the SKILL is `'All'`. Agent permissions are open by default
+     * (no rows means anyone may run it), so without this an id a caller merely NAMED could grant
+     * `Search`.
+     *
+     * Deliberately NOT asked at the point an `AIAgentID` is supplied: pre-execution RAG threads it
+     * purely so `SearchExecutionLog` can attribute the search, and gating that turns an analytics
+     * field into a retrieval outage.
+     *
+     * A stale metadata cache is reported distinctly. `GetUserAgentPermissions` throws when the agent
+     * is absent from `AIEngine.Instance.Agents` and fails closed to all-false, so an agent created
+     * after the cache loaded would otherwise read as "not permitted" — a metadata-load problem
+     * wearing an authorization message.
+     */
+    async agentIsWieldable(agent, user) {
+        await AIEngine.Instance.Config(false, user);
+        if (!AIEngine.Instance.Agents.some(a => UUIDsEqual(a.ID, agent.ID))) {
+            return { ok: false, kind: 'unavailable', reason: `agent '${agent.Name}' is not in the AI metadata cache, so its permissions cannot be evaluated (a metadata-load problem, not a denial)` };
+        }
+        const perms = await AIEngine.Instance.GetUserAgentPermissions(agent.ID, user);
+        if (!perms?.canRun)
+            return { ok: false, kind: 'denied', reason: `this user may not run agent '${agent.Name}'` };
+        return { ok: true };
+    }
+    /**
+     * Could this caller actually activate this skill on this agent? Asked wherever a skill is NAMED,
+     * because a skill steers the bound from a surface the permission verdict never sees — see step 1e.
+     *
+     * DOES NOT CHECK THE AGENT, AND THAT IS NOT SUFFICIENT ON ITS OWN. `GetSkillsForAgent` is
+     * agent-accepted ∩ agent-granted ∩ Active ∩ user-runnable-ON-THE-SKILL — read it
+     * (`BaseAIEngine.GetSkillsForAgent`): its permission filter is `AISkillPermissionHelper`, the
+     * user's rights on the SKILL. It never consults `AIAgentPermission`. So a user who may not run
+     * the agent still gets a NON-empty list here, because skill permissions are open by default.
+     *
+     * The agent is therefore judged separately, at the fallbacks (steps 4 and 4b), NOT here. That
+     * keeps an agent-side cache problem from refusing a user whose own grant covers the scope.
+     *
+     * It does NOT make this method exempt from the same hazard: step 1e runs BEFORE the grant steps,
+     * so a skill that cannot be confirmed refuses such a user too. That is deliberate — an
+     * unconfirmed skill must not steer the bound — but it is a real availability cost, which is why
+     * the cache case is separated from a denial below and reported as what it is.
+     */
+    async skillIsActivatable(agent, skill, user) {
+        await AIEngine.Instance.Config(false, user);
+        if (!agent)
+            return { ok: false, kind: 'denied', reason: `skill '${skill.Name}' is judged relative to the calling agent, and none was supplied` };
+        // SAME UNAVAILABLE-VS-DENIED DISTINCTION THE AGENT ARM CARRIES, FOR THE SAME REASON.
+        //
+        // `GetSkillsForAgent` reads `_skills` out of the AIEngine cache. A cold (never-loaded) cache yields
+        // an empty list, which is indistinguishable from "this user may not activate that skill" if
+        // you only look at the result. Reporting that as a permission denial sends an operator after
+        // skill grants when the real fault is metadata loading — and because step 1e runs BEFORE the
+        // direct/role grant steps, it is a user with their own grant who gets the misleading message.
+        // Still refuses either way: a skill that cannot be confirmed must not steer the bound.
+        // (A stale-but-LOADED cache is non-empty, so a skill created after boot reports as denied,
+        // not unavailable — the freshness caveat runs the other way from the agent arm's check.)
