@nocobase/plugin-multi-portal 2.2.0-alpha.10

package/dist/server/plugin.js

@@ -0,0 +1,2130 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var plugin_exports = {};
+__export(plugin_exports, {
+  PluginMultiPortalServer: () => PluginMultiPortalServer,
+  default: () => plugin_default
+});
+module.exports = __toCommonJS(plugin_exports);
+var import_server = require("@nocobase/server");
+var import_utils = require("@nocobase/utils");
+var import_child_process = require("child_process");
+var import_fs = __toESM(require("fs"));
+var import_os = __toESM(require("os"));
+var import_path = __toESM(require("path"));
+var import_url = require("url");
+var import_promises = require("stream/promises");
+var tar = __toESM(require("tar"));
+var import_zlib = require("zlib");
+var import_ensureDefaultRoleMultiPortalAccess = require("./ensureDefaultRoleMultiPortalAccess");
+const MULTI_PORTAL_RUNTIME_FIELDS = [
+  "uid",
+  "title",
+  "portalType",
+  "portalName",
+  "routePath",
+  "authCheck",
+  "enabled"
+];
+const MULTI_PORTAL_RUNTIME_QUERY_FIELDS = [...MULTI_PORTAL_RUNTIME_FIELDS, "uiLayoutUid"];
+const MULTI_PORTAL_ACCESSIBLE_FIELDS = [
+  "uid",
+  "title",
+  "icon",
+  "portalType",
+  "portalName",
+  "routePath",
+  "authCheck",
+  "enabled"
+];
+const MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS = [...MULTI_PORTAL_ACCESSIBLE_FIELDS, "uiLayoutUid"];
+const MULTI_PORTAL_UI_LAYOUT_RUNTIME_FIELDS = ["layoutType"];
+const DESKTOP_ROUTE_ROLE_PERMISSION_TARGET_FIELDS = ["id", "title", "hidden", "parentId", "options"];
+const UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG = "plugin-ui-layout:desktop-route-write-layout";
+const MAIN_APP_NAME = "main";
+const UNION_ROLE_KEY = "__union__";
+const MULTI_PORTAL_MANIFEST_NAMESPACE = "multi-portal";
+const MULTI_PORTAL_MANIFEST_SYNC_MESSAGE_TYPE = "multi-portal:app-manifest-changed";
+const DEFAULT_INIT_PORTAL_TYPE = "no-code";
+const DEFAULT_INIT_PORTAL_NAME = "admin";
+const DEFAULT_INIT_PORTAL_TEMPLATE = "@nocobase/portal-template-default";
+const PORTAL_CLIENT_PREFIX = "x";
+const PORTAL_DEPLOY_UPLOAD_LIMIT = 200 * 1024 * 1024;
+const PORTAL_DEPLOY_UPLOAD_DIR_PREFIX = "nocobase-portal-dist-upload-";
+const PORTAL_PUBLIC_DIR_MODE = 493;
+const PORTAL_PUBLIC_FILE_MODE = 420;
+const PORTAL_TEMPLATE_NPM_PACK_TIMEOUT_MS = 3e4;
+const DEFAULT_MULTI_PORTAL_UID = "__default_portal__";
+const MULTI_PORTAL_SLUG_PATTERN = /^[a-z0-9_-]+$/;
+const INIT_PORTAL_TYPES = ["no-code", "ai"];
+const DEFAULT_MULTI_PORTAL_UIDS = [DEFAULT_MULTI_PORTAL_UID];
+const DEFAULT_MULTI_PORTAL_UID_SET = new Set(DEFAULT_MULTI_PORTAL_UIDS);
+const MULTI_PORTAL_MANAGEMENT_ACTIONS = [
+  "multiPortals:list",
+  "multiPortals:get",
+  "multiPortals:getLog",
+  "multiPortals:create",
+  "multiPortals:update",
+  "multiPortals:firstOrCreate",
+  "multiPortals:destroy",
+  "multiPortals:deploy",
+  "multiPortals:pullSource",
+  "multiPortals:pushSource"
+];
+const ROLE_MULTI_PORTAL_PERMISSION_ACTIONS = [
+  "roles.multiPortals:*",
+  "rolesMultiPortalDesktopRoutes:*",
+  "rolesMultiPortalRoutePolicies:*"
+];
+const EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS = Symbol("explicitDesktopRouteUiLayouts");
+const SKIP_CREATE_PORTAL_DIRECTORY = Symbol("skipCreatePortalDirectory");
+function getRecordField(record, field) {
+  if (!record || typeof record !== "object") {
+    return;
+  }
+  const maybeModel = record;
+  if (typeof maybeModel.get === "function") {
+    return maybeModel.get(field);
+  }
+  return record[field];
+}
+function isRecordLike(value) {
+  return !!value && typeof value === "object";
+}
+async function pathExists(filePath) {
+  try {
+    await import_fs.default.promises.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function trimString(value) {
+  return String(value ?? "").trim();
+}
+function isInitPortalType(value) {
+  return INIT_PORTAL_TYPES.includes(value);
+}
+function getInitPortalType() {
+  const portalType = trimString(process.env.INIT_PORTAL_TYPE) || DEFAULT_INIT_PORTAL_TYPE;
+  if (!isInitPortalType(portalType)) {
+    throw new Error('INIT_PORTAL_TYPE must be either "no-code" or "ai".');
+  }
+  return portalType;
+}
+function getInitPortalName() {
+  const portalName = trimString(process.env.INIT_PORTAL_NAME) || DEFAULT_INIT_PORTAL_NAME;
+  if (!MULTI_PORTAL_SLUG_PATTERN.test(portalName)) {
+    throw new Error("INIT_PORTAL_NAME can only contain lowercase letters, numbers, hyphens, and underscores.");
+  }
+  return portalName;
+}
+function getInitPortalTemplate() {
+  return trimString(process.env.INIT_PORTAL_TEMPLATE) || DEFAULT_INIT_PORTAL_TEMPLATE;
+}
+function formatInitPortalTitle(portalName) {
+  const title = portalName.split(/[-_]/).filter(Boolean).map((segment) => `${segment.charAt(0).toUpperCase()}${segment.slice(1)}`).join(" ");
+  return title || portalName;
+}
+function getDefaultMultiPortalRecord() {
+  const portalName = getInitPortalName();
+  return {
+    uid: DEFAULT_MULTI_PORTAL_UID,
+    title: formatInitPortalTitle(portalName),
+    icon: "DesktopOutlined",
+    portalType: getInitPortalType(),
+    portalName,
+    routePath: `/${portalName}`,
+    authCheck: true,
+    enabled: true,
+    uiLayoutUid: "admin-layout-model"
+  };
+}
+function isValidPortalDeploySegment(value) {
+  return /^[A-Za-z0-9_-]+$/.test(value);
+}
+function normalizePortalStorageName(value) {
+  return trimString(value).replace(/^\/+|\/+$/g, "");
+}
+function normalizePortalStoragePath(value, fallbackName) {
+  const segment = trimString(value).replace(/^\/+|\/+$/g, "");
+  return `/${segment || fallbackName}`;
+}
+function resolvePortalStoragePublicPath(value) {
+  const normalized = trimString(value) || "/";
+  const withLeadingSlash = normalized.startsWith("/") ? normalized : `/${normalized}`;
+  return withLeadingSlash.endsWith("/") ? withLeadingSlash : `${withLeadingSlash}/`;
+}
+function joinPortalStoragePublicPath(publicPath, pathname) {
+  const normalizedPublicPath = resolvePortalStoragePublicPath(publicPath);
+  const normalizedPathname = normalizePortalStoragePath(pathname, "").replace(/^\/+/, "");
+  return `${normalizedPublicPath.replace(/\/$/, "")}/${normalizedPathname}`.replace(/^\/{2,}/, "/");
+}
+function isAbsoluteUrl(value) {
+  return /^[a-z][a-z\d+\-.]*:\/\//i.test(value) || value.startsWith("//");
+}
+function appendPortalStorageSubAppApiUrl(apiUrl, appName) {
+  if (appName === MAIN_APP_NAME) {
+    return apiUrl;
+  }
+  const subAppApiPath = `/__app/${encodeURIComponent(appName)}`;
+  const subAppApiPathPattern = new RegExp(`/__app/${appName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/?$`);
+  if (subAppApiPathPattern.test(apiUrl)) {
+    return apiUrl;
+  }
+  if (isAbsoluteUrl(apiUrl)) {
+    const url = new URL(apiUrl.startsWith("//") ? `http:${apiUrl}` : apiUrl);
+    if (!subAppApiPathPattern.test(url.pathname)) {
+      url.pathname = `${url.pathname.replace(/\/+$/, "")}${subAppApiPath}`;
+    }
+    const value = url.toString();
+    return apiUrl.startsWith("//") ? value.replace(/^http:/, "") : value;
+  }
+  return `${apiUrl.replace(/\/+$/, "")}${subAppApiPath}`;
+}
+function getPortalStorageApiUrl(appName) {
+  const configuredApiUrl = trimString(
+    process.env.NOCOBASE_API_URL || process.env.API_BASE_URL || process.env.API_BASE_PATH
+  );
+  const apiUrl = configuredApiUrl || "/api";
+  if (isAbsoluteUrl(apiUrl)) {
+    return appendPortalStorageSubAppApiUrl(apiUrl, appName);
+  }
+  const normalizedApiPath = normalizePortalStoragePath(apiUrl, "api");
+  const appPublicPath = resolvePortalStoragePublicPath(process.env.APP_PUBLIC_PATH || "/");
+  if (appPublicPath === "/" || normalizedApiPath === appPublicPath.slice(0, -1)) {
+    return appendPortalStorageSubAppApiUrl(normalizedApiPath, appName);
+  }
+  if (normalizedApiPath.startsWith(appPublicPath)) {
+    return appendPortalStorageSubAppApiUrl(normalizedApiPath, appName);
+  }
+  return appendPortalStorageSubAppApiUrl(joinPortalStoragePublicPath(appPublicPath, normalizedApiPath), appName);
+}
+function getPortalDeployBasePath(appName, portalName) {
+  const portalPath = appName === MAIN_APP_NAME ? `/${PORTAL_CLIENT_PREFIX}/${portalName}/` : `/${PORTAL_CLIENT_PREFIX}/apps/${appName}/${portalName}/`;
+  return resolvePortalStoragePublicPath(joinPortalStoragePublicPath(process.env.APP_PUBLIC_PATH || "/", portalPath));
+}
+function createPortalDeployUploadMiddleware() {
+  const storage = import_utils.koaMulter.diskStorage({
+    destination: import_os.default.tmpdir(),
+    filename: function(_req, _file, cb) {
+      const randomName = Date.now().toString() + Math.random().toString().slice(2);
+      cb(null, randomName);
+    }
+  });
+  const upload = (0, import_utils.koaMulter)({
+    storage,
+    limits: {
+      fileSize: PORTAL_DEPLOY_UPLOAD_LIMIT
+    }
