@conduction/nextcloud-vue 2.108.0 → 2.109.0

package/src/schemas/app-manifest-v2.schema.json

@@ -3,7 +3,7 @@
 	"$id": "https://raw.githubusercontent.com/ConductionNL/nextcloud-vue/main/src/schemas/app-manifest-v2.schema.json",
 	"title": "Conduction App Manifest v2",
 	"description": "v2 schema for the JSON-driven page and navigation manifest consumed by @conduction/nextcloud-vue. Introduces a uniform widgets[] array on every page type with a per-slot grid coordinate system, a typed actions[] discriminator, and the required $schema field for version detection. v1 manifests continue to validate against app-manifest.schema.json (unchanged).",
-	"version": "2.132.0",
+	"version": "2.133.0",
 	"type": "object",
 	"required": ["$schema", "version"],
 	"allOf": [
@@ -594,7 +594,10 @@
 						"responsePath": { "type": "string", "minLength": 1, "description": "Where the rows sit in the answer." },
 						"valueField": { "type": "string", "minLength": 1 },
 						"labelField": { "type": "string", "minLength": 1 },
-						"groupField": { "type": "string", "minLength": 1, "description": "Groups the options by this field, groups in the order they first appear (form-small-features)." }
+						"groupField": { "type": "string", "minLength": 1, "description": "Groups the options by this field, groups in the order they first appear (form-small-features)." },
+						"where": { "type": "object", "description": "Keep the rows whose fields equal these values; a value may be `@answer.<key>`, another field of the form (object-list-edit-in-place)." },
+						"itemsPath": { "type": "string", "minLength": 1, "description": "Read the options from the list at this path in each row (object-list-edit-in-place)." },
+						"hideWhenEmpty": { "type": "boolean", "description": "Leave the field out while the source gives no options (object-list-edit-in-place)." }
 					}
 				},
 				{
@@ -607,7 +610,10 @@
 						"filter": { "type": "object", "description": "Filters on the objects, as a list filter takes them." },
 						"valueField": { "type": "string", "minLength": 1 },
 						"labelField": { "type": "string", "minLength": 1 },
-						"groupField": { "type": "string", "minLength": 1, "description": "Groups the options by this field, groups in the order they first appear (form-small-features)." }
+						"groupField": { "type": "string", "minLength": 1, "description": "Groups the options by this field, groups in the order they first appear (form-small-features)." },
+						"where": { "type": "object", "description": "Keep the rows whose fields equal these values; a value may be `@answer.<key>`, another field of the form (object-list-edit-in-place)." },
+						"itemsPath": { "type": "string", "minLength": 1, "description": "Read the options from the list at this path in each row (object-list-edit-in-place)." },
+						"hideWhenEmpty": { "type": "boolean", "description": "Leave the field out while the source gives no options (object-list-edit-in-place)." }
 					}
 				}
 			]
@@ -2343,6 +2349,115 @@
 						}
 					}
 				},
+				{
+					"description": "decision-list built-in widget (CnDecisionListWidget): per-row sign-offs, each with an answer, its fields and a reason, sent to an app endpoint (2.133.0). Texts go through the host translate.",
+					"if": {
+						"properties": { "widgetKey": { "const": "decision-list" } },
+						"required": ["widgetKey"]
+					},
+					"then": {
+						"properties": {
+							"props": {
+								"type": "object",
+								"properties": {
+									"content": {
+										"type": "object",
+										"properties": {
+											"source": { "type": "object", "additionalProperties": true, "description": "An endpointSource: `url`, `params?`, `responsePath?`." },
+											"itemsPath": { "type": "string", "minLength": 1},
+											"idField": { "type": "string", "minLength": 1},
+											"title": { "type": "string", "description": "A template filled from a row." },
+											"meta": { "type": "string", "description": "A template filled from a row." },
+											"answers": { "type": "array", "items": { "type": "object", "required": ["value", "label"], "additionalProperties": true, "properties": { "value": {}, "label": { "type": "string", "minLength": 1}, "fields": { "type": "array", "items": { "type": "object", "required": ["field"], "additionalProperties": true, "properties": { "field": { "type": "string", "minLength": 1}, "type": { "type": "string", "enum": ["date", "text"] }, "label": { "type": "string" }, "required": { "type": "boolean" } }} }} }},
+											"reason": { "description": "`{ label?, required?, field? }` (required by default, sent as `field`, default `reason`); `false` drops it.", "anyOf": [{ "type": "boolean", "const": false}, { "type": "object", "additionalProperties": false, "properties": { "label": { "type": "string" }, "required": { "type": "boolean" }, "field": { "type": "string", "minLength": 1} }}] },
+											"submit": { "type": "object", "required": ["request"], "additionalProperties": true, "properties": { "label": { "type": "string" }, "request": { "type": "object", "required": ["url"], "additionalProperties": true, "properties": { "method": { "type": "string", "minLength": 1}, "url": { "type": "string", "minLength": 1}, "body": { "type": "object", "additionalProperties": true} }} }},
+											"answerField": { "type": "string", "minLength": 1},
+											"emptyText": { "type": "string" },
+											"errorTitle": { "type": "string" },
+											"answerLabel": { "type": "string" }
+										}
+									}
+								}
+							}
+						}
+					}
+				},
+				{
+					"description": "retention built-in widget (CnRetentionWidget): a record's stored retention, and a recompute for archivists (2.133.0). Texts go through the host translate.",
+					"if": {
+						"properties": { "widgetKey": { "const": "retention" } },
+						"required": ["widgetKey"]
+					},
+					"then": {
+						"properties": {
+							"props": {
+								"type": "object",
+								"properties": {
+									"content": {
+										"type": "object",
+										"properties": {
+											"title": { "type": "string" },
+											"subtitle": { "type": "string" },
+											"statusField": { "type": "string", "minLength": 1},
+											"archivedValues": { "type": "array", "items": { "type": "string" } },
