@nocobase/plugin-flow-engine 2.2.0-beta.9 → 3.0.0-alpha.1

package/dist/server/flow-surfaces/errors.d.ts

@@ -37,7 +37,7 @@ export declare class FlowSurfaceBadRequestError extends FlowSurfaceError {
     constructor(message: string, code?: string, options?: FlowSurfaceErrorOptions);
 }
 export declare class FlowSurfaceForbiddenError extends FlowSurfaceError {
-    constructor(message: string, code?: string);
+    constructor(message: string, code?: string, options?: FlowSurfaceErrorOptions);
 }
 export declare class FlowSurfaceConflictError extends FlowSurfaceError {
     constructor(message: string, code?: string);
@@ -76,6 +76,6 @@ export declare function toFlowSurfaceErrorItem(error: FlowSurfaceError): FlowSur
 export declare function normalizeFlowSurfaceError(error: unknown): FlowSurfaceError;
 export declare function throwBadRequest(message: string, codeOrOptions?: string | FlowSurfaceErrorOptions, options?: FlowSurfaceErrorOptions): never;
 export declare function throwAggregateBadRequest(errors: FlowSurfaceErrorItemInput[]): never;
-export declare function throwForbidden(message: string, code?: string): never;
+export declare function throwForbidden(message: string, code?: string, options?: FlowSurfaceErrorOptions): never;
 export declare function throwConflict(message: string, code?: string): never;
 export declare function throwInternalError(message: string, code?: string): never;

package/dist/server/flow-surfaces/errors.js

@@ -69,8 +69,8 @@ class FlowSurfaceBadRequestError extends FlowSurfaceError {
   }
 }
 class FlowSurfaceForbiddenError extends FlowSurfaceError {
-  constructor(message, code = "FLOW_SURFACE_FORBIDDEN") {
-    super(message, 403, "forbidden", code);
+  constructor(message, code = "FLOW_SURFACE_FORBIDDEN", options = {}) {
+    super(message, 403, "forbidden", code, options);
     this.name = "FlowSurfaceForbiddenError";
   }
 }
@@ -159,8 +159,8 @@ function throwBadRequest(message, codeOrOptions, options = {}) {
 function throwAggregateBadRequest(errors) {
   throw new FlowSurfaceAggregateError(errors);
 }
-function throwForbidden(message, code) {
-  throw new FlowSurfaceForbiddenError(message, code);
+function throwForbidden(message, code, options = {}) {
+  throw new FlowSurfaceForbiddenError(message, code, options);
 }
 function throwConflict(message, code) {
   throw new FlowSurfaceConflictError(message, code);

package/dist/server/flow-surfaces/navigation-targets.d.ts

@@ -0,0 +1,80 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import type { Database, Transaction } from '@nocobase/database';
+export declare const DEFAULT_ADMIN_UI_LAYOUT_UID = "admin-layout-model";
+export declare const DEFAULT_MOBILE_UI_LAYOUT_UID = "mobile-layout-model";
+export declare const DEFAULT_ADMIN_MULTI_PORTAL_UID = "__default_admin__";
+export declare const DEFAULT_MOBILE_MULTI_PORTAL_UID = "__default_mobile__";
+export type FlowSurfaceNavigationRequestRoles = readonly string[] | string;
+type FlowSurfacePortalRouteScopeKind = 'layout' | 'portal';
+export type FlowSurfaceResolvedMultiPortal = {
+    uid: string;
+    title: string;
+    icon?: string | null;
+    routeName?: string;
+    routePath?: string;
+    authCheck?: boolean;
+    enabled: true;
+    layoutUid: string;
+    layoutType?: string;
+    portalType: 'no-code';
+    routeScopeKind: FlowSurfacePortalRouteScopeKind;
+};
+export type FlowSurfaceNavigationTarget = {
+    kind: 'layout' | 'portal';
+    uid: string;
+    title: string;
+    icon?: string | null;
+    layoutUid: string;
+    layoutType?: string;
+    routeName?: string;
+    routePath?: string;
+    authCheck?: boolean;
+    default?: boolean;
+    portalUid?: string;
+};
+export type FlowSurfaceNavigationTargetsResult = {
