@abhi1693/medusa-rbac 0.0.1 → 0.0.2

package/.medusa/server/src/api/middlewares/enforce-admin-access.js

@@ -3,20 +3,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.enforceAdminAccess = enforceAdminAccess;
 const utils_1 = require("@medusajs/framework/utils");
 const access_control_1 = require("../../modules/access-control");
+const route_facts_1 = require("../../lib/access/route-facts");
+const native_resources_1 = require("../../lib/access/native-resources");
+const resources_1 = require("../../lib/access/resources");
+const permissions_1 = require("../../lib/access/permissions");
 const policy_1 = require("../../lib/access/policy");
 async function enforceAdminAccess(request, res, next) {
     const req = request;
     try {
-        const path = (0, policy_1.normalizedPath)(req.originalUrl);
-        if (!path)
+        if (!(0, route_facts_1.canonicalPath)(req.originalUrl))
             return res
                 .status(403)
                 .json({ message: "Ambiguous Admin path is not allowed" });
-        // This native route verifies its invitation token and accepts an unregistered identity.
-        if (path === "/admin/invites/accept" && req.method === "POST")
-            return next();
-        // Medusa exposes these static capability flags before login; preserve that contract.
-        if (path === "/admin/feature-flags" && ["GET", "HEAD"].includes(req.method))
+        if ((0, native_resources_1.describeNative)(req.method, req.originalUrl, req.body)?.access === "public")
             return next();
         const auth = req.auth_context;
         if (auth?.actor_type !== "user" || !auth.actor_id)
@@ -24,69 +23,58 @@ async function enforceAdminAccess(request, res, next) {
                 .status(401)
                 .json({ message: "An authenticated staff account is required" });
         res.setHeader("Cache-Control", "no-store");
-        const users = req.scope.resolve(utils_1.Modules.USER);
-        await users.retrieveUser(auth.actor_id, { select: ["id"] });
+        await req.scope
+            .resolve(utils_1.Modules.USER)
+            .retrieveUser(auth.actor_id, { select: ["id"] });
         const access = req.scope.resolve(access_control_1.ACCESS_CONTROL);
-        if ((0, policy_1.isSelfProfileUpdate)(req.method, path, auth.actor_id, req.body)) {
-            req.query.fields = "id,email,first_name,last_name,avatar_url";
+        const principal = await access.principal(auth.actor_id);
+        const native = (0, native_resources_1.describeNative)(req.method, req.originalUrl, req.body, auth.actor_id);
+        // The native account lookup and current persisted assignment above establish
+        // Superuser authority. Keep guarded account-deletion redirects below, while
+        // native routes and validators own all other Superuser operations.
+        if ((0, permissions_1.isSuperuser)(principal) && !native?.action.redirect) {
+            const ruleValue = (0, policy_1.nativePromotionRuleValue)(native?.resource || "", native?.params || {}, req.query);
+            if (ruleValue !== undefined) {
+                req.query.value = ruleValue;
+                delete req.query.id;
+            }
             return next();
         }
-        const principal = await access.principal(auth.actor_id);
-        const resource = path.split("/")[2];
-        const selfRead = (0, policy_1.isBootstrapRead)(req.method, path);
-        if (selfRead && path === "/admin/users/me")
-            req.query.fields = "id,email,first_name,last_name,avatar_url";
-        if (selfRead &&
-            path === "/admin/stores" &&
-            (!principal.active ||
-                !access.allows(principal, "settings.view", await access.permissionContext(req))))
-            req.query.fields = "id,name";
-        if (!selfRead && !principal.active)
-            return res
-                .status(403)
-                .json({ message: "Staff access is inactive or has not been assigned" });
-        const policy = access.policyFor(req.method, path);
+        const descriptor = await access.resolveRequest(req);
         const context = await access.permissionContext(req);
         const allowed = (permission) => access.allows(principal, permission, context);
-        if (!policy ||
-            (!selfRead &&
-                (!principal.active ||
-                    (policy.superuser && !principal.is_superuser) ||
-                    !policy.permissions.every(allowed))))
+        if (!descriptor || !(0, resources_1.operationAllowed)(principal, descriptor, allowed))
             return res
                 .status(403)
                 .json({ message: "You do not have permission for this operation" });
-        if (["GET", "HEAD"].includes(req.method) &&
-            !(0, policy_1.validateFieldSelection)(resource, req.query.fields)) {
-            return res
-                .status(403)
-                .json({ message: "This field selection is not allowed" });
-        }
-        if (typeof req.query.fields === "string" &&
-            req.query.fields.includes("inventory") &&
-            !allowed("inventory.view")) {
-            return res
-                .status(403)
-                .json({ message: "Inventory access is required for these fields" });
-        }
-        if (["products", "product-variants"].includes(resource) &&
-            !["GET", "HEAD"].includes(req.method)) {
-            if ((0, policy_1.additionalWritePermissions)(req.body, req.method === "POST" &&
-                (path === "/admin/products" ||
-                    /^\/admin\/products\/[^/]+\/variants$/.test(path))).some((p) => !allowed(p))) {
-                return res.status(403).json({
-                    message: "Additional permissions are required for the changed fields",
-                });
+        if (descriptor.action.forceFields)
+            req.query.fields = descriptor.action.forceFields.join(",");
+        const fallback = descriptor.action.fallbackFields;
+        if (fallback && (!principal.active || !fallback.permissions.every(allowed)))
+            req.query.fields = fallback.fields.join(",");
+        if (["GET", "HEAD"].includes(req.method)) {
+            const ruleValue = (0, policy_1.nativePromotionRuleValue)(descriptor.resource, descriptor.params, req.query);
+            if (ruleValue !== undefined) {
+                req.query.value = ruleValue;
+                delete req.query.id;
             }
+            const fields = (0, policy_1.nativeFieldSelection)(descriptor.fieldResource, req.query.fields);
+            if (fields !== req.query.fields)
+                req.query.fields = fields;
+            if (!(0, policy_1.validateFieldSelection)(descriptor.fieldResource, req.query.fields, descriptor.fields))
+                return res
+                    .status(403)
+                    .json({ message: "This field selection is not allowed" });
         }
-        if (req.method === "DELETE" && /^\/admin\/users\/[^/]+$/.test(path)) {
-            // Keep native Admin actions on the guarded, compensatable public workflow.
-            // 307 preserves DELETE; the destination independently checks authorization.
-            const rawId = req.originalUrl
-                .split("?")[0]
-                .replace(/\/+$/, "")
-                .split("/")[3];
-            return res.redirect(307, `/admin/access/staff/${encodeURIComponent(decodeURIComponent(rawId))}`);
+        if (typeof req.query.fields === "string" &&
+            descriptor.fieldRequirements.some((requirement) => requirement.pattern.test(req.query.fields) &&
+                !requirement.permissions.every(allowed)))
+            return res.status(403).json({
+                message: "Additional permissions are required for these fields",
+            });
+        if (descriptor.action.redirect) {
+            const { destination, parameter } = descriptor.action.redirect;
+            return res.redirect(307, destination.replace(`:${parameter}`, encodeURIComponent(descriptor.params[parameter])));
         }
         return next();
     }
@@ -94,4 +82,4 @@ async function enforceAdminAccess(request, res, next) {
         return next(error);
