@conduction/nextcloud-vue 2.2.0-vue3.13 → 2.2.0-vue3.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@conduction/nextcloud-vue",
-  "version": "2.2.0-vue3.13",
+  "version": "2.2.0-vue3.15",
   "description": "Shared Vue component library for Conduction Nextcloud apps — complements @nextcloud/vue with higher-level components, OpenRegister integration, and NL Design System support",
   "license": "EUPL-1.2",
   "author": "Conduction B.V. <info@conduction.nl>",
@@ -24,7 +24,9 @@
     "src/",
     "css/",
     "eslint/",
+    "stylelint/",
     "l10n/",
+    "scripts/",
     "testing/",
     "webpack/"
   ],

package/scripts/.jsdoc-baselines.json

@@ -0,0 +1,254 @@
+{
+  "CnActionButtons": 1,
+  "CnActionsBar": 1,
+  "CnActionsMenu": 1,
+  "CnAdminSettingsShell": 1,
+  "CnAdvancedFormDialog": 0.65,
+  "CnAiCompanion": 1,
+  "CnAnalyticsReportCreate": 1,
+  "CnAnalyticsReportPicker": 1,
+  "CnAppLoading": 0.67,
+  "CnAppNav": 1,
+  "CnAppRoot": 0.92,
+  "CnAuditTrailCard": 0.92,
+  "CnAuditTrailWidget": 1,
+  "CnAuditTrailWidgetForm": 1,
+  "CnBannerWidget": 1,
+  "CnBannerWidgetForm": 1,
+  "CnBodySections": 1,
+  "CnBookmarkCreate": 1,
+  "CnBookmarkPicker": 1,
+  "CnCalendarEventCreate": 1,
+  "CnCalendarEventPicker": 1,
+  "CnCalendarWidget": 1,
+  "CnCalendarWidgetForm": 1,
+  "CnCard": 0.59,
+  "CnCardGrid": 0.54,
+  "CnCellRenderer": 1,
+  "CnChartWidget": 1,
+  "CnChartWidgetForm": 1,
+  "CnChatPage": 0.69,
+  "CnCollectivePageCreate": 1,
+  "CnCollectivePagePicker": 1,
+  "CnColorPicker": 1,
+  "CnCommandPalette": 1,
+  "CnConfigurationCard": 0.17,
+  "CnContactCreate": 1,
+  "CnContactPicker": 1,
+  "CnContainerWidget": 1,
+  "CnContainerWidgetForm": 1,
+  "CnContextMenu": 1,
+  "CnCopyDialog": 0.82,
+  "CnCospendCreate": 1,
+  "CnCospendPicker": 1,
+  "CnCredentials": 1,
+  "CnDashboardGrid": 0.94,
+  "CnDashboardPage": 0.94,
+  "CnDashTileWidget": 1,
+  "CnDashTileWidgetForm": 1,
+  "CnDataMatrix": 1,
+  "CnDataTable": 1,
+  "CnDateRangePicker": 1,
+  "CnDeckCardCreate": 1,
+  "CnDeckCardPicker": 1,
+  "CnDeleteDialog": 0.82,
+  "CnDeltaWidget": 1,
+  "CnDeltaWidgetForm": 1,
+  "CnDependencyMissing": 1,
+  "CnDetailCard": 0.5,
+  "CnDetailGrid": 1,
+  "CnDetailPage": 1,
+  "CnDividerWidget": 1,
+  "CnDividerWidgetForm": 1,
+  "CnEmailPicker": 1,
+  "CnExportWizard": 1,
+  "CnFacetSidebar": 0.78,
+  "CnFeaturesAndRoadmapLink": 1,
+  "CnFeaturesAndRoadmapPage": 1,
+  "CnFeaturesAndRoadmapSidebar": 1,
+  "CnFeaturesAndRoadmapView": 1,
+  "CnFeaturesTab": 1,
