@pilotiq/pilotiq 0.1.0

package/dist/pageData.js

@@ -0,0 +1,3725 @@
+import { PilotiqRegistry } from './PilotiqRegistry.js';
+import { resourceBasePath, globalBasePath, pageBasePath, clusterBasePath } from './clusterPaths.js';
+import { Field } from './fields/Field.js';
+import { resolveSchema } from './schema/resolveSchema.js';
+import { isServerDataElement } from './schema/ServerDataElement.js';
+import { Form } from './elements/Form.js';
+import { Table } from './elements/Table.js';
+import { Column } from './Column.js';
+import { applyStateUpdate, coerceFormValues, findForms, findWizardStepFields, loadRelationRows, selectFormById } from './elements/dispatchForm.js';
+import { isRepeaterField, RepeaterField } from './fields/RepeaterField.js';
+import { isBuilderField, BuilderField } from './fields/BuilderField.js';
+import { SelectField } from './fields/SelectField.js';
+import { validateSchema } from './validation/index.js';
+import { searchAllResources } from './search.js';
+import { loadTableRecords, findTables } from './elements/dispatchTable.js';
+import { findActions, findRowExtraActions } from './elements/dispatchAction.js';
+import { Filter } from './filters/Filter.js';
+import { TrashedFilter } from './filters/TrashedFilter.js';
+import { resolveTheme } from './theme/resolve.js';
+import { consumeFlashedNotifications } from './notifications/flash.js';
+import { notificationChannel, NOTIFICATION_CREATED_EVENT, } from './notifications/broadcast.js';
+import { serializeIcon } from './icons/types.js';
+import { RIGHT_PANEL_DEFAULT_WIDTH, RIGHT_PANEL_MIN_WIDTH, RIGHT_PANEL_MAX_WIDTH, } from './RightPanel.js';
+import { safeManagerPolicy as safeManagerPolicyImpl, } from './RelationManager.js';
+import { RelationTabs, relationTab } from './schema/RelationTabs.js';
+import { Breadcrumbs } from './schema/Breadcrumbs.js';
+import { resolveRenderHooks, CHROME_HOOK_NAMES, } from './RenderHook.js';
+import { applyPageHooks, pageHooksFor } from './applyPageHooks.js';
+import { modelSave, modelLoadRecord, modelRelationTableRecords, findRecord, getPrimaryKey, getRelationType, getMorphRelationDescriptor, } from './orm/modelDefaults.js';
+import { normalizeRelationMode } from './RelationManager.js';
+export async function panelInfo(pilotiq, req, route = {}) {
+    const cfg = pilotiq.getConfig();
+    const merged = pilotiq.getMergedTheme();
+    const theme = merged ? resolveTheme(merged) : undefined;
+    const user = await pilotiq.resolveUser(req);
+    const [navigation, userMenu, renderHooks, rightSidebar] = await Promise.all([
+        buildNavigation(pilotiq, user),
+        buildUserMenu(pilotiq, user),
+        resolveChromeHooks(pilotiq, user, route),
+        buildRightSidebarMeta(cfg, user),
+    ]);
+    const databaseNotifications = buildDatabaseNotificationsMeta(cfg, user);
+    return {
+        name: cfg.name,
+        branding: cfg.branding,
+        navigation,
+        theme,
+        themeEditor: cfg.themeEditor ?? false,
+        ...(userMenu ? { userMenu } : {}),
+        ...(databaseNotifications ? { databaseNotifications } : {}),
+        ...(rightSidebar ? { rightSidebar } : {}),
+        ...(Object.keys(renderHooks).length > 0 ? { renderHooks } : {}),
+    };
+}
+/**
+ * Build the bell-icon meta. Returns `null` when:
+ *   - `Pilotiq.databaseNotifications()` was never called, OR
+ *   - no user resolves (no inbox to surface).
+ *
+ * Defaults follow Filament: 30s polling, 25 rows per page, primary
+ * badge color, topbar position.
+ */
+function buildDatabaseNotificationsMeta(cfg, user) {
+    if (!cfg.databaseNotifications?.enabled)
+        return null;
+    if (user === null || user === undefined)
+        return null;
+    const dn = cfg.databaseNotifications;
+    const base = cfg.path;
+    const meta = {
+        position: dn.position ?? 'topbar',
+        polling: dn.polling === null ? null : (dn.polling ?? 30),
+        pageSize: dn.pageSize ?? 25,
+        badgeColor: dn.badgeColor ?? 'primary',
+        listUrl: `${base}/_notifications`,
+        readAllUrl: `${base}/_notifications/read-all`,
+        readUrl: `${base}/_notifications/:id/read`,
+        unreadUrl: `${base}/_notifications/:id/unread`,
+        actionUrl: `${base}/_notifications/:id/_action/:actionName`,
+    };
+    if (dn.trigger)
+        meta.trigger = { ...dn.trigger };
+    // Phase 2 broadcast hint — only ship when broadcast is enabled AND the
+    // resolved user has an `id` to scope the channel to. The client uses
+    // `wsUrl` for the WebSocket connection and `channel` for the subscribe
+    // call (the private- prefix is already baked in).
+    if (dn.broadcast) {
+        const userId = user?.id;
+        if (userId !== undefined && userId !== null) {
+            const wsUrl = typeof dn.broadcast === 'object' && dn.broadcast.wsUrl
+                ? dn.broadcast.wsUrl
+                : ''; // empty = client falls back to same-origin /ws
+            meta.broadcast = {
+                wsUrl,
+                channel: notificationChannel(String(userId)),
+                event: NOTIFICATION_CREATED_EVENT,
+            };
+        }
+    }
+    return meta;
+}
+/**
+ * Build the right-sidebar meta from registered contributions. Returns
+ * `null` when:
+ *
+ *   - no contributions were registered, OR
+ *   - every contribution failed `canAccess(user)` (or its predicate
+ *     threw — fail-closed), OR
+ *   - every passing contribution is `hidden: true` (no tab-strip
+ *     surface to mount; programmatic-open consumers should ship at
+ *     least one visible tab).
+ *
+ * Visible contributions are sorted by `sort` ascending (default 100),
+ * with registration order as a stable tiebreaker. Each entry's icon is
+ * serialized through `serializeIcon` keyed on the contribution `id`
+ * (Phase B's Vite plugin extends `_components.ts` to round-trip
+ * component-typed icons under that key). `defaultWidth` rolls up:
+ * panel-level baseline is `RIGHT_PANEL_DEFAULT_WIDTH`; per-contribution
+ * overrides ride on `RightPanelMeta.defaultWidth`.
+ *
+ * Errors thrown by `canAccess` are swallowed (the contribution is
+ * dropped + a single console warn is emitted) so a flaky predicate on
+ * one pane never blanks the whole sidebar.
+ */
+async function buildRightSidebarMeta(cfg, user) {
+    const list = cfg.rightPanels ?? [];
+    if (list.length === 0)
+        return null;
+    const indexed = list.map((c, idx) => ({ c, idx }));
+    const gated = await Promise.all(indexed.map(async ({ c, idx }) => {
+        if (c.canAccess) {
+            try {
+                const ok = await c.canAccess(user);
+                if (!ok)
+                    return null;
+            }
+            catch (err) {
+                // eslint-disable-next-line no-console
+                console.warn(`[Pilotiq] rightPanel "${c.id}" canAccess threw — dropping`, err);
+                return null;
+            }
+        }
+        return { c, idx };
+    }));
+    const visible = gated
+        .filter((x) => x !== null)
+        .filter((x) => !x.c.hidden)
+        .sort((a, b) => {
+        const sa = a.c.sort ?? 100;
+        const sb = b.c.sort ?? 100;
+        if (sa !== sb)
+            return sa - sb;
+        return a.idx - b.idx;
+    });
+    if (visible.length === 0)
+        return null;
+    const panels = visible.map(({ c }) => {
+        const meta = {
+            id: c.id,
+            label: c.label ?? c.id,
+            defaultWidth: c.defaultWidth ?? RIGHT_PANEL_DEFAULT_WIDTH,
+        };
+        if (c.icon !== undefined) {
+            meta.icon = serializeIcon(c.icon, c.id);
+        }
+        return meta;
+    });
+    return {
+        panels,
+        defaultWidth: panels[0]?.defaultWidth ?? RIGHT_PANEL_DEFAULT_WIDTH,
+        minWidth: RIGHT_PANEL_MIN_WIDTH,
+        maxWidth: RIGHT_PANEL_MAX_WIDTH,
+    };
+}
+/**
+ * Resolve every chrome render hook (body / topbar / sidebar / user-menu
+ * / footer / head). Returns a sparse map — slots with no matching
+ * registered entries are omitted so the wire payload stays minimal on
+ * panels that don't use render hooks at all.
+ */
+async function resolveChromeHooks(pilotiq, user, route) {
+    const cfg = pilotiq.getConfig();
+    const entries = cfg.renderHooks ?? [];
+    if (entries.length === 0)
+        return {};
+    const ctx = {
+        user,
+        basePath: cfg.path,
+        url: route.url ?? cfg.path,
+    };
+    if (route.resource !== undefined)
+        ctx.resource = route.resource;
+    if (route.page !== undefined)
+        ctx.page = route.page;
+    if (route.global !== undefined)
+        ctx.global = route.global;
+    if (route.recordId !== undefined)
+        ctx.recordId = route.recordId;
+    return resolveRenderHooks(entries, CHROME_HOOK_NAMES, ctx);
+}
+/**
+ * Resolve a subset of page-role render hooks (e.g. `panels::page.start`
+ * + the list-records / create-record / view-record / edit-record /
+ * global-search slot families). Per-page-role data builders call this
+ * after schema resolution and stamp the result on `viewProps.renderHooks`.
+ *
+ * `names` lets each builder declare exactly which slots it serves so a
+ * list-page builder doesn't ship slots that only fire on the edit page.
+ */
+/**
+ * Per-builder one-shot — resolve the role's slot set + splice the
+ * results into the resolved schema. Wraps the two steps a per-builder
+ * data fn always does in lockstep:
+ *
+ *   1. `resolvePageHooks(pilotiq, user, pageHooksFor(role), route)`
+ *   2. `applyPageHooks(schemaData, hooks, role)`
+ *
+ * Returns the wrapped `ElementMeta[]`. No-op when the panel has no
+ * registered hooks. Pass through what you'd pass to `panelInfo()`'s
+ * route arg — same shape.
+ */
+export async function applyRoleHooks(pilotiq, user, role, schemaData, route = {}) {
+    const cfg = pilotiq.getConfig();
+    if (!cfg.renderHooks || cfg.renderHooks.length === 0)
+        return schemaData;
+    const hooks = await resolvePageHooks(pilotiq, user, pageHooksFor(role), route);
+    return applyPageHooks(schemaData, hooks, role);
+}
+export async function resolvePageHooks(pilotiq, user, names, route) {
+    const cfg = pilotiq.getConfig();
+    const entries = cfg.renderHooks ?? [];
+    if (entries.length === 0 || names.length === 0)
+        return {};
+    const ctx = {
+        user,
+        basePath: cfg.path,
+        url: route.url ?? cfg.path,
+    };
+    if (route.resource !== undefined)
+        ctx.resource = route.resource;
+    if (route.page !== undefined)
+        ctx.page = route.page;
+    if (route.global !== undefined)
+        ctx.global = route.global;
+    if (route.recordId !== undefined)
+        ctx.recordId = route.recordId;
+    return resolveRenderHooks(entries, names, ctx);
+}
+/**
+ * Build the top-right user-menu meta. Returns `null` when:
+ *   - `Pilotiq.user()` isn't configured, or
+ *   - the resolver returned `null` (anonymous request), or
+ *   - the user object has no extractable identity AND the panel
+ *     configured no items / no sign-out (nothing to render).
+ *
+ * Items resolve in parallel with their visibility predicates
+ * (`UserMenuItem.visible`). Throwing predicates fail closed (item
+ * dropped). Sort by `.sort(n)` ascending → registration order.
+ */
+async function buildUserMenu(pilotiq, user) {
+    if (user === null || user === undefined)
+        return null;
+    const cfg = pilotiq.getConfig();
+    const items = cfg.userMenuItems ?? [];
+    const ctx = { user };
+    // Resolve every item in parallel. `null` returns mean "filtered by
+    // visibility predicate" — drop them. Indexed pre-sort so stable ties
+    // resolve to registration order.
+    const resolved = await Promise.all(items.map(async (item, idx) => {
+        try {
+            const meta = await item.resolve(ctx);
+            return meta ? { meta, idx, sort: item.getSort() } : null;
+        }
+        catch {
+            return null;
+        }
+    }));
+    const visibleItems = resolved
+        .filter((x) => x !== null)
+        .sort((a, b) => {
+        const aHas = a.sort !== undefined, bHas = b.sort !== undefined;
+        if (aHas && bHas)
+            return a.sort - b.sort || a.idx - b.idx;
+        if (aHas)
+            return -1;
+        if (bHas)
+            return 1;
+        return a.idx - b.idx;
+    })
+        .map(x => x.meta);
+    // Auto-inject the profile entry from `cfg.profilePage` when set.
+    // Prepended (Filament-style) so it always sits at the top of the
+    // dropdown regardless of user-authored item ordering. Falls through
+    // its own `canAccess(user)` so per-user gating works without the
+    // user repeating the predicate at the menu level.
+    const profileItem = await buildProfileMenuItem(cfg, user);
+    const finalItems = profileItem ? [profileItem, ...visibleItems] : visibleItems;
+    const meta = {
+        user: extractUserIdentity(user),
+        items: finalItems,
+    };
+    if (cfg.signOut) {
+        meta.signOut = {
+            url: cfg.signOut.url,
+            label: cfg.signOut.label ?? 'Sign out',
+            method: cfg.signOut.method ?? 'POST',
+        };
+    }
+    return meta;
+}
+/** Build the auto-injected profile entry from `cfg.profilePage`. The
+ *  Page's `static label` / `static icon` win; defaults `'Edit profile'`
+ *  + `'user-circle'` (registry-resolved). Returns `null` when no
+ *  profile page is configured or `Page.canAccess(user)` denies. */
+async function buildProfileMenuItem(cfg, user) {
+    const P = cfg.profilePage;
+    if (!P)
+        return null;
+    if (!(await safeAccess(() => P.canAccess(user))))
+        return null;
+    const url = pageBasePath(cfg.path, P);
+    const icon = serializeIcon(P.icon ?? 'user-circle', P.name);
+    const meta = {
+        name: '__profile',
+        label: P.label ?? 'Edit profile',
+        url,
+    };
+    if (icon !== undefined)
+        meta.icon = icon;
+    return meta;
+}
+/** Duck-type the user object for display fields. We never throw — a
+ *  user resolver might return literally anything (a primitive, a class
+ *  instance with getters, a plain object) and the dropdown should
+ *  degrade gracefully (initials fallback to '?' when no name found). */
+function extractUserIdentity(user) {
+    if (user === null || user === undefined)
+        return {};
+    if (typeof user !== 'object')
+        return { name: String(user) };
+    const obj = user;
+    const out = {};
+    const name = obj.name ?? obj.fullName ?? obj.displayName ?? obj.username;
+    if (typeof name === 'string' && name)
+        out.name = name;
+    if (typeof obj.email === 'string' && obj.email)
+        out.email = obj.email;
+    const avatar = obj.avatar ?? obj.avatarUrl ?? obj.image;
+    if (typeof avatar === 'string' && avatar)
+        out.avatar = avatar;
+    return out;
+}
+/** Run a `canAccess` check, swallowing throws as `false`. Used by
+ *  `buildNavigation` to fail-closed on flaky auth predicates without
+ *  blanking the page. */
+async function safeAccess(fn) {
+    try {
+        return Boolean(await fn());
+    }
+    catch {
+        return false;
+    }
+}
+/** Plan #10 — stamp the resolved user onto a SchemaContext so action
+ *  visibility predicates can see it during `resolveSchema`. The `user`
+ *  field is opaque (whatever `Pilotiq.user(req => …)` returns); skipped
+ *  when null/undefined to keep ctx tidy. */
+function userCtx(ctx, user) {
+    if (user === null || user === undefined)
+        return ctx;
+    return { ...ctx, user: user };
+}
+/** Plan #6 — stamp the panel-wide upload URL so `FileUpload` fields
+ *  emit it on their meta. Single URL for the whole panel; no per-field
+ *  variation. The route is always registered (see `_uploads` in
+ *  `routes.ts`) — meta is stamped regardless of whether an adapter is
+ *  configured so the renderer can show a clear error rather than
+ *  silently breaking. The companion `hasUploadAdapter` flag distinguishes
+ *  "URL exists but adapter missing" so fields with optional upload
+ *  affordances (e.g. `MarkdownField`'s `attachFiles` button) can hide
+ *  themselves rather than render a broken control. */
+function uploadCtx(ctx, cfg) {
+    return {
+        ...ctx,
+        uploadUrl: `${cfg.path}/_uploads`,
+        ...(cfg.uploads ? { hasUploadAdapter: true } : {}),
+    };
+}
+async function buildNavigation(pilotiq, user) {
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    // Flatten + resolve badges in parallel. We build the raw list first so
+    // every entry has its identity (`name`) and parent set; badges resolve
+    // alongside.
+    const raw = [];
+    let idx = 0;
+    const pushBadge = [];
+    // Plan #10 — pre-evaluate canAccess for every owner in parallel so we
+    // can drop forbidden items before flattening. Failed predicates fail
+    // closed (treated as `false`) so a thrown auth check doesn't accidentally
+    // expose nav items. Clusters compose: a child gated through its
+    // cluster's `canAccess` returning false drops the child even when the
+    // child's own predicate would have passed.
+    const [resourceAccess, globalAccess, pageAccess, clusterAccess] = await Promise.all([
+        Promise.all(cfg.resources.map(R => safeAccess(() => R.canAccess(user)))),
+        Promise.all(cfg.globals.map(G => safeAccess(() => G.canAccess(user)))),
+        Promise.all(cfg.pages.map(P => safeAccess(() => P.canAccess(user)))),
+        Promise.all(cfg.clusters.map(C => safeAccess(() => C.canAccess(user)))),
+    ]);
+    // Identity-keyed so two clusters that happen to share a `.name`
+    // (minifier collisions, hot-reload duplicate imports) don't clobber.
