@bison-lab/payload-core 3.14.0 → 3.16.0

package/dist/index.mjs

@@ -1,6 +1,5 @@
-import { $ as defaultFeaturesFieldValue, A as ROLES_SLUG, B as CAPABILITIES, C as DUPLICATE_ROLE_NAME_MESSAGE, D as MISSING_SEED_ROLES_MESSAGE, E as LAST_USERS_TICK_MESSAGE, F as resetRolesMatrix, G as THEME_FEATURE_SLUGS, H as DEFAULT_ROLE_GRANTS, I as roleDescription, J as isRoleSlug, K as isRole, L as roleSelectOptions, M as defaultRolesFieldValue, N as normalizeStoredRoles, O as ROLES_FIELD_DESCRIPTION, P as parseRolesMatrix, Q as MISSING_PACKAGE_FEATURES_MESSAGE, R as seedRoleRows, S as DEVELOPER_DESCRIPTION, T as INVALID_ROLE_NAME_MESSAGE, U as ROLES, V as CAPABILITY_FEATURES, W as ROLE_LABELS, X as sanitizeRoleNameInput, Y as roleLabel, Z as slugifyRoleName, _ as isDeveloper, a as hideUnlessFeature, at as FEATURES_SLUG, b as storedRoles, c as canManageContent, ct as PACKAGE_FEATURES, d as hasCapability, dt as isFeatureSlug, et as featureCatalogue, f as hasGrant, ft as isLockedFeature, g as isAuthenticated, h as isAdminOrSelf, i as hasFeature, it as validateFeaturesMatrix, j as applyRoleSlugsFromNames, k as ROLES_GLOBAL_DESCRIPTION, l as canPublish, lt as PACKAGE_FEATURE_SLUGS, m as isAdmin, n as canUseFeature, nt as parseFeaturesMatrix, o as authenticatedOrPublished, ot as FEATURE_GROUPS, p as hasRole, pt as isPackageFeatureSlug, q as isRoleName, r as getFeaturesMatrix, rt as stampFeatureCatalogue, s as canManageBrand, st as FEATURE_GROUP_LABELS, tt as featureGroupLabel, u as getRolesMatrix, ut as isFeatureGroupId, v as isDeveloperTab, w as DUPLICATE_ROLE_SLUG_MESSAGE, x as DEFAULT_ROLE_MATRIX, y as isPrivilegedRole, z as validateRolesMatrix } from "./access-B3LglN2J.mjs";
-import { n as documentTitle, r as titleTemplate, t as SHARE_IMAGE_SIZE } from "./share-image-BlFAJLnd.mjs";
-import { A as THEME_FONT_FIELD, C as validateThemeHex, D as THEME_COLOR_SCALE_FIELD, E as THEME_COLOR_FIELD, F as THEME_PUBLISH_FIELD, I as THEME_SAVE_BUTTON, L as THEME_SECTION_HEADING, M as THEME_IDENTITY_FALLBACK, N as THEME_LIBRARY_FIELD, O as THEME_CONTRAST_REPORT, P as THEME_PAIRING_FIELD, R as headingSelectValue, S as validateSourceIncluded, T as THEME_APPEARANCE_FIELD, _ as THEME_SLUG, a as pageEditorLooks, c as findColorTokens, d as rewriteColorToken, f as themeColorKeys, g as THEME_IDENTITY_SLUG, h as THEME_COLORS_SLUG, i as PAGE_EDITOR_SYSTEM_KEYS, j as THEME_GREY_SCALE_FIELD, k as THEME_DOCUMENT_CONTROLS, l as rewriteColorTokens, m as THEME_APPEARANCE_SLUG, n as colorTokenField, o as pageEditorTokens, p as SYSTEM_COLOR_KEYS, r as lookField, s as themeLibraryFromDoc, t as resolveThemeIdentity, u as deleteLibraryColor, v as THEME_TYPOGRAPHY_SLUG, w as LOOK_FIELD, x as themeConfigFromDoc, y as docFromConfig } from "./identity-Dwyq8519.mjs";
+import { n as documentTitle, r as titleTemplate, t as SHARE_IMAGE_SIZE } from "./share-image-C4ILz4p2.mjs";
+import { A as THEME_FONT_FIELD, C as validateThemeHex, D as THEME_COLOR_SCALE_FIELD, E as THEME_COLOR_FIELD, F as THEME_PUBLISH_FIELD, I as THEME_SAVE_BUTTON, L as THEME_SECTION_HEADING, M as THEME_IDENTITY_FALLBACK, N as THEME_LIBRARY_FIELD, O as THEME_CONTRAST_REPORT, P as THEME_PAIRING_FIELD, R as headingSelectValue, S as validateSourceIncluded, T as THEME_APPEARANCE_FIELD, _ as THEME_SLUG, a as pageEditorLooks, c as findColorTokens, d as rewriteColorToken, f as themeColorKeys, g as THEME_IDENTITY_SLUG, h as THEME_COLORS_SLUG, i as PAGE_EDITOR_SYSTEM_KEYS, j as THEME_GREY_SCALE_FIELD, k as THEME_DOCUMENT_CONTROLS, l as rewriteColorTokens, m as THEME_APPEARANCE_SLUG, n as colorTokenField, o as pageEditorTokens, p as SYSTEM_COLOR_KEYS, r as lookField, s as themeLibraryFromDoc, t as resolveThemeIdentity, u as deleteLibraryColor, v as THEME_TYPOGRAPHY_SLUG, w as LOOK_FIELD, x as themeConfigFromDoc, y as docFromConfig } from "./identity-LAzSeorC.mjs";
 import { seoPlugin as seoPlugin$1 } from "@payloadcms/plugin-seo";
 import { catalog } from "@bison-lab/fonts";
 import { DESTRUCTIVE_SCALE_HEX, SHADE_STEPS, presetHints } from "@bison-lab/tokens";
@@ -169,24 +168,20 @@ const APPEARANCE_CHOICES = {
 /** Theme-store REST path. LibraryField calls `/api/globals/theme` + this. */
 const COLOR_USAGES_PATH = "/color-usages";
 /**
-* Walk every current document in the named collections and globals
+* Walk every current document in the resolved collections and globals
 * (drafts included). A color only on an unpublished page is still in use.
