@conduction/nextcloud-vue 2.56.0-beta.30 → 2.56.0-beta.31

package/src/schemas/app-manifest-v2.schema.json

@@ -3,7 +3,7 @@
 	"$id": "https://raw.githubusercontent.com/ConductionNL/nextcloud-vue/main/src/schemas/app-manifest-v2.schema.json",
 	"title": "Conduction App Manifest v2",
 	"description": "v2 schema for the JSON-driven page and navigation manifest consumed by @conduction/nextcloud-vue. Introduces a uniform widgets[] array on every page type with a per-slot grid coordinate system, a typed actions[] discriminator, and the required $schema field for version detection. v1 manifests continue to validate against app-manifest.schema.json (unchanged).",
-	"version": "2.85.0",
+	"version": "2.89.0",
 	"type": "object",
 	"required": ["$schema", "version"],
 	"allOf": [
@@ -803,6 +803,16 @@
 			"pattern": "^@answer\\.[A-Za-z][A-Za-z0-9_]*$",
 			"description": "form-live-values: another answer in the same form (@answer.<field>), read by a form field's assign rule and resolved client-side by CnFormPage / CnFormDialog. Mirrors SENTINEL_TOKEN_PATTERNS.answer."
 		},
+		"sentinelRowToken": {
+			"type": "string",
+			"pattern": "^@row\\.[A-Za-z][A-Za-z0-9_.@]*$",
+			"description": "Row context: a field of the row a row action runs on (@row.<field>, dot path allowed), read by the field-list widget's rowActions request url and payload (payload values resolve at any depth). Mirrors SENTINEL_TOKEN_PATTERNS.row."
+		},
+		"sentinelSubjectToken": {
+			"type": "string",
+			"pattern": "^@subject\\.[A-Za-z][A-Za-z0-9_.]*$",
+			"description": "Subject context: a field of the record an attention card names (the first row of its ordered `visibleWhen` source query), read by the banner widget's action route params and query (@subject.<field>, dot path allowed). Mirrors SENTINEL_TOKEN_PATTERNS.subject."
+		},
 		"sentinelTokenAny": {
 			"$comment": "Union of every canonical context plus the deprecated-during-window overlay. Single source the shared resolver + gate import.",
 			"anyOf": [
@@ -814,6 +824,8 @@
 				{ "$ref": "#/$defs/sentinelDeclarativeToken" },
 				{ "$ref": "#/$defs/sentinelVisibleWhenToken" },
 				{ "$ref": "#/$defs/sentinelAnswerToken" },
+				{ "$ref": "#/$defs/sentinelRowToken" },
+				{ "$ref": "#/$defs/sentinelSubjectToken" },
 				{ "$ref": "#/$defs/sentinelDeprecatedToken" }
 			]
 		},
@@ -1691,7 +1703,7 @@
 				"sizeToContent": {
 					"type": ["boolean", "integer"],
 					"minimum": 1,
-					"description": "Opt-in: hand this placement's height to whatever it renders, so a widget that decides AT RUNTIME it has nothing to show costs no row. `true` sizes purely to content; an integer is a row minimum. It makes gridHeight advisory for this widget — right for anything whose height is whatever it turned out to be (a banner whose condition is false, a list that came back empty), wrong for anything with a deliberate size. Maps to CnDashboardGrid's per-item `sizeToContent`."
+					"description": "Opt-in: hand this placement's height to whatever it renders, so a widget that decides AT RUNTIME it has nothing to show costs no row. `true` sizes purely to content; an integer sizes to content too but caps the height at that many rows (GridStack's maximum, NOT a minimum: content shorter than N rows is as short as it is, content taller is clipped at N). It makes gridHeight advisory for this widget — right for anything whose height is whatever it turned out to be (a banner whose condition is false, a list that came back empty), wrong for anything with a deliberate size. Maps to CnDashboardGrid's per-item `sizeToContent`."
 				},
 				"props": {
 					"type": "object",
@@ -1898,11 +1910,16 @@
 												"properties": {
 													"register": { "type": "string" },
 													"schema": { "type": "string" },
-													"filter": { "type": "object", "additionalProperties": true }
+													"filter": { "type": "object", "additionalProperties": true },
+													"order": {
+														"type": "object",
+														"additionalProperties": { "type": "string", "enum": ["asc", "desc"] },
