@nocobase/plugin-flow-engine 2.2.0-alpha.6 → 2.2.0-alpha.8

package/dist/server/flow-surfaces/constants.d.ts

@@ -52,6 +52,13 @@ export declare const FLOW_SURFACE_ACTION_DEFINITIONS: {
         readonly mutate: false;
         readonly valueSource: "default";
     };
+    readonly listNavigationTargets: {
+        readonly method: "post";
+        readonly read: true;
+        readonly transaction: false;
+        readonly mutate: false;
+        readonly valueSource: "default";
+    };
     readonly getReactionMeta: {
         readonly method: "post";
         readonly read: true;
@@ -380,7 +387,7 @@ type SelectFlowSurfaceActionNames<TFlag extends keyof FlowSurfaceActionDefinitio
     [K in FlowSurfacesActionName]: (typeof FLOW_SURFACE_ACTION_DEFINITIONS)[K][TFlag] extends true ? K : never;
 }[FlowSurfacesActionName];
 type FlowSurfaceMutateActionName = SelectFlowSurfaceActionNames<'mutate'>;
-export declare const FLOW_SURFACES_ACTION_NAMES: ("setFieldValueRules" | "setBlockLinkageRules" | "setFieldLinkageRules" | "setActionLinkageRules" | "context" | "get" | "configure" | "apply" | "createPage" | "addTab" | "addPopupTab" | "addBlock" | "addField" | "addAction" | "addRecordAction" | "compose" | "createMenu" | "catalog" | "describeSurface" | "exportBlueprint" | "getReactionMeta" | "applyBlueprint" | "applyApprovalBlueprint" | "listTemplates" | "getTemplate" | "saveTemplate" | "updateTemplate" | "destroyTemplate" | "convertTemplateToCopy" | "updateMenu" | "destroyPage" | "updateTab" | "moveTab" | "removeTab" | "updatePopupTab" | "movePopupTab" | "removePopupTab" | "addBlocks" | "addFields" | "addActions" | "addRecordActions" | "updateSettings" | "getEventFlowMeta" | "addEventFlow" | "setEventFlow" | "removeEventFlow" | "setEventFlows" | "setLayout" | "moveNode" | "removeNode" | "mutate")[];
+export declare const FLOW_SURFACES_ACTION_NAMES: ("setFieldValueRules" | "setBlockLinkageRules" | "setFieldLinkageRules" | "setActionLinkageRules" | "context" | "get" | "configure" | "apply" | "createPage" | "addTab" | "addPopupTab" | "addBlock" | "addField" | "addAction" | "addRecordAction" | "compose" | "createMenu" | "catalog" | "describeSurface" | "exportBlueprint" | "listNavigationTargets" | "getReactionMeta" | "applyBlueprint" | "applyApprovalBlueprint" | "listTemplates" | "getTemplate" | "saveTemplate" | "updateTemplate" | "destroyTemplate" | "convertTemplateToCopy" | "updateMenu" | "destroyPage" | "updateTab" | "moveTab" | "removeTab" | "updatePopupTab" | "movePopupTab" | "removePopupTab" | "addBlocks" | "addFields" | "addActions" | "addRecordActions" | "updateSettings" | "getEventFlowMeta" | "addEventFlow" | "setEventFlow" | "removeEventFlow" | "setEventFlows" | "setLayout" | "moveNode" | "removeNode" | "mutate")[];
 export declare const FLOW_SURFACES_READ_ACTION_NAMES: SelectFlowSurfaceActionNames<"read">[];
 export declare const FLOW_SURFACE_MUTATE_OP_TYPES: FlowSurfaceMutateActionName[];
-export declare const FLOW_SURFACES_ACTION_METHODS: Record<"setFieldValueRules" | "setBlockLinkageRules" | "setFieldLinkageRules" | "setActionLinkageRules" | "context" | "get" | "configure" | "apply" | "createPage" | "addTab" | "addPopupTab" | "addBlock" | "addField" | "addAction" | "addRecordAction" | "compose" | "createMenu" | "catalog" | "describeSurface" | "exportBlueprint" | "getReactionMeta" | "applyBlueprint" | "applyApprovalBlueprint" | "listTemplates" | "getTemplate" | "saveTemplate" | "updateTemplate" | "destroyTemplate" | "convertTemplateToCopy" | "updateMenu" | "destroyPage" | "updateTab" | "moveTab" | "removeTab" | "updatePopupTab" | "movePopupTab" | "removePopupTab" | "addBlocks" | "addFields" | "addActions" | "addRecordActions" | "updateSettings" | "getEventFlowMeta" | "addEventFlow" | "setEventFlow" | "removeEventFlow" | "setEventFlows" | "setLayout" | "moveNode" | "removeNode" | "mutate", FlowSurfaceActionMethod>;
