@bison-lab/payload-core 3.13.0 → 3.14.0

package/dist/index.mjs

@@ -1,5 +1,6 @@
-import { n as documentTitle, r as titleTemplate, t as SHARE_IMAGE_SIZE } from "./share-image-C4ILz4p2.mjs";
-import { A as THEME_FONT_FIELD, C as validateThemeHex, D as THEME_COLOR_SCALE_FIELD, E as THEME_COLOR_FIELD, F as THEME_PUBLISH_FIELD, I as THEME_SAVE_BUTTON, L as THEME_SECTION_HEADING, M as THEME_IDENTITY_FALLBACK, N as THEME_LIBRARY_FIELD, O as THEME_CONTRAST_REPORT, P as THEME_PAIRING_FIELD, R as headingSelectValue, S as validateSourceIncluded, T as THEME_APPEARANCE_FIELD, _ as THEME_SLUG, a as pageEditorLooks, c as findColorTokens, d as rewriteColorToken, f as themeColorKeys, g as THEME_IDENTITY_SLUG, h as THEME_COLORS_SLUG, i as PAGE_EDITOR_SYSTEM_KEYS, j as THEME_GREY_SCALE_FIELD, k as THEME_DOCUMENT_CONTROLS, l as rewriteColorTokens, m as THEME_APPEARANCE_SLUG, n as colorTokenField, o as pageEditorTokens, p as SYSTEM_COLOR_KEYS, r as lookField, s as themeLibraryFromDoc, t as resolveThemeIdentity, u as deleteLibraryColor, v as THEME_TYPOGRAPHY_SLUG, w as LOOK_FIELD, x as themeConfigFromDoc, y as docFromConfig } from "./identity-LAzSeorC.mjs";
+import { $ as defaultFeaturesFieldValue, A as ROLES_SLUG, B as CAPABILITIES, C as DUPLICATE_ROLE_NAME_MESSAGE, D as MISSING_SEED_ROLES_MESSAGE, E as LAST_USERS_TICK_MESSAGE, F as resetRolesMatrix, G as THEME_FEATURE_SLUGS, H as DEFAULT_ROLE_GRANTS, I as roleDescription, J as isRoleSlug, K as isRole, L as roleSelectOptions, M as defaultRolesFieldValue, N as normalizeStoredRoles, O as ROLES_FIELD_DESCRIPTION, P as parseRolesMatrix, Q as MISSING_PACKAGE_FEATURES_MESSAGE, R as seedRoleRows, S as DEVELOPER_DESCRIPTION, T as INVALID_ROLE_NAME_MESSAGE, U as ROLES, V as CAPABILITY_FEATURES, W as ROLE_LABELS, X as sanitizeRoleNameInput, Y as roleLabel, Z as slugifyRoleName, _ as isDeveloper, a as hideUnlessFeature, at as FEATURES_SLUG, b as storedRoles, c as canManageContent, ct as PACKAGE_FEATURES, d as hasCapability, dt as isFeatureSlug, et as featureCatalogue, f as hasGrant, ft as isLockedFeature, g as isAuthenticated, h as isAdminOrSelf, i as hasFeature, it as validateFeaturesMatrix, j as applyRoleSlugsFromNames, k as ROLES_GLOBAL_DESCRIPTION, l as canPublish, lt as PACKAGE_FEATURE_SLUGS, m as isAdmin, n as canUseFeature, nt as parseFeaturesMatrix, o as authenticatedOrPublished, ot as FEATURE_GROUPS, p as hasRole, pt as isPackageFeatureSlug, q as isRoleName, r as getFeaturesMatrix, rt as stampFeatureCatalogue, s as canManageBrand, st as FEATURE_GROUP_LABELS, tt as featureGroupLabel, u as getRolesMatrix, ut as isFeatureGroupId, v as isDeveloperTab, w as DUPLICATE_ROLE_SLUG_MESSAGE, x as DEFAULT_ROLE_MATRIX, y as isPrivilegedRole, z as validateRolesMatrix } from "./access-B3LglN2J.mjs";
+import { n as documentTitle, r as titleTemplate, t as SHARE_IMAGE_SIZE } from "./share-image-BlFAJLnd.mjs";
+import { A as THEME_FONT_FIELD, C as validateThemeHex, D as THEME_COLOR_SCALE_FIELD, E as THEME_COLOR_FIELD, F as THEME_PUBLISH_FIELD, I as THEME_SAVE_BUTTON, L as THEME_SECTION_HEADING, M as THEME_IDENTITY_FALLBACK, N as THEME_LIBRARY_FIELD, O as THEME_CONTRAST_REPORT, P as THEME_PAIRING_FIELD, R as headingSelectValue, S as validateSourceIncluded, T as THEME_APPEARANCE_FIELD, _ as THEME_SLUG, a as pageEditorLooks, c as findColorTokens, d as rewriteColorToken, f as themeColorKeys, g as THEME_IDENTITY_SLUG, h as THEME_COLORS_SLUG, i as PAGE_EDITOR_SYSTEM_KEYS, j as THEME_GREY_SCALE_FIELD, k as THEME_DOCUMENT_CONTROLS, l as rewriteColorTokens, m as THEME_APPEARANCE_SLUG, n as colorTokenField, o as pageEditorTokens, p as SYSTEM_COLOR_KEYS, r as lookField, s as themeLibraryFromDoc, t as resolveThemeIdentity, u as deleteLibraryColor, v as THEME_TYPOGRAPHY_SLUG, w as LOOK_FIELD, x as themeConfigFromDoc, y as docFromConfig } from "./identity-Dwyq8519.mjs";
 import { seoPlugin as seoPlugin$1 } from "@payloadcms/plugin-seo";
 import { catalog } from "@bison-lab/fonts";
 import { DESTRUCTIVE_SCALE_HEX, SHADE_STEPS, presetHints } from "@bison-lab/tokens";
@@ -752,6 +753,7 @@ function createTheme(options) {
 			lockDocuments: false,
 			admin: {
 				group: "Theme",
+				hidden: hideUnlessFeature("theme"),
 				hideAPIURL: true,
 				custom: adminCustom,
 				components: preview ? { elements: { beforeDocumentControls: [THEME_DOCUMENT_CONTROLS] } } : void 0
@@ -919,288 +921,27 @@ const THEME_PREVIEW_BREAKPOINTS = [
 	}
 ];
 //#endregion
-//#region src/roles/types.ts
-/**
-* The Roles Global a site's generated types will describe. Optional and
-* nullable, no index signature: a generated Global is assignable to this,
-* never the reverse.