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5mb3JjZS1hZG1pbi1hY2Nlc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvYXBpL21pZGRsZXdhcmVzL2VuZm9yY2UtYWRtaW4tYWNjZXNzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBa0JBLGdEQWtIQztBQTdIRCxxREFBbUQ7QUFDbkQsaUVBQTZEO0FBRTdELG9EQU1nQztBQUV6QixLQUFLLFVBQVUsa0JBQWtCLENBQ3RDLE9BQXNCLEVBQ3RCLEdBQW1CLEVBQ25CLElBQXdCO0lBRXhCLE1BQU0sR0FBRyxHQUFHLE9BQXFDLENBQUE7SUFDakQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxJQUFJLEdBQUcsSUFBQSx1QkFBYyxFQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQTtRQUM1QyxJQUFJLENBQUMsSUFBSTtZQUNQLE9BQU8sR0FBRztpQkFDUCxNQUFNLENBQUMsR0FBRyxDQUFDO2lCQUNYLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxDQUFDLENBQUE7UUFDN0Qsd0ZBQXdGO1FBQ3hGLElBQUksSUFBSSxLQUFLLHVCQUF1QixJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssTUFBTTtZQUFFLE9BQU8sSUFBSSxFQUFFLENBQUE7UUFDNUUscUZBQXFGO1FBQ3JGLElBQUksSUFBSSxLQUFLLHNCQUFzQixJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDO1lBQ3pFLE9BQU8sSUFBSSxFQUFFLENBQUE7UUFDZixNQUFNLElBQUksR0FBRyxHQUFHLENBQUMsWUFBWSxDQUFBO1FBQzdCLElBQUksSUFBSSxFQUFFLFVBQVUsS0FBSyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUTtZQUMvQyxPQUFPLEdBQUc7aUJBQ1AsTUFBTSxDQUFDLEdBQUcsQ0FBQztpQkFDWCxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsNENBQTRDLEVBQUUsQ0FBQyxDQUFBO1FBQ3BFLEdBQUcsQ0FBQyxTQUFTLENBQUMsZUFBZSxFQUFFLFVBQVUsQ0FBQyxDQUFBO1FBQzFDLE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFxQixlQUFPLENBQUMsSUFBSSxDQUFDLENBQUE7UUFDakUsTUFBTSxLQUFLLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUE7UUFDM0QsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQXVCLCtCQUFjLENBQUMsQ0FBQTtRQUN0RSxJQUFJLElBQUEsNEJBQW1CLEVBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNuRSxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRywwQ0FBMEMsQ0FBQTtZQUM3RCxPQUFPLElBQUksRUFBRSxDQUFBO1FBQ2YsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLE1BQU0sTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUE7UUFDdkQsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtRQUNuQyxNQUFNLFFBQVEsR0FBRyxJQUFBLHdCQUFlLEVBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQTtRQUNsRCxJQUFJLFFBQVEsSUFBSSxJQUFJLEtBQUssaUJBQWlCO1lBQ3hDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLDBDQUEwQyxDQUFBO1FBQy9ELElBQ0UsUUFBUTtZQUNSLElBQUksS0FBSyxlQUFlO1lBQ3hCLENBQUMsQ0FBQyxTQUFTLENBQUMsTUFBTTtnQkFDaEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUNaLFNBQVMsRUFDVCxlQUFlLEVBQ2YsTUFBTSxNQUFNLENBQUMsaUJBQWlCLENBQUMsR0FBRyxDQUFDLENBQ3BDLENBQUM7WUFFSixHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUE7UUFDOUIsSUFBSSxDQUFDLFFBQVEsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNO1lBQ2hDLE9BQU8sR0FBRztpQkFDUCxNQUFNLENBQUMsR0FBRyxDQUFDO2lCQUNYLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxtREFBbUQsRUFBRSxDQUFDLENBQUE7UUFDM0UsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFBO1FBQ2pELE1BQU0sT0FBTyxHQUFHLE1BQU0sTUFBTSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQ25ELE1BQU0sT0FBTyxHQUFHLENBQUMsVUFBa0IsRUFBRSxFQUFFLENBQ3JDLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQTtRQUMvQyxJQUNFLENBQUMsTUFBTTtZQUNQLENBQUMsQ0FBQyxRQUFRO2dCQUNSLENBQUMsQ0FBQyxTQUFTLENBQUMsTUFBTTtvQkFDaEIsQ0FBQyxNQUFNLENBQUMsU0FBUyxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQztvQkFDN0MsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBRXhDLE9BQU8sR0FBRztpQkFDUCxNQUFNLENBQUMsR0FBRyxDQUFDO2lCQUNYLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSwrQ0FBK0MsRUFBRSxDQUFDLENBQUE7UUFDdkUsSUFDRSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQztZQUNwQyxDQUFDLElBQUEsK0JBQXNCLEVBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQ25ELENBQUM7WUFDRCxPQUFPLEdBQUc7aUJBQ1AsTUFBTSxDQUFDLEdBQUcsQ0FBQztpQkFDWCxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUscUNBQXFDLEVBQUUsQ0FBQyxDQUFBO1FBQzdELENBQUM7UUFDRCxJQUNFLE9BQU8sR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtZQUNwQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO1lBQ3RDLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLEVBQzFCLENBQUM7WUFDRCxPQUFPLEdBQUc7aUJBQ1AsTUFBTSxDQUFDLEdBQUcsQ0FBQztpQkFDWCxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsK0NBQStDLEVBQUUsQ0FBQyxDQUFBO1FBQ3ZFLENBQUM7UUFDRCxJQUNFLENBQUMsVUFBVSxFQUFFLGtCQUFrQixDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztZQUNuRCxDQUFDLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQ3JDLENBQUM7WUFDRCxJQUNFLElBQUEsbUNBQTBCLEVBQ3hCLEdBQUcsQ0FBQyxJQUFJLEVBQ1IsR0FBRyxDQUFDLE1BQU0sS0FBSyxNQUFNO2dCQUNuQixDQUFDLElBQUksS0FBSyxpQkFBaUI7b0JBQ3pCLHNDQUFzQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUN2RCxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFDMUIsQ0FBQztnQkFDRCxPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDO29CQUMxQixPQUFPLEVBQUUsNERBQTREO2lCQUN0RSxDQUFDLENBQUE7WUFDSixDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUkseUJBQXlCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDcEUsMkVBQTJFO1lBQzNFLDRFQUE0RTtZQUM1RSxNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsV0FBVztpQkFDMUIsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztpQkFDYixPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztpQkFDbkIsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFBO1lBQ2hCLE9BQU8sR0FBRyxDQUFDLFFBQVEsQ0FDakIsR0FBRyxFQUNILHVCQUF1QixrQkFBa0IsQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQ3ZFLENBQUE7UUFDSCxDQUFDO1FBQ0QsT0FBTyxJQUFJLEVBQUUsQ0FBQTtJQUNmLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDcEIsQ0FBQztBQUNILENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5mb3JjZS1hZG1pbi1hY2Nlc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvYXBpL21pZGRsZXdhcmVzL2VuZm9yY2UtYWRtaW4tYWNjZXNzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBb0JBLGdEQWlIQztBQTlIRCxxREFBbUQ7QUFDbkQsaUVBQTZEO0FBRTdELDhEQUE0RDtBQUM1RCx3RUFBa0U7QUFDbEUsMERBQTZEO0FBQzdELDhEQUEwRDtBQUMxRCxvREFJZ0M7QUFFekIsS0FBSyxVQUFVLGtCQUFrQixDQUN0QyxPQUFzQixFQUN0QixHQUFtQixFQUNuQixJQUF3QjtJQUV4QixNQUFNLEdBQUcsR0FBRyxPQUFxQyxDQUFBO0lBQ2pELElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxJQUFBLDJCQUFhLEVBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQztZQUNqQyxPQUFPLEdBQUc7aUJBQ1AsTUFBTSxDQUFDLEdBQUcsQ0FBQztpQkFDWCxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUscUNBQXFDLEVBQUUsQ0FBQyxDQUFBO1FBQzdELElBQ0UsSUFBQSxpQ0FBYyxFQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLFdBQVcsRUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsTUFBTSxLQUFLLFFBQVE7WUFFMUUsT0FBTyxJQUFJLEVBQUUsQ0FBQTtRQUNmLE1BQU0sSUFBSSxHQUFHLEdBQUcsQ0FBQyxZQUFZLENBQUE7UUFDN0IsSUFBSSxJQUFJLEVBQUUsVUFBVSxLQUFLLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRO1lBQy9DLE9BQU8sR0FBRztpQkFDUCxNQUFNLENBQUMsR0FBRyxDQUFDO2lCQUNYLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSw0Q0FBNEMsRUFBRSxDQUFDLENBQUE7UUFDcEUsR0FBRyxDQUFDLFNBQVMsQ0FBQyxlQUFlLEVBQUUsVUFBVSxDQUFDLENBQUE7UUFDMUMsTUFBTSxHQUFHLENBQUMsS0FBSzthQUNaLE9BQU8sQ0FBcUIsZUFBTyxDQUFDLElBQUksQ0FBQzthQUN6QyxZQUFZLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQTtRQUNsRCxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBdUIsK0JBQWMsQ0FBQyxDQUFBO1FBQ3RFLE1BQU0sU0FBUyxHQUFHLE1BQU0sTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUE7UUFDdkQsTUFBTSxNQUFNLEdBQUcsSUFBQSxpQ0FBYyxFQUMzQixHQUFHLENBQUMsTUFBTSxFQUNWLEdBQUcsQ0FBQyxXQUFXLEVBQ2YsR0FBRyxDQUFDLElBQUksRUFDUixJQUFJLENBQUMsUUFBUSxDQUNkLENBQUE7UUFFRCw2RUFBNkU7UUFDN0UsNEVBQTRFO1FBQzVFLG1FQUFtRTtRQUNuRSxJQUFJLElBQUEseUJBQVcsRUFBQyxTQUFTLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDdkQsTUFBTSxTQUFTLEdBQUcsSUFBQSxpQ0FBd0IsRUFDeEMsTUFBTSxFQUFFLFFBQVEsSUFBSSxFQUFFLEVBQ3RCLE1BQU0sRUFBRSxNQUFNLElBQUksRUFBRSxFQUNwQixHQUFHLENBQUMsS0FBSyxDQUNWLENBQUE7WUFDRCxJQUFJLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDNUIsR0FBRyxDQUFDLEtBQUssQ0FBQyxLQUFLLEdBQUcsU0FBUyxDQUFBO2dCQUMzQixPQUFPLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFBO1lBQ3JCLENBQUM7WUFDRCxPQUFPLElBQUksRUFBRSxDQUFBO1FBQ2YsQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFHLE1BQU0sTUFBTSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUNuRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUNuRCxNQUFNLE9BQU8sR0FBRyxDQUFDLFVBQWtCLEVBQUUsRUFBRSxDQUNyQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUE7UUFDL0MsSUFBSSxDQUFDLFVBQVUsSUFBSSxDQUFDLElBQUEsNEJBQWdCLEVBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUM7WUFDbEUsT0FBTyxHQUFHO2lCQUNQLE1BQU0sQ0FBQyxHQUFHLENBQUM7aUJBQ1gsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLCtDQUErQyxFQUFFLENBQUMsQ0FBQTtRQUN2RSxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsV0FBVztZQUMvQixHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUE7UUFDNUQsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUE7UUFDakQsSUFBSSxRQUFRLElBQUksQ0FBQyxDQUFDLFNBQVMsQ0FBQyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN6RSxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUM5QyxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUN6QyxNQUFNLFNBQVMsR0FBRyxJQUFBLGlDQUF3QixFQUN4QyxVQUFVLENBQUMsUUFBUSxFQUNuQixVQUFVLENBQUMsTUFBTSxFQUNqQixHQUFHLENBQUMsS0FBSyxDQUNWLENBQUE7WUFDRCxJQUFJLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDNUIsR0FBRyxDQUFDLEtBQUssQ0FBQyxLQUFLLEdBQUcsU0FBUyxDQUFBO2dCQUMzQixPQUFPLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFBO1lBQ3JCLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFBLDZCQUFvQixFQUNqQyxVQUFVLENBQUMsYUFBYSxFQUN4QixHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FDakIsQ0FBQTtZQUNELElBQUksTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTTtnQkFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUE7WUFDMUQsSUFDRSxDQUFDLElBQUEsK0JBQXNCLEVBQ3JCLFVBQVUsQ0FBQyxhQUFhLEVBQ3hCLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUNoQixVQUFVLENBQUMsTUFBTSxDQUNsQjtnQkFFRCxPQUFPLEdBQUc7cUJBQ1AsTUFBTSxDQUFDLEdBQUcsQ0FBQztxQkFDWCxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUscUNBQXFDLEVBQUUsQ0FBQyxDQUFBO1FBQy9ELENBQUM7UUFDRCxJQUNFLE9BQU8sR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtZQUNwQyxVQUFVLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUMvQixDQUFDLFdBQVcsRUFBRSxFQUFFLENBQ2QsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFnQixDQUFDO2dCQUNwRCxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUMxQztZQUVELE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7Z0JBQzFCLE9BQU8sRUFBRSxzREFBc0Q7YUFDaEUsQ0FBQyxDQUFBO1FBQ0osSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQy9CLE1BQU0sRUFBRSxXQUFXLEVBQUUsU0FBUyxFQUFFLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUE7WUFDN0QsT0FBTyxHQUFHLENBQUMsUUFBUSxDQUNqQixHQUFHLEVBQ0gsV0FBVyxDQUFDLE9BQU8sQ0FDakIsSUFBSSxTQUFTLEVBQUUsRUFDZixrQkFBa0IsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQ2pELENBQ0YsQ0FBQTtRQUNILENBQUM7UUFDRCxPQUFPLElBQUksRUFBRSxDQUFBO0lBQ2YsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNwQixDQUFDO0FBQ0gsQ0FBQyJ9

