@almadar/std 16.235.0 → 16.236.0

package/behaviors/lolo/ui/core/atoms/std-board.lolo

@@ -2,6 +2,7 @@ app std-board "1.3.0"
 "std-board — generic N-column board primitive. `config.columns` is an array of column definitions ({ key, label, icon, variant }); the trait `array/map`s them on `BoardItemsLoaded` into `@entity.boards` where each board carries its filtered items + a count. The render is a `data-grid` over `@entity.boards` (one card per column) whose `renderItem` lambda nests a `data-list` over `@col.items` (the cards in that stage). N is config-driven — pass any number of columns; the outer `data-grid`'s `cols` is bound to `@config.gridCols` so the grid wraps if you exceed it. Topology = loading / viewing_board / viewing_card / adding / error — distinct from the cookie-cutter `loading/browsing/viewing_single/error` CRUD shape. App-level atoms (e.g. std-pipeline) compose std-board via `uses` and add a sibling persistor + extended source entity. `config.boardLook` switches the board body between the default N-column grid ('columns') and a Trello-style wide-column kanban ('kanban-classic'). `viewing_board` listens for REFETCH_QUERY/REFETCH_FILTER/REFETCH_PAGE (the std-search/std-filter/std-pagination wiring targets, no render on refetch — @entity.boards is bound reactively) and can optionally render its own search box (config.bodySearch, default false) and filter bar (config.filters, default []); no pagination control is rendered — a board's columns are not a paged list."
 type ObjectSpec = { id : string, label : string, value : string }
 type ColumnSpec = { key : string!, label : string!, icon : string, variant : string }
+type ItemAction = { label : string!, event : event, variant : primary | secondary | ghost | danger, icon : string, roles : [string] }
 type FilterSpec = { field : string!, label : string, options : [string] }
 orbital BoardOrbital {
     type BoardItem = { id : string!, title : string, description : string, stage : string, notes : string, position : number }
@@ -42,6 +43,7 @@ orbital BoardOrbital {
       INIT -> loading
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
         })
         (render-ui main {
           title: "Loading board…"
@@ -72,6 +74,7 @@ orbital BoardOrbital {
       BoardItemsSaved -> loading
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
         })
         (render-ui main {
           title: "Refreshing board…"
@@ -82,6 +85,7 @@ orbital BoardOrbital {
       BoardItemDeleted -> loading
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
         })
         (render-ui main {
           title: "Refreshing board…"
@@ -100,6 +104,7 @@ orbital BoardOrbital {
       INIT -> loading
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
         })
         (render-ui main {
           title: "Loading board…"
@@ -231,6 +236,7 @@ orbital BoardOrbital {
       BoardItemsSaved -> viewing_board
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
         })
       ;; REFETCH_* stay in viewing_board and issue no render-ui, matching
       ;; std-browse's REFETCH_QUERY/REFETCH_FILTER/REFETCH_PAGE: a render here
@@ -241,11 +247,13 @@ orbital BoardOrbital {
       REFETCH_QUERY -> viewing_board
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
           filter: (or ["=", ?searchTerm, ""] (str/includes (object/get @entity @config.searchField) ?searchTerm))
         })
       REFETCH_FILTER -> viewing_board
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
           filter: (or ["=", ?value, ""] ["=", (object/get @entity ?field), ?value])
         })
       ;; A board's columns are not a paged list — paging the underlying fetch
@@ -256,6 +264,7 @@ orbital BoardOrbital {
       REFETCH_PAGE -> viewing_board
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
           limit: @config.pageSize
           offset: ["*", ["-", ?page, 1], @config.pageSize]
         })
@@ -280,6 +289,7 @@ orbital BoardOrbital {
       CLOSE_CARD -> loading
         (fetch BoardView {
           emit: { failure: BoardItemsLoadFailed, success: BoardItemsLoaded }
+          include: @config.include
         })
         (render-ui main {
           title: "Refreshing board…"
@@ -531,6 +541,10 @@ orbital BoardOrbital {
     }
 
