adminizer 4.7.0-build.224 → 5.0.0-build.1

package/lib/DataAccessor.js

@@ -47,14 +47,29 @@ export class DataAccessor {
         this.actionVerb = getTokenAction(this.action);
     }
     getModelConfig(modelName) {
+        const resolvedModelName = this.adminizer.modelHandler.resolveModelName(modelName);
         const entry = Object.entries(this.adminizer.config.models)
-            .find(([key]) => key.toLowerCase() === modelName.toLowerCase());
+            .find(([key, config]) => {
+            if (key.toLowerCase() === resolvedModelName.toLowerCase()) {
+                return true;
+            }
+            if (!isObject(config)) {
+                return false;
+            }
+            return config.model?.toLowerCase() === resolvedModelName.toLowerCase();
+        });
         const config = entry ? entry[1] : undefined;
         return isObject(config) ? config : undefined;
     }
     accessRelationModel(modelName) {
         return this.adminizer.modelHandler.internal("data-accessor").get(modelName);
     }
+    resolveRelationTarget(modelName) {
+        if (!modelName) {
+            return undefined;
+        }
+        return this.adminizer.modelHandler.resolveModelName(modelName).toLowerCase();
+    }
     /**
      * Retrieves the fields for the given ModelResource based on action type,
      * taking into account access rights and configuration settings.
@@ -116,21 +131,22 @@ export class DataAccessor {
             let populatedModelFieldsConfig = {};
             if (modelField.type === "association" || modelField.type === "association-many") {
                 const modelName = modelField.model || modelField.collection;
-                const tokenId = `read-${modelName}-${MODEL_TOKEN_SUFFIX}`;
-                if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
-                    Adminizer.log.silly(`No access rights to model: ${this.modelResource.model.modelname}`);
-                    return undefined;
-                }
-                if (modelName) {
+                const resolvedModelName = modelName ? this.adminizer.modelHandler.resolveModelName(modelName) : undefined;
+                if (modelName && resolvedModelName) {
+                    const tokenId = `read-${resolvedModelName}-${MODEL_TOKEN_SUFFIX}`;
+                    if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
+                        Adminizer.log.silly(`No access rights to model: ${this.modelResource.model.modelname}`);
+                        return undefined;
+                    }
                     const model = this.adminizer.modelHandler.model.get(modelName);
                     if (model) {
-                        populatedModelFieldsConfig = this.getAssociatedFieldsConfig(modelName);
-                        const modelCfg = this.getModelConfig(modelName);
+                        populatedModelFieldsConfig = this.getAssociatedFieldsConfig(resolvedModelName);
+                        const modelCfg = this.getModelConfig(resolvedModelName);
                         if (modelCfg) {
                             associatedModelConfig = modelCfg;
                         }
                         else {
-                            Adminizer.log.error(`DataAccessor > getFieldsConfig > Model config not found: ${modelName}`);
+                            Adminizer.log.error(`DataAccessor > getFieldsConfig > Model config not found: ${resolvedModelName}`);
                         }
                     }
                     else {
@@ -167,15 +183,16 @@ export class DataAccessor {
         return orderedFields;
     }
     getAssociatedFieldsConfig(modelName) {
-        const model = this.adminizer.modelHandler.model.get(modelName);
-        const modelConfig = this.getModelConfig(modelName);
+        const resolvedModelName = this.adminizer.modelHandler.resolveModelName(modelName);
+        const model = this.adminizer.modelHandler.model.get(resolvedModelName);
+        const modelConfig = this.getModelConfig(resolvedModelName);
         if (!model || !modelConfig) {
             return undefined;
         }
         // Check if user has access to the associated model
-        const tokenId = `read-${modelName}-${MODEL_TOKEN_SUFFIX}`;
+        const tokenId = `read-${resolvedModelName}-${MODEL_TOKEN_SUFFIX}`;
         if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
-            Adminizer.log.debug(`getAssociatedFieldsConfig > No access rights to ${this.actionVerb} model: ${modelName}`);
+            Adminizer.log.debug(`getAssociatedFieldsConfig > No access rights to ${this.actionVerb} model: ${resolvedModelName}`);
             return undefined;
         }
         const associatedFields = {};
@@ -248,10 +265,28 @@ export class DataAccessor {
             return !userGroups || !userGroups.includes(this.adminizer.config.registration?.defaultUserGroup);
         }
     }
+    getSelectedFields(select) {
+        if (!select) {
+            return undefined;
+        }
+        if (Array.isArray(select)) {
+            return new Set(select);
+        }
+        return new Set(Object.entries(select)
+            .filter(([, enabled]) => enabled)
+            .map(([field]) => field));
+    }
+    getPopulateCriteria(criteria, fieldKey) {
+        const populateConfig = criteria?.populate?.[fieldKey];
+        return populateConfig && populateConfig !== true ? populateConfig : undefined;
+    }
+    canUseSelectedFieldFallback() {
+        return this.user.isAdministrator || this.adminizer.config.auth?.enable === false;
+    }
     /**
