@mercurjs/dashboard-sdk 2.3.6-canary.2 → 2.3.6-canary.3

package/dist/index.cjs

@@ -20,12 +20,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  OPERATION_IMPLICATIONS: () => OPERATION_IMPLICATIONS,
+  PERMISSION_RIGHT_RANK: () => PERMISSION_RIGHT_RANK,
   buildPermission: () => buildPermission,
   defineCustomFieldsConfig: () => defineCustomFieldsConfig,
   defineNavigationConfig: () => defineNavigationConfig,
   defineWidgetConfig: () => defineWidgetConfig,
-  parsePermission: () => parsePermission
+  parsePermission: () => parsePermission,
+  satisfiesPermission: () => satisfiesPermission
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -47,33 +48,39 @@ function defineCustomFieldsConfig(config) {
 }
 
 // src/permissions.ts
-var OPERATION_IMPLICATIONS = {
-  read: ["read"],
-  create: ["create"],
-  update: ["update"],
-  delete: ["delete"],
-  "*": ["read", "create", "update", "delete", "*"]
+var PERMISSION_RIGHT_RANK = {
+  view: 1,
+  edit: 2,
+  manage: 3
 };
 function parsePermission(permission) {
-  const parts = permission.split(":");
-  if (parts.length !== 2) {
+  const index = permission.lastIndexOf(":");
+  if (index <= 0) {
+    return null;
+  }
+  const right = permission.slice(index + 1);
+  if (!(right in PERMISSION_RIGHT_RANK)) {
     return null;
   }
-  const [resource, operation] = parts;
   return {
-    resource,
-    operation
+    key: permission.slice(0, index),
+    right
   };
 }
-function buildPermission(resource, operation) {
-  return `${resource}:${operation}`;
+function buildPermission(key, right) {
+  return `${key}:${right}`;
+}
+function satisfiesPermission(permissions, key, right) {
+  const granted = permissions[key];
+  return !!granted && PERMISSION_RIGHT_RANK[granted] >= PERMISSION_RIGHT_RANK[right];
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  OPERATION_IMPLICATIONS,
+  PERMISSION_RIGHT_RANK,
   buildPermission,
   defineCustomFieldsConfig,
   defineNavigationConfig,
   defineWidgetConfig,
-  parsePermission
+  parsePermission,
+  satisfiesPermission
 });

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { B as BuiltMercurConfig, M as MercurConfig, O as OPERATION_IMPLICATIONS, P as Permission, a as PermissionOperation, b as PermissionRequirement, c as PermissionResource, d as PermissionsContextValue, e as PermissionsRequirementsContextValue, R as RouteConfig, f as RouteHandle, U as UserPolicy, g as buildPermission, p as parsePermission } from './types-CTuDKgPc.cjs';
+export { B as BuiltMercurConfig, M as MercurConfig, P as PERMISSION_RIGHT_RANK, a as Permission, b as PermissionKey, c as PermissionMap, d as PermissionRight, e as PermissionsContextValue, R as RouteConfig, f as RouteHandle, g as buildPermission, p as parsePermission, s as satisfiesPermission } from './types-CEb2yQNN.cjs';
 import { ComponentType, ReactNode } from 'react';
 
 /**

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { B as BuiltMercurConfig, M as MercurConfig, O as OPERATION_IMPLICATIONS, P as Permission, a as PermissionOperation, b as PermissionRequirement, c as PermissionResource, d as PermissionsContextValue, e as PermissionsRequirementsContextValue, R as RouteConfig, f as RouteHandle, U as UserPolicy, g as buildPermission, p as parsePermission } from './types-CTuDKgPc.js';
+export { B as BuiltMercurConfig, M as MercurConfig, P as PERMISSION_RIGHT_RANK, a as Permission, b as PermissionKey, c as PermissionMap, d as PermissionRight, e as PermissionsContextValue, R as RouteConfig, f as RouteHandle, g as buildPermission, p as parsePermission, s as satisfiesPermission } from './types-CEb2yQNN.js';
 import { ComponentType, ReactNode } from 'react';
 