-*/
-const ROLES = [
-	"developer",
-	"admin",
-	"designer",
-	"author"
-];
-const ROLE_LABELS = {
-	developer: "Developer",
-	admin: "Admin",
-	designer: "Designer",
-	author: "Author"
-};
-const CAPABILITIES = [
-	"content",
-	"brand",
-	"publish",
-	"users"
-];
-function isRole(value) {
-	return typeof value === "string" && ROLES.includes(value);
-}
-/** Lowercase slug: `editor`, `site-editor`. Empty and punctuation are out. */
-function isRoleSlug(value) {
-	return typeof value === "string" && /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(value);
-}
-function roleLabel(role, label) {
-	const trimmed = typeof label === "string" ? label.trim() : "";
-	if (trimmed) return trimmed;
-	return isRole(role) ? ROLE_LABELS[role] : role;
-}
-//#endregion
-//#region src/roles/matrix.ts
-const ROLES_SLUG = "roles";
-const ROLES_GLOBAL_DESCRIPTION = "Who may do what. Drag to change rank.";
-const ROLES_FIELD_DESCRIPTION = "Drag to change rank. Ticks are Content, Brand, Publish, and Users.";
-/**
-* Default rank and ticks. Brand is Designer only. The API tab is not a
-* column — it is locked to Developer in `isDeveloper`.
-*/
-const DEFAULT_ROLE_MATRIX = [
-	{
-		role: "developer",
-		content: true,
-		brand: true,
-		publish: true,
-		users: true
-	},
-	{
-		role: "admin",
-		content: true,
-		brand: false,
-		publish: true,
-		users: true
-	},
-	{
-		role: "designer",
-		content: false,
-		brand: true,
-		publish: false,
-		users: false
-	},
-	{
-		role: "author",
-		content: true,
-		brand: false,
-		publish: false,
-		users: false
-	}
-];
-const DEVELOPER_DESCRIPTION = "Everything Admin can do, plus the document API tab.";
-const LAST_USERS_TICK_MESSAGE = "Keep Users ticked on at least one of Admin or Developer.";
-const MISSING_SEED_ROLES_MESSAGE = "Roles must include Developer, Admin, Designer, and Author.";
-const DUPLICATE_ROLE_SLUG_MESSAGE = "Each role needs a unique slug.";
-const CAPABILITY_LABELS = {
-	content: "Content",
-	brand: "Brand",
-	publish: "Publish",
-	users: "Users"
-};
-function seedRoleRows(extras = []) {
-	return [...DEFAULT_ROLE_MATRIX.map((row) => ({
-		...row,
-		label: isRole(row.role) ? ROLE_LABELS[row.role] : row.role
-	})), ...extras.map((extra) => ({ ...extra }))];
-}
-function defaultRolesFieldValue(extras = []) {
-	return seedRoleRows(extras).map((row) => ({
-		id: row.role,
-		...row
-	}));
-}
-function readRoleRow(item) {
-	const role = "role" in item ? item.role : void 0;
-	if (typeof role !== "string" || role.trim() === "") return { error: DUPLICATE_ROLE_SLUG_MESSAGE };
-	if (!isRoleSlug(role)) return { error: DUPLICATE_ROLE_SLUG_MESSAGE };
-	return {
-		id: role,
-		role,
-		label: roleLabel(role, "label" in item && typeof item.label === "string" ? item.label : void 0),
-		content: Boolean("content" in item && item.content),
-		brand: Boolean("brand" in item && item.brand),
-		publish: Boolean("publish" in item && item.publish),
-		users: Boolean("users" in item && item.users)
-	};
-}
-function parseRolesMatrix(value) {
-	if (!Array.isArray(value)) return {
-		ok: false,
-		message: MISSING_SEED_ROLES_MESSAGE
-	};
-	const rows = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of value) {
-		if (!item || typeof item !== "object") continue;
-		const parsed = readRoleRow(item);
-		if ("error" in parsed) return {
-			ok: false,
-			message: parsed.error
-		};
-		if (seen.has(parsed.role)) return {
-			ok: false,
-			message: DUPLICATE_ROLE_SLUG_MESSAGE
-		};
-		seen.add(parsed.role);
-		rows.push(parsed);
-	}
-	if (ROLES.some((role) => !seen.has(role))) return {
-		ok: false,
-		message: MISSING_SEED_ROLES_MESSAGE
-	};
-	return {
-		ok: true,
-		rows
-	};
-}
-function hasPrivilegedUsersTick(rows) {
-	return rows.some((row) => (row.role === "admin" || row.role === "developer") && row.users);
-}
-function validateRolesMatrix(value) {
-	const parsed = parseRolesMatrix(value);
-	if (!parsed.ok) return parsed.message;
-	if (!hasPrivilegedUsersTick(parsed.rows)) return LAST_USERS_TICK_MESSAGE;
-	return true;
-}
-/**
-* Developer is exclusive. Admin does not swallow Designer: both store.
