@bison-lab/payload-core 3.13.0 → 3.14.0

package/dist/access-B3LglN2J.mjs

@@ -0,0 +1,662 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/features/types.ts
+const FEATURES_SLUG = "features";
+const FEATURE_GROUPS = [
+	"pages",
+	"media",
+	"theme",
+	"users"
+];
+const FEATURE_GROUP_LABELS = {
+	pages: "Pages",
+	media: "Media",
+	theme: "Theme",
+	users: "Users"
+};
+const PACKAGE_FEATURE_SLUGS = [
+	"content",
+	"publish",
+	"api-tab",
+	"media",
+	"theme-colors",
+	"theme-typography",
+	"theme-appearance",
+	"theme-identity",
+	"brand-assets",
+	"users",
+	"roles"
+];
+/**
+* Package catalogue. Features itself is not a row — that screen is
+* Developer-only in code. Empty Global falls back to these defaults.
+*/
+const PACKAGE_FEATURES = [
+	{
+		slug: "content",
+		label: "Content",
+		group: "pages",
+		defaultReleased: true
+	},
+	{
+		slug: "publish",
+		label: "Publish",
+		group: "pages",
+		defaultReleased: true
+	},
+	{
+		slug: "api-tab",
+		label: "API tab",
+		group: "pages",
+		defaultReleased: false
+	},
+	{
+		slug: "media",
+		label: "Media",
+		group: "media",
+		defaultReleased: true
+	},
+	{
+		slug: "theme-colors",
+		label: "Colors",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "theme-typography",
+		label: "Typography",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "theme-appearance",
+		label: "Appearance",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "theme-identity",
+		label: "Identity",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "brand-assets",
+		label: "Brand assets",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "users",
+		label: "Users",
+		group: "users",
+		defaultReleased: true
+	},
+	{
+		slug: "roles",
+		label: "Roles",
+		group: "users",
+		defaultReleased: true
+	}
+];
+function isFeatureGroupId(value) {
+	return typeof value === "string" && FEATURE_GROUPS.includes(value);
+}
+function isPackageFeatureSlug(value) {
+	return typeof value === "string" && PACKAGE_FEATURE_SLUGS.includes(value);
+}
+function isFeatureSlug(value) {
+	return typeof value === "string" && /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(value);
+}
+/** @deprecated Locks are gone; the release switch is the valve. */
+function isLockedFeature(_slug, _locked) {
+	return false;
+}
+//#endregion
+//#region src/features/matrix.ts
+const MISSING_PACKAGE_FEATURES_MESSAGE = "Features must include Content, Publish, API tab, Media, Theme screens, Brand assets, Users, and Roles.";
+function featureCatalogue(extras = []) {
+	return [...PACKAGE_FEATURES.map((feature) => ({ ...feature })), ...extras.map((extra) => ({
+		slug: extra.slug,
+		label: extra.label,
+		group: extra.group ?? "users",
+		defaultReleased: extra.defaultReleased ?? false
+	}))];
+}
+function defaultFeaturesFieldValue(extras = []) {
+	return featureCatalogue(extras).map((feature) => ({
+		id: feature.slug,
+		slug: feature.slug,
+		label: feature.label,
+		group: feature.group,
+		released: feature.defaultReleased
+	}));
+}
+function stampFeatureCatalogue(value, extras = []) {
+	const bySlug = new Map(featureCatalogue(extras).map((feature) => [feature.slug, feature]));
+	if (!Array.isArray(value)) return defaultFeaturesFieldValue(extras);
+	return value.flatMap((item) => {
+		if (!item || typeof item !== "object") return [];
+		const slug = "slug" in item && typeof item.slug === "string" ? item.slug : "";
+		const feature = bySlug.get(slug);
+		if (!feature) return [];
+		return [{
+			id: feature.slug,
+			slug: feature.slug,
+			label: feature.label,
+			group: feature.group,
+			released: Boolean("released" in item && item.released)
+		}];
+	});
+}
+function parseFeaturesMatrix(value) {
+	if (!Array.isArray(value) || value.length === 0) return {
+		ok: false,
+		message: MISSING_PACKAGE_FEATURES_MESSAGE
+	};
+	const rows = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const slug = "slug" in item ? item.slug : void 0;
+		if (!isFeatureSlug(slug) || seen.has(slug)) continue;
+		seen.add(slug);
+		const pack = PACKAGE_FEATURES.find((feature) => feature.slug === slug);
