@mercurjs/dashboard-sdk 2.3.6-canary.1 → 2.3.6-canary.10

package/dist/index.cjs

@@ -20,12 +20,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  OPERATION_IMPLICATIONS: () => OPERATION_IMPLICATIONS,
+  PERMISSION_RIGHT_RANK: () => PERMISSION_RIGHT_RANK,
   buildPermission: () => buildPermission,
   defineCustomFieldsConfig: () => defineCustomFieldsConfig,
   defineNavigationConfig: () => defineNavigationConfig,
   defineWidgetConfig: () => defineWidgetConfig,
-  parsePermission: () => parsePermission
+  parsePermission: () => parsePermission,
+  satisfiesPermission: () => satisfiesPermission
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -47,33 +48,39 @@ function defineCustomFieldsConfig(config) {
 }
 
 // src/permissions.ts
-var OPERATION_IMPLICATIONS = {
-  read: ["read"],
-  create: ["create"],
-  update: ["update"],
-  delete: ["delete"],
-  "*": ["read", "create", "update", "delete", "*"]
+var PERMISSION_RIGHT_RANK = {
+  view: 1,
+  edit: 2,
+  manage: 3
 };
 function parsePermission(permission) {
-  const parts = permission.split(":");
-  if (parts.length !== 2) {
+  const index = permission.lastIndexOf(":");
+  if (index <= 0) {
+    return null;
+  }
+  const right = permission.slice(index + 1);
+  if (!(right in PERMISSION_RIGHT_RANK)) {
     return null;
   }
-  const [resource, operation] = parts;
   return {
-    resource,
-    operation
+    key: permission.slice(0, index),
+    right
   };
 }
-function buildPermission(resource, operation) {
-  return `${resource}:${operation}`;
+function buildPermission(key, right) {
+  return `${key}:${right}`;
+}
+function satisfiesPermission(permissions, key, right) {
+  const granted = permissions[key];
+  return !!granted && PERMISSION_RIGHT_RANK[granted] >= PERMISSION_RIGHT_RANK[right];
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  OPERATION_IMPLICATIONS,
+  PERMISSION_RIGHT_RANK,
   buildPermission,
   defineCustomFieldsConfig,
   defineNavigationConfig,
   defineWidgetConfig,
-  parsePermission
+  parsePermission,
+  satisfiesPermission
 });

package/dist/index.d.cts

@@ -1,59 +1,6 @@
-export { B as BuiltMercurConfig, M as MercurConfig, O as OPERATION_IMPLICATIONS, P as Permission, a as PermissionOperation, b as PermissionRequirement, c as PermissionResource, d as PermissionsContextValue, e as PermissionsRequirementsContextValue, R as RouteConfig, f as RouteHandle, U as UserPolicy, g as buildPermission, p as parsePermission } from './types-CTuDKgPc.cjs';
-import { ComponentType, ReactNode } from 'react';
-
-/**
- * Open registry interfaces. Each panel package ships a generated
- * `extension-targets.d.ts` that seeds the built-in ids into these interfaces
- * (declaration merging), and a developer augments them by hand to register a
- * zone their own page renders. The helper unions read off the interface keys.
- *
- * @example
- * declare module "@mercurjs/dashboard-sdk" {
- *   interface WidgetZoneRegistry {
- *     "erp.dashboard.before": true
- *   }
- * }
- */
-interface WidgetZoneRegistry {
-}
-interface NavItemRegistry {
-}
-interface NavParentRegistry {
-}
-type WidgetZoneId = keyof WidgetZoneRegistry extends never ? string : keyof WidgetZoneRegistry;
-type NavItemId = keyof NavItemRegistry extends never ? string : keyof NavItemRegistry;
-type NavParentId = keyof NavParentRegistry extends never ? string : keyof NavParentRegistry;
-/**
- * A widget is a React component attached to a named zone on a page. The
- * placement (`before | after`) is encoded as the zone-id suffix, so there is no
- * separate rank field — multiple `before`/`after` widgets stack in registration
- * order.
- */
-interface WidgetConfig {
-    zone: WidgetZoneId | WidgetZoneId[];
-    /** Stable id; derived from the file path at build time when omitted. */
-    id?: string;
-}
-/** Override for a single built-in navigation item. */
-interface NavItemOverride {
-    id: NavItemId;
-    /** Order within the item's parent (or among top-level items). */
-    rank?: number;
-    /** Remove from the sidebar (route may still be reachable directly). */
-    hidden?: boolean;
-    /** i18n key or literal replacing the item's label. */
-    label?: string;
-    /** Icon component replacing the item's icon. */
-    icon?: ComponentType;
-    /**
-     * Re-parent the item: a built-in parent id moves it under that parent's
-     * children; `null` promotes a nested item to the top level.
-     */
-    nested?: NavParentId | null;
-}
-interface NavigationConfig {
-    items: NavItemOverride[];
-}
+import { h as NavigationConfig, W as WidgetConfig } from './types-BTgTMD_t.cjs';
+export { B as BuiltMercurConfig, M as MercurConfig, N as NavGroupConfig, a as NavGroupId, b as NavGroupRegistry, c as NavItemId, d as NavItemOverride, e as NavItemRegistry, f as NavParentId, g as NavParentRegistry, P as PERMISSION_RIGHT_RANK, i as Permission, j as PermissionKey, k as PermissionKeys, l as PermissionMap, m as PermissionRight, n as PermissionsContextValue, R as RouteConfig, o as RouteHandle, p as WidgetZoneId, q as WidgetZoneRegistry, r as buildPermission, s as parsePermission, t as satisfiesPermission } from './types-BTgTMD_t.cjs';
+import { ReactNode, ComponentType } from 'react';
 
 /**
  * Minimal structural stand-in for a Zod schema, so the SDK stays free of a zod
@@ -189,7 +136,7 @@ interface CustomFieldsConfig<TModel extends CustomFieldModel = CustomFieldModel>
 }
 
 declare function defineWidgetConfig(config: WidgetConfig): WidgetConfig;
-declare function defineNavigationConfig(config: NavigationConfig): NavigationConfig;
+declare function defineNavigationConfig<TGroup extends string = never>(config: NavigationConfig<TGroup>): NavigationConfig<TGroup>;
 declare function defineCustomFieldsConfig<TModel extends CustomFieldModel>(config: CustomFieldsConfig<TModel>): CustomFieldsConfig<TModel>;
 
-export { type ActivityEntry, type CustomColumn, type CustomDisplayEntry, type CustomDisplayField, type CustomFieldAction, type CustomFieldActionRegistry, type CustomFieldModel, type CustomFieldsConfig, type CustomFieldsRegistry, type CustomFormEntry, type CustomFormField, type CustomFormTab, type CustomFormZone, type CustomListExtension, type FieldValidation, type NavItemId, type NavItemOverride, type NavItemRegistry, type NavParentId, type NavParentRegistry, type NavigationConfig, type SectionAction, type WidgetConfig, type WidgetZoneId, type WidgetZoneRegistry, defineCustomFieldsConfig, defineNavigationConfig, defineWidgetConfig };
+export { type ActivityEntry, type CustomColumn, type CustomDisplayEntry, type CustomDisplayField, type CustomFieldAction, type CustomFieldActionRegistry, type CustomFieldModel, type CustomFieldsConfig, type CustomFieldsRegistry, type CustomFormEntry, type CustomFormField, type CustomFormTab, type CustomFormZone, type CustomListExtension, type FieldValidation, NavigationConfig, type SectionAction, WidgetConfig, defineCustomFieldsConfig, defineNavigationConfig, defineWidgetConfig };

