@pilotiq/pilotiq 0.6.1 → 0.7.0

package/dist/pageData.js

@@ -40,6 +40,12 @@ export async function panelInfo(pilotiq, req, route = {}) {
         buildRightSidebarMeta(cfg, user),
     ]);
     const databaseNotifications = buildDatabaseNotificationsMeta(cfg, user);
+    // AI suggestion mode — sparse: omit when 'auto' (the default) so the
+    // wire shape stays minimal for panels that don't opt into review mode.
+    // Plugin clients (e.g. @pilotiq-pro/ai's `AiClientToolBindings`) read
+    // this to decide whether to apply writes immediately or stage them as
+    // PendingSuggestions for user approval.
+    const aiSuggestionsMode = pilotiq.getAiSuggestionsMode();
     return {
         name: cfg.name,
         branding: cfg.branding,
@@ -50,6 +56,7 @@ export async function panelInfo(pilotiq, req, route = {}) {
         ...(databaseNotifications ? { databaseNotifications } : {}),
         ...(rightSidebar ? { rightSidebar } : {}),
         ...(Object.keys(renderHooks).length > 0 ? { renderHooks } : {}),
+        ...(aiSuggestionsMode !== 'auto' ? { aiSuggestionsMode } : {}),
     };
 }
 /**
@@ -1570,7 +1577,7 @@ export async function resourceEditData(pilotiq, slug, recordId, prefill, req) {
     // navigation strip so users can drill into each manager's table
     // without leaving the parent record context. The "Edit" tab is
     // active here.
-    const relationTabsEl = buildRelationTabs(R, recordId, cfg.path, '__edit');
+    const relationTabsEl = await buildRelationTabs(R, recordId, cfg.path, '__edit', user, record);
     if (relationTabsEl)
         elements.unshift(relationTabsEl);
     const recordTitle = record !== undefined && record !== null
@@ -1832,7 +1839,7 @@ async function buildRelationListData(pilotiq, R, M, Related, parentRecord, scope
     const elements = [table];
     tagActionDispatch(elements, listUrl);
     await loadTableRecords(elements, scope.query ?? {}, listUrl, user);
-    const tabs = buildRelationTabs(R, scope.recordId, base, scope.relationship);
+    const tabs = await buildRelationTabs(R, scope.recordId, base, scope.relationship, user, parentRecord);
     if (tabs)
         elements.unshift(tabs);
     const breadcrumbs = relationListBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord));
@@ -1889,7 +1896,7 @@ async function buildRelationCreateData(pilotiq, R, M, Related, parentRecord, sco
         if (scope.prefill.errors)
             form.withErrors(scope.prefill.errors);
     }
-    const tabs = buildRelationTabs(R, scope.recordId, base, scope.relationship);
+    const tabs = await buildRelationTabs(R, scope.recordId, base, scope.relationship, user, parentRecord);
     if (tabs)
         elements.unshift(tabs);
     const breadcrumbs = relationCreateBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord));
@@ -1956,10 +1963,10 @@ async function buildRelationViewData(pilotiq, R, M, Related, parentRecord, scope
     // view straight into a grandchild list / create / view / edit page.
     // Active key `'__view'` because the user is currently viewing the
     // leaf parent record itself, not any nested manager.