 */
 async function findColorUsages(payload, scopes, key) {
+	const { collections, globals } = resolveScopes(payload, scopes);
 	const usages = [];
-	for (const collection of scopes?.collections ?? []) for await (const doc of eachCollectionDoc(payload, collection)) for (const hit of findColorTokens(doc, key)) usages.push({
+	for (const collection of collections) for await (const doc of eachCollectionDoc(payload, collection)) for (const hit of findColorTokens(doc, key)) usages.push({
 		collection,
 		id: idOf(doc),
 		path: hit.path,
 		token: hit.token
 	});
-	for (const slug of scopes?.globals ?? []) {
-		const doc = await payload.findGlobal({
-			slug,
-			draft: true,
-			depth: 0,
-			overrideAccess: true
-		});
+	for (const slug of globals) {
+		const doc = await readGlobal(payload, slug);
 		if (!doc) continue;
 		for (const hit of findColorTokens(doc, key)) usages.push({
 			global: slug,
@@ -197,7 +192,8 @@ async function findColorUsages(payload, scopes, key) {
 	return usages;
 }
 async function rewriteColorUsages(payload, scopes, fromKey, toKey) {
-	for (const collection of scopes?.collections ?? []) for await (const doc of eachCollectionDoc(payload, collection)) {
+	const { collections, globals } = resolveScopes(payload, scopes);
+	for (const collection of collections) for await (const doc of eachCollectionDoc(payload, collection)) {
 		if (findColorTokens(doc, fromKey).length === 0) continue;
 		const { id: _id, ...data } = rewriteColorTokens(doc, fromKey, toKey);
 		const id = idOf(doc);
@@ -210,13 +206,8 @@ async function rewriteColorUsages(payload, scopes, fromKey, toKey) {
 			overrideAccess: true
 		});
 	}
-	for (const slug of scopes?.globals ?? []) {
-		const doc = await payload.findGlobal({
-			slug,
-			draft: true,
-			depth: 0,
-			overrideAccess: true
-		});
+	for (const slug of globals) {
+		const doc = await readGlobal(payload, slug);
 		if (!doc || findColorTokens(doc, fromKey).length === 0) continue;
 		await payload.updateGlobal({
 			slug,
@@ -233,17 +224,52 @@ async function replacementKeys(payload, except) {
 		overrideAccess: true
 	})).map((look) => look.value).filter((key) => key !== except);
 }
-async function* eachCollectionDoc(payload, collection) {
-	let page = 1;
-	for (;;) {
-		const result = await payload.find({
-			collection,
+function resolveScopes(payload, scopes) {
+	if (scopes === true) return registeredScopes(payload);
+	return {
+		collections: scopes?.collections ?? [],
+		globals: scopes?.globals ?? []
+	};
+}
+function registeredScopes(payload) {
+	return {
+		collections: slugsOf(payload.config?.collections ?? payload.collections).filter((slug) => !slug.startsWith("payload-")),
+		globals: slugsOf(payload.config?.globals ?? payload.globals?.config).filter((slug) => slug !== THEME_SLUG)
+	};
+}
+function slugsOf(value) {
+	if (Array.isArray(value)) return value.map((item) => item?.slug).filter((slug) => Boolean(slug));
+	if (value && typeof value === "object") return Object.keys(value);
+	return [];
+}
+async function readGlobal(payload, slug) {
+	try {
+		return await payload.findGlobal({
+			slug,
 			draft: true,
 			depth: 0,
-			limit: 100,
-			page,
 			overrideAccess: true
 		});
+	} catch {
+		return null;
+	}
+}
+async function* eachCollectionDoc(payload, collection) {
+	let page = 1;
+	for (;;) {
+		let result;
+		try {
+			result = await payload.find({
+				collection,
+				draft: true,
+				depth: 0,
+				limit: 100,
+				page,
+				overrideAccess: true
+			});
+		} catch {
+			return;
+		}
 		for (const doc of result.docs) yield doc;
 		const totalPages = result.totalPages ?? (result.docs.length < 100 ? page : page + 1);
 		if (page >= totalPages || result.docs.length === 0) break;
@@ -304,75 +330,664 @@ async function readJson(req) {
 	return null;
 }
 //#endregion
-//#region src/theme/publish.ts
+//#region src/features/types.ts
+const FEATURES_SLUG = "features";
+const FEATURE_GROUPS = [
+	"pages",
+	"media",
+	"theme",
+	"users"
+];
+const FEATURE_GROUP_LABELS = {
+	pages: "Pages",
+	media: "Media",
+	theme: "Theme",
+	users: "Users"
+};
+const PACKAGE_FEATURE_SLUGS = [
+	"content",
+	"publish",
+	"media",
+	"theme-colors",
+	"theme-typography",
+	"theme-appearance",
+	"theme-identity",
+	"brand-assets",
+	"users",
+	"roles"
+];
 /**
-* Publishing a child writes that slice only. Other responsibilities stay
-* as they already are on the stored document. Unsaved form state on a
-* different child never goes live. A first save (no stored row) still
-* writes only the named child; `getPublishedTheme` fills the rest from
-* the seed.
+* Package catalogue. Features itself is not a row — that screen is
+* Developer-only in code. Empty Global falls back to these defaults.
 */
-function publishThemeChild(stored, incoming, child) {
-	if (child === "colors") return {
-		...stored,
-		colors: incoming.colors
+const PACKAGE_FEATURES = [
+	{
+		slug: "content",
+		label: "Content",
+		group: "pages",
+		defaultReleased: true
+	},
+	{
+		slug: "publish",
+		label: "Publish",
+		group: "pages",
+		defaultReleased: true
+	},
+	{
+		slug: "media",
+		label: "Media",
+		group: "media",
+		defaultReleased: true
+	},
+	{
+		slug: "theme-colors",
+		label: "Colors",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "theme-typography",
+		label: "Typography",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "theme-appearance",
+		label: "Appearance",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "theme-identity",
+		label: "Identity",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "brand-assets",
+		label: "Brand assets",
+		group: "theme",
+		defaultReleased: true
+	},
+	{
+		slug: "users",
+		label: "Users",
+		group: "users",
+		defaultReleased: true
+	},
+	{
+		slug: "roles",
+		label: "Roles",
+		group: "users",
+		defaultReleased: true
+	}
+];
+function isFeatureGroupId(value) {
+	return typeof value === "string" && FEATURE_GROUPS.includes(value);
+}
+function isPackageFeatureSlug(value) {
+	return typeof value === "string" && PACKAGE_FEATURE_SLUGS.includes(value);
+}
+function isFeatureSlug(value) {
+	return typeof value === "string" && /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(value);
