@nocobase/plugin-multi-portal 2.2.0-alpha.12 → 2.4.0-alpha.2

package/dist/server/plugin.js

@@ -60,9 +60,9 @@ const MULTI_PORTAL_RUNTIME_FIELDS = [
   "portalName",
   "routePath",
   "authCheck",
-  "enabled"
+  "enabled",
+  "uiLayoutUid"
 ];
-const MULTI_PORTAL_RUNTIME_QUERY_FIELDS = [...MULTI_PORTAL_RUNTIME_FIELDS, "uiLayoutUid"];
 const MULTI_PORTAL_ACCESSIBLE_FIELDS = [
   "uid",
   "title",
@@ -71,18 +71,15 @@ const MULTI_PORTAL_ACCESSIBLE_FIELDS = [
   "portalName",
   "routePath",
   "authCheck",
-  "enabled"
+  "enabled",
+  "uiLayoutUid"
 ];
-const MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS = [...MULTI_PORTAL_ACCESSIBLE_FIELDS, "uiLayoutUid"];
-const MULTI_PORTAL_UI_LAYOUT_RUNTIME_FIELDS = ["layoutType"];
 const DESKTOP_ROUTE_ROLE_PERMISSION_TARGET_FIELDS = ["id", "title", "hidden", "parentId", "options"];
 const UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG = "plugin-ui-layout:desktop-route-write-layout";
 const MAIN_APP_NAME = "main";
 const UNION_ROLE_KEY = "__union__";
 const MULTI_PORTAL_MANIFEST_NAMESPACE = "multi-portal";
 const MULTI_PORTAL_MANIFEST_SYNC_MESSAGE_TYPE = "multi-portal:app-manifest-changed";
-const DEFAULT_INIT_PORTAL_TYPE = "ai";
-const DEFAULT_INIT_PORTAL_NAME = "main";
 const DEFAULT_INIT_PORTAL_TEMPLATE = "@nocobase/portal-template-default";
 const PORTAL_CLIENT_PREFIX = "x";
 const PORTAL_DEPLOY_UPLOAD_LIMIT = 200 * 1024 * 1024;
@@ -92,7 +89,9 @@ const PORTAL_PUBLIC_FILE_MODE = 420;
 const PORTAL_TEMPLATE_NPM_PACK_TIMEOUT_MS = 3e4;
 const DEFAULT_MULTI_PORTAL_UID = "__default_portal__";
 const MULTI_PORTAL_SLUG_PATTERN = /^[a-z0-9_-]+$/;
-const INIT_PORTAL_TYPES = ["no-code", "ai"];
+const PORTAL_ACCESS_DENIED_CODE = "PORTAL_ACCESS_DENIED";
+const PORTAL_CONTEXT_INVALID_CODE = "PORTAL_CONTEXT_INVALID";
+const PORTAL_NOT_FOUND_CODE = "PORTAL_NOT_FOUND";
 const MULTI_PORTAL_MANAGEMENT_ACTIONS = [
   "multiPortals:list",
   "multiPortals:get",
@@ -100,6 +99,7 @@ const MULTI_PORTAL_MANAGEMENT_ACTIONS = [
   "multiPortals:create",
   "multiPortals:update",
   "multiPortals:firstOrCreate",
+  "multiPortals:setDefault",
   "multiPortals:destroy",
   "multiPortals:deploy",
   "multiPortals:pullSource",
@@ -119,6 +119,11 @@ const ROLE_MULTI_PORTAL_PERMISSION_ACTIONS = [
   "rolesMultiPortalDesktopRoutes:*",
   "rolesMultiPortalRoutePolicies:*"
 ];
+const MULTI_PORTAL_SEED_TYPES = ["no-code", "ai"];
+const MULTI_PORTAL_SEED_TYPE_SET = new Set(MULTI_PORTAL_SEED_TYPES);
+function isMultiPortalSeedType(value) {
+  return typeof value === "string" && MULTI_PORTAL_SEED_TYPE_SET.has(value);
+}
 const SKIP_CREATE_PORTAL_DIRECTORY = Symbol("skipCreatePortalDirectory");
 function getRecordField(record, field) {
   if (!record || typeof record !== "object") {
@@ -144,46 +149,28 @@ async function pathExists(filePath) {
 function trimString(value) {
   return String(value ?? "").trim();
 }
-function isInitPortalType(value) {
-  return INIT_PORTAL_TYPES.includes(value);
-}
-function getInitPortalType() {
-  const portalType = trimString(process.env.INIT_PORTAL_TYPE) || DEFAULT_INIT_PORTAL_TYPE;
-  if (!isInitPortalType(portalType)) {
-    throw new Error('INIT_PORTAL_TYPE must be either "no-code" or "ai".');
-  }
-  return portalType;
-}
-function getInitPortalName() {
-  const portalName = trimString(process.env.INIT_PORTAL_NAME) || DEFAULT_INIT_PORTAL_NAME;
-  if (!MULTI_PORTAL_SLUG_PATTERN.test(portalName)) {
-    throw new Error("INIT_PORTAL_NAME can only contain lowercase letters, numbers, hyphens, and underscores.");
-  }
-  return portalName;
-}
 function getInitPortalTemplate() {
   return trimString(process.env.INIT_PORTAL_TEMPLATE) || DEFAULT_INIT_PORTAL_TEMPLATE;
 }
-function formatInitPortalTitle(portalName) {
-  const title = portalName.split(/[-_]/).filter(Boolean).map((segment) => `${segment.charAt(0).toUpperCase()}${segment.slice(1)}`).join(" ");
-  return title || portalName;
+function hasDeprecatedInitPortalEnv() {
+  return Boolean(trimString(process.env.INIT_PORTAL_TYPE) || trimString(process.env.INIT_PORTAL_NAME));
 }
-function getDefaultMultiPortalRecord() {
-  const portalName = getInitPortalName();
+function getDefaultAiMultiPortalRecord(options = {}) {
   return {
     uid: DEFAULT_MULTI_PORTAL_UID,
-    title: formatInitPortalTitle(portalName),
+    title: "Main",
     icon: "DesktopOutlined",
-    portalType: getInitPortalType(),
-    portalName,
-    routePath: `/${portalName}`,
+    portalType: "ai",
+    portalName: "main",
+    routePath: "/main",
     authCheck: true,
     enabled: true,
-    uiLayoutUid: "admin-layout-model"
+    ...options.isDefault ? { isDefault: true } : {},
+    uiLayoutUid: import_constants.ADMIN_UI_LAYOUT_UID
   };
 }
 function getFreshMultiPortalRecords() {
-  return [getDefaultMultiPortalRecord()];
+  return [getDefaultAiMultiPortalRecord({ isDefault: true }), ...getFixedLayoutMultiPortalRecords()];
 }
 function getFixedLayoutMultiPortalRecords() {
   return [
@@ -196,7 +183,7 @@ function getFixedLayoutMultiPortalRecords() {
       routePath: "/admin",
       authCheck: true,
       enabled: true,
-      uiLayoutUid: "admin-layout-model"
+      uiLayoutUid: import_constants.ADMIN_UI_LAYOUT_UID
     },
     {
       uid: import_constants.DEFAULT_MOBILE_MULTI_PORTAL_UID,
@@ -207,7 +194,7 @@ function getFixedLayoutMultiPortalRecords() {
       routePath: "/mobile",
       authCheck: true,
       enabled: true,
-      uiLayoutUid: "mobile-layout-model"
+      uiLayoutUid: import_constants.MOBILE_UI_LAYOUT_UID
     }
   ];
 }
@@ -292,6 +279,13 @@ function getPortalDeployBasePath(appName, portalName) {
   const portalPath = appName === MAIN_APP_NAME ? `/${PORTAL_CLIENT_PREFIX}/${portalName}/` : `/${PORTAL_CLIENT_PREFIX}/apps/${appName}/${portalName}/`;
   return resolvePortalStoragePublicPath(joinPortalStoragePublicPath(process.env.APP_PUBLIC_PATH || "/", portalPath));
 }
+function getPortalDeployBasePathCandidates(appName, portalName) {
+  const expectedBasePaths = [getPortalDeployBasePath(appName, portalName)];
+  if (appName !== MAIN_APP_NAME) {
+    expectedBasePaths.push(getPortalDeployBasePath(MAIN_APP_NAME, portalName));
+  }
+  return expectedBasePaths;
+}
 function createPortalDeployUploadMiddleware() {
   const storage = import_utils.koaMulter.diskStorage({
     destination: import_os.default.tmpdir(),
@@ -434,80 +428,13 @@ async function resolvePortalTemplate(templateSource, logPath) {
   return downloadPortalTemplatePackage(templateSource, logPath);
 }
 async function copyPortalTemplate(sourceDir, targetDir) {
-  const ignoredSegments = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store"]);
+  const ignoredSegments = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store", ".env", ".env.local"]);
   await import_fs.default.promises.mkdir(import_path.default.dirname(targetDir), { recursive: true });
   await import_fs.default.promises.cp(sourceDir, targetDir, {
     recursive: true,
     filter: (source) => !import_path.default.relative(sourceDir, source).split(import_path.default.sep).some((segment) => segment.startsWith("._") || ignoredSegments.has(segment))
   });
 }
-function getPortalStorageConfig(options) {
-  const sourceOptions = isRecordLike(options) ? options : {};
-  const sourceStorage = trimString(sourceOptions.sourceStorage);
-  if (sourceStorage !== "git") {
-    return { sourceStorage: "nocobase" };
-  }
-  const gitOptions = isRecordLike(sourceOptions.git) ? sourceOptions.git : {};
-  return {
-    sourceStorage,
-    git: {
-      repo: trimString(gitOptions.repo),
-      branch: trimString(gitOptions.branch) || "main",
-      path: trimString(gitOptions.path) || "."