-    const nestedTabs = buildNestedRelationTabs(R, M, base, { recordId: scope.recordId, relationship: scope.relationship }, scope.childId, '__view');
+    const nestedTabs = await buildNestedRelationTabs(R, M, base, { recordId: scope.recordId, relationship: scope.relationship }, scope.childId, '__view', user, child);
     if (nestedTabs)
         elements.unshift(nestedTabs);
-    const tabs = buildRelationTabs(R, scope.recordId, base, scope.relationship);
+    const tabs = await buildRelationTabs(R, scope.recordId, base, scope.relationship, user, parentRecord);
     if (tabs)
         elements.unshift(tabs);
     const breadcrumbs = relationViewBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord), deriveParentTitle(Related, child, M));
@@ -2041,7 +2048,7 @@ async function buildRelationEditData(pilotiq, R, M, Related, parentRecord, scope
         const values = await applyFillPipeline(form, child);
         form.withValues(values);
     }
-    const tabs = buildRelationTabs(R, scope.recordId, base, scope.relationship);
+    const tabs = await buildRelationTabs(R, scope.recordId, base, scope.relationship, user, parentRecord);
     if (tabs)
         elements.unshift(tabs);
     const breadcrumbs = relationEditBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord), scope.childId, deriveParentTitle(Related, child, M));
@@ -2272,7 +2279,7 @@ async function buildNestedRelationListData(pilotiq, scope, resolved, req, user)
     const elements = [table];
     tagActionDispatch(elements, listUrl);
     await loadTableRecords(elements, scope.query ?? {}, listUrl, user);
-    const tabs = buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship);
+    const tabs = await buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship, user, resolved.child1);
     if (tabs)
         elements.unshift(tabs);
     const breadcrumbs = nestedRelationListBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1));
@@ -2307,7 +2314,7 @@ async function buildNestedRelationCreateData(pilotiq, scope, resolved, req, user
         if (scope.prefill.errors)
             form.withErrors(scope.prefill.errors);
     }
-    const tabs = buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship);
+    const tabs = await buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship, user, resolved.child1);
     if (tabs)
         elements.unshift(tabs);
     const breadcrumbs = nestedRelationCreateBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(resolved.Related1, child1, resolved.M1));
@@ -2347,7 +2354,7 @@ async function buildNestedRelationViewData(pilotiq, scope, resolved, req, user)
     const cfg = pilotiq.getConfig();
     const base = cfg.path;
     const elements = M2.detail(child2, child1);
-    const tabs = buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship);
+    const tabs = await buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship, user, resolved.child1);
     if (tabs)
         elements.unshift(tabs);
     const breadcrumbs = nestedRelationViewBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1), deriveParentTitle(Related2, child2, M2));
@@ -2403,7 +2410,7 @@ async function buildNestedRelationEditData(pilotiq, scope, resolved, req, user)
         const values = await applyFillPipeline(form, child2);
         form.withValues(values);
     }
-    const tabs = buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship);
+    const tabs = await buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship, user, resolved.child1);
     if (tabs)
         elements.unshift(tabs);
     const breadcrumbs = nestedRelationEditBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1), scope.childId, deriveParentTitle(Related2, child2, M2));
@@ -2436,13 +2443,27 @@ async function buildNestedRelationEditData(pilotiq, scope, resolved, req, user)
  * absent that, callers skip the prepend so single-manager surfaces stay
  * clean. `activeKey` accepts the literal `'__view'` for the leaf
  * parent's view tab, or any sibling manager's relationship key.
+ *
+ * Per-tab `canX` gating (2026-05-11) — sibling nested-manager tabs run
+ * `N.canViewAny(user, child1Record)` (with fall-through to the related
+ * Resource via `safeManagerPolicy`) so the strip hides tabs the user
+ * couldn't reach anyway. The back-link `__view` stays unconditional
+ * since the user is already on a page scoped under `M.canViewAny` —
+ * they reached this strip, they can navigate back to it.
  */
-function buildNestedRelationTabs(R, M, basePath, step0, child1Id, activeKey) {
+async function buildNestedRelationTabs(R, M, basePath, step0, child1Id, activeKey, user, child1Record) {
     const siblings = M.relations();
     if (siblings.length === 0)
         return undefined;
     const resourceBase = resourceBasePath(basePath, R);
     const parentBase = `${resourceBase}/${step0.recordId}/${step0.relationship}`;
+    // Sibling gating runs in parallel — each predicate may hit auth /
+    // db, so don't serialize them.
+    const siblingGates = siblings.map(N => {
+        const Related = N.relatedResource;
+        return safeManagerPolicyImpl(N, 'canViewAny', Related, user, child1Record);
+    });
+    const siblingVisible = await Promise.all(siblingGates);
     const tabs = [];
     // Back-link: depth-2 view page for the leaf parent record. Acts as
     // the "View" tab in the same way `__view` does on depth-1 strips.
@@ -2454,13 +2475,15 @@ function buildNestedRelationTabs(R, M, basePath, step0, child1Id, activeKey) {
         icon: M.getIcon(),
         iconOwner: M.name,
     }));
-    for (const N of siblings) {
+    siblings.forEach((N, i) => {
+        if (!siblingVisible[i])
+            return;
         let nestedRel = '';
         try {
             nestedRel = N.getRelationship();
         }
         catch {
-            continue;
+            return;
         }
         const icon = N.getIcon();
         tabs.push(relationTab({
@@ -2470,7 +2493,12 @@ function buildNestedRelationTabs(R, M, basePath, step0, child1Id, activeKey) {
             active: activeKey === nestedRel,
             ...(icon !== undefined ? { icon, iconOwner: N.name } : {}),
         }));
-    }
+    });
+    // After gating, only the back-link may remain — one tab isn't a
+    // useful sub-nav. Drop the strip in that case (consistent with
+    // depth-1's empty-tabs branch).