+											"archivistGroups": { "type": "array", "items": { "type": "string", "minLength": 1}, "description": "Groups that may recompute (default [\"archivaris\"]; admins always may)." },
+											"recompute": { "type": "boolean", "description": "false hides the recompute control." }
+										}
+									}
+								}
+							}
+						}
+					}
+				},
+				{
+					"description": "plan built-in widget (CnPlanWidget): a record's planned steps from OpenRegister's case layer (2.133.0).",
+					"if": {
+						"properties": { "widgetKey": { "const": "plan" } },
+						"required": ["widgetKey"]
+					},
+					"then": {
+						"properties": {
+							"props": {
+								"type": "object",
+								"properties": {
+									"content": {
+										"type": "object",
+										"properties": {
+											"emptyText": { "type": "string", "description": "Through the host translate." }
+										}
+									}
+								}
+							}
+						}
+					}
+				},
+				{
+					"description": "work-queue built-in widget (CnWorkQueue): one queue of everything waiting on the reader, in groups that can be hidden until tomorrow (2.133.0).",
+					"if": {
+						"properties": { "widgetKey": { "const": "work-queue" } },
+						"required": ["widgetKey"]
+					},
+					"then": {
+						"properties": {
+							"props": {
+								"type": "object",
+								"properties": {
+									"content": {
+										"type": "object",
+										"properties": {
+											"source": { "type": "object", "additionalProperties": true, "description": "An endpointSource answering `{ groups, hiddenGroups?, unavailable? }`." },
+											"hide": { "type": "string", "minLength": 1, "description": "A url template with `{group}` that hides a group until tomorrow." },
+											"show": { "type": "string", "minLength": 1, "description": "A url template with `{group}` that shows a hidden group again." },
+											"itemHref": { "type": "string", "minLength": 1, "description": "A template filled from an item, for items without `route` or `href`." },
+											"waitingParties": { "type": "object", "additionalProperties": { "type": "string" } },
+											"emptyText": { "type": "string" }
+										}
+									}
+								}
+							}
+						}
+					}
+				},
 				{
 					"description": "audit-trail built-in widget (CnAuditTrailWidget, Wave 1): the object change-log card. All props are optional — register/schema/objectId normally arrive via the detail-page object-context merge; explicit props win.",
 					"if": {
@@ -5287,6 +5402,7 @@
 							}
 						},
 						"search": { "type": "boolean", "default": true, "description": "type='index': `false` draws no inline search in the actions bar, also in the board look, which otherwise draws one on every index page. Wins over `inlineSearch` (2.127.0)." },
+						"searchRefusalHint": { "type": "string", "description": "type='index': what to do after a refused search, through the app's translate; the default explains AND, OR, NOT and quotes (2.133.0)." },
 						"searchPlacement": { "type": "string", "enum": ["", "toolbar"], "default": "", "description": "type='index', board look: where the search field sits. `toolbar` puts it on row 1 before the Filter button and the view switch instead of opening row 2 (DqTeamwachtrij, 2.127.0)." },
 						"sortSelectOptions": { "type": "array", "description": "type='index': the orders the index sidebar's Sort section offers in the list, card and map views, `{ value, label, order?, default?, source? }`. An option with a `source` takes its rows from an app endpoint, in that endpoint's order, for an order the server cannot sort by; the page's search, sidebar filters and pager run over those rows in the browser, and it is chosen by its value. `default: true` opens the page on it unless the address carries an order; a column header click in the table view leaves it. When the endpoint fails the list falls back to the option's `order` and shows `failedNote` (2.131.0).", "items": { "type": "object", "required": ["value", "label"], "properties": { "value": { "type": "string", "minLength": 1 }, "label": { "type": "string", "minLength": 1 }, "order": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "object" }, { "type": "array" } ] }, "default": { "type": "boolean" }, "source": { "type": "object", "required": ["url"], "additionalProperties": false, "properties": { "url": { "type": "string", "minLength": 1, "description": "An app path, resolved with generateUrl and fetched with the session." }, "params": { "type": "object", "description": "Query parameters sent with the request." }, "rowsPath": { "type": "string", "minLength": 1, "description": "Where the entries sit in the answer; `results` by default, a bare array as is." }, "rowPath": { "type": "string", "minLength": 1, "description": "Where each entry carries its row; entries without one are left out." }, "carry": { "type": "array", "items": { "type": "string", "minLength": 1 }, "description": "Entry fields copied onto each row, such as a tier a card's head pill reads." }, "idPath": { "type": "string", "minLength": 1, "description": "The row's identity for `annotate`; `id` by default." }, "annotate": { "type": "boolean", "description": "Copy the carried fields onto the rows of every other order too, matched on idPath." }, "searchFields": { "type": "array", "items": { "type": "string", "minLength": 1 }, "description": "The fields the search box matches; every top-level text by default." }, "failedNote": { "type": "string", "minLength": 1, "description": "Shown above the list when the endpoint failed and the option's order stands in, through the app's translate." } } } } } },
 						"defaultOrder": { "description": "type='index', self-fetch: the order the page opens on when neither the address nor sortKeys gives one: `\"-createdAt\"`, `\"priority:desc,title\"`, an `_order` map or a `[{ key, order }]` list (2.127.0).", "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "object", "additionalProperties": { "type": "string", "enum": ["asc", "desc", "ASC", "DESC"] } }, { "type": "array", "items": { "type": "object", "required": ["key"], "properties": { "key": { "type": "string", "minLength": 1 }, "order": { "type": "string", "enum": ["asc", "desc"] } } } } ] },

