@checkstack/incident-backend 1.13.4 → 1.13.6

package/CHANGELOG.md

@@ -1,5 +1,141 @@
 # @checkstack/incident-backend
 
+## 1.13.6
+
+### Patch Changes
+
+- be74b01: Render markdown in incident/maintenance update messages instead of escaping it
+
+  Thanks to @stuajnht for reporting: an email notification showed the raw
+  markdown of a link (`[text](url)`) instead of a clickable link. The report
+  placed the bug in the email renderer, but the email path was fine - it already
+  runs `markdownToHtml`. The damage happened upstream.
+
+  The shared `sanitizeUpdateMessage` (in `notification-common`, used by both the
+  incident and maintenance backends to embed the latest update in a notification
+  body) backslash-escaped every markdown control character and forced the message
+  onto a single line inside a blockquote. So a `[label](href)` link arrived as
+  `\[label\]\(href\)` and rendered as literal text in every channel - exactly the
+  symptom reported.
+
+  Update messages are authored as markdown and render as markdown on the web, so
+  they now do the same in notifications. `sanitizeUpdateMessage` still normalizes
+  the text (strips non-whitespace control characters, normalizes line endings,
+  collapses runs of blank lines, bounds the length) but no longer escapes the
+  markdown, and `buildUpdateMessageSuffix` appends it as its own multi-line
+  markdown block rather than a single-line blockquote. Links, emphasis, code, and
+  lists now render.
+
+  This does not weaken safety. The only strategy that emits HTML is SMTP, via
+  `markdownToHtml`, whose email-safe allow-list drops `<script>`, `on*=`
+  handlers, and `javascript:`/`data:` URLs; every other strategy renders markdown
+  / mrkdwn / an adaptive card or flattens to plain text, none of which execute
+  HTML. Source-side escaping was redundant with that renderer sanitization for
+  the security goal while destroying legitimate formatting. The notification
+  title and the incident/maintenance descriptions were already interpolated into
+  the body unescaped, so this brings the update message in line with them.
+
+- be74b01: Fix status-page detail-page content and status colouring
+
+  Thanks to @stuajnht for reporting several public status-page issues (the
+  announcement-block fix is a separate changeset):
+
+  - **Incident/maintenance status text was uncoloured and inline.** Update-timeline
+    status changes rendered in the muted grey `text-muted-foreground`, making the
+    status hard to tell apart from the message. The status change now sits on its
+    own line, coloured by its lifecycle (a new `incidentStatusTone`/`Label` mirrors
+    the incident status enum the way `maintenanceStatusTone` mirrors maintenance),
+    on both the summary block and the detail pages. The detail-page incident status
+    pill next to the title is now coloured too (was a neutral grey pill).
+
+  - **Detail pages showed raw markdown.** Individual incident/maintenance pages
+    rendered the update body as the raw source string; they now render sanitized
+    markdown via `<Markdown>`, like the block.
+
+  - **Detail pages showed only a few updates.** The individual pages reused the
+    summary block DTO, so they inherited the block's `maxUpdates` cap. Widget types
+    now expose an optional `resolveDetail` that returns the ONE item with ALL its
+    public updates (no cap) and its long-form description; the incident and
+    maintenance widgets implement it, and the status-page backend's
+    `resolvePublishedIncident`/`resolvePublishedMaintenance` call it. The detail
+    page is gated by the SAME anti-enumeration boundary as the block (the widget's
+    live scope), and the result is re-validated against the widget's item DTO, so
+    it fails closed exactly like the block.
+
+  - **Maintenance detail page showed no description.** The maintenance item DTO
+    gained an optional `description`, emitted by `resolveDetail` and rendered as
+    markdown on the detail page (the incident detail page already had the field
+    plumbed and now renders it too).
+
+  Note on maintenance/grey systems (also reported): the maintenance BLOCK already
