adminizer 5.0.0-build.8 → 5.1.0-build.24

package/index.d.ts

@@ -27,6 +27,9 @@ export * from "./lib/media-manager/AbstractMediaManager.js";
 export * from "./lib/controls/Control.js";
 export * from "./lib/controls/ControlsHandler.js";
 export * from "./lib/Adminizer.js";
+export * from "./lib/docs/AbstractDocumentation.js";
+export * from "./lib/docs/DocumentationHandler.js";
+export * from "./lib/docs/FileDocumentation.js";
 export * from "./lib/I18n.js";
 export * from "./models/Group.js";
 export * from "./models/User.js";
@@ -43,7 +46,15 @@ export * from "./lib/helper/jwt.js";
 export * from "./lib/notifications/AbstractNotificationService.js";
 export * from "./lib/POWCaptcha.js";
 export * from "./lib/ai-assistant/AbstractAiModelService.js";
+export * from "./lib/ai-assistant/AbstractAiConversationHistoryService.js";
 export * from "./lib/ai-assistant/AiAssistantHandler.js";
+export * from "./lib/ai-assistant/AiAgentRunManager.js";
+export * from "./lib/ai-assistant/jsonSafe.js";
+export * from "./lib/ai-assistant/AiAssistantUiMethodHandler.js";
+export * from "./lib/ai-assistant/AiAssistantAgentSkillHandler.js";
+export * from "./lib/admin-links/AdminLinkHandler.js";
+export * from "./helpers/modelResourceHelper.js";
+export * from "./helpers/navigationAccessHelper.js";
 export * from "./lib/DataAccessor.js";
 export * from "./lib/history-actions/AbstractHistoryAdapter.js";
 export * from "./lib/filters/CustomFilterHandler.js";

package/index.js

@@ -27,6 +27,9 @@ export * from "./lib/media-manager/AbstractMediaManager.js";
 export * from "./lib/controls/Control.js";
 export * from "./lib/controls/ControlsHandler.js";
 export * from "./lib/Adminizer.js";
+export * from "./lib/docs/AbstractDocumentation.js";
+export * from "./lib/docs/DocumentationHandler.js";
+export * from "./lib/docs/FileDocumentation.js";
 export * from "./lib/I18n.js";
 export * from "./models/Group.js";
 export * from "./models/User.js";
@@ -43,7 +46,15 @@ export * from "./lib/helper/jwt.js";
 export * from "./lib/notifications/AbstractNotificationService.js";
 export * from "./lib/POWCaptcha.js";
 export * from "./lib/ai-assistant/AbstractAiModelService.js";
+export * from "./lib/ai-assistant/AbstractAiConversationHistoryService.js";
 export * from "./lib/ai-assistant/AiAssistantHandler.js";
+export * from "./lib/ai-assistant/AiAgentRunManager.js";
+export * from "./lib/ai-assistant/jsonSafe.js";
+export * from "./lib/ai-assistant/AiAssistantUiMethodHandler.js";
+export * from "./lib/ai-assistant/AiAssistantAgentSkillHandler.js";
+export * from "./lib/admin-links/AdminLinkHandler.js";
+export * from "./helpers/modelResourceHelper.js";
+export * from "./helpers/navigationAccessHelper.js";
 export * from "./lib/DataAccessor.js";
 export * from "./lib/history-actions/AbstractHistoryAdapter.js";
 export * from "./lib/filters/CustomFilterHandler.js";