+}
+/** @deprecated Locks are gone; the release switch is the valve. */
+function isLockedFeature(_slug, _locked) {
+	return false;
+}
+//#endregion
+//#region src/features/matrix.ts
+const MISSING_PACKAGE_FEATURES_MESSAGE = "Features must include Content, Publish, Media, Theme screens, Brand assets, Users, and Roles.";
+function featureCatalogue(extras = []) {
+	return [...PACKAGE_FEATURES.map((feature) => ({ ...feature })), ...extras.map((extra) => ({
+		slug: extra.slug,
+		label: extra.label,
+		group: extra.group ?? "users",
+		defaultReleased: extra.defaultReleased ?? false
+	}))];
+}
+function defaultFeaturesFieldValue(extras = []) {
+	return featureCatalogue(extras).map((feature) => ({
+		id: feature.slug,
+		slug: feature.slug,
+		label: feature.label,
+		group: feature.group,
+		released: feature.defaultReleased
+	}));
+}
+function stampFeatureCatalogue(value, extras = []) {
+	const bySlug = new Map(featureCatalogue(extras).map((feature) => [feature.slug, feature]));
+	if (!Array.isArray(value)) return defaultFeaturesFieldValue(extras);
+	return value.flatMap((item) => {
+		if (!item || typeof item !== "object") return [];
+		const slug = "slug" in item && typeof item.slug === "string" ? item.slug : "";
+		const feature = bySlug.get(slug);
+		if (!feature) return [];
+		return [{
+			id: feature.slug,
+			slug: feature.slug,
+			label: feature.label,
+			group: feature.group,
+			released: Boolean("released" in item && item.released)
+		}];
+	});
+}
+function parseFeaturesMatrix(value) {
+	if (!Array.isArray(value) || value.length === 0) return {
+		ok: false,
+		message: MISSING_PACKAGE_FEATURES_MESSAGE
 	};
-	if (child === "typography") return {
-		...stored,
-		typography: incoming.typography
+	const rows = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const slug = "slug" in item ? item.slug : void 0;
+		if (!isFeatureSlug(slug) || seen.has(slug)) continue;
+		seen.add(slug);
+		const pack = PACKAGE_FEATURES.find((feature) => feature.slug === slug);
+		const label = "label" in item && typeof item.label === "string" ? item.label : pack?.label ?? slug;
+		const group = "group" in item && isFeatureGroupId(item.group) ? item.group : pack?.group ?? "users";
+		rows.push({
+			id: slug,
+			slug,
+			label,
+			group,
+			released: Boolean("released" in item && item.released)
+		});
+	}
+	if (PACKAGE_FEATURES.some((feature) => !seen.has(feature.slug))) return {
+		ok: false,
+		message: MISSING_PACKAGE_FEATURES_MESSAGE
 	};
-	if (child === "appearance") return {
-		...stored,
-		appearance: incoming.appearance
+	return {
+		ok: true,
+		rows
 	};
+}
+function validateFeaturesMatrix(value, extras = []) {
+	const parsed = parseFeaturesMatrix(value);
+	if (!parsed.ok) return parsed.message;
+	const allowed = new Set(featureCatalogue(extras).map((feature) => feature.slug));
+	if (parsed.rows.some((row) => !allowed.has(row.slug))) return MISSING_PACKAGE_FEATURES_MESSAGE;
+	return true;
+}
+function featureGroupLabel(group) {
+	return isFeatureGroupId(group) ? FEATURE_GROUP_LABELS[group] : group;
+}
+function packageFeatureLabel(slug, extras = []) {
+	const pack = PACKAGE_FEATURES.find((feature) => feature.slug === slug);
+	if (pack) return pack.label;
+	return extras.find((feature) => feature.slug === slug)?.label ?? slug;
+}
+function isGroupOnlySlug(slug) {
+	return isFeatureGroupId(slug) && !PACKAGE_FEATURES.some((feature) => feature.slug === slug);
+}
+//#endregion
+//#region src/roles/types.ts
+/**
+* The Roles Global a site's generated types will describe. Optional and
+* nullable, no index signature: a generated Global is assignable to this,
+* never the reverse.
+*/
+const ROLES = [
+	"developer",
+	"admin",
+	"designer",
+	"author"
+];
+const ROLE_LABELS = {
+	developer: "Developer",
+	admin: "Admin",
+	designer: "Designer",
+	author: "Author"
+};
+/** Capability aliases over feature grants. Brand is any Theme-group leaf. */
+const CAPABILITIES = [
+	"content",
+	"brand",
+	"publish",
+	"users"
+];
+const THEME_FEATURE_SLUGS = [
+	"theme-colors",
+	"theme-typography",
+	"theme-appearance",
+	"theme-identity",
+	"brand-assets"
+];
+const CAPABILITY_FEATURES = {
+	content: ["content"],
+	publish: ["publish"],
+	users: ["users"],
+	brand: THEME_FEATURE_SLUGS
+};
+const DEFAULT_ROLE_GRANTS = {
+	developer: [],
+	admin: [
+		"content",
+		"publish",
+		"media",
+		"users",
+		"roles"
+	],
+	designer: [
+		"content",
+		"media",
+		...THEME_FEATURE_SLUGS,
+		"users",
+		"roles"
+	],
+	author: ["content", "media"]
+};
+function isRole(value) {
+	return typeof value === "string" && ROLES.includes(value);
+}
+/** Lowercase slug from a letters-and-spaces name: `designer`, `the-designer`. */
+function isRoleSlug(value) {
+	return typeof value === "string" && /^[a-z]+(-[a-z]+)*$/.test(value);
+}
+/** Display name: letters and single spaces only. `The Greatest Designer`. */
+function isRoleName(value) {
+	return typeof value === "string" && /^[A-Za-z]+(?: [A-Za-z]+)*$/.test(value.trim());
+}
+/** Strip digits and punctuation as the name is typed. Trailing space stays. */
+function sanitizeRoleNameInput(value) {
+	return value.replace(/[^A-Za-z ]/g, "").replace(/ {2,}/g, " ");
+}
+/** Name → stored key. `The Greatest Designer` → `the-greatest-designer`. */
+function slugifyRoleName(value) {
+	if (typeof value !== "string") return "";
+	return value.trim().toLowerCase().replace(/[^a-z]+/g, "-").replace(/^-|-$/g, "");
+}
+function roleLabel(role, label) {
+	const trimmed = typeof label === "string" ? label.trim() : "";
+	if (trimmed) return trimmed;
+	return isRole(role) ? ROLE_LABELS[role] : role;
+}
+function defaultGrantsForRole(role, extraGrants) {
+	if (isRole(role)) return [...DEFAULT_ROLE_GRANTS[role]];
+	return extraGrants ? [...extraGrants] : [];
+}
+//#endregion
+//#region src/roles/matrix.ts
+const ROLES_SLUG = "roles";
+const ROLES_GLOBAL_DESCRIPTION = "Who may do what. Drag to change rank.";
+const ROLES_FIELD_DESCRIPTION = "Drag to change rank. Ticks are features released on Features. Developer has the whole catalogue.";
+/**
+* Default rank and grants. Developer is implicit (empty grants). Brand
+* screens default to Designer.