+    const clusterAccessByClass = new Map();
+    cfg.clusters.forEach((C, i) => clusterAccessByClass.set(C, !!clusterAccess[i]));
+    const firstChildUrlByCluster = new Map();
+    const recordChildUrl = (cluster, url) => {
+        if (!firstChildUrlByCluster.has(cluster))
+            firstChildUrlByCluster.set(cluster, url);
+    };
+    for (let i = 0; i < cfg.resources.length; i++) {
+        const R = cfg.resources[i];
+        if (!resourceAccess[i])
+            continue;
+        if (R.cluster && !clusterAccessByClass.get(R.cluster))
+            continue;
+        const url = resourceBasePath(base, R);
+        if (R.cluster)
+            recordChildUrl(R.cluster, url);
+        const item = {
+            name: R.name,
+            label: R.getNavigationLabel(),
+            url,
+            icon: serializeIcon(R.getNavigationIcon(), R.name),
+            _idx: idx++,
+        };
+        if (R.navigationGroup !== undefined)
+            item.group = R.navigationGroup;
+        if (R.navigationSort !== undefined)
+            item.sort = R.navigationSort;
+        // Cluster nesting wins over `navigationParentItem`. Both being set
+        // is a misconfiguration; cluster placement is the structural one.
+        if (R.cluster)
+            item.parent = R.cluster.name;
+        else if (R.navigationParentItem !== undefined)
+            item.parent = R.navigationParentItem;
+        if (R.navigationBadgeColor !== 'default')
+            item.badgeColor = R.navigationBadgeColor;
+        if (R.navigationBadge)
+            pushBadge.push({ item, handler: R.navigationBadge });
+        raw.push(item);
+    }
+    for (let i = 0; i < cfg.globals.length; i++) {
+        if (!globalAccess[i])
+            continue;
+        const G = cfg.globals[i];
+        if (G.cluster && !clusterAccessByClass.get(G.cluster))
+            continue;
+        // Globals default `navigationGroup` to `'Settings'`. Allow `null` as
+        // an explicit opt-out → render at top level.
+        const group = G.navigationGroup === null ? undefined : G.navigationGroup;
+        const url = globalBasePath(base, G);
+        if (G.cluster)
+            recordChildUrl(G.cluster, url);
+        const item = {
+            name: G.name,
+            label: G.getNavigationLabel(),
+            url,
+            icon: serializeIcon(G.getNavigationIcon(), G.name),
+            _idx: idx++,
+        };
+        if (group !== undefined)
+            item.group = group;
+        if (G.navigationSort !== undefined)
+            item.sort = G.navigationSort;
+        if (G.cluster)
+            item.parent = G.cluster.name;
+        else if (G.navigationParentItem !== undefined)
+            item.parent = G.navigationParentItem;
+        if (G.navigationBadgeColor !== 'default')
+            item.badgeColor = G.navigationBadgeColor;
+        if (G.navigationBadge)
+            pushBadge.push({ item, handler: G.navigationBadge });
+        raw.push(item);
+    }
+    for (let i = 0; i < cfg.pages.length; i++) {
+        if (!pageAccess[i])
+            continue;
+        const P = cfg.pages[i];
+        if (P.cluster && !clusterAccessByClass.get(P.cluster))
+            continue;
+        // The dashboard page collapses its nav URL to `${base}` so the
+        // sidebar entry deep-links to the panel root rather than
+        // `${base}/${P.getSlug()}` (which would 404 — the slug route skips
+        // the dashboard page at boot).
+        const isDashboard = cfg.dashboardPage === P;
+        const url = isDashboard ? base : pageBasePath(base, P);
+        if (P.cluster && !isDashboard)
+            recordChildUrl(P.cluster, url);
+        const item = {
+            name: P.name,
+            label: P.getNavigationLabel(),
+            url,
+            icon: serializeIcon(P.getNavigationIcon(), P.name),
+            _idx: idx++,
+        };
+        if (P.navigationGroup !== undefined)
+            item.group = P.navigationGroup;
+        if (P.navigationSort !== undefined)
+            item.sort = P.navigationSort;
+        if (P.cluster && !isDashboard)
+            item.parent = P.cluster.name;
+        else if (P.navigationParentItem !== undefined)
+            item.parent = P.navigationParentItem;
+        if (P.navigationBadgeColor !== 'default')
+            item.badgeColor = P.navigationBadgeColor;
+        if (P.navigationBadge)
+            pushBadge.push({ item, handler: P.navigationBadge });
+        raw.push(item);
+    }
+    // Clusters render as first-class nav items. Each gets a URL pointing
+    // at its `landingPage` (when set + accessible) or its first accessible
+    // child. Clusters whose every child was gated out are dropped silently
+    // — same posture as `navigationParentItem` with no resolvable parent.
+    for (let i = 0; i < cfg.clusters.length; i++) {
+        if (!clusterAccess[i])
+            continue;
+        const C = cfg.clusters[i];
+        let url;
+        if (C.landingPage) {
+            const lpIdx = cfg.pages.indexOf(C.landingPage);
+            if (lpIdx !== -1 && pageAccess[lpIdx]) {
+                url = cfg.dashboardPage === C.landingPage ? base : pageBasePath(base, C.landingPage);
+            }
+        }
+        if (url === undefined)
+            url = firstChildUrlByCluster.get(C);
+        if (url === undefined)
+            continue; // empty cluster — drop entirely
+        const item = {
+            name: C.name,
+            label: C.getNavigationLabel(),
+            url,
+            icon: serializeIcon(C.getNavigationIcon(), C.name),
+            _idx: idx++,
+        };
+        if (C.navigationGroup !== undefined)
+            item.group = C.navigationGroup;
+        if (C.navigationSort !== undefined)
+            item.sort = C.navigationSort;
+        if (C.navigationParentItem !== undefined)
+            item.parent = C.navigationParentItem;
+        if (C.navigationBadgeColor !== 'default')
+            item.badgeColor = C.navigationBadgeColor;
+        if (C.navigationBadge)
+            pushBadge.push({ item, handler: C.navigationBadge });
+        raw.push(item);
+    }
+    await Promise.all(pushBadge.map(async ({ item, handler }) => {
+        try {
+            const v = await handler();
+            if (v === undefined || v === null)
+                return;
+            item.badge = String(v);
+        }
+        catch {
+            // Per-badge errors stay silent.
+        }
+    }));
+    return nestAndSort(raw);
+}
+/**
+ * Resolve `parent` references → nest, drop cycles, sort within each
+ * grouping, then strip internal scaffolding (`parent`, `_idx`).
+ */
+function nestAndSort(raw) {
+    const byName = new Map();
+    for (const it of raw)
+        byName.set(it.name, it);
+    // Detect parent cycles: walk upwards from each item; any name seen
+    // twice → cycle. Items in a cycle get treated as top-level.
+    const inCycle = new Set();
+    for (const it of raw) {
+        if (it.parent === undefined)
+            continue;
+        const seen = new Set([it.name]);
+        let cur = it.parent;
+        while (cur !== undefined) {
+            if (seen.has(cur)) {
+                if (typeof console !== 'undefined' && typeof console.warn === 'function') {
+                    console.warn(`[Pilotiq] navigationParentItem cycle detected at "${it.name}" — rendering at top level.`);
+                }
+                inCycle.add(it.name);
+                break;
+            }
+            seen.add(cur);
+            const parent = byName.get(cur);
+            if (!parent)
+                break;
+            cur = parent.parent;
+        }
+    }
+    const childrenOf = new Map();
+    const top = [];
+    for (const it of raw) {
+        const parent = it.parent;
+        if (parent && byName.has(parent) && !inCycle.has(it.name)) {
+            const list = childrenOf.get(parent) ?? [];
+            list.push(it);
+            childrenOf.set(parent, list);
+        }
+        else {
+            top.push(it);
+        }
+    }
+    // Sort items in a sibling group by sort (asc), ties → registration order.
+    const sortItems = (items) => {
+        return [...items].sort((a, b) => {
+            const aHas = a.sort !== undefined, bHas = b.sort !== undefined;
+            if (aHas && bHas)
+                return a.sort - b.sort || a._idx - b._idx;
+            if (aHas)
+                return -1; // sorted items come before unsorted
+            if (bHas)
+                return 1;
+            return a._idx - b._idx;
+        });
+    };
+    // Strip internals + recurse into children.
+    const finalize = (items) => sortItems(items).map(it => {
+        const kids = childrenOf.get(it.name);
+        const { parent, _idx, ...rest } = it;
+        const out = { ...rest };
+        if (kids && kids.length > 0)
+            out.children = finalize(kids);
+        return out;
+    });
+    return finalize(top);
+}
+export async function callPageSchema(PageClass, ctx) {
+    return Promise.resolve(PageClass.schema(ctx));
+}
+/** Mark every Form on the page with its action URL so the rendered <form> posts to itself. */
+export function tagFormActions(elements, action) {
+    for (const form of findForms(elements)) {
+        if (!form.getAction())
+            form.action(action);
+    }
+}
+/**
+ * Plan #5 — stamp the partial-resolve endpoint URL on every form whose
+ * descendants include at least one `live()` field. The client uses
+ * `FormMeta.stateUrl` to flip into controlled-state mode; forms without
+ * any live fields stay uncontrolled (zero-cost legacy path).
+ *
+ * `urlBuilder(formId)` lets the caller compose a per-form URL — the
+ * endpoint shape is `${base}/${slug}/_form/${formId}/state` so each
+ * form on a multi-form page gets its own route segment.
+ */
+export function tagFormStateUrls(elements, urlBuilder) {
+    for (const form of findForms(elements)) {
+        if (formHasLiveField(form)) {
+            form.withStateUrl(urlBuilder(form.getFormId()));
+        }
+    }
+}
+/**
+ * Reorderable rows — stamp the POST-reorder URL on every `Table` that
+ * has `Table.reorderable()` set. The renderer reads `TableMeta.reorderUrl`
+ * to wire the drop handler; tables that aren't reorderable skip wiring
+ * entirely. Same shape as `tagFormStateUrls` so the call site stays
+ * consistent.
+ */
+export function tagTableReorderUrls(elements, url) {
+    for (const table of findTables(elements)) {
+        if (table.isReorderable() && !table.getReorderUrl()) {
+            table.withReorderUrl(url);
+        }
+    }
+}
+// Marks every Table on the page deferred and stamps the URL the
+// renderer will fetch from after mount. Must run BEFORE `loadTableRecords`
+// so the records handler short-circuits.
+export function tagTableDeferred(elements, url) {
+    for (const table of findTables(elements)) {
+        table.withDeferred(true);
+        table.withTableUrl(url);
+    }
+}
+/**
+ * Editable cell columns — walk every table on the page and stamp
+ * `_cellEditUrls[colName]` per row, but only on rows that already
+ * carry a `_cellEditable[colName]` marker (set by `loadTableRecords`
+ * after `R.canEdit(user, row)` passed). The dispatcher stays
+ * URL-shape-agnostic; URL building lives here parallel to
+ * `tagFormStateUrls / tagTableReorderUrls`.
+ *
+ * `idOf` extracts the per-row primary key. Defaults to reading `id` —
+ * works for the rudder ORM convention. Resources with a different
+ * primary-key column should pass an override (none in v1).
+ */
+export function tagCellEditUrls(elements, resourceUrl, idOf = row => row['id']) {
+    for (const table of findTables(elements)) {
+        const rows = table.getRows();
+        if (!rows || rows.length === 0)
+            continue;
+        // Optimisation: skip the table when none of its columns are editable.
+        const editable = (table.getChildren() ?? []).some(c => c instanceof Column && c.isEditable());
+        if (!editable)
+            continue;
+        for (const row of rows) {
+            const editableMap = row['_cellEditable'];
+            if (!editableMap)
+                continue;
+            const id = idOf(row);
+            if (id === undefined || id === null || id === '')
+                continue;
+            const urls = {};
+            for (const colName of Object.keys(editableMap)) {
+                urls[colName] = `${resourceUrl}/${encodeURIComponent(String(id))}/_cell/${encodeURIComponent(colName)}`;
+            }
+            ;
+            row['_cellEditUrls'] = urls;
+        }
+    }
+}
+/**
+ * Plan #8 — stamp the wizard step-validate endpoint URL on every form
+ * whose descendants include a `Wizard` element. `FormMeta.wizardUrl` is
+ * what the client posts to on Next-button clicks; forms without a wizard
+ * descendant skip wiring.
+ */
+export function tagFormWizardUrls(elements, urlBuilder) {
+    for (const form of findForms(elements)) {
+        if (formHasWizard(form)) {
+            form.withWizardUrl(urlBuilder(form.getFormId()));
+        }
+    }
+}
+/**
+ * Audit row 2026-05-07 cont'd⁸ — stamp the inline-create-option endpoint
+ * URL on every `SelectField` that has called `createOptionForm()`. Walks
+ * every form on the page so the URL carries the parent form's id; URL
+ * shape `${formScopeUrl}/_form/${formId}/create-option/${fieldName}` so
+ * the route handler can pick the form by id and the field by name.
+ *
+ * Mirrors `tagFormStateUrls / tagFormWizardUrls` — operates on the
+ * un-resolved Element tree, mutates field-instance state via
+ * `field.withCreateOptionUrl(url)`, and the field's `toMeta()` reads it
+ * back to emit `createOption.url`.
+ *
+ * Stops at Repeater / Builder boundaries (parallel to the form-state /
+ * wizard walkers): inside-row schemas are dispatched per-row and the
+ * createOption shape doesn't compose with row body coercion in v1.
+ */
+export function tagSelectCreateOptionUrls(elements, urlBuilder) {
+    for (const form of findForms(elements)) {
+        const formId = form.getFormId();
+        walkSelectFields(form.getChildren() ?? [], (field) => {
+            if (field.hasCreateOption() && !field.getCreateOptionUrl()) {
+                field.withCreateOptionUrl(urlBuilder(formId, field.name));
+            }
+        });
+    }
+}
+function walkSelectFields(elements, visit) {
+    for (const el of elements) {
+        if (el instanceof SelectField) {
+            visit(el);
+            // SelectField has no children of its own — no recursion needed.
+            continue;
+        }
+        // Stop at row-array boundaries — see comment on `tagSelectCreateOptionUrls`.
+        if (el instanceof RepeaterField)
+            continue;
+        if (el instanceof BuilderField)
+            continue;
+        const children = el.getChildren();
+        if (children && children.length > 0)
+            walkSelectFields(children, visit);
+    }
+}
+function isAsyncMentionField(el) {
+    if (el.getType() !== 'richtext')
+        return false;
+    const candidate = el;
+    return typeof candidate.hasAsyncMentions === 'function'
+        && typeof candidate.withMentionsUrl === 'function';
+}
+export function tagRichTextMentionUrls(elements, urlBuilder) {
+    for (const form of findForms(elements)) {
+        const url = urlBuilder(form.getFormId());
+        let stampedAny = false;
+        const visit = (els) => {
+            for (const el of els) {
+                // Don't cross into nested forms — each form gets its own URL.
+                if (el !== form && el.getType() === 'form')
+                    continue;
+                if (isAsyncMentionField(el) && el.hasAsyncMentions()) {
+                    el.withMentionsUrl(url);
+                    stampedAny = true;
+                }
+                // Builder.getChildren() returns undefined to keep the field-level
+                // walkers from treating heterogeneous rows as flat children. Manual
+                // descent into each block's schema covers the URL-stamping path
+                // without changing the no-cross posture for save/coerce.
+                if (isBuilderField(el)) {
+                    for (const block of el.getBlocks())
+                        visit(block.getSchema());
+                    continue;
+                }
+                const children = el.getChildren();
+                if (children)
+                    visit(children);
+            }
+        };
+        const children = form.getChildren();
+        if (children)
+            visit(children);
+        void stampedAny; // silence unused — kept locally for readability
+    }
+}
+function formHasLiveField(form) {
+    let found = false;
+    const visit = (els) => {
+        for (const el of els) {
+            if (found)
+                return;
+            // Either a server-side `live()` (drives a roundtrip) OR a
+            // client-side `afterStateUpdatedJs(body)` (JS-only) is enough to
+            // mount the controlled-form path: the FormStateProvider holds the
+            // values map either path needs, and the client gates the actual
+            // network POST on `live` separately. Cost of the over-stamp for
+            // JS-only forms is one unused endpoint URL per form — endpoint
+            // never gets hit because the client only POSTs on `live`.
+            if (el instanceof Field && (el.isLive() || el.getAfterStateUpdatedJs() !== undefined)) {
+                found = true;
+                return;
+            }
+            const children = el.getChildren();
+            if (children)
+                visit(children);
+        }
+    };
+    const children = form.getChildren();
+    if (children)
+        visit(children);
+    return found;
+}
+function formHasWizard(form) {
+    let found = false;
+    const visit = (els) => {
+        for (const el of els) {
+            if (found)
+                return;
+            if (el.getType() === 'wizard') {
+                found = true;
+                return;
+            }
+            const children = el.getChildren();
+            if (children)
+                visit(children);
+        }
+    };
+    const children = form.getChildren();
+    if (children)
+        visit(children);
+    return found;
+}
+/**
+ * Run the edit-mode fill pipeline on a loaded record:
+ *   mutateFormDataBeforeFill  →  fillFromRecord  →  mutateFormDataAfterFill
+ *
+ * `fillFromRecord` defaults to `{ ...record }` when not configured. Both
+ * mutators are optional and may be async. `ctx.record` is the loaded
+ * record so mutators can read from fields the form doesn't surface.
+ */
+export async function applyFillPipeline(form, record) {
+    const recordObj = record;
+    let values = { ...recordObj };
+    const before = form.getMutateFormDataBeforeFill();
+    if (before)
+        values = await before(values, { values, record });
+    const fill = form.getFillFromRecord();
+    if (fill)
+        values = fill(record);
+    const after = form.getMutateFormDataAfterFill();
+    if (after)
+        values = await after(values, { values, record });
+    return values;
+}
+/**
+ * Walk the form's top-level Repeaters and replace `values[fieldName]`
+ * with rows fetched from `parent.related(name)` for any
+ * relationship-backed Repeater. Each loaded row stamps `__id` to the
+ * child's primary key so the renderer can round-trip identity through
+ * a hidden input and the save-side diff can match submitted rows back
+ * to existing records.
+ *
+ * No-op when the parent record is null (create mode), when no
+ * relationship-backed Repeaters exist on the form, or when the
+ * resource has no `R.model` (relation queries need it).
+ *
+ * Mutates and returns a fresh values object — never the input.