-    }
-  };
-}
-function upsertPortalEnvContent(content, values) {
-  const nextValues = { ...values };
-  const lines = content ? content.replace(/\r\n/g, "\n").split("\n") : [];
-  const result = [];
-  for (const line of lines) {
-    if (!line && result.length === lines.length - 1) {
-      continue;
-    }
-    const match = line.match(/^(\s*)([A-Za-z_][A-Za-z0-9_]*)\s*=/);
-    const key = match == null ? void 0 : match[2];
-    if (key && Object.prototype.hasOwnProperty.call(nextValues, key)) {
-      result.push(`${key}=${nextValues[key]}`);
-      delete nextValues[key];
-      continue;
-    }
-    result.push(line);
-  }
-  for (const [key, value] of Object.entries(nextValues)) {
-    result.push(`${key}=${value}`);
-  }
-  return `${result.join("\n").replace(/\n*$/, "")}
-`;
-}
-async function upsertPortalEnvFile(filePath, values) {
-  let content = "";
-  try {
-    content = await import_fs.default.promises.readFile(filePath, "utf-8");
-  } catch {
-    content = "";
-  }
-  await import_fs.default.promises.writeFile(filePath, upsertPortalEnvContent(content, values), "utf-8");
-}
-async function ensurePortalStorageConfigFiles(portalDir, item) {
-  const apiUrl = getPortalStorageApiUrl(item.appName);
-  const portalBase = getPortalDeployBasePath(item.appName, item.portalName);
-  await import_fs.default.promises.mkdir(portalDir, { recursive: true });
-  await upsertPortalEnvFile(import_path.default.join(portalDir, ".env"), {
-    NOCOBASE_API_URL: resolvePortalStorageEnvApiUrl(apiUrl),
-    NOCOBASE_PORTAL_BASE: portalBase
-  });
-  await upsertPortalEnvFile(import_path.default.join(portalDir, ".env.local"), {
-    NOCOBASE_API_URL: apiUrl,
-    NOCOBASE_PORTAL_BASE: portalBase
-  });
-  await import_fs.default.promises.writeFile(
-    import_path.default.join(portalDir, "portal.config.json"),
-    `${JSON.stringify(item.config, null, 2)}
-`,
-    "utf-8"
-  );
-}
 function sanitizePortalStorageNodeOptions(value) {
   return trimString(value).split(/\s+/).filter((option) => option !== "--preserve-symlinks" && option !== "--preserve-symlinks-main").join(" ");
 }
@@ -592,17 +519,24 @@ async function runPortalStorageCommandOnce(command, args, options) {
     throw error;
   }
 }
-async function buildPortalStorageItem(portalDir, item) {
+function hasRequestAppHeader(options) {
+  var _a;
+  return Boolean(trimString((_a = options == null ? void 0 : options.context) == null ? void 0 : _a.get("X-App")));
+}
+async function buildPortalStorageItem(portalDir, item, options) {
   const logPath = getPortalStorageLogPath(item);
+  const buildAppName = hasRequestAppHeader(options) ? item.appName : MAIN_APP_NAME;
   const buildEnv = getPortalStorageCommandEnv({
-    NOCOBASE_API_URL: getPortalStorageApiUrl(item.appName),
-    NOCOBASE_PORTAL_BASE: getPortalDeployBasePath(item.appName, item.portalName),
+    NOCOBASE_API_URL: getPortalStorageApiUrl(buildAppName),
+    NOCOBASE_PORTAL_BASE: getPortalDeployBasePath(buildAppName, item.portalName),
+    SKIP_YARN_COREPACK_CHECK: "1",
+    COREPACK_ENABLE_STRICT: "0",
     COREPACK_ENABLE_PROJECT_SPEC: "0"
   });
   await appendPortalStorageLog(logPath, `Building portal ${item.appName}/${item.portalName}.`);
   await appendPortalStorageLog(
     logPath,
-    `Build environment: NOCOBASE_API_URL=${buildEnv.NOCOBASE_API_URL || ""} NOCOBASE_PORTAL_BASE=${buildEnv.NOCOBASE_PORTAL_BASE || ""} APP_PUBLIC_PATH=${buildEnv.APP_PUBLIC_PATH || ""}`
+    `Build environment: NOCOBASE_API_URL=${buildEnv.NOCOBASE_API_URL || ""} NOCOBASE_PORTAL_BASE=${buildEnv.NOCOBASE_PORTAL_BASE || ""} APP_PUBLIC_PATH=${buildEnv.APP_PUBLIC_PATH || ""} SKIP_YARN_COREPACK_CHECK=${buildEnv.SKIP_YARN_COREPACK_CHECK || ""} COREPACK_ENABLE_STRICT=${buildEnv.COREPACK_ENABLE_STRICT || ""} COREPACK_ENABLE_PROJECT_SPEC=${buildEnv.COREPACK_ENABLE_PROJECT_SPEC || ""}`
   );
   await runPortalStorageCommandOnce("yarn", ["build:html"], {
     cwd: portalDir,
@@ -616,9 +550,9 @@ function validatePortalDeployBasePath(appName, portalName, basePath) {
   if (normalizedBasePath.includes("..")) {
     throw new Error('basePath cannot contain ".."');
   }
-  const expectedBasePath = getPortalDeployBasePath(appName, portalName);
-  if (normalizedBasePath !== expectedBasePath) {
-    throw new Error(`basePath must be ${expectedBasePath}`);
+  const expectedBasePaths = getPortalDeployBasePathCandidates(appName, portalName);
+  if (!expectedBasePaths.includes(normalizedBasePath)) {
+    throw new Error(`basePath must be ${expectedBasePaths.join(" or ")}`);
   }
 }
 function isPortalDeployTarEntry(entry) {
@@ -856,19 +790,11 @@ function collectDesktopRouteIds(record) {
   }
   return uniqueDesktopRouteIds(routeIds);
 }
-function pickMultiPortalUiLayoutRuntimeFields(record) {
-  const result = {};
-  for (const field of MULTI_PORTAL_UI_LAYOUT_RUNTIME_FIELDS) {
-    result[field] = getRecordField(record, field);
-  }
-  return result;
-}
 function pickMultiPortalRuntimeFields(record) {
   const result = {};
   for (const field of MULTI_PORTAL_RUNTIME_FIELDS) {
     result[field] = getRecordField(record, field);
   }
-  result.uiLayout = pickMultiPortalUiLayoutRuntimeFields(getRecordField(record, "uiLayout"));
   return result;
 }
 function pickMultiPortalAccessibleFields(record) {
@@ -876,7 +802,6 @@ function pickMultiPortalAccessibleFields(record) {
   for (const field of MULTI_PORTAL_ACCESSIBLE_FIELDS) {
     result[field] = getRecordField(record, field) ?? null;
   }
-  result.uiLayout = pickMultiPortalUiLayoutRuntimeFields(getRecordField(record, "uiLayout"));
   return result;
 }
 function getExplicitRequestedLayoutUid(layout) {
@@ -1033,6 +958,37 @@ async function normalizeMultiPortalSlugValues(ctx, next) {
     values.portalName = slug;
     values.routePath = `/${slug}`;
   }
+  const repository = ctx.db.getRepository("multiPortals");
+  const pendingPortalNames = /* @__PURE__ */ new Set();
+  const targets = await getMultiPortalWriteTargets(ctx, ["uid"]);
+  for (const { existing, values } of targets) {
+    const portalName = values.portalName;
+    if (typeof portalName !== "string" || !portalName) {
+      continue;
+    }
+    if (pendingPortalNames.has(portalName)) {
+      ctx.throw(409, ctx.t('Portal name "{{portalName}}" already exists', { ns: import_constants.NAMESPACE, portalName }));
+      return;
+    }
+    pendingPortalNames.add(portalName);
+    const conflict = await repository.findOne({
+      filter: { portalName },
+      fields: ["uid"]
+    });
+    if (conflict && conflict.get("uid") !== (existing == null ? void 0 : existing.get("uid"))) {
+      ctx.throw(409, ctx.t('Portal name "{{portalName}}" already exists', { ns: import_constants.NAMESPACE, portalName }));
+      return;
+    }
+  }
+  await next();
+}
+async function preventDirectDefaultPortalMutation(ctx, next) {
+  for (const values of getMultiPortalWriteRecords(ctx)) {
+    if (Object.prototype.hasOwnProperty.call(values, "isDefault")) {
+      ctx.throw(400, ctx.t("Use multiPortals:setDefault to update the default Portal", { ns: import_constants.NAMESPACE }));
+      return;
+    }
+  }
   await next();
 }
 function isUniqueConstraintViolation(error) {
@@ -1087,55 +1043,33 @@ async function seedFreshMultiPortals(db) {
   }
 }
 async function seedHistoricalMultiPortals(db) {
-  if (getInitPortalType() === "ai") {
-    await createDefaultMultiPortalBestEffort(db, getDefaultMultiPortalRecord());
-  }
