@conduction/nextcloud-vue 2.67.0 → 2.68.0

package/src/components/CnRowActions/CnRowActions.vue

@@ -3,7 +3,7 @@
 		:primary="primary"
 		:menuName="menuName"
 		data-testid="cn-row-actions">
-		<template v-for="{ action, link } in renderedActions" :key="action.label">
+		<template v-for="{ action, link } in renderedActions" :key="actionKey(action)">
 			<!-- A navigate-only action is a real link, so it can be middle-clicked, opened in a new tab or copied. -->
 			<NcActionLink
 				v-if="link"
@@ -11,7 +11,7 @@
 				:target="link.target"
 				:title="getTitle(action)"
 				:class="{ 'cn-row-action--destructive': action.destructive }"
-				:data-testid="`cn-action-item-${slugifyLabel(action.label)}`"
+				:data-testid="actionTestId(action)"
 				closeAfterClick
 				@click="onLinkAction(action, link, $event)">
 				<template v-if="action.icon" #icon>
@@ -25,7 +25,7 @@
 				:title="getTitle(action)"
 				:disabled="isDisabled(action)"
 				:class="{ 'cn-row-action--destructive': action.destructive }"
-				:data-testid="`cn-action-item-${slugifyLabel(action.label)}`"
+				:data-testid="actionTestId(action)"
 				closeAfterClick
 				@click="onAction(action)">
 				<template v-if="action.icon" #icon>
@@ -42,7 +42,7 @@
 import { NcActionButton, NcActionLink, NcActions } from '@nextcloud/vue'
 import { followItemActionLink, resolveItemActionLink } from '../../utils/actionLink.js'
 import { isModifiedClick } from '../../utils/linkNavigation.js'
-import { evaluateVisibleWhenLocal, isLocallyDecidableVisibleWhen } from '../../utils/visibleWhen.js'
+import { isRowActionVisible, rowActionKey, rowActionPayload, rowActionTestId, slugifyActionLabel } from '../../utils/rowActionItem.js'
 import { CnIcon } from '../CnIcon/index.js'
 
 /**
@@ -103,11 +103,13 @@ export default {
 		 * - `to` (string | object | (row) => string | object) — render the entry as a link to this
 		 *   vue-router location; a plain click routes in place. Ignored when the router cannot resolve it.
 		 * - `linkTarget` (string) — the link's `target`, e.g. `_blank`
+		 * - `id` (string) — the action's id, passed in the `action` payload
+		 * - `builtin` (boolean) — set by CnIndexPage on its built-in View / Edit / Copy / Delete; a built-in's testid is `cn-action-item-<id>` in every locale and its key `builtin:<id>`
 		 *
 		 * A link entry still emits `action`, but its `handler` is not called: the link is the
 		 * navigation. A disabled entry, or a `to` without a resolvable route, stays a button.
 		 *
-		 * @type {Array<{label: string, icon: object | string, handler: (targetItem: object) => void, disabled: boolean | ((targetItem: object) => boolean), visible: boolean | ((targetItem: object) => boolean), title: string | ((targetItem: object) => string), destructive: boolean, href: string | ((targetItem: object) => string), to: string | object | ((targetItem: object) => string | object), linkTarget: string}>}
+		 * @type {Array<{label: string, id: string, builtin: boolean, icon: object | string, handler: (targetItem: object) => void, disabled: boolean | ((targetItem: object) => boolean), visible: boolean | ((targetItem: object) => boolean), title: string | ((targetItem: object) => string), destructive: boolean, href: string | ((targetItem: object) => string), to: string | object | ((targetItem: object) => string | object), linkTarget: string}>}
 		 */
 		actions: {
 			type: Array,
@@ -137,31 +139,13 @@ export default {
 
