@mmlogic/components 0.5.16 → 0.5.18

package/dist/types/components/documents/mrd-document-container/mrd-document-container.d.ts

@@ -33,6 +33,13 @@ export declare class MrdDocumentContainer {
      *  (with a tooltip explaining why) and the embedded table/list get it passed
      *  through so their own create/upload/drag-drop paths are disabled too. */
     readOnly: boolean;
+    /** Whether the current user may create a document here — set by mrd-layout-section from
+     *  its generic capability check (TASK-0299/FINDING-0155), the same answer the embedded
+     *  table gets in list mode. Named `mayCreate` (not `canCreate`) to avoid colliding with
+     *  the existing `canCreate` state below, which tracks something unrelated: whether the
+     *  folder tree currently has a valid drop target selected. Defaults to false (hidden)
+     *  until confirmed, same as mrd-table. */
+    mayCreate: boolean;
     /** Re-emitted from the embedded list/table. `nodeId` present for a folder load. */
     mrdLoadPage: EventEmitter<{
         page: number;

package/dist/types/components/layout/mrd-layout-section/mrd-layout-section.d.ts

@@ -22,6 +22,12 @@ export declare class MrdLayoutSection {
      *  create ("+") action and the documents view's New folder / Upload are disabled
      *  with a tooltip explaining why, so it's clear at a glance the user can't mutate data. */
     readOnly: boolean;
+    /** When false, skips the mrdViewCheckCapabilities round trip for every VIEW/RELATED_VIEW
+     *  binding and hands mrd-table/mrd-memo-container/mrd-document-container their create
+     *  affordance as allowed immediately — for a tenant with no access control configured,
+     *  the answer would always be mayCreate: true anyway (FINDING-0171 / TASK-0322). Default
+     *  `true` keeps today's ask-and-hide behaviour unchanged. */
+    accessControlEnabled: boolean;
     /** The active account's linked person record (userProfile.links.person), if any.
      *  Threaded to mrd-memo-container so a top-level memo VIEW (no parent record to
      *  attach a new memo to) can still offer "New memo" by falling back to the
@@ -32,7 +38,22 @@ export declare class MrdLayoutSection {
     private imagePreviewUrl;
     private imagePreviews;
     private openHistoryField;
+    /** Answers to mrdViewCheckCapabilities, keyed by view key — see emitCapabilitiesChecks().
+     *  Passed straight down as a `canCreate`/`mayCreate` prop to whichever body (mrd-table,
+     *  mrd-memo-container, mrd-document-container) is mounted for that key; a missing entry
+     *  means "not answered yet" and is treated as false (hidden), same default as mrd-table's
+     *  own standalone behaviour (TASK-0299). */
+    private canCreateMap;
+    /** Companion to canCreateMap — concrete types the mrdViewCheckCapabilities answer allows,
+     *  when the API reports them; passed to mrd-table's `allowedTypes` prop to narrow its
+     *  create-type picker down to types a create POST would actually accept (FINDING-0176 /
+     *  TASK-0314). A missing entry means "not answered yet / not reported" — mrd-table then
+     *  leaves `item.createTypes` unfiltered, same as before this existed. */
+    private allowedTypesMap;
     private historyClickOutside;
+    /** Signature last asked per view key (see emitCapabilitiesChecks()) — avoids re-emitting
+     *  mrdViewCheckCapabilities on every data/items update when the binding hasn't changed. */
+    private capabilitiesAsked;
     /** `attachments`, when present, prefetches the clicked document row's file slot
      *  (see TASK-0169 / FINDING-0111) so the host can render a preview immediately,
      *  without waiting for the navigated-to page's own mrdAttachments. Only set for
@@ -101,6 +122,19 @@ export declare class MrdLayoutSection {
         path: string;
         qs: string;
     }>;
+    /** Emitted once per VIEW/RELATED_VIEW binding — computed here directly, not relayed from a
+     *  child (see emitCapabilitiesChecks()), so it covers mrd-table, mrd-memo-container and
+     *  mrd-document-container uniformly. `name` is the view key (viewKeyFor(item)) — pass it
+     *  back to setViewCanCreate() to answer it. setViewCanCreate()'s optional third argument
+     *  narrows a table's `item.createTypes` picker to the concrete types the answer allows,
+     *  when the API's capabilities response reports them (FINDING-0176 / TASK-0314). */
+    mrdViewCheckCapabilities: EventEmitter<{
+        name: string;
+        type: string;
+        refType?: string;
+        refId?: string;
+        filterClass?: string;
+    }>;
     /** Generic "update an existing object" request from an embedded document view
