1.0.5

README.md

@@ -11,60 +11,23 @@ blog/archive system (collections under an archive page, listing, pagination).
 
 ---
 
-## Before you start
-
-The `git.intecion.net` server is internal — you'll only see the code and the
-package once you're signed in to your Intecion account. Every installation method
-needs your personal access token. Without it you'll get a 404 or an
-"Unauthorized" error.
-
-You generate the token once. It's tied to your account — don't ask anyone for
-theirs, and don't put it in any file that ends up in a repository.
-
-### Generate a token
-
-1. Sign in to Gitea → click your avatar → **Settings**.
-2. **Applications → Generate New Token**.
-3. Name it (e.g. `ipal-kit-install`) and select the scope:
-   - `read:package` — if you only install the plugin in projects,
-   - `write:package` — additionally, if you'll publish new versions.
-4. Click **Generate**. Copy the token now — Gitea shows it only once.
-
-### Store the token in your environment
-
-Don't paste the token straight into project files. Keep it in an environment
-variable, so your install config carries no secret.
-
-```bash
-# add to ~/.zshrc (or ~/.bashrc)
-export GITEA_TOKEN=paste_your_token_here
-```
-
-Reload your shell (`source ~/.zshrc`) or open a new terminal window.
-
----
-
 ## Installation
 
-There are two routes. Pick **Route A** if you just want to use the plugin in a
+The plugin is published to a **public package registry** on the company Gitea.
-project — it's faster and versioned. Choose **Route B** only when you need a
+Installing it needs no token — just point the `@intecion` scope at the registry.
-specific, unreleased commit straight from the repository.
 
-### Route A — from the registry (recommended)
+**1. Point the scope at the registry.** Add this line to an `.npmrc` file in your
-
+project (or to `~/.npmrc` to apply it everywhere):
-The plugin is published to the package registry in Gitea. You pull a ready-built
-package and build nothing locally.
-
-**1. Configure the registry.** Create an `.npmrc` file in your project directory
-(or add these two lines to `~/.npmrc` to make it work globally):
 
 ```
 @intecion:registry=https://git.intecion.net/api/packages/IntecionSoftware/npm/
-//git.intecion.net/api/packages/IntecionSoftware/npm/:_authToken=${GITEA_TOKEN}
 ```
 
-Because the token lives in the `${GITEA_TOKEN}` variable, this file holds no
+Only packages starting with `@intecion/` go to Gitea. Everything else
-secret — you can safely commit it.
+(`react`, `next`, `@payloadcms/*`, …) still comes from the public npm registry —
+this line is a scoped override, not a change of your default registry. The file
+holds no secret, so you can commit it (and you should — your deployment needs it
+too).
 
 **2. Install:**
 
@@ -72,28 +35,25 @@ secret — you can safely commit it.
 pnpm add @intecion/ipal-kit
 ```
 
-### Route B — straight from the repository
+That's it. No token, no login — the registry is public for reads.
 
-pnpm clones the repository and uses the pre-built output. There's no `gitea:`
+### Why the registry, not a git install
-shorthand — give the full address.
 
-Over HTTPS with your token:
+You *can* install straight from the repo
+(`pnpm add git+https://git.intecion.net/IntecionSoftware/ipal-kit.git`), and for a
+quick throwaway test it works. But prefer the registry for real projects:
 
-```bash
+- **Client components resolve correctly.** A git install unpacks into a
-pnpm add git+https://$GITEA_TOKEN@git.intecion.net/IntecionSoftware/ipal-kit.git
+  commit-hashed path (`.pnpm/@intecion+ipal-kit@git+https…#hash/…`) that breaks
-```
+  Next.js's React Client Manifest — the consent banner, analytics, and Turnstile
+  components fail at runtime with "Could not find the module … in the React
+  Client Manifest". The registry unpacks to a clean `node_modules/@intecion/…`
+  path, so this doesn't happen.
+- **Versioning.** `pnpm` sees a real version number, so a version bump cleanly
+  replaces the old one — no cache-clearing dance.
 
-Or over SSH, if you have a key added in Gitea:
+Keep the git install only for pulling a specific unreleased commit during
-
+plugin development.
-```bash
-pnpm add git+ssh://[email protected]:IntecionSoftware/ipal-kit.git
-```
-
-Append a specific version after `#` to pin to a release:
-
-```bash
-pnpm add git+https://$GITEA_TOKEN@git.intecion.net/IntecionSoftware/ipal-kit.git#v1.0.0
-```
 
 ---
 
@@ -107,6 +67,10 @@ pnpm add @payloadcms/[email protected] @payloadcms/[email protected] \
          nodemailer lucide-react slugify server-only
 ```
 
+> **Match `lucide-react` to the plugin.** The plugin uses `lucide-react@^0.400.0`.
+> If your project pulls a different major (e.g. `1.x`), you end up with two copies
+> and confusing type errors. Pin your project to the same range.
+
 From here, the guide takes over: **[docs/getting-started.md](./docs/getting-started.md)** —
 from an empty project to a working site.
 
@@ -114,16 +78,25 @@ from an empty project to a working site.
 
 ## Publishing a new version
 
-This section only applies if you develop the plugin itself and publish new
+This section applies only if you develop the plugin itself. Publishing (unlike
-versions. You'll need a token with the `write:package` scope.
+installing) **does** need a token, with the `write:package` scope.
 
-In `~/.npmrc`:
+In `~/.npmrc` (path differs per OS — see the table below):
 
 ```
 //git.intecion.net/api/packages/IntecionSoftware/npm/:_authToken=${GITEA_TOKEN}
 ```
 
-Build, bump the version number, publish:
+Generate the token in Gitea → **Settings → Applications → Generate New Token**,
+scope `write:package`. Put it in the `GITEA_TOKEN` env var.
+
+| System | Global `.npmrc` path |
+|---|---|
+| macOS | `~/.npmrc` |
+| Linux / Ubuntu | `~/.npmrc` |
+| Windows | `%USERPROFILE%\.npmrc` |
+
+Then build and publish:
 
 ```bash
 pnpm clean && pnpm build
@@ -131,8 +104,7 @@ npm version patch          # 1.0.0 → 1.0.1
 npm publish
 ```
 
-Bump the version on every release — that way pnpm always sees the new package and
+Full checklist and troubleshooting: **[docs/publishing.md](./docs/publishing.md)**.
-nobody gets stuck on a stale one from the cache.
 
 ---
 
@@ -141,7 +113,7 @@ nobody gets stuck on a stale one from the cache.
 Everything lives in the **[docs/](./docs)** directory. To get started:
 
 - **[getting-started.md](./docs/getting-started.md)** — project setup, step by step
-- **[install.md](./docs/install.md)** — more on installation and troubleshooting
+- **[publishing.md](./docs/publishing.md)** — releasing new plugin versions
 - **[README.md](./docs/README.md)** — index of the plugin's modules
 
 ---
@@ -150,10 +122,10 @@ Everything lives in the **[docs/](./docs)** directory. To get started:
 
 | What you see | What's wrong |
 |---|---|
-| `404` or `Unauthorized` on `pnpm add @intecion/...` | no token in `.npmrc`, a wrong token, or you don't have access to the organization in Gitea |
+| `404` on `pnpm add @intecion/...` | the `@intecion:registry` line is missing from `.npmrc` — the install went to public npm instead of Gitea |
-| `404` when installing from the `.git` address | you're not signed in, the token is missing from the address, or you lack access to the repository |
+| `Could not find the module … in the React Client Manifest` | installed from git, not the registry — reinstall from the registry (clean path) |
-| `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` | an attempt to build on install from git — report it to whoever publishes the plugin |
+| two versions of `lucide-react` | your project pins a different major than the plugin's `^0.400.0` — align them |
-| old code after reinstalling | cache: run `pnpm store prune`, then remove `.next` and `node_modules/@intecion` |
+| `missing secret key … to secure Payload` | `PAYLOAD_SECRET` isn't set in the runtime environment (not a plugin issue) |
 
-If you get stuck, check **[docs/install.md](./docs/install.md)** or message the
+If you get stuck, see **[docs/publishing.md](./docs/publishing.md)** or message the
 team that maintains the plugin.

