<?php
// ─── POST /api/pumps/timeline-delete.php ────────────────────────────────
define('ROOT', dirname(__DIR__, 2));
require_once ROOT . '/core/DB.php';
require_once ROOT . '/core/Response.php';
require_once ROOT . '/core/Auth.php';

$user = Auth::require();
$db   = DB::get();

$role = Auth::role($user);
if (!in_array($role, ['admin','dev','test'])) Response::error('Permission denied.', 403);

$id = (int) ($_POST['record_id'] ?? 0);
if (!$id) Response::error('record_id is required.');

$db->run("DELETE FROM pump_timeline WHERE record_id = ?", [$id]);
Response::ok(null, 'Deleted.');