package/dist/index.d.ts

@@ -1,59 +1,6 @@
-export { B as BuiltMercurConfig, M as MercurConfig, O as OPERATION_IMPLICATIONS, P as Permission, a as PermissionOperation, b as PermissionRequirement, c as PermissionResource, d as PermissionsContextValue, e as PermissionsRequirementsContextValue, R as RouteConfig, f as RouteHandle, U as UserPolicy, g as buildPermission, p as parsePermission } from './types-CTuDKgPc.js';
-import { ComponentType, ReactNode } from 'react';
-
-/**
- * Open registry interfaces. Each panel package ships a generated
- * `extension-targets.d.ts` that seeds the built-in ids into these interfaces
- * (declaration merging), and a developer augments them by hand to register a
- * zone their own page renders. The helper unions read off the interface keys.
- *
- * @example
- * declare module "@mercurjs/dashboard-sdk" {
- *   interface WidgetZoneRegistry {
- *     "erp.dashboard.before": true
- *   }
- * }
- */
-interface WidgetZoneRegistry {
-}
-interface NavItemRegistry {
-}
-interface NavParentRegistry {
-}
-type WidgetZoneId = keyof WidgetZoneRegistry extends never ? string : keyof WidgetZoneRegistry;
-type NavItemId = keyof NavItemRegistry extends never ? string : keyof NavItemRegistry;
-type NavParentId = keyof NavParentRegistry extends never ? string : keyof NavParentRegistry;
-/**
- * A widget is a React component attached to a named zone on a page. The
- * placement (`before | after`) is encoded as the zone-id suffix, so there is no
- * separate rank field — multiple `before`/`after` widgets stack in registration
- * order.
- */
-interface WidgetConfig {
-    zone: WidgetZoneId | WidgetZoneId[];
-    /** Stable id; derived from the file path at build time when omitted. */
-    id?: string;
-}
-/** Override for a single built-in navigation item. */
-interface NavItemOverride {
-    id: NavItemId;
-    /** Order within the item's parent (or among top-level items). */
-    rank?: number;
-    /** Remove from the sidebar (route may still be reachable directly). */
-    hidden?: boolean;
-    /** i18n key or literal replacing the item's label. */
-    label?: string;
-    /** Icon component replacing the item's icon. */
-    icon?: ComponentType;
-    /**
-     * Re-parent the item: a built-in parent id moves it under that parent's
-     * children; `null` promotes a nested item to the top level.
-     */
-    nested?: NavParentId | null;
-}
-interface NavigationConfig {
-    items: NavItemOverride[];
-}
+import { h as NavigationConfig, W as WidgetConfig } from './types-BTgTMD_t.js';
+export { B as BuiltMercurConfig, M as MercurConfig, N as NavGroupConfig, a as NavGroupId, b as NavGroupRegistry, c as NavItemId, d as NavItemOverride, e as NavItemRegistry, f as NavParentId, g as NavParentRegistry, P as PERMISSION_RIGHT_RANK, i as Permission, j as PermissionKey, k as PermissionKeys, l as PermissionMap, m as PermissionRight, n as PermissionsContextValue, R as RouteConfig, o as RouteHandle, p as WidgetZoneId, q as WidgetZoneRegistry, r as buildPermission, s as parsePermission, t as satisfiesPermission } from './types-BTgTMD_t.js';
+import { ReactNode, ComponentType } from 'react';
 
 /**
  * Minimal structural stand-in for a Zod schema, so the SDK stays free of a zod
@@ -189,7 +136,7 @@ interface CustomFieldsConfig<TModel extends CustomFieldModel = CustomFieldModel>
 }
 
 declare function defineWidgetConfig(config: WidgetConfig): WidgetConfig;
-declare function defineNavigationConfig(config: NavigationConfig): NavigationConfig;
+declare function defineNavigationConfig<TGroup extends string = never>(config: NavigationConfig<TGroup>): NavigationConfig<TGroup>;
 declare function defineCustomFieldsConfig<TModel extends CustomFieldModel>(config: CustomFieldsConfig<TModel>): CustomFieldsConfig<TModel>;
 
-export { type ActivityEntry, type CustomColumn, type CustomDisplayEntry, type CustomDisplayField, type CustomFieldAction, type CustomFieldActionRegistry, type CustomFieldModel, type CustomFieldsConfig, type CustomFieldsRegistry, type CustomFormEntry, type CustomFormField, type CustomFormTab, type CustomFormZone, type CustomListExtension, type FieldValidation, type NavItemId, type NavItemOverride, type NavItemRegistry, type NavParentId, type NavParentRegistry, type NavigationConfig, type SectionAction, type WidgetConfig, type WidgetZoneId, type WidgetZoneRegistry, defineCustomFieldsConfig, defineNavigationConfig, defineWidgetConfig };
+export { type ActivityEntry, type CustomColumn, type CustomDisplayEntry, type CustomDisplayField, type CustomFieldAction, type CustomFieldActionRegistry, type CustomFieldModel, type CustomFieldsConfig, type CustomFieldsRegistry, type CustomFormEntry, type CustomFormField, type CustomFormTab, type CustomFormZone, type CustomListExtension, type FieldValidation, NavigationConfig, type SectionAction, WidgetConfig, defineCustomFieldsConfig, defineNavigationConfig, defineWidgetConfig };

package/dist/index.js

@@ -18,32 +18,38 @@ function defineCustomFieldsConfig(config) {
 }
 
 // src/permissions.ts
-var OPERATION_IMPLICATIONS = {
-  read: ["read"],
-  create: ["create"],
-  update: ["update"],
-  delete: ["delete"],
-  "*": ["read", "create", "update", "delete", "*"]
+var PERMISSION_RIGHT_RANK = {
+  view: 1,
+  edit: 2,
+  manage: 3
 };
 function parsePermission(permission) {
-  const parts = permission.split(":");
-  if (parts.length !== 2) {
+  const index = permission.lastIndexOf(":");
+  if (index <= 0) {
+    return null;
+  }
+  const right = permission.slice(index + 1);
+  if (!(right in PERMISSION_RIGHT_RANK)) {
     return null;
   }
-  const [resource, operation] = parts;
   return {
-    resource,
-    operation
+    key: permission.slice(0, index),
+    right
   };
 }
-function buildPermission(resource, operation) {
-  return `${resource}:${operation}`;
+function buildPermission(key, right) {
+  return `${key}:${right}`;
+}
+function satisfiesPermission(permissions, key, right) {
+  const granted = permissions[key];
+  return !!granted && PERMISSION_RIGHT_RANK[granted] >= PERMISSION_RIGHT_RANK[right];
 }
 export {
-  OPERATION_IMPLICATIONS,
+  PERMISSION_RIGHT_RANK,
   buildPermission,
   defineCustomFieldsConfig,
   defineNavigationConfig,
   defineWidgetConfig,
-  parsePermission
+  parsePermission,
+  satisfiesPermission
 };