      *  (a document dragged into another folder). Host PATCHes `href` with `values`. */
     mrdUpdateObject: EventEmitter<{
@@ -129,8 +163,29 @@ export declare class MrdLayoutSection {
     componentDidLoad(): void;
     disconnectedCallback(): void;
     dataChanged(newVal: Record<string, unknown>): void;
+    /** A host can swap `items` (e.g. a different dashboard layout) without `data` changing —
+     *  dataChanged() alone would miss that binding change. */
+    itemsChanged(): void;
     private initEmbeddedTables;
     private emitLoadImages;
+    /** Parent record id extracted from `data._links.self.href` — the same value every
+     *  VIEW/RELATED_VIEW item on this record shares, used for RELATED_VIEW path construction
+     *  (renderRelatedView) and capability checks (emitCapabilitiesChecks). */
+    private computeParentId;
+    /** Asks, once per VIEW/RELATED_VIEW binding, whether the current user may create a record
+     *  there — the single generic place for this check (TASK-0299/FINDING-0155), so mrd-table,
+     *  mrd-memo-container and mrd-document-container all get the answer the same way: as a plain
+     *  `canCreate`/`mayCreate` prop from this component, computed here and handed down in
+     *  renderTable()/renderMemoContainer()/renderDocumentContainer() — none of the three leaf
+     *  components need to ask on their own when rendered through mrd-layout-section (mrd-table's
+     *  own self-ask only kicks in for standalone use, i.e. its `canCreate` prop left undefined).
+     *
+     *  The route/path variables mirror what each renderer already uses for its own rows —
+     *  `type` = `dataClass`, `refType`/`refId` = `fromClass`/parentId for a RELATED_VIEW, and
+     *  `filterClass` when the view is scoped to one subtype (the same value sent as `?type=` on
+     *  the row fetch). A signature (not just the key) is tracked per binding so a genuine route
+     *  change re-asks and hides again, without re-asking on every unrelated data/items update. */
+    private emitCapabilitiesChecks;
     /** Inject search results. Pass dataClass to target a specific SEARCH item; omit when there is only one. */
     setSearchResults(results: RelationSearchResult[], dataClass?: string): Promise<void>;
     /**
@@ -142,6 +197,20 @@ export declare class MrdLayoutSection {
     setViewPage(name: string, page: number, rows: any[], totalElements?: number, hasNext?: boolean, nodeId?: string): Promise<void>;
     /** Inject aggregation totals into an embedded mrd-table for a VIEW or RELATED_VIEW item. */
     setViewAggregations(name: string, data: any): Promise<void>;
+    /** Host answer to mrdViewCheckCapabilities — whether the current user may create a record
+     *  for the given view's bound route. `name` is the view key from the event detail. Stored in
+     *  canCreateMap and passed down as a plain prop to whichever body is mounted for that key
+     *  (mrd-table, mrd-memo-container or mrd-document-container) — no DOM lookup needed, unlike
+     *  setViewPage/setViewAggregations, since the prop flows through the next render. */
+    setViewCanCreate(name: string, value: boolean, allowedTypes?: string[]): Promise<void>;
+    /** `canCreateMap[key]` when access control is configured (default); always allowed
+     *  when `accessControlEnabled` is false, since emitCapabilitiesChecks() never asked
+     *  and canCreateMap[key] would otherwise stay permanently unanswered. */
+    private effectiveCanCreate;
+    /** `allowedTypesMap[key]` when access control is configured; `undefined` (don't filter)
+     *  when disabled, since emitCapabilitiesChecks() never asked and the map entry would
+     *  otherwise stay permanently unanswered — see effectiveCanCreate(). */
+    private effectiveAllowedTypes;
     /** Inject distinct values into an embedded mrd-document-list for a document view. */
     setViewDistinct(name: string, nodeId: string, values: DistinctValue[]): Promise<void>;
     /** Inject the uploaded file reference for a dropped file, so the document view

package/dist/types/components/memo/mrd-memo-container/mrd-memo-container.d.ts

@@ -52,6 +52,10 @@ export declare class MrdMemoContainer {
      *  tooltip, cards/rows are not clickable, and the embedded table's own
      *  create action is disabled too. */
     readOnly: boolean;
+    /** Whether the current user may create a memo here — set by mrd-layout-section from its
+     *  generic capability check (TASK-0299/FINDING-0155), the same answer the embedded table
+     *  gets in table mode. Defaults to false (hidden) until confirmed, same as mrd-table. */
+    canCreate: boolean;
     /** The active account's linked person record (userProfile.links.person), if any.
