@bison-lab/payload-core 3.10.0 → 3.12.0

package/dist/index.mjs

@@ -1,8 +1,10 @@
 import { n as documentTitle, r as titleTemplate, t as SHARE_IMAGE_SIZE } from "./share-image-C4ILz4p2.mjs";
-import { C as headingSelectValue, S as THEME_SECTION_HEADING, _ as THEME_IDENTITY_FALLBACK, a as SYSTEM_COLOR_KEYS, b as THEME_PUBLISH_FIELD, c as themeConfigFromDoc, d as THEME_APPEARANCE_FIELD, f as THEME_COLOR_FIELD, g as THEME_GREY_SCALE_FIELD, h as THEME_FONT_FIELD, i as themeColorKeys, l as validateSourceIncluded, m as THEME_CONTRAST_REPORT, n as deleteLibraryColor, o as THEME_SLUG, p as THEME_COLOR_SCALE_FIELD, r as rewriteColorToken, s as docFromConfig, t as resolveThemeIdentity, u as validateThemeHex, v as THEME_LIBRARY_FIELD, x as THEME_SAVE_BUTTON, y as THEME_PAIRING_FIELD } from "./identity-Bg-G05mb.mjs";
+import { A as THEME_IDENTITY_FALLBACK, C as THEME_APPEARANCE_FIELD, D as THEME_DOCUMENT_CONTROLS, E as THEME_CONTRAST_REPORT, F as THEME_SECTION_HEADING, I as headingSelectValue, M as THEME_PAIRING_FIELD, N as THEME_PUBLISH_FIELD, O as THEME_FONT_FIELD, P as THEME_SAVE_BUTTON, S as LOOK_FIELD, T as THEME_COLOR_SCALE_FIELD, _ as docFromConfig, a as pageEditorLooks, b as validateSourceIncluded, c as deleteLibraryColor, d as SYSTEM_COLOR_KEYS, f as THEME_APPEARANCE_SLUG, g as THEME_TYPOGRAPHY_SLUG, h as THEME_SLUG, i as PAGE_EDITOR_SYSTEM_KEYS, j as THEME_LIBRARY_FIELD, k as THEME_GREY_SCALE_FIELD, l as rewriteColorToken, m as THEME_IDENTITY_SLUG, n as colorTokenField, o as pageEditorTokens, p as THEME_COLORS_SLUG, r as lookField, s as themeLibraryFromDoc, t as resolveThemeIdentity, u as themeColorKeys, w as THEME_COLOR_FIELD, x as validateThemeHex, y as themeConfigFromDoc } from "./identity-DZOb3_Gk.mjs";
 import { seoPlugin as seoPlugin$1 } from "@payloadcms/plugin-seo";
 import { catalog } from "@bison-lab/fonts";
-import { SHADE_STEPS, presetHints } from "@bison-lab/tokens";
+import { DESTRUCTIVE_SCALE_HEX, SHADE_STEPS, presetHints } from "@bison-lab/tokens";
+import { APIError, ValidationError, definePlugin, validations } from "payload";
+import { select, text } from "payload/shared";
 //#region src/seo/fields.ts
 /**
 * The index switch, last in the SEO tab. Off by default: a page is public
@@ -163,12 +165,6 @@ const APPEARANCE_CHOICES = {
 };
 //#endregion
 //#region src/theme/publish.ts
-const THEME_CHILDREN = [
-	"colors",
-	"typography",
-	"appearance",
-	"identity"
-];
 /**
 * Publishing a child writes that slice only. Other responsibilities stay
 * as they already are on the stored document. Unsaved form state on a
@@ -196,24 +192,63 @@ function publishThemeChild(stored, incoming, child) {
 		logoMark: incoming.logoMark
 	};
 }
-function isThemeChild(value) {
-	return typeof value === "string" && THEME_CHILDREN.includes(value);
+function sliceFromTheme(theme, child) {
+	if (child === "colors") return { colors: theme.colors };
+	if (child === "typography") return { typography: theme.typography };
+	if (child === "appearance") return { appearance: theme.appearance };
+	return {
+		logo: theme.logo,
+		favicon: theme.favicon,
+		logoMark: theme.logoMark
+	};
+}
+function colorHex(color) {
+	if (typeof color === "string") return color;
+	return color?.hex ?? void 0;
+}
+/**
+* A Theme page is a real Global. Hydrate from the store only when this
+* page has never been saved — otherwise afterRead would overwrite the form.
+*/
+function hasThemeSlice(doc, child) {
+	if (!doc) return false;
+	if (child === "colors") return Boolean(colorHex(doc.colors?.brand?.primary));
+	if (child === "typography") return Boolean(doc.typography?.body);
+	if (child === "appearance") return Boolean(doc.appearance?.radius);
+	return Boolean(doc.logo || doc.favicon || doc.logoMark);
+}
+/**
+* Save on a Theme page writes that slice onto the hidden `theme` row.
+* Other children stay as stored.