 /**

package/dist/index.js

@@ -18,32 +18,38 @@ function defineCustomFieldsConfig(config) {
 }
 
 // src/permissions.ts
-var OPERATION_IMPLICATIONS = {
-  read: ["read"],
-  create: ["create"],
-  update: ["update"],
-  delete: ["delete"],
-  "*": ["read", "create", "update", "delete", "*"]
+var PERMISSION_RIGHT_RANK = {
+  view: 1,
+  edit: 2,
+  manage: 3
 };
 function parsePermission(permission) {
-  const parts = permission.split(":");
-  if (parts.length !== 2) {
+  const index = permission.lastIndexOf(":");
+  if (index <= 0) {
+    return null;
+  }
+  const right = permission.slice(index + 1);
+  if (!(right in PERMISSION_RIGHT_RANK)) {
     return null;
   }
-  const [resource, operation] = parts;
   return {
-    resource,
-    operation
+    key: permission.slice(0, index),
+    right
   };
 }
-function buildPermission(resource, operation) {
-  return `${resource}:${operation}`;
+function buildPermission(key, right) {
+  return `${key}:${right}`;
+}
+function satisfiesPermission(permissions, key, right) {
+  const granted = permissions[key];
+  return !!granted && PERMISSION_RIGHT_RANK[granted] >= PERMISSION_RIGHT_RANK[right];
 }
 export {
-  OPERATION_IMPLICATIONS,
+  PERMISSION_RIGHT_RANK,
   buildPermission,
   defineCustomFieldsConfig,
   defineNavigationConfig,
   defineWidgetConfig,
-  parsePermission
+  parsePermission,
+  satisfiesPermission
 };

