@conduction/nextcloud-vue 2.58.0 → 2.60.0

package/src/integrations/builtin/talk/CnTalkCard.vue

@@ -111,7 +111,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcAvatar, NcCounterBubble, NcLoadingIcon } from '@nextcloud/vue'
 import ChatOutline from 'vue-material-design-icons/ChatOutline.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
@@ -252,8 +252,9 @@ export default {
 			return stripMarker(raw) || String(this.roomKey(room))
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		roomUrl(room) {
-			if (room.url) {
+			if (room.url && safeHref(room.url) !== '#') {
 				return room.url
 			}
 			const token = room.token ?? room.id ?? ''

package/src/integrations/builtin/talk/CnTalkTab.vue

@@ -60,8 +60,7 @@
 			<NcButton
 				variant="primary"
 				:href="talkAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<ChatOutline :size="20" />
 				</template>
@@ -107,8 +106,7 @@
 					<NcActionLink
 						:closeAfterClick="true"
 						:href="roomUrl(room)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -149,7 +147,7 @@ import OpenInNew from 'vue-material-design-icons/OpenInNew.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnTalkRoomCreate from '../../../components/CnTalkRoomCreate/CnTalkRoomCreate.vue'
 import CnTalkRoomPicker from '../../../components/CnTalkRoomPicker/CnTalkRoomPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 import { stripMarker } from '../../utils/marker.js'
 
 /**
@@ -247,8 +245,9 @@ export default {
 			return stripMarker(raw) || String(this.roomKey(room))
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		roomUrl(room) {
-			if (room.url) {
+			if (room.url && safeHref(room.url) !== '#') {
 				return room.url
 			}
 			const token = room.roomToken ?? room.token ?? room.id ?? ''

package/src/integrations/builtin/time-tracker/CnTimeTrackerCard.vue

@@ -119,7 +119,7 @@ import { NcLoadingIcon } from '@nextcloud/vue'
 import Clock from 'vue-material-design-icons/Clock.vue'
 import Timer from 'vue-material-design-icons/Timer.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 
@@ -307,7 +307,7 @@ export default {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const kind = this.rowKind(row)

package/src/integrations/builtin/time-tracker/CnTimeTrackerTab.vue

@@ -81,8 +81,7 @@
 			<NcButton
 				variant="primary"
 				:href="timeTrackerAppUrl"
-				target="_blank"
-				rel="noopener noreferrer">
+				target="_blank">
 				<template #icon>
 					<Clock :size="20" />
 				</template>
@@ -185,7 +184,7 @@ import Plus from 'vue-material-design-icons/Plus.vue'
 import Timer from 'vue-material-design-icons/Timer.vue'
 import CnTimeTrackerCreate from '../../../components/CnTimeTrackerCreate/CnTimeTrackerCreate.vue'
 import CnTimeTrackerPicker from '../../../components/CnTimeTrackerPicker/CnTimeTrackerPicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 /**
  * CnTimeTrackerTab — bespoke sidebar tab for the `time-tracker`
@@ -361,7 +360,7 @@ export default {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const kind = this.rowKind(row)

package/src/integrations/builtin/xwiki/CnXwikiCard.vue

@@ -138,7 +138,7 @@ import { translatePlural as n, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon } from '@nextcloud/vue'
 import FileDocumentMultiple from 'vue-material-design-icons/FileDocumentMultiple.vue'
 import CnDetailCard from '../../../components/CnDetailCard/CnDetailCard.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const VALID_SURFACES = ['user-dashboard', 'app-dashboard', 'detail-page', 'single-entity']
 const PREVIEW_MAX_CHARS = 500
@@ -303,8 +303,10 @@ export default {
 			return String(page.title ?? page.page ?? page.reference ?? this.pageKey(page))
 		},
 
