rimecms 0.31.4 → 0.32.0

package/dist/core/auth/hooks/create-better-auth-user.server.js

@@ -0,0 +1,212 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+import { dev } from '$app/environment';
+import { RimeError, RimeFormError } from '../../errors/index.js';
+import { access } from '../access.js';
+import { t__ } from '../../i18n/index.js';
+import { BETTER_AUTH_ROLES } from '../constant.server.js';
+/**
+ * Create a better-auth user before a document creation
+ */
+export const createBetterAuthUser = Hooks.beforeCreate(async function createBetterAuthUser(args) {
+    const { config, event } = args;
+    const { rime } = event.locals;
+    if (!config.auth)
+        return args;
+    const IS_API_KEY_OPERATION = config.auth?.type === 'apiKey';
+    const ADMIN_ROLE_IN_DATA = Array.isArray(args.data.roles) && args.data.roles.includes(BETTER_AUTH_ROLES.ADMIN);
+    const IS_CURRENT_USER_ADMIN = access.isAdmin(event.locals.user);
+    const IS_CURRENT_USER_STAFF = Boolean(event.locals.user?.isStaff);
+    const IS_STAFF_CREATION = config.slug === 'staff';
+    const ADMIN_ROLE_ALLOWED = IS_STAFF_CREATION && Boolean(config.auth?.roles?.includes('admin'));
+    /**
+     * Which creation path this request is on. First match wins, read top to bottom.
+     *
+     * Written as a plain if/else-if chain: the conditions are not mutually exclusive and the
+     * order between them is the actual logic, so it should read as control flow.
+     */
+    const CREATION_CASE = {
+        INIT: 'INIT',
+        ADMIN_CREATE_USER: 'ADMIN_CREATE_USER',
+        STAFF_CREATE_USER: 'STAFF_CREATE_USER',
+        PUBLIC_SIGNUP: 'PUBLIC_SIGNUP',
+        API_KEY_CREATION: 'API_KEY_CREATION'
+    };
+    const resolveCase = () => {
+        /**
+         * 1. First-time Setup (Init)
+         * 	- Description: Creating the first admin user when the system is initialized
+         *		- Actor: No authenticated user exists yet
+         *			- Auth Flow:
+         *				- event.locals.isInit = true is set
+         *				- use admin plugin to creates user with "admin" role
+         *				- this will be the only isSuperAdmin user
+         */
+        if (Boolean(event.locals.isInit) && dev)
+            return CREATION_CASE.INIT;
+        /**
+         *	2. Admin Creating Users
+         *		- Description: Admin creates any users through the panel
+         *		- Actor: Authenticated admin user
+         *		- Auth Flow:
+         *			- Use the admin plugin to create a user
+         */
+        if (IS_CURRENT_USER_ADMIN && !IS_API_KEY_OPERATION)
+            return CREATION_CASE.ADMIN_CREATE_USER;
+        /*
+         * 3. Staff Creating users
+         *		- Description: Any panel user (staff collection) non admin, creating other users
+         *		- Actor: Authenticated staff user
+         *		- Auth Flow:
+         *			- ??
+         */
+        if (IS_CURRENT_USER_STAFF && !IS_API_KEY_OPERATION)
+            return CREATION_CASE.STAFF_CREATE_USER;
+        /*
+         * 4. Public User Signup
+         * 	- Description: End users registering themselves or sigin with social Provider
+         * 	- Actor: Unauthenticated visitor
+         * 	- Auth Flow:
+         * 		- User submits signup form
+         * 		- Better-Auth creates user with 'user' role
+         * 		- Better-Auth hook call rime.collection(slug).create to create the document
+         */
+        if (args.data.authUserId)
+            return CREATION_CASE.PUBLIC_SIGNUP;
+        /**
+         * 6. API Key Creation
+         * 	- Description: Creating an API KEY
+         * 	- Actor: Authenticated user
+         * 	-	Auth Flow:
+         * 		- Admin creates API key user that forward current authneticated user
+         * 		- API key generated and send by email
+         */
+        if (IS_API_KEY_OPERATION &&
+            Boolean(event.locals.user) &&
+            Boolean(event.locals.betterAuthUser?.id))
+            return CREATION_CASE.API_KEY_CREATION;
+        /**
+         * 7. Programmatic User Creation : API_KEY APP create user
+         * 	- Description: Creating an API KEY
+         * 	- Actor: Authenticated user related to the API_KEY
+         * 	- equivalent to ADMIN_CREATE_USER or STAFF_CREATE_USER
+         *
+         * Not implemented :
+         * 8. Invitation-based User Creation
+         */
+        return undefined;
+    };