+  }).single("file");
+  return async (ctx, next) => {
+    if (ctx.action.resourceName !== "multiPortals" || ctx.action.actionName !== "deploy" && ctx.action.actionName !== "pushSource") {
+      await next();
+      return;
+    }
+    await upload(ctx, next);
+  };
+}
+function isValidPortalStorageName(value) {
+  return /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value);
+}
+function getPortalStorageLogPath(item) {
+  return (0, import_utils.storagePathJoin)("logs", "portals", item.appName, `${item.portalName}.log`);
+}
+function getPortalStorageLogRelativePath(item) {
+  return import_path.default.join("logs", "portals", item.appName, `${item.portalName}.log`);
+}
+async function ensurePortalStorageLogFile(logPath) {
+  await import_fs.default.promises.mkdir(import_path.default.dirname(logPath), { recursive: true });
+}
+async function appendPortalStorageLog(logPath, message) {
+  await ensurePortalStorageLogFile(logPath);
+  await import_fs.default.promises.appendFile(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+`, "utf-8");
+}
+function formatPortalStorageCommand(command, args) {
+  return [command, ...args].join(" ");
+}
+function getLocalPortalTemplatePath(templateSource) {
+  if (templateSource.startsWith("file://")) {
+    try {
+      return (0, import_url.fileURLToPath)(templateSource);
+    } catch {
+      return null;
+    }
+  }
+  if (import_path.default.isAbsolute(templateSource) || templateSource.startsWith("./") || templateSource.startsWith("../")) {
+    return import_path.default.resolve(templateSource);
+  }
+  return null;
+}
+async function resolveLocalPortalTemplate(templateSource) {
+  const localPath = getLocalPortalTemplatePath(templateSource);
+  if (!localPath) {
+    return null;
+  }
+  let stat;
+  try {
+    stat = await import_fs.default.promises.stat(localPath);
+  } catch {
+    throw new Error(`Portal template "${templateSource}" is invalid: local directory does not exist.`);
+  }
+  if (!stat.isDirectory()) {
+    throw new Error(`Portal template "${templateSource}" is invalid: expected a directory.`);
+  }
+  if (!await pathExists(import_path.default.join(localPath, "package.json"))) {
+    throw new Error(`Portal template "${templateSource}" is invalid: package.json is missing.`);
+  }
+  return { dir: localPath };
+}
+function resolveInstalledPortalTemplatePackage(templatePackage) {
+  try {
+    return { dir: import_path.default.dirname(require.resolve(`${templatePackage}/package.json`)) };
+  } catch {
+    return null;
+  }
+}
+async function resolvePackedPortalTemplateTarball(packRoot, templatePackage) {
+  const entries = await import_fs.default.promises.readdir(packRoot, { withFileTypes: true });
+  const tarballs = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".tgz")).map((entry) => import_path.default.join(packRoot, entry.name)).sort();
+  if (tarballs.length === 1) {
+    return tarballs[0];
+  }
+  if (!tarballs.length) {
+    throw new Error(`npm pack did not produce a local tarball for ${templatePackage}.`);
+  }
+  throw new Error(`npm pack produced multiple tarballs for ${templatePackage}.`);
+}
+async function downloadPortalTemplatePackage(templatePackage, logPath) {
+  const packRoot = await import_fs.default.promises.mkdtemp(import_path.default.join(import_os.default.tmpdir(), "nocobase-portal-template-pack-"));
+  const extractRoot = await import_fs.default.promises.mkdtemp(import_path.default.join(import_os.default.tmpdir(), "nocobase-portal-template-extract-"));
+  let cleanupPackRoot = true;
+  let cleanupExtractRoot = true;
+  try {
+    await runPortalStorageCommandOnce("npm", ["pack", "--silent", templatePackage], {
+      cwd: packRoot,
+      env: getPortalStorageCommandEnv(),
+      logPath,
+      timeoutMs: PORTAL_TEMPLATE_NPM_PACK_TIMEOUT_MS
+    });
+    const tarballPath = await resolvePackedPortalTemplateTarball(packRoot, templatePackage);
+    await (0, import_promises.pipeline)(import_fs.default.createReadStream(tarballPath), (0, import_zlib.createGunzip)(), tar.extract({ cwd: extractRoot, strip: 1 }));
+    if (!await pathExists(import_path.default.join(extractRoot, "package.json"))) {
+      throw new Error(`Portal template package "${templatePackage}" is invalid: package.json is missing.`);
+    }
+    cleanupPackRoot = false;
+    cleanupExtractRoot = false;
+    return {
+      dir: extractRoot,
+      cleanup: async () => {
+        await import_fs.default.promises.rm(packRoot, { recursive: true, force: true });
+        await import_fs.default.promises.rm(extractRoot, { recursive: true, force: true });
+      }
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to download portal template package "${templatePackage}" with npm pack. ${message}`);
+  } finally {
+    if (cleanupPackRoot) {
+      await import_fs.default.promises.rm(packRoot, { recursive: true, force: true });
+    }
+    if (cleanupExtractRoot) {
+      await import_fs.default.promises.rm(extractRoot, { recursive: true, force: true });
+    }
+  }
+}
+async function resolvePortalTemplate(templateSource, logPath) {
+  const localTemplate = await resolveLocalPortalTemplate(templateSource);
+  if (localTemplate) {
+    return localTemplate;
+  }
+  const installedTemplate = resolveInstalledPortalTemplatePackage(templateSource);
+  if (installedTemplate) {
+    return installedTemplate;
+  }
+  return downloadPortalTemplatePackage(templateSource, logPath);
+}
+async function copyPortalTemplate(sourceDir, targetDir) {
+  const ignoredSegments = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store"]);
+  await import_fs.default.promises.mkdir(import_path.default.dirname(targetDir), { recursive: true });
+  await import_fs.default.promises.cp(sourceDir, targetDir, {
+    recursive: true,
+    filter: (source) => !import_path.default.relative(sourceDir, source).split(import_path.default.sep).some((segment) => segment.startsWith("._") || ignoredSegments.has(segment))
+  });
+}
+function sanitizePortalStorageNodeOptions(value) {
+  return trimString(value).split(/\s+/).filter((option) => option !== "--preserve-symlinks" && option !== "--preserve-symlinks-main").join(" ");
+}
+function getPortalStorageCommandEnv(env = {}) {
+  const commandEnv = { ...process.env, ...env };
+  const nodeOptions = sanitizePortalStorageNodeOptions(commandEnv.NODE_OPTIONS);
+  if (nodeOptions) {
+    commandEnv.NODE_OPTIONS = nodeOptions;
+  } else {
+    delete commandEnv.NODE_OPTIONS;
+  }
+  return commandEnv;
+}
+async function runPortalStorageCommandOnce(command, args, options) {
+  var _a, _b;
+  await appendPortalStorageLog(options.logPath, `Running command: ${formatPortalStorageCommand(command, args)}`);
+  await ensurePortalStorageLogFile(options.logPath);
+  const logStream = import_fs.default.createWriteStream(options.logPath, { flags: "a" });
+  const subprocess = (0, import_child_process.spawn)(command, args, {
+    cwd: options.cwd,
+    env: options.env,
+    shell: false
+  });
+  let timeout;
+  if (options.timeoutMs && options.timeoutMs > 0) {
+    timeout = setTimeout(() => {
+      var _a2;
+      (_a2 = subprocess.kill) == null ? void 0 : _a2.call(subprocess, "SIGTERM");
+    }, options.timeoutMs);
+  }
+  (_a = subprocess.stdout) == null ? void 0 : _a.pipe(logStream, { end: false });
+  (_b = subprocess.stderr) == null ? void 0 : _b.pipe(logStream, { end: false });
+  let result;
+  try {
+    result = await new Promise((resolve, reject) => {
+      subprocess.once("error", reject);
+      subprocess.once("close", (code, signal) => {
+        if (timeout) {
+          clearTimeout(timeout);
+        }
+        resolve({ code, signal });
+      });
+    });
+    await new Promise((resolve, reject) => {
+      const handleError = (error) => {
+        reject(error);
+      };
+      logStream.once("error", handleError);
+      logStream.end(() => {
+        logStream.off("error", handleError);
+        resolve();
+      });
+    });
+  } catch (error) {
+    if (timeout) {
+      clearTimeout(timeout);
+    }
+    logStream.end();
+    await appendPortalStorageLog(options.logPath, `Command failed to start: ${command}`);
+    throw error;
+  }
+  await appendPortalStorageLog(
+    options.logPath,
+    `Command finished: ${formatPortalStorageCommand(command, args)} exitCode=${result.code ?? ""} signal=${result.signal ?? ""}`
+  );
+  if (result.signal) {
+    const error = new Error(
+      `Command failed with signal ${result.signal}: ${formatPortalStorageCommand(command, args)}`
+    );
+    error.code = result.code;
+    error.signal = result.signal;
+    error.cmd = formatPortalStorageCommand(command, args);
+    throw error;
+  }
+  if (result.code && result.code !== 0) {
+    const error = new Error(
+      `Command failed with exit code ${result.code}: ${formatPortalStorageCommand(command, args)}`
