@betterportal/config-manager 10.6.24 → 10.6.26

package/lib/.bsb/clients/service-betterportal-config-manager.d.ts

@@ -1,7 +1,7 @@
 /**
  * Auto-generated BSB virtual client for service-betterportal-config-manager
  * DO NOT EDIT - Regenerated on every build
- * @version 10.6.24
+ * @version 10.6.26
  */
 import { ServiceClient, BSBService } from "@bsb/base";
 import type { Observable, BSBServiceClientDefinition, EventInputType } from "@bsb/base";

package/lib/.bsb/clients/service-betterportal-config-manager.js

@@ -1,7 +1,7 @@
 /**
  * Auto-generated BSB virtual client for service-betterportal-config-manager
  * DO NOT EDIT - Regenerated on every build
- * @version 10.6.24
+ * @version 10.6.26
  */
 import { ServiceClient, importPortableSchema, createFireAndForgetEvent, createBroadcastEvent, createEventSchemas } from "@bsb/base";
 const _webhookDeliveryAvailableSchema = importPortableSchema(JSON.parse("{\"anyvaliVersion\":\"1.0\",\"schemaVersion\":\"1.1\",\"root\":{\"kind\":\"object\",\"properties\":{},\"required\":[],\"unknownKeys\":\"strip\"},\"definitions\":{},\"extensions\":{}}"));

package/lib/bp-contracts/org.betterportal.config-manager.json

@@ -4,7 +4,7 @@
     "pluginId": "org.betterportal.config-manager",
     "title": "BetterPortal Config Manager",
     "description": "Admin-facing BetterPortal service for discovering and managing service config surfaces.",
-    "version": "10.6.24",
+    "version": "10.6.26",
     "category": "service",
     "deploymentModes": [
       "self-hosted"

package/lib/plugins/service-betterportal-config-manager/adminApi.d.ts

@@ -292,6 +292,7 @@ declare function automationServiceCatalog(config: BetterPortalConfig, appDef: Be
     })[];
 };
 export declare function renderAutomationLlmsApi(catalog: ReturnType<typeof automationServiceCatalog>): string;
+export declare function collectServiceDeleteBlockers(config: BetterPortalConfig, tenantId: string, serviceId: string): string[];
 export declare function purgeServiceReferences(config: BetterPortalConfig, tenantId: string, serviceId: string): {
     routesRemoved: number;
     menuItemsRemoved: number;

package/lib/plugins/service-betterportal-config-manager/adminApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adminApi.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/adminApi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EACnB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAcjC,OAAO,KAAK,EAAuE,kBAAkB,EAAE,eAAe,EAAgE,MAAM,yBAAyB,CAAC;AACtN,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAoJzD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GACvC,MAAM,GAAG,SAAS,CAepB;AAwGD,iBAAS,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkEpF;AAGD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,GAAG,MAAM,CA4CpG;AA4VD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IACvG,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB,CAwEA;AAkPD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAiiDN;AAwPD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,GAAG,MAAM,CAkaT"}
+{"version":3,"file":"adminApi.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/adminApi.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EACnB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAcjC,OAAO,KAAK,EAAuE,kBAAkB,EAAE,eAAe,EAAgE,MAAM,yBAAyB,CAAC;AACtN,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAoLzD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GACvC,MAAM,GAAG,SAAS,CAepB;AAwGD,iBAAS,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkEpF;AAGD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,GAAG,MAAM,CA4CpG;AA8RD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiDtH;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IACvG,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB,CA2FA;AAkPD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,IAAI,CA0iDN;AAwPD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,GAAG,MAAM,CAkaT"}

package/lib/plugins/service-betterportal-config-manager/adminApi.js

@@ -1,9 +1,12 @@
+import { isMenuRouteExcluded } from "./routeMounts.js";
+import { setTimeout as delay } from "node:timers/promises";
 import * as av from "anyvali";
 import { AppAuthRoleSchema, eventHeaders, htmlResponse, jsonResponse, resolveEmbeddedRequestContext, signServiceConfigTicket, uuidv7, BetterPortalMenuItemSchema, BetterPortalThemeConfigSchema } from "@betterportal/framework";
 import { generateApiKey, hashApiKey } from "./storage/index.js";
 import { getManifestCache } from "./syncApi.js";
 import { apiRoutePath, appRoutePatternKey, isApiRoute, pageRoutePath } from "./routeMounts.js";
 import { M2MConnectionError, approveM2MConnections, buildM2MConnectionModel, revokeM2MConnection } from "./m2mConnections.js";
+import { ConfigRevisionConflictError } from "./storage/core.js";
 import { isPreviewApp } from "./previewEnvironments.js";
 const API_BASE = "/.well-known/bp/admin";
 const CONFIG_TICKET_TTL_SECONDS = 5 * 60;
@@ -69,6 +72,30 @@ function htmxError(message, status = 400) {
 function validationError(event, message) {
     return wantsHtmx(event) ? htmxError(message, 400) : jsonResponse({ error: message }, 400);
 }
+// Only wrap operations whose effects are confined to the config transaction.