     config {
+      showHeader : boolean = true
+        @label "Show the board's own title row?"
+        @description "Off when the page already carries a page header naming the same thing, so the page shows one title."
+        @tier "presentation"
       title : string = Board
         @label "Board title"
         @description "Heading shown above the column board"
@@ -575,6 +589,11 @@ orbital BoardOrbital {
         @label "Card title binding"
         @description "Per-card binding for the title slot."
         @tier "presentation"
+      include : [string] = []
+        @label "Which relation fields to hydrate?"
+        @description "Entity relation field names to hydrate on fetch (e.g. an `assignee : TeamMember` field named `assignee`), so card bindings can use dot-paths like @item.assignee.name. Empty = no hydration, the default."
+        @synonyms "relation hydration, populate relations, joined fields, hydrate relations"
+        @tier "domain"
       cardDescriptionBinding : string = @item.description
         @label "Card description binding"
         @description "Per-card binding for the description slot."
@@ -624,16 +643,29 @@ orbital BoardOrbital {
         @description "Records fetched per REFETCH_PAGE request. std-board renders no pagination control itself — this only feeds the fetch limit/offset when a consumer wires a composed std-pagination to REFETCH_PAGE."
         @synonyms "fetch limit, records per page, batch size, page limit"
         @tier "presentation"
+      cardActions : [ItemAction] = [{
+        event: DELETE_CARD
+        icon: trash-2
+        label: Delete
+        variant: danger
+      }]
+        @label "Card panel action list"
+        @description "Buttons on the open-card panel's actions row, built by the default cardActionsContent. Give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each card action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
       cardActionsContent : render-ui = {
         align: center
-        children: [{
-          action: DELETE_CARD
+        children: (array/map (array/filter @config.cardActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole)))) (fn a {
+          action: @a.event
           actionPayload: { id: @entity.currentId }
-          icon: trash-2
-          label: Delete
+          icon: @a.icon
+          label: @a.label
           type: button
-          variant: danger
-        }]
+          variant: @a.variant
+        }))
         direction: horizontal
         gap: sm
         type: stack
@@ -642,17 +674,26 @@ orbital BoardOrbital {
         @description "Actions row of the open-card panel. Default is the Delete button only. Override to add consumer-wired actions — e.g. an Edit button with action: EDIT_CARD and actionPayload: { id: @entity.currentId, row: @entity.currentRow }, listened to by the organism's edit modal. Never leave a button here without a listener."
         @tier "presentation"
       bodyContent : render-ui = {
-        children: [{
-          align: center
-          children: [{ name: kanban-square, size: lg, type: icon }, {
-            content: @config.title
-            type: typography
-            variant: h3
-          }]
-          direction: horizontal
-          gap: sm
+        children: [(if @config.showHeader {
+          children: [{
+            align: center
+            children: [{ name: kanban-square, size: lg, type: icon }, {
+              content: @config.title
+              type: typography
+              variant: h3
+            }]
+            direction: horizontal
+            gap: sm
+            type: stack
+          }, { type: divider }]
+          direction: vertical
+          gap: md
+          type: stack
+        } {
+          children: []
+          gap: none
           type: stack
-        }, { type: divider }, (if @config.bodySearch {
+        }), (if @config.bodySearch {
           children: [{
             className: "w-full max-w-md"
             clearable: true
@@ -771,18 +812,27 @@ orbital BoardOrbital {
         @description "Render-ui SExpr rendered after the board loads for boardLook='columns' — the canonical column data-grid with nested per-column data-lists. boardLook='kanban-classic' renders kanbanClassicBodyContent instead; both share this trait's state machine, emits, and listens."
         @tier "internal"
       kanbanClassicBodyContent : render-ui = {
-        children: [{
-          align: center
-          children: [{ name: kanban-square, size: xl, type: icon }, {
-            content: @config.title
-            type: typography
-            variant: h2
-          }]
-          className: px-card-md
-          direction: horizontal
-          gap: sm
+        children: [(if @config.showHeader {
+          children: [{
+            align: center
+            children: [{ name: kanban-square, size: xl, type: icon }, {
+              content: @config.title
+              type: typography
+              variant: h2
+            }]
+            className: px-card-md
+            direction: horizontal
+            gap: sm
+            type: stack
+          }, { type: divider }]
+          direction: vertical
+          gap: md
+          type: stack
+        } {
+          children: []
+          gap: none
           type: stack
-        }, { type: divider }, (if @config.bodySearch {
+        }), (if @config.bodySearch {
           children: [{
             className: "w-full max-w-md"
             clearable: true