+*/
+async function persistThemeChild(payload, incoming, child) {
+	const next = publishThemeChild(await payload.findGlobal({
+		slug: "theme",
+		draft: false,
+		overrideAccess: true
+	}) ?? {}, incoming, child);
+	await payload.updateGlobal({
+		slug: THEME_SLUG,
+		data: next,
+		draft: false
+	});
+	return next;
 }
 //#endregion
 //#region src/theme/global.ts
+/** Same value as tokens `SUCCESS_SCALE_HEX`. Inlined so an older tokens peer still boots. */
+const LIBRARY_SUCCESS_HEX = "#22c55e";
 function requireAccess$1(options) {
 	const read = options.access?.read;
 	const update = options.access?.update;
-	if (!read || !update) throw new Error("createTheme requires access.read and access.update. Pass the site's predicates; canManageBrand is the intended update predicate until BIS-43 moves src/platform here.");
+	if (!read || !update) throw new Error("createTheme requires access.read and access.update. Pass canManageBrand from this package as update.");
 	return {
 		read,
 		update
 	};
 }
 function requireDestructive(options) {
-	const hex = options.destructive ?? options.seed.brandDestructive;
-	if (!hex) throw new Error("createTheme requires a destructive hex: pass options.destructive or seed.brandDestructive. There is no package default.");
-	return hex;
+	return options.destructive ?? options.seed.brandDestructive ?? DESTRUCTIVE_SCALE_HEX;
 }
 function namedSelect(name, label, choices, defaultValue, field) {
 	return {
@@ -306,7 +341,10 @@ function systemColorGroup(name, label, hexDefault) {
 		type: "group",
 		label,
 		fields: colorScaleFields(hexDefault),
-		admin: { components: { Field: THEME_COLOR_SCALE_FIELD } }
+		admin: {
+			components: { Field: THEME_COLOR_SCALE_FIELD },
+			hideGutter: true
+		}
 	};
 }
 function fontField(name, label, defaultValue, fonts, fontsBaseUrl, sameAsBody) {
@@ -334,205 +372,265 @@ function fontField(name, label, defaultValue, fonts, fontsBaseUrl, sameAsBody) {
 		}
 	};
 }
-/**
-* Settings → Theme. Field tabs: Colors, Typography, Appearance, Identity.
-* Publish in the Save slot writes the open tab only. No draft mode: a
-* save is live. `getPublishedTheme` reads that row. There is no Theme
-* preview pane.
-*/
-function createTheme(options) {
-	const access = requireAccess$1(options);
-	const destructive = requireDestructive(options);
-	const { seed, fonts = catalog, fontsBaseUrl = "/fonts", contrastTarget = 7, logo, identity, onPublish } = options;
-	const tabs = [
-		{
-			label: "Colors",
-			fields: [{
-				name: "colors",
+function colorsFields(seed, destructive) {
+	return [{
+		name: "colors",
+		type: "group",
+		label: false,
+		admin: {
+			hideGutter: true,
+			width: "100%"
+		},
+		fields: [
+			{
+				name: "brand",
 				type: "group",
 				label: false,
+				admin: {
+					hideGutter: true,
+					width: "100%"
+				},
 				fields: [
 					{
-						name: "brand",
-						type: "group",
-						label: false,
-						fields: [
-							{
-								name: "themeColorsHeading",
-								type: "ui",
-								admin: {
-									components: { Field: THEME_SECTION_HEADING },
-									custom: {
-										title: "Theme colors",
-										hint: "House semantic fills page editors can pick. Custom colors sit with these."
-									}
-								}
-							},
-							systemColorGroup("primary", "Primary", seed.brandPrimary),
-							systemColorGroup("secondary", "Secondary", seed.brandSecondary),
-							systemColorGroup("accent", "Accent", seed.brandAccent),
-							systemColorGroup("highlight", "Highlight", seed.brandHighlight),
-							{
-								name: "statusColorsHeading",
-								type: "ui",
-								admin: {
-									components: { Field: THEME_SECTION_HEADING },
-									custom: {
-										title: "Success and Destructive",
-										hint: "Theme chrome only. These are not offered as fills when someone is writing a page."
-									}
-								}
-							},
-							systemColorGroup("success", "Success", seed.brandSuccess),
-							systemColorGroup("destructive", "Destructive", destructive)
-						]
+						name: "themeColorsHeading",
+						type: "ui",
+						admin: {
+							components: { Field: THEME_SECTION_HEADING },
+							custom: {
+								title: "Brand colors",
+								hint: "These colors define the visual identity of the site. Adjust them freely to match the brand."
+							}
+						}
 					},
-					namedSelect("greyScale", "Gray family", presetHints.greyScale, seed.greyScale, THEME_GREY_SCALE_FIELD),
+					systemColorGroup("primary", "Primary", seed.brandPrimary),
+					systemColorGroup("secondary", "Secondary", seed.brandSecondary),
+					systemColorGroup("accent", "Accent", seed.brandAccent),
+					systemColorGroup("highlight", "Highlight", seed.brandHighlight),
 					{
-						name: "library",
-						type: "array",
-						label: "Custom colors",
-						labels: {
-							singular: "Color",
-							plural: "Colors"
-						},
-						fields: [
-							{
-								name: "key",
-								type: "text",
-								label: "Key",
-								required: true,
-								admin: { hidden: true }
-							},
-							{
-								name: "label",
-								type: "text",
-								label: "Name",
-								required: true,
-								admin: { hidden: true }
-							},
-							...colorScaleFields()
-						],
-						admin: { components: { Field: THEME_LIBRARY_FIELD } }
-					}
-				]
-			}, {
-				name: "contrast",
-				type: "ui",
-				admin: {
-					components: { Field: THEME_CONTRAST_REPORT },
-					custom: { target: contrastTarget }
-				}
-			}]
-		},
-		{
-			label: "Typography",
-			fields: [{
-				name: "typography",
-				type: "group",
-				label: false,
-				fields: [
-					fontField("heading", "Heading font", headingSelectValue(seed.fontHeading), fonts, fontsBaseUrl, true),
-					fontField("body", "Body font", seed.fontBody, fonts, fontsBaseUrl, false),
+						name: "libraryPlacement",
+						type: "ui",
+						admin: {
+							components: { Field: THEME_LIBRARY_FIELD },
+							custom: { dataPath: "colors.library" }
+						}
+					},
 					{
-						name: "pairing",
+						name: "greyPlacement",
 						type: "ui",
 						admin: {
-							components: { Field: THEME_PAIRING_FIELD },
-							custom: { fontsBaseUrl }
+							components: { Field: THEME_GREY_SCALE_FIELD },
+							custom: { dataPath: "colors.greyScale" }
 						}
-					}
+					},
+					{
+						name: "statusColorsHeading",
+						type: "ui",
+						admin: {
+							components: { Field: THEME_SECTION_HEADING },
+							custom: {
+								title: "Status colors",
+								hint: "These colors communicate meaning across the site. You can adjust them to fit your brand, but we'll help keep them recognizable as success and error states."