+  colours scheduled windows blue. On the SYSTEM-HEALTH widget the blue
+  "maintenance" tone is applied only while a window is actively `in_progress`; a
+  future scheduled window leaves the system on its live health, and a system with
+  no health data reads grey "unknown". That is deliberate and left as-is.
+
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+- Updated dependencies [be74b01]
+  - @checkstack/ai-backend@0.11.4
+  - @checkstack/notification-common@1.8.0
+  - @checkstack/status-page-backend@0.6.6
+  - @checkstack/status-page-common@0.6.5
+  - @checkstack/auth-common@0.16.0
+  - @checkstack/automation-backend@0.11.8
+  - @checkstack/catalog-backend@1.10.1
+  - @checkstack/catalog-common@2.8.1
+  - @checkstack/incident-common@1.10.5
+  - @checkstack/backend-api@0.34.1
+  - @checkstack/command-backend@0.2.27
+  - @checkstack/integration-backend@0.7.9
+
+## 1.13.5
+
+### Patch Changes
+
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+- Updated dependencies [6c8b36b]
+  - @checkstack/auth-common@0.15.0
+  - @checkstack/ai-backend@0.11.3
+  - @checkstack/backend-api@0.34.0
+  - @checkstack/catalog-common@2.8.0
+  - @checkstack/common@0.23.0
+  - @checkstack/catalog-backend@1.10.0
+  - @checkstack/status-page-backend@0.6.5
+  - @checkstack/automation-backend@0.11.7
+  - @checkstack/command-backend@0.2.26
+  - @checkstack/integration-backend@0.7.8
+  - @checkstack/incident-common@1.10.4
+  - @checkstack/status-page-common@0.6.4
+  - @checkstack/ai-common@0.6.7
+  - @checkstack/automation-common@0.10.2
+  - @checkstack/cache-api@0.3.20
+  - @checkstack/integration-common@0.9.10
+  - @checkstack/notification-common@1.7.2
+  - @checkstack/signal-common@0.3.1
+  - @checkstack/cache-utils@0.3.1
+
 ## 1.13.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-backend",
-  "version": "1.13.4",
+  "version": "1.13.6",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -14,25 +14,25 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/ai-backend": "0.11.2",
-    "@checkstack/ai-common": "0.6.6",
-    "@checkstack/backend-api": "0.33.0",
-    "@checkstack/cache-api": "0.3.19",
-    "@checkstack/cache-utils": "0.3.0",
-    "@checkstack/incident-common": "1.10.3",
-    "@checkstack/catalog-common": "2.7.3",
-    "@checkstack/catalog-backend": "1.9.2",
-    "@checkstack/notification-common": "1.7.1",
-    "@checkstack/auth-common": "0.14.0",
-    "@checkstack/command-backend": "0.2.25",
-    "@checkstack/signal-common": "0.3.0",
-    "@checkstack/status-page-backend": "0.6.4",
-    "@checkstack/status-page-common": "0.6.3",
-    "@checkstack/integration-backend": "0.7.7",
-    "@checkstack/integration-common": "0.9.9",
-    "@checkstack/automation-backend": "0.11.6",
-    "@checkstack/automation-common": "0.10.1",
-    "@checkstack/common": "0.22.0",
+    "@checkstack/ai-backend": "0.11.4",
+    "@checkstack/ai-common": "0.6.7",
+    "@checkstack/backend-api": "0.34.1",
+    "@checkstack/cache-api": "0.3.20",
+    "@checkstack/cache-utils": "0.3.1",
+    "@checkstack/incident-common": "1.10.5",
+    "@checkstack/catalog-common": "2.8.1",
+    "@checkstack/catalog-backend": "1.10.1",
+    "@checkstack/notification-common": "1.8.0",
+    "@checkstack/auth-common": "0.16.0",
+    "@checkstack/command-backend": "0.2.27",
+    "@checkstack/signal-common": "0.3.1",
+    "@checkstack/status-page-backend": "0.6.6",
+    "@checkstack/status-page-common": "0.6.5",
+    "@checkstack/integration-backend": "0.7.9",
+    "@checkstack/integration-common": "0.9.10",
+    "@checkstack/automation-backend": "0.11.8",
+    "@checkstack/automation-common": "0.10.2",
+    "@checkstack/common": "0.23.0",
     "drizzle-orm": "^0.45.0",
     "zod": "^4.2.1",
     "@orpc/contract": "^1.14.4",
@@ -40,8 +40,8 @@
   },
   "devDependencies": {
     "@checkstack/drizzle-helper": "0.0.6",
-    "@checkstack/scripts": "0.7.5",
-    "@checkstack/test-utils-backend": "0.1.59",
+    "@checkstack/scripts": "0.7.6",
+    "@checkstack/test-utils-backend": "0.1.61",
     "@checkstack/tsconfig": "0.0.7",
     "@types/bun": "^1.0.0",
     "@types/pg": "^8.20.0",