-* Unknown slugs (dropped catalogue keys such as `approver`) fall away unless
-* they appear on the matrix.
-*/
-function normalizeStoredRoles(value, matrix = DEFAULT_ROLE_MATRIX) {
-	if (!Array.isArray(value)) return [];
-	const allowed = new Set(matrix.map((row) => row.role));
-	const roles = [...new Set(value.filter((entry) => typeof entry === "string" && allowed.has(entry)))];
-	if (roles.includes("developer")) return ["developer"];
-	return roles;
-}
-function roleSelectOptions(matrix = DEFAULT_ROLE_MATRIX) {
-	return matrix.map((row) => ({
-		label: roleLabel(row.role, row.label),
-		value: row.role
-	}));
-}
-/** Capability copy only. Developer names the API tab; nothing about MCP or seed. */
-function roleDescription(role, matrix = DEFAULT_ROLE_MATRIX) {
-	if (role === "developer") return DEVELOPER_DESCRIPTION;
-	const row = matrix.find((entry) => entry.role === role);
-	if (!row) return "No capabilities";
-	return CAPABILITIES.filter((capability) => row[capability]).map((capability) => CAPABILITY_LABELS[capability]).join(", ") || "No capabilities";
-}
-/**
-* Seed ticks and package labels come back; extra rows stay as they are.
-*/
-function resetRolesMatrix(current) {
-	const extras = [];
-	if (Array.isArray(current)) for (const item of current) {
-		if (!item || typeof item !== "object") continue;
-		const parsed = readRoleRow(item);
-		if ("error" in parsed || isRole(parsed.role)) continue;
-		extras.push(parsed);
-	}
-	return [...defaultRolesFieldValue(), ...extras];
-}
-//#endregion
-//#region src/roles/access.ts
-function isAccessArgs$1(value) {
-	return typeof value === "object" && value !== null && "req" in value;
-}
-function storedRoles(user) {
-	return Array.isArray(user?.roles) ? user.roles : [];
-}
-function hasRole(user, role) {
-	return storedRoles(user).includes(role);
-}
-/** Not a tick. True only when `developer` is stored on the row. */
-function isDeveloper(user) {
-	return hasRole(user, "developer");
-}
-function hasCapability(user, capability, matrix = DEFAULT_ROLE_MATRIX) {
-	return storedRoles(user).some((role) => {
-		return matrix.find((entry) => entry.role === role)?.[capability] === true;
-	});
-}
-/**
-* Reads the saved Roles Global, falling back to the seed when the row is
-* empty, missing, or unreadable. Always override-access so a Designer
-* evaluating Theme does not have to read Settings → Roles.