+  await createDefaultMultiPortalBestEffort(db, getDefaultAiMultiPortalRecord());
   for (const portal of getFixedLayoutMultiPortalRecords()) {
     await createDefaultMultiPortalBestEffort(db, portal);
   }
   await repairFixedLayoutMultiPortalRecords(db);
 }
-async function preventUiLayoutRouteNameConflict(ctx, next) {
-  const targets = await getMultiPortalWriteTargets(ctx, ["uid", "portalName", "uiLayoutUid"]);
+async function validateMultiPortalUiLayoutUidWrite(ctx, next) {
+  var _a;
+  const targets = await getMultiPortalWriteTargets(ctx, ["uiLayoutUid"]);
+  const actionName = (_a = ctx.action) == null ? void 0 : _a.actionName;
+  const createsWhenMissing = actionName === "create" || actionName === "firstOrCreate" || actionName === "updateOrCreate";
   for (const { existing, values } of targets) {
-    const existingUid = trimString(existing == null ? void 0 : existing.get("uid"));
-    const uid = trimString(values.uid ?? existingUid);
-    const portalName = trimString(values.portalName ?? (existing == null ? void 0 : existing.get("portalName")));
-    const uiLayoutUid = trimString(values.uiLayoutUid ?? (existing == null ? void 0 : existing.get("uiLayoutUid")));
-    const fixedPortal = getFixedLayoutMultiPortalRecord(existingUid) || getFixedLayoutMultiPortalRecord(uid);
-    const canonicalPortal = (fixedPortal == null ? void 0 : fixedPortal.uid) === uid && (!existingUid || fixedPortal.uid === existingUid) && fixedPortal.portalName === portalName && fixedPortal.uiLayoutUid === uiLayoutUid;
-    if (fixedPortal && !canonicalPortal) {
-      ctx.throw(400, "Reserved Portal UID must match its canonical route and UI layout");
+    const hasUiLayoutUid = Object.prototype.hasOwnProperty.call(values, "uiLayoutUid");
+    if (!existing && createsWhenMissing && !hasUiLayoutUid) {
+      ctx.throw(400, `Portal UI layout must be one of: ${import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS.join(", ")}`);
       return;
     }
-    if (!portalName) {
-      continue;
-    }
-    if (portalName === "admin" || portalName === "mobile") {
+    if (!hasUiLayoutUid) {
       continue;
     }
-    const existingInitPortal = (existing == null ? void 0 : existing.get("uid")) === DEFAULT_MULTI_PORTAL_UID && existing.get("portalName") === portalName;
-    const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
-      filter: {
-        routeName: portalName
-      },
-      fields: ["uid"]
-    });
-    if (uiLayout && !existingInitPortal) {
-      ctx.throw(400, "Portal route name conflicts with an existing UI layout");
+    if (!(0, import_constants.isMultiPortalUiLayoutUid)(values.uiLayoutUid)) {
+      ctx.throw(400, `Portal UI layout must be one of: ${import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS.join(", ")}`);
       return;
     }
-  }
-  await next();
-}
-async function preventMultiPortalBackingLayoutChange(ctx, next) {
-  const targets = await getMultiPortalWriteTargets(ctx, ["uiLayoutUid"]);
-  for (const { existing, values } of targets) {
-    if (!Object.prototype.hasOwnProperty.call(values, "uiLayoutUid")) {
-      continue;
-    }
-    if (existing && existing.get("uiLayoutUid") !== values.uiLayoutUid) {
-      ctx.throw(400, "Portal backing UI layout cannot be changed");
+    const existingUiLayoutUid = existing == null ? void 0 : existing.get("uiLayoutUid");
+    if (existing && existingUiLayoutUid !== values.uiLayoutUid) {
+      ctx.throw(400, "Portal UI layout cannot be changed");
       return;
     }
   }
@@ -1163,20 +1097,8 @@ async function findRequestedMultiPortal(ctx, transaction) {
     ctx.throw(400, `Portal '${portalUid}' does not support desktop routes`);
   }
   const uiLayoutUid = portal.get("uiLayoutUid");
-  if (typeof uiLayoutUid !== "string" || !uiLayoutUid) {
-    ctx.throw(400, `Portal '${portalUid}' has no backing UI layout`);
-  }
-  const uiLayout = await ctx.db.getRepository("uiLayouts").findOne({
-    filter: {
-      uid: uiLayoutUid,
-      enabled: true
-    },
-    fields: ["uid"],
-    ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
-    transaction
-  });
-  if (!uiLayout) {
-    ctx.throw(400, `Portal '${portalUid}' has no enabled backing UI layout`);
+  if (!(0, import_constants.isMultiPortalUiLayoutUid)(uiLayoutUid)) {
+    ctx.throw(400, `Portal '${portalUid}' has an unsupported UI layout UID`);
   }
   const usesLayoutPermissions = (0, import_constants.isDefaultLayoutMultiPortalUid)(portalUid);
   return {
@@ -1242,7 +1164,6 @@ async function assertDesktopRouteParentsBelongToScope(ctx, scope, values = ((_a)
       id: parentIds,
       ...scope.filter
     },
-    ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
     transaction
   });
   if (new Set(normalizeDesktopRouteTargetIds(parents)).size !== new Set(parentIds.map(String)).size) {
@@ -1276,7 +1197,6 @@ async function assertDesktopRouteUpsertMatchesBelongToScope(ctx, scope, values =
         ...filter,
         ...scope.filter
       },
-      ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
       transaction
     });
     const allMatchIds = normalizeDesktopRouteTargetIds(allMatches);
@@ -1294,13 +1214,77 @@ async function canAccessMultiPortal(ctx, multiPortalUid) {
   if (!currentRoles.length) {
     return false;
   }
-  const count = await ctx.db.getRepository("rolesMultiPortals").count({
+  const access = await ctx.db.getRepository("rolesMultiPortals").findOne({
+    fields: ["id"],
     filter: {
       roleName: currentRoles,
       multiPortalUid
     }
   });
-  return count > 0;
+  return access !== null;
+}
+function throwPortalAccessGateError(ctx, status, code, message) {
+  ctx.throw(status, ctx.t(message, { ns: import_constants.NAMESPACE }), { code });
+  throw new Error(message);
+}
+function getRequestedPortalNameFromHeader(ctx) {
+  var _a;
+  const headers = (_a = ctx.request) == null ? void 0 : _a.headers;
+  if (!isRecordLike(headers) || !Object.prototype.hasOwnProperty.call(headers, "x-portal")) {
+    return;
+  }
+  const rawPortalName = headers["x-portal"];
+  if (typeof rawPortalName !== "string") {
+    throwPortalAccessGateError(ctx, 400, PORTAL_CONTEXT_INVALID_CODE, "Invalid Portal context");
+  }
+  const portalName = rawPortalName.startsWith("/x/") ? rawPortalName.slice("/x/".length) : rawPortalName;
+  if (!MULTI_PORTAL_SLUG_PATTERN.test(portalName)) {
+    throwPortalAccessGateError(ctx, 400, PORTAL_CONTEXT_INVALID_CODE, "Invalid Portal context");
+  }
+  return portalName;
+}
+function pickPortalAccessDeniedData(ctx, portalName) {
+  const roleCheckBody = isRecordLike(ctx.body) ? ctx.body : {};
+  return {
+    portalName,
+    role: typeof roleCheckBody.role === "string" ? roleCheckBody.role : "",
+    roles: Array.isArray(roleCheckBody.roles) ? roleCheckBody.roles.filter((role) => typeof role === "string") : [],
+    roleMode: typeof roleCheckBody.roleMode === "string" ? roleCheckBody.roleMode : "default",
+    allowAnonymous: roleCheckBody.allowAnonymous === true
+  };
+}
+async function checkMultiPortalAccessForRolesCheck(ctx, next) {
+  const portalName = getRequestedPortalNameFromHeader(ctx);
+  if (portalName === void 0) {
+    await next();
+    return;
+  }
+  const portal = await ctx.db.getRepository("multiPortals").findOne({
+    filter: {
+      portalName
+    },
+    fields: ["uid", "portalType", "enabled", "uiLayoutUid"]
+  });
