rimecms 0.33.0 → 1.0.0

package/dist/core/pipeline/run.server.d.ts

@@ -97,12 +97,7 @@ export declare const persistRelational: (args: {
     config: AnyConfig;
     locale?: string | undefined;
 }) => Promise<void>;
-/**
- * The read tail shared by findById and an area's find: turn a raw adapter row into a document,
- * then run the beforeRead chain over it.
- */
-export declare const readDocument: <S extends DocType, T extends GenericDoc>(args: {
-    raw: RawDoc;
+type ReadArgs<S extends DocType> = {
     config: AnyConfig;
     event: RequestEvent;
     context: OperationContext<S>;
@@ -110,6 +105,22 @@ export declare const readDocument: <S extends DocType, T extends GenericDoc>(arg
     localeFallback?: boolean;
     depth?: number;
     select?: string[];
+};
+/**
+ * The read tail of a list: every raw adapter row turned into rows, what their relations point at
+ * read in one pass, then each document built and run through the beforeRead chain.
+ *
+ * One settled result per raw, in order: a document that fails is the caller's to skip or throw.
+ */
+export declare const readDocuments: <S extends DocType, T extends GenericDoc>(args: ReadArgs<S> & {
+    raws: RawDoc[];
+}) => Promise<PromiseSettledResult<{
+    doc: T;
+    context: OperationContext<S>;
+}>[]>;
+/** The read tail of a single document: `readDocuments` over one raw row, its failure thrown. */
+export declare const readDocument: <S extends DocType, T extends GenericDoc>(args: ReadArgs<S> & {
+    raw: RawDoc;
 }) => Promise<{
     doc: T;
     context: OperationContext<S>;

package/dist/core/pipeline/run.server.js

@@ -1,6 +1,7 @@
 import { RimeError } from '../errors/index.js';
 import { versionsWritePlan } from '../prototype/shared/versions/write-plan.js';
 import { buildDocument } from './build-document.server.js';
+import { populateRelations } from './populate-relations.server.js';
 import { saveBlocks } from './persist/blocks/index.server.js';
 import { saveRelations } from './persist/relations/index.server.js';
 import { saveTreeBlocks } from './persist/tree/index.server.js';
@@ -133,42 +134,55 @@ export const persistRelational = async (args) => {
     });
 };
 /**
- * The read tail shared by findById and an area's find: turn a raw adapter row into a document,
- * then run the beforeRead chain over it.
+ * The read tail of a list: every raw adapter row turned into rows, what their relations point at
+ * read in one pass, then each document built and run through the beforeRead chain.
+ *
+ * One settled result per raw, in order: a document that fails is the caller's to skip or throw.
  */
-export const readDocument = async (args) => {
-    const { raw, config, event, locale, localeFallback, depth, select } = args;
+export const readDocuments = async (args) => {
+    const { raws, config, event, locale, localeFallback, depth = 0, select } = args;
     const hasSelect = !!select && Array.isArray(select) && !!select.length;
-    const rows = await event.locals.rime.adapter.transform.rows({
+    const rows = await Promise.allSettled(raws.map((raw) => event.locals.rime.adapter.transform.rows({
         doc: raw,
         slug: config.slug,
         locale,
         localeFallback
-    });
-    const document = await buildDocument(rows, {
-        config,
-        event,
-        locale,
-        depth,
-        withBlank: !hasSelect,
-        /**
-         * The panel edits blocks and tree nodes in place, so it needs each child row's own
-         * bookkeeping — `position`, `path`, `ownerId`, `locale` — kept on it.
-         *
-         * The adapter used to work this out for itself, by testing `event.params.panel`. Core naming
-         * the panel here is the last of that coupling (core letting go of `src/lib/panel/`), and it
-         * is one line rather than four `if`s in the database layer.
-         */
-        withRowMeta: event.params.panel !== undefined
-    });
-    return runDocHooks({
-        hooks: config.$hooks?.beforeRead,
-        doc: document,
-        config,
-        event,
-        operation: 'read',
-        context: args.context
-    });
+    })));
+    const populated = depth > 0
+        ? await populateRelations(rows.flatMap((row) => (row.status === 'fulfilled' ? [row.value] : [])), { event, locale, depth })
+        : undefined;
+    return Promise.allSettled(rows.map(async (row) => {
+        if (row.status === 'rejected')
+            throw row.reason;
+        const document = await buildDocument(row.value, {
+            config,
+            event,
+            locale,
+            depth,
+            populated,
+            withBlank: !hasSelect,
+            /**
+             * The panel edits blocks and tree nodes in place, so it needs each child row's own
+             * bookkeeping — `position`, `path`, `ownerId`, `locale` — kept on it.
+             */
+            withRowMeta: event.params.panel !== undefined
+        });
+        return runDocHooks({
+            hooks: config.$hooks?.beforeRead,
+            doc: document,
+            config,
+            event,
+            operation: 'read',
+            context: args.context
+        });
+    }));
+};
+/** The read tail of a single document: `readDocuments` over one raw row, its failure thrown. */
+export const readDocument = async (args) => {
+    const [result] = await readDocuments({ ...args, raws: [args.raw] });
+    if (result.status === 'rejected')
+        throw result.reason;
+    return result.value;
 };
 /**
  * The update pipeline, prototype-parameterized.