+    const CASE = resolveCase();
+    // Prevent superAdmin value to be set on creation
+    if ('isSuperAdmin' in args.data && CASE !== CREATION_CASE.INIT) {
+        throw new RimeError(RimeError.UNAUTHORIZED);
+    }
+    let authUserId;
+    switch (CASE) {
+        case CREATION_CASE.INIT:
+            authUserId = args.data.authUserId;
+            break;
+        case CREATION_CASE.ADMIN_CREATE_USER: {
+            // Define better-auth role
+            // First match wins, read top to bottom.
+            const role = ADMIN_ROLE_IN_DATA && ADMIN_ROLE_ALLOWED
+                ? BETTER_AUTH_ROLES.ADMIN
+                : !ADMIN_ROLE_IN_DATA && IS_STAFF_CREATION
+                    ? BETTER_AUTH_ROLES.STAFF
+                    : BETTER_AUTH_ROLES.USER;
+            const result = await rime.auth.api.createUser({
+                headers: args.event.request.headers,
+                body: {
+                    email: args.data.email,
+                    password: args.data.password,
+                    name: args.data.name,
+                    data: {
+                        type: config.slug
+                    },
+                    role
+                }
+            });
+            authUserId = result.user.id;
+            break;
+        }
+        //
+        case CREATION_CASE.STAFF_CREATE_USER: {
+            // Define better-auth role, staff can't create admin
+            const role = IS_STAFF_CREATION ? BETTER_AUTH_ROLES.STAFF : BETTER_AUTH_ROLES.USER;
+            const result = await rime.auth.api.createUser({
+                headers: args.event.request.headers,
+                body: {
+                    email: args.data.email,
+                    password: args.data.password,
+                    name: args.data.name,
+                    data: {
+                        type: config.slug
+                    },
+                    role
+                }
+            });
+            authUserId = result.user.id;
+            break;
+        }
+        case CREATION_CASE.API_KEY_CREATION: {
+            if (!event.locals.betterAuthUser || !event.locals.user) {
+                throw new RimeError(RimeError.UNAUTHORIZED);
+            }
+            if (!rime.mailer) {
+                throw new RimeError(RimeError.OPERATION_ERROR, `Can't create API KEY without smtp config`);
+            }
+            if (!args.data.name) {
+                throw new RimeFormError({ name: RimeFormError.REQUIRED_FIELD });
+            }
+            const apiKey = await rime.auth.api.createApiKey({
+                body: {
+                    name: args.data.name,
+                    userId: event.locals.betterAuthUser.id,
+                    permissions: {
+                        roles: args.data.roles || [BETTER_AUTH_ROLES.USER]
+                    }
+                }
+            });
+            // Send api key by email to the user
+            if ('mailer' in rime && rime.mailer) {
+                // Cast as any because when no SMTP config provided by consumer rime.mailer is never
+                await rime.mailer.sendMail({
+                    to: event.locals.user.email,
+                    subject: t__(`mail.api_key_created_subject`, args.data.name),
+                    text: t__(`mail.api_key_created_text`, args.data.name, apiKey.key)
+                });
+            }
+            else {
+                rime.logger.warn('Missing SMTP configuration');
+            }
+            return {
+                ...args,
+                context: {
+                    ...args.context,
+                    apiKey: apiKey.key
+                },
+                data: {
+                    ...args.data,
+                    apiKeyId: apiKey.id,
+                    authUserId: event.locals.betterAuthUser.id,
+                    ownerId: event.locals.user.id
+                }
+            };
+        }
+        case CREATION_CASE.PUBLIC_SIGNUP:
+            authUserId = args.data.authUserId;
+            break;
+        /**
+         * Any other case : throw UNAUTHORIZED
+         *  - unauthenticated user using direct API calls ex: POST /api/staff
+         */
+        default:
+            throw new RimeError(RimeError.UNAUTHORIZED);
+    }
+    return {
+        ...args,
+        data: {
+            ...args.data,
+            authUserId: authUserId
+        }
+    };
+});