dist/exports/client.d.js

@@ -1,11 +0,0 @@
-export { Analytics } from '../modules/analytics/client.js';
-/**
- * Entry point: ipal-kit/client
- *
- * Client-side ('use client') exports — React hooks, providers, and UI
- * components. Kept separate from the main entry so server bundles don't pull in
- * client-only code.
- */ export { ConsentProvider, CookieBanner, CookieButton, useConsent, useConsentContext } from '../modules/consent/client.js';
-export { Turnstile } from '../modules/turnstile/client.js';
-
-//# sourceMappingURL=client.d.js.map

dist/exports/client.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["client.d.ts"],"sourcesContent":["export { Analytics } from '../modules/analytics/client.js';\n/**\n * Entry point: ipal-kit/client\n *\n * Client-side ('use client') exports — React hooks, providers, and UI\n * components. Kept separate from the main entry so server bundles don't pull in\n * client-only code.\n */\nexport { ConsentProvider, CookieBanner, CookieButton, useConsent, useConsentContext, } from '../modules/consent/client.js';\nexport type { CookieBannerClassNames } from '../modules/consent/client.js';\nexport { Turnstile } from '../modules/turnstile/client.js';\nexport type { TurnstileProps } from '../modules/turnstile/client.js';\n"],"names":["Analytics","ConsentProvider","CookieBanner","CookieButton","useConsent","useConsentContext","Turnstile"],"mappings":"AAAA,SAASA,SAAS,QAAQ,iCAAiC;AAC3D;;;;;;CAMC,GACD,SAASC,eAAe,EAAEC,YAAY,EAAEC,YAAY,EAAEC,UAAU,EAAEC,iBAAiB,QAAS,+BAA+B;AAE3H,SAASC,SAAS,QAAQ,iCAAiC"}

dist/exports/client.d.ts

@@ -1,3 +1,4 @@
+export { MaskedField } from '../globals/SiteIntegrations/components/MaskedField.js';
 export { Analytics } from '../modules/analytics/client.js';
 /**
  * Entry point: ipal-kit/client

dist/exports/next-middleware.d.js

@@ -1,9 +0,0 @@
-/**
- * Entry point: ipal-kit/next/middleware
- *
- * Re-exports the locale middleware factory and default matcher for use in a
- * client project's middleware.ts. Kept as a thin re-export so the Next-facing
- * surface is separate from the main package export.
- */ export { createLocaleMiddleware, DEFAULT_MIDDLEWARE_MATCHER } from '../modules/i18n/index.js';
-
-//# sourceMappingURL=next-middleware.d.js.map

dist/exports/next-middleware.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["next-middleware.d.ts"],"sourcesContent":["/**\n * Entry point: ipal-kit/next/middleware\n *\n * Re-exports the locale middleware factory and default matcher for use in a\n * client project's middleware.ts. Kept as a thin re-export so the Next-facing\n * surface is separate from the main package export.\n */\nexport { createLocaleMiddleware, DEFAULT_MIDDLEWARE_MATCHER } from '../modules/i18n/index.js';\nexport type { LocaleMiddlewareResult } from '../modules/i18n/index.js';\n"],"names":["createLocaleMiddleware","DEFAULT_MIDDLEWARE_MATCHER"],"mappings":"AAAA;;;;;;CAMC,GACD,SAASA,sBAAsB,EAAEC,0BAA0B,QAAQ,2BAA2B"}

dist/exports/rsc.d.js

@@ -1,9 +0,0 @@
-/**
- * Entry point: ipal-kit/rsc
- *
- * Server-component exports. RenderBlocks is a React Server Component, so it
- * lives here rather than in the main package entry to keep React out of the
- * server-config bundle.
- */ export { RenderBlocks } from '../modules/blocks/index.js';
-
-//# sourceMappingURL=rsc.d.js.map

dist/exports/rsc.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["rsc.d.ts"],"sourcesContent":["/**\n * Entry point: ipal-kit/rsc\n *\n * Server-component exports. RenderBlocks is a React Server Component, so it\n * lives here rather than in the main package entry to keep React out of the\n * server-config bundle.\n */\nexport { RenderBlocks } from '../modules/blocks/index.js';\nexport type { BlockComponentMap, BlockData, EnhanceProps, RenderBlocksProps, } from '../modules/blocks/index.js';\n"],"names":["RenderBlocks"],"mappings":"AAAA;;;;;;CAMC,GACD,SAASA,YAAY,QAAQ,6BAA6B"}

dist/exports/server.d.js

@@ -1,16 +0,0 @@
-/**
- * Entry point: ipal-kit/server
- *
- * Server-only runtime functions — these import 'server-only' (Turnstile secret,
- * SMTP password, nodemailer). Kept OUT of the main entry so that loading the
- * Payload config or running `payload generate:importmap` (both Node scripts,
- * no bundler) never pulls in 'server-only', which throws outside a bundled
- * server context.
- *
- * Import these only from Server Actions, route handlers, or server components —
- * never from the Payload config or client code.
- */ export { verifyTurnstile } from '../modules/turnstile/index.js';
-export { sendEmail } from '../modules/email/index.js';
-export { submitForm } from '../modules/forms/index.js';
-
-//# sourceMappingURL=server.d.js.map

dist/exports/server.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["server.d.ts"],"sourcesContent":["/**\n * Entry point: ipal-kit/server\n *\n * Server-only runtime functions — these import 'server-only' (Turnstile secret,\n * SMTP password, nodemailer). Kept OUT of the main entry so that loading the\n * Payload config or running `payload generate:importmap` (both Node scripts,\n * no bundler) never pulls in 'server-only', which throws outside a bundled\n * server context.\n *\n * Import these only from Server Actions, route handlers, or server components —\n * never from the Payload config or client code.\n */\nexport { verifyTurnstile } from '../modules/turnstile/index.js';\nexport { sendEmail } from '../modules/email/index.js';\nexport type { SendEmailArgs, SendEmailResult } from '../modules/email/index.js';\nexport { submitForm } from '../modules/forms/index.js';\nexport type { SubmitFormArgs, SubmitFormResult } from '../modules/forms/index.js';\n"],"names":["verifyTurnstile","sendEmail","submitForm"],"mappings":"AAAA;;;;;;;;;;;CAWC,GACD,SAASA,eAAe,QAAQ,gCAAgC;AAChE,SAASC,SAAS,QAAQ,4BAA4B;AAEtD,SAASC,UAAU,QAAQ,4BAA4B"}

dist/globals/CookieSettings/fields.d.js

@@ -1,7 +0,0 @@
-/**
- * Fields for the CookieSettings global — GDPR consent banner copy, editable
- * per locale. The privacy-policy link is NOT stored here: it comes from the
- * pages module (system page role 'privacyPolicy'), keeping one source of truth.
- */ export { };
-
-//# sourceMappingURL=fields.d.js.map

dist/globals/CookieSettings/fields.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["fields.d.ts"],"sourcesContent":["import type { Field } from 'payload';\n/**\n * Fields for the CookieSettings global — GDPR consent banner copy, editable\n * per locale. The privacy-policy link is NOT stored here: it comes from the\n * pages module (system page role 'privacyPolicy'), keeping one source of truth.\n */\nexport declare const cookieSettingsFields: Field[];\n"],"names":[],"mappings":"AACA;;;;CAIC,GACD,WAAmD"}

dist/globals/CookieSettings/index.d.js

@@ -1,6 +0,0 @@
-/**
- * Builds the CookieSettings global — consent banner copy managed by editors.
- * Public read (the banner needs it on the frontend for anonymous visitors).
- */ export { };
-
-//# sourceMappingURL=index.d.js.map

dist/globals/CookieSettings/index.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.d.ts"],"sourcesContent":["import type { GlobalConfig } from 'payload';\n/**\n * Builds the CookieSettings global — consent banner copy managed by editors.\n * Public read (the banner needs it on the frontend for anonymous visitors).\n */\nexport declare function buildCookieSettings(): GlobalConfig;\n"],"names":[],"mappings":"AACA;;;CAGC,GACD,WAA4D"}

