@pilotiq/pilotiq 0.7.2 → 0.8.0

package/dist/routes/pages.js

@@ -0,0 +1,145 @@
+import { view } from '@rudderjs/view';
+import { resolveSchema } from '../schema/resolveSchema.js';
+import { dispatchFormSubmit, findForms, selectForm } from '../elements/dispatchForm.js';
+import { dispatchAction, parseActionBody } from '../elements/dispatchAction.js';
+import { pageBasePath } from '../clusterPaths.js';
+import { panelInfo, callPageSchema, tagFormActions, tagActionDispatch, customPageData, } from '../pageData.js';
+import { wantsJson, readFormBody, normalizeRedirect, splitMeta, forbidden, policyAccess, resolveDispatchTarget, handleFormState, handleFormWizard, handleFormCreateOption, handleFormMentions, handleWidgetData, sendActionResult, sendRedirectResponse, } from './helpers.js';
+/**
+ * Register the routes for a single custom Page — the optional widget /
+ * form-state companions, the GET render, action dispatch, and the
+ * page-level POST (when the page's schema includes a `Form`).
+ *
+ * Pulled out of `registerPilotiqRoutes` in 2026-05-12 (Phase 3 of the
+ * routes.ts split). Called once per `cfg.pages` entry. The caller is
+ * responsible for skipping the dashboard page (it's served by the
+ * panel-base GET).
+ */
+export function registerCustomPageRoutes(router, pilotiq, PageClass, base) {
+    const cfg = pilotiq.getConfig();
+    const pageSlug = PageClass.getSlug();
+    const pageUrl = pageBasePath(base, PageClass);
+    // Plan #15 — per-page widget polling endpoint. Mirrors the
+    // panel-scope `${base}/_widget/:id` but resolves the custom page's
+    // schema instead of the dashboard's.
+    router.post(`${pageUrl}/_widget/:id`, async (req, res) => {
+        const user = await pilotiq.resolveUser(req);
+        if (!await policyAccess(PageClass, user))
+            return forbidden(res, true);
+        return handleWidgetData(req, res, pilotiq, { kind: 'page', pageSlug }, req.params['id']);
+    });
+    // Plan #5 partial-resolve endpoint for custom pages with reactive forms.
+    // POST ${base}/${pageSlug}/_form/:formId/state
+    router.post(`${pageUrl}/_form/:formId/state`, async (req, res) => {
+        const user = await pilotiq.resolveUser(req);
+        if (!await policyAccess(PageClass, user))
+            return forbidden(res, true);
+        const formId = req.params['formId'];
+        return handleFormState(req, res, pilotiq, { kind: 'page', pageSlug }, formId);
+    });
+    // Plan #8 wizard step-validate endpoint for custom pages.
+    router.post(`${pageUrl}/_form/:formId/wizard`, async (req, res) => {
+        const user = await pilotiq.resolveUser(req);
+        if (!await policyAccess(PageClass, user))
+            return forbidden(res, true);
+        const formId = req.params['formId'];
+        return handleFormWizard(req, res, pilotiq, { kind: 'page', pageSlug }, formId);
+    });
+    // Async-mention endpoint for custom pages.
+    router.post(`${pageUrl}/_form/:formId/mentions`, async (req, res) => {
+        const user = await pilotiq.resolveUser(req);
+        if (!await policyAccess(PageClass, user))
+            return forbidden(res, true);
+        const formId = req.params['formId'];
+        return handleFormMentions(req, res, pilotiq, { kind: 'page', pageSlug }, formId);
+    });
+    // SelectField inline-create modal endpoint for custom pages.
+    router.post(`${pageUrl}/_form/:formId/create-option/:fieldName`, async (req, res) => {
+        const user = await pilotiq.resolveUser(req);
+        if (!await policyAccess(PageClass, user))
+            return forbidden(res, true);
+        const formId = req.params['formId'];
+        const fieldName = req.params['fieldName'];
+        return handleFormCreateOption(req, res, pilotiq, { kind: 'page', pageSlug }, formId, fieldName);
+    });
+    router.get(pageUrl, async (req, res) => {
+        const user = await pilotiq.resolveUser(req);
+        if (!await policyAccess(PageClass, user))
+            return forbidden(res, wantsJson(req));
+        const data = await customPageData(pilotiq, pageSlug, req);
+        return view('pilotiq.slug', data ?? {});
+    });
+    // Action dispatch — POST ${base}/${pageSlug}/_action/:actionName
+    router.post(`${pageUrl}/_action/:actionName`, async (req, res) => {
+        const user = await pilotiq.resolveUser(req);
+        if (!await policyAccess(PageClass, user))
+            return forbidden(res, wantsJson(req));
+        const actionName = req.params['actionName'];
+        const json = wantsJson(req);
+        const body = await readFormBody(req);
+        const input = parseActionBody(body);
+        const ctx = user !== null ? { user: user } : {};
+        const elements = await callPageSchema(PageClass, ctx);
+        tagActionDispatch(elements, pageUrl);
+        const target = resolveDispatchTarget(elements, actionName);
+        if (!target) {
+            if (json) {
+                res.status(404);
+                return res.json({ ok: false, error: `Action "${actionName}" not found` });
+            }
+            res.status(404);
+            return res.send(`Action "${actionName}" not found on page`);
+        }
+        const result = await dispatchAction(target.action, {
+            ...input,
+            request: req,
+            user,
+            ...(target.rowField ? { rowField: target.rowField } : {}),
+            ...(target.formSchema ? { formSchema: target.formSchema } : {}),
+        });
+        return sendActionResult(req, res, json, result, base, pageUrl);
+    });
+    // Custom pages can also accept submits when their schema includes a Form.
+    router.post(pageUrl, async (req, res) => {
+        const body = await readFormBody(req);
+        const { values, formId } = splitMeta(body);
+        const json = wantsJson(req);
+        const user = await pilotiq.resolveUser(req);
+        if (!await policyAccess(PageClass, user))
+            return forbidden(res, json);
+        const ctx = user !== null ? { user: user } : {};
+        const elements = await callPageSchema(PageClass, ctx);
+        tagFormActions(elements, pageUrl);
+        const form = selectForm(findForms(elements), formId);
+        if (!form) {
+            if (json) {
+                res.status(404);
+                return res.json({ ok: false, error: 'No form found on page' });
+            }
+            res.status(404);
+            return res.send('No form found on page');
+        }
+        const result = await dispatchFormSubmit(form, values, { values, basePath: base });
+        if (!result.ok) {
+            if (json) {
+                res.status(422);
+                return res.json({ ok: false, errors: result.errors });
+            }
+            form.withValues(values).withErrors(result.errors);
+            const schemaData = await resolveSchema(elements, ctx);
+            res.status(422);
+            return view('pilotiq.slug', {
+                pageType: 'page',
+                panel: await panelInfo(pilotiq, req),
+                page: PageClass.toMeta(),
+                schemaData,
+                basePath: base,
+                layout: cfg.layout,
+                hasErrors: true,
+            });
+        }
+        const redirect = normalizeRedirect(result.redirect, base) ?? pageUrl;
+        return sendRedirectResponse(req, res, json, redirect, result.notifications);
+    });
+}
+//# sourceMappingURL=pages.js.map

