@betterportal/config-manager 10.6.31 → 10.6.33

package/lib/plugins/service-betterportal-config-manager/appQueries.d.ts

@@ -0,0 +1,1096 @@
+import type { PoolClient } from "pg";
+import { type HeaderMap, type BetterPortalConfig, type BetterPortalObservability } from "@betterportal/framework";
+import type { PostgresStorage } from "./storage/postgres.js";
+export type AppDatabase = PostgresStorage["database"];
+/** Editor data, not a complete platform configuration and never passed to saveConfig. */
+export type AppEditorData = Pick<BetterPortalConfig, "apps" | "tenants" | "platformServices" | "sharedServiceCatalog" | "sharedServiceActivations" | "previewEnvironmentDeployments">;
+export declare function readAppEditor(client: PoolClient, db: AppDatabase, appId: string): Promise<AppEditorData>;
+/** A short transaction over one app's relational collections. No platform snapshots. */
+export declare function editAppRows<T>(db: AppDatabase, appId: string, obs: BetterPortalObservability | undefined, change: (data: AppEditorData) => Promise<T>): Promise<T>;
+/** Management request resolution reads app settings first, then only the matched app's rows. */
+export declare function readRequestConfig(db: AppDatabase, headers: HeaderMap, obs?: BetterPortalObservability): Promise<{
+    configManagement: {
+        auth: {
+            mechanism: "none" | "dev-token" | "jwt" | "oidc";
+            requiredPermissions: string[];
+            issuer?: string | undefined;
+            audience?: string | undefined;
+        };
+        adminTenantId?: string | undefined;
+        managementAppId?: string | undefined;
+    };
+    platformServices: {
+        id: string;
+        hostname: string;
+        apiKeyHash: string;
+        capabilities: string[];
+        title: string;
+        createdAt: string;
+        enabled: boolean;
+        publicKeyPem?: string | undefined;
+        keyId?: string | undefined;
+        serviceId?: string | undefined;
+        authProvider?: {
+            issuer: string;
+            audience: string;
+            jwksUri: string;
+            publicKeys?: {
+                keys: {
+                    kty: "RSA";
+                    use: "sig";
+                    alg: "RS256";
+                    kid: string;
+                    n: string;
+                    e: string;
+                }[];
+            } | undefined;
+        } | undefined;
+        description?: string | undefined;
+        category?: string | undefined;
+    }[];
+    tenants: {
+        id: string;
+        slug: string;
+        title: string;
+        active: boolean;
+        branding: {
+            brandName?: string | undefined;
+            logoUrl?: string | undefined;
+            primaryColor?: string | undefined;
+            secondaryColor?: string | undefined;
+        };
+        services: {
+            id: string;
+            hostname: string;
+            apiKeyHash: string;
+            capabilities: string[];
+            deploymentMode: "bp-hosted" | "customer-hosted" | "third-party-saas" | "self-hosted" | "saas-managed";
+            createdAt: string;
+            enabled: boolean;
+            publicKeyPem?: string | undefined;
+            keyId?: string | undefined;
+            serviceId?: string | undefined;
+            authProvider?: {
+                issuer: string;
+                audience: string;
+                jwksUri: string;
+                publicKeys?: {
+                    keys: {
+                        kty: "RSA";
+                        use: "sig";
+                        alg: "RS256";
+                        kid: string;
+                        n: string;
+                        e: string;
+                    }[];
+                } | undefined;
+            } | undefined;
+            title?: string | undefined;
+            description?: string | undefined;
+            lastSeenAt?: string | undefined;
+            lastSyncAt?: string | undefined;
+        }[];
+        activatedPlatformServices: string[];
+    }[];
+    apps: {
+        id: string;
+        tenantId: string;
+        slug: string;
+        title: string;
+        hostnames: string[];
+        originOverrides: string[];
+        refererOverrides: string[];
+        themeConfig: {
+            mode: "light" | "dark" | "system";
+            bootstrap: {
+                primary?: string | undefined;
+                secondary?: string | undefined;
+                success?: string | undefined;
+                info?: string | undefined;
+                warning?: string | undefined;
+                danger?: string | undefined;
+                light?: string | undefined;
+                dark?: string | undefined;
+            };
+            light: {
+                background?: string | undefined;
+                surface?: string | undefined;
+                surfaceAlt?: string | undefined;
+                text?: string | undefined;
+                textSoft?: string | undefined;
+                border?: string | undefined;
+                accentSoft?: string | undefined;
+            };
+            dark: {
+                background?: string | undefined;
+                surface?: string | undefined;
+                surfaceAlt?: string | undefined;
+                text?: string | undefined;
+                textSoft?: string | undefined;