+    version: '1';
+    capabilities: {
+        multiPortal: boolean;
+    };
+    targets: FlowSurfaceNavigationTarget[];
+};
+type PortalResolveOptions = {
+    actionName: string;
+    path: string;
+    currentRoles?: FlowSurfaceNavigationRequestRoles;
+    transaction?: Transaction;
+};
+export declare class FlowSurfaceNavigationTargetsService {
+    private readonly db;
+    constructor(db: Database);
+    hasMultiPortalCapability(): boolean;
+    hasUiLayoutCapability(): boolean;
+    normalizePortalUid(value: unknown): string;
+    listNavigationTargets(currentRoles?: FlowSurfaceNavigationRequestRoles, transaction?: Transaction): Promise<FlowSurfaceNavigationTargetsResult>;
+    resolveDefaultPortal(options: Omit<PortalResolveOptions, 'path'>): Promise<FlowSurfaceResolvedMultiPortal>;
+    resolvePortal(portalUidValue: unknown, options: PortalResolveOptions): Promise<FlowSurfaceResolvedMultiPortal>;
+    readRoutePortalUids(routeId: unknown, transaction?: Transaction): Promise<string[]>;
+    assertRouteBelongsToPortal(actionName: string, routeId: unknown, portalUid: string, path: string, transaction?: Transaction): Promise<void>;
+    attachRouteTreeToPortals(routeId: unknown, portalUids: string[], options: {
+        portalOnly: boolean;
+        transaction?: Transaction;
+    }): Promise<void>;
+    private listLayoutTargets;
+    private getEnabledPortalInventory;
+    private listAccessiblePortalTargets;
+    private comparePortalPriority;
+    private getPortalPriority;
+    private canAccessPortal;
+    private collectRouteTreeIds;
+    private removeDefaultLayoutRoutePermissions;
+    private grantDefaultPortalRouteAccess;
+}
+export {};

package/dist/server/flow-surfaces/navigation-targets.js

@@ -0,0 +1,546 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var navigation_targets_exports = {};
+__export(navigation_targets_exports, {
+  DEFAULT_ADMIN_MULTI_PORTAL_UID: () => DEFAULT_ADMIN_MULTI_PORTAL_UID,
+  DEFAULT_ADMIN_UI_LAYOUT_UID: () => DEFAULT_ADMIN_UI_LAYOUT_UID,
+  DEFAULT_MOBILE_MULTI_PORTAL_UID: () => DEFAULT_MOBILE_MULTI_PORTAL_UID,
+  DEFAULT_MOBILE_UI_LAYOUT_UID: () => DEFAULT_MOBILE_UI_LAYOUT_UID,
+  FlowSurfaceNavigationTargetsService: () => FlowSurfaceNavigationTargetsService
+});
+module.exports = __toCommonJS(navigation_targets_exports);
+var import_errors = require("./errors");
+const DEFAULT_ADMIN_UI_LAYOUT_UID = "admin-layout-model";
+const DEFAULT_MOBILE_UI_LAYOUT_UID = "mobile-layout-model";
+const DEFAULT_ADMIN_MULTI_PORTAL_UID = "__default_admin__";
+const DEFAULT_MOBILE_MULTI_PORTAL_UID = "__default_mobile__";
+function readRecordField(record, field) {
+  if (!record || typeof record !== "object") {
+    return void 0;
+  }
+  const model = record;
+  if (typeof model.get === "function") {
+    return model.get(field);
+  }
+  return record[field];
+}
+function readStringField(record, field) {
+  const value = readRecordField(record, field);
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function normalizeRoles(currentRoles) {
+  const roles = Array.isArray(currentRoles) ? currentRoles : typeof currentRoles === "string" ? [currentRoles] : [];
+  return roles.map((role) => String(role || "").trim()).filter(Boolean);
+}
+function normalizeRelationRouteId(routeId) {
+  return routeId === null || typeof routeId === "undefined" ? void 0 : routeId;
+}
+function isDefaultLayoutMultiPortalUid(uid) {
+  return uid === DEFAULT_ADMIN_MULTI_PORTAL_UID || uid === DEFAULT_MOBILE_MULTI_PORTAL_UID;
+}
+class FlowSurfaceNavigationTargetsService {
+  constructor(db) {
+    this.db = db;
+  }
+  hasMultiPortalCapability() {
+    var _a, _b;
+    try {