package/dist/core/auth/hooks/delete-better-auth-user.server.d.ts

@@ -0,0 +1,4 @@
+/**
+ * After delete, delete better-auth user
+ */
+export declare const deleteBetterAuthUser: import("../../pipeline/types").Hook<"auth", "delete", "after">;

package/dist/core/auth/hooks/delete-better-auth-user.server.js

@@ -0,0 +1,25 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+/**
+ * After delete, delete better-auth user
+ */
+export const deleteBetterAuthUser = Hooks.afterDelete(async function deleteBetterAuthUser(args) {
+    const { doc, event, config } = args;
+    const IS_API_AUTH = config.auth && config.auth?.type === 'apiKey';
+    if (IS_API_AUTH && doc.apiKeyId) {
+        await event.locals.rime.auth.api.deleteApiKey({
+            headers: args.event.request.headers,
+            body: {
+                keyId: doc.apiKeyId
+            }
+        });
+    }
+    else if (doc.authUserId) {
+        await event.locals.rime.auth.api.removeUser({
+            body: {
+                userId: doc.authUserId
+            },
+            headers: args.event.request.headers
+        });
+    }
+    return args;
+});

package/dist/core/auth/hooks/forward-roles.server.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Syncs this doc's `roles` field to better-auth's role.
+ *
+ * Rime's `roles` array is app-level, free-form per collection.
+ * Better-auth only knows one `role`: admin, staff, or user.
+ * When an update changes `roles`, this hook works out the right
+ * better-auth role and saves it on the better-auth user.
+ *
+ * Only the 'staff' collection can end up admin or staff.
+ * Every other collection always gets 'user'.
+ */
+export declare const forwardRolesToBetterAuth: import("../../pipeline/types").Hook<"auth", "update", "before">;

package/dist/core/auth/hooks/forward-roles.server.js

@@ -0,0 +1,58 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+import { RimeError } from '../../errors/index.js';
+import { access } from '../access.js';
+import { BETTER_AUTH_ROLES } from '../constant.server.js';
+import { betterAuthUserId } from '../user.server.js';
+/**
+ * Syncs this doc's `roles` field to better-auth's role.
+ *
+ * Rime's `roles` array is app-level, free-form per collection.
+ * Better-auth only knows one `role`: admin, staff, or user.
+ * When an update changes `roles`, this hook works out the right
+ * better-auth role and saves it on the better-auth user.
+ *
+ * Only the 'staff' collection can end up admin or staff.
+ * Every other collection always gets 'user'.
+ */
+export const forwardRolesToBetterAuth = Hooks.beforeUpdate(async function forwardRolesToBetterAuth(args) {
+    const { event, config, context } = args;
+    const { rime } = event.locals;
+    const IS_ROLES_MUTATION = 'roles' in args.data && Array.isArray(args.data.roles);
+    const IS_API_KEY_MUTATION = config.auth?.type === 'apiKey';
+    // API key docs have no better-auth user of their own — their `roles` field
+    // permissions the key itself, so there's nothing to forward here.
+    if (IS_API_KEY_MUTATION) {
+        return args;
+    }
+    const originalDoc = context.originalDoc;
+    if (!originalDoc) {
+        throw new RimeError(RimeError.OPERATION_ERROR, 'missing originalDoc @forwardRolesToBetterAuth');
+    }
+    if (IS_ROLES_MUTATION) {
+        const authUserId = await betterAuthUserId(rime.adapter, {
+            slug: config.slug,
+            id: originalDoc.id
+        });
+        if (!authUserId) {
+            throw new RimeError(RimeError.OPERATION_ERROR, 'user not found');
+        }
+        const ADMIN_ROLE_IN_DATA = Array.isArray(args.data.roles) && args.data.roles.includes('admin');
+        const IS_CURRENT_USER_ADMIN = access.isAdmin(event.locals.user);
+        const IS_CURRENT_USER_STAFF = Boolean(event.locals.user?.isStaff);
+        // First true condition wins, read top to bottom.
+        const role = 
+        // Only an admin can grant 'admin', and only on the staff collection.
+        IS_CURRENT_USER_ADMIN && ADMIN_ROLE_IN_DATA && config.slug === 'staff'
+            ? BETTER_AUTH_ROLES.ADMIN
+            : // Any staff member editing a staff doc without granting admin: 'staff'.
+                IS_CURRENT_USER_STAFF && config.slug === 'staff'
+                    ? BETTER_AUTH_ROLES.STAFF
+                    : // Everything else (non-staff collection, or no condition above matched): 'user'.
+                        BETTER_AUTH_ROLES.USER;
+        await rime.auth.api.setRole({
+            headers: args.event.request.headers,
+            body: { userId: authUserId, role }
+        });
+    }
+    return args;
+});

