@betterportal/config-manager 10.6.28 → 10.6.30

package/lib/.bsb/clients/service-betterportal-config-manager.d.ts

@@ -1,7 +1,7 @@
 /**
  * Auto-generated BSB virtual client for service-betterportal-config-manager
  * DO NOT EDIT - Regenerated on every build
- * @version 10.6.28
+ * @version 10.6.30
  */
 import { ServiceClient, BSBService } from "@bsb/base";
 import type { Observable, BSBServiceClientDefinition, EventInputType } from "@bsb/base";

package/lib/.bsb/clients/service-betterportal-config-manager.js

@@ -1,7 +1,7 @@
 /**
  * Auto-generated BSB virtual client for service-betterportal-config-manager
  * DO NOT EDIT - Regenerated on every build
- * @version 10.6.28
+ * @version 10.6.30
  */
 import { ServiceClient, importPortableSchema, createFireAndForgetEvent, createBroadcastEvent, createEventSchemas } from "@bsb/base";
 const _webhookDeliveryAvailableSchema = importPortableSchema(JSON.parse("{\"anyvaliVersion\":\"1.0\",\"schemaVersion\":\"1.1\",\"root\":{\"kind\":\"object\",\"properties\":{},\"required\":[],\"unknownKeys\":\"strip\"},\"definitions\":{},\"extensions\":{}}"));

package/lib/bp-contracts/org.betterportal.config-manager.json

@@ -4,7 +4,7 @@
     "pluginId": "org.betterportal.config-manager",
     "title": "BetterPortal Config Manager",
     "description": "Admin-facing BetterPortal service for discovering and managing service config surfaces.",
-    "version": "10.6.28",
+    "version": "10.6.30",
     "category": "service",
     "deploymentModes": [
       "self-hosted"

package/lib/plugins/service-betterportal-config-manager/adminApi.d.ts

@@ -31,7 +31,7 @@ declare function automationServiceCatalog(config: BetterPortalConfig, appDef: Be
                 scope: "tenant" | "app";
                 visibility: "public" | "protected" | "secret";
                 ownership: "bp" | "plugin" | "mixed";
-                sourceOfTruth: "bp" | "plugin" | "external";
+                sourceOfTruth: "external" | "bp" | "plugin";
                 required: boolean;
                 groupId?: string | undefined;
                 order?: number | undefined;
@@ -168,7 +168,7 @@ declare function automationServiceCatalog(config: BetterPortalConfig, appDef: Be
                 scope: "tenant" | "app";
                 visibility: "public" | "protected" | "secret";
                 ownership: "bp" | "plugin" | "mixed";
-                sourceOfTruth: "bp" | "plugin" | "external";
+                sourceOfTruth: "external" | "bp" | "plugin";
                 required: boolean;
                 groupId?: string | undefined;
                 order?: number | undefined;

package/lib/plugins/service-betterportal-config-manager/adminApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adminApi.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/adminApi.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EACnB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAcjC,OAAO,KAAK,EAAuE,kBAAkB,EAAE,eAAe,EAAgE,MAAM,yBAAyB,CAAC;AACtN,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAoLzD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GACvC,MAAM,GAAG,SAAS,CAepB;AAwGD,iBAAS,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkEpF;AAGD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,GAAG,MAAM,CA4CpG;AA8RD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiDtH;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IACvG,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB,CA2FA;AAkPD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,IAAI,CA0iDN;AAwPD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,GAAG,MAAM,CAwaT"}
+{"version":3,"file":"adminApi.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/adminApi.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EACnB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAcjC,OAAO,KAAK,EAAuE,kBAAkB,EAAE,eAAe,EAAgE,MAAM,yBAAyB,CAAC;AACtN,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAgLzD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GACvC,MAAM,GAAG,SAAS,CAepB;AAwGD,iBAAS,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkEpF;AAGD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,GAAG,MAAM,CA4CpG;AA8RD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiDtH;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IACvG,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB,CA2FA;AAkPD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAwiDN;AAwPD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,GAAG,MAAM,CAwaT"}

