@bison-lab/payload-core 3.14.0 → 3.15.0

package/README.md

@@ -25,7 +25,7 @@ lockstep.
 | `@bison-lab/payload-core`          | `seoPlugin`, `createTheme`, `createBrandAssets`, `createRoles`, `createFeatures`, `createPages`, `createUsers`, `createMedia`, `adminOnlyApiTab`, `seedTheme`, `seedRoles`, `seedFeatures`, predicates, `lookField`, `colorTokenField`, import-map strings, title and text helpers, types | Node. What `payload.config.ts` imports; it loads the plugin. |
 | `@bison-lab/payload-core/metadata` | `pageMetadata`, the title helpers, the same types                                                | Server. What a page route imports; it does not load the plugin.            |
 | `@bison-lab/payload-core/theme`    | `getPublishedTheme`, `getPublishedIdentity`, `themeConfigFromDoc`, `themeHead`, `themeHeadFromDoc` | Server. What a root layout imports; it does not load the plugin or React.  |
-| `@bison-lab/payload-core/admin`    | Theme child fields, the Roles and Features matrices, and the Users Roles checklist               | Admin. Referenced by import-map string; `generate:importmap` writes it.    |
+| `@bison-lab/payload-core/admin`    | Theme fields, the Roles and Features matrices, and the Users Roles checklist                     | Admin. Referenced by import-map string; `generate:importmap` writes it.    |
 | `@bison-lab/payload-core/react`    | `ThemePreview` (legacy; Theme has no preview pane)                                               | Client. Kept so an older site import does not break.                       |
 
 ## What editors get
@@ -125,13 +125,13 @@ The sitemap is the site's: filter `meta.noIndex` out of it.
 
 ## Adopting the Theme global
 
-Theme in the admin nav is a group like Content and Settings: Colors,
-Typography, Appearance, and Identity. Those are ordinary Payload Globals
-(`admin.group: "Theme"`), not custom views. `createTheme` returns them plus
-a hidden store (`theme`) that `getPublishedTheme` already reads. Save on a
-page is Payload's Save; it writes that slice onto the store. Document
-locking is off — these are settings forms. Theme has no draft mode and
-no preview pane. Contrast is the automatic label on editable fills at 7:1; it
+Theme in the admin nav is one Global (`theme`) in `admin.group: "Theme"`.
+Colors, Typography, Appearance, and Identity are field tabs on that
+document, not custom views and not extra Globals. Save is Payload's Save
+on the whole form — every tab is hydrated from the live row, so an
+untouched tab does not revert. `getPublishedTheme` reads that same row.
+Document locking is off. Theme has no draft mode and no preview pane.
+Contrast is the automatic label on editable fills at 7:1; it
 is never enforced and lives in the Needs-attention modal, not on the page.
 `bison.config.json` is the seed a site starts from, not the source of truth.
 Pass `destructive` (or `seed.brandDestructive`); otherwise Theme uses the
@@ -194,7 +194,7 @@ or pass empty arrays, and every additional color is unused and deletes
 immediately. A new look surface is added to `colorUsages`, not copied
 into a site helper. Site adopt names the slugs (SPI-93).
 
-Then `payload generate:importmap` (the Theme child fields resolve from
+Then `payload generate:importmap` (the Theme fields resolve from
 `@bison-lab/payload-core/admin`), `payload generate:types`, and
 `payload migrate:create`.
 