package/dist/core/auth/hooks/index.server.d.ts

@@ -0,0 +1,18 @@
+/**
+ * This feature's hooks, by name, so a prototype can place them as `auth.someHook`.
+ *
+ * A barrel and nothing else — `module.server.ts` beside it is the pair half `$rime/modules:` resolves, and
+ * only files named exactly `module(.server).ts` are, so this one is invisible to that mechanism.
+ * It exists because a prototype's `hooks.server.ts` writes the run order and would otherwise carry
+ * one import line per hook.
+ */
+export { augmentFieldsPassword } from './augment-fields-password.server.js';
+export { createBetterAuthUser } from './create-better-auth-user.server.js';
+export { deleteBetterAuthUser } from './delete-better-auth-user.server.js';
+export { forwardRolesToBetterAuth } from './forward-roles.server.js';
+export { populateAPIKey } from './populate-api-key.server.js';
+export { preventSuperAdminMutation } from './prevent-superadmin-mutation.server.js';
+export { preventSupperAdminDeletion } from './prevent-superadmin-deletion.server.js';
+export { preventUserMutations } from './prevent-user-mutations.server.js';
+export { removePrivateFields } from './remove-private-fields.server.js';
+export { signInNewUser } from './sign-in-new-user.server.js';

package/dist/core/auth/hooks/index.server.js

@@ -0,0 +1,18 @@
+/**
+ * This feature's hooks, by name, so a prototype can place them as `auth.someHook`.
+ *
+ * A barrel and nothing else — `module.server.ts` beside it is the pair half `$rime/modules:` resolves, and
+ * only files named exactly `module(.server).ts` are, so this one is invisible to that mechanism.
+ * It exists because a prototype's `hooks.server.ts` writes the run order and would otherwise carry
+ * one import line per hook.
+ */
+export { augmentFieldsPassword } from './augment-fields-password.server.js';
+export { createBetterAuthUser } from './create-better-auth-user.server.js';
+export { deleteBetterAuthUser } from './delete-better-auth-user.server.js';
+export { forwardRolesToBetterAuth } from './forward-roles.server.js';
+export { populateAPIKey } from './populate-api-key.server.js';
+export { preventSuperAdminMutation } from './prevent-superadmin-mutation.server.js';
+export { preventSupperAdminDeletion } from './prevent-superadmin-deletion.server.js';
+export { preventUserMutations } from './prevent-user-mutations.server.js';
+export { removePrivateFields } from './remove-private-fields.server.js';
+export { signInNewUser } from './sign-in-new-user.server.js';

