@nocobase/plugin-multi-portal 2.2.0-alpha.11 → 2.4.0-alpha.1

package/dist/server/plugin.js

@@ -41,6 +41,7 @@ __export(plugin_exports, {
 });
 module.exports = __toCommonJS(plugin_exports);
 var import_server = require("@nocobase/server");
+var import_database = require("@nocobase/database");
 var import_utils = require("@nocobase/utils");
 var import_child_process = require("child_process");
 var import_fs = __toESM(require("fs"));
@@ -51,6 +52,7 @@ var import_promises = require("stream/promises");
 var tar = __toESM(require("tar"));
 var import_zlib = require("zlib");
 var import_ensureDefaultRoleMultiPortalAccess = require("./ensureDefaultRoleMultiPortalAccess");
+var import_constants = require("../constants");
 const MULTI_PORTAL_RUNTIME_FIELDS = [
   "uid",
   "title",
@@ -58,9 +60,9 @@ const MULTI_PORTAL_RUNTIME_FIELDS = [
   "portalName",
   "routePath",
   "authCheck",
-  "enabled"
+  "enabled",
+  "uiLayoutUid"
 ];
-const MULTI_PORTAL_RUNTIME_QUERY_FIELDS = [...MULTI_PORTAL_RUNTIME_FIELDS, "uiLayoutUid"];
 const MULTI_PORTAL_ACCESSIBLE_FIELDS = [
   "uid",
   "title",
@@ -69,18 +71,15 @@ const MULTI_PORTAL_ACCESSIBLE_FIELDS = [
   "portalName",
   "routePath",
   "authCheck",
-  "enabled"
+  "enabled",
+  "uiLayoutUid"
 ];
-const MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS = [...MULTI_PORTAL_ACCESSIBLE_FIELDS, "uiLayoutUid"];
-const MULTI_PORTAL_UI_LAYOUT_RUNTIME_FIELDS = ["layoutType"];
 const DESKTOP_ROUTE_ROLE_PERMISSION_TARGET_FIELDS = ["id", "title", "hidden", "parentId", "options"];
 const UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG = "plugin-ui-layout:desktop-route-write-layout";
 const MAIN_APP_NAME = "main";
 const UNION_ROLE_KEY = "__union__";
 const MULTI_PORTAL_MANIFEST_NAMESPACE = "multi-portal";
 const MULTI_PORTAL_MANIFEST_SYNC_MESSAGE_TYPE = "multi-portal:app-manifest-changed";
-const DEFAULT_INIT_PORTAL_TYPE = "no-code";
-const DEFAULT_INIT_PORTAL_NAME = "admin";
 const DEFAULT_INIT_PORTAL_TEMPLATE = "@nocobase/portal-template-default";
 const PORTAL_CLIENT_PREFIX = "x";
 const PORTAL_DEPLOY_UPLOAD_LIMIT = 200 * 1024 * 1024;
@@ -90,9 +89,9 @@ const PORTAL_PUBLIC_FILE_MODE = 420;
 const PORTAL_TEMPLATE_NPM_PACK_TIMEOUT_MS = 3e4;
 const DEFAULT_MULTI_PORTAL_UID = "__default_portal__";
 const MULTI_PORTAL_SLUG_PATTERN = /^[a-z0-9_-]+$/;
-const INIT_PORTAL_TYPES = ["no-code", "ai"];
-const DEFAULT_MULTI_PORTAL_UIDS = [DEFAULT_MULTI_PORTAL_UID];
-const DEFAULT_MULTI_PORTAL_UID_SET = new Set(DEFAULT_MULTI_PORTAL_UIDS);
+const PORTAL_ACCESS_DENIED_CODE = "PORTAL_ACCESS_DENIED";
+const PORTAL_CONTEXT_INVALID_CODE = "PORTAL_CONTEXT_INVALID";
+const PORTAL_NOT_FOUND_CODE = "PORTAL_NOT_FOUND";
 const MULTI_PORTAL_MANAGEMENT_ACTIONS = [
   "multiPortals:list",
   "multiPortals:get",
@@ -100,17 +99,31 @@ const MULTI_PORTAL_MANAGEMENT_ACTIONS = [
   "multiPortals:create",
   "multiPortals:update",
   "multiPortals:firstOrCreate",
+  "multiPortals:setDefault",
   "multiPortals:destroy",
   "multiPortals:deploy",
   "multiPortals:pullSource",
-  "multiPortals:pushSource"
+  "multiPortals:pushSource",
+  "desktopRoutes:list",
+  "desktopRoutes:get",
+  "desktopRoutes:create",
+  "desktopRoutes:update",
+  "desktopRoutes:move",
+  "desktopRoutes:destroy",
+  "desktopRoutes:updateOrCreate",
+  "registry:list",
+  "registry:get"
 ];
 const ROLE_MULTI_PORTAL_PERMISSION_ACTIONS = [
   "roles.multiPortals:*",
   "rolesMultiPortalDesktopRoutes:*",
   "rolesMultiPortalRoutePolicies:*"
 ];
-const EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS = Symbol("explicitDesktopRouteUiLayouts");
+const MULTI_PORTAL_SEED_TYPES = ["no-code", "ai"];
+const MULTI_PORTAL_SEED_TYPE_SET = new Set(MULTI_PORTAL_SEED_TYPES);
+function isMultiPortalSeedType(value) {
+  return typeof value === "string" && MULTI_PORTAL_SEED_TYPE_SET.has(value);
+}
 const SKIP_CREATE_PORTAL_DIRECTORY = Symbol("skipCreatePortalDirectory");
 function getRecordField(record, field) {
   if (!record || typeof record !== "object") {
@@ -136,44 +149,58 @@ async function pathExists(filePath) {
 function trimString(value) {
   return String(value ?? "").trim();
 }
-function isInitPortalType(value) {
-  return INIT_PORTAL_TYPES.includes(value);
-}
-function getInitPortalType() {
-  const portalType = trimString(process.env.INIT_PORTAL_TYPE) || DEFAULT_INIT_PORTAL_TYPE;
-  if (!isInitPortalType(portalType)) {
-    throw new Error('INIT_PORTAL_TYPE must be either "no-code" or "ai".');
-  }
-  return portalType;
-}
-function getInitPortalName() {
-  const portalName = trimString(process.env.INIT_PORTAL_NAME) || DEFAULT_INIT_PORTAL_NAME;
-  if (!MULTI_PORTAL_SLUG_PATTERN.test(portalName)) {
-    throw new Error("INIT_PORTAL_NAME can only contain lowercase letters, numbers, hyphens, and underscores.");
-  }
-  return portalName;
-}
 function getInitPortalTemplate() {
   return trimString(process.env.INIT_PORTAL_TEMPLATE) || DEFAULT_INIT_PORTAL_TEMPLATE;
 }
-function formatInitPortalTitle(portalName) {
-  const title = portalName.split(/[-_]/).filter(Boolean).map((segment) => `${segment.charAt(0).toUpperCase()}${segment.slice(1)}`).join(" ");
-  return title || portalName;
+function hasDeprecatedInitPortalEnv() {
+  return Boolean(trimString(process.env.INIT_PORTAL_TYPE) || trimString(process.env.INIT_PORTAL_NAME));
 }
-function getDefaultMultiPortalRecord() {
-  const portalName = getInitPortalName();
+function getDefaultAiMultiPortalRecord(options = {}) {
   return {
     uid: DEFAULT_MULTI_PORTAL_UID,
-    title: formatInitPortalTitle(portalName),
+    title: "Main",
     icon: "DesktopOutlined",
-    portalType: getInitPortalType(),
-    portalName,
-    routePath: `/${portalName}`,
+    portalType: "ai",
+    portalName: "main",
+    routePath: "/main",
     authCheck: true,
     enabled: true,
-    uiLayoutUid: "admin-layout-model"
+    ...options.isDefault ? { isDefault: true } : {},
+    uiLayoutUid: import_constants.ADMIN_UI_LAYOUT_UID
   };
 }
+function getFreshMultiPortalRecords() {
+  return [getDefaultAiMultiPortalRecord({ isDefault: true }), ...getFixedLayoutMultiPortalRecords()];
+}
+function getFixedLayoutMultiPortalRecords() {
+  return [
+    {
+      uid: import_constants.DEFAULT_ADMIN_MULTI_PORTAL_UID,
+      title: "Desktop layout",
+      icon: "DesktopOutlined",
+      portalType: "no-code",
+      portalName: "admin",
+      routePath: "/admin",
+      authCheck: true,
+      enabled: true,
+      uiLayoutUid: import_constants.ADMIN_UI_LAYOUT_UID
+    },
+    {
+      uid: import_constants.DEFAULT_MOBILE_MULTI_PORTAL_UID,
+      title: "Mobile layout",
+      icon: "MobileOutlined",
+      portalType: "no-code",
+      portalName: "mobile",
+      routePath: "/mobile",
+      authCheck: true,
+      enabled: true,
+      uiLayoutUid: import_constants.MOBILE_UI_LAYOUT_UID
+    }
+  ];
+}
+function getFixedLayoutMultiPortalRecord(uid) {
+  return getFixedLayoutMultiPortalRecords().find((portal) => portal.uid === uid);
+}
 function isValidPortalDeploySegment(value) {
   return /^[A-Za-z0-9_-]+$/.test(value);
 }
@@ -252,6 +279,13 @@ function getPortalDeployBasePath(appName, portalName) {
   const portalPath = appName === MAIN_APP_NAME ? `/${PORTAL_CLIENT_PREFIX}/${portalName}/` : `/${PORTAL_CLIENT_PREFIX}/apps/${appName}/${portalName}/`;
   return resolvePortalStoragePublicPath(joinPortalStoragePublicPath(process.env.APP_PUBLIC_PATH || "/", portalPath));
 }
+function getPortalDeployBasePathCandidates(appName, portalName) {
+  const expectedBasePaths = [getPortalDeployBasePath(appName, portalName)];
+  if (appName !== MAIN_APP_NAME) {
+    expectedBasePaths.push(getPortalDeployBasePath(MAIN_APP_NAME, portalName));
+  }
+  return expectedBasePaths;
+}
 function createPortalDeployUploadMiddleware() {
   const storage = import_utils.koaMulter.diskStorage({
     destination: import_os.default.tmpdir(),
@@ -394,80 +428,13 @@ async function resolvePortalTemplate(templateSource, logPath) {
   return downloadPortalTemplatePackage(templateSource, logPath);
 }
 async function copyPortalTemplate(sourceDir, targetDir) {
-  const ignoredSegments = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store"]);
+  const ignoredSegments = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store", ".env", ".env.local"]);
   await import_fs.default.promises.mkdir(import_path.default.dirname(targetDir), { recursive: true });
   await import_fs.default.promises.cp(sourceDir, targetDir, {
     recursive: true,
     filter: (source) => !import_path.default.relative(sourceDir, source).split(import_path.default.sep).some((segment) => segment.startsWith("._") || ignoredSegments.has(segment))
   });
 }
-function getPortalStorageConfig(options) {
-  const sourceOptions = isRecordLike(options) ? options : {};
-  const sourceStorage = trimString(sourceOptions.sourceStorage);
-  if (sourceStorage !== "git") {
-    return { sourceStorage: "nocobase" };
-  }
-  const gitOptions = isRecordLike(sourceOptions.git) ? sourceOptions.git : {};
-  return {
-    sourceStorage,
-    git: {
-      repo: trimString(gitOptions.repo),
-      branch: trimString(gitOptions.branch) || "main",
-      path: trimString(gitOptions.path) || "."