+*/
+const DEFAULT_ROLE_MATRIX = ROLES.map((role) => ({
+	role,
+	grants: defaultGrantsForRole(role)
+}));
+const DEVELOPER_DESCRIPTION = "Everything, including features not released for assignment.";
+const LAST_USERS_TICK_MESSAGE = "Keep Users granted on at least one of Admin or Developer.";
+const MISSING_SEED_ROLES_MESSAGE = "Roles must include Developer, Admin, Designer, and Author.";
+const DUPLICATE_ROLE_SLUG_MESSAGE = "Each role needs a unique slug.";
+const DUPLICATE_ROLE_NAME_MESSAGE = "Each role needs a unique name.";
+const INVALID_ROLE_NAME_MESSAGE = "Use letters and spaces only.";
+function uniqueSlugs(values) {
+	const slugs = [];
+	for (const value of values) if (typeof value === "string" && isFeatureSlug(value) && !slugs.includes(value)) slugs.push(value);
+	return slugs;
+}
+/** Read stored grants, or rebuild them from the old capability ticks. */
+function grantsFromStoredRole(item) {
+	if ("grants" in item && Array.isArray(item.grants)) return uniqueSlugs(item.grants);
+	const grants = [];
+	if ("content" in item && item.content) grants.push("content", "media");
+	if ("publish" in item && item.publish) grants.push("publish");
+	if ("users" in item && item.users) grants.push("users", "roles");
+	if ("brand" in item && item.brand) grants.push(...THEME_FEATURE_SLUGS);
+	return uniqueSlugs(grants);
+}
+function seedRoleRows(extras = []) {
+	return [...DEFAULT_ROLE_MATRIX.map((row) => ({
+		...row,
+		grants: [...row.grants],
+		label: isRole(row.role) ? ROLE_LABELS[row.role] : row.role
+	})), ...extras.map((extra) => ({
+		role: extra.role,
+		label: extra.label,
+		grants: extra.grants ? [...extra.grants] : []
+	}))];
+}
+function defaultRolesFieldValue(extras = []) {
+	return seedRoleRows(extras).map((row) => ({
+		id: row.role,
+		...row
+	}));
+}
+function readRoleRow(item) {
+	const role = "role" in item ? item.role : void 0;
+	if (typeof role !== "string" || role.trim() === "") return { error: DUPLICATE_ROLE_SLUG_MESSAGE };
+	if (!isRoleSlug(role)) return { error: DUPLICATE_ROLE_SLUG_MESSAGE };
 	return {
-		...stored,
-		logo: incoming.logo,
-		favicon: incoming.favicon,
-		logoMark: incoming.logoMark
+		id: role,
+		role,
+		label: roleLabel(role, "label" in item && typeof item.label === "string" ? item.label : void 0),
+		grants: grantsFromStoredRole(item)
 	};
 }
-function sliceFromTheme(theme, child) {
-	if (child === "colors") return { colors: theme.colors };
-	if (child === "typography") return { typography: theme.typography };
-	if (child === "appearance") return { appearance: theme.appearance };
+function parseRolesMatrix(value) {
+	if (!Array.isArray(value)) return {
+		ok: false,
+		message: MISSING_SEED_ROLES_MESSAGE
+	};
+	const rows = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const role = "role" in item ? item.role : void 0;
+		if (typeof role !== "string" || role.trim() === "") continue;
+		const parsed = readRoleRow(item);
+		if ("error" in parsed) return {
+			ok: false,
+			message: parsed.error
+		};
+		if (seen.has(parsed.role)) return {
+			ok: false,
+			message: DUPLICATE_ROLE_SLUG_MESSAGE
+		};
+		seen.add(parsed.role);
+		rows.push(parsed);
+	}
+	if (ROLES.some((role) => !seen.has(role))) return {
+		ok: false,
+		message: MISSING_SEED_ROLES_MESSAGE
+	};
 	return {
-		logo: theme.logo,
-		favicon: theme.favicon,
-		logoMark: theme.logoMark
+		ok: true,
+		rows
 	};
 }
-function colorHex(color) {
-	if (typeof color === "string") return color;
-	return color?.hex ?? void 0;
+function roleHasGrant(row, slug) {
+	if (row.role === "developer") return true;
+	return row.grants.includes(slug);
+}
+function roleHasCapability(row, capability) {
+	if (row.role === "developer") return true;
+	return CAPABILITY_FEATURES[capability].some((slug) => row.grants.includes(slug));
 }
 /**
-* A Theme page is a real Global. Hydrate from the store only when this
-* page has never been saved — otherwise afterRead would overwrite the form.
+* Mint a slug from the name only when the row has none yet. An existing
+* key — seed or custom — stays put so a rename cannot orphan users.
 */
-function hasThemeSlice(doc, child) {
-	if (!doc) return false;
-	if (child === "colors") return Boolean(colorHex(doc.colors?.brand?.primary));
-	if (child === "typography") return Boolean(doc.typography?.body);
-	if (child === "appearance") return Boolean(doc.appearance?.radius);
-	return Boolean(doc.logo || doc.favicon || doc.logoMark);
+function applyRoleSlugsFromNames(value) {
+	if (!Array.isArray(value)) return value;
+	return value.map((item) => {
+		if (!item || typeof item !== "object") return item;
+		const row = item;
+		if (isRoleSlug(row.role)) return item;
+		const slug = slugifyRoleName(row.label);
+		return isRoleSlug(slug) ? {
+			...row,
+			role: slug
+		} : item;
+	});
+}
+function hasDuplicateRoleNames(value) {
+	if (!Array.isArray(value)) return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const role = "role" in item && typeof item.role === "string" ? item.role : "";
+		const name = ("label" in item && typeof item.label === "string" ? item.label : "").trim() || (isRole(role) ? ROLE_LABELS[role] : "");
+		if (!name) continue;
+		const key = name.toLowerCase();
+		if (seen.has(key)) return true;
+		seen.add(key);
+	}
+	return false;
+}
+function hasInvalidRoleName(value) {
+	if (!Array.isArray(value)) return false;
+	for (const item of value) {
+		if (!item || typeof item !== "object") continue;
+		const label = "label" in item && typeof item.label === "string" ? item.label.trim() : "";
+		if (!label) continue;
+		if (!isRoleName(label)) return true;
+	}
+	return false;
+}
+function validateRolesMatrix(value) {
+	if (hasDuplicateRoleNames(value)) return DUPLICATE_ROLE_NAME_MESSAGE;
+	if (hasInvalidRoleName(value)) return INVALID_ROLE_NAME_MESSAGE;
+	const parsed = parseRolesMatrix(applyRoleSlugsFromNames(value));
+	if (!parsed.ok) return parsed.message;
+	return true;
 }
 /**
-* Save on a Theme page writes that slice onto the hidden `theme` row.
-* Other children stay as stored.
+* Developer is exclusive. Admin does not swallow Designer: both store.
+* Unknown slugs (dropped catalogue keys such as `approver`) fall away unless
+* they appear on the matrix.
 */
-async function persistThemeChild(payload, incoming, child) {
-	const next = publishThemeChild(await payload.findGlobal({
-		slug: "theme",
-		draft: false,
-		overrideAccess: true
-	}) ?? {}, incoming, child);
-	await payload.updateGlobal({
-		slug: THEME_SLUG,
-		data: next,
-		draft: false
+function normalizeStoredRoles(value, matrix = DEFAULT_ROLE_MATRIX) {
+	if (!Array.isArray(value)) return [];
+	const allowed = new Set(matrix.map((row) => row.role));
+	const roles = [...new Set(value.filter((entry) => typeof entry === "string" && allowed.has(entry)))];
+	if (roles.includes("developer")) return ["developer"];
+	return roles;
+}
+function roleSelectOptions(matrix = DEFAULT_ROLE_MATRIX) {
+	return matrix.map((row) => ({
+		label: roleLabel(row.role, row.label),
+		value: row.role
+	}));
+}
+/** Grant copy only. Developer names the unreleased catalogue; nothing about MCP or seed. */
+function roleDescription(role, matrix = DEFAULT_ROLE_MATRIX) {
+	if (role === "developer") return DEVELOPER_DESCRIPTION;
+	const row = matrix.find((entry) => entry.role === role);
+	if (!row) return "No capabilities";
+	return row.grants.map((slug) => packageFeatureLabel(slug)).join(", ") || "No capabilities";
+}
+/**
+* Seed grants and package labels come back; extra rows stay as they are.