package/lib/plugins/service-betterportal-config-manager/adminApi.js

@@ -1,12 +1,10 @@
 import { isMenuRouteExcluded } from "./routeMounts.js";
-import { setTimeout as delay } from "node:timers/promises";
 import * as av from "anyvali";
 import { AppAuthRoleSchema, eventHeaders, htmlResponse, jsonResponse, resolveEmbeddedRequestContext, signServiceConfigTicket, uuidv7, BetterPortalMenuItemSchema, BetterPortalThemeConfigSchema } from "@betterportal/framework";
 import { generateApiKey, hashApiKey } from "./storage/index.js";
 import { getManifestCache } from "./syncApi.js";
 import { apiRoutePath, appRoutePatternKey, isApiRoute, pageRoutePath } from "./routeMounts.js";
 import { M2MConnectionError, approveM2MConnections, buildM2MConnectionModel, revokeM2MConnection } from "./m2mConnections.js";
-import { ConfigRevisionConflictError } from "./storage/core.js";
 import { isPreviewApp } from "./previewEnvironments.js";
 const API_BASE = "/.well-known/bp/admin";
 const CONFIG_TICKET_TTL_SECONDS = 5 * 60;
@@ -72,28 +70,27 @@ function htmxError(message, status = 400) {
 function validationError(event, message) {
     return wantsHtmx(event) ? htmxError(message, 400) : jsonResponse({ error: message }, 400);
 }
-// Only wrap operations whose effects are confined to the config transaction.
-// The callback must reload and revalidate, never resave a rejected snapshot.
-async function withRouteConfigRetry(event, store, action) {
-    for (let attempt = 0;; attempt++) {
-        try {
-            return await action();
-        }
-        catch (error) {
-            if (!(error instanceof ConfigRevisionConflictError))
-                throw error;
-            store.invalidate();
-            if (attempt < 4) {
-                await delay(25 * 2 ** attempt * (1 + Math.random()));
-                continue;
-            }
-            const message = "Route configuration is busy; retry submission";
-            const response = wantsHtmx(event)
-                ? htmxError(message, 503)
-                : jsonResponse({ error: message }, 503);
-            response.headers.set("Retry-After", "1");
-            return response;
-        }
+// PostgreSQL edits read current rows under an app-scoped transaction.
+// File stores retain their existing single-process save semantics.
+async function editApp(store, appId, action) {
+    const apply = async (config) => {
+        const response = await action(config);
+        if (!response.ok)
+            throw response;
+        return response;
+    };
+    try {
+        if (store.mutateApp)
+            return await store.mutateApp(appId, apply);
+        const config = await store.loadConfig();
+        const response = await apply(config);
+        await store.saveConfig(config);
+        return response;
+    }
+    catch (error) {
+        if (error instanceof Response)
+            return error;
+        throw error;
     }
 }
 function validateRoleId(value) {
@@ -1672,10 +1669,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
             && service.id === mountedServiceId
             && service.serviceId === identity.serviceId));
     };
-    const requireServiceIdentityForAuthoritativeService = async (event, config, appDef, type) => {
-        const identity = await readServiceIdentity(event);
-        if (identity instanceof Response)
-            return identity;
+    const requireServiceIdentityForAuthoritativeService = (identity, config, appDef, type) => {
         const mountedServiceId = appMountedServiceId(appDef, type);
         if (!serviceIdentityOwnsMountedService(config, appDef, identity, mountedServiceId)) {
             return jsonResponse({
@@ -1687,7 +1681,6 @@ export function registerAdminApiRoutes(app, store, cpState) {
         }
         return undefined;
     };
-    const requireServiceIdentityForAppAuth = async (event, config, appDef) => requireServiceIdentityForAuthoritativeService(event, config, appDef, "auth");
     const parseSyncedRoles = (appDef, roles) => {
         const parsedRoles = [];
         for (const rawRole of roles) {
@@ -1766,34 +1759,52 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const roles = Array.isArray(body.roles) ? body.roles : undefined;
         if (!roles)
             return jsonResponse({ error: "roles array required" }, 400);
-        const { config, appDef } = await getAppOr404(appId);
-        if (!appDef)
-            return jsonResponse({ error: "App not found" }, 404);
-        const serviceError = await requireServiceIdentityForAppAuth(event, config, appDef);
-        if (serviceError)