-*/
-async function getRolesMatrix(req = {}, extras = []) {
-	const fallback = seedRoleRows(extras);
-	const findGlobal = req.payload?.findGlobal;
-	if (typeof findGlobal !== "function") return fallback;
-	try {
-		const doc = await findGlobal({
-			slug: ROLES_SLUG,
-			overrideAccess: true,
-			req
-		});
-		const parsed = parseRolesMatrix(doc && typeof doc === "object" && "roles" in doc ? doc.roles : void 0);
-		return parsed.ok ? parsed.rows : fallback;
-	} catch {
-		return fallback;
-	}
-}
-function capabilityPredicate(capability) {
-	function predicate(userOrArgs, matrix) {
-		if (isAccessArgs$1(userOrArgs)) {
-			const user = userOrArgs.req.user;
-			if (matrix) return hasCapability(user, capability, matrix);
-			return getRolesMatrix(userOrArgs.req).then((rows) => hasCapability(user, capability, rows));
-		}
-		return hasCapability(userOrArgs, capability, matrix ?? DEFAULT_ROLE_MATRIX);
-	}
-	return predicate;
-}
-const canManageContent = capabilityPredicate("content");
-const canManageBrand = capabilityPredicate("brand");
-const canPublish = capabilityPredicate("publish");
-/** Users tick on any held role. */
-const isAdmin = capabilityPredicate("users");
-/** This role id currently has the Users tick. */
-function isPrivilegedRole(role, matrix = DEFAULT_ROLE_MATRIX) {
-	return typeof role === "string" && matrix.some((row) => row.role === role && row.users);
-}
-function isAuthenticated(userOrArgs) {
-	if (isAccessArgs$1(userOrArgs)) return Boolean(userOrArgs.req.user);
-	return Boolean(userOrArgs);
-}
-const isAdminOrSelf = async ({ req }) => {
-	if (!req.user) return false;
-	if (await isAdmin({ req })) return true;
-	return { id: { equals: req.user.id } };
-};
-const authenticatedOrPublished = ({ req: { user } }) => {
-	if (isAuthenticated(user)) return true;
-	return { _status: { equals: "published" } };
-};
-/** API tab condition: Developer only, not the Users tick. */
-function isDeveloperTab({ req }) {
-	return isDeveloper(req.user);
-}
-//#endregion
 //#region src/roles/fields.ts
 const ROLES_MATRIX_FIELD = "@bison-lab/payload-core/admin#RolesMatrixField";
 const ROLES_ROW_LABEL = "@bison-lab/payload-core/admin#RolesRowLabel";
 const ROLE_SLUG_FIELD = "@bison-lab/payload-core/admin#RoleSlugField";
+const ROLE_NAME_FIELD = "@bison-lab/payload-core/admin#RoleNameField";
 const ROLES_FIELD = "@bison-lab/payload-core/admin#RolesField";
+const ROLES_GRANTS_FIELD = "@bison-lab/payload-core/admin#RolesGrantsField";
 //#endregion
 //#region src/roles/global.ts
-const roleSlugValidate = (value, options) => {
-	if (options.operation === "update" && isRole(options.previousValue)) return value === options.previousValue || "Each role needs a unique slug.";
-	if (typeof value !== "string" || value === "") return DUPLICATE_ROLE_SLUG_MESSAGE;
+const roleSlugValidate = (value) => {
+	if (typeof value !== "string" || value === "") return true;
 	return isRoleSlug(value) || "Each role needs a unique slug.";
 };
+const roleNameValidate = (value) => {
+	if (typeof value !== "string" || value.trim() === "") return true;
+	return isRoleName(value) || "Use letters and spaces only.";
+};
 /**
-* Settings → Roles. Rank is the array order (Payload's drag handle). Ticks
-* are Content, Brand, Publish, Users. The API tab is not a column.
+* Settings → Roles. Rank is the array order (Payload's drag handle).
+* Ticks are released catalogue rows. Developer is implicit and shown
+* only to a Developer, with every catalogue tick locked on.
 */
 function createRoles({ extras = [] } = {}) {
 	const rolesField = {
@@ -1215,6 +956,7 @@ function createRoles({ extras = [] } = {}) {
 		required: true,
 		defaultValue: defaultRolesFieldValue(extras),
 		validate: validateRolesMatrix,
+		hooks: { beforeChange: [({ value }) => applyRoleSlugsFromNames(value)] },
 		admin: {
 			components: {
 				Field: ROLES_MATRIX_FIELD,
@@ -1228,36 +970,23 @@ function createRoles({ extras = [] } = {}) {
 				name: "role",
 				type: "text",
 				label: "Slug",
-				required: true,
 				validate: roleSlugValidate,
-				hooks: { beforeChange: [({ value, previousValue }) => isRole(previousValue) ? previousValue : value] },
-				admin: { components: { Field: ROLE_SLUG_FIELD } }
+				admin: { hidden: true }
 			},
 			{
 				name: "label",
 				type: "text",
 				label: "Name",
-				required: true
-			},
-			{
-				name: "content",
-				type: "checkbox",
-				label: "Content"
-			},
-			{
-				name: "brand",
-				type: "checkbox",
-				label: "Brand"
-			},
-			{
-				name: "publish",
-				type: "checkbox",
-				label: "Publish"
+				required: true,
+				validate: roleNameValidate,
+				admin: { components: { Field: ROLE_NAME_FIELD } }
 			},
 			{
-				name: "users",
-				type: "checkbox",
-				label: "Users"
+				name: "grants",
+				type: "json",
+				label: "Grants",
+				defaultValue: [],
+				admin: { components: { Field: ROLES_GRANTS_FIELD } }
 			}
 		]
 	};
@@ -1266,11 +995,11 @@ function createRoles({ extras = [] } = {}) {
 		label: "Roles",
 		admin: {
 			group: "Settings",
-			hidden: ({ user }) => !isAdmin(user),
+			hidden: hideUnlessFeature("roles"),
 			description: ROLES_GLOBAL_DESCRIPTION
 		},
 		access: {
-			read: (args) => isAdmin(args),
+			read: (args) => canUseFeature("roles")(args),
 			update: (args) => isAdmin(args)
 		},
 		fields: [rolesField]
@@ -1293,169 +1022,11 @@ async function seedRoles(payload, extras = []) {
 //#region src/features/fields.ts
 const FEATURES_MATRIX_FIELD = "@bison-lab/payload-core/admin#FeaturesMatrixField";
 //#endregion
-//#region src/features/types.ts
-const FEATURES_SLUG = "features";
-const PACKAGE_FEATURE_SLUGS = [
-	"pages",
-	"media",
-	"theme",
-	"brand-assets",
-	"users",
-	"roles",
-	"features"
-];
-/**
-* Package catalogue. Locked rows cannot be turned off. Empty Global falls
-* back to the named capability (Content → Pages/Media, Brand → Theme /
-* Brand assets, Users → Users/Roles/Features).
