@antelopejs/dms 0.5.5 → 0.6.0

package/dist/implementations/dms/page.js

@@ -14,9 +14,14 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DMSController = exports.internal = exports.GetFrontendModules = exports.createIgnoreFilter = exports.AddFrontendModule = void 0;
 exports.userCanAccessPage = userCanAccessPage;
+exports.reportMissingCategories = reportMissingCategories;
+exports.cancelMissingCategoryCheck = cancelMissingCategoryCheck;
+exports.GetMenuOrder = GetMenuOrder;
+exports.GetCategoryPermissionIds = GetCategoryPermissionIds;
 exports.NotifyMenuChanged = NotifyMenuChanged;
 exports.cancelPendingMenuNotifications = cancelPendingMenuNotifications;
 exports.buildPagePayload = buildPagePayload;
+exports.resolvePermissionPreviewAccess = resolvePermissionPreviewAccess;
 exports.filterPermissionsForBypassedSurfaces = filterPermissionsForBypassedSurfaces;
 exports.resolveUserPermissions = resolveUserPermissions;
 exports.buildSiteLayoutPayload = buildSiteLayoutPayload;
@@ -27,12 +32,15 @@ const logging_1 = require("@antelopejs/interface-core/logging");
 const component_1 = require("@antelopejs/interface-dms/component");
 const db_1 = require("@antelopejs/interface-dms/db");
 const page_1 = require("@antelopejs/interface-dms/page");
+const categories_1 = require("@antelopejs/interface-dms/page/internal/categories");
+const permission_gate_1 = require("@antelopejs/interface-dms/internal/permission-gate");
 const permissions_1 = require("@antelopejs/interface-dms/permissions");
 const request_tenant_1 = require("@antelopejs/interface-dms/request-tenant");
 const tenant_access_1 = require("@antelopejs/interface-dms/tenant-access");
+const tenant_access_2 = require("@antelopejs/interface-dms/internal/tenant-access");
 const tenant_scoped_model_1 = require("@antelopejs/interface-dms/tenant-scoped-model");
 const auth_1 = require("@antelopejs/interface-dms/auth");
-const component_target_1 = require("@antelopejs/interface-dms/page/component-target");
+const component_target_1 = require("@antelopejs/interface-dms/page/internal/component-target");
 const realtime_1 = require("../../realtime");
 const fire_and_forget_1 = require("@antelopejs/interface-dms/utils/fire-and-forget");
 const dev_reload_1 = require("./dev-reload");
@@ -42,8 +50,11 @@ const frontend_bootstrap_1 = require("./frontend-bootstrap");
 const quick_actions_1 = require("./quick-actions");
 const layout_banners_1 = require("./layout-banners");
 const route_params_1 = require("./route-params");
+const nav_badges_1 = require("./nav-badges");
 const resolver_timeout_1 = require("./resolver-timeout");
 const warn_once_1 = require("./warn-once");
+const permission_preview_1 = require("./permission-preview");
+const run_in_batches_1 = require("../../utils/run-in-batches");
 var frontend_modules_2 = require("./frontend-modules");
 Object.defineProperty(exports, "AddFrontendModule", { enumerable: true, get: function () { return frontend_modules_2.AddFrontendModule; } });
 Object.defineProperty(exports, "createIgnoreFilter", { enumerable: true, get: function () { return frontend_modules_2.createIgnoreFilter; } });
@@ -100,7 +111,7 @@ async function userCanAccessPage(user, fullId, memberModel, roleModel, tenantId)
     if (!user)
         return !(0, page_1.isInsideModule)(info) && info.publicAccess === true;
     const access = await (0, tenant_access_1.CheckTenantAccess)(user._id, tenantId);
-    if (!(0, tenant_access_1.gateAllowsSurface)(info, !access.allowed))
+    if (!(0, tenant_access_2.gateAllowsSurface)(info, !access.allowed))
         return false;
     const roleIds = await getRoleIdsForUser(memberModel, user);
     const permissions = await (0, permissions_1.GetEffectiveUserPermissions)(user, tenantId, roleIds, roleModel);
@@ -113,18 +124,53 @@ async function userCanAccessPage(user, fullId, memberModel, roleModel, tenantId)
     return (0, permissions_1.HasPermission)(permissions, resolvePagePermissionId(info.permission, info.fullId));
 }
 const warnedMissingCategories = new Set();
-function warnMissingCategory(categoryFullId, entryFullIds) {
+const suspectedMissingCategories = new Set();
+let missingCategoryCheck;