+							}
+						}
+					},
+					systemColorGroup("success", "Success", seed.brandSuccess || LIBRARY_SUCCESS_HEX),
+					systemColorGroup("destructive", "Destructive", destructive)
 				]
-			}]
-		},
-		{
-			label: "Appearance",
-			fields: [{
-				name: "appearance",
-				type: "group",
-				label: false,
-				fields: [
-					namedSelect("defaultTheme", "Default theme", APPEARANCE_CHOICES.defaultTheme, seed.defaultTheme),
-					namedSelect("radius", "Corner style", APPEARANCE_CHOICES.radius, seed.radius),
-					namedSelect("shadow", "Depth", APPEARANCE_CHOICES.shadow, seed.shadow),
-					namedSelect("motion", "Motion", APPEARANCE_CHOICES.motion, seed.motion),
-					namedSelect("density", "Spacing", APPEARANCE_CHOICES.density, seed.density)
-				],
-				admin: { components: { Field: THEME_APPEARANCE_FIELD } }
-			}]
-		}
-	];
-	tabs.push({
-		label: "Identity",
-		fields: logo ? [
-			{
-				name: "logo",
-				type: "upload",
-				relationTo: logo.collection,
-				label: "Logo",
-				admin: { description: "The full wordmark used in the header and footer." }
 			},
 			{
-				name: "favicon",
-				type: "upload",
-				relationTo: logo.collection,
-				label: "Favicon",
-				admin: { description: "The small icon in the browser tab. PNG or SVG." }
+				...namedSelect("greyScale", "Gray family", presetHints.greyScale, seed.greyScale, THEME_GREY_SCALE_FIELD),
+				admin: {
+					hidden: true,
+					components: { Field: THEME_GREY_SCALE_FIELD }
+				}
 			},
 			{
-				name: "logoMark",
-				type: "upload",
-				relationTo: logo.collection,
-				label: "Mobile menu logo",
-				admin: { description: "Optional. Used when the full logo is too wide for the mobile menu — typically the mark." }
+				name: "library",
+				type: "array",
+				label: "Additional colors",
+				labels: {
+					singular: "Color",
+					plural: "Colors"
+				},
+				fields: [
+					{
+						name: "key",
+						type: "text",
+						label: "Key",
+						required: true,
+						admin: { hidden: true }
+					},
+					{
+						name: "label",
+						type: "text",
+						label: "Name",
+						required: true,
+						admin: { hidden: true }
+					},
+					...colorScaleFields()
+				],
+				admin: {
+					hidden: true,
+					components: { Field: THEME_LIBRARY_FIELD },
+					width: "100%"
+				}
 			}
-		] : [{
-			name: "identityFallback",
-			type: "ui",
-			admin: {
-				components: { Field: THEME_IDENTITY_FALLBACK },
-				custom: { fallback: identity?.fallback }
+		]
+	}];
+}
+function typographyFields(seed, fonts, fontsBaseUrl) {
+	return [{
+		name: "typography",
+		type: "group",
+		label: "Typography",
+		fields: [
+			fontField("heading", "Heading font", headingSelectValue(seed.fontHeading), fonts, fontsBaseUrl, true),
+			fontField("body", "Body font", seed.fontBody, fonts, fontsBaseUrl, false),
+			{
+				name: "pairing",
+				type: "ui",
+				admin: {
+					components: { Field: THEME_PAIRING_FIELD },
+					custom: { fontsBaseUrl }
+				}
 			}
-		}]
-	});
-	const fields = [{
-		type: "tabs",
-		tabs
-	}, {
-		name: "publishChild",
-		type: "text",
-		admin: { hidden: true }
+		]
+	}];
+}
+function appearanceFields(seed) {
+	return [{
+		name: "appearance",
+		type: "group",
+		label: "Appearance",
+		fields: [
+			namedSelect("defaultTheme", "Default theme", APPEARANCE_CHOICES.defaultTheme, seed.defaultTheme),
+			namedSelect("radius", "Corner style", APPEARANCE_CHOICES.radius, seed.radius),
+			namedSelect("shadow", "Depth", APPEARANCE_CHOICES.shadow, seed.shadow),
+			namedSelect("motion", "Motion", APPEARANCE_CHOICES.motion, seed.motion),
+			namedSelect("density", "Spacing", APPEARANCE_CHOICES.density, seed.density)
+		],
+		admin: { components: { Field: THEME_APPEARANCE_FIELD } }
 	}];
+}
+function identityFields(collection) {
+	return [
+		{
+			name: "logo",
+			type: "upload",
+			relationTo: collection,
+			label: "Logo",
+			admin: { description: "The full wordmark used in the header and footer." }
+		},
+		{
+			name: "favicon",
+			type: "upload",
+			relationTo: collection,
+			label: "Favicon",
+			admin: { description: "The small icon in the browser tab. PNG or SVG." }
+		},
+		{
+			name: "logoMark",
+			type: "upload",
+			relationTo: collection,
+			label: "Mobile menu logo",
+			admin: { description: "Optional. Used when the full logo is too wide for the mobile menu — typically the mark." }
+		}
+	];
+}
+function pageHooks(child) {
 	return {
+		beforeChange: [async ({ data, req }) => {
+			if (req?.payload) await persistThemeChild(req.payload, data, child);
+			return data;
+		}],
+		afterRead: [async ({ doc, req }) => {
+			if (hasThemeSlice(doc, child)) return doc;
+			const theme = await req?.payload?.findGlobal({
+				slug: THEME_SLUG,
+				draft: false,
+				depth: child === "identity" ? 1 : 0,
+				overrideAccess: true
+			});
+			if (!theme) return doc;
+			return {
+				...doc,
+				...sliceFromTheme(theme, child)
+			};
+		}]
+	};
+}
+/**
+* Standard Payload Globals in an `admin.group: "Theme"` nav section —
+* the same pattern as Content and Settings. Each page is its own Global
+* (Save, fields, access). A hidden `theme` store is the published read
+* model `getPublishedTheme` already knows. Locking is off: these are
+* settings forms, not collaborative documents. No draft mode, no preview
+* pane.