      *  Used both to gate "New memo" (see effectiveContainerHref) and, on submit, to
      *  fill the author slot. */

package/dist/types/components/table/mrd-table/mrd-table.d.ts

@@ -63,6 +63,28 @@ export declare class MrdTable {
      *  explaining why) so a viewer-role user can see at a glance that this dashboard
      *  is read-only. Sorting, filtering and export stay available — those don't mutate data. */
     readOnly: boolean;
+    /** Whether the current user may create a record for the table's bound route. Leave
+     *  `undefined` for standalone use — the table then asks on its own via mrdCheckCapabilities
+     *  and hides the create button until setCanCreate() answers. Set it explicitly when a host
+     *  already knows the answer (e.g. mrd-layout-section, which asks once per binding and hands
+     *  the answer to whichever body it mounts) — the table then trusts it directly and never
+     *  asks on its own (TASK-0299). */
+    canCreate?: boolean;
+    /** Concrete types (`item.createTypes[].type`) the current user may actually create, when
+     *  `item.createTypes` offers a picker for a family type — narrows it down to only the types
+     *  a create POST would accept (FINDING-0176 / TASK-0314). Leave `undefined` for standalone
+     *  use — the table takes it from the second argument of setCanCreate() alongside `canCreate`.
+     *  Set it explicitly (e.g. from mrd-layout-section, alongside `canCreate`) when the host
+     *  already has the answer. `undefined` (not yet answered, or an older host/API that doesn't
+     *  report it) means "don't filter" — `item.createTypes` is shown unfiltered, same as before
+     *  this existed. */
+    allowedTypes?: string[] | null;
+    /** When false, skips the standalone mrdCheckCapabilities round trip entirely and renders
+     *  the create action immediately as allowed — for a tenant that has no access control
+     *  configured, the answer would always be true anyway (FINDING-0171 / TASK-0322). Ignored
+     *  while `canCreate` is set explicitly (the host already controls the answer directly in
+     *  that mode). Default `true` keeps today's ask-and-hide behaviour unchanged. */
+    accessControlEnabled: boolean;
     /** Clamp renderEnd when totalElements shrinks (e.g. after a filter is applied).
      *  0 means "unknown" (hosts that rely on minKnownTotal never set it, and some reset it
      *  while a filter is being applied) — clamping to it would collapse the window to a
@@ -70,6 +92,11 @@ export declare class MrdTable {
     totalElementsChanged(newVal: number): void;
     /** Reset to primary view when the item prop is replaced from outside. */
     itemChanged(newVal: ClientLayoutItem | null): void;
+    /** A parent-record navigation can reuse the same `item` reference while only `parentId`
+     *  changes (e.g. clicking a different dossier for the same RELATED_VIEW layout) — itemChanged()
+     *  would not fire for that. Re-ask so a stale canCreate answer from the previous parent never
+     *  leaks into the new one. */
+    parentIdChanged(): void;
     /** Index into allViews[] for the currently displayed view. 0 = primary, 1+ = alternatives. */
     private activeViewIdx;
     loadedPages: Map<number, Record<string, any>[]>;
@@ -116,6 +143,13 @@ export declare class MrdTable {
     private aggregationsPending;
     /** Lower bound on total derived from setPage() hasNext info; grows as pages load. */
     private minKnownTotal;
+    /** Self-asked answer for standalone use (the `canCreate` prop is undefined) — defaults to
+     *  hidden (TASK-0299) until the host answers mrdCheckCapabilities via setCanCreate(). Ignored
+     *  when the host controls `canCreate` directly; see effectiveCanCreate(). */
+    private selfCanCreate;
+    /** Self-asked companion to selfCanCreate — the concrete types setCanCreate() reported allowed,
+     *  or `undefined` while unanswered / when the host's mrdCheckCapabilities answer omitted it. */
+    private selfAllowedTypes;
     /** Fired when a page needs to be fetched. Host fetches and calls setPage().
