rimecms 0.32.1 → 1.0.0

package/dist/core/plugins/sse/index.server.js

@@ -1,7 +1,7 @@
 import { definePlugin } from '../index.js';
 import { connect, emit } from './bus.server.js';
 /**
- * The event stream, at `/api/sse`.
+ * The event stream, at `/api/sse`. Added to every config, configured by its `$sse` key.
  *
  * Send with `rime.sse.emit(key, event, payload)`, listen with `openSse(keys, handler)`.
  *
@@ -9,7 +9,8 @@ import { connect, emit } from './bus.server.js';
  * otherwise, so an app opens its own deliberately rather than by leaving a default alone.
  *
  * @example
- * sse({ access: (key) => key.startsWith('public:') })
+ * // rime.config.server.ts
+ * $sse: { access: (key) => key.startsWith('public:') }
  */
 export const sse = definePlugin((options) => ({
     name: 'sse',

package/dist/core/plugins/sse/types.d.ts

@@ -14,3 +14,8 @@ export type SSEHandler = (event: SSEEvent) => void | Promise<void>;
  * point of naming keys up front rather than filtering in the browser.
  */
 export type SSEAccess = (key: string, user?: User) => boolean;
+/** The `$sse` key of the config. */
+export type SSEConfig = {
+    /** Which keys, besides the panel's own, a caller may listen to. None without it. */
+    access?: SSEAccess;
+};

package/dist/core/prototype/area/api.server.js

@@ -1,4 +1,3 @@
-import { createBlankDocument } from '../doc.js';
 import { versionsReadQuery } from '../shared/versions/read-query.js';
 import { find } from './operations/find.js';
 import { update } from './operations/update.js';
@@ -40,7 +39,7 @@ class AreaAPI {
     }
     /** The area's document with every default applied. */
     blank() {
-        return createBlankDocument(this.config, this.event);
+        return this.config.blank(this.event);
     }
     /** The locale to act in: the one asked for, else the request's, else the config's default. */
     fallbackLocale(locale) {

package/dist/core/prototype/area/definition.js

@@ -1,9 +1,6 @@
 import { augmentMetas } from 'rimecms/core/prototype/shared/metas/module';
 import { augmentTitle } from '../shared/title/augment.js';
-import { augmentUrl } from '../shared/url/augment.js';
-import { hasUrl } from '../shared/url/enabled.js';
 import { augmentVersions } from '../shared/versions/augment.js';
-import { when } from '../when.js';
 import { definePrototype } from '../define.js';
 import { augmentAreaLabel } from './augment-label.js';
 /**
@@ -27,13 +24,7 @@ export const area = definePrototype({
      * in — it simply does not list them. That is what the two lists say that a shared
      * implementation with a flag could not.
      */
-    augments: () => [
-        augmentAreaLabel,
-        augmentVersions,
-        when(hasUrl, augmentUrl),
-        augmentTitle,
-        augmentMetas
-    ]
+    augments: () => [augmentAreaLabel, augmentVersions, augmentTitle, augmentMetas]
 });
 /**
  * The public authoring API: `Area.create('settings', {…})`. See the collection's for why the

package/dist/core/prototype/area/definition.server.js

@@ -1,5 +1,4 @@
 import { definePrototype } from '../define.js';
-import { createBlankDocument } from '../doc.js';
 import { blankVersion } from '../shared/versions/blank.js';
 import { area as base } from './definition.js';
 import { areaHooks } from './hooks.server.js';
@@ -22,9 +21,9 @@ export const area = definePrototype({
     hooks: areaHooks,
     boot: async ({ config, adapter, defaultLocale }) => {
         /**
-         * No request event: boot has no request. `createBlankDocument` takes one only to pass to a
-         * field's `defaultValue({ event })`, which already declares it optional — so a default that
-         * reads it gets `undefined` here rather than whichever request arrived first.
+         * No request event: boot has no request. `blank` takes one only to pass to a field's
+         * `defaultValue({ event })`, which already declares it optional — so a default that reads it
+         * gets `undefined` here rather than whichever request arrived first.
          *
          * The locale is the config's default for the same reason: the locale of an area's first row
          * is a property of the config, not of its first reader.
@@ -33,7 +32,7 @@ export const area = definePrototype({
             // Intent `'seed'`, not `'create'`: a feature that gives this prototype a versions table may need
             // the first row to differ from what an author's create starts with. See
             // FeatureDefinition.blank.
-            blank: blankVersion(createBlankDocument(config), config),
+            blank: blankVersion(config.blank(), config),
             locale: defaultLocale
         });
     }