 	computed: {
 		/**
-		 * Filter actions by their `visible` predicate. An action without a
-		 * `visible` field is always shown (backwards compatible).
+		 * Filter actions by their `visibleWhen` and `visible` gates, with the same rule CnContextMenu uses.
+		 * An action without either always shows.
 		 *
 		 * @return {Array} Visible actions for the current row.
 		 */
 		visibleActions() {
-			return this.actions.filter((action) => {
-				// A manifest is JSON and cannot hold a function, so `visibleWhen` is
-				// the only per-row gate an app configured from one can express. Only
-				// a locally decidable condition is gated on: an endpoint/source one is
-				// not this evaluator's question, and nothing gated a row action at all
-				// before, so answering `false` to it would delete the entry outright.
-				if (action.visibleWhen
-					&& isLocallyDecidableVisibleWhen(action.visibleWhen)
-					&& evaluateVisibleWhenLocal(action.visibleWhen, this.row) === false) {
-					return false
-				}
-				if (action.visible === undefined) {
-					return true
-				}
-				if (typeof action.visible === 'function') {
-					return !!action.visible(this.row)
-				}
-				return !!action.visible
-			})
+			return this.actions.filter((action) => isRowActionVisible(action, this.row))
 		},
 
 		/**
@@ -210,7 +194,7 @@ export default {
 			if (action.handler && typeof action.handler === 'function') {
 				action.handler(this.row)
 			}
-			this.$emit('action', { action: action.label, row: this.row })
+			this.$emit('action', rowActionPayload(action, this.row))
 		},
 
 		/**
@@ -229,26 +213,41 @@ export default {
 			}
 			followItemActionLink(event, link, this.$router)
 			/**
-			 * @event action User picked an entry. Payload: the action's label and the row. A button entry has already run its `handler`; a link entry navigates instead, and a modified (new-tab) click on a link emits nothing.
-			 * @type {{ action: string, row: object|null }}
+			 * @event action User picked an entry. Payload: `action` (the label), the row, the action's `id` when it has one, and `builtin: true` for a CnIndexPage built-in. A button entry has already run its `handler`; a link entry navigates instead, and a modified (new-tab) click on a link emits nothing.
+			 * @type {{ action: string, row: object|null, id?: string, builtin?: boolean }}
 			 */
-			this.$emit('action', { action: action.label, row: this.row })
+			this.$emit('action', rowActionPayload(action, this.row))
 		},
 
 		/**
 		 * Slugify an action label for use in stable `data-testid` selectors.
-		 * Lowercase, kebab-case, strip non-alphanumeric. Used solely by the
-		 * `:data-testid` binding on NcActionButton — does not affect runtime
-		 * behaviour or rendered text.
+		 * Lowercase, kebab-case, strip non-alphanumeric.
 		 *
 		 * @param {string} label - The action's display label
 		 * @return {string} kebab-case slug suitable for a testid suffix.
 		 */
 		slugifyLabel(label) {
-			return String(label || '')
-				.toLowerCase()
-				.replace(/[^a-z0-9]+/g, '-')
-				.replace(/^-+|-+$/g, '')
+			return slugifyActionLabel(label)
+		},
+
+		/**
+		 * The entry's `data-testid`: `cn-action-item-<id>` for a built-in, the label slug otherwise.
+		 *
+		 * @param {object} action The action definition.
+		 * @return {string} The testid.
+		 */
+		actionTestId(action) {
+			return rowActionTestId(action)
+		},
+
+		/**
+		 * The entry's render key: `builtin:<id>` for a built-in, the label otherwise.
+		 *
+		 * @param {object} action The action definition.
+		 * @return {string} The key.
+		 */
+		actionKey(action) {
+			return rowActionKey(action)
 		},
 	},
 }

package/src/components/CnSetupWizard/CnSetupWizard.vue

@@ -641,9 +641,15 @@ export default {
 							value = this.choiceLabel(step, raw)
 						}
 					} else if (step.type === 'config-fields') {
+						// Only the fields the reader filled in: a row of empty
+						// "Name: , KvK: ," reads as broken, not as "not set".
 						value = this.fieldsFor(step)
-							.map((f) => `${f.label}: ${this.configModel[f.key] !== null && this.configModel[f.key] !== undefined ? this.configModel[f.key] : ''}`)
-							.join(', ')
+							.filter((f) => {
+								const v = this.configModel[f.key]
+								return v !== null && v !== undefined && String(v).trim() !== ''
+							})
+							.map((f) => `${f.label}: ${this.configModel[f.key]}`)
+							.join(', ') || t('nextcloud-vue', 'Not set')
 					}
 					if (this.isOnDemand(step)) {
 						const ran = this.ranThisSession(step.id)