+export declare const FLOW_SURFACES_ACTION_METHODS: Record<"setFieldValueRules" | "setBlockLinkageRules" | "setFieldLinkageRules" | "setActionLinkageRules" | "context" | "get" | "configure" | "apply" | "createPage" | "addTab" | "addPopupTab" | "addBlock" | "addField" | "addAction" | "addRecordAction" | "compose" | "createMenu" | "catalog" | "describeSurface" | "exportBlueprint" | "listNavigationTargets" | "getReactionMeta" | "applyBlueprint" | "applyApprovalBlueprint" | "listTemplates" | "getTemplate" | "saveTemplate" | "updateTemplate" | "destroyTemplate" | "convertTemplateToCopy" | "updateMenu" | "destroyPage" | "updateTab" | "moveTab" | "removeTab" | "updatePopupTab" | "movePopupTab" | "removePopupTab" | "addBlocks" | "addFields" | "addActions" | "addRecordActions" | "updateSettings" | "getEventFlowMeta" | "addEventFlow" | "setEventFlow" | "removeEventFlow" | "setEventFlows" | "setLayout" | "moveNode" | "removeNode" | "mutate", FlowSurfaceActionMethod>;

package/dist/server/flow-surfaces/constants.js

@@ -41,6 +41,7 @@ const FLOW_SURFACE_ACTION_DEFINITIONS = {
   get: { method: "get", read: true, transaction: false, mutate: false, valueSource: "read" },
   describeSurface: { method: "post", read: true, transaction: false, mutate: false, valueSource: "default" },
   exportBlueprint: { method: "post", read: true, transaction: false, mutate: false, valueSource: "default" },
+  listNavigationTargets: { method: "post", read: true, transaction: false, mutate: false, valueSource: "default" },
   getReactionMeta: { method: "post", read: true, transaction: false, mutate: false, valueSource: "default" },
   setFieldValueRules: { method: "post", read: false, transaction: true, mutate: false, valueSource: "default" },
   setBlockLinkageRules: { method: "post", read: false, transaction: true, mutate: false, valueSource: "default" },

package/dist/server/flow-surfaces/contract-guard.js

@@ -393,27 +393,35 @@ function normalizeLinkageRulesValue(value, context, path) {
     return value;
   }
   return value.map((rule, index) => {
-    if (!import_lodash.default.isPlainObject(rule) || !import_lodash.default.has(rule, "condition")) {
-      return rule;
+    if (!import_lodash.default.isPlainObject(rule)) {
+      (0, import_errors.throwBadRequest)(
+        `flowSurfaces updateSettings domain '${getLinkageRuleDomainPath(context, path, index)}' on '${context.use}' expects each linkage rule to be an object`
+      );
     }
     const normalizedRule = import_lodash.default.cloneDeep(rule);
-    const conditionPath = getLinkageRuleDomainPath(context, path, index, "condition");
+    const hasCondition = import_lodash.default.has(normalizedRule, "condition");
+    const hasWhen = import_lodash.default.has(normalizedRule, "when");
+    const conditionLeaf = hasCondition ? "condition" : hasWhen ? "when" : "condition";
+    const conditionInput = hasCondition ? import_lodash.default.get(normalizedRule, "condition") : hasWhen ? import_lodash.default.get(normalizedRule, "when") : import_filter_group.FLOW_SURFACE_EMPTY_FILTER_GROUP;
     import_lodash.default.set(
       normalizedRule,
       "condition",
       (0, import_filter_group.normalizeFlowSurfaceCompatibleFilterGroupValue)(
-        import_lodash.default.get(normalizedRule, "condition"),
-        `flowSurfaces updateSettings domain '${conditionPath}' on '${context.use}' expects FilterGroup or backend query filter like ${import_filter_group.FLOW_SURFACE_FILTER_GROUP_EXAMPLE}`,
+        conditionInput,
+        `flowSurfaces updateSettings domain '${getLinkageRuleDomainPath(context, path, index, conditionLeaf)}' on '${context.use}' expects FilterGroup or backend query filter like ${import_filter_group.FLOW_SURFACE_FILTER_GROUP_EXAMPLE}`,
         { strictDateValues: true }
       )
     );