-            return serviceError;
-        const authResult = requireAuthBlock(event, appDef);
-        if (authResult.response)
-            return authResult.response;
-        const parsedRoles = parseSyncedRoles(appDef, roles);
-        if (parsedRoles instanceof Response)
-            return parsedRoles;
-        authResult.auth.roles = parsedRoles;
-        await store.saveConfig(config);
-        return jsonResponse({ ok: true, roles: parsedRoles.length });
+        const identity = await readServiceIdentity(event);
+        if (identity instanceof Response)
+            return identity;
+        return editApp(store, appId, async (config) => {
+            const appDef = config.apps.find(app => app.id === appId);
+            if (!appDef)
+                return jsonResponse({ error: "App not found" }, 404);
+            const serviceError = requireServiceIdentityForAuthoritativeService(identity, config, appDef, "auth");
+            if (serviceError)
+                return serviceError;
+            const authResult = requireAuthBlock(event, appDef);
+            if (authResult.response)
+                return authResult.response;
+            const parsedRoles = parseSyncedRoles(appDef, roles);
+            if (parsedRoles instanceof Response)
+                return parsedRoles;
+            authResult.auth.roles = parsedRoles;
+            return jsonResponse({ ok: true, roles: parsedRoles.length });
+        });
     });
     app.put(`${API_BASE}/services/self-mutation`, async (event) => {
         const parsed = SelfMutationRequestSchema.safeParse(await readJsonBody(event));
         if (!parsed.success)
             return jsonResponse({ error: "Invalid self-mutation request", issues: parsed.issues }, 400);
         const { tenantId, appId, type, mutation } = parsed.data;
-        const { config, appDef } = await getAppOr404(appId);
-        if (!appDef || appDef.tenantId !== tenantId)
-            return jsonResponse({ error: "App not found" }, 404);
-        const serviceError = await requireServiceIdentityForAuthoritativeService(event, config, appDef, type);
-        if (serviceError)
-            return serviceError;
-        if (type === "auth") {
+        const identity = await readServiceIdentity(event);
+        if (identity instanceof Response)
+            return identity;
+        if (type === "theme") {
+            const { config, appDef } = await getAppOr404(appId);
+            if (!appDef || appDef.tenantId !== tenantId)
+                return jsonResponse({ error: "App not found" }, 404);
+            const serviceError = requireServiceIdentityForAuthoritativeService(identity, config, appDef, type);
+            if (serviceError)
+                return serviceError;
+            appDef.themeConfig = mutation.themeConfig;
+            await store.saveConfig(config);
+            return jsonResponse({ ok: true, type });
+        }
+        return editApp(store, appId, async (config) => {
+            const appDef = config.apps.find(app => app.id === appId);
+            if (!appDef || appDef.tenantId !== tenantId)
+                return jsonResponse({ error: "App not found" }, 404);
+            const serviceError = requireServiceIdentityForAuthoritativeService(identity, config, appDef, type);
+            if (serviceError)
+                return serviceError;
             const authResult = requireAuthBlock(event, appDef);
             if (authResult.response)
                 return authResult.response;
@@ -1801,12 +1812,8 @@ export function registerAdminApiRoutes(app, store, cpState) {
             if (parsedRoles instanceof Response)
                 return parsedRoles;
             authResult.auth.roles = parsedRoles;
-            await store.saveConfig(config);
             return jsonResponse({ ok: true, type, roles: parsedRoles.length });
-        }
-        appDef.themeConfig = mutation.themeConfig;
-        await store.saveConfig(config);
-        return jsonResponse({ ok: true, type });
+        });
     });
     app.post(`${API_BASE}/apps/:appId/auth/roles`, async (event) => {
         const appId = getParam(event, "appId");
@@ -1821,27 +1828,28 @@ export function registerAdminApiRoutes(app, store, cpState) {
             const message = "role id must start with a letter or number, may contain letters, numbers, dot, underscore, colon, or dash, and cannot be reserved";
             return wantsHtmx(event) ? htmxError(message) : jsonResponse({ error: message }, 400);
         }
-        const { config, appDef } = await getAppOr404(appId);
-        if (!appDef)