+		// An unsafe scheme is treated like a missing URL.
 		pageUrl(page) {
-			return page.url ?? ''
+			const url = page.url ?? ''
+			return url && safeHref(url) !== '#' ? url : ''
 		},
 
 		breadcrumbLabel(page) {

package/src/integrations/builtin/xwiki/CnXwikiTab.vue

@@ -64,7 +64,6 @@
 				class="cn-xwiki-tab__banner-cta"
 				:href="banner.ctaHref || undefined"
 				:target="banner.ctaHref ? '_blank' : undefined"
-				:rel="banner.ctaHref ? 'noopener noreferrer' : undefined"
 				@click="banner.ctaHandler">
 				{{ banner.ctaLabel }}
 			</NcButton>
@@ -132,8 +131,7 @@
 						class="cn-xwiki-tab__open"
 						:closeAfterClick="true"
 						:href="pageHref(page)"
-						target="_blank"
-						rel="noopener noreferrer">
+						target="_blank">
 						<template #icon>
 							<OpenInNew :size="20" />
 						</template>
@@ -181,7 +179,7 @@ import OpenInNew from 'vue-material-design-icons/OpenInNew.vue'
 import Plus from 'vue-material-design-icons/Plus.vue'
 import CnXwikiPageCreate from '../../../components/CnXwikiPageCreate/CnXwikiPageCreate.vue'
 import CnXwikiPagePicker from '../../../components/CnXwikiPagePicker/CnXwikiPagePicker.vue'
-import { buildHeaders, prefixUrl } from '../../../utils/index.js'
+import { buildHeaders, prefixUrl, safeHref } from '../../../utils/index.js'
 
 const EXCERPT_MAX_CHARS = 140
 
@@ -386,15 +384,17 @@ export default {
 
 		/**
 		 * External XWiki deep-link for the page. Empty string when the
-		 * provider didn't surface a `url`, so the row renders as a plain
-		 * (non-anchored) NcListItem rather than a dead link.
+		 * provider didn't surface a `url`, or surfaced an unsafe scheme, so
+		 * the row renders as a plain (non-anchored) NcListItem rather than a
+		 * dead link.
 		 *
 		 * @param {object} page Provider row.
 		 *
 		 * @return {string} Absolute XWiki URL or ''.
 		 */
 		pageHref(page) {
-			return String(page.url ?? '')
+			const url = String(page.url ?? '')
+			return url && safeHref(url) !== '#' ? url : ''
 		},
 
 		breadcrumbLabel(page) {

package/src/integrations/builtin/xwiki/__tests__/CnXwikiTab.spec.js

@@ -55,6 +55,15 @@ describe('CnXwikiTab', () => {
 		delete global.fetch
 	})
 
+	it('gives a page with an unsafe URL no link', async () => {
+		global.fetch = jest.fn().mockResolvedValue({ ok: true, status: 200, json: () => Promise.resolve({ results: [] }) })
+		const wrapper = mount(CnXwikiTab, { propsData: { ...DEFAULT_PROPS } })
+		await flushPromises()
+		expect(wrapper.vm.pageHref({ url: 'javascript:alert(1)' })).toBe('')
+		expect(wrapper.vm.pageHref({ url: 'https://wiki.example/p' })).toBe('https://wiki.example/p')
+		wrapper.unmount()
+	})
+
 	it('renders the empty state when no pages are linked', async () => {
 		global.fetch = jest.fn().mockResolvedValueOnce({ ok: true, status: 200, json: () => Promise.resolve({ results: [] }) })
 		const wrapper = mount(CnXwikiTab, { propsData: { ...DEFAULT_PROPS } })