dist/globals/Notifications/fields.d.ts

@@ -0,0 +1,13 @@
+import type { Field } from 'payload';
+/**
+ * Fields for the Notifications global — localized user-facing texts for action
+ * results (form submission outcomes, and future contexts). Every text is
+ * localized: true so each language has its own value. Empty fields fall back to
+ * built-in English defaults (see modules/notifications/defaults).
+ *
+ * Grouped per context. `form` holds the outcomes of submitForm; more groups
+ * (e.g. `newsletter`, `system`) can be added the same way without touching
+ * consumers — getNotificationTexts resolves whatever exists, falling back
+ * per field.
+ */
+export declare const notificationsFields: Field[];

dist/globals/Notifications/index.d.ts

@@ -0,0 +1,7 @@
+import type { GlobalConfig } from 'payload';
+/**
+ * Builds the Notifications global — localized action-result texts. Readable by
+ * any authenticated panel user; server-side helpers read it with overrideAccess
+ * so the frontend can resolve texts without a session.
+ */
+export declare function buildNotifications(): GlobalConfig;

dist/globals/SiteIntegrations/components/MaskedField.d.ts

@@ -0,0 +1,3 @@
+import type { TextFieldClientComponent } from 'payload';
+export declare const MaskedField: TextFieldClientComponent;
+export default MaskedField;

dist/globals/SiteIntegrations/fields/analytics.d.js

@@ -1,6 +0,0 @@
-/**
- * Analytics configuration — GA4 measurement ID and GTM container ID.
- * IDs are public (exposed client-side), so no read restriction needed.
- */ export { };
-
-//# sourceMappingURL=analytics.d.js.map

dist/globals/SiteIntegrations/fields/analytics.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["analytics.d.ts"],"sourcesContent":["import type { Field } from 'payload';\n/**\n * Analytics configuration — GA4 measurement ID and GTM container ID.\n * IDs are public (exposed client-side), so no read restriction needed.\n */\nexport declare const analyticsFields: Field[];\n"],"names":[],"mappings":"AACA;;;CAGC,GACD,WAA8C"}

dist/globals/SiteIntegrations/fields/smtp.d.js

@@ -1,9 +0,0 @@
-/**
- * SMTP transport settings for outbound email.
- *
- * Protected at the global level (SiteIntegrations requires an authenticated
- * user), so all fields — including the password — stay editable in the admin
- * panel while remaining inaccessible to anonymous API requests.
- */ export { };
-
-//# sourceMappingURL=smtp.d.js.map

dist/globals/SiteIntegrations/fields/smtp.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["smtp.d.ts"],"sourcesContent":["import type { Field } from 'payload';\n/**\n * SMTP transport settings for outbound email.\n *\n * Protected at the global level (SiteIntegrations requires an authenticated\n * user), so all fields — including the password — stay editable in the admin\n * panel while remaining inaccessible to anonymous API requests.\n */\nexport declare const smtpFields: Field[];\n"],"names":[],"mappings":"AACA;;;;;;CAMC,GACD,WAAyC"}

dist/globals/SiteIntegrations/fields/storage.d.js

@@ -1,10 +0,0 @@
-/**
- * Cloudflare R2 storage credentials.
- * Reserved for future use — media offloading to R2.
- *
- * Protected at the global level (SiteIntegrations requires an authenticated
- * user), so the access keys stay editable in the admin panel while remaining
- * inaccessible to anonymous API requests.
- */ export { };
-
-//# sourceMappingURL=storage.d.js.map

dist/globals/SiteIntegrations/fields/storage.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["storage.d.ts"],"sourcesContent":["import type { Field } from 'payload';\n/**\n * Cloudflare R2 storage credentials.\n * Reserved for future use — media offloading to R2.\n *\n * Protected at the global level (SiteIntegrations requires an authenticated\n * user), so the access keys stay editable in the admin panel while remaining\n * inaccessible to anonymous API requests.\n */\nexport declare const storageFields: Field[];\n"],"names":[],"mappings":"AACA;;;;;;;CAOC,GACD,WAA4C"}

dist/globals/SiteIntegrations/fields/turnstile.d.js

@@ -1,10 +0,0 @@
-/**
- * Cloudflare Turnstile credentials.
- *
- * siteKey is public (rendered in the widget); secretKey is used for
- * server-side verification. Both are protected at the global level
- * (SiteIntegrations requires an authenticated user) rather than per-field,
- * so they remain editable in the admin panel.
- */ export { };
-
-//# sourceMappingURL=turnstile.d.js.map

dist/globals/SiteIntegrations/fields/turnstile.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["turnstile.d.ts"],"sourcesContent":["import type { Field } from 'payload';\n/**\n * Cloudflare Turnstile credentials.\n *\n * siteKey is public (rendered in the widget); secretKey is used for\n * server-side verification. Both are protected at the global level\n * (SiteIntegrations requires an authenticated user) rather than per-field,\n * so they remain editable in the admin panel.\n */\nexport declare const turnstileFields: Field[];\n"],"names":[],"mappings":"AACA;;;;;;;CAOC,GACD,WAA8C"}

dist/globals/SiteIntegrations/index.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=index.d.js.map

dist/globals/SiteIntegrations/index.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.d.ts"],"sourcesContent":["import type { Field, GlobalConfig } from 'payload';\ntype BuildSiteIntegrationsArgs = {\n    /** Extra fields injected by the client project */\n    additionalFields?: Field[];\n};\n/**\n * Builds the SiteIntegrations global.\n *\n * Holds third-party service credentials. Access is enforced at the global\n * level — the whole global requires an authenticated user — so secrets stay\n * out of anonymous API responses while remaining editable in the admin panel\n * and readable via the server-side Local API. (Field-level read:false was\n * avoided because it also hides fields from the admin UI, making them\n * impossible to enter.)\n *\n * Unnamed tabs keep data flat (siteIntegrations.ga4MeasurementId).\n */\nexport declare function buildSiteIntegrations({ additionalFields, }?: BuildSiteIntegrationsArgs): GlobalConfig;\nexport {};\n"],"names":[],"mappings":"AAkBA,WAAU"}

dist/globals/SiteSettings/fields/general.d.js

@@ -1,6 +0,0 @@
-/**
- * General site identity fields.
- * Consumed by SEO/OG (siteName, defaultShareImage) and frontend (logo).
- */ export { };
-
-//# sourceMappingURL=general.d.js.map

dist/globals/SiteSettings/fields/general.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["general.d.ts"],"sourcesContent":["import type { Field } from 'payload';\n/**\n * General site identity fields.\n * Consumed by SEO/OG (siteName, defaultShareImage) and frontend (logo).\n */\nexport declare const generalFields: Field[];\n"],"names":[],"mappings":"AACA;;;CAGC,GACD,WAA4C"}

dist/globals/SiteSettings/fields/navigation.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=navigation.d.js.map

dist/globals/SiteSettings/fields/navigation.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["navigation.d.ts"],"sourcesContent":["export {};\n"],"names":[],"mappings":"AAAA,WAAU"}

dist/globals/SiteSettings/fields/theme.d.js

@@ -1,9 +0,0 @@
-/**
- * Theme behavior configuration.
- *
- * These are decisions, not visuals — the plugin stores them, the client
- * template reads them and decides whether to render a toggle and which
- * mode to start in. Appearance itself stays in the template.
- */ export { };
-
-//# sourceMappingURL=theme.d.js.map

dist/globals/SiteSettings/fields/theme.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["theme.d.ts"],"sourcesContent":["import type { Field } from 'payload';\n/**\n * Theme behavior configuration.\n *\n * These are decisions, not visuals — the plugin stores them, the client\n * template reads them and decides whether to render a toggle and which\n * mode to start in. Appearance itself stays in the template.\n */\nexport declare const themeFields: Field[];\n"],"names":[],"mappings":"AACA;;;;;;CAMC,GACD,WAA0C"}

dist/globals/SiteSettings/index.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=index.d.js.map