+*/
+function createTheme(options) {
+	const access = requireAccess$1(options);
+	const destructive = requireDestructive(options);
+	const { seed, fonts = catalog, fontsBaseUrl = "/fonts", contrastTarget = 7, logo, identity, onPublish } = options;
+	const adminCustom = {
+		contrastTarget,
+		fontsBaseUrl,
+		identityFallback: identity?.fallback
+	};
+	const colorFields = colorsFields(seed, destructive);
+	const typeFields = typographyFields(seed, fonts, fontsBaseUrl);
+	const lookFields = appearanceFields(seed);
+	const markFields = logo ? identityFields(logo.collection) : [];
+	const store = {
 		slug: THEME_SLUG,
 		label: "Theme",
+		lockDocuments: false,
 		admin: {
-			group: "Settings",
-			custom: {
-				contrastTarget,
-				fontsBaseUrl,
-				identityFallback: identity?.fallback
-			},
-			components: { elements: { SaveButton: THEME_SAVE_BUTTON } }
+			hidden: true,
+			hideAPIURL: true,
+			custom: adminCustom
 		},
 		access: {
 			read: access.read,
 			update: access.update
 		},
-		fields,
-		hooks: {
-			beforeChange: [({ data, originalDoc }) => {
-				const { publishChild, ...rest } = data;
-				if (isThemeChild(publishChild)) return publishThemeChild(originalDoc ?? {}, rest, publishChild);
-				return rest;
-			}],
-			afterChange: [async ({ doc }) => {
-				if (!onPublish) return;
-				const themeDoc = doc;
-				await onPublish(themeConfigFromDoc(themeDoc, seed), themeDoc);
-			}]
-		}
+		fields: [
+			...colorFields,
+			...typeFields,
+			...lookFields,
+			...markFields
+		],
+		hooks: { afterChange: [async ({ doc }) => {
+			if (!onPublish) return;
+			const themeDoc = doc;
+			await onPublish(themeConfigFromDoc(themeDoc, seed), themeDoc);
+		}] }
 	};
+	function page(slug, label, child, fields, preview) {
+		return {
+			slug,
+			label,
+			lockDocuments: false,
+			admin: {
+				group: "Theme",
+				hideAPIURL: true,
+				custom: adminCustom,
+				components: preview ? { elements: { beforeDocumentControls: [THEME_DOCUMENT_CONTROLS] } } : void 0
+			},
+			access: {
+				read: access.read,
+				update: access.update
+			},
+			fields,
+			hooks: pageHooks(child)
+		};
+	}
+	return [
+		store,
+		page(THEME_COLORS_SLUG, "Colors", "colors", colorFields, true),
+		page(THEME_TYPOGRAPHY_SLUG, "Typography", "typography", typeFields, true),
+		page(THEME_APPEARANCE_SLUG, "Appearance", "appearance", lookFields, true),
+		...logo ? [page(THEME_IDENTITY_SLUG, "Identity", "identity", markFields, false)] : []
+	];
 }
 //#endregion
 //#region src/brand-assets/sanitize.ts
@@ -578,7 +676,7 @@ const BRAND_ASSETS_MIME_TYPES = [
 function requireAccess(options) {
 	const read = options.access?.read;
 	const update = options.access?.update;
-	if (!read || !update) throw new Error("createBrandAssets requires access.read and access.update. Pass the site's predicates; canManageBrand is the intended update predicate until BIS-43 moves src/platform here.");
+	if (!read || !update) throw new Error("createBrandAssets requires access.read and access.update. Pass canManageBrand from this package as update.");
 	return {
 		read,
 		update
@@ -681,6 +779,659 @@ const THEME_PREVIEW_BREAKPOINTS = [
 	}
 ];
 //#endregion
-export { BRAND_ASSETS_MIME_TYPES, BRAND_ASSETS_SLUG, DESCRIPTION_LENGTH, SHARE_IMAGE_SIZE, SYSTEM_COLOR_KEYS, THEME_APPEARANCE_FIELD, THEME_COLOR_FIELD, THEME_COLOR_SCALE_FIELD, THEME_CONTRAST_REPORT, THEME_FONT_FIELD, THEME_GREY_SCALE_FIELD, THEME_IDENTITY_FALLBACK, THEME_LIBRARY_FIELD, THEME_PAIRING_FIELD, THEME_PREVIEW_BREAKPOINTS, THEME_PUBLISH_FIELD, THEME_SAVE_BUTTON, THEME_SECTION_HEADING, THEME_SLUG, createBrandAssets, createTheme, deleteLibraryColor, documentTitle, firstImageIn, noIndexField, publishThemeChild, resolveThemeIdentity, rewriteColorToken, sanitizeSvg, seedTheme, seoPlugin, themeColorKeys, titleTemplate, truncateAtWord };
+//#region src/roles/types.ts
+/**
+* The Roles Global a site's generated types will describe. Optional and
+* nullable, no index signature: a generated Global is assignable to this,
+* never the reverse.