package/dist/core/plugins/cache/module.server.d.ts

@@ -29,7 +29,7 @@ export declare const cache: (options?: CacheOptions) => {
     readonly configure: <const C extends import("../../config/types.js").Config | import("../../config/types.js").SanitizedConfigClient>(config: C) => C;
     readonly routes: {
         readonly '/api/clear-cache': {
-            readonly POST: () => Response;
+            readonly POST: (event: RequestEvent) => Response;
         };
     };
     readonly actions: CacheActions;

package/dist/core/plugins/cache/module.server.js

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { isStaff } from '../../auth/access.js';
+import { error, json } from '@sveltejs/kit';
 import { createHash } from 'node:crypto';
 import { definePlugin } from '../index.js';
 import { Cache } from './cache.server.js';
@@ -20,9 +21,7 @@ export const cache = definePlugin((options) => {
     async function getAction(key, get) {
         return await Cache.get(key, get);
     }
-    /**
-     * Empty the .cache folder
-     */
+    /** Empties the cache. A config's hook calls it as an action; the route below guards it. */
     const clearCache = () => {
         Cache.clear();
         return json({ message: 'Cache cleared' });
@@ -59,8 +58,9 @@ export const cache = definePlugin((options) => {
             return config;
         },
         routes: {
+            // Staff only: the route is public, and an empty cache is a cost.
             '/api/clear-cache': {
-                POST: clearCache
+                POST: (event) => (isStaff(event.locals.user) ? clearCache() : error(403))
             }
         },
         actions,

package/dist/core/prototype/area/api.server.js

@@ -1,4 +1,3 @@
-import { createBlankDocument } from '../doc.js';
 import { versionsReadQuery } from '../shared/versions/read-query.js';
 import { find } from './operations/find.js';
 import { update } from './operations/update.js';
@@ -40,7 +39,7 @@ class AreaAPI {
     }
     /** The area's document with every default applied. */
     blank() {
-        return createBlankDocument(this.config, this.event);
+        return this.config.blank(this.event);
     }
     /** The locale to act in: the one asked for, else the request's, else the config's default. */
     fallbackLocale(locale) {

package/dist/core/prototype/area/definition.js

@@ -1,9 +1,6 @@
 import { augmentMetas } from 'rimecms/core/prototype/shared/metas/module';
 import { augmentTitle } from '../shared/title/augment.js';
-import { augmentUrl } from '../shared/url/augment.js';
-import { hasUrl } from '../shared/url/enabled.js';
 import { augmentVersions } from '../shared/versions/augment.js';
-import { when } from '../when.js';
 import { definePrototype } from '../define.js';
 import { augmentAreaLabel } from './augment-label.js';
 /**
@@ -27,13 +24,7 @@ export const area = definePrototype({
      * in — it simply does not list them. That is what the two lists say that a shared
      * implementation with a flag could not.
      */
-    augments: () => [
-        augmentAreaLabel,
-        augmentVersions,
-        when(hasUrl, augmentUrl),
-        augmentTitle,
-        augmentMetas
-    ]
+    augments: () => [augmentAreaLabel, augmentVersions, augmentTitle, augmentMetas]
 });
 /**
  * The public authoring API: `Area.create('settings', {…})`. See the collection's for why the

