@bison-lab/payload-core 3.12.0 → 3.14.0

package/dist/access-B3LglN2J.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-B3LglN2J.mjs","names":["isAccessArgs"],"sources":["../src/features/types.ts","../src/features/matrix.ts","../src/roles/types.ts","../src/roles/matrix.ts","../src/roles/access.ts","../src/features/access.ts"],"sourcesContent":["export const FEATURES_SLUG = \"features\";\n\nexport const FEATURE_GROUPS = [\"pages\", \"media\", \"theme\", \"users\"] as const;\n\nexport type FeatureGroupId = (typeof FEATURE_GROUPS)[number];\n\nexport const FEATURE_GROUP_LABELS: Record<FeatureGroupId, string> = {\n  pages: \"Pages\",\n  media: \"Media\",\n  theme: \"Theme\",\n  users: \"Users\",\n};\n\nexport const PACKAGE_FEATURE_SLUGS = [\n  \"content\",\n  \"publish\",\n  \"api-tab\",\n  \"media\",\n  \"theme-colors\",\n  \"theme-typography\",\n  \"theme-appearance\",\n  \"theme-identity\",\n  \"brand-assets\",\n  \"users\",\n  \"roles\",\n] as const;\n\nexport type PackageFeatureSlug = (typeof PACKAGE_FEATURE_SLUGS)[number];\n\nexport interface PackageFeature {\n  slug: PackageFeatureSlug;\n  label: string;\n  group: FeatureGroupId;\n  defaultReleased: boolean;\n}\n\n/**\n * Package catalogue. Features itself is not a row — that screen is\n * Developer-only in code. Empty Global falls back to these defaults.\n */\nexport const PACKAGE_FEATURES: readonly PackageFeature[] = [\n  { slug: \"content\", label: \"Content\", group: \"pages\", defaultReleased: true },\n  { slug: \"publish\", label: \"Publish\", group: \"pages\", defaultReleased: true },\n  { slug: \"api-tab\", label: \"API tab\", group: \"pages\", defaultReleased: false },\n  { slug: \"media\", label: \"Media\", group: \"media\", defaultReleased: true },\n  { slug: \"theme-colors\", label: \"Colors\", group: \"theme\", defaultReleased: true },\n  { slug: \"theme-typography\", label: \"Typography\", group: \"theme\", defaultReleased: true },\n  { slug: \"theme-appearance\", label: \"Appearance\", group: \"theme\", defaultReleased: true },\n  { slug: \"theme-identity\", label: \"Identity\", group: \"theme\", defaultReleased: true },\n  { slug: \"brand-assets\", label: \"Brand assets\", group: \"theme\", defaultReleased: true },\n  { slug: \"users\", label: \"Users\", group: \"users\", defaultReleased: true },\n  { slug: \"roles\", label: \"Roles\", group: \"users\", defaultReleased: true },\n];\n\n/** A site-only row. Other sites never see this slug. */\nexport interface FeatureExtra {\n  slug: string;\n  label: string;\n  group?: FeatureGroupId;\n  defaultReleased?: boolean;\n}\n\nexport interface FeatureRow {\n  id?: string | null;\n  slug: string;\n  label?: string | null;\n  group?: string | null;\n  released: boolean;\n}\n\nexport interface FeaturesDoc {\n  features?: FeatureRow[] | null;\n}\n\nexport function isFeatureGroupId(value: unknown): value is FeatureGroupId {\n  return typeof value === \"string\" && (FEATURE_GROUPS as readonly string[]).includes(value);\n}\n\nexport function isPackageFeatureSlug(value: unknown): value is PackageFeatureSlug {\n  return typeof value === \"string\" && (PACKAGE_FEATURE_SLUGS as readonly string[]).includes(value);\n}\n\nexport function isFeatureSlug(value: unknown): value is string {\n  return typeof value === \"string\" && /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(value);\n}\n\n/** @deprecated Locks are gone; the release switch is the valve. */\nexport function isLockedFeature(_slug: string, _locked?: boolean | null): boolean {\n  return false;\n}\n","import {\n  FEATURE_GROUP_LABELS,\n  isFeatureGroupId,\n  isFeatureSlug,\n  PACKAGE_FEATURES,\n  type FeatureExtra,\n  type FeatureGroupId,\n  type FeatureRow,\n  type PackageFeature,\n} from \"./types\";\n\nexport const MISSING_PACKAGE_FEATURES_MESSAGE =\n  \"Features must include Content, Publish, API tab, Media, Theme screens, Brand assets, Users, and Roles.\";\n\nexport interface FeatureCatalogueEntry {\n  slug: string;\n  label: string;\n  group: FeatureGroupId;\n  defaultReleased: boolean;\n}\n\nexport function featureCatalogue(extras: readonly FeatureExtra[] = []): FeatureCatalogueEntry[] {\n  return [\n    ...PACKAGE_FEATURES.map((feature) => ({ ...feature })),\n    ...extras.map((extra) => ({\n      slug: extra.slug,\n      label: extra.label,\n      group: extra.group ?? \"users\",\n      defaultReleased: extra.defaultReleased ?? false,\n    })),\n  ];\n}\n\nexport function defaultFeaturesFieldValue(extras: readonly FeatureExtra[] = []): FeatureRow[] {\n  return featureCatalogue(extras).map((feature) => ({\n    id: feature.slug,\n    slug: feature.slug,\n    label: feature.label,\n    group: feature.group,\n    released: feature.defaultReleased,\n  }));\n}\n\nexport function stampFeatureCatalogue(\n  value: unknown,\n  extras: readonly FeatureExtra[] = [],\n): FeatureRow[] {\n  const bySlug = new Map(featureCatalogue(extras).map((feature) => [feature.slug, feature]));\n  if (!Array.isArray(value)) return defaultFeaturesFieldValue(extras);\n  return value.flatMap((item) => {\n    if (!item || typeof item !== \"object\") return [];\n    const slug = \"slug\" in item && typeof item.slug === \"string\" ? item.slug : \"\";\n    const feature = bySlug.get(slug);\n    if (!feature) return [];\n    return [\n      {\n        id: feature.slug,\n        slug: feature.slug,\n        label: feature.label,\n        group: feature.group,\n        released: Boolean(\"released\" in item && item.released),\n      },\n    ];\n  });\n}\n\nexport function parseFeaturesMatrix(\n  value: unknown,\n): { ok: true; rows: FeatureRow[] } | { ok: false; message: string } {\n  if (!Array.isArray(value) || value.length === 0) {\n    return { ok: false, message: MISSING_PACKAGE_FEATURES_MESSAGE };\n  }\n\n  const rows: FeatureRow[] = [];\n  const seen = new Set<string>();\n\n  for (const item of value) {\n    if (!item || typeof item !