-*/
-const PACKAGE_FEATURES = [
-	{
-		slug: "pages",
-		label: "Pages",
-		fallback: "content",
-		locked: false
-	},
-	{
-		slug: "media",
-		label: "Media",
-		fallback: "content",
-		locked: false
-	},
-	{
-		slug: "theme",
-		label: "Theme",
-		fallback: "brand",
-		locked: false
-	},
-	{
-		slug: "brand-assets",
-		label: "Brand assets",
-		fallback: "brand",
-		locked: false
-	},
-	{
-		slug: "users",
-		label: "Users",
-		fallback: "users",
-		locked: true
-	},
-	{
-		slug: "roles",
-		label: "Roles",
-		fallback: "users",
-		locked: true
-	},
-	{
-		slug: "features",
-		label: "Features",
-		fallback: "users",
-		locked: true
-	}
-];
-function isPackageFeatureSlug(value) {
-	return typeof value === "string" && PACKAGE_FEATURE_SLUGS.includes(value);
-}
-function isFeatureSlug(value) {
-	return typeof value === "string" && /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(value);
-}
-function isLockedFeature(slug, locked) {
-	if (locked === true) return true;
-	return PACKAGE_FEATURES.find((feature) => feature.slug === slug)?.locked === true;
-}
-//#endregion
-//#region src/features/matrix.ts
-const MISSING_PACKAGE_FEATURES_MESSAGE = "Features must include Pages, Media, Theme, Brand assets, Users, Roles, and Features.";
-const LOCKED_FEATURE_MESSAGE = "Users, Roles, and Features cannot be turned off. Developer stays allowed on every row.";
-function featureCatalogue(extras = []) {
-	return [...PACKAGE_FEATURES.map((feature) => ({ ...feature })), ...extras.map((extra) => ({
-		slug: extra.slug,
-		label: extra.label,
-		fallback: null,
-		locked: false
-	}))];
-}
-function rolesForFeature(feature, matrix) {
-	const allowed = new Set(["developer"]);
-	if (feature.locked) {
-		for (const row of matrix) allowed.add(row.role);
-		return [...allowed];
-	}
-	if (feature.fallback) {
-		for (const row of matrix) if (row[feature.fallback]) allowed.add(row.role);
-	}
-	return [...allowed];
-}
-function defaultFeaturesFieldValue(extras = [], matrix = DEFAULT_ROLE_MATRIX) {
-	return featureCatalogue(extras).map((feature) => ({
-		id: feature.slug,
-		slug: feature.slug,
-		label: feature.label,
-		locked: feature.locked,
-		roles: rolesForFeature(feature, matrix)
-	}));
-}
-function parseFeaturesMatrix(value) {
-	if (!Array.isArray(value) || value.length === 0) return {
-		ok: false,
-		message: MISSING_PACKAGE_FEATURES_MESSAGE
-	};
-	const rows = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of value) {
-		if (!item || typeof item !== "object") continue;
-		const slug = "slug" in item ? item.slug : void 0;
-		if (!isFeatureSlug(slug) || seen.has(slug)) continue;
-		seen.add(slug);
-		const rawRoles = "roles" in item && Array.isArray(item.roles) ? item.roles : [];
-		const roles = [];
-		for (const role of rawRoles) if (typeof role === "string" && !roles.includes(role)) roles.push(role);
-		const label = "label" in item && typeof item.label === "string" ? item.label : slug;
-		rows.push({
-			id: slug,
-			slug,
-			label,
-			locked: isLockedFeature(slug, "locked" in item ? Boolean(item.locked) : void 0),
-			roles
-		});
-	}
-	if (PACKAGE_FEATURES.some((feature) => !seen.has(feature.slug))) return {
-		ok: false,
-		message: MISSING_PACKAGE_FEATURES_MESSAGE
-	};
-	return {
-		ok: true,
-		rows
-	};
-}
-function enforceFeatureLocks(rows, matrix = DEFAULT_ROLE_MATRIX) {
-	const roleSlugs = matrix.map((row) => row.role);
-	return rows.map((row) => {
-		const roles = new Set(row.roles ?? []);
-		roles.add("developer");
-		if (isLockedFeature(row.slug, row.locked)) for (const role of roleSlugs) roles.add(role);
-		return {
-			...row,
-			roles: [...roles]
-		};
-	});
-}
-function validateFeaturesMatrix(value, extras = [], matrix = DEFAULT_ROLE_MATRIX) {
-	const parsed = parseFeaturesMatrix(value);
-	if (!parsed.ok) return parsed.message;
-	const allowed = new Set(featureCatalogue(extras).map((feature) => feature.slug));
-	if (parsed.rows.some((row) => !allowed.has(row.slug))) return MISSING_PACKAGE_FEATURES_MESSAGE;
-	for (const row of parsed.rows) {
-		if (!row.roles?.includes("developer")) return LOCKED_FEATURE_MESSAGE;
-		if (isLockedFeature(row.slug, row.locked) && matrix.some((role) => !row.roles?.includes(role.role))) return LOCKED_FEATURE_MESSAGE;
-	}
-	return true;
-}
-//#endregion
 //#region src/features/global.ts
 /**
-* Settings → Features. Rows are the catalogue (code). Columns are the
-* Roles Global. Locked rows and Developer cannot be turned off.