-    }
-  };
-}
-function upsertPortalEnvContent(content, values) {
-  const nextValues = { ...values };
-  const lines = content ? content.replace(/\r\n/g, "\n").split("\n") : [];
-  const result = [];
-  for (const line of lines) {
-    if (!line && result.length === lines.length - 1) {
-      continue;
-    }
-    const match = line.match(/^(\s*)([A-Za-z_][A-Za-z0-9_]*)\s*=/);
-    const key = match == null ? void 0 : match[2];
-    if (key && Object.prototype.hasOwnProperty.call(nextValues, key)) {
-      result.push(`${key}=${nextValues[key]}`);
-      delete nextValues[key];
-      continue;
-    }
-    result.push(line);
-  }
-  for (const [key, value] of Object.entries(nextValues)) {
-    result.push(`${key}=${value}`);
-  }
-  return `${result.join("\n").replace(/\n*$/, "")}
-`;
-}
-async function upsertPortalEnvFile(filePath, values) {
-  let content = "";
-  try {
-    content = await import_fs.default.promises.readFile(filePath, "utf-8");
-  } catch {
-    content = "";
-  }
-  await import_fs.default.promises.writeFile(filePath, upsertPortalEnvContent(content, values), "utf-8");
-}
-async function ensurePortalStorageConfigFiles(portalDir, item) {
-  const apiUrl = getPortalStorageApiUrl(item.appName);
-  const portalBase = getPortalDeployBasePath(item.appName, item.portalName);
-  await import_fs.default.promises.mkdir(portalDir, { recursive: true });
-  await upsertPortalEnvFile(import_path.default.join(portalDir, ".env"), {
-    NOCOBASE_API_URL: resolvePortalStorageEnvApiUrl(apiUrl),
-    NOCOBASE_PORTAL_BASE: portalBase
-  });
-  await upsertPortalEnvFile(import_path.default.join(portalDir, ".env.local"), {
-    NOCOBASE_API_URL: apiUrl,
-    NOCOBASE_PORTAL_BASE: portalBase
-  });
-  await import_fs.default.promises.writeFile(
-    import_path.default.join(portalDir, "portal.config.json"),
-    `${JSON.stringify(item.config, null, 2)}
-`,
-    "utf-8"
-  );
-}
 function sanitizePortalStorageNodeOptions(value) {
   return trimString(value).split(/\s+/).filter((option) => option !== "--preserve-symlinks" && option !== "--preserve-symlinks-main").join(" ");
 }
@@ -552,16 +519,24 @@ async function runPortalStorageCommandOnce(command, args, options) {
     throw error;
   }
 }
-async function buildPortalStorageItem(portalDir, item) {
+function hasRequestAppHeader(options) {
+  var _a;
+  return Boolean(trimString((_a = options == null ? void 0 : options.context) == null ? void 0 : _a.get("X-App")));
+}
+async function buildPortalStorageItem(portalDir, item, options) {
   const logPath = getPortalStorageLogPath(item);
+  const buildAppName = hasRequestAppHeader(options) ? item.appName : MAIN_APP_NAME;
   const buildEnv = getPortalStorageCommandEnv({
-    NOCOBASE_API_URL: getPortalStorageApiUrl(item.appName),
-    NOCOBASE_PORTAL_BASE: getPortalDeployBasePath(item.appName, item.portalName)
+    NOCOBASE_API_URL: getPortalStorageApiUrl(buildAppName),
+    NOCOBASE_PORTAL_BASE: getPortalDeployBasePath(buildAppName, item.portalName),
+    SKIP_YARN_COREPACK_CHECK: "1",
+    COREPACK_ENABLE_STRICT: "0",
+    COREPACK_ENABLE_PROJECT_SPEC: "0"
   });
   await appendPortalStorageLog(logPath, `Building portal ${item.appName}/${item.portalName}.`);
   await appendPortalStorageLog(
     logPath,
-    `Build environment: NOCOBASE_API_URL=${buildEnv.NOCOBASE_API_URL || ""} NOCOBASE_PORTAL_BASE=${buildEnv.NOCOBASE_PORTAL_BASE || ""} APP_PUBLIC_PATH=${buildEnv.APP_PUBLIC_PATH || ""}`
+    `Build environment: NOCOBASE_API_URL=${buildEnv.NOCOBASE_API_URL || ""} NOCOBASE_PORTAL_BASE=${buildEnv.NOCOBASE_PORTAL_BASE || ""} APP_PUBLIC_PATH=${buildEnv.APP_PUBLIC_PATH || ""} SKIP_YARN_COREPACK_CHECK=${buildEnv.SKIP_YARN_COREPACK_CHECK || ""} COREPACK_ENABLE_STRICT=${buildEnv.COREPACK_ENABLE_STRICT || ""} COREPACK_ENABLE_PROJECT_SPEC=${buildEnv.COREPACK_ENABLE_PROJECT_SPEC || ""}`
   );
   await runPortalStorageCommandOnce("yarn", ["build:html"], {
     cwd: portalDir,
@@ -575,9 +550,9 @@ function validatePortalDeployBasePath(appName, portalName, basePath) {
   if (normalizedBasePath.includes("..")) {
     throw new Error('basePath cannot contain ".."');
   }
-  const expectedBasePath = getPortalDeployBasePath(appName, portalName);
-  if (normalizedBasePath !== expectedBasePath) {
-    throw new Error(`basePath must be ${expectedBasePath}`);
+  const expectedBasePaths = getPortalDeployBasePathCandidates(appName, portalName);
+  if (!expectedBasePaths.includes(normalizedBasePath)) {
+    throw new Error(`basePath must be ${expectedBasePaths.join(" or ")}`);
   }
 }
 function isPortalDeployTarEntry(entry) {
@@ -790,29 +765,6 @@ async function replacePortalSourceFromArchive(params) {
     await import_fs.default.promises.rm(tarPath, { force: true });
   }
 }
-function isDefaultMultiPortalUid(uid) {
-  return typeof uid === "string" && DEFAULT_MULTI_PORTAL_UID_SET.has(uid);
-}
-function getDefaultMultiPortalRecordForUid(uid) {
-  return isDefaultMultiPortalUid(uid) ? getDefaultMultiPortalRecord() : void 0;
-}
-function getDefaultMultiPortalUiLayoutUid(portal) {
-  return Object.prototype.hasOwnProperty.call(portal, "uiLayoutUid") ? portal.uiLayoutUid ?? null : null;
-}
-function withCustomMultiPortalFilter(filter = {}) {
-  const customFilter = { ...filter };
-  const uidFilter = customFilter.uid;
-  if (Array.isArray(uidFilter)) {
-    customFilter.uid = uidFilter.filter((uid) => !isDefaultMultiPortalUid(uid));
-    return customFilter;
-  }
-  if (isDefaultMultiPortalUid(uidFilter)) {
-    customFilter.uid = [];
-    return customFilter;
-  }
-  customFilter["uid.$notIn"] = DEFAULT_MULTI_PORTAL_UIDS;
-  return customFilter;
-}
 function uniqueDesktopRouteIds(routeIds) {
   const seen = /* @__PURE__ */ new Set();
   return routeIds.filter((routeId) => {
@@ -838,19 +790,11 @@ function collectDesktopRouteIds(record) {
   }
   return uniqueDesktopRouteIds(routeIds);
 }
-function pickMultiPortalUiLayoutRuntimeFields(record) {
-  const result = {};
-  for (const field of MULTI_PORTAL_UI_LAYOUT_RUNTIME_FIELDS) {
-    result[field] = getRecordField(record, field);
-  }
-  return result;
-}
 function pickMultiPortalRuntimeFields(record) {
   const result = {};
   for (const field of MULTI_PORTAL_RUNTIME_FIELDS) {
     result[field] = getRecordField(record, field);
   }
-  result.uiLayout = pickMultiPortalUiLayoutRuntimeFields(getRecordField(record, "uiLayout"));
   return result;
 }
 function pickMultiPortalAccessibleFields(record) {
@@ -858,7 +802,6 @@ function pickMultiPortalAccessibleFields(record) {
   for (const field of MULTI_PORTAL_ACCESSIBLE_FIELDS) {
     result[field] = getRecordField(record, field) ?? null;
   }
-  result.uiLayout = pickMultiPortalUiLayoutRuntimeFields(getRecordField(record, "uiLayout"));
   return result;
 }
 function getExplicitRequestedLayoutUid(layout) {
@@ -867,14 +810,25 @@ function getExplicitRequestedLayoutUid(layout) {
     return uid;
   }
 }
+function hasActionParam(params, key) {
+  return isRecordLike(params) && Object.prototype.hasOwnProperty.call(params, key);
+}
 function getRequestedMultiPortalUid(ctx) {
-  var _a, _b;
-  const portalUid = getExplicitRequestedLayoutUid((_a = ctx.action) == null ? void 0 : _a.params.portal);
-  const layoutUid = getExplicitRequestedLayoutUid((_b = ctx.action) == null ? void 0 : _b.params.layout);
-  if (portalUid && layoutUid) {
+  var _a, _b, _c;
+  const hasPortalScope = hasActionParam((_a = ctx.action) == null ? void 0 : _a.params, "portal");
+  const hasLayoutScope = hasActionParam((_b = ctx.action) == null ? void 0 : _b.params, "layout");
+  const portalUid = getExplicitRequestedLayoutUid((_c = ctx.action) == null ? void 0 : _c.params.portal);
+  if (hasPortalScope && hasLayoutScope) {
     ctx.throw(400, "layout and portal cannot be used together");
     return;
   }
+  if (!hasPortalScope) {
+    return;
+  }
+  if (!portalUid) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
   return portalUid;
 }
 function getCurrentRoles(ctx) {
@@ -899,27 +853,88 @@ function getMultiPortalNameFromValues(ctx) {
     return portalName;
   }
 }
-function getMultiPortalWriteValues(ctx) {
+function getMultiPortalWriteRecords(ctx) {
   var _a;
   const values = (_a = ctx.action) == null ? void 0 : _a.params.values;
-  if (!values || typeof values !== "object" || Array.isArray(values)) {
-    return;
+  const records = Array.isArray(values) ? values : [values];
+  return records.filter(
+    (record) => !!record && typeof record === "object" && !Array.isArray(record)
+  );
+}
+async function getMultiPortalWriteTargets(ctx, fields) {
+  var _a, _b, _c, _d, _e;
+  const records = getMultiPortalWriteRecords(ctx);
+  if (!records.length || ((_a = ctx.action) == null ? void 0 : _a.actionName) === "create") {
+    return records.map((values2) => ({ values: values2 }));
+  }
+  const repository = ctx.db.getRepository("multiPortals");
+  const actionName = (_b = ctx.action) == null ? void 0 : _b.actionName;
+  const requestedFilterKeys = (_c = ctx.action) == null ? void 0 : _c.params.filterKeys;
+  if ((actionName === "firstOrCreate" || actionName === "updateOrCreate") && Array.isArray(requestedFilterKeys) && requestedFilterKeys.every((filterKey) => typeof filterKey === "string")) {
+    const targets = [];
+    for (const values2 of records) {
+      const existing2 = await repository.findOne({
+        filter: import_database.Repository.valuesToFilter(values2, requestedFilterKeys),
+        fields
+      });
+      targets.push({ existing: existing2, values: values2 });
+    }
+    return targets;
+  }
+  if (records.length > 1) {
+    const targets = [];
+    for (const values2 of records) {
+      const uid2 = values2.uid;
+      const existing2 = typeof uid2 === "string" && uid2 ? await repository.findOne({
+        filterByTk: uid2,
+        fields
+      }) : null;
+      targets.push({ existing: existing2, values: values2 });
+    }
+    return targets;
+  }
+  const values = records[0];
+  const filterByTk = (_d = ctx.action) == null ? void 0 : _d.params.filterByTk;
+  if (filterByTk !== void 0 && filterByTk !== null) {
+    const existingRecords = await repository.find({
+      filterByTk,
+      fields
+    });
+    return existingRecords.length ? existingRecords.map((existing2) => ({ existing: existing2, values })) : [{ values }];
+  }
+  const filter = (_e = ctx.action) == null ? void 0 : _e.params.filter;
+  if (isRecordLike(filter) && !Array.isArray(filter)) {
+    const existingRecords = await repository.find({
+      filter,
+      fields
+    });
+    return existingRecords.length ? existingRecords.map((existing2) => ({ existing: existing2, values })) : [{ values }];
   }
-  return values;
+  const uid = values.uid;
+  const existing = typeof uid === "string" && uid ? await repository.findOne({
+    filterByTk: uid,
+    fields
+  }) : null;
+  return [{ existing, values }];
 }
 function isTruthyActionBoolean(value) {
   return value === true || value === 1 || value === "1" || value === "true";
 }
 async function captureSkipCreatePortalDirectory(ctx, next) {
-  const values = getMultiPortalWriteValues(ctx);
-  if (!values || !Object.prototype.hasOwnProperty.call(values, "skipCreatePortalDirectory")) {
+  const records = getMultiPortalWriteRecords(ctx);
+  const recordsWithOption = records.filter(
+    (record) => Object.prototype.hasOwnProperty.call(record, "skipCreatePortalDirectory")
+  );
+  if (!recordsWithOption.length) {
     await next();
     return;
   }
-  ctx[SKIP_CREATE_PORTAL_DIRECTORY] = isTruthyActionBoolean(
-    values.skipCreatePortalDirectory
+  ctx[SKIP_CREATE_PORTAL_DIRECTORY] = recordsWithOption.some(
+    (record) => isTruthyActionBoolean(record.skipCreatePortalDirectory)
   );
-  delete values.skipCreatePortalDirectory;
+  for (const record of recordsWithOption) {
+    delete record.skipCreatePortalDirectory;
+  }
   await next();
 }
 function shouldSkipCreatePortalDirectory(options) {
@@ -927,156 +942,177 @@ function shouldSkipCreatePortalDirectory(options) {
   return ((_a = options == null ? void 0 : options.context) == null ? void 0 : _a[SKIP_CREATE_PORTAL_DIRECTORY]) === true;
 }
 async function normalizeMultiPortalSlugValues(ctx, next) {
-  const values = getMultiPortalWriteValues(ctx);
-  const portalName = values == null ? void 0 : values.portalName;
-  if (portalName === void 0 || portalName === null) {
-    await next();
-    return;
-  }
-  if (typeof portalName !== "string") {
-    await next();
-    return;
+  for (const values of getMultiPortalWriteRecords(ctx)) {
+    const portalName = values.portalName;
+    if (portalName === void 0 || portalName === null || typeof portalName !== "string") {
+      continue;
+    }
+    const slug = portalName.trim();
+    if (!slug) {
+      continue;
+    }
+    if (!MULTI_PORTAL_SLUG_PATTERN.test(slug)) {
+      ctx.throw(400, "Portal name can only contain lowercase letters, numbers, hyphens, and underscores");
+      return;
+    }
+    values.portalName = slug;
+    values.routePath = `/${slug}`;
   }
-  const slug = portalName.trim();
-  if (!slug) {
-    await next();
-    return;
+  const repository = ctx.db.getRepository("multiPortals");
+  const pendingPortalNames = /* @__PURE__ */ new Set();
+  const targets = await getMultiPortalWriteTargets(ctx, ["uid"]);
+  for (const { existing, values } of targets) {
+    const portalName = values.portalName;
+    if (typeof portalName !== "string" || !portalName) {
+      continue;
+    }
+    if (pendingPortalNames.has(portalName)) {
+      ctx.throw(409, ctx.t('Portal name "{{portalName}}" already exists', { ns: import_constants.NAMESPACE, portalName }));
