rimecms 0.31.3 → 0.31.4

package/README.md

@@ -1,21 +1,19 @@
 ![rime logo](https://github.com/bienbiendev/rime/blob/main/assets/logo-white.png#gh-dark-mode-only)
 ![rime logo](https://github.com/bienbiendev/rime/blob/main/assets/logo-black.png#gh-light-mode-only)
 
-Headless CMS powered by SvelteKit.
+Headless CMS powered by SvelteKit. [Read the doc](https://github.com/bienbiendev/rime-doc/tree/master/docs)
 
 ![NPM Version](https://img.shields.io/npm/v/rimecms)
 ![NPM Downloads](https://img.shields.io/npm/dm/rimecms)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/bienbiendev/rime/blob/main/LICENSE)
 
-![alt backend capture](https://github.com/bienbiendev/rime/blob/main/assets/preview.png?raw=true)
-
-[Documentation](https://github.com/bienbiendev/rime-doc/tree/master/docs)
+![alt backend capture](https://github.com/bienbiendev/rime-doc/blob/develop/static/rime-preview-02-dark.jpg?raw=true)
 
 ## Features
 
 - Easy configuration
 - TypeScript
-- Built-in authentication (better-auth)
+- Built-in authentication with configurable better-auth.
 - Auto-generated:
   - API endpoints
   - Types
@@ -26,210 +24,11 @@ Headless CMS powered by SvelteKit.
 - Media management
 - Fine grained access control
 - i18n support
-- Document Hooks
+- Document versions
 - Optional SMTP integration
-
-### Content Management
-
-Fields types:
-
-- Blocks
-- Tree (nested array)
-- Tabs
-- Rich Text (TipTap)
-- Relation
-- Link
-- Slug
-- Email
-- Group
-- Select/Radio/Checkbox
-- Number
-- And more...
-
-## Quick Start
-
-### 1. Create a SvelteKit Project
-
-```bash
-npx sv create my-app
-cd my-app
-```
-
-> [!NOTE]
-> Select TypeScript when prompted
-
-### 2. Install Rime
-
-```bash
-npm install rimecms
-npx rime init
-```
-
-The `rime init` command will automatically:
-
-- Create/populate `.env` file
-- Create `src/lib/+rime/rime.config.ts` config file
-- Create a `db/` folder
-- Add a `drizzle.config.ts`
-- Create `src/hooks.server.ts` with the required initialization code
-- Add the Rime plugin to `vite.config.ts`
-- Install dependencies.
-- Push initial schema
-
-### 3. Create the first admin user
-
-```bash
-npm run dev
-```
-
-```bash
-curl -v POST http://localhost:5173/api/init \
-  -H "Content-Type: application/json" \
-  -d '{"email": "you@website.com", "password": "super-Secret+2000", "name": "Admin"}'
-```
-
-## Configuration Example
-
-```typescript
-// ./src/lib/+rime/rime.config.server.ts
-import { rime, Collection, Area } from '$rime/config';
-import { adapterSqlite } from 'rimecms/adapter-sqlite';
-import { Settings2 } from '@lucide/svelte';
-import { relation, link, richText, text, toggle } from 'rimecms/fields';
-import { access } from "rimecms/util";
-
-const Pages = Collection.create('pages', {
-  fields: [
-    text('title').isTitle().required(),
-    relation('parent').to('pages'),
-    richText('intro')
-  ],
-  access: {
-    read: () => true,
-    create: (user) => access.isAdmin(user),
-    update: (user) => access.hasRoles(user, 'admin', 'editor')
-  }
-};
-
-const Settings = Area.create('settings', {
-  icon: Settings2,
-  fields: [
-    toggle('maintenance'),
-    link('about'),
-    relation('logo').to('medias')
-  ],
-  access: {
-    read: () => true
-  }
-};
-
-const Medias = Collection.create('medias', {
-  label: {
-    singular: 'Media',
-    plural: 'Medias',
-  },
-  upload: true,
-  fields: [
-    text('alt')
-  ]
-};
-
-// Properties prefixed with "$" are server-only props, they will be stripped
-// in the generated client config
-export default rime({
-  $adapter: adapterSqlite('my-db.sqlite'),
-  collections: [Pages, Medias],
-  areas: [Settings],