+const MISSING_CATEGORY_SETTLE_MS = 250;
+function suspectMissingCategory(categoryFullId) {
     if (warnedMissingCategories.has(categoryFullId))
         return;
-    warnedMissingCategories.add(categoryFullId);
-    const entries = entryFullIds.map((fullId) => `"${fullId}"`).join(", ");
-    logging_1.Logging.Warn(`[dms] category "${categoryFullId}" is not registered but ${entries} hang under it: the menu shows them at its parent's level.`);
+    suspectedMissingCategories.add(categoryFullId);
+    missingCategoryCheck ??= setTimeout(reportMissingCategories, MISSING_CATEGORY_SETTLE_MS);
+    missingCategoryCheck.unref();
+}
+function findTreeNode(fullId) {
+    let node = navigationTree;
+    for (const part of fullId.split(".")) {
+        node = node?.children[part];
+    }
+    return node;
+}
+function reportMissingCategories() {
+    clearTimeout(missingCategoryCheck);
+    missingCategoryCheck = undefined;
+    for (const categoryFullId of suspectedMissingCategories) {
+        const node = findTreeNode(categoryFullId);
+        const heldKeys = node ? Object.keys(node.children) : [];
+        if (categoryFullId in categoriesByFullId ||
+            !node ||
+            !isContainerWithoutEntry(node) ||
+            heldKeys.length === 0) {
+            continue;
+        }
+        warnedMissingCategories.add(categoryFullId);
+        const entries = heldKeys
+            .map((key) => `"${categoryFullId}.${key}"`)
+            .join(", ");
+        logging_1.Logging.Warn(`[dms] category "${categoryFullId}" is not registered but ${entries} hang under it: the menu shows them at its parent's level.`);
+    }
+    suspectedMissingCategories.clear();
+}
+function cancelMissingCategoryCheck() {
+    clearTimeout(missingCategoryCheck);
+    missingCategoryCheck = undefined;
+    suspectedMissingCategories.clear();
 }
-function ensureContainer(level, containerFullId, entryFullId) {
+function ensureContainer(level, containerFullId) {
     const key = containerFullId.slice(containerFullId.lastIndexOf(".") + 1);
     const isRegistered = Boolean(level[key]?.fullId) || containerFullId in categoriesByFullId;
     if (!isRegistered)
-        warnMissingCategory(containerFullId, [entryFullId]);
+        suspectMissingCategory(containerFullId);
     level[key] ??= {
         displayName: "none",
         children: {},
@@ -141,7 +187,7 @@ function addToTree(newPageInfo) {
     let currentLevel = navigationTree.children;
     for (let i = 0; i < parts.length - 1; i++) {
         const containerFullId = parts.slice(0, i + 1).join(".");
-        currentLevel = ensureContainer(currentLevel, containerFullId, newPageInfo.fullId).children;
+        currentLevel = ensureContainer(currentLevel, containerFullId).children;
     }
     const lastPart = parts[parts.length - 1];
     const existingChildren = currentLevel[lastPart]?.children || {};
@@ -172,6 +218,31 @@ function updateChildrenOrders(node) {
         updateChildrenOrders(node.children[child]);
     }
 }
+function GetMenuOrder() {
+    const positions = new Map();
+    let position = 0;
+    const visit = (node) => {
+        for (const key of node.childrenOrders) {
+            const child = node.children[key];
+            if (!child)
+                continue;
+            if (!isContainerWithoutEntry(child)) {
+                const permissionId = resolvePagePermissionId(child.permission, child.fullId);
+                if (!positions.has(permissionId))
+                    positions.set(permissionId, position);
+                if (!positions.has(child.fullId))
+                    positions.set(child.fullId, position);
+                position += 1;
+            }
+            visit(child);
+        }
+    };
+    visit(navigationTree);
+    return positions;
+}
+function GetCategoryPermissionIds() {
+    return new Set(Object.values(categoriesByFullId).map((category) => resolvePagePermissionId(category.permission, category.fullId)));
+}
 function removeFromTree(fullId) {
     const parts = fullId.split(".");
     const levels = [
@@ -191,7 +262,7 @@ function removeFromTree(fullId) {
         return;
     const heldKeys = Object.keys(target.children);