package/.medusa/server/src/index.d.ts

@@ -3,6 +3,7 @@ export { default as AccessControlService } from "./modules/access-control/servic
 export * from "./lib/access/permissions";
 export * from "./lib/access/config";
 export * from "./lib/access/roles";
+export * from "./resources";
 export { requirePermission, requireAnyPermission, } from "./lib/access/middleware";
 export { definePermission } from "./lib/access/define-permission";
 export { explainPermission } from "./lib/access/explain";

package/.medusa/server/src/index.js

@@ -25,6 +25,7 @@ Object.defineProperty(exports, "AccessControlService", { enumerable: true, get:
 __exportStar(require("./lib/access/permissions"), exports);
 __exportStar(require("./lib/access/config"), exports);
 __exportStar(require("./lib/access/roles"), exports);
+__exportStar(require("./resources"), exports);
 var middleware_1 = require("./lib/access/middleware");
 Object.defineProperty(exports, "requirePermission", { enumerable: true, get: function () { return middleware_1.requirePermission; } });
 Object.defineProperty(exports, "requireAnyPermission", { enumerable: true, get: function () { return middleware_1.requireAnyPermission; } });
@@ -32,4 +33,4 @@ var define_permission_1 = require("./lib/access/define-permission");
 Object.defineProperty(exports, "definePermission", { enumerable: true, get: function () { return define_permission_1.definePermission; } });
 var explain_1 = require("./lib/access/explain");
 Object.defineProperty(exports, "explainPermission", { enumerable: true, get: function () { return explain_1.explainPermission; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyREFBeUQ7QUFBaEQsZ0hBQUEsY0FBYyxPQUFBO0FBQ3ZCLDREQUFrRjtBQUF6RSxnSUFBQSxPQUFPLE9BQXdCO0FBQ3hDLDJEQUF3QztBQUN4QyxzREFBbUM7QUFDbkMscURBQWtDO0FBQ2xDLHNEQUdnQztBQUY5QiwrR0FBQSxpQkFBaUIsT0FBQTtBQUNqQixrSEFBQSxvQkFBb0IsT0FBQTtBQUV0QixvRUFBaUU7QUFBeEQscUhBQUEsZ0JBQWdCLE9BQUE7QUFDekIsZ0RBQXdEO0FBQS9DLDRHQUFBLGlCQUFpQixPQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyREFBeUQ7QUFBaEQsZ0hBQUEsY0FBYyxPQUFBO0FBQ3ZCLDREQUFrRjtBQUF6RSxnSUFBQSxPQUFPLE9BQXdCO0FBQ3hDLDJEQUF3QztBQUN4QyxzREFBbUM7QUFDbkMscURBQWtDO0FBQ2xDLDhDQUEyQjtBQUMzQixzREFHZ0M7QUFGOUIsK0dBQUEsaUJBQWlCLE9BQUE7QUFDakIsa0hBQUEsb0JBQW9CLE9BQUE7QUFFdEIsb0VBQWlFO0FBQXhELHFIQUFBLGdCQUFnQixPQUFBO0FBQ3pCLGdEQUF3RDtBQUEvQyw0R0FBQSxpQkFBaUIsT0FBQSJ9