package/dist/core/auth/hooks/populate-api-key.server.d.ts

@@ -0,0 +1,5 @@
+/**
+ * After create populate the created API key
+ * on document so user can see it once.
+ */
+export declare const populateAPIKey: import("../../pipeline/types").Hook<"auth", "create", "after">;

package/dist/core/auth/hooks/populate-api-key.server.js

@@ -0,0 +1,22 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+import { RimeError } from '../../errors/index.js';
+/**
+ * After create populate the created API key
+ * on document so user can see it once.
+ */
+export const populateAPIKey = Hooks.afterCreate(async function populateAPIKey(args) {
+    const { config } = args;
+    const IS_API_AUTH = config.auth && config.auth.type === 'apiKey';
+    if (IS_API_AUTH) {
+        if (!args.context.apiKey)
+            throw new RimeError(RimeError.OPERATION_ERROR, 'missing key @populateAPIKey');
+        return {
+            ...args,
+            doc: {
+                ...args.doc,
+                apiKey: args.context.apiKey
+            }
+        };
+    }
+    return args;
+});

package/dist/core/auth/hooks/prevent-superadmin-deletion.server.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Refuses to delete the super-admin.
+ *
+ * There is exactly one, and nothing in the panel or the API may remove it.
+ */
+export declare const preventSupperAdminDeletion: import("../../pipeline/types").Hook<"raw", "delete", "before">;

package/dist/core/auth/hooks/prevent-superadmin-deletion.server.js

@@ -0,0 +1,16 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+import { RimeError } from '../../errors/index.js';
+import { isSuperAdmin } from '../user.server.js';
+/**
+ * Refuses to delete the super-admin.
+ *
+ * There is exactly one, and nothing in the panel or the API may remove it.
+ */
+export const preventSupperAdminDeletion = Hooks.beforeDelete(async function preventSupperAdminDeletion(args) {
+    const { doc, event } = args;
+    const isSuperAdminDeletion = await isSuperAdmin(event.locals.rime.adapter, doc.id);
+    if (isSuperAdminDeletion) {
+        throw new RimeError(RimeError.UNAUTHORIZED, "This user can't be deleted");
+    }
+    return args;
+});

package/dist/core/auth/hooks/prevent-superadmin-mutation.server.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Before update :
+ * - prevent superadmin to be changed by someone else
+ */
+export declare const preventSuperAdminMutation: import("../../pipeline/types").Hook<"raw", "update", "before">;

package/dist/core/auth/hooks/prevent-superadmin-mutation.server.js

@@ -0,0 +1,28 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+import { RimeError } from '../../errors/index.js';
+import { isSuperAdmin } from '../user.server.js';
+/**
+ * Before update :
+ * - prevent superadmin to be changed by someone else
+ */
+export const preventSuperAdminMutation = Hooks.beforeUpdate(async function preventSuperAdminMutation(args) {
+    const { event, context } = args;
+    const originalDoc = context.originalDoc;
+    if (!originalDoc)
+        throw new RimeError(RimeError.OPERATION_ERROR, 'missing originalDoc @preventSuperAdminMutation');
+    const IS_ROLES_MUTATION = 'roles' in args.data && Array.isArray(args.data.roles);
+    const IS_SUPERADMIN_MUTATION = await isSuperAdmin(event.locals.rime.adapter, originalDoc.id);
+    // Prevent super admin user to be changed by someone
+    if (IS_SUPERADMIN_MUTATION && !event.locals.user?.isSuperAdmin) {
+        throw new RimeError(RimeError.UNAUTHORIZED);
+    }
+    // Prevent "admin" roles of superadmin to be deleted
+    if (IS_SUPERADMIN_MUTATION && IS_ROLES_MUTATION && !args.data.roles.includes('admin')) {
+        args.data.roles.push('admin');
+    }
+    // Prevent superAdmin value to be changed
+    if ('isSuperAdmin' in args.data && !event.locals.isInit) {
+        throw new RimeError(RimeError.UNAUTHORIZED);
+    }
+    return args;
+});