      *  `sort` is the raw query-param value, e.g. "name" or "name,desc". */
     mrdLoadPage: EventEmitter<{
@@ -160,6 +194,24 @@ export declare class MrdTable {
         qs: string;
         aggQs: string;
     }>;
+    /** Standalone use only (never fires while the `canCreate` prop is set — see there). Fired
+     *  once per table binding (initial load, and whenever the bound item, parent record or active
+     *  view changes) to ask the host whether the current user may create a record here. Carries
+     *  the same route the table already uses for its own rows, unconstructed — VIEW:
+     *  GET /data/{tenant}/{type}/capabilities; RELATED_VIEW: GET /data/{tenant}/{refType}/{refId}/{type}/capabilities.
+     *  `filterClass`, when the view declares one, is the same subtype the row fetch sends as
+     *  `?type=` — e.g. a "contents" RELATED_VIEW filtered to `document` asks specifically whether
+     *  a document may be created here, not any content type.
+     *  The add button stays hidden until the host calls setCanCreate() (FINDING-0155 / TASK-0299).
+     *  setCanCreate()'s optional second argument narrows `item.createTypes`'s picker down to the
+     *  concrete types the answer allows, when the API's capabilities response reports them
+     *  (FINDING-0176 / TASK-0314). */
+    mrdCheckCapabilities: EventEmitter<{
+        type: string;
+        refType?: string;
+        refId?: string;
+        filterClass?: string;
+    }>;
     componentWillLoad(): void;
     componentDidLoad(): void;
     private applyDefaultSort;
@@ -183,6 +235,12 @@ export declare class MrdTable {
     setPage(pageNumber: number, rows: Record<string, any>[], hasNext?: boolean): Promise<void>;
     /** Inject aggregation totals returned by the /aggregations endpoint. */
     setAggregations(data: AggregationResult): Promise<void>;
+    /** Host answer to mrdCheckCapabilities — whether the current user may create a record for
+     *  the table's currently bound route (standalone use only; ignored while the `canCreate`
+     *  prop is set, since the host controls it directly in that mode). Call it any time after
+     *  the event fires; a stale answer for an old binding is discarded automatically
+     *  (selfCanCreate is reset to false before every new mrdCheckCapabilities emission). */
+    setCanCreate(value: boolean, allowedTypes?: string[]): Promise<void>;
     disconnectedCallback(): void;
     componentDidRender(): void;
     /** Freeze the column widths once the first data page has rendered.
@@ -273,6 +331,12 @@ export declare class MrdTable {
      *  VIEW:         /{dataClass}
      *  RELATED_VIEW: /{fromClass}/{parentId}/{dataClass}  */
     private buildDataPath;
+    /** Asks the host whether creating is allowed for the table's current binding (item, parent
+     *  and active view) — only in standalone use (`canCreate` prop undefined). A host that
+     *  controls `canCreate` directly already knows the answer, so the table never asks on its
+     *  own in that mode. Resets selfCanCreate to false first so the add button stays hidden for
+     *  the new binding until the host answers — it never inherits the previous binding's answer. */
+    private emitCapabilitiesCheck;
     /** Build query params for a page request from current sort, view filters, filterClass and active column filters.