+      return !!this.db.getCollection("multiPortals") && !!((_b = (_a = this.db.getCollection("desktopRoutes")) == null ? void 0 : _a.getField) == null ? void 0 : _b.call(_a, "multiPortals"));
+    } catch (error) {
+      return false;
+    }
+  }
+  hasUiLayoutCapability() {
+    var _a, _b;
+    try {
+      return !!this.db.getCollection("uiLayouts") && !!((_b = (_a = this.db.getCollection("desktopRoutes")) == null ? void 0 : _a.getField) == null ? void 0 : _b.call(_a, "uiLayouts"));
+    } catch (error) {
+      return false;
+    }
+  }
+  normalizePortalUid(value) {
+    const portalUid = String(value || "").trim();
+    return portalUid || void 0;
+  }
+  async listNavigationTargets(currentRoles, transaction) {
+    var _a;
+    let layoutTargets = await this.listLayoutTargets(transaction);
+    const multiPortal = this.hasMultiPortalCapability();
+    const portalInventory = multiPortal ? await this.getEnabledPortalInventory(currentRoles, transaction) : { accessible: [] };
+    const portalTargets = multiPortal ? await this.listAccessiblePortalTargets(portalInventory.accessible, transaction) : [];
+    if (multiPortal) {
+      layoutTargets = layoutTargets.map(({ default: _default, ...target }) => target);
+      if (portalInventory.accessible.length === 1 && ((_a = portalTargets[0]) == null ? void 0 : _a.uid) === readStringField(portalInventory.accessible[0], "uid")) {
+        portalTargets[0] = { ...portalTargets[0], default: true };
+      }
+    }
+    return {
+      version: "1",
+      capabilities: {
+        multiPortal
+      },
+      targets: [...layoutTargets, ...portalTargets]
+    };
+  }
+  async resolveDefaultPortal(options) {
+    if (!this.hasMultiPortalCapability()) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} requires the Multi-portal capability`, {
+        ruleId: "navigation-portal-unsupported",
+        path: "navigation"
+      });
+    }
+    const inventory = await this.getEnabledPortalInventory(options.currentRoles, options.transaction);
+    if (!inventory.enabled.length) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} requires an enabled portal`, {
+        ruleId: "navigation-portal-not-found",
+        path: "navigation",
+        details: {
+          uiBuilderAllowed: false,
+          adminLayoutFallbackAllowed: false,
+          agentInstruction: "Stop this Flow Surfaces write. Ask the user to create and enable a Portal before retrying; do not fall back to the Admin layout."
+        }
+      });
+    }
+    if (!inventory.accessible.length) {
+      (0, import_errors.throwForbidden)(
+        `flowSurfaces ${options.actionName} current roles cannot access an enabled portal`,
+        "FLOW_SURFACE_NAVIGATION_PORTAL_FORBIDDEN",
+        {
+          ruleId: "navigation-portal-forbidden",
+          path: "navigation"
+        }
+      );
+    }
+    if (inventory.accessible.length > 1) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} requires an explicit portal selection`, {
+        ruleId: "navigation-portal-selection-required",
+        path: "navigation",
+        details: {
+          candidates: inventory.accessible.map((portal) => {
+            const uid = readStringField(portal, "uid");
+            return {
+              uid,
+              portalName: readStringField(portal, "portalName") || null,
+              title: readStringField(portal, "title") || uid,
+              portalType: readStringField(portal, "portalType") || null
+            };
+          }),
+          uiBuilderAllowed: false,
+          adminLayoutFallbackAllowed: false,
+          agentInstruction: "Stop this Flow Surfaces write and ask the user to select one candidate before retrying; do not choose by Portal type or fall back to the Admin layout."