     if (heldKeys.length > 0) {
-        warnMissingCategory(fullId, heldKeys.map((heldKey) => `${fullId}.${heldKey}`));
+        suspectMissingCategory(fullId);
         currentLevel[key] = {
             ...target,
             displayName: "none",
@@ -219,10 +290,13 @@ function removeFromTree(fullId) {
 const moduleRegistry = {};
 const dynamicMenuProviders = [];
 const nodeProviders = new WeakMap();
+const nodeTargets = new WeakMap();
+let previewStructureVersion = 0;
 const HTTP_FORBIDDEN = 403;
 const WILDCARD_PERMISSION = "*";
 const ERROR_UNAUTHORIZED = "error.unauthorized";
 function notifyStructureChanged() {
+    previewStructureVersion++;
     (0, dev_reload_1.scheduleBroadcast)();
     schedulePublishMenuChanged(undefined);
 }
@@ -319,7 +393,7 @@ var internal;
         },
         unregister: (pageInfo) => {
             if (pagesBySlug[pageInfo.fullSlug] !== pageInfo) {
-                page_1.internal.clearPageMetadata(pageInfo.fullId, pageInfo);
+                (0, categories_1.clearPageMetadata)(pageInfo.fullId, pageInfo);
                 return;
             }
             delete pagesBySlug[pageInfo.fullSlug];
@@ -330,7 +404,7 @@ var internal;
             if ((0, page_1.isInsideModule)(pageInfo)) {
                 (0, permissions_1.UnmarkModuleScopedPermission)(resolvePagePermissionId(pageInfo.permission, pageInfo.fullId));
             }
-            page_1.internal.clearPageMetadata(pageInfo.fullId, pageInfo);
+            (0, categories_1.clearPageMetadata)(pageInfo.fullId, pageInfo);
             (0, page_1.ClearPageLayoutBySlug)(pageInfo.fullSlug);
             (0, realtime_1.clearPageTopics)(pageInfo.fullId);
         },
@@ -342,7 +416,7 @@ var internal;
         },
         unregister: (info) => {
             delete moduleRegistry[info.id];
-            page_1.internal.clearModuleResolution(info.id);
+            (0, categories_1.clearModuleResolution)(info.id);
             notifyStructureChanged();
         },
     };
@@ -360,11 +434,11 @@ var internal;
     };
     internal.RegisterPageExtension = {
         register: (info) => {
-            page_1.internal.applyPageExtension(info);
+            (0, categories_1.applyPageExtension)(info);
             (0, dev_reload_1.scheduleBroadcast)();
         },
         unregister: (info) => {
-            page_1.internal.revokePageExtension(info);
+            (0, categories_1.revokePageExtension)(info);
             (0, dev_reload_1.scheduleBroadcast)();
         },
     };
@@ -380,15 +454,25 @@ class DMSController extends (0, interface_api_1.Controller)("/dms") {
         return resolveUserPermissions(user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext));
     }
     async siteLayout(requestContext, roleModel, memberModel, user) {
-        return buildSiteLayoutPayload(user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext));
+        return buildSiteLayoutPayload(user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext), requestContext);
     }
     async modulesListing(requestContext, roleModel, memberModel, user) {
-        const accessContext = await buildAccessContext(user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext));
+        const tenantId = (0, request_tenant_1.getRequestTenantId)(requestContext);
+        const accessContext = await buildAccessContext(user, memberModel, roleModel, tenantId);
         (0, interface_api_util_1.assert)(accessContext.gated.isOwner, HTTP_FORBIDDEN, ERROR_UNAUTHORIZED);
-        return Object.values(moduleRegistry).map((info) => ({
-            ...info,
-            hasAccess: true,
-            landingSlug: resolveModuleLandingSlug(info),
+        const catalogContext = { user, tenantId };
+        return Promise.all(Object.values(moduleRegistry).map(async (info) => {
+            const [status, readout] = await Promise.all([
+                runModuleStatusHook(info, catalogContext),
+                runModuleReadoutHook(info, catalogContext),
+            ]);
+            return {
+                ...presentModuleInfo(info),
+                hasAccess: await computeModuleAccess(info.id, accessContext),
