@abhi1693/medusa-rbac 0.0.1 → 0.0.2

package/.medusa/server/src/lib/access/native-resources.js

@@ -0,0 +1,444 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeResources = void 0;
+exports.describeNative = describeNative;
+const native_routes_json_1 = __importDefault(require("./native-routes.json"));
+const route_facts_1 = require("./route-facts");
+const resources_1 = require("./resources");
+const write_permissions_1 = require("./write-permissions");
+const immutable_config_1 = require("./immutable-config");
+const read = (...permissions) => ({ permissions });
+const commerce = {
+    products: {
+        read: read("products.view", "prices.view"),
+        write: read("products.edit"),
+    },
+    "product-variants": {
+        read: read("products.view", "prices.view"),
+        write: read("products.edit"),
+    },
+    "product-categories": {
+        read: read("categories.view"),
+        write: read("categories.manage"),
+    },
+    collections: {
+        read: read("collections.view"),
+        write: read("collections.manage"),
+    },
+    "product-types": {
+        read: read("products.view"),
+        write: read("product_options.manage"),
+    },
+    "product-tags": {
+        read: read("products.view"),
+        write: read("product_options.manage"),
+    },
+    "product-options": {
+        read: read("products.view"),
+        write: read("product_options.manage"),
+    },
+    "product-option-values": {
+        read: read("products.view"),
+        write: read("product_options.manage"),
+    },
+    "price-lists": { read: read("prices.view"), write: read("prices.edit") },
+    "price-preferences": {
+        read: read("prices.view"),
+        write: read("prices.edit"),
+    },
+    "inventory-items": {
+        read: read("inventory.view", "products.view", "prices.view", "stock_locations.view"),
+        write: read("inventory.adjust"),
+    },
+    "stock-locations": {
+        read: read("stock_locations.view"),
+        write: read("stock_locations.manage"),
+    },
+    reservations: {
+        read: read("inventory.view", "products.view", "prices.view"),
+        write: read("inventory.adjust"),
+    },
+    orders: {
+        read: read("orders.view"),
+        write: read("orders.manage"),
+    },
+    "order-changes": {
+        read: read("orders.view"),
+        write: read("orders.manage"),
+    },
+    "draft-orders": {
+        read: read("orders.view"),
+        write: read("orders.manage"),
+    },
+    returns: {
+        read: read("orders.view"),
+        write: read("orders.manage"),
+    },
+    exchanges: {
+        read: read("orders.view"),
+        write: read("orders.manage"),
+    },
+    claims: {
+        read: read("orders.view"),
+        write: read("orders.manage"),
+    },
+    fulfillments: { read: read("orders.view"), write: read("orders.manage") },
+    customers: { read: read("customers.view"), write: read("customers.manage") },
+    "customer-groups": {
+        read: read("customers.view"),
+        write: read("customers.manage"),
+    },
+    payments: { read: read("payments.view"), write: read("payments.capture") },
+    "payment-collections": {
+        read: read("payments.view"),
+        write: read("payments.capture"),
+    },
+    promotions: {
+        read: read("promotions.view"),
+        write: read("promotions.manage"),
+    },
+    campaigns: {
+        read: read("promotions.view"),
+        write: read("promotions.manage"),
+    },
+    uploads: { read: read("media.manage"), write: read("media.manage") },
+};
+const settings = [
+    "stores",
+    "regions",
+    "currencies",
+    "countries",
+    "sales-channels",
+    "shipping-profiles",
+    "shipping-options",
+    "shipping-option-types",
+    "fulfillment-providers",
+    "fulfillment-sets",
+    "tax-regions",
+    "tax-rates",
+    "tax-providers",
+    "return-reasons",
+    "refund-reasons",
+    "locales",
+    "translations",
+];
+for (const resource of settings)
+    commerce[resource] = {
+        read: read("settings.view"),
+        write: read("settings.manage"),
+    };
+// Reviewed structural vocabulary, independent of request URLs. Unrecognized
+// members stay unclassified when a future native inventory adds a command.
+const members = {
+    campaigns: "promotions",
+    claims: "cancel claim-items inbound items outbound request shipping-method",
+    collections: "products",
+    "customer-groups": "customers",
+    customers: "addresses customer-groups export",
+    "draft-orders": "confirm convert-to-order edit item items method promotions request shipping-methods",
+    exchanges: "cancel inbound items outbound request shipping-method",
+    "fulfillment-providers": "options",
+    "fulfillment-sets": "service-zones",
+    fulfillments: "cancel shipment",
+    "inventory-items": "batch export location-levels",
+    orders: "archive authorize cancel changes complete credit-lines export fulfillments guest line-items mark-as-delivered payment-sessions preview shipments shipping-options transfer",
+    "payment-collections": "mark-as-paid payment-sessions",
+    payments: "capture payment-providers refund",
+    "price-lists": "batch prices products",
+    "product-categories": "products",
+    "product-options": "values",
+    products: "batch confirm export images import imports inventory-items options variants",
+    promotions: "batch buy-rules rule-attribute-options rule-value-options rules target-rules",
+    returns: "cancel confirm dismiss-items receive receive-items request request-items shipping-method",
+    "sales-channels": "products",
+    "shipping-options": "batch rules",
+    "stock-locations": "fulfillment-providers fulfillment-sets sales-channels",
+    "tax-rates": "rules",
+    translations: "batch entities settings statistics",
+    uploads: "presigned-urls",
+    users: "auth-providers me reset-password roles",
+    invites: "accept resend",
+};
+const commands = {
+    products: { import: "import", imports: "import", export: "export" },
+    "product-variants": { import: "import", imports: "import", export: "export" },
+    orders: { cancel: "cancel", export: "denied" },
+    "draft-orders": { cancel: "cancel" },
+    payments: { refund: "refund" },
+    customers: { export: "denied" },
+    "inventory-items": { export: "denied" },
+};
+const personalFields = ["id", "email", "first_name", "last_name", "avatar_url"];
+const editableProfileFields = ["first_name", "last_name", "avatar_url"];
+function addAction(profile, facts, action) {