+        }
+      });
+    }
+    return this.resolvePortal(readStringField(inventory.accessible[0], "uid"), {
+      ...options,
+      path: "navigation"
+    });
+  }
+  async resolvePortal(portalUidValue, options) {
+    const portalUid = this.normalizePortalUid(portalUidValue);
+    if (!portalUid) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} ${options.path} must be a non-empty string`, {
+        ruleId: "navigation-portal-invalid",
+        path: options.path
+      });
+    }
+    if (!this.hasMultiPortalCapability()) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} ${options.path} requires the Multi-portal capability`, {
+        ruleId: "navigation-portal-unsupported",
+        path: options.path,
+        details: { portalUid }
+      });
+    }
+    const portal = await this.db.getRepository("multiPortals").findOne({
+      filter: { uid: portalUid },
+      fields: ["uid", "title", "icon", "portalType", "portalName", "routePath", "authCheck", "enabled", "uiLayoutUid"],
+      transaction: options.transaction
+    });
+    if (!portal) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} ${options.path} references missing portal '${portalUid}'`, {
+        ruleId: "navigation-portal-not-found",
+        path: options.path,
+        details: { portalUid }
+      });
+    }
+    const routeScopeKind = isDefaultLayoutMultiPortalUid(portalUid) ? "layout" : "portal";
+    if (routeScopeKind === "portal" && !await this.canAccessPortal(portalUid, options.currentRoles, options.transaction)) {
+      (0, import_errors.throwForbidden)(
+        `flowSurfaces ${options.actionName} current roles cannot access portal '${portalUid}'`,
+        "FLOW_SURFACE_NAVIGATION_PORTAL_FORBIDDEN",
+        {
+          ruleId: "navigation-portal-forbidden",
+          path: options.path,
+          details: { portalUid }
+        }
+      );
+    }
+    if (readRecordField(portal, "enabled") !== true) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} portal '${portalUid}' is disabled`, {
+        ruleId: "navigation-portal-disabled",
+        path: options.path,
+        details: { portalUid }
+      });
+    }
+    const portalType = readStringField(portal, "portalType");
+    if (portalType !== "no-code") {
+      if (portalType === "ai") {
+        (0, import_errors.throwBadRequest)(
+          `flowSurfaces ${options.actionName} cannot use UI Builder or Flow Surfaces for AI Portal '${portalUid}'; stop and implement the request in the Portal source code`,
+          {
+            ruleId: "navigation-portal-type-unsupported",
+            path: options.path,
+            details: {
+              portalUid,
+              portalType,
+              portalName: readStringField(portal, "portalName") || null,
+              expectedPortalType: "no-code",
+              uiBuilderAllowed: false,
+              adminLayoutFallbackAllowed: false,
+              implementationPath: "ai-portal-source",
+              agentInstruction: "Stop this Flow Surfaces write. Run nb portal info <portalName> -j to resolve localPath, then implement the request in that AI Portal source code. Do not retry with an Admin layout."