dist/globals/SiteSettings/index.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.d.ts"],"sourcesContent":["import type { Field, GlobalConfig } from 'payload';\ntype BuildSiteSettingsArgs = {\n    /** Extra fields injected by the client project */\n    additionalFields?: Field[];\n    /**\n     * Fields for the \"System Pages\" tab — page assignments by role (homepage,\n     * privacy policy, collection archives). Assembled by the caller, which is the\n     * only place that knows which modules are enabled. The tab is omitted when\n     * this is empty.\n     */\n    systemPageFields?: Field[];\n};\n/**\n * Builds the SiteSettings global.\n *\n * Composes tabs out of field groups; it deliberately doesn't know where those\n * groups come from. Earlier it imported the pages and content modules directly,\n * which meant a global — a presentation-layer concern — had an opinion about\n * blogs. Now the plugin's composition root passes fields in, and adding a new\n * kind of page assignment needs no change here.\n *\n * Uses unnamed tabs — data stays flat (siteSettings.siteName, not\n * siteSettings.general.siteName). Client-provided fields land in their own\n * \"Custom\" tab so core data paths never shift.\n */\nexport declare function buildSiteSettings({ additionalFields, systemPageFields, }?: BuildSiteSettingsArgs): GlobalConfig;\nexport {};\n"],"names":[],"mappings":"AA0BA,WAAU"}

dist/index.d.js

@@ -1,17 +0,0 @@
-export { adminOnly, adminOnlyField, adminOrEditor, adminOrEditorField, adminOrSelf, authenticated, hasMinimumRole, isAdmin, isEditor, requireRole, requireRoleField, ROLE_HIERARCHY } from './modules/access/index.js';
-export { getAnalyticsConfig } from './modules/analytics/index.js';
-export { ACCEPT_ALL_CONSENT, CONSENT_CATEGORIES, CONSENT_COOKIE, CONSENT_MAX_AGE, CONSENT_VERSION, DEFAULT_CONSENT, getConsentTexts, parseConsent, REJECT_ALL_CONSENT, serializeConsent, setDefaultConsent, updateConsent } from './modules/consent/index.js';
-export { archiveFieldName, buildArchivePath, buildEntryPath, getArchiveEntries, parsePageParam, resolveRoute } from './modules/content/index.js';
-export { panelSmtpAdapter } from './modules/email/panelSmtpAdapter.js';
-export { buildFormsPlugin } from './modules/forms/formsPluginConfig.js';
-export { createContentHelpers } from './modules/frontend/index.js';
-export { buildLocalizedPath, getDefaultLocale, getLocaleCodes, getLocaleDefinition, getLocalizedSlugs, isValidLocale, LOCALE_COOKIE_NAME, matchAcceptLanguage, negotiateLocale, switchLocalePath } from './modules/i18n/index.js';
-export { createLocaleMiddleware, DEFAULT_MIDDLEWARE_MATCHER } from './modules/i18n/index.js';
-export { ALL_SYSTEM_PAGE_ROLES, getSystemPagePath } from './modules/pages/index.js';
-export { getGlobal, getSiteIntegrations, getSiteSettings, SITE_INTEGRATIONS_SLUG, SITE_SETTINGS_SLUG } from './modules/payload/index.js';
-export { buildHreflangAlternates, buildMetadata, composeTitle } from './modules/seo/index.js';
-export { buildAutoFillMetaHook, buildRobots, buildSitemapEntries, createMetadataGenerator, createPageMetadata, injectAutoFillMeta } from './modules/seo/index.js';
-export { buildSlugField, toSlug } from './modules/slug/index.js';
-export { ipalKit } from './plugin.js';
-
-//# sourceMappingURL=index.d.js.map

dist/modules/access/access.d.js

@@ -1,3 +0,0 @@
-/** Requires at least the given role, for field-level access. */ export { };
-
-//# sourceMappingURL=access.d.js.map

dist/modules/access/access.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["access.d.ts"],"sourcesContent":["import type { Access, FieldAccess } from 'payload';\nimport type { Role } from './types.js';\n/**\n * Collection-level access (returns boolean | Where).\n * Use in collection `access.read/create/update/delete`.\n */\nexport declare const adminOnly: Access;\nexport declare const adminOrEditor: Access;\nexport declare const authenticated: Access;\n/** Requires at least the given role. */\nexport declare const requireRole: (minimum: Role) => Access;\n/** Admins see all; others are constrained to their own document. */\nexport declare const adminOrSelf: Access;\n/**\n * Field-level access (returns boolean only — no Where support).\n * Use in field `access.read/update`.\n */\nexport declare const adminOnlyField: FieldAccess;\nexport declare const adminOrEditorField: FieldAccess;\n/** Requires at least the given role, for field-level access. */\nexport declare const requireRoleField: (minimum: Role) => FieldAccess;\n"],"names":[],"mappings":"AAmBA,8DAA8D,GAC9D,WAAsE"}

dist/modules/access/index.d.js

@@ -1,7 +0,0 @@
-export { adminOnly, adminOnlyField, adminOrEditor, adminOrEditorField, adminOrSelf, authenticated, requireRole, requireRoleField } from './access.js';
-export { injectRoles } from './injectRoles.js';
-export { hasMinimumRole, isAdmin, isEditor } from './predicates.js';
-export { buildRolesField } from './rolesField.js';
-export { ROLE_HIERARCHY } from './types.js';
-
-//# sourceMappingURL=index.d.js.map

dist/modules/access/index.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.d.ts"],"sourcesContent":["export { adminOnly, adminOnlyField, adminOrEditor, adminOrEditorField, adminOrSelf, authenticated, requireRole, requireRoleField, } from './access.js';\nexport { injectRoles } from './injectRoles.js';\nexport { hasMinimumRole, isAdmin, isEditor } from './predicates.js';\nexport { buildRolesField } from './rolesField.js';\nexport type { AccessOption, Role } from './types.js';\nexport { ROLE_HIERARCHY } from './types.js';\n"],"names":["adminOnly","adminOnlyField","adminOrEditor","adminOrEditorField","adminOrSelf","authenticated","requireRole","requireRoleField","injectRoles","hasMinimumRole","isAdmin","isEditor","buildRolesField","ROLE_HIERARCHY"],"mappings":"AAAA,SAASA,SAAS,EAAEC,cAAc,EAAEC,aAAa,EAAEC,kBAAkB,EAAEC,WAAW,EAAEC,aAAa,EAAEC,WAAW,EAAEC,gBAAgB,QAAS,cAAc;AACvJ,SAASC,WAAW,QAAQ,mBAAmB;AAC/C,SAASC,cAAc,EAAEC,OAAO,EAAEC,QAAQ,QAAQ,kBAAkB;AACpE,SAASC,eAAe,QAAQ,kBAAkB;AAElD,SAASC,cAAc,QAAQ,aAAa"}

dist/modules/access/injectRoles.d.js

@@ -1,9 +0,0 @@
-/**
- * Injects the fixed `roles` field into the client's auth collection.
- *
- * The plugin owns the role definition; the client owns the collection. This
- * finds the collection by slug and appends the field. We control the whole
- * stack, so no conflict handling is needed — the field is simply added.
- */ export { };
-
-//# sourceMappingURL=injectRoles.d.js.map

dist/modules/access/injectRoles.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["injectRoles.d.ts"],"sourcesContent":["import type { Config } from 'payload';\nimport type { AccessOption } from './types.js';\n/**\n * Injects the fixed `roles` field into the client's auth collection.\n *\n * The plugin owns the role definition; the client owns the collection. This\n * finds the collection by slug and appends the field. We control the whole\n * stack, so no conflict handling is needed — the field is simply added.\n */\nexport declare function injectRoles(config: Config, access: AccessOption): Config;\n"],"names":[],"mappings":"AAEA;;;;;;CAMC,GACD,WAAkF"}

dist/modules/access/predicates.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=predicates.d.js.map

dist/modules/access/predicates.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["predicates.d.ts"],"sourcesContent":["import type { Role } from './types.js';\n/**\n * The plugin can't know the client's generated User type, and Payload types\n * `req.user` loosely (UntypedUser | null). Predicates therefore accept an\n * unknown-ish user and read `roles` defensively — no assumptions about shape\n * beyond an optional roles array.\n */\ntype MaybeUser = {\n    roles?: null | Role[];\n} | null | Record<string, unknown> | undefined;\n/**\n * True if the user holds at least the given role in the hierarchy.\n * admin satisfies 'editor' and 'user'; editor satisfies 'user'.\n */\nexport declare function hasMinimumRole(user: MaybeUser, minimum: Role): boolean;\n/** True if the user is an admin. */\nexport declare function isAdmin(user: MaybeUser): boolean;\n/** True if the user is an editor or higher (editor, admin). */\nexport declare function isEditor(user: MaybeUser): boolean;\nexport {};\n"],"names":[],"mappings":"AAmBA,WAAU"}

