rimecms 0.31.4 → 0.32.0

package/dist/core/adapter.d.ts

@@ -0,0 +1,456 @@
+import type { BuiltArea, BuiltCollection } from './config/types.js';
+import type { OperationQuery } from './pipeline/types.js';
+import type { GenericBlock, PrototypeSlug, RawDoc, TreeBlock } from './prototype/types.js';
+import type { BeforeOperationRelation, Relation } from '../fields/relation/index.js';
+import type { Dic, WithOptional, WithRequired } from '../util/types.js';
+/**
+ * What core requires of a database adapter.
+ *
+ * Written here, in core's vocabulary, rather than read off an implementation: an interface
+ * inferred from what one adapter returns is not something a second adapter can conform to.
+ *
+ * The rule that decides what may appear below: **every argument and return type is something core
+ * can name**. Slugs, documents, blocks, relations, queries, locales. No tables, no columns, no
+ * drizzle. A method that cannot be phrased that way is work on the wrong side of the line — a
+ * parameter like `parentSlug: TableName`, naming a slug and carrying a table, is the tell.
+ *
+ * The escape hatch is deliberately **not** here. `rime.adapter.db` is documented for consumers
+ * who need to drop to SQL, and adapter-sqlite still exposes it; core is what must not use it.
+ * See `SqliteAdapter` in adapter-sqlite/index.server.ts for the full concrete surface.
+ */
+export interface Adapter {
+    /**
+     * Register a prototype. Boot only — see core/boot.server.ts.
+     *
+     * The adapter resolves its base, versions, children and branches once here, rather than working
+     * them out from a slug on every request, and refuses loudly if the tables are not there.
+     */
+    registerPrototype(config: BuiltArea | BuiltCollection): void;
+    /** The handle for a registered prototype. */
+    collection(slug: string): CollectionHandle;
+    /** The handle for a registered area. */
+    area(slug: string): AreaHandle;
+    /**
+     * The handle for the table holding a prototype's content — its versions table where it has one,
+     * its own otherwise.
+     *
+     * The table half of `contentOwnerId`: that names the row, this names what the row is in. For a
+     * write that sets columns on wherever the content is and does not care which kind of prototype
+     * that turned out to be — which is why it answers `BaseHandle` rather than one of the two above.
+     *
+     * Only the registry can answer it. A versioned area's versions table is registered as a
+     * *collection*, so the kind a caller starts from does not survive the hop, and the config says
+     * which slug but not which handle.
+     */
+    contentOwner(slug: string): BaseHandle;
+    /**
+     * The handle for a table a feature declared — see `TableDeclaration`.
+     *
+     * Separate from the two above because a declared table is not a prototype: no fields, no
+     * pipeline, no access rules, nothing to merge a blank into. Three verbs and a flat filter,
+     * because whoever declared it already knows its columns and there is nothing to resolve
+     * against a config.
+     */
+    table(slug: string): TableHandle;
+    blocks: BlocksHandle;
+    tree: TreeHandle;
+    relations: RelationsHandle;
+    transform: TransformHandle;
+    auth: AuthHandle;
+}
+/**
+ * What every prototype handle carries, whatever kind it is.
+ *
+ * `slug` and `config` are what it was registered with; `versions` is where this config's content
+ * lives when that is not its own row.
+ */
+export interface BaseHandle {
+    readonly slug: string;
+    readonly config: BuiltArea | BuiltCollection;
+    /** Where this config's content lives, when not on its own row — `config._versions`. */
+    readonly versions?: VersionsTable;
+    findMany(args?: {
+        select?: string[];
+        query?: OperationQuery;
+        sort?: string;
+        limit?: number;
+        offset?: number;
+        locale?: string;
+        /** See `find`. */
+        localeFallback?: boolean;
+        /** Per document, which content row — see `find`. Filters the list as well as picking rows. */
+        content?: OperationQuery;
+    }): Promise<RawDoc[]>;
+    /**
+     * Sets columns on every row this prototype owns that `query` matches.
+     *
+     * The bulk half of `update`: no pipeline, no children, and it writes exactly the columns given
+     * — `updatedAt` included only if the caller passes it. For a filter that names many rows and a
+     * patch that names one column, which `update` cannot express without a read and a write per row.
+     *
+     * With `locale`, a localized column lands on the localized half instead. The caller names a
+     * field and a locale; which table that is, is the adapter's business.
+     */
+    updateWhere(args: {