package/dist/types-BTgTMD_t.d.cts

@@ -0,0 +1,282 @@
+import { ComponentType, ReactNode } from 'react';
+
+/**
+ * Permission strings follow `{key}:{right}`, e.g. `orders:view`,
+ * `products:edit`, `sellers.approval:edit`.
+ *
+ * Keys mirror the catalog declared server-side with `defineMercurPermissions`
+ * (`packages/core/src/permissions/definitions`). Rights nest:
+ * `manage` implies `edit`, `edit` implies `view`.
+ */
+/**
+ * Registry of permission keys. Plugins add their own keys through declaration
+ * merging:
+ *
+ * @example
+ * declare module "@mercurjs/dashboard-sdk" {
+ *   interface PermissionKeys {
+ *     messaging: true
+ *   }
+ * }
+ */
+interface PermissionKeys {
+    "sellers": true;
+    "sellers.approval": true;
+    "sellers.premium": true;
+    "members": true;
+    "members.invites": true;
+    "roles": true;
+    "roles.owner": true;
+    "orders": true;
+    "orders.refunds": true;
+    "orders.returns": true;
+    "orders.edits": true;
+    "order_groups": true;
+    "payments": true;
+    "customers": true;
+    "customer_groups": true;
+    "products": true;
+    "products.review": true;
+    "product_changes": true;
+    "product_categories": true;
+    "product_collections": true;
+    "product_types": true;
+    "product_tags": true;
+    "product_attributes": true;
+    "offers": true;
+    "inventory_items": true;
+    "reservations": true;
+    "stock_locations": true;
+    "price_lists": true;
+    "price_preferences": true;
+    "promotions": true;
+    "campaigns": true;
+    "commission_rates": true;
+    "commission_lines": true;
+    "payouts": true;
+    "payout_accounts": true;
+    "shipping_profiles": true;
+    "shipping_options": true;
+    "fulfillment_sets": true;
+    "regions": true;
+    "tax_regions": true;
+    "store": true;
+    "sales_channels": true;
+    "return_reasons": true;
+    "refund_reasons": true;
+    "users": true;
+    "api_keys": true;
+    "translations": true;
+    "notifications": true;
+    "workflow_executions": true;
+    "reviews": true;
+}
+type PermissionKey = Extract<keyof PermissionKeys, string>;
+type PermissionRight = "view" | "edit" | "manage";
+type Permission = `${PermissionKey}:${PermissionRight}`;
+/** Effective rights of the acting user, as returned by `fields=+permissions`. */
+type PermissionMap = Partial<Record<string, PermissionRight>>;
+declare const PERMISSION_RIGHT_RANK: Record<PermissionRight, number>;
+interface PermissionsContextValue {
+    /** `null` while no access-control module is enforcing permissions. */
+    permissions: PermissionMap | null;
+    isLoading: boolean;
+    /** When `false`, every check resolves to `true`. */
+    isEnforced: boolean;
+    hasPermission: (permission: Permission) => boolean;
+    hasAnyPermission: (permissions: Permission[]) => boolean;
+    hasAllPermissions: (permissions: Permission[]) => boolean;
+    can: (key: PermissionKey, right?: PermissionRight) => boolean;
+}
+declare function parsePermission(permission: string): {
+    key: PermissionKey;
+    right: PermissionRight;
+} | null;
+declare function buildPermission(key: PermissionKey, right: PermissionRight): Permission;
+declare function satisfiesPermission(permissions: PermissionMap, key: string, right: PermissionRight): boolean;
+
+/**
+ * Open registry interfaces. Each panel package ships a generated
+ * `extension-targets.d.ts` that seeds the built-in ids into these interfaces
+ * (declaration merging), and a developer augments them by hand to register a
+ * zone their own page renders. The helper unions read off the interface keys.
+ *
+ * @example
+ * declare module "@mercurjs/dashboard-sdk" {
+ *   interface WidgetZoneRegistry {
+ *     "erp.dashboard.before": true
+ *   }
+ * }
+ */
+interface WidgetZoneRegistry {
+}
+interface NavItemRegistry {
+}
+interface NavParentRegistry {
+}
+interface NavGroupRegistry {
+}
+type WidgetZoneId = keyof WidgetZoneRegistry extends never ? string : keyof WidgetZoneRegistry;
+type NavItemId = keyof NavItemRegistry extends never ? string : keyof NavItemRegistry;
+type NavParentId = keyof NavParentRegistry extends never ? string : keyof NavParentRegistry;
+type NavGroupId = keyof NavGroupRegistry extends never ? string : keyof NavGroupRegistry;
+/**
+ * A widget is a React component attached to a named zone on a page. The
+ * placement (`before | after`) is encoded as the zone-id suffix, so there is no
+ * separate rank field — multiple `before`/`after` widgets stack in registration
+ * order.
+ */
+interface WidgetConfig {
+    zone: WidgetZoneId | WidgetZoneId[];
+    /** Stable id; derived from the file path at build time when omitted. */
+    id?: string;
+    /**
+     * Permission(s) the actor needs for the widget to render. With several, any
+     * one is enough.
+     */
+    permission?: Permission | Permission[];
+    /**
+     * i18n key or literal naming the tab. Required for a `*.tabs.*` zone, where
+     * the widget renders as a tab's panel; ignored elsewhere.
+     */
+    label?: string;
+}
+/** Override for a single built-in navigation item. */
+interface NavItemOverride<TGroup extends string = never> {
+    id: NavItemId;
+    /** Order within the item's parent (or among top-level items). */
+    rank?: number;