package/.medusa/server/src/lib/access/config.d.ts

@@ -1,6 +1,7 @@
 import type { MedusaRequest } from "@medusajs/framework/http";
 import { type AccessPrincipal } from "./permissions";
 import { type Policy } from "./policy";
+import { type OperationDescriptor, type ResourceDefinition } from "./resources";
 import { type RoleDefinition, type ConfiguredRoleDefinition } from "./roles";
 import type { ActorProvider } from "./actors";
 export type PermissionDefinition = readonly [
@@ -26,6 +27,8 @@ export type AccessControlOptions = {
     roles?: readonly RoleDefinition[];
     /** Explicit policies for custom APIs. Native/management policies take precedence. */
     routes?: RoutePolicy[];
+    /** Structural capability registrations for application/plugin-owned APIs. */
+    resources?: readonly ResourceDefinition[];
     contextResolvers?: ((request: MedusaRequest) => PermissionContext | Promise<PermissionContext>)[];
     /** Resolvers for custom APIs only. The Admin API always requires a native user. */
     actors?: ActorProvider[];
@@ -35,8 +38,11 @@ export declare function createAccessConfig(options?: AccessControlOptions): {
     roles: ConfiguredRoleDefinition[];
     ids: string[];
     actors: ActorProvider[];
+    resources: ResourceDefinition[];
     contextResolvers: ((request: MedusaRequest) => PermissionContext | Promise<PermissionContext>)[];
+    /** Structural inspection only. Enforce resolveRequest(request) with operationAllowed. */
     policyFor(method: string, path: string): Policy | null;
+    resolveRequest(request: MedusaRequest): Promise<OperationDescriptor | null>;
 };
 export declare function validateRules(value: unknown, ids: readonly string[]): PermissionRule[];
 /** Priority, then exact key/namespace specificity, then condition count, then deny. */