      *
      *  `q` and column filters are mutually exclusive on the backend — combining them breaks
@@ -291,6 +355,17 @@ export declare class MrdTable {
      *  mode must not flip back to the rows prop (and its "no results") while page 0 is in flight. */
     private get isPaginated();
     private get columns();
+    /** `canCreate` when the host controls it directly; else, when access control is disabled,
+     *  always allowed; else the table's own self-asked answer. */
+    private get effectiveCanCreate();
+    /** `allowedTypes` when the host controls it directly, else the table's own self-asked
+     *  answer. `undefined` means "unknown — don't filter", not "nothing allowed". */
+    private get effectiveAllowedTypes();
+    /** `item.createTypes` intersected with effectiveAllowedTypes when that is known, so the
+     *  create-type picker only offers concrete types a create POST would actually accept
+     *  (FINDING-0176 / TASK-0314). Unfiltered when the answer isn't known (undefined) — an
+     *  older host/API that never reports allowedTypes keeps today's unfiltered behaviour. */
+    private get effectiveCreateTypes();
     private get tableActions();
     private toggleCreatePicker;
     private closeCreatePicker;

package/dist/types/components.d.ts

@@ -156,6 +156,11 @@ export namespace Components {
           * @default navigator.language
          */
         "locale": string;
+        /**
+          * Whether the current user may create a document here — set by mrd-layout-section from its generic capability check (TASK-0299/FINDING-0155), the same answer the embedded table gets in list mode. Named `mayCreate` (not `canCreate`) to avoid colliding with the existing `canCreate` state below, which tracks something unrelated: whether the folder tree currently has a valid drop target selected. Defaults to false (hidden) until confirmed, same as mrd-table.
+          * @default false
+         */
+        "mayCreate": boolean;
         /**
           * Parent record id — required for RELATED_VIEW path building.
           * @default ''
@@ -516,6 +521,11 @@ export namespace Components {
         "statusListItems": ClientListValue[] | null;
     }
     interface MrdLayoutSection {
+        /**
+          * When false, skips the mrdViewCheckCapabilities round trip for every VIEW/RELATED_VIEW binding and hands mrd-table/mrd-memo-container/mrd-document-container their create affordance as allowed immediately — for a tenant with no access control configured, the answer would always be mayCreate: true anyway (FINDING-0171 / TASK-0322). Default `true` keeps today's ask-and-hide behaviour unchanged.
+          * @default true
+         */
+        "accessControlEnabled": boolean;
         /**
           * Top-level archetypes on the object dashboard. When it contains commons.document, the record is rendered as a single-document view instead of generic fields.
           * @default []
@@ -566,6 +576,10 @@ export namespace Components {
           * Inject aggregation totals into an embedded mrd-table for a VIEW or RELATED_VIEW item.
          */
         "setViewAggregations": (name: string, data: any) => Promise<void>;
+        /**
+          * Host answer to mrdViewCheckCapabilities — whether the current user may create a record for the given view's bound route. `name` is the view key from the event detail. Stored in canCreateMap and passed down as a plain prop to whichever body is mounted for that key (mrd-table, mrd-memo-container or mrd-document-container) — no DOM lookup needed, unlike setViewPage/setViewAggregations, since the prop flows through the next render.
+         */
+        "setViewCanCreate": (name: string, value: boolean, allowedTypes?: string[]) => Promise<void>;
         /**
           * Inject the created document's href after a file-drop create, so the optimistic row becomes navigable (see mrdCreateObject). For a memo quick-create there is no optimistic row to resolve — simply reload the container's current body so the new memo shows up.
          */
@@ -674,6 +688,11 @@ export namespace Components {
           * Resolved `commons.memo` archetype binding.
          */
         "archetype": ClientArchetype;
+        /**
+          * Whether the current user may create a memo here — set by mrd-layout-section from its generic capability check (TASK-0299/FINDING-0155), the same answer the embedded table gets in table mode. Defaults to false (hidden) until confirmed, same as mrd-table.
+          * @default false
+         */
+        "canCreate": boolean;
         /**
           * Canonical parent href — set when this is a RELATED_VIEW embedded under a parent record, which already gives a new memo something to attach to.