== \"object\") continue;\n    const slug = \"slug\" in item ? item.slug : undefined;\n    if (!isFeatureSlug(slug) || seen.has(slug)) continue;\n    seen.add(slug);\n    const pack = PACKAGE_FEATURES.find((feature) => feature.slug === slug);\n    const label =\n      \"label\" in item && typeof item.label === \"string\"\n        ? item.label\n        : (pack?.label ?? slug);\n    const group =\n      \"group\" in item && isFeatureGroupId(item.group) ? item.group : (pack?.group ?? \"users\");\n    rows.push({\n      id: slug,\n      slug,\n      label,\n      group,\n      released: Boolean(\"released\" in item && item.released),\n    });\n  }\n\n  if (PACKAGE_FEATURES.some((feature) => !seen.has(feature.slug))) {\n    return { ok: false, message: MISSING_PACKAGE_FEATURES_MESSAGE };\n  }\n  return { ok: true, rows };\n}\n\nexport function validateFeaturesMatrix(\n  value: unknown,\n  extras: readonly FeatureExtra[] = [],\n): true | string {\n  const parsed = parseFeaturesMatrix(value);\n  if (!parsed.ok) return parsed.message;\n  const allowed = new Set(featureCatalogue(extras).map((feature) => feature.slug));\n  if (parsed.rows.some((row) => !allowed.has(row.slug))) return MISSING_PACKAGE_FEATURES_MESSAGE;\n  return true;\n}\n\nexport function featureGroupLabel(group: string): string {\n  return isFeatureGroupId(group) ? FEATURE_GROUP_LABELS[group] : group;\n}\n\nexport function packageFeatureLabel(slug: string, extras: readonly FeatureExtra[] = []): string {\n  const pack = PACKAGE_FEATURES.find((feature) => feature.slug === slug);\n  if (pack) return pack.label;\n  const extra = extras.find((feature) => feature.slug === slug);\n  return extra?.label ?? slug;\n}\n\nexport function isGroupOnlySlug(slug: string): boolean {\n  return isFeatureGroupId(slug) && !PACKAGE_FEATURES.some((feature) => feature.slug === slug);\n}\n\nexport type { PackageFeature };\n","/**\n * The Roles Global a site's generated types will describe. Optional and\n * nullable, no index signature: a generated Global is assignable to this,\n * never the reverse.\n */\n\nexport const ROLES = [\"developer\", \"admin\", \"designer\", \"author\"] as const;\n\nexport type Role = (typeof ROLES)[number];\n\nexport const ROLE_LABELS: Record<Role, string> = {\n  developer: \"Developer\",\n  admin: \"Admin\",\n  designer: \"Designer\",\n  author: \"Author\",\n};\n\n/** Capability aliases over feature grants. Brand is any Theme-group leaf. */\nexport const CAPABILITIES = [\"content\", \"brand\", \"publish\", \"users\"] as const;\n\nexport type Capability = (typeof CAPABILITIES)[number];\n\nexport const THEME_FEATURE_SLUGS = [\n  \"theme-colors\",\n  \"theme-typography\",\n  \"theme-appearance\",\n  \"theme-identity\",\n  \"brand-assets\",\n] as const;\n\nexport const CAPABILITY_FEATURES: Record<Capability, readonly string[]> = {\n  content: [\"content\"],\n  publish: [\"publish\"],\n  users: [\"users\"],\n  brand: THEME_FEATURE_SLUGS,\n};\n\nexport const DEFAULT_ROLE_GRANTS: Record<Role, readonly string[]> = {\n  developer: [],\n  admin: [\"content\", \"publish\", \"media\", \"users\", \"roles\"],\n  designer: [\n    \"content\",\n    \"media\",\n    ...THEME_FEATURE_SLUGS,\n    \"users\",\n    \"roles\",\n  ],\n  author: [\"content\", \"media\"],\n};\n\n/**\n * A site-defined row passed into `createRoles({ extras })`. The slug is the\n * stored key; the label is what Settings → Roles and Users show.\n */\nexport interface RoleExtra {\n  role: string;\n  label: string;\n  grants?: readonly string[];\n}\n\nexport interface RoleRow {\n  id?: string | null;\n  role: string;\n  label?: string | null;\n  grants: string[];\n}\n\nexport interface RolesDoc {\n  roles?: RoleRow[] | null;\n}\n\n/**\n * `req.user` as Payload hands it over. Structural so this module never\n * imports a site's generated `User`. `roles` is optional because a row\n * that predates the field must come back powerless.\n */\nexport type MaybeUser = { id?: string | number; roles?: readonly string[] | null } | null | undefined;\n\nexport function isRole(value: unknown): value is Role {\n  return typeof value === \"string\" && (ROLES as readonly string[]).includes(value);\n}\n\n/** Lowercase slug from a letters-and-spaces name: `designer`, `the-designer`. */\nexport function isRoleSlug(value: unknown): value is string {\n  return typeof value === \"string\" && /^[a-z]+(-[a-z]+)*$/.test(value);\n}\n\n/** Display name: letters and single spaces only. `The Greatest Designer`. */\nexport function isRoleName(value: unknown): value is string {\n  return typeof value === \"string\" && /^[A-Za-z]+(?: [A-Za-z]+)*$/.test(value.trim());\n}\n\n/** Strip digits and punctuation as the name is typed. Trailing space stays. */\nexport function sanitizeRoleNameInput(value: string): string {\n  return value.replace(/[^A-Za-z ]/g, \"\").replace(/ {2,}/g, \" \");\n}\n\n/** Name → stored key. `The Greatest Designer` → `the-greatest-designer`. */\nexport function slugifyRoleName(value: unknown): string {\n  if (typeof value !== \"string\") return \"\";\n  return value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z]+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n}\n\nexport function roleLabel(role: string, label?: string | null): string {\n  const trimmed = typeof label === \"string\" ? label.trim() : \"\";\n  if (trimmed) return trimmed;\n  return isRole(role) ? ROLE_LABELS[role] : role;\n}\n\nexport function defaultGrantsForRole(role: string, extraGrants?: readonly string[]): string[] {\n  if (isRole(role)) return [...DEFAULT_ROLE_GRANTS[role]];\n  return extraGrants ? [...extraGrants] : [];\n}\n","import { packageFeatureLabel } from \"../features/matrix\";\nimport { isFeatureSlug } from \"../features/types\";\nimport {\n  CAPABILITY_FEATURES,\n  defaultGrantsForRole,\n  isRole,\n  isRoleName,\n  isRoleSlug,\n  ROLE_LABELS,\n  roleLabel,\n  ROLES,\n  slugifyRoleName,\n  THEME_FEATURE_SLUGS,\n  type Capability,\n  type RoleExtra,\n  type RoleRow,\n} from \"./types\";\n\nexport const ROLES_SLUG = \"roles\";\n\nexport const ROLES_GLOBAL_DESCRIPTION = \"Who may do what. Drag to change rank.\";\n\nexport const ROLES_FIELD_DESCRIPTION =\n  \"Drag to change rank. Ticks are features released on Features. Developer has the whole catalogue.\"\n\n/**\n * Default rank and grants. Developer is implicit (empty grants). Brand\n * screens default to Designer. The API tab is not granted until released.