-  staff: {
-    roles: [{ value: 'admin', label: 'Administrator' }, { value: 'editor' }],
-    fields: [
-      text('website')
-    ]
-  },
-  panel: {
-    $access: (user) => access.hasRoles(user, 'admin', 'editor'),
-  }
-});
-
-```
-
-> [!NOTE]
-> Icons must be imported from `@lucide/svelte` (other icon packages are not tested, but should work if a size prop is available on icon component)
-> Detailed configuration documentation is in development. Feel free to open issues for questions!
-
-## Retrieve your data
-
-### In routes handlers :
-
-```ts
-export const load = async (event: LayoutServerLoadEvent) => {
-  const { rime } = event.locals;
-  // Get an Area document
-  const menu = await rime.area('menu').find();
-  // Get all pages documents
-  const pages = await rime.collection('pages').findAll({ locale: 'en' });
-  // Get a page byId
-  const home = await rime.collection('pages').findById({ locale: 'en', id: 'some-id' });
-  // Get a user with a query
-  const [user] = await rime.collection('users').find({
-    query: `where[email][equals]=some@email.com` // qs query or ParsedQsQuery
-  });
-  // Get some config values
-  const languages = rime.config.getLocalesCodes();
-  const collections = rime.config.collections;
-  //...
-};
-```
-
-### From the API :
-
-```ts
-const { docs } = await fetch('http://localhost:5173/api/pages').then((r) => r.json());
-const { docs } = await fetch('http://localhost:5173/api/pages?sort=title&limit=1').then((r) =>
-  r.json()
-);
-const { docs } = await fetch(
-  'http://localhost:5173/api/pages?where[author][equals]=some-id&locale=en`;'
-).then((r) => r.json());
-const { docs } = await fetch(
-  'http://localhost:5173/api/pages?where[author.email][equals]=some@email.com&locale=en`;'
-).then((r) => r.json());
-```
-
-## DEPLOYING
-
-For now I am using it with @svelte/adapter-node, other adapter not tested and probably not working.
-
-With the node adapter :
-
-```sh
-npx rime build
-npx rime build -d # to copy the database directory
-```
-
-It's doing bascically `vite build` under the hood and create the server file inside an app directory, plus giving some info on how to run it.
-
-## ROADMAP
-
-- [x] switch from lucia to better-auth
-- [x] Document locked while being edited by another user
-- [x] Panel i18n
-- [x] Document status
-- [x] Tree field
-- [x] more tiptap integration
-- [x] more flexible better-auth integration
-- [x] Document version
-- [x] collection nested
-- [x] more better-auth integration
-- [x] Handle relation poperties in queries
-- [~] Documentation
-- [ ] Live Edit system in practice
-- [ ] configurable files storage adapter (local, s3, etc)
-- [ ] other storage adapter (postgress, turso, etc)
-- [ ] auto-saved draft
-- [ ] Put bin commands in a separate package ex: @rime/kit
+- Many built-in fields type
 
 ## Acknowledgments
 
 - Built with components from @huntabyte's bits-ui
-- Inspired by Kirby CMS and Payload CMS architectures
+- Inspired by Kirby CMS and Payload CMS

package/dist/adapter-sqlite/auth.server.d.ts

@@ -11,7 +11,7 @@ declare const createAuthFacade: (args: {
     db: LibSQLDatabase<GetRegisterType<"Schema">>;
     schema: GetRegisterType<"Schema">;
 }) => {
-    betterAuthAdapter: (options: import("better-auth/types").BetterAuthOptions) => import("better-auth/types").DBAdapter<import("better-auth/types").BetterAuthOptions>;
+    betterAuthAdapter: (options: import("better-auth").BetterAuthOptions) => import("better-auth").DBAdapter<import("better-auth").BetterAuthOptions>;
     hasAuthUser: () => Promise<boolean>;
     getAuthUserId: ({ slug, id }: {
         slug: CollectionSlug;