      * Returns filtered record applying config from this.fields on this record
      * @data - record from a specific model */
-    process(record) {
+    process(record, criteria) {
         // Initialize fields configuration, if it was not already set
         if (!this.fields) {
             this.fields = this.getFieldsConfig();
@@ -269,6 +304,8 @@ export class DataAccessor {
             // Check access to the field
             if (this.checkFieldAccess(fieldKey, fieldConfig.config)) {
                 const fieldType = fieldConfig.config.type;
+                const populateCriteria = this.getPopulateCriteria(criteria, fieldKey);
+                const selectedAssociatedFields = this.getSelectedFields(populateCriteria?.select);
                 // Handle fields that are not associations
                 if (fieldType !== 'association' && fieldType !== 'association-many') {
                     filteredRecord[fieldKey] = fieldValue;
@@ -278,7 +315,7 @@ export class DataAccessor {
                     if (Array.isArray(fieldValue)) {
                         // If the field value is an array of objects
                         filteredRecord[fieldKey] = (fieldValue.every(item => typeof item === 'object')
-                            ? fieldValue.map(associatedRecord => this.filterAssociatedRecord(associatedRecord, fieldConfig.populated))
+                            ? fieldValue.map(associatedRecord => this.filterAssociatedRecord(associatedRecord, fieldConfig.populated, selectedAssociatedFields))
                             : fieldValue); // If the array contains IDs, pass them as is (it can contain ids, because this function also can be called before saving something)
                     }
                     else {
@@ -290,7 +327,7 @@ export class DataAccessor {
                 else if (fieldType === 'association') {
                     if (fieldValue && typeof fieldValue === 'object') {
                         // If the field value is an object
-                        filteredRecord[fieldKey] = this.filterAssociatedRecord(fieldValue, fieldConfig.populated);
+                        filteredRecord[fieldKey] = this.filterAssociatedRecord(fieldValue, fieldConfig.populated, selectedAssociatedFields);
                     }
                     else {
                         // If the field value is an ID or null, pass it as is (it can contain id, because this function also can be called before saving something)
@@ -310,23 +347,30 @@ export class DataAccessor {
         return filteredRecord;
     }
     /** Filters associated records (simplified process() function) */
-    filterAssociatedRecord(associatedRecord, associatedFieldsConfig) {
-        if (!associatedFieldsConfig) {
+    filterAssociatedRecord(associatedRecord, associatedFieldsConfig, selectedFields) {
+        if (!associatedFieldsConfig && !selectedFields) {
             return {};
         }
         const filteredAssociatedRecord = {};
         for (const assocFieldKey in associatedRecord) {
-            const assocFieldConfig = associatedFieldsConfig[assocFieldKey];
+            if (selectedFields && !selectedFields.has(assocFieldKey)) {
+                continue;
+            }
+            const assocFieldConfig = associatedFieldsConfig?.[assocFieldKey];
             const assocFieldValue = associatedRecord[assocFieldKey];
             if (assocFieldConfig && this.checkFieldAccess(assocFieldKey, assocFieldConfig.config)) {
                 filteredAssociatedRecord[assocFieldKey] = assocFieldValue;
+                continue;
+            }
+            if (selectedFields && this.canUseSelectedFieldFallback()) {
+                filteredAssociatedRecord[assocFieldKey] = assocFieldValue;
             }
         }
         return filteredAssociatedRecord;
     }
     /** Process for an array of records */
-    processMany(records) {
-        return records.map(record => this.process(record));
+    processMany(records, criteria) {
+        return records.map(record => this.process(record, criteria));
     }
     async sanitizeUserRelationAccess(criteria = {}) {
         let sanitizedCriteria = {};
@@ -341,33 +385,35 @@ export class DataAccessor {
             const userAccessRelation = modelConfig.userAccessRelation;
             if (typeof userAccessRelation === 'string') {
                 let accessField = userAccessRelation;
-                // Check if the relation points to `UserAP` or `GroupAP` in the model's attributes
+                // Check if the relation points to `User` or `Group` in the model's attributes
                 const modelAttributes = this.modelResource.model.attributes;
                 const relation = modelAttributes[accessField];
-                if (!relation || !['userap', 'groupap'].includes(relation.model.toLowerCase() || relation.collection.toLowerCase())) {
+                const relationModel = this.resolveRelationTarget(relation?.model);
+                const relationCollection = this.resolveRelationTarget(relation?.collection);
+                if (!relation || !['user', 'group'].includes(relationModel ?? relationCollection ?? "")) {
                     throw new Error(`Invalid userAccessRelation configuration for model ${modelName}`);
                 }
                 // Determine if the current user matches the access criteria
-                if (relation.model) {
-                    if (relation.model.toLowerCase() === 'userap') {
-                        // Filter by the user's ID if related to UserAP as a model
+                if (relationModel) {