+  "CnFederationStatus": 1,
+  "CnFieldPicker": 1,
+  "CnFileManager": 1,
+  "CnFilesCard": 1,
+  "CnFilesPage": 0.72,
+  "CnFilesWidget": 1,
+  "CnFilesWidgetForm": 1,
+  "CnFilterBar": 0.75,
+  "CnFilterRowsEditor": 1,
+  "CnFkResolveCell": 1,
+  "CnFlowCanvas": 1,
+  "CnFlowOperationPicker": 1,
+  "CnFlowRunsWidget": 1,
+  "CnFlowRunsWidgetForm": 1,
+  "CnFolderSidebar": 1,
+  "CnFolderTree": 1,
+  "CnFormBuilder": 1,
+  "CnFormDialog": 0.72,
+  "CnFormPage": 1,
+  "CnGaugeWidget": 1,
+  "CnGaugeWidgetForm": 1,
+  "CnGraphCanvas": 1,
+  "CnHeaderWidget": 1,
+  "CnHeaderWidgetForm": 1,
+  "CnIcon": 1,
+  "CnIconBrowser": 1,
+  "CnIconPicker": 1,
+  "CnImageWidget": 1,
+  "CnImageWidgetForm": 1,
+  "CnIndexPage": 0.72,
+  "CnIndexSidebar": 0.69,
+  "CnInfoWidget": 1,
+  "CnIntegrationCard": 1,
+  "CnIntegrationTab": 1,
+  "CnIntegrationWidget": 1,
+  "CnIntegrationWidgetGrid": 1,
+  "CnInteractionFormWidget": 1,
+  "CnItemCard": 0.5,
+  "CnJsonViewer": 1,
+  "CnKbSearchWidget": 1,
+  "CnKpiGrid": 0.67,
+  "CnLabelWidget": 1,
+  "CnLabelWidgetForm": 1,
+  "CnLeafMountHost": 1,
+  "CnLifecycleActions": 1,
+  "CnLinkButtonWidget": 1,
+  "CnLinkButtonWidgetForm": 1,
+  "CnLinksWidget": 1,
+  "CnLinksWidgetForm": 1,
+  "CnLockedBanner": 1,
+  "CnLogsPage": 0.63,
+  "CnMapPage": 1,
+  "CnMapPoiCreate": 1,
+  "CnMapPoiPicker": 1,
+  "CnMapWidget": 1,
+  "CnMapWidgetForm": 1,
+  "CnMarkdownEditor": 1,
+  "CnMassActionBar": 1,
+  "CnMassCopyDialog": 0.92,
+  "CnMassDeleteDialog": 0.92,
+  "CnMassExportDialog": 0.93,
+  "CnMassImportDialog": 0.87,
+  "CnMenuItemEditor": 1,
+  "CnMenuTreeNode": 1,
+  "CnMenuWidget": 1,
+  "CnMenuWidgetForm": 1,
+  "CnNcDashboardWidgetForm": 1,
+  "CnNcWidgetGridPicker": 1,
+  "CnNcWidgetWidget": 1,
+  "CnNewsWidget": 1,
+  "CnNewsWidgetForm": 1,
+  "CnNoteCard": 0.67,
+  "CnNotesCard": 0.8,
+  "CnNotificationPreferences": 1,
+  "CnObjectCalendar": 1,
+  "CnObjectCard": 0.7,
+  "CnObjectDataWidget": 0.73,
+  "CnObjectDataWidgetForm": 1,
+  "CnObjectGeoWidget": 1,
+  "CnObjectGeoWidgetForm": 1,
+  "CnObjectKanban": 1,
+  "CnObjectList": 1,
+  "CnObjectListWidget": 1,
+  "CnObjectListWidgetForm": 1,
+  "CnObjectMetadataModal": 1,
+  "CnObjectMetadataWidget": 0.92,
+  "CnObjectRow": 1,
+  "CnObjectSidebar": 0.75,
+  "CnOpenBuildEditButton": 1,
+  "CnOpenProjectCreate": 1,
+  "CnOpenProjectPicker": 1,
+  "CnPageHeader": 0.67,
+  "CnPageRenderer": 1,
+  "CnPageTreeNode": 1,
+  "CnPagination": 1,
+  "CnPeopleWidget": 1,