+        query: OperationQuery;
+        data: Dic;
+        locale?: string;
+    }): Promise<void>;
+}
+/**
+ * What the adapter can do to one registered **collection**.
+ *
+ * Many documents, addressed by id: `find`, `update` and `delete` each take one, and `insert` makes
+ * a new one. That is the whole difference from an area, and the type says it — an `AreaHandle` has
+ * no `insert` and no `delete` to reach for.
+ */
+export interface CollectionHandle extends BaseHandle {
+    /**
+     * One document, merged with the version it should show. `undefined` when nothing matches — the
+     * caller decides whether that is a 404.
+     */
+    find(args: {
+        id: string;
+        select?: string[];
+        locale?: string;
+        /**
+         * Whether a field the locale has not written reads from the other locales, in the order the
+         * config gives. `true` unless said otherwise; `false` is the locale's own rows and nothing
+         * else, which is what a copy from one row to another reads.
+         */
+        localeFallback?: boolean;
+        /**
+         * Narrows which content row this read means, for a config that has one. The newest when
+         * omitted, which is what "the content of this document" means with nothing else said.
+         *
+         * This is what `draft` and `versionId` were. They were request parameters the adapter decoded
+         * against `config.versions.draft`; the caller decodes them now (`versionsReadQuery`) and hands
+         * down a filter, so the adapter applies one rather than choosing one.
+         */
+        content?: OperationQuery;
+    }): Promise<RawDoc | undefined>;
+    /**
+     * Makes a document. The difference from `update` is the one an insert has by definition:
+     * `content` carries no `id`, because the row does not exist yet — the adapter makes it and
+     * answers with it.
+     *
+     * A versioned config **requires** `content`. Its base row has no columns for the content, so a
+     * plan naming no content half would write half a document and hang its blocks off the wrong row;
+     * the adapter refuses instead.
+     *
+     * Returns the document's id and `contentId` — the row its content landed on, which is what its
+     * blocks, tree nodes and relations hang off. The two are the same when the config is not
+     * versioned.
+     */
+    insert(args: {
+        data: Dic;
+        content?: {
+            data: Dic;
+        };
+        locale?: string;
+    }): Promise<{
+        id: string;
+        contentId: string;
+    }>;
+    /**
+     * Writes the rows a write plan names: the document's own row always, and the content row when
+     * the caller names one.
+     *
+     * There is no `versionOperation` and no `versionId` here. The caller decided which rows this
+     * write touches before calling — `pipeline/run.server.ts` builds the plan and
+     * `versionsWritePlan` refines it — so the adapter executes a plan rather than decoding an enum
+     * into three branches.
+     */
+    update(args: {
+        id: string;
+        data: Dic;
+        content?: {
+            id: string;
+            data: Dic;
+        };
+        locale?: string;
+    }): Promise<{
+        id: string;
+    }>;
+    /** Removes one document. */
+    delete(args: {
+        id: string;
+    }): Promise<string | undefined>;
+}
+/**
+ * What the adapter can do to one registered **area**.
+ *
+ * Exactly one document, so nothing here takes an id — the handle resolves which row it is. There
+ * is no `insert` and no `delete`: not switched off, absent. `ensureExists` is the consequence, and
+ * it is boot's: the row has to be there before a request can read it.
+ */
+export interface AreaHandle extends BaseHandle {
+    /** The document, merged with the version it should show. See `CollectionHandle.find`. */
+    find(args?: {
+        select?: string[];
+        locale?: string;
+        /** See `CollectionHandle.find`. */
+        localeFallback?: boolean;
+        content?: OperationQuery;
+    }): Promise<RawDoc | undefined>;
+    /** Writes the rows a write plan names. See `CollectionHandle.update`. */
+    update(args: {
+        data: Dic;
+        content?: {
+            id: string;
+            data: Dic;
+        };
+        locale?: string;
+    }): Promise<{
+        id: string;
+    }>;
+    /** Boot only. Writes the row if absent; a no-op if not. */
+    ensureExists(args: {
+        blank: Dic;
+        locale?: string;
+    }): Promise<void>;
+}
+/**
+ * `parentSlug` is the slug that owns the children — the prototype's versions when it has one, the
+ * prototype itself when not. `pipeline/run.server.ts` resolves it off `PrototypeHandle.versions`,
+ * which is what registration was handed; nothing works it out from a config member.