+            }
+          }
+        );
+      }
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} portal '${portalUid}' does not support no-code routes`, {
+        ruleId: "navigation-portal-type-unsupported",
+        path: options.path,
+        details: { portalUid, portalType: portalType || null }
+      });
+    }
+    const layoutUid = readStringField(portal, "uiLayoutUid");
+    if (!layoutUid || !this.db.getCollection("uiLayouts")) {
+      (0, import_errors.throwBadRequest)(`flowSurfaces ${options.actionName} portal '${portalUid}' has no available backing UI layout`, {
+        ruleId: "navigation-portal-layout-not-found",
+        path: options.path,
+        details: { portalUid, layoutUid: layoutUid || null }
+      });
+    }
+    const layout = await this.db.getRepository("uiLayouts").findOne({
+      filter: { uid: layoutUid },
+      fields: ["uid", "layoutType", "enabled"],
+      transaction: options.transaction
+    });
+    if (!layout) {
+      (0, import_errors.throwBadRequest)(
+        `flowSurfaces ${options.actionName} portal '${portalUid}' backing UI layout '${layoutUid}' does not exist`,
+        {
+          ruleId: "navigation-portal-layout-not-found",
+          path: options.path,
+          details: { portalUid, layoutUid }
+        }
+      );
+    }
+    if (readRecordField(layout, "enabled") !== true) {
+      (0, import_errors.throwBadRequest)(
+        `flowSurfaces ${options.actionName} portal '${portalUid}' backing UI layout '${layoutUid}' is disabled`,
+        {
+          ruleId: "navigation-portal-layout-disabled",
+          path: options.path,
+          details: { portalUid, layoutUid }
+        }
+      );
+    }
+    return {
+      uid: portalUid,
+      title: readStringField(portal, "title") || portalUid,
+      icon: readStringField(portal, "icon") || null,
+      routeName: readStringField(portal, "portalName"),
+      routePath: readStringField(portal, "routePath"),
+      authCheck: readRecordField(portal, "authCheck") === true,
+      enabled: true,
+      layoutUid,
+      layoutType: readStringField(layout, "layoutType"),
+      portalType,
+      routeScopeKind
+    };
+  }
+  async readRoutePortalUids(routeId, transaction) {
+    const relationRouteId = normalizeRelationRouteId(routeId);
+    if (typeof relationRouteId === "undefined" || !this.hasMultiPortalCapability()) {
+      return [];
+    }
+    const portals = await this.db.getRepository("desktopRoutes.multiPortals", relationRouteId).find({ fields: ["uid"], transaction });
+    return Array.from(
+      new Set(
+        portals.map((portal) => readStringField(portal, "uid")).filter((portalUid) => !!portalUid)
+      )
+    );
+  }
+  async assertRouteBelongsToPortal(actionName, routeId, portalUid, path, transaction) {
+    const routePortalUids = await this.readRoutePortalUids(routeId, transaction);
+    if (routePortalUids.includes(portalUid)) {
+      return;
+    }
+    (0, import_errors.throwBadRequest)(`flowSurfaces ${actionName} ${path} does not belong to portal '${portalUid}'`, {
+      ruleId: "navigation-route-portal-mismatch",
+      path,
+      details: {
+        routeId,
+        portalUid,
+        routePortalUids
+      }
+    });
+  }
+  async attachRouteTreeToPortals(routeId, portalUids, options) {
+    const normalizedPortalUids = Array.from(new Set(portalUids.map((uid) => String(uid || "").trim()).filter(Boolean)));
+    const relationRouteId = normalizeRelationRouteId(routeId);
+    if (typeof relationRouteId === "undefined" || !normalizedPortalUids.length || !this.hasMultiPortalCapability()) {
+      return;
+    }
+    const routeIds = await this.collectRouteTreeIds(relationRouteId, options.transaction);
+    for (const currentRouteId of routeIds) {
+      await this.db.getRepository("desktopRoutes.multiPortals", currentRouteId).set({ tk: normalizedPortalUids, transaction: options.transaction });
+      if (options.portalOnly && this.hasUiLayoutCapability()) {
+        await this.db.getRepository("desktopRoutes.uiLayouts", currentRouteId).set({ tk: [], transaction: options.transaction });
+      }
+    }