package/src/schemas/app-manifest-v2.schema.json

@@ -240,6 +240,29 @@
 					"$ref": "#/$defs/primaryAction",
 					"description": "App-wide default primary action rendered as an NcAppNavigationNew button above the main menu list. A page-scoped pages[].primaryAction for the current route wins over this default."
 				},
+				"brand": {
+					"type": "object",
+					"additionalProperties": false,
+					"description": "A brand block at the very top of the app navigation, above the primary action: a logo, a name and a caption. Rendered by CnAppNav. Omitted, nothing renders there.",
+					"properties": {
+						"logo": {
+							"type": "string",
+							"description": "URL of the logo image. Decorative when `name` is set."
+						},
+						"name": {
+							"type": "string",
+							"description": "i18n key / text for the app or organisation name."
+						},
+						"caption": {
+							"type": "string",
+							"description": "i18n key / text for the line under the name, for example the organisation."
+						},
+						"alt": {
+							"type": "string",
+							"description": "i18n key / alternative text for the logo. Used only when no `name` is set."
+						}
+					}
+				},
 				"featureRequestRepo": {
 					"type": "string",
 					"description": "`<owner>/<repo>` slug on the forge that the in-product feature-request deep-link targets (provided to descendants as `cnFeatureRequestRepo`). Falls back to `Conduction/<appId>` when omitted."
@@ -976,6 +999,72 @@
 				"swimlaneField": {
 					"type": "string",
 					"description": "A second field to group the board into rows by, while the columns stay the stages. Cards with no value for it land in one named row, last, rather than being dropped: grouping by handler and hiding the unassigned work turns a board into a picture of what is already somebody's problem."
+				},
+				"dueRule": {
+					"$ref": "#/$defs/dueRule",
+					"description": "Marks late cards. A card whose date is before today gets an error edge and the label 'Overdue'; one due within `soonDays` gets 'Due soon'. Omitted, no card is marked."
+				}
+			}
+		},
+		"headerPill": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["field"],
+			"description": "A pill in a detail page header, rendered through CnStatusBadge from one field of the record. Nothing renders while the field is empty.",
+			"properties": {
+				"field": {
+					"type": "string",
+					"minLength": 1,
+					"description": "Dot-path to the value on the record."
+				},
+				"colorMap": {
+					"type": "object",
+					"description": "Raw value to badge variant. Keys are matched ignoring case.",
+					"additionalProperties": { "type": "string", "enum": ["default", "primary", "success", "warning", "error", "info"] }
+				},
+				"labels": {
+					"type": "object",
+					"description": "Raw value to the i18n key / text to show. A value without an entry is shown as is.",
+					"additionalProperties": { "type": "string" }
+				},
+				"variant": {
+					"type": "string",
+					"enum": ["default", "primary", "success", "warning", "error", "info"],
+					"default": "default",
+					"description": "Badge variant for a value `colorMap` does not name."
+				}
+			}
+		},
+		"dueRule": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["field"],
+			"description": "How a surface decides that a dated item is late. One shape for boards and lists, so a list and its board agree. A date before today is overdue. Days are whole calendar days in the reader's own timezone.",
+			"properties": {
+				"field": {
+					"type": "string",
+					"minLength": 1,
+					"description": "Dot-path to the due date on the row."
+				},
+				"soonDays": {
+					"type": "integer",
+					"minimum": 0,
+					"default": 3,
+					"description": "How many days ahead still counts as due soon. 0 marks only today."
+				},
+				"variantWhen": {
+					"type": "array",
+					"description": "The full rule list, in the shape a table's date cell uses, for a board that needs more than `soonDays`. Compared against the calendar days until the date (0 is today, negative is past); first match wins. `error` marks the card overdue, `warning` due soon. When set, `soonDays` is ignored.",
+					"items": {
+						"type": "object",
+						"additionalProperties": false,
+						"required": ["op", "value", "variant"],
+						"properties": {
+							"op": { "type": "string", "enum": ["eq", "neq", "gt", "gte", "lt", "lte"] },
+							"value": { "type": "number" },
+							"variant": { "type": "string", "enum": ["default", "success", "warning", "error", "danger"] }
+						}
+					}
 				}
 			}
 		},
@@ -1575,6 +1664,47 @@
 											{ "type": "string" },