+// The callback must reload and revalidate, never resave a rejected snapshot.
+async function withRouteConfigRetry(event, store, action) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await action();
+        }
+        catch (error) {
+            if (!(error instanceof ConfigRevisionConflictError))
+                throw error;
+            store.invalidate();
+            if (attempt < 4) {
+                await delay(25 * 2 ** attempt * (1 + Math.random()));
+                continue;
+            }
+            const message = "Route configuration is busy; retry submission";
+            const response = wantsHtmx(event)
+                ? htmxError(message, 503)
+                : jsonResponse({ error: message }, 503);
+            response.headers.set("Retry-After", "1");
+            return response;
+        }
+    }
+}
 function validateRoleId(value) {
     if (typeof value !== "string")
         return undefined;
@@ -95,7 +122,11 @@ function normalizeMenuItem(raw) {
     const item = raw && typeof raw === "object" ? raw : {};
     return BetterPortalMenuItemSchema.parse({
         id: typeof item.id === "string" ? item.id : uuidv7(),
-        type: item.type === "group" ? "group" : "link",
+        type: item.type ?? "link",
+        authStatus: item.authStatus ?? "auto",
+        serviceStatus: item.serviceStatus ?? "show",
+        rolesAnyOf: item.rolesAnyOf,
+        defaultExpanded: item.defaultExpanded,
         title: typeof item.title === "string" ? item.title : undefined,
         icon: typeof item.icon === "string" ? item.icon : undefined,
         routeId: typeof item.routeId === "string" ? item.routeId : undefined,
@@ -393,18 +424,6 @@ function parseRouteCreateBody(body) {
         route.query = query.replace(/^\?+/, "");
     return { route };
 }
-function serviceRouteTargetKey(route) {
-    const servicePath = route.servicePathVariant
-        ?? route.targetPath
-        ?? getManifestCache().get(route.serviceId)?.viewIndex[route.viewId]?.path;
-    return servicePath
-        ? `${route.serviceId}\u0000${route.viewId}\u0000${[...route.operations].sort().join(",")}\u0000${appRoutePatternKey(servicePath)}`
-        : undefined;
-}
-function hasDuplicateServiceRouteTarget(appDef, route, excludeRouteId) {
-    const key = serviceRouteTargetKey(route);
-    return !!key && appDef.routes.some((candidate) => candidate.id !== excludeRouteId && serviceRouteTargetKey(candidate) === key);
-}
 function countMenuRouteReferences(items, routeId) {
     if (!Array.isArray(items))
         return 0;
@@ -618,7 +637,7 @@ function duplicateTenantService(tenant, hostname, serviceId) {
     }
     return null;
 }
-function collectServiceDeleteBlockers(config, tenantId, serviceId) {
+export function collectServiceDeleteBlockers(config, tenantId, serviceId) {
     const blockers = [];
     const apps = config.apps.filter((app) => app.tenantId === tenantId);
     const add = (app, label, id) => {
@@ -641,6 +660,16 @@ function collectServiceDeleteBlockers(config, tenantId, serviceId) {
                     add(app, "fragment", `${location}.${fragment.fragmentId}`);
             }
         }
+        for (const [shellServiceId, settings] of Object.entries(app.shellFragments ?? {})) {
+            if (shellServiceId === serviceId)
+                add(app, "shell fragments", shellServiceId);
+            for (const [fragmentId, setting] of Object.entries(settings)) {
+                const items = setting.mode === "override" ? [setting.item] : setting.mode === "items" ? setting.items : [];
+                if (items.some(item => item.source === "service" && item.serviceId === serviceId)) {
+                    add(app, "shell fragment", `${shellServiceId}.${fragmentId}`);
+                }
+            }
+        }
         if (app.auth?.serviceId === serviceId)
             add(app, "auth provider", serviceId);
         for (const role of app.auth?.roles ?? []) {
@@ -699,6 +728,26 @@ export function purgeServiceReferences(config, tenantId, serviceId) {
                 summary.roleGrantsRemoved += before - role.permissions.length;
             }
         }
+        for (const [shellServiceId, settings] of Object.entries(app.shellFragments ?? {})) {
+            if (shellServiceId === serviceId) {
+                summary.fragmentsRemoved += Object.keys(settings).length;
+                delete app.shellFragments[shellServiceId];
+                continue;
+            }
+            for (const [fragmentId, setting] of Object.entries(settings)) {
+                if (setting.mode === "override" && setting.item.source === "service" && setting.item.serviceId === serviceId) {