-    if (!import_lodash.default.has(normalizedRule, "actions")) {
-      import_lodash.default.set(normalizedRule, "actions", []);
-    } else if (!Array.isArray(import_lodash.default.get(normalizedRule, "actions"))) {
+    const hasActions = import_lodash.default.has(normalizedRule, "actions");
+    const hasThen = import_lodash.default.has(normalizedRule, "then");
+    const actionsLeaf = hasActions ? "actions" : hasThen ? "then" : "actions";
+    const actionsInput = hasActions ? import_lodash.default.get(normalizedRule, "actions") : hasThen ? import_lodash.default.get(normalizedRule, "then") : [];
+    if (!Array.isArray(actionsInput)) {
       (0, import_errors.throwBadRequest)(
-        `flowSurfaces updateSettings domain '${getLinkageRuleDomainPath(context, path, index, "actions")}' on '${context.use}' expects actions to be an array`
+        `flowSurfaces updateSettings domain '${getLinkageRuleDomainPath(context, path, index, actionsLeaf)}' on '${context.use}' expects actions/then to be an array`
       );
     }
+    import_lodash.default.set(normalizedRule, "actions", actionsInput);
     if (!import_lodash.default.has(normalizedRule, "key")) {
       import_lodash.default.set(normalizedRule, "key", `linkage-rule-${index + 1}`);
     }
@@ -425,12 +433,14 @@ function normalizeLinkageRulesValue(value, context, path) {
       import_lodash.default.set(normalizedRule, "enable", typeof enabled === "boolean" ? enabled : true);
     }
     import_lodash.default.unset(normalizedRule, "enabled");
+    import_lodash.default.unset(normalizedRule, "when");
+    import_lodash.default.unset(normalizedRule, "then");
     return normalizedRule;
   });
 }
 function getLinkageRuleDomainPath(context, path, index, leaf) {
   const basePath = context.groupKey ? `${context.domain}.${context.groupKey}.${path}[${index}]` : `${context.domain}.${path}[${index}]`;
-  return `${basePath}.${leaf}`;
+  return leaf ? `${basePath}.${leaf}` : basePath;
 }
 function isContractDefinedFlowGroup(groupContract) {
   if (!groupContract) {

package/dist/server/flow-surfaces/errors.d.ts

@@ -37,7 +37,7 @@ export declare class FlowSurfaceBadRequestError extends FlowSurfaceError {
     constructor(message: string, code?: string, options?: FlowSurfaceErrorOptions);
 }
 export declare class FlowSurfaceForbiddenError extends FlowSurfaceError {
-    constructor(message: string, code?: string);
+    constructor(message: string, code?: string, options?: FlowSurfaceErrorOptions);
 }
 export declare class FlowSurfaceConflictError extends FlowSurfaceError {
     constructor(message: string, code?: string);
@@ -76,6 +76,6 @@ export declare function toFlowSurfaceErrorItem(error: FlowSurfaceError): FlowSur
 export declare function normalizeFlowSurfaceError(error: unknown): FlowSurfaceError;
 export declare function throwBadRequest(message: string, codeOrOptions?: string | FlowSurfaceErrorOptions, options?: FlowSurfaceErrorOptions): never;
 export declare function throwAggregateBadRequest(errors: FlowSurfaceErrorItemInput[]): never;
-export declare function throwForbidden(message: string, code?: string): never;
+export declare function throwForbidden(message: string, code?: string, options?: FlowSurfaceErrorOptions): never;
 export declare function throwConflict(message: string, code?: string): never;
 export declare function throwInternalError(message: string, code?: string): never;

package/dist/server/flow-surfaces/errors.js

@@ -69,8 +69,8 @@ class FlowSurfaceBadRequestError extends FlowSurfaceError {
   }
 }
 class FlowSurfaceForbiddenError extends FlowSurfaceError {
-  constructor(message, code = "FLOW_SURFACE_FORBIDDEN") {
-    super(message, 403, "forbidden", code);
+  constructor(message, code = "FLOW_SURFACE_FORBIDDEN", options = {}) {
+    super(message, 403, "forbidden", code, options);