package/dist/routes/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/routes/pages.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAGrC,OAAO,EAAE,aAAa,EAAsB,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EACL,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAC5D,cAAc,GACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAiB,EACjB,OAAkB,EAClB,SAAsB,EACtB,IAAiB;IAEjB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,CAAA;IACpC,MAAM,OAAO,GAAI,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAE9C,2DAA2D;IAC3D,mEAAmE;IACnE,qCAAqC;IACrC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACrE,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAA;QACpC,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,0DAA0D;IAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAA;QACpC,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,2CAA2C;IAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAA;QACpC,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,6DAA6D;IAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACrE,MAAM,MAAM,GAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAA;QACvC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAE,CAAA;QAC1C,OAAO,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/E,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QACzD,OAAO,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAE/E,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAE,CAAA;QAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAI,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QAEnC,MAAM,GAAG,GAAkB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAA0C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACpG,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACrD,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,CAAC,CAAA;YAAC,CAAC;YACxG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACf,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,UAAU,qBAAqB,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE;YACjD,GAAG,KAAK;YACR,OAAO,EAAE,GAAG;YACZ,IAAI;YACJ,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAG,CAAC,CAAC,EAAE,QAAQ,EAAI,MAAM,CAAC,QAAQ,EAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAE3B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAErE,MAAM,GAAG,GAAkB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAA0C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACpG,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACrD,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAA;YAAC,CAAC;YAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACf,OAAO,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAEjF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACf,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YACvD,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACjD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACf,OAAO,IAAI,CAAC,cAAc,EAAE;gBAC1B,QAAQ,EAAG,MAAM;gBACjB,KAAK,EAAM,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC;gBACxC,IAAI,EAAO,SAAS,CAAC,MAAM,EAAE;gBAC7B,UAAU;gBACV,QAAQ,EAAG,IAAI;gBACf,MAAM,EAAK,GAAG,CAAC,MAAM;gBACrB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,OAAO,CAAA;QACpE,OAAO,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/routes/panel.d.ts