package/src/notifications.test.ts

@@ -318,7 +318,13 @@ describe("notifyAffectedSystems", () => {
   });
 
   describe("update message in body", () => {
-    it("appends the escaped update message as a blockquote", async () => {
+    const bodyOf = () =>
+      (
+        mockNotificationClient.notifyForSubscription.mock
+          .calls[0] as unknown as [{ body?: string }]
+      )[0]?.body ?? "";
+
+    it("appends the update message as its own markdown block", async () => {
       await notifyAffectedSystems({
         catalogClient: mockCatalogClient as never,
         notificationClient: mockNotificationClient as never,
@@ -331,16 +337,12 @@ describe("notifyAffectedSystems", () => {
         updateMessage: "Rolled back the bad deploy, monitoring recovery.",
       });
 
-      const call = (
-        mockNotificationClient.notifyForSubscription.mock
-          .calls[0] as unknown as [{ body?: string }]
-      )[0];
-      expect(call?.body).toContain(
-        "\n\n> Rolled back the bad deploy, monitoring recovery",
+      expect(bodyOf()).toContain(
+        "\n\nRolled back the bad deploy, monitoring recovery.",
       );
     });
 
-    it("escapes markdown control characters in the message", async () => {
+    it("PRESERVES authored markdown so a link renders (the reported bug)", async () => {
       await notifyAffectedSystems({
         catalogClient: mockCatalogClient as never,
         notificationClient: mockNotificationClient as never,
@@ -350,18 +352,13 @@ describe("notifyAffectedSystems", () => {
         systemIds: ["sys-1"],
         action: "updated",
         severity: "minor",
-        updateMessage: "See [here](http://evil) **now** `code`",
+        updateMessage: "See [the status page](https://example.com/s/1) **now**",
       });
 
-      const call = (
-        mockNotificationClient.notifyForSubscription.mock
-          .calls[0] as unknown as [{ body?: string }]
-      )[0];
-      // No unescaped link/bold/code syntax survives into the body.
-      expect(call?.body).not.toContain("[here](http://evil)");
-      expect(call?.body).not.toContain("**now**");
-      expect(call?.body).toContain("\\[here\\]");
-      expect(call?.body).toContain("\\*\\*now\\*\\*");
+      const body = bodyOf();
+      expect(body).toContain("[the status page](https://example.com/s/1)");
+      expect(body).toContain("**now**");
+      expect(body).not.toContain("\\[the status page\\]");
     });
 
     it("strips non-whitespace control characters (ESC/NUL/BEL/DEL)", async () => {
@@ -377,19 +374,12 @@ describe("notifyAffectedSystems", () => {
         updateMessage: "before\u001B\u0000\u0007\u007Fafter",
       });
 
-      const call = (
-        mockNotificationClient.notifyForSubscription.mock
-          .calls[0] as unknown as [{ body?: string }]
-      )[0];
-      const blockquoteLine = (call?.body ?? "").split("\n\n> ")[1] ?? "";
-      expect(blockquoteLine).toBe("beforeafter");
-      // No control characters survive into the excerpt.
-      expect(/[\u0000-\u001F\u007F-\u009F]/u.test(blockquoteLine)).toBe(
-        false,
-      );
+      const body = bodyOf();
+      expect(body).toContain("\n\nbeforeafter");
+      expect(/[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/u.test(body.split("\n\n").at(-1) ?? "")).toBe(false);
     });
 
-    it("escapes HTML-significant < and & so markup cannot be injected", async () => {
+    it("preserves multi-line structure instead of collapsing to one line", async () => {
       await notifyAffectedSystems({
         catalogClient: mockCatalogClient as never,
         notificationClient: mockNotificationClient as never,
@@ -399,43 +389,13 @@ describe("notifyAffectedSystems", () => {
         systemIds: ["sys-1"],
         action: "updated",
         severity: "minor",
-        updateMessage: "watch <img onerror=x> & <script>",
+        updateMessage: "- rolled back\n- monitoring",
       });
 