package/interfaces/adminpanelConfig.d.ts

@@ -75,6 +75,26 @@ export interface AdminpanelConfig {
     models: {
         [key: string]: ModelConfig;
     };
+    /**
+     * Relationship-based record access (ReBAC): each key declares one access graph —
+     * models whose records inherit visibility from a root model down parent edges.
+     * Membership is granted once, on root records (same `through` form as the membership
+     * variant of `userAccessRelation`), and every model of the graph is filtered by it
+     * transitively. The graph wins over a covered model's own `userAccessRelation`: once a
+     * graph covers a model, that declaration stops applying. Declaring both is a configuration
+     * error and is reported as one when the graph compiles.
+     * Global CRUD tokens remain the upper bound: the graph narrows visibility, it never
+     * grants access the token gates denied.
+     *
+     * EXPERIMENTAL: the configuration format and access semantics may change in a minor release.
+     * Declaring this section makes Adminizer log a warning at boot naming the graphs in use.
+     *
+     * @beta
+     *
+     */
+    accessGraph?: {
+        [graphKey: string]: AccessGraphConfig;
+    };
     /**
      * For custom adminpanel sections, displays inside header
      * */
@@ -107,6 +127,14 @@ export interface AdminpanelConfig {
         sectionHandlers?: {
             [section: string]: (user: User, links: HrefConfig[]) => HrefConfig[];
         };
+        /**
+         * Presentation metadata for navbar sections, keyed by section name.
+         * The sections themselves are declared by the `section` field of individual
+         * links; this map only controls how a section header is drawn.
+         */
+        sections?: {
+            [section: string]: NavbarSectionConfig;
+        };
     };
     /**
      * Policies that will be executed before going to every page
@@ -223,6 +251,14 @@ export interface AdminpanelConfig {
         defaultModel?: string;
         models?: string[];
     };
+    /**
+     * Knowledge base (built-in documentation). The implementation is
+     * registered separately: `adminizer.documentationHandler.register(service)`.
+     */
+    documentation?: {
+        /** Master switch of the subsystem; nothing is brought up unless `true` */
+        enabled?: boolean;
+    };
     cors?: {
         enabled: boolean;
         origin: string[] | string;
@@ -299,9 +335,14 @@ export interface ModelConfig {
     adapter?: string;
     title: string;
     /**
-     * Model name
+     * Physical host ORM model name.
      * */
     model: string;
+    /**
+     * Required only when two or more Adminizer resources use the same host model.
+     * The primary resource is selected for associations that reference the host model.
+     */
+    primary?: boolean;
     /**
      * Optional display name for history. Should be a attribute of the model, or a function.
      */
@@ -392,16 +433,117 @@ export interface ModelConfig {
      * */
     identifierField?: string;
     /** In this field we can set model field, for which we want to check user access right.
-     *  May be association or association-many to User or Group */
+     *  May be association or association-many to User or Group
+     *
+     *  @deprecated Declare record access with {@link AdminpanelConfig.accessGraph} instead.
+     *  The membership form (`{field, through, via, group}`) is a single-edge access graph
+     *  written in a second syntax — same `membership` declaration, `field` becomes the
+     *  `include` edge's `parent`. The string and `{field, via}` forms have no graph
+     *  equivalent yet (the graph seeds root ids from membership rows, not from an owner
+     *  foreign key), so this option is removed in stages rather than at once.
+     *  Note that this option is already inert wherever an `accessGraph` covers the model:
+     *  the graph wins and the declaration below is ignored.
+     *
+     *  TODO: removal plan, its prerequisites and the migration recipe live in
+     *  `.ai-notes/todo/user-access-relation-removal.md`; the reasoning behind the
+     *  deprecation — including the one behaviour the graph does not reproduce (its root
+     *  model becomes record-restricted too) — in `.ai-notes/user-access-relation-deprecation.md`.
+     */
     userAccessRelation?: {
         field: string;
         via?: string;
+        /** Membership form: a join model holding exactly one relation to the model `field` points at,
+         *  a `via` relation to User and, optionally, a `group` relation to Group. Records are then
+         *  filtered to the targets the user has a membership row for. */
+        through?: string;
+        /** Field in `through` that associates with Group. When set, a membership only counts for the
+         *  actions whose CRUD token (`<verb>-<model>-model`) that group carries, so the same user may
+         *  hold different rights in different targets. Global tokens remain the upper bound: this
+         *  narrows rows, it never grants access the token gates denied. */
+        group?: string;
     } | string;