+ */
+export interface BlocksHandle {
+    create(args: {
+        parentSlug: PrototypeSlug;
+        block: WithOptional<GenericBlock, 'id'>;
+        ownerId: string;
+        locale?: string;
+    }): Promise<boolean>;
+    update(args: {
+        parentSlug: PrototypeSlug;
+        block: GenericBlock;
+        locale?: string;
+    }): Promise<boolean>;
+    delete(args: {
+        parentSlug: PrototypeSlug;
+        block: GenericBlock;
+    }): Promise<boolean>;
+}
+export interface TreeHandle {
+    create(args: {
+        parentSlug: PrototypeSlug;
+        block: WithOptional<WithRequired<TreeBlock, 'path'>, 'id'>;
+        ownerId: string;
+        locale?: string;
+    }): Promise<boolean>;
+    update(args: {
+        parentSlug: PrototypeSlug;
+        block: WithRequired<TreeBlock, 'path'>;
+        locale?: string;
+    }): Promise<boolean>;
+    delete(args: {
+        parentSlug: PrototypeSlug;
+        block: WithRequired<TreeBlock, 'path'>;
+    }): Promise<boolean>;
+}
+export interface RelationsHandle {
+    create(args: {
+        parentSlug: PrototypeSlug;
+        ownerId: string;
+        relations: BeforeOperationRelation[];
+    }): Promise<boolean>;
+    update(args: {
+        parentSlug: PrototypeSlug;
+        relations: Relation[];
+    }): Promise<boolean>;
+    delete(args: {
+        parentSlug: PrototypeSlug;
+        relations: Relation[];
+    }): Promise<boolean>;
+    deleteFromPaths(args: {
+        parentSlug: PrototypeSlug;
+        ownerId: string;
+        paths: string[];
+        locale?: string;
+    }): Promise<boolean>;
+    getAll(args: {
+        parentSlug: PrototypeSlug;
+        ownerId: string;
+        locale?: string;
+    }): Promise<Relation[]>;
+}
+export interface TransformHandle {
+    /**
+     * The rows one document is stored across, unflattened and grouped by what they are.
+     *
+     * Three things, and each of them needs a table: resolving which tables hang off this document,
+     * merging each locales branch, and turning column names back into document paths.
+     *
+     * `buildDocument` in `core/pipeline/build-document.server.ts` takes it from here — merging the
+     * blank, keeping the bookkeeping the caller asked for, and assembling relations into document
+     * properties are core's, and none of them needs a table.
+     */
+    rows(args: {
+        doc: RawDoc;
+        slug: PrototypeSlug;
+        locale?: string;
+        /** See `CollectionHandle.find`. */
+        localeFallback?: boolean;
+    }): Promise<DocumentRows>;
+}
+/**
+ * One document's storage rows, in core's vocabulary. No table names leave the adapter.
+ */
+export type DocumentRows = {
+    /**
+     * The document's own columns: flat, keyed by document path, with the locales branch merged in
+     * and every child table's key removed.
+     *
+     * Flat because the column-to-path rule (`__` separates path segments) is the adapter's, and
+     * applying it needs the flattened keys. Core unflattens once, at the end.
+     */
+    base: Dic;
+    /** Block rows, keyed by document path, each carrying its own `path`, `position` and `type`. */
+    blocks: Dic[];
+    /** Tree rows, same shape, ordered by `path`. */
+    tree: Dic[];
+    /**
+     * Junction rows, each with `relationTo` and `documentId` resolved off whichever foreign key
+     * column was set. A row with neither is an orphan; core warns and drops it.
+     */
+    relations: Dic[];
+};
+/**
+ * Read and write one table a feature declared.
+ *
+ * `where` is a flat map of column to value, ANDed. Not `OperationQuery`: that resolves paths
+ * against a prototype's fields, handles localized columns and relation properties, and a declared
+ * table has none of those. A feature that declared a table knows its columns, so there is nothing
+ * to resolve.
+ *
+ * `update` and `delete` **refuse an empty `where`**. A filter that matches everything is never
+ * what a caller meant, and drizzle's `and()` of nothing is `undefined`, which is a statement with
+ * no `WHERE` clause at all.
+ */
+export interface TableHandle {
+    /** Rows matching every condition, all columns unless `select` names some. */
+    find(args?: {
+        where?: Dic;
+        select?: string[];
+        limit?: number;
+    }): Promise<Dic[]>;
+    update(args: {
+        where: Dic;
+        data: Dic;
+    }): Promise<void>;
+    delete(args: {
+        where: Dic;
+    }): Promise<void>;
+}
+/**
+ * Better-auth's own database adapter, and nothing else.
+ *
+ * Reads of a collection's rows are `collection(slug).findMany`; reads and writes of Better-auth's
+ * own tables are `table(slug)`, since those are declared tables.
+ *
+ * **Better-auth's admin API cannot stand in for the latter.** `listUsers`, `setRole` and