+  if (!portal || portal.get("enabled") !== true || !getDefaultMultiPortalType(portal) || !(0, import_constants.isMultiPortalUiLayoutUid)(portal.get("uiLayoutUid"))) {
+    throwPortalAccessGateError(ctx, 404, PORTAL_NOT_FOUND_CODE, "Portal not found");
+  }
+  const portalUid = String(portal.get("uid"));
+  if ((0, import_constants.isDefaultLayoutMultiPortalUid)(portalUid) || await canAccessMultiPortal(ctx, portalUid)) {
+    await next();
+    return;
+  }
+  await next();
+  ctx.status = 403;
+  ctx.withoutDataWrapping = true;
+  ctx.body = {
+    errors: [
+      {
+        code: PORTAL_ACCESS_DENIED_CODE,
+        message: ctx.t("You do not have access to this Portal", { ns: import_constants.NAMESPACE })
+      }
+    ],
+    data: pickPortalAccessDeniedData(ctx, portalName)
+  };
 }
 async function listCurrentRoleAccessibleMultiPortalUids(ctx) {
   const currentRoles = getCurrentRoles(ctx);
@@ -1363,7 +1347,7 @@ async function removeRouteIdsWithUnauthorizedAncestors(ctx, routeIds) {
     }
   }
 }
-async function getMultiPortalAccessibleRouteIds(ctx, multiPortalUid) {
+async function getMultiPortalAccessibleRouteIds(ctx, portalContext) {
   const currentRoles = getCurrentRoles(ctx);
   if (currentRoles.includes("root")) {
     return;
@@ -1371,11 +1355,11 @@ async function getMultiPortalAccessibleRouteIds(ctx, multiPortalUid) {
   if (!currentRoles.length) {
     return /* @__PURE__ */ new Set();
   }
-  const routePermissions = await ctx.db.getRepository("rolesMultiPortalDesktopRoutes").find({
+  const routePermissions = await ctx.db.getRepository(portalContext.relation === "uiLayouts" ? "rolesDesktopRoutes" : "rolesMultiPortalDesktopRoutes").find({
     fields: ["desktopRouteId"],
     filter: {
       roleName: currentRoles,
-      multiPortalUid
+      ...portalContext.relation === "multiPortals" ? { multiPortalUid: portalContext.portalUid } : {}
     }
   });
   const routeIds = /* @__PURE__ */ new Set();
@@ -1391,7 +1375,7 @@ async function getMultiPortalAccessibleRouteIds(ctx, multiPortalUid) {
   const portalRoutes = await ctx.db.getRepository("desktopRoutes").find({
     fields: ["id"],
     filter: {
-      ...getDesktopRoutePortalFilter(multiPortalUid),
+      ...portalContext.filter,
       id: Array.from(routeIds)
     }
   });
@@ -1421,9 +1405,107 @@ function setDesktopRouteChildren(route, children) {
   const maybeModel = route;
   if (typeof maybeModel.setDataValue === "function") {
     maybeModel.setDataValue("children", children);
+  } else {
+    maybeModel.children = children;
+  }
+  if (!maybeModel._options) {
+    return;
+  }
+  if (!maybeModel._options.includeNames) {
+    maybeModel._options.includeNames = ["children"];
     return;
   }
-  route.children = children;
+  if (!maybeModel._options.includeNames.includes("children")) {
+    maybeModel._options.includeNames.push("children");
+  }
+}
+function getDesktopRouteId(route) {
+  const id = getRecordField(route, "id");
+  return id === null || id === void 0 ? void 0 : String(id);
+}
+function getDesktopRouteParentId(route) {
+  const parentId = getRecordField(route, "parentId");
+  return parentId === null || parentId === void 0 ? void 0 : String(parentId);
+}
+function collectDesktopRouteStringIds(routes, routeIds) {
+  for (const route of routes) {
+    const routeId = getDesktopRouteId(route);
+    if (routeId) {
+      routeIds.add(routeId);
+    }
+    const children = getRecordField(route, "children");
+    if (Array.isArray(children)) {
+      collectDesktopRouteStringIds(children, routeIds);
+    }
+  }
+}
+function removeNestedRootDesktopRoutes(routes) {
+  if (!Array.isArray(routes)) {
+    return [];
+  }
+  const routeIds = /* @__PURE__ */ new Set();
+  collectDesktopRouteStringIds(routes, routeIds);
+  return routes.filter((route) => {
+    const parentId = getDesktopRouteParentId(route);
+    return !parentId || !routeIds.has(parentId);
+  });
+}
+function buildAccessibleDesktopRouteTreeWithAncestors(routes, accessibleRouteIds) {
+  const routeById = /* @__PURE__ */ new Map();
+  const childrenByParentId = /* @__PURE__ */ new Map();
+  const roots = [];
+  for (const route of routes) {
+    const routeId = getDesktopRouteId(route);
+    if (!routeId) {
+      continue;
+    }
+    setDesktopRouteChildren(route, void 0);
+    routeById.set(routeId, route);
+  }
+  for (const route of routes) {
+    const routeId = getDesktopRouteId(route);
+    if (!routeId || !routeById.has(routeId)) {
+      continue;
+    }
+    const parentId = getDesktopRouteParentId(route);
+    if (!parentId || !routeById.has(parentId)) {
+      roots.push(route);
+      continue;
+    }
+    const children = childrenByParentId.get(parentId) ?? [];
+    children.push(route);
+    childrenByParentId.set(parentId, children);
+  }
+  const visitRoute = (route, visitingRouteIds) => {
+    const routeId = getDesktopRouteId(route);
+    if (!routeId || visitingRouteIds.has(routeId)) {
+      return void 0;
+    }
+    visitingRouteIds.add(routeId);
+    const visibleChildren = (childrenByParentId.get(routeId) ?? []).map((child) => visitRoute(child, visitingRouteIds)).filter((child) => child !== void 0);
+    visitingRouteIds.delete(routeId);
+    if (!accessibleRouteIds.has(routeId) && visibleChildren.length === 0) {
+      return void 0;
+    }
+    setDesktopRouteChildren(route, visibleChildren.length ? visibleChildren : void 0);
+    return route;
+  };
+  return roots.map((route) => visitRoute(route, /* @__PURE__ */ new Set())).filter((route) => route !== void 0);
+}
+async function includeDesktopRouteAncestorsForListAccessible(ctx, routes, portalFilter) {
+  if (!Array.isArray(routes)) {
+    return routes;
+  }
+  const accessibleRouteIds = /* @__PURE__ */ new Set();
+  collectDesktopRouteStringIds(routes, accessibleRouteIds);
+  if (!accessibleRouteIds.size) {
+    return routes;
+  }
+  const portalRoutes = await ctx.db.getRepository("desktopRoutes").find({
+    sort: "sort",
+    filter: portalFilter
+  });
+  return buildAccessibleDesktopRouteTreeWithAncestors(portalRoutes, accessibleRouteIds);
 }
 function removeDesktopRoutesByIds(routes, routeIds) {
   return routes.map((route) => {
@@ -1490,23 +1572,26 @@ async function removeMultiPortalOwnedRouteFromGetResponse(ctx) {
   ctx.body = void 0;
 }
 async function replaceListAccessibleRoutesWithPortalScopedRoutes(ctx, portalContext) {
-  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext.portalUid);
+  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext);
   if (routeIds && routeIds.size === 0) {
     ctx.body = [];
     return;
   }
-  ctx.body = await ctx.db.getRepository("desktopRoutes").find({
+  const routes = await ctx.db.getRepository("desktopRoutes").find({
     tree: true,
     sort: "sort",
     filter: {
-      ...getDesktopRoutePortalFilter(portalContext.portalUid),
+      ...portalContext.filter,
       ...routeIds ? { id: Array.from(routeIds) } : {}
     }
   });
+  ctx.body = removeNestedRootDesktopRoutes(
+    await includeDesktopRouteAncestorsForListAccessible(ctx, routes, portalContext.filter)
+  );
 }
 async function replaceGetAccessibleRouteWithPortalScopedRoute(ctx, portalContext) {
   var _a;
-  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext.portalUid);
+  const routeIds = await getMultiPortalAccessibleRouteIds(ctx, portalContext);
   if (routeIds && routeIds.size === 0) {
     ctx.status = 204;
     ctx.body = void 0;
@@ -1516,7 +1601,7 @@ async function replaceGetAccessibleRouteWithPortalScopedRoute(ctx, portalContext