\n */\nexport const DEFAULT_ROLE_MATRIX: readonly RoleRow[] = ROLES.map((role) => ({\n  role,\n  grants: defaultGrantsForRole(role),\n}));\n\nexport const DEVELOPER_DESCRIPTION =\n  \"Everything, including features not released for assignment.\";\n\nexport const LAST_USERS_TICK_MESSAGE =\n  \"Keep Users granted on at least one of Admin or Developer.\";\n\nexport const MISSING_SEED_ROLES_MESSAGE = \"Roles must include Developer, Admin, Designer, and Author.\";\n\nexport const DUPLICATE_ROLE_SLUG_MESSAGE = \"Each role needs a unique slug.\";\n\nexport const DUPLICATE_ROLE_NAME_MESSAGE = \"Each role needs a unique name.\";\n\nexport const INVALID_ROLE_NAME_MESSAGE = \"Use letters and spaces only.\";\n\nfunction uniqueSlugs(values: readonly unknown[]): string[] {\n  const slugs: string[] = [];\n  for (const value of values) {\n    if (typeof value === \"string\" && isFeatureSlug(value) && !slugs.includes(value)) slugs.push(value);\n  }\n  return slugs;\n}\n\n/** Read stored grants, or rebuild them from the old capability ticks. */\nexport function grantsFromStoredRole(item: object): string[] {\n  if (\"grants\" in item && Array.isArray(item.grants)) return uniqueSlugs(item.grants);\n  const grants: string[] = [];\n  if (\"content\" in item && item.content) {\n    grants.push(\"content\", \"media\");\n  }\n  if (\"publish\" in item && item.publish) grants.push(\"publish\");\n  if (\"users\" in item && item.users) grants.push(\"users\", \"roles\");\n  if (\"brand\" in item && item.brand) grants.push(...THEME_FEATURE_SLUGS);\n  return uniqueSlugs(grants);\n}\n\nexport function seedRoleRows(extras: readonly RoleExtra[] = []): RoleRow[] {\n  return [\n    ...DEFAULT_ROLE_MATRIX.map((row) => ({\n      ...row,\n      grants: [...row.grants],\n      label: isRole(row.role) ? ROLE_LABELS[row.role] : row.role,\n    })),\n    ...extras.map((extra) => ({\n      role: extra.role,\n      label: extra.label,\n      grants: extra.grants ? [...extra.grants] : [],\n    })),\n  ];\n}\n\nexport function defaultRolesFieldValue(extras: readonly RoleExtra[] = []): RoleRow[] {\n  return seedRoleRows(extras).map((row) => ({ id: row.role, ...row }));\n}\n\nfunction readRoleRow(item: object): RoleRow | { error: string } {\n  const role = \"role\" in item ? item.role : undefined;\n  if (typeof role !== \"string\" || role.trim() === \"\") return { error: DUPLICATE_ROLE_SLUG_MESSAGE };\n  if (!isRoleSlug(role)) return { error: DUPLICATE_ROLE_SLUG_MESSAGE };\n  const label = \"label\" in item && typeof item.label === \"string\" ? item.label : undefined;\n  return {\n    id: role,\n    role,\n    label: roleLabel(role, label),\n    grants: grantsFromStoredRole(item),\n  };\n}\n\nexport function parseRolesMatrix(\n  value: unknown,\n): { ok: true; rows: RoleRow[] } | { ok: false; message: string } {\n  if (!Array.isArray(value)) {\n    return { ok: false, message: MISSING_SEED_ROLES_MESSAGE };\n  }\n\n  const rows: RoleRow[] = [];\n  const seen = new Set<string>();\n  for (const item of value) {\n    if (!item || typeof item !== \"object\") continue;\n    // An Add Role row starts with no slug. Skip it so form-state can\n    // build the fields; the slug field still refuses an empty save.\n    const role = \"role\" in item ? item.role : undefined;\n    if (typeof role !== \"string\" || role.trim() === \"\") continue;\n    const parsed = readRoleRow(item);\n    if (\"error\" in parsed) return { ok: false, message: parsed.error };\n    if (seen.has(parsed.role)) return { ok: false, message: DUPLICATE_ROLE_SLUG_MESSAGE };\n    seen.add(parsed.role);\n    rows.push(parsed);\n  }\n\n  if (ROLES.some((role) => !seen.has(role))) {\n    return { ok: false, message: MISSING_SEED_ROLES_MESSAGE };\n  }\n  return { ok: true, rows };\n}\n\nexport function roleHasGrant(row: RoleRow, slug: string): boolean {\n  if (row.role === \"developer\") return true;\n  return row.grants.includes(slug);\n}\n\nexport function roleHasCapability(row: RoleRow, capability: Capability): boolean {\n  if (row.role === \"developer\") return true;\n  return CAPABILITY_FEATURES[capability].some((slug) => row.grants.includes(slug));\n}\n\n/**\n * Mint a slug from the name only when the row has none yet. An existing\n * key — seed or custom — stays put so a rename cannot orphan users.\n */\nexport function applyRoleSlugsFromNames(value: unknown): unknown {\n  if (!Array.isArray(value)) return value;\n  return value.map((item) => {\n    if (!item || typeof item !== \"object\") return item;\n    const row = item as RoleRow;\n    if (isRoleSlug(row.role)) return item;\n    const slug = slugifyRoleName(row.label);\n    return isRoleSlug(slug) ? { ...row, role: slug } : item;\n  });\n}\n\nfunction hasDuplicateRoleNames(value: unknown): boolean {\n  if (!Array.isArray(value)) return false;\n  const seen = new Set<string>();\n  for (const item of value) {\n    if (!item || typeof item !== \"object\") continue;\n    const role = \"role\" in item && typeof item.role === \"string\" ? item.role : \"\";\n    const raw = \"label\" in item && typeof item.label === \"string\" ? item.label : \"\";\n    const name = raw.trim() || (isRole(role) ? ROLE_LABELS[role] : \"\");\n    if (!name) continue;\n    const key = name.toLowerCase();\n    if (seen.has(key)) return true;\n    seen.add(key);\n  }\n  return false;\n}\n\nfunction hasInvalidRoleName(value: unknown): boolean {\n  if (!Array.isArray(value)) return false;\n  for (const item of value) {\n    if (!item || typeof item !== \"object\") continue;\n    const label = \"label\" in item && typeof item.label === \"string\" ? item.label.trim() : \"\";\n    if (!label) continue;\n    if (!isRoleName(label)) return true;\n  }\n  return false;\n}\n\nexport function validateRolesMatrix(value: unknown): true | string {\n  if (hasDuplicateRoleNames(value)) return DUPLICATE_ROLE_NAME_MESSAGE;\n  if (hasInvalidRoleName(value)) return INVALID_ROLE_NAME_MESSAGE;\n  const parsed = parseRolesMatrix(applyRoleSlugsFromNames(value));\n  if (!parsed.ok) return parsed.message;\n  return true;\n}\n\n/**\n * Developer is exclusive. Admin does not swallow Designer: both store.\n * Unknown slugs (dropped catalogue keys such as `approver`) fall away unless\n * they appear on the matrix.