+		const label = "label" in item && typeof item.label === "string" ? item.label : pack?.label ?? slug;
+		const group = "group" in item && isFeatureGroupId(item.group) ? item.group : pack?.group ?? "users";
+		rows.push({
+			id: slug,
+			slug,
+			label,
+			group,
+			released: Boolean("released" in item && item.released)
+		});
+	}
+	if (PACKAGE_FEATURES.some((feature) => !seen.has(feature.slug))) return {
+		ok: false,
+		message: MISSING_PACKAGE_FEATURES_MESSAGE
+	};
+	return {
+		ok: true,
+		rows
+	};
+}
+function validateFeaturesMatrix(value, extras = []) {
+	const parsed = parseFeaturesMatrix(value);
+	if (!parsed.ok) return parsed.message;
+	const allowed = new Set(featureCatalogue(extras).map((feature) => feature.slug));
+	if (parsed.rows.some((row) => !allowed.has(row.slug))) return MISSING_PACKAGE_FEATURES_MESSAGE;
+	return true;
+}
+function featureGroupLabel(group) {
+	return isFeatureGroupId(group) ? FEATURE_GROUP_LABELS[group] : group;
+}
+function packageFeatureLabel(slug, extras = []) {
+	const pack = PACKAGE_FEATURES.find((feature) => feature.slug === slug);
+	if (pack) return pack.label;
+	return extras.find((feature) => feature.slug === slug)?.label ?? slug;
+}
+function isGroupOnlySlug(slug) {
+	return isFeatureGroupId(slug) && !PACKAGE_FEATURES.some((feature) => feature.slug === slug);
+}
+//#endregion
+//#region src/roles/types.ts
+/**
+* The Roles Global a site's generated types will describe. Optional and
+* nullable, no index signature: a generated Global is assignable to this,
+* never the reverse.
+*/
+const ROLES = [
+	"developer",
+	"admin",
+	"designer",
+	"author"
+];
+const ROLE_LABELS = {
+	developer: "Developer",
+	admin: "Admin",
+	designer: "Designer",
+	author: "Author"
+};
+/** Capability aliases over feature grants. Brand is any Theme-group leaf. */
+const CAPABILITIES = [
+	"content",
+	"brand",
+	"publish",
+	"users"
+];
+const THEME_FEATURE_SLUGS = [
+	"theme-colors",
+	"theme-typography",
+	"theme-appearance",
+	"theme-identity",
+	"brand-assets"
+];
+const CAPABILITY_FEATURES = {
+	content: ["content"],
+	publish: ["publish"],
+	users: ["users"],
+	brand: THEME_FEATURE_SLUGS
+};
+const DEFAULT_ROLE_GRANTS = {
+	developer: [],
+	admin: [
+		"content",
+		"publish",
+		"media",
+		"users",
+		"roles"
+	],
+	designer: [
+		"content",
+		"media",
+		...THEME_FEATURE_SLUGS,
+		"users",
+		"roles"
+	],
+	author: ["content", "media"]
+};
+function isRole(value) {
+	return typeof value === "string" && ROLES.includes(value);
+}
+/** Lowercase slug from a letters-and-spaces name: `designer`, `the-designer`. */
+function isRoleSlug(value) {
+	return typeof value === "string" && /^[a-z]+(-[a-z]+)*$/.test(value);
+}
+/** Display name: letters and single spaces only. `The Greatest Designer`. */
+function isRoleName(value) {
+	return typeof value === "string" && /^[A-Za-z]+(?: [A-Za-z]+)*$/.test(value.trim());
+}
+/** Strip digits and punctuation as the name is typed. Trailing space stays. */
+function sanitizeRoleNameInput(value) {
+	return value.replace(/[^A-Za-z ]/g, "").replace(/ {2,}/g, " ");
+}
+/** Name → stored key. `The Greatest Designer` → `the-greatest-designer`. */
+function slugifyRoleName(value) {
+	if (typeof value !== "string") return "";
+	return value.trim().toLowerCase().replace(/[^a-z]+/g, "-").replace(/^-|-$/g, "");
+}
+function roleLabel(role, label) {
+	const trimmed = typeof label === "string" ? label.trim() : "";
+	if (trimmed) return trimmed;
+	return isRole(role) ? ROLE_LABELS[role] : role;
+}
+function defaultGrantsForRole(role, extraGrants) {
+	if (isRole(role)) return [...DEFAULT_ROLE_GRANTS[role]];
+	return extraGrants ? [...extraGrants] : [];
+}
+//#endregion
+//#region src/roles/matrix.ts
+const ROLES_SLUG = "roles";
+const ROLES_GLOBAL_DESCRIPTION = "Who may do what. Drag to change rank.";
+const ROLES_FIELD_DESCRIPTION = "Drag to change rank. Ticks are features released on Features. Developer has the whole catalogue.";
+/**
+* Default rank and grants. Developer is implicit (empty grants). Brand
+* screens default to Designer. The API tab is not granted until released.