+                    delete settings[fragmentId];
+                    summary.fragmentsRemoved += 1;
+                }
+                else if (setting.mode === "items") {
+                    const before = setting.items.length;
+                    setting.items = setting.items.filter(item => item.source !== "service" || item.serviceId !== serviceId);
+                    summary.fragmentsRemoved += before - setting.items.length;
+                }
+            }
+            if (Object.keys(settings).length === 0)
+                delete app.shellFragments[shellServiceId];
+        }
         const routeIds = new Set(app.routes.filter((route) => route.serviceId === serviceId).map((route) => route.id));
         const routeCountBefore = app.routes.length;
         app.routes = app.routes.filter((route) => route.serviceId !== serviceId);
@@ -1042,8 +1091,8 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const parsed = parseRouteCreateBody(body);
         if (parsed.error || !parsed.route)
             return validationError(event, parsed.error ?? "Invalid route");
-        if (hasDuplicateServiceRouteTarget(appDef, parsed.route)) {
-            return validationError(event, "This service view and path are already mounted in this app.");
+        if (appDef.routes.some((candidate) => appRoutePatternKey(candidate.path) === appRoutePatternKey(parsed.route.path))) {
+            return validationError(event, `A route already exists at ${parsed.route.path}.`);
         }
         const route = { id: uuidv7(), ...parsed.route };
         appDef.routes.push(route);
@@ -1944,31 +1993,32 @@ export function registerAdminApiRoutes(app, store, cpState) {
         if (!appId)
             return jsonResponse({ error: "appId required" }, 400);
         const body = await readFormOrJsonBody(event);
-        const config = await store.loadConfig();
-        const appDef = config.apps.find((a) => a.id === appId);
-        if (!appDef)
-            return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
-        const parsed = parseRouteCreateBody(body);
-        if (parsed.error || !parsed.route)
-            return validationError(event, parsed.error ?? "Invalid route.");
-        if (parsed.route.kind === "api")
-            return validationError(event, "Service/API routes are created by service manifest sync.");
-        const serviceError = validateRegisteredRouteService(config, appDef, parsed.route.serviceId);
-        if (serviceError)
-            return validationError(event, serviceError);
-        if (appDef.routes.some((candidate) => appRoutePatternKey(candidate.path) === appRoutePatternKey(parsed.route.path))) {
-            return validationError(event, `A route already exists at ${parsed.route.path}.`);
-        }
-        if (hasDuplicateServiceRouteTarget(appDef, parsed.route)) {
-            return validationError(event, "This service view and path are already mounted in this app.");
-        }
-        const route = { ...parsed.route, id: uuidv7() };
-        appDef.routes.push(route);
-        addRouteDependencies(appDef, route);
-        await store.saveConfig(config);
-        if (wantsHtmx(event))
-            return htmxReload(routesReloadPath(appId));
-        return jsonResponse({ ok: true, id: route.id }, 201);
+        return withRouteConfigRetry(event, store, async () => {
+            const config = await store.loadConfig();
+            if (isPreviewApp(config, appId))
+                return jsonResponse({ error: "Preview resources are managed through Preview Environments" }, 404);
+            const appDef = config.apps.find((a) => a.id === appId);
+            if (!appDef)
+                return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
+            const parsed = parseRouteCreateBody(body);
+            if (parsed.error || !parsed.route)
+                return validationError(event, parsed.error ?? "Invalid route.");
+            if (parsed.route.kind === "api")
+                return validationError(event, "Service/API routes are created by service manifest sync.");
+            const serviceError = validateRegisteredRouteService(config, appDef, parsed.route.serviceId);
+            if (serviceError)
+                return validationError(event, serviceError);
+            if (appDef.routes.some((candidate) => appRoutePatternKey(candidate.path) === appRoutePatternKey(parsed.route.path))) {
+                return validationError(event, `A route already exists at ${parsed.route.path}.`);
+            }
+            const route = { ...parsed.route, id: uuidv7() };
+            appDef.routes.push(route);