package/dist/adapter-sqlite/generate-schema/templates.server.d.ts

@@ -170,8 +170,8 @@ export declare const templateExportTables: (tables: string[]) => string;
  * Generates authentication tables for the schema
  * Creates tables for users, sessions, accounts, and verifications
  */
-export declare const templateAuth = "\nexport const authUsers = sqliteTable('auth_users', {\n\tid: text('id').primaryKey(),\n\tname: text('name').notNull(),\n\temail: text('email').notNull().unique(),\n\temailVerified: integer('email_verified', { mode: 'boolean' }).notNull(),\n\timage: text('image'),\n\tcreatedAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull(),\n\trole: text('role'),\n\tbanned: integer('banned', { mode: 'boolean' }),\n\tbanReason: text('ban_reason'),\n\tbanExpires: integer('ban_expires', { mode: 'timestamp_ms' }),\n\ttype: text('type').notNull()\n  });\n\nexport const authSessions = sqliteTable('auth_sessions', {\n\tid: text('id').primaryKey(),\n\texpiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),\n\ttoken: text('token').notNull().unique(),\n\tcreatedAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull(),\n\tipAddress: text('ip_address'),\n\tuserAgent: text('user_agent'),\n\tuserId: text('user_id')\n\t\t.notNull()\n\t\t.references(() => authUsers.id, { onDelete: 'cascade' }),\n\timpersonatedBy: text('impersonated_by')\n  });\n\nexport const authAccounts = sqliteTable('auth_accounts', {\n\tid: text('id').primaryKey(),\n\taccountId: text('account_id').notNull(),\n\tproviderId: text('provider_id').notNull(),\n\tuserId: text('user_id')\n\t\t.notNull()\n\t\t.references(() => authUsers.id, { onDelete: 'cascade' }),\n\taccessToken: text('access_token'),\n\trefreshToken: text('refresh_token'),\n\tidToken: text('id_token'),\n\taccessTokenExpiresAt: integer('access_token_expires_at', { mode: 'timestamp_ms' }),\n\trefreshTokenExpiresAt: integer('refresh_token_expires_at', { mode: 'timestamp_ms' }),\n\tscope: text('scope'),\n\tpassword: text('password'),\n\tcreatedAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull()\n  });\n\nexport const authVerifications = sqliteTable('auth_verifications', {\n\tid: text('id').primaryKey(),\n\tidentifier: text('identifier').notNull(),\n\tvalue: text('value').notNull(),\n\texpiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),\n\tcreatedAt: integer('created_at', { mode: 'timestamp_ms' }),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp_ms' })\n  });\n";
-export declare const templateAPIKey = "\nexport const apikey = sqliteTable(\"apikey\", {\n\tid: text('id').primaryKey(),\n\tname: text('name'),\n\tstart: text('start'),\n\tprefix: text('prefix'),\n\tkey: text('key').notNull(),\n\tuserId: text('user_id').notNull().references(()=> authUsers.id, { onDelete: 'cascade' }),\n\trefillInterval: integer('refill_interval'),\n\trefillAmount: integer('refill_amount'),\n\tlastRefillAt: integer('last_refill_at', { mode: 'timestamp' }),\n\tenabled: integer('enabled', { mode: 'boolean' }).default(true),\n\trateLimitEnabled: integer('rate_limit_enabled', { mode: 'boolean' }).default(true),\n\trateLimitTimeWindow: integer('rate_limit_time_window').default(86400000),\n\trateLimitMax: integer('rate_limit_max').default(10),\n\trequestCount: integer('request_count'),\n\tremaining: integer('remaining'),\n\tlastRequest: integer('last_request', { mode: 'timestamp' }),\n\texpiresAt: integer('expires_at', { mode: 'timestamp' }),\n\tcreatedAt: integer('created_at', { mode: 'timestamp' }).notNull(),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp' }).notNull(),\n\tpermissions: text('permissions'),\n\tmetadata: text('metadata')\n});\n";
+export declare const templateAuth = "\nexport const authUsers = sqliteTable('auth_users', {\n\tid: text('id').primaryKey(),\n\tname: text('name').notNull(),\n\temail: text('email').notNull().unique(),\n\temailVerified: integer('email_verified', { mode: 'boolean' }).notNull(),\n\timage: text('image'),\n\tcreatedAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull(),\n\trole: text('role'),\n\tbanned: integer('banned', { mode: 'boolean' }),\n\tbanReason: text('ban_reason'),\n\tbanExpires: integer('ban_expires', { mode: 'timestamp_ms' }),\n\ttype: text('type').notNull()\n  });\n\nexport const authSessions = sqliteTable('auth_sessions', {\n\tid: text('id').primaryKey(),\n\texpiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),\n\ttoken: text('token').notNull().unique(),\n\tcreatedAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull(),\n\tipAddress: text('ip_address'),\n\tuserAgent: text('user_agent'),\n\tuserId: text('user_id')\n\t\t.notNull()\n\t\t.references(() => authUsers.id, { onDelete: 'cascade' }),\n\timpersonatedBy: text('impersonated_by')\n  });\n\nexport const authAccounts = sqliteTable('auth_accounts', {\n\tid: text('id').primaryKey(),\n\taccountId: text('account_id').notNull(),\n\tissuer: text('issuer').notNull(),\n\tproviderId: text('provider_id').notNull(),\n\tuserId: text('user_id')\n\t\t.notNull()\n\t\t.references(() => authUsers.id, { onDelete: 'cascade' }),\n\taccessToken: text('access_token'),\n\trefreshToken: text('refresh_token'),\n\tidToken: text('id_token'),\n\taccessTokenExpiresAt: integer('access_token_expires_at', { mode: 'timestamp_ms' }),\n\trefreshTokenExpiresAt: integer('refresh_token_expires_at', { mode: 'timestamp_ms' }),\n\tscope: text('scope'),\n\tpassword: text('password'),\n\tcreatedAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp_ms' }).notNull()\n  });\n\nexport const authVerifications = sqliteTable('auth_verifications', {\n\tid: text('id').primaryKey(),\n\tidentifier: text('identifier').notNull(),\n\tvalue: text('value').notNull(),\n\texpiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),\n\tcreatedAt: integer('created_at', { mode: 'timestamp_ms' }),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp_ms' })\n  });\n";
+export declare const templateAPIKey = "\nexport const apikey = sqliteTable(\"apikey\", {\n\tid: text('id').primaryKey(),\n\tname: text('name'),\n\tstart: text('start'),\n\tprefix: text('prefix'),\n\tkey: text('key').notNull(),\n\treferenceId: text('reference_id').notNull().references(()=> authUsers.id, { onDelete: 'cascade' }),\n\tconfigId: text('config_id').notNull().default('default'),\n\trefillInterval: integer('refill_interval'),\n\trefillAmount: integer('refill_amount'),\n\tlastRefillAt: integer('last_refill_at', { mode: 'timestamp' }),\n\tenabled: integer('enabled', { mode: 'boolean' }).default(true),\n\trateLimitEnabled: integer('rate_limit_enabled', { mode: 'boolean' }).default(true),\n\trateLimitTimeWindow: integer('rate_limit_time_window').default(86400000),\n\trateLimitMax: integer('rate_limit_max').default(10),\n\trequestCount: integer('request_count'),\n\tremaining: integer('remaining'),\n\tlastRequest: integer('last_request', { mode: 'timestamp' }),\n\texpiresAt: integer('expires_at', { mode: 'timestamp' }),\n\tcreatedAt: integer('created_at', { mode: 'timestamp' }).notNull(),\n\tupdatedAt: integer('updated_at', { mode: 'timestamp' }).notNull(),\n\tpermissions: text('permissions'),\n\tmetadata: text('metadata')\n});\n";
 /**
  * Generates the final schema export with all tables and relations
  * Creates a schema object and exports it with proper TypeScript types