+    let node = profile;
+    for (const segment of facts.segments) {
+        if (segment.kind === "literal") {
+            const children = (node.children ||= {});
+            node = children[segment.value] ||= {};
+        }
+        else {
+            node.item ||= { parameter: segment.name, profile: {} };
+            if (node.item.parameter !== segment.name)
+                throw new Error("Conflicting native parameter grammar");
+            node = node.item.profile;
+        }
+    }
+    node.actions ||= {};
+    node.actions[facts.method] = action;
+}
+function compileNative(resource, policies) {
+    const profile = {};
+    const product = ["products", "product-variants"].includes(resource);
+    const operations = {
+        read: policies.read,
+        write: policies.write,
+        create: read("products.create"),
+        delete: read("products.delete"),
+        import: read("products.import", "products.create", "products.edit", "prices.edit"),
+        export: read("products.view", "prices.view", "products.export"),
+        refund: read("refunds.issue"),
+        cancel: read("orders.cancel"),
+        bootstrap: { permissions: [], access: "authenticated" },
+        public: { permissions: [], access: "public" },
+    };
+    for (const route of native_routes_json_1.default.filter((route) => route.path.split("/")[2] === resource)) {
+        for (const method of route.methods) {
+            const facts = (0, route_facts_1.matchRoute)([route], method, route.path.replace(/:[^/]+/g, "opaque"));
+            const literals = facts.segments
+                .filter((segment) => segment.kind === "literal")
+                .map((segment) => segment.value);
+            if (literals.some((literal) => !(members[resource] || "").split(" ").includes(literal)))
+                continue;
+            const command = literals
+                .map((literal) => commands[resource]?.[literal])
+                .find(Boolean);
+            if (command === "denied")
+                continue;
+            let operation = command || (method === "GET" ? "read" : "write");
+            if (product && !command) {
+                if (method === "DELETE")
+                    operation = "delete";
+                if (resource === "products" &&
+                    method === "POST" &&
+                    !facts.segments.length)
+                    operation = "create";
+            }
+            const variantCollection = facts.segments.length === 2 &&
+                facts.segments[0].kind === "parameter" &&
+                facts.segments[1].kind === "literal" &&
+                facts.segments[1].value === "variants";
+            const variantItem = facts.segments.length === 3 &&
+                facts.segments[2].kind === "parameter" &&
+                facts.segments[1].kind === "literal" &&
+                facts.segments[1].value === "variants";
+            const action = {
+                operation,
+                fieldResource: resource === "products" && (variantCollection || variantItem)
+                    ? "product-variants"
+                    : resource,
+            };
+            if (product && method !== "GET")
+                action.payload = (request) => (0, write_permissions_1.additionalWritePermissions)(request.body, method === "POST" && (operation === "create" || variantCollection));
+            if (resource === "stores" && method === "GET" && !facts.segments.length) {
+                action.operation = "bootstrap";
+                action.fallbackFields = {
+                    permissions: ["settings.view"],
+                    fields: ["id", "name"],
+                };
+            }
+            addAction(profile, facts, action);
+        }
+    }
+    return {
+        key: resource,
+        root: resource,
+        actorTypes: ["user"],
+        profile,
+        operations,
+    };
+}
+function accountResource(root) {
+    const profile = {};
+    const operations = {
+        read: { permissions: ["staff.view"], superuser: true },
+        manage: { permissions: [], superuser: true },
+        self: { permissions: [], access: "authenticated" },
+        public: { permissions: [], access: "public" },
+    };
+    for (const route of native_routes_json_1.default.filter((route) => route.path.split("/")[2] === root)) {
+        for (const method of route.methods) {
+            const facts = (0, route_facts_1.matchRoute)([route], method, route.path.replace(/:[^/]+/g, "opaque"));
+            const action = {
+                operation: root === "users" && method === "GET" ? "read" : "manage",
+            };
+            if (root === "users") {
+                const item = facts.segments.length === 1 && facts.segments[0].kind === "parameter";
+                const reset = facts.segments.length === 2 &&
+                    facts.segments[0].kind === "parameter" &&
+                    facts.segments[1].kind === "literal" &&
+                    facts.segments[1].value === "reset-password";
+                if (method !== "GET" &&
+                    !((method === "POST" && (item || reset)) ||
+                        (method === "DELETE" && item)))
+                    continue;
+                if (method === "POST" && item)
+                    action.self = {
+                        parameter: "id",
+                        fields: editableProfileFields,
+                        responseFields: personalFields,
+                    };
+                if (method === "DELETE")
+                    action.redirect = {
+                        destination: "/admin/access/staff/:id",
+                        parameter: "id",
+                    };
+                if (method === "GET" &&
+                    facts.segments.length === 1 &&
+                    facts.segments[0].kind === "literal" &&
+                    facts.segments[0].value === "me") {
+                    action.operation = "self";
+                    action.forceFields = personalFields;
+                }
+            }
+            else if (method === "POST" &&
+                facts.segments.length === 1 &&
+                facts.segments[0].kind === "literal" &&
+                facts.segments[0].value === "accept")
+                action.operation = "public";
+            addAction(profile, facts, action);
+        }
+    }
+    return { key: root, root, profile, operations, actorTypes: ["user"] };
+}
+const management = {
+    key: "access",
+    root: "access",
+    actorTypes: ["user"],