+    if (options.portalOnly) {
+      await this.removeDefaultLayoutRoutePermissions(routeIds, options.transaction);
+    }
+    for (const portalUid of normalizedPortalUids) {
+      await this.grantDefaultPortalRouteAccess(portalUid, routeIds, options.transaction);
+    }
+  }
+  async listLayoutTargets(transaction) {
+    const targets = [];
+    if (this.db.getCollection("uiLayouts")) {
+      const layouts = await this.db.getRepository("uiLayouts").find({
+        filter: { enabled: true },
+        fields: ["uid", "title", "layoutType", "routeName", "routePath", "authCheck"],
+        sort: ["uid"],
+        transaction
+      });
+      for (const layout of layouts) {
+        const layoutUid = readStringField(layout, "uid");
+        if (!layoutUid) {
+          continue;
+        }
+        targets.push({
+          kind: "layout",
+          uid: layoutUid,
+          title: readStringField(layout, "title") || layoutUid,
+          layoutUid,
+          layoutType: readStringField(layout, "layoutType"),
+          routeName: readStringField(layout, "routeName"),
+          routePath: readStringField(layout, "routePath"),
+          authCheck: readRecordField(layout, "authCheck") === true,
+          ...layoutUid === DEFAULT_ADMIN_UI_LAYOUT_UID ? { default: true } : {}
+        });
+      }
+    }
+    if (!targets.some((target) => target.uid === DEFAULT_ADMIN_UI_LAYOUT_UID)) {
+      targets.unshift({
+        kind: "layout",
+        uid: DEFAULT_ADMIN_UI_LAYOUT_UID,
+        title: "Admin",
+        layoutUid: DEFAULT_ADMIN_UI_LAYOUT_UID,
+        layoutType: "desktop",
+        routeName: "admin",
+        routePath: "/admin",
+        authCheck: true,
+        default: true
+      });
+    }
+    return targets.sort((left, right) => {
+      if (left.default) {
+        return -1;
+      }
+      if (right.default) {
+        return 1;
+      }
+      return left.uid.localeCompare(right.uid);
+    });
+  }
+  async getEnabledPortalInventory(currentRoles, transaction) {
+    const enabled = await this.db.getRepository("multiPortals").find({
+      filter: { enabled: true },
+      fields: ["uid", "title", "icon", "portalType", "portalName", "routePath", "authCheck", "enabled", "uiLayoutUid"],
+      sort: ["uid"],
+      transaction
+    });
+    enabled.sort(
+      (left, right) => String(readStringField(left, "uid") || "").localeCompare(String(readStringField(right, "uid") || ""))
+    );
+    const roles = normalizeRoles(currentRoles);
+    const isRoot = roles.includes("root");
+    const accessiblePortalUids = /* @__PURE__ */ new Set();
+    if (!isRoot && roles.length && this.db.getCollection("rolesMultiPortals")) {
+      const grants = await this.db.getRepository("rolesMultiPortals").find({
+        filter: { roleName: roles },
+        fields: ["multiPortalUid"],
+        transaction
+      });
+      for (const grant of grants) {
+        const portalUid = readStringField(grant, "multiPortalUid");
+        if (portalUid) {
+          accessiblePortalUids.add(portalUid);
+        }
+      }
+    }
+    const accessible = enabled.filter((portal) => {
+      const portalUid = readStringField(portal, "uid");
+      return !!portalUid && (isRoot || isDefaultLayoutMultiPortalUid(portalUid) || accessiblePortalUids.has(portalUid));
+    });
+    return { enabled, accessible };
+  }
+  async listAccessiblePortalTargets(portals, transaction) {
+    const targets = [];
+    for (const portal of portals) {
+      const portalUid = readStringField(portal, "uid");
+      const layoutUid = readStringField(portal, "uiLayoutUid");
+      const portalType = readStringField(portal, "portalType");
+      if (!portalUid || portalType !== "no-code") {
+        continue;
+      }
+      if (!layoutUid || !this.db.getCollection("uiLayouts")) {
+        continue;
+      }
+      const layout = await this.db.getRepository("uiLayouts").findOne({
+        filter: { uid: layoutUid, enabled: true },
+        fields: ["layoutType"],
+        transaction
+      });
+      if (!layout) {
+        continue;
+      }
+      targets.push({
+        kind: "portal",