+    /** Remove from the sidebar (route may still be reachable directly). */
+    hidden?: boolean;
+    /** i18n key or literal replacing the item's label. */
+    label?: string;
+    /** Icon component replacing the item's icon. */
+    icon?: ComponentType;
+    /**
+     * Re-parent the item: a built-in parent id moves it under that parent's
+     * children; `null` promotes a nested item to the top level.
+     */
+    nested?: NavParentId | null;
+    /**
+     * List the item under a group heading: a built-in settings group id or one
+     * declared in `groups`. Main sidebar items only join declared groups.
+     */
+    group?: NavGroupId | TGroup;
+}
+/**
+ * Declares a sidebar group, or overrides a built-in settings group by id. A
+ * group renders in whichever sidebar its items live in.
+ */
+interface NavGroupConfig<TId extends string = string> {
+    id: NavGroupId | TId;
+    /** i18n key (with `translationNs`) or literal. Falls back to the id. */
+    label?: string;
+    translationNs?: string;
+    /** Order among groups, lower first. Built-in settings groups rank 0, 1, 2… */
+    rank?: number;
+    /** Remove the group and its items from the sidebar. */
+    hidden?: boolean;
+}
+interface NavigationConfig<TGroup extends string = never> {
+    groups?: NavGroupConfig<TGroup>[];
+    items?: NavItemOverride<NoInfer<TGroup>>[];
+}
+
+/**
+ * Configuration for the Mercur dashboard plugin.
+ *
+ * Passed to `mercurDashboardPlugin()` in `vite.config.ts` to configure
+ * the vendor or admin dashboard at build time.
+ *
+ * @example
+ * ```ts
+ * mercurDashboardPlugin({
+ *   medusaConfigPath: '../../packages/api/medusa-config.ts',
+ *   enableSellerRegistration: true,
+ * })
+ * ```
+ */
+interface MercurConfig {
+    /** Path to the MedusaJS config file, resolved relative to the project root. */
+    medusaConfigPath: string;
+    /**
+     * Backend URL for API requests.
+     * @default "http://localhost:9000"
+     */
+    backendUrl?: string;
+    /**
+     * Absolute base URL for the vendor dashboard, including any path prefix
+     * (for example `https://vendors.example.com/seller`).
+     *
+     * The plugin does not read `.env` files on its own. Load env in your
+     * app's `vite.config.ts` and pass the value here when you need
+     * cross-origin links such as seller invite URLs.
+     *
+     * If omitted, the plugin falls back to vendor module dev server
+     * detection in development and to the configured vendor path in
+     * production.
+     */
+    vendorUrl?: string;
+    /** Dashboard display name. */
+    name?: string;
+    /** Path to a logo asset for the dashboard. */
+    logo?: string;
+    /** Internationalization settings. */
+    i18n?: {
+        /** The default language code (e.g. `"en"`). */
+        defaultLanguage: string;
+    };
+    /** Whether to allow new sellers to register from the login screen. */
+    enableSellerRegistration?: boolean;
+    /**
+     * Maximum allowed size for image uploads, in bytes.
+     * Used by dashboard upload components to reject oversized files
+     * before they are sent to the backend.
+     * @default 2_097_152 // 2 MB
+     */
+    imageLimit?: number;
+}
+interface BuiltMercurConfig extends MercurConfig {
+    backendUrl: string;
+    base?: string;
+    root: string;
+    srcDir: string;
+    pluginExtensions: string[];
+    imageLimit: number;
+}
+type RouteConfig = {
+    label: string;
+    icon?: ComponentType;
+    rank?: number;
+    nested?: string;
+    /**
+     * Sidebar group to list the route under: one declared in `_navigation.ts`
+     * or, for a `/settings/*` route, a built-in settings group. Must be a
+     * string literal.
+     */
+    group?: NavGroupId | (string & {});
+    translationNs?: string;
+    public?: boolean;
+    /**
+     * Permissions the actor must hold for this route's sidebar entry to be
+     * shown. Enforcement of the route itself comes from `handle.permissions`
+     * — this only controls navigation visibility.
+     */
+    permissions?: Permission[];
+    /** If true, ALL `permissions` are required. Defaults to ANY. */
+    requireAll?: boolean;
+};
+/**
+ * The value of a route module's `export const handle`. Read by react-router's
+ * `useMatches()`; `permissions` is enforced by `RoutePermissionGuard`.
+ */
+type RouteHandle = {
+    permissions?: Permission | Permission[];
+    /** If true (default at the route level), ALL permissions are required. */
+    requireAll?: boolean;
+    /** Where to send the actor on denial. Renders Access Denied when unset. */
+    redirectTo?: string;
+    breadcrumb?: (match: never) => ReactNode;
+};
+
+export { type BuiltMercurConfig as B, type MercurConfig as M, type NavGroupConfig as N, PERMISSION_RIGHT_RANK as P, type RouteConfig as R, type WidgetConfig as W, type NavGroupId as a, type NavGroupRegistry as b, type NavItemId as c, type NavItemOverride as d, type NavItemRegistry as e, type NavParentId as f, type NavParentRegistry as g, type NavigationConfig as h, type Permission as i, type PermissionKey as j, type PermissionKeys as k, type PermissionMap as l, type PermissionRight as m, type PermissionsContextValue as n, type RouteHandle as o, type WidgetZoneId as p, type WidgetZoneRegistry as q, buildPermission as r, parsePermission as s, satisfiesPermission as t };