+														"description": "Order of the query (`{ field: \"asc\" | \"desc\" }`), so the first result is the first of an ordered list. With it an attention card names that row: `{subject.<field>}` in its title, reason and kicker and `@subject.<field>` in an action route read it (screens-start-here-banner, 2.89.0)."
+													}
 												}
 											},
 											"field": { "type": "string", "description": "Dot-path into the response ('@total' or omitted = collection total for a source)." },
-											"op": { "type": "string", "enum": ["eq", "neq", "gt", "gte", "lt", "lte"], "default": "eq", "description": "Comparison operator." },
+											"op": { "type": "string", "enum": ["eq", "neq", "gt", "gte", "lt", "lte", "empty", "notEmpty"], "default": "eq", "description": "Comparison operator. `notEmpty` on `id` is the \"there is a first row\" test of a card that names one." },
 											"value": { "description": "Literal right-hand side of the comparison." }
 										}
 									},
@@ -1919,6 +1936,11 @@
 										"default": "banner",
 										"description": "How the banner renders. `banner` (default) is the note card. `attention` is a card with a severity edge, a kicker, a title, a reason line and up to two actions."
 									},
+									"stacked": {
+										"type": "boolean",
+										"default": false,
+										"description": "Attention card: put the actions under the text instead of beside it, with a 16px title (PqMijnWerk \"Begin hier\"; screens-start-here-banner, 2.89.0)."
+									},
 									"kicker": {
 										"type": "string",
 										"description": "Attention card: the small label above the title."
@@ -2184,9 +2206,27 @@
 											},
 											"style": {
 												"type": "string",
-												"enum": ["radio", "select"],
+												"enum": ["radio", "select", "chips", "toggle"],
 												"default": "radio",
-												"description": "Choice style: 'radio' (default) list or 'select' dropdown."
+												"description": "Choice style: 'radio' (default) list, 'select' dropdown, 'chips' (one compact segmented group with a count after each label; screens-page-lenses, 2.87.0) or 'toggle' (a switch writing `onValue` / `offValue`; screens-page-controls, 2.88.0)."
+											},
+											"layout": {
+												"type": "string",
+												"enum": ["start", "bar"],
+												"description": "'start' draws the start card; 'bar' draws `controls` side by side in one row (screens-page-controls, 2.88.0)."
+											},
+											"controls": {
+												"type": "array",
+												"items": { "type": "object", "additionalProperties": true },
+												"description": "With `layout: \"bar\"`: the bar's controls, each a workspace-filter content (chips, a toggle, a select) with its own `writes`. `align: \"end\"` pushes a control to the right edge (2.88.0)."
+											},
+											"onValue": { "description": "style 'toggle': the value written while the switch is on. Default true (2.88.0)." },
+											"offValue": { "description": "style 'toggle': the value written while the switch is off. Default false (2.88.0)." },
+											"align": { "type": "string", "enum": ["start", "end"], "description": "In a bar: 'end' pushes this control to the right edge (2.88.0)." },
+											"urlKey": {
+												"type": "string",
+												"minLength": 1,
+												"description": "Keep the choice in the address as `?<urlKey>=<value>` (replacing the history entry, keeping other query keys). The address wins over `default` on load, so a chip is linkable (screens-page-lenses, 2.87.0)."
 											},
 											"allLabel": {
 												"type": "string",
@@ -2199,7 +2239,7 @@
 											},
 											"options": {
 												"type": "array",
-												"description": "Static options — each { value, label, count? } (or { id, name } / bare strings, normalised).",
+												"description": "Static options — each { value, label, count?, countFrom? } (or { id, name } / bare strings, normalised). `countFrom` is `{ register, schema, filter? }`, or a list of those that are added up; the option shows that list's total (one list request each; none when it fails). screens-page-lenses, 2.87.0.",
 												"items": { "type": ["object", "string", "number"] }
 											},