package/behaviors/lolo/ui/core/atoms/std-browse.lolo

@@ -1,7 +1,7 @@
 app std-browse "2.5.0"
 "std-browse as a Function — single primitive: data-grid. Owns the fetch + REFETCH (query/filter/page) state machine. Consumers configure fields/imageField/itemActions/cols/gap/variant; the atom renders the grid. Each `fields[]` entry accepts `{ name, label, variant }` plus optional `referenceEntity` + `displayField` to render a foreign-key column as the joined entity's display value (data-grid resolves @list[referenceEntity] at render time when both keys are present). `browseLook` (table default / dense / feed / gallery / master-detail / triage) selects one of six render bodies; dense/feed/gallery were folded in from std-browse-dense/-feed/-gallery (Phase 5.B); master-detail (split record view driven by the guarded VIEW/CLOSE self-transitions) and triage (inbox rows) were folded in 2026-07-26. Consumers retarget by setting browseLook."
 type FieldSpec = { name : string!, label : string, variant : h3 | h4 | body | caption | badge | small | progress, icon : string, format : date | currency | number | boolean | percent, key : string, header : string }
-type ItemAction = { label : string!, event : event, navigatesTo : string, variant : primary | secondary | ghost | danger, icon : string }
+type ItemAction = { label : string!, event : event, navigatesTo : string, variant : primary | secondary | ghost | danger, icon : string, roles : [string], when : SExpr }
 type ColumnSpec = { key : string!, field : string, header : string, width : string, align : left | center | right, className : string, weight : normal | medium | semibold, format : badge | date | currency | number | percent | boolean, icon : string }
 type FilterSpec = { field : string!, label : string, options : [string] }
 orbital BrowseItemOrbital {
@@ -10,6 +10,8 @@ orbital BrowseItemOrbital {
     event : event!
     icon : string
     variant : string
+    roles : [string]
+    when : SExpr
   }
 
