@cosmicdrift/kumiko-renderer 0.257.0 → 0.258.0

package/src/app/action-form-shim.ts

@@ -19,26 +19,29 @@ import type {
   ActionFormScreenDefinition,
   EntityDefinition,
   EntityEditScreenDefinition,
+  FieldDefinition,
+  SecretMintConfirmStep,
+  SecretMintScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/ui-types";
 
 const ACTION_FORM_PSEUDO_ENTITY = "__action-form__";
 
-/** Baut eine minimale EntityDefinition aus den Inline-Fields des
- *  ActionForm-Screens. RenderEdit + computeEditViewModel iterieren
- *  über entity.fields zur Render-Zeit; alle weiteren EntityDefinition-
- *  Felder bleiben undefined. */
+/** Baut eine minimale EntityDefinition aus den Inline-Fields eines
+ *  ActionForm- oder SecretMint-Screens. RenderEdit + computeEditViewModel
+ *  iterieren über entity.fields zur Render-Zeit; alle weiteren
+ *  EntityDefinition-Felder bleiben undefined. */
 export function synthesizeActionFormEntity(
-  fields: ActionFormScreenDefinition["fields"],
+  fields: Readonly<Record<string, FieldDefinition>>,
 ): EntityDefinition {
   return { fields } as EntityDefinition;
 }
 
-/** Wandelt ein ActionFormScreenDefinition in die EntityEditScreen-
- *  Shape die RenderEdit erwartet. type wird auf "entityEdit" gesetzt
- *  damit der Type-Constraint hält; entity wird auf den Pseudo-Namen
- *  gepinnt — RenderEdit liest das Feld nicht. */
+/** Wandelt ein ActionFormScreenDefinition oder SecretMintScreenDefinition in
+ *  die EntityEditScreen-Shape die RenderEdit erwartet. type wird auf
+ *  "entityEdit" gesetzt damit der Type-Constraint hält; entity wird auf den
+ *  Pseudo-Namen gepinnt — RenderEdit liest das Feld nicht. */
 export function synthesizeActionFormScreen(
-  screen: ActionFormScreenDefinition,
+  screen: ActionFormScreenDefinition | SecretMintScreenDefinition,
 ): EntityEditScreenDefinition {
   return {
     id: screen.id,
@@ -49,3 +52,18 @@ export function synthesizeActionFormScreen(
     ...(screen.access !== undefined && { access: screen.access }),
   };
 }
+
+/** Separate id (`${screen.id}:confirm`) keeps this confirm-form screen from
+ *  colliding with the mint-form screen's draft key. */
+export function synthesizeSecretMintConfirmScreen(
+  screen: SecretMintScreenDefinition,
+  confirm: SecretMintConfirmStep,
+): EntityEditScreenDefinition {
+  return {
+    id: `${screen.id}:confirm`,
+    type: "entityEdit",
+    entity: ACTION_FORM_PSEUDO_ENTITY,
+    layout: confirm.layout,
+    ...(screen.access !== undefined && { access: screen.access }),
+  };
+}

package/src/app/kumiko-screen.tsx

@@ -82,6 +82,7 @@ import {
   stringifyNavParams,
 } from "./row-actions";
 import { screenAccessAllows } from "./screen-access";
+import { SecretMintBody } from "./secret-mint-body";
 import { SecretsEditBody } from "./secrets-edit-body";
 import { dispatcherErrorText, WriteFailedError } from "./write-failed-error";
 
@@ -211,6 +212,8 @@ export function KumikoScreen({
       return <DashboardScreenBody screen={screen} translate={translate} />;
     case "actionForm":
       return <ActionFormBody schema={schema} screen={screen} translate={translate} />;
+    case "secretMint":
+      return <SecretMintBody schema={schema} screen={screen} translate={translate} />;
     case "configEdit":
       return <ConfigEditBody schema={schema} screen={screen} translate={translate} />;
     case "secretsEdit":
@@ -345,11 +348,15 @@ export function buildInitialValues(
 ): Readonly<Record<string, unknown>> {
   const out: Record<string, unknown> = {};
   for (const [name, def] of Object.entries(fields)) {
-    const shape = def as { type?: string; default?: unknown };
+    const shape = def as { type?: string; default?: unknown; multiple?: boolean };
     if (shape.default !== undefined) {
       out[name] = shape.default;
       continue;
     }
+    if (shape.type === "embedded" && shape.multiple === true) {
+      out[name] = [];
+      continue;
+    }
     if (shape.type === "money" && defaultCurrency !== undefined) {
       out[name] = { amount: 0, currency: defaultCurrency };
       continue;
@@ -399,7 +406,7 @@ function parseJsonOrRaw(raw: string): unknown {
   }
 }
 