+    );
+    error.code = result.code;
+    error.signal = result.signal;
+    error.cmd = formatPortalStorageCommand(command, args);
+    throw error;
+  }
+}
+async function buildPortalStorageItem(portalDir, item) {
+  const logPath = getPortalStorageLogPath(item);
+  const buildEnv = getPortalStorageCommandEnv({
+    NOCOBASE_API_URL: getPortalStorageApiUrl(item.appName),
+    NOCOBASE_PORTAL_BASE: getPortalDeployBasePath(item.appName, item.portalName)
+  });
+  await appendPortalStorageLog(logPath, `Building portal ${item.appName}/${item.portalName}.`);
+  await appendPortalStorageLog(
+    logPath,
+    `Build environment: NOCOBASE_API_URL=${buildEnv.NOCOBASE_API_URL || ""} NOCOBASE_PORTAL_BASE=${buildEnv.NOCOBASE_PORTAL_BASE || ""} APP_PUBLIC_PATH=${buildEnv.APP_PUBLIC_PATH || ""}`
+  );
+  await runPortalStorageCommandOnce("yarn", ["build:html"], {
+    cwd: portalDir,
+    env: buildEnv,
+    logPath
+  });
+  await appendPortalStorageLog(logPath, `Portal build completed for ${item.appName}/${item.portalName}.`);
+}
+function validatePortalDeployBasePath(appName, portalName, basePath) {
+  const normalizedBasePath = resolvePortalStoragePublicPath(basePath);
+  if (normalizedBasePath.includes("..")) {
+    throw new Error('basePath cannot contain ".."');
+  }
+  const expectedBasePath = getPortalDeployBasePath(appName, portalName);
+  if (normalizedBasePath !== expectedBasePath) {
+    throw new Error(`basePath must be ${expectedBasePath}`);
+  }
+}
+function isPortalDeployTarEntry(entry) {
+  return Boolean(entry) && typeof entry === "object";
+}
+function validatePortalDeployTarEntry(entryPath, entry) {
+  const normalizedEntryPath = import_path.default.normalize(entryPath);
+  if (import_path.default.isAbsolute(entryPath) || normalizedEntryPath === ".." || normalizedEntryPath.startsWith(`..${import_path.default.sep}`) || normalizedEntryPath.split(import_path.default.sep).includes("..")) {
+    throw new Error(`Invalid dist archive entry path: ${entryPath}`);
+  }
+  const entryType = isPortalDeployTarEntry(entry) ? entry.type : void 0;
+  if (entryType === "SymbolicLink" || entryType === "Link") {
+    throw new Error(`Invalid dist archive link entry: ${entryPath}`);
+  }
+  const linkpath = isPortalDeployTarEntry(entry) ? entry.linkpath : void 0;
+  if (linkpath) {
+    throw new Error(`Invalid dist archive link target: ${entryPath}`);
+  }
+  return true;
+}
+function isPortalDeployStorageTempDir(name) {
+  return name.startsWith(".dist-upload-") || name.startsWith(".dist-backup-");
+}
+function isNodeFsError(error) {
+  return error instanceof Error && "code" in error;
+}
+async function cleanupInterruptedPortalDeployDirs(portalDir) {
+  let entries;
+  try {
+    entries = await import_fs.default.promises.readdir(portalDir, { withFileTypes: true });
+  } catch (error) {
+    if (isNodeFsError(error) && error.code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+  await Promise.all(
+    entries.filter((entry) => entry.isDirectory() && isPortalDeployStorageTempDir(entry.name)).map((entry) => import_fs.default.promises.rm(import_path.default.join(portalDir, entry.name), { recursive: true, force: true }))
+  );
+}
+async function movePortalDeployDir(sourceDir, targetDir) {
+  try {
+    await import_fs.default.promises.rename(sourceDir, targetDir);
+  } catch (error) {
+    if (!isNodeFsError(error) || error.code !== "EXDEV") {
+      throw error;
+    }
+    await import_fs.default.promises.cp(sourceDir, targetDir, { recursive: true });
+    await import_fs.default.promises.rm(sourceDir, { recursive: true, force: true });
+  }
+}
+async function chmodPortalDistTree(targetDir) {
+  await import_fs.default.promises.chmod(targetDir, PORTAL_PUBLIC_DIR_MODE);
+  const entries = await import_fs.default.promises.readdir(targetDir, { withFileTypes: true });
+  await Promise.all(
+    entries.map(async (entry) => {
+      const entryPath = import_path.default.join(targetDir, entry.name);
+      if (entry.isDirectory()) {
+        await chmodPortalDistTree(entryPath);
+        return;
+      }
+      if (entry.isFile()) {
+        await import_fs.default.promises.chmod(entryPath, PORTAL_PUBLIC_FILE_MODE);
+      }
+    })
+  );
+}
+async function ensurePortalDistPublicReadable(portalDir, distDir) {
+  const appDir = import_path.default.dirname(portalDir);
+  const portalsDir = import_path.default.dirname(appDir);
+  await import_fs.default.promises.chmod(portalsDir, PORTAL_PUBLIC_DIR_MODE);
+  await import_fs.default.promises.chmod(appDir, PORTAL_PUBLIC_DIR_MODE);
+  await import_fs.default.promises.chmod(portalDir, PORTAL_PUBLIC_DIR_MODE);
+  await chmodPortalDistTree(distDir);
+}
+async function replacePortalDistFromArchive(params) {
+  const portalDir = (0, import_utils.storagePathJoin)("portals", params.appName, params.portalName);
+  const distDir = import_path.default.join(portalDir, "dist");
+  const backupDir = import_path.default.join(portalDir, `.dist-backup-${Date.now()}-${Math.random().toString().slice(2)}`);
+  const tarPath = import_path.default.join(import_os.default.tmpdir(), `nocobase-portal-dist-${Date.now()}-${Math.random().toString().slice(2)}.tar`);
+  const uploadDir = await import_fs.default.promises.mkdtemp(import_path.default.join(import_os.default.tmpdir(), PORTAL_DEPLOY_UPLOAD_DIR_PREFIX));
+  let hasBackup = false;
+  await import_fs.default.promises.mkdir(portalDir, { recursive: true });
+  await cleanupInterruptedPortalDeployDirs(portalDir);
+  try {
+    await (0, import_promises.pipeline)(import_fs.default.createReadStream(params.filePath), (0, import_zlib.createGunzip)(), import_fs.default.createWriteStream(tarPath));
+    await tar.extract({
+      file: tarPath,
+      cwd: uploadDir,
+      strict: true,
+      filter: validatePortalDeployTarEntry
+    });
+    const indexPath = import_path.default.join(uploadDir, "index.html");
+    const indexStat = await import_fs.default.promises.stat(indexPath).catch(() => null);
+    if (!(indexStat == null ? void 0 : indexStat.isFile())) {
+      throw new Error("Portal dist archive is invalid: index.html is missing.");
+    }
+    if (await pathExists(distDir)) {
+      await import_fs.default.promises.rename(distDir, backupDir);
+      hasBackup = true;
+    }
+    await movePortalDeployDir(uploadDir, distDir);
+    await ensurePortalDistPublicReadable(portalDir, distDir);
+    if (hasBackup) {
+      await import_fs.default.promises.rm(backupDir, { recursive: true, force: true });
+      hasBackup = false;
+    }
+    return import_path.default.relative((0, import_utils.storagePathJoin)(), distDir);
+  } catch (error) {
+    await import_fs.default.promises.rm(uploadDir, { recursive: true, force: true });
+    if (hasBackup) {
+      await import_fs.default.promises.rm(distDir, { recursive: true, force: true });
+      await import_fs.default.promises.rename(backupDir, distDir).catch(async () => {
+        await import_fs.default.promises.rm(backupDir, { recursive: true, force: true });
+      });
+    }
+    throw error;
+  } finally {
+    await import_fs.default.promises.rm(params.filePath, { force: true });
+    await import_fs.default.promises.rm(uploadDir, { recursive: true, force: true });
+    await import_fs.default.promises.rm(tarPath, { force: true });
+  }
+}
+function shouldPackPortalSourceEntry(entryName) {
+  return !entryName.split("/").some((segment) => segment.startsWith("._") || [".git", "node_modules", "dist", ".DS_Store"].includes(segment));
+}
+function validatePortalSourceTarEntry(entryPath, entry) {
+  if (import_path.default.isAbsolute(entryPath) || entryPath.split(/[\\/]+/).includes("..")) {
+    return false;
+  }
+  const entryType = isPortalDeployTarEntry(entry) ? entry.type : void 0;
+  const linkpath = isPortalDeployTarEntry(entry) ? entry.linkpath : void 0;
+  if (entryType === "SymbolicLink" || entryType === "Link" || typeof linkpath === "string") {
+    return false;
+  }
+  return shouldPackPortalSourceEntry(entryPath);
+}
+async function packPortalSource(params) {
+  const portalDir = (0, import_utils.storagePathJoin)("portals", params.appName, params.portalName);
+  if (!await pathExists(portalDir)) {
+    throw new Error("Portal source directory does not exist.");
+  }
+  const archivePath = import_path.default.join(
+    import_os.default.tmpdir(),
+    `nocobase-portal-source-${Date.now()}-${Math.random().toString().slice(2)}.tar.gz`
+  );
+  await new Promise((resolve, reject) => {
+    var _a;
+    const child = (0, import_child_process.spawn)(
+      "tar",
+      [
+        "-czf",
+        archivePath,
+        "--exclude=.git",
+        "--exclude=node_modules",
+        "--exclude=dist",
+        "--exclude=.DS_Store",
+        "--exclude=._*",
+        "-C",
+        portalDir,
+        "."