+      return;
+    }
+    pendingPortalNames.add(portalName);
+    const conflict = await repository.findOne({
+      filter: { portalName },
+      fields: ["uid"]
+    });
+    if (conflict && conflict.get("uid") !== (existing == null ? void 0 : existing.get("uid"))) {
+      ctx.throw(409, ctx.t('Portal name "{{portalName}}" already exists', { ns: import_constants.NAMESPACE, portalName }));
+      return;
+    }
   }
-  if (!MULTI_PORTAL_SLUG_PATTERN.test(slug)) {
-    ctx.throw(400, "Portal name can only contain lowercase letters, numbers, hyphens, and underscores");
-    return;
+  await next();
+}
+async function preventDirectDefaultPortalMutation(ctx, next) {
+  for (const values of getMultiPortalWriteRecords(ctx)) {
+    if (Object.prototype.hasOwnProperty.call(values, "isDefault")) {
+      ctx.throw(400, ctx.t("Use multiPortals:setDefault to update the default Portal", { ns: import_constants.NAMESPACE }));
+      return;
+    }
   }
-  values.portalName = slug;
-  values.routePath = `/${slug}`;
   await next();
 }
-async function ensureDefaultMultiPortals(db, options) {
+function isUniqueConstraintViolation(error) {
+  return error instanceof import_database.UniqueConstraintError || isRecordLike(error) && error.name === "SequelizeUniqueConstraintError";
+}
+async function createDefaultMultiPortalBestEffort(db, portal) {
   const repository = db.getRepository("multiPortals");
-  const defaultPortal = getDefaultMultiPortalRecord();
-  const existing = await repository.findOne({
-    filterByTk: defaultPortal.uid,
-    fields: ["uid", "title", "icon", "portalType", "portalName", "routePath", "authCheck", "uiLayoutUid"],
-    transaction: options == null ? void 0 : options.transaction
-  });
-  if (!existing) {
-    await repository.create({
-      values: defaultPortal,
-      transaction: options == null ? void 0 : options.transaction
-    });
-    return;
+  const [uidConflict, portalNameConflict] = await Promise.all([
+    repository.findOne({
+      filterByTk: portal.uid,
+      fields: ["uid"]
+    }),
+    repository.findOne({
+      filter: { portalName: portal.portalName },
+      fields: ["uid"]
+    })
+  ]);
+  if (uidConflict || portalNameConflict) {
+    return false;
   }
-  const protectedValues = {
-    uid: defaultPortal.uid,
-    portalType: defaultPortal.portalType ?? null,
-    portalName: defaultPortal.portalName,
-    routePath: defaultPortal.routePath,
-    authCheck: defaultPortal.authCheck,
-    uiLayoutUid: getDefaultMultiPortalUiLayoutUid(defaultPortal)
-  };
-  const shouldRepair = Object.entries(protectedValues).some(([field, value]) => existing.get(field) !== value);
-  if (shouldRepair) {
+  try {
+    await repository.create({ values: portal });
+    return true;
+  } catch (error) {
+    if (isUniqueConstraintViolation(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+async function repairFixedLayoutMultiPortalRecords(db) {
+  const repository = db.getRepository("multiPortals");
+  for (const portal of getFixedLayoutMultiPortalRecords()) {
+    const existing = await repository.findOne({
+      filterByTk: portal.uid,
+      fields: ["uid", "portalType", "portalName", "routePath", "uiLayoutUid"]
+    });
+    if ((existing == null ? void 0 : existing.get("portalName")) !== portal.portalName || existing.get("routePath") !== portal.routePath || existing.get("uiLayoutUid") !== portal.uiLayoutUid || existing.get("portalType") === portal.portalType) {
+      continue;
+    }
     await repository.update({
-      filterByTk: defaultPortal.uid,
-      values: protectedValues,
-      transaction: options == null ? void 0 : options.transaction
+      filterByTk: portal.uid,
+      values: {
+        portalType: portal.portalType
+      }
     });
   }
 }
-async function protectDefaultMultiPortalUpdate(ctx, next) {
-  var _a, _b, _c;
-  const defaultPortal = getDefaultMultiPortalRecordForUid((_a = ctx.action) == null ? void 0 : _a.params.filterByTk);
-  if (!defaultPortal) {
-    await next();
-    return;
+async function seedFreshMultiPortals(db) {
+  for (const portal of getFreshMultiPortalRecords()) {
+    await createDefaultMultiPortalBestEffort(db, portal);
   }
-  const params = (_b = ctx.action) == null ? void 0 : _b.params;
-  const rawValues = isRecordLike(params == null ? void 0 : params.values) ? params.values : {};
-  const values = {
-    uid: defaultPortal.uid,
-    portalType: defaultPortal.portalType ?? null,
-    portalName: defaultPortal.portalName,
-    routePath: defaultPortal.routePath,
-    authCheck: defaultPortal.authCheck,
-    uiLayoutUid: getDefaultMultiPortalUiLayoutUid(defaultPortal)
-  };
-  if (Object.prototype.hasOwnProperty.call(rawValues, "title")) {
-    values.title = rawValues.title;
-  }
-  if (Object.prototype.hasOwnProperty.call(rawValues, "icon")) {
-    values.icon = rawValues.icon;
-  }
-  if (Object.prototype.hasOwnProperty.call(rawValues, "enabled")) {
-    values.enabled = rawValues.enabled;
+}
+async function seedHistoricalMultiPortals(db) {
+  await createDefaultMultiPortalBestEffort(db, getDefaultAiMultiPortalRecord());
+  for (const portal of getFixedLayoutMultiPortalRecords()) {
+    await createDefaultMultiPortalBestEffort(db, portal);
   }
-  (_c = ctx.action) == null ? void 0 : _c.mergeParams(
-    {
-      values
-    },
-    {
-      values: "overwrite"
-    }
-  );
-  await next();
+  await repairFixedLayoutMultiPortalRecords(db);
 }
-async function preventUiLayoutRouteNameConflict(ctx, next) {
+async function validateMultiPortalUiLayoutUidWrite(ctx, next) {
   var _a;
-  if (isDefaultMultiPortalUid((_a = ctx.action) == null ? void 0 : _a.params.filterByTk)) {
-    await next();
-    return;
-  }
-  const portalName = getMultiPortalNameFromValues(ctx);
-  if (!portalName) {
-    await next();
-    return;
-  }
-  const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
-    filter: {
-      routeName: portalName
-    },
-    fields: ["uid"]
-  });
-  if (uiLayout) {
-    ctx.throw(400, "Portal route name conflicts with an existing UI layout");
-    return;
+  const targets = await getMultiPortalWriteTargets(ctx, ["uiLayoutUid"]);
+  const actionName = (_a = ctx.action) == null ? void 0 : _a.actionName;
+  const createsWhenMissing = actionName === "create" || actionName === "firstOrCreate" || actionName === "updateOrCreate";
+  for (const { existing, values } of targets) {
+    const hasUiLayoutUid = Object.prototype.hasOwnProperty.call(values, "uiLayoutUid");
+    if (!existing && createsWhenMissing && !hasUiLayoutUid) {
+      ctx.throw(400, `Portal UI layout must be one of: ${import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS.join(", ")}`);
+      return;
+    }
+    if (!hasUiLayoutUid) {
+      continue;
+    }
+    if (!(0, import_constants.isMultiPortalUiLayoutUid)(values.uiLayoutUid)) {
+      ctx.throw(400, `Portal UI layout must be one of: ${import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS.join(", ")}`);
+      return;
+    }
+    const existingUiLayoutUid = existing == null ? void 0 : existing.get("uiLayoutUid");
+    if (existing && existingUiLayoutUid !== values.uiLayoutUid) {
+      ctx.throw(400, "Portal UI layout cannot be changed");
+      return;
+    }
   }
   await next();
 }
-async function findRequestedMultiPortal(ctx) {
-  var _a;
+async function findRequestedMultiPortal(ctx, transaction) {
   const portalUid = getRequestedMultiPortalUid(ctx);
   if (portalUid === void 0) {
     return {
       requested: false
     };
   }
-  const isExplicitPortalRequest = getExplicitRequestedLayoutUid((_a = ctx.action) == null ? void 0 : _a.params.portal) !== void 0;
-  if (!isExplicitPortalRequest) {
-    const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
-      filter: {
-        uid: portalUid
-      },
-      fields: ["uid"]
-    });
-    if (uiLayout) {
-      return {
-        requested: false
-      };
-    }
-  }
   const portal = await ctx.db.getRepository("multiPortals").findOne({
     filter: {
       uid: portalUid
     },
-    fields: ["uid", "uiLayoutUid", "enabled"]
+    fields: ["uid", "portalType", "uiLayoutUid", "enabled"],
+    ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+    transaction
   });
-  if ((portal == null ? void 0 : portal.get("enabled")) === true) {
-    return {
-      portal,
-      requested: true
-    };
+  if (!portal || portal.get("enabled") !== true) {
+    return { requested: true };
+  }
+  if (portal.get("portalType") !== "no-code") {
+    ctx.throw(400, `Portal '${portalUid}' does not support desktop routes`);
   }
+  const uiLayoutUid = portal.get("uiLayoutUid");
+  if (!(0, import_constants.isMultiPortalUiLayoutUid)(uiLayoutUid)) {
+    ctx.throw(400, `Portal '${portalUid}' has an unsupported UI layout UID`);
+  }
+  const usesLayoutPermissions = (0, import_constants.isDefaultLayoutMultiPortalUid)(portalUid);
   return {
-    requested: !!isExplicitPortalRequest || !!portal
+    portal,
+    requested: true,
+    scope: {
+      portalUid,
+      uiLayoutUid,
+      relation: usesLayoutPermissions ? "uiLayouts" : "multiPortals",
+      uid: usesLayoutPermissions ? uiLayoutUid : portalUid,
+      filter: usesLayoutPermissions ? {
+        "uiLayouts.uid": uiLayoutUid
+      } : getDesktopRoutePortalFilter(portalUid)
+    }
   };
 }
 function getDesktopRoutePortalFilter(multiPortalUid) {
@@ -1087,49 +1123,88 @@ function getDesktopRoutePortalFilter(multiPortalUid) {
 function isDesktopRouteCreateValue(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
-function hasDesktopRouteField(value, field) {
-  return !!value && Object.prototype.hasOwnProperty.call(value, field);
+function withDesktopRouteEffectiveOwner(value, scope) {
+  if (Array.isArray(value)) {
+    return value.map((item) => withDesktopRouteEffectiveOwner(item, scope));
+  }
+  if (!isDesktopRouteCreateValue(value)) {
+    return value;
+  }
+  const { uiLayouts: _uiLayouts, multiPortals: _multiPortals, children, ...route } = value;
+  return {
+    ...route,
+    ...scope.relation === "uiLayouts" ? { uiLayouts: [scope.uid] } : { multiPortals: [scope.uid] },
+    ...Array.isArray(children) ? { children: withDesktopRouteEffectiveOwner(children, scope) } : {}
+  };
 }
-function pickExplicitDesktopRouteUiLayouts(value) {
+function collectExplicitDesktopRouteParentIds(value) {
   if (Array.isArray(value)) {
-    return value.map((item) => pickExplicitDesktopRouteUiLayouts(item));
+    return uniqueDesktopRouteIds(value.flatMap((item) => collectExplicitDesktopRouteParentIds(item)));
   }
   if (!isDesktopRouteCreateValue(value)) {
-    return;
+    return [];
   }
-  const route = {};
-  if (hasDesktopRouteField(value, "uiLayouts")) {
-    route.uiLayouts = value.uiLayouts;
+  const parentIds = [];
+  if (typeof value.parentId === "string" || typeof value.parentId === "number") {
+    parentIds.push(value.parentId);
   }
   if (Array.isArray(value.children)) {
-    route.children = value.children.map((child) => pickExplicitDesktopRouteUiLayouts(child));
+    parentIds.push(...value.children.flatMap((child) => collectExplicitDesktopRouteParentIds(child)));
   }
-  return route;
+  return uniqueDesktopRouteIds(parentIds);
 }
-function withDesktopRouteMultiPortal(value, multiPortalUid, explicitValue = value) {
-  if (Array.isArray(value)) {
-    const explicitValues = Array.isArray(explicitValue) ? explicitValue : [];
-    return value.map((item, index) => withDesktopRouteMultiPortal(item, multiPortalUid, explicitValues[index]));
+async function assertDesktopRouteParentsBelongToScope(ctx, scope, values = ((_a) => (_a = ctx.action) == null ? void 0 : _a.params.values)(), transaction) {
+  const parentIds = collectExplicitDesktopRouteParentIds(values);
+  if (!parentIds.length) {
+    return;
   }
-  if (!isDesktopRouteCreateValue(value)) {
-    return value;
+  const parents = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      id: parentIds,
+      ...scope.filter
+    },
+    transaction
+  });
+  if (new Set(normalizeDesktopRouteTargetIds(parents)).size !== new Set(parentIds.map(String)).size) {
+    ctx.throw(400, "Parent route does not belong to the requested portal scope");
   }
-  const explicitRoute = isDesktopRouteCreateValue(explicitValue) ? explicitValue : void 0;
-  const existingMultiPortals = Array.isArray(value.multiPortals) ? value.multiPortals.filter((uid) => typeof uid === "string" && !!uid) : [];
-  const { uiLayouts: _uiLayouts, children: _children, ...route } = value;
-  return {
-    ...route,
-    ...hasDesktopRouteField(explicitRoute, "uiLayouts") ? { uiLayouts: explicitRoute == null ? void 0 : explicitRoute.uiLayouts } : {},
-    multiPortals: Array.from(/* @__PURE__ */ new Set([...existingMultiPortals, multiPortalUid])),
-    ...Array.isArray(value.children) ? { children: withDesktopRouteMultiPortal(value.children, multiPortalUid, explicitRoute == null ? void 0 : explicitRoute.children) } : {}
-  };
 }
-async function captureExplicitDesktopRouteUiLayouts(ctx, next) {
-  var _a;
-  ctx[EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS] = pickExplicitDesktopRouteUiLayouts(
-    (_a = ctx.action) == null ? void 0 : _a.params.values
-  );
-  await next();
+function getDesktopRouteUpdateOrCreateFilters(ctx, values = ((_b) => (_b = ctx.action) == null ? void 0 : _b.params.values)(), requestedFilterKeys = ((_c) => (_c = ctx.action) == null ? void 0 : _c.params.filterKeys)()) {
+  const filterKeys = Array.isArray(requestedFilterKeys) ? requestedFilterKeys.filter((key) => typeof key === "string" && !!key) : [];