-function warnMoneyParam(message: string): void {
+function warnPrefillParam(message: string): void {
   // biome-ignore lint/suspicious/noConsole: dev-warning for an authoring error
   console.warn(`[kumiko] ${message}`);
 }
@@ -416,7 +423,7 @@ function coerceMoneyValue(
   if (value === null) return undefined;
   if (isMoneyValue(value)) return { amount: value.amount, currency: value.currency.toUpperCase() };
   if (typeof value === "object") {
-    warnMoneyParam(
+    warnPrefillParam(
       `money field "${fieldName}" got an object without a usable {amount, currency} shape — the prefill is ignored.`,
     );
     return undefined;
@@ -424,12 +431,81 @@ function coerceMoneyValue(
   const amount = Number(typeof value === "number" ? value : raw);
   if (!Number.isFinite(amount)) return undefined;
   if (defaultCurrency !== undefined) return { amount, currency: defaultCurrency };
-  warnMoneyParam(
+  warnPrefillParam(
     `money field "${fieldName}" was prefilled with a bare number and no currency is available — pass {"amount":<number>,"currency":"<ISO code>"} as the param value, otherwise the handler's schema rejects the submit.`,
   );
   return amount;
 }
 
+type EmbeddedCellShape = { readonly type?: string; readonly options?: readonly string[] };
+
+const EMBEDDED_LIST_PREFILL_ROW_LIMIT = 500;
+
+function coerceEmbeddedCell(value: unknown, cell: EmbeddedCellShape): unknown {
+  switch (cell.type) {
+    case "number":
+    case "decimal":
+      return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+    case "money":
+      // Row cells are signed minor units; the currency lives on the head, so a
+      // top-level `{amount, currency}` in major units would land 100x off.
+      return typeof value === "number" && Number.isSafeInteger(value) ? value : undefined;
+    case "boolean":
+      return typeof value === "boolean" ? value : undefined;
+    case "select":
+      return typeof value === "string" && (cell.options ?? []).includes(value) ? value : undefined;
+    default:
+      return typeof value === "string" ? value : undefined;
+  }
+}
+
+// A partially coerced list is the hazard the prefill exists to avoid: the
+// handler replaces the list whole, so half a list overwrites the rest.
+function coerceEmbeddedListRows(
+  raw: string,
+  fieldName: string,
+  schema: Readonly<Record<string, EmbeddedCellShape>>,
+  maxItems?: number,
+): readonly Readonly<Record<string, unknown>>[] | undefined {
+  const parsed = parseJsonOrRaw(raw);
+  if (!Array.isArray(parsed)) {
+    warnPrefillParam(
+      `embedded-list field "${fieldName}" was prefilled with something that is not a JSON array — the prefill is ignored.`,
+    );
+    return undefined;
+  }
+  if (parsed.length > (maxItems ?? EMBEDDED_LIST_PREFILL_ROW_LIMIT)) {
+    warnPrefillParam(
+      `embedded-list field "${fieldName}" was prefilled with ${parsed.length} rows, more than it accepts — the prefill is ignored.`,
+    );
+    return undefined;
+  }
+  const rows: Readonly<Record<string, unknown>>[] = [];
+  for (const candidate of parsed) {
+    if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) {
+      warnPrefillParam(
+        `embedded-list field "${fieldName}" was prefilled with a row that is not an object — the prefill is ignored.`,
+      );
+      return undefined;
+    }
+    const cellEntries: [string, unknown][] = [];
+    for (const [cellName, cell] of Object.entries(schema)) {
+      const cellValue = (candidate as Record<string, unknown>)[cellName];
+      if (cellValue === undefined || cellValue === null) continue;
+      const coerced = coerceEmbeddedCell(cellValue, cell);
+      if (coerced === undefined) {
+        warnPrefillParam(
+          `embedded-list field "${fieldName}" was prefilled with a cell "${cellName}" the sub-schema rejects — the prefill is ignored.`,
+        );
+        return undefined;
+      }
+      cellEntries.push([cellName, coerced]);
+    }
+    rows.push(Object.fromEntries(cellEntries));
+  }
+  return rows;
+}
+
 export function mergeSearchParamsIntoInitial(
   fields: Readonly<Record<string, unknown>>,
   searchParams: Readonly<Record<string, string>>,
@@ -449,9 +525,15 @@ export function mergeSearchParamsIntoInitial(
     const shape = fieldDef as {
       type?: string;
       sensitive?: boolean;
+      format?: string;
       options?: readonly (string | { readonly value: string })[];
+      multiple?: boolean;
+      schema?: Readonly<Record<string, EmbeddedCellShape>>;
+      maxItems?: number;
     };
     if (shape.sensitive === true) continue;
+    // A password field must never be prefilled from the URL, same as sensitive.
+    if (shape.format === "password") continue;
     if (overrides !== undefined && name in overrides) {
       merged[name] = overrides[name];
       continue;
@@ -499,6 +581,9 @@ export function mergeSearchParamsIntoInitial(
       }
       merged[name] =
         optionValues !== undefined ? values.filter((v) => optionValues.has(v)) : values;
+    } else if (shape.type === "embedded" && shape.multiple === true) {
+      const rows = coerceEmbeddedListRows(raw, name, shape.schema ?? {}, shape.maxItems);
+      merged[name] = rows ?? defaults[name];
     } else {
       merged[name] = raw;
     }

