@almadar/std 16.234.0 → 16.236.0

package/behaviors/lolo/ui/core/atoms/std-graphs.lolo

@@ -1,5 +1,5 @@
 app std-graphs "2.0.0"
-"std-graphs — embeddable chart atom. ITEMS_LOADED groups @payload.data by @config.categoryField (or @config.timeField when timeAxis=true) and aggregates per bucket. Multi-series rendering via @config.series (preformatted ChartSeries shape). Histograms via chartType=histogram pass pre-binned @payload.data through unchanged. Stacked / 100% stacked bars via @config.stack. Post-process sort + limit. Clicking a data point emits UI:@config.drillEvent with { label, value, seriesLabel? }. Drop into a dashboard alongside std-stats / std-browse."
+"std-graphs — embeddable chart atom. ITEMS_LOADED keeps the rows whose @config.filterField equals @config.filterValue (blank = all), groups them by @config.categoryField, or (timeAxis=true) by the @config.period bucket of @config.timeField — rows without a time value have no place on a time axis and are left out — and aggregates per bucket. Multi-series rendering via @config.series (preformatted ChartSeries shape). Histograms via chartType=histogram pass pre-binned @payload.data through unchanged. Stacked / 100% stacked bars via @config.stack. Post-process sort + limit. Clicking a data point emits UI:@config.drillEvent with { label, value, seriesLabel? }. Drop into a dashboard alongside std-stats / std-browse."
 type ObjectSpec = { id : string, label : string, value : string }
 orbital GraphItemOrbital {
     type ChartPoint = { label : string!, value : number! }
@@ -27,17 +27,22 @@ orbital GraphItemOrbital {
           stack: @config.stack
           subtitle: @config.subtitle
           timeAxis: @config.timeAxis
+          period: @config.period
           title: @config.title
           type: @config.viewPattern
         })
       ITEMS_LOADED -> idle
-        (set @entity.chartData (if ["=", @config.chartType, histogram] (array/map ?data (fn p {
+        (let (
+            (rows (if ["=", @config.filterField, ""] ?data (array/filter ?data (fn row (= (object/get @row @config.filterField) @config.filterValue)))))
+          )
+          (set @entity.chartData (if ["=", @config.chartType, histogram] (array/map @rows (fn p {
           label: (object/get @p label)
           value: (object/get @p value)
-        })) (array/map (object/entries (array/groupBy ?data (if @config.timeAxis @config.timeField @config.categoryField))) (fn entry {
+        })) (array/map (object/entries (if @config.timeAxis (array/groupBy (array/map (array/filter @rows (fn row (object/get @row @config.timeField))) (fn row (object/set @row "periodStart" (time/startOf (time/parse (object/get @row @config.timeField)) @config.period)))) "periodStart") (array/groupBy @rows @config.categoryField))) (fn entry {
           label: (object/get @entry "0")
           value: (if ["=", @config.aggregation, sum] (array/sum (object/get @entry "1") @config.valueField) (if ["=", @config.aggregation, avg] (array/avg (object/get @entry "1") @config.valueField) (if ["=", @config.aggregation, min] (array/min (object/get @entry "1") @config.valueField) (if ["=", @config.aggregation, max] (array/max (object/get @entry "1") @config.valueField) (array/len (object/get @entry "1"))))))
-        }))))
+        })))))
+        (set @entity.chartData (if @config.timeAxis (array/sort @entity.chartData label asc) @entity.chartData))
         (set @entity.chartData (if ["!=", @config.sortField, none] (array/sort @entity.chartData @config.sortField @config.sortDir) @entity.chartData))
         (set @entity.chartData (if [">", @config.limit, 0] (array/take @entity.chartData @config.limit) @entity.chartData))
         (render-ui main {
@@ -51,6 +56,7 @@ orbital GraphItemOrbital {
           stack: @config.stack
           subtitle: @config.subtitle
           timeAxis: @config.timeAxis
+          period: @config.period
           title: @config.title
           type: @config.viewPattern
         })
@@ -92,6 +98,16 @@ orbital GraphItemOrbital {
         @description "Group by month, quarter, week, day, or year — the calendar bucket the chart groups data into. Set ALONGSIDE timeAxis=true whenever the user says 'group by <time-unit>' or 'by <time-unit>' or 'rebucket to <time-unit>' or 'instead of <other-time-unit>'."
         @synonyms "regroup / rebucket / change bucket / group differently. user phrases: 'group by month' / 'by month' / 'monthly' / 'monthly buckets' / 'switch to monthly' / 'instead of quarter' -> month; 'group by quarter' / 'by quarter' / 'quarterly' -> quarter; 'group by week' / 'by week' / 'weekly' / 'weekly buckets' -> week; 'group by day' / 'by day' / 'daily' / 'daily buckets' -> day; 'group by year' / 'by year' / 'yearly' / 'annually' -> year. Whenever the user voices 'group by <time-unit>' BOTH period AND timeAxis=true should be set."
         @tier "presentation"
+      filterField : string = ""
+        @label "Only count rows where field"
+        @description "Row field a row must match to be charted (blank = every row), compared with filterValue — e.g. status + paid charts paid invoices only"
+        @synonyms "only include, where, filter by, restrict to. user phrases: 'only paid invoices' -> filterField=status + filterValue=paid; 'just the open deals' -> filterField=status + filterValue=open"
+        @tier "presentation"
+      filterValue : string = ""
+        @label "Equals"
+        @description "The value filterField must equal for a row to be charted"
+        @synonyms "the kept value. user phrases: 'only paid' -> paid; 'just active ones' -> active"
+        @tier "presentation"
       valueField : string = ""
         @label "Value field"
         @description "Numeric field aggregated per bucket (blank = row count)"