+ * `removeUser` all sit behind `adminMiddleware`, and every caller runs where no admin session
+ * exists: `hasAuthUser` gates the init route, which only runs when there is no user at all;
+ * `setAuthUserRole` promotes the first signup; and `deleteAuthUser` rolls back a failed one,
+ * which `removeUser` refuses outright with `YOU_CANNOT_REMOVE_YOURSELF`.
+ */
+export interface AuthHandle {
+    /** The Better-auth database adapter. Opaque to core, which only hands it to Better-auth. */
+    betterAuthAdapter: unknown;
+}
+/** Which blank a feature is being asked to shape — see `FeatureDefinition.blank`. */
+export type BlankIntent = 'create' | 'seed';
+export type WritePlan = {
+    /** What goes on the prototype's own row. */
+    data: Dic;
+    /**
+     * The content row this write also touches, when it is not the base row.
+     *
+     * `id` is absent on an **insert**, where there is no row yet: the adapter creates it and answers
+     * with its id. Present on an update, which names the row it means.
+     */
+    content?: {
+        id?: string;
+        data: Dic;
+    };
+};
+/**
+ * A versions table, as the feature that owns it describes it.
+ *
+ * Only `slug` for now, and deliberately: it is what the schema needs, and an unread member is
+ * exactly the mistake this declaration replaces. The read selector and the owner column join it
+ * when there is something reading them.
+ */
+export type VersionsTable = {
+    /**
+     * The versions's own slug — `$pages__versions`. In slug space, never a table name: what a slug
+     * is called in the database is the adapter's business, and it maps.
+     */
+    slug: string;
+};
+/**
+ * How a feature describes storage it needs, in core's terms.
+ *
+ * A `versions` deviates a prototype's own table and a prototype's fields become its columns. Neither
+ * covers a table that belongs to the **feature** — better-auth's four, an api-key store, an audit
+ * log. Those were written out as drizzle source inside the schema generator, which is how the
+ * database layer came to know that a collection called `staff` exists and is special.
+ *
+ * No drizzle here, and no SQL: a declaration says what the storage *is*, and the adapter decides
+ * how to spell it. That is the same line `Adapter` draws, for the same reason — a second adapter
+ * has to be able to satisfy this.
+ */
+/**
+ * What a column holds.
+ *
+ * Six values, and deliberately only six: it is what the templates this replaces actually emit, and
+ * a wider set is a schema DSL nobody asked for. `timestamp` and `timestampMs` are two entries
+ * rather than one because they are two storage formats — epoch seconds and epoch milliseconds —
+ * and better-auth's own tables use both.
+ */
+export type ColumnType = 'text' | 'integer' | 'real' | 'boolean' | 'timestamp' | 'timestampMs' | 'json';
+export type ColumnDeclaration = {
+    /** The document-side name. The adapter derives the stored column name from it. */
+    name: string;
+    type: ColumnType;
+    primary?: boolean;
+    notNull?: boolean;
+    unique?: boolean;
+    /** Written into the schema as the column's `DEFAULT`, so only a literal. */
+    defaultValue?: string | number | boolean;
+    /**
+     * A foreign key, named in slug space — never as a table.
+     *
+     * `column` defaults to `id` and `onDelete` to `cascade`, which is every case there is today.
+     * A declaration may point at its own `table`: a directory's parent is a directory, which is the
+     * one shape a prototype's own fields never produce.
+     */
+    references?: {
+        table: string;
+        column?: string;
+        onDelete?: 'cascade' | 'set null';
+    };
+};
+export type TableDeclaration = {
+    /**
+     * The table's slug, `$`-prefixed to mark it rime-derived — `$authUsers`.
+     *
+     * It is an identifier, not a table name: the adapter maps it to both the name the schema exports
+     * it under and the name it has in the database.
+     */
+    slug: string;
+    columns: ColumnDeclaration[];
+};
+/**
+ * How a feature describes storage it needs, in core's terms.
+ *
+ * A `versions` deviates a prototype's own table and a prototype's fields become its columns. Neither
+ * covers a table that belongs to the **feature** — better-auth's four, an api-key store, an audit
+ * log. Those were written out as drizzle source inside the schema generator, which is how the
+ * database layer came to know that a collection called `staff` exists and is special.
+ *
+ * No drizzle here, and no SQL: a declaration says what the storage *is*, and the adapter decides
+ * how to spell it. That is the same line `Adapter` draws, for the same reason — a second adapter
+ * has to be able to satisfy this.
+ */