+    if (tabs.length <= 1)
+        return undefined;
     return RelationTabs.make(tabs);
 }
 /**
@@ -2481,11 +2509,25 @@ function buildNestedRelationTabs(R, M, basePath, step0, child1Id, activeKey) {
  * the manager's relationship key for a manager tab.
  *
  * Sub-nav follow-up (2026-05-03 cont'd) — emit BOTH `__view` and
- * `__edit` as sibling tabs (Filament-style record sub-navigation)
- * instead of one parent tab whose label depends on mode. Tabs are
- * dropped when the corresponding page role isn't registered (a
- * Resource overriding `pages()` to omit `view` or `edit` shouldn't
- * surface a tab that 404s).
+ * `__edit` as sibling tabs (record sub-navigation) instead of one
+ * parent tab whose label depends on mode. Tabs are dropped when the
+ * corresponding page role isn't registered (a Resource overriding
+ * `pages()` to omit `view` or `edit` shouldn't surface a tab that
+ * 404s).
+ *
+ * Per-tab `canX` gating (2026-05-11) — the strip now also evaluates
+ * the matching predicate for each tab and drops the entry when the
+ * user can't reach it. Routes still enforce; this is presentation
+ * polish so the chrome doesn't promise a link that 403s on click.
+ *
+ *   - `__view`  → `R.canView(user, parentRecord)` (skip gating when
+ *                 `parentRecord` is undefined — record load failed,
+ *                 so the route's own load+gate will surface a 404/403
+ *                 rather than the strip hiding silently).
+ *   - `__edit`  → `R.canEdit(user, parentRecord)` (same posture).
+ *   - manager  → `safeManagerPolicy(M, 'canViewAny', Related, user,
+ *                 parentRecord)` (falls through to Related's
+ *                 `canViewAny` when the manager hasn't overridden).
  *
  * Returns `undefined` when the resource has no relation managers — the
  * caller can then skip the prepend entirely so resources without
@@ -2493,17 +2535,55 @@ function buildNestedRelationTabs(R, M, basePath, step0, child1Id, activeKey) {
  * (View+Edit sub-nav alone isn't worth a tab strip; users navigate
  * those via headerActions or the back link.)
  */
-function buildRelationTabs(R, recordId, basePath, activeKey) {
+async function buildRelationTabs(R, recordId, basePath, activeKey, user, parentRecord) {
     const managers = R.relations();
-    if (managers.length === 0)
+    const recordPageMap = R.getRecordPages();
+    const recordPageSlugs = Object.keys(recordPageMap);
+    // No managers AND no record sub-pages → no strip. View+Edit alone
+    // isn't worth a tab strip; users navigate those via headerActions or
+    // the back link. (When either is non-empty, the strip is worth
+    // mounting even if all the dynamic tabs end up gated away — the
+    // post-gate emptiness check below catches that.)
+    if (managers.length === 0 && recordPageSlugs.length === 0)
         return undefined;
     const resourceBase = resourceBasePath(basePath, R);
     const pages = R.resolvePages();
+    // Evaluate every per-tab predicate in parallel. The arrays line up
+    // 1:1 with `pages.view` / `pages.edit` / `recordPageSlugs` /
+    // `managers` below — we resolve all gates first so the tab-build
+    // loop stays straight-line.
+    // Record-aware predicates short-circuit to `true` when no parent
+    // record was loaded (presentation should never hide more aggressively
+    // than the route can enforce; a missing record means the route will
+    // 404/403 on click and the strip stays consistent with that).
+    const canViewPromise = pages.view && parentRecord !== undefined && parentRecord !== null
+        ? safeBool(() => R.canView(user, parentRecord))
+        : Promise.resolve(true);
+    const canEditPromise = pages.edit && parentRecord !== undefined && parentRecord !== null
+        ? safeBool(() => R.canEdit(user, parentRecord))
+        : Promise.resolve(true);
+    const recordPageGates = recordPageSlugs.map(subSlug => {
+        // Record sub-page gates run against the parent record verbatim —
+        // missing record still calls the predicate so a sub-page that
+        // gates on global user state (no record needed) still evaluates.
+        // safeBool fails closed for throwing predicates.