+                border?: string | undefined;
+                accentSoft?: string | undefined;
+            };
+            brandName?: string | undefined;
+            documentTitle?: string | undefined;
+            lightLogoUrl?: string | undefined;
+            darkLogoUrl?: string | undefined;
+            faviconUrl?: string | undefined;
+        };
+        defaultRoute: string;
+        routes: {
+            id: string;
+            kind: "page" | "api";
+            path: string;
+            serviceId: string;
+            viewId: string;
+            enabled: boolean;
+            operations: string[];
+            servicePathVariant?: string | undefined;
+            fixedParams?: Record<string, string> | undefined;
+            authRequired?: boolean | undefined;
+            menuPermissions?: {
+                serviceId: string;
+                viewId: string;
+                permissions: string[];
+            }[] | undefined;
+            sitemap?: {
+                kind: "provider" | "default" | "exclude" | "metadata";
+                lastModified?: string | undefined;
+                changeFrequency?: "always" | "hourly" | "daily" | "weekly" | "monthly" | "yearly" | "never" | undefined;
+                priority?: number | undefined;
+            } | undefined;
+            robots?: {
+                userAgent: string;
+                access: "allow" | "disallow";
+                crawlDelaySeconds?: number | undefined;
+            }[] | undefined;
+            targetPath?: string | undefined;
+            resolvedServicePath?: string | undefined;
+            resolvedMethods?: ("GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS")[] | undefined;
+            query?: string | undefined;
+            title?: string | undefined;
+            icon?: string | undefined;
+            enablement?: "enabled" | "auto" | "disabled" | undefined;
+            menu?: boolean | undefined;
+            chrome?: {
+                [x: string]: string | number | boolean;
+                hideMenu?: boolean | undefined;
+                hideHeader?: boolean | undefined;
+                hideFooter?: boolean | undefined;
+                fullScreen?: boolean | undefined;
+            } | undefined;
+        }[];
+        menu: import("@betterportal/framework").BetterPortalMenuItem[];
+        slots: {
+            slotId: string;
+            serviceId: string;
+            viewId: string;
+            enabled: boolean;
+            renderer?: string | undefined;
+        }[];
+        fragments: Record<string, {
+            serviceId: string;
+            fragmentId: string;
+            targetPath: string;
+            enabled: boolean;
+        }[]>;
+        shellFragments: Record<string, Record<string, {
+            mode: "none";
+        } | {
+            mode: "override";
+            item: {
+                source: "shell";
+                fragmentId: string;
+            } | {
+                source: "service";
+                serviceId: string;
+                fragmentId: string;
+                targetPath: string;
+            };
+        } | {
+            mode: "items";
+            items: ({
+                source: "shell";
+                fragmentId: string;
+            } | {
+                source: "service";
+                serviceId: string;
+                fragmentId: string;
+                targetPath: string;
+            })[];
+        }>>;
+        shell?: {
+            serviceId: string;
+        } | undefined;
+        layoutId?: string | undefined;
+        seo?: {
+            visibility: "auto" | "public" | "private";
+            serviceFailure: "error" | "known-routes" | "omit-service";
+            serviceCache: "none" | "1h" | "24h" | "7d";
+            canonicalOrigin?: string | undefined;
+        } | undefined;
+        auth?: {
+            serviceId: string;
+            expectedIssuer: string;
+            expectedAudience: string;
+            jwksUri: string;
+            roles: {
+                id: string;
+                title: string;
+                permissions: {
+                    serviceId: string;
+                    viewId: string;
+                    permissions: ("read" | "create" | "update" | "delete")[];
+                }[];
+                description?: string | undefined;
+            }[];
+            provider?: {
+                kind: "betterportal.default";
+            } | {
+                kind: "authress.io";
+                roleClaimPath: string;
+                subjectClaimPath: string;
+                nameClaimPath?: string | undefined;
+                emailClaimPath?: string | undefined;
+                pictureClaimPath?: string | undefined;
+            } | undefined;
+            roleAuthority?: "provider" | "betterportal" | undefined;
+            loginViewId?: string | undefined;
+            logoutViewId?: string | undefined;
+            refreshViewId?: string | undefined;
+            redirects?: {
+                afterLogin?: {
+                    serviceId: string;
+                    viewId: string;
+                } | undefined;
+                afterLogout?: {
+                    serviceId: string;
+                    viewId: string;
+                } | undefined;
+            } | undefined;
+            publicKeys?: {
+                keys: {
+                    kty: "RSA";