package/dist/core/prototype/area/hooks.server.js

@@ -39,8 +39,9 @@ export const areaHooks = {
         setDocumentType,
         when(isVersioned, versions.exposeVersionId),
         title.setDocumentTitle,
-        // After the title, for the reason the collection's list gives.
-        when(hasUrl, url.populateURL),
+        // After the title: `$url` is the author's function, and may read it.
+        when(hasUrl, url.setAreaUrl),
+        when(hasUrl, url.setLiveUrl),
         metas.deletePanelLockMetas
     ],
     beforeUpdate: [

package/dist/core/prototype/area/operations/find.js

@@ -1,3 +1,4 @@
+import { readableReferences } from '../../../fields/util.js';
 import { RimeError } from '../../../errors/index.js';
 import { readDocument, runBeforeOperation } from '../../../pipeline/run.server.js';
 export const find = async (args) => {
@@ -24,6 +25,7 @@ export const find = async (args) => {
         locale,
         localeFallback,
         select,
+        resolve: isSystemOperation ? undefined : readableReferences(config.fields, event.locals.user),
         // See the collection's findById.
         content: ctx.versionQuery({ latest, versionId })
     });

package/dist/core/prototype/blank.d.ts

@@ -0,0 +1,26 @@
+import type { FieldBuilder } from '../fields/builders/field-builder.js';
+import type { GenericDoc } from './types.js';
+import type { Field } from '../../fields/types.js';
+import type { RequestEvent } from '@sveltejs/kit';
+/** What `blank` reads off the config it is a method of. */
+type BlankOwner = {
+    fields: FieldBuilder<Field>[];
+    slug: string;
+    type: string;
+};
+/**
+ * A document of this config's shape with every default applied, and no id.
+ *
+ * ```ts
+ * const page = config.getCollection('pages').blank();
+ * ```
+ *
+ * Written as a standalone function so every config carries the same one — `definePrototype.create`
+ * for an authored config, and the three derivations that build a config by hand. The event is a
+ * field default's; boot has none, and a default that reads it gets `undefined` there.
+ *
+ * Nothing feature-shaped lands here: a feature adds to a blank document through
+ * `FeatureDefinition.blank`, which the local API folds.
+ */
+export declare function blank(this: BlankOwner, event?: RequestEvent): GenericDoc;
+export {};

package/dist/core/prototype/blank.js

@@ -0,0 +1,22 @@
+import { blankFields } from '../fields/blank.js';
+/**
+ * A document of this config's shape with every default applied, and no id.
+ *
+ * ```ts
+ * const page = config.getCollection('pages').blank();
+ * ```
+ *
+ * Written as a standalone function so every config carries the same one — `definePrototype.create`
+ * for an authored config, and the three derivations that build a config by hand. The event is a
+ * field default's; boot has none, and a default that reads it gets `undefined` there.
+ *
+ * Nothing feature-shaped lands here: a feature adds to a blank document through
+ * `FeatureDefinition.blank`, which the local API folds.
+ */
+export function blank(event) {
+    return {
+        ...blankFields(this.fields, { event }),
+        _type: this.slug,
+        _prototype: this.type
+    };
+}