package/dist/core/adapter.js

@@ -0,0 +1,13 @@
+export {};
+/**
+ * How a feature describes storage it needs, in core's terms.
+ *
+ * A `versions` deviates a prototype's own table and a prototype's fields become its columns. Neither
+ * covers a table that belongs to the **feature** — better-auth's four, an api-key store, an audit
+ * log. Those were written out as drizzle source inside the schema generator, which is how the
+ * database layer came to know that a collection called `staff` exists and is special.
+ *
+ * No drizzle here, and no SQL: a declaration says what the storage *is*, and the adapter decides
+ * how to spell it. That is the same line `Adapter` draws, for the same reason — a second adapter
+ * has to be able to satisfy this.
+ */

package/dist/core/auth/access.d.ts

@@ -0,0 +1,73 @@
+import type { User } from './types.js';
+/**
+ * Checks if a user has admin privileges.
+ *
+ * @example
+ * // Check if current user is an admin
+ * if (isAdmin(currentUser)) {
+ *   // Perform admin-only operations
+ * }
+ */
+export declare const isAdmin: (user?: User) => boolean;
+/**
+ * Checks if a user is from the staff collection.
+ *
+ * @example
+ * // const user = {
+ * //  isStaff: true
+ * //  ...
+ * // }
+ * isStaff(user) // true
+ *
+ */
+export declare const isStaff: (user?: User) => boolean;
+/**
+ * Checks if a user has any of the specified roles.
+ *
+ * @example
+ * // Check if user has either editor or reviewer role
+ * if (hasRoles(user, 'editor', 'reviewer')) {
+ *   // Allow access to editing features
+ * }
+ */
+export declare const hasRoles: (user?: User, ...roles: string[]) => boolean;
+/**
+ * Checks if a user is an admin or matches the specified ID.
+ * Useful for operations that should be allowed for admins or the user themselves.
+ *
+ * @example
+ * // Check if user can edit a profile (either as admin or as the profile owner)
+ * if (isAdminOrMe(currentUser, profileId)) {
+ *   // Allow profile editing
+ * }
+ */
+export declare const isAdminOrMe: (user?: User, id?: string) => boolean;
+/**
+ * Checks if a user's ID matches the specified ID.
+ * Used for operations that should only be allowed for the user themselves.
+ *
+ * @example
+ * // Check if user is accessing their own settings
+ * if (isMe(currentUser, requestedUserId)) {
+ *   // Allow access to personal settings
+ * }
+ */
+export declare const isMe: (user?: User, id?: string) => boolean;
+/**
+ * Collection of access control utility functions.
+ * Provides methods for checking user permissions and roles.
+ */
+export declare const access: {
+    isAdmin: (user?: User) => boolean;
+    hasRoles: (user?: User, ...roles: string[]) => boolean;
+    isAdminOrMe: (user?: User, id?: string) => boolean;
+    isMe: (user?: User, id?: string) => boolean;
+    isStaff: (user?: User) => boolean;
+};
+declare const _default: {
+    isAdmin: (user?: User) => boolean;
+    hasRoles: (user?: User, ...roles: string[]) => boolean;
+    isAdminOrMe: (user?: User, id?: string) => boolean;
+    isMe: (user?: User, id?: string) => boolean;
+};
+export default _default;

package/dist/core/auth/augment.d.ts

@@ -0,0 +1,18 @@
+import type { Collection } from '../config/types.js';
+import type { CollectionAuthConfig } from './types.js';
+type Input = {
+    slug: string;
+    auth?: boolean | CollectionAuthConfig;
+    fields?: Collection<any>['fields'];
+};
+export type WithNormalizedAuth<T> = Omit<T, 'auth'> & {
+    auth?: CollectionAuthConfig;
+};
+/**
+ * Augment Auth collections :
+ * - normalize config.auth
+ * - add fields name, email fields
+ * - check roles fields
+ */
+export declare const augmentAuth: <T extends Input>(config: T) => WithNormalizedAuth<T>;
+export { configureStaff } from './staff/configure.js';