package/behaviors/lolo/ui/core/atoms/std-import.lolo

@@ -107,11 +107,6 @@ orbital ImportOrbital {
         @description "Text shown on the toolbar button that opens the import source popover"
         @synonyms "the text on the import trigger button. user phrases: 'rename import button to X' / 'set the button label to X' -> X (e.g. 'Import Data', 'Add Sources')"
         @tier "presentation"
-      event : string = IMPORT_SOURCE_PICKED
-        @label "Source-picked event"
-        @description "Event emitted when the user picks a source. Each entry in sources[] carries its own literal event field (no per-item templating in .lolo) — overriding this alone does not retarget the click; also set sources[].event to match."
-        @synonyms "bus event name. internal wiring; users rarely target directly"
-        @tier "internal"
       sources : [SourceOption] = [{
         event: IMPORT_SOURCE_PICKED
         id: paste

package/behaviors/lolo/ui/core/atoms/std-list.lolo

@@ -1,6 +1,7 @@
 app std-list "1.0.0"
 "std-list as a Function"
 type FilterSpec = { field : string!, label : string, options : [string] }
+type ItemAction = { label : string!, event : event, variant : string, roles : [string], when : SExpr }
 ;;
 ;; Daisy-chain composition showcase: no `on EVENT { ... }` trait-ref overrides.
 ;; Modal + Confirmation trait refs are configured via `config: { ... }` at the
@@ -11,6 +12,10 @@ type FilterSpec = { field : string!, label : string, options : [string] }
 ;; old version had — form-section's mode set only supports "create" | "edit",
 ;; and a dedicated detail-view pattern is tracked separately (std-detail).
 orbital ListItemOrbital {
+  uses RoleGate from "std/behaviors/std-role-gate"
+
+  uses Button from "std/behaviors/ui-button"
+
   uses Confirmation from "std/behaviors/std-confirmation"
 