package/dist/core/prototype/collection/api.server.d.ts

@@ -10,8 +10,10 @@ import { type DeleteByIdArgs } from './operations/delete-by-id.js';
 import { type DeleteArgs } from './operations/delete.js';
 import { type DuplicateArgs } from './operations/duplicate.js';
 import { type FindByIdArgs } from './operations/find-by-id.js';
+import { type FindByIdsArgs } from './operations/find-by-ids.js';
 import { type FindArgs } from './operations/find.js';
 import { type UpdateByIdArgs } from './operations/update-by-id.js';
+import { type UpdateSlugByIdArgs } from './operations/update-slug-by-id.js';
 /** What building a collection's API for one request needs. */
 export type CollectionApiArgs = {
     config: BuiltCollection;
@@ -49,8 +51,15 @@ declare class CollectionAPI<Doc extends RegisterCollection[CollectionSlug]> impl
     /**
      * A document of this collection's shape with every default applied, and no id.
      *
-     * An auth collection hands back nothing private — the password, the better-auth link. Only a
-     * collection signs in, which is why this step is here and not on the area's.
+     * An auth collection hands back nothing private. Only a collection signs in, which is why this
+     * step is here and not on the area's.
+     *
+     * **Likely dead, to be checked and dropped.** `withoutPrivateFields` strips `PRIVATE_FIELDS`, and
+     * of those only `apiKeyId` is ever a member of `config.fields` — `augment.ts` adds it, hidden, on
+     * an apiKey collection. `password` is appended per-operation by `augmentFieldsPassword`, which
+     * runs *after* the blank merge, and the rest are columns no field declares. So the one member
+     * this can remove is `apiKeyId`, which `removePrivateFields` takes off again on every read. If
+     * that holds, an auth collection's blank is a blank like any other and this line is ceremony.
      */
     blank(): Doc;
     /** The locale to act in: the one asked for, else the request's, else the config's default. */
@@ -119,6 +128,23 @@ declare class CollectionAPI<Doc extends RegisterCollection[CollectionSlug]> impl
      * });
      */
     findById(args: FindByIdArgs): Promise<Doc>;
+    /**
+     * Finds the documents with these ids, in one read. Each id is checked against the read access
+     * as findById would check it; a missing or refused one is left out. The order is the list's
+     * default sort, not the order of `ids`.
+     *
+     * @example
+     * const medias = await rime.collection('medias').findByIds({ ids: ['a1', 'b2'] });
+     */
+    findByIds(args: FindByIdsArgs): Promise<Doc[]>;
+    /**
+     * Changes a page's slug in one locale, on the published page. Its address changes, and the pages
+     * under it follow. A collection with `$url` only.
+     *
+     * @example
+     * await rime.collection('pages').updateSlugById({ id: '12345', slug: 'web-design', locale: 'en' });
+     */
+    updateSlugById(args: UpdateSlugByIdArgs): Promise<import("../../adapter.js").PathRow>;
     /**
      * Updates a document in the collection by ID.
      *
@@ -168,6 +194,6 @@ export declare const collectionApi: <Doc extends RegisterCollection[CollectionSl
  * itself and every `rime.collection(...)` in the repo would resolve to `never`. Each operation
  * exports its caller-facing arguments separately for the same reason.
  */
-export type CollectionApi<Doc extends RegisterCollection[CollectionSlug] = RegisterCollection[CollectionSlug]> = Pick<CollectionAPI<Doc>, 'config' | 'blank' | 'create' | 'duplicate' | 'find' | 'findById' | 'updateById' | 'deleteById' | 'delete' | 'system'>;
+export type CollectionApi<Doc extends RegisterCollection[CollectionSlug] = RegisterCollection[CollectionSlug]> = Pick<CollectionAPI<Doc>, 'config' | 'blank' | 'create' | 'duplicate' | 'find' | 'findById' | 'findByIds' | 'updateById' | 'updateSlugById' | 'deleteById' | 'delete' | 'system'>;
 export type CollectionAccessor = <Slug extends keyof RegisterCollection>(slug: Slug) => CollectionApi<RegisterCollection[Slug]>;
 export {};