     type BrowseItemLoaded = Event { data : [BrowseItem], totalCount : number } "Fired when the BrowseItem collection finishes loading; payload.data holds the (possibly paginated) slice and totalCount holds the unsliced filter total. totalCount is optional so compiled-path emitters that haven't been migrated yet still validate"
@@ -43,6 +45,7 @@ orbital BrowseItemOrbital {
     config {
       fields: @config.fields
       itemActions: @config.itemActions
+      viewerRole: @config.viewerRole
       itemClickEvent: @config.itemClickEvent
       maxInlineActions: @config.maxInlineActions
       variant: compact
@@ -283,14 +286,6 @@ orbital BrowseItemOrbital {
         @label "Badge field binding"
         @description "Binding path for the status/badge slot."
         @tier "internal"
-      imageLabelBinding : string = @item.thumbnailLabel
-        @label "Image label binding"
-        @description "Binding path for the image-area label slot."
-        @tier "internal"
-      priceBinding : string = @item.price
-        @label "Price field binding"
-        @description "Binding path for the price/amount overlay slot."
-        @tier "internal"
       metaBinding : string = @item.createdAt
         @label "Meta field binding"
         @description "Binding path for the secondary meta slot (timestamp / category). Hosts binding a count or other non-date value should label it in the binding itself (e.g. (str/concat \"Vehicles: \" @item.vehicleCount)) and set metaFormat: none."
@@ -303,14 +298,6 @@ orbital BrowseItemOrbital {
         @label "Category field binding"
         @description "Binding path for the category/tag slot."
         @tier "internal"
-      priorityBinding : string = @item.priority
-        @label "Priority field binding"
-        @description "Binding path for the priority slot."
-        @tier "internal"
-      assigneeBinding : string = @item.assignee
-        @label "Assignee field binding"
-        @description "Binding path for the assignee/owner slot."
-        @tier "internal"
       itemActions : [ItemAction] = []
         @label "What actions can users take on each row?"
         @description "Buttons rendered on each row (e.g. Edit, Delete, View)."
@@ -361,6 +348,10 @@ orbital BrowseItemOrbital {
         @description "Name the field on this entity that holds the viewer's id (e.g. memberId, patientId, assignee). When set, the list loads ONLY rows whose that field equals @user.id — the 'my bookings' / 'my appointments' shape. Left blank the list loads every row, which is the default. Declared, never inferred: guessing the column from its name would silently scope the wrong one."
         @synonyms "owner field, my records, only mine, only my own, scope to user, per-user list, mine only, owned by me"
         @tier "policy"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each row action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
       initialFilterField : string = ""
         @label "Which field does the first load filter on?"
         @description "Name the field the INITIAL load filters on, paired with initialFilterValue. This is the detail half of a list-detail pair: a thread that must wait for a conversation to be picked sets the field to its parent key and leaves the value blank, so the first load matches nothing and the empty state shows instead of every record in the table. REFETCH_FILTER then supplies the real selection. Left blank the first load is unfiltered, which is the default."
@@ -396,10 +387,21 @@ orbital BrowseItemOrbital {
         @description "Visual treatment for the embedded filter bar, mirroring std-filter's own enum. Only applies when `filters` is non-empty."
         @synonyms "filter bar style, facet style, chips, pills"
         @tier "presentation"
-      viewPattern : pattern = data-grid
-        @label "Render pattern"
-        @description "UI pattern used to render the collection. Used by the default bodyContent tree; Layer 3 variants override bodyContent directly instead and may ignore this knob."
-        @tier "internal"
+      emptyTitle : string = ""
+        @label "Empty-state title"
+        @description "Specific title shown when there are no rows (\"No orders yet\"). Left blank, a generic line shows."
+        @synonyms "empty title, no data title, empty heading"
+        @tier "presentation"
+      emptyDescription : string = ""
+        @label "Empty-state description"
+        @description "What will appear here once rows exist."
+        @synonyms "empty text, no data message, empty hint"
+        @tier "presentation"
+      emptyIcon : icon = inbox
+        @label "Empty-state icon"
+        @description "Domain icon shown when there are no rows."
+        @synonyms "empty icon, no data icon"
+        @tier "presentation"
       browseLook : "table" | "dense" | "feed" | "gallery" | "master-detail" | "triage" = table
         @label "Browse look"
         @description "Layer 2 visual treatment for the whole browse surface. table = the default data-grid (bodyContent); dense = spreadsheet-style table with toolbar search (denseBodyContent); feed = chronological card stream (feedBodyContent); gallery = image-first responsive card grid (galleryBodyContent); master-detail = record-work split view — dense list left, clicked record's detail right (masterDetailBodyContent); triage = inbox-register compact rows for queue work (triageBodyContent). Selecting a non-table look swaps which body tree renders after rows load; any body may still be overridden directly at the call site for a one-off layout."
@@ -451,9 +453,12 @@ orbital BrowseItemOrbital {
           fields: @config.fields
           gap: @config.gap
           imageField: @config.imageField
-          itemActions: @config.itemActions
+          itemActions: (array/filter @config.itemActions (fn item (or (= (array/len (object/get @item roles [])) 0) (array/includes (object/get @item roles []) @config.viewerRole))))
           maxInlineActions: @config.maxInlineActions
           pageSize: @config.displayPageSize
+          emptyDescription: @config.emptyDescription
+          emptyIcon: @config.emptyIcon
+          emptyTitle: @config.emptyTitle
           type: data-grid
         }]
         direction: vertical
@@ -498,14 +503,16 @@ orbital BrowseItemOrbital {
         }), {
           children: [{
             columns: @config.columns
-            emptyMessage: "No records"
             entity: ?data
-            itemActions: @config.itemActions
+            itemActions: (array/filter @config.itemActions (fn item (or (= (array/len (object/get @item roles [])) 0) (array/includes (object/get @item roles []) @config.viewerRole))))
             itemClickEvent: @config.itemClickEvent
             look: dense
             maxInlineActions: @config.maxInlineActions
             pageSize: @config.displayPageSize
             selectable: @config.selectable
+            emptyDescription: @config.emptyDescription
+            emptyIcon: @config.emptyIcon
+            emptyTitle: @config.emptyTitle
             type: table-view
           }]
           className: overflow-x-auto
@@ -559,7 +566,7 @@ orbital BrowseItemOrbital {
           entity: ?data
           fields: []
           gap: md
-          itemActions: @config.itemActions
+          itemActions: (array/filter @config.itemActions (fn item (or (= (array/len (object/get @item roles [])) 0) (array/includes (object/get @item roles []) @config.viewerRole))))
           renderItem: (fn item {
             children: [{
               align: start
@@ -627,6 +634,9 @@ orbital BrowseItemOrbital {
             padding: none
             type: card
           })
+          emptyDescription: @config.emptyDescription
+          emptyIcon: @config.emptyIcon
+          emptyTitle: @config.emptyTitle
           type: data-list
           variant: card
         }]
@@ -678,9 +688,12 @@ orbital BrowseItemOrbital {
           fields: @config.fields
           gap: lg
           imageField: @config.imageField
-          itemActions: @config.itemActions
+          itemActions: (array/filter @config.itemActions (fn item (or (= (array/len (object/get @item roles [])) 0) (array/includes (object/get @item roles []) @config.viewerRole))))
           maxInlineActions: @config.maxInlineActions
           minCardWidth: 260
+          emptyDescription: @config.emptyDescription
+          emptyIcon: @config.emptyIcon
+          emptyTitle: @config.emptyTitle
           type: data-grid
         }]
         className: w-full
@@ -728,8 +741,11 @@ orbital BrowseItemOrbital {
           children: [{
             entity: ?data
             fields: @config.fields
-            itemActions: @config.itemActions
+            itemActions: (array/filter @config.itemActions (fn item (or (= (array/len (object/get @item roles [])) 0) (array/includes (object/get @item roles []) @config.viewerRole))))
             maxInlineActions: @config.maxInlineActions
+            emptyDescription: @config.emptyDescription
+            emptyIcon: @config.emptyIcon
+            emptyTitle: @config.emptyTitle
             type: data-list
             variant: compact
           }]
@@ -844,7 +860,7 @@ orbital BrowseItemOrbital {
           type: stack
         }), {
           detail: {
-            actions: @config.detailActions
+            actions: (array/filter @config.detailActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             fieldNames: @config.detailFields
             initialData: ?row
             showActions: true