+        uid: portalUid,
+        portalUid,
+        title: readStringField(portal, "title") || portalUid,
+        icon: readStringField(portal, "icon") || null,
+        layoutUid,
+        layoutType: readStringField(layout, "layoutType"),
+        routeName: readStringField(portal, "portalName"),
+        routePath: readStringField(portal, "routePath"),
+        authCheck: readRecordField(portal, "authCheck") === true
+      });
+    }
+    return targets.sort((left, right) => this.comparePortalPriority(left, right));
+  }
+  comparePortalPriority(left, right) {
+    const priorityDelta = this.getPortalPriority(left) - this.getPortalPriority(right);
+    if (priorityDelta) {
+      return priorityDelta;
+    }
+    return String(readStringField(left, "uid") || "").localeCompare(String(readStringField(right, "uid") || ""));
+  }
+  getPortalPriority(portal) {
+    const uiLayout = readRecordField(portal, "uiLayout");
+    const layoutType = readStringField(portal, "layoutType") || readStringField(uiLayout, "layoutType");
+    if (readStringField(portal, "uid") === DEFAULT_ADMIN_MULTI_PORTAL_UID) {
+      return 0;
+    }
+    if (layoutType !== "mobile") {
+      return 1;
+    }
+    return 2;
+  }
+  async canAccessPortal(portalUid, currentRoles, transaction) {
+    const roles = normalizeRoles(currentRoles);
+    if (roles.includes("root")) {
+      return true;
+    }
+    if (!roles.length || !this.db.getCollection("rolesMultiPortals")) {
+      return false;
+    }
+    const count = await this.db.getRepository("rolesMultiPortals").count({
+      filter: {
+        roleName: roles,
+        multiPortalUid: portalUid
+      },
+      transaction
+    });
+    return count > 0;
+  }
+  async collectRouteTreeIds(routeId, transaction) {
+    const routeIds = [routeId];
+    const children = await this.db.getRepository("desktopRoutes").find({
+      fields: ["id"],
+      filter: { parentId: routeId },
+      transaction
+    });
+    for (const child of children) {
+      const childId = normalizeRelationRouteId(readRecordField(child, "id"));
+      if (typeof childId !== "undefined") {
+        routeIds.push(...await this.collectRouteTreeIds(childId, transaction));
+      }
+    }
+    return routeIds;
+  }
+  async removeDefaultLayoutRoutePermissions(routeIds, transaction) {
+    if (!routeIds.length || !this.db.getCollection("rolesDesktopRoutes")) {
+      return;
+    }
+    await this.db.getRepository("rolesDesktopRoutes").destroy({
+      filter: { desktopRouteId: routeIds },
+      transaction
+    });
+  }
+  async grantDefaultPortalRouteAccess(portalUid, routeIds, transaction) {
+    if (!routeIds.length || !this.db.getCollection("rolesMultiPortalRoutePolicies") || !this.db.getCollection("rolesMultiPortalDesktopRoutes")) {
+      return;
+    }
+    const policies = await this.db.getRepository("rolesMultiPortalRoutePolicies").find({
+      fields: ["roleName"],
+      filter: {
+        multiPortalUid: portalUid,
+        allowNewMenu: true
+      },
+      transaction
+    });
+    const roleNames = Array.from(
+      new Set(
+        policies.map((policy) => readStringField(policy, "roleName")).filter((roleName) => !!roleName)
+      )
+    );
+    const repository = this.db.getRepository("rolesMultiPortalDesktopRoutes");
+    for (const roleName of roleNames) {
+      for (const desktopRouteId of routeIds) {
+        await repository.firstOrCreate({
+          filterKeys: ["roleName", "multiPortalUid", "desktopRouteId"],
+          values: {
+            roleName,
+            multiPortalUid: portalUid,
+            desktopRouteId
+          },
+          transaction
+        });
+      }
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_ADMIN_MULTI_PORTAL_UID,
+  DEFAULT_ADMIN_UI_LAYOUT_UID,
+  DEFAULT_MOBILE_MULTI_PORTAL_UID,
+  DEFAULT_MOBILE_UI_LAYOUT_UID,
+  FlowSurfaceNavigationTargetsService
+});

package/dist/server/flow-surfaces/runjs-authoring/runtime/constants.js

@@ -159,6 +159,7 @@ const SURFACE_ALLOWED_MODEL_USES = {
 };
 const ALLOWED_CTX_ROOTS = /* @__PURE__ */ new Set([
   "acl",
+  "ai",
   "antd",
   "antdIcons",
   "api",