package/dist/core/prototype/area/definition.server.js

@@ -1,5 +1,4 @@
 import { definePrototype } from '../define.js';
-import { createBlankDocument } from '../doc.js';
 import { blankVersion } from '../shared/versions/blank.js';
 import { area as base } from './definition.js';
 import { areaHooks } from './hooks.server.js';
@@ -22,9 +21,9 @@ export const area = definePrototype({
     hooks: areaHooks,
     boot: async ({ config, adapter, defaultLocale }) => {
         /**
-         * No request event: boot has no request. `createBlankDocument` takes one only to pass to a
-         * field's `defaultValue({ event })`, which already declares it optional — so a default that
-         * reads it gets `undefined` here rather than whichever request arrived first.
+         * No request event: boot has no request. `blank` takes one only to pass to a field's
+         * `defaultValue({ event })`, which already declares it optional — so a default that reads it
+         * gets `undefined` here rather than whichever request arrived first.
          *
          * The locale is the config's default for the same reason: the locale of an area's first row
          * is a property of the config, not of its first reader.
@@ -33,7 +32,7 @@ export const area = definePrototype({
             // Intent `'seed'`, not `'create'`: a feature that gives this prototype a versions table may need
             // the first row to differ from what an author's create starts with. See
             // FeatureDefinition.blank.
-            blank: blankVersion(createBlankDocument(config), config),
+            blank: blankVersion(config.blank(), config),
             locale: defaultLocale
         });
     }

package/dist/core/prototype/area/hooks.server.js

@@ -39,8 +39,9 @@ export const areaHooks = {
         setDocumentType,
         when(isVersioned, versions.exposeVersionId),
         title.setDocumentTitle,
-        // After the title, for the reason the collection's list gives.
-        when(hasUrl, url.populateURL),
+        // After the title: `$url` is the author's function, and may read it.
+        when(hasUrl, url.setAreaUrl),
+        when(hasUrl, url.setLiveUrl),
         metas.deletePanelLockMetas
     ],
     beforeUpdate: [

package/dist/core/prototype/area/operations/find.js

@@ -1,3 +1,4 @@
+import { readableReferences } from '../../../fields/util.js';
 import { RimeError } from '../../../errors/index.js';
 import { readDocument, runBeforeOperation } from '../../../pipeline/run.server.js';
 export const find = async (args) => {
@@ -24,6 +25,7 @@ export const find = async (args) => {
         locale,
         localeFallback,
         select,
+        resolve: isSystemOperation ? undefined : readableReferences(config.fields, event.locals.user),
         // See the collection's findById.
         content: ctx.versionQuery({ latest, versionId })
     });

package/dist/core/prototype/blank.d.ts

@@ -0,0 +1,26 @@
+import type { FieldBuilder } from '../fields/builders/field-builder.js';
+import type { GenericDoc } from './types.js';
+import type { Field } from '../../fields/types.js';
+import type { RequestEvent } from '@sveltejs/kit';
+/** What `blank` reads off the config it is a method of. */
+type BlankOwner = {
+    fields: FieldBuilder<Field>[];
+    slug: string;
+    type: string;
+};
+/**
+ * A document of this config's shape with every default applied, and no id.
+ *
+ * ```ts
+ * const page = config.getCollection('pages').blank();
+ * ```
+ *
+ * Written as a standalone function so every config carries the same one — `definePrototype.create`
+ * for an authored config, and the three derivations that build a config by hand. The event is a
+ * field default's; boot has none, and a default that reads it gets `undefined` there.
+ *
+ * Nothing feature-shaped lands here: a feature adds to a blank document through
+ * `FeatureDefinition.blank`, which the local API folds.
+ */
+export declare function blank(this: BlankOwner, event?: RequestEvent): GenericDoc;
+export {};