 											{ "type": "object", "additionalProperties": true }
 										]
+									},
+									"layout": {
+										"type": "string",
+										"enum": ["banner", "attention"],
+										"default": "banner",
+										"description": "How the banner renders. `banner` (default) is the note card. `attention` is a card with a severity edge, a kicker, a title, a reason line and up to two actions."
+									},
+									"kicker": {
+										"type": "string",
+										"description": "Attention card: the small label above the title."
+									},
+									"title": {
+										"type": "string",
+										"description": "Attention card: the title. Falls back to `text`."
+									},
+									"reason": {
+										"type": "string",
+										"description": "Attention card: the line that says why this needs attention. `{value}` is replaced by the value visibleWhen read."
+									},
+									"actions": {
+										"type": "array",
+										"maxItems": 2,
+										"description": "Attention card: at most two actions. The first is the primary one unless an action sets `primary: true`.",
+										"items": {
+											"type": "object",
+											"required": ["label"],
+											"additionalProperties": false,
+											"properties": {
+												"id": { "type": "string", "description": "Identifier passed with the `action` event of an action that has no route or href." },
+												"label": { "type": "string", "description": "The text on the action." },
+												"route": {
+													"description": "A vue-router route NAME (string) or a full location object.",
+													"oneOf": [
+														{ "type": "string" },
+														{ "type": "object", "additionalProperties": true }
+													]
+												},
+												"href": { "type": "string", "description": "An URL, used when there is no route." },
+												"primary": { "type": "boolean", "description": "Render this action as the primary one." }
+											}
+										}
 									}
 								}
 							}
@@ -1875,6 +2005,125 @@
 							}
 						}
 					}
+				},
+				{
+					"description": "week-strip catalog widget (CnWeekStripWidget): the current week as day columns with the dated items under each day. Takes a `props.content` blob. Items come from an OpenRegister `source` (one request for the week, bucketed by `dateField`) or from static `items`.",
+					"if": {
+						"properties": { "widgetKey": { "const": "week-strip" } },
+						"required": ["widgetKey"]
+					},
+					"then": {
+						"properties": {
+							"props": {
+								"type": "object",
+								"properties": {
+									"content": {
+										"type": "object",
+										"additionalProperties": true,
+										"properties": {
+											"days": { "type": "integer", "enum": [5, 7], "default": 5, "description": "5 working days (default) or the whole week. The week starts on Monday." },
+											"source": {
+												"type": "object",
+												"additionalProperties": false,
+												"required": ["register", "schema"],
+												"description": "OpenRegister object query; `filter` supports the shared @-token grammar.",
+												"properties": {
+													"register": { "type": "string" },
+													"schema": { "type": "string" },
+													"filter": { "type": "object", "additionalProperties": true },
+													"limit": { "type": "integer", "minimum": 1, "description": "Cap on the records fetched for the week (default 100)." }
+												}
+											},
+											"dateField": { "type": "string", "description": "The field the items are bucketed by. Required with a source." },
+											"titleField": { "type": "string", "description": "The field shown as the item title. Defaults to the object's display name." },
+											"metaFields": { "type": "array", "items": { "type": "string" }, "description": "Fields shown under the title." },
+											"itemRoute": { "type": "string", "description": "Route name an item links to; the record id goes in params.id." },
+											"lateWhen": {
+												"type": "object",
+												"additionalProperties": false,
+												"description": "Rule on the number of days until the date that marks an item late. Default: before today ({ op: 'lt', value: 0 }).",
+												"properties": {
+													"op": { "type": "string", "enum": ["eq", "neq", "gt", "gte", "lt", "lte"] },
+													"value": { "type": "number" }
+												}
+											},
+											"lateField": { "type": "string", "description": "A boolean field that marks a record late, whatever its date." },
+											"items": {
+												"type": "array",
