@praxisui/table 10.0.0-rc.0 → 10.0.0-rc.4

package/README.md

@@ -604,7 +604,34 @@ The table can materialize analytic table projections produced by the canonical `
 When both `resourcePath` and `analyticsProjection` are present, the canonical `DataMode` precedence remains remote: the table cancels any analytical transport and does not mix rows from the stats endpoint with the resource collection.
 
 Detail rows can host governed rich content surfaces. Rich content semantics belong to the shared rich content/core contracts; the table provides the row-detail shell and host-mediated dispatch.
+`behavior.detail` owns governed rich content for both row expansion and the contextual bottom panel. Set `detail.presentation.placement` to `bottom` to use the existing selection model: exactly one visible record supplies the body. `presentation.emptyBehavior` chooses an instructional state (`message`, the default) or removes the surface when it has no renderable selected-record content (`hide`). `presentation.bottomStackPosition` defaults to `afterControls`, keeping the table, footer toolbar and paginator together before the contextual panel; `beforeControls` is available for deliberately authored compositions. `behavior.expansion` owns row interaction. The finite migration moves old `behavior.expansion.detail` documents and rejects conflicting definitions; runtime does not read both paths.
+
+The Details editor preserves authored field expressions and provider references through Apply/Save/reopen. `detail.configure`, `detail.source.configure` and `detail.presentation.configure` declare semantic operations; the canonical executor couples presentation, expansion and selection. See [the presentation ADR](docs/adr/table-detail-presentation.md) for activation, migration and async ownership rules. Rich content semantics belong to the shared rich content/core contracts; the table provides the detail shell and host-mediated dispatch.
+
+The visual source editor exposes the complete identity required by `source.mode: "resource"` (`kind`, `id`, and `version`) and the guarded HTTP fields required by `source.mode: "resourcePath"` (`path`, `method`, `resourceAllowList`, and `fallbackMode`). A resource fallback exposes the same identity fields even while another primary source is selected. Fallback cannot point back to the primary mode. Explicit incomplete sources and fallback cycles block Apply/Save. `paramsMap`, `contextMap`, and other advanced source extensions remain available in the advanced JSON without being rewritten by hydration.
+
+Use a `richContent` detail node when the selected-record body needs a callout, semantic card, icon, formatted hierarchy, token-based tone or contextual action. `source.inlineSchema` accepts either a detail document or one detail node; a single node is normalized into the same governed stack before validation and rendering. The Rich Content `document` and `rootClassName` use the canonical Rich Content validators before Apply/Save and again before rendering. The Details editor delegates that document to `PraxisRichContentConfigEditor`; Table does not redefine callout/card properties. Each Rich action ID must also be declared in `actions.row.actions[]`; an undeclared action blocks local authoring and remains unavailable at runtime for remotely supplied documents. Quick starts therefore create content without inventing a domain action. Declared actions use the Table row-action pipeline, so application handlers, global actions, capability checks and backend authorization keep their existing ownership. `requiresCapabilities` is evaluated against the canonical enterprise runtime capability list; the Table does not infer capabilities from authorities. Prefer semantic tones and application tokens. Arbitrary gradients remain an advanced style choice and require rendered contrast/theme evidence.
+
+The selected-record body supports the governed detail schema and its Rich Content presenter subset. The shell states for zero, multiple, off-page, loading, blocked and error remain localized plain text under `table.detail.*`; hosts can override them through `localization.translations`. The Details editor exposes guided copy overrides for the common zero-selection and selected-record introduction states. Other shell states remain available through localization, and shell states do not accept Rich Content documents. `textExpr`, `labelExpr` and `valueExpr` resolve governed context paths rather than arbitrary string formulas. Compose several presenter nodes to show multiple fields together, or materialize a canonical derived value upstream when the result carries reusable business meaning. The guided editor covers the common presets; advanced supported node properties round-trip through the detail JSON.
+
+Detail documents obtained from a provider or endpoint are untrusted input. In addition to the Table node allowlist, nested Rich Content presenters are validated by the canonical Rich Content document validator; unsafe styles, URLs, expressions or nested schemas fail closed according to the configured unsupported-node policy. Backend authorization and field-level disclosure policy remain mandatory because presentation sanitization does not decide whether a record or field may be returned.
+