package/dist/types-BTgTMD_t.d.ts

@@ -0,0 +1,282 @@
+import { ComponentType, ReactNode } from 'react';
+
+/**
+ * Permission strings follow `{key}:{right}`, e.g. `orders:view`,
+ * `products:edit`, `sellers.approval:edit`.
+ *
+ * Keys mirror the catalog declared server-side with `defineMercurPermissions`
+ * (`packages/core/src/permissions/definitions`). Rights nest:
+ * `manage` implies `edit`, `edit` implies `view`.
+ */
+/**
+ * Registry of permission keys. Plugins add their own keys through declaration
+ * merging:
+ *
+ * @example
+ * declare module "@mercurjs/dashboard-sdk" {
+ *   interface PermissionKeys {
+ *     messaging: true
+ *   }
+ * }
+ */
+interface PermissionKeys {
+    "sellers": true;
+    "sellers.approval": true;
+    "sellers.premium": true;
+    "members": true;
+    "members.invites": true;
+    "roles": true;
+    "roles.owner": true;
+    "orders": true;
+    "orders.refunds": true;
+    "orders.returns": true;
+    "orders.edits": true;
+    "order_groups": true;
+    "payments": true;
+    "customers": true;
+    "customer_groups": true;
+    "products": true;
+    "products.review": true;
+    "product_changes": true;
+    "product_categories": true;
+    "product_collections": true;
+    "product_types": true;
+    "product_tags": true;
+    "product_attributes": true;
+    "offers": true;
+    "inventory_items": true;
+    "reservations": true;
+    "stock_locations": true;
+    "price_lists": true;
+    "price_preferences": true;
+    "promotions": true;
+    "campaigns": true;
+    "commission_rates": true;
+    "commission_lines": true;
+    "payouts": true;
+    "payout_accounts": true;
+    "shipping_profiles": true;
+    "shipping_options": true;
+    "fulfillment_sets": true;
+    "regions": true;
+    "tax_regions": true;
+    "store": true;
+    "sales_channels": true;
+    "return_reasons": true;
+    "refund_reasons": true;
+    "users": true;
+    "api_keys": true;
+    "translations": true;
+    "notifications": true;
+    "workflow_executions": true;
+    "reviews": true;
+}
+type PermissionKey = Extract<keyof PermissionKeys, string>;
+type PermissionRight = "view" | "edit" | "manage";
+type Permission = `${PermissionKey}:${PermissionRight}`;
+/** Effective rights of the acting user, as returned by `fields=+permissions`. */
+type PermissionMap = Partial<Record<string, PermissionRight>>;
+declare const PERMISSION_RIGHT_RANK: Record<PermissionRight, number>;
+interface PermissionsContextValue {
+    /** `null` while no access-control module is enforcing permissions. */
+    permissions: PermissionMap | null;
+    isLoading: boolean;
+    /** When `false`, every check resolves to `true`. */
+    isEnforced: boolean;
+    hasPermission: (permission: Permission) => boolean;
+    hasAnyPermission: (permissions: Permission[]) => boolean;
+    hasAllPermissions: (permissions: Permission[]) => boolean;
+    can: (key: PermissionKey, right?: PermissionRight) => boolean;
+}
+declare function parsePermission(permission: string): {
+    key: PermissionKey;
+    right: PermissionRight;
+} | null;
+declare function buildPermission(key: PermissionKey, right: PermissionRight): Permission;
+declare function satisfiesPermission(permissions: PermissionMap, key: string, right: PermissionRight): boolean;
+
+/**
+ * Open registry interfaces. Each panel package ships a generated
+ * `extension-targets.d.ts` that seeds the built-in ids into these interfaces
+ * (declaration merging), and a developer augments them by hand to register a
+ * zone their own page renders. The helper unions read off the interface keys.
+ *
+ * @example
+ * declare module "@mercurjs/dashboard-sdk" {
+ *   interface WidgetZoneRegistry {
+ *     "erp.dashboard.before": true
+ *   }
+ * }
+ */
+interface WidgetZoneRegistry {
+}
+interface NavItemRegistry {
+}
+interface NavParentRegistry {
+}
+interface NavGroupRegistry {
+}
+type WidgetZoneId = keyof WidgetZoneRegistry extends never ? string : keyof WidgetZoneRegistry;
+type NavItemId = keyof NavItemRegistry extends never ? string : keyof NavItemRegistry;
+type NavParentId = keyof NavParentRegistry extends never ? string : keyof NavParentRegistry;
+type NavGroupId = keyof NavGroupRegistry extends never ? string : keyof NavGroupRegistry;
+/**
+ * A widget is a React component attached to a named zone on a page. The
+ * placement (`before | after`) is encoded as the zone-id suffix, so there is no
+ * separate rank field — multiple `before`/`after` widgets stack in registration
+ * order.
+ */
+interface WidgetConfig {
+    zone: WidgetZoneId | WidgetZoneId[];
+    /** Stable id; derived from the file path at build time when omitted. */
+    id?: string;
+    /**
+     * Permission(s) the actor needs for the widget to render. With several, any
+     * one is enough.
+     */
+    permission?: Permission | Permission[];
+    /**
+     * i18n key or literal naming the tab. Required for a `*.tabs.*` zone, where
+     * the widget renders as a tab's panel; ignored elsewhere.
+     */
+    label?: string;
+}
+/** Override for a single built-in navigation item. */
+interface NavItemOverride<TGroup extends string = never> {
+    id: NavItemId;
+    /** Order within the item's parent (or among top-level items). */
+    rank?: number;
+    /** Remove from the sidebar (route may still be reachable directly). */
+    hidden?: boolean;
+    /** i18n key or literal replacing the item's label. */
+    label?: string;
+    /** Icon component replacing the item's icon. */
+    icon?: ComponentType;
+    /**
+     * Re-parent the item: a built-in parent id moves it under that parent's
+     * children; `null` promotes a nested item to the top level.
+     */
+    nested?: NavParentId | null;
+    /**
+     * List the item under a group heading: a built-in settings group id or one
+     * declared in `groups`. Main sidebar items only join declared groups.
+     */
+    group?: NavGroupId | TGroup;
+}
+/**
+ * Declares a sidebar group, or overrides a built-in settings group by id. A
+ * group renders in whichever sidebar its items live in.
+ */
+interface NavGroupConfig<TId extends string = string> {
+    id: NavGroupId | TId;
+    /** i18n key (with `translationNs`) or literal. Falls back to the id. */
+    label?: string;
+    translationNs?: string;
+    /** Order among groups, lower first. Built-in settings groups rank 0, 1, 2… */
+    rank?: number;
+    /** Remove the group and its items from the sidebar. */
+    hidden?: boolean;
+}
+interface NavigationConfig<TGroup extends string = never> {
+    groups?: NavGroupConfig<TGroup>[];
+    items?: NavItemOverride<NoInfer<TGroup>>[];
+}
+
+/**
+ * Configuration for the Mercur dashboard plugin.
+ *
+ * Passed to `mercurDashboardPlugin()` in `vite.config.ts` to configure
+ * the vendor or admin dashboard at build time.
+ *
+ * @example
+ * ```ts
+ * mercurDashboardPlugin({
+ *   medusaConfigPath: '../../packages/api/medusa-config.ts',
+ *   enableSellerRegistration: true,
+ * })
+ * ```
+ */
+interface MercurConfig {
+    /** Path to the MedusaJS config file, resolved relative to the project root. */
+    medusaConfigPath: string;
+    /**
+     * Backend URL for API requests.
+     * @default "http://localhost:9000"
+     */
+    backendUrl?: string;
+    /**
+     * Absolute base URL for the vendor dashboard, including any path prefix
+     * (for example `https://vendors.example.com/seller`).
+     *
+     * The plugin does not read `.env` files on its own. Load env in your
+     * app's `vite.config.ts` and pass the value here when you need
+     * cross-origin links such as seller invite URLs.
+     *
+     * If omitted, the plugin falls back to vendor module dev server
+     * detection in development and to the configured vendor path in
+     * production.
+     */
+    vendorUrl?: string;
+    /** Dashboard display name. */
+    name?: string;
+    /** Path to a logo asset for the dashboard. */
+    logo?: string;
+    /** Internationalization settings. */
+    i18n?: {
+        /** The default language code (e.g. `"en"`). */
+        defaultLanguage: string;
+    };
+    /** Whether to allow new sellers to register from the login screen. */
+    enableSellerRegistration?: boolean;
+    /**
+     * Maximum allowed size for image uploads, in bytes.
+     * Used by dashboard upload components to reject oversized files
+     * before they are sent to the backend.
+     * @default 2_097_152 // 2 MB
+     */
+    imageLimit?: number;
+}
+interface BuiltMercurConfig extends MercurConfig {
+    backendUrl: string;
+    base?: string;
+    root: string;
+    srcDir: string;
+    pluginExtensions: string[];
+    imageLimit: number;
+}
+type RouteConfig = {
+    label: string;
+    icon?: ComponentType;
+    rank?: number;
+    nested?: string;
+    /**
+     * Sidebar group to list the route under: one declared in `_navigation.ts`
+     * or, for a `/settings/*` route, a built-in settings group. Must be a
+     * string literal.
+     */
+    group?: NavGroupId | (string & {});
+    translationNs?: string;
+    public?: boolean;
+    /**
+     * Permissions the actor must hold for this route's sidebar entry to be
+     * shown. Enforcement of the route itself comes from `handle.permissions`
+     * — this only controls navigation visibility.
+     */
+    permissions?: Permission[];
+    /** If true, ALL `permissions` are required. Defaults to ANY. */
+    requireAll?: boolean;
+};
+/**
+ * The value of a route module's `export const handle`. Read by react-router's
+ * `useMatches()`; `permissions` is enforced by `RoutePermissionGuard`.
+ */
+type RouteHandle = {
+    permissions?: Permission | Permission[];
+    /** If true (default at the route level), ALL permissions are required. */
+    requireAll?: boolean;
+    /** Where to send the actor on denial. Renders Access Denied when unset. */
+    redirectTo?: string;
+    breadcrumb?: (match: never) => ReactNode;
+};
+
+export { type BuiltMercurConfig as B, type MercurConfig as M, type NavGroupConfig as N, PERMISSION_RIGHT_RANK as P, type RouteConfig as R, type WidgetConfig as W, type NavGroupId as a, type NavGroupRegistry as b, type NavItemId as c, type NavItemOverride as d, type NavItemRegistry as e, type NavParentId as f, type NavParentRegistry as g, type NavigationConfig as h, type Permission as i, type PermissionKey as j, type PermissionKeys as k, type PermissionMap as l, type PermissionRight as m, type PermissionsContextValue as n, type RouteHandle as o, type WidgetZoneId as p, type WidgetZoneRegistry as q, buildPermission as r, parsePermission as s, satisfiesPermission as t };