+												"description": "Static items, used when there is no source.",
+												"items": {
+													"type": "object",
+													"required": ["title", "date"],
+													"additionalProperties": false,
+													"properties": {
+														"title": { "type": "string" },
+														"meta": { "type": "string" },
+														"date": { "type": "string", "description": "ISO date or date-time." },
+														"route": { "oneOf": [{ "type": "string" }, { "type": "object", "additionalProperties": true }] },
+														"href": { "type": "string" },
+														"late": { "type": "boolean" }
+													}
+												}
+											},
+											"emptyText": { "type": "string", "description": "Text of a day without items." },
+											"weekOffset": { "type": "integer", "description": "Whole weeks from the current one (1 = next week)." }
+										}
+									}
+								}
+							}
+						}
+					}
+				},
+				{
+					"description": "stacked-bar catalog widget (CnStackedBarWidget): one segmented bar with a legend that carries the label and count of every segment. Takes a `props.content` blob. Segments come from one grouped count request (`source.groupBy`) or from static `segments`.",
+					"if": {
+						"properties": { "widgetKey": { "const": "stacked-bar" } },
+						"required": ["widgetKey"]
+					},
+					"then": {
+						"properties": {
+							"props": {
+								"type": "object",
+								"properties": {
+									"content": {
+										"type": "object",
+										"additionalProperties": true,
+										"properties": {
+											"source": {
+												"type": "object",
+												"additionalProperties": false,
+												"required": ["register", "schema", "groupBy"],
+												"description": "OpenRegister grouped count; `filter` supports the shared @-token grammar.",
+												"properties": {
+													"register": { "type": "string" },
+													"schema": { "type": "string" },
+													"groupBy": { "type": "string", "description": "The field the records are counted per." },
+													"filter": { "type": "object", "additionalProperties": true }
+												}
+											},
+											"segments": {
+												"type": "array",
+												"description": "Static segments, used when there is no source.",
+												"items": {
+													"type": "object",
+													"required": ["label", "value"],
+													"additionalProperties": false,
+													"properties": {
+														"key": { "type": "string" },
+														"label": { "type": "string" },
+														"value": { "type": "number", "minimum": 0 }
+													}
+												}
+											},
+											"order": { "type": "array", "items": { "type": "string" }, "description": "Group keys in the order they render. Unlisted groups follow; a listed key without records shows 0." },
+											"labels": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The label of a group key." },
+											"emptyText": { "type": "string", "description": "Shown when the total is 0." }
+										}
+									}
+								}
+							}
+						}
+					}
 				}
 			]
 		},
@@ -2264,6 +2513,16 @@
 					"type": "string",
 					"description": "i18n key naming the `children` dropdown. Falls back to the parent action's own label, so the chevron is never announced unlabelled."
 				},
+				"group": {
+					"type": "string",
+					"minLength": 1,
+					"description": "Detail page header actions only. i18n key / text naming the group this action sits in inside the overflow menu. Grouped actions render under a caption with this name, in first appearance order, after the ungrouped ones. Ignored on other surfaces."
+				},
+				"adminOnly": {
+					"type": "boolean",
+					"default": false,
+					"description": "Detail page header actions only. Shows the action to instance admins alone, in the last group of the overflow menu. Hides a control and nothing more: the endpoint behind the action still decides who may call it. Ignored on other surfaces."
+				},
 				"visibleWhen": {
 					"$ref": "#/$defs/visibleWhen",
 					"description": "#91 Wave 3: an optional predicate gating whether the action renders — the shared banner shape ({ endpoint | source | field, op, value }). The `field`-only LOCAL form evaluates against the page object context (a detail action shown only in the right lifecycle state); endpoint / source forms fetch. Fail-safe: a broken predicate hides the action."
@@ -2887,7 +3146,7 @@
 						},
 						"columns": {
 							"type": "array",