package/.medusa/server/src/lib/access/config.js

@@ -8,10 +8,13 @@ exports.validateRules = validateRules;
 exports.evaluatePermission = evaluatePermission;
 const native_routes_json_1 = __importDefault(require("./native-routes.json"));
 const permissions_1 = require("./permissions");
-const policy_1 = require("./policy");
+const native_resources_1 = require("./native-resources");
+const route_facts_1 = require("./route-facts");
+const resources_1 = require("./resources");
 const permission_key_1 = require("./permission-key");
 const roles_1 = require("./roles");
 const explain_1 = require("./explain");
+const immutable_config_1 = require("./immutable-config");
 function createAccessConfig(options = {}) {
     const permissions = [...permissions_1.PERMISSIONS];
     const ids = new Set(permissions.map(([id]) => id));
@@ -55,7 +58,7 @@ function createAccessConfig(options = {}) {
     });
     const nativeRoots = new Set(native_routes_json_1.default.map((route) => route.path.split("/")[2]));
     const signatures = new Set();
-    const routes = (options.routes || []).map((route) => {
+    const routes = (0, immutable_config_1.immutableConfig)((options.routes || []).map((route) => {
         const method = route.method.toUpperCase();
         const signature = `${method} ${route.path}`;
         if (!/^(GET|POST|PUT|PATCH|DELETE)$/.test(method) ||
@@ -68,9 +71,70 @@ function createAccessConfig(options = {}) {
         return {
             ...route,
             method,
-            pattern: new RegExp(`^${route.path.replace(/:[a-z][a-z0-9_]*/g, "[^/]+")}$`),
         };
-    });
+    }));
+    const resources = (0, resources_1.validateResources)(options.resources || [], [...ids], [
+        ...native_resources_1.nativeResources,
+        ...[...nativeRoots].map((root) => ({ key: root, root })),
+        ...routes.map((route) => {
+            const parts = route.path.split("/");
+            return { key: parts[2], root: parts[2], namespace: parts[1] };
+        }),
+    ]);
+    const resourceMatcher = (0, route_facts_1.createRouteMatcher)(resources.flatMap(resources_1.resourceRoutes));
+    const configuredMatcher = (0, route_facts_1.createRouteMatcher)(routes.map((route) => ({ path: route.path, methods: [route.method] })));
+    const resourceOwners = new Set(resources.map((resource) => `${resource.namespace || "admin"}/${resource.root}`));
+    const reserved = (url) => {
+        const path = (0, route_facts_1.canonicalPath)(url);
+        if (!path)
+            return true;
+        const parts = path.toLowerCase().split("/");
+        return (parts[1] === "admin" &&
+            (nativeRoots.has(parts[2]) ||
+                native_resources_1.nativeResources.some((resource) => resource.root === parts[2]) ||
+                [
+                    "rbac",
+                    "workflows",
+                    "workflow-executions",
+                    "api-keys",
+                    "search",
+                    "search-indexes",
+                ].includes(parts[2])));
+    };
+    const custom = (method, url, body, actorId) => {
+        if (reserved(url))
+            return null;
+        const facts = resourceMatcher(method, url);
+        if (facts) {
+            const resource = resources.find((resource) => resource.root === facts.root &&
+                (resource.namespace || "admin") === facts.namespace);
+            return (0, resources_1.describeResource)(resource, facts, body, actorId);
+        }
+        const parts = (0, route_facts_1.canonicalPath)(url).toLowerCase().split("/");
+        if (resourceOwners.has(`${parts[1]}/${parts[2]}`))
+            return null;
+        const route = configuredMatcher(method, url);
+        if (!route)
+            return null;
+        const policy = routes.find((policy) => policy.path === route.template && policy.method === route.method);
+        return {
+            facts: route,
+            resource: route.root,
+            operation: "configured",
+            scope: "global",
+            params: route.params,
+            fieldResource: route.root,
+            actorTypes: ["user"],
+            access: "active-principal",
+            self: false,
+            policy: {
+                permissions: [...policy.permissions],
+                ...(policy.superuser ? { superuser: true } : {}),
+            },
+            action: { operation: "configured" },
+            fieldRequirements: [],
+        };
+    };
     const actors = options.actors || [];
     if (new Set(actors.map((actor) => actor.type)).size !== actors.length ||
         actors.some((actor) => !actor.type ||
@@ -83,18 +147,50 @@ function createAccessConfig(options = {}) {
         roles,
         ids: [...ids],
         actors,
+        resources,
         contextResolvers: options.contextResolvers || [],
+        /** Structural inspection only. Enforce resolveRequest(request) with operationAllowed. */
         policyFor(method, path) {
-            const native = (0, policy_1.policyFor)(method, path);
-            if (native)
-                return native;
-            // Never reopen native APIs or the access-management namespace with an extension.
-            if (/^\/admin\/(?:access|rbac|users|invites|workflows|workflow-executions|api-keys|search|search-indexes)(?:\/|$)/.test(path))
-                return null;
-            if (path.startsWith("/admin/") && nativeRoots.has(path.split("/")[2]))
+            return (((0, native_resources_1.describeNative)(method, path, {}) || custom(method, path, {}))
+                ?.policy || null);
+        },
+        async resolveRequest(request) {
+            const actorId = request
+                .auth_context?.actor_id;
+            let descriptor = (0, native_resources_1.describeNative)(request.method, request.originalUrl, request.body, actorId);
+            if (!descriptor && !reserved(request.originalUrl)) {
+                const facts = resourceMatcher(request.method, request.originalUrl);
+                const resource = facts &&
+                    resources.find((resource) => resource.root === facts.root &&
+                        (resource.namespace || "admin") === facts.namespace);
+                if (facts && resource?.resolveScope) {
+                    const action = (0, resources_1.profileAction)(resource.profile, facts);
+                    const scope = await resource.resolveScope(request, (0, immutable_config_1.immutableConfig)({
+                        facts,
+                        resource: resource.key,
+                        operation: action.operation,
+                        params: facts.params,
+                    }));
+                    if (scope === null ||
+                        !["global", "personal", "shared"].includes(scope))
+                        return null;
+                    descriptor = (0, resources_1.describeResource)(resource, facts, request.body, actorId, scope);
+                }
+                else
+                    descriptor = custom(request.method, request.originalUrl, request.body, actorId);
+            }
+            if (!descriptor)
                 return null;
-            const verb = method === "HEAD" ? "GET" : method;
-            return (routes.find((route) => route.method === verb && route.pattern.test(path)) || null);
+            if (descriptor.action.payload) {
+                const permissions = await descriptor.action.payload(request, (0, immutable_config_1.immutableConfig)(descriptor));
+                if (!Array.isArray(permissions) ||
+                    permissions.some((permission) => !ids.has(permission)))
+                    return null;
+                descriptor.policy.permissions = [
+                    ...new Set([...descriptor.policy.permissions, ...permissions]),
+                ];
+            }
+            return descriptor;
         },
     };
 }
@@ -145,4 +241,4 @@ function validateRules(value, ids) {
 function evaluatePermission(principal, permission, context = {}) {
     return (0, explain_1.explainPermission)(principal, permission, context).allowed;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2xpYi9hY2Nlc3MvY29uZmlnLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBK0NBLGdEQXdIQztBQUVELHNDQXlEQztBQUdELGdEQU1DO0FBM09ELDhFQUErQztBQUUvQywrQ0FJc0I7QUFDdEIscUNBQWlEO0FBQ2pELHFEQUE0RTtBQUM1RSxtQ0FJZ0I7QUFDaEIsdUNBQTZDO0FBaUM3QyxTQUFnQixrQkFBa0IsQ0FBQyxVQUFnQyxFQUFFO0lBQ25FLE1BQU0sV0FBVyxHQUEyQixDQUFDLEdBQUcseUJBQVcsQ0FBQyxDQUFBO0lBQzVELE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQ2xELEtBQUssTUFBTSxVQUFVLElBQUksT0FBTyxDQUFDLFdBQVcsSUFBSSxFQUFFLEVBQUUsQ0FBQztRQUNuRCxNQUFNLENBQUMsRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsR0FBRyxVQUFVLENBQUE7UUFDckMsSUFDRSxDQUFDLG9DQUFvQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDOUMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFO1lBQ2QsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFO1lBQ2QsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFFWCxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQzNELEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUE7UUFDWCxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBQ3RDLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFBO0lBQ2xDLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxDQUFTLENBQUMsc0JBQWMsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQ3RFLElBQ0UsT0FBTyxDQUFDLEtBQUssS0FBSyxTQUFTO1FBQzNCLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFFN0QsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFBO0lBQzdFLE1BQU0sS0FBSyxHQUErQixDQUFDLE9BQU8sQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUNqRSxDQUFDLFVBQVUsRUFBRSxFQUFFO1FBQ2IsSUFDRSxDQUFDLFVBQVU7WUFDWCxPQUFPLFVBQVUsS0FBSyxRQUFRO1lBQzlCLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO1lBQ3pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUMxQixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsYUFBYSxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FDaEU7WUFDRCxPQUFPLFVBQVUsQ0FBQyxHQUFHLEtBQUssUUFBUTtZQUNsQyxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1lBQy9DLFVBQVUsQ0FBQyxHQUFHLEtBQUssc0JBQWMsQ0FBQyxHQUFHO1lBQ3JDLFFBQVEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztZQUM1QixPQUFPLFVBQVUsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUNuQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFO1lBQ3ZCLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLEdBQUc7WUFDbkMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBRW5ELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0RBQWdELENBQUMsQ0FBQTtRQUNuRSxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUM1QixTQUFTLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQTtRQUNuRCxPQUFPO1lBQ0wsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO1lBQ25CLElBQUksRUFBRSxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRTtZQUM1QixXQUFXLEVBQUUsSUFBQSxpQ0FBbUIsRUFDOUIsVUFBVSxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLFdBQVcsRUFDbEUsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUNUO1lBQ0QsS0FBSyxFQUFFLGFBQWEsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQztTQUNqRCxDQUFBO0lBQ0gsQ0FBQyxDQUNGLENBQUE7SUFDRCxNQUFNLFdBQVcsR0FBRyxJQUFJLEdBQUcsQ0FDekIsNEJBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQ3RELENBQUE7SUFDRCxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFBO0lBQ3BDLE1BQU0sTUFBTSxHQUFHLENBQUMsT0FBTyxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtRQUNsRCxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFBO1FBQ3pDLE1BQU0sU0FBUyxHQUFHLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQTtRQUMzQyxJQUNFLENBQUMsK0JBQStCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztZQUM3QyxDQUFDLDZFQUE2RSxDQUFDLElBQUksQ0FDakYsS0FBSyxDQUFDLElBQUksQ0FDWDtZQUNELFVBQVUsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDO1lBQ3pCLEtBQUssQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDNUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztZQUUvQyxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxTQUFTLEVBQUUsQ0FBQyxDQUFBO1FBQ3BFLFVBQVUsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUE7UUFDekIsT0FBTztZQUNMLEdBQUcsS0FBSztZQUNSLE1BQU07WUFDTixPQUFPLEVBQUUsSUFBSSxNQUFNLENBQ2pCLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsbUJBQW1CLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FDeEQ7U0FDRixDQUFBO0lBQ0gsQ0FBQyxDQUFDLENBQUE7SUFDRixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQTtJQUNuQyxJQUNFLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsTUFBTTtRQUNqRSxNQUFNLENBQUMsSUFBSSxDQUNULENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FDUixDQUFDLEtBQUssQ0FBQyxJQUFJO1lBQ1gsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7WUFDekMsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFVBQVU7WUFDcEMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssQ0FBQyxJQUFJLEtBQUssVUFBVSxDQUFDLENBQ2pFO1FBRUQsTUFBTSxJQUFJLEtBQUssQ0FDYixxRUFBcUUsQ0FDdEUsQ0FBQTtJQUNILE9BQU87UUFDTCxXQUFXO1FBQ1gsS0FBSztRQUNMLEdBQUcsRUFBRSxDQUFDLEdBQUcsR0FBRyxDQUFDO1FBQ2IsTUFBTTtRQUNOLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxnQkFBZ0IsSUFBSSxFQUFFO1FBQ2hELFNBQVMsQ0FBQyxNQUFjLEVBQUUsSUFBWTtZQUNwQyxNQUFNLE1BQU0sR0FBRyxJQUFBLGtCQUFTLEVBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFBO1lBQ3RDLElBQUksTUFBTTtnQkFBRSxPQUFPLE1BQU0sQ0FBQTtZQUN6QixpRkFBaUY7WUFDakYsSUFDRSw4R0FBOEcsQ0FBQyxJQUFJLENBQ2pILElBQUksQ0FDTDtnQkFFRCxPQUFPLElBQUksQ0FBQTtZQUNiLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxXQUFXLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ25FLE9BQU8sSUFBSSxDQUFBO1lBQ2IsTUFBTSxJQUFJLEdBQUcsTUFBTSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUE7WUFDL0MsT0FBTyxDQUNMLE1BQU0sQ0FBQyxJQUFJLENBQ1QsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssSUFBSSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUM3RCxJQUFJLElBQUksQ0FDVixDQUFBO1FBQ0gsQ0FBQztLQUNGLENBQUE7QUFDSCxDQUFDO0FBRUQsU0FBZ0IsYUFBYSxDQUMzQixLQUFjLEVBQ2QsR0FBc0I7SUFFdEIsSUFBSSxLQUFLLEtBQUssU0FBUztRQUFFLE9BQU8sRUFBRSxDQUFBO0lBQ2xDLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLEdBQUcsR0FBRztRQUM3QyxNQUFNLElBQUksS0FBSyxDQUFDLCtDQUErQyxDQUFDLENBQUE7SUFDbEUsT0FBTyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUU7UUFDeEIsSUFDRSxDQUFDLElBQUk7WUFDTCxPQUFPLElBQUksS0FBSyxRQUFRO1lBQ3hCLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO1lBQ25CLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxDQUNwQixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ04sQ0FBQyxDQUFDLFlBQVksRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFlBQVksQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FDcEU7WUFDRCxPQUFPLElBQUksQ0FBQyxVQUFVLEtBQUssUUFBUTtZQUNuQyxDQUFDLENBQ0MsR0FBRyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO2dCQUM3QixDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsS0FBSyxHQUFHO29CQUN2Qix3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO29CQUMvRCxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxJQUFBLHFDQUFpQixFQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUM1RDtZQUNELENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7WUFDeEMsQ0FBQyxJQUFJLENBQUMsUUFBUSxLQUFLLFNBQVM7Z0JBQzFCLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7b0JBQ25DLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxDQUFDO1lBRXZDLE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLENBQUMsQ0FBQTtRQUM1QyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFBO1FBQ2xDLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBYyxFQUFFLEVBQUUsQ0FDaEMsS0FBSyxLQUFLLElBQUk7WUFDZCxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQ3pCLE9BQU8sS0FBSyxLQUFLLFNBQVM7WUFDMUIsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO1FBQ3ZELElBQ0UsVUFBVSxLQUFLLFNBQVM7WUFDeEIsQ0FBQyxDQUFDLFVBQVU7Z0JBQ1YsT0FBTyxVQUFVLEtBQUssUUFBUTtnQkFDOUIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUM7Z0JBQ3pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxHQUFHLEVBQUU7Z0JBQ25DLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUM3QixDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FDZixDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7b0JBQzlCLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQzt3QkFDcEIsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksR0FBRyxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO3dCQUNoRSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQ3JCLENBQUM7WUFFSixNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUE7UUFDNUMsT0FBTztZQUNMLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVTtZQUMzQixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07WUFDbkIsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNuRSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLEdBQUcsVUFBVSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQ3pELENBQUE7SUFDSCxDQUFDLENBQUMsQ0FBQTtBQUNKLENBQUM7QUFFRCx1RkFBdUY7QUFDdkYsU0FBZ0Isa0JBQWtCLENBQ2hDLFNBQTBCLEVBQzFCLFVBQWtCLEVBQ2xCLFVBQTZCLEVBQUU7SUFFL0IsT0FBTyxJQUFBLDJCQUFpQixFQUFDLFNBQVMsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsT0FBTyxDQUFBO0FBQ2xFLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2xpYi9hY2Nlc3MvY29uZmlnLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBK0RBLGdEQWlRQztBQUVELHNDQXlEQztBQUdELGdEQU1DO0FBcFlELDhFQUErQztBQUsvQywrQ0FJc0I7QUFFdEIseURBQW9FO0FBQ3BFLCtDQUFpRTtBQUNqRSwyQ0FPb0I7QUFDcEIscURBQTRFO0FBQzVFLG1DQUlnQjtBQUNoQix1Q0FBNkM7QUFDN0MseURBQW9EO0FBbUNwRCxTQUFnQixrQkFBa0IsQ0FBQyxVQUFnQyxFQUFFO0lBQ25FLE1BQU0sV0FBVyxHQUEyQixDQUFDLEdBQUcseUJBQVcsQ0FBQyxDQUFBO0lBQzVELE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQ2xELEtBQUssTUFBTSxVQUFVLElBQUksT0FBTyxDQUFDLFdBQVcsSUFBSSxFQUFFLEVBQUUsQ0FBQztRQUNuRCxNQUFNLENBQUMsRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsR0FBRyxVQUFVLENBQUE7UUFDckMsSUFDRSxDQUFDLG9DQUFvQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDOUMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFO1lBQ2QsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFO1lBQ2QsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFFWCxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQzNELEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUE7UUFDWCxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBQ3RDLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFBO0lBQ2xDLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxDQUFTLENBQUMsc0JBQWMsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQ3RFLElBQ0UsT0FBTyxDQUFDLEtBQUssS0FBSyxTQUFTO1FBQzNCLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFFN0QsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFBO0lBQzdFLE1BQU0sS0FBSyxHQUErQixDQUFDLE9BQU8sQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUNqRSxDQUFDLFVBQVUsRUFBRSxFQUFFO1FBQ2IsSUFDRSxDQUFDLFVBQVU7WUFDWCxPQUFPLFVBQVUsS0FBSyxRQUFRO1lBQzlCLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO1lBQ3pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUMxQixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsYUFBYSxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FDaEU7WUFDRCxPQUFPLFVBQVUsQ0FBQyxHQUFHLEtBQUssUUFBUTtZQUNsQyxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1lBQy9DLFVBQVUsQ0FBQyxHQUFHLEtBQUssc0JBQWMsQ0FBQyxHQUFHO1lBQ3JDLFFBQVEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztZQUM1QixPQUFPLFVBQVUsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUNuQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFO1lBQ3ZCLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLEdBQUc7WUFDbkMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBRW5ELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0RBQWdELENBQUMsQ0FBQTtRQUNuRSxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUM1QixTQUFTLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQTtRQUNuRCxPQUFPO1lBQ0wsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO1lBQ25CLElBQUksRUFBRSxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRTtZQUM1QixXQUFXLEVBQUUsSUFBQSxpQ0FBbUIsRUFDOUIsVUFBVSxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLFdBQVcsRUFDbEUsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUNUO1lBQ0QsS0FBSyxFQUFFLGFBQWEsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQztTQUNqRCxDQUFBO0lBQ0gsQ0FBQyxDQUNGLENBQUE7SUFDRCxNQUFNLFdBQVcsR0FBRyxJQUFJLEdBQUcsQ0FDekIsNEJBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQ3RELENBQUE7SUFDRCxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFBO0lBQ3BDLE1BQU0sTUFBTSxHQUFHLElBQUEsa0NBQWUsRUFDNUIsQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1FBQ25DLE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUE7UUFDekMsTUFBTSxTQUFTLEdBQUcsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLElBQUksRUFBRSxDQUFBO1FBQzNDLElBQ0UsQ0FBQywrQkFBK0IsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQzdDLENBQUMsNkVBQTZFLENBQUMsSUFBSSxDQUNqRixLQUFLLENBQUMsSUFBSSxDQUNYO1lBQ0QsVUFBVSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUM7WUFDekIsS0FBSyxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUM1QyxDQUFDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1lBRS9DLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLFNBQVMsRUFBRSxDQUFDLENBQUE7UUFDcEUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQTtRQUN6QixPQUFPO1lBQ0wsR0FBRyxLQUFLO1lBQ1IsTUFBTTtTQUNQLENBQUE7SUFDSCxDQUFDLENBQUMsQ0FDSCxDQUFBO0lBQ0QsTUFBTSxTQUFTLEdBQUcsSUFBQSw2QkFBaUIsRUFDakMsT0FBTyxDQUFDLFNBQVMsSUFBSSxFQUFFLEVBQ3ZCLENBQUMsR0FBRyxHQUFHLENBQUMsRUFDUjtRQUNFLEdBQUcsa0NBQWU7UUFDbEIsR0FBRyxDQUFDLEdBQUcsV0FBVyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3hELEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1lBQ3RCLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1lBQ25DLE9BQU8sRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFBO1FBQy9ELENBQUMsQ0FBQztLQUNILENBQ0YsQ0FBQTtJQUNELE1BQU0sZUFBZSxHQUFHLElBQUEsZ0NBQWtCLEVBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQywwQkFBYyxDQUFDLENBQUMsQ0FBQTtJQUM3RSxNQUFNLGlCQUFpQixHQUFHLElBQUEsZ0NBQWtCLEVBQzFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQ3ZFLENBQUE7SUFDRCxNQUFNLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FDNUIsU0FBUyxDQUFDLEdBQUcsQ0FDWCxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsR0FBRyxRQUFRLENBQUMsU0FBUyxJQUFJLE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQ2xFLENBQ0YsQ0FBQTtJQUNELE1BQU0sUUFBUSxHQUFHLENBQUMsR0FBVyxFQUFFLEVBQUU7UUFDL0IsTUFBTSxJQUFJLEdBQUcsSUFBQSwyQkFBYSxFQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQy9CLElBQUksQ0FBQyxJQUFJO1lBQUUsT0FBTyxJQUFJLENBQUE7UUFDdEIsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUMzQyxPQUFPLENBQ0wsS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLE9BQU87WUFDcEIsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDeEIsa0NBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUM5RDtvQkFDRSxNQUFNO29CQUNOLFdBQVc7b0JBQ1gscUJBQXFCO29CQUNyQixVQUFVO29CQUNWLFFBQVE7b0JBQ1IsZ0JBQWdCO2lCQUNqQixDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUN4QixDQUFBO0lBQ0gsQ0FBQyxDQUFBO0lBQ0QsTUFBTSxNQUFNLEdBQUcsQ0FDYixNQUFjLEVBQ2QsR0FBVyxFQUNYLElBQWMsRUFDZCxPQUFnQixFQUNZLEVBQUU7UUFDOUIsSUFBSSxRQUFRLENBQUMsR0FBRyxDQUFDO1lBQUUsT0FBTyxJQUFJLENBQUE7UUFDOUIsTUFBTSxLQUFLLEdBQUcsZUFBZSxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQTtRQUMxQyxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsTUFBTSxRQUFRLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FDN0IsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUNYLFFBQVEsQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLElBQUk7Z0JBQzVCLENBQUMsUUFBUSxDQUFDLFNBQVMsSUFBSSxPQUFPLENBQUMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUNyRCxDQUFBO1lBQ0YsT0FBTyxJQUFBLDRCQUFnQixFQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFBO1FBQ3pELENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxJQUFBLDJCQUFhLEVBQUMsR0FBRyxDQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQzFELElBQUksY0FBYyxDQUFDLEdBQUcsQ0FBQyxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUFFLE9BQU8sSUFBSSxDQUFBO1FBQzlELE1BQU0sS0FBSyxHQUFHLGlCQUFpQixDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQTtRQUM1QyxJQUFJLENBQUMsS0FBSztZQUFFLE9BQU8sSUFBSSxDQUFBO1FBQ3ZCLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQ3hCLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FDVCxNQUFNLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxRQUFRLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsTUFBTSxDQUNsRSxDQUFBO1FBQ0YsT0FBTztZQUNMLEtBQUssRUFBRSxLQUFLO1lBQ1osUUFBUSxFQUFFLEtBQUssQ0FBQyxJQUFJO1lBQ3BCLFNBQVMsRUFBRSxZQUFZO1lBQ3ZCLEtBQUssRUFBRSxRQUFRO1lBQ2YsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNO1lBQ3BCLGFBQWEsRUFBRSxLQUFLLENBQUMsSUFBSTtZQUN6QixVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDcEIsTUFBTSxFQUFFLGtCQUFrQjtZQUMxQixJQUFJLEVBQUUsS0FBSztZQUNYLE1BQU0sRUFBRTtnQkFDTixXQUFXLEVBQUUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUM7Z0JBQ3BDLEdBQUcsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQ2pEO1lBQ0QsTUFBTSxFQUFFLEVBQUUsU0FBUyxFQUFFLFlBQVksRUFBRTtZQUNuQyxpQkFBaUIsRUFBRSxFQUFFO1NBQ3RCLENBQUE7SUFDSCxDQUFDLENBQUE7SUFDRCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQTtJQUNuQyxJQUNFLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsTUFBTTtRQUNqRSxNQUFNLENBQUMsSUFBSSxDQUNULENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FDUixDQUFDLEtBQUssQ0FBQyxJQUFJO1lBQ1gsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7WUFDekMsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFVBQVU7WUFDcEMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssQ0FBQyxJQUFJLEtBQUssVUFBVSxDQUFDLENBQ2pFO1FBRUQsTUFBTSxJQUFJLEtBQUssQ0FDYixxRUFBcUUsQ0FDdEUsQ0FBQTtJQUNILE9BQU87UUFDTCxXQUFXO1FBQ1gsS0FBSztRQUNMLEdBQUcsRUFBRSxDQUFDLEdBQUcsR0FBRyxDQUFDO1FBQ2IsTUFBTTtRQUNOLFNBQVM7UUFDVCxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsZ0JBQWdCLElBQUksRUFBRTtRQUNoRCx5RkFBeUY7UUFDekYsU0FBUyxDQUFDLE1BQWMsRUFBRSxJQUFZO1lBQ3BDLE9BQU8sQ0FDTCxDQUFDLElBQUEsaUNBQWMsRUFBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUM1RCxFQUFFLE1BQU0sSUFBSSxJQUFJLENBQ25CLENBQUE7UUFDSCxDQUFDO1FBQ0QsS0FBSyxDQUFDLGNBQWMsQ0FDbEIsT0FBc0I7WUFFdEIsTUFBTSxPQUFPLEdBQUksT0FBK0M7aUJBQzdELFlBQVksRUFBRSxRQUFRLENBQUE7WUFDekIsSUFBSSxVQUFVLEdBQUcsSUFBQSxpQ0FBYyxFQUM3QixPQUFPLENBQUMsTUFBTSxFQUNkLE9BQU8sQ0FBQyxXQUFXLEVBQ25CLE9BQU8sQ0FBQyxJQUFJLEVBQ1osT0FBTyxDQUNSLENBQUE7WUFDRCxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO2dCQUNsRCxNQUFNLEtBQUssR0FBRyxlQUFlLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUE7Z0JBQ2xFLE1BQU0sUUFBUSxHQUNaLEtBQUs7b0JBQ0wsU0FBUyxDQUFDLElBQUksQ0FDWixDQUFDLFFBQVEsRUFBRSxFQUFFLENBQ1gsUUFBUSxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsSUFBSTt3QkFDNUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLENBQ3RELENBQUE7Z0JBQ0gsSUFBSSxLQUFLLElBQUksUUFBUSxFQUFFLFlBQVksRUFBRSxDQUFDO29CQUNwQyxNQUFNLE1BQU0sR0FBRyxJQUFBLHlCQUFhLEVBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUUsQ0FBQTtvQkFDdEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxRQUFRLENBQUMsWUFBWSxDQUN2QyxPQUFPLEVBQ1AsSUFBQSxrQ0FBZSxFQUFDO3dCQUNkLEtBQUs7d0JBQ0wsUUFBUSxFQUFFLFFBQVEsQ0FBQyxHQUFHO3dCQUN0QixTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7d0JBQzNCLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTtxQkFDckIsQ0FBQyxDQUNILENBQUE7b0JBQ0QsSUFDRSxLQUFLLEtBQUssSUFBSTt3QkFDZCxDQUFDLENBQUMsUUFBUSxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO3dCQUVqRCxPQUFPLElBQUksQ0FBQTtvQkFDYixVQUFVLEdBQUcsSUFBQSw0QkFBZ0IsRUFDM0IsUUFBUSxFQUNSLEtBQUssRUFDTCxPQUFPLENBQUMsSUFBSSxFQUNaLE9BQU8sRUFDUCxLQUFLLENBQ04sQ0FBQTtnQkFDSCxDQUFDOztvQkFDQyxVQUFVLEdBQUcsTUFBTSxDQUNqQixPQUFPLENBQUMsTUFBTSxFQUNkLE9BQU8sQ0FBQyxXQUFXLEVBQ25CLE9BQU8sQ0FBQyxJQUFJLEVBQ1osT0FBTyxDQUNSLENBQUE7WUFDTCxDQUFDO1lBQ0QsSUFBSSxDQUFDLFVBQVU7Z0JBQUUsT0FBTyxJQUFJLENBQUE7WUFDNUIsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUM5QixNQUFNLFdBQVcsR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUNqRCxPQUFPLEVBQ1AsSUFBQSxrQ0FBZSxFQUFDLFVBQVUsQ0FBQyxDQUM1QixDQUFBO2dCQUNELElBQ0UsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztvQkFDM0IsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDO29CQUV0RCxPQUFPLElBQUksQ0FBQTtnQkFDYixVQUFVLENBQUMsTUFBTSxDQUFDLFdBQVcsR0FBRztvQkFDOUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsR0FBRyxXQUFXLENBQUMsQ0FBQztpQkFDL0QsQ0FBQTtZQUNILENBQUM7WUFDRCxPQUFPLFVBQVUsQ0FBQTtRQUNuQixDQUFDO0tBQ0YsQ0FBQTtBQUNILENBQUM7QUFFRCxTQUFnQixhQUFhLENBQzNCLEtBQWMsRUFDZCxHQUFzQjtJQUV0QixJQUFJLEtBQUssS0FBSyxTQUFTO1FBQUUsT0FBTyxFQUFFLENBQUE7SUFDbEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxHQUFHO1FBQzdDLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQTtJQUNsRSxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRTtRQUN4QixJQUNFLENBQUMsSUFBSTtZQUNMLE9BQU8sSUFBSSxLQUFLLFFBQVE7WUFDeEIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7WUFDbkIsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQ3BCLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDTixDQUFDLENBQUMsWUFBWSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsWUFBWSxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUNwRTtZQUNELE9BQU8sSUFBSSxDQUFDLFVBQVUsS0FBSyxRQUFRO1lBQ25DLENBQUMsQ0FDQyxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQzdCLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxLQUFLLEdBQUc7b0JBQ3ZCLHdDQUF3QyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7b0JBQy9ELEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLElBQUEscUNBQWlCLEVBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQzVEO1lBQ0QsQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztZQUN4QyxDQUFDLElBQUksQ0FBQyxRQUFRLEtBQUssU0FBUztnQkFDMUIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztvQkFDbkMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUM7WUFFdkMsTUFBTSxJQUFJLEtBQUssQ0FBQyx5QkFBeUIsQ0FBQyxDQUFBO1FBQzVDLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUE7UUFDbEMsTUFBTSxNQUFNLEdBQUcsQ0FBQyxLQUFjLEVBQUUsRUFBRSxDQUNoQyxLQUFLLEtBQUssSUFBSTtZQUNkLE9BQU8sS0FBSyxLQUFLLFFBQVE7WUFDekIsT0FBTyxLQUFLLEtBQUssU0FBUztZQUMxQixDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUE7UUFDdkQsSUFDRSxVQUFVLEtBQUssU0FBUztZQUN4QixDQUFDLENBQUMsVUFBVTtnQkFDVixPQUFPLFVBQVUsS0FBSyxRQUFRO2dCQUM5QixLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQztnQkFDekIsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxNQUFNLEdBQUcsRUFBRTtnQkFDbkMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLENBQzdCLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUNmLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztvQkFDOUIsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO3dCQUNwQixDQUFDLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksS0FBSyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7d0JBQ2hFLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FDckIsQ0FBQztZQUVKLE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLENBQUMsQ0FBQTtRQUM1QyxPQUFPO1lBQ0wsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVO1lBQzNCLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtZQUNuQixHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ25FLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsR0FBRyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDekQsQ0FBQTtJQUNILENBQUMsQ0FBQyxDQUFBO0FBQ0osQ0FBQztBQUVELHVGQUF1RjtBQUN2RixTQUFnQixrQkFBa0IsQ0FDaEMsU0FBMEIsRUFDMUIsVUFBa0IsRUFDbEIsVUFBNkIsRUFBRTtJQUUvQixPQUFPLElBQUEsMkJBQWlCLEVBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxPQUFPLENBQUE7QUFDbEUsQ0FBQyJ9