package/dist/vite.cjs

@@ -464,6 +464,13 @@ function processConfigProperties(properties) {
   if (nested && (0, import_types.isObjectProperty)(nested) && (0, import_types.isStringLiteral)(nested.value)) {
     nestedValue = nested.value.value;
   }
+  const group = properties.find(
+    (prop) => (0, import_types.isObjectProperty)(prop) && (0, import_types.isIdentifier)(prop.key, { name: "group" })
+  );
+  let groupValue;
+  if (group && (0, import_types.isObjectProperty)(group) && (0, import_types.isStringLiteral)(group.value)) {
+    groupValue = group.value.value;
+  }
   const translationNs = properties.find(
     (prop) => (0, import_types.isObjectProperty)(prop) && (0, import_types.isIdentifier)(prop.key, { name: "translationNs" })
   );
@@ -490,6 +497,7 @@ function processConfigProperties(properties) {
     icon: hasIcon,
     rank: rankValue,
     nested: nestedValue,
+    group: groupValue,
     translationNs: translationNsValue,
     // Referenced by identifier at runtime rather than extracted here, so
     // the array may be computed instead of a string-literal list.
@@ -539,6 +547,7 @@ function generateMenuItem(config, file, routesDir, index) {
     path: getRoute2(file, routesDir),
     rank: config.rank,
     nested: config.nested,
+    group: config.group,
     translationNs: config.translationNs ? `${configName}.translationNs` : void 0,
     permissions: config.permissions ? `${configName}.permissions` : void 0,
     requireAll: config.requireAll
@@ -551,6 +560,7 @@ function formatMenuItem(menuItem) {
     `        path: "${menuItem.path}"`,
     `        rank: ${menuItem.rank !== void 0 ? menuItem.rank : "undefined"}`,
     `        nested: ${menuItem.nested ? `"${menuItem.nested}"` : "undefined"}`,
+    `        group: ${menuItem.group ? JSON.stringify(menuItem.group) : "undefined"}`,
     `        translationNs: ${menuItem.translationNs || "undefined"}`,
     `        permissions: ${menuItem.permissions || "undefined"}`,
     `        requireAll: ${menuItem.requireAll !== void 0 ? menuItem.requireAll : "undefined"}`
@@ -665,7 +675,7 @@ export default [${sources.join(", ")}].reduce(mergeResources, {})
 // src/widgets.ts
 var import_fs5 = __toESM(require("fs"), 1);
 var import_path5 = __toESM(require("path"), 1);
-function extractZones(value, zones) {
+function extractStrings(value, zones) {
   if ((0, import_types.isStringLiteral)(value)) {
     zones.push(value.value);
   } else if ((0, import_types.isArrayExpression)(value)) {
@@ -676,18 +686,26 @@ function extractZones(value, zones) {
 }
 function readWidgetConfig(properties) {
   const zones = [];
+  const permissions = [];
   let id;
+  let label;
   for (const prop of properties) {
     if (!(0, import_types.isObjectProperty)(prop)) continue;
     if ((0, import_types.isIdentifier)(prop.key, { name: "zone" })) {
-      extractZones(prop.value, zones);
+      extractStrings(prop.value, zones);
+    }
+    if ((0, import_types.isIdentifier)(prop.key, { name: "permission" })) {
+      extractStrings(prop.value, permissions);
     }
     if ((0, import_types.isIdentifier)(prop.key, { name: "id" }) && (0, import_types.isStringLiteral)(prop.value)) {
       id = prop.value.value;
     }
+    if ((0, import_types.isIdentifier)(prop.key, { name: "label" }) && (0, import_types.isStringLiteral)(prop.value)) {
+      label = prop.value.value;
+    }
   }
   if (zones.length === 0) return null;
-  return { zones, id };
+  return { zones, id, label, permissions };
 }
 function getConfigProperties(node) {
   if ((0, import_types.isCallExpression)(node) && node.arguments.length > 0 && (0, import_types.isObjectExpression)(node.arguments[0])) {
@@ -751,7 +769,7 @@ function parseWidgetFile(file, widgetsDir, index) {
     import: `import ${name} from "${importPath}"`,
     entry: `    { Component: ${name}, zone: ${zonesLiteral}, widgetId: ${JSON.stringify(
       id
-    )} }`
+    )}${info.label ? `, label: ${JSON.stringify(info.label)}` : ""}${info.permissions.length ? `, permission: ${JSON.stringify(info.permissions)}` : ""} }`
   };
 }
 function collectWidgets(srcDir, startIndex = 0) {

package/dist/vite.d.cts

@@ -1,5 +1,5 @@
 import * as Vite from 'vite';
-import { M as MercurConfig } from './types-CTuDKgPc.cjs';
+import { M as MercurConfig } from './types-BTgTMD_t.cjs';
 import 'react';
 
 declare function mercurDashboardPlugin(pluginConfig: MercurConfig): Vite.Plugin;

package/dist/vite.d.ts

@@ -1,5 +1,5 @@
 import * as Vite from 'vite';
-import { M as MercurConfig } from './types-CTuDKgPc.js';
+import { M as MercurConfig } from './types-BTgTMD_t.js';
 import 'react';
 
 declare function mercurDashboardPlugin(pluginConfig: MercurConfig): Vite.Plugin;

package/dist/vite.js

@@ -444,6 +444,13 @@ function processConfigProperties(properties) {
   if (nested && isObjectProperty(nested) && isStringLiteral(nested.value)) {
     nestedValue = nested.value.value;
   }
+  const group = properties.find(
+    (prop) => isObjectProperty(prop) && isIdentifier(prop.key, { name: "group" })
+  );
+  let groupValue;
+  if (group && isObjectProperty(group) && isStringLiteral(group.value)) {
+    groupValue = group.value.value;
+  }
   const translationNs = properties.find(
     (prop) => isObjectProperty(prop) && isIdentifier(prop.key, { name: "translationNs" })
   );
@@ -470,6 +477,7 @@ function processConfigProperties(properties) {
     icon: hasIcon,
     rank: rankValue,
     nested: nestedValue,
+    group: groupValue,
     translationNs: translationNsValue,
     // Referenced by identifier at runtime rather than extracted here, so
     // the array may be computed instead of a string-literal list.
@@ -519,6 +527,7 @@ function generateMenuItem(config, file, routesDir, index) {
     path: getRoute2(file, routesDir),
     rank: config.rank,
     nested: config.nested,
+    group: config.group,
     translationNs: config.translationNs ? `${configName}.translationNs` : void 0,
     permissions: config.permissions ? `${configName}.permissions` : void 0,
     requireAll: config.requireAll
@@ -531,6 +540,7 @@ function formatMenuItem(menuItem) {
     `        path: "${menuItem.path}"`,
     `        rank: ${menuItem.rank !== void 0 ? menuItem.rank : "undefined"}`,
     `        nested: ${menuItem.nested ? `"${menuItem.nested}"` : "undefined"}`,
+    `        group: ${menuItem.group ? JSON.stringify(menuItem.group) : "undefined"}`,
     `        translationNs: ${menuItem.translationNs || "undefined"}`,
     `        permissions: ${menuItem.permissions || "undefined"}`,
     `        requireAll: ${menuItem.requireAll !== void 0 ? menuItem.requireAll : "undefined"}`
@@ -645,7 +655,7 @@ export default [${sources.join(", ")}].reduce(mergeResources, {})
 // src/widgets.ts
 import fs5 from "fs";
 import path5 from "path";
-function extractZones(value, zones) {
+function extractStrings(value, zones) {
   if (isStringLiteral(value)) {
     zones.push(value.value);
   } else if (isArrayExpression(value)) {
@@ -656,18 +666,26 @@ function extractZones(value, zones) {
 }
 function readWidgetConfig(properties) {
   const zones = [];
+  const permissions = [];
   let id;
+  let label;
   for (const prop of properties) {
     if (!isObjectProperty(prop)) continue;
     if (isIdentifier(prop.key, { name: "zone" })) {
-      extractZones(prop.value, zones);
+      extractStrings(prop.value, zones);
+    }
+    if (isIdentifier(prop.key, { name: "permission" })) {
+      extractStrings(prop.value, permissions);
     }
     if (isIdentifier(prop.key, { name: "id" }) && isStringLiteral(prop.value)) {
       id = prop.value.value;
     }
+    if (isIdentifier(prop.key, { name: "label" }) && isStringLiteral(prop.value)) {
+      label = prop.value.value;
+    }
   }
   if (zones.length === 0) return null;
-  return { zones, id };
+  return { zones, id, label, permissions };
 }
 function getConfigProperties(node) {
   if (isCallExpression(node) && node.arguments.length > 0 && isObjectExpression(node.arguments[0])) {
@@ -731,7 +749,7 @@ function parseWidgetFile(file, widgetsDir, index) {
     import: `import ${name} from "${importPath}"`,
     entry: `    { Component: ${name}, zone: ${zonesLiteral}, widgetId: ${JSON.stringify(
       id
-    )} }`
+    )}${info.label ? `, label: ${JSON.stringify(info.label)}` : ""}${info.permissions.length ? `, permission: ${JSON.stringify(info.permissions)}` : ""} }`
   };
 }
 function collectWidgets(srcDir, startIndex = 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mercurjs/dashboard-sdk",
-  "version": "2.3.6-canary.1",
+  "version": "2.3.6-canary.10",
   "repository": {
     "type": "git",
     "url": "https://github.com/mercurjs/mercur",
@@ -31,12 +31,13 @@
   "scripts": {
     "dev": "tsup --watch",
     "build": "tsup",
+    "test:types": "tsc -p src/__tests__/types",
     "lint": "oxlint --max-warnings 0"
   },
   "dependencies": {
     "@babel/parser": "8.0.5",
-    "@babel/traverse": "7.25.6",
-    "@babel/types": "8.0.4",
+    "@babel/traverse": "8.0.6",
+    "@babel/types": "8.0.6",
     "esbuild-register": "^3.6.0"
   },
   "devDependencies": {