\n */\nexport function normalizeStoredRoles(\n  value: unknown,\n  matrix: readonly RoleRow[] = DEFAULT_ROLE_MATRIX,\n): string[] {\n  if (!Array.isArray(value)) return [];\n  const allowed = new Set(matrix.map((row) => row.role));\n  const roles = [...new Set(value.filter((entry): entry is string => typeof entry === \"string\" && allowed.has(entry)))];\n  if (roles.includes(\"developer\")) return [\"developer\"];\n  return roles;\n}\n\nexport function roleSelectOptions(matrix: readonly RoleRow[] = DEFAULT_ROLE_MATRIX) {\n  return matrix.map((row) => ({ label: roleLabel(row.role, row.label), value: row.role }));\n}\n\n/** Grant copy only. Developer names the unreleased catalogue; nothing about MCP or seed. */\nexport function roleDescription(role: string, matrix: readonly RoleRow[] = DEFAULT_ROLE_MATRIX): string {\n  if (role === \"developer\") return DEVELOPER_DESCRIPTION;\n  const row = matrix.find((entry) => entry.role === role);\n  if (!row) return \"No capabilities\";\n  const ticks = row.grants.map((slug) => packageFeatureLabel(slug));\n  return ticks.join(\", \") || \"No capabilities\";\n}\n\n/**\n * Seed grants and package labels come back; extra rows stay as they are.\n */\nexport function resetRolesMatrix(current: unknown): RoleRow[] {\n  const extras: RoleRow[] = [];\n  if (Array.isArray(current)) {\n    for (const item of current) {\n      if (!item || typeof item !== \"object\") continue;\n      const parsed = readRoleRow(item);\n      if (\"error\" in parsed || isRole(parsed.role)) continue;\n      extras.push(parsed);\n    }\n  }\n  return [...defaultRolesFieldValue(), ...extras];\n}\n","import type { Access, PayloadRequest } from \"payload\";\n\nimport { DEFAULT_ROLE_MATRIX, parseRolesMatrix, roleHasCapability, roleHasGrant, ROLES_SLUG, seedRoleRows } from \"./matrix\";\nimport { type Capability, type MaybeUser, type RoleExtra, type RoleRow } from \"./types\";\n\nexport type { MaybeUser } from \"./types\";\n\ntype AccessArgs = {\n  req: {\n    user?: MaybeUser;\n    payload?: Pick<NonNullable<PayloadRequest[\"payload\"]>, \"findGlobal\">;\n  };\n};\n\ntype CapabilityPredicate = {\n  (user: MaybeUser, matrix?: readonly RoleRow[]): boolean;\n  (args: AccessArgs): boolean | Promise<boolean>;\n};\n\nfunction isAccessArgs(value: unknown): value is AccessArgs {\n  return typeof value === \"object\" && value !== null && \"req\" in value;\n}\n\nexport function storedRoles(user: MaybeUser): readonly string[] {\n  return Array.isArray(user?.roles) ? user.roles : [];\n}\n\nexport function hasRole(user: MaybeUser, role: string): boolean {\n  return storedRoles(user).includes(role);\n}\n\n/** Not a tick. True only when `developer` is stored on the row. */\nexport function isDeveloper(user: MaybeUser): boolean {\n  return hasRole(user, \"developer\");\n}\n\nexport function hasCapability(\n  user: MaybeUser,\n  capability: Capability,\n  matrix: readonly RoleRow[] = DEFAULT_ROLE_MATRIX,\n): boolean {\n  if (isDeveloper(user)) return true;\n  return storedRoles(user).some((role) => {\n    const row = matrix.find((entry) => entry.role === role);\n    return row ? roleHasCapability(row, capability) : false;\n  });\n}\n\nexport function hasGrant(\n  user: MaybeUser,\n  slug: string,\n  matrix: readonly RoleRow[] = DEFAULT_ROLE_MATRIX,\n): boolean {\n  if (isDeveloper(user)) return true;\n  return storedRoles(user).some((role) => {\n    const row = matrix.find((entry) => entry.role === role);\n    return row ? roleHasGrant(row, slug) : false;\n  });\n}\n\n/**\n * Reads the saved Roles Global, falling back to the seed when the row is\n * empty, missing, or unreadable. Always override-access so a Designer\n * evaluating Theme does not have to read Settings → Roles.\n */\nexport async function getRolesMatrix(\n  req: AccessArgs[\"req\"] = {},\n  extras: readonly RoleExtra[] = [],\n): Promise<RoleRow[]> {\n  const fallback = seedRoleRows(extras);\n  const findGlobal = req.payload?.findGlobal;\n  if (typeof findGlobal !== \"function\") return fallback;\n  try {\n    const doc = await findGlobal({\n      slug: ROLES_SLUG,\n      overrideAccess: true,\n      req: req as PayloadRequest,\n    });\n    const parsed = parseRolesMatrix(doc && typeof doc === \"object\" && \"roles\" in doc ? doc.roles : undefined);\n    return parsed.ok ? parsed.rows : fallback;\n  } catch {\n    return fallback;\n  }\n}\n\nfunction capabilityPredicate(capability: Capability): CapabilityPredicate {\n  function predicate(\n    userOrArgs: MaybeUser | AccessArgs,\n    matrix?: readonly RoleRow[],\n  ): boolean | Promise<boolean> {\n    if (isAccessArgs(userOrArgs)) {\n      const user = userOrArgs.req.user as MaybeUser;\n      if (matrix) return hasCapability(user, capability, matrix);\n      return getRolesMatrix(userOrArgs.req).then((rows) => hasCapability(user, capability, rows));\n    }\n    return hasCapability(userOrArgs, capability, matrix ?? DEFAULT_ROLE_MATRIX);\n  }\n  return predicate as CapabilityPredicate;\n}\n\nexport const canManageContent = capabilityPredicate(\"content\");\nexport const canManageBrand = capabilityPredicate(\"brand\");\nexport const canPublish = capabilityPredicate(\"publish\");\n\n/** Users grant on any held role (Developer is implicit). */\nexport const isAdmin = capabilityPredicate(\"users\");\n\n/** This role id currently has the Users grant, or is Developer. */\nexport function isPrivilegedRole(\n  role: unknown,\n  matrix: readonly RoleRow[] = DEFAULT_ROLE_MATRIX,\n): boolean {\n  if (typeof role !== \"string\") return false;\n  if (role === \"developer\") return true;\n  const row = matrix.find((entry) => entry.role === role);\n  return row ? roleHasGrant(row, \"users\") : false;\n}\n\nexport function isAuthenticated(user: MaybeUser): boolean;\nexport function isAuthenticated(args: AccessArgs): boolean;\nexport function isAuthenticated(userOrArgs: MaybeUser | AccessArgs): boolean {\n  if (isAccessArgs(userOrArgs)) return Boolean(userOrArgs.req.user);\n  return Boolean(userOrArgs);\n}\n\nexport const isAdminOrSelf: Access = async ({ req }) => {\n  if (!req.user) return false;\n  if (await isAdmin({ req })) return true;\n  return { id: { equals: req.user.id } };\n};\n\nexport const authenticatedOrPublished: Access = ({ req: { user } }) => {\n  if (isAuthenticated(user as MaybeUser)) return true;\n  return { _status: { equals: \"published\" } };\n};\n\n/**\n * API tab condition. Unreleased (the default) is Developer only.