package/dist/types-CEb2yQNN.d.cts

@@ -0,0 +1,126 @@
+import { ComponentType, ReactNode } from 'react';
+
+/**
+ * Permission strings follow `{key}:{right}`, e.g. `orders:view`,
+ * `products:edit`, `sellers.approval:edit`.
+ *
+ * Keys mirror the catalog declared server-side with `defineMercurPermissions`
+ * (`packages/core/src/permissions/definitions`). Rights nest:
+ * `manage` implies `edit`, `edit` implies `view`.
+ */
+type PermissionKey = "sellers" | "sellers.approval" | "sellers.premium" | "members" | "members.invites" | "roles" | "roles.owner" | "orders" | "orders.refunds" | "orders.returns" | "orders.edits" | "order_groups" | "payments" | "customers" | "customer_groups" | "products" | "products.review" | "product_changes" | "product_categories" | "product_collections" | "product_types" | "product_tags" | "product_attributes" | "offers" | "inventory_items" | "reservations" | "stock_locations" | "price_lists" | "price_preferences" | "promotions" | "campaigns" | "commission_rates" | "commission_lines" | "payouts" | "payout_accounts" | "shipping_profiles" | "shipping_options" | "fulfillment_sets" | "regions" | "tax_regions" | "store" | "sales_channels" | "return_reasons" | "refund_reasons" | "users" | "api_keys" | "translations" | "notifications" | "workflow_executions" | "reviews";
+type PermissionRight = "view" | "edit" | "manage";
+type Permission = `${PermissionKey}:${PermissionRight}`;
+/** Effective rights of the acting user, as returned by `fields=+permissions`. */
+type PermissionMap = Partial<Record<string, PermissionRight>>;
+declare const PERMISSION_RIGHT_RANK: Record<PermissionRight, number>;
+interface PermissionsContextValue {
+    /** `null` while no access-control module is enforcing permissions. */
+    permissions: PermissionMap | null;
+    isLoading: boolean;
+    /** When `false`, every check resolves to `true`. */
+    isEnforced: boolean;
+    hasPermission: (permission: Permission) => boolean;
+    hasAnyPermission: (permissions: Permission[]) => boolean;
+    hasAllPermissions: (permissions: Permission[]) => boolean;
+    can: (key: PermissionKey, right?: PermissionRight) => boolean;
+}
+declare function parsePermission(permission: string): {
+    key: PermissionKey;
+    right: PermissionRight;
+} | null;
+declare function buildPermission(key: PermissionKey, right: PermissionRight): Permission;
+declare function satisfiesPermission(permissions: PermissionMap, key: string, right: PermissionRight): boolean;
+
+/**
+ * Configuration for the Mercur dashboard plugin.
+ *
+ * Passed to `mercurDashboardPlugin()` in `vite.config.ts` to configure
+ * the vendor or admin dashboard at build time.
+ *
+ * @example
+ * ```ts
+ * mercurDashboardPlugin({
+ *   medusaConfigPath: '../../packages/api/medusa-config.ts',
+ *   enableSellerRegistration: true,
+ * })
+ * ```
+ */
+interface MercurConfig {
+    /** Path to the MedusaJS config file, resolved relative to the project root. */
+    medusaConfigPath: string;
+    /**
+     * Backend URL for API requests.
+     * @default "http://localhost:9000"
+     */
+    backendUrl?: string;
+    /**
+     * Absolute base URL for the vendor dashboard, including any path prefix
+     * (for example `https://vendors.example.com/seller`).
+     *
+     * The plugin does not read `.env` files on its own. Load env in your
+     * app's `vite.config.ts` and pass the value here when you need
+     * cross-origin links such as seller invite URLs.
+     *
+     * If omitted, the plugin falls back to vendor module dev server
+     * detection in development and to the configured vendor path in
+     * production.
+     */
+    vendorUrl?: string;
+    /** Dashboard display name. */
+    name?: string;
+    /** Path to a logo asset for the dashboard. */
+    logo?: string;
+    /** Internationalization settings. */
+    i18n?: {
+        /** The default language code (e.g. `"en"`). */
+        defaultLanguage: string;
+    };
+    /** Whether to allow new sellers to register from the login screen. */
+    enableSellerRegistration?: boolean;
+    /**
+     * Maximum allowed size for image uploads, in bytes.
+     * Used by dashboard upload components to reject oversized files
+     * before they are sent to the backend.
+     * @default 2_097_152 // 2 MB
+     */
+    imageLimit?: number;
+}
+interface BuiltMercurConfig extends MercurConfig {
+    backendUrl: string;
+    base?: string;
+    root: string;
+    srcDir: string;
+    pluginExtensions: string[];
+    imageLimit: number;
+}
+type RouteConfig = {
+    label: string;
+    icon?: ComponentType;
+    rank?: number;
+    nested?: string;
+    translationNs?: string;
+    public?: boolean;
+    /**
+     * Permissions the actor must hold for this route's sidebar entry to be
+     * shown. Enforcement of the route itself comes from `handle.permissions`
+     * — this only controls navigation visibility.
+     */
+    permissions?: Permission[];
+    /** If true, ALL `permissions` are required. Defaults to ANY. */
+    requireAll?: boolean;
+};
+/**
+ * The value of a route module's `export const handle`. Read by react-router's
+ * `useMatches()`; `permissions` is enforced by `RoutePermissionGuard`.
+ */
+type RouteHandle = {
+    permissions?: Permission | Permission[];
+    /** If true (default at the route level), ALL permissions are required. */
+    requireAll?: boolean;
+    /** Where to send the actor on denial. Renders Access Denied when unset. */
+    redirectTo?: string;
+    breadcrumb?: (match: never) => ReactNode;
+};
+
+export { type BuiltMercurConfig as B, type MercurConfig as M, PERMISSION_RIGHT_RANK as P, type RouteConfig as R, type Permission as a, type PermissionKey as b, type PermissionMap as c, type PermissionRight as d, type PermissionsContextValue as e, type RouteHandle as f, buildPermission as g, parsePermission as p, satisfiesPermission as s };