+                    use: "sig";
+                    alg: "RS256";
+                    kid: string;
+                    n: string;
+                    e: string;
+                }[];
+            } | undefined;
+        } | undefined;
+        statusViewIds?: Record<string, string> | undefined;
+    }[];
+    sharedServiceCatalog: {
+        id: string;
+        title: string;
+        baseUrl: string;
+        apiKeyHash: string;
+        supportedDeploymentModes: ("bp-hosted" | "customer-hosted" | "third-party-saas" | "self-hosted" | "saas-managed")[];
+        owner: "bp" | "3p";
+        tags: string[];
+        enabled: boolean;
+        serviceId?: string | undefined;
+        description?: string | undefined;
+        logoUrl?: string | undefined;
+        publicKeyPem?: string | undefined;
+        keyId?: string | undefined;
+        authProvider?: {
+            issuer: string;
+            audience: string;
+            jwksUri: string;
+            publicKeys?: {
+                keys: {
+                    kty: "RSA";
+                    use: "sig";
+                    alg: "RS256";
+                    kid: string;
+                    n: string;
+                    e: string;
+                }[];
+            } | undefined;
+        } | undefined;
+        upgradeUrlTemplate?: string | undefined;
+        category?: string | undefined;
+        pricingHint?: "free" | "freemium" | "paid" | undefined;
+        publishedAt?: string | undefined;
+    }[];
+    sharedServiceActivations: {
+        id: string;
+        tenantId: string;
+        sharedServiceId: string;
+        activatedAt: string;
+        enabled: boolean;
+        appId?: string | undefined;
+    }[];
+    manifestCache: {
+        serviceId: string;
+        manifestVersion: string;
+        fetchedAt: string;
+        capabilities: string[];
+        m2mRequests: {
+            id: string;
+            title: string;
+            contractId: string;
+            requiredCapabilities: string[];
+            methods: ("GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS")[];
+            permissions: string[];
+            mode: "service" | "delegated";
+            optional: boolean;
+            description?: string | undefined;
+            version?: string | undefined;
+        }[];
+        apiContracts: {
+            id: string;
+            title: string;
+            version: string;
+            viewId: string;
+            methods: ("GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS")[];
+            capabilities: string[];
+            permissions: string[];
+            modes: ("service" | "delegated")[];
+            description?: string | undefined;
+        }[];
+        developerResources: {
+            id: string;
+            kind: "guide" | "template" | "skill" | "example";
+            title: string;
+            mediaType: string;
+            content: string;
+            description?: string | undefined;
+            language?: string | undefined;
+        }[];
+        configSchemas: {
+            id: string;
+            title: string;
+            description: string;
+            scope: "tenant" | "app";
+            jsonSchema: import("@betterportal/framework").JsonObject;
+            fields: {
+                key: string;
+                title: string;
+                description: string;
+                scope: "tenant" | "app";
+                visibility: "public" | "protected" | "secret";
+                ownership: "bp" | "plugin" | "mixed";
+                sourceOfTruth: "external" | "bp" | "plugin";
+                required: boolean;
+                groupId?: string | undefined;
+                order?: number | undefined;
+                defaultValue?: import("@betterportal/framework").JsonValue | undefined;
+                ui?: {
+                    control?: "number" | "email" | "text" | "select" | "url" | "date" | "textarea" | "password" | "checkbox" | "multiselect" | "color" | "time" | "datetime-local" | undefined;
+                    placeholder?: string | undefined;
+                    options?: {
+                        value: string;
+                        label: string;
+                    }[] | undefined;
+                    optionsSource?: "app.routes" | undefined;
+                    min?: string | number | undefined;
+                    max?: string | number | undefined;
+                    step?: number | undefined;
+                    rows?: number | undefined;
+                } | undefined;
+            }[];
+            groups?: {
+                id: string;
+                title: string;
+                description?: string | undefined;
+                order?: number | undefined;
+                optional?: boolean | undefined;
+            }[] | undefined;
+        }[];
+        webhooks: {
+            id: string;
+            title: string;
+            payloadSchema: import("@betterportal/framework").JsonObject;
+            description?: string | undefined;
+        }[];
+        viewIndex: Record<string, {
+            viewId: string;
+            title: string;
+            description: string;
+            path: string;
+            pathVariants: string[];
+            operations: {
+                operationId: string;
+                method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS";