+*/
+const DEFAULT_ROLE_MATRIX = ROLES.map((role) => ({
+	role,
+	grants: defaultGrantsForRole(role)
+}));
+const DEVELOPER_DESCRIPTION = "Everything, including features not released for assignment.";
+const LAST_USERS_TICK_MESSAGE = "Keep Users granted on at least one of Admin or Developer.";
+const MISSING_SEED_ROLES_MESSAGE = "Roles must include Developer, Admin, Designer, and Author.";
+const DUPLICATE_ROLE_SLUG_MESSAGE = "Each role needs a unique slug.";
+const DUPLICATE_ROLE_NAME_MESSAGE = "Each role needs a unique name.";
+const INVALID_ROLE_NAME_MESSAGE = "Use letters and spaces only.";
+function uniqueSlugs(values) {
+	const slugs = [];
+	for (const value of values) if (typeof value === "string" && isFeatureSlug(value) && !slugs.includes(value)) slugs.push(value);
+	return slugs;
+}
+/** Read stored grants, or rebuild them from the old capability ticks. */
+function grantsFromStoredRole(item) {
+	if ("grants" in item && Array.isArray(item.grants)) return uniqueSlugs(item.grants);
+	const grants = [];
+	if ("content" in item && item.content) grants.push("content", "media");
+	if ("publish" in item && item.publish) grants.push("publish");
+	if ("users" in item && item.users) grants.push("users", "roles");
+	if ("brand" in item && item.brand) grants.push(...THEME_FEATURE_SLUGS);
+	return uniqueSlugs(grants);
+}
+function seedRoleRows(extras = []) {
+	return [...DEFAULT_ROLE_MATRIX.map((row) => ({
+		...row,
+		grants: [...row.grants],
+		label: isRole(row.role) ? ROLE_LABELS[row.role] : row.role
+	})), ...extras.map((extra) => ({
+		role: extra.role,
+		label: extra.label,
+		grants: extra.grants ? [...extra.grants] : []
+	}))];
+}
+function defaultRolesFieldValue(extras = []) {
+	return seedRoleRows(extras).map((row) => ({
+		id: row.role,
+		...row
+	}));
+}
+function readRoleRow(item) {
+	const role = "role" in item ? item.role : void 0;
+	if (typeof role !== "string" || role.trim() === "") return { error: DUPLICATE_ROLE_SLUG_MESSAGE };
+	if (!isRoleSlug(role)) return { error: DUPLICATE_ROLE_SLUG_MESSAGE };
+	return {
+		id: role,
+		role,
+		label: roleLabel(role, "label" in item && typeof item.label === "string" ? item.label : void 0),
+		grants: grantsFromStoredRole(item)
+	};
+}
+function parseRolesMatrix(value) {
+	if (!Array.isArray(value)) return {
+		ok: false,
+		message: MISSING_SEED_ROLES_MESSAGE
+	};
+	const rows = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const role = "role" in item ? item.role : void 0;
+		if (typeof role !== "string" || role.trim() === "") continue;
+		const parsed = readRoleRow(item);
+		if ("error" in parsed) return {
+			ok: false,
+			message: parsed.error
+		};
+		if (seen.has(parsed.role)) return {
+			ok: false,
+			message: DUPLICATE_ROLE_SLUG_MESSAGE
+		};
+		seen.add(parsed.role);
+		rows.push(parsed);
+	}
+	if (ROLES.some((role) => !seen.has(role))) return {
+		ok: false,
+		message: MISSING_SEED_ROLES_MESSAGE
+	};
+	return {
+		ok: true,
+		rows
+	};
+}
+function roleHasGrant(row, slug) {
+	if (row.role === "developer") return true;
+	return row.grants.includes(slug);
+}
+function roleHasCapability(row, capability) {
+	if (row.role === "developer") return true;
+	return CAPABILITY_FEATURES[capability].some((slug) => row.grants.includes(slug));
+}
+/**
+* Mint a slug from the name only when the row has none yet. An existing
+* key — seed or custom — stays put so a rename cannot orphan users.