\n * After Features releases it, whoever holds the grant sees it.\n */\nexport function isDeveloperTab({ req }: AccessArgs): boolean | Promise<boolean> {\n  if (isDeveloper(req.user as MaybeUser)) return true;\n  if (!req.payload) return false;\n  // Dynamic import avoids a cycle: features/access reads this module.\n  return import(\"../features/access\").then(({ canUseFeature }) => canUseFeature(\"api-tab\")({ req }));\n}\n","import type { PayloadRequest } from \"payload\";\n\nimport { getRolesMatrix, hasGrant, isDeveloper, type MaybeUser } from \"../roles/access\";\nimport { DEFAULT_ROLE_MATRIX } from \"../roles/matrix\";\nimport type { RoleRow } from \"../roles/types\";\nimport { defaultFeaturesFieldValue, isGroupOnlySlug, parseFeaturesMatrix } from \"./matrix\";\nimport { FEATURES_SLUG, type FeatureRow } from \"./types\";\n\ntype AccessArgs = {\n  req: {\n    user?: MaybeUser;\n    payload?: Pick<NonNullable<PayloadRequest[\"payload\"]>, \"findGlobal\">;\n  };\n};\n\ntype FeaturePredicate = {\n  (user: MaybeUser, features?: readonly FeatureRow[] | null, roles?: readonly RoleRow[]): boolean;\n  (args: AccessArgs): boolean | Promise<boolean>;\n};\n\nfunction isAccessArgs(value: unknown): value is AccessArgs {\n  return typeof value === \"object\" && value !== null && \"req\" in value;\n}\n\nfunction grantedOnReleased(\n  user: MaybeUser,\n  slug: string,\n  row: FeatureRow,\n  matrix: readonly RoleRow[],\n): boolean {\n  if (!row.released) return false;\n  return hasGrant(user, slug, matrix);\n}\n\n/**\n * True when the feature is released and a held role is granted it.\n * Developer is always allowed. An empty Global falls back to catalogue\n * defaults. A group slug (`pages`, `theme`) is true when any child is.\n */\nexport function hasFeature(\n  user: MaybeUser,\n  slug: string,\n  features: readonly FeatureRow[] | null = null,\n  matrix: readonly RoleRow[] = DEFAULT_ROLE_MATRIX,\n): boolean {\n  if (isDeveloper(user)) return true;\n  if (!user) return false;\n  const rows = features && features.length > 0 ? features : defaultFeaturesFieldValue();\n  const leaf = rows.find((entry) => entry.slug === slug);\n  if (leaf) return grantedOnReleased(user, slug, leaf, matrix);\n  if (!isGroupOnlySlug(slug)) return false;\n  return rows.some((entry) => entry.group === slug && grantedOnReleased(user, entry.slug, entry, matrix));\n}\n\n/**\n * Reads the saved Features Global. `null` means empty or unreadable — callers\n * fall back to catalogue defaults. Always override-access.\n */\nexport async function getFeaturesMatrix(req: AccessArgs[\"req\"] = {}): Promise<FeatureRow[] | null> {\n  const findGlobal = req.payload?.findGlobal;\n  if (typeof findGlobal !== \"function\") return null;\n  try {\n    const doc = await findGlobal({\n      slug: FEATURES_SLUG,\n      overrideAccess: true,\n      req: req as PayloadRequest,\n    });\n    const parsed = parseFeaturesMatrix(\n      doc && typeof doc === \"object\" && \"features\" in doc ? doc.features : undefined,\n    );\n    return parsed.ok ? parsed.rows : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Access / nav helper for one catalogue slug. Sync against a passed grid;\n * async when given `req` so it can read both Globals.\n */\nexport function canUseFeature(slug: string): FeaturePredicate {\n  function predicate(\n    userOrArgs: MaybeUser | AccessArgs,\n    features?: readonly FeatureRow[] | null,\n    roles?: readonly RoleRow[],\n  ): boolean | Promise<boolean> {\n    if (isAccessArgs(userOrArgs)) {\n      const user = userOrArgs.req.user as MaybeUser;\n      if (features !== undefined) return hasFeature(user, slug, features, roles ?? DEFAULT_ROLE_MATRIX);\n      return Promise.all([getFeaturesMatrix(userOrArgs.req), getRolesMatrix(userOrArgs.req)]).then(\n        ([grid, matrix]) => hasFeature(user, slug, grid, matrix),\n      );\n    }\n    return hasFeature(userOrArgs, slug, features ?? null, roles ?? DEFAULT_ROLE_MATRIX);\n  }\n  return predicate as FeaturePredicate;\n}\n\n/** `admin.hidden`: hide when the login cannot use the feature. */\nexport function hideUnlessFeature(slug: string) {\n  return (args: { user?: MaybeUser; req?: AccessArgs[\"req\"] }) => {\n    const user = args.user;\n    if (args.req) {\n      const result = canUseFeature(slug)({ req: { ...args.req, user } });\n      if (result instanceof Promise) return result.then((ok) => !ok);\n      return !result;\n    }\n    return !canUseFeature(slug)(user ?? null);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAAA,MAAa,gBAAgB;AAE7B,MAAa,iBAAiB;CAAC;CAAS;CAAS;CAAS;CAAQ;AAIlE,MAAa,uBAAuD;CAClE,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;CACR;AAED,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;;;;AAeD,MAAa,mBAA8C;CACzD;EAAE,MAAM;EAAW,OAAO;EAAW,OAAO;EAAS,iBAAiB;EAAM;CAC5E;EAAE,MAAM;EAAW,OAAO;EAAW,OAAO;EAAS,iBAAiB;EAAM;CAC5E;EAAE,MAAM;EAAW,OAAO;EAAW,OAAO;EAAS,iBAAiB;EAAO;CAC7E;EAAE,MAAM;EAAS,OAAO;EAAS,OAAO;EAAS,iBAAiB;EAAM;CACxE;EAAE,MAAM;EAAgB,OAAO;EAAU,OAAO;EAAS,iBAAiB;EAAM;CAChF;EAAE,MAAM;EAAoB,OAAO;EAAc,OAAO;EAAS,iBAAiB;EAAM;CACxF;EAAE,MAAM;EAAoB,OAAO;EAAc,OAAO;EAAS,iBAAiB;EAAM;CACxF;EAAE,MAAM;EAAkB,OAAO;EAAY,OAAO;EAAS,iBAAiB;EAAM;CACpF;EAAE,MAAM;EAAgB,OAAO;EAAgB,OAAO;EAAS,iBAAiB;EAAM;CACtF;EAAE,MAAM;EAAS,OAAO;EAAS,OAAO;EAAS,iBAAiB;EAAM;CACxE;EAAE,MAAM;EAAS,OAAO;EAAS,OAAO;EAAS,iBAAiB;EAAM;CACzE;AAsBD,SAAgB,iBAAiB,OAAyC;AACxE,QAAO,OAAO,UAAU,YAAa,eAAqC,SAAS,MAAM;;AAG3F,SAAgB,qBAAqB,OAA6C;AAChF,QAAO,OAAO,UAAU,YAAa,sBAA4C,SAAS,MAAM;;AAGlG,SAAgB,cAAc,OAAiC;AAC7D,QAAO,OAAO,UAAU,YAAY,gCAAgC,KAAK,MAAM;;;AAIjF,SAAgB,gBAAgB,OAAe,SAAmC;AAChF,QAAO;;;;AC7ET,MAAa,mCACX;AASF,SAAgB,iBAAiB,SAAkC,EAAE,EAA2B;AAC9F,QAAO,CACL,GAAG,iBAAiB,KAAK,aAAa,EAAE,GAAG,SAAS,EAAE,EACtD,GAAG,OAAO,KAAK,WAAW;EACxB,MAAM,MAAM;EACZ,OAAO,MAAM;EACb,OAAO,MAAM,SAAS;EACtB,iBAAiB,MAAM,mBAAmB;EAC3C,EAAE,CACJ;;AAGH,SAAgB,0BAA0B,SAAkC,EAAE,EAAgB;AAC5F,QAAO,iBAAiB,OAAO,CAAC,KAAK,aAAa;EAChD,IAAI,QAAQ;EACZ,MAAM,QAAQ;EACd,OAAO,QAAQ;EACf,OAAO,QAAQ;EACf,UAAU,QAAQ;EACnB,