package/src/app/secret-mint-body.tsx

@@ -0,0 +1,235 @@
+import type { SecretMintScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
+import type { FormValues, SubmitResult, Translate } from "@cosmicdrift/kumiko-headless";
+import { type ReactNode, useCallback, useMemo, useRef, useState } from "react";
+import { RenderEdit } from "../components/render-edit";
+import { useTranslation } from "../i18n";
+import { usePrimitives } from "../primitives";
+import {
+  synthesizeActionFormEntity,
+  synthesizeActionFormScreen,
+  synthesizeSecretMintConfirmScreen,
+} from "./action-form-shim";
+import type { FeatureSchema } from "./feature-schema";
+import { buildInitialValues, mergeSearchParamsIntoInitial } from "./kumiko-screen";
+import { layoutFieldNames } from "./layout-fields";
+import { useNav } from "./nav";
+import { lastSegment } from "./qn";
+
+export type SecretMintBodyProps = {
+  readonly schema: FeatureSchema;
+  readonly screen: SecretMintScreenDefinition;
+  readonly translate?: Translate;
+};
+
+function extractRevealValue(data: unknown, field: string): unknown {
+  if (typeof data !== "object" || data === null) return undefined;
+  if (!Object.hasOwn(data, field)) return undefined;
+  return (data as Record<string, unknown>)[field];
+}
+
+function extractCarriedValues(
+  data: unknown,
+  carry: readonly string[],
+): Readonly<Record<string, unknown>> {
+  const carried: Record<string, unknown> = {};
+  for (const field of carry) {
+    const value = extractRevealValue(data, field);
+    if (value === undefined) continue;
+    carried[field] = value;
+  }
+  return carried;
+}
+
+function isBlank(value: unknown): boolean {
+  if (value === undefined || value === null || value === "") return true;
+  return Array.isArray(value) && value.length === 0;
+}
+
+// Mint form → one-time reveal → optional confirm → done. The revealed values
+// live ONLY in this component's `revealed` state — never in the URL, a query
+// cache, or nav — the write-handler's success payload is the only place the
+// secret ever exists (fw#2548). onSubmit copies exclusively the fields
+// declared in `screen.reveal.fields` out of that payload (a whitelist, never
+// the payload as a whole) so an unrelated field (e.g. an internal "id") can
+// never leak into the reveal. `screen.confirm` (fw#2838, e.g. TOTP enroll:
+// scan the code, then enter one) works the same way for its own carried
+// mint-payload fields — those live only in `carriedRef`, never in React state
+// that gets rendered, never in the confirm form's own values.
+export function SecretMintBody({ schema, screen, translate }: SecretMintBodyProps): ReactNode {
+  const nav = useNav();
+  const { Card, Heading, Banner, Button, Text, Grid, GridCell, SecretReveal } = usePrimitives();
+  const t = useTranslation();
+  const effectiveTranslate = translate ?? t;
+  const synthEntity = useMemo(() => synthesizeActionFormEntity(screen.fields), [screen.fields]);
+  const synthScreen = useMemo(() => synthesizeActionFormScreen(screen), [screen]);
+  const initial = useMemo(
+    () =>
+      mergeSearchParamsIntoInitial(
+        screen.fields,