     this.name = "FlowSurfaceForbiddenError";
   }
 }
@@ -159,8 +159,8 @@ function throwBadRequest(message, codeOrOptions, options = {}) {
 function throwAggregateBadRequest(errors) {
   throw new FlowSurfaceAggregateError(errors);
 }
-function throwForbidden(message, code) {
-  throw new FlowSurfaceForbiddenError(message, code);
+function throwForbidden(message, code, options = {}) {
+  throw new FlowSurfaceForbiddenError(message, code, options);
 }
 function throwConflict(message, code) {
   throw new FlowSurfaceConflictError(message, code);

package/dist/server/flow-surfaces/navigation-targets.d.ts

@@ -0,0 +1,73 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import type { Database, Transaction } from '@nocobase/database';
+export declare const DEFAULT_ADMIN_UI_LAYOUT_UID = "admin-layout-model";
+export declare const DEFAULT_MOBILE_UI_LAYOUT_UID = "mobile-layout-model";
+export declare const DEFAULT_ADMIN_MULTI_PORTAL_UID = "__default_admin__";
+export declare const DEFAULT_MOBILE_MULTI_PORTAL_UID = "__default_mobile__";
+export type FlowSurfaceNavigationRequestRoles = readonly string[] | string;
+export type FlowSurfaceResolvedMultiPortal = {
+    uid: string;
+    title: string;
+    icon?: string | null;
+    routeName?: string;
+    routePath?: string;
+    authCheck?: boolean;
+    enabled: true;
+    layoutUid: string;
+    layoutType?: string;
+};
+export type FlowSurfaceNavigationTarget = {
+    kind: 'layout' | 'portal';
+    uid: string;
+    title: string;
+    icon?: string | null;
+    layoutUid: string;
+    layoutType?: string;
+    routeName?: string;
+    routePath?: string;
+    authCheck?: boolean;
+    default?: boolean;
+    portalUid?: string;
+};
+export type FlowSurfaceNavigationTargetsResult = {
+    version: '1';
+    capabilities: {
+        multiPortal: boolean;
+    };
+    targets: FlowSurfaceNavigationTarget[];
+};
+type PortalResolveOptions = {
+    actionName: string;
+    path: string;
+    currentRoles?: FlowSurfaceNavigationRequestRoles;
+    transaction?: Transaction;
+};
+export declare class FlowSurfaceNavigationTargetsService {
+    private readonly db;
+    constructor(db: Database);
+    hasMultiPortalCapability(): boolean;
+    hasUiLayoutCapability(): boolean;
+    normalizePortalUid(value: unknown): string;
+    listNavigationTargets(currentRoles?: FlowSurfaceNavigationRequestRoles, transaction?: Transaction): Promise<FlowSurfaceNavigationTargetsResult>;
+    resolvePortal(portalUidValue: unknown, options: PortalResolveOptions): Promise<FlowSurfaceResolvedMultiPortal>;
+    readRoutePortalUids(routeId: unknown, transaction?: Transaction): Promise<string[]>;
+    assertRouteBelongsToPortal(actionName: string, routeId: unknown, portalUid: string, path: string, transaction?: Transaction): Promise<void>;
+    attachRouteTreeToPortals(routeId: unknown, portalUids: string[], options: {
+        portalOnly: boolean;
+        transaction?: Transaction;
+    }): Promise<void>;
+    private listLayoutTargets;
+    private listAccessiblePortalTargets;
+    private canAccessPortal;
+    private collectRouteTreeIds;
+    private removeDefaultLayoutRoutePermissions;
+    private grantDefaultPortalRouteAccess;
+}
+export {};

package/dist/server/flow-surfaces/navigation-targets.js

@@ -0,0 +1,439 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var navigation_targets_exports = {};
+__export(navigation_targets_exports, {
+  DEFAULT_ADMIN_MULTI_PORTAL_UID: () => DEFAULT_ADMIN_MULTI_PORTAL_UID,
+  DEFAULT_ADMIN_UI_LAYOUT_UID: () => DEFAULT_ADMIN_UI_LAYOUT_UID,
+  DEFAULT_MOBILE_MULTI_PORTAL_UID: () => DEFAULT_MOBILE_MULTI_PORTAL_UID,
+  DEFAULT_MOBILE_UI_LAYOUT_UID: () => DEFAULT_MOBILE_UI_LAYOUT_UID,
+  FlowSurfaceNavigationTargetsService: () => FlowSurfaceNavigationTargetsService
+});
+module.exports = __toCommonJS(navigation_targets_exports);