+                title: string;
+                description: string;
+                renderers: string[];
+                renderModes: ("page" | "fragment" | "embed")[];
+                authRequired: boolean;
+                robots: {
+                    userAgent: string;
+                    access: "allow" | "disallow";
+                    crawlDelaySeconds?: number | undefined;
+                }[];
+                dependencies: {
+                    operationId: string;
+                    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS";
+                    serviceId?: string | undefined;
+                }[];
+                permissions: {
+                    serviceId: string;
+                    viewId: string;
+                    permissions: string[];
+                }[];
+                renderable: boolean;
+                apiContracts: {
+                    id: string;
+                    title: string;
+                    version: string;
+                    viewId: string;
+                    methods: ("GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS")[];
+                    capabilities: string[];
+                    permissions: string[];
+                    modes: ("service" | "delegated")[];
+                    description?: string | undefined;
+                }[];
+                demoScenarios: {
+                    id: string;
+                    title: string;
+                    response: import("@betterportal/framework").JsonValue;
+                    description?: string | undefined;
+                    match?: {
+                        query?: import("@betterportal/framework").JsonObject | undefined;
+                        params?: import("@betterportal/framework").JsonObject | undefined;
+                        headers?: Record<string, string> | undefined;
+                        request?: import("@betterportal/framework").JsonObject | undefined;
+                    } | undefined;
+                }[];
+                role?: string | undefined;
+                sitemap?: {
+                    kind: "provider" | "default" | "exclude" | "metadata";
+                    lastModified?: string | undefined;
+                    changeFrequency?: "always" | "hourly" | "daily" | "weekly" | "monthly" | "yearly" | "never" | undefined;
+                    priority?: number | undefined;
+                } | undefined;
+                menu?: boolean | undefined;
+                chrome?: {
+                    [x: string]: string | number | boolean;
+                    hideMenu?: boolean | undefined;
+                    hideHeader?: boolean | undefined;
+                    hideFooter?: boolean | undefined;
+                    fullScreen?: boolean | undefined;
+                } | undefined;
+                schemas?: {
+                    query?: import("@betterportal/framework").JsonObject | undefined;
+                    headers?: import("@betterportal/framework").JsonObject | undefined;
+                    request?: import("@betterportal/framework").JsonObject | undefined;
+                    multipart?: import("@betterportal/framework").JsonObject | undefined;
+                    response?: import("@betterportal/framework").JsonObject | undefined;
+                } | undefined;
+                raw?: boolean | undefined;
+            }[];
+            fragments: {
+                fragmentId: string;
+                targetPath: string;
+                operationId: string;
+                method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS";
+            }[];
+            paramsSchema?: import("@betterportal/framework").JsonObject | undefined;
+        }>;
+        title?: string | undefined;
+        authProvider?: {
+            issuer: string;
+            audience: string;
+            jwksUri: string;
+            publicKeys?: {
+                keys: {
+                    kty: "RSA";
+                    use: "sig";
+                    alg: "RS256";
+                    kid: string;
+                    n: string;
+                    e: string;
+                }[];
+            } | undefined;
+        } | undefined;
+        shell?: {
+            service: string;
+            renderer: string;
+            fragments: {
+                id: string;
+                kind: "fragment" | "block";
+                title: string;
+                description: string;
+                defaultItems: string[];
+            }[];
+        } | undefined;
+    }[];
+    m2m: {
+        bindings: {
+            id: string;
+            tenantId: string;
+            sourceServiceId: string;
+            requestId: string;
+            contractId: string;
+            targetServiceId: string;
+            targetViewId: string;
+            mode: "service" | "delegated";
+            enabled: boolean;
+            createdAt: string;
+            appId?: string | undefined;
+        }[];
+        grants: {
+            id: string;
+            tenantId: string;
+            bindingId: string;
+            methods: ("GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS")[];
+            permissions: string[];
+            enabled: boolean;
+            createdAt: string;
+            appId?: string | undefined;
+        }[];
+    };
+    previewEnvironmentGroups: {
+        id: string;
+        name: string;