package/src/components/CnTimelineWidget/CnTimelineWidget.vue

@@ -53,7 +53,7 @@
 <script>
 import { getLanguage, translate as t } from '@nextcloud/l10n'
 import { NcLoadingIcon, NcNoteCard } from '@nextcloud/vue'
-import { auditEvents, fieldEvents, relatedEvents, sortEvents, timelineEntryEvents } from '../../utils/timelineEvents.js'
+import { auditEvents, fieldEvents, listEvents, relatedEvents, sortEvents, timelineEntryEvents } from '../../utils/timelineEvents.js'
 
 /**
  * CnTimelineWidget — an object's dated events in time order (`timeline`
@@ -193,6 +193,7 @@ export default {
 			const now = new Date()
 			const all = [
 				...fieldEvents(this.resolvedObject || {}, this.fieldsConfig, now),
+				...listEvents(this.resolvedObject || {}, this.content.lists, now),
 				...this.relatedConfig.flatMap((cfg, i) => relatedEvents(this.relatedRows[i] || [], cfg, now)),
 				...auditEvents(this.auditEntries, this.describeAudit, now),
 				...timelineEntryEvents(this.timelineEntries, t('nextcloud-vue', 'Note'), now),
@@ -347,7 +348,7 @@ export default {
 			})
 
 			if (this.content.auditTrail === true) {
-				jobs.push(axios.get(generateUrl(`${base}/audit-trail`), { params: { limit: this.content.auditLimit || 50 } })
+				jobs.push(axios.get(generateUrl(`${base}/audit-trails`), { params: { limit: this.content.auditLimit || 50 } })
 					.then((r) => {
 						const data = r && r.data
 						this.auditEntries = (data && (data.results || data)) || []

package/src/composables/useContextMenu.js

@@ -1,4 +1,5 @@
 import { onBeforeUnmount, ref } from 'vue'
+import { rowActionPayload } from '../utils/rowActionItem.js'
 
 export const CTX_MENU_CSS_VAR_X = '--cn-ctx-menu-x'
 export const CTX_MENU_CSS_VAR_Y = '--cn-ctx-menu-y'
@@ -135,15 +136,16 @@ export function useContextMenu() {
 	 *
 	 * Calls `action.handler(targetItem)` if a handler exists, then returns a
 	 * payload object the caller can pass to `$emit('action', payload)`.
+	 * The payload is the one CnRowActions and CnContextMenu emit: the label as `action`, plus `id` and `builtin: true` when the action carries them.
 	 *
 	 * @param {object} action Action definition with `label` and optional `handler`
-	 * @return {{ action: string, row: object }}
+	 * @return {{ action: string, row: object, id?: string, builtin?: boolean }}
 	 */
 	function triggerAction(action) {
 		if (action.handler && typeof action.handler === 'function') {
 			action.handler(targetItem.value)
 		}
-		return { action: action.label, row: targetItem.value }
+		return rowActionPayload(action, targetItem.value)
 	}
 