+        return safeBool(() => recordPageMap[subSlug].canAccess(user, parentRecord));
+    });
+    const managerGates = managers.map(M => {
+        const Related = M.relatedResource;
+        return safeManagerPolicyImpl(M, 'canViewAny', Related, user, parentRecord);
+    });
+    const gateResults = await Promise.all([
+        canViewPromise, canEditPromise,
+        ...recordPageGates,
+        ...managerGates,
+    ]);
+    const canView = gateResults[0];
+    const canEdit = gateResults[1];
+    const recordPageVisible = gateResults.slice(2, 2 + recordPageSlugs.length);
+    const managerVisible = gateResults.slice(2 + recordPageSlugs.length);
     const tabs = [];
-    // View tab — only when the resource has a ViewPage registered.
-    // Defaults always include one; users who pruned ViewPage in their
-    // `static pages()` override get no broken link.
-    if (pages.view) {
+    if (pages.view && canView) {
         tabs.push(relationTab({
             key: '__view',
             label: 'View',
@@ -2513,8 +2593,7 @@ function buildRelationTabs(R, recordId, basePath, activeKey) {
             iconOwner: R.name,
         }));
     }
-    // Edit tab — same defensive check.
-    if (pages.edit) {
+    if (pages.edit && canEdit) {
         tabs.push(relationTab({
             key: '__edit',
             label: 'Edit',
@@ -2527,13 +2606,34 @@ function buildRelationTabs(R, recordId, basePath, activeKey) {
             iconOwner: R.name,
         }));
     }
-    for (const M of managers) {
+    // Record sub-page tabs — between Edit and the managers, in declaration
+    // order. Tab label inherits from the sub-page's class (`getLabel()`);
+    // icon picks up the sub-page's static `icon` when set. Slug doubles as
+    // the URL segment AND the `activeKey` discriminator the data builder
+    // passes when rendering the sub-page.
+    recordPageSlugs.forEach((subSlug, i) => {
+        if (!recordPageVisible[i])
+            return;
+        const SubPage = recordPageMap[subSlug];
+        tabs.push(relationTab({
+            key: subSlug,
+            label: SubPage.getLabel(),
+            url: `${resourceBase}/${recordId}/${subSlug}`,
+            active: activeKey === subSlug,
+            ...(SubPage.icon !== undefined
+                ? { icon: SubPage.icon, iconOwner: SubPage.name }
+                : {}),
+        }));
+    });
+    managers.forEach((M, i) => {
+        if (!managerVisible[i])
+            return;
         let rel = '';
         try {
             rel = M.getRelationship();
         }
         catch {
-            continue;
+            return;
         }
         const icon = M.getIcon();
         tabs.push(relationTab({
@@ -2543,9 +2643,27 @@ function buildRelationTabs(R, recordId, basePath, activeKey) {
             active: activeKey === rel,
             ...(icon !== undefined ? { icon, iconOwner: M.name } : {}),
         }));
-    }
+    });
+    // After gating, the strip may collapse to zero entries. Mirror the
+    // "no managers + no sub-pages" branch above — no strip is friendlier
+    // than a one-tab strip with just the active page.
+    if (tabs.length === 0)
+        return undefined;
     return RelationTabs.make(tabs);
 }
+/**
+ * Tiny shim over `try { Boolean(await fn()) } catch { false }` so the
+ * relation-tabs builder stays straight-line — mirrors `checkPolicy`
+ * in `routes.ts` but kept local to avoid cross-module imports.
+ */
+async function safeBool(fn) {
+    try {
+        return Boolean(await fn());
+    }
+    catch {
+        return false;
+    }
+}
 /** Pull a human-readable title off a parent record for breadcrumb /
  *  page-title use. Falls back through `recordTitleAttribute` →
  *  `name` → `title` → primary key value → 'Record'. */
@@ -3330,7 +3448,7 @@ export async function resourceViewData(pilotiq, slug, recordId, req) {
     }
     // Plan #11 — prepend the relation tabs strip with the "Details" tab
     // active when the resource has relation managers configured.
-    const relationTabsEl = buildRelationTabs(R, recordId, cfg.path, '__view');
+    const relationTabsEl = await buildRelationTabs(R, recordId, cfg.path, '__view', user, record);
     if (relationTabsEl)
         elements.unshift(relationTabsEl);
     const recordTitle = record !== undefined && record !== null
@@ -3353,6 +3471,91 @@ export async function resourceViewData(pilotiq, slug, recordId, req) {
         notifications: consumeFlashedNotifications(req),
     };
 }
+/**
+ * Custom record sub-page data builder. Mounted at
+ * `${resourceBase}/${slug}/:id/${subPageSlug}` for each entry in
+ * `Resource.pages().record`. Mirrors `resourceViewData`'s shape: load
+ * the record, run R.canAccess + R.canView (parent-resource gates),
+ * then SubPage.canAccess(user, record) (sub-page-specific gate),
+ * then render the sub-page's schema with `ctx.record` set. Tab strip
+ * carries the sub-page slug as the active key so the matching record
+ * sub-page tab highlights.