+                    if (relationModel === 'user') {
+                        // Filter by the user's ID if related to User as a model
                         sanitizedCriteria = { ...sanitizedCriteria, [accessField]: this.user.id };
                     }
-                    else if (relation.model.toLowerCase() === 'groupap') {
-                        // Filter by user's group membership if related to GroupAP as a model
+                    else if (relationModel === 'group') {
+                        // Filter by user's group membership if related to Group as a model
                         const userGroups = this.user.groups?.map((group) => group.id);
                         sanitizedCriteria = { ...sanitizedCriteria, [accessField]: { in: userGroups } };
                     }
                 }
                 /** Warning: collection relation access is not supported and needs adapter-level processing */
-                if (relation.collection) {
+                if (relationCollection) {
                     Adminizer.log.warn(`Collection relation is not supported and was not tested. You may have an error here: ${JSON.stringify(relation, null, 2)}`);
-                    if (relation.collection.toLowerCase() === 'userap') {
-                        // Ensure user's ID is part of the associated collection to UserAP
+                    if (relationCollection === 'user') {
+                        // Ensure user's ID is part of the associated collection to User
                         sanitizedCriteria = { ...sanitizedCriteria, [accessField]: { contains: this.user.id } };
                     }
-                    else if (relation.collection.toLowerCase() === 'groupap') {
-                        // Ensure user's groups intersect with the collection to GroupAP
+                    else if (relationCollection === 'group') {
+                        // Ensure user's groups intersect with the collection to Group
                         const userGroups = this.user.groups?.map((group) => group.id);
                         sanitizedCriteria = { ...sanitizedCriteria, [accessField]: { intersects: userGroups } };
                     }
@@ -390,9 +436,9 @@ export class DataAccessor {
                 // Validate the `via` field in the intermediate model
                 const intermediateAttributes = intermediateModel.attributes;
                 const viaRelation = intermediateAttributes[via];
-                if (!viaRelation || viaRelation.model.toLowerCase() !== 'userap') {
+                if (!viaRelation || this.resolveRelationTarget(viaRelation.model) !== 'user') {
                     throw new Error(`Unsupported or invalid via field "${via}" in intermediate model "${intermediateRelation.model}". ` +
-                        `Currently, only relations to "userap" are supported`);
+                        `Currently, only relations to "User" are supported`);
                 }
                 // Fetch all intermediate records associated with the user
                 const intermediateRecords = await this.accessRelationModel(intermediateRelation.model).find({ where: { [via]: this.user.id } });
@@ -418,16 +464,17 @@ export class DataAccessor {
                 if (updatedRecord[accessField] && !this.user.isAdministrator) {
                     delete updatedRecord[accessField];
                 }
-                // Check if the relation points to `UserAP` or `GroupAP` in the model's attributes
+                // Check if the relation points to `User` or `Group` in the model's attributes
                 const modelAttributes = this.modelResource.model.attributes;
                 const relation = modelAttributes[accessField];
-                if (relation && ['userap', 'groupap'].includes(relation.model.toLowerCase())) {
-                    if (relation.model.toLowerCase() === 'userap') {
+                const relationModel = this.resolveRelationTarget(relation?.model);
+                if (relation && ['user', 'group'].includes(relationModel ?? "")) {
+                    if (relationModel === 'user') {
                         if (!this.user.isAdministrator) {
                             updatedRecord[accessField] = this.user.id;
                         }
                     }
-                    else if (relation.model.toLowerCase() === 'groupap') {
+                    else if (relationModel === 'group') {
                         const userGroups = this.user.groups || [];
                         if (userGroups.length === 1) {
                             updatedRecord[accessField] = userGroups[0].id;
@@ -458,9 +505,9 @@ export class DataAccessor {
                     // Validate the `via` field in the intermediate model
                     const intermediateAttributes = intermediateModel.attributes;
                     const viaRelation = intermediateAttributes[via];
-                    if (!viaRelation || !viaRelation.model || viaRelation.model.toLowerCase() !== 'userap') {
+                    if (!viaRelation || this.resolveRelationTarget(viaRelation.model) !== 'user') {
                         throw new Error(`Unsupported or invalid via field "${via}" in intermediate model "${intermediateRelation.model}". ` +
-                            `Currently, only relations to "userap" are supported`);
+                            `Currently, only relations to "User" are supported`);
                     }
                     const intermediatePk = (intermediateModel.primaryKey ?? 'id');
                     const chosenId = typeof updatedRecord[field] === 'object'