 	// Clean up DOM if the consumer unmounts while the menu is open — nothing

package/src/schemas/app-manifest-v2.schema.json

@@ -3,7 +3,7 @@
 	"$id": "https://raw.githubusercontent.com/ConductionNL/nextcloud-vue/main/src/schemas/app-manifest-v2.schema.json",
 	"title": "Conduction App Manifest v2",
 	"description": "v2 schema for the JSON-driven page and navigation manifest consumed by @conduction/nextcloud-vue. Introduces a uniform widgets[] array on every page type with a per-slot grid coordinate system, a typed actions[] discriminator, and the required $schema field for version detection. v1 manifests continue to validate against app-manifest.schema.json (unchanged).",
-	"version": "2.49.0",
+	"version": "2.50.0",
 	"type": "object",
 	"required": ["$schema", "version"],
 	"allOf": [
@@ -3458,14 +3458,30 @@
 						"actions": {
 							"type": "array",
 							"items": {
-								"type": "object",
-								"required": ["label"],
-								"additionalProperties": true,
-								"properties": {
-									"label": { "type": "string", "minLength": 1 }
-								}
+								"anyOf": [
+									{
+										"type": "object",
+										"required": ["label"],
+										"additionalProperties": true,
+										"properties": {
+											"label": { "type": "string", "minLength": 1 },
+											"id": { "type": "string", "not": { "pattern": "^builtin:" } },
+											"builtin": false
+										}
+									},
+									{
+										"type": "string",
+										"enum": ["builtin:view", "builtin:edit", "builtin:copy", "builtin:delete"]
+									}
+								]
 							},
-							"description": "Declarative actions on a page. Governed ONLY by \"an object carrying a non-empty label\", deliberately: this key is polymorphic by page type (index rows dispatch $defs/action; detail pages also carry type='lifecycle-transition' entries), so one closed grammar here would reject working manifests. A label is what every dialect needs — CnRowActions renders an entry from its label and icon, so an entry without one became a full-height, clickable, EMPTY row in the overflow menu. Two shapes hit this, both meaning \"show the built-in\": a bare string (\"edit\") and a key-only object ({\"key\": \"edit\"}). Built-ins are enabled with config.actionToggles / the show*Action keys, never by naming them here."
+							"allOf": [
+								{ "contains": { "const": "builtin:view" }, "minContains": 0, "maxContains": 1 },
+								{ "contains": { "const": "builtin:edit" }, "minContains": 0, "maxContains": 1 },
+								{ "contains": { "const": "builtin:copy" }, "minContains": 0, "maxContains": 1 },
+								{ "contains": { "const": "builtin:delete" }, "minContains": 0, "maxContains": 1 }
+							],
+							"description": "Declarative actions on a page. An object entry is governed ONLY by \"an object carrying a non-empty label\", deliberately: this key is polymorphic by page type (index rows dispatch $defs/action; detail pages also carry type='lifecycle-transition' entries), so one closed grammar here would reject working manifests. A label is what every dialect needs — CnRowActions renders an entry from its label and icon, so an entry without one became a full-height, clickable, EMPTY row in the overflow menu. An object is always an app action whatever its id: an id, when present, must be a string that does not start with 'builtin:', and the object may not set a 'builtin' key. On a type='index' page an entry may also be one of the placeholders \"builtin:view\", \"builtin:edit\", \"builtin:copy\" or \"builtin:delete\", each at most once, which puts that built-in row action at its position in the menu. A placeholder only places a built-in: config.actionToggles / the show*Action keys still decide whether it renders. Enabled built-ins the array does not place are appended after everything else in the order View, Edit, Copy, Delete. Any other string (a bare \"edit\", an unknown \"builtin:archive\") is refused, and placeholders are refused on every page type other than index."
 						},
 						"rowIndicators": {
 							"type": "array",
@@ -3732,6 +3748,10 @@
 									"type": "boolean",
 									"description": "Whether the built-in create / edit form dialog is enabled. Maps to CnIndexPage `showFormDialog`."
 								},
+								"showViewAction": {
+									"type": "boolean",
+									"description": "Whether to add a View action to row actions. Maps to CnIndexPage `showViewAction`."
+								},
 								"showEditAction": {
 									"type": "boolean",
 									"description": "Whether to add an Edit action to row actions. Maps to CnIndexPage `showEditAction`."
@@ -3824,6 +3844,24 @@
 						}
 					}
 				},
+				{
+					"description": "The \"builtin:<id>\" placeholders in config.actions place CnIndexPage's built-in row actions, so only a type='index' page may use them. On every other page type config.actions holds objects only; a placeholder there would validate and then render nothing (row-action-builtin-placement).",
+					"if": {
+						"not": {
+							"properties": { "type": { "const": "index" } },
+							"required": ["type"]
+						}
+					},
+					"then": {
+						"properties": {
+							"config": {
+								"properties": {
+									"actions": { "items": { "type": "object" } }
+								}
+							}
+						}
+					}
+				},
 				{
 					"description": "tabInAddress puts the active tab of a record in the address. Only a detail page has a record and a tab strip, so the key is refused elsewhere rather than validating into a no-op (case-page-and-list-as-a-place).",
 					"if": {