package/dist/adapter-sqlite/generate-schema/templates.server.js

@@ -277,6 +277,7 @@ export const authSessions = sqliteTable('auth_sessions', {
 export const authAccounts = sqliteTable('auth_accounts', {
 	id: text('id').primaryKey(),
 	accountId: text('account_id').notNull(),
+	issuer: text('issuer').notNull(),
 	providerId: text('provider_id').notNull(),
 	userId: text('user_id')
 		.notNull()
@@ -308,7 +309,8 @@ export const apikey = sqliteTable("apikey", {
 	start: text('start'),
 	prefix: text('prefix'),
 	key: text('key').notNull(),
-	userId: text('user_id').notNull().references(()=> authUsers.id, { onDelete: 'cascade' }),
+	referenceId: text('reference_id').notNull().references(()=> authUsers.id, { onDelete: 'cascade' }),
+	configId: text('config_id').notNull().default('default'),
 	refillInterval: integer('refill_interval'),
 	refillAmount: integer('refill_amount'),
 	lastRefillAt: integer('last_refill_at', { mode: 'timestamp' }),

package/dist/adapter-sqlite/generate-schema/write.server.js

@@ -6,11 +6,15 @@ import fs from 'fs';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 const write = (schema) => {
+    const outputFile = schemaPath();
+    // The output path is part of what "unchanged" means here, not just the schema string — a
+    // RIME_CONFIG_DIR change can leave the schema content byte-identical while the file it needs
+    // to land at moves, and drizzle-kit still needs to re-run against the new location.
+    const cacheValue = `${outputFile}\n${schema}`;
     const cachedSchema = cache.get('schema');
-    if (cachedSchema && cachedSchema === schema) {
+    if (cachedSchema && cachedSchema === cacheValue) {
         return;
     }
-    const outputFile = schemaPath();
     const outputDir = path.dirname(outputFile);
     if (!fs.existsSync(outputDir)) {
         fs.mkdirSync(outputDir, { recursive: true });
@@ -45,6 +49,6 @@ const write = (schema) => {
     // Only mark the schema as in sync once generate + migrate both actually
     // succeeded — otherwise a future run with an unchanged schema string would
     // skip re-running drizzle-kit and the DB would stay silently out of sync.
-    cache.set('schema', schema);
+    cache.set('schema', cacheValue);
 };
 export default write;

package/dist/core/config/auth/better-auth-hooks.server.d.ts

@@ -1,4 +1,4 @@
-import { type AuthMiddleware } from 'better-auth/plugins';
+import { type AuthMiddleware } from 'better-auth/api';
 /****************************************************/
 export declare const betterAuthBeforeHook: AuthMiddleware;
 export declare const betterAuthAfterHook: AuthMiddleware;

package/dist/core/config/auth/better-auth-hooks.server.js

@@ -4,8 +4,7 @@ import { BETTER_AUTH_ROLES } from '../../collections/auth/constant.server.js';
 import { logger } from '../../logger/index.server.js';
 import { trycatch } from '../../../util/function.js';
 import { omit } from '../../../util/object.js';
-import { APIError } from 'better-auth/api';
-import { createAuthMiddleware } from 'better-auth/plugins';
+import { APIError, createAuthMiddleware } from 'better-auth/api';
 import { eq } from 'drizzle-orm';
 /****************************************************/
 /* After hooks