 											"source": {
@@ -2925,15 +2965,20 @@
 						"filter": { "type": "object", "additionalProperties": true }
 					}
 				},
+				"workspace": {
+					"type": "string",
+					"minLength": 1,
+					"description": "WORKSPACE mode (screens-page-lenses, 2.87.0): the key of the page workspace context to compare, read at once with no request. A page control (a `workspace-filter` with `writes`) sets the key, and a dashboard widget carrying this condition appears and disappears as it changes. Honoured on a dashboard widget or KPI-row tile only, and as a top-level condition (not inside `all` / `any`)."
+				},
 				"field": {
 					"type": "string",
 					"description": "Dot-path to the compared value — into the endpoint body, the source's first result, or (LOCAL mode) the caller's object context."
 				},
 				"op": {
 					"type": "string",
-					"enum": ["eq", "neq", "gt", "gte", "lt", "lte", "empty", "notEmpty"],
+					"enum": ["eq", "neq", "gt", "gte", "lt", "lte", "empty", "notEmpty", "in"],
 					"default": "eq",
-					"description": "Comparison operator (default eq). eq/neq compare loosely-normalised primitives; ordering operators coerce both sides to Number. `empty` / `notEmpty` take no `value` and treat undefined, null, '' and an empty array alike — the one question eq cannot ask, because an unset field arrives in a shape that depends on the store and String(null) is the word 'null' rather than blank."
+					"description": "Comparison operator (default eq). eq/neq compare loosely-normalised primitives; ordering operators coerce both sides to Number. `in` holds when the value is one of the listed `value` array (2.87.0). `empty` / `notEmpty` take no `value` and treat undefined, null, '' and an empty array alike — the one question eq cannot ask, because an unset field arrives in a shape that depends on the store and String(null) is the word 'null' rather than blank."
 				},
 				"value": {
 					"description": "The right-hand side of the comparison, resolved through the shared @-token grammar so `@me` names the signed-in reader rather than a literal only the server knows. Omitted for `empty` / `notEmpty`."
@@ -2985,6 +3030,45 @@
 					"type": "array",
 					"items": { "type": "string" },
 					"description": "OpenRegister `_extend[]` values forwarded on the fetch (e.g. [\"calculations\"]) so read-time virtual/derived fields are hydrated and available as columns. Each entry is passed through verbatim."
+				},
+				"pageControls": { "$ref": "#/$defs/pageControls" }
+			}
+		},
+		"pageControls": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "screens-page-controls (2.88.0): which page controls a list widget (`record-list`, `object-table`) listens to, and what they mean for it. A page control is a `workspace-filter` select or switch that writes a workspace key. `sort` picks the list's sort from the key's value; `toggle` drops filter keys while the key is on. Without it the list ignores the page's controls.",
+			"properties": {
+				"sort": {
+					"type": "object",
+					"required": ["key", "map"],
+					"additionalProperties": false,
+					"description": "The workspace key a sort select writes, and what each of its values sorts by. A value with no entry leaves the list's own sort.",
+					"properties": {
+						"key": { "type": "string", "minLength": 1 },
+						"map": {
+							"type": "object",
+							"additionalProperties": {
+								"type": "object",
+								"required": ["field"],
+								"additionalProperties": false,
+								"properties": {
+									"field": { "type": "string", "minLength": 1 },
+									"dir": { "type": "string", "enum": ["asc", "desc"], "default": "asc" }
+								}
+							}
+						}
+					}
+				},
+				"toggle": {
+					"type": "object",
+					"required": ["key", "removes"],
+					"additionalProperties": false,
+					"description": "The workspace key a switch writes. While it is on (true, 1, \"1\", \"true\") the filter keys in `removes` are dropped, so a list that hides finished work shows it.",
+					"properties": {
+						"key": { "type": "string", "minLength": 1 },
+						"removes": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+					}
 				}
 			}
 		},