EAAE;;AAGL,SAAgB,sBACd,OACA,SAAkC,EAAE,EACtB;CACd,MAAM,SAAS,IAAI,IAAI,iBAAiB,OAAO,CAAC,KAAK,YAAY,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC;AAC1F,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO,0BAA0B,OAAO;AACnE,QAAO,MAAM,SAAS,SAAS;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE;EAChD,MAAM,OAAO,UAAU,QAAQ,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;EAC3E,MAAM,UAAU,OAAO,IAAI,KAAK;AAChC,MAAI,CAAC,QAAS,QAAO,EAAE;AACvB,SAAO,CACL;GACE,IAAI,QAAQ;GACZ,MAAM,QAAQ;GACd,OAAO,QAAQ;GACf,OAAO,QAAQ;GACf,UAAU,QAAQ,cAAc,QAAQ,KAAK,SAAS;GACvD,CACF;GACD;;AAGJ,SAAgB,oBACd,OACmE;AACnE,KAAI,CAAC,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,EAC5C,QAAO;EAAE,IAAI;EAAO,SAAS;EAAkC;CAGjE,MAAM,OAAqB,EAAE;CAC7B,MAAM,uBAAO,IAAI,KAAa;AAE9B,MAAK,MAAM,QAAQ,OAAO;AACxB,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;EACvC,MAAM,OAAO,UAAU,OAAO,KAAK,OAAO,KAAA;AAC1C,MAAI,CAAC,cAAc,KAAK,IAAI,KAAK,IAAI,KAAK,CAAE;AAC5C,OAAK,IAAI,KAAK;EACd,MAAM,OAAO,iBAAiB,MAAM,YAAY,QAAQ,SAAS,KAAK;EACtE,MAAM,QACJ,WAAW,QAAQ,OAAO,KAAK,UAAU,WACrC,KAAK,QACJ,MAAM,SAAS;EACtB,MAAM,QACJ,WAAW,QAAQ,iBAAiB,KAAK,MAAM,GAAG,KAAK,QAAS,MAAM,SAAS;AACjF,OAAK,KAAK;GACR,IAAI;GACJ;GACA;GACA;GACA,UAAU,QAAQ,cAAc,QAAQ,KAAK,SAAS;GACvD,CAAC;;AAGJ,KAAI,iBAAiB,MAAM,YAAY,CAAC,KAAK,IAAI,QAAQ,KAAK,CAAC,CAC7D,QAAO;EAAE,IAAI;EAAO,SAAS;EAAkC;AAEjE,QAAO;EAAE,IAAI;EAAM;EAAM;;AAG3B,SAAgB,uBACd,OACA,SAAkC,EAAE,EACrB;CACf,MAAM,SAAS,oBAAoB,MAAM;AACzC,KAAI,CAAC,OAAO,GAAI,QAAO,OAAO;CAC9B,MAAM,UAAU,IAAI,IAAI,iBAAiB,OAAO,CAAC,KAAK,YAAY,QAAQ,KAAK,CAAC;AAChF,KAAI,OAAO,KAAK,MAAM,QAAQ,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAE,QAAO;AAC9D,QAAO;;AAGT,SAAgB,kBAAkB,OAAuB;AACvD,QAAO,iBAAiB,MAAM,GAAG,qBAAqB,SAAS;;AAGjE,SAAgB,oBAAoB,MAAc,SAAkC,EAAE,EAAU;CAC9F,MAAM,OAAO,iBAAiB,MAAM,YAAY,QAAQ,SAAS,KAAK;AACtE,KAAI,KAAM,QAAO,KAAK;AAEtB,QADc,OAAO,MAAM,YAAY,QAAQ,SAAS,KAAK,EAC/C,SAAS;;AAGzB,SAAgB,gBAAgB,MAAuB;AACrD,QAAO,iBAAiB,KAAK,IAAI,CAAC,iBAAiB,MAAM,YAAY,QAAQ,SAAS,KAAK;;;;;;;;;ACxH7F,MAAa,QAAQ;CAAC;CAAa;CAAS;CAAY;CAAS;AAIjE,MAAa,cAAoC;CAC/C,WAAW;CACX,OAAO;CACP,UAAU;CACV,QAAQ;CACT;;AAGD,MAAa,eAAe;CAAC;CAAW;CAAS;CAAW;CAAQ;AAIpE,MAAa,sBAAsB;CACjC;CACA;CACA;CACA;CACA;CACD;AAED,MAAa,sBAA6D;CACxE,SAAS,CAAC,UAAU;CACpB,SAAS,CAAC,UAAU;CACpB,OAAO,CAAC,QAAQ;CAChB,OAAO;CACR;AAED,MAAa,sBAAuD;CAClE,WAAW,EAAE;CACb,OAAO;EAAC;EAAW;EAAW;EAAS;EAAS;EAAQ;CACxD,UAAU;EACR;EACA;EACA,GAAG;EACH;EACA;EACD;CACD,QAAQ,CAAC,WAAW,QAAQ;CAC7B;AA8BD,SAAgB,OAAO,OAA+B;AACpD,QAAO,OAAO,UAAU,YAAa,MAA4B,SAAS,MAAM;;;AAIlF,SAAgB,WAAW,OAAiC;AAC1D,QAAO,OAAO,UAAU,YAAY,qBAAqB,KAAK,MAAM;;;AAItE,SAAgB,WAAW,OAAiC;AAC1D,QAAO,OAAO,UAAU,YAAY,6BAA6B,KAAK,MAAM,MAAM,CAAC;;;AAIrF,SAAgB,sBAAsB,OAAuB;AAC3D,QAAO,MAAM,QAAQ,eAAe,GAAG,CAAC,QAAQ,UAAU,IAAI;;;AAIhE,SAAgB,gBAAgB,OAAwB;AACtD,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAO,MACJ,MAAM,CACN,aAAa,CACb,QAAQ,YAAY,IAAI,CACxB,QAAQ,UAAU,GAAG;;AAG1B,SAAgB,UAAU,MAAc,OAA+B;CACrE,MAAM,UAAU,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG;AAC3D,KAAI,QAAS,QAAO;AACpB,QAAO,OAAO,KAAK,GAAG,YAAY,QAAQ;;AAG5C,SAAgB,qBAAqB,MAAc,aAA2C;AAC5F,KAAI,OAAO,KAAK,CAAE,QAAO,CAAC,GAAG,oBAAoB,MAAM;AACvD,QAAO,cAAc,CAAC,GAAG,YAAY,GAAG,EAAE;;;;ACjG5C,MAAa,aAAa;AAE1B,MAAa,2BAA2B;AAExC,MAAa,0BACX;;;;;AAMF,MAAa,sBAA0C,MAAM,KAAK,UAAU;CAC1E;CACA,QAAQ,qBAAqB,KAAK;CACnC,EAAE;AAEH,MAAa,wBACX;AAEF,MAAa,0BACX;AAEF,MAAa,6BAA6B;AAE1C,MAAa,8BAA8B;AAE3C,MAAa,8BAA8B;AAE3C,MAAa,4BAA4B;AAEzC,SAAS,YAAY,QAAsC;CACzD,MAAM,QAAkB,EAAE;AAC1B,MAAK,MAAM,SAAS,OAClB,KAAI,OAAO,UAAU,YAAY,cAAc,MAAM,IAAI,CAAC,MAAM,SAAS,MAAM,CAAE,OAAM,KAAK,MAAM;AAEpG,QAAO;;;AAIT,SAAgB,qBAAqB,MAAwB;AAC3D,KAAI,YAAY,QAAQ,MAAM,QAAQ,KAAK,OAAO,CAAE,QAAO,YAAY,KAAK,OAAO;CACnF,MAAM,SAAmB,EAAE;AAC3B,KAAI,aAAa,QAAQ,KAAK,QAC5B,QAAO,KAAK,WAAW,QAAQ;AAEjC,KAAI,aAAa,QAAQ,KAAK,QAAS,QAAO,KAAK,UAAU;AAC7D,KAAI,WAAW,QAAQ,KAAK,MAAO,QAAO,KAAK,SAAS,QAAQ;AAChE,KAAI,WAAW,QAAQ,KAAK,MAAO,QAAO,KAAK,GAAG,oBAAoB;AACtE,QAAO,YAAY,OAAO;;AAG5B,SAAgB,aAAa,SAA+B,EAAE,EAAa;AACzE,QAAO,CACL,GAAG,oBAAoB,KAAK,SAAS;EACnC,GAAG;EACH,QAAQ,CAAC,GAAG,IAAI,OAAO;EACvB,OAAO,OAAO,IAAI,KAAK,GAAG,YAAY,IAAI,QAAQ,IAAI;EACvD,EAAE,EACH,GAAG,OAAO,KAAK,WAAW;EACxB,MAAM,MAAM;EACZ,OAAO,MAAM;EACb,QAAQ,MAAM,SAAS,CAAC,GAAG,MAAM,OAAO,GAAG,EAAE;EAC9C,EAAE,CACJ;;AAGH,SAAgB,uBAAuB,SAA+B,EAAE,EAAa;AACnF,QAAO,aAAa,OAAO,CAAC,KAAK,SAAS;EAAE,IAAI,IAAI;EAAM,GAAG;EAAK,EAAE;;AAGtE,SAAS,YAAY,MAA2C;CAC9D,MAAM,OAAO,UAAU,OAAO,KAAK,OAAO,KAAA;AAC1C,KAAI,OAAO,SAAS,YAAY,KAAK,MAAM,KAAK,GAAI,QAAO,EAAE,OAAO,6BAA6B;AACjG,KAAI,CAAC,WAAW,KAAK,CAAE,QAAO,EAAE,OAAO,6BAA6B;AAEpE,QAAO;EACL,IAAI;EACJ;EACA,OAAO,UAAU,MAJL,WAAW,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAA,EAIhD;EAC7B,QAAQ,qBAAqB,KAAK;EACnC;;AAGH,SAAgB,iBACd,OACgE;AAChE,KAAI,CAAC,MAAM,QAAQ,MAAM,CACvB,QAAO;EAAE,IAAI;EAAO,SAAS;EAA4B;CAG3D,MAAM,OAAkB,EAAE;CAC1B,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,QAAQ,OAAO;AACxB,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;EAGvC,MAAM,OAAO,UAAU,OAAO,KAAK,OAAO,KAAA;AAC1C,MAAI,OAAO,SAAS,YAAY,KAAK,MAAM,KAAK,GAAI;EACpD,MAAM,SAAS,YAAY,KAAK;AAChC,MAAI,WAAW,OAAQ,QAAO;GAAE,IAAI;GAAO,SAAS,OAAO;GAAO;AAClE,MAAI,KAAK,IAAI,OAAO,KAAK,CAAE,QAAO;GAAE,IAAI;GAAO,SAAS;GAA6B;AACrF,OAAK,IAAI,OAAO,KAAK;AACrB,OAAK,KAAK,OAAO;;AAGnB,KAAI,MAAM,MAAM,SAAS,CAAC,KAAK,IAAI,KAAK,CAAC,CACvC,QAAO;EAAE,IAAI;EAAO,SAAS;EAA4B;AAE3D,QAAO;EAAE,IAAI;EAAM;EAAM;;AAG3B,SAAgB,aAAa,KAAc,MAAuB;AAChE,KAAI,IAAI,SAAS,YAAa,QAAO;AACrC,QAAO,IAAI,OAAO,SAAS,KAAK;;AAGlC,SAAgB,kBAAkB,KAAc,YAAiC;AAC/E,KAAI,IAAI,SAAS,YAAa,QAAO;AACrC,QAAO,oBAAoB,YAAY,MAAM,SAAS,IAAI,OAAO,SAAS,KAAK,CAAC;;;;;;AAOlF,SAAgB,wBAAwB,OAAyB;AAC/D,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO;AAClC,QAAO,MAAM,KAAK,SAAS;AACzB,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;EAC9C,MAAM,MAAM;AACZ,MAAI,WAAW,IAAI,KAAK,CAAE,QAAO;EACjC,MAAM,OAAO,gBAAgB,IAAI,MAAM;AACvC,SAAO,WAAW,KAAK,GAAG;GAAE,GAAG;GAAK,MAAM;GAAM,GAAG;GACnD;;AAGJ,SAAS,sBAAsB,OAAyB;AACtD,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO;CAClC,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,QAAQ,OAAO;AACxB,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;EACvC,MAAM,OAAO,UAAU,QAAQ,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;EAE3E,MAAM,QADM,WAAW,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,IAC5D,MAAM,KAAK,OAAO,KAAK,GAAG,YAAY,QAAQ;AAC/D,MAAI,CAAC,KAAM;EACX,