   uses Modal from "std/behaviors/std-modal"
@@ -61,13 +66,7 @@ orbital ListItemOrbital {
               direction: horizontal
               gap: md
               type: stack
-            }, {
-              action: CREATE
-              icon: plus
-              label: Create
-              type: button
-              variant: primary
-            }]
+            }, <trait.ListItemCreateGate />]
             direction: horizontal
             gap: md
             justify: between
@@ -118,15 +117,7 @@ orbital ListItemOrbital {
               name: status
               variant: badge
             }]
-            itemActions: [{
-              event: EDIT
-              label: Edit
-              variant: ghost
-            }, {
-              event: DELETE
-              label: Delete
-              variant: danger
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             pageSize: @config.displayPageSize
             type: data-grid
           }]
@@ -208,13 +199,7 @@ orbital ListItemOrbital {
               direction: horizontal
               gap: md
               type: stack
-            }, {
-              action: CREATE
-              icon: plus
-              label: Create
-              type: button
-              variant: primary
-            }]
+            }, <trait.ListItemCreateGate />]
             direction: horizontal
             gap: md
             justify: between
@@ -265,15 +250,7 @@ orbital ListItemOrbital {
               name: status
               variant: badge
             }]
-            itemActions: [{
-              event: EDIT
-              label: Edit
-              variant: ghost
-            }, {
-              event: DELETE
-              label: Delete
-              variant: danger
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             pageSize: @config.displayPageSize
             type: data-grid
           }]
@@ -392,6 +369,43 @@ orbital ListItemOrbital {
         @description "Rows visible per page before the data-grid's own pagination control appears — 20 matches the CRUD-list density sweet spot (Miller's law, 10-25 rows)."
         @synonyms "visible rows, items per page, display limit, show per page"
         @tier "presentation"
+      itemActions : [ItemAction] = [{
+        event: EDIT
+        label: Edit
+        variant: ghost
+      }, {
+        event: DELETE
+        label: Delete
+        variant: danger
+      }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
+      createRoles : [string] = []
+        @label "Roles that can create"
+        @description "Roles (matched against viewerRole) that see the Create button. Empty = everyone."
+        @tier "policy"
+    }
+  }
+
+  trait ListItemCreateButton = Button.traits.ButtonRender {
+    config {
+      action: CREATE
+      icon: plus
+      label: Create
+      variant: primary
+    }
+  }
+
+  trait ListItemCreateGate = RoleGate.traits.RoleGate {
+    config {
+      roles: @config.createRoles
+      viewerRole: @config.viewerRole
+      content: <trait.ListItemCreateButton />
     }
   }
 

package/behaviors/lolo/ui/core/atoms/std-modal-editor.lolo

@@ -293,7 +293,7 @@ orbital ModalEditorOrbital {
         (set @entity.cmdline "")
         (emit SET_MODE { editorId: ?editorId, mode: "NORMAL", caret: "block" })
 
-      KEY -> COMMAND when (and ["!=", ?key, "Enter"] ["!=", ?key, "Escape"] ["!=", ?key, "Backspace"])
+      KEY -> COMMAND when (and (array/includes (object/get @config.keymap "COMMAND") ?key) ["!=", ?key, "Enter"] ["!=", ?key, "Escape"] ["!=", ?key, "Backspace"])
         (set @entity.cmdline (str/concat @entity.cmdline ?key))
 
       EDITOR_FOCUS -> COMMAND
@@ -312,7 +312,7 @@ orbital ModalEditorOrbital {
         meta : boolean
         repeat : boolean
       }
-        @description "One physical keydown, delivered by the host's keyboard router. The host decides preventDefault from config.keymap; this trait only reads key + editorId."
+        @description "One physical keydown, delivered by the host's keyboard router. The host decides preventDefault from config.keymap; the command line accepts only keys config.keymap captures in COMMAND."
       EDITOR_FOCUS {
         editorId : string
       }