+        sourceTenantId: string;
+        sourceAppId: string;
+        expiresInDays: number | null;
+        elevatedRoleIds: string[];
+        apiKeyHash: string;
+        services: {
+            serviceId: string;
+            config: {
+                tenant: import("@betterportal/framework").JsonObject;
+                app: import("@betterportal/framework").JsonObject;
+            };
+            title?: string | undefined;
+            configSchemas?: {
+                id: string;
+                title: string;
+                description: string;
+                scope: "tenant" | "app";
+                jsonSchema: import("@betterportal/framework").JsonObject;
+                fields: {
+                    key: string;
+                    title: string;
+                    description: string;
+                    scope: "tenant" | "app";
+                    visibility: "public" | "protected" | "secret";
+                    ownership: "bp" | "plugin" | "mixed";
+                    sourceOfTruth: "external" | "bp" | "plugin";
+                    required: boolean;
+                    groupId?: string | undefined;
+                    order?: number | undefined;
+                    defaultValue?: import("@betterportal/framework").JsonValue | undefined;
+                    ui?: {
+                        control?: "number" | "email" | "text" | "select" | "url" | "date" | "textarea" | "password" | "checkbox" | "multiselect" | "color" | "time" | "datetime-local" | undefined;
+                        placeholder?: string | undefined;
+                        options?: {
+                            value: string;
+                            label: string;
+                        }[] | undefined;
+                        optionsSource?: "app.routes" | undefined;
+                        min?: string | number | undefined;
+                        max?: string | number | undefined;
+                        step?: number | undefined;
+                        rows?: number | undefined;
+                    } | undefined;
+                }[];
+                groups?: {
+                    id: string;
+                    title: string;
+                    description?: string | undefined;
+                    order?: number | undefined;
+                    optional?: boolean | undefined;
+                }[] | undefined;
+            }[] | undefined;
+        }[];
+        createdAt: string;
+        updatedAt: string;
+        oidc?: {
+            issuer: string;
+            audience: string;
+            jwksUri: string;
+            requiredClaims: Record<string, string>;
+            subjectPrefix?: string | undefined;
+        } | undefined;
+    }[];
+    previewEnvironmentDeployments: {
+        id: string;
+        groupId: string;
+        key: string;
+        name: string;
+        hostname: string;
+        tenantId: string;
+        appId: string;
+        expiresInDays: number | null;
+        services: {
+            serviceId: string;
+            instanceId: string;
+            url: string;
+        }[];
+        createdAt: string;
+        updatedAt: string;
+        effectiveConfig?: {
+            services: {
+                serviceId: string;
+                config: {
+                    tenant: import("@betterportal/framework").JsonObject;
+                    app: import("@betterportal/framework").JsonObject;
+                };
+                title?: string | undefined;
+                configSchemas?: {
+                    id: string;
+                    title: string;
+                    description: string;
+                    scope: "tenant" | "app";
+                    jsonSchema: import("@betterportal/framework").JsonObject;
+                    fields: {
+                        key: string;
+                        title: string;
+                        description: string;
+                        scope: "tenant" | "app";
+                        visibility: "public" | "protected" | "secret";
+                        ownership: "bp" | "plugin" | "mixed";
+                        sourceOfTruth: "external" | "bp" | "plugin";
+                        required: boolean;
+                        groupId?: string | undefined;
+                        order?: number | undefined;
+                        defaultValue?: import("@betterportal/framework").JsonValue | undefined;
+                        ui?: {
+                            control?: "number" | "email" | "text" | "select" | "url" | "date" | "textarea" | "password" | "checkbox" | "multiselect" | "color" | "time" | "datetime-local" | undefined;
+                            placeholder?: string | undefined;
+                            options?: {
+                                value: string;
+                                label: string;
+                            }[] | undefined;
+                            optionsSource?: "app.routes" | undefined;
+                            min?: string | number | undefined;
+                            max?: string | number | undefined;
+                            step?: number | undefined;
+                            rows?: number | undefined;
+                        } | undefined;
+                    }[];
+                    groups?: {
+                        id: string;
+                        title: string;