package/src/utils/actionsDispatcher.js

@@ -1021,7 +1021,12 @@ export function dispatchAction(action, context = {}) {
 			if (op === 'delete') {
 				return store.deleteObject(type, id)
 			}
-			// patch: the row's object merged with the action's values.
+			// patch: only the action's values, as a PATCH, so every other key
+			// keeps its stored value. A store without patchObject writes the
+			// row's object merged with the values.
+			if (typeof store.patchObject === 'function') {
+				return store.patchObject(type, id, { ...(action.values || {}) })
+			}
 			return store.saveObject(type, { ...row, ...(action.values || {}), id })
 		}
 

package/src/utils/builtInModals.js

@@ -13,13 +13,15 @@ import { defineAsyncComponent } from 'vue'
 /**
  * The built-in modals, as registry entries (`{ kind: 'modal', component }`):
  * `CnActionDialog`, the generic summary, checklist, reason and confirm dialog,
- * its `config` in the action's `props`. Loaded on first open.
+ * and `CnAssignDialog`, hand a record to another user or team; each takes its
+ * `config` in the action's `props`. Loaded on first open.
  *
  * @type {Readonly<Record<string, {kind: string, component: object}>>}
  * @spec openspec/changes/action-dialog/specs/action-dialog/spec.md#requirement-a-manifest-configures-an-action-dialog
  */
 export const BUILT_IN_MODALS = Object.freeze({
 	CnActionDialog: { kind: 'modal', component: defineAsyncComponent(() => import('../components/CnActionDialog/CnActionDialog.vue')) },
+	CnAssignDialog: { kind: 'modal', component: defineAsyncComponent(() => import('../components/CnAssignDialog/CnAssignDialog.vue')) },
 })
 