+ *
+ * Returns:
+ *   - `null` — resource / sub-page slug not found (404 upstream).
+ *   - `{ ok: false, status: 403 }` — any gate fails or throws.
+ *   - resolved page data — on success.
+ */
+export async function resourceRecordPageData(pilotiq, slug, recordId, subPageSlug, req) {
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === slug);
+    if (!R)
+        return null;
+    const recordPages = R.getRecordPages();
+    const PageClass = recordPages[subPageSlug];
+    if (!PageClass)
+        return null;
+    const user = await pilotiq.resolveUser(req);
+    // Load the parent record before gating so canView / SubPage.canAccess
+    // can branch on record state. Sub-pages without a Resource.model
+    // still get gated against an `undefined` record — the same posture as
+    // resourceViewData when no model is bound.
+    let record = undefined;
+    if (R.model) {
+        try {
+            record = await findRecord(R, recordId, { user });
+        }
+        catch { /* ignore */ }
+    }
+    if (record === undefined || record === null) {
+        // Distinguish "model bound but record missing" (route should 404)
+        // from "no model bound" (treat record as `{ id: recordId }` so the
+        // page can still render — same convention as the edit page).
+        if (R.model)
+            return null;
+        record = { id: recordId };
+    }
+    // Three gates: parent resource access + view, then the sub-page's own
+    // canAccess. The route would have run R.canAccess upstream, but
+    // re-running here makes resourceRecordPageData safe to call from
+    // dispatchPageData (where the SPA path skips the route prelude).
+    if (!await safeBool(() => R.canAccess(user)))
+        return { ok: false, status: 403 };
+    if (!await safeBool(() => R.canView(user, record)))
+        return { ok: false, status: 403 };
+    if (!await safeBool(() => PageClass.canAccess(user, record)))
+        return { ok: false, status: 403 };
+    const ctx = uploadCtx(userCtx({ mode: 'view', recordId, basePath: cfg.path }, user), cfg);
+    const elements = await callPageSchema(PageClass, ctx);
+    // Insert the relation-tabs strip with the sub-page slug active so the
+    // matching tab highlights. `buildRelationTabs` evaluates per-tab
+    // gating against `user + record` — record sub-page tabs are gated
+    // alongside __view/__edit/managers.
+    const relationTabsEl = await buildRelationTabs(R, recordId, cfg.path, subPageSlug, user, record);
+    if (relationTabsEl)
+        elements.unshift(relationTabsEl);
+    const recordTitle = record !== undefined && record !== null
+        ? deriveParentTitle(R, record)
+        : recordId;
+    const breadcrumbs = resourceViewBreadcrumbs(cfg, R, recordTitle);
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const recordPageRoute = { resource: R, page: PageClass, recordId };
+    const schemaData = await applyRoleHooks(pilotiq, user, 'view', await resolveSchema(elements, record !== undefined ? { ...ctx, record } : ctx), recordPageRoute);
+    return {
+        pageType: 'record-page',
+        panel: await panelInfo(pilotiq, req, recordPageRoute),
+        page: PageClass.toMeta(),
+        resource: { name: R.name, label: R.labelSingular, slug, icon: serializeIcon(R.icon, R.name) },
+        mode: 'record',
+        recordId,
+        subPage: { slug: subPageSlug, label: PageClass.getLabel() },
+        basePath: cfg.path,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
 export async function globalEditData(pilotiq, slug, prefill, req) {
     const cfg = pilotiq.getConfig();
     const G = cfg.globals.find(g => g.getSlug() === slug);
@@ -3662,9 +3865,14 @@ export async function dispatchPageData(pageContext) {
             });
             // Tagged failure shapes (`{ ok: false, status: 403 }`) leak straight
             // through to the +Page renderer, which can branch on the shape.
-            // For Plan #11 we let null short-circuit the SPA render the same
-            // way the resource builders do.
-            return out === null ? null : out;
+            // null = no manager named `relationship` on R; fall through to the
+            // record sub-page lookup so URLs like `/admin/users/u1/activity`
+            // (where `activity` is registered under `pages().record`) route
+            // through `resourceRecordPageData` rather than 404ing.
+            if (out !== null)
+                return out;
+            const recordOut = await resourceRecordPageData(panel, slug, id, relationship);
+            return recordOut === null ? null : recordOut;
         }
         case '/pages/(pilotiq)/relation-create': {
             const slug = routeParams['slug'];