MAAM,MAAM,KAAK,aAAa;AAC9B,MAAI,KAAK,IAAI,IAAI,CAAE,QAAO;AAC1B,OAAK,IAAI,IAAI;;AAEf,QAAO;;AAGT,SAAS,mBAAmB,OAAyB;AACnD,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO;AAClC,MAAK,MAAM,QAAQ,OAAO;AACxB,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;EACvC,MAAM,QAAQ,WAAW,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,MAAM,GAAG;AACtF,MAAI,CAAC,MAAO;AACZ,MAAI,CAAC,WAAW,MAAM,CAAE,QAAO;;AAEjC,QAAO;;AAGT,SAAgB,oBAAoB,OAA+B;AACjE,KAAI,sBAAsB,MAAM,CAAE,QAAO;AACzC,KAAI,mBAAmB,MAAM,CAAE,QAAO;CACtC,MAAM,SAAS,iBAAiB,wBAAwB,MAAM,CAAC;AAC/D,KAAI,CAAC,OAAO,GAAI,QAAO,OAAO;AAC9B,QAAO;;;;;;;AAQT,SAAgB,qBACd,OACA,SAA6B,qBACnB;AACV,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO,EAAE;CACpC,MAAM,UAAU,IAAI,IAAI,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC;CACtD,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,UAA2B,OAAO,UAAU,YAAY,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC;AACrH,KAAI,MAAM,SAAS,YAAY,CAAE,QAAO,CAAC,YAAY;AACrD,QAAO;;AAGT,SAAgB,kBAAkB,SAA6B,qBAAqB;AAClF,QAAO,OAAO,KAAK,SAAS;EAAE,OAAO,UAAU,IAAI,MAAM,IAAI,MAAM;EAAE,OAAO,IAAI;EAAM,EAAE;;;AAI1F,SAAgB,gBAAgB,MAAc,SAA6B,qBAA6B;AACtG,KAAI,SAAS,YAAa,QAAO;CACjC,MAAM,MAAM,OAAO,MAAM,UAAU,MAAM,SAAS,KAAK;AACvD,KAAI,CAAC,IAAK,QAAO;AAEjB,QADc,IAAI,OAAO,KAAK,SAAS,oBAAoB,KAAK,CAAC,CACpD,KAAK,KAAK,IAAI;;;;;AAM7B,SAAgB,iBAAiB,SAA6B;CAC5D,MAAM,SAAoB,EAAE;AAC5B,KAAI,MAAM,QAAQ,QAAQ,CACxB,MAAK,MAAM,QAAQ,SAAS;AAC1B,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;EACvC,MAAM,SAAS,YAAY,KAAK;AAChC,MAAI,WAAW,UAAU,OAAO,OAAO,KAAK,CAAE;AAC9C,SAAO,KAAK,OAAO;;AAGvB,QAAO,CAAC,GAAG,wBAAwB,EAAE,GAAG,OAAO;;;;ACpNjD,SAASA,eAAa,OAAqC;AACzD,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS;;AAGjE,SAAgB,YAAY,MAAoC;AAC9D,QAAO,MAAM,QAAQ,MAAM,MAAM,GAAG,KAAK,QAAQ,EAAE;;AAGrD,SAAgB,QAAQ,MAAiB,MAAuB;AAC9D,QAAO,YAAY,KAAK,CAAC,SAAS,KAAK;;;AAIzC,SAAgB,YAAY,MAA0B;AACpD,QAAO,QAAQ,MAAM,YAAY;;AAGnC,SAAgB,cACd,MACA,YACA,SAA6B,qBACpB;AACT,KAAI,YAAY,KAAK,CAAE,QAAO;AAC9B,QAAO,YAAY,KAAK,CAAC,MAAM,SAAS;EACtC,MAAM,MAAM,OAAO,MAAM,UAAU,MAAM,SAAS,KAAK;AACvD,SAAO,MAAM,kBAAkB,KAAK,WAAW,GAAG;GAClD;;AAGJ,SAAgB,SACd,MACA,MACA,SAA6B,qBACpB;AACT,KAAI,YAAY,KAAK,CAAE,QAAO;AAC9B,QAAO,YAAY,KAAK,CAAC,MAAM,SAAS;EACtC,MAAM,MAAM,OAAO,MAAM,UAAU,MAAM,SAAS,KAAK;AACvD,SAAO,MAAM,aAAa,KAAK,KAAK,GAAG;GACvC;;;;;;;AAQJ,eAAsB,eACpB,MAAyB,EAAE,EAC3B,SAA+B,EAAE,EACb;CACpB,MAAM,WAAW,aAAa,OAAO;CACrC,MAAM,aAAa,IAAI,SAAS;AAChC,KAAI,OAAO,eAAe,WAAY,QAAO;AAC7C,KAAI;EACF,MAAM,MAAM,MAAM,WAAW;GAC3B,MAAM;GACN,gBAAgB;GACX;GACN,CAAC;EACF,MAAM,SAAS,iBAAiB,OAAO,OAAO,QAAQ,YAAY,WAAW,MAAM,IAAI,QAAQ,KAAA,EAAU;AACzG,SAAO,OAAO,KAAK,OAAO,OAAO;SAC3B;AACN,SAAO;;;AAIX,SAAS,oBAAoB,YAA6C;CACxE,SAAS,UACP,YACA,QAC4B;AAC5B,MAAIA,eAAa,WAAW,EAAE;GAC5B,MAAM,OAAO,WAAW,IAAI;AAC5B,OAAI,OAAQ,QAAO,cAAc,MAAM,YAAY,OAAO;AAC1D,UAAO,eAAe,WAAW,IAAI,CAAC,MAAM,SAAS,cAAc,MAAM,YAAY,KAAK,CAAC;;AAE7F,SAAO,cAAc,YAAY,YAAY,UAAU,oBAAoB;;AAE7E,QAAO;;AAGT,MAAa,mBAAmB,oBAAoB,UAAU;AAC9D,MAAa,iBAAiB,oBAAoB,QAAQ;AAC1D,MAAa,aAAa,oBAAoB,UAAU;;AAGxD,MAAa,UAAU,oBAAoB,QAAQ;;AAGnD,SAAgB,iBACd,MACA,SAA6B,qBACpB;AACT,KAAI,OAAO,SAAS,SAAU,QAAO;AACrC,KAAI,SAAS,YAAa,QAAO;CACjC,MAAM,MAAM,OAAO,MAAM,UAAU,MAAM,SAAS,KAAK;AACvD,QAAO,MAAM,aAAa,KAAK,QAAQ,GAAG;;AAK5C,SAAgB,gBAAgB,YAA6C;AAC3E,KAAIA,eAAa,WAAW,CAAE,QAAO,QAAQ,WAAW,IAAI,KAAK;AACjE,QAAO,QAAQ,WAAW;;AAG5B,MAAa,gBAAwB,OAAO,EAAE,UAAU;AACtD,KAAI,CAAC,IAAI,KAAM,QAAO;AACtB,KAAI,MAAM,QAAQ,EAAE,KAAK,CAAC,CAAE,QAAO;AACnC,QAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,KAAK,IAAI,EAAE;;AAGxC,MAAa,4BAAoC,EAAE,KAAK,EAAE,aAAa;AACrE,KAAI,gBAAgB,KAAkB,CAAE,QAAO;AAC/C,QAAO,EAAE,SAAS,EAAE,QAAQ,aAAa,EAAE;;;;;;AAO7C,SAAgB,eAAe,EAAE,OAA+C;AAC9E,KAAI,YAAY,IAAI,KAAkB,CAAE,QAAO;AAC/C,KAAI,CAAC,IAAI,QAAS,QAAO;AAEzB,QAAA,QAAA,SAAA,CAAA,WAAA,eAAA,CAAoC,MAAM,EAAE,oBAAoB,cAAc,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;;;;;;;;;;AC5HpG,SAAS,aAAa,OAAqC;AACzD,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS;;AAGjE,SAAS,kBACP,MACA,MACA,KACA,QACS;AACT,KAAI,CAAC,IAAI,SAAU,QAAO;AAC1B,QAAO,SAAS,MAAM,MAAM,OAAO;;;;;;;AAQrC,SAAgB,WACd,MACA,MACA,WAAyC,MACzC,SAA6B,qBACpB;AACT,KAAI,YAAY,KAAK,CAAE,QAAO;AAC9B,KAAI,CAAC,KAAM,QAAO;CAClB,MAAM,OAAO,YAAY,SAAS,SAAS,IAAI,WAAW,2BAA2B;CACrF,MAAM,OAAO,KAAK,MAAM,UAAU,MAAM,SAAS,KAAK;AACtD,KAAI,KAAM,QAAO,kBAAkB,MAAM,MAAM,MAAM,OAAO;AAC5D,KAAI,CAAC,gBAAgB,KAAK,CAAE,QAAO;AACnC,QAAO,KAAK,MAAM,UAAU,MAAM,UAAU,QAAQ,kBAAkB,MAAM,MAAM,MAAM,OAAO,OAAO,CAAC;;;;;;AAOzG,eAAsB,kBAAkB,MAAyB,EAAE,EAAgC;CACjG,MAAM,aAAa,IAAI,SAAS;AAChC,KAAI,OAAO,eAAe,WAAY,QAAO;AAC7C,KAAI;EACF,MAAM,MAAM,MAAM,WAAW;GAC3B,MAAM;GACN,gBAAgB;GACX;GACN,CAAC;EACF,MAAM,SAAS,oBACb,OAAO,OAAO,QAAQ,YAAY,cAAc,MAAM,IAAI,WAAW,KAAA,EACtE;AACD,SAAO,OAAO,KAAK,OAAO,OAAO;SAC3B;AACN,SAAO;;;;;;;AAQX,SAAgB,cAAc,MAAgC;CAC5D,SAAS,UACP,YACA,UACA,OAC4B;AAC5B,MAAI,aAAa,WAAW,EAAE;GAC5B,MAAM,OAAO,WAAW,IAAI;AAC5B,OAAI,aAAa,KAAA,EAAW,QAAO,WAAW,MAAM,MAAM,UAAU,SAAS,oBAAoB;AACjG,UAAO,QAAQ,IAAI,CAAC,kBAAkB,WAAW,IAAI,EAAE,eAAe,WAAW,IAAI,CAAC,CAAC,CAAC,MACrF,CAAC,MAAM,YAAY,WAAW,MAAM,MAAM,MAAM,OAAO,CACzD;;AAEH,SAAO,WAAW,YAAY,MAAM,YAAY,MAAM,SAAS,oBAAoB;;AAErF,QAAO;;;AAIT,SAAgB,kBAAkB,MAAc;AAC9C,SAAQ,SAAwD;EAC9D,MAAM,OAAO,KAAK;AAClB,MAAI,KAAK,KAAK;GACZ,MAAM,SAAS,cAAc,KAAK,CAAC,EAAE,KAAK;IAAE,GAAG,KAAK;IAAK;IAAM,EAAE,CAAC;AAClE,OAAI,kBAAkB,QAAS,QAAO,OAAO,MAAM,OAAO,CAAC,GAAG;AAC9D,UAAO,CAAC;;AAEV,SAAO,CAAC,cAAc,KAAK,CAAC,QAAQ,KAAK"}

package/dist/admin.d.mts

@@ -1,7 +1,7 @@
 
 import { ThemeConfig } from "@bison-lab/tokens";
 import * as react_jsx_runtime0 from "react/jsx-runtime";
-import { ArrayFieldClientComponent, GroupFieldClientComponent, SelectFieldClientComponent, TextFieldClientComponent, UIFieldClientComponent } from "payload";
+import { ArrayFieldClientComponent, GroupFieldClientComponent, JSONFieldClientComponent, SelectFieldClientComponent, TextFieldClientComponent, UIFieldClientComponent } from "payload";
 
 //#region src/admin/color-field.d.ts
 /**
@@ -19,10 +19,10 @@ declare const ColorScaleField: GroupFieldClientComponent;
 //#endregion
 //#region src/admin/library-field.d.ts
 /**
- * Custom colors: the same scale controls as system colors. A row that is
- * not referenced on a page deletes immediately. Rewriting in-use tokens
- * (`rewriteColorToken`) waits on a site usage lookup — Theme cannot see
- * page assignments by itself.