+*/
+const ROLES = [
+	"developer",
+	"admin",
+	"designer",
+	"author"
+];
+const ROLE_LABELS = {
+	developer: "Developer",
+	admin: "Admin",
+	designer: "Designer",
+	author: "Author"
+};
+const CAPABILITIES = [
+	"content",
+	"brand",
+	"publish",
+	"users"
+];
+function isRole(value) {
+	return typeof value === "string" && ROLES.includes(value);
+}
+//#endregion
+//#region src/roles/matrix.ts
+const ROLES_SLUG = "roles";
+/**
+* Default rank and ticks. Brand is Designer only. The API tab is not a
+* column — it is locked to Developer in `isDeveloper`.
+*/
+const DEFAULT_ROLE_MATRIX = [
+	{
+		role: "developer",
+		content: true,
+		brand: true,
+		publish: true,
+		users: true
+	},
+	{
+		role: "admin",
+		content: true,
+		brand: false,
+		publish: true,
+		users: true
+	},
+	{
+		role: "designer",
+		content: false,
+		brand: true,
+		publish: false,
+		users: false
+	},
+	{
+		role: "author",
+		content: true,
+		brand: false,
+		publish: false,
+		users: false
+	}
+];
+const DEVELOPER_DESCRIPTION = "Everything Admin can do, plus the document API tab.";
+const LAST_USERS_TICK_MESSAGE = "Keep Users ticked on at least one of Admin or Developer.";
+const CAPABILITY_LABELS = {
+	content: "Content",
+	brand: "Brand",
+	publish: "Publish",
+	users: "Users"
+};
+function defaultRolesFieldValue() {
+	return DEFAULT_ROLE_MATRIX.map((row) => ({
+		id: row.role,
+		...row
+	}));
+}
+function parseRolesMatrix(value) {
+	if (!Array.isArray(value)) return {
+		ok: false,
+		message: "Roles must be Developer, Admin, Designer, and Author."
+	};
+	const rows = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const role = "role" in item ? item.role : void 0;
+		if (!isRole(role) || seen.has(role)) continue;
+		seen.add(role);
+		rows.push({
+			id: role,
+			role,
+			content: Boolean("content" in item && item.content),
+			brand: Boolean("brand" in item && item.brand),
+			publish: Boolean("publish" in item && item.publish),
+			users: Boolean("users" in item && item.users)
+		});
+	}
+	if (rows.length !== ROLES.length || ROLES.some((role) => !seen.has(role))) return {
+		ok: false,
+		message: "Roles must be Developer, Admin, Designer, and Author."
+	};
+	return {
+		ok: true,
+		rows
+	};
+}
+function hasPrivilegedUsersTick(rows) {
+	return rows.some((row) => (row.role === "admin" || row.role === "developer") && row.users);
+}
+function validateRolesMatrix(value) {
+	const parsed = parseRolesMatrix(value);
+	if (!parsed.ok) return parsed.message;
+	if (!hasPrivilegedUsersTick(parsed.rows)) return LAST_USERS_TICK_MESSAGE;
+	return true;
+}
+/**
+* Developer is exclusive. Admin does not swallow Designer: both store.
+*/
+function normalizeStoredRoles(value) {
+	if (!Array.isArray(value)) return [];
+	const roles = [...new Set(value.filter(isRole))];
+	if (roles.includes("developer")) return ["developer"];
+	return roles;
+}
+function roleSelectOptions(matrix = DEFAULT_ROLE_MATRIX) {
+	return matrix.map((row) => ({
+		label: ROLE_LABELS[row.role],
+		value: row.role
+	}));
+}
+/** Capability copy only. Developer names the API tab; nothing about MCP or seed. */
+function roleDescription(role, matrix = DEFAULT_ROLE_MATRIX) {
+	if (role === "developer") return DEVELOPER_DESCRIPTION;
+	const row = matrix.find((entry) => entry.role === role);
+	if (!row) return "No capabilities";
+	return CAPABILITIES.filter((capability) => row[capability]).map((capability) => CAPABILITY_LABELS[capability]).join(", ") || "No capabilities";
+}
+//#endregion
+//#region src/roles/access.ts
+function isAccessArgs(value) {
+	return typeof value === "object" && value !== null && "req" in value;
+}
+function storedRoles(user) {
+	return Array.isArray(user?.roles) ? user.roles : [];
+}
+function hasRole(user, role) {
+	return storedRoles(user).includes(role);
+}
+/** Not a tick. True only when `developer` is stored on the row. */
+function isDeveloper(user) {
+	return hasRole(user, "developer");
+}
+function hasCapability(user, capability, matrix = DEFAULT_ROLE_MATRIX) {
+	return storedRoles(user).some((role) => {
+		return matrix.find((entry) => entry.role === role)?.[capability] === true;
+	});
+}
+/**
+* Reads the saved Roles Global, falling back to the seed when the row is
+* empty, missing, or unreadable. Always override-access so a Designer
+* evaluating Theme does not have to read Settings → Roles.