package/dist/core/auth/hooks/prevent-user-mutations.server.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Before update :
+ * - prevent email/name/password to be changed
+ */
+export declare const preventUserMutations: import("../../pipeline/types").Hook<"auth", "update", "before">;

package/dist/core/auth/hooks/prevent-user-mutations.server.js

@@ -0,0 +1,13 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+import { RimeError } from '../../errors/index.js';
+/**
+ * Before update :
+ * - prevent email/name/password to be changed
+ */
+export const preventUserMutations = Hooks.beforeUpdate(async function preventUserMutations(args) {
+    const IS_MUTATION_AUTH = 'email' in args.data || 'name' in args.data || 'password' in args.data;
+    if (IS_MUTATION_AUTH && args.config.auth) {
+        throw new RimeError(RimeError.UNAUTHORIZED);
+    }
+    return args;
+});

package/dist/core/auth/hooks/remove-private-fields.server.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Strips auth's private members from a document on its way out — the password, the better-auth
+ * link.
+ *
+ * First in `beforeRead`, so nothing deriving from the document can copy one into derived data.
+ */
+export declare const removePrivateFields: import("../../pipeline/types").Hook<"raw", "read", "before">;

package/dist/core/auth/hooks/remove-private-fields.server.js

@@ -0,0 +1,11 @@
+import { Hooks } from '../../pipeline/define-hook.js';
+import { withoutPrivateFields } from '../constant.server.js';
+/**
+ * Strips auth's private members from a document on its way out — the password, the better-auth
+ * link.
+ *
+ * First in `beforeRead`, so nothing deriving from the document can copy one into derived data.
+ */
+export const removePrivateFields = Hooks.beforeRead(async function removePrivateFields(args) {
+    return { ...args, doc: withoutPrivateFields(args.doc) };
+});

package/dist/core/auth/hooks/sign-in-new-user.server.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Signs a user in as soon as their own sign-up created them.
+ *
+ * Better-auth's sign-up handler sets `event.locals.pendingSignInAfterSignUp`, and this reads it: the document
+ * exists by now, so `event.locals.user` can be populated from it and the response comes back
+ * already authenticated. Only the public sign-up path sets that flag — an admin creating a user
+ * from the panel must not be signed in as them.
+ *
+ * `authUserId` comes off `data`, which `createBetterAuthUser` set — not off the caller's incoming
+ * data, where it is only present on the public sign-up path.
+ */
+export declare const signInNewUser: import("../../pipeline/types.js").Hook<"auth", "create", "after">;

package/dist/core/auth/hooks/sign-in-new-user.server.js

@@ -0,0 +1,29 @@
+import { RimeError } from '../../errors/index.js';
+import { Hooks } from '../../pipeline/define-hook.js';
+import { userAttributes } from '../user.server.js';
+/**
+ * Signs a user in as soon as their own sign-up created them.
+ *
+ * Better-auth's sign-up handler sets `event.locals.pendingSignInAfterSignUp`, and this reads it: the document
+ * exists by now, so `event.locals.user` can be populated from it and the response comes back
+ * already authenticated. Only the public sign-up path sets that flag — an admin creating a user
+ * from the panel must not be signed in as them.
+ *
+ * `authUserId` comes off `data`, which `createBetterAuthUser` set — not off the caller's incoming
+ * data, where it is only present on the public sign-up path.
+ */
+export const signInNewUser = Hooks.afterCreate(async function signInNewUser(args) {
+    const { config, event, data } = args;
+    if (!event.locals.pendingSignInAfterSignUp)
+        return args;
+    if (typeof data.name !== 'string' ||
+        typeof data.email !== 'string' ||
+        typeof data.authUserId !== 'string') {
+        throw new RimeError(RimeError.OPERATION_ERROR, 'unable to signin user');
+    }
+    event.locals.user = await userAttributes(event.locals.rime.adapter, {
+        authUserId: data.authUserId,
+        slug: config.slug
+    });
+    return args;
+});

package/dist/core/auth/module.d.ts

@@ -0,0 +1,2 @@
+export { augmentAuth } from './augment.js';
+export { configureStaff } from './staff/configure.js';