package/dist/types-CEb2yQNN.d.ts

@@ -0,0 +1,126 @@
+import { ComponentType, ReactNode } from 'react';
+
+/**
+ * Permission strings follow `{key}:{right}`, e.g. `orders:view`,
+ * `products:edit`, `sellers.approval:edit`.
+ *
+ * Keys mirror the catalog declared server-side with `defineMercurPermissions`
+ * (`packages/core/src/permissions/definitions`). Rights nest:
+ * `manage` implies `edit`, `edit` implies `view`.
+ */
+type PermissionKey = "sellers" | "sellers.approval" | "sellers.premium" | "members" | "members.invites" | "roles" | "roles.owner" | "orders" | "orders.refunds" | "orders.returns" | "orders.edits" | "order_groups" | "payments" | "customers" | "customer_groups" | "products" | "products.review" | "product_changes" | "product_categories" | "product_collections" | "product_types" | "product_tags" | "product_attributes" | "offers" | "inventory_items" | "reservations" | "stock_locations" | "price_lists" | "price_preferences" | "promotions" | "campaigns" | "commission_rates" | "commission_lines" | "payouts" | "payout_accounts" | "shipping_profiles" | "shipping_options" | "fulfillment_sets" | "regions" | "tax_regions" | "store" | "sales_channels" | "return_reasons" | "refund_reasons" | "users" | "api_keys" | "translations" | "notifications" | "workflow_executions" | "reviews";
+type PermissionRight = "view" | "edit" | "manage";
+type Permission = `${PermissionKey}:${PermissionRight}`;
+/** Effective rights of the acting user, as returned by `fields=+permissions`. */
+type PermissionMap = Partial<Record<string, PermissionRight>>;
+declare const PERMISSION_RIGHT_RANK: Record<PermissionRight, number>;
+interface PermissionsContextValue {
+    /** `null` while no access-control module is enforcing permissions. */
+    permissions: PermissionMap | null;
+    isLoading: boolean;
+    /** When `false`, every check resolves to `true`. */
+    isEnforced: boolean;
+    hasPermission: (permission: Permission) => boolean;
+    hasAnyPermission: (permissions: Permission[]) => boolean;
+    hasAllPermissions: (permissions: Permission[]) => boolean;
+    can: (key: PermissionKey, right?: PermissionRight) => boolean;
+}
+declare function parsePermission(permission: string): {
+    key: PermissionKey;
+    right: PermissionRight;
+} | null;
+declare function buildPermission(key: PermissionKey, right: PermissionRight): Permission;
+declare function satisfiesPermission(permissions: PermissionMap, key: string, right: PermissionRight): boolean;
+
+/**
+ * Configuration for the Mercur dashboard plugin.
+ *
+ * Passed to `mercurDashboardPlugin()` in `vite.config.ts` to configure
+ * the vendor or admin dashboard at build time.
+ *
+ * @example
+ * ```ts
+ * mercurDashboardPlugin({
+ *   medusaConfigPath: '../../packages/api/medusa-config.ts',
+ *   enableSellerRegistration: true,
+ * })
+ * ```
+ */
+interface MercurConfig {
+    /** Path to the MedusaJS config file, resolved relative to the project root. */
+    medusaConfigPath: string;
+    /**
+     * Backend URL for API requests.
+     * @default "http://localhost:9000"
+     */
+    backendUrl?: string;
+    /**
+     * Absolute base URL for the vendor dashboard, including any path prefix
+     * (for example `https://vendors.example.com/seller`).
+     *
+     * The plugin does not read `.env` files on its own. Load env in your
+     * app's `vite.config.ts` and pass the value here when you need
+     * cross-origin links such as seller invite URLs.
+     *
+     * If omitted, the plugin falls back to vendor module dev server
+     * detection in development and to the configured vendor path in
+     * production.
+     */
+    vendorUrl?: string;
+    /** Dashboard display name. */
+    name?: string;
+    /** Path to a logo asset for the dashboard. */
+    logo?: string;
+    /** Internationalization settings. */
+    i18n?: {
+        /** The default language code (e.g. `"en"`). */
+        defaultLanguage: string;
+    };
+    /** Whether to allow new sellers to register from the login screen. */
+    enableSellerRegistration?: boolean;
+    /**
+     * Maximum allowed size for image uploads, in bytes.
+     * Used by dashboard upload components to reject oversized files
+     * before they are sent to the backend.
+     * @default 2_097_152 // 2 MB
+     */
+    imageLimit?: number;
+}
+interface BuiltMercurConfig extends MercurConfig {
+    backendUrl: string;
+    base?: string;
+    root: string;
+    srcDir: string;
+    pluginExtensions: string[];
+    imageLimit: number;
+}
+type RouteConfig = {
+    label: string;
+    icon?: ComponentType;
+    rank?: number;
+    nested?: string;
+    translationNs?: string;
+    public?: boolean;
+    /**
+     * Permissions the actor must hold for this route's sidebar entry to be
+     * shown. Enforcement of the route itself comes from `handle.permissions`
+     * — this only controls navigation visibility.
+     */
+    permissions?: Permission[];
+    /** If true, ALL `permissions` are required. Defaults to ANY. */
+    requireAll?: boolean;
+};
+/**
+ * The value of a route module's `export const handle`. Read by react-router's
+ * `useMatches()`; `permissions` is enforced by `RoutePermissionGuard`.
+ */
+type RouteHandle = {
+    permissions?: Permission | Permission[];
+    /** If true (default at the route level), ALL permissions are required. */
+    requireAll?: boolean;
+    /** Where to send the actor on denial. Renders Access Denied when unset. */
+    redirectTo?: string;
+    breadcrumb?: (match: never) => ReactNode;
+};
+
+export { type BuiltMercurConfig as B, type MercurConfig as M, PERMISSION_RIGHT_RANK as P, type RouteConfig as R, type Permission as a, type PermissionKey as b, type PermissionMap as c, type PermissionRight as d, type PermissionsContextValue as e, type RouteHandle as f, buildPermission as g, parsePermission as p, satisfiesPermission as s };