package/lib/access-rights/AccessRightsHandler.d.ts

@@ -0,0 +1,17 @@
+import type { AccessRightsToken } from "../../interfaces/types";
+import type { Adminizer } from "../Adminizer";
+export interface AccessRightsRecord {
+    id: string;
+    appName: string;
+    token: AccessRightsToken;
+}
+export declare class AccessRightsHandler {
+    private adminizer;
+    private records;
+    constructor(adminizer: Adminizer);
+    register(appName: string, token: AccessRightsToken): string;
+    unregister(id: string): void;
+    getByApp(appName: string): AccessRightsRecord[];
+    private getRecordId;
+    private getTokenOwner;
+}

package/lib/access-rights/AccessRightsHandler.js

@@ -0,0 +1,63 @@
+export class AccessRightsHandler {
+    adminizer;
+    records = new Map();
+    constructor(adminizer) {
+        this.adminizer = adminizer;
+    }
+    register(appName, token) {
+        const normalizedToken = {
+            ...token,
+            id: token.id.toLowerCase(),
+        };
+        const id = this.getRecordId(appName, normalizedToken.id);
+        if (this.records.has(id)) {
+            throw new Error(`Access rights token "${normalizedToken.id}" is already registered for app "${appName}"`);
+        }
+        const existingOwner = this.getTokenOwner(normalizedToken.id);
+        if (existingOwner && existingOwner !== appName) {
+            throw new Error(`Access rights token "${normalizedToken.id}" is already registered by app "${existingOwner}"`);
+        }
+        if (!existingOwner && this.adminizer.accessRightsHelper.hasToken(normalizedToken.id)) {
+            throw new Error(`Access rights token "${normalizedToken.id}" is already registered`);
+        }
+        this.adminizer.accessRightsHelper.registerToken(normalizedToken);
+        this.records.set(id, {
+            id,
+            appName,
+            token: normalizedToken,
+        });
+        this.adminizer.emitter.emit("app:access-right:registered", {
+            appName,
+            resourceId: id,
+            tokenId: normalizedToken.id,
+        });
+        return id;
+    }
+    unregister(id) {
+        const record = this.records.get(id);
+        if (!record) {
+            return;
+        }
+        this.adminizer.accessRightsHelper.unregisterToken(record.token.id);
+        this.records.delete(id);
+        this.adminizer.emitter.emit("app:access-right:unregistered", {
+            appName: record.appName,
+            resourceId: id,
+            tokenId: record.token.id,
+        });
+    }
+    getByApp(appName) {
+        return Array.from(this.records.values()).filter((record) => record.appName === appName);
+    }
+    getRecordId(appName, tokenId) {
+        return `${appName}:${tokenId}`;
+    }
+    getTokenOwner(tokenId) {
+        for (const record of this.records.values()) {
+            if (record.token.id === tokenId) {
+                return record.appName;
+            }
+        }
+        return undefined;
+    }
+}