+      ],
+      {
+        stdio: ["ignore", "ignore", "pipe"]
+      }
+    );
+    let stderr = "";
+    (_a = child.stderr) == null ? void 0 : _a.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(new Error(`tar exited with code ${code}${stderr ? `: ${stderr.trim()}` : ""}`));
+    });
+  });
+  return archivePath;
+}
+async function replacePortalSourceFromArchive(params) {
+  const portalDir = (0, import_utils.storagePathJoin)("portals", params.appName, params.portalName);
+  const tarPath = import_path.default.join(
+    import_os.default.tmpdir(),
+    `nocobase-portal-source-${Date.now()}-${Math.random().toString().slice(2)}.tar`
+  );
+  const uploadDir = await import_fs.default.promises.mkdtemp(import_path.default.join(import_os.default.tmpdir(), "nocobase-portal-source-upload-"));
+  try {
+    await (0, import_promises.pipeline)(import_fs.default.createReadStream(params.filePath), (0, import_zlib.createGunzip)(), import_fs.default.createWriteStream(tarPath));
+    await tar.extract({
+      file: tarPath,
+      cwd: uploadDir,
+      strict: true,
+      filter: validatePortalSourceTarEntry
+    });
+    await import_fs.default.promises.mkdir(portalDir, { recursive: true });
+    const existingEntries = await import_fs.default.promises.readdir(portalDir).catch(() => []);
+    await Promise.all(
+      existingEntries.filter((entry) => shouldPackPortalSourceEntry(entry)).map((entry) => import_fs.default.promises.rm(import_path.default.join(portalDir, entry), { recursive: true, force: true }))
+    );
+    const sourceEntries = await import_fs.default.promises.readdir(uploadDir);
+    await Promise.all(
+      sourceEntries.map((entry) => import_fs.default.promises.rename(import_path.default.join(uploadDir, entry), import_path.default.join(portalDir, entry)))
+    );
+    return import_path.default.relative((0, import_utils.storagePathJoin)(), portalDir);
+  } finally {
+    await import_fs.default.promises.rm(params.filePath, { force: true });
+    await import_fs.default.promises.rm(uploadDir, { recursive: true, force: true });
+    await import_fs.default.promises.rm(tarPath, { force: true });
+  }
+}
+function isDefaultMultiPortalUid(uid) {
+  return typeof uid === "string" && DEFAULT_MULTI_PORTAL_UID_SET.has(uid);
+}
+function getDefaultMultiPortalRecordForUid(uid) {
+  return isDefaultMultiPortalUid(uid) ? getDefaultMultiPortalRecord() : void 0;
+}
+function getDefaultMultiPortalUiLayoutUid(portal) {
+  return Object.prototype.hasOwnProperty.call(portal, "uiLayoutUid") ? portal.uiLayoutUid ?? null : null;
+}
+function withCustomMultiPortalFilter(filter = {}) {
+  const customFilter = { ...filter };
+  const uidFilter = customFilter.uid;
+  if (Array.isArray(uidFilter)) {
+    customFilter.uid = uidFilter.filter((uid) => !isDefaultMultiPortalUid(uid));
+    return customFilter;
+  }
+  if (isDefaultMultiPortalUid(uidFilter)) {
+    customFilter.uid = [];
+    return customFilter;
+  }
+  customFilter["uid.$notIn"] = DEFAULT_MULTI_PORTAL_UIDS;
+  return customFilter;
+}
+function uniqueDesktopRouteIds(routeIds) {
+  const seen = /* @__PURE__ */ new Set();
+  return routeIds.filter((routeId) => {
+    if (seen.has(routeId)) {
+      return false;
+    }
+    seen.add(routeId);
+    return true;
+  });
+}
+function collectDesktopRouteIds(record) {
+  if (Array.isArray(record)) {
+    return uniqueDesktopRouteIds(record.flatMap((item) => collectDesktopRouteIds(item)));
+  }
+  const routeId = getRecordField(record, "id");
+  const children = getRecordField(record, "children");
+  const routeIds = [];
+  if (typeof routeId === "string" || typeof routeId === "number") {
+    routeIds.push(routeId);
+  }
+  if (Array.isArray(children)) {
+    routeIds.push(...children.flatMap((child) => collectDesktopRouteIds(child)));
+  }
+  return uniqueDesktopRouteIds(routeIds);
+}
+function pickMultiPortalUiLayoutRuntimeFields(record) {
+  const result = {};
+  for (const field of MULTI_PORTAL_UI_LAYOUT_RUNTIME_FIELDS) {
+    result[field] = getRecordField(record, field);
+  }
+  return result;
+}
+function pickMultiPortalRuntimeFields(record) {
+  const result = {};
+  for (const field of MULTI_PORTAL_RUNTIME_FIELDS) {
+    result[field] = getRecordField(record, field);
+  }
+  result.uiLayout = pickMultiPortalUiLayoutRuntimeFields(getRecordField(record, "uiLayout"));
+  return result;
+}
+function pickMultiPortalAccessibleFields(record) {
+  const result = {};
+  for (const field of MULTI_PORTAL_ACCESSIBLE_FIELDS) {
+    result[field] = getRecordField(record, field) ?? null;
+  }
+  result.uiLayout = pickMultiPortalUiLayoutRuntimeFields(getRecordField(record, "uiLayout"));
+  return result;
+}
+function getExplicitRequestedLayoutUid(layout) {
+  const uid = Array.isArray(layout) ? layout[0] : layout;
+  if (typeof uid === "string" && uid.trim()) {
+    return uid;
+  }
+}
+function getRequestedMultiPortalUid(ctx) {
+  var _a, _b;
+  const portalUid = getExplicitRequestedLayoutUid((_a = ctx.action) == null ? void 0 : _a.params.portal);
+  const layoutUid = getExplicitRequestedLayoutUid((_b = ctx.action) == null ? void 0 : _b.params.layout);
+  if (portalUid && layoutUid) {
+    ctx.throw(400, "layout and portal cannot be used together");
+    return;
+  }
+  return portalUid;
+}
+function getCurrentRoles(ctx) {
+  const currentRole = ctx.state.currentRole;
+  if (typeof currentRole === "string" && currentRole && currentRole !== UNION_ROLE_KEY) {
+    return [currentRole];
+  }
+  const currentRoles = ctx.state.currentRoles;
+  if (Array.isArray(currentRoles)) {
+    return currentRoles.filter((role) => typeof role === "string");
+  }
+  return typeof currentRole === "string" && currentRole ? [currentRole] : [];
+}
+function getMultiPortalNameFromValues(ctx) {
+  var _a;
+  const values = (_a = ctx.action) == null ? void 0 : _a.params.values;
+  if (!values || typeof values !== "object" || Array.isArray(values)) {
+    return;
+  }
+  const portalName = values.portalName;
+  if (typeof portalName === "string" && portalName.trim()) {
+    return portalName;
+  }
+}
+function getMultiPortalWriteValues(ctx) {
+  var _a;
+  const values = (_a = ctx.action) == null ? void 0 : _a.params.values;
+  if (!values || typeof values !== "object" || Array.isArray(values)) {
+    return;
+  }
+  return values;
+}
+function isTruthyActionBoolean(value) {
+  return value === true || value === 1 || value === "1" || value === "true";
+}
+async function captureSkipCreatePortalDirectory(ctx, next) {
+  const values = getMultiPortalWriteValues(ctx);
+  if (!values || !Object.prototype.hasOwnProperty.call(values, "skipCreatePortalDirectory")) {
+    await next();
+    return;
+  }
+  ctx[SKIP_CREATE_PORTAL_DIRECTORY] = isTruthyActionBoolean(
+    values.skipCreatePortalDirectory
+  );
+  delete values.skipCreatePortalDirectory;
+  await next();
+}
+function shouldSkipCreatePortalDirectory(options) {
+  var _a;
+  return ((_a = options == null ? void 0 : options.context) == null ? void 0 : _a[SKIP_CREATE_PORTAL_DIRECTORY]) === true;
+}
+async function normalizeMultiPortalSlugValues(ctx, next) {
+  const values = getMultiPortalWriteValues(ctx);
+  const portalName = values == null ? void 0 : values.portalName;
+  if (portalName === void 0 || portalName === null) {
+    await next();
+    return;
+  }
+  if (typeof portalName !== "string") {
+    await next();
+    return;
+  }
+  const slug = portalName.trim();
+  if (!slug) {
+    await next();
+    return;
+  }
+  if (!MULTI_PORTAL_SLUG_PATTERN.test(slug)) {
+    ctx.throw(400, "Portal name can only contain lowercase letters, numbers, hyphens, and underscores");
+    return;
+  }
+  values.portalName = slug;
+  values.routePath = `/${slug}`;
+  await next();
+}
+async function ensureDefaultMultiPortals(db, options) {
+  const repository = db.getRepository("multiPortals");
+  const defaultPortal = getDefaultMultiPortalRecord();
+  const existing = await repository.findOne({
+    filterByTk: defaultPortal.uid,
+    fields: ["uid", "title", "icon", "portalType", "portalName", "routePath", "authCheck", "uiLayoutUid"],
+    transaction: options == null ? void 0 : options.transaction
+  });
+  if (!existing) {
+    await repository.create({
+      values: defaultPortal,
+      transaction: options == null ? void 0 : options.transaction
+    });
+    return;
+  }
+  const protectedValues = {
+    uid: defaultPortal.uid,
+    portalType: defaultPortal.portalType ?? null,
+    portalName: defaultPortal.portalName,
+    routePath: defaultPortal.routePath,
+    authCheck: defaultPortal.authCheck,
+    uiLayoutUid: getDefaultMultiPortalUiLayoutUid(defaultPortal)
+  };
+  const shouldRepair = Object.entries(protectedValues).some(([field, value]) => existing.get(field) !== value);
+  if (shouldRepair) {
+    await repository.update({
+      filterByTk: defaultPortal.uid,
+      values: protectedValues,
+      transaction: options == null ? void 0 : options.transaction
+    });
+  }
+}
+async function protectDefaultMultiPortalUpdate(ctx, next) {
+  var _a, _b, _c;
+  const defaultPortal = getDefaultMultiPortalRecordForUid((_a = ctx.action) == null ? void 0 : _a.params.filterByTk);
+  if (!defaultPortal) {
+    await next();
+    return;
+  }
+  const params = (_b = ctx.action) == null ? void 0 : _b.params;
+  const rawValues = isRecordLike(params == null ? void 0 : params.values) ? params.values : {};
+  const values = {
+    uid: defaultPortal.uid,
+    portalType: defaultPortal.portalType ?? null,
+    portalName: defaultPortal.portalName,
+    routePath: defaultPortal.routePath,
+    authCheck: defaultPortal.authCheck,
+    uiLayoutUid: getDefaultMultiPortalUiLayoutUid(defaultPortal)
+  };
+  if (Object.prototype.hasOwnProperty.call(rawValues, "title")) {
+    values.title = rawValues.title;
+  }
+  if (Object.prototype.hasOwnProperty.call(rawValues, "icon")) {
+    values.icon = rawValues.icon;
+  }
+  if (Object.prototype.hasOwnProperty.call(rawValues, "enabled")) {
+    values.enabled = rawValues.enabled;
+  }
+  (_c = ctx.action) == null ? void 0 : _c.mergeParams(
+    {
+      values
+    },
+    {
+      values: "overwrite"
+    }
+  );
+  await next();
+}
+async function preventUiLayoutRouteNameConflict(ctx, next) {
+  var _a;
+  if (isDefaultMultiPortalUid((_a = ctx.action) == null ? void 0 : _a.params.filterByTk)) {
+    await next();
+    return;
+  }
+  const portalName = getMultiPortalNameFromValues(ctx);
+  if (!portalName) {
+    await next();
+    return;
+  }
+  const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
+    filter: {
+      routeName: portalName
+    },
+    fields: ["uid"]
+  });
+  if (uiLayout) {
+    ctx.throw(400, "Portal route name conflicts with an existing UI layout");
+    return;
+  }
+  await next();
+}
+async function findRequestedMultiPortal(ctx) {