package/.medusa/server/src/lib/access/explain.d.ts

@@ -1,5 +1,5 @@
 import type { PermissionContext, PermissionRule } from "./config";
-import type { AccessPrincipal } from "./permissions";
+import { type AccessPrincipal } from "./permissions";
 export type PermissionDecision = {
     allowed: boolean;
     reason: "inactive" | "superuser" | "no_match" | "allow" | "deny";

package/.medusa/server/src/lib/access/explain.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.explainPermission = explainPermission;
+const permissions_1 = require("./permissions");
 const permission_key_1 = require("./permission-key");
 /** The shared decision engine used by enforcement and permission diagnostics. */
 function explainPermission(principal, permission, context = {}) {
     if (!principal.active)
         return { allowed: false, reason: "inactive", matches: [] };
-    if (principal.is_superuser)
+    if ((0, permissions_1.isSuperuser)(principal))
         return { allowed: true, reason: "superuser", matches: [] };
     const matches = (principal.rules || [])
         .filter((rule) => (0, permission_key_1.permissionKeyMatches)(rule.permission, permission) &&
@@ -36,4 +37,4 @@ function explainPermission(principal, permission, context = {}) {
         matches,
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhwbGFpbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9saWIvYWNjZXNzL2V4cGxhaW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFXQSw4Q0E0Q0M7QUFyREQscURBQXVEO0FBUXZELGlGQUFpRjtBQUNqRixTQUFnQixpQkFBaUIsQ0FDL0IsU0FBMEIsRUFDMUIsVUFBa0IsRUFDbEIsVUFBNkIsRUFBRTtJQUUvQixJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU07UUFDbkIsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsRUFBRSxFQUFFLENBQUE7SUFDNUQsSUFBSSxTQUFTLENBQUMsWUFBWTtRQUN4QixPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsQ0FBQTtJQUM1RCxNQUFNLE9BQU8sR0FBa0MsQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztTQUNuRSxNQUFNLENBQ0wsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUNQLElBQUEscUNBQW9CLEVBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUM7UUFDakQsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FDekMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxRQUFRLENBQUMsRUFBRSxFQUFFLENBQ2xCLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQztZQUMzQixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO2dCQUN0QixDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ2pDLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQ2pDLENBQ0o7U0FDQSxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLElBQUksRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQy9DLElBQUksU0FBUyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1FBQzVDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQTtJQUNyRSxNQUFNLEtBQUssR0FBRyxDQUFDLElBQW9CLEVBQUUsRUFBRSxDQUFDO1FBQ3RDLElBQUksQ0FBQyxRQUFRLElBQUksQ0FBQztRQUNsQixJQUFJLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNO1FBQ3pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNO0tBQzFDLENBQUE7SUFDRCxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFO1FBQ3BCLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQTtRQUNyQixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUE7UUFDdEIsT0FBTyxDQUNMLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDO1lBQ2xCLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDO1lBQ2xCLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDO1lBQ2xCLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxDQUMxRCxDQUFBO0lBQ0gsQ0FBQyxDQUFDLENBQUE7SUFDRixPQUFPO1FBQ0wsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEtBQUssT0FBTztRQUN2QyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sSUFBSSxVQUFVO1FBQ3hDLE9BQU87S0FDUixDQUFBO0FBQ0gsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhwbGFpbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9saWIvYWNjZXNzL2V4cGxhaW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFXQSw4Q0E0Q0M7QUF0REQsK0NBQWlFO0FBQ2pFLHFEQUF1RDtBQVF2RCxpRkFBaUY7QUFDakYsU0FBZ0IsaUJBQWlCLENBQy9CLFNBQTBCLEVBQzFCLFVBQWtCLEVBQ2xCLFVBQTZCLEVBQUU7SUFFL0IsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNO1FBQ25CLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxDQUFBO0lBQzVELElBQUksSUFBQSx5QkFBVyxFQUFDLFNBQVMsQ0FBQztRQUN4QixPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsQ0FBQTtJQUM1RCxNQUFNLE9BQU8sR0FBa0MsQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztTQUNuRSxNQUFNLENBQ0wsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUNQLElBQUEscUNBQW9CLEVBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUM7UUFDakQsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FDekMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxRQUFRLENBQUMsRUFBRSxFQUFFLENBQ2xCLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQztZQUMzQixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO2dCQUN0QixDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ2pDLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQ2pDLENBQ0o7U0FDQSxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLElBQUksRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQy9DLElBQUksU0FBUyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1FBQzVDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQTtJQUNyRSxNQUFNLEtBQUssR0FBRyxDQUFDLElBQW9CLEVBQUUsRUFBRSxDQUFDO1FBQ3RDLElBQUksQ0FBQyxRQUFRLElBQUksQ0FBQztRQUNsQixJQUFJLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNO1FBQ3pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNO0tBQzFDLENBQUE7SUFDRCxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFO1FBQ3BCLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQTtRQUNyQixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUE7UUFDdEIsT0FBTyxDQUNMLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDO1lBQ2xCLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDO1lBQ2xCLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDO1lBQ2xCLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxDQUMxRCxDQUFBO0lBQ0gsQ0FBQyxDQUFDLENBQUE7SUFDRixPQUFPO1FBQ0wsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEtBQUssT0FBTztRQUN2QyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sSUFBSSxVQUFVO1FBQ3hDLE9BQU87S0FDUixDQUFBO0FBQ0gsQ0FBQyJ9

package/.medusa/server/src/lib/access/immutable-config.d.ts

@@ -0,0 +1,2 @@
+/** Copy policy data before freezing it; callbacks retain their server-owned identity. */
+export declare function immutableConfig<T>(value: T): T;

package/.medusa/server/src/lib/access/immutable-config.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.immutableConfig = immutableConfig;
+/** Copy policy data before freezing it; callbacks retain their server-owned identity. */
+function immutableConfig(value) {
+    if (Array.isArray(value))
+        return Object.freeze(value.map(immutableConfig));
+    if (value instanceof RegExp)
+        return Object.freeze(new RegExp(value.source, value.flags));
+    if (value && typeof value === "object")
+        return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, child]) => [
+            key,
+            immutableConfig(child),
+        ])));
+    return value;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW1tdXRhYmxlLWNvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9saWIvYWNjZXNzL2ltbXV0YWJsZS1jb25maWcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFDQSwwQ0FlQztBQWhCRCx5RkFBeUY7QUFDekYsU0FBZ0IsZUFBZSxDQUFJLEtBQVE7SUFDekMsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztRQUN0QixPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxlQUFlLENBQUMsQ0FBTSxDQUFBO0lBQ3ZELElBQUksS0FBSyxZQUFZLE1BQU07UUFDekIsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFNLENBQUE7SUFDbEUsSUFBSSxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtRQUNwQyxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQ2xCLE1BQU0sQ0FBQyxXQUFXLENBQ2hCLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQzFDLEdBQUc7WUFDSCxlQUFlLENBQUMsS0FBSyxDQUFDO1NBQ3ZCLENBQUMsQ0FDSCxDQUNHLENBQUE7SUFDUixPQUFPLEtBQUssQ0FBQTtBQUNkLENBQUMifQ==

package/.medusa/server/src/lib/access/native-resources.d.ts

@@ -0,0 +1,3 @@
+import { type ResourceDefinition } from "./resources";
+export declare const nativeResources: readonly ResourceDefinition[];
+export declare function describeNative(method: string, url: string, body?: unknown, actorId?: string): import("./resources").OperationDescriptor | null;