+  if (!filterKeys.length) {
+    return [];
+  }
+  const records = Array.isArray(values) ? values : [values];
+  return records.flatMap((value) => {
+    if (!isDesktopRouteCreateValue(value) || filterKeys.some((key) => !Object.prototype.hasOwnProperty.call(value, key))) {
+      return [];
+    }
+    return [Object.fromEntries(filterKeys.map((key) => [key, value[key]]))];
+  });
+}
+async function assertDesktopRouteUpsertMatchesBelongToScope(ctx, scope, values = ((_d) => (_d = ctx.action) == null ? void 0 : _d.params.values)(), filterKeys = ((_e) => (_e = ctx.action) == null ? void 0 : _e.params.filterKeys)(), transaction) {
+  for (const filter of getDesktopRouteUpdateOrCreateFilters(ctx, values, filterKeys)) {
+    const allMatches = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id"],
+      filter,
+      ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+      transaction
+    });
+    const scopedMatches = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id"],
+      filter: {
+        ...filter,
+        ...scope.filter
+      },
+      transaction
+    });
+    const allMatchIds = normalizeDesktopRouteTargetIds(allMatches);
+    const scopedMatchIds = normalizeDesktopRouteTargetIds(scopedMatches);
+    if (allMatchIds.join(",") !== scopedMatchIds.join(",")) {
+      ctx.throw(400, "Desktop route does not belong to the requested portal scope");
+    }
+  }
 }
 async function canAccessMultiPortal(ctx, multiPortalUid) {
   const currentRoles = getCurrentRoles(ctx);
@@ -1139,13 +1214,77 @@ async function canAccessMultiPortal(ctx, multiPortalUid) {
   if (!currentRoles.length) {
     return false;
   }
-  const count = await ctx.db.getRepository("rolesMultiPortals").count({
+  const access = await ctx.db.getRepository("rolesMultiPortals").findOne({
+    fields: ["id"],
     filter: {
       roleName: currentRoles,
       multiPortalUid
     }
   });
-  return count > 0;
+  return access !== null;
+}
+function throwPortalAccessGateError(ctx, status, code, message) {
+  ctx.throw(status, ctx.t(message, { ns: import_constants.NAMESPACE }), { code });
+  throw new Error(message);
+}
+function getRequestedPortalNameFromHeader(ctx) {
+  var _a;
+  const headers = (_a = ctx.request) == null ? void 0 : _a.headers;
+  if (!isRecordLike(headers) || !Object.prototype.hasOwnProperty.call(headers, "x-portal")) {
+    return;
+  }
+  const rawPortalName = headers["x-portal"];
+  if (typeof rawPortalName !== "string") {
+    throwPortalAccessGateError(ctx, 400, PORTAL_CONTEXT_INVALID_CODE, "Invalid Portal context");
+  }
+  const portalName = rawPortalName.startsWith("/x/") ? rawPortalName.slice("/x/".length) : rawPortalName;
+  if (!MULTI_PORTAL_SLUG_PATTERN.test(portalName)) {
+    throwPortalAccessGateError(ctx, 400, PORTAL_CONTEXT_INVALID_CODE, "Invalid Portal context");
+  }
+  return portalName;
+}
+function pickPortalAccessDeniedData(ctx, portalName) {
+  const roleCheckBody = isRecordLike(ctx.body) ? ctx.body : {};
+  return {
+    portalName,
+    role: typeof roleCheckBody.role === "string" ? roleCheckBody.role : "",
+    roles: Array.isArray(roleCheckBody.roles) ? roleCheckBody.roles.filter((role) => typeof role === "string") : [],
+    roleMode: typeof roleCheckBody.roleMode === "string" ? roleCheckBody.roleMode : "default",
+    allowAnonymous: roleCheckBody.allowAnonymous === true
+  };
+}
+async function checkMultiPortalAccessForRolesCheck(ctx, next) {
+  const portalName = getRequestedPortalNameFromHeader(ctx);
+  if (portalName === void 0) {
+    await next();
+    return;
+  }
+  const portal = await ctx.db.getRepository("multiPortals").findOne({
+    filter: {
+      portalName
+    },
+    fields: ["uid", "portalType", "enabled", "uiLayoutUid"]
+  });
+  if (!portal || portal.get("enabled") !== true || !getDefaultMultiPortalType(portal) || !(0, import_constants.isMultiPortalUiLayoutUid)(portal.get("uiLayoutUid"))) {
+    throwPortalAccessGateError(ctx, 404, PORTAL_NOT_FOUND_CODE, "Portal not found");
+  }
+  const portalUid = String(portal.get("uid"));
+  if ((0, import_constants.isDefaultLayoutMultiPortalUid)(portalUid) || await canAccessMultiPortal(ctx, portalUid)) {
+    await next();
+    return;
+  }
+  await next();
+  ctx.status = 403;
+  ctx.withoutDataWrapping = true;
+  ctx.body = {
+    errors: [
+      {
+        code: PORTAL_ACCESS_DENIED_CODE,
+        message: ctx.t("You do not have access to this Portal", { ns: import_constants.NAMESPACE })
+      }
+    ],
+    data: pickPortalAccessDeniedData(ctx, portalName)
+  };
 }
 async function listCurrentRoleAccessibleMultiPortalUids(ctx) {
   const currentRoles = getCurrentRoles(ctx);
@@ -1208,7 +1347,7 @@ async function removeRouteIdsWithUnauthorizedAncestors(ctx, routeIds) {
     }
   }
 }
-async function getMultiPortalAccessibleRouteIds(ctx, multiPortalUid) {
+async function getMultiPortalAccessibleRouteIds(ctx, portalContext) {
   const currentRoles = getCurrentRoles(ctx);
   if (currentRoles.includes("root")) {
     return;
@@ -1216,11 +1355,11 @@ async function getMultiPortalAccessibleRouteIds(ctx, multiPortalUid) {
   if (!currentRoles.length) {
     return /* @__PURE__ */ new Set();
   }
-  const routePermissions = await ctx.db.getRepository("rolesMultiPortalDesktopRoutes").find({
+  const routePermissions = await ctx.db.getRepository(portalContext.relation === "uiLayouts" ? "rolesDesktopRoutes" : "rolesMultiPortalDesktopRoutes").find({
     fields: ["desktopRouteId"],
     filter: {
       roleName: currentRoles,
-      multiPortalUid
+      ...portalContext.relation === "multiPortals" ? { multiPortalUid: portalContext.portalUid } : {}
     }
   });
   const routeIds = /* @__PURE__ */ new Set();
@@ -1236,7 +1375,7 @@ async function getMultiPortalAccessibleRouteIds(ctx, multiPortalUid) {
   const portalRoutes = await ctx.db.getRepository("desktopRoutes").find({
     fields: ["id"],
     filter: {
-      ...getDesktopRoutePortalFilter(multiPortalUid),
+      ...portalContext.filter,
       id: Array.from(routeIds)
     }
   });
@@ -1266,25 +1405,123 @@ function setDesktopRouteChildren(route, children) {
   const maybeModel = route;
   if (typeof maybeModel.setDataValue === "function") {
     maybeModel.setDataValue("children", children);
+  } else {
+    maybeModel.children = children;
+  }
+  if (!maybeModel._options) {
+    return;
+  }
+  if (!maybeModel._options.includeNames) {
+    maybeModel._options.includeNames = ["children"];
     return;
   }
-  route.children = children;
+  if (!maybeModel._options.includeNames.includes("children")) {
+    maybeModel._options.includeNames.push("children");
+  }
 }
-function removeDesktopRoutesByIds(routes, routeIds) {
-  return routes.map((route) => {
-    const routeId = getRecordField(route, "id");
-    const normalizedRouteId = routeId === null || routeId === void 0 ? void 0 : String(routeId);
-    if (normalizedRouteId && routeIds.has(normalizedRouteId)) {
-      return null;
+function getDesktopRouteId(route) {
+  const id = getRecordField(route, "id");
+  return id === null || id === void 0 ? void 0 : String(id);
+}
+function getDesktopRouteParentId(route) {
+  const parentId = getRecordField(route, "parentId");
+  return parentId === null || parentId === void 0 ? void 0 : String(parentId);
+}
+function collectDesktopRouteStringIds(routes, routeIds) {
+  for (const route of routes) {
+    const routeId = getDesktopRouteId(route);
+    if (routeId) {
+      routeIds.add(routeId);
     }
     const children = getRecordField(route, "children");
     if (Array.isArray(children)) {
-      setDesktopRouteChildren(route, removeDesktopRoutesByIds(children, routeIds));
+      collectDesktopRouteStringIds(children, routeIds);
     }
-    return route;
-  }).filter((route) => route !== null);
+  }
 }
-async function getPortalOnlyDesktopRouteIds(ctx, routeIds) {
+function removeNestedRootDesktopRoutes(routes) {
+  if (!Array.isArray(routes)) {
+    return [];
+  }
+  const routeIds = /* @__PURE__ */ new Set();
+  collectDesktopRouteStringIds(routes, routeIds);
+  return routes.filter((route) => {
+    const parentId = getDesktopRouteParentId(route);
+    return !parentId || !routeIds.has(parentId);
+  });
+}
+function buildAccessibleDesktopRouteTreeWithAncestors(routes, accessibleRouteIds) {
+  const routeById = /* @__PURE__ */ new Map();
+  const childrenByParentId = /* @__PURE__ */ new Map();
+  const roots = [];
+  for (const route of routes) {
+    const routeId = getDesktopRouteId(route);
+    if (!routeId) {
+      continue;
+    }
+    setDesktopRouteChildren(route, void 0);
+    routeById.set(routeId, route);
+  }
+  for (const route of routes) {
+    const routeId = getDesktopRouteId(route);
+    if (!routeId || !routeById.has(routeId)) {
+      continue;
+    }
+    const parentId = getDesktopRouteParentId(route);
+    if (!parentId || !routeById.has(parentId)) {
+      roots.push(route);
+      continue;
+    }
+    const children = childrenByParentId.get(parentId) ?? [];
+    children.push(route);
+    childrenByParentId.set(parentId, children);
+  }
+  const visitRoute = (route, visitingRouteIds) => {
+    const routeId = getDesktopRouteId(route);
+    if (!routeId || visitingRouteIds.has(routeId)) {
+      return void 0;
+    }
+    visitingRouteIds.add(routeId);
+    const visibleChildren = (childrenByParentId.get(routeId) ?? []).map((child) => visitRoute(child, visitingRouteIds)).filter((child) => child !== void 0);
+    visitingRouteIds.delete(routeId);
+    if (!accessibleRouteIds.has(routeId) && visibleChildren.length === 0) {
+      return void 0;
+    }
+    setDesktopRouteChildren(route, visibleChildren.length ? visibleChildren : void 0);
+    return route;
+  };
+  return roots.map((route) => visitRoute(route, /* @__PURE__ */ new Set())).filter((route) => route !== void 0);
+}
+async function includeDesktopRouteAncestorsForListAccessible(ctx, routes, portalFilter) {
+  if (!Array.isArray(routes)) {
+    return routes;
+  }
+  const accessibleRouteIds = /* @__PURE__ */ new Set();
+  collectDesktopRouteStringIds(routes, accessibleRouteIds);
+  if (!accessibleRouteIds.size) {
+    return routes;
+  }
+  const portalRoutes = await ctx.db.getRepository("desktopRoutes").find({
+    sort: "sort",
+    filter: portalFilter
+  });
+  return buildAccessibleDesktopRouteTreeWithAncestors(portalRoutes, accessibleRouteIds);
+}
+function removeDesktopRoutesByIds(routes, routeIds) {
+  return routes.map((route) => {
+    const routeId = getRecordField(route, "id");
+    const normalizedRouteId = routeId === null || routeId === void 0 ? void 0 : String(routeId);
+    if (normalizedRouteId && routeIds.has(normalizedRouteId)) {
+      return null;
+    }
+    const children = getRecordField(route, "children");
+    if (Array.isArray(children)) {
+      setDesktopRouteChildren(route, removeDesktopRoutesByIds(children, routeIds));
+    }
+    return route;
+  }).filter((route) => route !== null);
+}
+async function getPortalOnlyDesktopRouteIds(ctx, routeIds) {
   if (!routeIds.length) {
     return /* @__PURE__ */ new Set();
   }
@@ -1335,23 +1572,26 @@ async function removeMultiPortalOwnedRouteFromGetResponse(ctx) {
   ctx.body = void 0;
 }
 async function replaceListAccessibleRoutesWithPortalScopedRoutes(ctx, portalContext) {
-  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext.portalUid);
+  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext);
   if (routeIds && routeIds.size === 0) {
     ctx.body = [];
     return;
   }
-  ctx.body = await ctx.db.getRepository("desktopRoutes").find({
+  const routes = await ctx.db.getRepository("desktopRoutes").find({
     tree: true,
     sort: "sort",
     filter: {
-      ...getDesktopRoutePortalFilter(portalContext.portalUid),
+      ...portalContext.filter,
       ...routeIds ? { id: Array.from(routeIds) } : {}
     }
   });
+  ctx.body = removeNestedRootDesktopRoutes(
+    await includeDesktopRouteAncestorsForListAccessible(ctx, routes, portalContext.filter)
+  );
 }
 async function replaceGetAccessibleRouteWithPortalScopedRoute(ctx, portalContext) {
   var _a;
-  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext.portalUid);
+  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext);
   if (routeIds && routeIds.size === 0) {
     ctx.status = 204;
     ctx.body = void 0;
@@ -1361,7 +1601,7 @@ async function replaceGetAccessibleRouteWithPortalScopedRoute(ctx, portalContext
     sort: "sort",
     filterByTk: (_a = ctx.action) == null ? void 0 : _a.params.filterByTk,
     filter: {
-      ...getDesktopRoutePortalFilter(portalContext.portalUid),
+      ...portalContext.filter,
       ...routeIds ? { id: Array.from(routeIds) } : {}
     }
   });
@@ -1379,25 +1619,17 @@ async function prepareAccessibleDesktopRoutesForMultiPortal(ctx) {
   if (!portalRequest.requested) {
     return;
   }
-  const portal = portalRequest.portal;
-  if (!portal) {
-    return null;
-  }
-  const portalUid = portal.get("uid");
-  const uiLayoutUid = portal.get("uiLayoutUid");
-  if (typeof portalUid !== "string" || !portalUid || typeof uiLayoutUid !== "string" || !uiLayoutUid) {
+  const scope = portalRequest.scope;
+  if (!scope) {
     return null;
   }
-  if (!await canAccessMultiPortal(ctx, portalUid)) {
+  if (scope.relation === "multiPortals" && !await canAccessMultiPortal(ctx, scope.portalUid)) {
     return null;
   }
   if ((_a = ctx.action) == null ? void 0 : _a.params) {
-    ctx.action.params.layout = uiLayoutUid;