+  var _a;
+  const portalUid = getRequestedMultiPortalUid(ctx);
+  if (portalUid === void 0) {
+    return {
+      requested: false
+    };
+  }
+  const isExplicitPortalRequest = getExplicitRequestedLayoutUid((_a = ctx.action) == null ? void 0 : _a.params.portal) !== void 0;
+  if (!isExplicitPortalRequest) {
+    const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
+      filter: {
+        uid: portalUid
+      },
+      fields: ["uid"]
+    });
+    if (uiLayout) {
+      return {
+        requested: false
+      };
+    }
+  }
+  const portal = await ctx.db.getRepository("multiPortals").findOne({
+    filter: {
+      uid: portalUid
+    },
+    fields: ["uid", "uiLayoutUid", "enabled"]
+  });
+  if ((portal == null ? void 0 : portal.get("enabled")) === true) {
+    return {
+      portal,
+      requested: true
+    };
+  }
+  return {
+    requested: !!isExplicitPortalRequest || !!portal
+  };
+}
+function getDesktopRoutePortalFilter(multiPortalUid) {
+  return {
+    "multiPortals.uid": multiPortalUid
+  };
+}
+function isDesktopRouteCreateValue(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function hasDesktopRouteField(value, field) {
+  return !!value && Object.prototype.hasOwnProperty.call(value, field);
+}
+function pickExplicitDesktopRouteUiLayouts(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => pickExplicitDesktopRouteUiLayouts(item));
+  }
+  if (!isDesktopRouteCreateValue(value)) {
+    return;
+  }
+  const route = {};
+  if (hasDesktopRouteField(value, "uiLayouts")) {
+    route.uiLayouts = value.uiLayouts;
+  }
+  if (Array.isArray(value.children)) {
+    route.children = value.children.map((child) => pickExplicitDesktopRouteUiLayouts(child));
+  }
+  return route;
+}
+function withDesktopRouteMultiPortal(value, multiPortalUid, explicitValue = value) {
+  if (Array.isArray(value)) {
+    const explicitValues = Array.isArray(explicitValue) ? explicitValue : [];
+    return value.map((item, index) => withDesktopRouteMultiPortal(item, multiPortalUid, explicitValues[index]));
+  }
+  if (!isDesktopRouteCreateValue(value)) {
+    return value;
+  }
+  const explicitRoute = isDesktopRouteCreateValue(explicitValue) ? explicitValue : void 0;
+  const existingMultiPortals = Array.isArray(value.multiPortals) ? value.multiPortals.filter((uid) => typeof uid === "string" && !!uid) : [];
+  const { uiLayouts: _uiLayouts, children: _children, ...route } = value;
+  return {
+    ...route,
+    ...hasDesktopRouteField(explicitRoute, "uiLayouts") ? { uiLayouts: explicitRoute == null ? void 0 : explicitRoute.uiLayouts } : {},
+    multiPortals: Array.from(/* @__PURE__ */ new Set([...existingMultiPortals, multiPortalUid])),
+    ...Array.isArray(value.children) ? { children: withDesktopRouteMultiPortal(value.children, multiPortalUid, explicitRoute == null ? void 0 : explicitRoute.children) } : {}
+  };
+}
+async function captureExplicitDesktopRouteUiLayouts(ctx, next) {
+  var _a;
+  ctx[EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS] = pickExplicitDesktopRouteUiLayouts(
+    (_a = ctx.action) == null ? void 0 : _a.params.values
+  );
+  await next();
+}
+async function canAccessMultiPortal(ctx, multiPortalUid) {
+  const currentRoles = getCurrentRoles(ctx);
+  if (currentRoles.includes("root")) {
+    return true;
+  }
+  if (!currentRoles.length) {
+    return false;
+  }
+  const count = await ctx.db.getRepository("rolesMultiPortals").count({
+    filter: {
+      roleName: currentRoles,
+      multiPortalUid
+    }
+  });
+  return count > 0;
+}
+async function listCurrentRoleAccessibleMultiPortalUids(ctx) {
+  const currentRoles = getCurrentRoles(ctx);
+  if (currentRoles.includes("root")) {
+    return;
+  }
+  if (!currentRoles.length) {
+    return [];
+  }
+  const grants = await ctx.db.getRepository("rolesMultiPortals").find({
+    fields: ["multiPortalUid"],
+    filter: {
+      roleName: currentRoles
+    }
+  });
+  return Array.from(
+    new Set(
+      grants.map((grant) => grant.get("multiPortalUid")).filter((uid) => typeof uid === "string" && !!uid)
+    )
+  );
+}
+async function removeRouteIdsWithUnauthorizedAncestors(ctx, routeIds) {
+  if (routeIds.size === 0) {
+    return;
+  }
+  const parentIdByRouteId = /* @__PURE__ */ new Map();
+  let pendingRouteIds = new Set(routeIds);
+  while (pendingRouteIds.size > 0) {
+    const routes = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id", "parentId"],
+      filter: {
+        id: Array.from(pendingRouteIds)
+      }
+    });
+    pendingRouteIds = /* @__PURE__ */ new Set();
+    for (const route of routes) {
+      const routeId = route.get("id");
+      if (routeId === null || routeId === void 0) {
+        continue;
+      }
+      const normalizedRouteId = String(routeId);
+      const parentId = route.get("parentId");
+      const normalizedParentId = parentId === null || parentId === void 0 ? void 0 : String(parentId);
+      parentIdByRouteId.set(normalizedRouteId, normalizedParentId);
+      if (normalizedParentId && !parentIdByRouteId.has(normalizedParentId)) {
+        pendingRouteIds.add(normalizedParentId);
+      }
+    }
+  }
+  for (const routeId of Array.from(routeIds)) {
+    const visitedRouteIds = /* @__PURE__ */ new Set([routeId]);
+    let parentId = parentIdByRouteId.get(routeId);
+    while (parentId) {
+      if (!routeIds.has(parentId) || visitedRouteIds.has(parentId)) {
+        routeIds.delete(routeId);
+        break;
+      }
+      visitedRouteIds.add(parentId);
+      parentId = parentIdByRouteId.get(parentId);
+    }
+  }
+}
+async function getMultiPortalAccessibleRouteIds(ctx, multiPortalUid) {
+  const currentRoles = getCurrentRoles(ctx);
+  if (currentRoles.includes("root")) {
+    return;
+  }
+  if (!currentRoles.length) {
+    return /* @__PURE__ */ new Set();
+  }
+  const routePermissions = await ctx.db.getRepository("rolesMultiPortalDesktopRoutes").find({
+    fields: ["desktopRouteId"],
+    filter: {
+      roleName: currentRoles,
+      multiPortalUid
+    }
+  });
+  const routeIds = /* @__PURE__ */ new Set();
+  for (const permission of routePermissions) {
+    const routeId = permission.get("desktopRouteId");
+    if (routeId !== null && routeId !== void 0) {
+      routeIds.add(String(routeId));
+    }
+  }
+  if (routeIds.size === 0) {
+    return routeIds;
+  }
+  const portalRoutes = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      ...getDesktopRoutePortalFilter(multiPortalUid),
+      id: Array.from(routeIds)
+    }
+  });
+  const portalRouteIds = /* @__PURE__ */ new Set();
+  for (const route of portalRoutes) {
+    const routeId = route.get("id");
+    if (routeId !== null && routeId !== void 0) {
+      portalRouteIds.add(String(routeId));
+    }
+  }
+  await removeRouteIdsWithUnauthorizedAncestors(ctx, portalRouteIds);
+  return portalRouteIds;
+}
+function pickDesktopRouteRolePermissionTargetFields(route) {
+  const result = {};
+  for (const field of DESKTOP_ROUTE_ROLE_PERMISSION_TARGET_FIELDS) {
+    result[field] = getRecordField(route, field) ?? null;
+  }
+  const children = getRecordField(route, "children");
+  result.children = Array.isArray(children) ? children.map((child) => pickDesktopRouteRolePermissionTargetFields(child)) : [];
+  return result;
+}
+function setDesktopRouteChildren(route, children) {
+  if (!route || typeof route !== "object") {
+    return;
+  }
+  const maybeModel = route;
+  if (typeof maybeModel.setDataValue === "function") {
+    maybeModel.setDataValue("children", children);
+    return;
+  }
+  route.children = children;
+}
+function removeDesktopRoutesByIds(routes, routeIds) {
+  return routes.map((route) => {
+    const routeId = getRecordField(route, "id");
+    const normalizedRouteId = routeId === null || routeId === void 0 ? void 0 : String(routeId);
+    if (normalizedRouteId && routeIds.has(normalizedRouteId)) {
+      return null;
+    }
+    const children = getRecordField(route, "children");
+    if (Array.isArray(children)) {
+      setDesktopRouteChildren(route, removeDesktopRoutesByIds(children, routeIds));
+    }
+    return route;
+  }).filter((route) => route !== null);
+}
+async function getPortalOnlyDesktopRouteIds(ctx, routeIds) {
+  if (!routeIds.length) {
+    return /* @__PURE__ */ new Set();
+  }
+  const routes = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    appends: ["multiPortals", "uiLayouts"],
+    filter: {
+      id: uniqueDesktopRouteIds(routeIds)
+    }
+  });
+  const portalOnlyRouteIds = /* @__PURE__ */ new Set();
+  for (const route of routes) {
+    const multiPortals = route.get("multiPortals");
+    const uiLayouts = route.get("uiLayouts");
+    if (!Array.isArray(multiPortals) || multiPortals.length === 0) {
+      continue;
+    }
+    if (Array.isArray(uiLayouts) && uiLayouts.length > 0) {
+      continue;
+    }
+    const routeId = route.get("id");
+    if (routeId !== null && routeId !== void 0) {
+      portalOnlyRouteIds.add(String(routeId));
+    }
+  }
+  return portalOnlyRouteIds;
+}
+async function removeMultiPortalOwnedRoutesFromListResponse(ctx) {
+  if (!Array.isArray(ctx.body)) {
+    return;
+  }
+  const portalOnlyRouteIds = await getPortalOnlyDesktopRouteIds(ctx, collectDesktopRouteIds(ctx.body));
+  if (portalOnlyRouteIds.size === 0) {
+    return;
+  }
+  ctx.body = removeDesktopRoutesByIds(ctx.body, portalOnlyRouteIds);
+}
+async function removeMultiPortalOwnedRouteFromGetResponse(ctx) {
+  if (!ctx.body) {
+    return;
+  }
+  const routeIds = collectDesktopRouteIds(ctx.body);
+  const portalOnlyRouteIds = await getPortalOnlyDesktopRouteIds(ctx, routeIds);
+  if (portalOnlyRouteIds.size === 0) {
+    return;
+  }
+  ctx.status = 204;
+  ctx.body = void 0;
+}
+async function replaceListAccessibleRoutesWithPortalScopedRoutes(ctx, portalContext) {
+  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext.portalUid);
+  if (routeIds && routeIds.size === 0) {
+    ctx.body = [];
+    return;
+  }
+  ctx.body = await ctx.db.getRepository("desktopRoutes").find({
+    tree: true,
+    sort: "sort",
+    filter: {
+      ...getDesktopRoutePortalFilter(portalContext.portalUid),
+      ...routeIds ? { id: Array.from(routeIds) } : {}
+    }
+  });
+}
+async function replaceGetAccessibleRouteWithPortalScopedRoute(ctx, portalContext) {
+  var _a;
+  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext.portalUid);
+  if (routeIds && routeIds.size === 0) {
+    ctx.status = 204;
+    ctx.body = void 0;
+    return;
+  }
+  const route = await ctx.db.getRepository("desktopRoutes").findOne({
+    sort: "sort",
+    filterByTk: (_a = ctx.action) == null ? void 0 : _a.params.filterByTk,
+    filter: {
+      ...getDesktopRoutePortalFilter(portalContext.portalUid),
+      ...routeIds ? { id: Array.from(routeIds) } : {}