-							"description": "Table columns (for type='index' and type='logs'). Items may be strings (legacy shorthand) or column objects ({ key, label, sortable?, width?, formatter?, formatterOptions?, widget?, widgetProps?, format?, aggregate? }). `formatter` resolves against cnFormatters (built-ins incl. currency / conditionalPhrase — configured via `formatterOptions`); `widget` resolves against cnCellWidgets (built-ins incl. badge / fkResolve / link).",
+							"description": "Table columns (for type='index' and type='logs'). Items may be strings (legacy shorthand) or column objects ({ key, label, sortable?, width?, formatter?, formatterOptions?, widget?, widgetProps?, format?, aggregate? }). `formatter` resolves against cnFormatters (built-ins incl. currency / conditionalPhrase — configured via `formatterOptions`); `widget` resolves against cnCellWidgets (built-ins incl. badge / fkResolve / link / avatar / date).",
 							"items": {
 								"oneOf": [
 									{ "type": "string" },
@@ -2936,6 +3195,127 @@
 								"additionalProperties": true
 							}
 						},
+						"stageField": {
+							"type": "string",
+							"minLength": 1,
+							"default": "status",
+							"description": "type='detail': dot-path to the field holding the record's stage. Read by `primaryActionByStage` and `nextStep`."
+						},
+						"primaryActionByStage": {
+							"type": "object",
+							"description": "type='detail': the page's primary button per stage. Keys are values of `stageField` (matched exactly first, then ignoring case). A value is an action in the header action shape, or the id of a `headerActions` entry, which then leaves the overflow menu. A stage without an entry falls back to the page's `primaryAction`.",
+							"additionalProperties": {
+								"oneOf": [
+									{ "type": "string", "minLength": 1 },
+									{ "$ref": "#/$defs/action" }
+								]
+							}
+						},
+						"quickActions": {
+							"type": "array",
+							"maxItems": 3,
+							"description": "type='detail': at most three always visible buttons in the header, for the actions a handler uses on every record. An item is an action in the header action shape, or the id of a `headerActions` entry, which then leaves the overflow menu.",
+							"items": {
+								"oneOf": [
+									{ "type": "string", "minLength": 1 },
+									{ "$ref": "#/$defs/action" }
+								]
+							}
+						},
+						"actionsMenu": {
+							"type": "object",
+							"additionalProperties": false,
+							"description": "type='detail': what the header's overflow menu itself shows. Omitted, the menu keeps Refresh and the three help links.",
+							"properties": {
+								"showRefresh": {
+									"type": "boolean",
+									"description": "false removes Refresh from the menu."
+								},
+								"showHelpLinks": {
+									"type": "boolean",
+									"description": "false removes Request a feature, Report a bug and Documentation, for an app that offers them in its own help menu."
+								},
+								"label": {
+									"type": "string",
+									"minLength": 1,
+									"description": "i18n key / text naming the menu, for example 'More'. Defaults to 'Actions'."
+								}
+							}
+						},
+						"nextStep": {
+							"type": "object",
+							"additionalProperties": false,
+							"required": ["stages"],
+							"description": "type='detail': the 'what now' card above the body. For the record's stage it shows a short checklist next to the primary button. A stage without an entry shows no card. Rendered by CnNextStepCard.",
+							"properties": {
+								"field": {
+									"type": "string",
+									"minLength": 1,
+									"description": "Dot-path to the stage, when it differs from `stageField`."
+								},
+								"title": {
+									"type": "string",
+									"description": "i18n key / heading used by a stage that names none."
+								},
+								"stages": {
+									"type": "object",
+									"description": "Keys are stage values.",
+									"additionalProperties": {
+										"type": "object",
+										"additionalProperties": false,
+										"required": ["checklist"],
+										"properties": {
+											"title": { "type": "string", "description": "i18n key / heading of the card for this stage." },
+											"after": { "type": "string", "description": "i18n key / one line under the button saying what follows." },
+											"checklist": {
+												"type": "array",
+												"description": "What this stage still needs. An empty list shows no card.",
+												"items": {
+													"type": "object",
+													"additionalProperties": false,
+													"required": ["label"],
+													"properties": {
+														"label": { "type": "string", "minLength": 1, "description": "i18n key / text of the item." },