package/dist/core/auth/module.js

@@ -0,0 +1,2 @@
+export { augmentAuth } from './augment.js';
+export { configureStaff } from './staff/configure.js';

package/dist/core/auth/module.server.d.ts

@@ -0,0 +1,2 @@
+export { augmentAuth } from './augment.server.js';
+export { configureStaff } from './staff/configure.server.js';

package/dist/core/auth/module.server.js

@@ -0,0 +1,2 @@
+export { augmentAuth } from './augment.server.js';
+export { configureStaff } from './staff/configure.server.js';

package/dist/core/auth/staff/configure.d.ts

@@ -0,0 +1,7 @@
+import type { BuiltCollection, Config } from '../../config/types.js';
+export declare const configureStaff: <T extends {
+    collections?: BuiltCollection[];
+    staff?: Config["staff"];
+}>(config: T) => T & {
+    readonly collections: readonly [BuiltCollection, ...BuiltCollection[]];
+};

package/dist/core/auth/staff/configure.js

@@ -0,0 +1,13 @@
+import { getStaffCollection } from './derive.js';
+// Straight from the collection's own definition, never through `core/config/index.js`: that
+// barrel also exports the config builder, which reaches the prototype registry and so every
+// feature, including this one. Going through it closes a cycle in which `auth` is `undefined` in
+// the collection's feature list at the moment the definition evaluates.
+//
+// The isomorphic half, and that is the rule rather than a preference: a feature must not import a
+// prototype's `definition.server.ts`, which spreads `{ ...base }` at module scope.
+import { create } from '../../prototype/collection/definition.js';
+export const configureStaff = (config) => {
+    const staff = create('staff', getStaffCollection(config.staff));
+    return { ...config, collections: [staff, ...(config.collections || [])] };
+};

package/dist/core/auth/staff/configure.server.d.ts

@@ -0,0 +1,7 @@
+import type { BuiltCollection, Config } from '../../config/types.js';
+export declare const configureStaff: <const T extends {
+    collections?: BuiltCollection[];
+    staff?: Config["staff"];
+}>(config: T) => T & {
+    readonly collections: readonly [...BuiltCollection[], BuiltCollection];
+};

package/dist/core/auth/staff/configure.server.js

@@ -0,0 +1,14 @@
+import { getStaffCollection } from './derive.js';
+// Straight from the collection's own definition, never through `core/config/index.server.js`:
+// that barrel also exports `rime`, which reaches the prototype registry and so every feature,
+// including this one. Going through it closes a cycle in which `auth` is `undefined` in the
+// collection's feature list at the moment the definition evaluates.
+//
+// The isomorphic half, which is now the only one: `create` is composed by `definePrototype` and
+// there is no server copy of it to reach for — and a feature must not import a prototype's
+// `definition.server.ts` anyway.
+import { create } from '../../prototype/collection/definition.js';
+export const configureStaff = (config) => {
+    const staff = create('staff', getStaffCollection(config.staff));
+    return { ...config, collections: [...(config.collections || []), staff] };
+};

package/dist/core/auth/staff/derive.d.ts

@@ -0,0 +1,23 @@
+import type { CollectionWithoutSlug } from '../../prototype/collection/types.js';
+import type { FieldBuilder } from '../../fields/builders/field-builder.js';
+import type { Field } from '../../../types.js';
+import type { Access } from '../../config/types.js';
+import type { AdditionalStaffConfig } from '../types.js';
+export declare const staffCollection: {
+    label: {
+        singular: string;
+        plural: string;
+    };
+    panel: {
+        description: string;
+        group: string;
+    };
+    auth: {
+        type: string;
+        roles: string[];
+    };
+    icon: import("svelte").Component<import("@lucide/svelte").LucideProps, {}, "">;
+    fields: FieldBuilder<Field>[];
+    access: Access;
+};
+export declare const getStaffCollection: ({ roles: incomingRoles, fields, access, panel, label }?: AdditionalStaffConfig) => CollectionWithoutSlug<"staff">;