package/dist/core/prototype/blank.js

@@ -0,0 +1,22 @@
+import { blankFields } from '../fields/blank.js';
+/**
+ * A document of this config's shape with every default applied, and no id.
+ *
+ * ```ts
+ * const page = config.getCollection('pages').blank();
+ * ```
+ *
+ * Written as a standalone function so every config carries the same one — `definePrototype.create`
+ * for an authored config, and the three derivations that build a config by hand. The event is a
+ * field default's; boot has none, and a default that reads it gets `undefined` there.
+ *
+ * Nothing feature-shaped lands here: a feature adds to a blank document through
+ * `FeatureDefinition.blank`, which the local API folds.
+ */
+export function blank(event) {
+    return {
+        ...blankFields(this.fields, { event }),
+        _type: this.slug,
+        _prototype: this.type
+    };
+}

package/dist/core/prototype/collection/api.server.d.ts

@@ -10,8 +10,10 @@ import { type DeleteByIdArgs } from './operations/delete-by-id.js';
 import { type DeleteArgs } from './operations/delete.js';
 import { type DuplicateArgs } from './operations/duplicate.js';
 import { type FindByIdArgs } from './operations/find-by-id.js';
+import { type FindByIdsArgs } from './operations/find-by-ids.js';
 import { type FindArgs } from './operations/find.js';
 import { type UpdateByIdArgs } from './operations/update-by-id.js';
+import { type UpdateSlugByIdArgs } from './operations/update-slug-by-id.js';
 /** What building a collection's API for one request needs. */
 export type CollectionApiArgs = {
     config: BuiltCollection;
@@ -49,8 +51,15 @@ declare class CollectionAPI<Doc extends RegisterCollection[CollectionSlug]> impl
     /**
      * A document of this collection's shape with every default applied, and no id.
      *
-     * An auth collection hands back nothing private — the password, the better-auth link. Only a
-     * collection signs in, which is why this step is here and not on the area's.
+     * An auth collection hands back nothing private. Only a collection signs in, which is why this
+     * step is here and not on the area's.
+     *
+     * **Likely dead, to be checked and dropped.** `withoutPrivateFields` strips `PRIVATE_FIELDS`, and
+     * of those only `apiKeyId` is ever a member of `config.fields` — `augment.ts` adds it, hidden, on
+     * an apiKey collection. `password` is appended per-operation by `augmentFieldsPassword`, which
+     * runs *after* the blank merge, and the rest are columns no field declares. So the one member
+     * this can remove is `apiKeyId`, which `removePrivateFields` takes off again on every read. If
+     * that holds, an auth collection's blank is a blank like any other and this line is ceremony.
      */
     blank(): Doc;
     /** The locale to act in: the one asked for, else the request's, else the config's default. */
@@ -119,6 +128,23 @@ declare class CollectionAPI<Doc extends RegisterCollection[CollectionSlug]> impl
      * });
      */
     findById(args: FindByIdArgs): Promise<Doc>;
+    /**
+     * Finds the documents with these ids, in one read. Each id is checked against the read access
+     * as findById would check it; a missing or refused one is left out. The order is the list's
+     * default sort, not the order of `ids`.
+     *
+     * @example
+     * const medias = await rime.collection('medias').findByIds({ ids: ['a1', 'b2'] });
+     */
+    findByIds(args: FindByIdsArgs): Promise<Doc[]>;
+    /**
+     * Changes a page's slug in one locale, on the published page. Its address changes, and the pages
+     * under it follow. A collection with `$url` only.
+     *
+     * @example
+     * await rime.collection('pages').updateSlugById({ id: '12345', slug: 'web-design', locale: 'en' });
+     */
+    updateSlugById(args: UpdateSlugByIdArgs): Promise<import("../../adapter.js").PathRow>;
     /**
      * Updates a document in the collection by ID.
      *
@@ -168,6 +194,6 @@ export declare const collectionApi: <Doc extends RegisterCollection[CollectionSl
  * itself and every `rime.collection(...)` in the repo would resolve to `never`. Each operation
  * exports its caller-facing arguments separately for the same reason.
  */
-export type CollectionApi<Doc extends RegisterCollection[CollectionSlug] = RegisterCollection[CollectionSlug]> = Pick<CollectionAPI<Doc>, 'config' | 'blank' | 'create' | 'duplicate' | 'find' | 'findById' | 'updateById' | 'deleteById' | 'delete' | 'system'>;
+export type CollectionApi<Doc extends RegisterCollection[CollectionSlug] = RegisterCollection[CollectionSlug]> = Pick<CollectionAPI<Doc>, 'config' | 'blank' | 'create' | 'duplicate' | 'find' | 'findById' | 'findByIds' | 'updateById' | 'updateSlugById' | 'deleteById' | 'delete' | 'system'>;
 export type CollectionAccessor = <Slug extends keyof RegisterCollection>(slug: Slug) => CollectionApi<RegisterCollection[Slug]>;
 export {};