+*/
+function resetRolesMatrix(current) {
+	const extras = [];
+	if (Array.isArray(current)) for (const item of current) {
+		if (!item || typeof item !== "object") continue;
+		const parsed = readRoleRow(item);
+		if ("error" in parsed || isRole(parsed.role)) continue;
+		extras.push(parsed);
+	}
+	return [...defaultRolesFieldValue(), ...extras];
+}
+//#endregion
+//#region src/roles/access.ts
+function isAccessArgs$1(value) {
+	return typeof value === "object" && value !== null && "req" in value;
+}
+function storedRoles(user) {
+	return Array.isArray(user?.roles) ? user.roles : [];
+}
+function hasRole(user, role) {
+	return storedRoles(user).includes(role);
+}
+/** Not a tick. True only when `developer` is stored on the row. */
+function isDeveloper(user) {
+	return hasRole(user, "developer");
+}
+function hasCapability(user, capability, matrix = DEFAULT_ROLE_MATRIX) {
+	if (isDeveloper(user)) return true;
+	return storedRoles(user).some((role) => {
+		const row = matrix.find((entry) => entry.role === role);
+		return row ? roleHasCapability(row, capability) : false;
 	});
-	return next;
+}
+function hasGrant(user, slug, matrix = DEFAULT_ROLE_MATRIX) {
+	if (isDeveloper(user)) return true;
+	return storedRoles(user).some((role) => {
+		const row = matrix.find((entry) => entry.role === role);
+		return row ? roleHasGrant(row, slug) : false;
+	});
+}
+/**
+* Reads the saved Roles Global, falling back to the seed when the row is
+* empty, missing, or unreadable. Always override-access so a Designer
+* evaluating Theme does not have to read Settings → Roles.
+*/
+async function getRolesMatrix(req = {}, extras = []) {
+	const fallback = seedRoleRows(extras);
+	const findGlobal = req.payload?.findGlobal;
+	if (typeof findGlobal !== "function") return fallback;
+	try {
+		const doc = await findGlobal({
+			slug: ROLES_SLUG,
+			overrideAccess: true,
+			req
+		});
+		const parsed = parseRolesMatrix(doc && typeof doc === "object" && "roles" in doc ? doc.roles : void 0);
+		return parsed.ok ? parsed.rows : fallback;
+	} catch {
+		return fallback;
+	}
+}
+function capabilityPredicate(capability) {
+	function predicate(userOrArgs, matrix) {
+		if (isAccessArgs$1(userOrArgs)) {
+			const user = userOrArgs.req.user;
+			if (matrix) return hasCapability(user, capability, matrix);
+			return getRolesMatrix(userOrArgs.req).then((rows) => hasCapability(user, capability, rows));
+		}
+		return hasCapability(userOrArgs, capability, matrix ?? DEFAULT_ROLE_MATRIX);
+	}
+	return predicate;
+}
+const canManageContent = capabilityPredicate("content");
+const canManageBrand = capabilityPredicate("brand");
+const canPublish = capabilityPredicate("publish");
+/** Users grant on any held role (Developer is implicit). */
+const isAdmin = capabilityPredicate("users");
+/** This role id currently has the Users grant, or is Developer. */
+function isPrivilegedRole(role, matrix = DEFAULT_ROLE_MATRIX) {
+	if (typeof role !== "string") return false;
+	if (role === "developer") return true;
+	const row = matrix.find((entry) => entry.role === role);
+	return row ? roleHasGrant(row, "users") : false;
+}
+function isAuthenticated(userOrArgs) {
+	if (isAccessArgs$1(userOrArgs)) return Boolean(userOrArgs.req.user);
+	return Boolean(userOrArgs);
+}
+const isAdminOrSelf = async ({ req }) => {
+	if (!req.user) return false;
+	if (await isAdmin({ req })) return true;
+	return { id: { equals: req.user.id } };
+};
+const authenticatedOrPublished = ({ req: { user } }) => {
+	if (isAuthenticated(user)) return true;
+	return { _status: { equals: "published" } };
+};
+/**
+* API tab condition. Code-locked to the `developer` slug — not a Features
+* row and not a Role tick a client can grant.
+*/
+function isDeveloperTab({ req }) {
+	return isDeveloper(req.user);
+}
+/** Access for chrome globals (Features, Better Editor settings). */
+function developerOnlyAccess() {
+	return {
+		read: ({ req }) => isDeveloper(req.user),
+		update: ({ req }) => isDeveloper(req.user)
+	};
+}
+/** `admin.hidden`: hide unless the login is Developer. */
+function hideUnlessDeveloper({ user }) {
+	return !isDeveloper(user);
+}
+//#endregion
+//#region src/features/access.ts
+function isAccessArgs(value) {
+	return typeof value === "object" && value !== null && "req" in value;
+}
+function grantedOnReleased(user, slug, row, matrix) {
+	if (!row.released) return false;
+	return hasGrant(user, slug, matrix);
+}
+/**
+* True when the feature is released and a held role is granted it.
+* Developer is always allowed. An empty Global falls back to catalogue
+* defaults. A group slug (`pages`, `theme`) is true when any child is.
+*/
+function hasFeature(user, slug, features = null, matrix = DEFAULT_ROLE_MATRIX) {
+	if (isDeveloper(user)) return true;
+	if (!user) return false;
+	const rows = features && features.length > 0 ? features : defaultFeaturesFieldValue();
+	const leaf = rows.find((entry) => entry.slug === slug);
+	if (leaf) return grantedOnReleased(user, slug, leaf, matrix);
+	if (!isGroupOnlySlug(slug)) return false;
+	return rows.some((entry) => entry.group === slug && grantedOnReleased(user, entry.slug, entry, matrix));
+}
+/**
+* Reads the saved Features Global. `null` means empty or unreadable — callers
+* fall back to catalogue defaults. Always override-access.
+*/
+async function getFeaturesMatrix(req = {}) {
+	const findGlobal = req.payload?.findGlobal;
+	if (typeof findGlobal !== "function") return null;
+	try {
+		const doc = await findGlobal({
+			slug: FEATURES_SLUG,
+			overrideAccess: true,
+			req
+		});
+		const parsed = parseFeaturesMatrix(doc && typeof doc === "object" && "features" in doc ? doc.features : void 0);
+		return parsed.ok ? parsed.rows : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Access / nav helper for one catalogue slug. Sync against a passed grid;
+* async when given `req` so it can read both Globals.
+*/
+function canUseFeature(slug) {
+	function predicate(userOrArgs, features, roles) {
+		if (isAccessArgs(userOrArgs)) {
+			const user = userOrArgs.req.user;
+			if (features !== void 0) return hasFeature(user, slug, features, roles ?? DEFAULT_ROLE_MATRIX);
+			return Promise.all([getFeaturesMatrix(userOrArgs.req), getRolesMatrix(userOrArgs.req)]).then(([grid, matrix]) => hasFeature(user, slug, grid, matrix));
+		}
+		return hasFeature(userOrArgs, slug, features ?? null, roles ?? DEFAULT_ROLE_MATRIX);
+	}
+	return predicate;
+}
+/**
+* Feature slugs (and group slugs) this login may use. Written onto the
+* user at afterRead so `admin.hidden({ user })` can follow the saved
+* Features and Roles Globals without a `req`.