package/behaviors/lolo/ui/core/atoms/std-calendar.lolo

@@ -1,6 +1,6 @@
 app std-calendar "1.4.0"
 "std-calendar as a Function — owns the fetch + SELECT_DAY state machine; default bodyContent renders the month-grid + upcoming-events tree. `config.calendarLook` switches the body between the default month-grid ('month'), a day-grouped agenda list ('agenda-list'), and a 7-column week timeline ('week-timeline') while inheriting the same trait, state machine, emits, and listens."
-type ItemAction = { label : string!, event : event, navigatesTo : string, variant : primary | secondary | ghost | danger, icon : string }
+type ItemAction = { label : string!, event : event, navigatesTo : string, variant : primary | secondary | ghost | danger, icon : string, roles : [string], when : SExpr }
 type FilterSpec = { field : string!, label : string, options : [string] }
 type FieldSpec = { name : string!, label : string, variant : h3 | h4 | body | caption | badge | small | progress, icon : string, format : date | currency | number | boolean | percent }
 orbital CalendarEventOrbital {
@@ -279,6 +279,10 @@ orbital CalendarEventOrbital {
         @description "Per-item action buttons on agenda-list rows — data-list itemActions descriptors (label/event/icon/variant). Consumers override to wire their own row actions (View/Edit/Delete) so agenda hosts never need a second table for actions."
         @synonyms "agenda actions, row actions, event actions, list actions"
         @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
       agendaGroupBy : string = date
         @label "Agenda group-by field"
         @description "Row field the agenda list groups its day sections by. Rebound hosts point this at their own timestamp column (e.g. startTime, scheduledAt)."
@@ -378,7 +382,7 @@ orbital CalendarEventOrbital {
         }, {
           entity: ?data
           fields: @config.fields
-          itemActions: @config.agendaItemActions
+          itemActions: (array/filter @config.agendaItemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
           look: @config.tableLook
           type: data-list
         }]
@@ -446,7 +450,7 @@ orbital CalendarEventOrbital {
           fields: []
           gap: md
           groupBy: @config.agendaGroupBy
-          itemActions: @config.agendaItemActions
+          itemActions: (array/filter @config.agendaItemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
           renderItem: (fn item {
             children: [{
               align: start

package/behaviors/lolo/ui/core/atoms/std-esign-flow.lolo

@@ -1,5 +1,6 @@
 app std-esign-flow "1.2.0"
 "std-esign-flow — the send-for-signature flow: list signature requests, create one (pick document + recipient), resend or cancel, track status. Composes std-file-store + std-esign-request; no document-rendering or code-preview chrome. v1.2 (W5): EnvelopeDispatcher wires sessions to the real `esign` service — SEND_ENVELOPE dispatches a DocuSign envelope (the document rides the event as an UploadDropZone-shaped file payload, since StoredFile rows are metadata-only) and stamps `envelopeId`/`sentAt`/status=sent; the browse grid's per-row \"Refresh status\" pulls getEnvelopeStatus and maps completed/delivered/declined onto signed/viewed/declined."
+type ItemAction = { label : string!, event : event, variant : string, roles : [string], when : SExpr }
 orbital SignatureSessionOrbital {
   uses StoredFile from "std/behaviors/std-file-store"
 