+            addRouteDependencies(appDef, route);
+            await store.saveConfig(config);
+            if (wantsHtmx(event))
+                return htmxReload(routesReloadPath(appId));
+            return jsonResponse({ ok: true, id: route.id }, 201);
+        });
     });
     app.put(`${API_BASE}/apps/:appId/routes/:routeId`, async (event) => {
         const appId = getParam(event, "appId");
@@ -1976,167 +2026,170 @@ export function registerAdminApiRoutes(app, store, cpState) {
         if (!appId || !routeId)
             return jsonResponse({ error: "appId and routeId required" }, 400);
         const body = await readFormOrJsonBody(event);
-        const config = await store.loadConfig();
-        const appDef = config.apps.find((a) => a.id === appId);
-        if (!appDef)
-            return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
-        const route = appDef.routes.find((r) => r.id === routeId);
-        if (!route)
-            return wantsHtmx(event) ? htmxError("Route not found", 404) : jsonResponse({ error: "Route not found" }, 404);
-        if (route.kind === "api" && Object.keys(body).some((key) => key !== "enabled")) {
-            return validationError(event, "Service/API route identity and metadata are managed by service manifest sync.");
-        }
-        const originalServiceTargetKey = serviceRouteTargetKey(route);
-        if (body.path !== undefined) {
-            const path = trimmedString(body, "path");
-            if (!path)
-                return validationError(event, "Mount path is required.");
-            const pathError = validateCanonicalRoutePath(path, "Mount path");
-            if (pathError)
-                return validationError(event, pathError);
-            if (appDef.routes.some((candidate) => candidate.id !== route.id && appRoutePatternKey(candidate.path) === appRoutePatternKey(path))) {
-                return validationError(event, `A route already exists at ${path}.`);
+        return withRouteConfigRetry(event, store, async () => {
+            const config = await store.loadConfig();
+            if (isPreviewApp(config, appId))
+                return jsonResponse({ error: "Preview resources are managed through Preview Environments" }, 404);
+            const appDef = config.apps.find((a) => a.id === appId);
+            if (!appDef)
+                return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
+            const route = appDef.routes.find((r) => r.id === routeId);
+            if (!route)
+                return wantsHtmx(event) ? htmxError("Route not found", 404) : jsonResponse({ error: "Route not found" }, 404);
+            if (route.kind === "api" && Object.keys(body).some((key) => key !== "enabled")) {
+                return validationError(event, "Service/API route identity and metadata are managed by service manifest sync.");
             }
-            route.path = path;
-        }
-        if (body.serviceId !== undefined) {
-            const serviceId = trimmedString(body, "serviceId");
-            if (!serviceId)
-                return validationError(event, "Service is required.");
-            const serviceError = validateRegisteredRouteService(config, appDef, serviceId);
-            if (serviceError)
-                return validationError(event, serviceError);
-            route.serviceId = serviceId;
-        }
-        if (body.viewId !== undefined) {
-            const viewId = trimmedString(body, "viewId");
-            if (!viewId)
-                return validationError(event, "View is required.");
-            route.viewId = viewId;
-        }
-        if (body.operationId !== undefined) {
-            const operationId = trimmedString(body, "operationId");
-            if (!operationId)
-                return validationError(event, "Operation is required.");
-            route.operations = [operationId];
-        }
-        const manifest = getManifestCache().get(route.serviceId);
-        const manifestView = manifest?.viewIndex[route.viewId];
-        if (manifestView) {
-            const manifestOperation = manifestView.operations.find((operation) => route.operations.includes(operation.operationId));
-            if (!manifestOperation)
-                return validationError(event, "Selected operation is not available for this view.");
-            const routeIdentityChanged = body.serviceId !== undefined || body.viewId !== undefined || body.operationId !== undefined;
-            const requestedServicePath = trimmedString(body, "servicePathVariant")
-                ?? (routeIdentityChanged ? undefined : route.servicePathVariant)