+var import_errors = require("./errors");
+const DEFAULT_ADMIN_UI_LAYOUT_UID = "admin-layout-model";
+const DEFAULT_MOBILE_UI_LAYOUT_UID = "mobile-layout-model";
+const DEFAULT_ADMIN_MULTI_PORTAL_UID = "__default_admin__";
+const DEFAULT_MOBILE_MULTI_PORTAL_UID = "__default_mobile__";
+const RESERVED_MULTI_PORTAL_UIDS = /* @__PURE__ */ new Set([DEFAULT_ADMIN_MULTI_PORTAL_UID, DEFAULT_MOBILE_MULTI_PORTAL_UID]);
+function readRecordField(record, field) {
+  if (!record || typeof record !== "object") {
+    return void 0;
+  }
+  const model = record;
+  if (typeof model.get === "function") {
+    return model.get(field);
+  }
+  return record[field];
+}
+function readStringField(record, field) {
+  const value = readRecordField(record, field);
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function normalizeRoles(currentRoles) {
+  const roles = Array.isArray(currentRoles) ? currentRoles : typeof currentRoles === "string" ? [currentRoles] : [];
+  return roles.map((role) => String(role || "").trim()).filter(Boolean);
+}
+function normalizeRelationRouteId(routeId) {
+  return routeId === null || typeof routeId === "undefined" ? void 0 : routeId;
+}
+class FlowSurfaceNavigationTargetsService {
+  constructor(db) {
+    this.db = db;
+  }
+  hasMultiPortalCapability() {
+    var _a, _b;
+    try {
+      return !!this.db.getCollection("multiPortals") && !!((_b = (_a = this.db.getCollection("desktopRoutes")) == null ? void 0 : _a.getField) == null ? void 0 : _b.call(_a, "multiPortals"));
+    } catch (error) {
+      return false;
+    }
+  }
+  hasUiLayoutCapability() {
+    var _a, _b;
+    try {
+      return !!this.db.getCollection("uiLayouts") && !!((_b = (_a = this.db.getCollection("desktopRoutes")) == null ? void 0 : _a.getField) == null ? void 0 : _b.call(_a, "uiLayouts"));
+    } catch (error) {
+      return false;
+    }
+  }
+  normalizePortalUid(value) {
+    const portalUid = String(value || "").trim();
+    return portalUid || void 0;
+  }
+  async listNavigationTargets(currentRoles, transaction) {
+    const layoutTargets = await this.listLayoutTargets(transaction);
+    const multiPortal = this.hasMultiPortalCapability();
+    const portalTargets = multiPortal ? await this.listAccessiblePortalTargets(currentRoles, transaction) : [];
+    return {
+      version: "1",
+      capabilities: {
+        multiPortal
+      },
+      targets: [...layoutTargets, ...portalTargets]
+    };
+  }
+  async resolvePortal(portalUidValue, options) {
+    const portalUid = this.normalizePortalUid(portalUidValue);
+    if (!portalUid) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} ${options.path} must be a non-empty string`, {
+        ruleId: "navigation-portal-invalid",
+        path: options.path
+      });
+    }
+    if (!this.hasMultiPortalCapability()) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} ${options.path} requires the Multi-portal capability`, {
+        ruleId: "navigation-portal-unsupported",
+        path: options.path,
+        details: { portalUid }
+      });
+    }
+    if (RESERVED_MULTI_PORTAL_UIDS.has(portalUid)) {
+      (0, import_errors.throwBadRequest)(
+        `flowSurfaces ${options.actionName} ${options.path} cannot use reserved default portal uid '${portalUid}'; use layoutUid semantics instead`,
+        {
+          ruleId: "navigation-portal-reserved",
+          path: options.path,
+          details: { portalUid }
+        }
+      );
+    }
+    const portal = await this.db.getRepository("multiPortals").findOne({
+      filter: { uid: portalUid },
+      fields: ["uid", "title", "icon", "routeName", "routePath", "authCheck", "enabled", "uiLayoutUid"],
+      transaction: options.transaction
+    });
+    if (!portal) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} ${options.path} references missing portal '${portalUid}'`, {