package/src/utils/resolveRowActions.js

@@ -0,0 +1,127 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+/**
+ * The built-in row action ids, in their default order.
+ *
+ * @type {ReadonlyArray<string>}
+ */
+export const BUILTIN_ROW_ACTION_IDS = Object.freeze(['view', 'edit', 'copy', 'delete'])
+
+/**
+ * The prefix that marks a row action entry as a placeholder for a built-in.
+ *
+ * @type {string}
+ */
+export const BUILTIN_PLACEHOLDER_PREFIX = 'builtin:'
+
+/**
+ * Whether an entry is one of the four built-in placeholders (`"builtin:view"`, `"builtin:edit"`, `"builtin:copy"`, `"builtin:delete"`).
+ *
+ * @param {object|string} entry A declared row action entry.
+ * @return {boolean} True for a known placeholder string.
+ */
+export function isBuiltinPlaceholder(entry) {
+	return typeof entry === 'string'
+		&& entry.startsWith(BUILTIN_PLACEHOLDER_PREFIX)
+		&& BUILTIN_ROW_ACTION_IDS.includes(entry.slice(BUILTIN_PLACEHOLDER_PREFIX.length))
+}
+
+/**
+ * A short name for an entry in a warning message.
+ *
+ * @param {object} action An app action object.
+ * @return {string} Its id, else its label, quoted.
+ */
+function describe(action) {
+	const name = (typeof action.id === 'string' && action.id !== '') ? action.id : action.label
+	return JSON.stringify(name === undefined ? '' : name)
+}
+
+/**
+ * Resolve a page's declared row actions and its enabled built-ins into the one ordered list every row surface renders.
+ *
+ * - An object is an app action, whatever its `id`; a `builtin` key on it is dropped, since only real built-ins carry that marker.
+ * - A placeholder (`"builtin:edit"`) puts that built-in at its position when it is enabled, and renders nothing when it is not: the toggle wins.
+ * - A repeated placeholder keeps its first position.
+ * - Any other entry is dropped.
+ * - Enabled built-ins the entries do not place are appended in the order `builtins` gives them.
+ *
+ * Every dropped or questionable entry is reported in `warnings`; the caller decides whether to log them.
+ *
+ * @param {Array<object|string>} declared The declared entries: app action objects and placeholders.
+ * @param {Array<{id: string}>} builtins The enabled built-in actions, in default order.
+ * @param {object} [options] Options.
+ * @param {(action: object) => object} [options.prepare] Maps an app action to the object rendered for it.
+ * @return {{actions: Array<object>, warnings: Array<{code: string, message: string}>, deleteNotLast: boolean}} The ordered actions, the warnings, and whether the built-in Delete is enabled but not last.
+ */
+export function resolveRowActions(declared, builtins, { prepare = (action) => action } = {}) {
+	const enabled = new Map()
+	for (const builtin of (Array.isArray(builtins) ? builtins : [])) {
+		if (builtin && typeof builtin.id === 'string') {
+			enabled.set(builtin.id, builtin)
+		}
+	}
+	const placed = new Set()
+	const actions = []
+	const warnings = []
+
+	for (const entry of (Array.isArray(declared) ? declared : [])) {
+		if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+			let action = entry
+			if (Object.hasOwn(entry, 'builtin')) {
+				const { builtin, ...rest } = entry
+				action = rest
+				warnings.push({
+					code: 'builtin-key-ignored',
+					message: `Action ${describe(entry)} sets "builtin", which only built-in actions carry; the key is ignored and the entry stays an app action.`,
+				})
+			}
+			actions.push(prepare(action))
+			continue
+		}
+		if (isBuiltinPlaceholder(entry)) {
+			const id = entry.slice(BUILTIN_PLACEHOLDER_PREFIX.length)
+			if (placed.has(id)) {
+				warnings.push({
+					code: 'repeated-placeholder',
+					message: `"${entry}" is placed more than once; only its first position is used.`,
+				})
+				continue
+			}
+			placed.add(id)
+			if (!enabled.has(id)) {
+				warnings.push({
+					code: 'disabled-placeholder',
+					message: `"${entry}" is placed but that built-in action is turned off, so it renders nothing. Its show*Action toggle decides whether it renders.`,
+				})
+				continue
+			}
+			actions.push(enabled.get(id))
+			continue
+		}
+		warnings.push({
+			code: 'invalid-entry',
+			message: `Ignoring action ${JSON.stringify(entry)}: actions must be objects with an id and a label, or one of ${BUILTIN_ROW_ACTION_IDS.map((id) => `"${BUILTIN_PLACEHOLDER_PREFIX}${id}"`).join(', ')}. To turn a built-in action on or off use the showViewAction / showEditAction / showCopyAction / showDeleteAction props.`,
+		})
+	}
+
+	for (const builtin of enabled.values()) {
+		if (!placed.has(builtin.id)) {
+			actions.push(builtin)
+		}
+	}
+
+	const deleteIndex = actions.findIndex((action) => action && action.builtin === true && action.id === 'delete')
+	const deleteNotLast = deleteIndex !== -1 && deleteIndex !== actions.length - 1
+	if (deleteNotLast) {
+		warnings.push({
+			code: 'delete-not-last',
+			message: `"${BUILTIN_PLACEHOLDER_PREFIX}delete" is not the last row action; it renders before ${actions.slice(deleteIndex + 1).map((a) => (a.builtin === true ? `"${BUILTIN_PLACEHOLDER_PREFIX}${a.id}"` : describe(a))).join(', ')}. Delete is normally last.`,
+		})
+	}
+
+	return { actions, warnings, deleteNotLast }
+}