+*/
+function applyRoleSlugsFromNames(value) {
+	if (!Array.isArray(value)) return value;
+	return value.map((item) => {
+		if (!item || typeof item !== "object") return item;
+		const row = item;
+		if (isRoleSlug(row.role)) return item;
+		const slug = slugifyRoleName(row.label);
+		return isRoleSlug(slug) ? {
+			...row,
+			role: slug
+		} : item;
+	});
+}
+function hasDuplicateRoleNames(value) {
+	if (!Array.isArray(value)) return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const role = "role" in item && typeof item.role === "string" ? item.role : "";
+		const name = ("label" in item && typeof item.label === "string" ? item.label : "").trim() || (isRole(role) ? ROLE_LABELS[role] : "");
+		if (!name) continue;
+		const key = name.toLowerCase();
+		if (seen.has(key)) return true;
+		seen.add(key);
+	}
+	return false;
+}
+function hasInvalidRoleName(value) {
+	if (!Array.isArray(value)) return false;
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const label = "label" in item && typeof item.label === "string" ? item.label.trim() : "";
+		if (!label) continue;
+		if (!isRoleName(label)) return true;
+	}
+	return false;
+}
+function validateRolesMatrix(value) {
+	if (hasDuplicateRoleNames(value)) return DUPLICATE_ROLE_NAME_MESSAGE;
+	if (hasInvalidRoleName(value)) return INVALID_ROLE_NAME_MESSAGE;
+	const parsed = parseRolesMatrix(applyRoleSlugsFromNames(value));
+	if (!parsed.ok) return parsed.message;
+	return true;
+}
+/**
+* Developer is exclusive. Admin does not swallow Designer: both store.
+* Unknown slugs (dropped catalogue keys such as `approver`) fall away unless
+* they appear on the matrix.
+*/
+function normalizeStoredRoles(value, matrix = DEFAULT_ROLE_MATRIX) {
+	if (!Array.isArray(value)) return [];
+	const allowed = new Set(matrix.map((row) => row.role));
+	const roles = [...new Set(value.filter((entry) => typeof entry === "string" && allowed.has(entry)))];
+	if (roles.includes("developer")) return ["developer"];
+	return roles;
+}
+function roleSelectOptions(matrix = DEFAULT_ROLE_MATRIX) {
+	return matrix.map((row) => ({
+		label: roleLabel(row.role, row.label),
+		value: row.role
+	}));
+}
+/** Grant copy only. Developer names the unreleased catalogue; nothing about MCP or seed. */
+function roleDescription(role, matrix = DEFAULT_ROLE_MATRIX) {
+	if (role === "developer") return DEVELOPER_DESCRIPTION;
+	const row = matrix.find((entry) => entry.role === role);
+	if (!row) return "No capabilities";
+	return row.grants.map((slug) => packageFeatureLabel(slug)).join(", ") || "No capabilities";
+}
+/**
+* Seed grants and package labels come back; extra rows stay as they are.
+*/
+function resetRolesMatrix(current) {
+	const extras = [];
+	if (Array.isArray(current)) for (const item of current) {
+		if (!item || typeof item !== "object") continue;
+		const parsed = readRoleRow(item);
+		if ("error" in parsed || isRole(parsed.role)) continue;
+		extras.push(parsed);
+	}
+	return [...defaultRolesFieldValue(), ...extras];
+}
+//#endregion
+//#region src/roles/access.ts
+function isAccessArgs$1(value) {
+	return typeof value === "object" && value !== null && "req" in value;
+}
+function storedRoles(user) {
+	return Array.isArray(user?.roles) ? user.roles : [];
+}
+function hasRole(user, role) {
+	return storedRoles(user).includes(role);
+}
+/** Not a tick. True only when `developer` is stored on the row. */
+function isDeveloper(user) {
+	return hasRole(user, "developer");
+}
+function hasCapability(user, capability, matrix = DEFAULT_ROLE_MATRIX) {
+	if (isDeveloper(user)) return true;
+	return storedRoles(user).some((role) => {
+		const row = matrix.find((entry) => entry.role === role);
+		return row ? roleHasCapability(row, capability) : false;
+	});
+}
+function hasGrant(user, slug, matrix = DEFAULT_ROLE_MATRIX) {
+	if (isDeveloper(user)) return true;
+	return storedRoles(user).some((role) => {
+		const row = matrix.find((entry) => entry.role === role);
+		return row ? roleHasGrant(row, slug) : false;
+	});
+}
+/**
+* Reads the saved Roles Global, falling back to the seed when the row is
+* empty, missing, or unreadable. Always override-access so a Designer
+* evaluating Theme does not have to read Settings → Roles.