package/dist/vite.d.cts

@@ -1,5 +1,5 @@
 import * as Vite from 'vite';
-import { M as MercurConfig } from './types-CTuDKgPc.cjs';
+import { M as MercurConfig } from './types-CEb2yQNN.cjs';
 import 'react';
 
 declare function mercurDashboardPlugin(pluginConfig: MercurConfig): Vite.Plugin;

package/dist/vite.d.ts

@@ -1,5 +1,5 @@
 import * as Vite from 'vite';
-import { M as MercurConfig } from './types-CTuDKgPc.js';
+import { M as MercurConfig } from './types-CEb2yQNN.js';
 import 'react';
 
 declare function mercurDashboardPlugin(pluginConfig: MercurConfig): Vite.Plugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mercurjs/dashboard-sdk",
-  "version": "2.3.6-canary.2",
+  "version": "2.3.6-canary.3",
   "repository": {
     "type": "git",
     "url": "https://github.com/mercurjs/mercur",
@@ -35,8 +35,8 @@
   },
   "dependencies": {
     "@babel/parser": "8.0.5",
-    "@babel/traverse": "7.25.6",
-    "@babel/types": "8.0.4",
+    "@babel/traverse": "8.0.6",
+    "@babel/types": "8.0.6",
     "esbuild-register": "^3.6.0"
   },
   "devDependencies": {