+														"hint": { "type": "string", "description": "i18n key / short note after the label, for example '2 of 5 done'." },
+														"doneField": { "type": "string", "minLength": 1, "description": "Dot-path on the record. The item is done when it holds a value; a list counts when it is not empty." },
+														"doneWhen": { "type": "object", "description": "A local visibleWhen condition ({ field, op, value } or { all | any }). The item is done when it is true. Wins over `doneField`." },
+														"done": { "type": "boolean", "description": "A fixed state, for an item the record cannot answer." }
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						},
+						"typePill": {
+							"$ref": "#/$defs/headerPill",
+							"description": "type='detail': a pill above the title saying what kind of record this is."
+						},
+						"statusPill": {
+							"$ref": "#/$defs/headerPill",
+							"description": "type='detail': a pill above the title saying where the record stands."
+						},
+						"sideColumn": {
+							"type": "array",
+							"description": "type='detail': a column of cards beside the body, for the record's facts. An item is a widget definition, or the id of a widget declared on the page. The column stacks under the body on a narrow page.",
+							"items": {
+								"oneOf": [
+									{ "type": "string", "minLength": 1 },
+									{
+										"type": "object",
+										"additionalProperties": true,
+										"required": ["type"],
+										"properties": {
+											"id": { "type": "string" },
+											"type": { "type": "string", "minLength": 1 },
+											"title": { "type": "string" },
+											"content": { "type": "object", "additionalProperties": true }
+										}
+									}
+								]
+							}
+						},
 						"headerActions": {
 							"type": "array",
 							"description": "Page-level header actions rendered inside CnActionsBar's overflow dropdown (between the built-in Refresh action and the `#action-items` slot). On a `type:'detail'` page the same entries render in the header's Actions menu, above the Request-a-feature / Report-a-bug / Documentation trio. Same shape as the row-level `actions[]` ($ref action), but handlers receive NO row context — they are page-level. Reserved ids (`refresh`, `import`, `export`, `copy`, `delete`) are dropped at render time to avoid shadowing built-ins. See manifest-icons-and-page-actions for the dispatch semantics.",
@@ -2992,6 +3372,14 @@
 							},
 							"description": "type='index': saved view ids this page renders as tabs instead of as entries in the views control. A view appears in one place or the other, never both. An id naming a view that no longer exists produces no tab, rather than a tab that opens nothing. Maps to CnIndexPage `viewTabs`."
 						},
+						"viewCounts": {
+							"description": "type='index': which saved views show how many records they match. `true` counts every saved view (tabs and the entries in the views control), an array counts only the view ids it lists. Off by default, so no count request is made. Quick filters opt in per entry with `showCount: true`. Maps to CnIndexPage `viewCounts`.",
+							"oneOf": [
+								{ "type": "boolean" },
+								{ "type": "array", "items": { "type": "string", "minLength": 1 } }
+							],
+							"default": false
+						},
 						"priorityField": {
 							"type": "string",
 							"description": "type='index': the field carrying a record's DERIVED priority. The list reads the value and sorts on it; it never computes one. A record with no priority, or one outside `priorityLevels`, sorts after every ranked record in BOTH directions and stays in the list. Maps to CnIndexPage `priorityField`."

package/src/schemas/app-manifest.schema.json

@@ -342,7 +342,8 @@
 									"label": { "type": "string", "description": "i18n key or plain text rendered on the tab." },
 									"filter": { "type": "object", "additionalProperties": true, "description": "Filter map merged into the fetch when this tab is active." },
 									"default": { "type": "boolean", "default": false, "description": "Pre-selected on mount." },
-									"icon": { "type": "string", "description": "Optional MDI icon name displayed alongside the label." }
+									"icon": { "type": "string", "description": "Optional MDI icon name displayed alongside the label." },
+									"showCount": { "type": "boolean", "default": false, "description": "Show how many records this tab matches, after its label. Off by default: no count request is made for a tab that does not ask. Tabs that filter the same single field share one grouped request." }
 								}
 							}
 						},