           * @default ''
@@ -997,6 +1016,19 @@ export namespace Components {
         "value": string;
     }
     interface MrdTable {
+        /**
+          * When false, skips the standalone mrdCheckCapabilities round trip entirely and renders the create action immediately as allowed — for a tenant that has no access control configured, the answer would always be true anyway (FINDING-0171 / TASK-0322). Ignored while `canCreate` is set explicitly (the host already controls the answer directly in that mode). Default `true` keeps today's ask-and-hide behaviour unchanged.
+          * @default true
+         */
+        "accessControlEnabled": boolean;
+        /**
+          * Concrete types (`item.createTypes[].type`) the current user may actually create, when `item.createTypes` offers a picker for a family type — narrows it down to only the types a create POST would accept (FINDING-0176 / TASK-0314). Leave `undefined` for standalone use — the table takes it from the second argument of setCanCreate() alongside `canCreate`. Set it explicitly (e.g. from mrd-layout-section, alongside `canCreate`) when the host already has the answer. `undefined` (not yet answered, or an older host/API that doesn't report it) means "don't filter" — `item.createTypes` is shown unfiltered, same as before this existed.
+         */
+        "allowedTypes"?: string[] | null;
+        /**
+          * Whether the current user may create a record for the table's bound route. Leave `undefined` for standalone use — the table then asks on its own via mrdCheckCapabilities and hides the create button until setCanCreate() answers. Set it explicitly when a host already knows the answer (e.g. mrd-layout-section, which asks once per binding and hands the answer to whichever body it mounts) — the table then trusts it directly and never asks on its own (TASK-0299).
+         */
+        "canCreate"?: boolean;
         /**
           * Initialise (or reset) the virtual scroll. Call after setting all props and registering the mrdLoadPage listener, but before calling setPage(0, rows).
          */
@@ -1044,6 +1076,10 @@ export namespace Components {
           * Inject aggregation totals returned by the /aggregations endpoint.
          */
         "setAggregations": (data: AggregationResult) => Promise<void>;
+        /**
+          * Host answer to mrdCheckCapabilities — whether the current user may create a record for the table's currently bound route (standalone use only; ignored while the `canCreate` prop is set, since the host controls it directly in that mode). Call it any time after the event fires; a stale answer for an old binding is discarded automatically (selfCanCreate is reset to false before every new mrdCheckCapabilities emission).
+         */
+        "setCanCreate": (value: boolean, allowedTypes?: string[]) => Promise<void>;
         /**
           * Inject the rows for a given page (0-based). Creates a new Map reference so Stencil detects the state change.  When the page contains fewer rows than pageSize it is the last page. renderEnd is clamped immediately so no loading-placeholder rows appear beyond the actual data — without requiring the host to update totalElements.  Pass hasNext (from _links.next in the API response) for accurate last-page detection even when rows.length === pageSize (exact multiple of page size).
          */
@@ -1638,6 +1674,7 @@ declare global {
         "mrdViewAction": { name: string; action: string; dataClass: string; path?: string; qs?: string; parentPath?: string | null; basicType?: string };
         "mrdLoadViewAggregations": { name: string; dataClass: string; path: string; qs: string; aggQs: string };
         "mrdLoadViewDistinct": { name: string; nodeId: string; distinct: string; path: string; qs: string };
+        "mrdViewCheckCapabilities": { name: string; type: string; refType?: string; refId?: string; filterClass?: string };
         "mrdUpdateObject": { href: string; values: Record<string, unknown> };
         "mrdDeleteObject": { href: string };
         "mrdViewUpload": { name: string; file: File };
@@ -1879,6 +1916,7 @@ declare global {
         "mrdAction": { action: string; path?: string; qs?: string; dataClass?: string; parentPath?: string | null; basicType?: string };
         "mrdDownload": { href: string; fileName: string };
         "mrdLoadAggregations": { path: string; qs: string; aggQs: string };
+        "mrdCheckCapabilities": { type: string; refType?: string; refId?: string; filterClass?: string };
     }
     interface HTMLMrdTableElement extends Components.MrdTable, HTMLStencilElement {
         addEventListener<K extends keyof HTMLMrdTableElementEventMap>(type: K, listener: (this: HTMLMrdTableElement, ev: MrdTableCustomEvent<HTMLMrdTableElementEventMap[K]>) => any, options?: boolean | AddEventListenerOptions): void;
@@ -2129,6 +2167,11 @@ declare namespace LocalJSX {
           * @default navigator.language
          */
         "locale"?: string;
+        /**
+          * Whether the current user may create a document here — set by mrd-layout-section from its generic capability check (TASK-0299/FINDING-0155), the same answer the embedded table gets in list mode. Named `mayCreate` (not `canCreate`) to avoid colliding with the existing `canCreate` state below, which tracks something unrelated: whether the folder tree currently has a valid drop target selected. Defaults to false (hidden) until confirmed, same as mrd-table.