+  "CnPeopleWidgetForm": 1,
+  "CnPhotoAlbumCreate": 1,
+  "CnPhotoAlbumPicker": 1,
+  "CnPollCreate": 1,
+  "CnPollPicker": 1,
+  "CnProgressBar": 0.71,
+  "CnQuickFilterBar": 0.9,
+  "CnQuicklinksWidget": 1,
+  "CnQuicklinksWidgetForm": 1,
+  "CnRegisterMapping": 0.68,
+  "CnRegisterSchemaSelect": 1,
+  "CnRelatedCollections": 1,
+  "CnRelatedFiles": 1,
+  "CnRelatedObjectsWidget": 1,
+  "CnRelatedObjectsWidgetForm": 1,
+  "CnRelationshipGraph": 1,
+  "CnResourceSelect": 1,
+  "CnRichSubmitDialog": 1,
+  "CnRoadmapItem": 1,
+  "CnRoadmapTab": 1,
+  "CnRowActions": 0.8,
+  "CnSavedViewsControl": 1,
+  "CnSaveViewDialog": 1,
+  "CnSchemaFormDialog": 0.79,
+  "CnSearchPage": 1,
+  "CnSettingsCard": 0.83,
+  "CnSettingsPage": 0.64,
+  "CnSettingsSection": 0.71,
+  "CnSetupWizard": 1,
+  "CnShareCreate": 1,
+  "CnSignatureCapture": 1,
+  "CnSpendAnalyticsWidget": 1,
+  "CnSpendAnalyticsWidgetForm": 1,
+  "CnStatsBlock": 0.88,
+  "CnStatsBlockWidget": 1,
+  "CnStatsBlockWidgetForm": 1,
+  "CnStatsPanel": 0.33,
+  "CnStatusBadge": 0.71,
+  "CnStatWidget": 1,
+  "CnStatWidgetForm": 1,
+  "CnStructuredDocReview": 1,
+  "CnSuggestFeatureModal": 1,
+  "CnSummaryAggregates": 1,
+  "CnSupportDialog": 1,
+  "CnTabbedFormDialog": 0.7,
+  "CnTableWidget": 1,
+  "CnTabs": 1,
+  "CnTagsCard": 1,
+  "CnTalkRoomCreate": 1,
+  "CnTalkRoomPicker": 1,
+  "CnTasksCard": 0.91,
+  "CnTenantBadge": 1,
+  "CnTextTableEditor": 1,
+  "CnTextWidget": 1,
+  "CnTextWidgetForm": 1,
+  "CnThemePreview": 1,
+  "CnTileWidget": 1,
+  "CnTimelineStages": 0.78,
+  "CnTimelineView": 1,
+  "CnTimeTrackerCreate": 1,
+  "CnTimeTrackerPicker": 1,
+  "CnTranslatedBadge": 1,
+  "CnTreeView": 1,
+  "CnUserActionMenu": 1,
+  "CnVersionHistory": 1,
+  "CnVersionInfoCard": 0.72,
+  "CnVideoWidget": 1,
+  "CnVideoWidgetForm": 1,
+  "CnWalkthrough": 1,
+  "CnWidgetCardGrid": 1,
+  "CnWidgetEditCog": 1,
+  "CnWidgetFormRenderer": 1,
+  "CnWidgetGrid": 1,
+  "CnWidgetMapViewer": 1,
+  "CnWidgetObjectTable": 1,
+  "CnWidgetRefItem": 1,
+  "CnWidgetRenderer": 1,
+  "CnWidgetWrapper": 0.84,
+  "CnWikiPage": 1,
+  "CnWizardDialog": 1,
+  "CnWorkspaceFilterWidget": 1,
+  "CnXwikiPageCreate": 1,
+  "CnXwikiPagePicker": 1,
+  "__schema__": {
+    "generatedBy": "scripts/check-jsdoc.js --update",
+    "rule": "CI fails if any component score < baseline. New components require 1.0."
+  }
+}

package/scripts/build-validators.js

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: EUPL-1.2
+// Copyright (C) 2026 Conduction B.V.