dist/modules/access/rolesField.d.js

@@ -1,8 +0,0 @@
-/**
- * Builds the fixed `roles` field the plugin injects into the auth collection.
- *
- * Saved to the JWT so role checks avoid a database lookup. Only admins can
- * change roles, preventing privilege escalation by lower-privilege users.
- */ export { };
-
-//# sourceMappingURL=rolesField.d.js.map

dist/modules/access/rolesField.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["rolesField.d.ts"],"sourcesContent":["import type { Field } from 'payload';\nimport type { Role } from './types.js';\n/**\n * Builds the fixed `roles` field the plugin injects into the auth collection.\n *\n * Saved to the JWT so role checks avoid a database lookup. Only admins can\n * change roles, preventing privilege escalation by lower-privilege users.\n */\nexport declare function buildRolesField(defaultRole?: Role): Field;\n"],"names":[],"mappings":"AAEA;;;;;CAKC,GACD,WAAmE"}

dist/modules/access/types.d.js

@@ -1,12 +0,0 @@
-/**
- * Role hierarchy, lowest to highest privilege.
- * A higher role satisfies any requirement met by a lower one.
- */ /**
- * Access-control options.
- *
- * The plugin injects a fixed `roles` field into the client's auth collection
- * — the collection itself belongs to the client (create-payload-app), the
- * role definition belongs to the plugin.
- */ export { };
-
-//# sourceMappingURL=types.d.js.map

dist/modules/access/types.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["types.d.ts"],"sourcesContent":["/**\n * Role hierarchy, lowest to highest privilege.\n * A higher role satisfies any requirement met by a lower one.\n */\nexport declare const ROLE_HIERARCHY: readonly [\"user\", \"editor\", \"admin\"];\nexport type Role = (typeof ROLE_HIERARCHY)[number];\n/**\n * Access-control options.\n *\n * The plugin injects a fixed `roles` field into the client's auth collection\n * — the collection itself belongs to the client (create-payload-app), the\n * role definition belongs to the plugin.\n */\nexport type AccessOption = {\n    /** Slug of the client's auth collection, e.g. 'users'. */\n    authCollection: string;\n    /** Role assigned to new users. Defaults to 'user'. */\n    defaultRole?: Role;\n};\n"],"names":[],"mappings":"AAAA;;;CAGC,GAGD;;;;;;CAMC,GACD,WAKE"}

dist/modules/analytics/Analytics.d.js

@@ -1,14 +0,0 @@
-/**
- * Loads Google Analytics — GTM if a container ID is set, otherwise GA4 gtag.
- *
- * Consent Mode is initialised to the visitor's stored consent BEFORE the tag
- * loads (via setDefaultConsent from the consent module), so tags respect the
- * choice from the first hit; useConsent sends an update the moment the visitor
- * decides. IDs are public and come from SiteIntegrations, passed in as props
- * (the client project reads them server-side).
- *
- * Renders nothing — it only injects the scripts. Mount once, high in the tree
- * (e.g. root layout), inside ConsentProvider.
- */ export { };
-
-//# sourceMappingURL=Analytics.d.js.map

dist/modules/analytics/Analytics.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["Analytics.d.ts"],"sourcesContent":["import type { AnalyticsConfig } from './types.js';\ndeclare global {\n    interface Window {\n        dataLayer?: unknown[];\n    }\n}\n/**\n * Loads Google Analytics — GTM if a container ID is set, otherwise GA4 gtag.\n *\n * Consent Mode is initialised to the visitor's stored consent BEFORE the tag\n * loads (via setDefaultConsent from the consent module), so tags respect the\n * choice from the first hit; useConsent sends an update the moment the visitor\n * decides. IDs are public and come from SiteIntegrations, passed in as props\n * (the client project reads them server-side).\n *\n * Renders nothing — it only injects the scripts. Mount once, high in the tree\n * (e.g. root layout), inside ConsentProvider.\n */\nexport declare function Analytics({ ga4MeasurementId, gtmContainerId }: AnalyticsConfig): null;\n"],"names":[],"mappings":"AAMA;;;;;;;;;;;CAWC,GACD,WAA+F"}

dist/modules/analytics/client.d.js

@@ -1,3 +0,0 @@
-export { Analytics } from './Analytics.js';
-
-//# sourceMappingURL=client.d.js.map

dist/modules/analytics/client.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["client.d.ts"],"sourcesContent":["export { Analytics } from './Analytics.js';\n"],"names":["Analytics"],"mappings":"AAAA,SAASA,SAAS,QAAQ,iBAAiB"}

dist/modules/analytics/getAnalyticsConfig.d.js

@@ -1,8 +0,0 @@
-/**
- * Reads the public analytics IDs from SiteIntegrations, server-side.
- *
- * Returns only the two public IDs (GA4 / GTM) — safe to pass to the client
- * <Analytics> component. Does NOT expose any secret from SiteIntegrations.
- */ export { };
-
-//# sourceMappingURL=getAnalyticsConfig.d.js.map

dist/modules/analytics/getAnalyticsConfig.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["getAnalyticsConfig.d.ts"],"sourcesContent":["import type { BasePayload } from 'payload';\nimport type { AnalyticsConfig } from './types.js';\n/**\n * Reads the public analytics IDs from SiteIntegrations, server-side.\n *\n * Returns only the two public IDs (GA4 / GTM) — safe to pass to the client\n * <Analytics> component. Does NOT expose any secret from SiteIntegrations.\n */\nexport declare function getAnalyticsConfig(payload: BasePayload): Promise<AnalyticsConfig>;\n"],"names":[],"mappings":"AAEA;;;;;CAKC,GACD,WAA2F"}

dist/modules/analytics/index.d.js

@@ -1,3 +0,0 @@
-export { getAnalyticsConfig } from './getAnalyticsConfig.js';
-
-//# sourceMappingURL=index.d.js.map

dist/modules/analytics/index.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.d.ts"],"sourcesContent":["export type { AnalyticsConfig } from './types.js';\nexport { getAnalyticsConfig } from './getAnalyticsConfig.js';\n"],"names":["getAnalyticsConfig"],"mappings":"AACA,SAASA,kBAAkB,QAAQ,0BAA0B"}

dist/modules/analytics/index.d.ts

@@ -1,2 +1,2 @@
-export type { AnalyticsConfig } from './types.js';
 export { getAnalyticsConfig } from './getAnalyticsConfig.js';
+export type { AnalyticsConfig } from './types.js';

dist/modules/analytics/index.js

@@ -1,5 +1,3 @@
-// Server-safe: config type + the helper that reads IDs from SiteIntegrations.
-// The <Analytics> component is client-side — exported via ./client.
 export { getAnalyticsConfig } from './getAnalyticsConfig.js';
 
 //# sourceMappingURL=index.js.map

dist/modules/analytics/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/modules/analytics/index.ts"],"sourcesContent":["// Server-safe: config type + the helper that reads IDs from SiteIntegrations.\n// The <Analytics> component is client-side — exported via ./client.\nexport type { AnalyticsConfig } from './types.js'\nexport { getAnalyticsConfig } from './getAnalyticsConfig.js'\n"],"names":["getAnalyticsConfig"],"mappings":"AAAA,8EAA8E;AAC9E,oEAAoE;AAEpE,SAASA,kBAAkB,QAAQ,0BAAyB"}
+{"version":3,"sources":["../../../src/modules/analytics/index.ts"],"sourcesContent":["export { getAnalyticsConfig } from './getAnalyticsConfig.js'\n// Server-safe: config type + the helper that reads IDs from SiteIntegrations.\n// The <Analytics> component is client-side — exported via ./client.\nexport type { AnalyticsConfig } from './types.js'\n"],"names":["getAnalyticsConfig"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,0BAAyB"}

dist/modules/analytics/types.d.js

@@ -1,5 +0,0 @@
-/**
- * Analytics IDs, read from SiteIntegrations (public — safe on the client).
- */ export { };
-
-//# sourceMappingURL=types.d.js.map

dist/modules/analytics/types.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["types.d.ts"],"sourcesContent":["/**\n * Analytics IDs, read from SiteIntegrations (public — safe on the client).\n */\nexport type AnalyticsConfig = {\n    /** GA4 Measurement ID, e.g. 'G-XXXXXXXXXX'. */\n    ga4MeasurementId?: null | string;\n    /** GTM Container ID, e.g. 'GTM-XXXXXXX'. */\n    gtmContainerId?: null | string;\n};\n"],"names":[],"mappings":"AAAA;;CAEC,GACD,WAKE"}