+    ctx.action.params.layout = scope.uiLayoutUid;
   }
-  return {
-    portalUid,
-    uiLayoutUid
-  };
+  return scope;
 }
 async function addMultiPortalListAccessibleGuard(ctx, next) {
   const portalContext = await prepareAccessibleDesktopRoutesForMultiPortal(ctx);
@@ -1433,98 +1665,740 @@ async function mapMultiPortalLayoutToUiLayoutForRolePermissionTargets(ctx, next)
     ctx.body = [];
     return;
   }
-  const portal = portalRequest.portal;
-  const portalUid = portal == null ? void 0 : portal.get("uid");
-  if (typeof portalUid === "string" && portalUid) {
+  const scope = portalRequest.scope;
+  if (scope) {
     const routes = await ctx.db.getRepository("desktopRoutes").find({
-      tree: true,
       sort: "sort",
-      filter: getDesktopRoutePortalFilter(portalUid),
+      filter: scope.filter,
       fields: [...DESKTOP_ROUTE_ROLE_PERMISSION_TARGET_FIELDS]
     });
+    const routeIds = /* @__PURE__ */ new Set();
+    collectDesktopRouteStringIds(routes, routeIds);
+    const routeTree = buildAccessibleDesktopRouteTreeWithAncestors(routes, routeIds);
     ctx.status = 200;
-    ctx.body = routes.map((route) => pickDesktopRouteRolePermissionTargetFields(route));
+    ctx.body = removeNestedRootDesktopRoutes(routeTree).map(
+      (route) => pickDesktopRouteRolePermissionTargetFields(route)
+    );
     return;
   }
   await next();
   await removeMultiPortalOwnedRoutesFromListResponse(ctx);
 }
 async function addDesktopRouteCreateMultiPortal(ctx, next) {
-  var _a, _b;
+  var _a, _b, _c;
   const portalRequest = await findRequestedMultiPortal(ctx);
   if (portalRequest.requested && !portalRequest.portal) {
     ctx.throw(400, "Invalid portal scope");
     return;
   }
-  const portal = portalRequest.portal;
-  const portalUid = portal == null ? void 0 : portal.get("uid");
-  if (typeof portalUid === "string" && portalUid) {
-    const explicitValues = ctx[EXPLICIT_DESKTOP_ROUTE_UI_LAYOUTS];
-    (_b = ctx.action) == null ? void 0 : _b.mergeParams(
+  const scope = portalRequest.scope;
+  if (scope) {
+    await assertDesktopRouteParentsBelongToScope(ctx, scope);
+    if (((_a = ctx.action) == null ? void 0 : _a.actionName) === "updateOrCreate") {
+      await assertDesktopRouteUpsertMatchesBelongToScope(ctx, scope);
+    }
+    (_c = ctx.action) == null ? void 0 : _c.mergeParams(
       {
-        values: withDesktopRouteMultiPortal((_a = ctx.action) == null ? void 0 : _a.params.values, portalUid, explicitValues)
+        values: withDesktopRouteEffectiveOwner((_b = ctx.action) == null ? void 0 : _b.params.values, scope)
       },
       {
         values: "overwrite"
       }
     );
     await next();
-    const desktopRouteIds = collectDesktopRouteIds(ctx.body);
-    await removeLayoutRoutePermissionsFromPortalOnlyRoutes(ctx, desktopRouteIds);
-    await grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, portalUid, desktopRouteIds);
     return;
   }
   await next();
 }
+async function addDesktopRouteEffectiveScopeFilter(ctx, next) {
+  var _a;
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (!portalRequest.requested) {
+    await next();
+    return;
+  }
+  if (!portalRequest.scope) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
+  (_a = ctx.action) == null ? void 0 : _a.mergeParams({
+    filter: portalRequest.scope.filter
+  });
+  await next();
+}
+function withoutDesktopRouteOwnerFields(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => withoutDesktopRouteOwnerFields(item));
+  }
+  if (!isDesktopRouteCreateValue(value)) {
+    return value;
+  }
+  const { uiLayouts: _uiLayouts, multiPortals: _multiPortals, children, ...route } = value;
+  return {
+    ...route,
+    ...Array.isArray(children) ? { children: withoutDesktopRouteOwnerFields(children) } : {}
+  };
+}
+function normalizeDesktopRouteTargetIds(records) {
+  return records.map((record) => record.get("id")).filter((id) => typeof id === "string" || typeof id === "number").map(String).sort();
+}
+async function findDesktopRouteMutationTargets(ctx, scopeFilter, transaction, selector) {
+  var _a;
+  const params = selector ?? ((_a = ctx.action) == null ? void 0 : _a.params) ?? {};
+  const values = params.values;
+  const batchUpdateIds = Array.isArray(values) ? values.flatMap((value) => {
+    if (!isDesktopRouteCreateValue(value)) {
+      return [];
+    }
+    const routeId = value.id;
+    return typeof routeId === "string" || typeof routeId === "number" ? [routeId] : [];
+  }) : [];
+  const hasBatchUpdateTargets = batchUpdateIds.length > 0;
+  const filterByTk = hasBatchUpdateTargets ? batchUpdateIds : params.filterByTk;
+  const filter = !hasBatchUpdateTargets && isRecordLike(params.filter) ? params.filter : void 0;
+  if ((filterByTk === void 0 || filterByTk === null) && !filter) {
+    return [];
+  }
+  return ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    ...filterByTk !== void 0 && filterByTk !== null ? { filterByTk } : {},
+    filter: {
+      ...filter ?? {},
+      ...scopeFilter ?? {}
+    },
+    ...transaction && !scopeFilter ? { lock: transaction.LOCK.UPDATE } : {},
+    transaction
+  });
+}
+async function assertDesktopRouteMutationTargetsBelongToScope(ctx, scope, transaction, selector) {
+  const allTargets = await findDesktopRouteMutationTargets(ctx, void 0, transaction, selector);
+  const scopedTargets = await findDesktopRouteMutationTargets(ctx, scope.filter, transaction, selector);
+  const allTargetIds = normalizeDesktopRouteTargetIds(allTargets);
+  const scopedTargetIds = normalizeDesktopRouteTargetIds(scopedTargets);
+  if (!allTargetIds.length || allTargetIds.join(",") !== scopedTargetIds.join(",")) {
+    ctx.throw(400, "Desktop route does not belong to the requested portal scope");
+  }
+}
+async function guardDesktopRouteUpdateScope(ctx, next) {
+  var _a, _b;
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (!portalRequest.requested) {
+    await next();
+    return;
+  }
+  const scope = portalRequest.scope;
+  if (!scope) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
+  await assertDesktopRouteMutationTargetsBelongToScope(ctx, scope);
+  await assertDesktopRouteParentsBelongToScope(ctx, scope);
+  (_b = ctx.action) == null ? void 0 : _b.mergeParams(
+    {
+      values: withoutDesktopRouteOwnerFields((_a = ctx.action) == null ? void 0 : _a.params.values)
+    },
+    {
+      values: "overwrite"
+    }
+  );
+  await next();
+}
+function getDesktopRoutePortalContext(context) {
+  var _a;
+  if (!isRecordLike(context)) {
+    return;
+  }
+  const ctx = context;
+  if (((_a = ctx.action) == null ? void 0 : _a.resourceName) !== "desktopRoutes" || !hasActionParam(ctx.action.params, "portal")) {
+    return;
+  }
+  return ctx;
+}
+async function resolveRequiredDesktopRouteScope(ctx, transaction) {
+  const portalRequest = await findRequestedMultiPortal(ctx, transaction);
+  if (!portalRequest.scope) {
+    ctx.throw(400, "Invalid portal scope");
+  }
+  return portalRequest.scope;
+}
+function withDesktopRouteScopeFilter(filter, scope) {
+  return {
+    ...isRecordLike(filter) ? filter : {},
+    ...scope.filter
+  };
+}
+class MultiPortalDesktopRouteRepository extends import_database.Repository {
+  async withAuthoritativeScopeTransaction(existingTransaction, callback) {
+    if (existingTransaction) {
+      return callback(existingTransaction);
+    }
+    return this.database.sequelize.transaction(callback);
+  }
+  async create(options) {
+    const ctx = getDesktopRoutePortalContext(options.context);
+    if (!ctx) {
+      return super.create(options);
+    }
+    return this.withAuthoritativeScopeTransaction(options.transaction, async (transaction) => {
+      const scope = await resolveRequiredDesktopRouteScope(ctx, transaction);
+      const values = withDesktopRouteEffectiveOwner(options.values, scope);
+      await assertDesktopRouteParentsBelongToScope(ctx, scope, values, transaction);
+      return super.create({
+        ...options,
+        values,
+        transaction
+      });
+    });
+  }
+  async update(options) {
+    const ctx = getDesktopRoutePortalContext(options.context);
+    if (!ctx) {
+      return super.update(options);
+    }
+    return this.withAuthoritativeScopeTransaction(options.transaction, async (transaction) => {
+      const scope = await resolveRequiredDesktopRouteScope(ctx, transaction);
+      await assertDesktopRouteMutationTargetsBelongToScope(ctx, scope, transaction, options);
+      const values = withoutDesktopRouteOwnerFields(options.values);
+      await assertDesktopRouteParentsBelongToScope(ctx, scope, values, transaction);
+      return super.update({
+        ...options,
+        filter: withDesktopRouteScopeFilter(options.filter, scope),
+        values,
+        transaction
+      });
+    });
+  }
+  async updateOrCreate(options) {
+    const ctx = getDesktopRoutePortalContext(options.context);
+    if (!ctx) {
+      return super.updateOrCreate(options);
+    }
+    return this.withAuthoritativeScopeTransaction(options.transaction, async (transaction) => {
+      const scope = await resolveRequiredDesktopRouteScope(ctx, transaction);
+      const values = withDesktopRouteEffectiveOwner(options.values, scope);
+      await assertDesktopRouteParentsBelongToScope(ctx, scope, values, transaction);
+      await assertDesktopRouteUpsertMatchesBelongToScope(ctx, scope, values, options.filterKeys, transaction);
+      return super.updateOrCreate({
+        ...options,
+        values,
+        transaction
+      });
+    });
+  }
+}
+async function guardDesktopRouteMoveScope(ctx, next) {
+  var _a;
+  const portalRequest = await findRequestedMultiPortal(ctx);
+  if (!portalRequest.requested) {
+    await next();
+    return;
+  }
+  const params = ((_a = ctx.action) == null ? void 0 : _a.params) ?? {};
+  const sourceId = params.sourceId;
+  const targetId = params.targetId;
+  const hasTargetId = targetId !== void 0 && targetId !== null;
+  if (typeof sourceId !== "string" && typeof sourceId !== "number" || hasTargetId && typeof targetId !== "string" && typeof targetId !== "number" || params.sortField !== void 0 && params.sortField !== "sort") {
+    ctx.throw(400, "Invalid desktop route move scope");
+    return;
+  }
+  await ctx.db.sequelize.transaction(async (transaction) => {
+    const scope = await resolveRequiredDesktopRouteScope(ctx, transaction);
+    const routeIds = uniqueDesktopRouteIds(hasTargetId ? [sourceId, targetId] : [sourceId]);
+    const allRoutes = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id", "parentId", "sort"],
+      filter: {
+        id: routeIds
+      },
+      lock: transaction.LOCK.UPDATE,
+      transaction
+    });
+    const scopedRoutes = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id", "parentId", "sort"],
+      filter: {
+        id: routeIds,
+        ...scope.filter
+      },
+      transaction
+    });
+    if (normalizeDesktopRouteTargetIds(allRoutes).join(",") !== normalizeDesktopRouteTargetIds(scopedRoutes).join(",") || scopedRoutes.length !== routeIds.length) {
+      ctx.throw(400, "Move target does not belong to the requested portal scope");
+      return;
+    }
+    const routesById = new Map(
+      scopedRoutes.map((route) => [String(route.get("id")), route])
+    );
+    let source = routesById.get(String(sourceId));
+    const target = hasTargetId ? routesById.get(String(targetId)) : void 0;
+    if (!source || hasTargetId && !target) {
+      ctx.throw(400, "Move target does not belong to the requested portal scope");
+      return;
+    }
+    const targetScope = isRecordLike(params.targetScope) ? params.targetScope : void 0;
+    const requestedParentId = targetScope == null ? void 0 : targetScope.parentId;
+    const parentIds = uniqueDesktopRouteIds(
+      [source.get("parentId"), target == null ? void 0 : target.get("parentId"), requestedParentId].filter(
+        (id) => typeof id === "string" || typeof id === "number"
+      )
+    );
+    if (parentIds.length) {
+      const parents = await ctx.db.getRepository("desktopRoutes").find({
+        fields: ["id"],
+        filter: {
+          id: parentIds,
+          ...scope.filter
+        },
+        transaction
+      });
+      if (normalizeDesktopRouteTargetIds(parents).join(",") !== parentIds.map(String).sort().join(",")) {
+        ctx.throw(400, "Move parent does not belong to the requested portal scope");
+        return;
+      }
+    }
+    const updateSource = async (values, silent) => {
+      const [updatedSource] = await ctx.db.getRepository("desktopRoutes").update({
+        filterByTk: sourceId,
+        values,
+        silent,
+        transaction
+      });
+      if (!updatedSource) {
+        ctx.throw(400, "Move source does not belong to the requested portal scope");
+      }
+      source = updatedSource;
+    };
+    if (target) {
+      const targetParentId = target.get("parentId");
+      if (source.get("parentId") !== targetParentId) {
+        await updateSource({ parentId: targetParentId }, false);
+      }
+      const sourceSort = source.get("sort");
+      let targetSort = target.get("sort");
+      if (typeof sourceSort !== "number" || typeof targetSort !== "number") {
+        ctx.throw(400, "Invalid desktop route sort value");
+        return;
+      }
+      if (params.method === "insertAfter") {
+        targetSort += 1;
+      }
+      const movesForward = targetSort > sourceSort;
+      const affectedRoutes = await ctx.db.getRepository("desktopRoutes").find({
+        fields: ["id"],
+        filter: {