+//
+// Pre-compiles the v2 manifest JSON Schema into a standalone JS module
+// that doesn't require runtime `new Function()`. Nextcloud's CSP blocks
+// unsafe-eval, so Ajv's default JIT compilation breaks Vue mount in v2
+// apps (EvalError on every app boot). This generator runs at build time
+// as a `prebuild` step to produce
+// src/utils/validateManifestV2.compiled.js — a regular CJS module that
+// imports Ajv's runtime helpers but never calls new Function().
+//
+// See ADR-036 and docs/utilities/validate-manifest-v2.md for rationale.
+
+'use strict'
+
+const fs = require('fs')
+const path = require('path')
+// eslint-disable-next-line n/no-unpublished-require
+const Ajv2020 = require('ajv/dist/2020')
+// eslint-disable-next-line n/no-unpublished-require
+const addFormats = require('ajv-formats')
+// eslint-disable-next-line n/no-unpublished-require
+const standaloneCode = require('ajv/dist/standalone')
+
+// ajv and ajv-formats export default via CJS interop differently depending on
+// bundler / Node version — unwrap .default when present.
+const AjvClass = Ajv2020.default || Ajv2020
+const addFormatsFunc = addFormats.default || addFormats
+const standaloneCodeFunc = standaloneCode.default || standaloneCode
+
+const schemaPath = path.resolve(__dirname, '../src/schemas/app-manifest-v2.schema.json')
+const outPath = path.resolve(__dirname, '../src/utils/validateManifestV2.compiled.js')
+
+const schema = JSON.parse(fs.readFileSync(schemaPath, 'utf-8'))
+
+const ajv = new AjvClass({
+	code: { source: true, esm: false }, // CJS output for broadest bundler compat
+	useDefaults: true,
+	allErrors: true,
+	strict: false,
+})
+addFormatsFunc(ajv)
+
+const validate = ajv.compile(schema)
+let moduleCode = standaloneCodeFunc(ajv, validate)
+
+// Inline ajv-formats so the standalone module has ZERO runtime dependency on
+// ajv-formats. Ajv's standalone output emits lines like
+//   const formatN = require("ajv-formats/dist/formats").fullFormats.uri;
+// That runtime require survives Node/Jest fine, but the rollup→webpack
+// double-bundle every consumer app runs tree-shakes ajv-formats'
+// `exports.fullFormats = {…}` assignment down to `{}`, so at runtime
+// `{}.fullFormats.uri` throws `Cannot read properties of undefined (reading
+// 'uri')` during app boot and white-screens the whole SPA (observed
+// 2026-07-11 on openbuild). Replacing each reference with a self-contained
+// inline definition, extracted from the installed ajv-formats at build time,
+// removes the fragile require while preserving identical validation. The
+// formats file is re-read on every regeneration, so this stays in sync.
+const formatsSrc = fs.readFileSync(
+	require.resolve('ajv-formats/dist/formats'),
+	'utf-8',
+)
+const fullFormats = require('ajv-formats/dist/formats').fullFormats
+
+/**
+ * Read a full JavaScript regex literal (including flags) from source, starting
+ * at the opening `/`. Correctly skips escapes and `[…]` character classes so a
+ * bare `/` inside a class does not prematurely terminate the literal.
+ *
+ * @param {string} src The source text.
+ * @param {number} start Index of the opening `/`.
+ * @return {string|null} The literal `/…/flags`, or null if unterminated.
+ */
+function readRegexLiteral(src, start) {
+	let i = start + 1
+	let inClass = false
+	for (; i < src.length; i++) {
+		const ch = src[i]
+		if (ch === '\\') {
+			i++
+			continue
+		}
+		if (ch === '[') {
+			inClass = true
+		} else if (ch === ']') {
+			inClass = false
+		} else if (ch === '/' && !inClass) {
+			break
+		} else if (ch === '\n') {
+			return null
+		}
+	}
+	if (i >= src.length) {
+		return null
+	}
+	let end = i + 1
+	while (end < src.length && /[a-z]/i.test(src[end])) {
+		end++
+	}
+	return src.slice(start, end)
+}
+
+/**
+ * Build a self-contained JS expression reproducing one ajv-formats format,
+ * with no runtime dependency on the ajv-formats package.