-            return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
-        const authResult = requireAuthBlock(event, appDef);
-        if (authResult.response)
-            return authResult.response;
-        const auth = authResult.auth;
-        const role = {
-            id: roleId,
-            title,
-            description: body.description,
-            permissions: Array.isArray(body.permissions) ? body.permissions : []
-        };
-        if (auth.roles.some((r) => r.id === role.id)) {
-            return wantsHtmx(event) ? htmxError("role id already exists", 409) : jsonResponse({ error: "role id already exists" }, 409);
-        }
-        auth.roles.push(role);
-        await store.saveConfig(config);
-        if (wantsHtmx(event))
-            return htmxReload(`/auth?appId=${encodeURIComponent(appId)}`);
-        return jsonResponse(role, 201);
+        return editApp(store, appId, async (config) => {
+            const appDef = config.apps.find(app => app.id === appId);
+            if (!appDef)
+                return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
+            const authResult = requireAuthBlock(event, appDef);
+            if (authResult.response)
+                return authResult.response;
+            const auth = authResult.auth;
+            const role = {
+                id: roleId,
+                title,
+                description: body.description,
+                permissions: Array.isArray(body.permissions) ? body.permissions : []
+            };
+            if (auth.roles.some((r) => r.id === role.id)) {
+                return wantsHtmx(event) ? htmxError("role id already exists", 409) : jsonResponse({ error: "role id already exists" }, 409);
+            }
+            auth.roles.push(role);
+            if (wantsHtmx(event))
+                return htmxReload(`/auth?appId=${encodeURIComponent(appId)}`);
+            return jsonResponse(role, 201);
+        });
     });
     app.put(`${API_BASE}/apps/:appId/auth/roles/:roleId`, async (event) => {
         const appId = getParam(event, "appId");
@@ -1849,62 +1857,64 @@ export function registerAdminApiRoutes(app, store, cpState) {
         if (!appId || !roleId)
             return jsonResponse({ error: "appId + roleId required" }, 400);
         const body = await readFormOrJsonBody(event);
-        const { config, appDef } = await getAppOr404(appId);
-        if (!appDef)
-            return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
-        const authResult = requireAuthBlock(event, appDef);
-        if (authResult.response)
-            return authResult.response;
-        const auth = authResult.auth;
-        const role = auth.roles.find((r) => r.id === roleId);
-        if (!role)
-            return wantsHtmx(event) ? htmxError("Role not found", 404) : jsonResponse({ error: "Role not found" }, 404);
-        if (typeof body.title === "string")
-            role.title = body.title;
-        if (typeof body.description === "string" || body.description === null)
-            role.description = body.description ?? undefined;
-        if (Array.isArray(body.permissions)) {
-            role.permissions = body.permissions;
-        }
-        else if (typeof body.grant === "string" || Array.isArray(body.grant)) {
-            const grants = Array.isArray(body.grant) ? body.grant : [body.grant];
-            const byView = new Map();
-            for (const grant of grants) {
-                const [serviceId, viewId, action] = String(grant).split("|");
-                if (!serviceId || !viewId || !["read", "create", "update", "delete"].includes(action))
-                    continue;
-                const key = `${serviceId}::${viewId}`;
-                if (!byView.has(key))
-                    byView.set(key, { serviceId, viewId, permissions: [] });
-                byView.get(key).permissions.push(action);
+        return editApp(store, appId, async (config) => {
+            const appDef = config.apps.find(app => app.id === appId);
+            if (!appDef)
+                return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
+            const authResult = requireAuthBlock(event, appDef);
+            if (authResult.response)
+                return authResult.response;
+            const auth = authResult.auth;
+            const role = auth.roles.find((r) => r.id === roleId);
+            if (!role)
+                return wantsHtmx(event) ? htmxError("Role not found", 404) : jsonResponse({ error: "Role not found" }, 404);
+            if (typeof body.title === "string")