+        nav.searchParams,
+        layoutFieldNames(synthScreen),
+      ) as FormValues,
+    [screen.fields, nav.searchParams, synthScreen],
+  );
+  const [revealed, setRevealed] = useState<Readonly<Record<string, unknown>> | null>(null);
+  const [done, setDone] = useState(false);
+  // Never rendered, never merged into `revealed` or the confirm form's
+  // initial values — read only from `buildPayload` at confirm-submit time.
+  const carriedRef = useRef<Readonly<Record<string, unknown>>>({});
+
+  const confirm = screen.confirm;
+  const confirmEntity = useMemo(
+    () => (confirm !== undefined ? synthesizeActionFormEntity(confirm.fields) : undefined),
+    [confirm],
+  );
+  const confirmScreen = useMemo(
+    () => (confirm !== undefined ? synthesizeSecretMintConfirmScreen(screen, confirm) : undefined),
+    [screen, confirm],
+  );
+  const confirmInitial = useMemo(
+    () => (confirm !== undefined ? (buildInitialValues(confirm.fields) as FormValues) : undefined),
+    [confirm],
+  );
+
+  const handleSubmitted = useCallback(
+    (result: SubmitResult<unknown>) => {
+      if (!result.isSuccess) return;
+      const values: Record<string, unknown> = {};
+      for (const revealField of screen.reveal.fields) {
+        const value = extractRevealValue(result.data, revealField.field);
+        if (value === undefined) continue;
+        values[revealField.field] = value;
+      }
+      setRevealed(values);
+      carriedRef.current =
+        confirm?.carry !== undefined ? extractCarriedValues(result.data, confirm.carry) : {};
+    },
+    [screen.reveal.fields, confirm?.carry],
+  );
+
+  const handleCancel = useMemo<(() => void) | undefined>(() => {
+    const target = screen.cancelTarget ?? screen.redirect;
+    if (target === undefined || target === false) return undefined;
+    return () => nav.navigate({ screenId: lastSegment(target) });
+  }, [nav, screen.redirect, screen.cancelTarget]);
+
+  // Ends the reveal phase for both paths (the bare acknowledge button, and a
+  // successful confirm submit): clears the secret and the carried values, then
+  // either navigates (screen.redirect) or shows a done-state — never falls
+  // back to re-rendering the mint form, which would let a stray click mint
+  // (and invalidate) the secret again.
+  const finishMint = useCallback(() => {
+    setRevealed(null);
+    carriedRef.current = {};
+    if (screen.redirect !== undefined) {
+      nav.navigate({ screenId: lastSegment(screen.redirect) });
+    } else {
+      setDone(true);
+    }
+  }, [nav, screen.redirect]);
+
+  const handleConfirmSubmitted = useCallback(
+    (result: SubmitResult<unknown>) => {
+      if (result.isSuccess) finishMint();
+    },
+    [finishMint],
+  );
+
+  if (done) {
+    return (
+      <Card>
+        <Banner variant="info" testId="kumiko-screen-secret-mint-done">
+          {effectiveTranslate(confirm?.doneMessage ?? "kumiko.secretMint.done")}
+        </Banner>
+      </Card>
+    );
+  }
+
+  if (revealed !== null) {
+    const values = screen.reveal.fields.flatMap((revealField) => {
+      const raw = revealed[revealField.field];
+      if (isBlank(raw)) return [];