+ */
+export async function applyRelationshipRepeaterFill(form, values, record, parentModel) {
+    if (record == null)
+        return values;
+    if (!parentModel)
+        return values;
+    const repeaters = findRelationshipRepeaters(form.getChildren() ?? []);
+    if (repeaters.length === 0)
+        return values;
+    const out = { ...values };
+    for (const repeater of repeaters) {
+        const cfg = repeater.getRelationship();
+        const pivotColumns = cfg.pivotColumns;
+        let rows;
+        try {
+            rows = await loadRelationRows(parentModel, record, cfg.name, pivotColumns);
+        }
+        catch {
+            // Failed lookup (e.g. missing `relations` map on a test stub)
+            // — fall back to whatever value applyFillPipeline produced
+            // rather than wiping the field. Better to render stale data
+            // than to silently empty the row list.
+            continue;
+        }
+        // The child model is opaque here — we don't have the full
+        // descriptor at this seam, so use the configured override or
+        // peek the parent's relations map for the FK column. Strip it
+        // (and the PK) from each row's payload so the inner schema
+        // doesn't surface them as form values. For morphMany the
+        // attachment is two columns instead of one — strip both.
+        const pkColumn = pickChildPrimaryKey(parentModel, cfg.name) ?? 'id';
+        const fkColumn = cfg.foreignKey ?? pickChildForeignKey(parentModel, cfg.name);
+        const morph = getMorphRelationDescriptor(parentModel, cfg.name);
+        const morphIdCol = morph ? `${morph.morphName}Id` : undefined;
+        const morphTyCol = morph ? `${morph.morphName}Type` : undefined;
+        out[repeater.name] = rows.map(row => {
+            const r = (row && typeof row === 'object') ? { ...row } : {};
+            const pkValue = r[pkColumn];
+            delete r[pkColumn];
+            if (fkColumn)
+                delete r[fkColumn];
+            if (morphIdCol)
+                delete r[morphIdCol];
+            if (morphTyCol)
+                delete r[morphTyCol];
+            // M2M pivot extras — flatten `row.pivot[col]` onto the row's data
+            // so each pivot column round-trips through the inner schema as a
+            // regular form field. The pivot envelope itself is dropped from
+            // the values shape — the persist side splits pivot vs child
+            // columns by name lookup against `cfg.pivotColumns`.
+            const pivotEnvelope = r['pivot'];
+            delete r['pivot'];
+            const stamped = { ...r };
+            if (pivotColumns && pivotColumns.length > 0
+                && pivotEnvelope && typeof pivotEnvelope === 'object') {
+                const pe = pivotEnvelope;
+                for (const col of pivotColumns) {
+                    if (col in pe)
+                        stamped[col] = pe[col];
+                }
+            }
+            if (pkValue !== undefined && pkValue !== null) {
+                stamped['__id'] = String(pkValue);
+            }
+            return stamped;
+        });
+    }
+    return out;
+}
+/** Walk the form's children for top-level relationship-backed Repeaters. */
+function findRelationshipRepeaters(elements) {
+    const out = [];
+    const walk = (els) => {
+        for (const el of els) {
+            if (isRepeaterField(el)) {
+                const r = el;
+                if (r.getRelationship())
+                    out.push(r);
+                // Don't dive into Repeater children — relationship-on-relationship
+                // isn't supported in v1.
+                continue;
+            }
+            // Don't dive into Builder children either — relationship-backed
+            // Builders are resolved separately by `findRelationshipBuilders`.
+            if (isBuilderField(el))
+                continue;
+            const children = el.getChildren();
+            if (children && children.length > 0)
+                walk(children);
+        }
+    };
+    walk(elements);
+    return out;
+}
+/**
+ * Walk the form's top-level Builders and replace `values[fieldName]` with
+ * rows fetched from `parent.related(name)` for any relationship-backed
+ * Builder. Each loaded row stamps `__id` (child PK) + `type` (block
+ * discriminator) + `data` (per-block JSON payload) so the renderer can
+ * round-trip the heterogeneous envelope.
+ *
+ * Mirrors `applyRelationshipRepeaterFill`. No-op when the parent record
+ * is null (create mode), the resource has no `R.model`, or no
+ * relationship-backed Builders exist on the form.
+ */
+export async function applyRelationshipBuilderFill(form, values, record, parentModel) {
+    if (record == null)
+        return values;
+    if (!parentModel)
+        return values;
+    const builders = findRelationshipBuilders(form.getChildren() ?? []);
+    if (builders.length === 0)
+        return values;
+    const out = { ...values };
+    for (const builder of builders) {
+        const cfg = builder.getRelationship();
+        let rows;
+        try {
+            rows = await loadRelationRows(parentModel, record, cfg.name);
+        }
+        catch {
+            // Failed lookup (e.g. missing `relations` map on a test stub) —
+            // fall back to whatever value applyFillPipeline produced rather
+            // than wiping the field. Better stale than silently empty.
+            continue;
+        }
+        const pkColumn = pickChildPrimaryKey(parentModel, cfg.name) ?? 'id';
+        const fkColumn = cfg.foreignKey ?? pickChildForeignKey(parentModel, cfg.name);
+        const typeColumn = cfg.typeColumn ?? 'type';
+        const dataColumn = cfg.dataColumn ?? 'data';
+        out[builder.name] = rows.map(row => {
+            const r = (row && typeof row === 'object') ? { ...row } : {};
+            const pkValue = r[pkColumn];
+            const blockType = typeof r[typeColumn] === 'string' ? r[typeColumn] : '';
+            const dataRaw = r[dataColumn];
+            const blockData = parseBuilderDataPayload(dataRaw);
+            const stamped = {
+                type: blockType,
+                data: blockData,
+            };
+            if (pkValue !== undefined && pkValue !== null) {
+                stamped['__id'] = String(pkValue);
+            }
+            // Non-`type` / `data` / FK / PK columns aren't surfaced — the
+            // JSON envelope is the source of truth for per-block fields. If
+            // a user denormalizes a column, they handle it via per-block
+            // mutate hooks, not by leaking the column into row values.
+            void fkColumn;
+            return stamped;
+        });
+    }
+    return out;
+}
+/**
+ * Normalize the JSON payload column into a plain object. Prisma
+ * hydrates `Json` columns to objects; some adapters return strings.
+ * Anything that isn't a parseable object falls back to `{}` so the
+ * inner schema renders fresh defaults.
+ */
+function parseBuilderDataPayload(raw) {
+    if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+        return raw;
+    }
+    if (typeof raw === 'string') {
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+        catch {
+            // fall through to {}
+        }
+    }
+    return {};
+}
+/** Walk the form's children for top-level relationship-backed Builders. */
+function findRelationshipBuilders(elements) {
+    const out = [];
+    const walk = (els) => {
+        for (const el of els) {
+            if (isBuilderField(el)) {
+                const b = el;
+                if (b.getRelationship())
+                    out.push(b);
+                continue;
+            }
+            // Don't dive into Repeater children either — both array-row
+            // boundaries are walker stops here.
+            if (isRepeaterField(el))
+                continue;
+            const children = el.getChildren();
+            if (children && children.length > 0)
+                walk(children);
+        }
+    };
+    walk(elements);
+    return out;
+}
+/** Read the child model's PK column from the parent's relations map, when present. */
+function pickChildPrimaryKey(parentModel, name) {
+    const relations = parentModel['relations'];
+    if (!relations || typeof relations !== 'object')
+        return undefined;
+    const entry = relations[name];
+    if (!entry || typeof entry !== 'object')
+        return undefined;
+    const e = entry;
+    if (typeof e['model'] !== 'function')
+        return undefined;
+    try {
+        const child = e['model']();
+        return getPrimaryKey(child);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Read the FK column from the parent's relations map, when present. */
+function pickChildForeignKey(parentModel, name) {
+    const relations = parentModel['relations'];
+    if (!relations || typeof relations !== 'object')
+        return undefined;
+    const entry = relations[name];
+    if (!entry || typeof entry !== 'object')
+        return undefined;
+    const e = entry;
+    return typeof e['foreignKey'] === 'string' ? e['foreignKey'] : undefined;
+}
+/**
+ * Plan #15 — collect every `ServerDataElement` in the schema tree and
+ * resolve their `getServerData(ctx)` payloads in parallel. Returns a
+ * map keyed by element id, ready to ship as `viewProps._widgetData`.
+ *
+ * Lazy elements (default — `lazy(false)` opts out) skip the hook and
+ * stamp `null` so the renderer paints a skeleton and fetches the
+ * payload via `POST {base}/_widget/:id` on mount. Eager elements
+ * resolve synchronously and ship the data with the page.
+ *
+ * Per-widget errors are caught and surfaced as `{ error: '...' }` —
+ * one flaky `getStats()` shouldn't 500 the entire dashboard.
+ *
+ * Visibility is **not** re-evaluated here. The schema resolver
+ * (`resolveSchema → evaluateVisibility`) drops hidden layout elements
+ * before any widget code runs. Widgets inside still-rendered branches
+ * always resolve (or stamp lazy null).
+ */
+export async function resolveServerDataElements(elements, ctx) {
+    const widgets = collectServerDataElements(elements);
+    if (widgets.length === 0)
+        return {};
+    const out = {};
+    await Promise.all(widgets.map(async (el) => {
+        const id = el.getId();
+        if (el.isLazy()) {
+            out[id] = null; // sentinel — renderer paints skeleton, fetches on mount
+            return;
+        }
+        try {
+            out[id] = await el.resolveServerData(ctx);
+        }
+        catch (err) {
+            out[id] = { error: err instanceof Error ? err.message : 'Widget failed to load' };
+        }
+    }));
+    return out;
+}
+/** Walk the tree collecting every `ServerDataElement`. Walks into
+ *  containers but stops at Form/Repeater/Builder boundaries — widgets
+ *  inside an editable form don't make sense in v1. */
+function collectServerDataElements(elements) {
+    const out = [];
+    const walk = (els) => {
+        for (const el of els) {
+            if (isServerDataElement(el)) {
+                out.push(el);
+                // Don't recurse into a widget's children — `View` etc. are leaves
+                // for v1 (no nested widgets inside widgets).
+                continue;
+            }
+            // Skip walkers that imply per-row resolution — widgets inside
+            // Repeater/Builder rows don't have a stable id space.
+            const type = el.getType();
+            if (type === 'form' || type === 'repeater' || type === 'builder' || type === 'table' || type === 'tableWidget')
+                continue;
+            const children = el.getChildren();
+            if (children)
+                walk(children);
+        }
+    };
+    walk(elements);
+    return out;
+}
+/**
+ * Plan #15 — stamp the polling-endpoint URL on every `ServerDataElement`
+ * in the tree. Mirrors `tagFormStateUrls / tagTableReorderUrls`. Walks
+ * with the same boundaries as `collectServerDataElements` so the wire
+ * stays in sync (no orphan widgets without URLs and vice versa).
+ *
+ * `urlBuilder(id)` typically produces `${base}/_widget/${id}` for
+ * dashboard widgets and `${base}/${pageSlug}/_widget/${id}` for
+ * custom-page widgets — the route handlers for both shapes are wired up
+ * in `routes.ts` (see Phase A.4).
+ */
+export function tagWidgetUrls(elements, urlBuilder) {
+    for (const widget of collectServerDataElements(elements)) {
+        if (widget.getWidgetUrl())
+            continue; // user-set wins
+        widget.withWidgetUrl(urlBuilder(widget.getId()));
+    }
+}
+/** Stamp dispatchUrl on every handler-style Action so the client knows where to POST. */
+export function tagActionDispatch(elements, baseUrl) {
+    for (const action of findActions(elements)) {
+        if (!action.getHandler())
+            continue;
+        if (action.getHref() || action.getMethod())
+            continue;
+        if (action.getDispatchUrl())
+            continue;
+        action.dispatchUrl(`${baseUrl}/_action/${action.name}`);
+    }
+    // Row-scoped extraItemActions (Repeater/Builder). Stamped here too so
+    // the client can POST to the same `_action/:name` route — the renderer
+    // attaches `_rowPath=<fieldName>.<index>` per click; the server's
+    // dispatcher uses that to walk into the right row when building
+    // `ctx.row`. See `findRowExtraActions` in `dispatchAction.ts`.
+    for (const { action } of findRowExtraActions(elements)) {
+        if (!action.getHandler())
+            continue;
+        if (action.getDispatchUrl())
+            continue;
+        action.dispatchUrl(`${baseUrl}/_action/${action.name}`);
+    }
+}
+// ─── Per-role data builders ──────────────────────────────────
+export async function dashboardData(pilotiq, req) {
+    const cfg = pilotiq.getConfig();
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({ basePath: cfg.path }, user), cfg);
+    // Plan #15 — when `panel.dashboard(P)` was called, resolve P's
+    // schema instead of the builder-level `cfg.schema`. Page-scoped
+    // schema means widget elements read like a regular custom page —
+    // including action dispatch, form-state, and `_widget/:id` polling.
+    let elements;
+    if (cfg.dashboardPage) {
+        elements = await callPageSchema(cfg.dashboardPage, ctx);
+        tagFormActions(elements, cfg.path);
+        tagFormStateUrls(elements, formId => `${cfg.path}/_form/${formId}/state`);
+        tagFormWizardUrls(elements, formId => `${cfg.path}/_form/${formId}/wizard`);
+        tagRichTextMentionUrls(elements, formId => `${cfg.path}/_form/${formId}/mentions`);
+        tagSelectCreateOptionUrls(elements, (formId, fieldName) => `${cfg.path}/_form/${formId}/create-option/${fieldName}`);
+        tagActionDispatch(elements, cfg.path);
+    }
+    else {
+        elements = [];
+        if (cfg.schema) {
+            const def = cfg.schema;
+            elements = typeof def === 'function' ? await def(ctx) : def;
+        }
+    }
+    // Stamp polling URLs on every widget — panel-scope (no pageSlug
+    // segment) for the dashboard. Done before schema resolve so the URL
+    // rides on each widget's stamped meta.
+    tagWidgetUrls(elements, id => `${cfg.path}/_widget/${id}`);
+    const widgetData = await resolveServerDataElements(elements, ctx);
+    const dashRoute = cfg.dashboardPage ? { page: cfg.dashboardPage } : {};
+    const schemaData = await applyRoleHooks(pilotiq, user, 'dashboard', await resolveSchema(elements, ctx), dashRoute);
+    return {
+        panel: await panelInfo(pilotiq, req, dashRoute),
+        page: cfg.dashboardPage ? cfg.dashboardPage.toMeta() : undefined,
+        basePath: cfg.path,
+        layout: cfg.layout,
+        schemaData,
+        _widgetData: widgetData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+export async function resourceIndexData(pilotiq, slug, query = {}, req) {
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === slug);
+    if (!R)
+        return null;
+    const pages = R.resolvePages();
+    if (!pages.index)
+        return null;
+    const PageClass = pages.index;
+    const indexUrl = resourceBasePath(cfg.path, R);
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({ mode: 'table', basePath: cfg.path }, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    tagActionDispatch(elements, indexUrl);
+    // Plan #15 — resource-scope widget polling URL. Stamped before the
+    // schema resolves so each widget's meta carries its endpoint.
+    tagWidgetUrls(elements, id => `${indexUrl}/_widget/${id}`);
+    // Mark the active tab + parallel-eval badges + stamp per-tab URLs
+    // before the table records run — `loadTableRecords` walks the schema
+    // for the active tab and splices its `modifyQuery` predicate into the
+    // ORM chain alongside filters.
+    await resolveActiveTab(elements, query, indexUrl);
+    if (R.deferLoading)
+        tagTableDeferred(elements, `${indexUrl}/_table`);
+    await loadTableRecords(elements, query, indexUrl, user, {
+        canEdit: (u, record) => R.canEdit(u, record),
+    });
+    tagTableReorderUrls(elements, `${indexUrl}/_reorder`);
+    tagCellEditUrls(elements, indexUrl);
+    const widgetData = await resolveServerDataElements(elements, ctx);
+    const breadcrumbs = resourceListBreadcrumbs(cfg, R);
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const listRoute = { resource: R, page: PageClass };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'list', await resolveSchema(elements, ctx), listRoute);
+    return {
+        pageType: 'resource',
+        panel: await panelInfo(pilotiq, req, listRoute),
+        page: PageClass.toMeta(),
+        resource: { name: R.name, label: R.label, labelSingular: R.labelSingular, slug, icon: serializeIcon(R.icon, R.name) },
+        basePath: cfg.path,
+        layout: cfg.layout,
+        schemaData,
+        _widgetData: widgetData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+// Deferred-load JSON endpoint payload — `GET {base}/{slug}/_table`
+// re-runs the list-page builder without the deferred flag, then returns
+// every resolved `TableMeta` as a flat array. Returns null on missing
+// resource / index page (route 404s).
+export async function resourceTableData(pilotiq, slug, query = {}, req) {
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === slug);
+    if (!R)
+        return null;
+    const pages = R.resolvePages();
+    if (!pages.index)
+        return null;
+    const PageClass = pages.index;
+    const indexUrl = resourceBasePath(cfg.path, R);
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({ mode: 'table', basePath: cfg.path }, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    tagActionDispatch(elements, indexUrl);
+    await resolveActiveTab(elements, query, indexUrl);
+    await loadTableRecords(elements, query, indexUrl, user, {
+        canEdit: (u, record) => R.canEdit(u, record),
+    });
+    tagTableReorderUrls(elements, `${indexUrl}/_reorder`);
+    tagCellEditUrls(elements, indexUrl);
+    const schemaData = await resolveSchema(elements, ctx);
+    const tables = collectTableMetas(schemaData);
+    return { tables };
+}
+function collectTableMetas(metas) {
+    const out = [];
+    const walk = (nodes) => {
+        for (const node of nodes) {
+            if (node['type'] === 'table')
+                out.push(node);
+            const children = node['children'];
+            if (Array.isArray(children))
+                walk(children);
+        }
+    };
+    walk(metas);
+    return out;
+}
+/**
+ * Walk the schema for `ListTabs` containers, pick the active tab from
+ * `?tab=…` (defaulting to the tab marked `.default()` or the first one),
+ * stamp render-time state (`active` flag, per-tab `?tab=` URL, and
+ * resolved badge counts) onto each tab. The active tab's query/context
+ * modifier is NOT applied here — `loadTableRecords` walks for the active
+ * tab and splices in its modifier when it builds the records-handler
+ * `TableContext`.
+ *
+ * No-op when the page has no `ListTabs`.