+*/
+async function getRolesMatrix(req = {}) {
+	const findGlobal = req.payload?.findGlobal;
+	if (typeof findGlobal !== "function") return [...DEFAULT_ROLE_MATRIX];
+	try {
+		const doc = await findGlobal({
+			slug: ROLES_SLUG,
+			overrideAccess: true,
+			req
+		});
+		const parsed = parseRolesMatrix(doc && typeof doc === "object" && "roles" in doc ? doc.roles : void 0);
+		return parsed.ok ? parsed.rows : [...DEFAULT_ROLE_MATRIX];
+	} catch {
+		return [...DEFAULT_ROLE_MATRIX];
+	}
+}
+function capabilityPredicate(capability) {
+	function predicate(userOrArgs, matrix) {
+		if (isAccessArgs(userOrArgs)) {
+			const user = userOrArgs.req.user;
+			if (matrix) return hasCapability(user, capability, matrix);
+			return getRolesMatrix(userOrArgs.req).then((rows) => hasCapability(user, capability, rows));
+		}
+		return hasCapability(userOrArgs, capability, matrix ?? DEFAULT_ROLE_MATRIX);
+	}
+	return predicate;
+}
+const canManageContent = capabilityPredicate("content");
+const canManageBrand = capabilityPredicate("brand");
+const canPublish = capabilityPredicate("publish");
+/** Users tick on any held role. */
+const isAdmin = capabilityPredicate("users");
+/** This role id currently has the Users tick. */
+function isPrivilegedRole(role, matrix = DEFAULT_ROLE_MATRIX) {
+	return isRole(role) && matrix.some((row) => row.role === role && row.users);
+}
+function isAuthenticated(userOrArgs) {
+	if (isAccessArgs(userOrArgs)) return Boolean(userOrArgs.req.user);
+	return Boolean(userOrArgs);
+}
+const isAdminOrSelf = async ({ req }) => {
+	if (!req.user) return false;
+	if (await isAdmin({ req })) return true;
+	return { id: { equals: req.user.id } };
+};
+const authenticatedOrPublished = ({ req: { user } }) => {
+	if (isAuthenticated(user)) return true;
+	return { _status: { equals: "published" } };
+};
+/** API tab condition: Developer only, not the Users tick. */
+function isDeveloperTab({ req }) {
+	return isDeveloper(req.user);
+}
+//#endregion
+//#region src/roles/fields.ts
+const ROLES_MATRIX_FIELD = "@bison-lab/payload-core/admin#RolesMatrixField";
+const ROLES_FIELD = "@bison-lab/payload-core/admin#RolesField";
+//#endregion
+//#region src/roles/global.ts
+/**
+* Settings → Roles. Rank is the array order (Payload's drag handle). Ticks
+* are Content, Brand, Publish, Users. The API tab is not a column.
+*/
+function createRoles() {
+	return {
+		slug: ROLES_SLUG,
+		label: "Roles",
+		admin: {
+			group: "Settings",
+			hidden: ({ user }) => !isAdmin(user),
+			description: "Who may do what. Drag to change rank. The API tab is locked to Developer."
+		},
+		access: {
+			read: (args) => isAdmin(args),
+			update: (args) => isAdmin(args)
+		},
+		fields: [{
+			name: "roles",
+			type: "array",
+			label: "Roles",
+			labels: {
+				singular: "Role",
+				plural: "Roles"
+			},
+			minRows: 4,
+			maxRows: 4,
+			required: true,
+			defaultValue: defaultRolesFieldValue(),
+			validate: validateRolesMatrix,
+			admin: {
+				components: { Field: ROLES_MATRIX_FIELD },
+				description: "Drag to change rank. Ticks are Content, Brand, Publish, and Users. The API tab is locked to Developer.",
+				initCollapsed: false
+			},
+			fields: [
+				{
+					name: "role",
+					type: "select",
+					label: "Role",
+					required: true,
+					options: ROLES.map((value) => ({
+						label: ROLE_LABELS[value],
+						value
+					})),
+					admin: { readOnly: true }
+				},
+				{
+					name: "content",
+					type: "checkbox",
+					label: "Content"
+				},
+				{
+					name: "brand",
+					type: "checkbox",
+					label: "Brand"
+				},
+				{
+					name: "publish",
+					type: "checkbox",
+					label: "Publish"
+				},
+				{
+					name: "users",
+					type: "checkbox",
+					label: "Users"
+				}
+			]
+		}]
+	};
+}
+//#endregion
+//#region src/roles/seed.ts
+/**
+* Writes the default matrix. For a site's migration `up()`. Never writes a
+* user row — seeding `developer` on a person stays a site concern.
+*/
+async function seedRoles(payload) {
+	return payload.updateGlobal({
+		slug: ROLES_SLUG,
+		data: { roles: defaultRolesFieldValue() }
+	});
+}
+//#endregion
+//#region src/fields/slug.ts
+/**
+* A stored slug from whatever was typed: lowercased, with any run of
+* whitespace and slashes stripped from either end in one pass, so `/ about-us /`
+* does not keep the inner spaces a trim-then-strip would leave.
+*/
+function normalizeSlug(value) {
+	return value.replace(/^[\s/]+|[\s/]+$/g, "").toLowerCase();
+}
+async function slugProblem(slug, { collection, id, isReserved, req }) {
+	if (!slug) return void 0;
+	if (isReserved(slug)) return `"/${slug}" is a built-in page on this site, so a page here cannot use it. Please choose a different address.`;
+	if (typeof req?.payload?.find !== "function") return void 0;
+	const where = { slug: { equals: slug } };
+	if (id !== void 0) where.id = { not_equals: id };
+	const query = {
+		collection,
+		depth: 0,
+		limit: 1,
+		overrideAccess: true,
+		pagination: false,
+		req,
+		where
+	};
+	return (await req.payload.find(query)).docs.length > 0 || (await req.payload.find({
+		...query,
+		draft: true
+	})).docs.length > 0 ? `Another page is already using "/${slug}". Please choose a different address.` : void 0;
+}
+/**
+* The path a document is published at, normalised on the way in. Unique
+* across the collection. `validate` is the message under the field;
+* `beforeChange` is the enforcement on a draft save, where Payload skips
+* field validation.
+*/
+function slugField({ collection, isReserved }) {
+	const validate = async (value, options) => {
+		try {
+			const builtIn = await validations.text(value, options);
+			if (builtIn !== true) return builtIn;
+		} catch {}
+		return await slugProblem(typeof value === "string" ? value : "", {
+			collection,
+			id: options.id,
+			isReserved,
+			req: options.req
+		}) ?? true;
+	};
+	return {
+		name: "slug",
+		type: "text",
+		required: true,
+		unique: true,
+		admin: { description: "Path under the site root, no leading slash: \"about-us\" or \"patients/stories\"." },
+		hooks: {
+			beforeValidate: [({ value }) => typeof value === "string" ? normalizeSlug(value) : value],
+			beforeChange: [async ({ data, originalDoc, req, value }) => {
+				if (typeof value !== "string") return value;
+				const problem = await slugProblem(value, {
+					collection,
+					id: originalDoc?.id ?? data?.id,
+					isReserved,
+					req
+				});
+				if (problem) throw new ValidationError({
+					collection,
+					errors: [{
+						message: problem,
+						path: "slug"
+					}],
+					req
+				}, req?.t);
+				return value;
+			}]
+		},
+		validate
+	};
+}
+//#endregion
+//#region src/collections/pages.ts
+/**
+* CMS-managed pages: one required hero, then a reorderable body of sections.