package/lib/ai-assistant/AbstractAiModelService.d.ts

@@ -1,17 +1,14 @@
-import { Adminizer } from '../Adminizer';
 import { AiAssistantMessage, AiAssistantModelInfo } from '../../interfaces/types';
-import { UserAP } from '../../models/UserAP';
+import { User } from '../../models/User';
 /**
- * Base class for AI assistant models. It is responsible for registering
- * access rights for the model and providing metadata for the front-end.
+ * Base class for AI assistant models. App modules register access rights
+ * and expose model metadata through this service.
  */
 export declare abstract class AbstractAiModelService {
-    protected readonly adminizer: Adminizer;
     readonly id: string;
     readonly name: string;
     readonly description?: string;
-    protected constructor(adminizer: Adminizer, metadata: AiAssistantModelInfo);
-    protected registerAccessRight(): void;
+    protected constructor(metadata: AiAssistantModelInfo);
     getMetadata(): AiAssistantModelInfo;
-    abstract generateReply(prompt: string, history: AiAssistantMessage[], user: UserAP): Promise<string>;
+    abstract generateReply(prompt: string, history: AiAssistantMessage[], user: User): Promise<string>;
 }

package/lib/ai-assistant/AbstractAiModelService.js

@@ -1,26 +1,15 @@
 /**
- * Base class for AI assistant models. It is responsible for registering
- * access rights for the model and providing metadata for the front-end.
+ * Base class for AI assistant models. App modules register access rights
+ * and expose model metadata through this service.
  */
 export class AbstractAiModelService {
-    adminizer;
     id;
     name;
     description;
-    constructor(adminizer, metadata) {
-        this.adminizer = adminizer;
+    constructor(metadata) {
         this.id = metadata.id;
         this.name = metadata.name;
         this.description = metadata.description;
-        this.registerAccessRight();
-    }
-    registerAccessRight() {
-        this.adminizer.accessRightsHelper.registerToken({
-            id: `ai-assistant-${this.id}`,
-            name: this.name,
-            description: `Access to AI assistant model ${this.name}`,
-            department: 'AI Assistant',
-        });
     }
     getMetadata() {
         return {

package/lib/ai-assistant/AiAssistantHandler.d.ts

@@ -1,7 +1,7 @@
 import { Adminizer } from '../Adminizer';
 import { AbstractAiModelService } from './AbstractAiModelService';
 import { AiAssistantMessage, AiAssistantModelInfo } from '../../interfaces/types';
-import { UserAP } from '../../models/UserAP';
+import { User } from '../../models/User';
 export declare class AiAssistantHandler {
     private readonly adminizer;
     private readonly models;
@@ -12,7 +12,7 @@ export declare class AiAssistantHandler {
     getModels(): AiAssistantModelInfo[];
     getHistory(userId: number, modelId: string): AiAssistantMessage[];
     resetHistory(userId: number, modelId: string): void;
-    sendMessage(user: UserAP, modelId: string, prompt: string): Promise<{
+    sendMessage(user: User, modelId: string, prompt: string): Promise<{
         history: AiAssistantMessage[];
     }>;
     private getSessionKey;