package/src/utils/rowActionItem.js

@@ -0,0 +1,100 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * How a row action renders as a menu entry.
+ * CnRowActions and CnContextMenu both use these, so a row's actions menu and its right-click menu agree on which entries show and on each entry's key, testid and event payload.
+ */
+
+import { evaluateVisibleWhenLocal, isLocallyDecidableVisibleWhen } from './visibleWhen.js'
+
+/**
+ * Whether an action is a built-in row action (View, Edit, Copy, Delete).
+ *
+ * @param {object} action The action.
+ * @return {boolean} True for a built-in carrying an id.
+ */
+function isBuiltin(action) {
+	return !!action && action.builtin === true && typeof action.id === 'string' && action.id !== ''
+}
+
+/**
+ * Whether an action shows for an item.
+ * A locally decidable `visibleWhen` that is false hides it; an endpoint or source condition is not decided here.
+ * Then `visible` (a boolean or `(item) => boolean`) applies; without it the action shows.
+ *
+ * @param {object} action The action.
+ * @param {object|string|number|null} item The row or right-clicked item.
+ * @return {boolean} Whether the entry renders.
+ */
+export function isRowActionVisible(action, item) {
+	if (action.visibleWhen
+		&& isLocallyDecidableVisibleWhen(action.visibleWhen)
+		&& evaluateVisibleWhenLocal(action.visibleWhen, item) === false) {
+		return false
+	}
+	if (action.visible === undefined) {
+		return true
+	}
+	if (typeof action.visible === 'function') {
+		return !!action.visible(item)
+	}
+	return !!action.visible
+}
+
+/**
+ * Slugify a label for a `data-testid` suffix: lowercase, kebab-case, non-alphanumerics stripped.
+ *
+ * @param {string} label The label.
+ * @return {string} The slug.
+ */
+export function slugifyActionLabel(label) {
+	// One pass collapses every run of other characters to a single '-', so at
+	// most one '-' can sit at either end; trimming it by index keeps this
+	// linear. `/^-+|-+$/g` here was a ReDoS on long runs of '-' (CodeQL).
+	const slug = String(label || '')
+		.toLowerCase()
+		.replace(/[^a-z0-9]+/g, '-')
+	const start = slug.startsWith('-') ? 1 : 0
+	const end = slug.length > start && slug.endsWith('-') ? slug.length - 1 : slug.length
+	return slug.slice(start, end)
+}
+
+/**
+ * The render key of an entry: `builtin:<id>` for a built-in, the label for an app action.
+ * An app action with `id: "edit"` therefore never shares a key with the built-in Edit.
+ *
+ * @param {object} action The action.
+ * @return {string} The key.
+ */
+export function rowActionKey(action) {
+	return isBuiltin(action) ? `builtin:${action.id}` : action.label
+}
+
+/**
+ * The `data-testid` of an entry: `cn-action-item-<id>` for a built-in, in every locale, and the slug of the label for an app action.
+ *
+ * @param {object} action The action.