package/dist/core/prototype/collection/api.server.js

@@ -1,15 +1,16 @@
 import { RimeError } from '../../errors/index.js';
 import { withoutPrivateFields } from '../../auth/constant.server.js';
 import { isAuth } from '../../auth/enabled.js';
-import { createBlankDocument } from '../doc.js';
 import { versionsReadQuery } from '../shared/versions/read-query.js';
 import { create } from './operations/create.js';
 import { deleteById } from './operations/delete-by-id.js';
 import { deleteDocs } from './operations/delete.js';
 import { duplicate } from './operations/duplicate.js';
 import { findById } from './operations/find-by-id.js';
+import { findByIds } from './operations/find-by-ids.js';
 import { find } from './operations/find.js';
 import { updateById } from './operations/update-by-id.js';
+import { updateSlugById } from './operations/update-slug-by-id.js';
 /**
  * Everything `rime.collection('pages')` can do, in the collection's own folder, beside the
  * operations that implement it.
@@ -49,11 +50,18 @@ class CollectionAPI {
     /**
      * A document of this collection's shape with every default applied, and no id.
      *
-     * An auth collection hands back nothing private — the password, the better-auth link. Only a
-     * collection signs in, which is why this step is here and not on the area's.
+     * An auth collection hands back nothing private. Only a collection signs in, which is why this
+     * step is here and not on the area's.
+     *
+     * **Likely dead, to be checked and dropped.** `withoutPrivateFields` strips `PRIVATE_FIELDS`, and
+     * of those only `apiKeyId` is ever a member of `config.fields` — `augment.ts` adds it, hidden, on
+     * an apiKey collection. `password` is appended per-operation by `augmentFieldsPassword`, which
+     * runs *after* the blank merge, and the rest are columns no field declares. So the one member
+     * this can remove is `apiKeyId`, which `removePrivateFields` takes off again on every read. If
+     * that holds, an auth collection's blank is a blank like any other and this line is ceremony.
      */
     blank() {
-        const doc = createBlankDocument(this.config, this.event);
+        const doc = this.config.blank(this.event);
         return (isAuth(this.config) ? withoutPrivateFields(doc) : doc);
     }
     /** The locale to act in: the one asked for, else the request's, else the config's default. */
@@ -173,6 +181,41 @@ class CollectionAPI {
             locale: this.fallbackLocale(locale)
         }));
     }
+    /**
+     * Finds the documents with these ids, in one read. Each id is checked against the read access
+     * as findById would check it; a missing or refused one is left out. The order is the list's
+     * default sort, not the order of `ids`.
+     *
+     * @example
+     * const medias = await rime.collection('medias').findByIds({ ids: ['a1', 'b2'] });
+     */
+    findByIds(args) {
+        const { ids, locale, depth = 0, localeFallback } = args;
+        if (!ids.length)
+            return Promise.resolve([]);
+        return findByIds({
+            ctx: this,
+            ids,
+            depth,
+            localeFallback,
+            locale: this.fallbackLocale(locale)
+        });
+    }
+    /**
+     * Changes a page's slug in one locale, on the published page. Its address changes, and the pages
+     * under it follow. A collection with `$url` only.
+     *
+     * @example
+     * await rime.collection('pages').updateSlugById({ id: '12345', slug: 'web-design', locale: 'en' });
+     */
+    updateSlugById(args) {
+        return updateSlugById({
+            ctx: this,
+            id: args.id,
+            slug: args.slug,
+            locale: this.fallbackLocale(args.locale)
+        });
+    }
     /**
      * Updates a document in the collection by ID.
      *

package/dist/core/prototype/collection/definition.js

@@ -7,8 +7,6 @@ import { augmentThumbnail } from './thumbnail/augment.js';
 import { augmentTitle } from '../shared/title/augment.js';
 import { augmentUpload } from 'rimecms/core/prototype/collection/upload/module';
 import { isUpload } from './upload/enabled.js';
-import { augmentUrl } from '../shared/url/augment.js';
-import { hasUrl } from '../shared/url/enabled.js';
 import { augmentVersions } from '../shared/versions/augment.js';
 import { when } from '../when.js';
 import { definePrototype } from '../define.js';
@@ -50,7 +48,6 @@ export const collection = definePrototype({
         when(isUpload, augmentUpload),
         when(isNested, augmentNested),
         augmentVersions,
-        when(hasUrl, augmentUrl),
         augmentTitle,
         augmentThumbnail,
         augmentMetas

package/dist/core/prototype/collection/hooks/merge-with-blank.server.d.ts

@@ -1,5 +1,9 @@
 /**
- * Merges the incoming data onto a blank document, so a create starts from every field the config
+ * Fills the incoming data from a blank document, so a create starts from every field the config
  * declares rather than only the ones the caller sent.
+ *
+ * What the caller sent is kept as sent: an upload's `File` is not a plain object and is not
+ * walked, a key no field declares has no blank to fill from. The data's own nested objects are
+ * shared with the caller's payload from here on, not copied.
  */
 export declare const mergeWithBlankDocument: import("../../../pipeline/types").Hook<"raw", "create", "before">;