 /**

package/src/utils/duplicateWarning.js

@@ -0,0 +1,59 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * What a duplicate warning offers, decided in one place, and the candidate an
+ * app sends to OpenRegister's duplicate check. None of this enforces
+ * anything: the server refuses a duplicate on the write. These helpers make
+ * sure the user is told before pressing Create rather than after.
+ *
+ * @module utils/duplicateWarning
+ */
+
+/**
+ * What the duplicate warning shows and which buttons it offers.
+ *
+ * A policy other than `block` reads as `warn`, as on the server. `checked:
+ * false` means the check never answered: nothing is shown, because the write
+ * still refuses a real duplicate.
+ *
+ * @spec openspec/changes/duplicate-warning/specs/duplicate-warning/spec.md#requirement-a-generic-duplicate-warning
+ * @param {object} state The state to decide from.
+ * @param {Array<object>} [state.matches] The scored matches.
+ * @param {boolean} [state.checked] Whether the check ran (default true).
+ * @param {string} [state.policy] `warn` or `block`.
+ * @param {boolean} [state.mayOverride] Whether this account may file over a block.
+ * @return {{show: boolean, blocked: boolean, mayContinue: boolean, needsReason: boolean}} What to draw.
+ */
+export function duplicateAffordances(state) {
+	const source = state || {}
+	const matches = Array.isArray(source.matches) ? source.matches : []
+	const show = source.checked !== false && matches.length > 0
+	const blocked = show && source.policy === 'block'
+	const mayOverride = source.mayOverride === true
+	return {
+		show,
+		blocked,
+		mayContinue: show && (!blocked || mayOverride),
+		needsReason: blocked && mayOverride,
+	}
+}
+
+/**
+ * The candidate to send to the duplicate check, without blank fields.
+ *
+ * OpenRegister scores two empty strings as a match, and a form sends `''`
+ * for every field nobody filled in, so blanks would match almost everything.
+ *
+ * @spec openspec/changes/duplicate-warning/specs/duplicate-warning/spec.md#requirement-a-generic-duplicate-warning
+ * @param {object} payload The form's values.
+ * @return {object} The candidate.
+ */
+export function candidateWithoutBlanks(payload) {
+	return Object.fromEntries(Object.entries(payload || {}).filter(([, value]) => {
+		if (value === null || value === undefined || value === '') {
+			return false
+		}
+		return !Array.isArray(value) || value.length > 0
+	}))
+}

package/src/utils/errors.js

@@ -9,6 +9,7 @@ import { translateValidationMessage } from './validationMessages.js'
  * @property {object|null} details Validation errors or additional details
  * @property {boolean} isValidation Whether this is a validation error (400/422)
  * @property {object|null} fields Per-field validation errors
+ * @property {number|null} [position] The 1-based character a refused search term stopped at (400 only)
  */
 
 /**
@@ -62,6 +63,7 @@ export async function parseResponseError(response, type) {
 	const status = response.status
 	let details = null
 	let fields = null
+	let position = null
 	let message
 
 	try {
@@ -74,6 +76,7 @@ export async function parseResponseError(response, type) {
 		} else if (body && typeof body === 'object') {
 			details = body.errors || body.error || body.message || null
 			fields = body.validationErrors || body.errors || null
+			position = Number.isInteger(body.position) && body.position > 0 ? body.position : null
 		}
 	} catch {
 		// Response body is not JSON
@@ -88,6 +91,7 @@ export async function parseResponseError(response, type) {
 				details,
 				isValidation: true,
 				fields,
+				position,
 				toString() {
 					return this.message
 				},

package/src/utils/libraryWidgetKeys.js

@@ -59,6 +59,7 @@ export const BUILT_IN_WIDGET_KEYS = Object.freeze([
 	'form-renderer',
 	'map-viewer',
 	'notice',
+	'decision-list',
 	'object-geo',
 	'card-grid',
 	'nav-card-grid',
@@ -134,10 +135,12 @@ export const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'object-table',
 	'party-actions',
 	'people',
+	'plan',
 	'quicklinks',
 	'radio-cards',
 	'record-list',
 	'related',
+	'retention',
 	'saved-view',
 	'saved-views',
 	'sections',
@@ -159,6 +162,7 @@ export const DASHBOARD_CATALOG_WIDGET_KEYS = Object.freeze([
 	'video',
 	'week-strip',
 	'working-calendar',
+	'work-queue',
 	'workspace-filter',
 ])
 