package/dist/core/prototype/collection/api.server.js

@@ -1,15 +1,16 @@
 import { RimeError } from '../../errors/index.js';
 import { withoutPrivateFields } from '../../auth/constant.server.js';
 import { isAuth } from '../../auth/enabled.js';
-import { createBlankDocument } from '../doc.js';
 import { versionsReadQuery } from '../shared/versions/read-query.js';
 import { create } from './operations/create.js';
 import { deleteById } from './operations/delete-by-id.js';
 import { deleteDocs } from './operations/delete.js';
 import { duplicate } from './operations/duplicate.js';
 import { findById } from './operations/find-by-id.js';
+import { findByIds } from './operations/find-by-ids.js';
 import { find } from './operations/find.js';
 import { updateById } from './operations/update-by-id.js';
+import { updateSlugById } from './operations/update-slug-by-id.js';
 /**
  * Everything `rime.collection('pages')` can do, in the collection's own folder, beside the
  * operations that implement it.
@@ -49,11 +50,18 @@ class CollectionAPI {
     /**
      * A document of this collection's shape with every default applied, and no id.
      *
-     * An auth collection hands back nothing private — the password, the better-auth link. Only a
-     * collection signs in, which is why this step is here and not on the area's.
+     * An auth collection hands back nothing private. Only a collection signs in, which is why this
+     * step is here and not on the area's.
+     *
+     * **Likely dead, to be checked and dropped.** `withoutPrivateFields` strips `PRIVATE_FIELDS`, and
+     * of those only `apiKeyId` is ever a member of `config.fields` — `augment.ts` adds it, hidden, on
+     * an apiKey collection. `password` is appended per-operation by `augmentFieldsPassword`, which
+     * runs *after* the blank merge, and the rest are columns no field declares. So the one member
+     * this can remove is `apiKeyId`, which `removePrivateFields` takes off again on every read. If
+     * that holds, an auth collection's blank is a blank like any other and this line is ceremony.
      */
     blank() {
-        const doc = createBlankDocument(this.config, this.event);
+        const doc = this.config.blank(this.event);
         return (isAuth(this.config) ? withoutPrivateFields(doc) : doc);
     }
     /** The locale to act in: the one asked for, else the request's, else the config's default. */
@@ -173,6 +181,41 @@ class CollectionAPI {
             locale: this.fallbackLocale(locale)
         }));
     }
+    /**
+     * Finds the documents with these ids, in one read. Each id is checked against the read access
+     * as findById would check it; a missing or refused one is left out. The order is the list's
+     * default sort, not the order of `ids`.
+     *
+     * @example
+     * const medias = await rime.collection('medias').findByIds({ ids: ['a1', 'b2'] });
+     */
+    findByIds(args) {
+        const { ids, locale, depth = 0, localeFallback } = args;
+        if (!ids.length)
+            return Promise.resolve([]);
+        return findByIds({
+            ctx: this,
+            ids,
+            depth,
+            localeFallback,
+            locale: this.fallbackLocale(locale)
+        });
+    }
+    /**
+     * Changes a page's slug in one locale, on the published page. Its address changes, and the pages
+     * under it follow. A collection with `$url` only.
+     *
+     * @example
+     * await rime.collection('pages').updateSlugById({ id: '12345', slug: 'web-design', locale: 'en' });
+     */
+    updateSlugById(args) {
+        return updateSlugById({
+            ctx: this,
+            id: args.id,
+            slug: args.slug,
+            locale: this.fallbackLocale(args.locale)
+        });
+    }
     /**
      * Updates a document in the collection by ID.
      *