+ * Custom colors: the same scale controls as system colors. Unused: the
+ * Theme store's color-usages endpoint returns nothing and the row is
+ * gone. In use: pick a live replacement; confirm rewrites stored tokens
+ * then drops the row. Success and Destructive stay off that list.
  */
 declare const LibraryField: ArrayFieldClientComponent;
 //#endregion
@@ -103,18 +103,57 @@ declare const LookField: TextFieldClientComponent;
 //#endregion
 //#region src/admin/roles-matrix-field.d.ts
 /**
- * Payload's array field: drag rank stays, add/remove go away. Reset writes
- * the package seed back onto the field.
+ * Payload's array field: drag rank stays, add is for custom rows, seed
+ * rows have no remove. Developer stays in the saved array and is shown
+ * only to a Developer. Reset restores seed ticks and package labels.
  */
 declare const RolesMatrixField: ArrayFieldClientComponent;
 //#endregion
+//#region src/admin/roles-row-label.d.ts
+/**
+ * Array row header. Shows the current display name, not “Role 01”.
+ */
+declare function RolesRowLabel(): react_jsx_runtime0.JSX.Element;
+//#endregion
+//#region src/admin/role-slug-field.d.ts
+/**
+ * Seed slugs stay read-only. A custom row's slug is typed here.
+ */
+declare const RoleSlugField: TextFieldClientComponent;
+//#endregion
+//#region src/admin/role-name-field.d.ts
+/**
+ * Role name. Letters and spaces only, so the hidden slug stays
+ * `the-greatest-designer` from `The Greatest Designer`.
+ */
+declare const RoleNameField: TextFieldClientComponent;
+//#endregion
 //#region src/admin/roles-field.d.ts
 /**
  * Users Roles checklist. Order and labels come from the field options (the
- * Roles Global, or the seed). Copy is `roleDescription`. Developer is
- * exclusive; Admin does not swallow Designer.
+ * Roles Global, or the seed plus extras). Copy is `roleDescription`.
+ * Developer is exclusive; a custom role does not clear Designer.
  */
 declare const RolesField: SelectFieldClientComponent;
 //#endregion
-export { AppearanceField, ColorField, ColorScaleField, ContrastReport, FontField, GreyScaleField, HiddenSaveButton, IdentityFallback, LibraryField, LookField, PairingField, PublishChild, RolesField, RolesMatrixField, SectionHeading, ThemeDocumentControls, ThemeSaveButton };
+//#region src/admin/roles-grants-field.d.ts
+/**
+ * Released catalogue rows as ticks. Unreleased features do not appear,
+ * except on Developer: every catalogue row is shown granted and locked
+ * so a new Feature is visibly included.
+ */
+declare const RolesGrantsField: JSONFieldClientComponent;
+//#endregion
+//#region src/admin/features-matrix-field.d.ts
+/**
+ * One release switch per catalogue row, grouped. Off hides the tick on
+ * Roles; Developer still has the feature.
+ *
+ * Writes both the array value and each row's `released` checkbox path.
+ * Payload still registers those child fields; toggling only the parent
+ * array leaves them false and Save stores the old flags.
+ */
+declare const FeaturesMatrixField: ArrayFieldClientComponent;
+//#endregion
+export { AppearanceField, ColorField, ColorScaleField, ContrastReport, FeaturesMatrixField, FontField, GreyScaleField, HiddenSaveButton, IdentityFallback, LibraryField, LookField, PairingField, PublishChild, RoleNameField, RoleSlugField, RolesField, RolesGrantsField, RolesMatrixField, RolesRowLabel, SectionHeading, ThemeDocumentControls, ThemeSaveButton };
 //# sourceMappingURL=admin.d.mts.map

package/dist/admin.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/admin/color-field.tsx","../src/admin/color-scale-field.tsx","../src/admin/library-field.tsx","../src/admin/font-field.tsx","../src/admin/pairing-field.tsx","../src/admin/appearance-field.tsx","../src/admin/grey-scale-field.tsx","../src/admin/contrast-report.tsx","../src/admin/section-heading.tsx","../src/admin/publish-child.tsx","../src/admin/save-button.tsx","../src/admin/identity-fallback.tsx","../src/admin/look-field.tsx","../src/admin/roles-matrix-field.tsx","../src/admin/roles-field.tsx"],"mappings":";;;;;;;;;;cAWa,UAAA,EAAY,wBAAA;;;;;;;cCsBZ,eAAA,EAAiB,yBAAA;;;;;;;;ADtB9B;cEca,YAAA,EAAc,yBAAA;;;;;;;;AFd3B;cGOa,SAAA,EAAW,0BAAA;;;;;;;cCNX,YAAA,EAAc,sBAAA;;;;;;;cCCd,eAAA,EAAiB,yBAAA;;;;;;;cCuDjB,cAAA,EAAgB,0BAAA;;;;;;;cChDhB,cAAA,EAAgB,sBAAA;;;;;;cCbhB,cAAA,EAAgB,sBAAA;;;cCgJhB,YAAA,EAAc,sBAAA;;;;;;;;iBC3IX,qBAAA,CAAA,GAAqB,kBAAA,CAAA,GAAA,CAAA,OAAA;AVDrC;;;;AAAA,iBUgBgB,eAAA,CAAA,GAAe,kBAAA,CAAA,GAAA,CAAA,OAAA;;iBA0Bf,gBAAA,CAAA,GAAgB,kBAAA,CAAA,GAAA,CAAA,OAAA;;;;;;;cC7CnB,gBAAA,EAAkB,sBAAA;;;;;;;cCIlB,SAAA,EAAW,wBAAA;;;;;;;cCDX,gBAAA,EAAkB,yBAAA;;;;;;;;cCkBlB,UAAA,EAAY,0BAAA"}
+{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/admin/color-field.tsx","../src/admin/color-scale-field.tsx","../src/admin/library-field.tsx","../src/admin/font-field.tsx","../src/admin/pairing-field.tsx","../src/admin/appearance-field.tsx","../src/admin/grey-scale-field.tsx","../src/admin/contrast-report.tsx","../src/admin/section-heading.tsx","../src/admin/publish-child.tsx","../src/admin/save-button.tsx","../src/admin/identity-fallback.tsx","../src/admin/look-field.tsx","../src/admin/roles-matrix-field.tsx","../src/admin/roles-row-label.tsx","../src/admin/role-slug-field.tsx","../src/admin/role-name-field.tsx","../src/admin/roles-field.tsx","../src/admin/roles-grants-field.tsx","../src/admin/features-matrix-field.tsx"],"mappings":";;;;;;;;;;cAWa,UAAA,EAAY,wBAAA;;;;;;;cCsBZ,eAAA,EAAiB,yBAAA;;;;;;;;ADtB9B;cEgBa,YAAA,EAAc,yBAAA;;;;;;;;AFhB3B;cGOa,SAAA,EAAW,0BAAA;;;;;;;cCNX,YAAA,EAAc,sBAAA;;;;;;;cCCd,eAAA,EAAiB,yBAAA;;;;;;;cCuDjB,cAAA,EAAgB,0BAAA;;;;;;;cChDhB,cAAA,EAAgB,sBAAA;;;;;;cCbhB,cAAA,EAAgB,sBAAA;;;cCgJhB,YAAA,EAAc,sBAAA;;;;;;;;iBC3IX,qBAAA,CAAA,GAAqB,kBAAA,CAAA,GAAA,CAAA,OAAA;AVDrC;;;;AAAA,iBUgBgB,eAAA,CAAA,GAAe,kBAAA,CAAA,GAAA,CAAA,OAAA;;iBA0Bf,gBAAA,CAAA,GAAgB,kBAAA,CAAA,GAAA,CAAA,OAAA;;;;;;;cC7CnB,gBAAA,EAAkB,sBAAA;;;;;;;cCIlB,SAAA,EAAW,wBAAA;;;;;;;;cCsBX,gBAAA,EAAkB,yBAAA;;;;;;iBC3Bf,aAAA,CAAA,GAAa,kBAAA,CAAA,GAAA,CAAA,OAAA;;;;;;cCChB,aAAA,EAAe,wBAAA;;;;;;;cCCf,aAAA,EAAe,wBAAA;;;;;;;;cC8Cf,UAAA,EAAY,0BAAA;;;;;;;;cChCZ,gBAAA,EAAkB,wBAAA;;;;;;;;AlBZ/B;;;cmB0Ca,mBAAA,EAAqB,yBAAA"}