package/src/utils/openDuplicateWarning.js

@@ -0,0 +1,35 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Open CnDuplicateWarning from code (a create override, a store action) and
+ * wait for the user's answer.
+ *
+ * @module utils/openDuplicateWarning
+ */
+
+import { createApp } from 'vue'
+import CnDuplicateWarning from '../components/CnDuplicateWarning/CnDuplicateWarning.vue'
+
+/**
+ * Mount the warning on the page and resolve with the decision: `{ reason,
+ * over }` when the user files anyway, null when they cancel.
+ *
+ * @spec openspec/changes/duplicate-warning/specs/duplicate-warning/spec.md#requirement-a-generic-duplicate-warning
+ * @param {object} props CnDuplicateWarning's props (`matches`, `records`, `policy`, `mayOverride`, ...).
+ * @return {Promise<{reason: string, over: Array<string>}|null>} The decision.
+ */
+export function openDuplicateWarning(props) {
+	return new Promise((resolve) => {
+		const host = document.createElement('div')
+		document.body.appendChild(host)
+		let app = null
+		const finish = (decision) => {
+			app.unmount()
+			host.remove()
+			resolve(decision)
+		}
+		app = createApp(CnDuplicateWarning, { ...(props || {}), onClose: () => finish(null), onFile: (decision) => finish(decision) })
+		app.mount(host)
+	})
+}

package/src/utils/optionsFrom.js

@@ -113,7 +113,7 @@ export async function loadOptionsFrom(from, ctx = {}) {
 		return []
 	}
 	const data = await fetchEndpointSource(source, ctx, { force: true })
-	const rows = Array.isArray(data) ? data : []
+	const rows = narrowRows(Array.isArray(data) ? data : [], from)
 	const seen = new Set()
 	const out = []
 	for (const row of rows) {
@@ -131,6 +131,73 @@ export async function loadOptionsFrom(from, ctx = {}) {
 	return out
 }
 
+/**
+ * The rows a source answers, narrowed: `where` keeps the rows whose fields
+ * equal its values (`{ type: 'string' }`), and `itemsPath` replaces each
+ * remaining row by the list at that path (the formats of one property type).
+ *
+ * @param {Array<unknown>} rows The rows.
+ * @param {{where?: object, itemsPath?: string}} from The `optionsFrom` block.
+ * @return {Array<unknown>} The rows the options are read from.
+ */
+function narrowRows(rows, from) {
+	let out = rows
+	if (isPlainObject(from.where)) {
+		out = out.filter((row) => row && typeof row === 'object' && Object.entries(from.where).every(([key, value]) => String(readPath(row, key)) === String(value)))
+	}
+	if (typeof from.itemsPath === 'string' && from.itemsPath !== '') {
+		out = out.flatMap((row) => {
+			const items = readPath(row, from.itemsPath)
+			return Array.isArray(items) ? items : []
+		})
+	}
+	return out
+}
+
+/**
+ * An `optionsFrom` block with every `@answer.<key>` string replaced by that
+ * form value, so a source can depend on another field (`where: { type:
+ * '@answer.propertyType' }`). A value the form does not hold becomes ''.
+ *
+ * @param {unknown} value The block, or a part of it.
+ * @param {object} formData The form values.
+ * @return {unknown} The block with the form values filled in.
+ */
+export function resolveFormTokens(value, formData) {
+	if (typeof value === 'string' && value.startsWith('@answer.')) {
+		const held = (formData || {})[value.slice('@answer.'.length)]
+		return held === undefined || held === null ? '' : held
+	}
+	if (Array.isArray(value)) {
+		return value.map((v) => resolveFormTokens(v, formData))
+	}
+	if (isPlainObject(value)) {
+		return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, resolveFormTokens(v, formData)]))
+	}
+	return value
+}
+
+/**
+ * The form fields an `optionsFrom` block reads through `@answer.<key>`.
+ *
+ * @param {unknown} from The block.
+ * @return {Array<string>} The keys.
+ */
+export function formTokenKeys(from) {
+	const keys = new Set()
+	const walk = (v) => {
+		if (typeof v === 'string' && v.startsWith('@answer.')) {
+			keys.add(v.slice('@answer.'.length))
+		} else if (Array.isArray(v)) {
+			v.forEach(walk)
+		} else if (isPlainObject(v)) {
+			Object.values(v).forEach(walk)
+		}
+	}
+	walk(from)
+	return [...keys]
+}
+
 /**
  * The options whose label holds the query, ignoring case. An empty query
  * keeps them all.