package/dist/types-CTuDKgPc.d.cts

@@ -1,142 +0,0 @@
-import { ComponentType, ReactNode } from 'react';
-
-/**
- * Permission strings follow the pattern `{resource}:{operation}`, e.g.
- * `customer:read`, `product:create`, `order:*`.
- *
- * The resource list mirrors the policies registered server-side — Medusa's own
- * catalog plus Mercur's (`packages/core/src/policies`). A name that is not
- * registered there is not a type error, it simply never matches a granted
- * policy, so the two are kept in sync by a test in `packages/admin`.
- */
-type PermissionResource = "api_key" | "campaign" | "commission_line" | "commission_rate" | "commission_rule" | "currency" | "customer" | "customer_address" | "customer_group" | "file" | "fulfillment" | "fulfillment_provider" | "fulfillment_set" | "inventory_item" | "inventory_level" | "invite" | "member_invite" | "notification" | "offer" | "order" | "order_change" | "order_claim" | "order_claim_item" | "order_exchange" | "order_group" | "order_item" | "payment" | "payment_collection" | "payment_method" | "payment_session" | "payout" | "payout_account" | "price" | "price_list" | "price_preference" | "product" | "product_attribute" | "product_attribute_value" | "product_category" | "product_change" | "product_collection" | "product_option" | "product_option_value" | "product_tag" | "product_type" | "product_variant" | "promotion" | "rbac_policy" | "rbac_role" | "refund_reason" | "region" | "reservation_item" | "return" | "return_reason" | "review" | "sales_channel" | "seller" | "seller_member" | "service_zone" | "shipping_option" | "shipping_option_type" | "shipping_profile" | "stock_location" | "store" | "store_locale" | "tax_provider" | "tax_rate" | "tax_region" | "translation" | "translation_setting" | "user" | "workflow_execution";
-type PermissionOperation = "read" | "create" | "update" | "delete" | "*";
-type Permission = `${PermissionResource}:${PermissionOperation}`;
-interface UserPolicy {
-    permissions: Permission[];
-}
-interface PermissionRequirement {
-    permissions: Permission[];
-    /** If true, ALL permissions are required. Defaults to ANY. */
-    requireAll?: boolean;
-    /** Optional label describing where the requirement came from. */
-    source?: string;
-}
-interface PermissionsContextValue {
-    policy: UserPolicy | null;
-    isLoading: boolean;
-    /** Whether RBAC is active. When `false`, every check resolves to `true`. */
-    isRbacEnabled: boolean;
-    hasPermission: (permission: Permission) => boolean;
-    hasAnyPermission: (permissions: Permission[]) => boolean;
-    hasAllPermissions: (permissions: Permission[]) => boolean;
-    can: (resource: PermissionResource, operation: PermissionOperation) => boolean;
-}
-interface PermissionsRequirementsContextValue {
-    requiredPermissions: PermissionRequirement[];
-    registerRequiredPermissions: (id: string, requirement: PermissionRequirement) => void;
-    unregisterRequiredPermissions: (id: string) => void;
-}
-/**
- * Operations implied by a granted operation. Only the wildcard fans out.
- * Note that `update` does not imply `read` — grants must be explicit.
- */
-declare const OPERATION_IMPLICATIONS: Record<PermissionOperation, PermissionOperation[]>;
-declare function parsePermission(permission: string): {
-    resource: PermissionResource;
-    operation: PermissionOperation;
-} | null;
-declare function buildPermission(resource: PermissionResource, operation: PermissionOperation): Permission;
-
-/**
- * Configuration for the Mercur dashboard plugin.
- *
- * Passed to `mercurDashboardPlugin()` in `vite.config.ts` to configure
- * the vendor or admin dashboard at build time.
- *
- * @example
- * ```ts
- * mercurDashboardPlugin({
- *   medusaConfigPath: '../../packages/api/medusa-config.ts',
- *   enableSellerRegistration: true,
- * })
- * ```
- */
-interface MercurConfig {
-    /** Path to the MedusaJS config file, resolved relative to the project root. */
-    medusaConfigPath: string;
-    /**
-     * Backend URL for API requests.
-     * @default "http://localhost:9000"
-     */
-    backendUrl?: string;
-    /**
-     * Absolute base URL for the vendor dashboard, including any path prefix
-     * (for example `https://vendors.example.com/seller`).
-     *
-     * The plugin does not read `.env` files on its own. Load env in your
-     * app's `vite.config.ts` and pass the value here when you need
-     * cross-origin links such as seller invite URLs.
-     *
-     * If omitted, the plugin falls back to vendor module dev server
-     * detection in development and to the configured vendor path in
-     * production.
-     */
-    vendorUrl?: string;
-    /** Dashboard display name. */
-    name?: string;
-    /** Path to a logo asset for the dashboard. */
-    logo?: string;
-    /** Internationalization settings. */
-    i18n?: {
-        /** The default language code (e.g. `"en"`). */
-        defaultLanguage: string;
-    };
-    /** Whether to allow new sellers to register from the login screen. */
-    enableSellerRegistration?: boolean;
-    /**
-     * Maximum allowed size for image uploads, in bytes.
-     * Used by dashboard upload components to reject oversized files
-     * before they are sent to the backend.
-     * @default 2_097_152 // 2 MB
-     */
-    imageLimit?: number;
-}
-interface BuiltMercurConfig extends MercurConfig {
-    backendUrl: string;
-    base?: string;
-    root: string;
-    srcDir: string;
-    pluginExtensions: string[];
-    imageLimit: number;
-}
-type RouteConfig = {
-    label: string;
-    icon?: ComponentType;
-    rank?: number;
-    nested?: string;
-    translationNs?: string;
-    public?: boolean;
-    /**
-     * Permissions the actor must hold for this route's sidebar entry to be
-     * shown. Enforcement of the route itself comes from `handle.permissions`
-     * — this only controls navigation visibility.
-     */
-    permissions?: Permission[];
-    /** If true, ALL `permissions` are required. Defaults to ANY. */
-    requireAll?: boolean;
-};
-/**
- * The value of a route module's `export const handle`. Read by react-router's
- * `useMatches()`; `permissions` is enforced by `RoutePermissionGuard`.
- */
-type RouteHandle = {
-    permissions?: Permission | Permission[];
-    /** If true (default at the route level), ALL permissions are required. */
-    requireAll?: boolean;
-    /** Where to send the actor on denial. Renders Access Denied when unset. */
-    redirectTo?: string;
-    breadcrumb?: (match: never) => ReactNode;
-};
-
-export { type BuiltMercurConfig as B, type MercurConfig as M, OPERATION_IMPLICATIONS as O, type Permission as P, type RouteConfig as R, type UserPolicy as U, type PermissionOperation as a, type PermissionRequirement as b, type PermissionResource as c, type PermissionsContextValue as d, type PermissionsRequirementsContextValue as e, type RouteHandle as f, buildPermission as g, parsePermission as p };