package/dist/core/prototype/collection/definition.js

@@ -7,8 +7,6 @@ import { augmentThumbnail } from './thumbnail/augment.js';
 import { augmentTitle } from '../shared/title/augment.js';
 import { augmentUpload } from 'rimecms/core/prototype/collection/upload/module';
 import { isUpload } from './upload/enabled.js';
-import { augmentUrl } from '../shared/url/augment.js';
-import { hasUrl } from '../shared/url/enabled.js';
 import { augmentVersions } from '../shared/versions/augment.js';
 import { when } from '../when.js';
 import { definePrototype } from '../define.js';
@@ -50,7 +48,6 @@ export const collection = definePrototype({
         when(isUpload, augmentUpload),
         when(isNested, augmentNested),
         augmentVersions,
-        when(hasUrl, augmentUrl),
         augmentTitle,
         augmentThumbnail,
         augmentMetas

package/dist/core/prototype/collection/hooks/merge-with-blank.server.d.ts

@@ -1,5 +1,9 @@
 /**
- * Merges the incoming data onto a blank document, so a create starts from every field the config
+ * Fills the incoming data from a blank document, so a create starts from every field the config
  * declares rather than only the ones the caller sent.
+ *
+ * What the caller sent is kept as sent: an upload's `File` is not a plain object and is not
+ * walked, a key no field declares has no blank to fill from. The data's own nested objects are
+ * shared with the caller's payload from here on, not copied.
  */
 export declare const mergeWithBlankDocument: import("../../../pipeline/types").Hook<"raw", "create", "before">;

package/dist/core/prototype/collection/hooks/merge-with-blank.server.js

@@ -1,28 +1,14 @@
 import { Hooks } from '../../../pipeline/define-hook.js';
-import { createBlankDocument } from '../../doc.js';
-import { omit, pick } from '../../../../util/object.js';
-import deepmerge from 'deepmerge';
+import { withDefaults } from '../../../../util/object.js';
 /**
- * Merges the incoming data onto a blank document, so a create starts from every field the config
+ * Fills the incoming data from a blank document, so a create starts from every field the config
  * declares rather than only the ones the caller sent.
+ *
+ * What the caller sent is kept as sent: an upload's `File` is not a plain object and is not
+ * walked, a key no field declares has no blank to fill from. The data's own nested objects are
+ * shared with the caller's payload from here on, not copied.
  */
 export const mergeWithBlankDocument = Hooks.beforeCreate(async function mergeWithBlankDocument(args) {
-    const blank = createBlankDocument(args.config, args.event);
-    const known = Object.keys(blank);
-    const data = args.data;
-    /**
-     * The blank is built from the config's fields, so only the keys it has are keys there is
-     * anything to merge *with*. Everything else is carried across rather than through.
-     *
-     * That is what keeps a `File` a `File`. `deepmerge` clones every plain object it walks, so an
-     * upload payload passed through it would come out with none of a `File`'s methods — and `file`
-     * is not a field on any config, so the blank has no key for it and nothing to merge it into.
-     */
-    return {
-        ...args,
-        data: {
-            ...deepmerge(blank, pick(known, data), { arrayMerge: (_, incoming) => incoming }),
-            ...omit(known, data)
-        }
-    };
+    const blank = args.config.blank(args.event);
+    return { ...args, data: withDefaults(args.data, blank) };
 });

package/dist/core/prototype/collection/hooks.server.js

@@ -62,9 +62,8 @@ export const collectionHooks = {
         when(isNested, nested.addChildrenProperty),
         when(isVersioned, versions.exposeVersionId),
         title.setDocumentTitle,
-        // After the title: `config.$url(document)` is the author's own function, and a slug built
-        // from the title is the ordinary case.
-        when(hasUrl, url.populateURL),
+        // The live edit link, from the url the read joined.
+        when(hasUrl, url.setLiveUrl),
         // After the sizes: it takes the thumbnail `upload.populateSizes` derived when there is one.
         thumbnail.setDocumentThumbnail,
         metas.deletePanelLockMetas
@@ -89,7 +88,12 @@ export const collectionHooks = {
         when(isUpload, upload.castBase64ToFile),
         when(isUpload, upload.processFileUpload)
     ],
-    afterCreate: [when(isAuth, auth.populateAPIKey), when(isAuth, auth.signInNewUser)],
+    afterCreate: [
+        when(isAuth, auth.populateAPIKey),
+        when(isAuth, auth.signInNewUser),
+        when(hasUrl, url.createPaths)
+    ],
+    afterUpdate: [when(hasUrl, url.syncPaths)],
     beforeUpdate: [
         versions.stripAutoSaveFlag,
         getOriginalDocument,
@@ -127,7 +131,9 @@ export const collectionHooks = {
         when(isAuth, auth.preventSupperAdminDeletion),
         // After the refusal above: a user who cannot be deleted keeps their auto-saves.
         when(isStaffCollection, versions.discardAutoSavesOf),
-        when(isUpload, upload.cleanUpFiles)
+        when(isUpload, upload.cleanUpFiles),
+        // Its children go to the top with their addresses, before its own go by cascade.
+        when(hasUrl, url.detachPaths)
     ],
     afterDelete: [when(isAuth, auth.deleteBetterAuthUser)]
 };