+          ...scope.filter,
+          parentId: targetParentId ?? null,
+          sort: movesForward ? {
+            $gt: sourceSort,
+            $lte: targetSort
+          } : {
+            $lt: sourceSort,
+            $gte: targetSort
+          }
+        },
+        transaction
+      });
+      const affectedRouteIds = affectedRoutes.map((route) => route.get("id"));
+      if (affectedRouteIds.length) {
+        await ctx.db.getCollection("desktopRoutes").model.increment("sort", {
+          where: {
+            id: {
+              [import_database.Op.in]: affectedRouteIds
+            }
+          },
+          by: movesForward ? -1 : 1,
+          silent: true,
+          transaction
+        });
+      }
+      await updateSource({ sort: targetSort }, true);
+    }
+    if (requestedParentId && source.get("parentId") !== requestedParentId) {
+      await updateSource({ parentId: requestedParentId }, false);
+      if (params.method === "prepend") {
+        await updateSource({ sort: 0 }, true);
+      }
+    }
+    if (params.sticky) {
+      await updateSource({ sort: 0 }, true);
+    }
+  });
+  ctx.body = "ok";
+}
+function normalizeDesktopRouteFilterByTk(filterByTk) {
+  const values = Array.isArray(filterByTk) ? filterByTk : [filterByTk];
+  return uniqueDesktopRouteIds(
+    values.filter((value) => typeof value === "string" || typeof value === "number")
+  );
+}
+async function getDesktopRouteDestroyOwnerScope(ctx, transaction) {
+  var _a, _b, _c, _d;
+  const hasPortalScope = hasActionParam((_a = ctx.action) == null ? void 0 : _a.params, "portal");
+  const hasLayoutScope = hasActionParam((_b = ctx.action) == null ? void 0 : _b.params, "layout");
+  const portalUid = getExplicitRequestedLayoutUid((_c = ctx.action) == null ? void 0 : _c.params.portal);
+  const layoutUid = getExplicitRequestedLayoutUid((_d = ctx.action) == null ? void 0 : _d.params.layout);
+  if (hasPortalScope && hasLayoutScope) {
+    ctx.throw(400, "layout and portal cannot be used together");
+    return;
+  }
+  if (hasPortalScope) {
+    if (!portalUid) {
+      ctx.throw(400, "Invalid portal scope");
+      return;
+    }
+    const portalRequest = await findRequestedMultiPortal(ctx, transaction);
+    if (!portalRequest.scope) {
+      ctx.throw(400, "Invalid portal scope");
+      return;
+    }
+    return portalRequest.scope;
+  }
+  if (!hasLayoutScope) {
+    return;
+  }
+  if (!layoutUid) {
+    ctx.throw(400, "Invalid layout scope");
+    return;
+  }
+  const layout = await ctx.db.getRepository("uiLayouts").findOne({
+    fields: ["uid"],
+    filter: {
+      uid: layoutUid
+    },
+    transaction
+  });
+  if (!layout) {
+    ctx.throw(400, "Invalid layout scope");
+    return;
+  }
+  return {
+    filter: {
+      "uiLayouts.uid": layoutUid
+    },
+    relation: "uiLayouts",
+    uid: layoutUid
+  };
+}
+async function findDesktopRouteDestroyRoots(ctx, transaction, scopeFilter) {
+  var _a, _b, _c;
+  const filterByTk = normalizeDesktopRouteFilterByTk((_a = ctx.action) == null ? void 0 : _a.params.filterByTk);
+  const actionFilter = isRecordLike((_b = ctx.action) == null ? void 0 : _b.params.filter) ? (_c = ctx.action) == null ? void 0 : _c.params.filter : void 0;
+  if (!filterByTk.length && !actionFilter) {
+    return [];
+  }
+  const records = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      ...actionFilter ?? {},
+      ...scopeFilter ?? {},
+      ...filterByTk.length ? { id: filterByTk } : {}
+    },
+    ...scopeFilter ? {} : { lock: transaction.LOCK.UPDATE },
+    transaction
+  });
+  return collectDesktopRouteIds(records);
+}
+async function findDesktopRouteSubtreeIds(ctx, rootId, transaction) {
+  const rootRoutes = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      id: rootId
+    },
+    lock: transaction.LOCK.UPDATE,
+    transaction
+  });
+  const routeIds = collectDesktopRouteIds(rootRoutes);
+  let parentIds = [...routeIds];
+  while (parentIds.length) {
+    const children = await ctx.db.getRepository("desktopRoutes").find({
+      fields: ["id"],
+      filter: {
+        parentId: parentIds
+      },
+      lock: transaction.LOCK.UPDATE,
+      sort: ["id"],
+      transaction
+    });
+    const childIds = collectDesktopRouteIds(children).filter((routeId) => !routeIds.includes(routeId));
+    routeIds.push(...childIds);
+    parentIds = childIds;
+  }
+  return routeIds;
+}
+function getDesktopRouteOwnerUids(route, relation) {
+  const owners = getRecordField(route, relation);
+  if (!Array.isArray(owners)) {
+    return [];
+  }
+  return owners.map((owner) => getRecordField(owner, "uid")).filter((uid) => typeof uid === "string" && !!uid);
+}
+function desktopRouteHasOwnerOutsideScope(route, scope) {
+  const multiPortalUids = getDesktopRouteOwnerUids(route, "multiPortals");
+  const uiLayoutUids = getDesktopRouteOwnerUids(route, "uiLayouts");
+  if (scope.relation === "multiPortals") {
+    return multiPortalUids.some((uid) => uid !== scope.uid) || uiLayoutUids.length > 0;
+  }
+  return uiLayoutUids.some((uid) => uid !== scope.uid) || multiPortalUids.length > 0;
+}
+async function detachDesktopRouteTreeOwner(ctx, routeIds, scope, transaction) {
+  if (scope.relation === "multiPortals") {
+    await ctx.db.getRepository("rolesMultiPortalDesktopRoutes").destroy({
+      filter: {
+        multiPortalUid: scope.uid,
+        desktopRouteId: routeIds
+      },
+      transaction
+    });
+  }
+  for (const routeId of routeIds) {
+    await ctx.db.getRepository(`desktopRoutes.${scope.relation}`, routeId).remove({
+      tk: scope.uid,
+      transaction
+    });
+  }
+}
+async function detachOwnerAndFindDestroyRoots(ctx, routeIds, scope, transaction) {
+  var _a;
+  await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      id: routeIds
+    },
+    lock: transaction.LOCK.UPDATE,
+    transaction
+  });
+  const routes = await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id", "parentId"],
+    appends: ["multiPortals", "uiLayouts"],
+    filter: {
+      id: routeIds
+    },
+    transaction
+  });
+  const routesById = new Map(routes.map((route) => [String(route.get("id")), route]));
+  const ownerlessRouteIds = new Set(
+    routes.filter((route) => !desktopRouteHasOwnerOutsideScope(route, scope)).map((route) => String(route.get("id")))
+  );
+  await detachDesktopRouteTreeOwner(ctx, routeIds, scope, transaction);
+  for (const route of routes) {
+    if (ownerlessRouteIds.has(String(route.get("id")))) {
+      continue;
+    }
+    let parentId = route.get("parentId");
+    const visitedParentIds = /* @__PURE__ */ new Set();
+    while (parentId !== null && parentId !== void 0 && ownerlessRouteIds.has(String(parentId))) {
+      const normalizedParentId = String(parentId);
+      if (visitedParentIds.has(normalizedParentId)) {
+        ctx.throw(400, "Invalid desktop route tree");
+        return [];
+      }
+      visitedParentIds.add(normalizedParentId);
+      parentId = ((_a = routesById.get(normalizedParentId)) == null ? void 0 : _a.get("parentId")) ?? null;
+    }
+    if (route.get("parentId") !== parentId) {
+      await ctx.db.getRepository("desktopRoutes").update({
+        filterByTk: route.get("id"),
+        values: {
+          parentId
+        },
+        transaction
+      });
+    }
+  }
+  return routes.filter((route) => {
+    if (!ownerlessRouteIds.has(String(route.get("id")))) {
+      return false;
+    }
+    const parentId = route.get("parentId");
+    return parentId === null || parentId === void 0 || !ownerlessRouteIds.has(String(parentId));
+  }).map((route) => route.get("id"));
+}
+async function destroyScopedDesktopRoutes(ctx, next) {
+  var _a, _b;
+  if (!hasActionParam((_a = ctx.action) == null ? void 0 : _a.params, "portal") && !hasActionParam((_b = ctx.action) == null ? void 0 : _b.params, "layout")) {
+    await next();
+    return;
+  }
+  const result = await ctx.db.sequelize.transaction(async (transaction) => {
+    const scope = await getDesktopRouteDestroyOwnerScope(ctx, transaction);
+    if (!scope) {
+      return true;
+    }
+    const allRootIds = (await findDesktopRouteDestroyRoots(ctx, transaction)).sort(
+      (left, right) => String(left).localeCompare(String(right))
+    );
+    const rootIds = (await findDesktopRouteDestroyRoots(ctx, transaction, scope.filter)).sort(
+      (left, right) => String(left).localeCompare(String(right))
+    );
+    if (allRootIds.map(String).join(",") !== rootIds.map(String).join(",")) {
+      ctx.throw(400, "Desktop route does not belong to the requested portal scope");
+      return true;
+    }
+    const routeTrees = [];
+    for (const rootId of rootIds) {
+      routeTrees.push({
+        rootId,
+        routeIds: await findDesktopRouteSubtreeIds(ctx, rootId, transaction)
+      });
+    }
+    const rootRouteTrees = routeTrees.filter(
+      (routeTree, index) => !routeTrees.some(
+        (candidate, candidateIndex) => candidateIndex !== index && candidate.routeIds.includes(routeTree.rootId)
+      )
+    );
+    const physicalDestroyRootIds = [];
+    for (const routeTree of rootRouteTrees) {
+      physicalDestroyRootIds.push(
+        ...await detachOwnerAndFindDestroyRoots(ctx, routeTree.routeIds, scope, transaction)
+      );
+    }
+    if (!physicalDestroyRootIds.length) {
+      return true;
+    }
+    return ctx.db.getRepository("desktopRoutes").destroy({
+      context: ctx,
+      filterByTk: physicalDestroyRootIds.length === 1 ? physicalDestroyRootIds[0] : physicalDestroyRootIds,
+      transaction
+    });
+  });
+  ctx.status = 200;
+  ctx.body = result;
+}
 async function listEnabledMultiPortals(ctx, next) {
   const records = await ctx.db.getRepository("multiPortals").find({
-    filter: withCustomMultiPortalFilter({
+    filter: {
       enabled: true,
-      "uiLayout.enabled": true
-    }),
-    fields: [...MULTI_PORTAL_RUNTIME_QUERY_FIELDS],
-    appends: ["uiLayout"],
+      uiLayoutUid: {
+        $in: [...import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS]
+      }
+    },
+    fields: [...MULTI_PORTAL_RUNTIME_FIELDS],
     sort: ["uid"]
   });
   ctx.body = records.map((record) => pickMultiPortalRuntimeFields(record));
   await next();
 }
-async function listAccessibleMultiPortals(ctx, next) {
-  const accessiblePortalUids = await listCurrentRoleAccessibleMultiPortalUids(ctx);
-  if (Array.isArray(accessiblePortalUids) && accessiblePortalUids.length === 0) {
-    ctx.body = [];
-    await next();
-    return;
+const DEFAULT_MULTI_PORTAL_RESPONSE_FIELDS = ["uid", "portalType", "routePath"];
+function getDefaultMultiPortalType(record) {
+  const portalType = record.get("portalType");
+  if (portalType === null || portalType === void 0) {
+    return "no-code";
   }
-  const filter = {
-    enabled: true,
-    "uiLayout.enabled": true
+  return isMultiPortalSeedType(portalType) ? portalType : null;
+}
+function pickDefaultMultiPortalFields(record) {
+  return {
+    uid: String(record.get("uid")),
+    portalType: getDefaultMultiPortalType(record) || "no-code",
+    routePath: String(record.get("routePath"))
   };
-  if (Array.isArray(accessiblePortalUids)) {
-    filter.uid = accessiblePortalUids;
+}
+async function findEnabledDefaultMultiPortal(ctx, transaction) {
+  const record = await ctx.db.getRepository("multiPortals").findOne({
+    filter: {
+      enabled: true,
+      isDefault: true
+    },
+    fields: [...DEFAULT_MULTI_PORTAL_RESPONSE_FIELDS, "uiLayoutUid"],
+    transaction
+  });
+  if (!record) {
+    return null;
+  }
+  const portalType = getDefaultMultiPortalType(record);
+  if (!portalType) {
+    return null;
+  }
+  if (!(0, import_constants.isMultiPortalUiLayoutUid)(record.get("uiLayoutUid"))) {
+    return null;
+  }
+  return record;
+}
+async function getDefaultMultiPortal(ctx, next) {
+  const record = await findEnabledDefaultMultiPortal(ctx);
+  ctx.body = record ? pickDefaultMultiPortalFields(record) : null;
+  ctx.status = 200;
+  await next();
+}
+async function setDefaultMultiPortal(ctx, next) {
+  var _a;
+  const filterByTk = (_a = ctx.action) == null ? void 0 : _a.params.filterByTk;
+  if (filterByTk === void 0 || filterByTk === null || filterByTk === "") {
+    ctx.throw(400, ctx.t("filterByTk is required", { ns: import_constants.NAMESPACE }));
+    return;
   }
+  const repository = ctx.db.getRepository("multiPortals");
+  const updated = await ctx.db.sequelize.transaction(async (transaction) => {
+    const target = await repository.findOne({
+      filterByTk,
+      fields: [...DEFAULT_MULTI_PORTAL_RESPONSE_FIELDS, "enabled", "uiLayoutUid"],
+      lock: transaction.LOCK.UPDATE,
+      transaction
+    });
+    if (!target) {
+      ctx.throw(404, ctx.t("Portal not found", { ns: import_constants.NAMESPACE }));
+      return null;
+    }
+    if (target.get("enabled") !== true) {
+      ctx.throw(400, ctx.t("Disabled Portal cannot be set as default", { ns: import_constants.NAMESPACE }));
+      return null;
+    }
+    const portalType = getDefaultMultiPortalType(target);
+    if (!portalType) {
+      ctx.throw(400, ctx.t("Unsupported Portal type cannot be set as default", { ns: import_constants.NAMESPACE }));
+      return null;
+    }
+    if (!(0, import_constants.isMultiPortalUiLayoutUid)(target.get("uiLayoutUid"))) {
+      ctx.throw(400, ctx.t("Portal device configuration is invalid", { ns: import_constants.NAMESPACE }));
+      return null;
+    }
+    await repository.update({
+      filter: { isDefault: true },
+      values: { isDefault: null },