package/src/utils/facets.js

@@ -37,14 +37,29 @@ export function normalizeFacetBucket(bucket) {
 	return option
 }
 
+/**
+ * The option id that stands for "this property holds no value".
+ *
+ * Chosen so no real bucket key can collide with it. Selecting it is sent to
+ * OpenRegister as `<property>_isnull=true` by {@link facetFilterParams}.
+ *
+ * @type {string}
+ */
+export const MISSING_VALUE = '__cn_missing__'
+
 /**
  * Normalise the `facets` block of a collection response into sidebar format.
  *
  * Fields whose facet carries no bucket list are skipped entirely, so a caller
  * can tell an unfaceted field from one that faceted to nothing.
  *
+ * What OpenRegister puts beside the buckets is carried through rather than
+ * dropped: `missing` (how many objects in scope hold no value, sent as
+ * `{ results }` or `{ count }`), `type` and `title`. A missing count is only
+ * set when the backend sent one, for the same reason a bucket count is.
+ *
  * @param {object} facets The `facets` block of an API response
- * @return {object} `{ fieldName: { values: [{ value, count?, label? }] } }`
+ * @return {object} `{ fieldName: { values: [{ value, count?, label? }], missing?, type?, title? } }`
  */
 export function normalizeFacets(facets) {
 	const transformed = {}
@@ -54,12 +69,69 @@ export function normalizeFacets(facets) {
 		if (!buckets) {
 			continue
 		}
-		transformed[key] = { values: buckets.map(normalizeFacetBucket) }
+		const normalized = { values: buckets.map(normalizeFacetBucket) }
+
+		const missing = facet.missing?.results ?? facet.missing?.count
+		if (typeof missing === 'number') {
+			normalized.missing = missing
+		}
+		for (const name of ['type', 'title']) {
+			if (facet[name] !== undefined && facet[name] !== null) {
+				normalized[name] = facet[name]
+			}
+		}
+
+		transformed[key] = normalized
 	}
 
 	return transformed
 }
 
+/**
+ * The sidebar options for one normalised facet, with the missing-value option
+ * appended when some objects hold no value.
+ *
+ * @param {object|undefined} facet        A normalised facet from {@link normalizeFacets}
+ * @param {function(number): string} missingLabel Renders the missing option's label from its count
+ * @return {Array<{id: unknown, label: string}>|null} The options, or null when the
+ *   facet offers nothing, so the caller can fall back to its static options
+ */
+export function facetOptions(facet, missingLabel) {
+	const options = (facet?.values || []).map((v) => ({
+		id: v.value,
+		label: facetOptionLabel(v),
+	}))
+
+	if (typeof facet?.missing === 'number' && facet.missing > 0) {
+		options.push({ id: MISSING_VALUE, label: missingLabel(facet.missing) })
+	}
+
+	return options.length > 0 ? options : null
+}
+
+/**
+ * The query parameters one facet selection sends.
+ *
+ * An ordinary selection is the property itself, one value unwrapped and
+ * several as a list. The missing-value option is exclusive: no object both
+ * holds one of the chosen values and holds none, so combining them would
+ * always answer an empty list. It is sent as `<property>_isnull=true`.
+ *
+ * @param {string} key      The filtered property
+ * @param {Array} values    The selected option ids
+ * @return {object} The parameters to merge into the request
+ */
+export function facetFilterParams(key, values) {
+	if (!Array.isArray(values) || values.length === 0) {
+		return {}
+	}
+	if (values.includes(MISSING_VALUE)) {
+		return { [`${key}_isnull`]: 'true' }
+	}
+
+	return { [key]: values.length === 1 ? values[0] : values }
+}
+
 /**
  * Build the visible label for one faceted filter option.
  *

package/src/utils/fillTemplate.js

@@ -49,6 +49,11 @@ function formatValue(value, format, now) {
 	if (format === 'datetime') {
 		return formatBoardDateTime(value, now)
 	}
+	if (format === 'days') {
+		// Whole days from the date to now (0 for today; negative for a future date).
+		const date = parseDateValue(value)
+		return date === null ? '' : String(Math.floor((now.getTime() - date.getTime()) / 86400000))
+	}
 	return String(value)
 }
 
@@ -57,7 +62,8 @@ function formatValue(value, format, now) {
  * `"Termijn {deadline|date}"` from an object.
  *
  * Every `{path}` token is a dot path into the object; `{path|date}` and
- * `{path|datetime}` format it as the boards write dates. A token without a
+ * `{path|datetime}` format it as the boards write dates, and `{path|days}` is the
+ * whole days since that date ("has waited {createdAt|days} days"). A token without a
  * value empties the WHOLE template, because "Termijn " is worse than nothing.
  * A template without tokens is returned as written (a constant label).
  *