package/dist/core/prototype/collection/hooks/merge-with-blank.server.js

@@ -1,28 +1,14 @@
 import { Hooks } from '../../../pipeline/define-hook.js';
-import { createBlankDocument } from '../../doc.js';
-import { omit, pick } from '../../../../util/object.js';
-import deepmerge from 'deepmerge';
+import { withDefaults } from '../../../../util/object.js';
 /**
- * Merges the incoming data onto a blank document, so a create starts from every field the config
+ * Fills the incoming data from a blank document, so a create starts from every field the config
  * declares rather than only the ones the caller sent.
+ *
+ * What the caller sent is kept as sent: an upload's `File` is not a plain object and is not
+ * walked, a key no field declares has no blank to fill from. The data's own nested objects are
+ * shared with the caller's payload from here on, not copied.
  */
 export const mergeWithBlankDocument = Hooks.beforeCreate(async function mergeWithBlankDocument(args) {
-    const blank = createBlankDocument(args.config, args.event);
-    const known = Object.keys(blank);
-    const data = args.data;
-    /**
-     * The blank is built from the config's fields, so only the keys it has are keys there is
-     * anything to merge *with*. Everything else is carried across rather than through.
-     *
-     * That is what keeps a `File` a `File`. `deepmerge` clones every plain object it walks, so an
-     * upload payload passed through it would come out with none of a `File`'s methods — and `file`
-     * is not a field on any config, so the blank has no key for it and nothing to merge it into.
-     */
-    return {
-        ...args,
-        data: {
-            ...deepmerge(blank, pick(known, data), { arrayMerge: (_, incoming) => incoming }),
-            ...omit(known, data)
-        }
-    };
+    const blank = args.config.blank(args.event);
+    return { ...args, data: withDefaults(args.data, blank) };
 });

package/dist/core/prototype/collection/hooks.server.js

@@ -62,9 +62,8 @@ export const collectionHooks = {
         when(isNested, nested.addChildrenProperty),
         when(isVersioned, versions.exposeVersionId),
         title.setDocumentTitle,
-        // After the title: `config.$url(document)` is the author's own function, and a slug built
-        // from the title is the ordinary case.
-        when(hasUrl, url.populateURL),
+        // The live edit link, from the url the read joined.
+        when(hasUrl, url.setLiveUrl),
         // After the sizes: it takes the thumbnail `upload.populateSizes` derived when there is one.
         thumbnail.setDocumentThumbnail,
         metas.deletePanelLockMetas
@@ -89,7 +88,12 @@ export const collectionHooks = {
         when(isUpload, upload.castBase64ToFile),
         when(isUpload, upload.processFileUpload)
     ],
-    afterCreate: [when(isAuth, auth.populateAPIKey), when(isAuth, auth.signInNewUser)],
+    afterCreate: [
+        when(isAuth, auth.populateAPIKey),
+        when(isAuth, auth.signInNewUser),
+        when(hasUrl, url.createPaths)
+    ],
+    afterUpdate: [when(hasUrl, url.syncPaths)],
     beforeUpdate: [
         versions.stripAutoSaveFlag,
         getOriginalDocument,
@@ -127,7 +131,9 @@ export const collectionHooks = {
         when(isAuth, auth.preventSupperAdminDeletion),
         // After the refusal above: a user who cannot be deleted keeps their auto-saves.
         when(isStaffCollection, versions.discardAutoSavesOf),
-        when(isUpload, upload.cleanUpFiles)
+        when(isUpload, upload.cleanUpFiles),
+        // Its children go to the top with their addresses, before its own go by cascade.
+        when(hasUrl, url.detachPaths)
     ],
     afterDelete: [when(isAuth, auth.deleteBetterAuthUser)]
 };

package/dist/core/prototype/collection/nested/module.server.js

@@ -15,7 +15,9 @@ export const augmentNested = (config) => ({
         text('_parent')
             .$references(config.slug, { onDelete: 'set null', selfReferencing: true })
             .hidden()
-            .$root(),
+            .$root()
+            // A read lists a document's children by it
+            .$index(),
         number('_position').defaultValue(0).hidden().$root()
     ]
 });