package/dist/core/auth/augment.js

@@ -0,0 +1,110 @@
+import { access } from './access.js';
+import { email } from '../../fields/email/index.js';
+import { select } from '../../fields/select/index.js';
+import { text } from '../../fields/text/index.js';
+const emailField = email('email')
+    .access({
+    create: () => true,
+    read: (user) => !!user,
+    update: () => false
+})
+    .required()
+    .unique();
+const nameField = text('name')
+    .access({
+    create: () => true,
+    read: (user) => !!user,
+    update: () => false
+})
+    .required();
+const withNormalizedAuth = (config) => {
+    // Create a new object without the auth property
+    const { auth, ...rest } = config;
+    // Determine the normalized auth value
+    let normalizedAuth;
+    if (typeof auth === 'boolean') {
+        normalizedAuth = { type: 'password' };
+    }
+    else {
+        normalizedAuth = auth;
+    }
+    // Return the new object with the normalized auth
+    return {
+        ...rest,
+        auth: normalizedAuth
+    };
+};
+/**
+ * Augment Auth collections :
+ * - normalize config.auth
+ * - add fields name, email fields
+ * - check roles fields
+ */
+export const augmentAuth = (config) => {
+    const normalizedAuthConfig = withNormalizedAuth(config);
+    if (!normalizedAuthConfig.auth)
+        return normalizedAuthConfig;
+    // Augment Fields
+    const IS_STAFF_COLLECTION = normalizedAuthConfig.slug === 'staff';
+    const IS_GENERIC_COLLECTION = !IS_STAFF_COLLECTION;
+    const IS_API_AUTH = normalizedAuthConfig.auth.type === 'apiKey';
+    const roles = [...(normalizedAuthConfig.auth.roles || ['user'])];
+    let normalizedRoles = roles.map((r) => (typeof r === 'string' ? { value: r } : r));
+    // Filter out 'admin' roles for non staff collection
+    normalizedRoles = IS_GENERIC_COLLECTION
+        ? normalizedRoles.filter((role) => role.value !== 'admin')
+        : normalizedRoles;
+    const defaultRole = normalizedRoles.filter((r) => r.value !== 'admin')[0];
+    if (!defaultRole) {
+        throw Error('Missing default role');
+    }
+    // Define role field
+    const rolesField = select('roles')
+        .options(...roles)
+        .defaultValue([defaultRole.value])
+        .many()
+        .required();
+    if (IS_GENERIC_COLLECTION) {
+        rolesField.access({
+            create: () => true,
+            read: (user) => !!user,
+            update: (user) => !!user
+        });
+    }
+    else {
+        rolesField.access({
+            create: (user) => !!user && access.isAdmin(user),
+            read: (user) => !!user && access.isAdmin(user),
+            update: (user) => !!user && access.isAdmin(user)
+        });
+    }
+    const fields = [
+        nameField,
+        // Add email field for non api key auth type.
+        ...(!IS_API_AUTH ? [emailField] : []),
+        rolesField,
+        ...(normalizedAuthConfig.fields || []),
+        // Add apiKeyId for api key auth type.
+        ...(IS_API_AUTH
+            ? [
+                text('apiKeyId')
+                    .hidden()
+                    .access({ update: () => false })
+            ]
+            : [])
+    ];
+    if (IS_API_AUTH) {
+        const ownerIdField = text('ownerId')
+            .hidden()
+            .access({ update: () => false });
+        fields.push(ownerIdField);
+    }
+    // What an auth document is called, overriding the prototype's fallback rather than being
+    // guessed at by `title`. Upload overrides it again where a config carries both, which is the
+    // precedence registry order gives: upload is listed after auth.
+    const _titleFallback = IS_API_AUTH ? 'name' : 'email';
+    return { ...normalizedAuthConfig, fields, _titleFallback };
+};
+// The staff collection every config gets. Client-side it goes first (the panel lists it
+// first), server-side last — the one thing the two halves genuinely disagree on.
+export { configureStaff } from './staff/configure.js';

package/dist/core/auth/augment.server.d.ts

@@ -0,0 +1,3 @@
+import type { Collection } from '../config/types.js';
+import { type WithNormalizedAuth } from './augment.js';
+export declare const augmentAuth: <T extends Collection<any>>(config: T) => WithNormalizedAuth<T>;