 When the actions column header combines an icon and a label, the table materializes that rich content with inline, non-wrapping layout. Column width may still be governed by the table contract, but the icon is not allowed to force the label onto a second line.
+
+When `EnterpriseRuntimeContextService` publishes a different user, tenant, environment, profile, module, authority/capability set, locale or timezone, Table invalidates pending detail/data work, selection, rendered rows and row discovery. Local hosts must deliver a new `data` array for the effective context and cancel their own obsolete requests; retaining or mutating the previous array does not make it eligible again. Remote Table reloads through its existing data pipeline. Configure the host's canonical context propagation and enforce authorization in the backend; UI invalidation does not authorize a record or prove tenant isolation. Label and timestamp refreshes alone preserve runtime state.
+
+`initiallyCollapsed` applies after persisted hydration and configuration Apply as well as initial input. Known detail group shapes, source modes, presentation modes and booleans are validated before Apply; unknown extension properties remain preserved. A missing `height` uses dynamic sizing, matching the editor default. `height.mode: "dynamic"` makes that intent explicit, follows the rendered content and occupies no body space when the surface is hidden. `height.mode: "fixed"` requires a positive pixel height; the editor starts at 192px when fixed mode is selected without a previous value.
+
+Within `lazyLoad`, only `cache.enabled` (retention after collapse) and `cancelOnCollapse` currently change runtime behavior. `enabled`, `actionId`, `cache.ttlMs`, `retry.maxAttempts`, and `dedupeByRowKey` are deprecated compatibility fields: they round-trip but do not enable TTL, retries, action-based loading, or a deduplication override. Corporate configurations must not rely on those fields until an owning transport contract implements and tests them.
+
+The fixed bottom body is a named, keyboard-focusable scroll region. This keeps long notes, timelines, referenced content and actions reachable, including when the operating system hides scrollbars until interaction. Dynamic mode lets short or variable content determine the panel height and keeps the collection controls in their stable position above the panel by default.
+
+For detail `source.mode: "resourcePath"`, only a relative route that resolves to the host origin is executable. The runtime admits the canonical pathname through `resourceAllowList`, rejects explicit or encoded path traversal/separators and follows no redirects. Requests use same-origin credentials and `EnterpriseRuntimeContextService.effectiveRequestHeaders()`; this explicit surface can include the current context and host-configured authentication data without changing the context-only `headers()` contract. The allowlist is a document guardrail, not authorization, and it is not method-aware. Backend authorization remains mandatory for every GET/POST. Query semantics remain the endpoint owner's contract. Relative routes without a leading slash retain document-base behavior. Hosts that rely on Angular authentication or XSRF interceptors must use `source.mode: "resource"` with `PRAXIS_TABLE_DETAIL_RESOURCE_RESOLVER`, or publish the required headers through the canonical enterprise runtime header configuration, because this redirect-denying transport intentionally uses Fetch.
+
+The Fetch-based detail transport currently buffers the response body before parsing and does not define a client-side byte limit. Corporate gateways and detail endpoints must therefore enforce response-size and timeout policies. Treat a configurable client-side budget as a future platform contract, not as a property that can be improvised in a Table document.
+
+Every non-2xx response is a failed detail resolution even when its body resembles a valid schema. Error bodies are never materialized as UI content; the configured fallback may run, otherwise the detail stays in its governed blocked state.
+
 When no bottom paginator or footer toolbar follows the data surface, the table closes its lower corners. When a bottom surface is present, the table keeps square lower corners so the stack remains visually continuous.
 Governed embed nodes (`formRef`, `tableRef`, `chartRef`, `templateRef`, `diagramEmbed`) default to `renderMode: "reference"` when the field is omitted.
 `renderMode: "inline"` is an explicit intent for an owning runtime/provider to materialize the referenced surface inside the detail row; hosts must still keep the reference shell as the accessible fallback when the provider, data, or capability is unavailable.
@@ -693,3 +720,11 @@ editor” até 768px de largura disponível, mantendo a mesma seleção e os con
 das abas. Acima desse limite, reaparece a navegação por abas. O Settings Panel
 organiza título, expandir e fechar em uma grade até 599px; a prévia, quando
 suportada, ocupa a linha seguinte. Nenhum documento ou protocolo de Save é alterado.
+
+<!-- praxis-npm-catalog-links:start -->
+## Official documentation and examples
+
+- [Canonical technical overview: Overview](https://praxisui.dev/docs/components/praxis-table)
+- [Praxis Angular public catalog](https://praxisui.dev/angular)
+- [Public example: Examples](https://praxisui.dev/docs/components/praxis-table/examples)
+<!-- praxis-npm-catalog-links:end -->