+    }
+  });
+  if (!route) {
+    ctx.status = 204;
+    ctx.body = void 0;
+    return;
+  }
+  ctx.status = 200;
+  ctx.body = route;
+}
+async function prepareAccessibleDesktopRoutesForMultiPortal(ctx) {
+  var _a;
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (!portalRequest.requested) {
+    return;
+  }
+  const portal = portalRequest.portal;
+  if (!portal) {
+    return null;
+  }
+  const portalUid = portal.get("uid");
+  const uiLayoutUid = portal.get("uiLayoutUid");
+  if (typeof portalUid !== "string" || !portalUid || typeof uiLayoutUid !== "string" || !uiLayoutUid) {
+    return null;
+  }
+  if (!await canAccessMultiPortal(ctx, portalUid)) {
+    return null;
+  }
+  if ((_a = ctx.action) == null ? void 0 : _a.params) {
+    ctx.action.params.layout = uiLayoutUid;
+  }
+  return {
+    portalUid,
+    uiLayoutUid
+  };
+}
+async function addMultiPortalListAccessibleGuard(ctx, next) {
+  const portalContext = await prepareAccessibleDesktopRoutesForMultiPortal(ctx);
+  if (portalContext === null) {
+    ctx.body = [];
+    return;
+  }
+  await next();
+  if (portalContext) {
+    await replaceListAccessibleRoutesWithPortalScopedRoutes(ctx, portalContext);
+    return;
+  }
+  await removeMultiPortalOwnedRoutesFromListResponse(ctx);
+}
+async function addMultiPortalGetAccessibleGuard(ctx, next) {
+  const portalContext = await prepareAccessibleDesktopRoutesForMultiPortal(ctx);
+  if (portalContext === null) {
+    ctx.status = 204;
+    ctx.body = void 0;
+    return;
+  }
+  await next();
+  if (portalContext) {
+    await replaceGetAccessibleRouteWithPortalScopedRoute(ctx, portalContext);
+    return;
+  }
+  await removeMultiPortalOwnedRouteFromGetResponse(ctx);
+}
+async function mapMultiPortalLayoutToUiLayoutForRolePermissionTargets(ctx, next) {
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (portalRequest.requested && !portalRequest.portal) {
+    ctx.status = 200;
+    ctx.body = [];
+    return;
+  }
+  const portal = portalRequest.portal;
+  const portalUid = portal == null ? void 0 : portal.get("uid");
+  if (typeof portalUid === "string" && portalUid) {
+    const routes = await ctx.db.getRepository("desktopRoutes").find({
+      tree: true,
+      sort: "sort",
+      filter: getDesktopRoutePortalFilter(portalUid),
+      fields: [...DESKTOP_ROUTE_ROLE_PERMISSION_TARGET_FIELDS]
+    });
+    ctx.status = 200;
+    ctx.body = routes.map((route) => pickDesktopRouteRolePermissionTargetFields(route));
+    return;
+  }
+  await next();
+  await removeMultiPortalOwnedRoutesFromListResponse(ctx);
+}
+async function addDesktopRouteCreateMultiPortal(ctx, next) {
+  var _a, _b;
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (portalRequest.requested && !portalRequest.portal) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
+  const portal = portalRequest.portal;
+  const portalUid = portal == null ? void 0 : portal.get("uid");
+  if (typeof portalUid === "string" && portalUid) {
+    const explicitValues = ctx[EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS];
+    (_b = ctx.action) == null ? void 0 : _b.mergeParams(
+      {
+        values: withDesktopRouteMultiPortal((_a = ctx.action) == null ? void 0 : _a.params.values, portalUid, explicitValues)
+      },
+      {
+        values: "overwrite"
+      }
+    );
+    await next();
+    const desktopRouteIds = collectDesktopRouteIds(ctx.body);
+    await removeLayoutRoutePermissionsFromPortalOnlyRoutes(ctx, desktopRouteIds);
+    await grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, portalUid, desktopRouteIds);
+    return;
+  }
+  await next();
+}
+async function listEnabledMultiPortals(ctx, next) {
+  const records = await ctx.db.getRepository("multiPortals").find({
+    filter: withCustomMultiPortalFilter({
+      enabled: true,
+      "uiLayout.enabled": true
+    }),
+    fields: [...MULTI_PORTAL_RUNTIME_QUERY_FIELDS],
+    appends: ["uiLayout"],
+    sort: ["uid"]
+  });
+  ctx.body = records.map((record) => pickMultiPortalRuntimeFields(record));
+  await next();
+}
+async function listAccessibleMultiPortals(ctx, next) {
+  const accessiblePortalUids = await listCurrentRoleAccessibleMultiPortalUids(ctx);
+  if (Array.isArray(accessiblePortalUids) && accessiblePortalUids.length === 0) {
+    ctx.body = [];
+    await next();
+    return;
+  }
+  const filter = {
+    enabled: true,
+    "uiLayout.enabled": true
+  };
+  if (Array.isArray(accessiblePortalUids)) {
+    filter.uid = accessiblePortalUids;
+  }
+  const records = await ctx.db.getRepository("multiPortals").find({
+    filter: withCustomMultiPortalFilter(filter),
+    fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
+    appends: ["uiLayout"],
+    sort: ["uid"]
+  });
+  ctx.body = records.map((record) => pickMultiPortalAccessibleFields(record));
+  await next();
+}
+async function grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, multiPortalUid, desktopRouteIds) {
+  if (!desktopRouteIds.length) {
+    return;
+  }
+  if (!ctx.db.getCollection("rolesMultiPortalRoutePolicies") || !ctx.db.getCollection("rolesMultiPortalDesktopRoutes")) {
+    return;
+  }
+  const routePolicies = await ctx.db.getRepository("rolesMultiPortalRoutePolicies").find({
+    fields: ["roleName"],
+    filter: {
+      multiPortalUid,
+      allowNewMenu: true
+    }
+  });
+  const roleNames = routePolicies.map((routePolicy) => routePolicy.get("roleName")).filter((roleName) => typeof roleName === "string" && !!roleName);
+  if (!roleNames.length) {
+    return;
+  }
+  const routePermissionRepository = ctx.db.getRepository("rolesMultiPortalDesktopRoutes");
+  for (const roleName of roleNames) {
+    for (const desktopRouteId of desktopRouteIds) {
+      await routePermissionRepository.firstOrCreate({
+        filterKeys: ["roleName", "multiPortalUid", "desktopRouteId"],
+        values: {
+          roleName,
+          multiPortalUid,
+          desktopRouteId
+        },
+        context: ctx
+      });
+    }
+  }
+}
+async function removeLayoutRoutePermissionsFromPortalOnlyRoutes(ctx, desktopRouteIds) {
+  if (!desktopRouteIds.length || !ctx.db.getCollection("rolesDesktopRoutes")) {
+    return;
+  }
+  const portalOnlyRouteIds = await getPortalOnlyDesktopRouteIds(ctx, desktopRouteIds);
+  if (portalOnlyRouteIds.size === 0) {
+    return;
+  }
+  await ctx.db.getRepository("rolesDesktopRoutes").destroy({
+    filter: {
+      desktopRouteId: Array.from(portalOnlyRouteIds)
+    },
+    context: ctx
+  });
+}
+async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
+  if (multiPortal.get("enabled") !== true) {
+    return;
+  }
+  const multiPortalUid = multiPortal.get("uid");
+  if (typeof multiPortalUid !== "string" || !multiPortalUid) {
+    return;
+  }
+  if (isDefaultMultiPortalUid(multiPortalUid)) {
+    return;
+  }
+  if (!db.getCollection("roles") || !db.getCollection("rolesMultiPortals")) {
+    return;
+  }
+  const roles = await db.getRepository("roles").find({
+    fields: ["name"],
+    filter: {
+      allowNewMultiPortal: true
+    },
+    transaction: options == null ? void 0 : options.transaction
+  });
+  const roleNames = roles.map((role) => role.get("name")).filter((roleName) => typeof roleName === "string" && !!roleName);
+  const records = roleNames.map((roleName) => ({
+    roleName,
+    multiPortalUid
+  }));
+  const routePolicyRecords = roleNames.map((roleName) => ({
+    roleName,
+    multiPortalUid,
+    allowNewMenu: true
+  }));
+  if (!records.length) {
+    return;
+  }
+  const repository = db.getRepository("rolesMultiPortals");
+  for (const values of records) {
+    await repository.firstOrCreate({
+      filterKeys: ["roleName", "multiPortalUid"],
+      values,
+      transaction: options == null ? void 0 : options.transaction
+    });
+  }
+  if (!db.getCollection("rolesMultiPortalRoutePolicies")) {
+    return;
+  }
+  const routePolicyRepository = db.getRepository("rolesMultiPortalRoutePolicies");
+  for (const values of routePolicyRecords) {
+    await routePolicyRepository.firstOrCreate({
+      filterKeys: ["roleName", "multiPortalUid"],
+      values,
+      transaction: options == null ? void 0 : options.transaction
+    });
+  }
+}
+class PluginMultiPortalServer extends import_server.Plugin {
+  portalStorageTaskKeys = /* @__PURE__ */ new Set();
+  portalStorageTasks = /* @__PURE__ */ new Map();
+  async afterAdd() {
+  }
+  getAppName() {
+    return this.app.name || MAIN_APP_NAME;
+  }
+  getMultiPortalStorageItem(multiPortal, previous = false) {
+    const record = multiPortal;
+    const readField = (field) => previous && typeof record.previous === "function" ? record.previous(field) : getRecordField(record, field);
+    const portalType = readField("portalType");
+    if (portalType !== "ai") {
+      return null;
+    }
+    const portalName = normalizePortalStorageName(readField("portalName"));
+    if (!portalName || !isValidPortalStorageName(portalName)) {
+      return null;
+    }
+    return {
+      appName: this.getAppName(),
+      portalName,
+      enabled: readField("enabled") === true
+    };
+  }
+  warnPortalStorageSyncFailed(error) {
+    var _a, _b;
+    (_b = (_a = this.app.logger) == null ? void 0 : _a.warn) == null ? void 0 : _b.call(_a, "failed to sync multi-portal storage portal", {
+      appName: this.getAppName(),
+      error
+    });
+  }
+  getPortalStorageTaskKey(item) {
+    return `${item.appName}/${item.portalName}`;
+  }
+  async runPortalStorageTask(task, options) {
+    var _a;
+    const run = async () => {
+      try {
+        await task();
+      } catch (error) {
+        this.warnPortalStorageSyncFailed(error);
+      }
+    };
+    if ((_a = options == null ? void 0 : options.transaction) == null ? void 0 : _a.afterCommit) {
+      options.transaction.afterCommit(() => run());
+      return;
+    }
+    await run();
+  }
+  async removePortalStorageDist(item) {
+    await import_fs.default.promises.rm((0, import_utils.storagePathJoin)("portals", item.appName, item.portalName, "dist"), {
+      force: true,
+      recursive: true
+    });
+  }
+  waitForPortalStorageTasks() {
+    const tasks = [...this.portalStorageTasks.values()];
+    if (!tasks.length) {
+      return Promise.resolve();
+    }
+    return Promise.allSettled(tasks).then(() => void 0);
+  }
+  async schedulePortalTemplateCopyAndBuild(item, template, portalDir) {
+    var _a;
+    const taskKey = this.getPortalStorageTaskKey(item);
+    if (this.portalStorageTaskKeys.has(taskKey)) {
+      await ((_a = template.cleanup) == null ? void 0 : _a.call(template));
+      return;
+    }
+    this.portalStorageTaskKeys.add(taskKey);
+    const task = (async () => {
+      var _a2;
+      const logPath = getPortalStorageLogPath(item);
+      try {
+        await appendPortalStorageLog(