package/dist/types-CTuDKgPc.d.cts

@@ -1,142 +0,0 @@
-import { ComponentType, ReactNode } from 'react';
-
-/**
- * Permission strings follow the pattern `{resource}:{operation}`, e.g.
- * `customer:read`, `product:create`, `order:*`.
- *
- * The resource list mirrors the policies registered server-side — Medusa's own
- * catalog plus Mercur's (`packages/core/src/policies`). A name that is not
- * registered there is not a type error, it simply never matches a granted
- * policy, so the two are kept in sync by a test in `packages/admin`.
- */
-type PermissionResource = "api_key" | "campaign" | "commission_line" | "commission_rate" | "commission_rule" | "currency" | "customer" | "customer_address" | "customer_group" | "file" | "fulfillment" | "fulfillment_provider" | "fulfillment_set" | "inventory_item" | "inventory_level" | "invite" | "member_invite" | "notification" | "offer" | "order" | "order_change" | "order_claim" | "order_claim_item" | "order_exchange" | "order_group" | "order_item" | "payment" | "payment_collection" | "payment_method" | "payment_session" | "payout" | "payout_account" | "price" | "price_list" | "price_preference" | "product" | "product_attribute" | "product_attribute_value" | "product_category" | "product_change" | "product_collection" | "product_option" | "product_option_value" | "product_tag" | "product_type" | "product_variant" | "promotion" | "rbac_policy" | "rbac_role" | "refund_reason" | "region" | "reservation_item" | "return" | "return_reason" | "review" | "sales_channel" | "seller" | "seller_member" | "service_zone" | "shipping_option" | "shipping_option_type" | "shipping_profile" | "stock_location" | "store" | "store_locale" | "tax_provider" | "tax_rate" | "tax_region" | "translation" | "translation_setting" | "user" | "workflow_execution";
-type PermissionOperation = "read" | "create" | "update" | "delete" | "*";
-type Permission = `${PermissionResource}:${PermissionOperation}`;
-interface UserPolicy {
-    permissions: Permission[];
-}
-interface PermissionRequirement {
-    permissions: Permission[];
-    /** If true, ALL permissions are required. Defaults to ANY. */
-    requireAll?: boolean;
-    /** Optional label describing where the requirement came from. */
-    source?: string;
-}
-interface PermissionsContextValue {
-    policy: UserPolicy | null;
-    isLoading: boolean;
-    /** Whether RBAC is active. When `false`, every check resolves to `true`. */
-    isRbacEnabled: boolean;
-    hasPermission: (permission: Permission) => boolean;
-    hasAnyPermission: (permissions: Permission[]) => boolean;
-    hasAllPermissions: (permissions: Permission[]) => boolean;
-    can: (resource: PermissionResource, operation: PermissionOperation) => boolean;
-}
-interface PermissionsRequirementsContextValue {
-    requiredPermissions: PermissionRequirement[];
-    registerRequiredPermissions: (id: string, requirement: PermissionRequirement) => void;
-    unregisterRequiredPermissions: (id: string) => void;
-}
-/**
- * Operations implied by a granted operation. Only the wildcard fans out.
- * Note that `update` does not imply `read` — grants must be explicit.
- */
-declare const OPERATION_IMPLICATIONS: Record<PermissionOperation, PermissionOperation[]>;
-declare function parsePermission(permission: string): {
-    resource: PermissionResource;
-    operation: PermissionOperation;
-} | null;
-declare function buildPermission(resource: PermissionResource, operation: PermissionOperation): Permission;