+        ruleId: "navigation-portal-not-found",
+        path: options.path,
+        details: { portalUid }
+      });
+    }
+    if (readRecordField(portal, "enabled") !== true) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} portal '${portalUid}' is disabled`, {
+        ruleId: "navigation-portal-disabled",
+        path: options.path,
+        details: { portalUid }
+      });
+    }
+    const layoutUid = readStringField(portal, "uiLayoutUid");
+    if (!layoutUid || !this.db.getCollection("uiLayouts")) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} portal '${portalUid}' has no available backing UI layout`, {
+        ruleId: "navigation-portal-layout-not-found",
+        path: options.path,
+        details: { portalUid, layoutUid: layoutUid || null }
+      });
+    }
+    const layout = await this.db.getRepository("uiLayouts").findOne({
+      filter: { uid: layoutUid },
+      fields: ["uid", "layoutType", "enabled"],
+      transaction: options.transaction
+    });
+    if (!layout) {
+      (0, import_errors.throwBadRequest)(
+        `flowSurfaces ${options.actionName} portal '${portalUid}' backing UI layout '${layoutUid}' does not exist`,
+        {
+          ruleId: "navigation-portal-layout-not-found",
+          path: options.path,
+          details: { portalUid, layoutUid }
+        }
+      );
+    }
+    if (readRecordField(layout, "enabled") !== true) {
+      (0, import_errors.throwBadRequest)(
+        `flowSurfaces ${options.actionName} portal '${portalUid}' backing UI layout '${layoutUid}' is disabled`,
+        {
+          ruleId: "navigation-portal-layout-disabled",
+          path: options.path,
+          details: { portalUid, layoutUid }
+        }
+      );
+    }
+    if (!await this.canAccessPortal(portalUid, options.currentRoles, options.transaction)) {
+      (0, import_errors.throwForbidden)(
+        `flowSurfaces ${options.actionName} current roles cannot access portal '${portalUid}'`,
+        "FLOW_SURFACE_NAVIGATION_PORTAL_FORBIDDEN",
+        {
+          ruleId: "navigation-portal-forbidden",
+          path: options.path,
+          details: { portalUid }
+        }
+      );
+    }
+    return {
+      uid: portalUid,
+      title: readStringField(portal, "title") || portalUid,
+      icon: readStringField(portal, "icon") || null,
+      routeName: readStringField(portal, "routeName"),
+      routePath: readStringField(portal, "routePath"),
+      authCheck: readRecordField(portal, "authCheck") === true,
+      enabled: true,
+      layoutUid,
+      layoutType: readStringField(layout, "layoutType")
+    };
+  }
+  async readRoutePortalUids(routeId, transaction) {
+    const relationRouteId = normalizeRelationRouteId(routeId);
+    if (typeof relationRouteId === "undefined" || !this.hasMultiPortalCapability()) {
+      return [];
+    }
+    const portals = await this.db.getRepository("desktopRoutes.multiPortals", relationRouteId).find({ fields: ["uid"], transaction });
+    return Array.from(
+      new Set(
+        portals.map((portal) => readStringField(portal, "uid")).filter((portalUid) => !!portalUid)
+      )
+    );
+  }
+  async assertRouteBelongsToPortal(actionName, routeId, portalUid, path, transaction) {
+    const routePortalUids = await this.readRoutePortalUids(routeId, transaction);
+    if (routePortalUids.includes(portalUid)) {
+      return;
+    }
+    (0, import_errors.throwBadRequest)(`flowSurfaces ${actionName} ${path} does not belong to portal '${portalUid}'`, {
+      ruleId: "navigation-route-portal-mismatch",
+      path,
+      details: {
+        routeId,
+        portalUid,
+        routePortalUids
+      }
+    });
+  }
+  async attachRouteTreeToPortals(routeId, portalUids, options) {
+    const normalizedPortalUids = Array.from(new Set(portalUids.map((uid) => String(uid || "").trim()).filter(Boolean)));