+          logPath,
+          `Portal storage create task started for ${item.appName}/${item.portalName}.`
+        );
+        if (!await pathExists(portalDir)) {
+          await appendPortalStorageLog(
+            logPath,
+            `Copying default portal template from ${template.dir} to ${portalDir}.`
+          );
+          await copyPortalTemplate(template.dir, portalDir);
+          await appendPortalStorageLog(logPath, `Default portal template copied to ${portalDir}.`);
+        }
+        if (item.enabled) {
+          await buildPortalStorageItem(portalDir, item);
+          return;
+        }
+        await this.removePortalStorageDist(item);
+        await appendPortalStorageLog(logPath, `Portal dist directory removed for ${item.appName}/${item.portalName}.`);
+      } catch (error) {
+        await appendPortalStorageLog(
+          logPath,
+          `Portal storage create task failed for ${item.appName}/${item.portalName}.`
+        );
+        this.warnPortalStorageSyncFailed(error);
+      } finally {
+        await ((_a2 = template.cleanup) == null ? void 0 : _a2.call(template));
+        this.portalStorageTaskKeys.delete(taskKey);
+        this.portalStorageTasks.delete(taskKey);
+      }
+    })();
+    this.portalStorageTasks.set(taskKey, task);
+    await task;
+  }
+  async ensurePortalStorageItem(item) {
+    const portalDir = (0, import_utils.storagePathJoin)("portals", item.appName, item.portalName);
+    const portalIndex = import_path.default.join(portalDir, "dist", "index.html");
+    if (!await pathExists(portalDir)) {
+      const template = await resolvePortalTemplate(getInitPortalTemplate(), getPortalStorageLogPath(item));
+      await this.schedulePortalTemplateCopyAndBuild(item, template, portalDir);
+      return;
+    }
+    if (item.enabled) {
+      if (!await pathExists(portalIndex)) {
+        await buildPortalStorageItem(portalDir, item);
+      }
+      return;
+    }
+    await this.removePortalStorageDist(item);
+  }
+  async syncMultiPortalStorageItem(multiPortal, options, syncPrevious = false) {
+    const currentItem = this.getMultiPortalStorageItem(multiPortal);
+    const previousItem = syncPrevious ? this.getMultiPortalStorageItem(multiPortal, true) : null;
+    await this.runPortalStorageTask(async () => {
+      if (previousItem && (!currentItem || previousItem.appName !== currentItem.appName || previousItem.portalName !== currentItem.portalName || !currentItem.enabled)) {
+        await this.removePortalStorageDist(previousItem);
+      }
+      if (currentItem) {
+        await this.ensurePortalStorageItem(currentItem);
+      }
+    }, options);
+  }
+  async removeMultiPortalStorageItem(multiPortal, options) {
+    const item = this.getMultiPortalStorageItem(multiPortal);
+    if (!item) {
+      return;
+    }
+    await this.runPortalStorageTask(async () => {
+      const logPath = getPortalStorageLogPath(item);
+      await appendPortalStorageLog(
+        logPath,
+        `Portal storage delete task started for ${item.appName}/${item.portalName}.`
+      );
+      await import_fs.default.promises.rm((0, import_utils.storagePathJoin)("portals", item.appName, item.portalName), { force: true, recursive: true });
+      await appendPortalStorageLog(logPath, `Portal storage directory deleted for ${item.appName}/${item.portalName}.`);
+    }, options);
+  }
+  async getMultiPortalLog(ctx, next) {
+    const filterByTk = ctx.action.params.filterByTk;
+    if (typeof filterByTk !== "string" || !filterByTk) {
+      ctx.throw(400, "filterByTk is required");
+      return;
+    }
+    const multiPortal = await this.db.getRepository("multiPortals").findOne({
+      filterByTk,
+      fields: ["uid", "portalType", "portalName", "enabled"]
+    });
+    const item = multiPortal ? this.getMultiPortalStorageItem(multiPortal) : null;
+    if (!item) {
+      ctx.throw(404, "Portal log is only available for AI portals");
+      return;
+    }
+    const logPath = getPortalStorageLogPath(item);
+    const content = await pathExists(logPath) ? await import_fs.default.promises.readFile(logPath, "utf-8") : "";
+    ctx.body = {
+      content,
+      path: getPortalStorageLogRelativePath(item)
+    };
+    await next();
+  }
+  async deployPortalDist(ctx, next) {
+    var _a, _b, _c, _d;
+    const deployCtx = ctx;
+    const appName = normalizePortalStorageName(((_a = deployCtx.request.body) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
+    const portalName = normalizePortalStorageName((_b = deployCtx.request.body) == null ? void 0 : _b.portal);
+    const basePath = trimString((_c = deployCtx.request.body) == null ? void 0 : _c.basePath);
+    const filePath = trimString((_d = deployCtx.request.file) == null ? void 0 : _d.path);
+    try {
+      if (!isValidPortalDeploySegment(appName)) {
+        throw new Error("Invalid app");
+      }
+      if (!portalName || !isValidPortalDeploySegment(portalName)) {
+        throw new Error("Invalid portal");
+      }
+      if (!basePath) {
+        throw new Error("basePath is required");
+      }
+      if (!filePath || !await pathExists(filePath)) {
+        throw new Error("file is required");
+      }
+      validatePortalDeployBasePath(appName, portalName, basePath);
+      const distPath = await replacePortalDistFromArchive({
+        filePath,
+        appName,
+        portalName
+      });
+      ctx.body = {
+        status: "ok",
+        app: appName,
+        portal: portalName,
+        basePath: resolvePortalStoragePublicPath(basePath),
+        distPath,
+        deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await next();
+    } catch (error) {
+      if (filePath) {
+        await import_fs.default.promises.rm(filePath, { force: true });
+      }
+      ctx.throw(400, error instanceof Error ? error.message : String(error));
+    }
+  }
+  async pullPortalSource(ctx, next) {
+    var _a, _b;
+    const appName = normalizePortalStorageName(((_a = ctx.action.params.values) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
+    const portalName = normalizePortalStorageName((_b = ctx.action.params.values) == null ? void 0 : _b.portal);
+    try {
+      if (!isValidPortalDeploySegment(appName)) {
+        throw new Error("Invalid app");
+      }
+      if (!portalName || !isValidPortalDeploySegment(portalName)) {
+        throw new Error("Invalid portal");
+      }
+      const archivePath = await packPortalSource({ appName, portalName });
+      ctx.attachment(`${portalName}-source.tar.gz`);
+      ctx.body = import_fs.default.createReadStream(archivePath);
+      ctx.res.once("finish", () => {
+        import_fs.default.promises.rm(archivePath, { force: true });
+      });
+      await next();
+    } catch (error) {
+      ctx.throw(400, error instanceof Error ? error.message : String(error));
+    }
+  }
+  async pushPortalSource(ctx, next) {
+    var _a, _b, _c;
+    const sourceCtx = ctx;
+    const appName = normalizePortalStorageName(((_a = sourceCtx.request.body) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
+    const portalName = normalizePortalStorageName((_b = sourceCtx.request.body) == null ? void 0 : _b.portal);
+    const filePath = trimString((_c = sourceCtx.request.file) == null ? void 0 : _c.path);
+    try {
+      if (!isValidPortalDeploySegment(appName)) {
+        throw new Error("Invalid app");
+      }
+      if (!portalName || !isValidPortalDeploySegment(portalName)) {
+        throw new Error("Invalid portal");
+      }
+      if (!filePath || !await pathExists(filePath)) {
+        throw new Error("file is required");
+      }
+      const sourcePath = await replacePortalSourceFromArchive({
+        filePath,
+        appName,
+        portalName
+      });
+      const sourceRevision = (/* @__PURE__ */ new Date()).toISOString();
+      const repository = this.db.getRepository("multiPortals");
+      const multiPortal = await repository.findOne({
+        filterByTk: portalName,
+        fields: ["uid", "options"]
+      });
+      const currentOptions = multiPortal ? getRecordField(multiPortal, "options") : void 0;
+      const options = currentOptions && typeof currentOptions === "object" && !Array.isArray(currentOptions) ? { ...currentOptions } : {};
+      await this.db.getRepository("multiPortals").update({
+        filterByTk: portalName,
+        values: {
+          options: {
+            ...options,
+            sourceStorage: "nocobase",
+            sourceRevision,
+            sourceUpdatedAt: sourceRevision
+          }
+        }
+      });
+      ctx.body = {
+        status: "ok",
+        app: appName,
+        portal: portalName,
+        sourcePath,
+        sourceRevision
+      };
+      await next();
+    } catch (error) {
+      if (filePath) {
+        await import_fs.default.promises.rm(filePath, { force: true });
+      }
+      ctx.throw(400, error instanceof Error ? error.message : String(error));
+    }
+  }
+  async listAppPortalManifest(options) {
+    const records = await this.db.getRepository("multiPortals").find({
+      filter: withCustomMultiPortalFilter({
+        enabled: true,
+        "uiLayout.enabled": true
+      }),
+      fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
+      appends: ["uiLayout"],
+      sort: ["uid"],
+      transaction: options == null ? void 0 : options.transaction
+    });
+    return records.map((record) => {
+      const portal = pickMultiPortalAccessibleFields(record);
+      const uiLayout = portal.uiLayout;
+      const uid = typeof portal.uid === "string" ? portal.uid : "";
+      const title = typeof portal.title === "string" ? portal.title : "";
+      return {
+        uid,
+        title,
+        icon: typeof portal.icon === "string" ? portal.icon : null,
+        portalType: typeof portal.portalType === "string" ? portal.portalType : null,
+        routePath: String(portal.routePath || ""),
+        layout: typeof (uiLayout == null ? void 0 : uiLayout.layoutType) === "string" ? uiLayout.layoutType : null
+      };
+    });
+  }
+  async getUiLayout(uid, options) {
+    if (typeof uid !== "string" || !uid) {
+      return null;
+    }
+    return this.db.getRepository("uiLayouts").findOne({
+      filterByTk: uid,
+      transaction: options == null ? void 0 : options.transaction
+    });
+  }
+  async toAppPortalManifestItem(multiPortal, options) {
+    const uid = getRecordField(multiPortal, "uid");
+    const title = getRecordField(multiPortal, "title");
+    const portalType = getRecordField(multiPortal, "portalType");
+    const routePath = getRecordField(multiPortal, "routePath");
+    const enabled = getRecordField(multiPortal, "enabled");
+    if (typeof uid !== "string" || !uid || isDefaultMultiPortalUid(uid) || typeof title !== "string" || typeof routePath !== "string" || !routePath || enabled !== true) {