+        if (AIEngine.Instance.Agents.length === 0) {
+            return { ok: false, kind: 'unavailable', reason: `the AI metadata cache is empty, so skill '${skill.Name}' cannot be evaluated (a metadata-load problem, not a denial)` };
+        }
+        // The declared parameter is the Extended agent entity, but the implementation reads only
+        // `ID` and `AcceptsSkills` — both on the base type — so the cast bridges a declared shape,
+        // not missing data. Revisit if GetSkillsForAgent ever reads Extended-only members.
+        const activatable = AIEngine.Instance.GetSkillsForAgent(agent, user);
+        if (!activatable.some(x => UUIDsEqual(x.ID, skill.ID))) {
+            return { ok: false, kind: 'denied', reason: `skill '${skill.Name}' is not activatable by agent '${agent.Name}' for this user` };
+        }
+        return { ok: true };
+    }
     /** Bundles the result fields together with a closure-bound toSqlPredicate. */
     buildResult(allowed, level, source, reason) {
         return {

package/dist/permissions/SearchScopePermissionResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SearchScopePermissionResolver.js","sourceRoot":"","sources":["../../src/permissions/SearchScopePermissionResolver.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAY,OAAO,EAAY,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAuF7E,MAAM,UAAU,GAA+C;IAC3D,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;CACZ,CAAC;AAEF;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAA6B,EAAE,CAA6B;IAC9E,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,OAAgB,iCAAiC;CAEtD;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,+BAA+B,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,iCAAiC;IAChF;;;OAGG;IACI,KAAK,CAAC,0BAA0B,CAAC,KAA6B;QACjE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;QAE9C,8DAA8D;QAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAC9C,UAAU,KAAK,CAAC,IAAI,8EAA8E,CAAC,CAAC;QAC5G,CAAC;QAED,8EAA8E;QAC9E,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;YACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAC3D,UAAU,KAAK,CAAC,IAAI,kHAAkH,CAAC,CAAC;YAChJ,CAAC;YACD,iEAAiE;YACjE,0DAA0D;QAC9D,CAAC;QAED,wFAAwF;QACxF,qFAAqF;QACrF,2DAA2D;QAC3D,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAC9C,UAAU,KAAK,CAAC,IAAI,8EAA8E,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;YACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAC3D,UAAU,KAAK,CAAC,IAAI,kHAAkH,CAAC,CAAC;YAChJ,CAAC;YACD,+EAA+E;QACnF,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC/E,sFAAsF;QACtF,0FAA0F;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC;QAEhF,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,4DAA4D;YAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,MAAM,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAChD,SAAS,IAAI,CAAC,IAAI,sDAAsD,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC3B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,eAA6C,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAC9C,SAAS,IAAI,CAAC,IAAI,kCAAkC,KAAK,kBAAkB,CAAC,CAAC;QACrF,CAAC;QAED,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM;eACrC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,MAAO,CAAC,CAAC;eACnD,CAAC,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC3B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,eAA6C,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAC5C,SAAS,IAAI,CAAC,IAAI,qBAAqB,KAAK,0CAA0C,CAAC,CAAC;QAChG,CAAC;QAED,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EACtD,UAAU,KAAK,CAAC,IAAI,gFAAgF,CAAC,CAAC;QAC9G,CAAC;QAED,wDAAwD;QACxD,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EACtD,UAAU,KAAK,CAAC,IAAI,gFAAgF,CAAC,CAAC;QAC9G,CAAC;QAED,oBAAoB;QACpB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAC5C,SAAS,IAAI,CAAC,IAAI,uGAAuG,CAAC,CAAC;IACnI,CAAC;IAED;;;;;;OAMG;IACO,gBAAgB,CACtB,IAAqC,EACrC,oBAAmC,EACnC,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,sFAAsF;IAC5E,eAAe,CAAC,GAAkC,EAAE,GAAS;QACnE,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACO,gBAAgB,CAAC,GAAkC,EAAE,oBAAmC;QAC9F,IAAI,CAAC,GAAG,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC,oBAAoB;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,UAAU,CAAC,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,sBAAsB,CAClC,OAAe,EACf,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAA6B;YACxD,UAAU,EAAE,4BAA4B;YACxC,WAAW,EAAE,YAAY,OAAO,wBAAwB,aAAa,uBAAuB;YAC5F,UAAU,EAAE,QAAQ;YACpB,mFAAmF;YACnF,iBAAiB;YACjB,WAAW,EAAE,IAAI;SACpB,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACX,mFAAmF,OAAO,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB,CAClC,OAAe,EACf,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB;YAC5C,UAAU,EAAE,4BAA4B;YACxC,WAAW,EAAE,YAAY,OAAO,wBAAwB,aAAa,uBAAuB;YAC5F,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;YACpB,iEAAiE;YACjE,+DAA+D;YAC/D,aAAa;YACb,WAAW,EAAE,IAAI;SACpB,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACX,mFAAmF,OAAO,WAAW,aAAa,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACtJ,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB,CACnC,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAgC;YAC3D,UAAU,EAAE,8BAA8B;YAC1C,WAAW,EAAE,kBAAkB,aAAa,GAAG;YAC/C,UAAU,EAAE,QAAQ;YACpB,6EAA6E;YAC7E,yEAAyE;YACzE,wEAAwE;YACxE,2EAA2E;YAC3E,WAAW,EAAE,IAAI;SACpB,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,iEAAiE;YACjE,6BAA6B;YAC7B,MAAM,IAAI,KAAK,CACX,uEAAuE,aAAa,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,8EAA8E;IACtE,WAAW,CACf,OAAgB,EAChB,KAAiC,EACjC,MAAmC,EACnC,MAAc;QAEd,OAAO;YACH,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;SAChD,CAAC;IACN,CAAC;CACJ,CAAA;AAxOY,6BAA6B;IADzC,aAAa,CAAC,iCAAiC,EAAE,oCAAoC,CAAC;GAC1E,6BAA6B,CAwOzC;;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,6BAA6B,EAAE,CAAC;AAExF;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC;IAC5C,OAAO,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAChD,iCAAiC,EACjC,oCAAoC,CACvC,IAAI,oCAAoC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"SearchScopePermissionResolver.js","sourceRoot":"","sources":["../../src/permissions/SearchScopePermissionResolver.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAY,OAAO,EAAY,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAwFpD,MAAM,UAAU,GAA+C;IAC3D,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;CACZ,CAAC;AAEF;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAA6B,EAAE,CAA6B;IAC9E,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,OAAgB,iCAAiC;CAEtD;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,+BAA+B,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,iCAAiC;IAChF;;;OAGG;IACI,KAAK,CAAC,0BAA0B,CAAC,KAA6B;QACjE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;QAE9C,8DAA8D;QAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAC9C,UAAU,KAAK,CAAC,IAAI,8EAA8E,CAAC,CAAC;QAC5G,CAAC;QAED,8EAA8E;QAC9E,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;YACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAC3D,UAAU,KAAK,CAAC,IAAI,kHAAkH,CAAC,CAAC;YAChJ,CAAC;YACD,iEAAiE;YACjE,0DAA0D;QAC9D,CAAC;QAED,wFAAwF;QACxF,qFAAqF;QACrF,2DAA2D;QAC3D,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAC9C,UAAU,KAAK,CAAC,IAAI,8EAA8E,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;YACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAC3D,UAAU,KAAK,CAAC,IAAI,kHAAkH,CAAC,CAAC;YAChJ,CAAC;YACD,+EAA+E;QACnF,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,4FAA4F;QAC5F,4FAA4F;QAC5F,mEAAmE;QACnE,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,2FAA2F;QAC3F,4FAA4F;QAC5F,+FAA+F;QAC/