+                landingSlug: resolveModuleLandingSlug(info),
+                status,
+                readout,
+            };
         }));
     }
     async pageLayout(requestContext, roleModel, memberModel, user, slug) {
@@ -400,7 +484,7 @@ class DMSController extends (0, interface_api_1.Controller)("/dms") {
     }
     async page(requestContext, roleModel, memberModel, user) {
         (0, interface_api_util_1.assert)(this.pagePath, 400, "error.path_required");
-        const payload = await buildPagePayload(this.pagePath, user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext), this.sharedPage !== OMIT_SHARED_PAGE_QUERY_VALUE);
+        const payload = await buildPagePayload(this.pagePath, user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext), this.sharedPage !== OMIT_SHARED_PAGE_QUERY_VALUE, requestContext);
         await (0, stale_session_1.assertPageSessionAccepted)(payload, !!user, this.authorization);
         return payload;
     }
@@ -509,7 +593,7 @@ function resolveRegisteredPageSlug(path) {
     return Object.keys(pagesBySlug).find((pattern) => pattern.includes(":") && matchesPagePattern(pattern, path));
 }
 async function buildPagePayload(...arguments_) {
-    const [slug, user, memberModel, roleModel, tenantId, includeShared = true] = arguments_;
+    const [slug, user, memberModel, roleModel, tenantId, includeShared = true, requestContext,] = arguments_;
     const normalizedSlug = `/${slug.replace(/^\/+|\/+$/g, "")}`;
     const registeredSlug = resolveRegisteredPageSlug(normalizedSlug);
     (0, interface_api_util_1.assert)(registeredSlug, 404, "error.page_not_found");
@@ -525,10 +609,299 @@ async function buildPagePayload(...arguments_) {
     }
     const [layout, shared] = await Promise.all([
         handler(user, memberModel, roleModel, tenantId),
-        buildSiteLayoutPayload(user, memberModel, roleModel, tenantId),
+        buildSiteLayoutPayload(user, memberModel, roleModel, tenantId, requestContext),
     ]);
     return { route: shared.siteLayout.pages[registeredSlug], shared, layout };
 }
+function buildPreviewAccessContext(previewPermissions, real) {
+    const preview = {
+        permissions: previewPermissions,
+        isOwner: previewPermissions.has(WILDCARD_PERMISSION),
+        isAuthenticated: true,
+    };
+    if (!real.gateDenied) {
+        return {
+            gated: preview,
+            ungated: preview,
+            client: preview,
+            gateDenied: false,
+            entryAccess: new Map(),
+        };
+    }
+    return buildDeniedAccessContext(preview);
+}
+async function findRegisteredEntriesHiddenByPreview(real, preview) {
+    const entries = [
+        ...Object.values(pagesBySlug),
+        ...Object.values(categoriesByFullId),
+    ];
+    const hidden = [];
+    for (const entry of entries) {
+        if (!(await computeEntryAccess(entry, real)))
+            continue;
+        if (!(await computeEntryAccess(entry, preview)))
+            hidden.push(entry.fullId);
+    }
+    return hidden;
+}
+function findDynamicEntriesHiddenByPreview(served, previewed) {
+    const kept = new Set([...previewed.values()].flat().map((node) => node.fullId));
+    return [...served.values()]
+        .flat()
+        .map((node) => node.fullId)
+        .filter((fullId) => !kept.has(fullId));
+}
+function previewMemberModels(previewPermissions) {
+    const roleIds = [PREVIEW_ROLE_ID];
+    const roles = [
+        { _id: PREVIEW_ROLE_ID, permissions: [...previewPermissions] },
+    ];
+    return {
+        memberModel: {
+            getByUser: async () => ({ roleIds }),
+        },
+        roleModel: { getBy: async () => roles },
+    };
+}
+function memoizeViewerModels(memberModel, roleModel) {
+    const answers = new Map();
+    const remember = (key, read) => {
+        const known = answers.get(key);
+        if (known)
+            return known;
+        const pending = Promise.resolve(read());
+        answers.set(key, pending);
+        return pending;
+    };
+    return {
+        memberModel: {
+            getByUser: (userId) => remember(`member:${userId}`, () => memberModel.getByUser(userId)),
+        },
+        roleModel: {
+            getBy: (...args) => remember(`roles:${JSON.stringify(args)}`, () => roleModel.getBy(...args)),
+        },
+    };
+}
+const PREVIEW_LOSS_TTL_MS = 30_000;
+const PREVIEW_LOSS_MAX_SCOPES = 16;
+const PREVIEW_PAGE_CONCURRENCY = 4;
+const PREVIEW_ROLE_ID = "dms-permission-preview";
+async function findPreviewHeaderActions(handler, layout, request, quickActions) {
+    const viewerActions = (0, permission_preview_1.readHeaderActions)(layout.layout);
+    if (viewerActions.length === 0)
+        return [];
+    const { memberModel, roleModel } = previewMemberModels(request.previewPermissions);
+    const previewUser = Object.assign(Object.create(request.user), {
+        owner: false,
+    });
+    const previewLayout = await handler(previewUser, memberModel, roleModel, request.tenantId);
+    const viewer = {
+        headerActions: viewerActions,
+        quickActions: quickActions.real,
+    };
+    const preview = {
+        headerActions: (0, permission_preview_1.readHeaderActions)(previewLayout.layout),
+        quickActions: quickActions.preview,
+    };
+    return (0, permission_preview_1.findHeaderActionsHiddenByPreview)(viewer, preview);
+}
+function readViewerLayout(route, handler, { request, layouts }) {
+    const known = layouts.get(route.fullId);
+    if (known)
+        return known;
+    const { user, memberModel, roleModel, tenantId } = request;
+    const layout = handler(user, memberModel, roleModel, tenantId);
+    layouts.set(route.fullId, layout);
+    layout.catch(() => layouts.delete(route.fullId));
+    return layout;
+}
+const viewerLayoutCache = new permission_preview_1.PreviewScopeCache(PREVIEW_LOSS_TTL_MS, PREVIEW_LOSS_MAX_SCOPES);
+function viewerLayoutsFor(request, real) {
+    return viewerLayoutCache.pagesFor((0, permission_preview_1.previewCacheKey)({
+        tenantId: request.tenantId,
+        userId: request.user._id,
+        structureVersion: previewStructureVersion,
+        real: real.ungated.permissions,
+        preview: [],
+    }));
+}
+async function readPreviewPage(route, handler, reading) {
+    const { request, hiddenInPreview, quickActions } = reading;
+    const layout = await readViewerLayout(route, handler, reading);
+    return {
+        fullId: route.fullId,
+        displayName: route.displayName,
+        pagePermissionId: resolvePagePermissionId(route.permission, route.fullId),
+        filtersComponents: route.publicAccess !== true &&
+            route.authOnly !== true &&
+            route.noComponentPermissions !== true,
+        hiddenInPreview,
+        components: layout.components,
+        hiddenHeaderActions: hiddenInPreview
+            ? (0, permission_preview_1.readHeaderActions)(layout.layout).map((action) => action.id)
+            : await findPreviewHeaderActions(handler, layout, request, quickActions),
+    };
+}
+async function resolvePreviewPage(path, request, contexts, quickActions) {
+    const normalizedSlug = `/${path.replace(/^\/+|\/+$/g, "")}`;
+    const registeredSlug = resolveRegisteredPageSlug(normalizedSlug);
+    const route = registeredSlug ? pagesBySlug[registeredSlug] : undefined;
+    const handler = registeredSlug
+        ? (0, page_1.GetPageLayoutBySlug)(registeredSlug)
+        : undefined;
+    if (!route || !handler)
+        return null;
+    if (!(await computeEntryAccess(route, contexts.real)))
+        return null;
+    const hiddenInPreview = !(await computeEntryAccess(route, contexts.preview));
+    return readPreviewPage(route, handler, {
+        request,
+        hiddenInPreview,
+        quickActions,
+        layouts: viewerLayoutsFor(request, contexts.real),
+    });
+}
+const previewLossCaches = new WeakMap();
+function previewLossCacheFor(check) {
+    let cache = previewLossCaches.get(check);
+    if (!cache) {
+        cache = new permission_preview_1.PreviewScopeCache(PREVIEW_LOSS_TTL_MS, PREVIEW_LOSS_MAX_SCOPES);
+        previewLossCaches.set(check, cache);
+    }
+    return cache;
+}
+function collectPreviewMenuNodes(node, pageIds) {
+    return Object.values(node.children).flatMap((child) => {