     userAccessRelationCallback?: (userWithGroups: UserWithGroups, record: any) => boolean;
 }
 type UserWithGroups = User & {
     groups: Group[];
 };
+/** CRUD verb of the action being performed, as used in `<verb>-<model>-model` tokens. */
+export type AccessGraphActionVerb = "create" | "read" | "update" | "delete";
+/** Ids of the root records the user may see, `"all"` for an explicit bypass, or
+ *  `undefined` to fall back to the declared `membership`. */
+export type AccessGraphRootIds = unknown[] | "all" | undefined;
+/**
+ * One access graph: a root model carrying memberships plus the models that inherit
+ * its visibility down explicit parent edges.
+ */
+export interface AccessGraphConfig {
+    /** Root model of the graph; memberships are granted on its records. */
+    root: string;
+    /**
+     * Membership declaration at the root: `through` is a join model holding exactly one
+     * relation to the root model, a `via` relation to User and, optionally, a `group`
+     * relation to Group. With `group` declared, a membership only counts for the actions
+     * whose CRUD token (`<verb>-<model>-model`, checked against the model being accessed)
+     * that group carries.
+     */
+    membership?: {
+        through: string;
+        via: string;
+        group?: string;
+    };
+    /**
+     * Models covered by the graph. Each entry names the association alias the model uses
+     * to look at its parent in the graph; the parent model is derived from that alias and
+     * must itself belong to the graph (the root or another `include` entry). Exactly one
+     * edge per model — the parent is never guessed from foreign keys.
+     */
+    include?: {
+        [modelName: string]: {
+            /** Association alias on this model pointing at its parent in the graph. */
+            parent: string;
+        };
+    };
+    /**
+     * Stage 2: denormalized root-id columns. For a listed model the read filter collapses
+     * to one step — `{<column>: {in: graphRootIds}}` — instead of walking the parent chain.
+     * The column is maintained by the application; Adminizer only filters by it. The model
+     * still declares its `include` edge — writes keep validating the chosen parent.
+     */
+    graphRootField?: {
+        [modelName: string]: string;
+    };
+    /**
+     * Stage 3: compile the read filter into one nested-subquery SQL emitted by the adapter
+     * instead of materializing intermediate id lists in the application. Applies when every
+     * model on the path (and the membership model) lives on the same adapter connection;
+     * otherwise the resolver falls back to per-level materialization automatically. The SQL
+     * is generated from this declaration — no hand-written queries.
+     *
+     * Why it exists: the default walk costs one query per level of the chain, and the last of
+     * them carries every intermediate id the user can reach as a literal `IN (...)` list. The
+     * price of the filter therefore grows with the size of the user's data, not with the size
+     * of the page — a member of 500 projects ships ~25 000 task ids to render 25 rows, while
+     * the pushed-down form emits one statement of constant size whatever the account holds.
+     * The accounts it slows down first are the biggest ones.
+     *
+     * Setting it is a permission, not a guarantee: a chain that cannot be compiled goes back to
+     * materialization, and the write path never uses pushdown at all. The fallback is invisible in
+     * the result, so it is logged — one warning per model, naming the graph and the reason. Silence
+     * means the chain compiled.
+     */
+    pushdown?: boolean;
+    /**
+     * Token id that lets its holders see the whole graph unfiltered. Matched against the
+     * token grants of the user's global groups; it does not need to be a registered token.
+     */
+    bypassToken?: string;
+    /**
+     * Replaces the membership source at the root without touching the graph below it.
+     * Returning `undefined` falls back to the declared `membership`; `"all"` is the
+     * explicit bypass. The result is still bounded by global tokens.
+     */
+    resolveGraphRootIds?: (user: User, actionVerb: AccessGraphActionVerb) => Promise<AccessGraphRootIds> | AccessGraphRootIds;
+}
 export type ModelFieldConfig = (BaseFieldConfig | TuiEditorFieldConfig) & {
     groupsAccessRights?: string[];
 };
@@ -583,6 +725,22 @@ export interface HrefConfig {
      */
     section?: string;
 }
+/**
+ * Presentation of a single navbar section header.
+ */
+export interface NavbarSectionConfig {
+    /**
+     * Icon of the section header. Also used as the section's trigger in the
+     * collapsed (icon-only) sidebar.
+     */
+    icon?: MaterialIcon;
+    /**
+     * Explicit position of the section. Sections carrying an `order` are sorted
+     * ascending and placed before the ones without it, which keep the default
+     * ordering (`Platform` first, `System` last, the rest alphabetically).
+     */
+    order?: number;
+}
 export interface MediaManagerConfig {
     fileStoragePath: string;
     allowMIME?: string[];