+*/
+async function allowedFeaturesForUser(user, req = {}) {
+	const [features, roles] = await Promise.all([getFeaturesMatrix(req), getRolesMatrix(req)]);
+	return [...(features && features.length > 0 ? features : defaultFeaturesFieldValue()).map((row) => row.slug), ...FEATURE_GROUPS].filter((slug) => hasFeature(user, slug, features, roles));
+}
+function userHasAllowedFeature(user, slug) {
+	if (isDeveloper(user)) return true;
+	const allowed = user?.allowedFeatures;
+	if (!Array.isArray(allowed)) return false;
+	return allowed.includes(slug);
+}
+/** `admin.hidden`: hide when the login cannot use the feature. */
+function hideUnlessFeature(slug) {
+	return (args) => {
+		const user = args.user ?? null;
+		if (isDeveloper(user)) return false;
+		if (user && Array.isArray(user.allowedFeatures)) return !userHasAllowedFeature(user, slug);
+		if (args.req) {
+			const result = canUseFeature(slug)({ req: {
+				...args.req,
+				user
+			} });
+			if (result instanceof Promise) return result.then((ok) => !ok);
+			return !result;
+		}
+		return !canUseFeature(slug)(user);
+	};
 }
 //#endregion
 //#region src/theme/global.ts
@@ -677,35 +1292,11 @@ function identityFields(collection) {
 		}
 	];
 }
-function pageHooks(child) {
-	return {
-		beforeChange: [async ({ data, req }) => {
-			if (req?.payload) await persistThemeChild(req.payload, data, child);
-			return data;
-		}],
-		afterRead: [async ({ doc, req }) => {
-			if (hasThemeSlice(doc, child)) return doc;
-			const theme = await req?.payload?.findGlobal({
-				slug: THEME_SLUG,
-				draft: false,
-				depth: child === "identity" ? 1 : 0,
-				overrideAccess: true
-			});
-			if (!theme) return doc;
-			return {
-				...doc,
-				...sliceFromTheme(theme, child)
-			};
-		}]
-	};
-}
 /**
-* Standard Payload Globals in an `admin.group: "Theme"` nav section —
-* the same pattern as Content and Settings. Each page is its own Global
-* (Save, fields, access). A hidden `theme` store is the published read
-* model `getPublishedTheme` already knows. Locking is off: these are
-* settings forms, not collaborative documents. No draft mode, no preview
-* pane.
+* One Theme Global. Colors, Typography, Appearance, and Identity are
+* tabs on that document. Save writes the whole form — Payload hydrates
+* every tab from the live row, so an untouched tab does not revert.
+* Locking is off. No draft mode, no preview pane.
 */
 function createTheme(options) {
 	const access = requireAccess$1(options);
@@ -720,59 +1311,49 @@ function createTheme(options) {
 	const typeFields = typographyFields(seed, fonts, fontsBaseUrl);
 	const lookFields = appearanceFields(seed);
 	const markFields = logo ? identityFields(logo.collection) : [];
-	const store = {
+	return [{
 		slug: THEME_SLUG,
 		label: "Theme",
 		lockDocuments: false,
 		admin: {
-			hidden: true,
+			group: "Theme",
+			hidden: hideUnlessFeature("theme"),
 			hideAPIURL: true,
-			custom: adminCustom
+			custom: adminCustom,
+			components: { elements: { beforeDocumentControls: [THEME_DOCUMENT_CONTROLS] } }
 		},
 		access: {
 			read: access.read,
 			update: access.update
 		},
-		fields: [
-			...colorFields,
-			...typeFields,
-			...lookFields,
-			...markFields
-		],
+		fields: [{
+			type: "tabs",
+			tabs: [
+				{
+					label: "Colors",
+					fields: colorFields
+				},
+				{
+					label: "Typography",
+					fields: typeFields
+				},
+				{
+					label: "Appearance",
+					fields: lookFields
+				},
+				...logo ? [{
+					label: "Identity",
+					fields: markFields
+				}] : []
+			]
+		}],
 		endpoints: colorUsageEndpoints(access, colorUsages),
 		hooks: { afterChange: [async ({ doc }) => {
 			if (!onPublish) return;
 			const themeDoc = doc;
 			await onPublish(themeConfigFromDoc(themeDoc, seed), themeDoc);
 		}] }
-	};
-	function page(slug, label, child, fields, preview) {
-		return {
-			slug,
-			label,
-			lockDocuments: false,
-			admin: {
-				group: "Theme",
-				hidden: hideUnlessFeature("theme"),
-				hideAPIURL: true,
-				custom: adminCustom,
-				components: preview ? { elements: { beforeDocumentControls: [THEME_DOCUMENT_CONTROLS] } } : void 0
-			},
-			access: {
-				read: access.read,
-				update: access.update
-			},
-			fields,
-			hooks: pageHooks(child)
-		};
-	}
-	return [
-		store,
-		page(THEME_COLORS_SLUG, "Colors", "colors", colorFields, true),
-		page(THEME_TYPOGRAPHY_SLUG, "Typography", "typography", typeFields, true),
-		page(THEME_APPEARANCE_SLUG, "Appearance", "appearance", lookFields, true),
-		...logo ? [page(THEME_IDENTITY_SLUG, "Identity", "identity", markFields, false)] : []
-	];
+	}];
 }
 //#endregion
 //#region src/brand-assets/sanitize.ts
@@ -840,6 +1421,7 @@ function createBrandAssets(options) {
 		admin: {
 			group: "Settings",
 			useAsTitle: "label",
+			hidden: hideUnlessFeature("brand-assets"),
 			description: "Logo, favicon, and mobile-menu mark. SVG preferred; PNG and ICO allowed."
 		},
 		upload: {
@@ -921,6 +1503,52 @@ const THEME_PREVIEW_BREAKPOINTS = [
 	}
 ];
 //#endregion
+//#region src/theme/publish.ts
+/**
+* Publishing a child writes that slice only. Other responsibilities stay
+* as they already are on the stored document. Unsaved form state on a
+* different child never goes live. A first save (no stored row) still
+* writes only the named child; `getPublishedTheme` fills the rest from
+* the seed.
+*/
+function publishThemeChild(stored, incoming, child) {
+	if (child === "colors") return {
+		...stored,
+		colors: incoming.colors
+	};
+	if (child === "typography") return {
+		...stored,
+		typography: incoming.typography
+	};
+	if (child === "appearance") return {
+		...stored,
+		appearance: incoming.appearance
+	};
+	return {
+		...stored,
+		logo: incoming.logo,
+		favicon: incoming.favicon,
+		logoMark: incoming.logoMark
+	};
+}
+/**
+* Save on a Theme page writes that slice onto the hidden `theme` row.
+* Other children stay as stored.