+        const children = collectPreviewMenuNodes(child, pageIds);
+        if (!child.hasAccess)
+            return children;
+        return [
+            {
+                fullId: child.fullId,
+                opensPage: pageIds.has(child.fullId) || nodeTargets.has(child),
+                children,
+            },
+        ];
+    });
+}
+function flattenPreviewMenuNodes(nodes) {
+    return nodes.flatMap((node) => [
+        node,
+        ...flattenPreviewMenuNodes(node.children),
+    ]);
+}
+async function findPagesLosingInPreview(pages, reading, check) {
+    const { request, contexts, quickActions } = reading;
+    const grants = {
+        real: contexts.real.ungated.permissions,
+        preview: request.previewPermissions,
+    };
+    const answers = previewLossCacheFor(check).pagesFor((0, permission_preview_1.previewCacheKey)({
+        tenantId: request.tenantId,
+        userId: request.user._id,
+        structureVersion: previewStructureVersion,
+        real: grants.real,
+        preview: grants.preview,
+    }));
+    const pageReading = {
+        request: {
+            ...request,
+            ...memoizeViewerModels(request.memberModel, request.roleModel),
+        },
+        hiddenInPreview: false,
+        quickActions,
+        layouts: viewerLayoutsFor(request, contexts.real),
+    };
+    const losing = new Set();
+    await (0, run_in_batches_1.runInBatches)(pages, PREVIEW_PAGE_CONCURRENCY, async (route) => {
+        let answer = answers.get(route.fullId);
+        if (!answer) {
+            const handler = (0, page_1.GetPageLayoutBySlug)(route.fullSlug);
+            answer = handler
+                ? readPreviewPage(route, handler, pageReading)
+                    .then((page) => check(page, grants))
+                    .catch(() => false)
+                : Promise.resolve(false);
+            answers.set(route.fullId, answer);
+        }
+        if (await answer)
+            losing.add(route.fullId);
+    });
+    return losing;
+}
+function listPreviewLossTargets(nodes, reading, pagesByFullId) {
+    const { served, denied } = reading;
+    const pages = new Map();
+    const entryTargets = new Map();
+    for (const node of flattenPreviewMenuNodes(nodes)) {
+        const page = pagesByFullId.get(node.fullId);
+        if (page && !denied.has(page.fullId))
+            pages.set(page.fullId, page);
+    }
+    for (const node of [...served.values()].flat()) {
+        const target = nodeTargets.get(node);
+        if (!target || denied.has(node.fullId) || denied.has(target.fullId)) {
+            continue;
+        }
+        pages.set(target.fullId, target);
+        entryTargets.set(node.fullId, target.fullId);
+    }
+    return { pages: [...pages.values()], entryTargets };
+}
+async function aggregatePreviewMenuStates(reading) {
+    const { request, contexts, served, denied } = reading;
+    const tree = await addAccessToTree(navigationTree, contexts.real, true, served);
+    const pagesByFullId = new Map(Object.values(pagesBySlug).map((page) => [page.fullId, page]));
+    const nodes = collectPreviewMenuNodes(tree, new Set(pagesByFullId.keys()));
+    const losesInside = new Set();
+    if (request.pageLoses) {
+        const { pages, entryTargets } = listPreviewLossTargets(nodes, reading, pagesByFullId);
+        const losing = await findPagesLosingInPreview(pages, reading, request.pageLoses);
+        for (const fullId of losing)
+            losesInside.add(fullId);
+        for (const [entry, target] of entryTargets) {
+            if (losing.has(target))
+                losesInside.add(entry);
+        }
+    }
+    return (0, permission_preview_1.aggregatePreviewMenu)(nodes, denied, losesInside);
+}
+async function resolvePermissionPreviewAccess(request) {
+    const { path, user, memberModel, roleModel, tenantId } = request;
+    const real = await buildAccessContext(user, memberModel, roleModel, tenantId);
+    const preview = buildPreviewAccessContext(request.previewPermissions, real);
+    const contexts = { real, preview };
+    const [realQuickActions, previewQuickActions, served, previewed] = await Promise.all([