package/behaviors/lolo/ui/core/atoms/std-rating-review.lolo

@@ -312,6 +312,7 @@ orbital RatingReviewOrbital {
                 mode: edit
                 submitEvent: SUBMIT_REVIEW
                 submitLabel: @config.submitLabel
+                cancelLabel: @config.cancelLabel
                 type: form-section
               }]
               direction: vertical
@@ -1114,6 +1115,7 @@ orbital RatingReviewOrbital {
                 mode: edit
                 submitEvent: SUBMIT_REVIEW
                 submitLabel: @config.submitLabel
+                cancelLabel: @config.cancelLabel
                 type: form-section
               }]
               direction: vertical
@@ -1426,10 +1428,11 @@ orbital RatingReviewOrbital {
             }, {
               cancelEvent: CANCEL_REVIEW
               entity: @entity
-              fields: (draftComment)
+              fields: (if @config.allowComment ["draftComment"] [])
               mode: edit
               submitEvent: SUBMIT_REVIEW
               submitLabel: @config.submitLabel
+              cancelLabel: @config.cancelLabel
               type: form-section
             }]
             direction: vertical
@@ -1455,10 +1458,11 @@ orbital RatingReviewOrbital {
             }, {
               cancelEvent: CANCEL_REVIEW
               entity: @entity
-              fields: (draftComment)
+              fields: (if @config.allowComment ["draftComment"] [])
               mode: edit
               submitEvent: SUBMIT_REVIEW
               submitLabel: @config.submitLabel
+              cancelLabel: @config.cancelLabel
               type: form-section
             }]
             direction: vertical
@@ -1504,10 +1508,11 @@ orbital RatingReviewOrbital {
             }, {
               cancelEvent: CANCEL_REVIEW
               entity: @entity
-              fields: (draftComment)
+              fields: (if @config.allowComment ["draftComment"] [])
               mode: edit
               submitEvent: SUBMIT_REVIEW
               submitLabel: @config.submitLabel
+              cancelLabel: @config.cancelLabel
               type: form-section
             }]
             direction: vertical
@@ -1569,10 +1574,11 @@ orbital RatingReviewOrbital {
             }, {
               cancelEvent: CANCEL_REVIEW
               entity: @entity
-              fields: (draftComment)
+              fields: (if @config.allowComment ["draftComment"] [])
               mode: edit
               submitEvent: SUBMIT_REVIEW
               submitLabel: @config.submitLabel
+              cancelLabel: @config.cancelLabel
               type: form-section
             }]
             direction: vertical
@@ -1600,10 +1606,11 @@ orbital RatingReviewOrbital {
             }, {
               cancelEvent: CANCEL_REVIEW
               entity: @entity
-              fields: (draftComment)
+              fields: (if @config.allowComment ["draftComment"] [])
               mode: edit
               submitEvent: SUBMIT_REVIEW
               submitLabel: @config.submitLabel
+              cancelLabel: @config.cancelLabel
               type: form-section
             }]
             direction: vertical
@@ -1696,10 +1703,6 @@ orbital RatingReviewOrbital {
         @label "Cancel button"
         @description "Label on the cancel button"
         @tier "presentation"
-      submitEvent : string = SUBMIT_REVIEW
-        @label "Submit event"
-        @description "Event emitted when the user submits the form"
-        @tier "internal"
       maxStars : number = 5
         @label "Max stars"
         @description "Top of the rating scale (typically 5)"
@@ -1708,10 +1711,6 @@ orbital RatingReviewOrbital {
         @label "Allow comment"
         @description "Show a free-text comment field below the stars"
         @tier "presentation"
-      allowPhotos : boolean = false
-        @label "Allow photos"
-        @description "Let the user attach photos to the review"
-        @tier "presentation"
       cardLook : "elevated" | "flat-bordered" | "borderless-divider" | "ticket" | "invoice" | "chip" | "tile-image-first" = elevated
         @label "Card look"
         @description "Visual style of the wrapper card. Layer 2 cardLook knob — render-ui references @config.cardLook on the compose card."