-
-/**
- * Configuration for the Mercur dashboard plugin.
- *
- * Passed to `mercurDashboardPlugin()` in `vite.config.ts` to configure
- * the vendor or admin dashboard at build time.
- *
- * @example
- * ```ts
- * mercurDashboardPlugin({
- *   medusaConfigPath: '../../packages/api/medusa-config.ts',
- *   enableSellerRegistration: true,
- * })
- * ```
- */
-interface MercurConfig {
-    /** Path to the MedusaJS config file, resolved relative to the project root. */
-    medusaConfigPath: string;
-    /**
-     * Backend URL for API requests.
-     * @default "http://localhost:9000"
-     */
-    backendUrl?: string;
-    /**
-     * Absolute base URL for the vendor dashboard, including any path prefix
-     * (for example `https://vendors.example.com/seller`).
-     *
-     * The plugin does not read `.env` files on its own. Load env in your
-     * app's `vite.config.ts` and pass the value here when you need
-     * cross-origin links such as seller invite URLs.
-     *
-     * If omitted, the plugin falls back to vendor module dev server
-     * detection in development and to the configured vendor path in
-     * production.
-     */
-    vendorUrl?: string;
-    /** Dashboard display name. */
-    name?: string;
-    /** Path to a logo asset for the dashboard. */
-    logo?: string;
-    /** Internationalization settings. */
-    i18n?: {
-        /** The default language code (e.g. `"en"`). */
-        defaultLanguage: string;
-    };
-    /** Whether to allow new sellers to register from the login screen. */
-    enableSellerRegistration?: boolean;
-    /**
-     * Maximum allowed size for image uploads, in bytes.
-     * Used by dashboard upload components to reject oversized files
-     * before they are sent to the backend.
-     * @default 2_097_152 // 2 MB
-     */
-    imageLimit?: number;
-}
-interface BuiltMercurConfig extends MercurConfig {
-    backendUrl: string;
-    base?: string;
-    root: string;
-    srcDir: string;
-    pluginExtensions: string[];
-    imageLimit: number;
-}
-type RouteConfig = {
-    label: string;
-    icon?: ComponentType;
-    rank?: number;
-    nested?: string;
-    translationNs?: string;
-    public?: boolean;
-    /**
-     * Permissions the actor must hold for this route's sidebar entry to be
-     * shown. Enforcement of the route itself comes from `handle.permissions`
-     * — this only controls navigation visibility.
-     */
-    permissions?: Permission[];
-    /** If true, ALL `permissions` are required. Defaults to ANY. */
-    requireAll?: boolean;
-};
-/**
- * The value of a route module's `export const handle`. Read by react-router's
- * `useMatches()`; `permissions` is enforced by `RoutePermissionGuard`.
- */
-type RouteHandle = {
-    permissions?: Permission | Permission[];
-    /** If true (default at the route level), ALL permissions are required. */
-    requireAll?: boolean;
-    /** Where to send the actor on denial. Renders Access Denied when unset. */
-    redirectTo?: string;
-    breadcrumb?: (match: never) => ReactNode;
-};
-
-export { type BuiltMercurConfig as B, type MercurConfig as M, OPERATION_IMPLICATIONS as O, type Permission as P, type RouteConfig as R, type UserPolicy as U, type PermissionOperation as a, type PermissionRequirement as b, type PermissionResource as c, type PermissionsContextValue as d, type PermissionsRequirementsContextValue as e, type RouteHandle as f, buildPermission as g, parsePermission as p };