+ */
+export async function resolveActiveTab(elements, query, currentPath) {
+    const listTabs = findListTabs(elements);
+    if (listTabs.length === 0)
+        return;
+    for (const container of listTabs) {
+        const children = (container.getChildren() ?? []).filter((c) => c.getType() === 'listTab');
+        if (children.length === 0)
+            continue;
+        // Default tab (used both for `?tab=` fallback and to omit the param
+        // from the canonical URL of that tab — see `buildTabUrl`).
+        const defaultTab = children.find(t => t.isDefault()) ?? children[0];
+        // Active tab: explicit `?tab=name` → default tab.
+        const wanted = typeof query['tab'] === 'string' ? query['tab'] : undefined;
+        const active = (wanted && children.find(t => t.name === wanted)) || defaultTab;
+        // Stamp render-time state on each tab.
+        children.forEach(t => {
+            t.withActive(t === active);
+            t.withUrl(buildTabUrl(currentPath, query, t.name, defaultTab.name));
+        });
+        // Resolve every tab's badge in parallel — failed handlers swallow
+        // silently (badge omitted) so a flaky count never blanks the page.
+        await Promise.all(children.map(async (tab) => {
+            const handler = tab.getBadgeHandler();
+            if (!handler)
+                return;
+            try {
+                const v = await handler();
+                if (v === undefined || v === null)
+                    return;
+                tab.withResolvedBadge(String(v));
+            }
+            catch {
+                // Per-tab badge errors stay silent.
+            }
+        }));
+    }
+}
+function findListTabs(elements) {
+    const out = [];
+    const walk = (els) => {
+        for (const el of els) {
+            if (el.getType() === 'listTabs')
+                out.push(el);
+            const children = el.getChildren();
+            if (children)
+                walk(children);
+        }
+    };
+    walk(elements);
+    return out;
+}
+function buildTabUrl(pathname, query, tabName, defaultTabName) {
+    // Carry forward search/sort/perPage + any filter values; reset page to 1
+    // (tab change reshapes the result set, page numbers don't translate).
+    // The default tab gets the canonical, paramless URL — visiting that URL
+    // already lands on the default, so emitting `?tab=default` would just be
+    // noise that bookmarks/share-links pick up.
+    const params = new URLSearchParams();
+    for (const [k, v] of Object.entries(query)) {
+        if (v === undefined || v === '' || v === null)
+            continue;
+        if (k === 'tab' || k === 'page')
+            continue;
+        params.set(k, String(v));
+    }
+    if (tabName !== defaultTabName)
+        params.set('tab', tabName);
+    const qs = params.toString();
+    return qs ? `${pathname}?${qs}` : pathname;
+}
+export async function resourceCreateData(pilotiq, slug, prefill, req) {
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === slug);
+    if (!R)
+        return null;
+    const pages = R.resolvePages();
+    if (!pages.create)
+        return null;
+    const PageClass = pages.create;
+    const resourceBase = resourceBasePath(cfg.path, R);
+    const createUrl = `${resourceBase}/create`;
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({ mode: 'create', basePath: cfg.path }, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    tagFormActions(elements, createUrl);
+    tagActionDispatch(elements, createUrl);
+    tagFormStateUrls(elements, formId => `${resourceBase}/_form/${formId}/state`);
+    tagFormWizardUrls(elements, formId => `${resourceBase}/_form/${formId}/wizard`);
+    tagRichTextMentionUrls(elements, formId => `${resourceBase}/_form/${formId}/mentions`);
+    tagSelectCreateOptionUrls(elements, (formId, fieldName) => `${resourceBase}/_form/${formId}/create-option/${fieldName}`);
+    if (prefill) {
+        const form = findForms(elements)[0];
+        if (form) {
+            if (prefill.values)
+                form.withValues(prefill.values);
+            if (prefill.errors)
+                form.withErrors(prefill.errors);
+        }
+    }
+    const breadcrumbs = resourceCreateBreadcrumbs(cfg, R);
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const createRoute = { resource: R, page: PageClass };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'create', await resolveSchema(elements, ctx), createRoute);
+    return {
+        panel: await panelInfo(pilotiq, req, createRoute),
+        page: PageClass.toMeta(),
+        resource: { name: R.name, label: R.labelSingular, slug, icon: serializeIcon(R.icon, R.name) },
+        mode: 'create',
+        basePath: cfg.path,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+        ...(prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+export async function resourceEditData(pilotiq, slug, recordId, prefill, req) {
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === slug);
+    if (!R)
+        return null;
+    const pages = R.resolvePages();
+    if (!pages.edit)
+        return null;
+    const PageClass = pages.edit;
+    const resourceBase = resourceBasePath(cfg.path, R);
+    const editUrl = `${resourceBase}/${recordId}/edit`;
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({ mode: 'edit', recordId, basePath: cfg.path }, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    tagFormActions(elements, editUrl);
+    tagActionDispatch(elements, editUrl);
+    tagFormStateUrls(elements, formId => `${resourceBase}/${recordId}/_form/${formId}/state`);
+    tagFormWizardUrls(elements, formId => `${resourceBase}/${recordId}/_form/${formId}/wizard`);
+    tagRichTextMentionUrls(elements, formId => `${resourceBase}/${recordId}/_form/${formId}/mentions`);
+    tagSelectCreateOptionUrls(elements, (formId, fieldName) => `${resourceBase}/${recordId}/_form/${formId}/create-option/${fieldName}`);
+    // Locate the primary form, load the record, fill values.
+    const form = findForms(elements)[0];
+    let record = undefined;
+    if (form?.getLoadRecord()) {
+        try {
+            record = await form.getLoadRecord()(recordId, { values: prefill?.values ?? {} });
+        }
+        catch {
+            // sentinel/missing record — fall through
+        }
+        if (!prefill?.values && record != null) {
+            const values = await applyFillPipeline(form, record);
+            const withRelations = await applyRelationshipRepeaterFill(form, values, record, R.model);
+            const withBuilders = await applyRelationshipBuilderFill(form, withRelations, record, R.model);
+            form.withValues(withBuilders);
+        }
+        else if (prefill?.values) {
+            form.withValues(prefill.values);
+        }
+        if (prefill?.errors)
+            form.withErrors(prefill.errors);
+    }
+    // Plan #11 — when the resource has relation managers, prepend a
+    // navigation strip so users can drill into each manager's table
+    // without leaving the parent record context. The "Edit" tab is
+    // active here.
+    const relationTabsEl = buildRelationTabs(R, recordId, cfg.path, '__edit');
+    if (relationTabsEl)
+        elements.unshift(relationTabsEl);
+    const recordTitle = record !== undefined && record !== null
+        ? deriveParentTitle(R, record)
+        : recordId;
+    const breadcrumbs = resourceEditBreadcrumbs(cfg, R, recordId, recordTitle);
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const editRoute = { resource: R, page: PageClass, recordId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'edit', await resolveSchema(elements, record !== undefined ? { ...ctx, record } : ctx), editRoute);
+    return {
+        panel: await panelInfo(pilotiq, req, editRoute),
+        page: PageClass.toMeta(),
+        resource: { name: R.name, label: R.labelSingular, slug, icon: serializeIcon(R.icon, R.name) },
+        mode: 'edit',
+        recordId,
+        basePath: cfg.path,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+        ...(prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+/**
+ * Discover the related Resource for a manager. Order:
+ *   1. `M.relatedResource` explicit override (skip discovery).
+ *   2. Rudder ORM convention: walk
+ *      `R.model.relations[manager.relationship].model()` and find
+ *      `cfg.resources[i].model === relatedModel`.
+ *   3. Otherwise undefined — caller must error or fall back.
+ *
+ * A returned Resource is the one whose `model` backs the related
+ * table. Callers use it for `Related.model.find(childId)`,
+ * `Related.canEdit(user, child)`, and the auto-wired form save handler.
+ */
+export function findRelatedResource(M, R, cfg) {
+    if (M.relatedResource)
+        return M.relatedResource;
+    const ParentModel = R.model;
+    if (!ParentModel)
+        return undefined;
+    const def = ParentModel.relations?.[M.getRelationship()];
+    const RelatedModel = typeof def?.model === 'function' ? def.model() : undefined;
+    if (!RelatedModel)
+        return undefined;
+    return cfg.resources.find(r => r.model === RelatedModel);
+}
+/** Find a registered manager on a Resource by its relationship key.
+ *  Throws on unknown manager — so the route can 404 cleanly. */
+function findManager(R, relationship) {
+    return R.relations().find(M => {
+        try {
+            return M.getRelationship() === relationship;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Verify a child record actually belongs to the given parent under the
+ * declared relationship. Anti-IDOR — without this an attacker can swap
+ * the `:childId` segment to load any related-model row regardless of
+ * whether it's actually owned by the parent.
+ *
+ * Strategy: re-resolve the parent's relation query and check whether
+ * the child's primary key shows up in `where(pk, '=', childId).paginate(1, 1)`.
+ * Yes, it's a second round-trip — but it's the single point of trust
+ * for IDOR safety, and it fits naturally into the same query path
+ * `modelRelationTableRecords` uses.
+ */
+async function childBelongsToParent(parentModel, parent, relationship, childPk, childId) {
+    try {
+        const q = (parentModel.relatedQuery
+            ? parentModel.relatedQuery(parent, relationship)
+            : parent.related(relationship));
+        const result = await q.where(childPk, '=', childId).paginate(1, 1);
+        return result.total > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Auto-wire the manager's table records loader against the parent's
+ * relation query when the user didn't set `Table.records()` themselves.
+ * Mirrors `defaultPages`'s wiring of `Table.records()` from `R.model`
+ * for the resource list page.
+ */
+function autoWireManagerTable(table, parentModel, parent, relationship) {
+    if (table.getRecords())
+        return; // user wired it explicitly
+    table.records(modelRelationTableRecords(parentModel, parent, relationship, table));
+}
+/**
+ * Plan #13 polish — auto-inject `TrashedFilter` on a relation manager's
+ * table when the **related** Resource opts into soft deletes. Mirrors the
+ * resource-list pattern in `defaultPages.applyTableDefaults`. The check
+ * is on the related Resource (not the manager), because soft-delete is a
+ * model-level capability — if the child model supports trashing, the
+ * manager's table should expose the toggle.
+ *
+ * No-op when:
+ *   - the related Resource hasn't set `softDeletes = true`
+ *   - the user already attached a `TrashedFilter` in `M.table()`
+ */
+function injectManagerTrashedFilter(table, Related) {
+    if (!Related?.softDeletes)
+        return;
+    const children = table.getChildren() ?? [];
+    const hasTrashed = children.some(c => c instanceof TrashedFilter);
+    if (hasTrashed)
+        return;
+    const existing = children.filter(c => c instanceof Filter);
+    table.filters([...existing, TrashedFilter.make()]);
+}
+/**
+ * Auto-wire the manager's form save + loadRecord handlers against the
+ * **related** Resource's `model` when the user didn't set them. The
+ * route handler is responsible for stamping the parent context
+ * (parent, parentRecord, parentId, relationship) onto the
+ * `FormContext` so user-supplied `mutateDataBeforeCreate` etc. can
+ * read them.
+ */
+function autoWireManagerForm(form, Related) {
+    const RelatedModel = Related.model;
+    if (!RelatedModel)
+        return;
+    if (!form.getSave())
+        form.save(modelSave(RelatedModel));
+    if (!form.getLoadRecord())
+        form.loadRecord(modelLoadRecord(Related));
+}
+async function safePolicy(fn) {
+    try {
+        return Boolean(await fn());
+    }
+    catch {
+        return false;
+    }
+}
+/** Plan #11 — authorize a relation-manager action with sensible defaults.
+ *  Re-exported from `RelationManager.ts` so external callers (route
+ *  handlers, third-party plugins) keep their existing import path. */
+export const safeManagerPolicy = safeManagerPolicyImpl;
+/**
+ * Plan #11 — render data for the three relation-manager URL scopes.
+ * Mirrors the resource* builders' shape so routes and Vike +data hooks
+ * consume identical props. Authorization runs inline (parent
+ * `canAccess + canEdit(parent)` then manager-scoped predicate); IDOR
+ * check on `relation-edit` runs against the parent's relation query.
+ *
+ * Returns:
+ *   - `null` when panel / parent / manager / child don't exist.
+ *   - `{ ok: false, status: 403 }` when authorization denies.
+ *   - the props record on success (route picks SSR view / SPA prop
+ *     downstream).
+ */
+export async function relationManagerData(pilotiq, scope, req) {
+    // Phase B nested-relation-* scopes split out into their own pipeline
+    // — the chain walking + per-layer auth differs enough from the
+    // depth-1 path that interleaving them would mostly hurt readability.
+    if (scope.kind === 'nested-relation-list'
+        || scope.kind === 'nested-relation-create'
+        || scope.kind === 'nested-relation-view'
+        || scope.kind === 'nested-relation-edit') {
+        return nestedRelationManagerData(pilotiq, scope, req);
+    }
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+    if (!R)
+        return null;
+    const M = findManager(R, scope.relationship);
+    if (!M)
+        return null;
+    const user = await pilotiq.resolveUser(req);
+    // Layer 1: parent access. canAccess gates the resource entirely;
+    // canEdit gates managing its relations (managers are read-write
+    // surfaces — read-only inline views opt in by overriding the
+    // manager's can*). Cluster gate composes with R.canAccess — both
+    // must pass when the parent resource is inside a cluster.
+    if (R.cluster && !await safePolicy(() => R.cluster.canAccess(user)))
+        return { ok: false, status: 403 };
+    if (!await safePolicy(() => R.canAccess(user)))
+        return { ok: false, status: 403 };
+    if (!R.model) {
+        // Without a model on the parent we can't load the parent record,
+        // and without that we can't IDOR-check children. Point users at
+        // the missing wiring rather than silent 500s.
+        throw new Error(`[Pilotiq] Resource "${R.name}" has relations(${M.name}) but no static model. ` +
+            `Set Resource.model = … to enable relation managers, or remove the manager.`);
+    }
+    const parentRecord = await findRecord(R, scope.recordId, { user }).catch(() => undefined);
+    if (!parentRecord)
+        return null;
+    if (!await safePolicy(() => R.canEdit(user, parentRecord)))
+        return { ok: false, status: 403 };
+    // Read the relation type off the parent's relations map once,
+    // normalize to the six-way `RelationMode` the manager-side logic
+    // uses. `belongsToMany` / `morphToMany` (owning polymorphic) /
+    // `morphedByMany` (inverse polymorphic) all flip into pivot-mutation
+    // mode (attach / detach / sync — same accessor surface), `morphMany|
+    // morphOne` collapses to `'morphMany'` (parent-side polymorphic —
+    // auto-fills morph columns on create), `morphTo` is the child-side
+    // polymorphic (no auto-actions; requires explicit `M.relatedResource`).
+    // Everything else collapses to `'hasMany'`.
+    const relationType = getRelationType(R.model, scope.relationship);
+    const mode = normalizeRelationMode(relationType);
+    const Related = findRelatedResource(M, R, cfg);
+    // Related Resource is required for: edit/create form auto-wire,
+    // child loading on edit, related URL generation. Throw when missing
+    // *only* if we'd otherwise need it — for `relation-list` it's
+    // optional (the table can be hand-wired by the user).
+    const needRelated = scope.kind !== 'relation-list';
+    if (needRelated && !Related) {
+        throw new Error(`[Pilotiq] RelationManager ${M.name} on ${R.name} could not resolve its related Resource. ` +
+            `Set static relatedResource on the manager, or ensure the parent's model declares relations[${JSON.stringify(M.getRelationship())}].`);
+    }
+    switch (scope.kind) {
+        case 'relation-list':
+            return buildRelationListData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode);
+        case 'relation-create':
+            return buildRelationCreateData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode);
+        case 'relation-view':
+            return buildRelationViewData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode);
+        case 'relation-edit':
+            return buildRelationEditData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode);
+    }
+}
+async function buildRelationListData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode) {
+    if (!await safeManagerPolicy(M, 'canViewAny', Related, user, parentRecord))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const resourceBase = resourceBasePath(base, R);
+    const listUrl = `${resourceBase}/${scope.recordId}/${scope.relationship}`;
+    // Build a single Table by piping a fresh Table through M.table(table, ctx).
+    // Context lets the user wire `Action.relationCreate / relationEdit /
+    // relationDelete(M, ctx)` factories inside `static table()` to template
+    // URLs without threading basePath / parentId by hand.
+    const managerCtx = {
+        basePath: base,
+        parentSlug: scope.slug,
+        parentId: scope.recordId,
+        relationship: scope.relationship,
+        parentRecord,
+        related: Related,
+        mode,
+    };
+    const table = M.table(Table.make(), managerCtx);
+    autoWireManagerTable(table, R.model, parentRecord, scope.relationship);
+    injectManagerTrashedFilter(table, Related);
+    const ctx = uploadCtx(userCtx({
+        mode: 'table',
+        basePath: base,
+        record: parentRecord,
+    }, user), cfg);
+    const elements = [table];
+    tagActionDispatch(elements, listUrl);
+    await loadTableRecords(elements, scope.query ?? {}, listUrl, user);
+    const tabs = buildRelationTabs(R, scope.recordId, base, scope.relationship);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = relationListBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const relationListRoute = { resource: R, recordId: scope.recordId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'relation-list', await resolveSchema(elements, ctx), relationListRoute);
+    return {
+        pageType: 'relation-list',
+        panel: await panelInfo(pilotiq, req, relationListRoute),
+        resource: { name: R.name, label: R.label, labelSingular: R.labelSingular, slug: scope.slug, icon: serializeIcon(R.icon, R.name) },
+        relation: {
+            name: M.name,
+            label: M.getLabel(),
+            labelSingular: M.getLabelSingular(),
+            relationship: scope.relationship,
+            icon: M.getIcon() ? serializeIcon(M.getIcon(), M.name) : undefined,
+            relatedSlug: Related?.getSlug(),
+        },
+        parent: {
+            id: scope.recordId,
+            title: deriveParentTitle(R, parentRecord),
+        },
+        basePath: base,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+async function buildRelationCreateData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode) {
+    if (!await safeManagerPolicy(M, 'canCreate', Related, user, parentRecord))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const resourceBase = resourceBasePath(base, R);
+    const createUrl = `${resourceBase}/${scope.recordId}/${scope.relationship}/create`;
+    const managerCtx = {
+        basePath: base,
+        parentSlug: scope.slug,
+        parentId: scope.recordId,
+        relationship: scope.relationship,
+        parentRecord,
+        related: Related,
+        mode,
+    };
+    const form = M.form(Form.make(), managerCtx);
+    if (Related.model)
+        autoWireManagerForm(form, Related);
+    const elements = [form];
+    tagFormActions(elements, createUrl);
+    if (scope.prefill) {
+        if (scope.prefill.values)
+            form.withValues(scope.prefill.values);
+        if (scope.prefill.errors)
+            form.withErrors(scope.prefill.errors);
+    }
+    const tabs = buildRelationTabs(R, scope.recordId, base, scope.relationship);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = relationCreateBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'create',
+        basePath: base,
+        record: parentRecord,
+    }, user), cfg);
+    const relationCreateRoute = { resource: R, recordId: scope.recordId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'relation-create', await resolveSchema(elements, ctx), relationCreateRoute);
+    return {
+        pageType: 'relation-create',
+        panel: await panelInfo(pilotiq, req, relationCreateRoute),
+        resource: { name: R.name, label: R.labelSingular, slug: scope.slug, icon: serializeIcon(R.icon, R.name) },
+        relation: {
+            name: M.name,
+            label: M.getLabel(),
+            labelSingular: M.getLabelSingular(),
+            relationship: scope.relationship,
+            icon: M.getIcon() ? serializeIcon(M.getIcon(), M.name) : undefined,
+            relatedSlug: Related.getSlug(),
+        },
+        parent: {
+            id: scope.recordId,
+            title: deriveParentTitle(R, parentRecord),
+        },
+        mode: 'create',
+        basePath: base,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+        ...(scope.prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+/**
+ * Phase A — read-only view page for a related record at depth-2:
+ * `${base}/${slug}/:id/${rel}/:childId`. Mirrors `buildRelationEditData`'s
+ * IDOR + auth posture but resolves the manager's `static detail(child,
+ * parent)` instead of its form. The default `detail()` returns `[]` —
+ * managers opt in by overriding it; the chrome (RelationTabs strip)
+ * still renders so users can sideways-nav between sibling managers.