package/interfaces/queryCriteria.d.ts

@@ -47,6 +47,19 @@ export interface QueryCriteria<TModel = any> {
     where?: CriteriaWhere<TModel>;
     select?: CriteriaSelect;
     populate?: CriteriaPopulate<TModel>;
+    /**
+     * Record-access confinement of single populated associations, keyed by association
+     * name and ANDed into the populate JOIN's ON clause: a populated record failing the
+     * condition arrives as its bare foreign-key value instead of an object, while the
+     * owning row itself stays in the result — unlike `populate.<field>.where`, which
+     * confines the owning rows.
+     *
+     * Set exclusively by `DataAccessor.pushDownPopulateAccess` for the associations the
+     * adapter declared pushdown-capable (`AbstractModel.canPushdownPopulateAccess`);
+     * `sanitizeUserRelationAccess` discards an incoming value, so hand-built criteria
+     * cannot suppress the association verification that trusts this key.
+     */
+    populateOn?: Record<string, CriteriaWhere>;
     sort?: CriteriaSort;
     limit?: number;
     skip?: number;

package/interfaces/types.d.ts

@@ -1,5 +1,6 @@
 import { AbstractModel } from "../lib/model/AbstractModel.js";
 import { ModelConfig } from "./adminpanelConfig.js";
+import type { User } from "../models/User.js";
 export interface ModelResource {
     name: string;
     config?: ModelConfig;
@@ -11,7 +12,24 @@ export interface AccessRightsToken {
     description: string;
     department: string;
     id: string;
+    getOptions?: (user: User) => Promise<PermissionOption[]>;
+    check?: (user: User, context?: PermissionContext) => Promise<boolean>;
 }
+export interface PermissionOption {
+    id: string;
+    name: string;
+    description?: string;
+}
+export interface PermissionContext {
+    rights?: string[];
+    [key: string]: unknown;
+}
+/** Serialized as a JSON string in Group.tokens for a contextual token. */
+export interface GroupPermissionGrant {
+    tokenId: string;
+    rights: string[];
+}
+export type PermissionGrant = string | GroupPermissionGrant;
 export interface PropsField {
     label: string;
     type: string;
@@ -70,3 +88,154 @@ export interface AiAssistantModelInfo {
     name: string;
     description?: string;
 }
+/**
+ * Streaming agent contract.
+ *
+ * A model service that only implements `generateReply` stays a plain chat
+ * model; services that also implement the optional agent members below are
+ * driven by the streaming UI (tool calls, reasoning, attachments, per-user
+ * server-side session). See AbstractAiModelService.
+ */
+/** One SSE frame of a run. `type` drives how the UI folds it into the thread. */
+export type AiAgentStreamEvent = {
+    type: 'text.delta' | 'text.done' | 'reasoning.delta' | 'reasoning.done' | 'tool.start' | 'tool.done' | 'tool.error' | 'step.done' | 'turn.done' | 'done' | 'error' | string;
+    [key: string]: unknown;
+};
+export type AiAgentPublish = (event: AiAgentStreamEvent) => void;
+export interface AiAgentTokenUsage {
+    inputTokens?: number;
+    outputTokens?: number;
+    totalTokens?: number;
+}
+/** One selectable LLM inside an agent service. */
+export interface AiAgentModelOption {
+    id: string;
+    contextWindow: number | null;
+    maxOutputTokens: number | null;
+    vision: boolean;
+    /** Relative spend multiplier (×1 = median-priced model); null if unknown. */
+    costCoefficient: number | null;
+    [key: string]: unknown;
+}
+/** State of the user's server-side agent session. */
+export interface AiAgentSessionMeta {
+    model: string;
+    contextWindow: number;
+    vision: boolean;
+    turns: number;
+    contextTokens: number;
+    totalUsage: AiAgentTokenUsage;
+    [key: string]: unknown;
+}
+/**
+ * Whether the service can talk to its LLM yet. Services that need no
+ * provisioning simply omit `getConnectionStatus()` and are treated as ready.
+ */
+export interface AiAgentConnectionStatus {
+    state: 'ready' | 'registering' | 'waiting_retry' | 'setup_required' | 'error';
+    provider?: string;
+    baseUrl?: string;
+    source?: string | null;
+    nextAttemptAt?: string | null;
+    lastError?: string | null;
+    expiresAt?: string | null;
+    [key: string]: unknown;
+}
+/** States for which an agent can describe its connection screen. */
+export type AiAgentConnectionState = Exclude<AiAgentConnectionStatus['state'], 'ready'>;
+/**
+ * Declarative connection screen supplied by an agent service. The shared panel
+ * owns rendering, while the agent owns its copy, CTA and which status details
+ * are useful to expose.
+ */
+export interface AiAgentConnectionScreen {
+    title?: string;
+    description?: string;
+    icon?: 'spinner' | 'bot' | 'error';
+    action?: {
+        label: string;
+        href: string;
+    };
+    /** Status values the agent wants to render on this screen. */
+    details?: Array<{
+        field: string;
+        label?: string;
+        format?: 'text' | 'local-time';
+        tone?: 'muted' | 'error';
+    }>;
+}
+/** Normalized budget / rate limits of the provider key, when it exposes them. */
+export interface AiAgentLimits {
+    provider: string;
+    supported: boolean;
+    overBudget?: boolean;
+    message?: string;
+    maxBudgetUsd?: number | null;
+    spentUsd?: number | null;
+    remainingBudgetUsd?: number | null;
+    budgetResetAt?: string | null;
+    burstMaxBudgetUsd?: number | null;
+    burstSpentUsd?: number | null;
+    burstRemainingBudgetUsd?: number | null;
+    burstResetAt?: string | null;
+    burstDurationLabel?: string | null;
+    rpmLimit?: number | null;
+    tpmLimit?: number | null;
+    fetchedAt?: string;
+    [key: string]: unknown;
+}
+/**
+ * Copy the panel shows instead of its neutral defaults. `getUiHints(locale)`
+ * receives the admin user's locale, so agents can return localized copy.
+ */
+export interface AiAgentUiHints {
+    title?: string;
+    welcomeHint?: string;
+    composerPlaceholder?: string;
+    suggestions?: string[];
+    /** Setting an operator must fill in before the service can connect. */
+    setupSetting?: string;
+    /** Where to fill it in; rendered as a button on the connection loader. */
+    setupUrl?: string;
+    /**
+     * Per-state pages rendered while this agent is not ready. `default` is
+     * used for any state without its own screen.
+     */
+    connectionScreens?: Partial<Record<AiAgentConnectionState | 'default', AiAgentConnectionScreen>>;
+    [key: string]: unknown;
+}
+/** A browser-side capability which an agent may call through `ui.method`. */
+export interface AiAgentUiMethod {
+    id: string;
+    title: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    action: string;
+    accessRightsToken?: string;
+}
+/** Declarative UI contract consumed by the shared assistant panel. */
+export interface AiAgentUiSchema extends AiAgentUiHints {
+    commands: Array<{
+        id: string;
+        description?: string;
+    }>;
+    uiMethods?: AiAgentUiMethod[];
+    panels: {
+        history: boolean;
+        models: boolean;
+        limits: boolean;
+    };
+}
+/** An uploaded file as handed to the agent service (multer memory storage). */
+export interface AiAgentUploadedFile {
+    originalname: string;
+    mimetype: string;
+    size: number;
+    buffer: Buffer;
+}
+/** What the service reports back about a stored upload, if it stores them. */
+export interface AiAgentSavedFile {
+    id?: string;
+    name?: string;
+    [key: string]: unknown;
+}