package/dist/types-CTuDKgPc.d.ts

@@ -1,142 +0,0 @@
-import { ComponentType, ReactNode } from 'react';
-
-/**
- * Permission strings follow the pattern `{resource}:{operation}`, e.g.
- * `customer:read`, `product:create`, `order:*`.
- *
- * The resource list mirrors the policies registered server-side — Medusa's own
- * catalog plus Mercur's (`packages/core/src/policies`). A name that is not
- * registered there is not a type error, it simply never matches a granted
- * policy, so the two are kept in sync by a test in `packages/admin`.
- */
-type PermissionResource = "api_key" | "campaign" | "commission_line" | "commission_rate" | "commission_rule" | "currency" | "customer" | "customer_address" | "customer_group" | "file" | "fulfillment" | "fulfillment_provider" | "fulfillment_set" | "inventory_item" | "inventory_level" | "invite" | "member_invite" | "notification" | "offer" | "order" | "order_change" | "order_claim" | "order_claim_item" | "order_exchange" | "order_group" | "order_item" | "payment" | "payment_collection" | "payment_method" | "payment_session" | "payout" | "payout_account" | "price" | "price_list" | "price_preference" | "product" | "product_attribute" | "product_attribute_value" | "product_category" | "product_change" | "product_collection" | "product_option" | "product_option_value" | "product_tag" | "product_type" | "product_variant" | "promotion" | "rbac_policy" | "rbac_role" | "refund_reason" | "region" | "reservation_item" | "return" | "return_reason" | "review" | "sales_channel" | "seller" | "seller_member" | "service_zone" | "shipping_option" | "shipping_option_type" | "shipping_profile" | "stock_location" | "store" | "store_locale" | "tax_provider" | "tax_rate" | "tax_region" | "translation" | "translation_setting" | "user" | "workflow_execution";
-type PermissionOperation = "read" | "create" | "update" | "delete" | "*";
-type Permission = `${PermissionResource}:${PermissionOperation}`;
-interface UserPolicy {
-    permissions: Permission[];
-}
-interface PermissionRequirement {
-    permissions: Permission[];
-    /** If true, ALL permissions are required. Defaults to ANY. */
-    requireAll?: boolean;
-    /** Optional label describing where the requirement came from. */
-    source?: string;
-}
-interface PermissionsContextValue {
-    policy: UserPolicy | null;
-    isLoading: boolean;
-    /** Whether RBAC is active. When `false`, every check resolves to `true`. */
-    isRbacEnabled: boolean;
-    hasPermission: (permission: Permission) => boolean;
-    hasAnyPermission: (permissions: Permission[]) => boolean;
-    hasAllPermissions: (permissions: Permission[]) => boolean;
-    can: (resource: PermissionResource, operation: PermissionOperation) => boolean;
-}
-interface PermissionsRequirementsContextValue {
-    requiredPermissions: PermissionRequirement[];
-    registerRequiredPermissions: (id: string, requirement: PermissionRequirement) => void;
-    unregisterRequiredPermissions: (id: string) => void;
-}
-/**
- * Operations implied by a granted operation. Only the wildcard fans out.
- * Note that `update` does not imply `read` — grants must be explicit.
- */
-declare const OPERATION_IMPLICATIONS: Record<PermissionOperation, PermissionOperation[]>;
-declare function parsePermission(permission: string): {
-    resource: PermissionResource;
-    operation: PermissionOperation;
-} | null;
-declare function buildPermission(resource: PermissionResource, operation: PermissionOperation): Permission;
-
-/**
- * Configuration for the Mercur dashboard plugin.
- *
- * Passed to `mercurDashboardPlugin()` in `vite.config.ts` to configure
- * the vendor or admin dashboard at build time.
- *
- * @example
- * ```ts
- * mercurDashboardPlugin({
- *   medusaConfigPath: '../../packages/api/medusa-config.ts',
- *   enableSellerRegistration: true,
- * })
- * ```
- */
-interface MercurConfig {
-    /** Path to the MedusaJS config file, resolved relative to the project root. */
-    medusaConfigPath: string;
-    /**
-     * Backend URL for API requests.
-     * @default "http://localhost:9000"
-     */
-    backendUrl?: string;
-    /**
-     * Absolute base URL for the vendor dashboard, including any path prefix
-     * (for example `https://vendors.example.com/seller`).
-     *
-     * The plugin does not read `.env` files on its own. Load env in your
-     * app's `vite.config.ts` and pass the value here when you need
-     * cross-origin links such as seller invite URLs.
-     *
-     * If omitted, the plugin falls back to vendor module dev server
-     * detection in development and to the configured vendor path in
-     * production.
-     */
-    vendorUrl?: string;
-    /** Dashboard display name. */
-    name?: string;
-    /** Path to a logo asset for the dashboard. */
-    logo?: string;
-    /** Internationalization settings. */
-    i18n?: {
-        /** The default language code (e.g. `"en"`). */
-        defaultLanguage: string;
-    };
-    /** Whether to allow new sellers to register from the login screen. */
-    enableSellerRegistration?: boolean;
-    /**
-     * Maximum allowed size for image uploads, in bytes.
-     * Used by dashboard upload components to reject oversized files
-     * before they are sent to the backend.
-     * @default 2_097_152 // 2 MB
-     */
-    imageLimit?: number;
-}
-interface BuiltMercurConfig extends MercurConfig {
-    backendUrl: string;
-    base?: string;
-    root: string;
-    srcDir: string;
-    pluginExtensions: string[];
-    imageLimit: number;
-}
-type RouteConfig = {
-    label: string;
-    icon?: ComponentType;
-    rank?: number;
-    nested?: string;
-    translationNs?: string;
-    public?: boolean;
-    /**
-     * Permissions the actor must hold for this route's sidebar entry to be
-     * shown. Enforcement of the route itself comes from `handle.permissions`
-     * — this only controls navigation visibility.
-     */
-    permissions?: Permission[];
-    /** If true, ALL `permissions` are required. Defaults to ANY. */
-    requireAll?: boolean;
-};
-/**
- * The value of a route module's `export const handle`. Read by react-router's
- * `useMatches()`; `permissions` is enforced by `RoutePermissionGuard`.
- */
-type RouteHandle = {
-    permissions?: Permission | Permission[];
-    /** If true (default at the route level), ALL permissions are required. */
-    requireAll?: boolean;
-    /** Where to send the actor on denial. Renders Access Denied when unset. */
-    redirectTo?: string;
-    breadcrumb?: (match: never) => ReactNode;
-};
-
-export { type BuiltMercurConfig as B, type MercurConfig as M, OPERATION_IMPLICATIONS as O, type Permission as P, type RouteConfig as R, type UserPolicy as U, type PermissionOperation as a, type PermissionRequirement as b, type PermissionResource as c, type PermissionsContextValue as d, type PermissionsRequirementsContextValue as e, type RouteHandle as f, buildPermission as g, parsePermission as p };