+* Settings → Features. One release switch per catalogue row. Off hides
+* the tick on Roles; Developer still has the feature. This screen is
+* not itself a row.
 */
 function createFeatures({ extras = [] } = {}) {
 	const catalogue = featureCatalogue(extras);
@@ -1464,12 +1035,12 @@ function createFeatures({ extras = [] } = {}) {
 		label: "Features",
 		admin: {
 			group: "Settings",
-			hidden: ({ user }) => !isAdmin(user),
-			description: "Who may use which collections and globals."
+			hidden: ({ user }) => !isDeveloper(user),
+			description: "Which features other people may be granted on Roles."
 		},
 		access: {
-			read: (args) => isAdmin(args),
-			update: (args) => isAdmin(args)
+			read: ({ req }) => isDeveloper(req.user),
+			update: ({ req }) => isDeveloper(req.user)
 		},
 		fields: [{
 			name: "features",
@@ -1483,16 +1054,14 @@ function createFeatures({ extras = [] } = {}) {
 			maxRows: catalogue.length,
 			required: true,
 			defaultValue: defaultFeaturesFieldValue(extras),
-			validate: async (value, { req }) => {
-				return validateFeaturesMatrix(value, extras, await getRolesMatrix(req));
-			},
-			hooks: { beforeChange: [async ({ value, req }) => {
+			validate: (value) => validateFeaturesMatrix(value, extras),
+			hooks: { beforeChange: [({ value }) => {
 				if (!Array.isArray(value)) return value;
-				return enforceFeatureLocks(value, await getRolesMatrix(req));
+				return stampFeatureCatalogue(value, extras);
 			}] },
 			admin: {
 				components: { Field: FEATURES_MATRIX_FIELD },
-				description: "Turn a feature on or off per role. Users, Roles, and Features stay on. Developer is always allowed.",
+				description: "Release a feature so it can be assigned on Roles. Off keeps it Developer-only.",
 				initCollapsed: false
 			},
 			fields: [
@@ -1511,16 +1080,16 @@ function createFeatures({ extras = [] } = {}) {
 					admin: { readOnly: true }
 				},
 				{
-					name: "locked",
-					type: "checkbox",
-					label: "Locked",
+					name: "group",
+					type: "text",
+					label: "Group",
 					admin: { hidden: true }
 				},
 				{
-					name: "roles",
-					type: "json",
-					label: "Roles",
-					required: true
+					name: "released",
+					type: "checkbox",
+					label: "Released",
+					admin: { hidden: true }
 				}
 			]
 		}]
@@ -1539,80 +1108,6 @@ async function seedFeatures(payload, extras = []) {
 	});
 }
 //#endregion
-//#region src/features/access.ts
-function isAccessArgs(value) {
-	return typeof value === "object" && value !== null && "req" in value;
-}
-function fallbackFeature(user, slug, matrix) {
-	const pack = PACKAGE_FEATURES.find((feature) => feature.slug === slug);
-	if (!pack) return false;
-	return hasCapability(user, pack.fallback, matrix);
-}
-/**
-* True when any stored role is on the feature row. An empty grid falls
-* back to the capability map. Developer is always allowed.
-*/
-function hasFeature(user, slug, features = null, matrix = DEFAULT_ROLE_MATRIX) {
-	if (isDeveloper(user)) return true;
-	if (!user) return false;
-	if (!features || features.length === 0) return fallbackFeature(user, slug, matrix);
-	const row = features.find((entry) => entry.slug === slug);
-	if (!row) return false;
-	const allowed = row.roles ?? [];
-	return storedRoles(user).some((role) => allowed.includes(role));
-}
-/**
-* Reads the saved Features Global. `null` means empty or unreadable — callers
-* fall back to the capability map. Always override-access.
-*/
-async function getFeaturesMatrix(req = {}) {
-	const findGlobal = req.payload?.findGlobal;
-	if (typeof findGlobal !== "function") return null;
-	try {
-		const doc = await findGlobal({
-			slug: FEATURES_SLUG,
-			overrideAccess: true,
-			req
-		});
-		const parsed = parseFeaturesMatrix(doc && typeof doc === "object" && "features" in doc ? doc.features : void 0);
-		if (!parsed.ok) return null;
-		const matrix = await getRolesMatrix(req);
-		return enforceFeatureLocks(parsed.rows, matrix);
-	} catch {
-		return null;
-	}
-}
-/**
-* Access / nav helper for one catalogue slug. Sync against a passed grid;
-* async when given `req` so it can read both Globals.