@@ -0,0 +1,19 @@
+import type { Router } from '@rudderjs/router';
+import type { Pilotiq } from '../Pilotiq.js';
+/**
+ * Register the panel-level sibling routes — the ones that don't belong
+ * to any individual Resource / Global / custom Page:
+ *
+ * - `GET ${base}`                 — dashboard
+ * - `POST ${base}/_uploads`       — `FileUpload` field POST target
+ * - `POST ${base}/_widget/:id`    — Plan #15 dashboard widget polling
+ * - `GET ${base}/_search`         — Plan #12 global search
+ * - `${base}/_notifications/...`  — bell-icon dropdown endpoints (only
+ *   mounted when `Pilotiq.databaseNotifications()` was called)
+ *
+ * Plus the broadcast-auth registration that the notifications path
+ * needs in the same `if` branch. Reads `cfg = pilotiq.getConfig()`
+ * internally so the call site only has to thread the basePath.
+ */
+export declare function registerPanelRoutes(router: Router, pilotiq: Pilotiq, base: string): void;
+//# sourceMappingURL=panel.d.ts.map

package/dist/routes/panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"panel.d.ts","sourceRoot":"","sources":["../../src/routes/panel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAG9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAkB5C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAG,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,IAAI,EAAK,MAAM,GACd,IAAI,CAmKN"}