package/lib/Adminizer.d.ts

@@ -27,6 +27,10 @@ import { ControllerHandler } from "./app-manager/ControllerHandler.js";
 import { AssetHandler } from "./app-manager/AssetHandler.js";
 import { ConfigLayerHandler } from "./app-manager/ConfigLayerHandler.js";
 import { AccessRightsHandler } from "./access-rights/AccessRightsHandler.js";
+import { AiAssistantUiMethodHandler } from './ai-assistant/AiAssistantUiMethodHandler.js';
+import { AdminLinkHandler } from './admin-links/AdminLinkHandler.js';
+import { AiAssistantAgentSkillHandler } from './ai-assistant/AiAssistantAgentSkillHandler.js';
+import { DocumentationHandler } from './docs/DocumentationHandler.js';
 export declare function createAdminizerLogger(): winston.Logger;
 export interface EmitAsyncOptions {
     /**
@@ -54,6 +58,10 @@ export declare class Adminizer {
     notificationHandler: NotificationHandler;
     historyHandler: HistoryHandler;
     private _aiAssistantHandler?;
+    aiAssistantUiMethodHandler: AiAssistantUiMethodHandler;
+    adminLinkHandler: AdminLinkHandler;
+    aiAssistantAgentSkillHandler: AiAssistantAgentSkillHandler;
+    documentationHandler: DocumentationHandler;
     modelHandler: ModelHandler;
     widgetHandler: WidgetHandler;
     customFilterHandler: CustomFilterHandler;