+ *
+ * @param {string} name The format name (e.g. "uri").
+ * @return {string} A JS expression that evaluates to the format value.
+ */
+function inlineFormat(name) {
+	const value = fullFormats[name]
+	if (value === undefined) {
+		throw new Error(`build-validators: ajv-formats has no format "${name}" to inline`)
+	}
+	if (value instanceof RegExp) {
+		return value.toString()
+	}
+	if (typeof value === 'function') {
+		// A function format (e.g. uri) closes over module-level `const X = /…/;`
+		// regexes in formats.js. Inline exactly the ones it references inside an
+		// IIFE so the returned function is self-contained. Regex literals are
+		// read with a lexer-correct scanner (escapes + `[…]` classes) — a plain
+		// regex can't parse a regex literal that contains bare `/` inside a
+		// character class (ajv-formats' URI regex does).
+		const body = value.toString()
+		const deps = []
+		const declRe = /const ([A-Z0-9_]+) = \//g
+		let m
+		while ((m = declRe.exec(formatsSrc)) !== null) {
+			const name = m[1]
+			if (!new RegExp(`\\b${name}\\b`).test(body)) {
+				continue
+			}
+			const literal = readRegexLiteral(formatsSrc, m.index + m[0].length - 1)
+			if (literal) {
+				deps.push(`const ${name} = ${literal};`)
+			}
+		}
+		return `(function(){${deps.join('')}return ${body};})()`
+	}
+	throw new Error(`build-validators: cannot inline ajv-formats format "${name}" of type ${typeof value}`)
+}
+
+moduleCode = moduleCode.replace(
+	/require\("ajv-formats\/dist\/formats"\)\.fullFormats\.([A-Za-z0-9_-]+)/g,
+	(_match, name) => inlineFormat(name),
+)
+
+if (/require\("ajv-formats/.test(moduleCode)) {
+	throw new Error('build-validators: a require("ajv-formats…") reference survived inlining — the standalone validator is not self-contained')
+}
+
+const banner = `// SPDX-License-Identifier: EUPL-1.2
+// Copyright (C) 2026 Conduction B.V.
+//
+// AUTOGENERATED by scripts/build-validators.js — DO NOT EDIT BY HAND.
+// Run \`npm run build:validators\` to regenerate after editing
+// src/schemas/app-manifest-v2.schema.json.
+//
+// This is a standalone Ajv-compiled validator. It does NOT use
+// new Function() at runtime — required for Nextcloud's CSP which
+// blocks unsafe-eval. The validator function is exported as the
+// module's default export (CJS: module.exports).
+//
+// See ADR-036 and docs/utilities/validate-manifest-v2.md.
+
+`
+
+fs.writeFileSync(outPath, banner + moduleCode)
+
+const kb = (moduleCode.length / 1024).toFixed(1)
+// eslint-disable-next-line no-console
+console.log(`build-validators: wrote ${path.relative(process.cwd(), outPath)} (${kb} KB)`)

package/scripts/check-css-entry.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+
+/**
+ * Published-CSS-entry gate.
+ *
+ * THE BUG THIS GUARDS AGAINST
+ * ---------------------------
+ * `css/index.css` — the entry every consumer app imports — used to re-export
+ * `../src/css/index.css`, which holds only the UNSCOPED globals. Every
+ * component's scoped SFC style block lives exclusively in the built
+ * `dist/nextcloud-vue.css`, and the only reference to that file was the
+ * `import './nextcloud-vue.css'` banner atop `dist/esm/index.js`. webpack
+ * treats that barrel as side-effect-free (it is absent from
+ * package.json#sideEffects), so it skips the module — and the CSS import with
+ * it — whenever a consumer imports named components instead of the namespace.