+        (0, quick_actions_1.getQuickActionsForUser)((target) => resolveQuickActionTarget(target, real)),
+        (0, quick_actions_1.getQuickActionsForUser)((target) => resolveQuickActionTarget(target, preview)),
+        resolveDynamicChildren(user, tenantId, real),
+        resolveDynamicChildren(user, tenantId, preview),
+    ]);
+    const quickActions = { real: realQuickActions, preview: previewQuickActions };
+    const [registeredHidden, page] = await Promise.all([
+        findRegisteredEntriesHiddenByPreview(real, preview),
+        path
+            ? resolvePreviewPage(path, request, contexts, quickActions)
+            : Promise.resolve(null),
+    ]);
+    const denied = new Set([
+        ...registeredHidden,
+        ...findDynamicEntriesHiddenByPreview(served, previewed),
+    ]);
+    const states = await aggregatePreviewMenuStates({
+        request,
+        contexts,
+        quickActions,
+        served,
+        denied,
+    });
+    return {
+        hiddenEntries: states.hidden,
+        partialEntries: states.partial,
+        hiddenQuickActions: (0, permission_preview_1.findQuickActionsHiddenByPreview)(realQuickActions, previewQuickActions),
+        page,
+    };
+}
 async function getRoleIdsForUser(memberModel, user) {
     const member = await memberModel.getByUser(user._id);
     return member?.roleIds ?? [];
@@ -607,13 +980,21 @@ function buildLayoutBannerContext(user, tenantId, context) {
         isTenantAccessDenied: context.gateDenied,
     };
 }
-async function buildSiteLayoutPayload(user, memberModel, roleModel, tenantId) {
+async function buildSiteLayoutPayload(user, memberModel, roleModel, tenantId, requestContext) {
     const accessContext = await buildAccessContext(user, memberModel, roleModel, tenantId);
     const banners = (0, layout_banners_1.resolveLayoutBanners)(buildLayoutBannerContext(user, tenantId, accessContext));
     const dynamicChildren = await resolveDynamicChildren(user, tenantId, accessContext);
+    const siteLayout = await annotateSiteLayoutAccess(accessContext, banners);
+    const navBadges = await (0, nav_badges_1.resolveMenuNavBadges)(requestContext, user, Object.values(siteLayout.pages));
     return {
-        siteLayout: await annotateSiteLayoutAccess(accessContext, banners),
-        siteLayoutTree: await addAccessToTree(navigationTree, accessContext, true, dynamicChildren),
+        siteLayout: {
+            ...siteLayout,
+            pages: Object.fromEntries(Object.entries(siteLayout.pages).map(([slug, page]) => [
+                slug,
+                (0, nav_badges_1.withNavBadge)(page, navBadges),
+            ])),
+        },
+        siteLayoutTree: (0, nav_badges_1.withTreeNavBadges)(await addAccessToTree(navigationTree, accessContext, true, dynamicChildren), navBadges),
         quickActions: await (0, quick_actions_1.getQuickActionsForUser)((target) => resolveQuickActionTarget(target, accessContext)),
         modules: await buildModuleAccessMap(accessContext),
         isOwner: accessContext.gated.isOwner,
@@ -684,7 +1065,7 @@ async function computeEntryAccess(entry, context) {
     return result;
 }
 async function computeEntryAccessUncached(entry, context) {
-    if (!(0, tenant_access_1.gateAllowsSurface)(entry, context.gateDenied))
+    if (!(0, tenant_access_2.gateAllowsSurface)(entry, context.gateDenied))
         return false;
     const effective = selectEntryContext(entry, context);
     if (effective.isOwner)
@@ -841,6 +1222,7 @@ async function buildDynamicNodes(provider, items, context) {
         }
         const node = buildDynamicNode(categoryFullId, item, target, link);
         nodeProviders.set(node, provider);
+        nodeTargets.set(node, target);
         nodes.push(node);
     }
     return nodes;
@@ -943,9 +1325,12 @@ async function resolveButtonTarget(target, page) {
     };
 }
 async function holdsButtonPermission(page, component, button) {
-    if (button.permission === undefined)
+    if (!(0, permission_gate_1.isPermissionGated)(button))
         return true;
-    const permissionId = component.resolveButtonPermissionId(button.permission);
+    const permissionId = button.permissionId ??