@@ -95,19 +96,7 @@ orbital SignatureSessionOrbital {
               name: sentAt
               variant: caption
             }]
-            itemActions: [{
-              event: RESEND_REQUEST
-              label: Resend
-              variant: primary
-            }, {
-              event: REQUEST_DELETE
-              label: Cancel
-              variant: danger
-            }, {
-              event: CHECK_ENVELOPE_STATUS
-              label: "Refresh status"
-              variant: secondary
-            }]
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             type: data-grid
           }]
           direction: vertical
@@ -216,6 +205,29 @@ orbital SignatureSessionOrbital {
       SignatureSessionPersistor.SESSION_RESENT -> INIT
       SignatureSessionPersistor.SESSION_DELETED -> INIT
     }
+
+    config {
+      itemActions : [ItemAction] = [{
+        event: RESEND_REQUEST
+        label: Resend
+        variant: primary
+      }, {
+        event: REQUEST_DELETE
+        label: Cancel
+        variant: danger
+      }, {
+        event: CHECK_ENVELOPE_STATUS
+        label: "Refresh status"
+        variant: secondary
+      }]
+        @label "Row actions"
+        @description "Actions offered on each row; give an item `roles` to show it only to those viewer roles."
+        @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
+    }
   }
 
   trait SignatureSessionCreate = Modal.traits.ModalRecordModal -> SignatureSession {

package/behaviors/lolo/ui/core/atoms/std-esign-request.lolo

@@ -61,6 +61,7 @@ orbital ESignRequestOrbital {
         label: Revoke
         variant: danger
       }]
+      viewerRole: @config.viewerRole
       look: @config.tableLook
     }
   }
@@ -178,6 +179,10 @@ orbital ESignRequestOrbital {
         @label "Table look"
         @description "Layer 2 visual treatment for the data table rendered by this atom."
         @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
     }
   }
 

package/behaviors/lolo/ui/core/atoms/std-event-log.lolo

@@ -659,11 +659,6 @@ orbital EventLogOrbital {
         @description "Records fetched from the server per REFETCH_PAGE request. The initial load and every search/kind/filter refetch stay unpaginated (load everything that matches) so the default unlimited activity feed is unchanged; only an explicit REFETCH_PAGE from a composed std-pagination control applies this limit."
         @synonyms "fetch limit, records per page, page limit"
         @tier "presentation"
-      displayPageSize : number = 20
-        @label "How many entries per page should a pager show?"
-        @description "Page size a consumer-composed std-pagination control should use to compute total pages (e.g. from totalCount). This atom's own timeline pattern has no built-in pager UI, so this knob is informational for the composed control, not consumed by the timeline itself."
-        @synonyms "visible rows, items per page, display limit"
-        @tier "presentation"
     }
   }
 

package/behaviors/lolo/ui/core/atoms/std-export.lolo

@@ -59,16 +59,6 @@ orbital ExportOrbital {
     }
 
     config {
-      tileId : string = ""
-        @label "Tile id"
-        @description "Identifier of the dashboard tile being exported"
-        @synonyms "internal identifier — host orbital wires this; users rarely set it directly"
-        @tier "internal"
-      event : string = EXPORT_REQUESTED
-        @label "Export event"
-        @description "Event emitted when the user picks a format. Each entry in formats[] carries its own literal event field (no per-item templating in .lolo) — overriding this alone does not retarget the click; also set formats[].event to match."
-        @synonyms "bus event name. internal wiring; users rarely target directly"
-        @tier "internal"
       formats : [FormatOption] = [{
         event: EXPORT_REQUESTED
         format: csv