+                        description?: string | undefined;
+                        order?: number | undefined;
+                        optional?: boolean | undefined;
+                    }[] | undefined;
+                }[] | undefined;
+            }[];
+            elevatedRoleIds: string[];
+        } | undefined;
+        credentialReplay?: {
+            requestHash: string;
+            ciphertext: string;
+            expiresAt: string;
+        } | undefined;
+        expiresAt?: string | undefined;
+    }[];
+    webhooks: {
+        targets: {
+            id: string;
+            tenantId: string;
+            serviceId: string;
+            eventId: string;
+            url: string;
+            secret: string;
+            createdAt: string;
+            enabled: boolean;
+            maxAttempts: number;
+            appId?: string | undefined;
+        }[];
+    };
+}>;
+export declare function readAppPage(db: AppDatabase, appId?: string, chooseFirst?: boolean): Promise<{
+    appChoices: {
+        id: string;
+        tenantId: string;
+        title: string;
+    }[];
+    apps: {
+        id: string;
+        tenantId: string;
+        slug: string;
+        title: string;
+        hostnames: string[];
+        originOverrides: string[];
+        refererOverrides: string[];
+        themeConfig: {
+            mode: "light" | "dark" | "system";
+            bootstrap: {
+                primary?: string | undefined;
+                secondary?: string | undefined;
+                success?: string | undefined;
+                info?: string | undefined;
+                warning?: string | undefined;
+                danger?: string | undefined;
+                light?: string | undefined;
+                dark?: string | undefined;
+            };
+            light: {
+                background?: string | undefined;
+                surface?: string | undefined;
+                surfaceAlt?: string | undefined;
+                text?: string | undefined;
+                textSoft?: string | undefined;
+                border?: string | undefined;
+                accentSoft?: string | undefined;
+            };
+            dark: {
+                background?: string | undefined;
+                surface?: string | undefined;
+                surfaceAlt?: string | undefined;
+                text?: string | undefined;
+                textSoft?: string | undefined;
+                border?: string | undefined;
+                accentSoft?: string | undefined;
+            };
+            brandName?: string | undefined;
+            documentTitle?: string | undefined;
+            lightLogoUrl?: string | undefined;
+            darkLogoUrl?: string | undefined;
+            faviconUrl?: string | undefined;
+        };
+        defaultRoute: string;
+        routes: {
+            id: string;
+            kind: "page" | "api";
+            path: string;
+            serviceId: string;
+            viewId: string;
+            enabled: boolean;
+            operations: string[];
+            servicePathVariant?: string | undefined;
+            fixedParams?: Record<string, string> | undefined;
+            authRequired?: boolean | undefined;
+            menuPermissions?: {
+                serviceId: string;
+                viewId: string;
+                permissions: string[];
+            }[] | undefined;
+            sitemap?: {
+                kind: "provider" | "default" | "exclude" | "metadata";
+                lastModified?: string | undefined;
+                changeFrequency?: "always" | "hourly" | "daily" | "weekly" | "monthly" | "yearly" | "never" | undefined;
+                priority?: number | undefined;
+            } | undefined;
+            robots?: {
+                userAgent: string;
+                access: "allow" | "disallow";
+                crawlDelaySeconds?: number | undefined;
+            }[] | undefined;
+            targetPath?: string | undefined;
+            resolvedServicePath?: string | undefined;
+            resolvedMethods?: ("GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS")[] | undefined;
+            query?: string | undefined;
+            title?: string | undefined;
+            icon?: string | undefined;
+            enablement?: "enabled" | "auto" | "disabled" | undefined;
+            menu?: boolean | undefined;
+            chrome?: {
+                [x: string]: string | number | boolean;
+                hideMenu?: boolean | undefined;
+                hideHeader?: boolean | undefined;
+                hideFooter?: boolean | undefined;
+                fullScreen?: boolean | undefined;
+            } | undefined;
+        }[];
+        menu: import("@betterportal/framework").BetterPortalMenuItem[];
+        slots: {
+            slotId: string;
+            serviceId: string;
+            viewId: string;
+            enabled: boolean;
+            renderer?: string | undefined;
+        }[];
+        fragments: Record<string, {
+            serviceId: string;
+            fragmentId: string;
+            targetPath: string;
+            enabled: boolean;
+        }[]>;
+        shellFragments: Record<string, Record<string, {
+            mode: "none";
+        } | {
+            mode: "override";
+            item: {
+                source: "shell";
+                fragmentId: string;
+            } | {