package/dist/core/config/auth/better-auth-permissions.d.ts

@@ -1,73 +1,33 @@
 export declare const accessControl: {
-    newRole<K extends "user" | "session">(statements: import("better-auth/plugins/access").Subset<K, {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
         readonly session: readonly ["list", "revoke", "delete"];
-    }>): {
-        authorize<K_1 extends K>(request: K_1 extends infer T extends K_2 ? { [key in T]?: import("better-auth/plugins/access").Subset<K, {
-            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-            readonly session: readonly ["list", "revoke", "delete"];
-        }>[key] | {
-            actions: import("better-auth/plugins/access").Subset<K, {
-                readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-                readonly session: readonly ["list", "revoke", "delete"];
-            }>[key];
-            connector: "OR" | "AND";
-        } | undefined; } : never, connector?: "OR" | "AND"): import("better-auth/plugins/access").AuthorizeResponse;
-        statements: import("better-auth/plugins/access").Subset<K, {
-            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-            readonly session: readonly ["list", "revoke", "delete"];
-        }>;
-    };
-    statements: {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-        readonly session: readonly ["list", "revoke", "delete"];
-    };
-};
-export declare const admin: {
-    authorize<K_1 extends "user" | "session">(request: K_1 extends infer T extends K ? { [key in T]?: import("better-auth/plugins/access").Subset<"user" | "session", {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-        readonly session: readonly ["list", "revoke", "delete"];
-    }>[key] | {
-        actions: import("better-auth/plugins/access").Subset<"user" | "session", {
-            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-            readonly session: readonly ["list", "revoke", "delete"];
-        }>[key];
-        connector: "OR" | "AND";
-    } | undefined; } : never, connector?: "OR" | "AND"): import("better-auth/plugins/access").AuthorizeResponse;
-    statements: import("better-auth/plugins/access").Subset<"user" | "session", {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
         readonly session: readonly ["list", "revoke", "delete"];
     }>;
-};
-export declare const staff: {
-    authorize<K_1 extends "user">(request: K_1 extends infer T extends K ? { [key in T]?: import("better-auth/plugins/access").Subset<"user", {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-        readonly session: readonly ["list", "revoke", "delete"];
-    }>[key] | {
-        actions: import("better-auth/plugins/access").Subset<"user", {
-            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-            readonly session: readonly ["list", "revoke", "delete"];
-        }>[key];
-        connector: "OR" | "AND";
-    } | undefined; } : never, connector?: "OR" | "AND"): import("better-auth/plugins/access").AuthorizeResponse;
-    statements: import("better-auth/plugins/access").Subset<"user", {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-        readonly session: readonly ["list", "revoke", "delete"];
-    }>;
-};
-export declare const user: {
-    authorize<K_1 extends "user" | "session">(request: K_1 extends infer T extends K ? { [key in T]?: import("better-auth/plugins/access").Subset<"user" | "session", {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-        readonly session: readonly ["list", "revoke", "delete"];
-    }>[key] | {
-        actions: import("better-auth/plugins/access").Subset<"user" | "session", {
-            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
-            readonly session: readonly ["list", "revoke", "delete"];
-        }>[key];
-        connector: "OR" | "AND";
-    } | undefined; } : never, connector?: "OR" | "AND"): import("better-auth/plugins/access").AuthorizeResponse;
-    statements: import("better-auth/plugins/access").Subset<"user" | "session", {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    statements: {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
         readonly session: readonly ["list", "revoke", "delete"];
-    }>;
+    };
 };
+export declare const admin: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<import("better-auth/plugins").ExactRoleStatements<{
+    readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: ["list", "revoke", "delete"];
+}>>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+}>;
+export declare const staff: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+    readonly user: ["create", "list", "delete"];
+}>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+}>;
+export declare const user: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<import("better-auth/plugins").ExactRoleStatements<{
+    readonly user: [];
+    readonly session: [];
+}>>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+}>;