+*/
+async function persistThemeChild(payload, incoming, child) {
+	const next = publishThemeChild(await payload.findGlobal({
+		slug: "theme",
+		draft: false,
+		overrideAccess: true
+	}) ?? {}, incoming, child);
+	await payload.updateGlobal({
+		slug: THEME_SLUG,
+		data: next,
+		draft: false
+	});
+	return next;
+}
+//#endregion
 //#region src/roles/fields.ts
 const ROLES_MATRIX_FIELD = "@bison-lab/payload-core/admin#RolesMatrixField";
 const ROLES_ROW_LABEL = "@bison-lab/payload-core/admin#RolesRowLabel";
@@ -1030,69 +1658,67 @@ const FEATURES_MATRIX_FIELD = "@bison-lab/payload-core/admin#FeaturesMatrixField
 */
 function createFeatures({ extras = [] } = {}) {
 	const catalogue = featureCatalogue(extras);
+	const featuresField = {
+		name: "features",
+		type: "array",
+		label: "Features",
+		labels: {
+			singular: "Feature",
+			plural: "Features"
+		},
+		minRows: catalogue.length,
+		maxRows: catalogue.length,
+		required: true,
+		defaultValue: defaultFeaturesFieldValue(extras),
+		validate: (value) => validateFeaturesMatrix(value, extras),
+		hooks: { beforeChange: [({ value }) => {
+			if (!Array.isArray(value)) return value;
+			return stampFeatureCatalogue(value, extras);
+		}] },
+		admin: {
+			components: { Field: FEATURES_MATRIX_FIELD },
+			description: "Release a feature so it can be assigned on Roles. Off keeps it Developer-only.",
+			initCollapsed: false
+		},
+		fields: [
+			{
+				name: "slug",
+				type: "text",
+				label: "Slug",
+				required: true,
+				admin: { readOnly: true }
+			},
+			{
+				name: "label",
+				type: "text",
+				label: "Name",
+				required: true,
+				admin: { readOnly: true }
+			},
+			{
+				name: "group",
+				type: "text",
+				label: "Group",
+				admin: { hidden: true }
+			},
+			{
+				name: "released",
+				type: "checkbox",
+				label: "Released",
+				admin: { hidden: true }
+			}
+		]
+	};
 	return {
 		slug: FEATURES_SLUG,
 		label: "Features",
 		admin: {
 			group: "Settings",
-			hidden: ({ user }) => !isDeveloper(user),
+			hidden: hideUnlessDeveloper,
 			description: "Which features other people may be granted on Roles."
 		},
-		access: {
-			read: ({ req }) => isDeveloper(req.user),
-			update: ({ req }) => isDeveloper(req.user)
-		},
-		fields: [{
-			name: "features",
-			type: "array",
-			label: "Features",
-			labels: {
-				singular: "Feature",
-				plural: "Features"
-			},
-			minRows: catalogue.length,
-			maxRows: catalogue.length,
-			required: true,
-			defaultValue: defaultFeaturesFieldValue(extras),
-			validate: (value) => validateFeaturesMatrix(value, extras),
-			hooks: { beforeChange: [({ value }) => {
-				if (!Array.isArray(value)) return value;
-				return stampFeatureCatalogue(value, extras);
-			}] },
-			admin: {
-				components: { Field: FEATURES_MATRIX_FIELD },
-				description: "Release a feature so it can be assigned on Roles. Off keeps it Developer-only.",
-				initCollapsed: false
-			},
-			fields: [
-				{
-					name: "slug",
-					type: "text",
-					label: "Slug",
-					required: true,
-					admin: { readOnly: true }
-				},
-				{
-					name: "label",
-					type: "text",
-					label: "Name",
-					required: true,
-					admin: { readOnly: true }
-				},
-				{
-					name: "group",
-					type: "text",
-					label: "Group",
-					admin: { hidden: true }
-				},
-				{
-					name: "released",
-					type: "checkbox",
-					label: "Released",
-					admin: { hidden: true }
-				}
-			]
-		}]
+		access: developerOnlyAccess(),
+		fields: [featuresField]
 	};
 }
 //#endregion
@@ -1189,6 +1815,15 @@ function slugField({ collection, isReserved }) {
 //#endregion
 //#region src/collections/pages.ts
 /**
+* Content to create or save a draft; Publish to publish or edit a live
+* page. Without Publish, update is constrained to `_status: draft`.
+*/
+const pagesUpdate = async (args) => {
+	if (!await Promise.resolve(canUseFeature("content")(args))) return false;
+	if (await Promise.resolve(canPublish(args))) return true;
+	return { _status: { equals: "draft" } };
+};
+/**
 * CMS-managed pages: one required hero, then a reorderable body of sections.
 * The CMS owns copy and the order of sections; what a section looks like is
 * code-owned, which is why the blocks are an argument.
@@ -1215,7 +1850,7 @@ function createPages({ heroBlocks, isReservedSlug, layoutBlocks, previewPath, pr
 			read: authenticatedOrPublished,
 			readVersions: isAuthenticated,
 			create: canUseFeature("content"),
-			update: canUseFeature("content"),
+			update: pagesUpdate,
 			delete: isAdmin
 		},
 		versions: {
@@ -1374,27 +2009,45 @@ function createUsers({ secureCookies, rolesField, extras = [] }) {
 				return arg.result;
 			}]
 		},
-		fields: [{
-			type: "row",
-			fields: [nameField("firstName"), nameField("lastName")]
-		}, {
-			name: "roles",
-			type: "select",
-			hasMany: true,
-			required: true,
-			defaultValue: ["author"],
-			options: roleSelectOptions(fallback),
-			admin: {
-				components: { Field: rolesField ?? "@bison-lab/payload-core/admin#RolesField" },
-				description: "One person can hold several, e.g. Author + Designer."
+		fields: [
+			{
+				type: "row",
+				fields: [nameField("firstName"), nameField("lastName")]
 			},
-			access: { update: isAdmin },
-			validate: rolesValidate(extras),
-			hooks: { beforeValidate: [async ({ value, req }) => {
-				if (!Array.isArray(value)) return value;
-				return normalizeStoredRoles(value, await getRolesMatrix(req, extras));
-			}] }
-		}]
+			{
+				name: "roles",
+				type: "select",
+				hasMany: true,
+				required: true,
+				defaultValue: ["author"],
+				saveToJWT: true,
+				options: roleSelectOptions(fallback),
+				admin: {
+					components: { Field: rolesField ?? "@bison-lab/payload-core/admin#RolesField" },
+					description: "One person can hold several, e.g. Author + Designer."