+* The CMS owns copy and the order of sections; what a section looks like is
+* code-owned, which is why the blocks are an argument.
+*/
+function createPages({ heroBlocks, isReservedSlug, layoutBlocks, previewPath, previewButton }) {
+	const [defaultHero] = heroBlocks;
+	if (!defaultHero) throw new Error("createPages needs at least one hero block");
+	return {
+		slug: "pages",
+		admin: {
+			useAsTitle: "title",
+			group: "Content",
+			defaultColumns: [
+				"title",
+				"slug",
+				"_status",
+				"updatedAt"
+			],
+			preview: (doc) => previewPath(typeof doc.slug === "string" ? doc.slug : ""),
+			...previewButton ? { components: { edit: { PreviewButton: previewButton } } } : {}
+		},
+		access: {
+			read: authenticatedOrPublished,
+			readVersions: isAuthenticated,
+			create: canManageContent,
+			update: canManageContent,
+			delete: isAdmin
+		},
+		versions: {
+			drafts: { autosave: { interval: 375 } },
+			maxPerDoc: 50
+		},
+		fields: [
+			{
+				name: "title",
+				type: "text",
+				required: true
+			},
+			slugField({
+				collection: "pages",
+				isReserved: isReservedSlug
+			}),
+			{
+				name: "hero",
+				type: "blocks",
+				required: true,
+				minRows: 1,
+				maxRows: 1,
+				blocks: heroBlocks,
+				defaultValue: [{ blockType: defaultHero.slug }],
+				admin: { description: "Every page opens with one hero. A page cannot be published without one." }
+			},
+			{
+				name: "layout",
+				type: "blocks",
+				required: true,
+				minRows: 1,
+				blocks: layoutBlocks,
+				labels: {
+					singular: "Section",
+					plural: "Sections"
+				}
+			}
+		]
+	};
+}
+//#endregion
+//#region src/collections/users.ts
+const nameValidate = (value, options) => {
+	if (options.operation === "update" && value === "" && options.previousValue === "") return true;
+	return text(value, options);
+};
+function nameField(name) {
+	return {
+		name,
+		type: "text",
+		required: true,
+		validate: nameValidate
+	};
+}
+/** Refuses the save that would remove Users from the only privileged user. */
+const LAST_ADMIN_DEMOTE_MESSAGE = "Make another user an admin before removing it from this one.";
+/** Refuses the delete that would remove the only privileged user. */
+const LAST_ADMIN_DELETE_MESSAGE = "Make another user an admin before deleting this one.";
+const LAST_ADMIN_LOCK = "select pg_advisory_xact_lock(hashtext('users:last-admin'))";
+async function lockLastAdminDecision(req) {
+	const { execute, sessions } = req.payload.db;
+	const id = req.transactionID;
+	const session = typeof id === "string" || typeof id === "number" ? sessions?.[id] : void 0;
+	if (!session || typeof execute !== "function") return;
+	await execute({
+		db: session.db,
+		raw: LAST_ADMIN_LOCK
+	});
+}
+function privilegedRoles(matrix) {
+	return matrix.filter((row) => row.users).map((row) => row.role);
+}
+function holdsPrivilegedRole(roles, matrix) {
+	return Array.isArray(roles) && roles.some((role) => isPrivilegedRole(role, matrix));
+}
+function privilegedWhere(matrix) {
+	const roles = privilegedRoles(matrix);
+	if (roles.length === 0) return { id: { equals: "__none__" } };
+	return { or: roles.map((role) => ({ roles: { contains: role } })) };
+}
+async function adminCount(req, excluding) {
+	await lockLastAdminDecision(req);
+	const holdsPrivileged = privilegedWhere(await getRolesMatrix(req));
+	const { totalDocs } = await req.payload.count({
+		collection: "users",
+		overrideAccess: true,
+		req,
+		where: excluding === void 0 ? holdsPrivileged : { and: [holdsPrivileged, { id: { not_equals: excluding } }] }
+	});
+	return totalDocs;
+}
+const rolesValidate = async (value, options) => {
+	const builtIn = select(value, options);
+	if (builtIn !== true) return builtIn;
+	if (options.operation !== "update" || options.id === void 0) return true;
+	const matrix = await getRolesMatrix(options.req);
+	if (holdsPrivilegedRole(value, matrix) || !holdsPrivilegedRole(options.previousValue, matrix)) return true;
+	return await adminCount(options.req, options.id) > 0 ? true : LAST_ADMIN_DEMOTE_MESSAGE;
+};
+function createUsers({ secureCookies, rolesField }) {
+	return {
+		slug: "users",
+		auth: {
+			maxLoginAttempts: 5,
+			lockTime: 600 * 1e3,
+			tokenExpiration: 7200,
+			cookies: {
+				sameSite: "Lax",
+				secure: secureCookies
+			}
+		},
+		admin: {
+			useAsTitle: "email",
+			defaultColumns: [
+				"email",
+				"firstName",
+				"lastName",
+				"roles"
+			],
+			hidden: ({ user }) => !isAdmin(user)
+		},
+		access: {
+			create: isAdmin,
+			delete: isAdmin,
+			unlock: isAdmin,
+			read: isAdminOrSelf,
+			update: isAdminOrSelf
+		},
+		hooks: {
+			beforeDelete: [async ({ id, req }) => {
+				if (!isAdmin(await req.payload.findByID({
+					collection: "users",
+					id,
+					depth: 0,
+					disableErrors: true,
+					overrideAccess: true,
+					req
+				})) || await adminCount(req, id) > 0) return;
+				throw new APIError(LAST_ADMIN_DELETE_MESSAGE, 400);
+			}],
+			afterOperation: [async (arg) => {
+				const { operation, req } = arg;
+				const touchesRoles = (operation === "update" || operation === "updateByID") && arg.args.data?.roles !== void 0;
+				const deletes = operation === "delete" || operation === "deleteByID";
+				if ((touchesRoles || deletes) && await adminCount(req) === 0) throw new APIError(deletes ? LAST_ADMIN_DELETE_MESSAGE : LAST_ADMIN_DEMOTE_MESSAGE, 400);
+				return arg.result;
+			}]
+		},
+		fields: [{
+			type: "row",
+			fields: [nameField("firstName"), nameField("lastName")]
+		}, {
+			name: "roles",
+			type: "select",
+			hasMany: true,
+			required: true,
+			defaultValue: ["author"],
+			options: roleSelectOptions(),
+			admin: {
+				components: { Field: rolesField ?? "@bison-lab/payload-core/admin#RolesField" },
+				description: "One person can hold several, e.g. Author + Designer."