dist/modules/blocks/RenderBlocks.d.js

@@ -1,21 +0,0 @@
-/**
- * Generic, server-side block renderer.
- *
- * Iterates a document's blocks and renders each via the client's component
- * map. Unknown blocks are skipped (null), never thrown. Block-specific logic is
- * delegated to the client's optional `enhanceProps` — the plugin itself is
- * block-agnostic.
- *
- * The client owns components and block schemas (they pass `components` and
- * define blocks in their config); the plugin owns only the iteration and
- * wiring. No wrapper markup is added — spacing/layout belong to the client's
- * components.
- *
- * Nested blocks: a block that needs to render child blocks should render its
- * own <RenderBlocks> and import the registry itself, rather than receiving the
- * component map as a prop. Passing the map as a prop breaks React Server
- * Components — functions (client components) can't cross the server→client
- * boundary via props.
- */ export { };
-
-//# sourceMappingURL=RenderBlocks.d.js.map

dist/modules/blocks/RenderBlocks.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["RenderBlocks.d.ts"],"sourcesContent":["import type { BlockComponentMap, BlockData, EnhanceProps } from './types.js';\nexport type RenderBlocksProps = {\n    /** Block data array from a Payload document (e.g. page.layout). */\n    blocks: BlockData[] | null | undefined;\n    /** Client-provided map of blockType → component. */\n    components: BlockComponentMap;\n    /**\n     * Optional client hook to inject block-specific props (nav anchors, etc.).\n     * Keeps the engine generic — the plugin knows no concrete block types.\n     */\n    enhanceProps?: EnhanceProps;\n};\n/**\n * Generic, server-side block renderer.\n *\n * Iterates a document's blocks and renders each via the client's component\n * map. Unknown blocks are skipped (null), never thrown. Block-specific logic is\n * delegated to the client's optional `enhanceProps` — the plugin itself is\n * block-agnostic.\n *\n * The client owns components and block schemas (they pass `components` and\n * define blocks in their config); the plugin owns only the iteration and\n * wiring. No wrapper markup is added — spacing/layout belong to the client's\n * components.\n *\n * Nested blocks: a block that needs to render child blocks should render its\n * own <RenderBlocks> and import the registry itself, rather than receiving the\n * component map as a prop. Passing the map as a prop breaks React Server\n * Components — functions (client components) can't cross the server→client\n * boundary via props.\n */\nexport declare function RenderBlocks({ blocks, components, enhanceProps }: RenderBlocksProps): import(\"react/jsx-runtime\").JSX.Element | null;\n"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;CAkBC,GACD,WAA8I"}

dist/modules/blocks/index.d.js

@@ -1,3 +0,0 @@
-export { RenderBlocks } from './RenderBlocks.js';
-
-//# sourceMappingURL=index.d.js.map

dist/modules/blocks/index.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.d.ts"],"sourcesContent":["export { RenderBlocks } from './RenderBlocks.js';\nexport type { RenderBlocksProps } from './RenderBlocks.js';\nexport type { BlockComponentMap, BlockData, EnhanceProps } from './types.js';\n"],"names":["RenderBlocks"],"mappings":"AAAA,SAASA,YAAY,QAAQ,oBAAoB"}

dist/modules/blocks/types.d.js

@@ -1,9 +0,0 @@
-/**
- * Optional per-block prop enhancer supplied by the client.
- *
- * Lets the client inject block-specific logic (e.g. collect anchors for a nav
- * block) without the plugin knowing any concrete block types. Returns extra
- * props merged into the rendered block.
- */ export { };
-
-//# sourceMappingURL=types.d.js.map

dist/modules/blocks/types.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["types.d.ts"],"sourcesContent":["import type { ComponentType } from 'react';\n/**\n * A single block's data as stored by Payload — always has a blockType, plus\n * arbitrary block-specific fields. The plugin stays generic over the shape.\n */\nexport type BlockData = {\n    [key: string]: unknown;\n    blockType: string;\n};\n/**\n * Maps a blockType to the client's component for it.\n * The client owns the components; the plugin only receives this map.\n */\nexport type BlockComponentMap = Record<string, ComponentType<any>>;\n/**\n * Optional per-block prop enhancer supplied by the client.\n *\n * Lets the client inject block-specific logic (e.g. collect anchors for a nav\n * block) without the plugin knowing any concrete block types. Returns extra\n * props merged into the rendered block.\n */\nexport type EnhanceProps = (args: {\n    allBlocks: BlockData[];\n    block: BlockData;\n    index: number;\n}) => Record<string, unknown>;\n"],"names":[],"mappings":"AAcA;;;;;;CAMC,GACD,WAI8B"}

dist/modules/consent/ConsentContext.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=ConsentContext.d.js.map

dist/modules/consent/ConsentContext.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["ConsentContext.d.ts"],"sourcesContent":["import { type ReactNode } from 'react';\nimport type { ConsentTexts } from './texts.js';\nimport { useConsent } from './useConsent.js';\ntype ConsentContextValue = {\n    texts: ConsentTexts;\n} & ReturnType<typeof useConsent>;\nexport declare function ConsentProvider({ children, texts }: {\n    children: ReactNode;\n    texts: ConsentTexts;\n}): import(\"react/jsx-runtime\").JSX.Element;\nexport declare function useConsentContext(): ConsentContextValue;\nexport {};\n"],"names":[],"mappings":"AAWA,WAAU"}

dist/modules/consent/CookieBanner.d.js

@@ -1,6 +0,0 @@
-/**
- * Optional class overrides — for when tokens aren't enough, e.g. turning the
- * bottom bar into a centred modal. Replaces the slot's classes outright.
- */ export { };
-
-//# sourceMappingURL=CookieBanner.d.js.map

dist/modules/consent/CookieBanner.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["CookieBanner.d.ts"],"sourcesContent":["/**\n * Optional class overrides — for when tokens aren't enough, e.g. turning the\n * bottom bar into a centred modal. Replaces the slot's classes outright.\n */\nexport type CookieBannerClassNames = {\n    primaryButton?: string;\n    root?: string;\n    secondaryButton?: string;\n};\nexport declare function CookieBanner({ classNames }?: {\n    classNames?: CookieBannerClassNames;\n}): import(\"react/jsx-runtime\").JSX.Element | null;\n"],"names":[],"mappings":"AAAA;;;CAGC,GAMD,WAEmD"}

dist/modules/consent/CookieButton.d.js

@@ -1,12 +0,0 @@
-/**
- * Floating "cookie settings" button — lets visitors reopen the consent panel
- * after deciding (GDPR: withdrawing consent must be as easy as giving it).
- * Hidden while the banner is showing.
- *
- * Colours follow the same CSS custom properties as CookieBanner
- * (--ipal-surface, --ipal-border, --ipal-hover, --ipal-text), so a client's
- * palette applies to both without touching either component. Pass className to
- * replace the styling outright.
- */ export { };
-
-//# sourceMappingURL=CookieButton.d.js.map

dist/modules/consent/CookieButton.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["CookieButton.d.ts"],"sourcesContent":["/**\n * Floating \"cookie settings\" button — lets visitors reopen the consent panel\n * after deciding (GDPR: withdrawing consent must be as easy as giving it).\n * Hidden while the banner is showing.\n *\n * Colours follow the same CSS custom properties as CookieBanner\n * (--ipal-surface, --ipal-border, --ipal-hover, --ipal-text), so a client's\n * palette applies to both without touching either component. Pass className to\n * replace the styling outright.\n */\nexport declare function CookieButton({ className }?: {\n    className?: string;\n}): import(\"react/jsx-runtime\").JSX.Element | null;\n"],"names":[],"mappings":"AAAA;;;;;;;;;CASC,GACD,WAEmD"}

dist/modules/consent/categories.d.js

@@ -1,6 +0,0 @@
-/**
- * Cookie consent categories (GDPR). 'necessary' is always granted and cannot be
- * disabled. The rest default to false until the user opts in.
- */ export { };
-
-//# sourceMappingURL=categories.d.js.map