+				},
+				access: { update: isAdmin },
+				validate: rolesValidate(extras),
+				hooks: { beforeValidate: [async ({ value, req }) => {
+					if (!Array.isArray(value)) return value;
+					return normalizeStoredRoles(value, await getRolesMatrix(req, extras));
+				}] }
+			},
+			{
+				name: "allowedFeatures",
+				type: "json",
+				admin: {
+					hidden: true,
+					readOnly: true
+				},
+				access: { update: () => false },
+				saveToJWT: true,
+				hooks: { afterRead: [async ({ siblingData, data, req }) => allowedFeaturesForUser({
+					id: siblingData?.id ?? data?.id,
+					roles: siblingData?.roles ?? data?.roles
+				}, req ?? {})] }
+			}
+		]
 	};
 }
 //#endregion
@@ -1470,6 +2123,6 @@ const adminOnlyApiTab = definePlugin({
 	})
 });
 //#endregion
-export { BRAND_ASSETS_MIME_TYPES, BRAND_ASSETS_SLUG, CAPABILITIES, CAPABILITY_FEATURES, DEFAULT_ROLE_GRANTS, DEFAULT_ROLE_MATRIX, DESCRIPTION_LENGTH, DEVELOPER_DESCRIPTION, DUPLICATE_ROLE_NAME_MESSAGE, DUPLICATE_ROLE_SLUG_MESSAGE, FEATURES_MATRIX_FIELD, FEATURES_SLUG, FEATURE_GROUPS, FEATURE_GROUP_LABELS, INVALID_ROLE_NAME_MESSAGE, LAST_ADMIN_DELETE_MESSAGE, LAST_ADMIN_DEMOTE_MESSAGE, LAST_USERS_TICK_MESSAGE, LOOK_FIELD, MISSING_PACKAGE_FEATURES_MESSAGE, MISSING_SEED_ROLES_MESSAGE, PACKAGE_FEATURES, PACKAGE_FEATURE_SLUGS, PAGE_EDITOR_SYSTEM_KEYS, ROLES, ROLES_FIELD, ROLES_FIELD_DESCRIPTION, ROLES_GLOBAL_DESCRIPTION, ROLES_GRANTS_FIELD, ROLES_MATRIX_FIELD, ROLES_ROW_LABEL, ROLES_SLUG, ROLE_LABELS, ROLE_NAME_FIELD, ROLE_SLUG_FIELD, SHARE_IMAGE_SIZE, SYSTEM_COLOR_KEYS, THEME_APPEARANCE_FIELD, THEME_APPEARANCE_SLUG, THEME_COLORS_SLUG, THEME_COLOR_FIELD, THEME_COLOR_SCALE_FIELD, THEME_CONTRAST_REPORT, THEME_DOCUMENT_CONTROLS, THEME_FEATURE_SLUGS, THEME_FONT_FIELD, THEME_GREY_SCALE_FIELD, THEME_IDENTITY_FALLBACK, THEME_IDENTITY_SLUG, THEME_LIBRARY_FIELD, THEME_PAIRING_FIELD, THEME_PREVIEW_BREAKPOINTS, THEME_PUBLISH_FIELD, THEME_SAVE_BUTTON, THEME_SECTION_HEADING, THEME_SLUG, THEME_TYPOGRAPHY_SLUG, adminOnlyApiTab, applyRoleSlugsFromNames, authenticatedOrPublished, canManageBrand, canManageContent, canPublish, canUseFeature, colorTokenField, createBrandAssets, createFeatures, createMedia, createPages, createRoles, createTheme, createUsers, defaultFeaturesFieldValue, defaultRolesFieldValue, deleteLibraryColor, documentTitle, featureCatalogue, featureGroupLabel, findColorTokens, findColorUsages, firstImageIn, getFeaturesMatrix, getRolesMatrix, hasCapability, hasFeature, hasGrant, hasRole, hideUnlessFeature, isAdmin, isAdminOrSelf, isAuthenticated, isDeveloper, isDeveloperTab, isFeatureGroupId, isFeatureSlug, isLockedFeature, isPackageFeatureSlug, isPrivilegedRole, isRole, isRoleName, isRoleSlug, lookField, noIndexField, normalizeSlug, normalizeStoredRoles, pageEditorLooks, pageEditorTokens, parseFeaturesMatrix, parseRolesMatrix, persistThemeChild, publishThemeChild, resetRolesMatrix, resolveThemeIdentity, rewriteColorToken, rewriteColorTokens, rewriteColorUsages, roleDescription, roleLabel, roleSelectOptions, sanitizeRoleNameInput, sanitizeSvg, seedFeatures, seedRoleRows, seedRoles, seedTheme, seoPlugin, slugField, slugifyRoleName, stampFeatureCatalogue, storedRoles, themeColorKeys, themeLibraryFromDoc, titleTemplate, truncateAtWord, validateFeaturesMatrix, validateRolesMatrix };
+export { BRAND_ASSETS_MIME_TYPES, BRAND_ASSETS_SLUG, CAPABILITIES, CAPABILITY_FEATURES, DEFAULT_ROLE_GRANTS, DEFAULT_ROLE_MATRIX, DESCRIPTION_LENGTH, DEVELOPER_DESCRIPTION, DUPLICATE_ROLE_NAME_MESSAGE, DUPLICATE_ROLE_SLUG_MESSAGE, FEATURES_MATRIX_FIELD, FEATURES_SLUG, FEATURE_GROUPS, FEATURE_GROUP_LABELS, INVALID_ROLE_NAME_MESSAGE, LAST_ADMIN_DELETE_MESSAGE, LAST_ADMIN_DEMOTE_MESSAGE, LAST_USERS_TICK_MESSAGE, LOOK_FIELD, MISSING_PACKAGE_FEATURES_MESSAGE, MISSING_SEED_ROLES_MESSAGE, PACKAGE_FEATURES, PACKAGE_FEATURE_SLUGS, PAGE_EDITOR_SYSTEM_KEYS, ROLES, ROLES_FIELD, ROLES_FIELD_DESCRIPTION, ROLES_GLOBAL_DESCRIPTION, ROLES_GRANTS_FIELD, ROLES_MATRIX_FIELD, ROLES_ROW_LABEL, ROLES_SLUG, ROLE_LABELS, ROLE_NAME_FIELD, ROLE_SLUG_FIELD, SHARE_IMAGE_SIZE, SYSTEM_COLOR_KEYS, THEME_APPEARANCE_FIELD, THEME_APPEARANCE_SLUG, THEME_COLORS_SLUG, THEME_COLOR_FIELD, THEME_COLOR_SCALE_FIELD, THEME_CONTRAST_REPORT, THEME_DOCUMENT_CONTROLS, THEME_FEATURE_SLUGS, THEME_FONT_FIELD, THEME_GREY_SCALE_FIELD, THEME_IDENTITY_FALLBACK, THEME_IDENTITY_SLUG, THEME_LIBRARY_FIELD, THEME_PAIRING_FIELD, THEME_PREVIEW_BREAKPOINTS, THEME_PUBLISH_FIELD, THEME_SAVE_BUTTON, THEME_SECTION_HEADING, THEME_SLUG, THEME_TYPOGRAPHY_SLUG, adminOnlyApiTab, allowedFeaturesForUser, applyRoleSlugsFromNames, authenticatedOrPublished, canManageBrand, canManageContent, canPublish, canUseFeature, colorTokenField, createBrandAssets, createFeatures, createMedia, createPages, createRoles, createTheme, createUsers, defaultFeaturesFieldValue, defaultRolesFieldValue, deleteLibraryColor, developerOnlyAccess, documentTitle, featureCatalogue, featureGroupLabel, findColorTokens, findColorUsages, firstImageIn, getFeaturesMatrix, getRolesMatrix, hasCapability, hasFeature, hasGrant, hasRole, hideUnlessDeveloper, hideUnlessFeature, isAdmin, isAdminOrSelf, isAuthenticated, isDeveloper, isDeveloperTab, isFeatureGroupId, isFeatureSlug, isLockedFeature, isPackageFeatureSlug, isPrivilegedRole, isRole, isRoleName, isRoleSlug, lookField, noIndexField, normalizeSlug, normalizeStoredRoles, pageEditorLooks, pageEditorTokens, parseFeaturesMatrix, parseRolesMatrix, persistThemeChild, publishThemeChild, resetRolesMatrix, resolveThemeIdentity, rewriteColorToken, rewriteColorTokens, rewriteColorUsages, roleDescription, roleLabel, roleSelectOptions, sanitizeRoleNameInput, sanitizeSvg, seedFeatures, seedRoleRows, seedRoles, seedTheme, seoPlugin, slugField, slugifyRoleName, stampFeatureCatalogue, storedRoles, themeColorKeys, themeLibraryFromDoc, titleTemplate, truncateAtWord, validateFeaturesMatrix, validateRolesMatrix };
 
 //# sourceMappingURL=index.mjs.map