-                ?? manifestView.path;
-            if (![manifestView.path, ...manifestView.pathVariants].includes(requestedServicePath)) {
-                return validationError(event, "Selected service path is not available for this view.");
+            if (body.path !== undefined) {
+                const path = trimmedString(body, "path");
+                if (!path)
+                    return validationError(event, "Mount path is required.");
+                const pathError = validateCanonicalRoutePath(path, "Mount path");
+                if (pathError)
+                    return validationError(event, pathError);
+                if (appDef.routes.some((candidate) => candidate.id !== route.id && appRoutePatternKey(candidate.path) === appRoutePatternKey(path))) {
+                    return validationError(event, `A route already exists at ${path}.`);
+                }
+                route.path = path;
             }
-            const servicePathError = validateCanonicalRoutePath(requestedServicePath, "Service path");
-            if (servicePathError)
-                return validationError(event, servicePathError);
-            const submittedFixed = fixedParamsFromBody(body);
-            const pageRenderable = manifestOperation.method === "GET" && manifestOperation.renderModes.includes("page");
-            const mappedAppPath = !pageRenderable
-                ? apiRoutePath(manifest?.serviceId ?? route.serviceId, requestedServicePath)
-                : route.path;
-            const appParams = new Set(routeParamNames(mappedAppPath));
-            const fixedParams = Object.fromEntries(Object.entries(submittedFixed).filter(([name]) => routeParamNames(requestedServicePath).includes(name) && !appParams.has(name)));
-            const mappingError = validateRouteParamMapping(mappedAppPath, requestedServicePath, fixedParams, manifestView.paramsSchema);
-            if (mappingError)
-                return validationError(event, mappingError);
-            if (requestedServicePath === manifestView.path)
-                delete route.servicePathVariant;
-            else
-                route.servicePathVariant = requestedServicePath;
-            if (Object.keys(fixedParams).length > 0)
-                route.fixedParams = fixedParams;
-            else
-                delete route.fixedParams;
-            route.targetPath = requestedServicePath;
-            if (!pageRenderable) {
-                route.kind = "api";
-                route.path = apiRoutePath(manifest?.serviceId ?? route.serviceId, requestedServicePath);
-                route.title = manifestOperation.title;
-                delete route.query;
+            if (body.serviceId !== undefined) {
+                const serviceId = trimmedString(body, "serviceId");
+                if (!serviceId)
+                    return validationError(event, "Service is required.");
+                const serviceError = validateRegisteredRouteService(config, appDef, serviceId);
+                if (serviceError)
+                    return validationError(event, serviceError);
+                route.serviceId = serviceId;
             }
-            else {
-                route.kind = "page";
+            if (body.viewId !== undefined) {
+                const viewId = trimmedString(body, "viewId");
+                if (!viewId)
+                    return validationError(event, "View is required.");
+                route.viewId = viewId;
             }
-        }
-        if (body.targetPath !== undefined) {
-            const targetPath = trimmedString(body, "targetPath");
-            if (targetPath)
-                route.targetPath = targetPath;
-            else
-                delete route.targetPath;
-        }
-        if (body.query !== undefined) {
-            const query = trimmedString(body, "query");
-            const renderable = manifestView?.operations.some((operation) => route.operations.includes(operation.operationId) && operation.method === "GET" && operation.renderModes.includes("page"));
-            if (isApiRoute(route, renderable))
-                delete route.query;
-            else if (query)
-                route.query = query.replace(/^\?+/, "");
-            else
-                delete route.query;
-        }
-        if (body.title !== undefined) {
-            const title = trimmedString(body, "title");
-            if (!title)
-                return validationError(event, "Display title is required.");
-            const renderable = manifestView?.operations.some((operation) => route.operations.includes(operation.operationId) && operation.method === "GET" && operation.renderModes.includes("page"));