+ */
+async function buildRelationViewData(pilotiq, R, M, Related, parentRecord, scope, req, user, _mode) {
+    if (!Related.model) {
+        throw new Error(`[Pilotiq] Cannot load child record for ${M.name}: Related Resource ${Related.name} has no static model.`);
+    }
+    const childPk = getPrimaryKey(Related.model);
+    const belongs = await childBelongsToParent(R.model, parentRecord, scope.relationship, childPk, scope.childId);
+    if (!belongs)
+        return null;
+    const child = await findRecord(Related, scope.childId, { user }).catch(() => undefined);
+    if (!child)
+        return null;
+    if (!await safeManagerPolicy(M, 'canView', Related, user, parentRecord, child))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const elements = M.detail(child, parentRecord);
+    // Phase B polish — when M declares nested managers, surface them on
+    // this page too. The strip lists the leaf parent's view tab plus one
+    // tab per sibling nested manager so users can jump from the Phase A
+    // view straight into a grandchild list / create / view / edit page.
+    // Active key `'__view'` because the user is currently viewing the
+    // leaf parent record itself, not any nested manager.
+    const nestedTabs = buildNestedRelationTabs(R, M, base, { recordId: scope.recordId, relationship: scope.relationship }, scope.childId, '__view');
+    if (nestedTabs)
+        elements.unshift(nestedTabs);
+    const tabs = buildRelationTabs(R, scope.recordId, base, scope.relationship);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = relationViewBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord), deriveParentTitle(Related, child, M));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'view',
+        basePath: base,
+        record: child,
+        recordId: scope.childId,
+    }, user), cfg);
+    const relationViewRoute = { resource: R, recordId: scope.childId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'relation-view', await resolveSchema(elements, ctx), relationViewRoute);
+    return {
+        pageType: 'relation-view',
+        panel: await panelInfo(pilotiq, req, relationViewRoute),
+        resource: { name: R.name, label: R.labelSingular, slug: scope.slug, icon: serializeIcon(R.icon, R.name) },
+        relation: {
+            name: M.name,
+            label: M.getLabel(),
+            labelSingular: M.getLabelSingular(),
+            relationship: scope.relationship,
+            icon: M.getIcon() ? serializeIcon(M.getIcon(), M.name) : undefined,
+            relatedSlug: Related.getSlug(),
+        },
+        parent: {
+            id: scope.recordId,
+            title: deriveParentTitle(R, parentRecord),
+        },
+        mode: 'view',
+        childId: scope.childId,
+        basePath: base,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+async function buildRelationEditData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode) {
+    if (!Related.model) {
+        throw new Error(`[Pilotiq] Cannot load child record for ${M.name}: Related Resource ${Related.name} has no static model.`);
+    }
+    const childPk = getPrimaryKey(Related.model);
+    // IDOR check first — confirm the child actually belongs to the
+    // parent under this relationship before doing anything else. Guards
+    // against URL tampering swapping `:childId`.
+    const belongs = await childBelongsToParent(R.model, parentRecord, scope.relationship, childPk, scope.childId);
+    if (!belongs)
+        return null;
+    const child = await findRecord(Related, scope.childId, { user }).catch(() => undefined);
+    if (!child)
+        return null;
+    if (!await safeManagerPolicy(M, 'canEdit', Related, user, parentRecord, child))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const resourceBase = resourceBasePath(base, R);
+    const editUrl = `${resourceBase}/${scope.recordId}/${scope.relationship}/${scope.childId}/edit`;
+    const managerCtx = {
+        basePath: base,
+        parentSlug: scope.slug,
+        parentId: scope.recordId,
+        relationship: scope.relationship,
+        parentRecord,
+        related: Related,
+        mode,
+    };
+    const form = M.form(Form.make(), managerCtx);
+    autoWireManagerForm(form, Related);
+    const elements = [form];
+    tagFormActions(elements, editUrl);
+    // Prefill values: explicit prefill (re-render after 422) wins,
+    // otherwise pipe the loaded child through Form's fill pipeline.
+    if (scope.prefill?.values) {
+        form.withValues(scope.prefill.values);
+        if (scope.prefill.errors)
+            form.withErrors(scope.prefill.errors);
+    }
+    else if (child != null) {
+        const values = await applyFillPipeline(form, child);
+        form.withValues(values);
+    }
+    const tabs = buildRelationTabs(R, scope.recordId, base, scope.relationship);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = relationEditBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord), scope.childId, deriveParentTitle(Related, child, M));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'edit',
+        basePath: base,
+        record: child,
+        recordId: scope.childId,
+    }, user), cfg);
+    const relationEditRoute = { resource: R, recordId: scope.childId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'relation-edit', await resolveSchema(elements, ctx), relationEditRoute);
+    return {
+        pageType: 'relation-edit',
+        panel: await panelInfo(pilotiq, req, relationEditRoute),
+        resource: { name: R.name, label: R.labelSingular, slug: scope.slug, icon: serializeIcon(R.icon, R.name) },
+        relation: {
+            name: M.name,
+            label: M.getLabel(),
+            labelSingular: M.getLabelSingular(),
+            relationship: scope.relationship,
+            icon: M.getIcon() ? serializeIcon(M.getIcon(), M.name) : undefined,
+            relatedSlug: Related.getSlug(),
+        },
+        parent: {
+            id: scope.recordId,
+            title: deriveParentTitle(R, parentRecord),
+        },
+        mode: 'edit',
+        childId: scope.childId,
+        basePath: base,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+        ...(scope.prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+/**
+ * Phase B — resolve a depth-2 chain, running every auth + IDOR layer:
+ *   Layer 0 — top-level Resource: cluster gate, R.canAccess.
+ *   Layer 1 — parent record: R.canEdit(parent) (Phase A gate to manage relations).
+ *   Layer 2 — first manager M1: relationship discovered, related resource discovered.
+ *   IDOR #1 — child1 (the leaf parent) must belong to parentRecord under chain[0].relationship.
+ *   Layer 3 — M1.canView(child1, parent) (Filament-style: must be allowed
+ *             to view the child to drill into its sub-relations).
+ *   Layer 4 — second manager M2 lookup; relation type read off Related1.model.
+ *
+ * The leaf manager's per-scope predicate (canViewAny / canCreate /
+ * canView / canEdit) runs inside the per-scope builders below, since
+ * each predicate has different arguments.
+ */
+export async function resolveRelationChain(pilotiq, scope, user) {
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+    if (!R)
+        return null;
+    // Layer 0 — same gates as the depth-1 pipeline.
+    if (R.cluster && !await safePolicy(() => R.cluster.canAccess(user)))
+        return { ok: false, status: 403 };
+    if (!await safePolicy(() => R.canAccess(user)))
+        return { ok: false, status: 403 };
+    if (!R.model) {
+        throw new Error(`[Pilotiq] Resource "${R.name}" has nested relations but no static model. ` +
+            `Set Resource.model = … or remove the manager.`);
+    }
+    const [step0, step1] = scope.chain;
+    const parentRecord = await findRecord(R, step0.recordId, { user }).catch(() => undefined);
+    if (!parentRecord)
+        return null;
+    // Layer 1 — parent record gate.
+    if (!await safePolicy(() => R.canEdit(user, parentRecord)))
+        return { ok: false, status: 403 };
+    // Layer 2 — first manager M1.
+    const M1 = findManager(R, step0.relationship);
+    if (!M1)
+        return null;
+    const Related1 = findRelatedResource(M1, R, cfg);
+    if (!Related1) {
+        throw new Error(`[Pilotiq] RelationManager ${M1.name} on ${R.name} could not resolve its related Resource. ` +
+            `Set static relatedResource on the manager, or ensure the parent's model declares relations[${JSON.stringify(M1.getRelationship())}].`);
+    }
+    if (!Related1.model) {
+        throw new Error(`[Pilotiq] Related Resource ${Related1.name} has no static model — ` +
+            `cannot resolve nested manager chain through it.`);
+    }
+    const child1Mode = normalizeRelationMode(getRelationType(R.model, step0.relationship));
+    // IDOR #1 — confirm the leaf parent (`step1.recordId`) actually
+    // belongs to the top parent under the first relationship key.
+    const child1Pk = getPrimaryKey(Related1.model);
+    const belongs1 = await childBelongsToParent(R.model, parentRecord, step0.relationship, child1Pk, step1.recordId);
+    if (!belongs1)
+        return null;
+    const child1 = await findRecord(Related1, step1.recordId, { user }).catch(() => undefined);
+    if (!child1)
+        return null;
+    // Layer 3 — M1.canView(child1, parent) gate. Filament-style: viewing
+    // the child is the prerequisite for entering its nested manager strip.
+    if (!await safeManagerPolicy(M1, 'canView', Related1, user, parentRecord, child1))
+        return { ok: false, status: 403 };
+    // Layer 4 — second manager M2 declared under M1.relations().
+    const M2 = M1.relations().find(N => {
+        try {
+            return N.getRelationship() === step1.relationship;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!M2)
+        return null;
+    const Related2 = findRelatedResource(M2, Related1, cfg);
+    const child2Mode = normalizeRelationMode(getRelationType(Related1.model, step1.relationship));
+    return { R, parentRecord, M1, Related1, child1, child1Mode, M2, Related2, child2Mode };
+}
+/**
+ * Phase B dispatcher — splits the four nested scopes onto their builders
+ * after the shared chain walk. Mirrors the depth-1 `relationManagerData`
+ * function shape.
+ */
+async function nestedRelationManagerData(pilotiq, scope, req) {
+    const user = await pilotiq.resolveUser(req);
+    const resolved = await resolveRelationChain(pilotiq, scope, user);
+    if (resolved === null)
+        return null;
+    if ('ok' in resolved)
+        return resolved;
+    // For create / view / edit we strictly need a registered Related2 so
+    // we can load the leaf record + auto-wire the form save.
+    const needRelated2 = scope.kind !== 'nested-relation-list';
+    if (needRelated2 && !resolved.Related2) {
+        throw new Error(`[Pilotiq] Nested RelationManager ${resolved.M2.name} under ${resolved.M1.name} ` +
+            `on ${resolved.R.name} could not resolve its related Resource. ` +
+            `Set static relatedResource on the manager, or ensure the parent's model declares ` +
+            `relations[${JSON.stringify(resolved.M2.getRelationship())}].`);
+    }
+    switch (scope.kind) {
+        case 'nested-relation-list':
+            return buildNestedRelationListData(pilotiq, scope, resolved, req, user);
+        case 'nested-relation-create':
+            return buildNestedRelationCreateData(pilotiq, scope, resolved, req, user);
+        case 'nested-relation-view':
+            return buildNestedRelationViewData(pilotiq, scope, resolved, req, user);
+        case 'nested-relation-edit':
+            return buildNestedRelationEditData(pilotiq, scope, resolved, req, user);
+    }
+}
+/** Phase B — build the manager context for a nested leaf manager. The
+ *  parent here is `child1` (the chain's leaf parent record); the URL
+ *  prefix comes from `scope.chain[0]` via `Action.relation*` factories
+ *  reading `ctx.chain`. */
+function nestedManagerCtx(base, scope, resolved) {
+    const [step0, step1] = scope.chain;
+    return {
+        basePath: base,
+        parentSlug: resolved.R.getSlug(),
+        parentId: step1.recordId, // immediate parent = child1's id
+        relationship: step1.relationship, // leaf manager's relationship
+        parentRecord: resolved.child1, // immediate parent record = child1
+        related: resolved.Related2,
+        mode: resolved.child2Mode,
+        chain: [{
+                slug: resolved.R.getSlug(),
+                recordId: step0.recordId,
+                relationship: step0.relationship,
+            }],
+    };
+}
+/** Phase B — assemble the response shape that mirrors the depth-1
+ *  builders but adds a `chain` array so renderers can build breadcrumbs
+ *  and back-links without re-deriving them. */
+function nestedResponseEnvelope(pageType, pilotiq, base, scope, resolved, req) {
+    const { R, M1, Related1, child1, M2, Related2 } = resolved;
+    const [step0, step1] = scope.chain;
+    const parentChildTitle = deriveParentTitle(Related1, child1, M1);
+    return {
+        pageType,
+        resource: { name: R.name, label: R.labelSingular, slug: R.getSlug(), icon: serializeIcon(R.icon, R.name) },
+        parentRelation: {
+            name: M1.name,
+            relationship: step0.relationship,
+            label: M1.getLabel(),
+            relatedSlug: Related1.getSlug(),
+        },
+        parentChild: {
+            id: step1.recordId,
+            title: parentChildTitle,
+        },
+        relation: {
+            name: M2.name,
+            relationship: step1.relationship,
+            label: M2.getLabel(),
+            labelSingular: M2.getLabelSingular(),
+            icon: M2.getIcon() ? serializeIcon(M2.getIcon(), M2.name) : undefined,
+            relatedSlug: Related2?.getSlug(),
+        },
+        parent: {
+            // Top-of-chain record — same shape the depth-1 builders ship as
+            // `parent` so renderers can reuse the back-to-resource link.