package/src/utils/planTree.js

@@ -0,0 +1,54 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The plan rows of OpenRegister's case layer as a tree, and the moves a
+ * user may ask for on one item. The moves are advisory: OpenRegister decides.
+ *
+ * @module utils/planTree
+ */
+
+/** Plan item states after which nothing more can happen. */
+export const TERMINAL_STATES = ['completed', 'terminated', 'disabled']
+
+/**
+ * The plan rows as a tree: stages with their items, each level by position.
+ *
+ * @param {Array<object>} items The plan rows (`id`, `parentItemId`, `position`).
+ * @return {Array<object>} The roots, each with `children`.
+ */
+export function planTree(items) {
+	const rows = Array.isArray(items) ? items : []
+	const byId = new Map(rows.map((row) => [row.id, { ...row, children: [] }]))
+	const roots = []
+	for (const row of rows) {
+		const node = byId.get(row.id)
+		const parent = row.parentItemId === null || row.parentItemId === undefined ? undefined : byId.get(row.parentItemId)
+		if (parent === undefined) {
+			roots.push(node)
+		} else {
+			parent.children.push(node)
+		}
+	}
+	const byPosition = (a, b) => (a.position ?? 0) - (b.position ?? 0)
+	for (const node of byId.values()) {
+		node.children.sort(byPosition)
+	}
+	return roots.sort(byPosition)
+}
+
+/**
+ * The target states a user may ask for. Advisory only: OpenRegister decides.
+ *
+ * @param {object} item The plan item.
+ * @return {string[]} The targets.
+ */
+export function offeredTransitions(item) {
+	if (!item || TERMINAL_STATES.includes(item.state)) {
+		return []
+	}
+	if (item.type === 'milestone') {
+		return item.state === 'available' ? ['completed', 'terminated'] : []
+	}
+	return item.state === 'active' ? ['completed', 'terminated'] : ['terminated']
+}

package/src/utils/redactionSegments.js

@@ -0,0 +1,50 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * A document text cut into plain and marked segments, for the redaction
+ * editor to draw the passages in place.
+ *
+ * @module utils/redactionSegments
+ */
+
+/**
+ * The text as segments: plain ones and marked ones carrying the passage's
+ * verdict (`open` before it has one). Where passages overlap the longest wins,
+ * and every occurrence of a passage is marked.
+ *
+ * @param {string} text The document text.
+ * @param {Array<{value: string, verdict: (string|null)}>} passages The passages.
+ * @return {Array<{text: string, verdict: (string|null)}>} The segments.
+ */
+export function redactionSegments(text, passages) {
+	const source = String(text || '')
+	const ranges = []
+	const ordered = (Array.isArray(passages) ? passages : [])
+		.filter((passage) => passage && String(passage.value || '') !== '')
+		.sort((left, right) => right.value.length - left.value.length)
+	for (const passage of ordered) {
+		let from = source.indexOf(passage.value)
+		while (from !== -1) {
+			const to = from + passage.value.length
+			if (ranges.every((range) => to <= range.from || from >= range.to)) {
+				ranges.push({ from, to, verdict: passage.verdict || 'open' })
+			}
+			from = source.indexOf(passage.value, to)
+		}
+	}
+	ranges.sort((left, right) => left.from - right.from)
+	const segments = []
+	let at = 0
+	for (const range of ranges) {
+		if (range.from > at) {
+			segments.push({ text: source.slice(at, range.from), verdict: null })
+		}
+		segments.push({ text: source.slice(range.from, range.to), verdict: range.verdict })
+		at = range.to
+	}
+	if (at < source.length) {
+		segments.push({ text: source.slice(at), verdict: null })
+	}
+	return segments
+}