+        (button.permission === undefined
+            ? undefined
+            : component.resolveButtonPermissionId(button.permission));
     return (permissionId !== undefined &&
         (await holdsPagePermission(page, permissionId)));
 }
@@ -970,12 +1355,79 @@ async function buildModuleAccessMap(context) {
     const result = {};
     for (const [moduleId, info] of Object.entries(moduleRegistry)) {
         const hasAccess = await computeModuleAccess(moduleId, context);
+        const presented = presentModuleInfo(info);
         result[moduleId] = hasAccess
-            ? { ...info, hasAccess }
-            : { ...info, title: "", description: "", icon: "", hasAccess };
+            ? { ...presented, hasAccess }
+            : {
+                ...presented,
+                title: "",
+                description: "",
+                icon: "",
+                version: undefined,
+                catalogCategory: undefined,
+                hasAccess,
+            };
     }
     return result;
 }
+const DEFAULT_MODULE_STATUS = "live";
+const MODULE_STATUSES = new Set([
+    "live",
+    "beta",
+    "update",
+    "attention",
+]);
+const MODULE_READOUT_TONES = new Set([
+    "success",
+    "info",
+    "warning",
+    "error",
+]);
+const MODULE_READOUT_MAX_LINES = 3;
+function presentModuleInfo(info) {
+    const { status: _status, readout: _readout, ...presented } = info;
+    return presented;
+}
+async function runModuleStatusHook(info, context) {
+    if (!info.status)
+        return DEFAULT_MODULE_STATUS;
+    try {
+        const status = await (0, resolver_timeout_1.withResolverTimeout)(Promise.resolve(info.status(context)), `status of module "${info.id}"`);
+        if (typeof status === "string" && MODULE_STATUSES.has(status)) {
+            return status;
+        }
+        (0, warn_once_1.warnOnceFor)(info, "status-invalid", `[dms] module "${info.id}" status() returned ${JSON.stringify(status)}; expected one of ${[...MODULE_STATUSES].join(", ")}.`);
+    }
+    catch (error) {
+        (0, warn_once_1.warnOnceFor)(info, "status-failed", `[dms] module "${info.id}" status() failed: ${String(error)}`);
+    }
+    return DEFAULT_MODULE_STATUS;
+}
+async function runModuleReadoutHook(info, context) {
+    if (!info.readout)
+        return [];
+    try {
+        const lines = await (0, resolver_timeout_1.withResolverTimeout)(Promise.resolve(info.readout(context)), `readout of module "${info.id}"`);
+        if (!Array.isArray(lines))
+            return [];
+        return lines
+            .filter((line) => !!line && typeof line.text === "string" && line.text.length > 0)
+            .slice(0, MODULE_READOUT_MAX_LINES)
+            .map((line) => {
+            const tone = line.tone;
+            return {
+                text: line.text,
+                tone: tone && MODULE_READOUT_TONES.has(tone)
+                    ? tone
+                    : "info",
+            };
+        });
+    }
+    catch (error) {
+        (0, warn_once_1.warnOnceFor)(info, "readout-failed", `[dms] module "${info.id}" readout() failed: ${String(error)}`);
+        return [];
+    }
+}
 async function computeModuleAccess(_moduleId, context) {
     return context.gated.isOwner;
 }