+                role.title = body.title;
+            if (typeof body.description === "string" || body.description === null)
+                role.description = body.description ?? undefined;
+            if (Array.isArray(body.permissions)) {
+                role.permissions = body.permissions;
             }
-            role.permissions = Array.from(byView.values());
-        }
-        await store.saveConfig(config);
-        if (wantsHtmx(event))
-            return htmxReload(`/auth?appId=${encodeURIComponent(appId)}`);
-        return jsonResponse(role);
+            else if (typeof body.grant === "string" || Array.isArray(body.grant)) {
+                const grants = Array.isArray(body.grant) ? body.grant : [body.grant];
+                const byView = new Map();
+                for (const grant of grants) {
+                    const [serviceId, viewId, action] = String(grant).split("|");
+                    if (!serviceId || !viewId || !["read", "create", "update", "delete"].includes(action))
+                        continue;
+                    const key = `${serviceId}::${viewId}`;
+                    if (!byView.has(key))
+                        byView.set(key, { serviceId, viewId, permissions: [] });
+                    byView.get(key).permissions.push(action);
+                }
+                role.permissions = Array.from(byView.values());
+            }
+            if (wantsHtmx(event))
+                return htmxReload(`/auth?appId=${encodeURIComponent(appId)}`);
+            return jsonResponse(role);
+        });
     });
     app.delete(`${API_BASE}/apps/:appId/auth/roles/:roleId`, async (event) => {
         const appId = getParam(event, "appId");
         const roleId = getParam(event, "roleId");
         if (!appId || !roleId)
             return jsonResponse({ error: "appId + roleId required" }, 400);
-        const { config, appDef } = await getAppOr404(appId);
-        if (!appDef)
-            return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
-        const authResult = requireAuthBlock(event, appDef);
-        if (authResult.response)
-            return authResult.response;
-        const auth = authResult.auth;
-        const before = auth.roles.length;
-        auth.roles = auth.roles.filter((r) => r.id !== roleId);
-        if (auth.roles.length === before)
-            return wantsHtmx(event) ? htmxError("Role not found", 404) : jsonResponse({ error: "Role not found" }, 404);
-        await store.saveConfig(config);
-        if (wantsHtmx(event))
-            return htmxReload(`/auth?appId=${encodeURIComponent(appId)}`);
-        return jsonResponse({ ok: true });
+        return editApp(store, appId, async (config) => {
+            const appDef = config.apps.find(app => app.id === appId);
+            if (!appDef)
+                return wantsHtmx(event) ? htmxError("App not found", 404) : jsonResponse({ error: "App not found" }, 404);
+            const authResult = requireAuthBlock(event, appDef);
+            if (authResult.response)
+                return authResult.response;
+            const auth = authResult.auth;
+            const before = auth.roles.length;
+            auth.roles = auth.roles.filter((r) => r.id !== roleId);
+            if (auth.roles.length === before)
+                return wantsHtmx(event) ? htmxError("Role not found", 404) : jsonResponse({ error: "Role not found" }, 404);
+            if (wantsHtmx(event))
+                return htmxReload(`/auth?appId=${encodeURIComponent(appId)}`);
+            return jsonResponse({ ok: true });
+        });
     });
     // Service connections (per app)
     app.get(`${API_BASE}/apps/:appId/m2m/connections`, async (event) => {
@@ -1993,8 +2003,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
         if (!appId)
             return jsonResponse({ error: "appId required" }, 400);
         const body = await readFormOrJsonBody(event);
-        return withRouteConfigRetry(event, store, async () => {
-            const config = await store.loadConfig();
+        return editApp(store, appId, async (config) => {
             if (isPreviewApp(config, appId))
                 return jsonResponse({ error: "Preview resources are managed through Preview Environments" }, 404);
             const appDef = config.apps.find((a) => a.id === appId);
@@ -2014,7 +2023,6 @@ export function registerAdminApiRoutes(app, store, cpState) {
             const route = { ...parsed.route, id: uuidv7() };
             appDef.routes.push(route);
             addRouteDependencies(appDef, route);