package/behaviors/lolo/ui/core/atoms/std-record-detail.lolo

@@ -2,7 +2,7 @@ app std-record-detail "1.0.0"
 "std-record-detail — single primitive: detail-panel. Owns the fetch-one-record state machine (loading → viewing → error, with RETRY), the record counterpart to std-browse's collection machine. Consumers configure fields/sections/actions and the title/subtitle/status bindings; the atom fetches by the id (or, for slug-routed records, the slug) carried on INIT and renders the panel. `detailLook` (panel default / slide-over / page / document) selects the render body, exactly as std-browse's browseLook selects a collection shape. The `document` look is for records whose shape IS a document (wiki page, note, article): the pure writing surface — a big inline-editable title with the rich-text body DIRECTLY beneath it, Edit/Done and the actions menu tucked into the header corner — where clicking the body drops a cursor in, every typing pause autosaves (CONTENT_SAVED, which the host persists QUIETLY — no refetch, or the editor unmounts mid-keystroke), and Done emits CONTENT_COMMITTED (the host refetches and snapshots version history on this one). Metadata never sits between the title and the words: compose the sibling RecordItemDetails trait beside the doc for a Gutenberg-style settings rail. A row minted blank by a document-first create arrives with draft=1 on INIT and opens straight in the editor. Pair with std-detail-layout for the back + breadcrumb chrome — that atom owns navigation, this one owns the record — exactly as a list page pairs std-browse with std-app-layout."
 ;; @capabilities "record detail, single record view, entity detail panel, drill-down record, show one record, record profile, detail page, view details, document editor, wiki page, note taking, article body, rich text editing, write and edit content"
 orbital RecordItemOrbital {
-  type RecordAction = { label : string!, event : event!, icon : string, variant : primary | secondary | ghost | danger }
+  type RecordAction = { label : string!, event : event!, icon : string, variant : primary | secondary | ghost | danger, roles : [string], when : SExpr }
   type RecordFieldSpec = { key : string!, header : string, format : date | currency | number | boolean | percent }
   type MetaFieldSpec = { key : string!, label : string, kind : text | boolean | select | readonly, options : [string], icon : string, format : date | currency | number | boolean | percent }
   type RecordSection = { title : string!, fields : [string] }
@@ -481,6 +481,10 @@ orbital RecordItemOrbital {
         @description "Buttons on the panel header. One primary at most; the rest collapse past maxInlineActions."
         @synonyms "record actions, detail actions, panel buttons"
         @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
       maxInlineActions : number = 3
         @label "How many actions before collapsing?"
         @description "Actions beyond this count collapse into a '⋯' overflow menu."
@@ -560,10 +564,10 @@ orbital RecordItemOrbital {
         @tier "presentation"
       bodyContent : render-ui = {
         children: [{
-          actions: @config.actions
-          entity: ?data
+          actions: (array/filter @config.actions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
+          entity: @entity.loadedRow
           fields: @config.fields
-          initialData: ?data
+          initialData: @entity.loadedRow
           maxInlineActions: @config.maxInlineActions
           sections: @config.sections
           showActions: @config.showActions
@@ -580,10 +584,10 @@ orbital RecordItemOrbital {
         @tier "internal"
       slideOverBodyContent : render-ui = {
         children: [{
-          actions: @config.actions
-          entity: ?data
+          actions: (array/filter @config.actions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
+          entity: @entity.loadedRow
           fields: @config.fields
-          initialData: ?data
+          initialData: @entity.loadedRow
           maxInlineActions: @config.maxInlineActions
           sections: @config.sections
           showActions: @config.showActions
@@ -601,10 +605,10 @@ orbital RecordItemOrbital {
         @tier "internal"
       pageBodyContent : render-ui = {
         children: [{
-          actions: @config.actions
-          entity: ?data
+          actions: (array/filter @config.actions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
+          entity: @entity.loadedRow
           fields: @config.fields
-          initialData: ?data
+          initialData: @entity.loadedRow
           maxInlineActions: @config.maxInlineActions
           sections: @config.sections
           showActions: @config.showActions
@@ -621,7 +625,7 @@ orbital RecordItemOrbital {
         @description "Render-ui SExpr rendered after the record loads when detailLook = page: a full record page, width-capped so field rows do not stretch past a readable measure (Almadar_UI_Beauty.md §3)."
         @tier "internal"
       documentBodyContent : render-ui = {
-        actions: @config.actions
+        actions: (array/filter @config.actions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
         coverImage: @entity.coverUrl
         icon: @entity.iconName
         editEvent: (if @config.allowEdit EDIT_CONTENT null)
@@ -640,7 +644,7 @@ orbital RecordItemOrbital {
         @description "Render-ui SExpr for detailLook = document while reading: the pure writing surface — editable title with the rich-text body DIRECTLY beneath it, Edit and the actions menu tucked into the header corner. Metadata never sits between title and content; compose the sibling RecordItemDetails trait beside this one for the settings rail. Binds only @entity fields, never ?data, because it is also painted by arms whose payload is not the record."
         @tier "internal"
       documentEditingContent : render-ui = {
-        actions: @config.actions
+        actions: (array/filter @config.actions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
         coverImage: @entity.coverUrl
         icon: @entity.iconName
         autosaveHint: @config.autosaveHint

package/behaviors/lolo/ui/core/atoms/std-recurrence.lolo

@@ -1,6 +1,7 @@
 app std-recurrence "2.1.0"
 "std-recurrence — recurring-rule definition + upcoming runs (Stripe Subscriptions / Cron Hub style). The viewing state shows a plain-English rule sentence and the next N dated runs as an agenda timeline. Per-run exception modal supports skip / reschedule. Topology = loading / defining_rule / viewing / awaiting_exception_decision / cancelled / error."
 type ObjectSpec = { id : string, label : string, value : string }
+type ItemAction = { label : string!, event : event, roles : [string] }
 orbital RecurrenceOrbital {
     type OccurrenceItem = { id : string!, title : string!, description : string, date : string, status : "complete" | "active" | "pending" | "error", rawStatus : "scheduled" | "skipped" | "completed" | "rescheduled" }
 