dist/modules/consent/categories.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["categories.d.ts"],"sourcesContent":["/**\n * Cookie consent categories (GDPR). 'necessary' is always granted and cannot be\n * disabled. The rest default to false until the user opts in.\n */\nexport declare const CONSENT_CATEGORIES: readonly [\"necessary\", \"functional\", \"analytics\", \"marketing\"];\nexport type ConsentCategory = (typeof CONSENT_CATEGORIES)[number];\nexport type ConsentState = Record<ConsentCategory, boolean>;\nexport declare const DEFAULT_CONSENT: ConsentState;\nexport declare const ACCEPT_ALL_CONSENT: ConsentState;\nexport declare const REJECT_ALL_CONSENT: ConsentState;\n"],"names":[],"mappings":"AAAA;;;CAGC,GAMD,WAAsD"}

dist/modules/consent/client.d.js

@@ -1,6 +0,0 @@
-export { ConsentProvider, useConsentContext } from './ConsentContext.js';
-export { CookieBanner } from './CookieBanner.js';
-export { CookieButton } from './CookieButton.js';
-export { useConsent } from './useConsent.js';
-
-//# sourceMappingURL=client.d.js.map

dist/modules/consent/client.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["client.d.ts"],"sourcesContent":["export { ConsentProvider, useConsentContext } from './ConsentContext.js';\nexport { CookieBanner } from './CookieBanner.js';\nexport type { CookieBannerClassNames } from './CookieBanner.js';\nexport { CookieButton } from './CookieButton.js';\nexport { useConsent } from './useConsent.js';\n"],"names":["ConsentProvider","useConsentContext","CookieBanner","CookieButton","useConsent"],"mappings":"AAAA,SAASA,eAAe,EAAEC,iBAAiB,QAAQ,sBAAsB;AACzE,SAASC,YAAY,QAAQ,oBAAoB;AAEjD,SAASC,YAAY,QAAQ,oBAAoB;AACjD,SAASC,UAAU,QAAQ,kBAAkB"}

dist/modules/consent/getConsentTexts.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=getConsentTexts.d.js.map

dist/modules/consent/getConsentTexts.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["getConsentTexts.d.ts"],"sourcesContent":["import type { BasePayload } from 'payload';\nimport type { I18nConfig } from '../i18n/index.js';\nimport type { ConsentTexts } from './texts.js';\ntype GetConsentTextsArgs = {\n    config: I18nConfig;\n    locale?: string;\n    payload: BasePayload;\n    /**\n     * Privacy-policy label + the system page (from SiteSettings.privacyPolicy,\n     * read with locale:'all') to link to. Optional — omit for no link.\n     */\n    privacyPolicy?: {\n        label: string;\n        page: {\n            slug?: null | Record<string, unknown>;\n        } | null;\n    };\n};\n/**\n * Resolves consent banner texts from the CookieSettings global, falling back to\n * English defaults per field. The privacy-policy link is built from the pages\n * module (system page role), not stored in CookieSettings — one source of truth.\n */\nexport declare function getConsentTexts({ config, locale, payload, privacyPolicy, }: GetConsentTextsArgs): Promise<ConsentTexts>;\nexport {};\n"],"names":[],"mappings":"AAwBA,WAAU"}

dist/modules/consent/googleConsent.d.js

@@ -1,3 +0,0 @@
-/** Updates consent after the user decides. */ export { };
-
-//# sourceMappingURL=googleConsent.d.js.map

dist/modules/consent/googleConsent.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["googleConsent.d.ts"],"sourcesContent":["import type { ConsentState } from './categories.js';\ndeclare global {\n    interface Window {\n        dataLayer?: unknown[];\n    }\n}\n/**\n * Mirrors Google's canonical snippet: `function gtag(){dataLayer.push(arguments)}`.\n *\n * Pushing `arguments` rather than a plain array is not a stylistic detail.\n * Google's tags recognise a consent command by the Arguments object it arrives\n * in; a real array lands in the dataLayer as ordinary data and the command is\n * silently ignored — the tag loads, but consent never updates and analytics\n * stays denied. The rest parameter exists only to type the call sites.\n *\n * Exported for the analytics module (which needs `js`/`config` commands) —\n * intentionally not re-exported from the package's public API.\n */\nexport declare function gtag(..._args: unknown[]): void;\n/** Sets the default consent state (call before Google tags load). */\nexport declare function setDefaultConsent(state: ConsentState): void;\n/** Updates consent after the user decides. */\nexport declare function updateConsent(state: ConsentState): void;\n"],"names":[],"mappings":"AAqBA,4CAA4C,GAC5C,WAAiE"}

dist/modules/consent/index.d.js

@@ -1,6 +0,0 @@
-export { ACCEPT_ALL_CONSENT, CONSENT_CATEGORIES, DEFAULT_CONSENT, REJECT_ALL_CONSENT } from './categories.js';
-export { getConsentTexts } from './getConsentTexts.js';
-export { setDefaultConsent, updateConsent } from './googleConsent.js';
-export { CONSENT_COOKIE, CONSENT_MAX_AGE, CONSENT_VERSION, parseConsent, serializeConsent } from './storage.js';
-
-//# sourceMappingURL=index.d.js.map

dist/modules/consent/index.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.d.ts"],"sourcesContent":["export { ACCEPT_ALL_CONSENT, CONSENT_CATEGORIES, DEFAULT_CONSENT, REJECT_ALL_CONSENT, } from './categories.js';\nexport type { ConsentCategory, ConsentState } from './categories.js';\nexport { getConsentTexts } from './getConsentTexts.js';\nexport { setDefaultConsent, updateConsent } from './googleConsent.js';\nexport { CONSENT_COOKIE, CONSENT_MAX_AGE, CONSENT_VERSION, parseConsent, serializeConsent, } from './storage.js';\nexport type { ConsentTexts } from './texts.js';\n"],"names":["ACCEPT_ALL_CONSENT","CONSENT_CATEGORIES","DEFAULT_CONSENT","REJECT_ALL_CONSENT","getConsentTexts","setDefaultConsent","updateConsent","CONSENT_COOKIE","CONSENT_MAX_AGE","CONSENT_VERSION","parseConsent","serializeConsent"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,kBAAkB,EAAEC,eAAe,EAAEC,kBAAkB,QAAS,kBAAkB;AAE/G,SAASC,eAAe,QAAQ,uBAAuB;AACvD,SAASC,iBAAiB,EAAEC,aAAa,QAAQ,qBAAqB;AACtE,SAASC,cAAc,EAAEC,eAAe,EAAEC,eAAe,EAAEC,YAAY,EAAEC,gBAAgB,QAAS,eAAe"}

dist/modules/consent/storage.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=storage.d.js.map

dist/modules/consent/storage.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["storage.d.ts"],"sourcesContent":["import type { ConsentState } from './categories.js';\n/**\n * Consent persistence in a cookie. Stored with a version so we can invalidate\n * old consents when the policy changes, and a timestamp (GDPR: consent must be\n * dated). Readable both client-side (banner) and server-side (script gating).\n */\nexport declare const CONSENT_COOKIE = \"cookie-consent\";\nexport declare const CONSENT_VERSION = 1;\nexport declare const CONSENT_MAX_AGE: number;\nexport declare function serializeConsent(state: ConsentState): string;\nexport declare function parseConsent(raw: string | undefined): ConsentState | null;\n"],"names":[],"mappings":"AAUA,WAAmF"}

dist/modules/consent/texts.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=texts.d.js.map

dist/modules/consent/texts.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["texts.d.ts"],"sourcesContent":["import type { ConsentCategory } from './categories.js';\nexport type ConsentTexts = {\n    buttons: {\n        acceptAll: string;\n        back: string;\n        reject: string;\n        save: string;\n        settings: string;\n    };\n    categories: Record<ConsentCategory, {\n        description: string;\n        title: string;\n    }>;\n    message: string;\n    /** null = no privacy-policy link shown */\n    privacyLink: {\n        href: string;\n        label: string;\n    } | null;\n    settingsTitle: string;\n};\n"],"names":[],"mappings":"AACA,WAmBE"}

dist/modules/consent/useConsent.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=useConsent.d.js.map