+    operations: {
+        self: { permissions: [], access: "authenticated" },
+        roles: read("roles.view"),
+        staff: read("staff.view"),
+        audit: read("audit.view"),
+        manage: { permissions: [], superuser: true },
+    },
+    profile: {
+        children: {
+            me: { actions: { GET: "self" } },
+            permissions: { actions: { GET: "roles" } },
+            audit: { actions: { GET: "audit" } },
+            roles: {
+                actions: { GET: "roles", POST: "manage" },
+                item: {
+                    parameter: "id",
+                    profile: {
+                        actions: { GET: "roles", POST: "manage", DELETE: "manage" },
+                    },
+                },
+            },
+            staff: {
+                actions: { GET: "staff" },
+                item: {
+                    parameter: "id",
+                    profile: {
+                        actions: { GET: "staff", POST: "manage", DELETE: "manage" },
+                    },
+                },
+            },
+            invites: {
+                actions: { GET: "manage", POST: "manage" },
+                item: { parameter: "id", profile: { actions: { DELETE: "manage" } } },
+            },
+            evaluate: { actions: { POST: "manage" } },
+            actors: {
+                item: {
+                    parameter: "actor_type",
+                    profile: {
+                        actions: { GET: "manage" },
+                        item: {
+                            parameter: "id",
+                            profile: { actions: { GET: "manage", POST: "manage" } },
+                        },
+                    },
+                },
+            },
+        },
+    },
+};
+const layouts = {
+    key: "layouts",
+    root: "layouts",
+    actorTypes: ["user"],
+    profile: (0, resources_1.actorOwnedPreferences)({
+        parameter: "zone",
+        member: "configuration",
+        list: "configurations",
+        sharedField: "is_default",
+    }),
+    operations: {
+        read: read(),
+        save: {
+            permissions: [],
+            scopes: { personal: [], shared: ["settings.manage"] },
+        },
+        reset: { permissions: [], scopes: { personal: [] } },
+    },
+};
+exports.nativeResources = (0, immutable_config_1.immutableConfig)([
+    ...Object.entries(commerce).map(([root, policies]) => compileNative(root, policies)),
+    accountResource("users"),
+    accountResource("invites"),
+    management,
+    layouts,
+    ...["plugins", "feature-flags"].map((root) => ({
+        key: root,
+        root,
+        actorTypes: ["user"],
+        profile: { actions: { GET: "read" } },
+        operations: {
+            read: {
+                permissions: [],
+                access: root === "feature-flags" ? "public" : "authenticated",
+            },
+        },
+    })),
+].map((resource) => ({
+    ...resource,
+    fieldRequirements: [
+        { pattern: /inventory/, permissions: ["inventory.view"] },
+        ...(resource.root === "orders"
+            ? [
+                {
+                    pattern: /(?:^|,)\s*[+-]?\*?payment_collections\.(?:payment_sessions|payments\.refunds\.refund_reason)\s*(?:,|$)/,
+                    permissions: ["payments.view"],
+                },
+            ]
+            : []),
+        ...(resource.root === "stock-locations"
+            ? [
+                {
+                    pattern: /(?:^|,)\s*[+-]?\*?(?:fulfillment_sets|fulfillment_providers|sales_channels)(?:\.|\s*(?:,|$))/,
+                    permissions: ["settings.view"],
+                },
+            ]
+            : []),
+    ],
+})));
+const nativeMatcher = (0, route_facts_1.createRouteMatcher)(native_routes_json_1.default);
+const managementDefinition = exports.nativeResources.find((resource) => resource.key === "access");
+const managementMatcher = (0, route_facts_1.createRouteMatcher)((0, resources_1.resourceRoutes)(managementDefinition));
+function describeNative(method, url, body, actorId) {
+    const facts = nativeMatcher(method, url);
+    if (!facts) {
+        const custom = managementMatcher(method, url);
+        return custom
+            ? (0, resources_1.describeResource)(managementDefinition, custom, body, actorId)
+            : null;
+    }
+    const resource = exports.nativeResources.find((resource) => resource.root === facts.root);
+    return resource ? (0, resources_1.describeResource)(resource, facts, body, actorId) : null;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmF0aXZlLXJlc291cmNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9saWIvYWNjZXNzL25hdGl2ZS1yZXNvdXJjZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBK2ZBLHdDQWlCQztBQWhoQkQsOEVBQStDO0FBQy9DLCtDQUtzQjtBQUN0QiwyQ0FRb0I7QUFDcEIsMkRBQWdFO0FBQ2hFLHlEQUFvRDtBQUNwRCxNQUFNLElBQUksR0FBRyxDQUFDLEdBQUcsV0FBcUIsRUFBb0IsRUFBRSxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFBO0FBQzlFLE1BQU0sUUFBUSxHQUdWO0lBQ0YsUUFBUSxFQUFFO1FBQ1IsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsYUFBYSxDQUFDO1FBQzFDLEtBQUssRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO0tBQzdCO0lBQ0Qsa0JBQWtCLEVBQUU7UUFDbEIsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsYUFBYSxDQUFDO1FBQzFDLEtBQUssRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO0tBQzdCO0lBQ0Qsb0JBQW9CLEVBQUU7UUFDcEIsSUFBSSxFQUFFLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztRQUM3QixLQUFLLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDO0tBQ2pDO0lBQ0QsV0FBVyxFQUFFO1FBQ1gsSUFBSSxFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztRQUM5QixLQUFLLEVBQUUsSUFBSSxDQUFDLG9CQUFvQixDQUFDO0tBQ2xDO0lBQ0QsZUFBZSxFQUFFO1FBQ2YsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDM0IsS0FBSyxFQUFFLElBQUksQ0FBQyx3QkFBd0IsQ0FBQztLQUN0QztJQUNELGNBQWMsRUFBRTtRQUNkLElBQUksRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO1FBQzNCLEtBQUssRUFBRSxJQUFJLENBQUMsd0JBQXdCLENBQUM7S0FDdEM7SUFDRCxpQkFBaUIsRUFBRTtRQUNqQixJQUFJLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQztRQUMzQixLQUFLLEVBQUUsSUFBSSxDQUFDLHdCQUF3QixDQUFDO0tBQ3RDO0lBQ0QsdUJBQXVCLEVBQUU7UUFDdkIsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDM0IsS0FBSyxFQUFFLElBQUksQ0FBQyx3QkFBd0IsQ0FBQztLQUN0QztJQUNELGFBQWEsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsRUFBRTtJQUN4RSxtQkFBbUIsRUFBRTtRQUNuQixJQUFJLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQztRQUN6QixLQUFLLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQztLQUMzQjtJQUNELGlCQUFpQixFQUFFO1FBQ2pCLElBQUksRUFBRSxJQUFJLENBQ1IsZ0JBQWdCLEVBQ2hCLGVBQWUsRUFDZixhQUFhLEVBQ2Isc0JBQXNCLENBQ3ZCO1FBQ0QsS0FBSyxFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztLQUNoQztJQUNELGlCQUFpQixFQUFFO1FBQ2pCLElBQUksRUFBRSxJQUFJLENBQUMsc0JBQXNCLENBQUM7UUFDbEMsS0FBSyxFQUFFLElBQUksQ0FBQyx3QkFBd0IsQ0FBQztLQUN0QztJQUNELFlBQVksRUFBRTtRQUNaLElBQUksRUFBRSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsZUFBZSxFQUFFLGFBQWEsQ0FBQztRQUM1RCxLQUFLLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDO0tBQ2hDO0lBQ0QsTUFBTSxFQUFFO1FBQ04sSUFBSSxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDekIsS0FBSyxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7S0FDN0I7SUFDRCxlQUFlLEVBQUU7UUFDZixJQUFJLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQztRQUN6QixLQUFLLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQztLQUM3QjtJQUNELGNBQWMsRUFBRTtRQUNkLElBQUksRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDO1FBQ3pCLEtBQUssRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO0tBQzdCO0lBQ0QsT0FBTyxFQUFFO1FBQ1AsSUFBSSxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDekIsS0FBSyxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7S0FDN0I7SUFDRCxTQUFTLEVBQUU7UUFDVCxJQUFJLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQztRQUN6QixLQUFLLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQztLQUM3QjtJQUNELE1BQU0sRUFBRTtRQUNOLElBQUksRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDO1FBQ3pCLEtBQUssRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO0tBQzdCO0lBQ0QsWUFBWSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQyxFQUFFO0lBQ3pFLFNBQVMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEVBQUU7SUFDNUUsaUJBQWlCLEVBQUU7UUFDakIsSUFBSSxFQUFFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztRQUM1QixLQUFLLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDO0tBQ2hDO0lBQ0QsUUFBUSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEVBQUU7SUFDMUUscUJBQXFCLEVBQUU7UUFDckIsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDM0IsS0FBSyxFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztLQUNoQztJQUNELFVBQVUsRUFBRTtRQUNWLElBQUksRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFDN0IsS0FBSyxFQUFFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQztLQUNqQztJQUNELFNBQVMsRUFBRTtRQUNULElBQUksRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFDN0IsS0FBSyxFQUFFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQztLQUNqQztJQUNELE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsY0FBYyxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRTtDQUNyRSxDQUFBO0FBQ0QsTUFBTSxRQUFRLEdBQUc7SUFDZixRQUFRO0lBQ1IsU0FBUztJQUNULFlBQVk7SUFDWixXQUFXO0lBQ1gsZ0JBQWdCO0lBQ2hCLG1CQUFtQjtJQUNuQixrQkFBa0I7SUFDbEIsdUJBQXVCO0lBQ3ZCLHVCQUF1QjtJQUN2QixrQkFBa0I7SUFDbEIsYUFBYTtJQUNiLFdBQVc7SUFDWCxlQUFlO0lBQ2YsZ0JBQWdCO0lBQ2hCLGdCQUFnQjtJQUNoQixTQUFTO0lBQ1QsY0FBYztDQUNmLENBQUE7QUFDRCxLQUFLLE1BQU0sUUFBUSxJQUFJLFFBQVE7SUFDN0IsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHO1FBQ25CLElBQUksRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO1FBQzNCLEtBQUssRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUM7S0FDL0IsQ0FBQTtBQUVILDRFQUE0RTtBQUM1RSwyRUFBMkU7QUFDM0UsTUFBTSxPQUFPLEdBQTJCO0lBQ3RDLFNBQVMsRUFBRSxZQUFZO0lBQ3ZCLE1BQU0sRUFBRSxtRUFBbUU7SUFDM0UsV0FBVyxFQUFFLFVBQVU7SUFDdkIsaUJBQWlCLEVBQUUsV0FBVztJQUM5QixTQUFTLEVBQUUsa0NBQWtDO0lBQzdDLGNBQWMsRUFDWixxRkFBcUY7SUFDdkYsU0FBUyxFQUFFLHVEQUF1RDtJQUNsRSx1QkFBdUIsRUFBRSxTQUFTO0lBQ2xDLGtCQUFrQixFQUFFLGVBQWU7SUFDbkMsWUFBWSxFQUFFLGlCQUFpQjtJQUMvQixpQkFBaUIsRUFBRSw4QkFBOEI7SUFDakQsTUFBTSxFQUNKLDRLQUE0SztJQUM5SyxxQkFBcUIsRUFBRSwrQkFBK0I7SUFDdEQsUUFBUSxFQUFFLGtDQUFrQztJQUM1QyxhQUFhLEVBQUUsdUJBQXVCO0lBQ3RDLG9CQUFvQixFQUFFLFVBQVU7SUFDaEMsaUJBQWlCLEVBQUUsUUFBUTtJQUMzQixRQUFRLEVBQ04sNkVBQTZFO0lBQy9FLFVBQVUsRUFDUiw4RUFBOEU7SUFDaEYsT0FBTyxFQUNMLDBGQUEwRjtJQUM1RixnQkFBZ0IsRUFBRSxVQUFVO0lBQzVCLGtCQUFrQixFQUFFLGFBQWE7SUFDakMsaUJBQWlCLEVBQUUsdURBQXVEO0lBQzFFLFdBQVcsRUFBRSxPQUFPO0lBQ3BCLFlBQVksRUFBRSxvQ0FBb0M7SUFDbEQsT0FBTyxFQUFFLGdCQUFnQjtJQUN6QixLQUFLLEVBQUUsd0NBQXdDO0lBQy9DLE9BQU8sRUFBRSxlQUFlO0NBQ3pCLENBQUE7QUFDRCxNQUFNLFFBQVEsR0FBMkM7SUFDdkQsUUFBUSxFQUFFLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUU7SUFDbkUsa0JBQWtCLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRTtJQUM3RSxNQUFNLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUU7SUFDOUMsY0FBYyxFQUFFLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRTtJQUNwQyxRQUFRLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFO0lBQzlCLFNBQVMsRUFBRSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUU7SUFDL0IsaUJBQWlCLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFO0NBQ3hDLENBQUE7QUFDRCxNQUFNLGNBQWMsR0FBRyxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxZQUFZLENBQUMsQ0FBQTtBQUMvRSxNQUFNLHFCQUFxQixHQUFHLENBQUMsWUFBWSxFQUFFLFdBQVcsRUFBRSxZQUFZLENBQUMsQ0FBQTtBQUV2RSxTQUFTLFNBQVMsQ0FDaEIsT0FBd0IsRUFDeEIsS0FBaUIsRUFDakIsTUFBcUI7SUFFckIsSUFBSSxJQUFJLEdBQUcsT0FBTyxDQUFBO0lBQ2xCLEtBQUssTUFBTSxPQUFPLElBQUksS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ3JDLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUMvQixNQUFNLFFBQVEsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLEtBQUssRUFBRSxDQUFvQyxDQUFBO1lBQzFFLElBQUksR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsQ0FBQTtRQUN2QyxDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksQ0FBQyxJQUFJLEtBQUssRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsRUFBRSxFQUFFLENBQUE7WUFDdEQsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsS0FBSyxPQUFPLENBQUMsSUFBSTtnQkFDdEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFBO1lBQ3pELElBQUksR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQTtRQUMxQixDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLEtBQUssRUFBRSxDQUFBO0lBQ25CLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQXFCLENBQUMsR0FBRyxNQUFNLENBQUE7QUFDcEQsQ0FBQztBQUVELFNBQVMsYUFBYSxDQUNwQixRQUFnQixFQUNoQixRQUE2RDtJQUU3RCxNQUFNLE9BQU8sR0FBb0IsRUFBRSxDQUFBO0lBQ25DLE1BQU0sT0FBTyxHQUFHLENBQUMsVUFBVSxFQUFFLGtCQUFrQixDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQ25FLE1BQU0sVUFBVSxHQUFxQztRQUNuRCxJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUk7UUFDbkIsS0FBSyxFQUFFLFFBQVEsQ0FBQyxLQUFLO1FBQ3JCLE1BQU0sRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFDL0IsTUFBTSxFQUFFLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztRQUMvQixNQUFNLEVBQUUsSUFBSSxDQUNWLGlCQUFpQixFQUNqQixpQkFBaUIsRUFDakIsZUFBZSxFQUNmLGFBQWEsQ0FDZDtRQUNELE1BQU0sRUFBRSxJQUFJLENBQUMsZUFBZSxFQUFFLGFBQWEsRUFBRSxpQkFBaUIsQ0FBQztRQUMvRCxNQUFNLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQztRQUM3QixNQUFNLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQztRQUM3QixTQUFTLEVBQUUsRUFBRSxXQUFXLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxlQUFlLEVBQUU7UUFDdkQsTUFBTSxFQUFFLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFO0tBQzlDLENBQUE7SUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLDRCQUFZLENBQUMsTUFBTSxDQUNyQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssUUFBUSxDQUNqRCxFQUFFLENBQUM7UUFDRixLQUFLLE1BQU0sTUFBTSxJQUFJLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNuQyxNQUFNLEtBQUssR0FBRyxJQUFBLHdCQUFVLEVBQ3RCLENBQUMsS0FBSyxDQUFDLEVBQ1AsTUFBTSxFQUNOLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FDdkMsQ0FBQTtZQUNGLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRO2lCQUM1QixNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDO2lCQUMvQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQTtZQUNsQyxJQUNFLFFBQVEsQ0FBQyxJQUFJLENBQ1gsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FDckU7Z0JBRUQsU0FBUTtZQUNWLE1BQU0sT0FBTyxHQUFHLFFBQVE7aUJBQ3JCLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLENBQUM7aUJBQy9DLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQTtZQUNoQixJQUFJLE9BQU8sS0FBSyxRQUFRO2dCQUFFLFNBQVE7WUFDbEMsSUFBSSxTQUFTLEdBQUcsT0FBTyxJQUFJLENBQUMsTUFBTSxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQTtZQUNoRSxJQUFJLE9BQU8sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUN4QixJQUFJLE1BQU0sS0FBSyxRQUFRO29CQUFFLFNBQVMsR0FBRyxRQUFRLENBQUE7Z0JBQzdDLElBQ0UsUUFBUSxLQUFLLFVBQVU7b0JBQ3ZCLE1BQU0sS0FBSyxNQUFNO29CQUNqQixDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTTtvQkFFdEIsU0FBUyxHQUFHLFFBQVEsQ0FBQTtZQUN4QixDQUFDO1lBQ0QsTUFBTSxpQkFBaUIsR0FDckIsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztnQkFDM0IsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssV0FBVztnQkFDdEMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssU0FBUztnQkFDcEMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLEtBQUssVUFBVSxDQUFBO1lBQ3hDLE1BQU0sV0FBVyxHQUNmLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7Z0JBQzNCLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLFdBQVc7Z0JBQ3RDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLFNBQVM7Z0JBQ3BDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxLQUFLLFVBQVUsQ0FBQTtZQUN4QyxNQUFNLE1BQU0sR0FBa0I7Z0JBQzVCLFNBQVM7Z0JBQ1QsYUFBYSxFQUNYLFFBQVEsS0FBSyxVQUFVLElBQUksQ0FBQyxpQkFBaUIsSUFBSSxXQUFXLENBQUM7b0JBQzNELENBQUMsQ0FBQyxrQkFBa0I7b0JBQ3BCLENBQUMsQ0FBQyxRQUFRO2FBQ2YsQ0FBQTtZQUNELElBQUksT0FBTyxJQUFJLE1BQU0sS0FBSyxLQUFLO2dCQUM3QixNQUFNLENBQUMsT0FBTyxHQUFHLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FDM0IsSUFBQSw4Q0FBMEIsRUFDeEIsT0FBTyxDQUFDLElBQUksRUFDWixNQUFNLEtBQUssTUFBTSxJQUFJLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxpQkFBaUIsQ0FBQyxDQUNuRSxDQUFBO1lBQ0wsSUFBSSxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sS0FBSyxLQUFLLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUN4RSxNQUFNLENBQUMsU0FBUyxHQUFHLFdBQVcsQ0FBQTtnQkFDOUIsTUFBTSxDQUFDLGNBQWMsR0FBRztvQkFDdEIsV0FBVyxFQUFFLENBQUMsZUFBZSxDQUFDO29CQUM5QixNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDO2lCQUN2QixDQUFBO1lBQ0gsQ0FBQztZQUNELFNBQVMsQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFBO1FBQ25DLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTztRQUNMLEdBQUcsRUFBRSxRQUFRO1FBQ2IsSUFBSSxFQUFFLFFBQVE7UUFDZCxVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUM7UUFDcEIsT0FBTztRQUNQLFVBQVU7S0FDWCxDQUFBO0FBQ0gsQ0FBQztBQUVELFNBQVMsZUFBZSxDQUFDLElBQXlCO0lBQ2hELE1BQU0sT0FBTyxHQUFvQixFQUFFLENBQUE7SUFDbkMsTUFBTSxVQUFVLEdBQXFDO1FBQ25ELElBQUksRUFBRSxFQUFFLFdBQVcsRUFBRSxDQUFDLFlBQVksQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUU7UUFDdEQsTUFBTSxFQUFFLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFO1FBQzVDLElBQUksRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsTUFBTSxFQUFFLGVBQWUsRUFBRTtRQUNsRCxNQUFNLEVBQUUsRUFBRSxXQUFXLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUU7S0FDOUMsQ0FBQTtJQUNELEtBQUssTUFBTSxLQUFLLElBQUksNEJBQVksQ0FBQyxNQUFNLENBQ3JDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxJQUFJLENBQzdDLEVBQUUsQ0FBQztRQUNGLEtBQUssTUFBTSxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ25DLE1BQU0sS0FBSyxHQUFHLElBQUEsd0JBQVUsRUFDdEIsQ0FBQyxLQUFLLENBQUMsRUFDUCxNQUFNLEVBQ04sS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUN2QyxDQUFBO1lBQ0YsTUFBTSxNQUFNLEdBQWtCO2dCQUM1QixTQUFTLEVBQUUsSUFBSSxLQUFLLE9BQU8sSUFBSSxNQUFNLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVE7YUFDcEUsQ0FBQTtZQUNELElBQUksSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO2dCQUNyQixNQUFNLElBQUksR0FDUixLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssV0FBVyxDQUFBO2dCQUN2RSxNQUFNLEtBQUssR0FDVCxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO29CQUMzQixLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxXQUFXO29CQUN0QyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTO29CQUNwQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssS0FBSyxnQkFBZ0IsQ0FBQTtnQkFDOUMsSUFDRSxNQUFNLEtBQUssS0FBSztvQkFDaEIsQ0FBQyxDQUNDLENBQUMsTUFBTSxLQUFLLE1BQU0sSUFBSSxDQUFDLElBQUksSUFBSSxLQUFLLENBQUMsQ0FBQzt3QkFDdEMsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxDQUM5QjtvQkFFRCxTQUFRO2dCQUNWLElBQUksTUFBTSxLQUFLLE1BQU0sSUFBSSxJQUFJO29CQUMzQixNQUFNLENBQUMsSUFBSSxHQUFHO3dCQUNaLFNBQVMsRUFBRSxJQUFJO3dCQUNmLE1BQU0sRUFBRSxxQkFBcUI7d0JBQzdCLGNBQWMsRUFBRSxjQUFjO3FCQUMvQixDQUFBO2dCQUNILElBQUksTUFBTSxLQUFLLFFBQVE7b0JBQ3JCLE1BQU0sQ0FBQyxRQUFRLEdBQUc7d0JBQ2hCLFdBQVcsRUFBRSx5QkFBeUI7d0JBQ3RDLFNBQVMsRUFBRSxJQUFJO3FCQUNoQixDQUFBO2dCQUNILElBQ0UsTUFBTSxLQUFLLEtBQUs7b0JBQ2hCLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7b0JBQzNCLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLFNBQVM7b0JBQ3BDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxLQUFLLElBQUksRUFDaEMsQ0FBQztvQkFDRCxNQUFNLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQTtvQkFDekIsTUFBTSxDQUFDLFdBQVcsR0FBRyxjQUFjLENBQUE7Z0JBQ3JDLENBQUM7WUFDSCxDQUFDO2lCQUFNLElBQ0wsTUFBTSxLQUFLLE1BQU07Z0JBQ2pCLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7Z0JBQzNCLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLFNBQVM7Z0JBQ3BDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxLQUFLLFFBQVE7Z0JBRXBDLE1BQU0sQ0FBQyxTQUFTLEdBQUcsUUFBUSxDQUFBO1lBQzdCLFNBQVMsQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFBO1FBQ25DLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQTtBQUN2RSxDQUFDO0FBRUQsTUFBTSxVQUFVLEdBQXVCO0lBQ3JDLEdBQUcsRUFBRSxRQUFRO0lBQ2IsSUFBSSxFQUFFLFFBQVE7SUFDZCxVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUM7SUFDcEIsVUFBVSxFQUFFO1FBQ1YsSUFBSSxFQUFFLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxNQUFNLEVBQUUsZUFBZSxFQUFFO1FBQ2xELEtBQUssRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQ3pCLEtBQUssRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQ3pCLEtBQUssRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQ3pCLE1BQU0sRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRTtLQUM3QztJQUNELE9BQU8sRUFBRTtRQUNQLFFBQVEsRUFBRTtZQUNSLEVBQUUsRUFBRSxFQUFFLE9BQU8sRUFBRSxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNoQyxXQUFXLEVBQUUsRUFBRSxPQUFPLEVBQUUsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDMUMsS0FBSyxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ3BDLEtBQUssRUFBRTtnQkFDTCxPQUFPLEVBQUUsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUU7Z0JBQ3pDLElBQUksRUFBRTtvQkFDSixTQUFTLEVBQUUsSUFBSTtvQkFDZixPQUFPLEVBQUU7d0JBQ1AsT0FBTyxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUU7cUJBQzVEO2lCQUNGO2FBQ0Y7WUFDRCxLQUFLLEVBQUU7Z0JBQ0wsT0FBTyxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRTtnQkFDekIsSUFBSSxFQUFFO29CQUNKLFNBQVMsRUFBRSxJQUFJO29CQUNmLE9BQU8sRUFBRTt3QkFDUCxPQUFPLEVBQUUsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRTtxQkFDNUQ7aUJBQ0Y7YUFDRjtZQUNELE9BQU8sRUFBRTtnQkFDUCxPQUFPLEVBQUUsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUU7Z0JBQzFDLElBQUksRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUU7YUFDdEU7WUFDRCxRQUFRLEVBQUUsRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLEVBQUU7WUFDekMsTUFBTSxFQUFFO2dCQUNOLElBQUksRUFBRTtvQkFDSixTQUFTLEVBQUUsWUFBWTtvQkFDdkIsT0FBTyxFQUFFO3dCQUNQLE9BQU8sRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUU7d0JBQzFCLElBQUksRUFBRTs0QkFDSixTQUFTLEVBQUUsSUFBSTs0QkFDZixPQUFPLEVBQUUsRUFBRSxPQUFPLEVBQUUsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsRUFBRTt5QkFDeEQ7cUJBQ0Y7aUJBQ0Y7YUFDRjtTQUNGO0tBQ0Y7Q0FDRixDQUFBO0FBQ0QsTUFBTSxPQUFPLEdBQXVCO0lBQ2xDLEdBQUcsRUFBRSxTQUFTO0lBQ2QsSUFBSSxFQUFFLFNBQVM7SUFDZixVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUM7SUFDcEIsT0FBTyxFQUFFLElBQUEsaUNBQXFCLEVBQUM7UUFDN0IsU0FBUyxFQUFFLE1BQU07UUFDakIsTUFBTSxFQUFFLGVBQWU7UUFDdkIsSUFBSSxFQUFFLGdCQUFnQjtRQUN0QixXQUFXLEVBQUUsWUFBWTtLQUMxQixDQUFDO0lBQ0YsVUFBVSxFQUFFO1FBQ1YsSUFBSSxFQUFFLElBQUksRUFBRTtRQUNaLElBQUksRUFBRTtZQUNKLFdBQVcsRUFBRSxFQUFFO1lBQ2YsTUFBTSxFQUFFLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFO1NBQ3REO1FBQ0QsS0FBSyxFQUFFLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxNQUFNLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUU7S0FDckQ7Q0FDRixDQUFBO0FBQ1ksUUFBQSxlQUFlLEdBQWtDLElBQUEsa0NBQWUsRUFDM0U7SUFDRSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUNuRCxhQUFhLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUM5QjtJQUNELGVBQWUsQ0FBQyxPQUFPLENBQUM7SUFDeEIsZUFBZSxDQUFDLFNBQVMsQ0FBQztJQUMxQixVQUFVO0lBQ1YsT0FBTztJQUNQLEdBQUcsQ0FBQyxTQUFTLEVBQUUsZUFBZSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFzQixFQUFFLENBQUMsQ0FBQztRQUNqRSxHQUFHLEVBQUUsSUFBSTtRQUNULElBQUk7UUFDSixVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUM7UUFDcEIsT0FBTyxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxFQUFFO1FBQ3JDLFVBQVUsRUFBRTtZQUNWLElBQUksRUFBRTtnQkFDSixXQUFXLEVBQUUsRUFBRTtnQkFDZixNQUFNLEVBQUUsSUFBSSxLQUFLLGVBQWUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxlQUFlO2FBQzlEO1NBQ0Y7S0FDRixDQUFDLENBQUM7Q0FDSixDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNuQixHQUFHLFFBQVE7SUFDWCxpQkFBaUIsRUFBRTtRQUNqQixFQUFFLE9BQU8sRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLENBQUMsZ0JBQWdCLENBQUMsRUFBRTtRQUN6RCxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRO1lBQzVCLENBQUMsQ0FBQztnQkFDRTtvQkFDRSxPQUFPLEVBQ0wsd0dBQXdHO29CQUMxRyxXQUFXLEVBQUUsQ0FBQyxlQUFlLENBQUM7aUJBQy9CO2FBQ0Y7WUFDSCxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ1AsR0FBRyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssaUJBQWlCO1lBQ3JDLENBQUMsQ0FBQztnQkFDRTtvQkFDRSxPQUFPLEVBQ0wsOEZBQThGO29CQUNoRyxXQUFXLEVBQUUsQ0FBQyxlQUFlLENBQUM7aUJBQy9CO2FBQ0Y7WUFDSCxDQUFDLENBQUMsRUFBRSxDQUFDO0tBQ1I7Q0FDRixDQUFDLENBQUMsQ0FDSixDQUFBO0FBRUQsTUFBTSxhQUFhLEdBQUcsSUFBQSxnQ0FBa0IsRUFBQyw0QkFBWSxDQUFDLENBQUE7QUFDdEQsTUFBTSxvQkFBb0IsR0FBRyx1QkFBZSxDQUFDLElBQUksQ0FDL0MsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEtBQUssUUFBUSxDQUN2QyxDQUFBO0FBQ0YsTUFBTSxpQkFBaUIsR0FBRyxJQUFBLGdDQUFrQixFQUMxQyxJQUFBLDBCQUFjLEVBQUMsb0JBQW9CLENBQUMsQ0FDckMsQ0FBQTtBQUVELFNBQWdCLGNBQWMsQ0FDNUIsTUFBYyxFQUNkLEdBQVcsRUFDWCxJQUFjLEVBQ2QsT0FBZ0I7SUFFaEIsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQTtJQUN4QyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDWCxNQUFNLE1BQU0sR0FBRyxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUE7UUFDN0MsT0FBTyxNQUFNO1lBQ1gsQ0FBQyxDQUFDLElBQUEsNEJBQWdCLEVBQUMsb0JBQW9CLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUM7WUFDL0QsQ0FBQyxDQUFDLElBQUksQ0FBQTtJQUNWLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyx1QkFBZSxDQUFDLElBQUksQ0FDbkMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLElBQUksQ0FDM0MsQ0FBQTtJQUNELE9BQU8sUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFBLDRCQUFnQixFQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7QUFDM0UsQ0FBQyJ9

package/.medusa/server/src/lib/access/permission-key.d.ts

@@ -1,4 +1,4 @@
-import type { AccessPrincipal } from "./permissions";
+import { type AccessPrincipal } from "./permissions";
 export declare function permissionKeyMatches(pattern: string, permission: string): boolean;
 /** Navigation hint only. Request authorization must evaluate trusted server context. */
 export declare function hasPermissionCandidate(principal: AccessPrincipal, permission: string): boolean;

package/.medusa/server/src/lib/access/permission-key.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.permissionKeyMatches = permissionKeyMatches;
 exports.hasPermissionCandidate = hasPermissionCandidate;
+const permissions_1 = require("./permissions");
 function permissionKeyMatches(pattern, permission) {
     return (pattern === permission ||
         pattern === "*" ||
@@ -10,9 +11,9 @@ function permissionKeyMatches(pattern, permission) {
 /** Navigation hint only. Request authorization must evaluate trusted server context. */
 function hasPermissionCandidate(principal, permission) {
     return (principal.active &&
-        (principal.is_superuser ||
+        ((0, permissions_1.isSuperuser)(principal) ||
             principal.permissions.includes(permission) ||
             Boolean(principal.rules?.some((rule) => rule.effect === "allow" &&
                 permissionKeyMatches(rule.permission, permission)))));