package/dist/core/prototype/collection/nested/tree.d.ts

@@ -0,0 +1,12 @@
+import type { GenericDoc } from '../../types.js';
+/**
+ * The flat rows of a nested collection as a tree, each document holding its own children.
+ *
+ * Roots are the documents with no `_parent`, ordered by `_position`; a document already placed is
+ * never placed twice, so a cycle in the rows stops rather than recurses.
+ *
+ * ```ts
+ * toNestedStructure(pages); // [{ id: '1', _children: [{ id: '2', _children: [] }] }]
+ * ```
+ */
+export declare const toNestedStructure: (documents: GenericDoc[]) => GenericDoc[];

package/dist/core/prototype/collection/nested/tree.js

@@ -0,0 +1,42 @@
+import { snapshot } from '../../../../util/state.js';
+/**
+ * The flat rows of a nested collection as a tree, each document holding its own children.
+ *
+ * Roots are the documents with no `_parent`, ordered by `_position`; a document already placed is
+ * never placed twice, so a cycle in the rows stops rather than recurses.
+ *
+ * ```ts
+ * toNestedStructure(pages); // [{ id: '1', _children: [{ id: '2', _children: [] }] }]
+ * ```
+ */
+export const toNestedStructure = (documents) => {
+    const incomingDocs = snapshot(documents);
+    const docById = new Map();
+    incomingDocs.forEach((doc) => docById.set(doc.id, doc));
+    const processed = new Set();
+    const processDocument = (doc) => {
+        if (!doc || processed.has(doc.id)) {
+            return doc;
+        }
+        processed.add(doc.id);
+        const result = { ...doc };
+        // Children first, depth-first.
+        if (Array.isArray(result._children)) {
+            result._children = result._children
+                .map((id) => {
+                const childDoc = docById.get(id);
+                return childDoc ? processDocument(childDoc) : null;
+            })
+                .filter(Boolean);
+        }
+        // The parent stays an id — only children are expanded.
+        if (result._parent && typeof result._parent === 'string') {
+            result._parent = docById.get(result._parent)?.id || null;
+        }
+        return result;
+    };
+    return incomingDocs
+        .filter((doc) => !doc._parent)
+        .map(processDocument)
+        .sort((a, b) => (a._position || 0) - (b._position || 0));
+};

package/dist/core/prototype/collection/operations/find-by-id.js

@@ -1,3 +1,4 @@
+import { readableReferences } from '../../../fields/util.js';
 import { RimeError } from '../../../errors/index.js';
 import { readDocument, runBeforeOperation } from '../../../pipeline/run.server.js';
 export const findById = async (args) => {
@@ -26,6 +27,7 @@ export const findById = async (args) => {
         locale,
         localeFallback,
         select,
+        resolve: isSystemOperation ? undefined : readableReferences(config.fields, event.locals.user),
         // `draft` and `versionId` are request parameters; which row they name is the feature's answer.
         content: ctx.versionQuery({ latest, versionId })
     });

package/dist/core/prototype/collection/operations/find-by-ids.d.ts

@@ -0,0 +1,19 @@
+import type { BuiltCollection } from '../../../config/types.js';
+import type { PrototypeApiContext } from '../../define.js';
+import type { GenericDoc } from '../../types.js';
+export type FindByIdsArgs = {
+    ids: string[];
+    locale?: string | undefined;
+    depth?: number;
+    /** See the collection's findById. */
+    localeFallback?: boolean;
+};
+type Args = FindByIdsArgs & {
+    ctx: PrototypeApiContext<BuiltCollection>;
+};
+/**
+ * The published documents with these ids, in one read. A missing id, or one this reader is refused,
+ * is left out.
+ */
+export declare const findByIds: <T extends GenericDoc>(args: Args) => Promise<T[]>;
+export {};