+      transaction
+    });
+    await repository.update({
+      filterByTk,
+      values: { isDefault: true },
+      transaction
+    });
+    return repository.findOne({
+      filterByTk,
+      fields: [...DEFAULT_MULTI_PORTAL_RESPONSE_FIELDS],
+      transaction
+    });
+  });
+  ctx.body = updated ? pickDefaultMultiPortalFields(updated) : null;
+  await next();
+}
+async function listAccessibleMultiPortals(ctx, next) {
+  const accessiblePortalUids = await listCurrentRoleAccessibleMultiPortalUids(ctx);
   const records = await ctx.db.getRepository("multiPortals").find({
-    filter: withCustomMultiPortalFilter(filter),
-    fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
-    appends: ["uiLayout"],
+    filter: {
+      enabled: true,
+      uiLayoutUid: {
+        $in: [...import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS]
+      }
+    },
+    fields: [...MULTI_PORTAL_ACCESSIBLE_FIELDS],
     sort: ["uid"]
   });
-  ctx.body = records.map((record) => pickMultiPortalAccessibleFields(record));
+  const accessiblePortalUidSet = Array.isArray(accessiblePortalUids) ? new Set(accessiblePortalUids) : void 0;
+  const accessibleRecords = records.filter(
+    (record) => (0, import_constants.isDefaultLayoutMultiPortalUid)(record.get("uid")) || !accessiblePortalUidSet || accessiblePortalUidSet.has(String(record.get("uid")))
+  );
+  ctx.body = accessibleRecords.map((record) => pickMultiPortalAccessibleFields(record));
   await next();
 }
-async function grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, multiPortalUid, desktopRouteIds) {
+async function grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, multiPortalUid, desktopRouteIds, transaction) {
   if (!desktopRouteIds.length) {
     return;
   }
-  if (!ctx.db.getCollection("rolesMultiPortalRoutePolicies") || !ctx.db.getCollection("rolesMultiPortalDesktopRoutes")) {
-    return;
-  }
   const routePolicies = await ctx.db.getRepository("rolesMultiPortalRoutePolicies").find({
     fields: ["roleName"],
     filter: {
       multiPortalUid,
       allowNewMenu: true
-    }
+    },
+    transaction
   });
   const roleNames = routePolicies.map((routePolicy) => routePolicy.get("roleName")).filter((roleName) => typeof roleName === "string" && !!roleName);
   if (!roleNames.length) {
@@ -1540,26 +2414,52 @@ async function grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, multiPortalUid
           multiPortalUid,
           desktopRouteId
         },
-        context: ctx
+        context: ctx,
+        transaction
       });
     }
   }
 }
-async function removeLayoutRoutePermissionsFromPortalOnlyRoutes(ctx, desktopRouteIds) {
-  if (!desktopRouteIds.length || !ctx.db.getCollection("rolesDesktopRoutes")) {
-    return;
-  }
-  const portalOnlyRouteIds = await getPortalOnlyDesktopRouteIds(ctx, desktopRouteIds);
-  if (portalOnlyRouteIds.size === 0) {
+async function removeLayoutRoutePermissionsFromPortalRoutes(ctx, desktopRouteIds, transaction) {
+  if (!desktopRouteIds.length) {
     return;
   }
   await ctx.db.getRepository("rolesDesktopRoutes").destroy({
     filter: {
-      desktopRouteId: Array.from(portalOnlyRouteIds)
+      desktopRouteId: desktopRouteIds
     },
-    context: ctx
+    context: ctx,
+    transaction
   });
 }
+async function reconcileCreatedDesktopRoutePermissions(desktopRoute, options) {
+  const ctx = options == null ? void 0 : options.context;
+  if (!ctx) {
+    return;
+  }
+  const portalRequest = await findRequestedMultiPortal(ctx, options.transaction);
+  if (!portalRequest.requested) {
+    return;
+  }
+  const scope = portalRequest.scope;
+  if (!scope) {
+    ctx.throw(400, "Invalid portal scope");
+    return;
+  }
+  if (scope.relation !== "multiPortals") {
+    return;
+  }
+  const transaction = options.transaction;
+  if (!transaction) {
+    throw new Error("Portal desktop route creation requires a transaction");
+  }
+  const desktopRouteId = desktopRoute.get("id");
+  if (typeof desktopRouteId !== "string" && typeof desktopRouteId !== "number") {
+    throw new Error("Created Portal desktop route has no identifier");
+  }
+  await removeLayoutRoutePermissionsFromPortalRoutes(ctx, [desktopRouteId], transaction);
+  await grantDefaultRouteAccessToNewMultiPortalRoutes(ctx, scope.portalUid, [desktopRouteId], transaction);
+}
 async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
   if (multiPortal.get("enabled") !== true) {
     return;
@@ -1568,7 +2468,7 @@ async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
   if (typeof multiPortalUid !== "string" || !multiPortalUid) {
     return;
   }
-  if (isDefaultMultiPortalUid(multiPortalUid)) {
+  if ((0, import_constants.isDefaultLayoutMultiPortalUid)(multiPortalUid)) {
     return;
   }
   if (!db.getCollection("roles") || !db.getCollection("rolesMultiPortals")) {
@@ -1602,7 +2502,7 @@ async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
       transaction: options == null ? void 0 : options.transaction
     });
   }
-  if (!db.getCollection("rolesMultiPortalRoutePolicies")) {
+  if (multiPortal.get("portalType") === "ai" || !db.getCollection("rolesMultiPortalRoutePolicies")) {
     return;
   }
   const routePolicyRepository = db.getRepository("rolesMultiPortalRoutePolicies");
@@ -1617,11 +2517,15 @@ async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
 class PluginMultiPortalServer extends import_server.Plugin {
   portalStorageTaskKeys = /* @__PURE__ */ new Set();
   portalStorageTasks = /* @__PURE__ */ new Map();
+  deprecatedInitPortalEnvWarningEmitted = false;
   async afterAdd() {
   }
   getAppName() {
     return this.app.name || MAIN_APP_NAME;
   }
+  getCurrentStorageAppName() {
+    return normalizePortalStorageName(this.getAppName()) || MAIN_APP_NAME;
+  }
   getMultiPortalStorageItem(multiPortal, previous = false) {
     const record = multiPortal;
     const readField = (field) => previous && typeof record.previous === "function" ? record.previous(field) : getRecordField(record, field);
@@ -1636,8 +2540,7 @@ class PluginMultiPortalServer extends import_server.Plugin {
     return {
       appName: this.getAppName(),
       portalName,
-      enabled: readField("enabled") === true,
-      config: getPortalStorageConfig(readField("options"))
+      enabled: readField("enabled") === true
     };
   }
   warnPortalStorageSyncFailed(error) {
@@ -1647,6 +2550,14 @@ class PluginMultiPortalServer extends import_server.Plugin {
       error
     });
   }
+  logPortalBuildHtml(item, status, reason) {
+    var _a, _b;
+    (_b = (_a = this.app.logger) == null ? void 0 : _a.info) == null ? void 0 : _b.call(_a, `Portal yarn build:html ${status} for ${item.appName}/${item.portalName}`, {
+      appName: item.appName,
+      portalName: item.portalName,
+      reason
+    });
+  }
   getPortalStorageTaskKey(item) {
     return `${item.appName}/${item.portalName}`;
   }
@@ -1665,10 +2576,9 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
     await run();
   }
-  async removePortalStorageDist(item) {
-    await import_fs.default.promises.rm((0, import_utils.storagePathJoin)("portals", item.appName, item.portalName, "dist"), {
-      force: true,
-      recursive: true
+  async removePortalStorageIndexHtml(item) {
+    await import_fs.default.promises.rm((0, import_utils.storagePathJoin)("portals", item.appName, item.portalName, "dist", "index.html"), {
+      force: true
     });
   }
   waitForPortalStorageTasks() {
@@ -1678,10 +2588,11 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
     return Promise.allSettled(tasks).then(() => void 0);
   }
-  async schedulePortalTemplateCopyAndBuild(item, template, portalDir) {
+  async schedulePortalTemplateCopyAndBuild(item, template, portalDir, options) {
     var _a;
     const taskKey = this.getPortalStorageTaskKey(item);
     if (this.portalStorageTaskKeys.has(taskKey)) {
+      this.logPortalBuildHtml(item, "skipped", "a storage task is already running");
       await ((_a = template.cleanup) == null ? void 0 : _a.call(template));
       return;
     }
@@ -1702,14 +2613,13 @@ class PluginMultiPortalServer extends import_server.Plugin {
           await copyPortalTemplate(template.dir, portalDir);
           await appendPortalStorageLog(logPath, `Default portal template copied to ${portalDir}.`);
         }
-        await ensurePortalStorageConfigFiles(portalDir, item);
-        await appendPortalStorageLog(logPath, `Portal configuration files updated in ${portalDir}.`);
         if (item.enabled) {
-          await buildPortalStorageItem(portalDir, item);
+          this.logPortalBuildHtml(item, "requested", "storage directory was initialized");
+          await buildPortalStorageItem(portalDir, item, options);
+          this.logPortalBuildHtml(item, "completed", "yarn build:html finished successfully");
           return;
         }
-        await this.removePortalStorageDist(item);
-        await appendPortalStorageLog(logPath, `Portal dist directory removed for ${item.appName}/${item.portalName}.`);
+        this.logPortalBuildHtml(item, "skipped", "the portal is disabled");
       } catch (error) {
         await appendPortalStorageLog(
           logPath,
@@ -1725,32 +2635,41 @@ class PluginMultiPortalServer extends import_server.Plugin {
     this.portalStorageTasks.set(taskKey, task);
     await task;
   }
-  async ensurePortalStorageItem(item) {
+  async ensurePortalStorageItem(item, options = {}) {
     const portalDir = (0, import_utils.storagePathJoin)("portals", item.appName, item.portalName);
     const portalIndex = import_path.default.join(portalDir, "dist", "index.html");
+    const logPath = getPortalStorageLogPath(item);
     if (!await pathExists(portalDir)) {
-      const template = await resolvePortalTemplate(getInitPortalTemplate(), getPortalStorageLogPath(item));
-      await this.schedulePortalTemplateCopyAndBuild(item, template, portalDir);
+      const template = await resolvePortalTemplate(getInitPortalTemplate(), logPath);
+      await this.schedulePortalTemplateCopyAndBuild(item, template, portalDir, options);
       return;
     }
-    await ensurePortalStorageConfigFiles(portalDir, item);
     if (item.enabled) {
-      if (!await pathExists(portalIndex)) {
-        await buildPortalStorageItem(portalDir, item);
+      const hasPortalIndex = await pathExists(portalIndex);
+      if (options.forceBuild || !hasPortalIndex) {
+        this.logPortalBuildHtml(
+          item,
+          "requested",
+          options.forceBuild ? "forceBuild is enabled" : "dist/index.html does not exist"
+        );
+        await buildPortalStorageItem(portalDir, item, options);
+        this.logPortalBuildHtml(item, "completed", "yarn build:html finished successfully");
+      } else {
+        this.logPortalBuildHtml(item, "skipped", "dist/index.html already exists");
       }
       return;
     }
-    await this.removePortalStorageDist(item);
+    this.logPortalBuildHtml(item, "skipped", "the portal is disabled");
   }
-  async syncMultiPortalStorageItem(multiPortal, options, syncPrevious = false) {
+  async syncMultiPortalStorageItem(multiPortal, options, syncPrevious = false, forceBuild = false) {
     const currentItem = this.getMultiPortalStorageItem(multiPortal);
     const previousItem = syncPrevious ? this.getMultiPortalStorageItem(multiPortal, true) : null;
     await this.runPortalStorageTask(async () => {
-      if (previousItem && (!currentItem || previousItem.appName !== currentItem.appName || previousItem.portalName !== currentItem.portalName || !currentItem.enabled)) {
-        await this.removePortalStorageDist(previousItem);
+      if (previousItem && (!currentItem || previousItem.appName !== currentItem.appName || previousItem.portalName !== currentItem.portalName)) {
+        await this.removePortalStorageIndexHtml(previousItem);
       }
       if (currentItem) {
-        await this.ensurePortalStorageItem(currentItem);
+        await this.ensurePortalStorageItem(currentItem, { ...options, forceBuild });
       }
     }, options);
   }
@@ -1793,12 +2712,12 @@ class PluginMultiPortalServer extends import_server.Plugin {
     await next();
   }
   async deployPortalDist(ctx, next) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c;
     const deployCtx = ctx;
-    const appName = normalizePortalStorageName(((_a = deployCtx.request.body) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
-    const portalName = normalizePortalStorageName((_b = deployCtx.request.body) == null ? void 0 : _b.portal);
-    const basePath = trimString((_c = deployCtx.request.body) == null ? void 0 : _c.basePath);
-    const filePath = trimString((_d = deployCtx.request.file) == null ? void 0 : _d.path);
+    const appName = this.getCurrentStorageAppName();
+    const portalName = normalizePortalStorageName((_a = deployCtx.request.body) == null ? void 0 : _a.portal);
+    const basePath = trimString((_b = deployCtx.request.body) == null ? void 0 : _b.basePath);
+    const filePath = trimString((_c = deployCtx.request.file) == null ? void 0 : _c.path);
     try {
       if (!isValidPortalDeploySegment(appName)) {
         throw new Error("Invalid app");
@@ -1835,9 +2754,9 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
   }
   async pullPortalSource(ctx, next) {
-    var _a, _b;
-    const appName = normalizePortalStorageName(((_a = ctx.action.params.values) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
-    const portalName = normalizePortalStorageName((_b = ctx.action.params.values) == null ? void 0 : _b.portal);