F,wFAAwF;QACxF,kFAAkF;QAClF,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACtE,IAAI,WAAW,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAC5D,GAAG,WAAW,CAAC,MAAM,oEAAoE,CAAC,CAAC;YACnG,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC/E,sFAAsF;QACtF,0FAA0F;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC;QAEhF,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,4DAA4D;YAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,MAAM,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAChD,SAAS,IAAI,CAAC,IAAI,sDAAsD,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC3B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,eAA6C,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAC9C,SAAS,IAAI,CAAC,IAAI,kCAAkC,KAAK,kBAAkB,CAAC,CAAC;QACrF,CAAC;QAED,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM;eACrC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,MAAO,CAAC,CAAC;eACnD,CAAC,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC3B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,eAA6C,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAC5C,SAAS,IAAI,CAAC,IAAI,qBAAqB,KAAK,0CAA0C,CAAC,CAAC;QAChG,CAAC;QAED,4CAA4C;QAC5C,EAAE;QACF,yFAAyF;QACzF,0FAA0F;QAC1F,8FAA8F;QAC9F,yEAAyE;QACzE,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK;eAC5B,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,KAAK,EAAE,iBAAiB,KAAK,KAAK,CAAC,CAAC;QACjF,MAAM,YAAY,GAAG,mBAAmB;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAwB,EAAE,IAAI,CAAC;YAC7D,CAAC,CAAC,IAAI,CAAC;QACX,4FAA4F;QAC5F,EAAE;QACF,6FAA6F;QAC7F,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,sCAAsC;QACtC,EAAE;QACF,+FAA+F;QAC/F,mFAAmF;QACnF,MAAM,gBAAgB,GAAG,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,MAAM,WAAW,GAAG,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,KAAK,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ;YAC3F,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAEjC,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC7C,yDAAyD;YACzD,EAAE;YACF,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,kFAAkF;YAClF,kFAAkF;YAClF,IAAI,YAAY,EAAE,EAAE,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EACtD,UAAU,KAAK,CAAC,IAAI,gFAAgF,CAAC,CAAC;YAC9G,CAAC;YACD,kFAAkF;YAClF,kFAAkF;YAClF,iFAAiF;YACjF,sFAAsF;YACtF,kFAAkF;YAClF,aAAa;YACb,IAAI,WAAW,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAC5D,UAAU,KAAK,CAAC,IAAI,sCAAsC,WAAW,iCAAiC,CAAC,CAAC;YAChH,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,+FAA+F;QAC/F,2EAA2E;QAC3E,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC7C,uFAAuF;YACvF,qFAAqF;YACrF,wFAAwF;YACxF,4EAA4E;YAC5E,IAAI,gBAAgB,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAC5D,UAAU,KAAK,CAAC,IAAI,sCAAsC,gBAAgB,yGAAyG,CAAC,CAAC;YAC7L,CAAC;YACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EACtD,UAAU,KAAK,CAAC,IAAI,gFAAgF,CAAC,CAAC;QAC9G,CAAC;QAED,0FAA0F;QAC1F,6FAA6F;QAC7F,wDAAwD;QACxD,IAAI,gBAAgB,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAC5D,UAAU,KAAK,EAAE,IAAI,sCAAsC,gBAAgB,gFAAgF,CAAC,CAAC;QACrK,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAC5C,SAAS,IAAI,CAAC,IAAI,uGAAuG,CAAC,CAAC;IACnI,CAAC;IAED;;;;;;OAMG;IACO,gBAAgB,CACtB,IAAqC,EACrC,oBAAmC,EACnC,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,sFAAsF;IAC5E,eAAe,CAAC,GAAkC,EAAE,GAAS;QACnE,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACO,gBAAgB,CAAC,GAAkC,EAAE,oBAAmC;QAC9F,IAAI,CAAC,GAAG,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC,oBAAoB;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,UAAU,CAAC,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,sBAAsB,CAClC,OAAe,EACf,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAA6B;YACxD,UAAU,EAAE,4BAA4B;YACxC,WAAW,EAAE,YAAY,eAAe,CAAC,OAAO,CAAC,wBAAwB,eAAe,CAAC,aAAa,CAAC,uBAAuB;YAC9H,UAAU,EAAE,QAAQ;YACpB,mFAAmF;YACnF,iBAAiB;YACjB,WAAW,EAAE,IAAI;SACpB,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACX,mFAAmF,OAAO,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB,CAClC,OAAe,EACf,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB;YAC5C,UAAU,EAAE,4BAA4B;YACxC,WAAW,EAAE,YAAY,eAAe,CAAC,OAAO,CAAC,wBAAwB,eAAe,CAAC,aAAa,CAAC,uBAAuB;YAC9H,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;YACpB,iEAAiE;YACjE,+DAA+D;YAC/D,aAAa;YACb,WAAW,EAAE,IAAI;SACpB,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACX,mFAAmF,OAAO,WAAW,aAAa,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACtJ,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB,CACnC,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAgC;YAC3D,UAAU,EAAE,8BAA8B;YAC1C,WAAW,EAAE,kBAAkB,eAAe,CAAC,aAAa,CAAC,GAAG;YAChE,UAAU,EAAE,QAAQ;YACpB,6EAA6E;YAC7E,yEAAyE;YACzE,wEAAwE;YACxE,2EAA2E;YAC3E,WAAW,EAAE,IAAI;SACpB,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,iEAAiE;YACjE,6BAA6B;YAC7B,MAAM,IAAI,KAAK,CACX,uEAAuE,aAAa,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACO,KAAK,CAAC,gBAAgB,CAC5B,KAAsB,EACtB,IAAc;QAEd,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,KAAK,CAAC,IAAI,mHAAmH,EAAE,CAAC;QAC/L,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gCAAgC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;QAChH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACO,KAAK,CAAC,kBAAkB,CAC9B,KAA6B,EAC7B,KAAsB,EACtB,IAAc;QAEd,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,KAAK,CAAC,IAAI,kEAAkE,EAAE,CAAC;QAEjJ,qFAAqF;QACrF,EAAE;QACF,oGAAoG;QACpG,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,8FAA8F;QAC9F,uFAAuF;QACvF,2FAA2F;QAC3F,yFAAyF;QACzF,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,6CAA6C,KAAK,CAAC,IAAI,+DAA+D,EAAE,CAAC;QAC9K,CAAC;QACD,yFAAyF;QACzF,2FAA2F;QAC3F,mFAAmF;QACnF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CACnD,KAAkE,EAAE,IAAI,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,KAAK,CAAC,IAAI,kCAAkC,KAAK,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACpI,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAGD,8EAA8E;IACtE,WAAW,CACf,OAAgB,EAChB,KAAiC,EACjC,MAAmC,EACnC,MAAc;QAEd,OAAO;YACH,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;SAChD,CAAC;IACN,CAAC;CACJ,CAAA;AA5YY,6BAA6B;IADzC,aAAa,CAAC,iCAAiC,EAAE,oCAAoC,CAAC;GAC1E,6BAA6B,CA4YzC;;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,6BAA6B,EAAE,CAAC;AAExF;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC;IAC5C,OAAO,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAChD,iCAAiC,EACjC,oCAAoC,CACvC,IAAI,oCAAoC,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@memberjunction/search-engine",
   "type": "module",
-  "version": "6.1.0-edge.4",
+  "version": "6.1.0-edge.6",
   "description": "MemberJunction: Reusable server-side search engine - vector + full-text + entity search with RRF fusion",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -11,13 +11,13 @@
   "author": "MemberJunction.com",
   "license": "BUSL-1.1",
   "dependencies": {
-    "@memberjunction/ai": "6.1.0-edge.4",
-    "@memberjunction/ai-vectordb": "6.1.0-edge.4",
-    "@memberjunction/aiengine": "6.1.0-edge.4",
-    "@memberjunction/core": "6.1.0-edge.4",
-    "@memberjunction/core-entities": "6.1.0-edge.4",
-    "@memberjunction/global": "6.1.0-edge.4",
-    "@memberjunction/storage": "6.1.0-edge.4",
+    "@memberjunction/ai": "6.1.0-edge.6",
+    "@memberjunction/ai-vectordb": "6.1.0-edge.6",
+    "@memberjunction/aiengine": "6.1.0-edge.6",
+    "@memberjunction/core": "6.1.0-edge.6",
+    "@memberjunction/core-entities": "6.1.0-edge.6",
+    "@memberjunction/global": "6.1.0-edge.6",
+    "@memberjunction/storage": "6.1.0-edge.6",
     "nunjucks": "^3.2.4"
   },
   "optionalDependencies": {