package/dist/types-CTuDKgPc.d.ts

@@ -1,142 +0,0 @@
-import { ComponentType, ReactNode } from 'react';
-
-/**
- * Permission strings follow the pattern `{resource}:{operation}`, e.g.
- * `customer:read`, `product:create`, `order:*`.
- *
- * The resource list mirrors the policies registered server-side — Medusa's own
- * catalog plus Mercur's (`packages/core/src/policies`). A name that is not
- * registered there is not a type error, it simply never matches a granted
- * policy, so the two are kept in sync by a test in `packages/admin`.
- */
-type PermissionResource = "api_key" | "campaign" | "commission_line" | "commission_rate" | "commission_rule" | "currency" | "customer" | "customer_address" | "customer_group" | "file" | "fulfillment" | "fulfillment_provider" | "fulfillment_set" | "inventory_item" | "inventory_level" | "invite" | "member_invite" | "notification" | "offer" | "order" | "order_change" | "order_claim" | "order_claim_item" | "order_exchange" | "order_group" | "order_item" | "payment" | "payment_collection" | "payment_method" | "payment_session" | "payout" | "payout_account" | "price" | "price_list" | "price_preference" | "product" | "product_attribute" | "product_attribute_value" | "product_category" | "product_change" | "product_collection" | "product_option" | "product_option_value" | "product_tag" | "product_type" | "product_variant" | "promotion" | "rbac_policy" | "rbac_role" | "refund_reason" | "region" | "reservation_item" | "return" | "return_reason" | "review" | "sales_channel" | "seller" | "seller_member" | "service_zone" | "shipping_option" | "shipping_option_type" | "shipping_profile" | "stock_location" | "store" | "store_locale" | "tax_provider" | "tax_rate" | "tax_region" | "translation" | "translation_setting" | "user" | "workflow_execution";
-type PermissionOperation = "read" | "create" | "update" | "delete" | "*";
-type Permission = `${PermissionResource}:${PermissionOperation}`;
-interface UserPolicy {
-    permissions: Permission[];
-}
-interface PermissionRequirement {
-    permissions: Permission[];
-    /** If true, ALL permissions are required. Defaults to ANY. */
-    requireAll?: boolean;
-    /** Optional label describing where the requirement came from. */
-    source?: string;
-}
-interface PermissionsContextValue {
-    policy: UserPolicy | null;
-    isLoading: boolean;
-    /** Whether RBAC is active. When `false`, every check resolves to `true`. */
-    isRbacEnabled: boolean;
-    hasPermission: (permission: Permission) => boolean;
-    hasAnyPermission: (permissions: Permission[]) => boolean;
-    hasAllPermissions: (permissions: Permission[]) => boolean;
-    can: (resource: PermissionResource, operation: PermissionOperation) => boolean;
-}
-interface PermissionsRequirementsContextValue {
-    requiredPermissions: PermissionRequirement[];
-    registerRequiredPermissions: (id: string, requirement: PermissionRequirement) => void;
-    unregisterRequiredPermissions: (id: string) => void;
-}
-/**
- * Operations implied by a granted operation. Only the wildcard fans out.
- * Note that `update` does not imply `read` — grants must be explicit.
- */
-declare const OPERATION_IMPLICATIONS: Record<PermissionOperation, PermissionOperation[]>;
-declare function parsePermission(permission: string): {
-    resource: PermissionResource;
-    operation: PermissionOperation;
-} | null;
-declare function buildPermission(resource: PermissionResource, operation: PermissionOperation): Permission;
-
-/**
- * Configuration for the Mercur dashboard plugin.
- *
- * Passed to `mercurDashboardPlugin()` in `vite.config.ts` to configure
- * the vendor or admin dashboard at build time.
- *
- * @example
- * ```ts
- * mercurDashboardPlugin({
- *   medusaConfigPath: '../../packages/api/medusa-config.ts',
- *   enableSellerRegistration: true,
- * })
- * ```
- */
-interface MercurConfig {
-    /** Path to the MedusaJS config file, resolved relative to the project root. */
-    medusaConfigPath: string;
-    /**
-     * Backend URL for API requests.
-     * @default "http://localhost:9000"
-     */
-    backendUrl?: string;
-    /**
-     * Absolute base URL for the vendor dashboard, including any path prefix
-     * (for example `https://vendors.example.com/seller`).
-     *
-     * The plugin does not read `.env` files on its own. Load env in your
-     * app's `vite.config.ts` and pass the value here when you need
-     * cross-origin links such as seller invite URLs.
-     *
-     * If omitted, the plugin falls back to vendor module dev server
-     * detection in development and to the configured vendor path in
-     * production.
-     */
-    vendorUrl?: string;
-    /** Dashboard display name. */
-    name?: string;
-    /** Path to a logo asset for the dashboard. */
-    logo?: string;
-    /** Internationalization settings. */
-    i18n?: {
-        /** The default language code (e.g. `"en"`). */
-        defaultLanguage: string;
-    };
-    /** Whether to allow new sellers to register from the login screen. */
-    enableSellerRegistration?: boolean;
-    /**
-     * Maximum allowed size for image uploads, in bytes.
-     * Used by dashboard upload components to reject oversized files
-     * before they are sent to the backend.
-     * @default 2_097_152 // 2 MB
-     */
-    imageLimit?: number;
-}
-interface BuiltMercurConfig extends MercurConfig {
-    backendUrl: string;
-    base?: string;
-    root: string;
-    srcDir: string;
-    pluginExtensions: string[];
-    imageLimit: number;
-}
-type RouteConfig = {
-    label: string;
-    icon?: ComponentType;
-    rank?: number;
-    nested?: string;
-    translationNs?: string;
-    public?: boolean;
-    /**
-     * Permissions the actor must hold for this route's sidebar entry to be
-     * shown. Enforcement of the route itself comes from `handle.permissions`
-     * — this only controls navigation visibility.
-     */
-    permissions?: Permission[];
-    /** If true, ALL `permissions` are required. Defaults to ANY. */
-    requireAll?: boolean;
-};
-/**
- * The value of a route module's `export const handle`. Read by react-router's
- * `useMatches()`; `permissions` is enforced by `RoutePermissionGuard`.
- */
-type RouteHandle = {
-    permissions?: Permission | Permission[];
-    /** If true (default at the route level), ALL permissions are required. */
-    requireAll?: boolean;
-    /** Where to send the actor on denial. Renders Access Denied when unset. */
-    redirectTo?: string;
-    breadcrumb?: (match: never) => ReactNode;
-};
-
-export { type BuiltMercurConfig as B, type MercurConfig as M, OPERATION_IMPLICATIONS as O, type Permission as P, type RouteConfig as R, type UserPolicy as U, type PermissionOperation as a, type PermissionRequirement as b, type PermissionResource as c, type PermissionsContextValue as d, type PermissionsRequirementsContextValue as e, type RouteHandle as f, buildPermission as g, parsePermission as p };