@@ -139,7 +140,7 @@ orbital RecurrenceOrbital {
           }, {
             entity: @entity.occurrences
             fields: (title description date status)
-            itemActions: [{ event: OPEN_EXCEPTION, label: Manage }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             look: @config.timelineLook
             type: timeline
           }, {
@@ -543,6 +544,14 @@ orbital RecurrenceOrbital {
         @label "Timeline look"
         @description "Layer 2 visual treatment for the timeline."
         @tier "presentation"
+      itemActions : [ItemAction] = [{ event: OPEN_EXCEPTION, label: Manage }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
     }
   }
 

package/behaviors/lolo/ui/core/atoms/std-role-gate.lolo

@@ -0,0 +1,39 @@
+app std-role-gate "1.0.0"
+"std-role-gate — explicit role gate around ONE piece of UI. Renders its `content` trait only when `roles` is empty or lists the viewer's role; any other viewer gets nothing rendered. Wrap a single button, FAB or panel in it, bind `viewerRole` at the call site (e.g. `viewerRole: @user.role`), and list the roles that may see it."
+;; @capabilities "role gate, only for roles, hide for role, permission wrapper, restrict button to role, show only to admins, role-based visibility"
+;; @synonyms "role guard, permission gate, access gate, visible to roles, hide unless role, admin only"
+orbital RoleGateOrbital {
+  entity RoleGateData [runtime] {
+    id : string!
+  }
+
+  trait RoleGate -> @rebindable RoleGateData [interaction, instance] {
+    initial: idle
+
+    state idle {
+      INIT -> idle when (or (= (array/len @config.roles) 0) (array/includes @config.roles @config.viewerRole))
+        (render-ui main { children: [@config.content], type: box })
+      INIT -> idle when (not (or (= (array/len @config.roles) 0) (array/includes @config.roles @config.viewerRole)))
+        (render-ui main null)
+    }
+
+    config {
+      content : trait
+        @label "Gated content"
+        @description "The trait rendered when the viewer's role is allowed, e.g. a button or panel trait ref."
+        @synonyms "wrapped content, guarded element, protected button"
+        @tier "presentation"
+      roles : [string] = []
+        @label "Visible to roles"
+        @description "Roles (matched against viewerRole) that see the content. Empty = everyone; any other viewer sees nothing."
+        @synonyms "allowed roles, only for, who can see, permitted roles"
+        @tier "policy"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`); left empty, only an ungated (empty `roles`) gate renders."
+        @tier "policy"
+    }
+  }
+
+  page "/role-gate" as RoleGatePage -> RoleGate
+}

package/behaviors/lolo/ui/core/atoms/std-saved-search.lolo

@@ -1,5 +1,6 @@
 app std-saved-search "1.0.0"
 "std-saved-search — persisted query + alert subscription. Owns a SavedSearch entity (one row per saved query) and a single manage trait that lists saved searches in a data-grid, lets users toggle their alert subscription / rename the search / delete it, and persists each change."
+type ItemAction = { label : string!, event : event, variant : string, icon : string, roles : [string], when : SExpr }
 orbital SavedSearchOrbital {
     type SavedSearchLoaded = Event { data : [SavedSearch] } "Fired when the saved-search collection finishes loading"
 
@@ -9,6 +10,8 @@ orbital SavedSearchOrbital {
 
     type SavedSearchDeleted = Event { id : string! } "Fired after a saved-search row is deleted"
 