-            if (!isApiRoute(route, renderable))
-                route.title = title;
-        }
-        if (body.enabled !== undefined) {
-            route.enabled = body.enabled === true || body.enabled === "true" || body.enabled === "on";
-            route.enablement = route.enabled ? "enabled" : "disabled";
-        }
-        if (appDef.routes.some((candidate) => candidate.id !== route.id && appRoutePatternKey(candidate.path) === appRoutePatternKey(route.path))) {
-            return validationError(event, `A route already exists at ${route.path}.`);
-        }
-        const updatedServiceTargetKey = serviceRouteTargetKey(route);
-        if (updatedServiceTargetKey !== originalServiceTargetKey && hasDuplicateServiceRouteTarget(appDef, route, route.id)) {
-            return validationError(event, "This service view and path are already mounted in this app.");
-        }
-        await store.saveConfig(config);
-        if (wantsHtmx(event))
-            return htmxReload(routesReloadPath(appId, route.kind === "api" ? route.serviceId : undefined));
-        return jsonResponse({ ok: true });
+            if (body.operationId !== undefined) {
+                const operationId = trimmedString(body, "operationId");
+                if (!operationId)
+                    return validationError(event, "Operation is required.");
+                route.operations = [operationId];
+            }
+            const manifest = getManifestCache().get(route.serviceId);
+            const manifestView = manifest?.viewIndex[route.viewId];
+            if (manifestView) {
+                const manifestOperation = manifestView.operations.find((operation) => route.operations.includes(operation.operationId));
+                if (!manifestOperation)
+                    return validationError(event, "Selected operation is not available for this view.");
+                const routeIdentityChanged = body.serviceId !== undefined || body.viewId !== undefined || body.operationId !== undefined;
+                const requestedServicePath = trimmedString(body, "servicePathVariant")
+                    ?? (routeIdentityChanged ? undefined : route.servicePathVariant)
+                    ?? manifestView.path;
+                if (![manifestView.path, ...manifestView.pathVariants].includes(requestedServicePath)) {
+                    return validationError(event, "Selected service path is not available for this view.");
+                }
+                const servicePathError = validateCanonicalRoutePath(requestedServicePath, "Service path");
+                if (servicePathError)
+                    return validationError(event, servicePathError);
+                const submittedFixed = fixedParamsFromBody(body);
+                const pageRenderable = manifestOperation.method === "GET" && manifestOperation.renderModes.includes("page");
+                const mappedAppPath = !pageRenderable
+                    ? apiRoutePath(manifest?.serviceId ?? route.serviceId, requestedServicePath)
+                    : route.path;
+                const appParams = new Set(routeParamNames(mappedAppPath));
+                const fixedParams = Object.fromEntries(Object.entries(submittedFixed).filter(([name]) => routeParamNames(requestedServicePath).includes(name) && !appParams.has(name)));
+                const mappingError = validateRouteParamMapping(mappedAppPath, requestedServicePath, fixedParams, manifestView.paramsSchema);
+                if (mappingError)
+                    return validationError(event, mappingError);
+                if (requestedServicePath === manifestView.path)
+                    delete route.servicePathVariant;
+                else
+                    route.servicePathVariant = requestedServicePath;
+                if (Object.keys(fixedParams).length > 0)
+                    route.fixedParams = fixedParams;
+                else
+                    delete route.fixedParams;
+                route.targetPath = requestedServicePath;
+                if (!pageRenderable) {
+                    route.kind = "api";
+                    route.path = apiRoutePath(manifest?.serviceId ?? route.serviceId, requestedServicePath);
+                    route.title = manifestOperation.title;
+                    delete route.query;
+                }
+                else {
+                    route.kind = "page";
+                }
+            }
+            if (body.targetPath !== undefined) {
+                const targetPath = trimmedString(body, "targetPath");
+                if (targetPath)