-*/
-function canUseFeature(slug) {
-	function predicate(userOrArgs, features, roles) {
-		if (isAccessArgs(userOrArgs)) {
-			const user = userOrArgs.req.user;
-			if (features !== void 0) return hasFeature(user, slug, features, roles ?? DEFAULT_ROLE_MATRIX);
-			return Promise.all([getFeaturesMatrix(userOrArgs.req), getRolesMatrix(userOrArgs.req)]).then(([grid, matrix]) => hasFeature(user, slug, grid, matrix));
-		}
-		return hasFeature(userOrArgs, slug, features ?? null, roles ?? DEFAULT_ROLE_MATRIX);
-	}
-	return predicate;
-}
-/** `admin.hidden`: hide when the login cannot use the feature. */
-function hideUnlessFeature(slug) {
-	return (args) => {
-		const user = args.user;
-		if (args.req) {
-			const result = canUseFeature(slug)({ req: {
-				...args.req,
-				user
-			} });
-			if (result instanceof Promise) return result.then((ok) => !ok);
-			return !result;
-		}
-		return !canUseFeature(slug)(user ?? null);
-	};
-}
-//#endregion
 //#region src/fields/slug.ts
 /**
 * A stored slug from whatever was typed: lowercased, with any run of
@@ -1712,15 +1207,15 @@ function createPages({ heroBlocks, isReservedSlug, layoutBlocks, previewPath, pr
 				"_status",
 				"updatedAt"
 			],
-			hidden: hideUnlessFeature("pages"),
+			hidden: hideUnlessFeature("content"),
 			preview: (doc) => previewPath(typeof doc.slug === "string" ? doc.slug : ""),
 			...previewButton ? { components: { edit: { PreviewButton: previewButton } } } : {}
 		},
 		access: {
 			read: authenticatedOrPublished,
 			readVersions: isAuthenticated,
-			create: canUseFeature("pages"),
-			update: canUseFeature("pages"),
+			create: canUseFeature("content"),
+			update: canUseFeature("content"),
 			delete: isAdmin
 		},
 		versions: {
@@ -1791,7 +1286,7 @@ async function lockLastAdminDecision(req) {
 	});
 }
 function privilegedRoles(matrix) {
-	return matrix.filter((row) => row.users).map((row) => row.role);
+	return matrix.filter((row) => isPrivilegedRole(row.role, matrix)).map((row) => row.role);
 }
 function holdsPrivilegedRole(roles, matrix) {
 	return Array.isArray(roles) && roles.some((role) => isPrivilegedRole(role, matrix));
@@ -1847,13 +1342,16 @@ function createUsers({ secureCookies, rolesField, extras = [] }) {
 				"lastName",
 				"roles"
 			],
-			hidden: ({ user }) => !isAdmin(user)
+			hidden: hideUnlessFeature("users")
 		},
 		access: {
 			create: isAdmin,
 			delete: isAdmin,
 			unlock: isAdmin,
-			read: isAdminOrSelf,
+			read: async (args) => {
+				if (await Promise.resolve(canUseFeature("users")(args))) return true;
+				return isAdminOrSelf(args);
+			},
 			update: isAdminOrSelf
 		},
 		hooks: {
@@ -1972,6 +1470,6 @@ const adminOnlyApiTab = definePlugin({
 	})
 });
 //#endregion
-export { BRAND_ASSETS_MIME_TYPES, BRAND_ASSETS_SLUG, CAPABILITIES, DEFAULT_ROLE_MATRIX, DESCRIPTION_LENGTH, DEVELOPER_DESCRIPTION, DUPLICATE_ROLE_SLUG_MESSAGE, FEATURES_MATRIX_FIELD, FEATURES_SLUG, LAST_ADMIN_DELETE_MESSAGE, LAST_ADMIN_DEMOTE_MESSAGE, LAST_USERS_TICK_MESSAGE, LOCKED_FEATURE_MESSAGE, LOOK_FIELD, MISSING_PACKAGE_FEATURES_MESSAGE, MISSING_SEED_ROLES_MESSAGE, PACKAGE_FEATURES, PACKAGE_FEATURE_SLUGS, PAGE_EDITOR_SYSTEM_KEYS, ROLES, ROLES_FIELD, ROLES_FIELD_DESCRIPTION, ROLES_GLOBAL_DESCRIPTION, ROLES_MATRIX_FIELD, ROLES_ROW_LABEL, ROLES_SLUG, ROLE_LABELS, ROLE_SLUG_FIELD, SHARE_IMAGE_SIZE, SYSTEM_COLOR_KEYS, THEME_APPEARANCE_FIELD, THEME_APPEARANCE_SLUG, THEME_COLORS_SLUG, THEME_COLOR_FIELD, THEME_COLOR_SCALE_FIELD, THEME_CONTRAST_REPORT, THEME_DOCUMENT_CONTROLS, THEME_FONT_FIELD, THEME_GREY_SCALE_FIELD, THEME_IDENTITY_FALLBACK, THEME_IDENTITY_SLUG, THEME_LIBRARY_FIELD, THEME_PAIRING_FIELD, THEME_PREVIEW_BREAKPOINTS, THEME_PUBLISH_FIELD, THEME_SAVE_BUTTON, THEME_SECTION_HEADING, THEME_