@@ -284,33 +284,54 @@ createRoles({
 Settings → Features is a Developer-only release valve: one switch per
 catalogue row. Off hides the tick on Roles; Developer still has the
 feature. The catalogue is code, grouped for the UI: Pages (Content,
-Publish, API tab), Media, Theme (Colors, Typography, Appearance,
-Identity, Brand assets), and Users (Users, Roles). Features itself is
-not a row. A site may pass `extras` into `createFeatures` — those rows
-appear only there. `canUseFeature(slug)` is true when the row is
-released and a held role is granted it, or when the login is Developer.
-An empty Global falls back to the catalogue defaults. Group slugs
-`pages` and `theme` are true when any child is. `createPages` /
-`createMedia` use `canUseFeature` for create and update (and
-`admin.hidden`). Theme and brand-assets still take `access` arguments —
-pass `canUseFeature("theme")` / `canUseFeature("brand-assets")` as
-`update`.
+Publish), Media, Theme (Colors, Typography, Appearance, Identity, Brand
+assets), and Users (Users, Roles). Features itself is not a row. The
+document API tab and Better Editor overlay settings are not rows either
+— they stay code-locked to Developer (`adminOnlyApiTab`,
+`developerOnlyAccess` / `hideUnlessDeveloper`). A site may pass `extras`
+into `createFeatures` — those rows appear only there, including a
+future Navigation global:
 
 ```ts
 createFeatures({
-  extras: [{ slug: "doctors", label: "Doctor search", group: "users" }],
+  extras: [
+    { slug: "doctors", label: "Doctor search", group: "users" },
+    { slug: "navigation", label: "Navigation" },
+  ],
 });
+
+// On that Global:
+//   access: { update: canUseFeature("navigation") }
+// Drafts use the same Publish tick as Pages to go live.
 ```
 
+`canUseFeature(slug)` is true when the row is released and a held role
+is granted it, or when the login is Developer. An empty Global falls
+back to the catalogue defaults. Group slugs `pages` and `theme` are
+true when any child is. `createPages` / `createMedia` use
+`canUseFeature` for create and update (and `admin.hidden`). Theme and
+brand-assets still take `access` arguments — pass
+`canUseFeature("theme")` / `canUseFeature("brand-assets")` as `update`.
+`admin.hidden` is presentation; Access Control is enforcement. Nav
+hiding follows `user.allowedFeatures` on the JWT (computed at user
+read from the live Features and Roles Globals) so Payload's
+`admin.hidden({ user })` matches the API.
+
 ## Pages, users, and media
 
 `createPages`, `createUsers`, `createMedia`, `slugField`, and
 `adminOnlyApiTab` ship from the same React-free entry. Pages take the
 site's hero and layout blocks, reserved-slug predicate, and preview
-path. Users sit under Settings next to Roles, take `secureCookies`, and
-offer whatever rows the Global (or the seed plus the same `extras`) has.
-The checklist labels are the editable names. `adminOnlyApiTab` shows the
-document API tab only to Developer.
+path. Create follows the Content tick. Update without Publish is
+constrained to `_status: draft` — an Author can save a draft and cannot
+publish or edit a live page. Users sit under Settings next to Roles,
+take `secureCookies`, and offer whatever rows the Global (or the seed
+plus the same `extras`) has. `users.roles` and `users.allowedFeatures`
+set `saveToJWT: true`. The checklist labels are the editable names.
+`adminOnlyApiTab` shows the document API tab only to Developer. Overlay
+settings (Better Editor) take `developerOnlyAccess` and
+`hideUnlessDeveloper` on the site — the package does not add that
+plugin as a peer.
 
 ## No generated types
 

package/dist/admin.mjs

@@ -2546,12 +2546,6 @@ const PACKAGE_FEATURES = [
 		group: "pages",
 		defaultReleased: true
 	},
-	{
-		slug: "api-tab",
-		label: "API tab",
-		group: "pages",
-		defaultReleased: false
-	},
 	{
 		slug: "media",
 		label: "Media",
@@ -2609,7 +2603,7 @@ function isFeatureSlug(value) {
 }
 //#endregion
 //#region src/features/matrix.ts
-const MISSING_PACKAGE_FEATURES_MESSAGE = "Features must include Content, Publish, API tab, Media, Theme screens, Brand assets, Users, and Roles.";
+const MISSING_PACKAGE_FEATURES_MESSAGE = "Features must include Content, Publish, Media, Theme screens, Brand assets, Users, and Roles.";
 function featureCatalogue(extras = []) {
 	return [...PACKAGE_FEATURES.map((feature) => ({ ...feature })), ...extras.map((extra) => ({
 		slug: extra.slug,
@@ -2736,7 +2730,7 @@ function defaultGrantsForRole(role, extraGrants) {
 const ROLES_SLUG = "roles";
 /**
 * Default rank and grants. Developer is implicit (empty grants). Brand
-* screens default to Designer. The API tab is not granted until released.
+* screens default to Designer.
 */
 const DEFAULT_ROLE_MATRIX = ROLES.map((role) => ({
 	role,