+    var _a;
+    const appName = this.getCurrentStorageAppName();
+    const portalName = normalizePortalStorageName((_a = ctx.action.params.values) == null ? void 0 : _a.portal);
     try {
       if (!isValidPortalDeploySegment(appName)) {
         throw new Error("Invalid app");
@@ -1857,11 +2776,11 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
   }
   async pushPortalSource(ctx, next) {
-    var _a, _b, _c;
+    var _a, _b;
     const sourceCtx = ctx;
-    const appName = normalizePortalStorageName(((_a = sourceCtx.request.body) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
-    const portalName = normalizePortalStorageName((_b = sourceCtx.request.body) == null ? void 0 : _b.portal);
-    const filePath = trimString((_c = sourceCtx.request.file) == null ? void 0 : _c.path);
+    const appName = this.getCurrentStorageAppName();
+    const portalName = normalizePortalStorageName((_a = sourceCtx.request.body) == null ? void 0 : _a.portal);
+    const filePath = trimString((_b = sourceCtx.request.file) == null ? void 0 : _b.path);
     try {
       if (!isValidPortalDeploySegment(appName)) {
         throw new Error("Invalid app");
@@ -1913,62 +2832,43 @@ class PluginMultiPortalServer extends import_server.Plugin {
   }
   async listAppPortalManifest(options) {
     const records = await this.db.getRepository("multiPortals").find({
-      filter: withCustomMultiPortalFilter({
+      filter: {
         enabled: true,
-        "uiLayout.enabled": true
-      }),
-      fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
-      appends: ["uiLayout"],
+        uiLayoutUid: {
+          $in: [...import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS]
+        }
+      },
+      fields: [...MULTI_PORTAL_ACCESSIBLE_FIELDS],
       sort: ["uid"],
       transaction: options == null ? void 0 : options.transaction
     });
-    return records.map((record) => {
-      const portal = pickMultiPortalAccessibleFields(record);
-      const uiLayout = portal.uiLayout;
-      const uid = typeof portal.uid === "string" ? portal.uid : "";
-      const title = typeof portal.title === "string" ? portal.title : "";
-      return {
-        uid,
-        title,
-        icon: typeof portal.icon === "string" ? portal.icon : null,
-        portalType: typeof portal.portalType === "string" ? portal.portalType : null,
-        routePath: String(portal.routePath || ""),
-        layout: typeof (uiLayout == null ? void 0 : uiLayout.layoutType) === "string" ? uiLayout.layoutType : null
-      };
-    });
-  }
-  async getUiLayout(uid, options) {
-    if (typeof uid !== "string" || !uid) {
-      return null;
-    }
-    return this.db.getRepository("uiLayouts").findOne({
-      filterByTk: uid,
-      transaction: options == null ? void 0 : options.transaction
+    return records.flatMap((record) => {
+      const item = this.toAppPortalManifestItem(record);
+      return item ? [item] : [];
     });
   }
-  async toAppPortalManifestItem(multiPortal, options) {
+  toAppPortalManifestItem(multiPortal) {
     const uid = getRecordField(multiPortal, "uid");
     const title = getRecordField(multiPortal, "title");
     const portalType = getRecordField(multiPortal, "portalType");
     const routePath = getRecordField(multiPortal, "routePath");
     const enabled = getRecordField(multiPortal, "enabled");
-    if (typeof uid !== "string" || !uid || isDefaultMultiPortalUid(uid) || typeof title !== "string" || typeof routePath !== "string" || !routePath || enabled !== true) {
+    if (typeof uid !== "string" || !uid || typeof title !== "string" || typeof routePath !== "string" || !routePath || enabled !== true) {
       return null;
     }
     const uiLayoutUid = getRecordField(multiPortal, "uiLayoutUid");
-    const uiLayout = getRecordField(multiPortal, "uiLayout") || await this.getUiLayout(uiLayoutUid, options);
-    if (!uiLayout || getRecordField(uiLayout, "enabled") !== true) {
+    const layout = (0, import_constants.getMultiPortalLayoutType)(uiLayoutUid);
+    if (!layout) {
       return null;
     }
     const icon = getRecordField(multiPortal, "icon");
-    const layoutType = getRecordField(uiLayout, "layoutType");
     return {
       uid,
       title,
       icon: typeof icon === "string" ? icon : null,
       portalType: typeof portalType === "string" ? portalType : null,
       routePath,
-      layout: typeof layoutType === "string" ? layoutType : null
+      layout
     };
   }
   async setAppManifestItem(item, options) {
@@ -2011,30 +2911,13 @@ class PluginMultiPortalServer extends import_server.Plugin {
     if (typeof uid !== "string" || !uid) {
       return;
     }
-    const item = await this.toAppPortalManifestItem(multiPortal, options);
+    const item = this.toAppPortalManifestItem(multiPortal);
     if (item) {
       await this.setAppManifestItem(item, options);
       return;
     }
     await this.removeAppManifestItem(uid, options);
   }
-  async publishUiLayoutManifestItems(uiLayout, options) {
-    const uiLayoutUid = getRecordField(uiLayout, "uid");
-    if (typeof uiLayoutUid !== "string" || !uiLayoutUid) {
-      return;
-    }
-    const records = await this.db.getRepository("multiPortals").find({
-      filter: withCustomMultiPortalFilter({
-        uiLayoutUid
-      }),
-      fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
-      transaction: options == null ? void 0 : options.transaction
-    });
-    for (const record of records) {
-      record.set("uiLayout", uiLayout);
-      await this.publishAppManifestItem(record, options);
-    }
-  }
   async reconcilePortalStorage(options) {
     const records = await this.db.getRepository("multiPortals").find({
       filter: {
@@ -2085,6 +2968,10 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
   }
   async beforeLoad() {
+    this.app.db.registerRepositories({ MultiPortalDesktopRouteRepository });
+    this.app.resourceManager.registerPreActionHandler("roles:check", checkMultiPortalAccessForRolesCheck);
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:list", addDesktopRouteEffectiveScopeFilter);
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:get", addDesktopRouteEffectiveScopeFilter);
     this.app.resourceManager.registerPreActionHandler(
       "desktopRoutes:listAccessible",
       addMultiPortalListAccessibleGuard
@@ -2094,25 +2981,30 @@ class PluginMultiPortalServer extends import_server.Plugin {
       "desktopRoutes:listRolePermissionTargets",
       mapMultiPortalLayoutToUiLayoutForRolePermissionTargets
     );
+    this.app.resourceManager.registerPreActionHandler("multiPortals:create", preventDirectDefaultPortalMutation);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:create", validateMultiPortalUiLayoutUidWrite);
     this.app.resourceManager.registerPreActionHandler("multiPortals:create", captureSkipCreatePortalDirectory);
     this.app.resourceManager.registerPreActionHandler("multiPortals:create", normalizeMultiPortalSlugValues);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:create", preventUiLayoutRouteNameConflict);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:update", protectDefaultMultiPortalUpdate);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:update", preventDirectDefaultPortalMutation);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:update", validateMultiPortalUiLayoutUidWrite);
     this.app.resourceManager.registerPreActionHandler("multiPortals:update", normalizeMultiPortalSlugValues);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:update", preventUiLayoutRouteNameConflict);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", preventDirectDefaultPortalMutation);
+    this.app.resourceManager.registerPreActionHandler(
+      "multiPortals:firstOrCreate",
+      validateMultiPortalUiLayoutUidWrite
+    );
     this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", captureSkipCreatePortalDirectory);
     this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", normalizeMultiPortalSlugValues);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", preventUiLayoutRouteNameConflict);
-    this.app.resourceManager.registerPreActionHandler("desktopRoutes:create", captureExplicitDesktopRouteUiLayouts, {
-      before: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
-    });
     this.app.resourceManager.registerPreActionHandler(
-      "desktopRoutes:updateOrCreate",
-      captureExplicitDesktopRouteUiLayouts,
-      {
-        before: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
-      }
+      "multiPortals:updateOrCreate",
+      preventDirectDefaultPortalMutation
+    );
+    this.app.resourceManager.registerPreActionHandler(
+      "multiPortals:updateOrCreate",
+      validateMultiPortalUiLayoutUidWrite
     );
+    this.app.resourceManager.registerPreActionHandler("multiPortals:updateOrCreate", captureSkipCreatePortalDirectory);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:updateOrCreate", normalizeMultiPortalSlugValues);
     this.app.resourceManager.registerPreActionHandler("desktopRoutes:create", addDesktopRouteCreateMultiPortal, {
       after: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
     });
@@ -2123,6 +3015,9 @@ class PluginMultiPortalServer extends import_server.Plugin {
         after: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
       }
     );
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:update", guardDesktopRouteUpdateScope);
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:move", guardDesktopRouteMoveScope);
+    this.app.resourceManager.registerPreActionHandler("desktopRoutes:destroy", destroyScopedDesktopRoutes);
   }
   async load() {
     this.app.acl.registerSnippet({
@@ -2134,12 +3029,15 @@ class PluginMultiPortalServer extends import_server.Plugin {
       actions: ROLE_MULTI_PORTAL_PERMISSION_ACTIONS
     });
     this.app.acl.allow("multiPortals", "listEnabled", "public");
+    this.app.acl.allow("multiPortals", "getDefault", "public");
     this.app.acl.allow("multiPortals", "listAccessible", "loggedIn");
     this.app.resourceManager.use(createPortalDeployUploadMiddleware(), {
       tag: "multiPortalDeployUpload",
       after: "acl"
     });
     this.app.resourceManager.registerActionHandler("multiPortals:listEnabled", listEnabledMultiPortals);
+    this.app.resourceManager.registerActionHandler("multiPortals:getDefault", getDefaultMultiPortal);
+    this.app.resourceManager.registerActionHandler("multiPortals:setDefault", setDefaultMultiPortal);
     this.app.resourceManager.registerActionHandler("multiPortals:listAccessible", listAccessibleMultiPortals);
     this.app.resourceManager.registerActionHandler("multiPortals:deploy", async (ctx, next) => {
       await this.deployPortalDist(ctx, next);
@@ -2163,13 +3061,19 @@ class PluginMultiPortalServer extends import_server.Plugin {
     this.app.db.on("roles.beforeCreate", (role) => {
       (0, import_ensureDefaultRoleMultiPortalAccess.applyDefaultRoleMultiPortalAccess)(role);
     });
+    this.app.db.on("desktopRoutes.afterCreate", reconcileCreatedDesktopRoutePermissions);
+    this.app.db.on("multiPortals.beforeUpdate", (multiPortal) => {
+      if (multiPortal.get("enabled") === false && multiPortal.get("isDefault") === true) {
+        multiPortal.set("isDefault", null);
+      }
+    });
     this.app.db.on("multiPortals.afterCreate", async (multiPortal, options) => {
       await grantDefaultAccessToNewMultiPortal(this.app.db, multiPortal, options);
       await this.publishAppManifestItem(multiPortal, options);
       if (shouldSkipCreatePortalDirectory(options)) {
         return;
       }
-      await this.syncMultiPortalStorageItem(multiPortal, options);
+      await this.syncMultiPortalStorageItem(multiPortal, options, false, true);
     });
     this.app.db.on("multiPortals.afterUpdate", async (multiPortal, options) => {
       await this.publishAppManifestItem(multiPortal, options);
@@ -2182,19 +3086,28 @@ class PluginMultiPortalServer extends import_server.Plugin {
       }
       await this.removeMultiPortalStorageItem(multiPortal, options);
     });
-    this.app.db.on("uiLayouts.afterUpdate", async (uiLayout, options) => {
-      await this.publishUiLayoutManifestItems(uiLayout, options);
-    });
   }
   async install() {
-    await ensureDefaultMultiPortals(this.db);
-    await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);
+    var _a, _b;
+    if (!this.deprecatedInitPortalEnvWarningEmitted && hasDeprecatedInitPortalEnv()) {
+      this.deprecatedInitPortalEnvWarningEmitted = true;
+      (_b = (_a = this.app.logger) == null ? void 0 : _a.warn) == null ? void 0 : _b.call(
+        _a,
+        'INIT_PORTAL_TYPE and INIT_PORTAL_NAME are deprecated and no longer affect multi-portal seeding; NocoBase now creates the AI Portal "main" plus the fixed no-code "admin" and "mobile" portals by default.'
+      );
+    }
+    const version = await this.app.version.get();
+    if (!version) {
+      await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);
+      await seedFreshMultiPortals(this.db);
+    } else {
+      await seedHistoricalMultiPortals(this.db);
+    }
     await this.reconcilePortalStorage();
     await this.reconcileAppManifest();
   }
   async afterEnable() {
-    await ensureDefaultMultiPortals(this.db);
-    await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);
+    await repairFixedLayoutMultiPortalRecords(this.db);
     await this.reconcilePortalStorage();
     await this.reconcileAppManifest();
   }