+    const relationRouteId = normalizeRelationRouteId(routeId);
+    if (typeof relationRouteId === "undefined" || !normalizedPortalUids.length || !this.hasMultiPortalCapability()) {
+      return;
+    }
+    const routeIds = await this.collectRouteTreeIds(relationRouteId, options.transaction);
+    for (const currentRouteId of routeIds) {
+      await this.db.getRepository("desktopRoutes.multiPortals", currentRouteId).set({ tk: normalizedPortalUids, transaction: options.transaction });
+      if (options.portalOnly && this.hasUiLayoutCapability()) {
+        await this.db.getRepository("desktopRoutes.uiLayouts", currentRouteId).set({ tk: [], transaction: options.transaction });
+      }
+    }
+    if (options.portalOnly) {
+      await this.removeDefaultLayoutRoutePermissions(routeIds, options.transaction);
+    }
+    for (const portalUid of normalizedPortalUids) {
+      await this.grantDefaultPortalRouteAccess(portalUid, routeIds, options.transaction);
+    }
+  }
+  async listLayoutTargets(transaction) {
+    const targets = [];
+    if (this.db.getCollection("uiLayouts")) {
+      const layouts = await this.db.getRepository("uiLayouts").find({
+        filter: { enabled: true },
+        fields: ["uid", "title", "layoutType", "routeName", "routePath", "authCheck"],
+        sort: ["uid"],
+        transaction
+      });
+      for (const layout of layouts) {
+        const layoutUid = readStringField(layout, "uid");
+        if (!layoutUid) {
+          continue;
+        }
+        targets.push({
+          kind: "layout",
+          uid: layoutUid,
+          title: readStringField(layout, "title") || layoutUid,
+          layoutUid,
+          layoutType: readStringField(layout, "layoutType"),
+          routeName: readStringField(layout, "routeName"),
+          routePath: readStringField(layout, "routePath"),
+          authCheck: readRecordField(layout, "authCheck") === true,
+          ...layoutUid === DEFAULT_ADMIN_UI_LAYOUT_UID ? { default: true } : {}
+        });
+      }
+    }
+    if (!targets.some((target) => target.uid === DEFAULT_ADMIN_UI_LAYOUT_UID)) {
+      targets.unshift({
+        kind: "layout",
+        uid: DEFAULT_ADMIN_UI_LAYOUT_UID,
+        title: "Admin",
+        layoutUid: DEFAULT_ADMIN_UI_LAYOUT_UID,
+        layoutType: "desktop",
+        routeName: "admin",
+        routePath: "/admin",
+        authCheck: true,
+        default: true
+      });
+    }
+    return targets.sort((left, right) => {
+      if (left.default) {
+        return -1;
+      }
+      if (right.default) {
+        return 1;
+      }
+      return left.uid.localeCompare(right.uid);
+    });
+  }
+  async listAccessiblePortalTargets(currentRoles, transaction) {
+    const roles = normalizeRoles(currentRoles);
+    let accessiblePortalUids;
+    if (!roles.includes("root")) {
+      if (!roles.length || !this.db.getCollection("rolesMultiPortals")) {
+        return [];
+      }
+      const grants = await this.db.getRepository("rolesMultiPortals").find({
+        fields: ["multiPortalUid"],
+        filter: { roleName: roles },
+        transaction
+      });
+      accessiblePortalUids = Array.from(
+        new Set(
+          grants.map((grant) => readStringField(grant, "multiPortalUid")).filter((portalUid) => !!portalUid)
+        )
+      );
+      if (!accessiblePortalUids.length) {
+        return [];
+      }
+    }
+    const accessiblePortalUidSet = accessiblePortalUids ? new Set(accessiblePortalUids) : void 0;
+    const filter = {
+      enabled: true,
+      "uid.$notIn": Array.from(RESERVED_MULTI_PORTAL_UIDS)
+    };
+    const portals = await this.db.getRepository("multiPortals").find({
+      filter,
+      fields: ["uid", "title", "icon", "routeName", "routePath", "authCheck", "enabled", "uiLayoutUid"],