+*/
+async function getRolesMatrix(req = {}, extras = []) {
+	const fallback = seedRoleRows(extras);
+	const findGlobal = req.payload?.findGlobal;
+	if (typeof findGlobal !== "function") return fallback;
+	try {
+		const doc = await findGlobal({
+			slug: ROLES_SLUG,
+			overrideAccess: true,
+			req
+		});
+		const parsed = parseRolesMatrix(doc && typeof doc === "object" && "roles" in doc ? doc.roles : void 0);
+		return parsed.ok ? parsed.rows : fallback;
+	} catch {
+		return fallback;
+	}
+}
+function capabilityPredicate(capability) {
+	function predicate(userOrArgs, matrix) {
+		if (isAccessArgs$1(userOrArgs)) {
+			const user = userOrArgs.req.user;
+			if (matrix) return hasCapability(user, capability, matrix);
+			return getRolesMatrix(userOrArgs.req).then((rows) => hasCapability(user, capability, rows));
+		}
+		return hasCapability(userOrArgs, capability, matrix ?? DEFAULT_ROLE_MATRIX);
+	}
+	return predicate;
+}
+const canManageContent = capabilityPredicate("content");
+const canManageBrand = capabilityPredicate("brand");
+const canPublish = capabilityPredicate("publish");
+/** Users grant on any held role (Developer is implicit). */
+const isAdmin = capabilityPredicate("users");
+/** This role id currently has the Users grant, or is Developer. */
+function isPrivilegedRole(role, matrix = DEFAULT_ROLE_MATRIX) {
+	if (typeof role !== "string") return false;
+	if (role === "developer") return true;
+	const row = matrix.find((entry) => entry.role === role);
+	return row ? roleHasGrant(row, "users") : false;
+}
+function isAuthenticated(userOrArgs) {
+	if (isAccessArgs$1(userOrArgs)) return Boolean(userOrArgs.req.user);
+	return Boolean(userOrArgs);
+}
+const isAdminOrSelf = async ({ req }) => {
+	if (!req.user) return false;
+	if (await isAdmin({ req })) return true;
+	return { id: { equals: req.user.id } };
+};
+const authenticatedOrPublished = ({ req: { user } }) => {
+	if (isAuthenticated(user)) return true;
+	return { _status: { equals: "published" } };
+};
+/**
+* API tab condition. Unreleased (the default) is Developer only.
+* After Features releases it, whoever holds the grant sees it.
+*/
+function isDeveloperTab({ req }) {
+	if (isDeveloper(req.user)) return true;
+	if (!req.payload) return false;
+	return Promise.resolve().then(() => access_exports).then(({ canUseFeature }) => canUseFeature("api-tab")({ req }));
+}
+//#endregion
+//#region src/features/access.ts
+var access_exports = /* @__PURE__ */ __exportAll({
+	canUseFeature: () => canUseFeature,
+	getFeaturesMatrix: () => getFeaturesMatrix,
+	hasFeature: () => hasFeature,
+	hideUnlessFeature: () => hideUnlessFeature
+});
+function isAccessArgs(value) {
+	return typeof value === "object" && value !== null && "req" in value;
+}
+function grantedOnReleased(user, slug, row, matrix) {
+	if (!row.released) return false;
+	return hasGrant(user, slug, matrix);
+}
+/**
+* True when the feature is released and a held role is granted it.
+* Developer is always allowed. An empty Global falls back to catalogue
+* defaults. A group slug (`pages`, `theme`) is true when any child is.
+*/
+function hasFeature(user, slug, features = null, matrix = DEFAULT_ROLE_MATRIX) {
+	if (isDeveloper(user)) return true;
+	if (!user) return false;
+	const rows = features && features.length > 0 ? features : defaultFeaturesFieldValue();
+	const leaf = rows.find((entry) => entry.slug === slug);
+	if (leaf) return grantedOnReleased(user, slug, leaf, matrix);
+	if (!isGroupOnlySlug(slug)) return false;
+	return rows.some((entry) => entry.group === slug && grantedOnReleased(user, entry.slug, entry, matrix));
+}
+/**
+* Reads the saved Features Global. `null` means empty or unreadable — callers
+* fall back to catalogue defaults. Always override-access.