+            id: step0.recordId,
+            title: deriveParentTitle(R, resolved.parentRecord),
+        },
+        basePath: base,
+        layout: pilotiq.getConfig().layout,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+async function buildNestedRelationListData(pilotiq, scope, resolved, req, user) {
+    const { Related1, child1, M2, Related2 } = resolved;
+    if (!await safeManagerPolicy(M2, 'canViewAny', Related2, user, child1))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const [step0, step1] = scope.chain;
+    const resourceBase = resourceBasePath(base, resolved.R);
+    const listUrl = `${resourceBase}/${step0.recordId}/${step0.relationship}/${step1.recordId}/${step1.relationship}`;
+    const managerCtx = nestedManagerCtx(base, scope, resolved);
+    const table = M2.table(Table.make(), managerCtx);
+    if (Related1.model) {
+        autoWireManagerTable(table, Related1.model, child1, step1.relationship);
+    }
+    injectManagerTrashedFilter(table, Related2);
+    const ctx = uploadCtx(userCtx({
+        mode: 'table',
+        basePath: base,
+        record: child1,
+    }, user), cfg);
+    const elements = [table];
+    tagActionDispatch(elements, listUrl);
+    await loadTableRecords(elements, scope.query ?? {}, listUrl, user);
+    const tabs = buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = nestedRelationListBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const nestedListRoute = { resource: resolved.R, recordId: scope.chain[1].recordId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'relation-list', await resolveSchema(elements, ctx), nestedListRoute);
+    return {
+        ...nestedResponseEnvelope('nested-relation-list', pilotiq, base, scope, resolved, req),
+        panel: await panelInfo(pilotiq, req, nestedListRoute),
+        schemaData,
+    };
+}
+async function buildNestedRelationCreateData(pilotiq, scope, resolved, req, user) {
+    const { child1, M2, Related2 } = resolved;
+    if (!await safeManagerPolicy(M2, 'canCreate', Related2, user, child1))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const [step0, step1] = scope.chain;
+    const resourceBase = resourceBasePath(base, resolved.R);
+    const createUrl = `${resourceBase}/${step0.recordId}/${step0.relationship}/${step1.recordId}/${step1.relationship}/create`;
+    const managerCtx = nestedManagerCtx(base, scope, resolved);
+    const form = M2.form(Form.make(), managerCtx);
+    if (Related2?.model)
+        autoWireManagerForm(form, Related2);
+    const elements = [form];
+    tagFormActions(elements, createUrl);
+    if (scope.prefill) {
+        if (scope.prefill.values)
+            form.withValues(scope.prefill.values);
+        if (scope.prefill.errors)
+            form.withErrors(scope.prefill.errors);
+    }
+    const tabs = buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = nestedRelationCreateBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(resolved.Related1, child1, resolved.M1));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'create',
+        basePath: base,
+        record: child1,
+    }, user), cfg);
+    const nestedCreateRoute = { resource: resolved.R, recordId: scope.chain[1].recordId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'relation-create', await resolveSchema(elements, ctx), nestedCreateRoute);
+    return {
+        ...nestedResponseEnvelope('nested-relation-create', pilotiq, base, scope, resolved, req),
+        panel: await panelInfo(pilotiq, req, nestedCreateRoute),
+        mode: 'create',
+        schemaData,
+        ...(scope.prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+async function buildNestedRelationViewData(pilotiq, scope, resolved, req, user) {
+    const { Related1, child1, M2, Related2 } = resolved;
+    if (!Related2?.model) {
+        throw new Error(`[Pilotiq] Cannot load child record for nested manager ${M2.name}: ` +
+            `Related Resource ${Related2?.name ?? '(none)'} has no static model.`);
+    }
+    const [, step1] = scope.chain;
+    const child2Pk = getPrimaryKey(Related2.model);
+    const belongs2 = await childBelongsToParent(Related1.model, child1, step1.relationship, child2Pk, scope.childId);
+    if (!belongs2)
+        return null;
+    const child2 = await findRecord(Related2, scope.childId, { user }).catch(() => undefined);
+    if (!child2)
+        return null;
+    if (!await safeManagerPolicy(M2, 'canView', Related2, user, child1, child2))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const elements = M2.detail(child2, child1);
+    const tabs = buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = nestedRelationViewBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1), deriveParentTitle(Related2, child2, M2));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'view',
+        basePath: base,
+        record: child2,
+        recordId: scope.childId,
+    }, user), cfg);
+    const nestedViewRoute = { resource: resolved.R, recordId: scope.childId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'relation-view', await resolveSchema(elements, ctx), nestedViewRoute);
+    return {
+        ...nestedResponseEnvelope('nested-relation-view', pilotiq, base, scope, resolved, req),
+        panel: await panelInfo(pilotiq, req, nestedViewRoute),
+        mode: 'view',
+        childId: scope.childId,
+        schemaData,
+    };
+}
+async function buildNestedRelationEditData(pilotiq, scope, resolved, req, user) {
+    const { Related1, child1, M2, Related2 } = resolved;
+    if (!Related2?.model) {
+        throw new Error(`[Pilotiq] Cannot load child record for nested manager ${M2.name}: ` +
+            `Related Resource ${Related2?.name ?? '(none)'} has no static model.`);
+    }
+    const [step0, step1] = scope.chain;
+    const child2Pk = getPrimaryKey(Related2.model);
+    const belongs2 = await childBelongsToParent(Related1.model, child1, step1.relationship, child2Pk, scope.childId);
+    if (!belongs2)
+        return null;
+    const child2 = await findRecord(Related2, scope.childId, { user }).catch(() => undefined);
+    if (!child2)
+        return null;
+    if (!await safeManagerPolicy(M2, 'canEdit', Related2, user, child1, child2))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const resourceBase = resourceBasePath(base, resolved.R);
+    const editUrl = `${resourceBase}/${step0.recordId}/${step0.relationship}/${step1.recordId}/${step1.relationship}/${scope.childId}/edit`;
+    const managerCtx = nestedManagerCtx(base, scope, resolved);
+    const form = M2.form(Form.make(), managerCtx);
+    autoWireManagerForm(form, Related2);
+    const elements = [form];
+    tagFormActions(elements, editUrl);
+    if (scope.prefill?.values) {
+        form.withValues(scope.prefill.values);
+        if (scope.prefill.errors)
+            form.withErrors(scope.prefill.errors);
+    }
+    else if (child2 != null) {
+        const values = await applyFillPipeline(form, child2);
+        form.withValues(values);
+    }
+    const tabs = buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = nestedRelationEditBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1), scope.childId, deriveParentTitle(Related2, child2, M2));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'edit',
+        basePath: base,
+        record: child2,
+        recordId: scope.childId,
+    }, user), cfg);
+    const nestedEditRoute = { resource: resolved.R, recordId: scope.childId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'relation-edit', await resolveSchema(elements, ctx), nestedEditRoute);
+    return {
+        ...nestedResponseEnvelope('nested-relation-edit', pilotiq, base, scope, resolved, req),
+        panel: await panelInfo(pilotiq, req, nestedEditRoute),
+        mode: 'edit',
+        childId: scope.childId,
+        schemaData,
+        ...(scope.prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+/**
+ * Phase B — build a `RelationTabs` strip scoped to a parent's nested
+ * children (e.g. tabs for `replies / reactions` listed under a single
+ * comment). The strip's "back" tab points to the depth-2 view page for
+ * the leaf parent itself, then one tab per sibling nested manager.
+ *
+ * Only emitted when the depth-1 manager declares `M.relations()` —
+ * absent that, callers skip the prepend so single-manager surfaces stay
+ * clean. `activeKey` accepts the literal `'__view'` for the leaf
+ * parent's view tab, or any sibling manager's relationship key.
+ */
+function buildNestedRelationTabs(R, M, basePath, step0, child1Id, activeKey) {
+    const siblings = M.relations();
+    if (siblings.length === 0)
+        return undefined;
+    const resourceBase = resourceBasePath(basePath, R);
+    const parentBase = `${resourceBase}/${step0.recordId}/${step0.relationship}`;
+    const tabs = [];
+    // Back-link: depth-2 view page for the leaf parent record. Acts as
+    // the "View" tab in the same way `__view` does on depth-1 strips.
+    tabs.push(relationTab({
+        key: '__view',
+        label: M.getLabelSingular(),
+        url: `${parentBase}/${child1Id}`,
+        active: activeKey === '__view',
+        icon: M.getIcon(),
+        iconOwner: M.name,
+    }));
+    for (const N of siblings) {
+        let nestedRel = '';
+        try {
+            nestedRel = N.getRelationship();
+        }
+        catch {
+            continue;
+        }
+        const icon = N.getIcon();
+        tabs.push(relationTab({
+            key: nestedRel,
+            label: N.getLabel(),
+            url: `${parentBase}/${child1Id}/${nestedRel}`,
+            active: activeKey === nestedRel,
+            ...(icon !== undefined ? { icon, iconOwner: N.name } : {}),
+        }));
+    }
+    return RelationTabs.make(tabs);
+}
+/**
+ * Plan #11 — build the `RelationTabs` strip for a parent record. The
+ * strip surfaces the per-record sub-navigation: View, Edit, plus one
+ * tab per `R.relations()` manager. `activeKey` selects which tab the
+ * renderer highlights — `'__view'` / `'__edit'` for the parent tabs,
+ * the manager's relationship key for a manager tab.
+ *
+ * Sub-nav follow-up (2026-05-03 cont'd) — emit BOTH `__view` and
+ * `__edit` as sibling tabs (Filament-style record sub-navigation)
+ * instead of one parent tab whose label depends on mode. Tabs are
+ * dropped when the corresponding page role isn't registered (a
+ * Resource overriding `pages()` to omit `view` or `edit` shouldn't
+ * surface a tab that 404s).
+ *
+ * Returns `undefined` when the resource has no relation managers — the
+ * caller can then skip the prepend entirely so resources without
+ * relations stay shape-compatible with their existing schemaData.
+ * (View+Edit sub-nav alone isn't worth a tab strip; users navigate
+ * those via headerActions or the back link.)
+ */
+function buildRelationTabs(R, recordId, basePath, activeKey) {
+    const managers = R.relations();
+    if (managers.length === 0)
+        return undefined;
+    const resourceBase = resourceBasePath(basePath, R);
+    const pages = R.resolvePages();
+    const tabs = [];
+    // View tab — only when the resource has a ViewPage registered.
+    // Defaults always include one; users who pruned ViewPage in their
+    // `static pages()` override get no broken link.
+    if (pages.view) {
+        tabs.push(relationTab({
+            key: '__view',
+            label: 'View',
+            url: `${resourceBase}/${recordId}`,
+            active: activeKey === '__view',
+            icon: R.icon,
+            iconOwner: R.name,
+        }));
+    }
+    // Edit tab — same defensive check.
+    if (pages.edit) {
+        tabs.push(relationTab({
+            key: '__edit',
+            label: 'Edit',
+            url: `${resourceBase}/${recordId}/edit`,
+            active: activeKey === '__edit',
+            // Re-use the resource icon so when ViewPage is pruned, Edit
+            // still carries the visual identity. When both are present, the
+            // icon repeats — acceptable; the labels disambiguate.
+            icon: R.icon,
+            iconOwner: R.name,
+        }));
+    }
+    for (const M of managers) {
+        let rel = '';
+        try {
+            rel = M.getRelationship();
+        }
+        catch {
+            continue;
+        }
+        const icon = M.getIcon();
+        tabs.push(relationTab({
+            key: rel,
+            label: M.getLabel(),
+            url: `${resourceBase}/${recordId}/${rel}`,
+            active: activeKey === rel,
+            ...(icon !== undefined ? { icon, iconOwner: M.name } : {}),
+        }));
+    }
+    return RelationTabs.make(tabs);
+}
+/** Pull a human-readable title off a parent record for breadcrumb /
+ *  page-title use. Falls back through `recordTitleAttribute` →
+ *  `name` → `title` → primary key value → 'Record'. */
+function deriveParentTitle(R, record, manager) {
+    const r = record;
+    // Manager-scoped child rows prefer the manager's `recordTitleAttribute`
+    // when set — the manager owns its presentation surface, and the related
+    // Resource may not opt into the same column (e.g. nested-only Resources
+    // that exist purely to back a manager).
+    const managerAttr = manager?.recordTitleAttribute;
+    if (managerAttr && r[managerAttr] != null)
+        return String(r[managerAttr]);
+    const attr = R.recordTitleAttribute;
+    if (attr && r[attr] != null)
+        return String(r[attr]);
+    if (r['name'] != null)
+        return String(r['name']);
+    if (r['title'] != null)
+        return String(r['title']);
+    if (R.model) {
+        const pk = getPrimaryKey(R.model);
+        if (r[pk] != null)
+            return String(r[pk]);
+    }
+    return 'Record';
+}
+// ─── Phase C breadcrumb builders ─────────────────────────────
+//
+// Server-resolved chain rendered above any other top-of-page chrome
+// (e.g. RelationTabs). The trailing item is always the current page,
+// emitted without a `url` so the renderer can paint it as plain text
+// + `aria-current="page"`. All earlier items link to their canonical
+// URL — clusters route through `clusterBasePath`, resources through
+// `resourceBasePath`, etc., so a clustered resource resolves to
+// `Home / Cluster / Resource / …` instead of skipping the cluster
+// rung.
+function homeBreadcrumb(cfg) {
+    return {
+        label: cfg.branding?.title ?? cfg.name ?? 'Home',
+        url: cfg.path,
+    };
+}
+function clusterBreadcrumb(cfg, child) {
+    if (!child.cluster)
+        return undefined;
+    return {
+        label: child.cluster.label,
+        url: clusterBasePath(cfg.path, child.cluster),
+    };
+}
+function buildBreadcrumbs(items) {
+    // A single "Home" rung carries no information beyond the dashboard
+    // link the layout already exposes — drop it. Every other length is
+    // worth rendering.
+    if (items.length < 2)
+        return undefined;
+    return Breadcrumbs.make(items);
+}
+function resourceListBreadcrumbs(cfg, R) {
+    const items = [homeBreadcrumb(cfg)];
+    const cluster = clusterBreadcrumb(cfg, R);
+    if (cluster)
+        items.push(cluster);
+    items.push({ label: R.getBreadcrumb() });
+    return buildBreadcrumbs(items);
+}
+function resourceCreateBreadcrumbs(cfg, R) {
+    const items = [homeBreadcrumb(cfg)];
+    const cluster = clusterBreadcrumb(cfg, R);
+    if (cluster)
+        items.push(cluster);
+    items.push({ label: R.getBreadcrumb(), url: resourceBasePath(cfg.path, R) });
+    items.push({ label: 'Create' });
+    return buildBreadcrumbs(items);
+}
+function resourceViewBreadcrumbs(cfg, R, recordTitle) {
+    const items = [homeBreadcrumb(cfg)];
+    const cluster = clusterBreadcrumb(cfg, R);
+    if (cluster)
+        items.push(cluster);
+    items.push({ label: R.getBreadcrumb(), url: resourceBasePath(cfg.path, R) });
+    items.push({ label: recordTitle });
+    return buildBreadcrumbs(items);
+}
+function resourceEditBreadcrumbs(cfg, R, recordId, recordTitle) {
+    const items = [homeBreadcrumb(cfg)];
+    const cluster = clusterBreadcrumb(cfg, R);
+    if (cluster)
+        items.push(cluster);
+    const resourceBase = resourceBasePath(cfg.path, R);
+    items.push({ label: R.getBreadcrumb(), url: resourceBase });
+    // Link the record title to the View page when registered — falls
+    // back to plain text so users who pruned ViewPage don't hit a 404.
+    const hasView = R.resolvePages().view !== undefined;
+    items.push(hasView
+        ? { label: recordTitle, url: `${resourceBase}/${recordId}` }
+        : { label: recordTitle });
+    items.push({ label: 'Edit' });
+    return buildBreadcrumbs(items);
+}
+function globalBreadcrumbs(cfg, G) {
+    // Globals don't have a list page — `Home > <Global Label>` is the
+    // shortest meaningful chain. Edit and View collapse to the same
+    // breadcrumb (both render the singleton).
+    const items = [homeBreadcrumb(cfg)];
+    const cluster = clusterBreadcrumb(cfg, G);
+    if (cluster)
+        items.push(cluster);
+    items.push({ label: G.label });
+    return buildBreadcrumbs(items);
+}
+function customPageBreadcrumbs(cfg, P) {
+    const items = [homeBreadcrumb(cfg)];
+    const cluster = clusterBreadcrumb(cfg, P);
+    if (cluster)
+        items.push(cluster);
+    items.push({ label: P.getLabel() });
+    return buildBreadcrumbs(items);
+}
+/** Common "Home / cluster? / Resource / parent record" prefix used by
+ *  every relation-* / nested-relation-* breadcrumb. The parent record
+ *  links to its View page when registered; the resource list is the
+ *  fallback so users still have a back-link out of the relation chain. */
+function relationBreadcrumbPrefix(cfg, R, parentId, parentTitle) {
+    const items = [homeBreadcrumb(cfg)];
+    const cluster = clusterBreadcrumb(cfg, R);
+    if (cluster)
+        items.push(cluster);
+    const resourceBase = resourceBasePath(cfg.path, R);
+    items.push({ label: R.getBreadcrumb(), url: resourceBase });
+    const hasView = R.resolvePages().view !== undefined;
+    items.push(hasView
+        ? { label: parentTitle, url: `${resourceBase}/${parentId}` }
+        : { label: parentTitle });
+    return items;
+}
+function relationListBreadcrumbs(cfg, R, M, parentId, parentTitle) {
+    const items = relationBreadcrumbPrefix(cfg, R, parentId, parentTitle);
+    items.push({ label: M.getLabel() });
+    return buildBreadcrumbs(items);
+}
+function relationCreateBreadcrumbs(cfg, R, M, parentId, parentTitle) {
+    const items = relationBreadcrumbPrefix(cfg, R, parentId, parentTitle);
+    const relList = `${resourceBasePath(cfg.path, R)}/${parentId}/${M.getRelationship()}`;
+    items.push({ label: M.getLabel(), url: relList });
+    items.push({ label: 'Create' });
+    return buildBreadcrumbs(items);
+}
+function relationViewBreadcrumbs(cfg, R, M, parentId, parentTitle, childTitle) {
+    const items = relationBreadcrumbPrefix(cfg, R, parentId, parentTitle);
+    const relList = `${resourceBasePath(cfg.path, R)}/${parentId}/${M.getRelationship()}`;
+    items.push({ label: M.getLabel(), url: relList });
+    items.push({ label: childTitle });
+    return buildBreadcrumbs(items);
+}
+function relationEditBreadcrumbs(cfg, R, M, parentId, parentTitle, childId, childTitle) {
+    const items = relationBreadcrumbPrefix(cfg, R, parentId, parentTitle);
+    const relBase = `${resourceBasePath(cfg.path, R)}/${parentId}/${M.getRelationship()}`;
+    items.push({ label: M.getLabel(), url: relBase });
+    // Phase A always mounts the relation-view page per (R, M), so the
+    // child title can always link back to it.
+    items.push({ label: childTitle, url: `${relBase}/${childId}` });
+    items.push({ label: 'Edit' });
+    return buildBreadcrumbs(items);
+}
+/** Phase B — depth-2 prefix shared by every nested-relation-* role.
+ *  Returns "Home / cluster? / Resource / parent / M1 / child1". */
+function nestedRelationBreadcrumbPrefix(cfg, R, M1, step0, parentTitle, child1Id, child1Title) {
+    const items = relationBreadcrumbPrefix(cfg, R, step0.recordId, parentTitle);
+    const rel1Base = `${resourceBasePath(cfg.path, R)}/${step0.recordId}/${step0.relationship}`;
+    items.push({ label: M1.getLabel(), url: rel1Base });
+    // Phase A relation-view always mounted, so child1 always links.
+    items.push({ label: child1Title, url: `${rel1Base}/${child1Id}` });
+    return items;
+}
+function nestedRelationListBreadcrumbs(cfg, R, M1, M2, step0, parentTitle, child1Id, child1Title) {
+    const items = nestedRelationBreadcrumbPrefix(cfg, R, M1, step0, parentTitle, child1Id, child1Title);
+    items.push({ label: M2.getLabel() });
+    return buildBreadcrumbs(items);
+}
+function nestedRelationCreateBreadcrumbs(cfg, R, M1, M2, step0, parentTitle, child1Id, child1Title) {
+    const items = nestedRelationBreadcrumbPrefix(cfg, R, M1, step0, parentTitle, child1Id, child1Title);
+    const rel2Base = `${resourceBasePath(cfg.path, R)}/${step0.recordId}/${step0.relationship}/${child1Id}/${M2.getRelationship()}`;
+    items.push({ label: M2.getLabel(), url: rel2Base });
+    items.push({ label: 'Create' });
+    return buildBreadcrumbs(items);
+}
+function nestedRelationViewBreadcrumbs(cfg, R, M1, M2, step0, parentTitle, child1Id, child1Title, child2Title) {
+    const items = nestedRelationBreadcrumbPrefix(cfg, R, M1, step0, parentTitle, child1Id, child1Title);
+    const rel2Base = `${resourceBasePath(cfg.path, R)}/${step0.recordId}/${step0.relationship}/${child1Id}/${M2.getRelationship()}`;
+    items.push({ label: M2.getLabel(), url: rel2Base });
+    items.push({ label: child2Title });
+    return buildBreadcrumbs(items);
+}
+function nestedRelationEditBreadcrumbs(cfg, R, M1, M2, step0, parentTitle, child1Id, child1Title, child2Id, child2Title) {
+    const items = nestedRelationBreadcrumbPrefix(cfg, R, M1, step0, parentTitle, child1Id, child1Title);
+    const rel2Base = `${resourceBasePath(cfg.path, R)}/${step0.recordId}/${step0.relationship}/${child1Id}/${M2.getRelationship()}`;
+    items.push({ label: M2.getLabel(), url: rel2Base });
+    items.push({ label: child2Title, url: `${rel2Base}/${child2Id}` });
+    items.push({ label: 'Edit' });
+    return buildBreadcrumbs(items);
+}
+/**
+ * Plan #5 — handle a partial-resolve roundtrip from a `live()` field.