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbi1rZXkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvbGliL2FjY2Vzcy9wZXJtaXNzaW9uLWtleS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUVBLG9EQU1DO0FBR0Qsd0RBZ0JDO0FBekJELFNBQWdCLG9CQUFvQixDQUFDLE9BQWUsRUFBRSxVQUFrQjtJQUN0RSxPQUFPLENBQ0wsT0FBTyxLQUFLLFVBQVU7UUFDdEIsT0FBTyxLQUFLLEdBQUc7UUFDZixDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksVUFBVSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDeEUsQ0FBQTtBQUNILENBQUM7QUFFRCx3RkFBd0Y7QUFDeEYsU0FBZ0Isc0JBQXNCLENBQ3BDLFNBQTBCLEVBQzFCLFVBQWtCO0lBRWxCLE9BQU8sQ0FDTCxTQUFTLENBQUMsTUFBTTtRQUNoQixDQUFDLFNBQVMsQ0FBQyxZQUFZO1lBQ3JCLFNBQVMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztZQUMxQyxPQUFPLENBQ0wsU0FBUyxDQUFDLEtBQUssRUFBRSxJQUFJLENBQ25CLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FDUCxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU87Z0JBQ3ZCLG9CQUFvQixDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQ3BELENBQ0YsQ0FBQyxDQUNMLENBQUE7QUFDSCxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbi1rZXkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvbGliL2FjY2Vzcy9wZXJtaXNzaW9uLWtleS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUVBLG9EQU1DO0FBR0Qsd0RBZ0JDO0FBM0JELCtDQUFpRTtBQUVqRSxTQUFnQixvQkFBb0IsQ0FBQyxPQUFlLEVBQUUsVUFBa0I7SUFDdEUsT0FBTyxDQUNMLE9BQU8sS0FBSyxVQUFVO1FBQ3RCLE9BQU8sS0FBSyxHQUFHO1FBQ2YsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLFVBQVUsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQ3hFLENBQUE7QUFDSCxDQUFDO0FBRUQsd0ZBQXdGO0FBQ3hGLFNBQWdCLHNCQUFzQixDQUNwQyxTQUEwQixFQUMxQixVQUFrQjtJQUVsQixPQUFPLENBQ0wsU0FBUyxDQUFDLE1BQU07UUFDaEIsQ0FBQyxJQUFBLHlCQUFXLEVBQUMsU0FBUyxDQUFDO1lBQ3JCLFNBQVMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztZQUMxQyxPQUFPLENBQ0wsU0FBUyxDQUFDLEtBQUssRUFBRSxJQUFJLENBQ25CLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FDUCxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU87Z0JBQ3ZCLG9CQUFvQixDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQ3BELENBQ0YsQ0FBQyxDQUNMLENBQUE7QUFDSCxDQUFDIn0=

package/.medusa/server/src/lib/access/permissions.d.ts

@@ -12,3 +12,10 @@ export type AccessPrincipal = {
     permissions: Permission[];
     rules?: PermissionRule[];
 };
+/** Elevated authority applies only to an active native staff principal. */
+export declare function isSuperuser(principal: AccessPrincipal): boolean;
+export declare const SUPERUSER_AUTHORITY: Readonly<{
+    scope: "all_admin_operations";
+    description: "An active native staff account with the Superuser role can access all registered Admin pages and operations, including publishable API keys, secret API keys, workflows and plugin routes without a permission mapping. All permissions below are included, along with future permissions. Native authentication, validation and account safety protections still apply.";
+}>;
+export type SuperuserAuthority = typeof SUPERUSER_AUTHORITY;

package/.medusa/server/src/lib/access/permissions.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PERMISSION_IDS = exports.PERMISSIONS = void 0;
+exports.SUPERUSER_AUTHORITY = exports.PERMISSION_IDS = exports.PERMISSIONS = void 0;
 exports.validatePermissions = validatePermissions;
+exports.isSuperuser = isSuperuser;
 exports.PERMISSIONS = [
     ["staff.view", "View staff", "Access"],
     ["roles.view", "View roles", "Access"],
@@ -47,4 +48,16 @@ function validatePermissions(values, ids = exports.PERMISSION_IDS) {
     }
     return [...new Set(values)];
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvbGliL2FjY2Vzcy9wZXJtaXNzaW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUEyQ0Esa0RBY0M7QUF4RFksUUFBQSxXQUFXLEdBQUc7SUFDekIsQ0FBQyxZQUFZLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQztJQUN0QyxDQUFDLFlBQVksRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDO0lBQ3RDLENBQUMsWUFBWSxFQUFFLDJCQUEyQixFQUFFLFFBQVEsQ0FBQztJQUNyRCxDQUFDLGVBQWUsRUFBRSw0QkFBNEIsRUFBRSxTQUFTLENBQUM7SUFDMUQsQ0FBQyxpQkFBaUIsRUFBRSx1QkFBdUIsRUFBRSxTQUFTLENBQUM7SUFDdkQsQ0FBQyxlQUFlLEVBQUUsZUFBZSxFQUFFLFNBQVMsQ0FBQztJQUM3QyxDQUFDLGtCQUFrQixFQUFFLGtCQUFrQixFQUFFLFNBQVMsQ0FBQztJQUNuRCxDQUFDLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLFNBQVMsQ0FBQztJQUNqRCxDQUFDLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLFNBQVMsQ0FBQztJQUNqRCxDQUFDLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLFNBQVMsQ0FBQztJQUNqRCxDQUFDLGFBQWEsRUFBRSxhQUFhLEVBQUUsU0FBUyxDQUFDO0lBQ3pDLENBQUMsYUFBYSxFQUFFLGVBQWUsRUFBRSxTQUFTLENBQUM7SUFDM0MsQ0FBQyxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxTQUFTLENBQUM7SUFDakQsQ0FBQyxtQkFBbUIsRUFBRSxtQkFBbUIsRUFBRSxTQUFTLENBQUM7SUFDckQsQ0FBQyxrQkFBa0IsRUFBRSxrQkFBa0IsRUFBRSxTQUFTLENBQUM7SUFDbkQsQ0FBQyxvQkFBb0IsRUFBRSxvQkFBb0IsRUFBRSxTQUFTLENBQUM7SUFDdkQsQ0FBQyx3QkFBd0IsRUFBRSxnQ0FBZ0MsRUFBRSxTQUFTLENBQUM7SUFDdkUsQ0FBQyxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDO0lBQzdDLENBQUMsZ0JBQWdCLEVBQUUsNkJBQTZCLEVBQUUsV0FBVyxDQUFDO0lBQzlELENBQUMsa0JBQWtCLEVBQUUsK0JBQStCLEVBQUUsV0FBVyxDQUFDO0lBQ2xFLENBQUMsc0JBQXNCLEVBQUUsc0JBQXNCLEVBQUUsV0FBVyxDQUFDO0lBQzdELENBQUMsd0JBQXdCLEVBQUUsd0JBQXdCLEVBQUUsV0FBVyxDQUFDO0lBQ2pFLENBQUMsYUFBYSxFQUFFLGFBQWEsRUFBRSxRQUFRLENBQUM7SUFDeEMsQ0FBQyxlQUFlLEVBQUUsdUNBQXVDLEVBQUUsUUFBUSxDQUFDO0lBQ3BFLENBQUMsZUFBZSxFQUFFLGVBQWUsRUFBRSxRQUFRLENBQUM7SUFDNUMsQ0FBQyxnQkFBZ0IsRUFBRSw4QkFBOEIsRUFBRSxXQUFXLENBQUM7SUFDL0QsQ0FBQyxrQkFBa0IsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLENBQUM7SUFDckQsQ0FBQyxlQUFlLEVBQUUsZUFBZSxFQUFFLFNBQVMsQ0FBQztJQUM3QyxDQUFDLGtCQUFrQixFQUFFLGtCQUFrQixFQUFFLFNBQVMsQ0FBQztJQUNuRCxDQUFDLGVBQWUsRUFBRSxlQUFlLEVBQUUsU0FBUyxDQUFDO0lBQzdDLENBQUMsaUJBQWlCLEVBQUUsaUJBQWlCLEVBQUUsV0FBVyxDQUFDO0lBQ25ELENBQUMsbUJBQW1CLEVBQUUsbUJBQW1CLEVBQUUsV0FBVyxDQUFDO0lBQ3ZELENBQUMsZUFBZSxFQUFFLHdCQUF3QixFQUFFLFVBQVUsQ0FBQztJQUN2RCxDQUFDLGlCQUFpQixFQUFFLDBCQUEwQixFQUFFLFVBQVUsQ0FBQztDQUNuRCxDQUFBO0FBR0csUUFBQSxjQUFjLEdBQTBCLG1CQUFXLENBQUMsR0FBRyxDQUNsRSxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FDYixDQUFBO0FBRUQsU0FBZ0IsbUJBQW1CLENBQ2pDLE1BQWUsRUFDZixNQUF5QixzQkFBYztJQUV2QyxNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUMxQixJQUNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDdEIsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUMxRCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FDYixnRUFBZ0UsQ0FDakUsQ0FBQTtJQUNILENBQUM7SUFDRCxPQUFPLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBaUIsQ0FBQTtBQUM3QyxDQUFDIn0=
+/** Elevated authority applies only to an active native staff principal. */
+function isSuperuser(principal) {
+    return (principal.actor_type === "user" &&
+        principal.active &&
+        principal.is_superuser);
+}
+// Describes authority beyond the finite permission catalog without inventing
+// grant identifiers for native routes that ordinary roles cannot access.