+*/
+async function getFeaturesMatrix(req = {}) {
+	const findGlobal = req.payload?.findGlobal;
+	if (typeof findGlobal !== "function") return null;
+	try {
+		const doc = await findGlobal({
+			slug: FEATURES_SLUG,
+			overrideAccess: true,
+			req
+		});
+		const parsed = parseFeaturesMatrix(doc && typeof doc === "object" && "features" in doc ? doc.features : void 0);
+		return parsed.ok ? parsed.rows : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Access / nav helper for one catalogue slug. Sync against a passed grid;
+* async when given `req` so it can read both Globals.
+*/
+function canUseFeature(slug) {
+	function predicate(userOrArgs, features, roles) {
+		if (isAccessArgs(userOrArgs)) {
+			const user = userOrArgs.req.user;
+			if (features !== void 0) return hasFeature(user, slug, features, roles ?? DEFAULT_ROLE_MATRIX);
+			return Promise.all([getFeaturesMatrix(userOrArgs.req), getRolesMatrix(userOrArgs.req)]).then(([grid, matrix]) => hasFeature(user, slug, grid, matrix));
+		}
+		return hasFeature(userOrArgs, slug, features ?? null, roles ?? DEFAULT_ROLE_MATRIX);
+	}
+	return predicate;
+}
+/** `admin.hidden`: hide when the login cannot use the feature. */
+function hideUnlessFeature(slug) {
+	return (args) => {
+		const user = args.user;
+		if (args.req) {
+			const result = canUseFeature(slug)({ req: {
+				...args.req,
+				user
+			} });
+			if (result instanceof Promise) return result.then((ok) => !ok);
+			return !result;
+		}
+		return !canUseFeature(slug)(user ?? null);
+	};
+}
+//#endregion
+export { defaultFeaturesFieldValue as $, ROLES_SLUG as A, CAPABILITIES as B, DUPLICATE_ROLE_NAME_MESSAGE as C, MISSING_SEED_ROLES_MESSAGE as D, LAST_USERS_TICK_MESSAGE as E, resetRolesMatrix as F, THEME_FEATURE_SLUGS as G, DEFAULT_ROLE_GRANTS as H, roleDescription as I, isRoleSlug as J, isRole as K, roleSelectOptions as L, defaultRolesFieldValue as M, normalizeStoredRoles as N, ROLES_FIELD_DESCRIPTION as O, parseRolesMatrix as P, MISSING_PACKAGE_FEATURES_MESSAGE as Q, seedRoleRows as R, DEVELOPER_DESCRIPTION as S, INVALID_ROLE_NAME_MESSAGE as T, ROLES as U, CAPABILITY_FEATURES as V, ROLE_LABELS as W, sanitizeRoleNameInput as X, roleLabel as Y, slugifyRoleName as Z, isDeveloper as _, hideUnlessFeature as a, FEATURES_SLUG as at, storedRoles as b, canManageContent as c, PACKAGE_FEATURES as ct, hasCapability as d, isFeatureSlug as dt, featureCatalogue as et, hasGrant as f, isLockedFeature as ft, isAuthenticated as g, isAdminOrSelf as h, hasFeature as i, validateFeaturesMatrix as it, applyRoleSlugsFromNames as j, ROLES_GLOBAL_DESCRIPTION as k, canPublish as l, PACKAGE_FEATURE_SLUGS as lt, isAdmin as m, canUseFeature as n, parseFeaturesMatrix as nt, authenticatedOrPublished as o, FEATURE_GROUPS as ot, hasRole as p, isPackageFeatureSlug as pt, isRoleName as q, getFeaturesMatrix as r, stampFeatureCatalogue as rt, canManageBrand as s, FEATURE_GROUP_LABELS as st, access_exports as t, featureGroupLabel as tt, getRolesMatrix as u, isFeatureGroupId as ut, isDeveloperTab as v, DUPLICATE_ROLE_SLUG_MESSAGE as w, DEFAULT_ROLE_MATRIX as x, isPrivilegedRole as y, validateRolesMatrix as z };
+
+//# sourceMappingURL=access-B3LglN2J.mjs.map