+ *
+ * Locates the page's schema, finds the targeted form by `formId`, runs
+ * `applyStateUpdate` to apply the changed value + run
+ * `afterStateUpdated`, then re-resolves the form's children with the
+ * mutated values + bound `$get / $set` so dependent options /
+ * conditional visibility re-evaluate. Returns the resolved FormMeta the
+ * client uses to replace its rendered form.
+ *
+ * Returns `null` when the route prefix doesn't resolve to a real
+ * resource/global/page — the route handler turns this into a 404. The
+ * inner `{ status: 422 }` failure is for "form found but `changed`
+ * field doesn't exist on it" — also a client-side bug.
+ */
+export async function formStateData(pilotiq, scope, body, req) {
+    const cfg = pilotiq.getConfig();
+    const user = await pilotiq.resolveUser(req);
+    let PageClass;
+    let mode;
+    let record = undefined;
+    let recordId;
+    let baseCtxExtras = {};
+    if (scope.kind === 'resource-create' || scope.kind === 'resource-edit') {
+        const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+        if (!R)
+            return null;
+        const pages = R.resolvePages();
+        if (scope.kind === 'resource-create') {
+            if (!pages.create)
+                return null;
+            PageClass = pages.create;
+            mode = 'create';
+        }
+        else {
+            if (!pages.edit)
+                return null;
+            PageClass = pages.edit;
+            mode = 'edit';
+            recordId = scope.recordId;
+            baseCtxExtras = { recordId };
+            if (R.model) {
+                try {
+                    record = await findRecord(R, scope.recordId, { user });
+                }
+                catch { /* ignore */ }
+            }
+            else if (recordId) {
+                record = { id: recordId };
+            }
+        }
+    }
+    else if (scope.kind === 'global-edit') {
+        const G = cfg.globals.find(g => g.getSlug() === scope.slug);
+        if (!G)
+            return null;
+        const pages = G.resolvePages();
+        if (!pages.edit)
+            return null;
+        PageClass = pages.edit;
+        mode = 'edit';
+    }
+    else {
+        const P = cfg.pages.find(p => p.getSlug() === scope.pageSlug);
+        if (!P)
+            return null;
+        PageClass = P;
+        // Custom pages don't have a record/edit-mode concept — pass mode
+        // 'edit' so resolveSchema treats fields as form inputs (not table
+        // cells / view-mode read-only).
+        mode = 'edit';
+    }
+    if (!PageClass)
+        return null;
+    const baseCtx = uploadCtx(userCtx({ mode, basePath: cfg.path, ...baseCtxExtras }, user), cfg);
+    const elements = await callPageSchema(PageClass, baseCtx);
+    const form = selectFormById(findForms(elements), body.formId);
+    if (!form)
+        return { ok: false, status: 404, error: `Form "${body.formId}" not found on page` };
+    const update = await applyStateUpdate(form, body.values, body.changed, {
+        ...(record !== undefined ? { record } : {}),
+        ...(user !== null ? { user } : {}),
+        request: req,
+    });
+    if (!update) {
+        return { ok: false, status: 422, error: `Field "${body.changed}" not found on form "${body.formId}"` };
+    }
+    // Re-resolve the form with the mutated values bound. We bind
+    // `$get / $set` against the post-update values map so further
+    // resolve-time logic (SelectField.options(fn), reactive
+    // visibility) reads current state.
+    const $get = (name) => update.values[name];
+    // $set on the resolve pass is a no-op — only afterStateUpdated
+    // mutations survive into the response. Resolve-time `$set` would
+    // race against the client's view of the world.
+    const $set = (_name, _v) => { };
+    const resolveCtx = {
+        ...baseCtx,
+        values: update.values,
+        $get,
+        $set,
+        changed: body.changed,
+        ...(record !== undefined ? { record } : {}),
+    };
+    // Snapshot values onto the form so its FormMeta carries them.
+    form.withValues(update.values);
+    const resolved = await resolveSchema([form], resolveCtx);
+    const formMeta = resolved[0];
+    if (!formMeta || formMeta.type !== 'form') {
+        return { ok: false, status: 422, error: 'Form re-resolved to non-form meta' };
+    }
+    return { ok: true, form: formMeta, dirty: update.dirty };
+}
+/**
+ * Plan #8 — handle a Wizard step-validate POST. Locates the form by id,
+ * walks to the Wizard descendant, validates only the fields inside step
+ * `step` against `values`. Returns `{ ok: true }` on success or
+ * `{ ok: false, status: 422, errors }` when fields fail validation.
+ *
+ * Errors are keyed by field name, same shape as the form-submit 422 path,
+ * so the client (`FormStateApi.applyErrors`) can surface them in-place.
+ */
+export async function formWizardData(pilotiq, scope, body, req) {
+    const cfg = pilotiq.getConfig();
+    const user = await pilotiq.resolveUser(req);
+    let PageClass;
+    let mode;
+    let record = undefined;
+    let baseCtxExtras = {};
+    if (scope.kind === 'resource-create' || scope.kind === 'resource-edit') {
+        const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+        if (!R)
+            return null;
+        const pages = R.resolvePages();
+        if (scope.kind === 'resource-create') {
+            if (!pages.create)
+                return null;
+            PageClass = pages.create;
+            mode = 'create';
+        }
+        else {
+            if (!pages.edit)
+                return null;
+            PageClass = pages.edit;
+            mode = 'edit';
+            baseCtxExtras = { recordId: scope.recordId };
+            if (R.model) {
+                try {
+                    record = await findRecord(R, scope.recordId, { user });
+                }
+                catch { /* ignore */ }
+            }
+            else {
+                record = { id: scope.recordId };
+            }
+        }
+    }
+    else if (scope.kind === 'global-edit') {
+        const G = cfg.globals.find(g => g.getSlug() === scope.slug);
+        if (!G)
+            return null;
+        const pages = G.resolvePages();
+        if (!pages.edit)
+            return null;
+        PageClass = pages.edit;
+        mode = 'edit';
+    }
+    else {
+        const P = cfg.pages.find(p => p.getSlug() === scope.pageSlug);
+        if (!P)
+            return null;
+        PageClass = P;
+        mode = 'edit';
+    }
+    if (!PageClass)
+        return null;
+    const baseCtx = uploadCtx(userCtx({ mode, basePath: cfg.path, ...baseCtxExtras }, user), cfg);
+    const elements = await callPageSchema(PageClass, baseCtx);
+    const form = selectFormById(findForms(elements), body.formId);
+    if (!form)
+        return { ok: false, status: 404, error: `Form "${body.formId}" not found on page` };
+    const formChildren = form.getChildren() ?? [];
+    const stepFields = findWizardStepFields(formChildren, body.step);
+    if (!stepFields)
+        return { ok: false, status: 404, error: `Step ${body.step} not found on form "${body.formId}"` };
+    const errors = await validateSchema(stepFields, body.values, record);
+    if (Object.keys(errors).length > 0) {
+        return { ok: false, status: 422, errors };
+    }
+    return { ok: true };
+}
+/** Find a `SelectField` by name inside a form's children, walking through
+ *  layout containers but stopping at Repeater / Builder boundaries
+ *  (parallel to `tagSelectCreateOptionUrls`'s walker). Returns the first
+ *  match or `undefined`. */
+function findSelectFieldByName(elements, name) {
+    for (const el of elements) {
+        if (el instanceof SelectField) {
+            if (el.name === name)
+                return el;
+            continue;
+        }
+        if (el instanceof RepeaterField)
+            continue;
+        if (el instanceof BuilderField)
+            continue;
+        const children = el.getChildren();
+        if (children && children.length > 0) {
+            const found = findSelectFieldByName(children, name);
+            if (found)
+                return found;
+        }
+    }
+    return undefined;
+}
+/**
+ * Audit row 2026-05-07 cont'd⁸ — handle a `SelectField.createOptionForm()`
+ * modal submit. Locates the parent form by `formId`, finds the SelectField
+ * by `fieldName`, re-evaluates the `createOptionAuthorize` rule (so a
+ * tampered URL can't bypass), coerces + validates the body against the
+ * sub-form's fields, then calls `createOptionUsing(handler)` and returns
+ * `{ option }` for the client to append + select.
+ *
+ * Returns `null` when the route prefix doesn't resolve to a real
+ * resource/global/page (route handler turns into 404).
+ */
+export async function formCreateOptionData(pilotiq, scope, body, req) {
+    const cfg = pilotiq.getConfig();
+    const user = await pilotiq.resolveUser(req);
+    let PageClass;
+    let mode;
+    let record = undefined;
+    let baseCtxExtras = {};
+    if (scope.kind === 'resource-create' || scope.kind === 'resource-edit') {
+        const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+        if (!R)
+            return null;
+        const pages = R.resolvePages();
+        if (scope.kind === 'resource-create') {
+            if (!pages.create)
+                return null;
+            PageClass = pages.create;
+            mode = 'create';
+        }
+        else {
+            if (!pages.edit)
+                return null;
+            PageClass = pages.edit;
+            mode = 'edit';
+            baseCtxExtras = { recordId: scope.recordId };
+            if (R.model) {
+                try {
+                    record = await findRecord(R, scope.recordId, { user });
+                }
+                catch { /* ignore */ }
+            }
+            else {
+                record = { id: scope.recordId };
+            }
+        }
+    }
+    else if (scope.kind === 'global-edit') {
+        const G = cfg.globals.find(g => g.getSlug() === scope.slug);
+        if (!G)
+            return null;
+        const pages = G.resolvePages();
+        if (!pages.edit)
+            return null;
+        PageClass = pages.edit;
+        mode = 'edit';
+    }
+    else {
+        const P = cfg.pages.find(p => p.getSlug() === scope.pageSlug);
+        if (!P)
+            return null;
+        PageClass = P;
+        mode = 'edit';
+    }
+    if (!PageClass)
+        return null;
+    const baseCtx = uploadCtx(userCtx({ mode, basePath: cfg.path, ...baseCtxExtras }, user), cfg);
+    const elements = await callPageSchema(PageClass, baseCtx);
+    const form = selectFormById(findForms(elements), body.formId);
+    if (!form)
+        return { ok: false, status: 404, error: `Form "${body.formId}" not found on page` };
+    const field = findSelectFieldByName(form.getChildren() ?? [], body.fieldName);
+    if (!field)
+        return { ok: false, status: 404, error: `SelectField "${body.fieldName}" not found on form "${body.formId}"` };
+    if (!field.hasCreateOption())
+        return { ok: false, status: 404, error: `SelectField "${body.fieldName}" does not configure createOptionForm()` };
+    const createForm = field.getCreateOptionForm();
+    const handler = field.getCreateOptionHandler();
+    if (!handler) {
+        return { ok: false, status: 500, error: `SelectField "${body.fieldName}" has createOptionForm() but no createOptionUsing() handler` };
+    }
+    // Re-evaluate authorize. Build the same ActionVisibilityContext shape
+    // the field's `toMeta` did — keeps server / meta-build paths consistent.
+    const authorize = field.getCreateOptionAuthorize();
+    if (authorize !== undefined) {
+        const authVisible = await (async () => {
+            if (typeof authorize !== 'function')
+                return authorize;
+            const visCtx = {};
+            if (record !== undefined)
+                visCtx.record = record;
+            if (user !== null)
+                visCtx.user = user;
+            try {
+                return await authorize(visCtx);
+            }
+            catch {
+                return false;
+            }
+        })();
+        if (!authVisible)
+            return { ok: false, status: 403, error: 'createOptionAuthorize denied' };
+    }
+    // Coerce + validate body against the sub-form's fields. The createOption
+    // sub-schema is detached from the parent form so we run it against its
+    // own children only — coerceFormValues mutates `out` to normalize toggle
+    // / number / date / etc. shapes (same shape parent forms use).
+    const coerced = coerceFormValues(createForm, { ...body.values });
+    const errors = await validateSchema(createForm, coerced, undefined);
+    if (Object.keys(errors).length > 0) {
+        return { ok: false, status: 422, errors };
+    }
+    const ctx = {
+        ...baseCtx,
+        values: coerced,
+        ...(record !== undefined ? { record } : {}),
+    };
+    let option;
+    try {
+        option = await handler(coerced, ctx);
+    }
+    catch (e) {
+        return { ok: false, status: 500, error: e instanceof Error ? e.message : String(e) };
+    }
+    if (!option || typeof option.value !== 'string' || typeof option.label !== 'string') {
+        return { ok: false, status: 500, error: `createOptionUsing must return { value: string, label: string }` };
+    }
+    return { ok: true, option };
+}
+function isMentionResolverField(el) {
+    if (el.getType() !== 'richtext')
+        return false;
+    const candidate = el;
+    return typeof candidate.resolveMention === 'function';
+}
+/**
+ * Walk a form's tree looking for the named field. Descends into Repeater /
+ * Builder rows when the requested name carries the row-prefix shape:
+ *
+ *   - Repeater rows: `<repeaterName>.<index>.<innerPath>` — looks up
+ *     `<innerPath>` against the Repeater's template schema. Field config
+ *     (providers, async resolver) is shared across rows, so any row index
+ *     resolves to the same template field.
+ *   - Builder rows: `<builderName>.<index>.data.<innerPath>` — looks up
+ *     `<innerPath>` against every block's schema; first match wins. Block
+ *     schemas often share leaf names — if two blocks define a RichTextField
+ *     with the same name and different async-mention providers, only the
+ *     first block in declaration order is reachable here. Authors needing
+ *     per-block resolution should give the leaves distinct names.
+ *
+ * Mirrors the boundary-stopping posture of `findFieldByName` inside
+ * `dispatchForm.ts` for top-level matches — only the dotted-prefix branch
+ * crosses into row schemas.
+ */
+function findRichTextFieldByName(elements, name) {
+    for (const el of elements) {
+        if (isMentionResolverField(el) && el.name === name) {
+            return el;
+        }
+        if (isRepeaterField(el)) {
+            const inner = stripRepeaterRowPrefix(name, el.name);
+            if (inner !== undefined) {
+                const hit = findRichTextFieldByName(el.getInnerSchema(), inner);
+                if (hit)
+                    return hit;
+            }
+            continue;
+        }
+        if (isBuilderField(el)) {
+            const inner = stripBuilderRowPrefix(name, el.name);
+            if (inner !== undefined) {
+                for (const block of el.getBlocks()) {
+                    const hit = findRichTextFieldByName(block.getSchema(), inner);
+                    if (hit)
+                        return hit;
+                }
+            }
+            continue;
+        }
+        const children = el.getChildren();
+        if (children && children.length > 0) {
+            const hit = findRichTextFieldByName(children, name);
+            if (hit)
+                return hit;
+        }
+    }
+    return undefined;
+}
+/**
+ * `items.0.body` → `body`. Returns `undefined` when the path doesn't match
+ * the `<repeaterName>.<digits>.<rest>` shape so the walker keeps searching
+ * other branches instead of misinterpreting an unrelated dotted name.
+ */
+function stripRepeaterRowPrefix(path, repeaterName) {
+    const parts = path.split('.');
+    if (parts.length < 3)
+        return undefined;
+    if (parts[0] !== repeaterName)
+        return undefined;
+    if (!/^\d+$/.test(parts[1] ?? ''))
+        return undefined;
+    return parts.slice(2).join('.');
+}
+/**
+ * `blocks.0.data.heading` → `heading`. The literal `data` segment matches
+ * Builder's wire shape (`{ __id, type, data: {…} }`) and distinguishes a
+ * Builder leaf from a Repeater leaf at the same depth.
+ */
+function stripBuilderRowPrefix(path, builderName) {
+    const parts = path.split('.');
+    if (parts.length < 4)
+        return undefined;
+    if (parts[0] !== builderName)
+        return undefined;
+    if (!/^\d+$/.test(parts[1] ?? ''))
+        return undefined;
+    if (parts[2] !== 'data')
+        return undefined;
+    return parts.slice(3).join('.');
+}
+/**
+ * Resolve one async-mention round-trip. Locates the page's schema, finds
+ * the form by `formId` and the RichTextField by `field`, calls its
+ * `resolveMention(trigger, query, ctx)`. Returns `{ ok, items }`, a 404
+ * when the form / field / trigger isn't present, or `null` for a missing
+ * page (the route handler turns `null` into a 404 too).
+ *
+ * The dispatcher is duck-typed against the contract in `@pilotiq/tiptap`'s
+ * `RichTextField` — pilotiq core never imports the adapter. Any future
+ * field-type that ships an async-resolve trigger can implement the same
+ * shape and pick up routing for free.
+ */
+export async function mentionResolveData(pilotiq, scope, body, req) {
+    const cfg = pilotiq.getConfig();
+    const user = await pilotiq.resolveUser(req);
+    let PageClass;
+    let mode;
+    let record = undefined;
+    let baseCtxExtras = {};
+    if (scope.kind === 'resource-create' || scope.kind === 'resource-edit') {
+        const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+        if (!R)
+            return null;
+        const pages = R.resolvePages();
+        if (scope.kind === 'resource-create') {
+            if (!pages.create)
+                return null;
+            PageClass = pages.create;
+            mode = 'create';
+        }
+        else {
+            if (!pages.edit)
+                return null;
+            PageClass = pages.edit;
+            mode = 'edit';
+            baseCtxExtras = { recordId: scope.recordId };
+            if (R.model) {
+                try {
+                    record = await findRecord(R, scope.recordId, { user });
+                }
+                catch { /* ignore */ }
+            }
+            else {
+                record = { id: scope.recordId };
+            }
+        }
+    }
+    else if (scope.kind === 'global-edit') {
+        const G = cfg.globals.find(g => g.getSlug() === scope.slug);
+        if (!G)
+            return null;
+        const pages = G.resolvePages();
+        if (!pages.edit)
+            return null;
+        PageClass = pages.edit;
+        mode = 'edit';
+    }
+    else {
+        const P = cfg.pages.find(p => p.getSlug() === scope.pageSlug);
+        if (!P)
+            return null;
+        PageClass = P;
+        mode = 'edit';
+    }
+    if (!PageClass)
+        return null;
+    const baseCtx = uploadCtx(userCtx({ mode, basePath: cfg.path, ...baseCtxExtras }, user), cfg);
+    const elements = await callPageSchema(PageClass, baseCtx);
+    const form = selectFormById(findForms(elements), body.formId);
+    if (!form)
+        return { ok: false, status: 404, error: `Form "${body.formId}" not found on page` };
+    const field = findRichTextFieldByName(form.getChildren() ?? [], body.field);
+    if (!field) {
+        return { ok: false, status: 404, error: `Rich-text field "${body.field}" not found on form "${body.formId}"` };
+    }
+    let items;
+    try {
+        items = await field.resolveMention(body.trigger, body.query, {
+            ...(record !== undefined ? { record } : {}),
+            ...(user !== null ? { user } : {}),
+            request: req,
+        });
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 422,
+            error: err instanceof Error ? err.message : 'Mention resolver threw',
+        };
+    }
+    if (items === null) {
+        return { ok: false, status: 404, error: `No mention provider for trigger "${body.trigger}" on field "${body.field}"` };
+    }
+    return { ok: true, items };
+}
+export async function resourceViewData(pilotiq, slug, recordId, req) {
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === slug);
+    if (!R)
+        return null;
+    const pages = R.resolvePages();
+    if (!pages.view)
+        return null;
+    const PageClass = pages.view;
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({ mode: 'view', recordId, basePath: cfg.path }, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    // For the view page we want the record threaded into resolveSchema so
+    // factory-attached visibility predicates see it. Resource.detail()
+    // already runs against the loaded record in user code; here we mirror
+    // that into ctx.record for the action eval pass.