+ * @return {string} The testid.
+ */
+export function rowActionTestId(action) {
+	return `cn-action-item-${isBuiltin(action) ? action.id : slugifyActionLabel(action.label)}`
+}
+
+/**
+ * The `action` event payload for an entry: `action` is the label, `id` is the action's id when it has one, and `builtin: true` marks a built-in.
+ *
+ * @param {object} action The action.
+ * @param {object|string|number|null} row The row or right-clicked item.
+ * @return {{action: string, row: (object|string|number|null), id?: string, builtin?: true}} The payload.
+ */
+export function rowActionPayload(action, row) {
+	const payload = { action: action.label, row }
+	if (typeof action.id === 'string' && action.id !== '') {
+		payload.id = action.id
+	}
+	if (isBuiltin(action)) {
+		payload.builtin = true
+	}
+	return payload
+}

package/src/utils/timelineEvents.js

@@ -97,6 +97,49 @@ export function fieldEvents(object, fields, now = new Date()) {
  * @param {Date} [now] The reference moment.
  * @return {Array<object>} The events.
  */
+/**
+ * The text at a path of a list entry, or '' when the path is unset or empty.
+ *
+ * @param {object} row The list entry.
+ * @param {string|undefined} path The path to read.
+ * @return {string} The text.
+ */
+function textAt(row, path) {
+	if (!path) {
+		return ''
+	}
+	const value = readPath(row, path)
+	return value === null || value === undefined ? '' : String(value)
+}
+
+/**
+ * Events from a list held on the object itself, such as a status history:
+ * `[{ field, dateField, labelField?, label?, detailField? }]`. Each entry of the
+ * list at `field` becomes one event, dated by `dateField`, labelled by its
+ * `labelField` value (else `label`), with `detailField` as the line under it.
+ *
+ * @param {object} object The object.
+ * @param {Array<object>} lists The list configs.
+ * @param {Date} now The moment that separates past from upcoming.
+ * @return {Array<object>} The events.
+ * @spec openspec/changes/timeline-audit-trails-url/specs/timeline-widget/spec.md#requirement-a-list-on-the-object-becomes-dated-events
+ */
+export function listEvents(object, lists, now = new Date()) {
+	return (Array.isArray(lists) ? lists : [])
+		.filter((l) => l && typeof l.field === 'string' && typeof l.dateField === 'string')
+		.flatMap((l) => {
+			const rows = readPath(object, l.field)
+			return (Array.isArray(rows) ? rows : []).map((row, i) => makeEvent({
+				id: `list:${l.field}:${i}`,
+				raw: readPath(row, l.dateField),
+				label: textAt(row, l.labelField) || l.label || l.field,
+				detail: textAt(row, l.detailField),
+				source: 'list',
+			}, now))
+		})
+		.filter(Boolean)
+}
+
 export function relatedEvents(rows, config, now = new Date()) {
 	const cfg = config || {}
 	const dateField = cfg.dateField || '@self.created'