package/dist/core/prototype/collection/operations/find-by-ids.js

@@ -0,0 +1,54 @@
+import { readableReferences } from '../../../fields/util.js';
+import { RimeError } from '../../../errors/index.js';
+import { logger } from '../../../logger.server.js';
+import { readDocuments, runBeforeOperation } from '../../../pipeline/run.server.js';
+import { trycatch } from '../../../../util/function.js';
+/**
+ * The published documents with these ids, in one read. A missing id, or one this reader is refused,
+ * is left out.
+ */
+export const findByIds = async (args) => {
+    const { ctx, ids, locale, depth, localeFallback } = args;
+    const { config, event, isSystemOperation } = ctx;
+    // The beforeOperation chain findById runs, once per id: a read rule that looks at `id` answers
+    // for each document as it would one at a time. A refusal leaves the id out; anything else throws.
+    const readable = [];
+    for (const id of ids) {
+        const [error] = await trycatch(() => runBeforeOperation({
+            config,
+            event,
+            operation: 'read',
+            context: { isSystemOperation, params: { id, locale, depth } }
+        }));
+        if (!error)
+            readable.push(id);
+        else if (!(error instanceof RimeError && error.code === RimeError.UNAUTHORIZED))
+            throw error;
+    }
+    if (!readable.length)
+        return [];
+    const documentsRaw = await event.locals.rime.adapter.collection(config.slug).findMany({
+        // `id` names the document on a versioned collection too: the adapter reads it as `ownerId`.
+        query: { where: { id: { in_array: readable } } },
+        locale,
+        localeFallback,
+        resolve: isSystemOperation ? undefined : readableReferences(config.fields, event.locals.user),
+        // The published row, as findById reads with no `latest` and no `versionId`.
+        content: ctx.versionQuery({})
+    });
+    const results = await readDocuments({
+        raws: documentsRaw,
+        config,
+        event,
+        context: { isSystemOperation, params: { locale, depth, select: [] } },
+        locale,
+        localeFallback,
+        depth
+    });
+    return results.flatMap((result) => {
+        if (result.status === 'fulfilled')
+            return [result.value.doc];
+        logger.error(result.reason.message, result.reason);
+        return [];
+    });
+};

package/dist/core/prototype/collection/operations/find.js

@@ -1,5 +1,6 @@
+import { readableReferences } from '../../../fields/util.js';
 import { logger } from '../../../logger.server.js';
-import { readDocument, runBeforeOperation } from '../../../pipeline/run.server.js';
+import { readDocuments, runBeforeOperation } from '../../../pipeline/run.server.js';
 export const find = async (args) => {
     //
     const { ctx, locale, sort, limit, offset, depth, query, latest, select = [], localeFallback } = args;
@@ -32,34 +33,27 @@ export const find = async (args) => {
         locale,
         localeFallback,
         select,
+        resolve: isSystemOperation ? undefined : readableReferences(config.fields, event.locals.user),
         // Which content row each document shows. `and`ed with `query` by the adapter, rather than
         // spliced into it — see the collection's findById for where the answer comes from.
         content: ctx.versionQuery({ latest })
     });
-    async function processDocument(documentRaw) {
-        try {
-            const result = await readDocument({
-                raw: documentRaw,
-                config,
-                event,
-                context,
-                locale,
-                localeFallback,
-                depth,
-                select
-            });
-            context = result.context;
-            return result.doc;
-        }
-        catch (error) {
-            // Skip this document and carry on with the next one. The transform is inside the try
-            // alongside the hooks now: a row rime cannot turn into a document is the same kind of
-            // per-row problem as a beforeRead hook rejecting one, and taking the whole query down
-            // for it made a single bad row look like an empty collection.
-            logger.error(error.message, error);
-            return null;
-        }
-    }
-    const documents = await Promise.all(documentsRaw.map((doc) => processDocument(doc)));
-    return documents.filter((d) => !!d);
+    const results = await readDocuments({
+        raws: documentsRaw,
+        config,
+        event,
+        context,
+        locale,
+        localeFallback,
+        depth,
+        select
+    });
+    // A row rime cannot turn into a document, or that a beforeRead hook rejects, is skipped: one bad
+    // row does not take the whole list down.
+    return results.flatMap((result) => {
+        if (result.status === 'fulfilled')
+            return [result.value.doc];
+        logger.error(result.reason.message, result.reason);
+        return [];
+    });
 };