+          * @default false
+         */
+        "mayCreate"?: boolean;
         /**
           * A table toolbar action was triggered.
          */
@@ -2588,6 +2631,11 @@ declare namespace LocalJSX {
         "statusListItems"?: ClientListValue[] | null;
     }
     interface MrdLayoutSection {
+        /**
+          * When false, skips the mrdViewCheckCapabilities round trip for every VIEW/RELATED_VIEW binding and hands mrd-table/mrd-memo-container/mrd-document-container their create affordance as allowed immediately — for a tenant with no access control configured, the answer would always be mayCreate: true anyway (FINDING-0171 / TASK-0322). Default `true` keeps today's ask-and-hide behaviour unchanged.
+          * @default true
+         */
+        "accessControlEnabled"?: boolean;
         /**
           * Top-level archetypes on the object dashboard. When it contains commons.document, the record is rendered as a single-document view instead of generic fields.
           * @default []
@@ -2659,6 +2707,10 @@ declare namespace LocalJSX {
           * Re-emitted from an embedded mrd-table's mrdAction; host builds the target URL from dataClass.
          */
         "onMrdViewAction"?: (event: MrdLayoutSectionCustomEvent<{ name: string; action: string; dataClass: string; path?: string; qs?: string; parentPath?: string | null; basicType?: string }>) => void;
+        /**
+          * Emitted once per VIEW/RELATED_VIEW binding — computed here directly, not relayed from a child (see emitCapabilitiesChecks()), so it covers mrd-table, mrd-memo-container and mrd-document-container uniformly. `name` is the view key (viewKeyFor(item)) — pass it back to setViewCanCreate() to answer it. setViewCanCreate()'s optional third argument narrows a table's `item.createTypes` picker to the concrete types the answer allows, when the API's capabilities response reports them (FINDING-0176 / TASK-0314).
+         */
+        "onMrdViewCheckCapabilities"?: (event: MrdLayoutSectionCustomEvent<{ name: string; type: string; refType?: string; refId?: string; filterClass?: string }>) => void;
         /**
           * An external file was dropped on a document view; host uploads and calls setViewFileReference(name, uri).
          */
@@ -2764,6 +2816,11 @@ declare namespace LocalJSX {
           * Resolved `commons.memo` archetype binding.
          */
         "archetype": ClientArchetype;
+        /**
+          * Whether the current user may create a memo here — set by mrd-layout-section from its generic capability check (TASK-0299/FINDING-0155), the same answer the embedded table gets in table mode. Defaults to false (hidden) until confirmed, same as mrd-table.
+          * @default false
+         */
+        "canCreate"?: boolean;
         /**
           * Canonical parent href — set when this is a RELATED_VIEW embedded under a parent record, which already gives a new memo something to attach to.
           * @default ''
@@ -3107,6 +3164,19 @@ declare namespace LocalJSX {
         "value"?: string;
     }
     interface MrdTable {
+        /**
+          * When false, skips the standalone mrdCheckCapabilities round trip entirely and renders the create action immediately as allowed — for a tenant that has no access control configured, the answer would always be true anyway (FINDING-0171 / TASK-0322). Ignored while `canCreate` is set explicitly (the host already controls the answer directly in that mode). Default `true` keeps today's ask-and-hide behaviour unchanged.