+			},
+			access: { update: isAdmin },
+			validate: rolesValidate,
+			hooks: { beforeValidate: [({ value }) => Array.isArray(value) ? normalizeStoredRoles(value) : value] }
+		}]
+	};
+}
+//#endregion
+//#region src/collections/media.ts
+/**
+* Uploads, readable by anyone: the public site serves these files. Writing is
+* an editorial action, deleting is not — removing an asset a live page
+* references breaks that page.
+*/
+function createMedia({ staticDir = "media", mimeTypes = ["image/*"], imageSizes } = {}) {
+	return {
+		slug: "media",
+		access: {
+			read: () => true,
+			create: canManageContent,
+			update: canManageContent,
+			delete: isAdmin
+		},
+		upload: {
+			staticDir,
+			mimeTypes,
+			imageSizes
+		},
+		fields: [{
+			name: "alt",
+			type: "text",
+			required: true
+		}]
+	};
+}
+//#endregion
+//#region src/plugins/admin-only-api-tab.ts
+function gateApiTab(entity) {
+	const components = entity.admin?.components;
+	const edit = components?.views?.edit;
+	const api = edit && "api" in edit ? edit.api : void 0;
+	return {
+		...entity,
+		admin: {
+			...entity.admin,
+			components: {
+				...components,
+				views: {
+					...components?.views,
+					edit: {
+						...edit,
+						api: {
+							...api,
+							tab: {
+								...api?.tab,
+								condition: isDeveloperTab
+							}
+						}
+					}
+				}
+			}
+		}
+	};
+}
+/**
+* Gates the document API tab to Developer, config-wide. After plugins that
+* use `definePlugin` order (MCP is 10), so a collection those plugins
+* register is still covered.
+*/
+const adminOnlyApiTab = definePlugin({
+	slug: "admin-only-api-tab",
+	order: 1e3,
+	plugin: ({ config }) => ({
+		...config,
+		collections: config.collections?.map(gateApiTab),
+		globals: config.globals?.map(gateApiTab)
+	})
+});
+//#endregion
+export { BRAND_ASSETS_MIME_TYPES, BRAND_ASSETS_SLUG, CAPABILITIES, DEFAULT_ROLE_MATRIX, DESCRIPTION_LENGTH, DEVELOPER_DESCRIPTION, LAST_ADMIN_DELETE_MESSAGE, LAST_ADMIN_DEMOTE_MESSAGE, LAST_USERS_TICK_MESSAGE, LOOK_FIELD, PAGE_EDITOR_SYSTEM_KEYS, ROLES, ROLES_FIELD, ROLES_MATRIX_FIELD, ROLES_SLUG, ROLE_LABELS, SHARE_IMAGE_SIZE, SYSTEM_COLOR_KEYS, THEME_APPEARANCE_FIELD, THEME_APPEARANCE_SLUG, THEME_COLORS_SLUG, THEME_COLOR_FIELD, THEME_COLOR_SCALE_FIELD, THEME_CONTRAST_REPORT, THEME_DOCUMENT_CONTROLS, THEME_FONT_FIELD, THEME_GREY_SCALE_FIELD, THEME_IDENTITY_FALLBACK, THEME_IDENTITY_SLUG, THEME_LIBRARY_FIELD, THEME_PAIRING_FIELD, THEME_PREVIEW_BREAKPOINTS, THEME_PUBLISH_FIELD, THEME_SAVE_BUTTON, THEME_SECTION_HEADING, THEME_SLUG, THEME_TYPOGRAPHY_SLUG, adminOnlyApiTab, authenticatedOrPublished, canManageBrand, canManageContent, canPublish, colorTokenField, createBrandAssets, createMedia, createPages, createRoles, createTheme, createUsers, defaultRolesFieldValue, deleteLibraryColor, documentTitle, firstImageIn, getRolesMatrix, hasCapability, hasRole, isAdmin, isAdminOrSelf, isAuthenticated, isDeveloper, isDeveloperTab, isPrivilegedRole, isRole, lookField, noIndexField, normalizeSlug, normalizeStoredRoles, pageEditorLooks, pageEditorTokens, parseRolesMatrix, persistThemeChild, publishThemeChild, resolveThemeIdentity, rewriteColorToken, roleDescription, roleSelectOptions, sanitizeSvg, seedRoles, seedTheme, seoPlugin, slugField, storedRoles, themeColorKeys, themeLibraryFromDoc, titleTemplate, truncateAtWord, validateRolesMatrix };
 
 //# sourceMappingURL=index.mjs.map