-      const call = (
-        mockNotificationClient.notifyForSubscription.mock
-          .calls[0] as unknown as [{ body?: string }]
-      )[0];
-      const blockquoteLine = (call?.body ?? "").split("\n\n> ")[1] ?? "";
-      expect(blockquoteLine).not.toContain("<");
-      expect(blockquoteLine).toContain("&lt;img");
-      expect(blockquoteLine).toContain("&amp;");
-    });
-
-    it("collapses newlines so the message cannot break out of the blockquote", async () => {
-      await notifyAffectedSystems({
-        catalogClient: mockCatalogClient as never,
-        notificationClient: mockNotificationClient as never,
-        logger: mockLogger as never,
-        incidentId: "inc-1",
-        incidentTitle: "API Outage",
-        systemIds: ["sys-1"],
-        action: "updated",
-        severity: "minor",
-        updateMessage: "line one\n\nline two\ninjected",
-      });
-
-      const call = (
-        mockNotificationClient.notifyForSubscription.mock
-          .calls[0] as unknown as [{ body?: string }]
-      )[0];
-      const blockquoteLine = (call?.body ?? "").split("\n\n> ")[1] ?? "";
-      expect(blockquoteLine).not.toContain("\n");
-      expect(blockquoteLine).toBe("line one line two injected");
+      expect(bodyOf()).toContain("\n\n- rolled back\n- monitoring");
     });
 
     it("truncates an over-long message to a bounded length", async () => {
-      const longMessage = "a".repeat(1000);
       await notifyAffectedSystems({
         catalogClient: mockCatalogClient as never,
         notificationClient: mockNotificationClient as never,
@@ -445,20 +405,15 @@ describe("notifyAffectedSystems", () => {
         systemIds: ["sys-1"],
         action: "updated",
         severity: "minor",
-        updateMessage: longMessage,
+        updateMessage: "a".repeat(1000),
       });
 
-      const call = (
-        mockNotificationClient.notifyForSubscription.mock
-          .calls[0] as unknown as [{ body?: string }]
-      )[0];
-      const blockquoteLine = (call?.body ?? "").split("\n\n> ")[1] ?? "";
-      expect(blockquoteLine.endsWith("...")).toBe(true);
-      // 500 chars + the "..." indicator.
-      expect(blockquoteLine.length).toBeLessThanOrEqual(503);
+      const block = bodyOf().split("\n\n").at(-1) ?? "";
+      expect(block.endsWith("...")).toBe(true);
+      expect(block.length).toBeLessThanOrEqual(503);
     });
 
-    it("omits the blockquote entirely for a blank/whitespace message", async () => {
+    it("appends no extra block for a blank/whitespace message", async () => {
       await notifyAffectedSystems({
         catalogClient: mockCatalogClient as never,
         notificationClient: mockNotificationClient as never,
@@ -471,14 +426,11 @@ describe("notifyAffectedSystems", () => {
         updateMessage: "   \n  ",
       });
 
-      const call = (
-        mockNotificationClient.notifyForSubscription.mock
-          .calls[0] as unknown as [{ body?: string }]
-      )[0];
-      expect(call?.body).not.toContain("\n\n>");
+      // No suffix -> the body is a single paragraph with no block separator.
+      expect(bodyOf().includes("\n\n")).toBe(false);
     });
 
-    it("omits the blockquote when no message is provided", async () => {
+    it("appends nothing when no message is provided", async () => {
       await notifyAffectedSystems({
         catalogClient: mockCatalogClient as never,
         notificationClient: mockNotificationClient as never,
@@ -490,11 +442,7 @@ describe("notifyAffectedSystems", () => {
         severity: "minor",
       });
 
-      const call = (
-        mockNotificationClient.notifyForSubscription.mock
-          .calls[0] as unknown as [{ body?: string }]
-      )[0];
-      expect(call?.body).not.toContain("\n\n>");
+      expect(bodyOf().includes("\n\n")).toBe(false);
     });
   });
 

package/src/status-page-widget.test.ts

@@ -62,17 +62,36 @@ interface IncidentFixture {
   systemIds: string[];
   createdAt: string;
   updatedAt: string;
+  description?: string;
+}
+
+interface UpdateFixture {
+  message: string;
+  statusChange?: string;
+  createdAt: string;
+  /** "public" | "logged_in" | "internal" — only public reaches the page. */
+  visibility: string;
+  /** Internal author identity that must NEVER reach the public detail page. */
+  createdBy?: string;
+  createdByName?: string;
 }
 