+      return null;
+    }
+    const uiLayoutUid = getRecordField(multiPortal, "uiLayoutUid");
+    const uiLayout = getRecordField(multiPortal, "uiLayout") || await this.getUiLayout(uiLayoutUid, options);
+    if (!uiLayout || getRecordField(uiLayout, "enabled") !== true) {
+      return null;
+    }
+    const icon = getRecordField(multiPortal, "icon");
+    const layoutType = getRecordField(uiLayout, "layoutType");
+    return {
+      uid,
+      title,
+      icon: typeof icon === "string" ? icon : null,
+      portalType: typeof portalType === "string" ? portalType : null,
+      routePath,
+      layout: typeof layoutType === "string" ? layoutType : null
+    };
+  }
+  async setAppManifestItem(item, options) {
+    var _a, _b;
+    try {
+      await import_server.AppSupervisor.getInstance().setAppManifestItem(
+        this.getAppName(),
+        MULTI_PORTAL_MANIFEST_NAMESPACE,
+        item.uid,
+        item
+      );
+      await this.notifyAppManifestChanged({ action: "set", itemKey: item.uid }, options);
+    } catch (error) {
+      (_b = (_a = this.app.logger) == null ? void 0 : _a.warn) == null ? void 0 : _b.call(_a, "failed to set multi-portal app manifest item", {
+        appName: this.getAppName(),
+        itemKey: item.uid,
+        error
+      });
+    }
+  }
+  async removeAppManifestItem(itemKey, options) {
+    var _a, _b;
+    try {
+      await import_server.AppSupervisor.getInstance().removeAppManifestItem(
+        this.getAppName(),
+        MULTI_PORTAL_MANIFEST_NAMESPACE,
+        itemKey
+      );
+      await this.notifyAppManifestChanged({ action: "remove", itemKey }, options);
+    } catch (error) {
+      (_b = (_a = this.app.logger) == null ? void 0 : _a.warn) == null ? void 0 : _b.call(_a, "failed to remove multi-portal app manifest item", {
+        appName: this.getAppName(),
+        itemKey,
+        error
+      });
+    }
+  }
+  async publishAppManifestItem(multiPortal, options) {
+    const uid = getRecordField(multiPortal, "uid");
+    if (typeof uid !== "string" || !uid) {
+      return;
+    }
+    const item = await this.toAppPortalManifestItem(multiPortal, options);
+    if (item) {
+      await this.setAppManifestItem(item, options);
+      return;
+    }
+    await this.removeAppManifestItem(uid, options);
+  }
+  async publishUiLayoutManifestItems(uiLayout, options) {
+    const uiLayoutUid = getRecordField(uiLayout, "uid");
+    if (typeof uiLayoutUid !== "string" || !uiLayoutUid) {
+      return;
+    }
+    const records = await this.db.getRepository("multiPortals").find({
+      filter: withCustomMultiPortalFilter({
+        uiLayoutUid
+      }),
+      fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
+      transaction: options == null ? void 0 : options.transaction
+    });
+    for (const record of records) {
+      record.set("uiLayout", uiLayout);
+      await this.publishAppManifestItem(record, options);
+    }
+  }
+  async reconcilePortalStorage(options) {
+    const records = await this.db.getRepository("multiPortals").find({
+      filter: {
+        portalType: "ai"
+      },
+      fields: ["uid", "portalType", "portalName", "enabled"],
+      transaction: options == null ? void 0 : options.transaction
+    });
+    for (const record of records) {
+      await this.syncMultiPortalStorageItem(record, options);
+    }
+  }
+  async reconcileAppManifest(options) {
+    await this.removeAppManifest();
+    for (const item of await this.listAppPortalManifest(options)) {
+      await this.setAppManifestItem(item, options);
+    }
+  }
+  async removeAppManifest() {
+    var _a, _b;
+    try {
+      await import_server.AppSupervisor.getInstance().removeAppManifest(this.getAppName(), MULTI_PORTAL_MANIFEST_NAMESPACE);
+      await this.notifyAppManifestChanged({ action: "clear" });
+    } catch (error) {
+      (_b = (_a = this.app.logger) == null ? void 0 : _a.warn) == null ? void 0 : _b.call(_a, "failed to remove multi-portal app manifest", {
+        appName: this.getAppName(),
+        error
+      });
+    }
+  }
+  async notifyAppManifestChanged(message, options) {
+    var _a;
+    const syncMessage = {
+      type: MULTI_PORTAL_MANIFEST_SYNC_MESSAGE_TYPE,
+      appName: this.getAppName(),
+      namespace: MULTI_PORTAL_MANIFEST_NAMESPACE,
+      ...message
+    };
+    if ((_a = options == null ? void 0 : options.transaction) == null ? void 0 : _a.afterCommit) {
+      options.transaction.afterCommit(() => this.sendSyncMessage(syncMessage));
+      return;
+    }
+    await this.sendSyncMessage(syncMessage);
+  }
+  async handleSyncMessage(message) {
+    if (isRecordLike(message) && message.type === MULTI_PORTAL_MANIFEST_SYNC_MESSAGE_TYPE && message.namespace === MULTI_PORTAL_MANIFEST_NAMESPACE) {
+      this.app.emit(MULTI_PORTAL_MANIFEST_SYNC_MESSAGE_TYPE, message);
+    }
+  }
+  async beforeLoad() {
+    this.app.resourceManager.registerPreActionHandler(
+      "desktopRoutes:listAccessible",
+      addMultiPortalListAccessibleGuard
+    );
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:getAccessible", addMultiPortalGetAccessibleGuard);
+    this.app.resourceManager.registerPreActionHandler(
+      "desktopRoutes:listRolePermissionTargets",
+      mapMultiPortalLayoutToUiLayoutForRolePermissionTargets
+    );
+    this.app.resourceManager.registerPreActionHandler("multiPortals:create", captureSkipCreatePortalDirectory);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:create", normalizeMultiPortalSlugValues);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:create", preventUiLayoutRouteNameConflict);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:update", protectDefaultMultiPortalUpdate);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:update", normalizeMultiPortalSlugValues);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:update", preventUiLayoutRouteNameConflict);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", captureSkipCreatePortalDirectory);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", normalizeMultiPortalSlugValues);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", preventUiLayoutRouteNameConflict);
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:create", captureExplicitDesktopRouteUiLayouts, {
+      before: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
+    });
+    this.app.resourceManager.registerPreActionHandler(
+      "desktopRoutes:updateOrCreate",
+      captureExplicitDesktopRouteUiLayouts,
+      {
+        before: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
+      }
+    );
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:create", addDesktopRouteCreateMultiPortal, {
+      after: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
+    });
+    this.app.resourceManager.registerPreActionHandler(
+      "desktopRoutes:updateOrCreate",
+      addDesktopRouteCreateMultiPortal,
+      {
+        after: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
+      }
+    );
+  }
+  async load() {
+    this.app.acl.registerSnippet({
+      name: "pm.multi-portal",
+      actions: MULTI_PORTAL_MANAGEMENT_ACTIONS
+    });
+    this.app.acl.registerSnippet({
+      name: "pm.acl.roles",
+      actions: ROLE_MULTI_PORTAL_PERMISSION_ACTIONS
+    });
+    this.app.acl.allow("multiPortals", "listEnabled", "public");
+    this.app.acl.allow("multiPortals", "listAccessible", "loggedIn");
+    this.app.resourceManager.use(createPortalDeployUploadMiddleware(), {
+      tag: "multiPortalDeployUpload",
+      after: "acl"
+    });
+    this.app.resourceManager.registerActionHandler("multiPortals:listEnabled", listEnabledMultiPortals);
+    this.app.resourceManager.registerActionHandler("multiPortals:listAccessible", listAccessibleMultiPortals);
+    this.app.resourceManager.registerActionHandler("multiPortals:deploy", async (ctx, next) => {
+      await this.deployPortalDist(ctx, next);
+    });
+    this.app.resourceManager.registerActionHandler("multiPortals:pullSource", async (ctx, next) => {
+      await this.pullPortalSource(ctx, next);
+    });
+    this.app.resourceManager.registerActionHandler("multiPortals:pushSource", async (ctx, next) => {
+      await this.pushPortalSource(ctx, next);
+    });
+    this.app.resourceManager.registerActionHandler("multiPortals:getLog", async (ctx, next) => {
+      await this.getMultiPortalLog(ctx, next);
+    });
+    this.app.on("afterStart", async () => {
+      await this.reconcileAppManifest();
+      await this.reconcilePortalStorage();
+    });
+    this.app.on("beforeDestroy", async () => {
+      await this.waitForPortalStorageTasks();
+    });
+    this.app.db.on("roles.beforeCreate", (role) => {
+      (0, import_ensureDefaultRoleMultiPortalAccess.applyDefaultRoleMultiPortalAccess)(role);
+    });
+    this.app.db.on("multiPortals.afterCreate", async (multiPortal, options) => {
+      await grantDefaultAccessToNewMultiPortal(this.app.db, multiPortal, options);
+      await this.publishAppManifestItem(multiPortal, options);
+      if (shouldSkipCreatePortalDirectory(options)) {
+        return;
+      }
+      await this.syncMultiPortalStorageItem(multiPortal, options);
+    });
+    this.app.db.on("multiPortals.afterUpdate", async (multiPortal, options) => {
+      await this.publishAppManifestItem(multiPortal, options);
+      await this.syncMultiPortalStorageItem(multiPortal, options, true);
+    });
+    this.app.db.on("multiPortals.afterDestroy", async (multiPortal, options) => {
+      const uid = getRecordField(multiPortal, "uid");
+      if (typeof uid === "string" && uid) {
+        await this.removeAppManifestItem(uid, options);
+      }
+      await this.removeMultiPortalStorageItem(multiPortal, options);
+    });
+    this.app.db.on("uiLayouts.afterUpdate", async (uiLayout, options) => {
+      await this.publishUiLayoutManifestItems(uiLayout, options);
+    });
+  }
+  async install() {
+    await ensureDefaultMultiPortals(this.db);
+    await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);
+    await this.reconcilePortalStorage();
+    await this.reconcileAppManifest();
+  }
+  async afterEnable() {
+    await ensureDefaultMultiPortals(this.db);
+    await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);
+    await this.reconcilePortalStorage();
+    await this.reconcileAppManifest();
+  }
+  async afterDisable() {
+    await this.removeAppManifest();
+  }
+  async remove() {
+    await this.removeAppManifest();
+  }
+  static async staticImport() {
+    await (0, import_server.appendToBuiltInPlugins)("@nocobase/plugin-multi-portal");
+  }
+}
+var plugin_default = PluginMultiPortalServer;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PluginMultiPortalServer
+});