+exports.SUPERUSER_AUTHORITY = Object.freeze({
+    scope: "all_admin_operations",
+    description: "An active native staff account with the Superuser role can access all registered Admin pages and operations, including publishable API keys, secret API keys, workflows and plugin routes without a permission mapping. All permissions below are included, along with future permissions. Native authentication, validation and account safety protections still apply.",
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvbGliL2FjY2Vzcy9wZXJtaXNzaW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUEyQ0Esa0RBY0M7QUFhRCxrQ0FNQztBQTNFWSxRQUFBLFdBQVcsR0FBRztJQUN6QixDQUFDLFlBQVksRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDO0lBQ3RDLENBQUMsWUFBWSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUM7SUFDdEMsQ0FBQyxZQUFZLEVBQUUsMkJBQTJCLEVBQUUsUUFBUSxDQUFDO0lBQ3JELENBQUMsZUFBZSxFQUFFLDRCQUE0QixFQUFFLFNBQVMsQ0FBQztJQUMxRCxDQUFDLGlCQUFpQixFQUFFLHVCQUF1QixFQUFFLFNBQVMsQ0FBQztJQUN2RCxDQUFDLGVBQWUsRUFBRSxlQUFlLEVBQUUsU0FBUyxDQUFDO0lBQzdDLENBQUMsa0JBQWtCLEVBQUUsa0JBQWtCLEVBQUUsU0FBUyxDQUFDO0lBQ25ELENBQUMsaUJBQWlCLEVBQUUsaUJBQWlCLEVBQUUsU0FBUyxDQUFDO0lBQ2pELENBQUMsaUJBQWlCLEVBQUUsaUJBQWlCLEVBQUUsU0FBUyxDQUFDO0lBQ2pELENBQUMsaUJBQWlCLEVBQUUsaUJBQWlCLEVBQUUsU0FBUyxDQUFDO0lBQ2pELENBQUMsYUFBYSxFQUFFLGFBQWEsRUFBRSxTQUFTLENBQUM7SUFDekMsQ0FBQyxhQUFhLEVBQUUsZUFBZSxFQUFFLFNBQVMsQ0FBQztJQUMzQyxDQUFDLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLFNBQVMsQ0FBQztJQUNqRCxDQUFDLG1CQUFtQixFQUFFLG1CQUFtQixFQUFFLFNBQVMsQ0FBQztJQUNyRCxDQUFDLGtCQUFrQixFQUFFLGtCQUFrQixFQUFFLFNBQVMsQ0FBQztJQUNuRCxDQUFDLG9CQUFvQixFQUFFLG9CQUFvQixFQUFFLFNBQVMsQ0FBQztJQUN2RCxDQUFDLHdCQUF3QixFQUFFLGdDQUFnQyxFQUFFLFNBQVMsQ0FBQztJQUN2RSxDQUFDLGNBQWMsRUFBRSxnQkFBZ0IsRUFBRSxTQUFTLENBQUM7SUFDN0MsQ0FBQyxnQkFBZ0IsRUFBRSw2QkFBNkIsRUFBRSxXQUFXLENBQUM7SUFDOUQsQ0FBQyxrQkFBa0IsRUFBRSwrQkFBK0IsRUFBRSxXQUFXLENBQUM7SUFDbEUsQ0FBQyxzQkFBc0IsRUFBRSxzQkFBc0IsRUFBRSxXQUFXLENBQUM7SUFDN0QsQ0FBQyx3QkFBd0IsRUFBRSx3QkFBd0IsRUFBRSxXQUFXLENBQUM7SUFDakUsQ0FBQyxhQUFhLEVBQUUsYUFBYSxFQUFFLFFBQVEsQ0FBQztJQUN4QyxDQUFDLGVBQWUsRUFBRSx1Q0FBdUMsRUFBRSxRQUFRLENBQUM7SUFDcEUsQ0FBQyxlQUFlLEVBQUUsZUFBZSxFQUFFLFFBQVEsQ0FBQztJQUM1QyxDQUFDLGdCQUFnQixFQUFFLDhCQUE4QixFQUFFLFdBQVcsQ0FBQztJQUMvRCxDQUFDLGtCQUFrQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsQ0FBQztJQUNyRCxDQUFDLGVBQWUsRUFBRSxlQUFlLEVBQUUsU0FBUyxDQUFDO0lBQzdDLENBQUMsa0JBQWtCLEVBQUUsa0JBQWtCLEVBQUUsU0FBUyxDQUFDO0lBQ25ELENBQUMsZUFBZSxFQUFFLGVBQWUsRUFBRSxTQUFTLENBQUM7SUFDN0MsQ0FBQyxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxXQUFXLENBQUM7SUFDbkQsQ0FBQyxtQkFBbUIsRUFBRSxtQkFBbUIsRUFBRSxXQUFXLENBQUM7SUFDdkQsQ0FBQyxlQUFlLEVBQUUsd0JBQXdCLEVBQUUsVUFBVSxDQUFDO0lBQ3ZELENBQUMsaUJBQWlCLEVBQUUsMEJBQTBCLEVBQUUsVUFBVSxDQUFDO0NBQ25ELENBQUE7QUFHRyxRQUFBLGNBQWMsR0FBMEIsbUJBQVcsQ0FBQyxHQUFHLENBQ2xFLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsRUFBRSxDQUNiLENBQUE7QUFFRCxTQUFnQixtQkFBbUIsQ0FDakMsTUFBZSxFQUNmLE1BQXlCLHNCQUFjO0lBRXZDLE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBO0lBQzFCLElBQ0UsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQztRQUN0QixNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQzFELENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUNiLGdFQUFnRSxDQUNqRSxDQUFBO0lBQ0gsQ0FBQztJQUNELE9BQU8sQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFpQixDQUFBO0FBQzdDLENBQUM7QUFZRCwyRUFBMkU7QUFDM0UsU0FBZ0IsV0FBVyxDQUFDLFNBQTBCO0lBQ3BELE9BQU8sQ0FDTCxTQUFTLENBQUMsVUFBVSxLQUFLLE1BQU07UUFDL0IsU0FBUyxDQUFDLE1BQU07UUFDaEIsU0FBUyxDQUFDLFlBQVksQ0FDdkIsQ0FBQTtBQUNILENBQUM7QUFFRCw2RUFBNkU7QUFDN0UseUVBQXlFO0FBQzVELFFBQUEsbUJBQW1CLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUMvQyxLQUFLLEVBQUUsc0JBQStCO0lBQ3RDLFdBQVcsRUFDVCwwV0FBMFc7Q0FDN1csQ0FBQyxDQUFBIn0=

package/.medusa/server/src/lib/access/policy.d.ts

@@ -1,13 +1,22 @@
 import { type PermissionContext } from "./config";
-import type { Permission, AccessPrincipal } from "./permissions";
+import { type Permission, type AccessPrincipal } from "./permissions";
+export { additionalWritePermissions } from "./write-permissions";
 export type Policy = {
     permissions: Permission[];
     superuser?: boolean;
 };
 export declare function normalizedPath(url: string): string | null;
+/** Structural inspection; request body, scope and payload grants require resolveRequest. */
 export declare function policyFor(method: string, path: string): Policy | null;
 export declare function isBootstrapRead(method: string, path: string): boolean;
 export declare function isSelfProfileUpdate(method: string, path: string, userId: string, body: unknown): boolean;
 export declare function can(principal: AccessPrincipal, policy: Policy, context?: PermissionContext): boolean;
-export declare function validateFieldSelection(resource: string, fields: unknown): boolean;
-export declare function additionalWritePermissions(value: unknown, creating?: boolean): Permission[];
+/** Dashboard's group picker only reads member IDs to disable existing choices. */
+export declare function nativeFieldSelection<T>(resource: string, fields: T): T | string;
+/** Native promotion rule picker hydrates a selected sales channel by ID. */
+export declare function nativePromotionRuleValue(resource: string, params: Record<string, string>, query: {
+    id?: unknown;
+    value?: unknown;
+    limit?: unknown;
+}): string | undefined;
+export declare function validateFieldSelection(resource: string, fields: unknown, override?: readonly string[]): boolean;