 function makeCtx(args: {
   publishedEnvironmentIds?: string[];
   incidents?: IncidentFixture[];
+  /** incidentId -> its full internal update timeline (the bulk-fetch source). */
+  updatesById?: Record<string, UpdateFixture[]>;
   /** environmentId -> member system ids (the catalog env->systems mapping). */
   envSystems?: Record<string, string[]>;
   systems?: Array<{ id: string; name: string }>;
 }): WidgetResolveContext {
-  const { publishedEnvironmentIds, incidents = [], envSystems = {}, systems = [] } =
-    args;
+  const {
+    publishedEnvironmentIds,
+    incidents = [],
+    updatesById = {},
+    envSystems = {},
+    systems = [],
+  } = args;
   const memo = new Map<string, Promise<unknown>>();
   const api = {
     resolveEnvironments: async ({
@@ -92,7 +111,15 @@ function makeCtx(args: {
     getGroups: async () => [],
     getSystems: async () => ({ systems }),
     listIncidents: async () => ({ incidents }),
-    getBulkIncidentUpdates: async () => ({ updates: {} }),
+    getBulkIncidentUpdates: async ({
+      incidentIds,
+    }: {
+      incidentIds: string[];
+    }) => {
+      const updates: Record<string, UpdateFixture[]> = {};
+      for (const id of incidentIds) updates[id] = updatesById[id] ?? [];
+      return { updates };
+    },
   };
   return {
     rpcClient: {
@@ -196,3 +223,92 @@ describe("incidents widget — environment filtering", () => {
     expect(result.incidents[0]?.systems).toEqual(["Prod System"]);
   });
 });
+
+// ---------------------------------------------------------------------------
+// resolveDetail — the individual incident page. Unlike the summary block, it
+// returns ALL public updates (never capped by `maxUpdates`) and the incident's
+// description (Items 4/5/6), while keeping the same scope gate + createdBy strip.
+// ---------------------------------------------------------------------------
+
+describe("incidents widget — resolveDetail (full detail page)", () => {
+  const systems = [{ id: "s1", name: "System One" }];
+  const incident: IncidentFixture = {
+    id: "inc-1",
+    title: "API outage",
+    status: "monitoring",
+    severity: "major",
+    systemIds: ["s1"],
+    createdAt: "2026-07-01T00:00:00Z",
+    updatedAt: "2026-07-02T00:00:00Z",
+    description: "Full **markdown** postmortem body.",
+  };
+  // Five public updates + one internal one. The block caps to maxUpdates (1);
+  // the detail page must return every PUBLIC update and drop the internal one.
+  const updatesById = {
+    "inc-1": [
+      { message: "u1 public", statusChange: "investigating", createdAt: "2026-07-01T01:00:00Z", visibility: "public", createdBy: "op-1", createdByName: "Alice" },
+      { message: "u2 public", statusChange: "identified", createdAt: "2026-07-01T02:00:00Z", visibility: "public" },
+      { message: "u3 internal only", createdAt: "2026-07-01T02:30:00Z", visibility: "internal" },
+      { message: "u4 public", statusChange: "fixing", createdAt: "2026-07-01T03:00:00Z", visibility: "public" },
+      { message: "u5 public", createdAt: "2026-07-01T04:00:00Z", visibility: "public" },
+      { message: "u6 public", statusChange: "monitoring", createdAt: "2026-07-01T05:00:00Z", visibility: "public" },
+    ],
+  };
+
+  test("returns ALL public updates (ignoring the block's maxUpdates cap) + description", async () => {
+    const widget = capture();
+    const detail = (await widget.resolveDetail!({
+      id: "inc-1",
+      // maxUpdates: 1 would cap the BLOCK to one update; the detail page ignores it.
+      config: { systemIds: ["s1"], maxUpdates: 1 },
+      ctx: makeCtx({ incidents: [incident], updatesById, systems }),
+    })) as {
+      description?: string;
+      updates: Array<{ message: string; statusChange?: string }>;
+    } | null;
+    if (!detail) throw new Error("expected detail");
+    // All FIVE public updates, most-recent first; the internal one is dropped.
+    expect(detail.updates.map((u) => u.message)).toEqual([
+      "u6 public",
+      "u5 public",
+      "u4 public",
+      "u2 public",
+      "u1 public",
+    ]);
+    // createdBy / createdByName never reach the public DTO.
+    expect(JSON.stringify(detail.updates)).not.toContain("Alice");
+    expect(detail.description).toBe("Full **markdown** postmortem body.");
+  });
+
+  test("returns null for an id the page does not surface (anti-enumeration gate)", async () => {
+    const widget = capture();
+    const detail = await widget.resolveDetail!({
+      id: "some-other-incident",
+      config: { systemIds: ["s1"] },
+      ctx: makeCtx({ incidents: [incident], updatesById, systems }),
+    });
+    expect(detail).toBeNull();
+  });
+
+  test("returns null when nothing is bound (fail closed, no read)", async () => {
+    const widget = capture();
+    expect(
+      await widget.resolveDetail!({ id: "inc-1", config: {}, ctx: noReadCtx }),
+    ).toBeNull();
+  });
+
+  test("omits description when the incident has none", async () => {
+    const widget = capture();
+    const detail = (await widget.resolveDetail!({
+      id: "inc-1",
+      config: { systemIds: ["s1"] },
+      ctx: makeCtx({
+        incidents: [{ ...incident, description: undefined }],
+        updatesById,
+        systems,
+      }),
+    })) as { description?: string } | null;
+    if (!detail) throw new Error("expected detail");
+    expect(detail.description).toBeUndefined();
+  });
+});