+                source: "service";
+                serviceId: string;
+                fragmentId: string;
+                targetPath: string;
+            };
+        } | {
+            mode: "items";
+            items: ({
+                source: "shell";
+                fragmentId: string;
+            } | {
+                source: "service";
+                serviceId: string;
+                fragmentId: string;
+                targetPath: string;
+            })[];
+        }>>;
+        shell?: {
+            serviceId: string;
+        } | undefined;
+        layoutId?: string | undefined;
+        seo?: {
+            visibility: "auto" | "public" | "private";
+            serviceFailure: "error" | "known-routes" | "omit-service";
+            serviceCache: "none" | "1h" | "24h" | "7d";
+            canonicalOrigin?: string | undefined;
+        } | undefined;
+        auth?: {
+            serviceId: string;
+            expectedIssuer: string;
+            expectedAudience: string;
+            jwksUri: string;
+            roles: {
+                id: string;
+                title: string;
+                permissions: {
+                    serviceId: string;
+                    viewId: string;
+                    permissions: ("read" | "create" | "update" | "delete")[];
+                }[];
+                description?: string | undefined;
+            }[];
+            provider?: {
+                kind: "betterportal.default";
+            } | {
+                kind: "authress.io";
+                roleClaimPath: string;
+                subjectClaimPath: string;
+                nameClaimPath?: string | undefined;
+                emailClaimPath?: string | undefined;
+                pictureClaimPath?: string | undefined;
+            } | undefined;
+            roleAuthority?: "provider" | "betterportal" | undefined;
+            loginViewId?: string | undefined;
+            logoutViewId?: string | undefined;
+            refreshViewId?: string | undefined;
+            redirects?: {
+                afterLogin?: {
+                    serviceId: string;
+                    viewId: string;
+                } | undefined;
+                afterLogout?: {
+                    serviceId: string;
+                    viewId: string;
+                } | undefined;
+            } | undefined;
+            publicKeys?: {
+                keys: {
+                    kty: "RSA";
+                    use: "sig";
+                    alg: "RS256";
+                    kid: string;
+                    n: string;
+                    e: string;
+                }[];
+            } | undefined;
+        } | undefined;
+        statusViewIds?: Record<string, string> | undefined;
+    }[];
+    platformServices: {
+        id: string;
+        hostname: string;
+        apiKeyHash: string;
+        capabilities: string[];
+        title: string;
+        createdAt: string;
+        enabled: boolean;
+        publicKeyPem?: string | undefined;
+        keyId?: string | undefined;
+        serviceId?: string | undefined;
+        authProvider?: {
+            issuer: string;
+            audience: string;
+            jwksUri: string;
+            publicKeys?: {
+                keys: {
+                    kty: "RSA";
+                    use: "sig";
+                    alg: "RS256";
+                    kid: string;
+                    n: string;
+                    e: string;
+                }[];
+            } | undefined;
+        } | undefined;
+        description?: string | undefined;
+        category?: string | undefined;
+    }[];
+    tenants: {
+        id: string;
+        slug: string;
+        title: string;
+        active: boolean;
+        branding: {
+            brandName?: string | undefined;
+            logoUrl?: string | undefined;
+            primaryColor?: string | undefined;
+            secondaryColor?: string | undefined;
+        };
+        services: {
+            id: string;
+            hostname: string;
+            apiKeyHash: string;
+            capabilities: string[];
+            deploymentMode: "bp-hosted" | "customer-hosted" | "third-party-saas" | "self-hosted" | "saas-managed";
+            createdAt: string;
+            enabled: boolean;
+            publicKeyPem?: string | undefined;
+            keyId?: string | undefined;
+            serviceId?: string | undefined;
+            authProvider?: {
+                issuer: string;
+                audience: string;
+                jwksUri: string;
+                publicKeys?: {
+                    keys: {
+                        kty: "RSA";
+                        use: "sig";
+                        alg: "RS256";
+                        kid: string;
+                        n: string;
+                        e: string;
+                    }[];
+                } | undefined;
+            } | undefined;
+            title?: string | undefined;
+            description?: string | undefined;
+            lastSeenAt?: string | undefined;
+            lastSyncAt?: string | undefined;
+        }[];
+        activatedPlatformServices: string[];
+    }[];
+    sharedServiceCatalog: {
+        id: string;
+        title: string;
+        baseUrl: string;
+        apiKeyHash: string;
+        supportedDeploymentModes: ("bp-hosted" | "customer-hosted" | "third-party-saas" | "self-hosted" | "saas-managed")[];