package/behaviors/lolo/ui/core/atoms/std-file-store.lolo

@@ -1,7 +1,7 @@
 app std-file-store "2.0.0"
 "std-file-store — the generic file/page tree primitive. A file-tree + config-driven data table over a hierarchical collection; opens a row in `viewing_single` with config-driven detail actions. Rebindable: pass `fields`/`itemActions`/`detailActions`/`tree` to retarget it at any hierarchical entity (files, wiki pages, note trees). Folds in the former std-page-tree via `reorderable` + a page field/action set."
 type FieldSpec = { name : string!, label : string, variant : "h3" | "h4" | "body" | "caption" | "badge" | "small" | "progress", icon : string, format : "date" | "currency" | "number" | "boolean" | "percent", key : string, header : string }
-type ItemAction = { label : string!, event : event!, variant : "primary" | "secondary" | "ghost" | "danger", icon : string }
+type ItemAction = { label : string!, event : event!, variant : "primary" | "secondary" | "ghost" | "danger", icon : string, roles : [string], when : SExpr }
 type TreeNode = { name : string!, path : string!, type : "file" | "dir"!, children : [TreeNode] }
 orbital StoredFileOrbital {
     type StoredFileLoaded = Event { data : [StoredFile] } "Fired when the collection finishes loading"
@@ -63,7 +63,7 @@ orbital StoredFileOrbital {
             entity: ?data
             fields: @config.fields
             gap: sm
-            itemActions: @config.itemActions
+            itemActions: (array/filter @config.itemActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             look: @config.tableLook
             reorderEvent: REORDER
             reorderable: @config.reorderable
@@ -154,7 +154,7 @@ orbital StoredFileOrbital {
             gap: sm
             type: stack
           }, { type: divider }, {
-            entity: @config.detailActions
+            entity: (array/filter @config.detailActions (fn action (or (= (array/len (object/get @action roles [])) 0) (array/includes (object/get @action roles []) @config.viewerRole))))
             fields: []
             gap: sm
             renderItem: (fn a {
@@ -431,6 +431,10 @@ orbital StoredFileOrbital {
         @label "Detail actions"
         @description "Buttons shown on the opened row's detail"
         @tier "presentation"
+      viewerRole : string = ""
+        @label "Viewer's role"
+        @description "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show."
+        @tier "policy"
       tree : [TreeNode] = [{
         children: [{
           name: "Active.pdf"

package/behaviors/lolo/ui/core/atoms/std-form-advanced.lolo

@@ -1,7 +1,6 @@
 app std-form-advanced "1.2.0"
-"std-form-advanced — full-typed form-section primitive. Hosts the `editing` state with a configurable `fields` array (each entry mirrors @almadar/ui's `form-section` field schema: `{ name, label, type?, values?, relation?, required? }`). Field-level constraints live in `config.fieldValidation` as `[{ field, format?: 'email'|'url'|'phone', regex?, minLength?, maxLength?, message? }]` — form-section surfaces inline errors when a submit violates a declared constraint. Agents drive shape by overriding `config.fields` + `config.fieldValidation` per-call-site."
+"std-form-advanced — full-typed form-section primitive. Hosts the `editing` state with a configurable `fields` array (each entry mirrors @almadar/ui's `form-section` field schema: `{ name, label, type?, values?, relation?, required? }`). Agents drive shape by overriding `config.fields` per-call-site."
 type FieldSpec = { name : string!, label : string, variant : string, icon : string, format : string, key : string, header : string }
-type ValidationSpec = { field : string!, rule : string, message : string }
 orbital FormEntryOrbital {
     type FormEntryLoaded = Event { data : [FormEntry] } "Fired when FormEntry finishes loading"
 
@@ -251,10 +250,6 @@ orbital FormEntryOrbital {
         @label "Form fields"
         @description "Inputs to render; each entry follows the form-section field schema"
         @tier "presentation"
-      fieldValidation : [ValidationSpec] = []
-        @label "Field validation"
-        @description "Per-field rules (format, regex, length) shown inline on submit"
-        @tier "domain"
       submitLabel : string
         @label "Submit button"
         @description "Label on the submit button; unset keeps the translated Save"

package/behaviors/lolo/ui/core/atoms/std-geosearch.lolo

@@ -22,6 +22,7 @@ orbital GeoSearchResultOrbital {
 
     state idle {
       INIT -> idle
+        (set @entity.radiusKm @config.defaultRadiusKm)
         (render-ui main {
           children: [{
             event: @config.event