package/dist/routes/panel.js

@@ -0,0 +1,191 @@
+import { view } from '@rudderjs/view';
+import { dashboardData, searchData } from '../pageData.js';
+import { listForUser as listDatabaseNotifications, markAsRead as markDatabaseNotificationAsRead, markAsUnread as markDatabaseNotificationAsUnread, markAllAsRead as markAllDatabaseNotificationsAsRead, } from '../notifications/database.js';
+import { dispatchNotificationAction } from '../notifications/dispatchNotificationAction.js';
+import { registerBroadcastAuth } from '../notifications/registerBroadcastAuth.js';
+import { wantsJson, forbidden, policyAccess, handleWidgetData, handleUploadRequest, } from './helpers.js';
+/**
+ * Register the panel-level sibling routes — the ones that don't belong
+ * to any individual Resource / Global / custom Page:
+ *
+ * - `GET ${base}`                 — dashboard
+ * - `POST ${base}/_uploads`       — `FileUpload` field POST target
+ * - `POST ${base}/_widget/:id`    — Plan #15 dashboard widget polling
+ * - `GET ${base}/_search`         — Plan #12 global search
+ * - `${base}/_notifications/...`  — bell-icon dropdown endpoints (only
+ *   mounted when `Pilotiq.databaseNotifications()` was called)
+ *
+ * Plus the broadcast-auth registration that the notifications path
+ * needs in the same `if` branch. Reads `cfg = pilotiq.getConfig()`
+ * internally so the call site only has to thread the basePath.
+ */
+export function registerPanelRoutes(router, pilotiq, base) {
+    const cfg = pilotiq.getConfig();
+    // ── Dashboard (1-segment) ─────────────────────────────
+    router.get(base, async (req, res) => {
+        // Plan #15 — when `panel.dashboard(P)` is set, gate the dashboard
+        // route through the page's `canAccess` predicate. Same posture as
+        // custom pages — fail-closed on throw.
+        if (cfg.dashboardPage) {
+            const user = await pilotiq.resolveUser(req);
+            if (!await policyAccess(cfg.dashboardPage, user)) {
+                return forbidden(res, wantsJson(req));
+            }
+        }
+        return view('pilotiq.dashboard', await dashboardData(pilotiq, req));
+    });
+    // ── File uploads (FileUpload field POST target) ───────
+    router.post(`${base}/_uploads`, async (req, res) => {
+        return handleUploadRequest(req, res, pilotiq);
+    });
+    // ── Plan #15 dashboard widget polling ─────────────────
+    // POST ${base}/_widget/:id — re-resolves the dashboard page schema,
+    // finds widget by id, runs `getServerData(ctx)`. Body: `{ filter? }`.
+    // Mounted unconditionally — widgetData() returns 404 when no
+    // dashboard page is registered, so this stays cheap when unused.
+    router.post(`${base}/_widget/:id`, async (req, res) => {
+        if (cfg.dashboardPage) {
+            const user = await pilotiq.resolveUser(req);
+            if (!await policyAccess(cfg.dashboardPage, user))
+                return forbidden(res, true);
+        }
+        return handleWidgetData(req, res, pilotiq, { kind: 'panel' }, req.params['id']);
+    });
+    // ── Plan #12 global search ────────────────────────────
+    // GET ${base}/_search?q=…&limit=… → { ok, results }
+    // No 403 on unrecognised users — `searchAllResources` filters per
+    // resource. The Pilotiq.guard() layer above is the panel-level gate.
+    router.get(`${base}/_search`, async (req, res) => {
+        const query = req.query;
+        const rawQ = query?.['q'];
+        const q = typeof rawQ === 'string' ? rawQ.slice(0, 200) : '';
+        const data = await searchData(pilotiq, q, req);
+        return res.json(data);
+    });
+    // ── Database notifications (bell-icon dropdown) ───────
+    // Only mounted when `Pilotiq.databaseNotifications()` was called.
+    // Every route 401s when no user resolves so a non-authenticated
+    // request never sees another user's inbox. The `notifiable_type`
+    // value is configurable but defaults to `'users'` to match
+    // `@rudderjs/notification`'s `DatabaseChannel` writes.
+    if (cfg.databaseNotifications?.enabled) {
+        const dn = cfg.databaseNotifications;
+        const notifiableType = dn.notifiableType ?? 'users';
+        const pageSize = dn.pageSize ?? 25;
+        /** Resolve `{ id }` from the panel's user resolver. Returns null
+         *  when no user / unknown id — every route then 401s. The user
+         *  object is opaque to pilotiq; we duck-type `.id`. */
+        const resolveUserId = async (req) => {
+            const user = await pilotiq.resolveUser(req);
+            if (!user || typeof user !== 'object')
+                return null;
+            const id = user.id;
+            if (id === undefined || id === null)
+                return null;
+            return String(id);
+        };
+        // GET ${base}/_notifications → { notifications, unreadCount }
+        router.get(`${base}/_notifications`, async (req, res) => {
+            const id = await resolveUserId(req);
+            if (id === null) {
+                res.status(401);
+                return res.json({ ok: false, error: 'Not authenticated' });
+            }
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            const unreadOnly = url.searchParams.get('unread') === 'true';
+            const limitRaw = Number(url.searchParams.get('limit') ?? pageSize);
+            const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(limitRaw, 100) : pageSize;
+            const data = await listDatabaseNotifications({
+                notifiableType,
+                notifiableId: id,
+                limit,
+                unreadOnly,
+            });
+            return res.json({ ok: true, ...data });
+        });
+        // POST ${base}/_notifications/:id/read
+        router.post(`${base}/_notifications/:id/read`, async (req, res) => {
+            const userId = await resolveUserId(req);
+            if (userId === null) {
+                res.status(401);
+                return res.json({ ok: false, error: 'Not authenticated' });
+            }
+            const rowId = req.params['id'] ?? '';
+            const updated = await markDatabaseNotificationAsRead(rowId, {
+                notifiableType,
+                notifiableId: userId,
+            });
+            return res.json({ ok: updated });
+        });
+        // POST ${base}/_notifications/:id/unread
+        router.post(`${base}/_notifications/:id/unread`, async (req, res) => {
+            const userId = await resolveUserId(req);
+            if (userId === null) {
+                res.status(401);
+                return res.json({ ok: false, error: 'Not authenticated' });
+            }
+            const rowId = req.params['id'] ?? '';
+            const updated = await markDatabaseNotificationAsUnread(rowId, {
+                notifiableType,
+                notifiableId: userId,
+            });
+            return res.json({ ok: updated });
+        });
+        // POST ${base}/_notifications/read-all
+        router.post(`${base}/_notifications/read-all`, async (req, res) => {
+            const userId = await resolveUserId(req);
+            if (userId === null) {
+                res.status(401);
+                return res.json({ ok: false, error: 'Not authenticated' });
+            }
+            const count = await markAllDatabaseNotificationsAsRead({
+                notifiableType,
+                notifiableId: userId,
+            });
+            return res.json({ ok: true, count });
+        });
+        // POST ${base}/_notifications/:id/_action/:actionName
+        //
+        // Notification action dispatch — looks up the stored action on the
+        // row, resolves the named handler against the panel's
+        // `notificationHandlers` registry, and runs it with the row's
+        // stored payload. Optionally flips `read_at` server-side when the
+        // action carried `markAsRead: true`.
+        //
+        // Defends in depth: 404s on missing row / wrong owner / action
+        // missing / non-string handler / unknown registry name. Body is
+        // ignored — payload reads exclusively from the stored row, so a
+        // tampered client can't inject extra payload keys.
+        router.post(`${base}/_notifications/:id/_action/:actionName`, async (req, res) => {
+            const user = await pilotiq.resolveUser(req);
+            const userId = user && typeof user === 'object'
+                ? (user.id !== undefined && user.id !== null
+                    ? String(user.id) : null)
+                : null;
+            if (userId === null) {
+                res.status(401);
+                return res.json({ ok: false, error: 'Not authenticated' });
+            }
+            const params = req.params;
+            const result = await dispatchNotificationAction(pilotiq, {
+                notificationId: params['id'] ?? '',
+                actionName: params['actionName'] ?? '',
+                notifiableType,
+                notifiableId: userId,
+                user,
+                request: req,
+            });
+            if (!result.ok) {
+                res.status(result.status);
+                return res.json({ ok: false, error: result.error });
+            }
+            return res.json(result);
+        });
+        // Phase 2 — register the broadcast auth callback for private
+        // `pilotiq-notifications.<userId>` channels. Soft-fails when
+        // `@rudderjs/broadcast` isn't installed; apps that haven't enabled
+        // broadcast on the toggle stay quiet either way.
+        void registerBroadcastAuth(pilotiq);
+    }
+}
+//# sourceMappingURL=panel.js.map