     sort: "sort",
     filterByTk: (_a = ctx.action) == null ? void 0 : _a.params.filterByTk,
     filter: {
-      ...getDesktopRoutePortalFilter(portalContext.portalUid),
+      ...portalContext.filter,
       ...routeIds ? { id: Array.from(routeIds) } : {}
     }
   });
@@ -1553,13 +1638,10 @@ async function addMultiPortalListAccessibleGuard(ctx, next) {
     return;
   }
   await next();
-  if ((portalContext == null ? void 0 : portalContext.relation) === "multiPortals") {
+  if (portalContext) {
     await replaceListAccessibleRoutesWithPortalScopedRoutes(ctx, portalContext);
     return;
   }
-  if ((portalContext == null ? void 0 : portalContext.relation) === "uiLayouts") {
-    return;
-  }
   await removeMultiPortalOwnedRoutesFromListResponse(ctx);
 }
 async function addMultiPortalGetAccessibleGuard(ctx, next) {
@@ -1570,17 +1652,13 @@ async function addMultiPortalGetAccessibleGuard(ctx, next) {
     return;
   }
   await next();
-  if ((portalContext == null ? void 0 : portalContext.relation) === "multiPortals") {
+  if (portalContext) {
     await replaceGetAccessibleRouteWithPortalScopedRoute(ctx, portalContext);
     return;
   }
-  if ((portalContext == null ? void 0 : portalContext.relation) === "uiLayouts") {
-    return;
-  }
   await removeMultiPortalOwnedRouteFromGetResponse(ctx);
 }
 async function mapMultiPortalLayoutToUiLayoutForRolePermissionTargets(ctx, next) {
-  var _a;
   const portalRequest = await findRequestedMultiPortal(ctx);
   if (portalRequest.requested && !portalRequest.portal) {
     ctx.status = 200;
@@ -1588,22 +1666,19 @@ async function mapMultiPortalLayoutToUiLayoutForRolePermissionTargets(ctx, next)
     return;
   }
   const scope = portalRequest.scope;
-  if ((scope == null ? void 0 : scope.relation) === "uiLayouts") {
-    if ((_a = ctx.action) == null ? void 0 : _a.params) {
-      ctx.action.params.layout = scope.uiLayoutUid;
-    }
-    await next();
-    return;
-  }
-  if ((scope == null ? void 0 : scope.relation) === "multiPortals") {
+  if (scope) {
     const routes = await ctx.db.getRepository("desktopRoutes").find({
-      tree: true,
       sort: "sort",
       filter: scope.filter,
       fields: [...DESKTOP_ROUTE_ROLE_PERMISSION_TARGET_FIELDS]
     });
+    const routeIds = /* @__PURE__ */ new Set();
+    collectDesktopRouteStringIds(routes, routeIds);
+    const routeTree = buildAccessibleDesktopRouteTreeWithAncestors(routes, routeIds);
     ctx.status = 200;
-    ctx.body = routes.map((route) => pickDesktopRouteRolePermissionTargetFields(route));
+    ctx.body = removeNestedRootDesktopRoutes(routeTree).map(
+      (route) => pickDesktopRouteRolePermissionTargetFields(route)
+    );
     return;
   }
   await next();
@@ -1691,7 +1766,7 @@ async function findDesktopRouteMutationTargets(ctx, scopeFilter, transaction, se
       ...filter ?? {},
       ...scopeFilter ?? {}
     },
-    ...transaction ? { lock: transaction.LOCK.UPDATE } : {},
+    ...transaction && !scopeFilter ? { lock: transaction.LOCK.UPDATE } : {},
     transaction
   });
 }
@@ -1843,7 +1918,6 @@ async function guardDesktopRouteMoveScope(ctx, next) {
         id: routeIds,
         ...scope.filter
       },
-      lock: transaction.LOCK.UPDATE,
       transaction
     });
     if (normalizeDesktopRouteTargetIds(allRoutes).join(",") !== normalizeDesktopRouteTargetIds(scopedRoutes).join(",") || scopedRoutes.length !== routeIds.length) {
@@ -1873,7 +1947,6 @@ async function guardDesktopRouteMoveScope(ctx, next) {
           id: parentIds,
           ...scope.filter
         },
-        lock: transaction.LOCK.UPDATE,
         transaction
       });
       if (normalizeDesktopRouteTargetIds(parents).join(",") !== parentIds.map(String).sort().join(",")) {
@@ -1921,7 +1994,6 @@ async function guardDesktopRouteMoveScope(ctx, next) {
             $gte: targetSort
           }
         },
-        lock: transaction.LOCK.UPDATE,
         transaction
       });
       const affectedRouteIds = affectedRoutes.map((route) => route.get("id"));
@@ -2019,7 +2091,7 @@ async function findDesktopRouteDestroyRoots(ctx, transaction, scopeFilter) {
       ...scopeFilter ?? {},
       ...filterByTk.length ? { id: filterByTk } : {}
     },
-    lock: transaction.LOCK.UPDATE,
+    ...scopeFilter ? {} : { lock: transaction.LOCK.UPDATE },
     transaction
   });
   return collectDesktopRouteIds(records);
@@ -2085,13 +2157,20 @@ async function detachDesktopRouteTreeOwner(ctx, routeIds, scope, transaction) {
 }
 async function detachOwnerAndFindDestroyRoots(ctx, routeIds, scope, transaction) {
   var _a;
+  await ctx.db.getRepository("desktopRoutes").find({
+    fields: ["id"],
+    filter: {
+      id: routeIds
+    },
+    lock: transaction.LOCK.UPDATE,
+    transaction
+  });
   const routes = await ctx.db.getRepository("desktopRoutes").find({
     fields: ["id", "parentId"],
     appends: ["multiPortals", "uiLayouts"],
     filter: {
       id: routeIds
     },
-    lock: transaction.LOCK.UPDATE,
     transaction
   });
   const routesById = new Map(routes.map((route) => [String(route.get("id")), route]));
@@ -2187,24 +2266,119 @@ async function listEnabledMultiPortals(ctx, next) {
   const records = await ctx.db.getRepository("multiPortals").find({
     filter: {
       enabled: true,
-      "uiLayout.enabled": true
+      uiLayoutUid: {
+        $in: [...import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS]
+      }
     },
-    fields: [...MULTI_PORTAL_RUNTIME_QUERY_FIELDS],
-    appends: ["uiLayout"],
+    fields: [...MULTI_PORTAL_RUNTIME_FIELDS],
     sort: ["uid"]
   });
   ctx.body = records.map((record) => pickMultiPortalRuntimeFields(record));
   await next();
 }
+const DEFAULT_MULTI_PORTAL_RESPONSE_FIELDS = ["uid", "portalType", "routePath"];
+function getDefaultMultiPortalType(record) {
+  const portalType = record.get("portalType");
+  if (portalType === null || portalType === void 0) {
+    return "no-code";
+  }
+  return isMultiPortalSeedType(portalType) ? portalType : null;
+}
+function pickDefaultMultiPortalFields(record) {
+  return {
+    uid: String(record.get("uid")),
+    portalType: getDefaultMultiPortalType(record) || "no-code",
+    routePath: String(record.get("routePath"))
+  };
+}
+async function findEnabledDefaultMultiPortal(ctx, transaction) {
+  const record = await ctx.db.getRepository("multiPortals").findOne({
+    filter: {
+      enabled: true,
+      isDefault: true
+    },
+    fields: [...DEFAULT_MULTI_PORTAL_RESPONSE_FIELDS, "uiLayoutUid"],
+    transaction
+  });
+  if (!record) {
+    return null;
+  }
+  const portalType = getDefaultMultiPortalType(record);
+  if (!portalType) {
+    return null;
+  }
+  if (!(0, import_constants.isMultiPortalUiLayoutUid)(record.get("uiLayoutUid"))) {
+    return null;
+  }
+  return record;
+}
+async function getDefaultMultiPortal(ctx, next) {
+  const record = await findEnabledDefaultMultiPortal(ctx);
+  ctx.body = record ? pickDefaultMultiPortalFields(record) : null;
+  ctx.status = 200;
+  await next();
+}
+async function setDefaultMultiPortal(ctx, next) {
+  var _a;
+  const filterByTk = (_a = ctx.action) == null ? void 0 : _a.params.filterByTk;
+  if (filterByTk === void 0 || filterByTk === null || filterByTk === "") {
+    ctx.throw(400, ctx.t("filterByTk is required", { ns: import_constants.NAMESPACE }));
+    return;
+  }
+  const repository = ctx.db.getRepository("multiPortals");