+          * @default true
+         */
+        "accessControlEnabled"?: boolean;
+        /**
+          * Concrete types (`item.createTypes[].type`) the current user may actually create, when `item.createTypes` offers a picker for a family type — narrows it down to only the types a create POST would accept (FINDING-0176 / TASK-0314). Leave `undefined` for standalone use — the table takes it from the second argument of setCanCreate() alongside `canCreate`. Set it explicitly (e.g. from mrd-layout-section, alongside `canCreate`) when the host already has the answer. `undefined` (not yet answered, or an older host/API that doesn't report it) means "don't filter" — `item.createTypes` is shown unfiltered, same as before this existed.
+         */
+        "allowedTypes"?: string[] | null;
+        /**
+          * Whether the current user may create a record for the table's bound route. Leave `undefined` for standalone use — the table then asks on its own via mrdCheckCapabilities and hides the create button until setCanCreate() answers. Set it explicitly when a host already knows the answer (e.g. mrd-layout-section, which asks once per binding and hands the answer to whichever body it mounts) — the table then trusts it directly and never asks on its own (TASK-0299).
+         */
+        "canCreate"?: boolean;
         /**
           * The VIEW or RELATED_VIEW layout item. Contains view config, dataClass, fromClass, actions etc.
           * @default null
@@ -3120,6 +3190,10 @@ declare namespace LocalJSX {
           * Fired when a toolbar action button is clicked. For 'export': includes `path` (relative excel path) and `qs` (current sort+filter params). For 'create': includes `dataClass` (target type) and `parentPath` (e.g. /buyers/123 for RELATED_VIEW).
          */
         "onMrdAction"?: (event: MrdTableCustomEvent<{ action: string; path?: string; qs?: string; dataClass?: string; parentPath?: string | null; basicType?: string }>) => void;
+        /**
+          * Standalone use only (never fires while the `canCreate` prop is set — see there). Fired once per table binding (initial load, and whenever the bound item, parent record or active view changes) to ask the host whether the current user may create a record here. Carries the same route the table already uses for its own rows, unconstructed — VIEW: GET /data/{tenant}/{type}/capabilities; RELATED_VIEW: GET /data/{tenant}/{refType}/{refId}/{type}/capabilities. `filterClass`, when the view declares one, is the same subtype the row fetch sends as `?type=` — e.g. a "contents" RELATED_VIEW filtered to `document` asks specifically whether a document may be created here, not any content type. The add button stays hidden until the host calls setCanCreate() (FINDING-0155 / TASK-0299). setCanCreate()'s optional second argument narrows `item.createTypes`'s picker down to the concrete types the answer allows, when the API's capabilities response reports them (FINDING-0176 / TASK-0314).
+         */
+        "onMrdCheckCapabilities"?: (event: MrdTableCustomEvent<{ type: string; refType?: string; refId?: string; filterClass?: string }>) => void;
         /**
           * Fired when a FILE or IMAGE cell is clicked. Host resolves the href to a signed download URL.
          */
@@ -3317,6 +3391,7 @@ declare namespace LocalJSX {
         "height": number;
         "locale": string;
         "readOnly": boolean;
+        "mayCreate": boolean;
     }
     interface MrdDocumentListAttributes {
         "parentId": string;
@@ -3384,6 +3459,7 @@ declare namespace LocalJSX {
     interface MrdLayoutSectionAttributes {
         "locale": string;
         "readOnly": boolean;
+        "accessControlEnabled": boolean;
     }
     interface MrdListFieldAttributes {
         "name": string;
@@ -3411,6 +3487,7 @@ declare namespace LocalJSX {
         "viewKey": string;
         "locale": string;
         "readOnly": boolean;
+        "canCreate": boolean;
     }
     interface MrdMemoListAttributes {
         "parentId": string;
@@ -3472,6 +3549,8 @@ declare namespace LocalJSX {
         "tableHeight": number;
         "requestTimeoutMs": number;
         "readOnly": boolean;
+        "canCreate": boolean;
+        "accessControlEnabled": boolean;
     }
     interface MrdTextFieldAttributes {
         "name": string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmlogic/components",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "description": "Stencil.js web component library for dynamic forms and virtual-scroll data tables",
   "license": "MIT",
   "author": "Mosterd",