package/dist/routes/panel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"panel.js","sourceRoot":"","sources":["../../src/routes/panel.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAErC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EACL,WAAW,IAAO,yBAAyB,EAC3C,UAAU,IAAQ,8BAA8B,EAChD,YAAY,IAAM,gCAAgC,EAClD,aAAa,IAAK,kCAAkC,GACrD,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAA;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAe,EACf,OAAgB,EAChB,IAAe;IAEf,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;IAE/B,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,kEAAkE;QAClE,kEAAkE;QAClE,uCAAuC;QACvC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,aAAc,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClD,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,oEAAoE;IACpE,sEAAsE;IACtE,6DAA6D;IAC7D,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,aAAc,EAAE,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAChF,CAAC;QACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,oDAAoD;IACpD,kEAAkE;IAClE,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAA4C,CAAA;QAC9D,MAAM,IAAI,GAAI,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,CAAC,GAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAChE,MAAM,IAAI,GAAI,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,kEAAkE;IAClE,gEAAgE;IAChE,iEAAiE;IACjE,2DAA2D;IAC3D,uDAAuD;IACvD,IAAI,GAAG,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,GAAG,CAAC,qBAAqB,CAAA;QACpC,MAAM,cAAc,GAAG,EAAE,CAAC,cAAc,IAAI,OAAO,CAAA;QACnD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAA;QAElC;;+DAEuD;QACvD,MAAM,aAAa,GAAG,KAAK,EAAE,GAAe,EAA0B,EAAE;YACtE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAClD,MAAM,EAAE,GAAI,IAAyB,CAAC,EAAE,CAAA;YACxC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAChD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAA;QACnB,CAAC,CAAA;QAED,8DAA8D;QAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;YAAC,CAAC;YAChG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;YACvD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAA;YAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;YAC5F,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC;gBAC3C,cAAc;gBACd,YAAY,EAAE,EAAE;gBAChB,KAAK;gBACL,UAAU;aACX,CAAC,CAAA;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;QAEF,uCAAuC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAChE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;YAAC,CAAC;YACpG,MAAM,KAAK,GAAI,GAAG,CAAC,MAA6C,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YAC5E,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE;gBAC1D,cAAc;gBACd,YAAY,EAAE,MAAM;aACrB,CAAC,CAAA;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QAEF,yCAAyC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAClE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;YAAC,CAAC;YACpG,MAAM,KAAK,GAAI,GAAG,CAAC,MAA6C,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YAC5E,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC,KAAK,EAAE;gBAC5D,cAAc;gBACd,YAAY,EAAE,MAAM;aACrB,CAAC,CAAA;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QAEF,uCAAuC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAChE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;YAAC,CAAC;YACpG,MAAM,KAAK,GAAG,MAAM,kCAAkC,CAAC;gBACrD,cAAc;gBACd,YAAY,EAAE,MAAM;aACrB,CAAC,CAAA;YACF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,sDAAsD;QACtD,EAAE;QACF,mEAAmE;QACnE,sDAAsD;QACtD,8DAA8D;QAC9D,kEAAkE;QAClE,qCAAqC;QACrC,EAAE;QACF,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,mDAAmD;QACnD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAC7C,CAAC,CAAC,CAAE,IAAyB,CAAC,EAAE,KAAK,SAAS,IAAK,IAAyB,CAAC,EAAE,KAAK,IAAI;oBACpF,CAAC,CAAC,MAAM,CAAE,IAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClD,CAAC,CAAC,IAAI,CAAA;YACR,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;YAAC,CAAC;YAEpG,MAAM,MAAM,GAAI,GAAG,CAAC,MAA6C,CAAA;YACjE,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE;gBACvD,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,IAAY,EAAE;gBAC1C,UAAU,EAAM,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;gBAC1C,cAAc;gBACd,YAAY,EAAI,MAAM;gBACtB,IAAI;gBACJ,OAAO,EAAS,GAAG;aACpB,CAAC,CAAA;YACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBACzB,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;YACrD,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;QAEF,6DAA6D;QAC7D,6DAA6D;QAC7D,mEAAmE;QACnE,iDAAiD;QACjD,KAAK,qBAAqB,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;AACH,CAAC"}