package/src/utils/pageControls.js

@@ -0,0 +1,78 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * pageControls: how a list widget listens to the page's controls.
+ *
+ * A page control (a `workspace-filter` select or switch) writes a value to the
+ * page workspace. A list widget declares which control it listens to and what
+ * the value means for it:
+ *
+ *   pageControls: {
+ *     sort:   { key: "sort", map: { deadline: { field: "slaDeadline", dir: "asc" } } },
+ *     toggle: { key: "showDone", removes: ["status"] }
+ *   }
+ *
+ * `sort`: the workspace value at `key` picks an entry of `map` (the sort the
+ * list uses); a value with no entry leaves the list's own sort.
+ * `toggle`: while the workspace value at `key` is on (true, "1", "true"), the
+ * filter keys in `removes` are dropped, so a list that hides finished work
+ * shows it.
+ *
+ * @module utils/pageControls
+ */
+
+/**
+ * Whether a workspace value reads as on.
+ *
+ * @param {unknown} value The value.
+ * @return {boolean} True for true, 1, "1" and "true".
+ */
+export function isOn(value) {
+	return value === true || value === 1 || value === '1' || value === 'true'
+}
+
+/**
+ * The sort a list uses once the page's sort control is read.
+ *
+ * @param {object|null} pageControls The widget's `pageControls`.
+ * @param {object} workspace The plain workspace bag.
+ * @param {{field: string, dir?: string}|null} own The list's own sort.
+ * @return {{field: string, dir?: string}|null} The sort to use.
+ * @spec openspec/changes/screens-page-controls/specs/page-controls/spec.md#requirement-a-list-listens-to-the-pages-controls
+ */
+export function pageSort(pageControls, workspace, own) {
+	const listen = pageControls && typeof pageControls === 'object' ? pageControls.sort : null
+	if (!listen || typeof listen.key !== 'string' || !listen.map || typeof listen.map !== 'object') {
+		return own
+	}
+	const chosen = workspace ? workspace[listen.key] : undefined
+	const entry = chosen !== undefined && chosen !== null ? listen.map[String(chosen)] : null
+	return entry && typeof entry === 'object' && typeof entry.field === 'string' && entry.field !== '' ? entry : own
+}
+
+/**
+ * The filter a list uses once the page's toggle is read: with the toggle on,
+ * the keys it `removes` are gone.
+ *
+ * @param {object|null} pageControls The widget's `pageControls`.
+ * @param {object} workspace The plain workspace bag.
+ * @param {object} filter The list's own filter (before token resolution).
+ * @return {object} The filter to use (the same object when nothing is removed).
+ * @spec openspec/changes/screens-page-controls/specs/page-controls/spec.md#requirement-a-list-listens-to-the-pages-controls
+ */
+export function pageFilter(pageControls, workspace, filter) {
+	const listen = pageControls && typeof pageControls === 'object' ? pageControls.toggle : null
+	const base = filter && typeof filter === 'object' ? filter : {}
+	if (!listen || typeof listen.key !== 'string' || !Array.isArray(listen.removes)) {
+		return base
+	}
+	if (!isOn(workspace ? workspace[listen.key] : undefined)) {
+		return base
+	}
+	const out = { ...base }
+	for (const key of listen.removes) {
+		delete out[key]
+	}
+	return out
+}

package/src/utils/personalLenses.js

@@ -37,6 +37,42 @@ export function personalLensTabs(lenses) {
 		.map((id) => ({ label: labels[id], filter: { [LENS_FILTER_KEYS[id]]: true }, lens: id }))
 }
 