+      const display = revealField.display ?? "code";
+      const value =
+        display === "list" && Array.isArray(raw)
+          ? raw.map((v) => String(v)).join("\n")
+          : String(raw);
+      return [
+        {
+          label: effectiveTranslate(revealField.label),
+          value,
+          copyable: revealField.copyable ?? true,
+          multiline: display === "list",
+          ...(display === "qr" && { qr: true }),
+        },
+      ];
+    });
+    return (
+      <Card testId="kumiko-screen-secret-mint-card">
+        <Heading variant="page">
+          {effectiveTranslate(screen.reveal.title ?? "kumiko.secretMint.title")}
+        </Heading>
+        <Banner variant="warning" testId="kumiko-screen-secret-mint-warning">
+          {effectiveTranslate(screen.reveal.warning ?? "kumiko.secretMint.warning")}
+        </Banner>
+        {SecretReveal !== undefined ? (
+          <SecretReveal
+            values={values}
+            copyLabel={effectiveTranslate("kumiko.secretMint.copy")}
+            copiedLabel={effectiveTranslate("kumiko.secretMint.copied")}
+            testId="kumiko-screen-secret-mint-reveal"
+          />
+        ) : (
+          <Grid columns={1} testId="kumiko-screen-secret-mint-reveal">
+            {values.map((v) => (
+              <GridCell key={v.label}>
+                <Text>{v.label}</Text>
+                <Text variant="code">{v.value}</Text>
+              </GridCell>
+            ))}
+          </Grid>
+        )}
+        {confirm !== undefined && confirmEntity !== undefined && confirmScreen !== undefined ? (
+          <RenderEdit
+            screen={confirmScreen}
+            entity={confirmEntity}
+            featureName={schema.featureName}
+            initial={confirmInitial ?? ({} as FormValues)}
+            writeCommand={confirm.handler}
+            payloadMode="values"
+            buildPayload={(snapshot) => ({ ...snapshot.values, ...carriedRef.current })}
+            onSubmit={handleConfirmSubmitted}
+            {...(handleCancel !== undefined && { onCancel: handleCancel })}
+            {...(translate !== undefined && { translate })}
+            {...(confirm.submitLabel !== undefined && { submitLabel: confirm.submitLabel })}
+          />
+        ) : (
+          <Button
+            type="button"
+            variant="primary"
+            onClick={finishMint}
+            testId="kumiko-screen-secret-mint-confirm"
+          >
+            {effectiveTranslate(screen.reveal.confirmLabel ?? "kumiko.secretMint.confirm")}
+          </Button>
+        )}
+      </Card>
+    );
+  }
+
+  return (
+    <RenderEdit
+      screen={synthScreen}
+      entity={synthEntity}
+      featureName={schema.featureName}
+      initial={initial}
+      extensionInitialValues={initial}
+      writeCommand={screen.handler}
+      payloadMode="values"
+      onSubmit={handleSubmitted}
+      {...(handleCancel !== undefined && { onCancel: handleCancel })}
+      {...(translate !== undefined && { translate })}
+      {...(screen.submitLabel !== undefined && { submitLabel: screen.submitLabel })}
+    />
+  );
+}