package/lib/Adminizer.js

@@ -37,12 +37,18 @@ import { bindCors } from "../system/bindCors.js";
 import bindHistory from "../system/bindHistory.js";
 import bindCustomFilterHandlers from "../system/bindCustomFilterHandlers.js";
 import { FeedbackHandler } from "./feedback/FeedbackHandler.js";
-import { buildInternalModelAccess } from "../system/buildInternalModelAccess.js";
+import { refreshInternalModelAccess } from "../system/buildInternalModelAccess.js";
+import { validateAccessGraph } from "./access-graph/AccessGraphResolver.js";
 import { AppManager } from "./app-manager/AppManager.js";
 import { ControllerHandler } from "./app-manager/ControllerHandler.js";
 import { AssetHandler } from "./app-manager/AssetHandler.js";
 import { ConfigLayerHandler } from "./app-manager/ConfigLayerHandler.js";
 import { AccessRightsHandler } from "./access-rights/AccessRightsHandler.js";
+import { AiAssistantUiMethodHandler } from './ai-assistant/AiAssistantUiMethodHandler.js';
+import { AdminLinkHandler } from './admin-links/AdminLinkHandler.js';
+import { AiAssistantAgentSkillHandler } from './ai-assistant/AiAssistantAgentSkillHandler.js';
+import { DocumentationHandler } from './docs/DocumentationHandler.js';
+import bindDocs from '../system/bindDocs.js';
 const logFilePath = "logs/app.log";
 function ensureLogDirectory(filePath) {
     const logDirectory = path.dirname(filePath);
@@ -109,6 +115,10 @@ export class Adminizer {
     notificationHandler;
     historyHandler;
     _aiAssistantHandler;
+    aiAssistantUiMethodHandler;
+    adminLinkHandler;
+    aiAssistantAgentSkillHandler;
+    documentationHandler;
     modelHandler;
     widgetHandler;
     customFilterHandler;
@@ -141,10 +151,19 @@ export class Adminizer {
         this.catalogTemplateComponentHandler = new CatalogTemplateComponentHandler();
         this.mediaManagerHandler = new MediaManagerHandler();
         this.feedbackHandler = new FeedbackHandler(this);
+        this.aiAssistantUiMethodHandler = new AiAssistantUiMethodHandler(this);
+        this.adminLinkHandler = new AdminLinkHandler(this);
+        this.aiAssistantAgentSkillHandler = new AiAssistantAgentSkillHandler(this);
+        this.documentationHandler = new DocumentationHandler(this, () => bindDocs(this));
         this.controllerHandler = new ControllerHandler(this);
         this.assetHandler = new AssetHandler(this);
         this.configLayerHandler = new ConfigLayerHandler(this);
         this.appManager = new AppManager(this);
+        // App model (un)registration changes what the record-access resolvers may query,
+        // so the internal allowlists must follow; config-layer rebuilds refresh them
+        // synchronously inside rebuildConfig itself.
+        this.emitter.on("app:model:registered", () => refreshInternalModelAccess(this));
+        this.emitter.on("app:model:unregistered", () => refreshInternalModelAccess(this));
     }
     /**
      * Shared AI assistant model registry.
@@ -257,7 +276,10 @@ export class Adminizer {
         this.emitter.emit('adminizer:init');
         // validate models
         validateSystemModels(this);
-        this.modelHandler.configureInternalAccess(buildInternalModelAccess(this.config, this.modelHandler));
+        refreshInternalModelAccess(this);
+        // Fail loud on structural accessGraph errors at boot; later config rebuilds only
+        // log them and the affected models fail closed at access time.
+        validateAccessGraph(this);
         bindCustomFilterHandlers(this);
         this.config.rootPath = path.resolve(import.meta.dirname + "/..");
         await this.middlewareManager.loadMiddlewares();
@@ -293,6 +315,11 @@ export class Adminizer {
             bindHistory(this);
         this.router = new Router(this);
         await this.router.bind(); // must be after binding policies and req/res functions
+        // Documentation (knowledge base) wires itself on register(); this call
+        // covers a service registered before the config was read. It runs after
+        // the router so those routes sit behind the same middleware stack a
+        // service registered after init() gets.
+        this.documentationHandler.activate();
         /**
          * Adminizer loaded
          * This call is used so that other apps can know that the admin panel is present in the panel and has been loaded, and can activate their logic.