package/dist/routes/relations.d.ts

@@ -0,0 +1,21 @@
+import type { Router } from '@rudderjs/router';
+import type { Pilotiq } from '../Pilotiq.js';
+import type { ResourceClass } from '../Resource.js';
+/**
+ * Register the relation manager routes for one Resource — every
+ * relation declared via `R.relations()` mounts a depth-1 strip
+ * (list / create / view / edit / delete / restore / force-delete /
+ * `_action` / `_detach`); each nested `M.relations()` entry mounts a
+ * depth-2 strip with the same shape under a `nestedBase` prefix.
+ *
+ * Authorization is two-layered: parent `canAccess + canEdit` runs first,
+ * then manager-scoped `canX` (with fall-through to the related Resource
+ * via `safeManagerPolicy`). Reserved-token / depth-3 / morphTo-no-target
+ * guards run at boot in the host barrel (`routes.ts`), not here.
+ *
+ * Pulled out of `registerPilotiqRoutes` in 2026-05-12 (Phase 4 of the
+ * routes.ts split). Called once per `cfg.resources` entry from
+ * `registerResourceRoutes`.
+ */
+export declare function registerRelationRoutes(router: Router, pilotiq: Pilotiq, R: ResourceClass, base: string): void;
+//# sourceMappingURL=relations.d.ts.map

package/dist/routes/relations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.d.ts","sourceRoot":"","sources":["../../src/routes/relations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAG9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAoCnD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAG,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,CAAC,EAAQ,aAAa,EACtB,IAAI,EAAK,MAAM,GACd,IAAI,CAqoCN"}