+      sort: ["uid"],
+      transaction
+    });
+    const targets = [];
+    for (const portal of portals) {
+      const portalUid = readStringField(portal, "uid");
+      const layoutUid = readStringField(portal, "uiLayoutUid");
+      if (!portalUid || accessiblePortalUidSet && !accessiblePortalUidSet.has(portalUid) || !layoutUid || !this.db.getCollection("uiLayouts")) {
+        continue;
+      }
+      const layout = await this.db.getRepository("uiLayouts").findOne({
+        filter: { uid: layoutUid, enabled: true },
+        fields: ["layoutType"],
+        transaction
+      });
+      if (!layout) {
+        continue;
+      }
+      targets.push({
+        kind: "portal",
+        uid: portalUid,
+        portalUid,
+        title: readStringField(portal, "title") || portalUid,
+        icon: readStringField(portal, "icon") || null,
+        layoutUid,
+        layoutType: readStringField(layout, "layoutType"),
+        routeName: readStringField(portal, "routeName"),
+        routePath: readStringField(portal, "routePath"),
+        authCheck: readRecordField(portal, "authCheck") === true
+      });
+    }
+    return targets;
+  }
+  async canAccessPortal(portalUid, currentRoles, transaction) {
+    const roles = normalizeRoles(currentRoles);
+    if (roles.includes("root")) {
+      return true;
+    }
+    if (!roles.length || !this.db.getCollection("rolesMultiPortals")) {
+      return false;
+    }
+    const count = await this.db.getRepository("rolesMultiPortals").count({
+      filter: {
+        roleName: roles,
+        multiPortalUid: portalUid
+      },
+      transaction
+    });
+    return count > 0;
+  }
+  async collectRouteTreeIds(routeId, transaction) {
+    const routeIds = [routeId];
+    const children = await this.db.getRepository("desktopRoutes").find({
+      fields: ["id"],
+      filter: { parentId: routeId },
+      transaction
+    });
+    for (const child of children) {
+      const childId = normalizeRelationRouteId(readRecordField(child, "id"));
+      if (typeof childId !== "undefined") {
+        routeIds.push(...await this.collectRouteTreeIds(childId, transaction));
+      }
+    }
+    return routeIds;
+  }
+  async removeDefaultLayoutRoutePermissions(routeIds, transaction) {
+    if (!routeIds.length || !this.db.getCollection("rolesDesktopRoutes")) {
+      return;
+    }
+    await this.db.getRepository("rolesDesktopRoutes").destroy({
+      filter: { desktopRouteId: routeIds },
+      transaction
+    });
+  }
+  async grantDefaultPortalRouteAccess(portalUid, routeIds, transaction) {
+    if (!routeIds.length || !this.db.getCollection("rolesMultiPortalRoutePolicies") || !this.db.getCollection("rolesMultiPortalDesktopRoutes")) {
+      return;
+    }
+    const policies = await this.db.getRepository("rolesMultiPortalRoutePolicies").find({
+      fields: ["roleName"],
+      filter: {
+        multiPortalUid: portalUid,
+        allowNewMenu: true
+      },
+      transaction
+    });
+    const roleNames = Array.from(
+      new Set(
+        policies.map((policy) => readStringField(policy, "roleName")).filter((roleName) => !!roleName)
+      )
+    );
+    const repository = this.db.getRepository("rolesMultiPortalDesktopRoutes");
+    for (const roleName of roleNames) {
+      for (const desktopRouteId of routeIds) {
+        await repository.firstOrCreate({
+          filterKeys: ["roleName", "multiPortalUid", "desktopRouteId"],
+          values: {
+            roleName,
+            multiPortalUid: portalUid,
+            desktopRouteId
+          },
+          transaction
+        });
+      }
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_ADMIN_MULTI_PORTAL_UID,
+  DEFAULT_ADMIN_UI_LAYOUT_UID,
+  DEFAULT_MOBILE_MULTI_PORTAL_UID,
+  DEFAULT_MOBILE_UI_LAYOUT_UID,
+  FlowSurfaceNavigationTargetsService
+});