package/src/status-page-widget.ts

@@ -4,6 +4,7 @@ import {
   pluginMetadata as statusPagePluginMetadata,
   IncidentsConfigSchema,
   IncidentsDtoSchema,
+  IncidentDtoItemSchema,
   toPublicUpdate,
   selectEvents,
   resolveEventFeedScope,
@@ -84,18 +85,26 @@ function iso(value: string | Date): string {
   return value instanceof Date ? value.toISOString() : String(value);
 }
 
-/** Newest `max` updates, most-recent first (the current progress at the top). */
-function latestUpdates(updates: InternalUpdate[], max: number): PublicUpdate[] {
-  return updates
+/**
+ * Public updates, most-recent first (the current progress at the top). `max`
+ * caps the list for the summary BLOCK; omit it (the detail page) to return ALL
+ * updates.
+ */
+function latestUpdates(
+  updates: InternalUpdate[],
+  max?: number,
+): PublicUpdate[] {
+  const sorted = updates
     // The public status page is anonymous: only `public`-visibility updates may
     // appear. `logged_in` / `internal` updates are filtered out here so they
     // never reach the unauthenticated projection (Item 3/5).
     .filter((u) => u.visibility === "public")
     .toSorted(
       (a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime(),
-    )
-    .slice(0, max)
-    .map((u) => toPublicUpdate(u));
+    );
+  return (max === undefined ? sorted : sorted.slice(0, max)).map((u) =>
+    toPublicUpdate(u),
+  );
 }
 
 async function labelsFor(
@@ -219,6 +228,41 @@ const incidents: WidgetTypeDefinition = {
     });
     return IncidentsDtoSchema.parse({ incidents: items });
   },
+  // Full detail for the individual incident page: the ONE incident's ALL public
+  // updates (no `maxUpdates` cap) + its description. Scope-checked the same way
+  // as resolvePublic; returns null for an out-of-scope / unknown id.
+  async resolveDetail({ id, config, ctx }) {
+    const c = IncidentsConfigSchema.parse(config);
+    const bound = await effectiveScope(c, ctx);
+    if (bound.size === 0) return null;
+    const inc = ctx.rpcClient.forPlugin(IncidentApi);
+    // includeResolved so a resolved incident's page still loads; the status-page
+    // gate has already confirmed this id is surfaced by the page.
+    const { incidents: all } = await inc.listIncidents({ includeResolved: true });
+    const found = all.find(
+      (i) => i.id === id && i.systemIds.some((s) => bound.has(s)),
+    );
+    if (!found) return null;
+    const names = await labelsFor(ctx, [...bound]);
+    const labelOf = (sid: string): string | undefined =>
+      bound.has(sid) ? (c.systemLabels[sid] ?? names.get(sid) ?? sid) : undefined;
+    const bulk = await inc.getBulkIncidentUpdates({ incidentIds: [id] });
+    const updates = latestUpdates(bulk.updates?.[id] ?? []);
+    const resolved = found.status === "resolved";
+    return IncidentDtoItemSchema.parse({
+      id: found.id,
+      title: found.title,
+      status: found.status,
+      severity: found.severity,
+      systems: found.systemIds
+        .map((sid) => labelOf(sid))
+        .filter((l): l is string => l !== undefined),
+      startedAt: iso(found.createdAt),
+      ...(resolved ? { resolvedAt: iso(found.updatedAt) } : {}),
+      ...(found.description ? { description: found.description } : {}),
+      updates,
+    });
+  },
 };
 
 /** Register the incident-owned status-page widget under the `statuspage.*` namespace. */