+  const updated = await ctx.db.sequelize.transaction(async (transaction) => {
+    const target = await repository.findOne({
+      filterByTk,
+      fields: [...DEFAULT_MULTI_PORTAL_RESPONSE_FIELDS, "enabled", "uiLayoutUid"],
+      lock: transaction.LOCK.UPDATE,
+      transaction
+    });
+    if (!target) {
+      ctx.throw(404, ctx.t("Portal not found", { ns: import_constants.NAMESPACE }));
+      return null;
+    }
+    if (target.get("enabled") !== true) {
+      ctx.throw(400, ctx.t("Disabled Portal cannot be set as default", { ns: import_constants.NAMESPACE }));
+      return null;
+    }
+    const portalType = getDefaultMultiPortalType(target);
+    if (!portalType) {
+      ctx.throw(400, ctx.t("Unsupported Portal type cannot be set as default", { ns: import_constants.NAMESPACE }));
+      return null;
+    }
+    if (!(0, import_constants.isMultiPortalUiLayoutUid)(target.get("uiLayoutUid"))) {
+      ctx.throw(400, ctx.t("Portal device configuration is invalid", { ns: import_constants.NAMESPACE }));
+      return null;
+    }
+    await repository.update({
+      filter: { isDefault: true },
+      values: { isDefault: null },
+      transaction
+    });
+    await repository.update({
+      filterByTk,
+      values: { isDefault: true },
+      transaction
+    });
+    return repository.findOne({
+      filterByTk,
+      fields: [...DEFAULT_MULTI_PORTAL_RESPONSE_FIELDS],
+      transaction
+    });
+  });
+  ctx.body = updated ? pickDefaultMultiPortalFields(updated) : null;
+  await next();
+}
 async function listAccessibleMultiPortals(ctx, next) {
   const accessiblePortalUids = await listCurrentRoleAccessibleMultiPortalUids(ctx);
   const records = await ctx.db.getRepository("multiPortals").find({
     filter: {
       enabled: true,
-      "uiLayout.enabled": true
+      uiLayoutUid: {
+        $in: [...import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS]
+      }
     },
-    fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
-    appends: ["uiLayout"],
+    fields: [...MULTI_PORTAL_ACCESSIBLE_FIELDS],
     sort: ["uid"]
   });
   const accessiblePortalUidSet = Array.isArray(accessiblePortalUids) ? new Set(accessiblePortalUids) : void 0;
@@ -2343,11 +2517,15 @@ async function grantDefaultAccessToNewMultiPortal(db, multiPortal, options) {
 class PluginMultiPortalServer extends import_server.Plugin {
   portalStorageTaskKeys = /* @__PURE__ */ new Set();
   portalStorageTasks = /* @__PURE__ */ new Map();
+  deprecatedInitPortalEnvWarningEmitted = false;
   async afterAdd() {
   }
   getAppName() {
     return this.app.name || MAIN_APP_NAME;
   }
+  getCurrentStorageAppName() {
+    return normalizePortalStorageName(this.getAppName()) || MAIN_APP_NAME;
+  }
   getMultiPortalStorageItem(multiPortal, previous = false) {
     const record = multiPortal;
     const readField = (field) => previous && typeof record.previous === "function" ? record.previous(field) : getRecordField(record, field);
@@ -2362,8 +2540,7 @@ class PluginMultiPortalServer extends import_server.Plugin {
     return {
       appName: this.getAppName(),
       portalName,
-      enabled: readField("enabled") === true,
-      config: getPortalStorageConfig(readField("options"))
+      enabled: readField("enabled") === true
     };
   }
   warnPortalStorageSyncFailed(error) {
@@ -2373,6 +2550,14 @@ class PluginMultiPortalServer extends import_server.Plugin {
       error
     });
   }
+  logPortalBuildHtml(item, status, reason) {
+    var _a, _b;
+    (_b = (_a = this.app.logger) == null ? void 0 : _a.info) == null ? void 0 : _b.call(_a, `Portal yarn build:html ${status} for ${item.appName}/${item.portalName}`, {
+      appName: item.appName,
+      portalName: item.portalName,
+      reason
+    });
+  }
   getPortalStorageTaskKey(item) {
     return `${item.appName}/${item.portalName}`;
   }
@@ -2391,10 +2576,9 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
     await run();
   }
-  async removePortalStorageDist(item) {
-    await import_fs.default.promises.rm((0, import_utils.storagePathJoin)("portals", item.appName, item.portalName, "dist"), {
-      force: true,
-      recursive: true
+  async removePortalStorageIndexHtml(item) {
+    await import_fs.default.promises.rm((0, import_utils.storagePathJoin)("portals", item.appName, item.portalName, "dist", "index.html"), {
+      force: true
     });
   }
   waitForPortalStorageTasks() {
@@ -2404,10 +2588,11 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
     return Promise.allSettled(tasks).then(() => void 0);
   }
-  async schedulePortalTemplateCopyAndBuild(item, template, portalDir) {
+  async schedulePortalTemplateCopyAndBuild(item, template, portalDir, options) {
     var _a;
     const taskKey = this.getPortalStorageTaskKey(item);
     if (this.portalStorageTaskKeys.has(taskKey)) {
+      this.logPortalBuildHtml(item, "skipped", "a storage task is already running");
       await ((_a = template.cleanup) == null ? void 0 : _a.call(template));
       return;
     }
@@ -2428,14 +2613,13 @@ class PluginMultiPortalServer extends import_server.Plugin {
           await copyPortalTemplate(template.dir, portalDir);
           await appendPortalStorageLog(logPath, `Default portal template copied to ${portalDir}.`);
         }
-        await ensurePortalStorageConfigFiles(portalDir, item);
-        await appendPortalStorageLog(logPath, `Portal configuration files updated in ${portalDir}.`);
         if (item.enabled) {
-          await buildPortalStorageItem(portalDir, item);
+          this.logPortalBuildHtml(item, "requested", "storage directory was initialized");
+          await buildPortalStorageItem(portalDir, item, options);
+          this.logPortalBuildHtml(item, "completed", "yarn build:html finished successfully");
           return;
         }
-        await this.removePortalStorageDist(item);
-        await appendPortalStorageLog(logPath, `Portal dist directory removed for ${item.appName}/${item.portalName}.`);
+        this.logPortalBuildHtml(item, "skipped", "the portal is disabled");
       } catch (error) {
         await appendPortalStorageLog(
           logPath,
@@ -2451,32 +2635,41 @@ class PluginMultiPortalServer extends import_server.Plugin {
     this.portalStorageTasks.set(taskKey, task);
     await task;
   }
-  async ensurePortalStorageItem(item) {
+  async ensurePortalStorageItem(item, options = {}) {
     const portalDir = (0, import_utils.storagePathJoin)("portals", item.appName, item.portalName);
     const portalIndex = import_path.default.join(portalDir, "dist", "index.html");
+    const logPath = getPortalStorageLogPath(item);
     if (!await pathExists(portalDir)) {
-      const template = await resolvePortalTemplate(getInitPortalTemplate(), getPortalStorageLogPath(item));
-      await this.schedulePortalTemplateCopyAndBuild(item, template, portalDir);
+      const template = await resolvePortalTemplate(getInitPortalTemplate(), logPath);
+      await this.schedulePortalTemplateCopyAndBuild(item, template, portalDir, options);
       return;
     }
-    await ensurePortalStorageConfigFiles(portalDir, item);
     if (item.enabled) {
-      if (!await pathExists(portalIndex)) {
-        await buildPortalStorageItem(portalDir, item);
+      const hasPortalIndex = await pathExists(portalIndex);
+      if (options.forceBuild || !hasPortalIndex) {
+        this.logPortalBuildHtml(
+          item,