+/**
+ * Turn the `empty` / `notEmpty` shorthand of quick filters into a filter.
+ *
+ * `{ label: "Not logged in yet", empty: "lastLoginAt" }` is the rows where the
+ * field has no value: the filter `{ lastLoginAt: { isnull: true } }`, which
+ * OpenRegister reads as `lastLoginAt[isnull]=true`. `notEmpty` is the rows
+ * where it has one. Either takes a field or a list of fields and merges with
+ * the entry's own `filter`. Returns the same array when no entry uses it.
+ *
+ * @param {Array<object>|null} quickFilters The page's quick filters.
+ * @return {Array<object>|null} The quick filters with the shorthand expanded.
+ */
+export function expandEmptyFilters(quickFilters) {
+	if (!Array.isArray(quickFilters)) {
+		return quickFilters
+	}
+	const uses = (tab) => tab && typeof tab === 'object' && (tab.empty || tab.notEmpty)
+	if (!quickFilters.some(uses)) {
+		return quickFilters
+	}
+	const fieldsOf = (value) => (Array.isArray(value) ? value : [value]).filter((f) => typeof f === 'string' && f !== '')
+	return quickFilters.map((tab) => {
+		if (!uses(tab)) {
+			return tab
+		}
+		const filter = { ...(tab.filter && typeof tab.filter === 'object' ? tab.filter : {}) }
+		for (const field of fieldsOf(tab.empty)) {
+			filter[field] = { isnull: true }
+		}
+		for (const field of fieldsOf(tab.notEmpty)) {
+			filter[field] = { isnull: false }
+		}
+		return { ...tab, filter }
+	})
+}
+
 /**
  * The page's quick filters with its personal lenses appended. A page with no
  * quick filters of its own gets an "All" tab first, so a lens is not active
@@ -48,10 +84,11 @@ export function personalLensTabs(lenses) {
  */
 export function withPersonalLenses(quickFilters, lenses) {
 	const tabs = personalLensTabs(lenses)
+	const expanded = expandEmptyFilters(quickFilters)
 	if (tabs.length === 0) {
-		return quickFilters
+		return expanded
 	}
-	const own = Array.isArray(quickFilters) ? quickFilters : []
+	const own = Array.isArray(expanded) ? expanded : []
 	return own.length > 0
 		? [...own, ...tabs]
 		: [{ label: t('nextcloud-vue', 'All'), filter: {}, default: true }, ...tabs]

package/src/utils/resolveFilterTokens.js

@@ -67,7 +67,9 @@
 
 import { getCurrentUser } from '@nextcloud/auth'
 import { TODAY_DELTA_RE } from './sentinelTokens.js'
-import { peekCurrentUserGroups } from './widgetVisibility.js'
+// userGroupsPeek, not widgetVisibility: that one imports @nextcloud/axios, and
+// this resolver runs on public pages and in node (see userGroupsPeek.js).
+import { peekCurrentUserGroups } from './userGroupsPeek.js'
 
 /** The filter token for the current user's group ids. */
 export const MY_GROUPS_TOKEN = '@myGroups'

package/src/utils/resolveManifestTokens.js

@@ -54,6 +54,8 @@ export const SENTINEL_RESOLVERS = Object.freeze({
 	declarative: 'fetchAggregate (OpenRegister server-side)',
 	visibleWhen: 'evaluateVisibleWhen (utils/visibleWhen.js)',
 	answer: 'resolveAssignValue (utils/formAssign.js)',
+	row: 'CnFieldListWidget (rowActions request)',
+	subject: 'CnBannerWidget (action route)',
 })
 
 /**

package/src/utils/sentinelTokens.js

@@ -83,6 +83,12 @@ export const SENTINEL_TOKEN_PATTERNS = Object.freeze({
 	visibleWhen: '^@total$',
 	// form-live-values: another answer in the same form, read by a field's `assign` rule.
 	answer: '^@answer\\.[A-Za-z][A-Za-z0-9_]*$',
+	// A field of the row a row action is run on (`@row.<field>`, dot path), read by the
+	// field-list widget's `rowActions` request URL and payload.
+	row: '^@row\\.[A-Za-z][A-Za-z0-9_.@]*$',
+	// A field of the record a start-here attention card names (`@subject.<field>`, dot path),
+	// read by the banner widget's action routes.
+	subject: '^@subject\\.[A-Za-z][A-Za-z0-9_.]*$',
 	// Deprecated-but-not-yet-removed tokens. Kept in the schema union so
 	// deployed manifests still validate during the migration window; the gate
 	// downgrades them to a WARN (see SENTINEL_DEPRECATIONS).
@@ -90,7 +96,7 @@ export const SENTINEL_TOKEN_PATTERNS = Object.freeze({
 })
 
 /**
- * The eight canonical context names (excludes `deprecated`, which is a
+ * The nine canonical context names (excludes `deprecated`, which is a
  * transitional overlay, not a resolution context).
  *
  * @type {string[]}
@@ -104,6 +110,8 @@ export const SENTINEL_CONTEXTS = Object.freeze([
 	'declarative',
 	'visibleWhen',
 	'answer',
+	'row',
+	'subject',
 ])
 