SLUG, THEME_TYPOGRAPHY_SLUG, adminOnlyApiTab, authenticatedOrPublished, canManageBrand, canManageContent, canPublish, canUseFeature, colorTokenField, createBrandAssets, createFeatures, createMedia, createPages, createRoles, createTheme, createUsers, defaultFeaturesFieldValue, defaultRolesFieldValue, deleteLibraryColor, documentTitle, featureCatalogue, findColorTokens, findColorUsages, firstImageIn, getFeaturesMatrix, getRolesMatrix, hasCapability, hasFeature, hasRole, hideUnlessFeature, isAdmin, isAdminOrSelf, isAuthenticated, isDeveloper, isDeveloperTab, isFeatureSlug, isLockedFeature, isPackageFeatureSlug, isPrivilegedRole, isRole, isRoleSlug, lookField, noIndexField, normalizeSlug, normalizeStoredRoles, pageEditorLooks, pageEditorTokens, parseFeaturesMatrix, parseRolesMatrix, persistThemeChild, publishThemeChild, resetRolesMatrix, resolveThemeIdentity, rewriteColorToken, rewriteColorTokens, rewriteColorUsages, roleDescription, roleLabel, roleSelectOptions, sanitizeSvg, seedFeatures, seedRoleRows, seedRoles, seedTheme, seoPlugin, slugField, storedRoles, themeColorKeys, themeLibraryFromDoc, titleTemplate, truncateAtWord, validateFeaturesMatrix, validateRolesMatrix };
+export { BRAND_ASSETS_MIME_TYPES, BRAND_ASSETS_SLUG, CAPABILITIES, CAPABILITY_FEATURES, DEFAULT_ROLE_GRANTS, DEFAULT_ROLE_MATRIX, DESCRIPTION_LENGTH, DEVELOPER_DESCRIPTION, DUPLICATE_ROLE_NAME_MESSAGE, DUPLICATE_ROLE_SLUG_MESSAGE, FEATURES_MATRIX_FIELD, FEATURES_SLUG, FEATURE_GROUPS, FEATURE_GROUP_LABELS, INVALID_ROLE_NAME_MESSAGE, LAST_ADMIN_DELETE_MESSAGE, LAST_ADMIN_DEMOTE_MESSAGE, LAST_USERS_TICK_MESSAGE, LOOK_FIELD, MISSING_PACKAGE_FEATURES_MESSAGE, MISSING_SEED_ROLES_MESSAGE, PACKAGE_FEATURES, PACKAGE_FEATURE_SLUGS, PAGE_EDITOR_SYSTEM_KEYS, ROLES, ROLES_FIELD, ROLES_FIELD_DESCRIPTION, ROLES_GLOBAL_DESCRIPTION, ROLES_GRANTS_FIELD, ROLES_MATRIX_FIELD, ROLES_ROW_LABEL, ROLES_SLUG, ROLE_LABELS, ROLE_NAME_FIELD, ROLE_SLUG_FIELD, SHARE_IMAGE_SIZE, SYSTEM_COLOR_KEYS, THEME_APPEARANCE_FIELD, THEME_APPEARANCE_SLUG, THEME_COLORS_SLUG, THEME_COLOR_FIELD, THEME_COLOR_SCALE_FIELD, THEME_CONTRAST_REPORT, THEME_DOCUMENT_CONTROLS, THEME_FEATURE_SLUGS, THEME_FONT_FIELD, THEME_GREY_SCALE_FIELD, THEME_IDENTITY_FALLBACK, THEME_IDENTITY_SLUG, THEME_LIBRARY_FIELD, THEME_PAIRING_FIELD, THEME_PREVIEW_BREAKPOINTS, THEME_PUBLISH_FIELD, THEME_SAVE_BUTTON, THEME_SECTION_HEADING, THEME_SLUG, THEME_TYPOGRAPHY_SLUG, adminOnlyApiTab, applyRoleSlugsFromNames, authenticatedOrPublished, canManageBrand, canManageContent, canPublish, canUseFeature, colorTokenField, createBrandAssets, createFeatures, createMedia, createPages, createRoles, createTheme, createUsers, defaultFeaturesFieldValue, defaultRolesFieldValue, deleteLibraryColor, documentTitle, featureCatalogue, featureGroupLabel, findColorTokens, findColorUsages, firstImageIn, getFeaturesMatrix, getRolesMatrix, hasCapability, hasFeature, hasGrant, hasRole, hideUnlessFeature, isAdmin, isAdminOrSelf, isAuthenticated, isDeveloper, isDeveloperTab, isFeatureGroupId, isFeatureSlug, isLockedFeature, isPackageFeatureSlug, isPrivilegedRole, isRole, isRoleName, isRoleSlug, lookField, noIndexField, normalizeSlug, normalizeStoredRoles, pageEditorLooks, pageEditorTokens, parseFeaturesMatrix, parseRolesMatrix, persistThemeChild, publishThemeChild, resetRolesMatrix, resolveThemeIdentity, rewriteColorToken, rewriteColorTokens, rewriteColorUsages, roleDescription, roleLabel, roleSelectOptions, sanitizeRoleNameInput, sanitizeSvg, seedFeatures, seedRoleRows, seedRoles, seedTheme, seoPlugin, slugField, slugifyRoleName, stampFeatureCatalogue, storedRoles, themeColorKeys, themeLibraryFromDoc, titleTemplate, truncateAtWord, validateFeaturesMatrix, validateRolesMatrix };
 
 //# sourceMappingURL=index.mjs.map