package/src/components/__tests__/render-edit-submit-actions.test.tsx

@@ -320,6 +320,22 @@ describe("RenderEdit — submit path", () => {
 
     await waitFor(() => expect(rtlScreen.queryByTestId("render-edit-form-error")).toBeNull());
   });
+
+  // fw#2838: an input-less secretMint mint step declares an empty entity
+  // (fields: {}) and an empty layout (sections: []) — such a form can never
+  // go dirty, so the unchanged-gate must not permanently disable its submit.
+  test("a fieldless form's submit button is not disabled and stays visible", () => {
+    const zeroFieldScreen: EntityEditScreenDefinition = {
+      id: "trigger",
+      type: "entityEdit",
+      entity: "trigger",
+      layout: { sections: [] },
+    };
+    renderEdit(zeroFieldScreen, {}, { fields: {} });
+
+    const save = rtlScreen.getByTestId("render-edit-submit") as HTMLButtonElement;
+    expect(save.disabled).toBe(false);
+  });
 });
 describe("RenderEdit — custom actions", () => {
   test("renders an action button and runs its handler on click", async () => {

package/src/components/__tests__/render-field-password-format.test.tsx

@@ -0,0 +1,101 @@
+// fw#2548: TextFieldDef.format "password" is a pure render hint — the
+// editable widget masks the input, and the read-only display never shows
+// the plaintext value.
+
+import { describe, expect, test } from "bun:test";
+import type { EditFieldViewModel } from "@cosmicdrift/kumiko-headless";
+import { render } from "@testing-library/react";
+import type { ComponentType, ReactNode } from "react";
+import { createStaticLocaleResolver, LocaleProvider } from "../../i18n";
+import {
+  type CorePrimitives,
+  type InputProps,
+  PrimitivesProvider,
+  type TextProps,
+} from "../../primitives";
+import { RenderField } from "../render-field";
+
+let capturedInput: InputProps | undefined;
+const captureInput: ComponentType<InputProps> = (props) => {
+  capturedInput = props;
+  return null;
+};
+let capturedText: TextProps | undefined;
+const captureText: ComponentType<TextProps> = (props) => {
+  capturedText = props;
+  return null;
+};
+const noop = (): ReactNode => null;
+const passChildren = ({ children }: { readonly children?: ReactNode }): ReactNode => children;
+
+const testPrimitives: CorePrimitives = {
+  Button: noop,
+  Banner: noop,
+  Field: passChildren,
+  Input: captureInput,
+  DataTable: noop,
+  Form: noop,
+  Section: noop,
+  Card: noop,
+  Grid: noop,
+  GridCell: noop,
+  Text: captureText,
+  Heading: noop,
+  Dialog: noop,
+  Modal: noop,
+  Lightbox: noop,
+  ConfigSourceBadge: noop,
+  ConfigCascadeView: noop,
+  Link: noop,
+};
+
+function textField(overrides: Partial<EditFieldViewModel> = {}): EditFieldViewModel {
+  return {
+    field: "apiToken",
+    label: "API token",
+    type: "text",
+    value: "s3cr3t",
+    visible: true,
+    readOnly: false,
+    required: false,
+    ...overrides,
+  };
+}
+
+function renderField(field: EditFieldViewModel, valueDisplay?: "form" | "text"): void {
+  capturedInput = undefined;
+  capturedText = undefined;
+  render(
+    <LocaleProvider resolver={createStaticLocaleResolver({ locale: "en-US" })}>
+      <PrimitivesProvider value={testPrimitives}>
+        <RenderField
+          field={field}
+          onChange={() => {}}
+          {...(valueDisplay !== undefined && { valueDisplay })}
+        />
+      </PrimitivesProvider>
+    </LocaleProvider>,
+  );
+}
+
+describe("RenderField — format: 'password'", () => {
+  test("editable password field renders Input kind=password", () => {
+    renderField(textField({ format: "password" }));
+    expect(capturedInput?.kind).toBe("password");
+  });
+
+  test("a plain text field (no format) still renders Input kind=text", () => {
+    renderField(textField());
+    expect(capturedInput?.kind).toBe("text");
+  });
+
+  test("read-only password field shows a fixed mask, never the plaintext", () => {
+    renderField(textField({ format: "password", readOnly: true }), "text");
+    expect(capturedText?.children).toBe("••••••••");
+  });
+
+  test("read-only password field with an empty value shows the empty placeholder, not the mask", () => {
+    renderField(textField({ format: "password", readOnly: true, value: "" }), "text");
+    expect(capturedText?.children).toBe("—");
+  });
+});

package/src/components/render-edit.tsx

@@ -628,6 +628,11 @@ export function RenderEdit<TValues extends FormValues, TCtx = unknown>(
 