+                    route.targetPath = targetPath;
+                else
+                    delete route.targetPath;
+            }
+            if (body.query !== undefined) {
+                const query = trimmedString(body, "query");
+                const renderable = manifestView?.operations.some((operation) => route.operations.includes(operation.operationId) && operation.method === "GET" && operation.renderModes.includes("page"));
+                if (isApiRoute(route, renderable))
+                    delete route.query;
+                else if (query)
+                    route.query = query.replace(/^\?+/, "");
+                else
+                    delete route.query;
+            }
+            if (body.title !== undefined) {
+                const title = trimmedString(body, "title");
+                if (!title)
+                    return validationError(event, "Display title is required.");
+                const renderable = manifestView?.operations.some((operation) => route.operations.includes(operation.operationId) && operation.method === "GET" && operation.renderModes.includes("page"));
+                if (!isApiRoute(route, renderable))
+                    route.title = title;
+            }
+            if (body.enabled !== undefined) {
+                route.enabled = body.enabled === true || body.enabled === "true" || body.enabled === "on";
+                route.enablement = route.enabled ? "enabled" : "disabled";
+            }
+            if (appDef.routes.some((candidate) => candidate.id !== route.id && appRoutePatternKey(candidate.path) === appRoutePatternKey(route.path))) {
+                return validationError(event, `A route already exists at ${route.path}.`);
+            }
+            await store.saveConfig(config);
+            if (wantsHtmx(event))
+                return htmxReload(routesReloadPath(appId, route.kind === "api" ? route.serviceId : undefined));
+            return jsonResponse({ ok: true });
+        });
     });
     app.delete(`${API_BASE}/apps/:appId/routes/:routeId`, async (event) => {
         const appId = getParam(event, "appId");
         const routeId = getParam(event, "routeId");
         if (!appId || !routeId)
             return jsonResponse({ error: "appId and routeId required" }, 400);
-        const config = await store.loadConfig();
-        const appDef = config.apps.find((a) => a.id === appId);
-        if (!appDef)
-            return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
-        const route = appDef.routes.find((r) => r.id === routeId);
-        if (!route)
-            return wantsHtmx(event) ? htmxAlert("Route not found.") : jsonResponse({ error: "Route not found" }, 404);
-        if (route.kind === "api") {
-            const message = "Service/API routes are managed by service manifest sync and cannot be deleted manually.";
-            return wantsHtmx(event) ? htmxAlert(message, "warning") : jsonResponse({ error: message }, 409);
-        }
-        const menuReferenceCount = countMenuRouteReferences(appDef.menu, routeId);
-        if (menuReferenceCount > 0) {
-            const message = `Cannot delete route "${route.title ?? route.path}" because ${menuReferenceCount} menu item${menuReferenceCount === 1 ? "" : "s"} reference it. Remove the menu reference first.`;
-            return wantsHtmx(event) ? htmxAlert(message, "warning") : jsonResponse({ error: message }, 409);
-        }
-        const redirectReference = Object.entries(appDef.auth?.redirects ?? {}).find(([, target]) => target?.serviceId === route.serviceId && target.viewId === route.viewId);
-        if (redirectReference) {
-            const message = `Cannot delete route "${route.title ?? route.path}" because the app uses it for auth ${redirectReference[0]} navigation.`;
-            return wantsHtmx(event) ? htmxAlert(message, "warning") : jsonResponse({ error: message }, 409);
-        }
-        appDef.routes = appDef.routes.filter((r) => r.id !== routeId);
-        await store.saveConfig(config);
-        if (wantsHtmx(event))
-            return htmxReload(`/routes?appId=${encodeURIComponent(appId)}`);
-        return jsonResponse({ ok: true });
+        return withRouteConfigRetry(event, store, async () => {
+            const config = await store.loadConfig();
+            if (isPreviewApp(config, appId))
+                return jsonResponse({ error: "Preview resources are managed through Preview Environments" }, 404);
+            const appDef = config.apps.find((a) => a.id === appId);
+            if (!appDef)
+                return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