+          "requested",
+          options.forceBuild ? "forceBuild is enabled" : "dist/index.html does not exist"
+        );
+        await buildPortalStorageItem(portalDir, item, options);
+        this.logPortalBuildHtml(item, "completed", "yarn build:html finished successfully");
+      } else {
+        this.logPortalBuildHtml(item, "skipped", "dist/index.html already exists");
       }
       return;
     }
-    await this.removePortalStorageDist(item);
+    this.logPortalBuildHtml(item, "skipped", "the portal is disabled");
   }
-  async syncMultiPortalStorageItem(multiPortal, options, syncPrevious = false) {
+  async syncMultiPortalStorageItem(multiPortal, options, syncPrevious = false, forceBuild = false) {
     const currentItem = this.getMultiPortalStorageItem(multiPortal);
     const previousItem = syncPrevious ? this.getMultiPortalStorageItem(multiPortal, true) : null;
     await this.runPortalStorageTask(async () => {
-      if (previousItem && (!currentItem || previousItem.appName !== currentItem.appName || previousItem.portalName !== currentItem.portalName || !currentItem.enabled)) {
-        await this.removePortalStorageDist(previousItem);
+      if (previousItem && (!currentItem || previousItem.appName !== currentItem.appName || previousItem.portalName !== currentItem.portalName)) {
+        await this.removePortalStorageIndexHtml(previousItem);
       }
       if (currentItem) {
-        await this.ensurePortalStorageItem(currentItem);
+        await this.ensurePortalStorageItem(currentItem, { ...options, forceBuild });
       }
     }, options);
   }
@@ -2519,12 +2712,12 @@ class PluginMultiPortalServer extends import_server.Plugin {
     await next();
   }
   async deployPortalDist(ctx, next) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c;
     const deployCtx = ctx;
-    const appName = normalizePortalStorageName(((_a = deployCtx.request.body) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
-    const portalName = normalizePortalStorageName((_b = deployCtx.request.body) == null ? void 0 : _b.portal);
-    const basePath = trimString((_c = deployCtx.request.body) == null ? void 0 : _c.basePath);
-    const filePath = trimString((_d = deployCtx.request.file) == null ? void 0 : _d.path);
+    const appName = this.getCurrentStorageAppName();
+    const portalName = normalizePortalStorageName((_a = deployCtx.request.body) == null ? void 0 : _a.portal);
+    const basePath = trimString((_b = deployCtx.request.body) == null ? void 0 : _b.basePath);
+    const filePath = trimString((_c = deployCtx.request.file) == null ? void 0 : _c.path);
     try {
       if (!isValidPortalDeploySegment(appName)) {
         throw new Error("Invalid app");
@@ -2561,9 +2754,9 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
   }
   async pullPortalSource(ctx, next) {
-    var _a, _b;
-    const appName = normalizePortalStorageName(((_a = ctx.action.params.values) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
-    const portalName = normalizePortalStorageName((_b = ctx.action.params.values) == null ? void 0 : _b.portal);
+    var _a;
+    const appName = this.getCurrentStorageAppName();
+    const portalName = normalizePortalStorageName((_a = ctx.action.params.values) == null ? void 0 : _a.portal);
     try {
       if (!isValidPortalDeploySegment(appName)) {
         throw new Error("Invalid app");
@@ -2583,11 +2776,11 @@ class PluginMultiPortalServer extends import_server.Plugin {
     }
   }
   async pushPortalSource(ctx, next) {
-    var _a, _b, _c;
+    var _a, _b;
     const sourceCtx = ctx;
-    const appName = normalizePortalStorageName(((_a = sourceCtx.request.body) == null ? void 0 : _a.app) || MAIN_APP_NAME) || MAIN_APP_NAME;
-    const portalName = normalizePortalStorageName((_b = sourceCtx.request.body) == null ? void 0 : _b.portal);
-    const filePath = trimString((_c = sourceCtx.request.file) == null ? void 0 : _c.path);
+    const appName = this.getCurrentStorageAppName();
+    const portalName = normalizePortalStorageName((_a = sourceCtx.request.body) == null ? void 0 : _a.portal);
+    const filePath = trimString((_b = sourceCtx.request.file) == null ? void 0 : _b.path);
     try {
       if (!isValidPortalDeploySegment(appName)) {
         throw new Error("Invalid app");
@@ -2641,38 +2834,20 @@ class PluginMultiPortalServer extends import_server.Plugin {
     const records = await this.db.getRepository("multiPortals").find({
       filter: {
         enabled: true,
-        "uiLayout.enabled": true
+        uiLayoutUid: {
+          $in: [...import_constants.MULTI_PORTAL_UI_LAYOUT_UIDS]
+        }
       },
-      fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
-      appends: ["uiLayout"],
+      fields: [...MULTI_PORTAL_ACCESSIBLE_FIELDS],
       sort: ["uid"],
       transaction: options == null ? void 0 : options.transaction
     });
-    return records.map((record) => {
-      const portal = pickMultiPortalAccessibleFields(record);
-      const uiLayout = portal.uiLayout;
-      const uid = typeof portal.uid === "string" ? portal.uid : "";
-      const title = typeof portal.title === "string" ? portal.title : "";
-      return {
-        uid,
-        title,
-        icon: typeof portal.icon === "string" ? portal.icon : null,
-        portalType: typeof portal.portalType === "string" ? portal.portalType : null,
-        routePath: String(portal.routePath || ""),
-        layout: typeof (uiLayout == null ? void 0 : uiLayout.layoutType) === "string" ? uiLayout.layoutType : null
-      };
+    return records.flatMap((record) => {
+      const item = this.toAppPortalManifestItem(record);
+      return item ? [item] : [];
     });
   }
-  async getUiLayout(uid, options) {
-    if (typeof uid !== "string" || !uid) {
-      return null;
-    }
-    return this.db.getRepository("uiLayouts").findOne({
-      filterByTk: uid,
-      transaction: options == null ? void 0 : options.transaction
-    });
-  }
-  async toAppPortalManifestItem(multiPortal, options) {
+  toAppPortalManifestItem(multiPortal) {
     const uid = getRecordField(multiPortal, "uid");
     const title = getRecordField(multiPortal, "title");
     const portalType = getRecordField(multiPortal, "portalType");
@@ -2682,19 +2857,18 @@ class PluginMultiPortalServer extends import_server.Plugin {
       return null;
     }
     const uiLayoutUid = getRecordField(multiPortal, "uiLayoutUid");
-    const uiLayout = getRecordField(multiPortal, "uiLayout") || await this.getUiLayout(uiLayoutUid, options);
-    if (!uiLayout || getRecordField(uiLayout, "enabled") !== true) {
+    const layout = (0, import_constants.getMultiPortalLayoutType)(uiLayoutUid);
+    if (!layout) {
       return null;
     }
     const icon = getRecordField(multiPortal, "icon");
-    const layoutType = getRecordField(uiLayout, "layoutType");
     return {
       uid,
       title,
       icon: typeof icon === "string" ? icon : null,
       portalType: typeof portalType === "string" ? portalType : null,
       routePath,
-      layout: typeof layoutType === "string" ? layoutType : null
+      layout
     };
   }
   async setAppManifestItem(item, options) {
@@ -2737,30 +2911,13 @@ class PluginMultiPortalServer extends import_server.Plugin {
     if (typeof uid !== "string" || !uid) {
       return;
     }
-    const item = await this.toAppPortalManifestItem(multiPortal, options);