-            await store.saveConfig(config);
             if (wantsHtmx(event))
                 return htmxReload(routesReloadPath(appId));
             return jsonResponse({ ok: true, id: route.id }, 201);
@@ -2026,8 +2034,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
         if (!appId || !routeId)
             return jsonResponse({ error: "appId and routeId required" }, 400);
         const body = await readFormOrJsonBody(event);
-        return withRouteConfigRetry(event, store, async () => {
-            const config = await store.loadConfig();
+        return editApp(store, appId, async (config) => {
             if (isPreviewApp(config, appId))
                 return jsonResponse({ error: "Preview resources are managed through Preview Environments" }, 404);
             const appDef = config.apps.find((a) => a.id === appId);
@@ -2149,7 +2156,6 @@ export function registerAdminApiRoutes(app, store, cpState) {
             if (appDef.routes.some((candidate) => candidate.id !== route.id && appRoutePatternKey(candidate.path) === appRoutePatternKey(route.path))) {
                 return validationError(event, `A route already exists at ${route.path}.`);
             }
-            await store.saveConfig(config);
             if (wantsHtmx(event))
                 return htmxReload(routesReloadPath(appId, route.kind === "api" ? route.serviceId : undefined));
             return jsonResponse({ ok: true });
@@ -2160,8 +2166,7 @@ export function registerAdminApiRoutes(app, store, cpState) {
         const routeId = getParam(event, "routeId");
         if (!appId || !routeId)
             return jsonResponse({ error: "appId and routeId required" }, 400);
-        return withRouteConfigRetry(event, store, async () => {
-            const config = await store.loadConfig();
+        return editApp(store, appId, async (config) => {
             if (isPreviewApp(config, appId))
                 return jsonResponse({ error: "Preview resources are managed through Preview Environments" }, 404);
             const appDef = config.apps.find((a) => a.id === appId);
@@ -2185,7 +2190,6 @@ export function registerAdminApiRoutes(app, store, cpState) {
                 return wantsHtmx(event) ? htmxAlert(message, "warning") : jsonResponse({ error: message }, 409);
             }
             appDef.routes = appDef.routes.filter((r) => r.id !== routeId);
-            await store.saveConfig(config);
             if (wantsHtmx(event))
                 return htmxReload(`/routes?appId=${encodeURIComponent(appId)}`);
             return jsonResponse({ ok: true });
@@ -2208,20 +2212,20 @@ export function registerAdminApiRoutes(app, store, cpState) {
             return jsonResponse({ error: "appId required" }, 400);
         const body = await readJsonBody(event);
         const items = Array.isArray(body.items) ? body.items : [];
-        const config = await store.loadConfig();
-        const appDef = config.apps.find((a) => a.id === appId);
-        if (!appDef)
-            return jsonResponse({ error: "App not found" }, 404);
-        const menu = items.map(normalizeMenuItem);
-        const invalid = (entries) => entries.some(item => {
-            const route = item.routeId ? appDef.routes.find(route => route.id === item.routeId) : undefined;
-            return (Boolean(item.routeId) && (!route || isMenuRouteExcluded(route, getManifestCache()))) || invalid(item.children);
+        return editApp(store, appId, async (config) => {
+            const appDef = config.apps.find((a) => a.id === appId);
+            if (!appDef)
+                return jsonResponse({ error: "App not found" }, 404);
+            const menu = items.map(normalizeMenuItem);
+            const invalid = (entries) => entries.some(item => {
+                const route = item.routeId ? appDef.routes.find(route => route.id === item.routeId) : undefined;
+                return (Boolean(item.routeId) && (!route || isMenuRouteExcluded(route, getManifestCache()))) || invalid(item.children);
+            });
+            if (invalid(menu))
+                return jsonResponse({ error: "Menu contains a missing or excluded route" }, 400);
+            appDef.menu = menu;
+            return jsonResponse({ ok: true });
         });
-        if (invalid(menu))
-            return jsonResponse({ error: "Menu contains a missing or excluded route" }, 400);
-        appDef.menu = menu;
-        await store.saveConfig(config);
-        return jsonResponse({ ok: true });
     });
     // Full config (read-only)
     app.get(`${API_BASE}/config`, async () => {