+    type SavedSearchCreated = Event SavedSearch "Fired after the current search is saved as a new row"
+
   entity SavedSearch [persistent: savedsearches] {
     id : string!
     name : string! @description "A user-defined label for the saved search." @synonyms "title, label, search name"
@@ -74,22 +77,7 @@ orbital SavedSearchOrbital {
               variant: badge
             }]
             gap: sm
-            itemActions: [{
-              event: TOGGLE_ALERT
-              icon: bell
-              label: "Toggle alert"
-              variant: secondary
-            }, {
-              event: EDIT
-              icon: pencil
-              label: Edit
-              variant: secondary
-            }, {
-              event: DELETE
-              icon: trash-2
-              label: Delete
-              variant: danger
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             look: @config.tableLook
             type: data-grid
           }]
@@ -137,6 +125,24 @@ orbital SavedSearchOrbital {
         (persist delete SavedSearch ?id {
           emit: { failure: SavedSearchLoadFailed, success: SavedSearchDeleted }
         })
+      ;; The page's live search, fed by whichever search/filter traits the
+      ;; consumer wires in, so SAVE_CURRENT captures what the viewer sees.
+      TRACK_QUERY -> browsing
+        (set @entity.query ?query)
+      ;; One filter change at a time (std-filter's FILTER shape); an empty
+      ;; value clears that filter, matching std-browse's REFETCH_FILTER.
+      TRACK_FILTERS -> browsing
+        (set @entity.filters (if ["=", ?value, ""] (object/omit @entity.filters [?field]) (object/set @entity.filters ?field ?value)))
+      SAVE_CURRENT -> browsing
+        (persist create SavedSearch {
+          name: (if @entity.query @entity.query @config.defaultSearchName)
+          query: @entity.query
+          filters: @entity.filters
+          userId: @user.id
+          createdAt: @now
+        } {
+          emit: { failure: SavedSearchLoadFailed, success: SavedSearchCreated }
+        })
       EDIT -> editing
         (set @entity.id ?id)
         (render-ui main {
@@ -194,6 +200,10 @@ orbital SavedSearchOrbital {
         (fetch SavedSearch {
           emit: { failure: SavedSearchLoadFailed, success: SavedSearchLoaded }
         })
+      SavedSearchCreated -> loading
+        (fetch SavedSearch {
+          emit: { failure: SavedSearchLoadFailed, success: SavedSearchLoaded }
+        })
       ;; editing.SAVE -> browsing lands here before the persist resolves; a
       ;; failure must be caught here too, not just by loading's twin arm.
       SavedSearchLoadFailed -> error
@@ -280,6 +290,10 @@ orbital SavedSearchOrbital {
         @description "Indicates a failure to load saved search data."
         @synonyms "error, failure, load error"
         @tier "internal"
+      SavedSearchCreated
+        @description "Indicates the current search has been saved as a new row."
+        @synonyms "saved, created, bookmarked"
+        @tier "presentation"
       SavedSearchUpdated
         @description "Indicates a saved search has been modified and persisted."
         @synonyms "modified, changed, updated, persisted"
@@ -332,6 +346,27 @@ orbital SavedSearchOrbital {
         @description "Aborts the current operation or view."
         @synonyms "dismiss, close, undo"
         @tier "domain"
+      TRACK_QUERY {
+        query : string
+      }
+        @description "The page's current search text changed."
+        @synonyms "search changed, query changed, typed search"
+        @tier "domain"
+      TRACK_FILTERS {
+        field : string!
+        value : string!
+      }
+        @description "The page's current filters changed."
+        @synonyms "filters changed, criteria changed"
+        @tier "domain"
+      SAVE_CURRENT
+        @description "Save the page's current search and filters as a new saved search."
+        @synonyms "save search, bookmark search, remember search"
+        @tier "domain"
+      SavedSearchCreated
+        @description "The current search was saved as a new row."
+        @synonyms "saved, created, bookmarked"
+        @tier "presentation"
       SavedSearchLoaded {
         data : [SavedSearch]
       }
@@ -366,6 +401,33 @@ orbital SavedSearchOrbital {
         @label "Table look"
         @description "Layer 2 visual treatment for the data table rendered by this atom."
         @tier "presentation"
+      defaultSearchName : string = "Saved search"
+        @label "Default saved-search name"
+        @description "Name given to a saved search when the current search has no query text (filters only). Renamable afterwards."
+        @tier "presentation"
+      itemActions : [ItemAction] = [{
+        event: TOGGLE_ALERT
+        icon: bell
+        label: "Toggle alert"
+        variant: secondary
+      }, {
+        event: EDIT
+        icon: pencil
+        label: Edit
+        variant: secondary
+      }, {
+        event: DELETE
+        icon: trash-2
+        label: Delete
+        variant: danger
+      }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
     }
   }