+ *
+ * Net effect: dist-consuming apps rendered components carrying `data-v-*`
+ * scope attributes for which no rule was ever shipped. Nothing errored; the
+ * elements just silently lost every scoped declaration, so flex containers
+ * fell back to `display: block`. Observed on pipelinq, where the dashboard
+ * header stacked its action buttons underneath the title and 11 nc-vue
+ * components rendered entirely unstyled.
+ *
+ * WHAT THIS DOES
+ * --------------
+ * Follows the @import chain out of `css/index.css` exactly as a consumer's
+ * css-loader would, then asserts the invariant that was violated: EVERY
+ * `data-v-*` scope id baked into the built JS has at least one matching rule
+ * in the CSS reachable from that entry. Vue only emits a scope id for a
+ * component that actually has a scoped <style> block, so an id with no rules
+ * always means its styles were dropped somewhere between rollup and the
+ * published entry point.
+ *
+ * Runs after `npm run build` (dist/ must exist).
+ *
+ * Exit codes:
+ *   0 — every scope id rendered by the built JS is styled by the CSS entry
+ *   1 — at least one scope id would ship unstyled
+ */
+
+const fs = require('fs')
+const path = require('path')
+
+const root = path.resolve(__dirname, '..')
+const entry = path.join(root, 'css', 'index.css')
+
+const SCOPE_ID = /data-v-[0-9a-f]{8}/g
+
+/**
+ * Resolve a stylesheet and everything it @imports, css-loader style.
+ *
+ * @param {string} file Absolute path to a CSS file.
+ * @param {Set<string>} seen Guard against @import cycles.
+ * @return {string} The concatenated CSS of `file` and its transitive imports.
+ */
+function readWithImports(file, seen = new Set()) {
+	if (seen.has(file)) {
+		return ''
+	}
+	seen.add(file)
+
+	if (!fs.existsSync(file)) {
+		console.error(`✗ CSS entry points at a file that does not exist: ${path.relative(root, file)}`)
+		console.error('  Did `npm run build` run first? dist/ is gitignored and built by rollup.')
+		process.exit(1)
+	}
+
+	const css = fs.readFileSync(file, 'utf8')
+	const imports = [...css.matchAll(/@import\s+['"]([^'"]+)['"]/g)].map((m) => m[1])
+
+	return imports.reduce(
+		(acc, spec) => acc + readWithImports(path.resolve(path.dirname(file), spec), seen),
+		css,
+	)
+}
+
+/**
+ * Collect every scope id the built JS will stamp onto rendered elements.
+ *
+ * @return {Set<string>} Scope ids such as `data-v-5266112e`.
+ */
+function scopeIdsInBuiltJs() {
+	const ids = new Set()
+	const walk = (dir) => {
+		for (const dirent of fs.readdirSync(dir, { withFileTypes: true })) {
+			const full = path.join(dir, dirent.name)
+			if (dirent.isDirectory()) {
+				walk(full)
+			} else if (dirent.name.endsWith('.js')) {
+				for (const id of fs.readFileSync(full, 'utf8').match(SCOPE_ID) || []) {
+					ids.add(id)
+				}
+			}
+		}
+	}
+	walk(path.join(root, 'dist'))
+	return ids
+}
+
+const css = readWithImports(entry)
+const styled = new Set(css.match(SCOPE_ID) || [])
+const rendered = scopeIdsInBuiltJs()
+const unstyled = [...rendered].filter((id) => !styled.has(id)).sort()
+
+if (unstyled.length > 0) {
+	console.error(`✗ ${unstyled.length} scope id(s) are rendered by the built JS but carry no rule in css/index.css:`)
+	for (const id of unstyled) {
+		console.error(`    ${id}`)
+	}
+	console.error('')
+	console.error('  Consumers importing @conduction/nextcloud-vue/css/index.css would render')
+	console.error('  these components with every scoped declaration missing (silently — no error).')
+	console.error('  css/index.css must @import the BUILT stylesheet (dist/nextcloud-vue.css),')
+	console.error('  which carries the scoped SFC styles as well as the unscoped globals.')
+	process.exit(1)
+}
+
+console.log(`✓ css/index.css styles all ${rendered.size} scope ids rendered by the built JS`)