package/src/utils/registerNcDashboardWidgets.js

@@ -0,0 +1,57 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Register an app's Nextcloud Dashboard widgets from configuration.
+ *
+ * @module utils/registerNcDashboardWidgets
+ */
+
+import { translate } from '@nextcloud/l10n'
+import { createApp } from 'vue'
+import CnNcDashboardList from '../components/CnNcDashboardList/CnNcDashboardList.vue'
+
+/**
+ * Register each widget with `OCA.Dashboard.register(id, …)`. A widget mounts
+ * CnNcDashboardList with its `config`, or its own `component` with `props`
+ * and the widget's `title`, as its own Vue app with the app's translate provided as `cnTranslate`. The
+ * Dashboard host draws the widget's title, so the component must not.
+ *
+ * The widget ids are the ones the app's PHP `IWidget::getId()` returns; the
+ * server side stays the app's.
+ *
+ * @spec openspec/changes/nc-dashboard-widgets/specs/nc-dashboard-widgets/spec.md#requirement-dashboard-widgets-are-configuration
+ * @param {Array<{id: string, config?: object, component?: object, props?: object}>} widgets The widgets.
+ * @param {object} options Options.
+ * @param {string} options.appId The app id, for its translations.
+ * @param {(app: object) => void} [options.setup] Called on each widget's Vue app before mounting (to `use` a pinia, say).
+ * @param {object} [options.dashboard] The `OCA.Dashboard` registry (default `window.OCA.Dashboard`).
+ * @return {string[]} The ids registered; none when the Dashboard is absent.
+ */
+export function registerNcDashboardWidgets(widgets, options = {}) {
+	const dashboard = options.dashboard || (typeof window !== 'undefined' && window.OCA && window.OCA.Dashboard) || null
+	if (!dashboard || typeof dashboard.register !== 'function' || !Array.isArray(widgets)) {
+		return []
+	}
+	const appId = options.appId || 'nextcloud-vue'
+	const cnTranslate = (key, vars) => translate(appId, key, vars)
+	const registered = []
+	for (const widget of widgets) {
+		if (!widget || typeof widget.id !== 'string' || widget.id === '') {
+			continue
+		}
+		dashboard.register(widget.id, (el, context = {}) => {
+			const title = context.widget && context.widget.title ? context.widget.title : ''
+			const app = widget.component
+				? createApp(widget.component, { ...(widget.props || {}), title })
+				: createApp(CnNcDashboardList, { config: widget.config || {} })
+			app.provide('cnTranslate', cnTranslate)
+			if (typeof options.setup === 'function') {
+				options.setup(app)
+			}
+			app.mount(el)
+		})
+		registered.push(widget.id)
+	}
+	return registered
+}

package/src/utils/searchRefusal.js

@@ -0,0 +1,59 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * A refused search, said where it was typed. OpenRegister refuses a `_search`
+ * term it cannot parse (an unclosed bracket or quote) with `400 { error,
+ * position, term }` rather than running it as a literal, which would return
+ * nothing and read as an honest empty result.
+ *
+ * @module utils/searchRefusal
+ */
+
+/** `<reason> at position <n>.`, the shape OpenRegister builds the message in. */
+const POSITION_IN_MESSAGE = /\bat position (\d+)\.?\s*$/
+
+/**
+ * The 1-based character a refusal points at, or null.
+ *
+ * @param {object} error The ApiError.
+ * @return {number|null}
+ */
+function positionOf(error) {
+	const carried = error.position ?? (error.details && typeof error.details === 'object' ? error.details.position : undefined)
+	if (Number.isInteger(carried) && carried > 0) {
+		return carried
+	}
+	const match = POSITION_IN_MESSAGE.exec(String(error.message || ''))
+	const parsed = match ? Number(match[1]) : 0
+	return parsed > 0 ? parsed : null
+}
+
+/**
+ * A search refusal, or null when this failure is not one: not a 400, no term
+ * typed, or no position to point at (then it is a plain failed fetch).
+ *
+ * @spec openspec/changes/index-search-refusal/specs/index-search-refusal/spec.md#requirement-a-refused-search-is-said-where-it-was-typed
+ * @param {object|null} error The ApiError the store recorded.
+ * @param {string} term The term the user typed.
+ * @return {{message: string, position: number, term: string, before: string, at: string, after: string}|null}
+ */
+export function readSearchRefusal(error, term) {
+	const typed = typeof term === 'string' ? term : ''
+	if (!error || typed.trim() === '' || Number(error.status) !== 400) {
+		return null
+	}
+	const position = positionOf(error)
+	if (position === null) {
+		return null
+	}
+	const index = Math.min(position - 1, typed.length)
+	return {
+		message: String(error.message || ''),
+		position,
+		term: typed,
+		before: typed.slice(0, index),
+		at: typed.slice(index, index + 1),
+		after: typed.slice(index + 1),
+	}
+}