+    let record = undefined;
+    if (R.model) {
+        try {
+            record = await findRecord(R, recordId, { user });
+        }
+        catch { /* ignore */ }
+    }
+    // Plan #11 — prepend the relation tabs strip with the "Details" tab
+    // active when the resource has relation managers configured.
+    const relationTabsEl = buildRelationTabs(R, recordId, cfg.path, '__view');
+    if (relationTabsEl)
+        elements.unshift(relationTabsEl);
+    const recordTitle = record !== undefined && record !== null
+        ? deriveParentTitle(R, record)
+        : recordId;
+    const breadcrumbs = resourceViewBreadcrumbs(cfg, R, recordTitle);
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const viewRoute = { resource: R, page: PageClass, recordId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'view', await resolveSchema(elements, record !== undefined ? { ...ctx, record } : ctx), viewRoute);
+    return {
+        panel: await panelInfo(pilotiq, req, viewRoute),
+        page: PageClass.toMeta(),
+        resource: { name: R.name, label: R.labelSingular, slug, icon: serializeIcon(R.icon, R.name) },
+        mode: 'view',
+        recordId,
+        basePath: cfg.path,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+export async function globalEditData(pilotiq, slug, prefill, req) {
+    const cfg = pilotiq.getConfig();
+    const G = cfg.globals.find(g => g.getSlug() === slug);
+    if (!G)
+        return null;
+    const pages = G.resolvePages();
+    if (!pages.edit)
+        return null;
+    const PageClass = pages.edit;
+    const editUrl = globalBasePath(cfg.path, G);
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({ mode: 'edit', basePath: cfg.path }, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    tagFormActions(elements, editUrl);
+    tagFormStateUrls(elements, formId => `${editUrl}/_form/${formId}/state`);
+    tagFormWizardUrls(elements, formId => `${editUrl}/_form/${formId}/wizard`);
+    tagRichTextMentionUrls(elements, formId => `${editUrl}/_form/${formId}/mentions`);
+    tagSelectCreateOptionUrls(elements, (formId, fieldName) => `${editUrl}/_form/${formId}/create-option/${fieldName}`);
+    const form = findForms(elements)[0];
+    let record = undefined;
+    if (form?.getLoadRecord()) {
+        try {
+            record = await form.getLoadRecord()('', { values: prefill?.values ?? {} });
+        }
+        catch { /* ignore */ }
+        if (!prefill?.values && record != null) {
+            const values = await applyFillPipeline(form, record);
+            form.withValues(values);
+        }
+        else if (prefill?.values) {
+            form.withValues(prefill.values);
+        }
+        if (prefill?.errors)
+            form.withErrors(prefill.errors);
+    }
+    const breadcrumbs = globalBreadcrumbs(cfg, G);
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const globalEditRoute = { global: G, page: PageClass };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'global-edit', await resolveSchema(elements, record !== undefined ? { ...ctx, record } : ctx), globalEditRoute);
+    return {
+        pageType: 'global',
+        panel: await panelInfo(pilotiq, req, globalEditRoute),
+        page: PageClass.toMeta(),
+        global: { name: G.name, label: G.label, labelSingular: G.labelSingular, slug, icon: serializeIcon(G.icon, G.name) },
+        basePath: cfg.path,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+        ...(prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+export async function globalViewData(pilotiq, slug, req) {
+    const cfg = pilotiq.getConfig();
+    const G = cfg.globals.find(g => g.getSlug() === slug);
+    if (!G)
+        return null;
+    const pages = G.resolvePages();
+    if (!pages.view)
+        return null;
+    const PageClass = pages.view;
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({ mode: 'view', basePath: cfg.path }, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    const breadcrumbs = globalBreadcrumbs(cfg, G);
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const globalViewRoute = { global: G, page: PageClass };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'global-view', await resolveSchema(elements, ctx), globalViewRoute);
+    return {
+        panel: await panelInfo(pilotiq, req, globalViewRoute),
+        page: PageClass.toMeta(),
+        global: { name: G.name, label: G.label, labelSingular: G.labelSingular, slug, icon: serializeIcon(G.icon, G.name) },
+        basePath: cfg.path,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+export async function customPageData(pilotiq, pageSlug, req) {
+    const cfg = pilotiq.getConfig();
+    const PageClass = cfg.pages.find(P => P.getSlug() === pageSlug);
+    if (!PageClass)
+        return null;
+    const pageUrl = pageBasePath(cfg.path, PageClass);
+    const user = await pilotiq.resolveUser(req);
+    const ctx = uploadCtx(userCtx({}, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    tagFormActions(elements, pageUrl);
+    tagFormStateUrls(elements, formId => `${pageUrl}/_form/${formId}/state`);
+    tagFormWizardUrls(elements, formId => `${pageUrl}/_form/${formId}/wizard`);
+    tagRichTextMentionUrls(elements, formId => `${pageUrl}/_form/${formId}/mentions`);
+    tagSelectCreateOptionUrls(elements, (formId, fieldName) => `${pageUrl}/_form/${formId}/create-option/${fieldName}`);
+    tagActionDispatch(elements, pageUrl);
+    // Page-scope polling URL (mirrors `${base}/${pageSlug}/_widget/:id`
+    // route registered in routes.ts).
+    tagWidgetUrls(elements, id => `${pageUrl}/_widget/${id}`);
+    const widgetData = await resolveServerDataElements(elements, ctx);
+    const breadcrumbs = customPageBreadcrumbs(cfg, PageClass);
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const customRoute = { page: PageClass };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'page', await resolveSchema(elements, ctx), customRoute);
+    return {
+        pageType: 'page',
+        panel: await panelInfo(pilotiq, req, customRoute),
+        page: PageClass.toMeta(),
+        schemaData,
+        _widgetData: widgetData,
+        basePath: cfg.path,
+        layout: cfg.layout,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+/**
+ * Plan #15 — re-resolve the active page's schema, find the widget by
+ * id, fail-closed via `evaluateVisibility`, then run
+ * `resolveServerData(ctx)` and return the payload.
+ *
+ *   - 404 when the page or widget id doesn't exist.
+ *   - 403 when the layout-level `visible(rule)` says the widget is
+ *     hidden (server doesn't show data for hidden surfaces).
+ *   - 500 when the hook itself throws.
+ *
+ * `body.filter` rides along on `RenderContext.filter` so per-chart
+ * filter dropdowns can re-fetch with the new filter value. Treated as
+ * an opaque string — widget hooks decode it however they want.
+ */
+export async function widgetData(pilotiq, scope, body, req) {
+    const cfg = pilotiq.getConfig();
+    const user = await pilotiq.resolveUser(req);
+    let elements;
+    let ctx;
+    if (scope.kind === 'panel') {
+        if (!cfg.dashboardPage)
+            return { ok: false, status: 404, error: 'No dashboard page registered' };
+        ctx = uploadCtx(userCtx({ basePath: cfg.path }, user), cfg);
+        elements = await callPageSchema(cfg.dashboardPage, ctx);
+    }
+    else if (scope.kind === 'page') {
+        const P = cfg.pages.find(p => p.getSlug() === scope.pageSlug);
+        if (!P)
+            return { ok: false, status: 404, error: 'Page not found' };
+        ctx = uploadCtx(userCtx({ basePath: cfg.path }, user), cfg);
+        elements = await callPageSchema(P, ctx);
+    }
+    else {
+        // Resource-scope: re-resolve the list page's schema so widgets from
+        // `Resource.headerSchema()` / `footerSchema()` are reachable.
+        const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+        if (!R)
+            return { ok: false, status: 404, error: 'Resource not found' };
+        const pages = R.resolvePages();
+        if (!pages.index)
+            return { ok: false, status: 404, error: 'Resource has no list page' };
+        ctx = uploadCtx(userCtx({ mode: 'table', basePath: cfg.path }, user), cfg);
+        elements = await callPageSchema(pages.index, ctx);
+    }
+    // Stamp the request's filter onto the render context so widget hooks
+    // can branch on it. Opaque string — widgets decode their own format.
+    if (body.filter !== undefined)
+        ctx = { ...ctx, filter: body.filter };
+    const widget = findWidgetById(elements, body.id);
+    if (!widget)
+        return { ok: false, status: 404, error: `Widget "${body.id}" not found` };
+    // Layout-level visibility re-check — if the widget is hidden by a
+    // visible(rule), refuse to ship data. Same fail-closed posture as
+    // the schema resolver. (Parent-container `visible(false)` would
+    // already drop the widget from the schema tree at SSR time, so a
+    // direct hidden-widget probe here covers the visible-rule-only case.)
+    const layoutCtx = {};
+    if (user !== null && user !== undefined)
+        layoutCtx.user = user;
+    if (!await widget.evaluateVisibility(layoutCtx)) {
+        return { ok: false, status: 403, error: 'Widget hidden' };
+    }
+    try {
+        const data = await widget.resolveServerData(ctx);
+        return { ok: true, data, timestamp: Date.now() };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 500,
+            error: err instanceof Error ? err.message : 'Widget failed',
+        };
+    }
+}
+/** Walk the element tree looking for a server-data element with the
+ *  given id. Same walker as `collectServerDataElements` but stops on
+ *  first match. */
+function findWidgetById(elements, id) {
+    let found;
+    const walk = (els) => {
+        for (const el of els) {
+            if (found)
+                return;
+            if (isServerDataElement(el)) {
+                if (el.getId() === id) {
+                    found = el;
+                    return;
+                }
+                continue;
+            }
+            const type = el.getType();
+            if (type === 'form' || type === 'repeater' || type === 'builder' || type === 'table' || type === 'tableWidget')
+                continue;
+            const children = el.getChildren();
+            if (children)
+                walk(children);
+        }
+    };
+    walk(elements);
+    return found;
+}
+// ─── Plan #12 global search data builder ─────────────────────
+/**
+ * Resolve the user via `pilotiq.resolveUser(req)` and run the
+ * panel-wide search. Mirrors the formStateData/formWizardData
+ * shape so the `/_search` route handler stays a thin wrapper.
+ *
+ * Also resolves the `panels::global-search.results.before/.after`
+ * render hooks when the panel registered any — sparse, absent when
+ * neither slot has registered fns. Sent as a `RenderHookMap` so the
+ * client `<CommandPalette>` can mount `<RenderHookSlot>` above and
+ * below the result list (same pattern chrome slots use).
+ */
+export async function searchData(pilotiq, query, req) {
+    const user = await pilotiq.resolveUser(req);
+    const results = await searchAllResources(pilotiq, query, user);
+    const cfg = pilotiq.getConfig();
+    const out = {
+        ok: true,
+        results,
+    };
+    if (cfg.renderHooks && cfg.renderHooks.length > 0) {
+        const hooks = await resolvePageHooks(pilotiq, user, pageHooksFor('search'), { url: `${cfg.path}/_search` });
+        if (Object.keys(hooks).length > 0)
+            out.renderHooks = hooks;
+    }
+    return out;
+}
+/**
+ * Single entry point Vike's `+data` hook calls. Inspects the page id and
+ * route params, finds the panel via `PilotiqRegistry`, and dispatches to
+ * the matching builder. Returns the same shape SSR's `viewProps` carries.
+ */
+export async function dispatchPageData(pageContext) {
+    const { pageId, routeParams = {} } = pageContext;
+    const search = pageContext.urlParsed?.search ?? {};
+    const basePathParam = routeParams['basePath'];
+    const basePath = basePathParam ? `/${basePathParam}` : '';
+    const panel = basePath ? PilotiqRegistry.findByPath(basePath) : null;
+    if (!panel)
+        return null;
+    switch (pageId) {
+        case '/pages/(pilotiq)/dashboard':
+            return dashboardData(panel);
+        case '/pages/(pilotiq)/slug': {
+            // 2-segment URL: could be a resource list, a global edit, or a custom page.
+            const slug = routeParams['slug'];
+            if (!slug)
+                return null;
+            const cfg = panel.getConfig();
+            if (cfg.resources.some(R => R.getSlug() === slug)) {
+                return resourceIndexData(panel, slug, search);
+            }
+            if (cfg.globals.some(G => G.getSlug() === slug)) {
+                return globalEditData(panel, slug);
+            }
+            return customPageData(panel, slug);
+        }
+        case '/pages/(pilotiq)/resource-create': {
+            const slug = routeParams['slug'];
+            if (!slug)
+                return null;
+            return resourceCreateData(panel, slug);
+        }
+        case '/pages/(pilotiq)/resource-edit': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            if (!slug || !id)
+                return null;
+            return resourceEditData(panel, slug, id);
+        }
+        case '/pages/(pilotiq)/resource-view': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            if (!slug)
+                return null;
+            // Globals also use this route under `/{slug}/view` — id will be 'view'.
+            if (id === 'view')
+                return globalViewData(panel, slug);
+            if (!id)
+                return null;
+            return resourceViewData(panel, slug, id);
+        }
+        case '/pages/(pilotiq)/relation-list': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            const relationship = routeParams['relationship'];
+            if (!slug || !id || !relationship)
+                return null;
+            const out = await relationManagerData(panel, {
+                kind: 'relation-list', slug, recordId: id, relationship,
+                query: search,
+            });
+            // Tagged failure shapes (`{ ok: false, status: 403 }`) leak straight
+            // through to the +Page renderer, which can branch on the shape.
+            // For Plan #11 we let null short-circuit the SPA render the same
+            // way the resource builders do.
+            return out === null ? null : out;
+        }
+        case '/pages/(pilotiq)/relation-create': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            const relationship = routeParams['relationship'];
+            if (!slug || !id || !relationship)
+                return null;
+            const out = await relationManagerData(panel, {
+                kind: 'relation-create', slug, recordId: id, relationship,
+            });
+            return out === null ? null : out;
+        }
+        case '/pages/(pilotiq)/relation-view': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            const relationship = routeParams['relationship'];
+            const childId = routeParams['childId'];
+            if (!slug || !id || !relationship || !childId)
+                return null;
+            const out = await relationManagerData(panel, {
+                kind: 'relation-view', slug, recordId: id, relationship, childId,
+            });
+            return out === null ? null : out;
+        }
+        case '/pages/(pilotiq)/relation-edit': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            const relationship = routeParams['relationship'];
+            const childId = routeParams['childId'];
+            if (!slug || !id || !relationship || !childId)
+                return null;
+            const out = await relationManagerData(panel, {
+                kind: 'relation-edit', slug, recordId: id, relationship, childId,
+            });
+            return out === null ? null : out;
+        }
+        // Phase B nested-relation routes. Param names match those declared
+        // by the auto-gen Vike stubs in `src/vite.ts`:
+        //   id, relationship, childId1, relationship2, childId2.
+        case '/pages/(pilotiq)/nested-relation-list': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            const relationship = routeParams['relationship'];
+            const childId1 = routeParams['childId1'];
+            const relationship2 = routeParams['relationship2'];
+            if (!slug || !id || !relationship || !childId1 || !relationship2)
+                return null;
+            const out = await relationManagerData(panel, {
+                kind: 'nested-relation-list', slug,
+                chain: [
+                    { recordId: id, relationship },
+                    { recordId: childId1, relationship: relationship2 },
+                ],
+                query: search,
+            });
+            return out === null ? null : out;
+        }
+        case '/pages/(pilotiq)/nested-relation-create': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            const relationship = routeParams['relationship'];
+            const childId1 = routeParams['childId1'];
+            const relationship2 = routeParams['relationship2'];
+            if (!slug || !id || !relationship || !childId1 || !relationship2)
+                return null;
+            const out = await relationManagerData(panel, {
+                kind: 'nested-relation-create', slug,
+                chain: [
+                    { recordId: id, relationship },
+                    { recordId: childId1, relationship: relationship2 },
+                ],
+            });
+            return out === null ? null : out;
+        }
+        case '/pages/(pilotiq)/nested-relation-view': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            const relationship = routeParams['relationship'];
+            const childId1 = routeParams['childId1'];
+            const relationship2 = routeParams['relationship2'];
+            const childId2 = routeParams['childId2'];
+            if (!slug || !id || !relationship || !childId1 || !relationship2 || !childId2)
+                return null;
+            const out = await relationManagerData(panel, {
+                kind: 'nested-relation-view', slug,
+                chain: [
+                    { recordId: id, relationship },
+                    { recordId: childId1, relationship: relationship2 },
+                ],
+                childId: childId2,
+            });
+            return out === null ? null : out;
+        }
+        case '/pages/(pilotiq)/nested-relation-edit': {
+            const slug = routeParams['slug'];
+            const id = routeParams['id'];
+            const relationship = routeParams['relationship'];
+            const childId1 = routeParams['childId1'];
+            const relationship2 = routeParams['relationship2'];
+            const childId2 = routeParams['childId2'];
+            if (!slug || !id || !relationship || !childId1 || !relationship2 || !childId2)
+                return null;
+            const out = await relationManagerData(panel, {
+                kind: 'nested-relation-edit', slug,
+                chain: [
+                    { recordId: id, relationship },
+                    { recordId: childId1, relationship: relationship2 },
+                ],
+                childId: childId2,
+            });
+            return out === null ? null : out;
+        }
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=pageData.js.map