+        owner: "bp" | "3p";
+        tags: string[];
+        enabled: boolean;
+        serviceId?: string | undefined;
+        description?: string | undefined;
+        logoUrl?: string | undefined;
+        publicKeyPem?: string | undefined;
+        keyId?: string | undefined;
+        authProvider?: {
+            issuer: string;
+            audience: string;
+            jwksUri: string;
+            publicKeys?: {
+                keys: {
+                    kty: "RSA";
+                    use: "sig";
+                    alg: "RS256";
+                    kid: string;
+                    n: string;
+                    e: string;
+                }[];
+            } | undefined;
+        } | undefined;
+        upgradeUrlTemplate?: string | undefined;
+        category?: string | undefined;
+        pricingHint?: "free" | "freemium" | "paid" | undefined;
+        publishedAt?: string | undefined;
+    }[];
+    sharedServiceActivations: {
+        id: string;
+        tenantId: string;
+        sharedServiceId: string;
+        activatedAt: string;
+        enabled: boolean;
+        appId?: string | undefined;
+    }[];
+    previewEnvironmentDeployments: {
+        id: string;
+        groupId: string;
+        key: string;
+        name: string;
+        hostname: string;
+        tenantId: string;
+        appId: string;
+        expiresInDays: number | null;
+        services: {
+            serviceId: string;
+            instanceId: string;
+            url: string;
+        }[];
+        createdAt: string;
+        updatedAt: string;
+        effectiveConfig?: {
+            services: {
+                serviceId: string;
+                config: {
+                    tenant: import("@betterportal/framework").JsonObject;
+                    app: import("@betterportal/framework").JsonObject;
+                };
+                title?: string | undefined;
+                configSchemas?: {
+                    id: string;
+                    title: string;
+                    description: string;
+                    scope: "tenant" | "app";
+                    jsonSchema: import("@betterportal/framework").JsonObject;
+                    fields: {
+                        key: string;
+                        title: string;
+                        description: string;
+                        scope: "tenant" | "app";
+                        visibility: "public" | "protected" | "secret";
+                        ownership: "bp" | "plugin" | "mixed";
+                        sourceOfTruth: "external" | "bp" | "plugin";
+                        required: boolean;
+                        groupId?: string | undefined;
+                        order?: number | undefined;
+                        defaultValue?: import("@betterportal/framework").JsonValue | undefined;
+                        ui?: {
+                            control?: "number" | "email" | "text" | "select" | "url" | "date" | "textarea" | "password" | "checkbox" | "multiselect" | "color" | "time" | "datetime-local" | undefined;
+                            placeholder?: string | undefined;
+                            options?: {
+                                value: string;
+                                label: string;
+                            }[] | undefined;
+                            optionsSource?: "app.routes" | undefined;
+                            min?: string | number | undefined;
+                            max?: string | number | undefined;
+                            step?: number | undefined;
+                            rows?: number | undefined;
+                        } | undefined;
+                    }[];
+                    groups?: {
+                        id: string;
+                        title: string;
+                        description?: string | undefined;
+                        order?: number | undefined;
+                        optional?: boolean | undefined;
+                    }[] | undefined;
+                }[] | undefined;
+            }[];
+            elevatedRoleIds: string[];
+        } | undefined;
+        credentialReplay?: {
+            requestHash: string;
+            ciphertext: string;
+            expiresAt: string;
+        } | undefined;
+        expiresAt?: string | undefined;
+    }[];
+}>;
+export type CacheData = Pick<BetterPortalConfig, "apps" | "tenants" | "platformServices" | "sharedServiceCatalog" | "sharedServiceActivations" | "configManagement" | "manifestCache">;
+/** Caches need service manifests and auth grants, never menus, routes or preview snapshots. */
+export declare function readCacheData(db: AppDatabase): Promise<CacheData>;
+export declare function readApp(db: AppDatabase, appId: string): Promise<AppEditorData>;
+export type DirectoryData = Pick<BetterPortalConfig, "apps" | "tenants" | "platformServices" | "sharedServiceCatalog" | "sharedServiceActivations" | "configManagement" | "m2m">;
+/** Service/settings pages need registration summaries, not app operational collections. */
+export declare function readDirectory(db: AppDatabase): Promise<DirectoryData>;
+/** Tenant editor needs route choices/counts, but no route options, menus or grants. */
+export declare function readTenantPage(db: AppDatabase): Promise<DirectoryData>;
+//# sourceMappingURL=appQueries.d.ts.map