   // true when editable fields exist or an extension opted into composed submit (fw#2359).
   const isFormEditable = hasEditableSection(filteredSections);
+  // A fieldless form (input-less secretMint mint, fw#2838 — the secret is
+  // server-generated, the mint step is only its submit button) has no
+  // section to gate on: it IS the action, so it always shows the submit
+  // button, and it can never go dirty either.
+  const isFieldless = Object.keys(entity.fields).length === 0;
 
   // A lone relatedList tab (hideSectionTitles is only ever set by the tabs
   // layout, which also narrows filteredSections to that one active section)
@@ -704,10 +709,23 @@ export function RenderEdit<TValues extends FormValues, TCtx = unknown>(
       );
       return;
     }
+    const passwordFieldNames = new Set(
+      vm.sections.flatMap((section) =>
+        section.kind === "fields"
+          ? section.fields.filter((f) => f.format === "password").map((f) => f.field)
+          : [],
+      ),
+    );
+    // A password field never enters the persisted draft blob — it would be stored in the clear and restored on resume.
+    const draftValues = Object.fromEntries(
+      Object.entries(controller.getSnapshot().values).filter(
+        ([field]) => !passwordFieldNames.has(field),
+      ),
+    );
     void dispatcher
       .write(FORM_DRAFT_SAVE, {
         draftKey: key,
-        values: controller.getSnapshot().values,
+        values: draftValues,
         stepIndex,
       })
       .catch((err: unknown) => {
@@ -1005,7 +1023,8 @@ export function RenderEdit<TValues extends FormValues, TCtx = unknown>(
   const hasFormActions =
     (isWizard && currentStep > 0) ||
     (isWizard && !isLastWizardStep) ||
-    ((isFormEditable || hasExtensionRegistrations) && (!isWizard || isLastWizardStep));
+    ((isFormEditable || hasExtensionRegistrations || isFieldless) &&
+      (!isWizard || isLastWizardStep));
   const formActions = (
     <>
       {isWizard && currentStep > 0 && (
@@ -1029,18 +1048,21 @@ export function RenderEdit<TValues extends FormValues, TCtx = unknown>(
           {translate("kumiko.actions.next")}
         </Button>
       )}
-      {(isFormEditable || hasExtensionRegistrations) && (!isWizard || isLastWizardStep) && (
-        <Button
-          type="submit"
-          disabled={(snapshot.isUnchanged && !extensionDirty) || isSubmitting || disabled}
-          loading={isSubmitting}
-          variant={submitVariant ?? "primary"}
-          icon="check"
-          testId="render-edit-submit"
-        >
-          {translate(submitLabel ?? (isWizard ? "kumiko.actions.finish" : "kumiko.actions.save"))}
-        </Button>
-      )}
+      {(isFormEditable || hasExtensionRegistrations || isFieldless) &&
+        (!isWizard || isLastWizardStep) && (
+          <Button
+            type="submit"
+            disabled={
+              (snapshot.isUnchanged && !extensionDirty && !isFieldless) || isSubmitting || disabled
+            }
+            loading={isSubmitting}
+            variant={submitVariant ?? "primary"}
+            icon="check"
+            testId="render-edit-submit"
+          >
+            {translate(submitLabel ?? (isWizard ? "kumiko.actions.finish" : "kumiko.actions.save"))}
+          </Button>
+        )}
     </>
   );
 

package/src/components/render-field.tsx

@@ -751,6 +751,16 @@ function renderInput({
       );
     }
     default: {
+      if (field.type === "text" && field.format === "password") {
+        return (
+          <Input
+            kind="password"
+            {...common}
+            value={stringValue(field.value)}
+            onChange={(v) => onChange(v)}
+          />
+        );
+      }
       // text + unknown scalar type → text input. If TextFieldDef.multiline
       // is set (the view-model carries it), the renderer switches to
       // textarea. longText always renders a textarea — that's the point of
@@ -867,6 +877,7 @@ function locatedValue(v: unknown): { at: string; tz: string; utc?: string } | ""
 function readOnlyDisplayText(field: EditFieldViewModel, appLocale: string): string {
   const { type, value } = field;
   if (value === undefined || value === null || value === "") return "—";
+  if (type === "text" && field.format === "password") return "••••••••";
   switch (type) {
     case "boolean":
       return applyFormatSpec({ format: "boolean" }, value);