+            const route = appDef.routes.find((r) => r.id === routeId);
+            if (!route)
+                return wantsHtmx(event) ? htmxAlert("Route not found.") : jsonResponse({ error: "Route not found" }, 404);
+            if (route.kind === "api") {
+                const message = "Service/API routes are managed by service manifest sync and cannot be deleted manually.";
+                return wantsHtmx(event) ? htmxAlert(message, "warning") : jsonResponse({ error: message }, 409);
+            }
+            const menuReferenceCount = countMenuRouteReferences(appDef.menu, routeId);
+            if (menuReferenceCount > 0) {
+                const message = `Cannot delete route "${route.title ?? route.path}" because ${menuReferenceCount} menu item${menuReferenceCount === 1 ? "" : "s"} reference it. Remove the menu reference first.`;
+                return wantsHtmx(event) ? htmxAlert(message, "warning") : jsonResponse({ error: message }, 409);
+            }
+            const redirectReference = Object.entries(appDef.auth?.redirects ?? {}).find(([, target]) => target?.serviceId === route.serviceId && target.viewId === route.viewId);
+            if (redirectReference) {
+                const message = `Cannot delete route "${route.title ?? route.path}" because the app uses it for auth ${redirectReference[0]} navigation.`;
+                return wantsHtmx(event) ? htmxAlert(message, "warning") : jsonResponse({ error: message }, 409);
+            }
+            appDef.routes = appDef.routes.filter((r) => r.id !== routeId);
+            await store.saveConfig(config);
+            if (wantsHtmx(event))
+                return htmxReload(`/routes?appId=${encodeURIComponent(appId)}`);
+            return jsonResponse({ ok: true });
+        });
     });
     // Menu (per app)
     app.get(`${API_BASE}/apps/:appId/menu`, async (event) => {
@@ -2159,7 +2212,14 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const appDef = config.apps.find((a) => a.id === appId);
         if (!appDef)
             return jsonResponse({ error: "App not found" }, 404);
-        appDef.menu = items.map(normalizeMenuItem);
+        const menu = items.map(normalizeMenuItem);
+        const invalid = (entries) => entries.some(item => {
+            const route = item.routeId ? appDef.routes.find(route => route.id === item.routeId) : undefined;
+            return (Boolean(item.routeId) && (!route || isMenuRouteExcluded(route, getManifestCache()))) || invalid(item.children);
+        });
+        if (invalid(menu))
+            return jsonResponse({ error: "Menu contains a missing or excluded route" }, 400);
+        appDef.menu = menu;
         await store.saveConfig(config);
         return jsonResponse({ ok: true });
     });
@@ -2254,6 +2314,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
                             operationId: operation.operationId,
                             title: typeof operation.title === "string" ? operation.title : view.title,
                             renderable: operation.renderable === true,
+                            menu: operation.menu,
                             pageRenderable: operation.method === "GET" && hasPageRenderer({ ...view, operations: [operation] })
                         }]
                     : []));
@@ -2308,7 +2369,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
                     });
                     if (r.pageRenderable)
                         existingPaths.add(mountPath);
-                    if (r.pageRenderable && !isApiRoute({ kind: "page", path: mountPath }, true)) {
+                    if (r.pageRenderable && r.menu !== false && !isApiRoute({ kind: "page", path: mountPath }, true)) {
                         groupChildren.push({
                             id: uuidv7(),
                             type: "link",
@@ -2316,7 +2377,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
                             routeId,
                             enabled: true,
                             serviceStatus: "show",
-                            authStatus: "show",
+                            authStatus: "auto",
                             children: []
                         });
                     }
@@ -2328,7 +2389,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
                         title,
                         enabled: true,
                         serviceStatus: "show",
-                        authStatus: "show",
+                        authStatus: "auto",
                         children: groupChildren
                     });
                 }