package/dist/core/prototype/collection/nested/module.server.js

@@ -15,7 +15,9 @@ export const augmentNested = (config) => ({
         text('_parent')
             .$references(config.slug, { onDelete: 'set null', selfReferencing: true })
             .hidden()
-            .$root(),
+            .$root()
+            // A read lists a document's children by it
+            .$index(),
         number('_position').defaultValue(0).hidden().$root()
     ]
 });

package/dist/core/prototype/collection/nested/tree.d.ts

@@ -0,0 +1,12 @@
+import type { GenericDoc } from '../../types.js';
+/**
+ * The flat rows of a nested collection as a tree, each document holding its own children.
+ *
+ * Roots are the documents with no `_parent`, ordered by `_position`; a document already placed is
+ * never placed twice, so a cycle in the rows stops rather than recurses.
+ *
+ * ```ts
+ * toNestedStructure(pages); // [{ id: '1', _children: [{ id: '2', _children: [] }] }]
+ * ```
+ */
+export declare const toNestedStructure: (documents: GenericDoc[]) => GenericDoc[];

package/dist/core/prototype/collection/nested/tree.js

@@ -0,0 +1,42 @@
+import { snapshot } from '../../../../util/state.js';
+/**
+ * The flat rows of a nested collection as a tree, each document holding its own children.
+ *
+ * Roots are the documents with no `_parent`, ordered by `_position`; a document already placed is
+ * never placed twice, so a cycle in the rows stops rather than recurses.
+ *
+ * ```ts
+ * toNestedStructure(pages); // [{ id: '1', _children: [{ id: '2', _children: [] }] }]
+ * ```
+ */
+export const toNestedStructure = (documents) => {
+    const incomingDocs = snapshot(documents);
+    const docById = new Map();
+    incomingDocs.forEach((doc) => docById.set(doc.id, doc));
+    const processed = new Set();
+    const processDocument = (doc) => {
+        if (!doc || processed.has(doc.id)) {
+            return doc;
+        }
+        processed.add(doc.id);
+        const result = { ...doc };
+        // Children first, depth-first.
+        if (Array.isArray(result._children)) {
+            result._children = result._children
+                .map((id) => {
+                const childDoc = docById.get(id);
+                return childDoc ? processDocument(childDoc) : null;
+            })
+                .filter(Boolean);
+        }
+        // The parent stays an id — only children are expanded.
+        if (result._parent && typeof result._parent === 'string') {
+            result._parent = docById.get(result._parent)?.id || null;
+        }
+        return result;
+    };
+    return incomingDocs
+        .filter((doc) => !doc._parent)
+        .map(processDocument)
+        .sort((a, b) => (a._position || 0) - (b._position || 0));
+};

package/dist/core/prototype/collection/operations/find-by-id.js

@@ -1,3 +1,4 @@
+import { readableReferences } from '../../../fields/util.js';
 import { RimeError } from '../../../errors/index.js';
 import { readDocument, runBeforeOperation } from '../../../pipeline/run.server.js';
 export const findById = async (args) => {
@@ -26,6 +27,7 @@ export const findById = async (args) => {
         locale,
         localeFallback,
         select,
+        resolve: isSystemOperation ? undefined : readableReferences(config.fields, event.locals.user),
         // `draft` and `versionId` are request parameters; which row they name is the feature's answer.
         content: ctx.versionQuery({ latest, versionId })
     });