+    const item = this.toAppPortalManifestItem(multiPortal);
     if (item) {
       await this.setAppManifestItem(item, options);
       return;
     }
     await this.removeAppManifestItem(uid, options);
   }
-  async publishUiLayoutManifestItems(uiLayout, options) {
-    const uiLayoutUid = getRecordField(uiLayout, "uid");
-    if (typeof uiLayoutUid !== "string" || !uiLayoutUid) {
-      return;
-    }
-    const records = await this.db.getRepository("multiPortals").find({
-      filter: {
-        uiLayoutUid
-      },
-      fields: [...MULTI_PORTAL_ACCESSIBLE_QUERY_FIELDS],
-      transaction: options == null ? void 0 : options.transaction
-    });
-    for (const record of records) {
-      record.set("uiLayout", uiLayout);
-      await this.publishAppManifestItem(record, options);
-    }
-  }
   async reconcilePortalStorage(options) {
     const records = await this.db.getRepository("multiPortals").find({
       filter: {
@@ -2812,6 +2969,7 @@ class PluginMultiPortalServer extends import_server.Plugin {
   }
   async beforeLoad() {
     this.app.db.registerRepositories({ MultiPortalDesktopRouteRepository });
+    this.app.resourceManager.registerPreActionHandler("roles:check", checkMultiPortalAccessForRolesCheck);
     this.app.resourceManager.registerPreActionHandler("desktopRoutes:list", addDesktopRouteEffectiveScopeFilter);
     this.app.resourceManager.registerPreActionHandler("desktopRoutes:get", addDesktopRouteEffectiveScopeFilter);
     this.app.resourceManager.registerPreActionHandler(
@@ -2823,26 +2981,30 @@ class PluginMultiPortalServer extends import_server.Plugin {
       "desktopRoutes:listRolePermissionTargets",
       mapMultiPortalLayoutToUiLayoutForRolePermissionTargets
     );
+    this.app.resourceManager.registerPreActionHandler("multiPortals:create", preventDirectDefaultPortalMutation);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:create", validateMultiPortalUiLayoutUidWrite);
     this.app.resourceManager.registerPreActionHandler("multiPortals:create", captureSkipCreatePortalDirectory);
     this.app.resourceManager.registerPreActionHandler("multiPortals:create", normalizeMultiPortalSlugValues);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:create", preventUiLayoutRouteNameConflict);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:update", preventMultiPortalBackingLayoutChange);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:update", preventDirectDefaultPortalMutation);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:update", validateMultiPortalUiLayoutUidWrite);
     this.app.resourceManager.registerPreActionHandler("multiPortals:update", normalizeMultiPortalSlugValues);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:update", preventUiLayoutRouteNameConflict);
+    this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", preventDirectDefaultPortalMutation);
     this.app.resourceManager.registerPreActionHandler(
       "multiPortals:firstOrCreate",
-      preventMultiPortalBackingLayoutChange
+      validateMultiPortalUiLayoutUidWrite
     );
     this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", captureSkipCreatePortalDirectory);
     this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", normalizeMultiPortalSlugValues);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:firstOrCreate", preventUiLayoutRouteNameConflict);
     this.app.resourceManager.registerPreActionHandler(
       "multiPortals:updateOrCreate",
-      preventMultiPortalBackingLayoutChange
+      preventDirectDefaultPortalMutation
+    );
+    this.app.resourceManager.registerPreActionHandler(
+      "multiPortals:updateOrCreate",
+      validateMultiPortalUiLayoutUidWrite
     );
     this.app.resourceManager.registerPreActionHandler("multiPortals:updateOrCreate", captureSkipCreatePortalDirectory);
     this.app.resourceManager.registerPreActionHandler("multiPortals:updateOrCreate", normalizeMultiPortalSlugValues);
-    this.app.resourceManager.registerPreActionHandler("multiPortals:updateOrCreate", preventUiLayoutRouteNameConflict);
     this.app.resourceManager.registerPreActionHandler("desktopRoutes:create", addDesktopRouteCreateMultiPortal, {
       after: UI_LAYOUT_DESKTOP_ROUTE_WRITE_LAYOUT_HANDLER_TAG
     });
@@ -2867,12 +3029,15 @@ class PluginMultiPortalServer extends import_server.Plugin {
       actions: ROLE_MULTI_PORTAL_PERMISSION_ACTIONS
     });
     this.app.acl.allow("multiPortals", "listEnabled", "public");
+    this.app.acl.allow("multiPortals", "getDefault", "public");
     this.app.acl.allow("multiPortals", "listAccessible", "loggedIn");
     this.app.resourceManager.use(createPortalDeployUploadMiddleware(), {
       tag: "multiPortalDeployUpload",
       after: "acl"
     });
     this.app.resourceManager.registerActionHandler("multiPortals:listEnabled", listEnabledMultiPortals);
+    this.app.resourceManager.registerActionHandler("multiPortals:getDefault", getDefaultMultiPortal);
+    this.app.resourceManager.registerActionHandler("multiPortals:setDefault", setDefaultMultiPortal);
     this.app.resourceManager.registerActionHandler("multiPortals:listAccessible", listAccessibleMultiPortals);
     this.app.resourceManager.registerActionHandler("multiPortals:deploy", async (ctx, next) => {
       await this.deployPortalDist(ctx, next);
@@ -2897,13 +3062,18 @@ class PluginMultiPortalServer extends import_server.Plugin {
       (0, import_ensureDefaultRoleMultiPortalAccess.applyDefaultRoleMultiPortalAccess)(role);
     });
     this.app.db.on("desktopRoutes.afterCreate", reconcileCreatedDesktopRoutePermissions);
+    this.app.db.on("multiPortals.beforeUpdate", (multiPortal) => {
+      if (multiPortal.get("enabled") === false && multiPortal.get("isDefault") === true) {
+        multiPortal.set("isDefault", null);
+      }
+    });
     this.app.db.on("multiPortals.afterCreate", async (multiPortal, options) => {
       await grantDefaultAccessToNewMultiPortal(this.app.db, multiPortal, options);
       await this.publishAppManifestItem(multiPortal, options);
       if (shouldSkipCreatePortalDirectory(options)) {
         return;
       }
-      await this.syncMultiPortalStorageItem(multiPortal, options);
+      await this.syncMultiPortalStorageItem(multiPortal, options, false, true);
     });
     this.app.db.on("multiPortals.afterUpdate", async (multiPortal, options) => {
       await this.publishAppManifestItem(multiPortal, options);
@@ -2916,11 +3086,16 @@ class PluginMultiPortalServer extends import_server.Plugin {
       }
       await this.removeMultiPortalStorageItem(multiPortal, options);
     });
-    this.app.db.on("uiLayouts.afterUpdate", async (uiLayout, options) => {
-      await this.publishUiLayoutManifestItems(uiLayout, options);
-    });
   }
   async install() {
+    var _a, _b;
+    if (!this.deprecatedInitPortalEnvWarningEmitted && hasDeprecatedInitPortalEnv()) {
+      this.deprecatedInitPortalEnvWarningEmitted = true;
+      (_b = (_a = this.app.logger) == null ? void 0 : _a.warn) == null ? void 0 : _b.call(
+        _a,
+        'INIT_PORTAL_TYPE and INIT_PORTAL_NAME are deprecated and no longer affect multi-portal seeding; NocoBase now creates the AI Portal "main" plus the fixed no-code "admin" and "mobile" portals by default.'
+      );
+    }
     const version = await this.app.version.get();
     if (!version) {
       await (0, import_ensureDefaultRoleMultiPortalAccess.ensureDefaultRoleMultiPortalAccess)(this.db);