 /**
@@ -154,6 +162,16 @@ export const SENTINEL_VOCABULARY = Object.freeze({
 		description: 'Another answer in the same form, read by a field\'s `assign` rule.',
 		members: ['@answer.<field>'],
 	},
+	row: {
+		resolver: 'CnFieldListWidget (rowActions request url and payload)',
+		description: 'A field of the row a row action runs on, read by the field-list widget when it sends the action\'s request. Dot paths are allowed (`@row.owner.id`).',
+		members: ['@row.<field>'],
+	},
+	subject: {
+		resolver: 'CnBannerWidget (action route params and query)',
+		description: 'A field of the record an attention card names (the first row of its ordered `visibleWhen` source query), read when the card builds an action\'s route. Dot paths are allowed (`@subject.owner.id`).',
+		members: ['@subject.<field>'],
+	},
 })
 
 /**

package/src/utils/userGroupsPeek.js

@@ -0,0 +1,87 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The synchronous, reactive read of the current user's group ids, without
+ * the request that loads them.
+ *
+ * `resolveFilterTokens` (and through it `visibleWhen`) needs the groups for
+ * `@myGroups`, and those utilities are used on public, signed-out pages too.
+ * Importing `widgetVisibility.js` statically pulled `@nextcloud/axios` and
+ * `@nextcloud/router` into every bundle that resolves a filter token: a public
+ * site bundle broke its size budget, and node specs crashed because axios
+ * reads the request token when it is imported. This module imports no
+ * `@nextcloud/*` package. It loads `widgetVisibility.js` lazily, only the
+ * first time a signed-in user's groups are actually peeked.
+ *
+ * @module utils/userGroupsPeek
+ */
+
+import { reactive } from 'vue'
+
+/**
+ * Reactive mirror of the group cache, keyed by user id. A computed that reads
+ * a missing key tracks it, so it re-runs when the groups arrive.
+ *
+ * @type {{ byUser: Record<string, string[]> }}
+ */
+const _peek = reactive({ byUser: {} })
+
+/** User ids whose groups a peek already asked for (not reactive on purpose). */
+const _peekRequested = new Set()
+
+/**
+ * Get the current Nextcloud user ID from OC.currentUser.
+ *
+ * @return {string|null} The current user ID, or null if not logged in
+ */
+export function getCurrentUserId() {
+	return window.OC?.currentUser?.uid
+		|| window.OC?.currentUser
+		|| null
+}
+
+/**
+ * Synchronous, reactive read of the current user's group ids, for code that
+ * cannot await (the `@myGroups` filter token). Returns the ids once they are
+ * loaded, `null` while the first request is in flight (and starts that
+ * request on first use), and `[]` when nobody is signed in. Read inside a
+ * computed, the computed re-runs when the groups arrive.
+ *
+ * @spec openspec/changes/nextcloud-group-surfaces/specs/schema-utilities/spec.md#requirement-mygroups-resolves-to-the-current-users-group-ids
+ * @return {string[]|null} The group ids, or null while loading.
+ */
+export function peekCurrentUserGroups() {
+	const userId = getCurrentUserId()
+	if (!userId) {
+		return []
+	}
+	const known = _peek.byUser[userId]
+	if (Array.isArray(known)) {
+		return known
+	}
+	if (!_peekRequested.has(userId)) {
+		_peekRequested.add(userId)
+		import('./widgetVisibility.js')
+			.then((module) => module.getCurrentUserGroups())
+			.then((groups) => {
+				_peek.byUser[userId] = Array.isArray(groups) ? [...groups] : []
+			})
+			.catch(() => {
+				_peek.byUser[userId] = []
+			})
+	}
+	return null
+}
+
+/**
+ * Forget every peeked group list. `resetVisibilityCache()` calls this.
+ *
+ * @spec exclude test helper behind resetVisibilityCache, no behaviour of its own
+ */
+export function resetGroupsPeek() {
+	_peekRequested.clear()
+	for (const key of Object.keys(_peek.byUser)) {
+		delete _peek.byUser[key]
+	}
+}