dist/modules/consent/useConsent.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["useConsent.d.ts"],"sourcesContent":["import type { ConsentCategory, ConsentState } from './categories.js';\nexport declare function useConsent(): {\n    acceptAll: () => void;\n    decided: boolean;\n    rejectAll: () => void;\n    reopen: () => void;\n    savePreferences: (choices: Partial<Record<ConsentCategory, boolean>>) => void;\n    state: ConsentState;\n};\n"],"names":[],"mappings":"AACA,WAOE"}

dist/modules/consent/useConsent.d.ts

@@ -1,5 +1,5 @@
 import type { ConsentCategory, ConsentState } from './categories.js';
-export declare function useConsent(): {
+export declare function useConsent(cookieMap?: Partial<Record<ConsentCategory, string[]>>): {
     acceptAll: () => void;
     decided: boolean;
     rejectAll: () => void;

dist/modules/consent/useConsent.js

@@ -1,9 +1,22 @@
 'use client';
 import { useCallback, useEffect, useState } from 'react';
+import { LOCALE_COOKIE_NAME } from '../i18n/index.js';
 import { ACCEPT_ALL_CONSENT, DEFAULT_CONSENT, REJECT_ALL_CONSENT } from './categories.js';
 import { updateConsent } from './googleConsent.js';
 import { CONSENT_COOKIE, CONSENT_MAX_AGE, parseConsent, serializeConsent } from './storage.js';
-export function useConsent() {
+/**
+ * Cookies to delete when consent for a category is withdrawn. Keyed by
+ * category. The plugin knows about its own functional cookie (locale); clients
+ * can extend this via the `cookieMap` arg to useConsent if they set their own.
+ */ const DEFAULT_COOKIE_MAP = {
+    functional: [
+        LOCALE_COOKIE_NAME
+    ]
+};
+/** Expire a cookie now, across the whole site. */ function deleteCookie(name) {
+    document.cookie = `${name}=;path=/;max-age=0;samesite=lax`;
+}
+export function useConsent(cookieMap = DEFAULT_COOKIE_MAP) {
     const [state, setState] = useState(DEFAULT_CONSENT);
     const [decided, setDecided] = useState(false);
     useEffect(()=>{
@@ -15,6 +28,19 @@ export function useConsent() {
         }
     }, []);
     const persist = useCallback((next)=>{
+        // Withdrawal cleanup: for any category flipping true → false, delete the
+        // cookies tied to it. GDPR: withdrawing consent must stop the processing,
+        // so a functional cookie (e.g. locale) written under consent has to go when
+        // that consent is revoked. Uses the current `state` as the previous value.
+        for (const cat of Object.keys(cookieMap)){
+            const wasGranted = state[cat] === true;
+            const nowDenied = next[cat] !== true;
+            if (wasGranted && nowDenied) {
+                for (const name of cookieMap[cat] ?? []){
+                    deleteCookie(name);
+                }
+            }
+        }
         document.cookie = `${CONSENT_COOKIE}=${serializeConsent(next)};path=/;max-age=${CONSENT_MAX_AGE};samesite=lax`;
         setState(next);
         setDecided(true);
@@ -23,7 +49,10 @@ export function useConsent() {
         // the rest of the session and never write their cookies — the banner would
         // look like it worked while nothing changed.
         updateConsent(next);
-    }, []);
+    }, [
+        state,
+        cookieMap
+    ]);
     const acceptAll = useCallback(()=>persist(ACCEPT_ALL_CONSENT), [
         persist
     ]);

dist/modules/content/archiveFields.d.js

@@ -1,12 +0,0 @@
-/**
- * Builds one relationship field per content collection, pointing at the
- * client's Pages collection.
- *
- * Sits alongside the system-page roles (homepage, privacy policy) because it's
- * the same idea: a page referenced by function rather than by slug. The
- * assignment is locale-agnostic — one page document — while the resulting path
- * is locale-aware, since the page's slug is localized. Assign the "Artykuły"
- * page once and you get /pl/artykuly and /en/articles from its own slugs.
- */ export { };
-
-//# sourceMappingURL=archiveFields.d.js.map

dist/modules/content/archiveFields.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["archiveFields.d.ts"],"sourcesContent":["import type { Field } from 'payload';\nimport type { ContentOption } from './types.js';\n/**\n * Builds one relationship field per content collection, pointing at the\n * client's Pages collection.\n *\n * Sits alongside the system-page roles (homepage, privacy policy) because it's\n * the same idea: a page referenced by function rather than by slug. The\n * assignment is locale-agnostic — one page document — while the resulting path\n * is locale-aware, since the page's slug is localized. Assign the \"Artykuły\"\n * page once and you get /pl/artykuly and /en/articles from its own slugs.\n */\nexport declare function buildArchiveFields(content: ContentOption, pagesSlug: string): Field[];\n"],"names":[],"mappings":"AAEA;;;;;;;;;CASC,GACD,WAA+F"}

dist/modules/content/getArchiveEntries.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=getArchiveEntries.d.js.map

dist/modules/content/getArchiveEntries.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["getArchiveEntries.d.ts"],"sourcesContent":["import type { BasePayload } from 'payload';\nexport type ArchiveEntries<T = Record<string, unknown>> = {\n    docs: T[];\n    hasNextPage: boolean;\n    hasPrevPage: boolean;\n    /** 1-based. */\n    page: number;\n    totalDocs: number;\n    totalPages: number;\n};\ntype GetArchiveEntriesArgs = {\n    /** Collection to list, e.g. 'posts'. */\n    collection: string;\n    /** Relationship depth. Defaults to 1 — enough for a cover image. */\n    depth?: number;\n    locale: string;\n    /** 1-based. Values below 1 are clamped. */\n    page?: number;\n    payload: BasePayload;\n    /** Defaults to 10. */\n    perPage?: number;\n    /** Payload sort string. Defaults to newest first. */\n    sort?: string;\n    /** Extra constraints merged into the query, e.g. { category: { equals: id } }. */\n    where?: Record<string, unknown>;\n};\n/**\n * Fetches one page of a collection's entries for an archive listing.\n *\n * Only published documents are returned when the collection has drafts enabled;\n * Payload's `where` on `_status` is left to the caller, since a collection\n * without drafts has no such field.\n *\n * Returns pagination facts rather than markup — the listing itself belongs to\n * the client (as a block on the archive page, most likely), because how a list\n * of posts should look isn't something a plugin can decide.\n */\nexport declare function getArchiveEntries<T = Record<string, unknown>>({ collection, depth, locale, page, payload, perPage, sort, where, }: GetArchiveEntriesArgs): Promise<ArchiveEntries<T>>;\nexport {};\n"],"names":[],"mappings":"AAsCA,WAAU"}

dist/modules/content/index.d.js

@@ -1,7 +0,0 @@
-export { buildArchiveFields } from './archiveFields.js';
-export { getArchiveEntries } from './getArchiveEntries.js';
-export { buildArchivePath, buildEntryPath, parsePageParam } from './paths.js';
-export { resolveRoute } from './resolveRoute.js';
-export { archiveFieldName } from './types.js';
-
-//# sourceMappingURL=index.d.js.map

dist/modules/content/index.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.d.ts"],"sourcesContent":["export { buildArchiveFields } from './archiveFields.js';\nexport { getArchiveEntries } from './getArchiveEntries.js';\nexport type { ArchiveEntries } from './getArchiveEntries.js';\nexport { buildArchivePath, buildEntryPath, parsePageParam } from './paths.js';\nexport { resolveRoute } from './resolveRoute.js';\nexport type { ResolvedRoute } from './resolveRoute.js';\nexport type { ContentCollectionOption, ContentOption } from './types.js';\nexport { archiveFieldName } from './types.js';\n"],"names":["buildArchiveFields","getArchiveEntries","buildArchivePath","buildEntryPath","parsePageParam","resolveRoute","archiveFieldName"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,qBAAqB;AACxD,SAASC,iBAAiB,QAAQ,yBAAyB;AAE3D,SAASC,gBAAgB,EAAEC,cAAc,EAAEC,cAAc,QAAQ,aAAa;AAC9E,SAASC,YAAY,QAAQ,oBAAoB;AAGjD,SAASC,gBAAgB,QAAQ,aAAa"}

dist/modules/content/paths.d.js

@@ -1,3 +0,0 @@
-export { };
-
-//# sourceMappingURL=paths.d.js.map