package/lib/app-manager/AdminizerApp.d.ts

@@ -0,0 +1,228 @@
+import type { ActionType, AdminpanelConfig, AdminpanelIcon, ModelConfig } from "../../interfaces/adminpanelConfig";
+import type { AccessRightsToken, INotification, ModelResource } from "../../interfaces/types";
+import type { AbstractCatalog } from "../catalog/AbstractCatalog";
+import type { CatalogTemplateComponentResource } from "../catalog/CatalogTemplateComponentHandler";
+import type { AppModelAccess } from "../model/ModelHandler";
+import type { AbstractMediaManager } from "../media-manager/AbstractMediaManager";
+import type { Config, ControlType } from "../controls/Control";
+import type { User } from "../../models/User";
+import type { DataAccessor } from "../DataAccessor";
+import type { AbstractAiModelService } from "../ai-assistant/AbstractAiModelService";
+export type AppDisposer = () => void | Promise<void>;
+export type AppEventName = string | symbol;
+export type AppEventHandler<TPayload = any> = (payload: TPayload, runtime: AppRuntime) => void | Promise<void>;
+export type AppControllerMethod = "get" | "post" | "put" | "patch" | "delete" | "all";
+export type AppControllerPolicyMode = "ui" | "api";
+export type AppControllerPolicy = {
+    type: "auth";
+    mode?: AppControllerPolicyMode;
+} | {
+    type: "auth-enabled";
+} | {
+    type: "admin";
+    mode?: AppControllerPolicyMode;
+} | {
+    type: "permission";
+    token: string;
+    mode?: AppControllerPolicyMode;
+} | {
+    type: "any-permission";
+    tokens: string[];
+    mode?: AppControllerPolicyMode;
+};
+export type AppConfigPatch = {
+    [K in keyof AdminpanelConfig]?: AdminpanelConfig[K] extends (...args: any[]) => any ? AdminpanelConfig[K] : AdminpanelConfig[K] extends Array<infer U> ? U[] : AdminpanelConfig[K] extends object ? Partial<AdminpanelConfig[K]> : AdminpanelConfig[K];
+};
+/**
+ * A controller owned by an Adminizer app.
+ *
+ * Before the middleware runs, ControllerHandler assigns an AppRuntime scoped
+ * to the owning app to `req.runtime`. App controllers must use that runtime
+ * instead of reading `req.adminizer`.
+ */
+export interface AppController {
+    id?: string;
+    route: string;
+    method: AppControllerMethod;
+    middleware: MiddlewareType;
+    policies?: AppControllerPolicy[];
+}
+export interface AppAsset {
+    id: string;
+    filePath: string;
+    route?: string;
+    devUrl?: string;
+}
+export interface AppControlResource {
+    id?: string;
+    type: ControlType;
+    name: string;
+    config?: Config;
+    component: AppAsset;
+    stylesheet?: AppAsset;
+}
+export interface AppWidgetBaseResource {
+    id: string;
+    name: string;
+    description: string;
+    icon?: AdminpanelIcon | string;
+    department: string;
+    backgroundCSS?: string | null;
+    size?: {
+        h: number;
+        w: number;
+    } | null;
+    accessRightsToken?: string;
+    group?: string;
+}
+export interface AppWidgetContext {
+    runtime: AppRuntime;
+}
+export interface AppWidgetInfoContext extends AppWidgetContext {
+    user?: ReqType["user"];
+}
+export interface AppInfoWidgetResource extends AppWidgetBaseResource {
+    type: "info";
+    link?: string;
+    linkType?: "self" | "blank";
+    getInfo(context: AppWidgetInfoContext): Promise<string> | string;
+}
+export interface AppActionWidgetResource extends AppWidgetBaseResource {
+    type: "action";
+    action(context: AppWidgetContext): Promise<unknown> | unknown;
+}
+export interface AppSwitchWidgetResource extends AppWidgetBaseResource {
+    type: "switcher";
+    getState(context: AppWidgetContext): Promise<boolean> | boolean;
+    switchIt(context: AppWidgetContext): Promise<boolean> | boolean;
+}
+export interface AppLinkWidgetLink {
+    name: string;
+    description: string;
+    icon?: AdminpanelIcon | string;
+    link: string;
+    linkType: "self" | "blank";
+    backgroundCSS?: string | null;
+}
+export interface AppLinkWidgetResource extends AppWidgetBaseResource {
+    type: "link";
+    links: AppLinkWidgetLink[];
+}
+export interface AppCustomWidgetResource extends AppWidgetBaseResource {
+    type: "custom";
+    component: AppAsset;
+}
+export type AppWidgetResource = AppInfoWidgetResource | AppActionWidgetResource | AppSwitchWidgetResource | AppLinkWidgetResource | AppCustomWidgetResource;
+/**
+ * Public capabilities available to an Adminizer app at runtime.
+ *
+ * The runtime is scoped to the app that registered the resource. In
+ * particular, `models` exposes only models declared through
+ * `AppSetupContext.modelAccess()`.
+ *
+ * App code must not retain or depend on the Adminizer instance. Controllers
+ * receive this object through `req.runtime`; catalog factories and event
+ * listeners receive it as an argument.
+ */
+export interface AppRuntime {
+    models: AppModelAccess;
+    config: AppRuntimeConfig;
+    notifications: AppRuntimeNotifications;
+    apps: AppRuntimeApps;
+}
+export interface AppRuntimeConfig {
+    readonly routePrefix: string;
+    getModelConfig(modelName: string): ModelConfig | undefined;
+}
+export type AppRuntimeAppState = "registered" | "enabled" | "disabled" | "unregistered" | "failed";
+export interface AppRuntimeApp {
+    readonly name: string;
+    readonly version: string;
+    readonly state: AppRuntimeAppState;
+}
+export interface AppRuntimeApps {
+    list(): AppRuntimeApp[];
+    get(name: string): AppRuntimeApp | undefined;
+    enable(name: string): Promise<void>;
+    disable(name: string): Promise<void>;
+    unregister(name: string): Promise<void>;
+}
+export interface AppRuntimeNotifications {
+    send(notification: Omit<INotification, "id" | "createdAt" | "icon">): Promise<boolean>;
+}
+export interface AppModelAccessResource {
+    id?: string;
+    models: string[];
+}
+export interface AppModelResource {
+    name: string;
+    adapter?: string;
+}
+export interface AppCatalogFactoryResource {
+    id: string;
+    templates?: CatalogTemplateComponentResource[];
+    factory: (runtime: AppRuntime) => AbstractCatalog | Promise<AbstractCatalog>;
+}
+export interface AppMediaManagerResource {
+    factory: (runtime: AppRuntime) => AbstractMediaManager | Promise<AbstractMediaManager>;
+}
+export interface AppAiAssistantContext {
+    runtime: AppRuntime;
+    routePrefix: string;
+    getModelResources(): ModelResource[];
+    resolveModelResource(modelName: string): ModelResource | undefined;
+    hasPermission(token: string, user: User): boolean;
+    createDataAccessor(modelResource: ModelResource, user: User, action: ActionType): DataAccessor;
+}
+export interface AppAiAssistantResource {
+    models: Array<(context: AppAiAssistantContext) => AbstractAiModelService | Promise<AbstractAiModelService>>;
+}
+/**
+ * Resource registration API provided while an app is being enabled.
+ *
+ * Apps use this context to declare everything they own. They must not accept
+ * an Adminizer instance in their constructor or setup method. This keeps app
+ * lifecycle, resource cleanup, model permissions, and runtime capabilities
+ * under AppManager control.
+ */
+export interface AppSetupContext {
+    asset(asset: AppAsset): string;
+    control(control: AppControlResource): void;
+    widget(widget: AppWidgetResource): void;
+    controller(controller: AppController): string;
+    config(config: AppConfigPatch, id?: string): void;
+    accessRight(token: AccessRightsToken): void;
+    catalog(catalog: AppCatalogFactoryResource): void;
+    mediaManager(resource: AppMediaManagerResource): void;
+    model(model: AppModelResource): void;
+    modelAccess(access: AppModelAccessResource): void;
+    aiAssistant(resource: AppAiAssistantResource): void;
+    listener(event: AppEventName, handler: AppEventHandler): void;
+}
+/**
+ * Base contract for an Adminizer app.
+ *
+ * An app is created from its own configuration and optional app-level
+ * dependencies, then enabled with `adminizer.appManager.enable(app)`.
+ * The Adminizer instance belongs to the host application and must not be
+ * passed into or stored by the app.
+ *
+ * Use `setup(ctx)` for resource registration. At runtime, use:
+ * - `req.runtime` in app controllers;
+ * - the `runtime` factory argument in catalogs;
+ * - the `runtime` handler argument in event listeners.
+ */
+export declare abstract class AbstractAdminizerApp<TConfig = unknown> {
+    abstract readonly name: string;
+    abstract readonly version: string;
+    readonly config?: TConfig;
+    protected constructor();
+    /**
+     * Declares resources owned by the app.
+     *
+     * Do not add an Adminizer parameter. Runtime access is intentionally
+     * provided through registered controller requests, factories, and
+     * listeners.
+     */
+    abstract setup(ctx: AppSetupContext): void | Promise<void>;
+}