@cosmicdrift/kumiko-renderer 0.334.0 → 0.336.0

package/dist/app/content-preview.js

@@ -1,4 +1,10 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+// Read-only render of a content editor's format with the collection's
+// example variableSchema values substituted in for `{{name}}` — reuses the
+// same registered editor the collection edits with (readOnly), so "rich"
+// renders formatted HTML and "plain"/"markdown" render as text through the
+// exact same component, no separate render path per format.
+import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { useId } from "react";
 import { useContentEditor } from "./content-editors.js";
 const VARIABLE_PATTERN = /\{\{\s*(\w+)\s*\}\}/g;
@@ -8,14 +14,6 @@ const noop = () => { };
 export function substituteVariables(content, variables) {
     return content.replace(VARIABLE_PATTERN, (match, name) => Object.hasOwn(variables, name) ? (variables[name] ?? match) : match);
 }
-function escapeHtml(value) {
-    return value
-        .replace(/&/g, "&")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;")
-        .replace(/"/g, "&quot;")
-        .replace(/'/g, "&#39;");
-}
 export function ContentPreview({ content, variables, contentFormat, }) {
     const Editor = useContentEditor(contentFormat);
     const id = useId();
@@ -24,7 +22,7 @@ export function ContentPreview({ content, variables, contentFormat, }) {
     // render as an unescaped entity (`&`). "plain"/"markdown" content is text,
     // no escaping wanted there.
     const safeVariables = contentFormat === "rich"
-        ? Object.fromEntries(Object.entries(variables).map(([name, value]) => [name, escapeHtml(value)]))
+        ? Object.fromEntries(Object.entries(variables).map(([name, value]) => [name, escapeHtmlAttr(value)]))
         : variables;
     return (_jsx(Editor, { id: id, value: substituteVariables(content, safeVariables), onChange: noop, variables: [], readOnly: true }));
 }

package/dist/app/extension-sections.d.ts

@@ -55,6 +55,12 @@ export type ExtensionSectionProps = {
         readonly index: number;
         readonly isLast: boolean;
     };
+    /** Only set for extension steps of a `layout.mode: "wizard"` entityEdit
+     *  editing an existing record (update mode); undefined everywhere else.
+     *  Report through `useReportStepComplete(reportStepComplete, complete)`
+     *  (`null` while the step's data loads) with whether the step already holds
+     *  its data, so the step bar shows the step as done. */
+    readonly reportStepComplete?: (complete: boolean) => void;
 };
 export type ExtensionSectionComponent = ComponentType<ExtensionSectionProps>;
 export type ExtensionSectionsMap = Readonly<Record<string, ExtensionSectionComponent>>;

package/dist/app/form-schema.d.ts

@@ -1,4 +1,5 @@
 import type { EntityDefinition, EntityEditScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
 import * as z from "zod";
+export declare function isPresent(value: unknown): boolean;
 export declare const REQUIRED_FIELD_I18N_KEY = "kumiko.validation.required";
-export declare function buildFormSchema(entity: EntityDefinition, screen: EntityEditScreenDefinition): z.ZodType;
+export declare function buildFormSchema(entity: EntityDefinition, screen: EntityEditScreenDefinition, unchangedFrom?: Readonly<Record<string, unknown>>): z.ZodType;

package/dist/app/form-schema.js

@@ -4,7 +4,7 @@ import * as z from "zod";
 import { layoutEditFields } from "./layout-fields.js";
 // `required` means "has a value", not "is truthy" — `false` and `0` count
 // as present, only the actually-empty representations don't.
-function isPresent(value) {
+export function isPresent(value) {
     if (value === undefined || value === null || value === "")
         return false;
     if (Array.isArray(value) && value.length === 0)
@@ -39,7 +39,12 @@ export const REQUIRED_FIELD_I18N_KEY = "kumiko.validation.required";
 // checked here: `visible`. `runValidate` already filters issues on hidden
 // fields via `computeFieldStates(options.fields, …)` (form-controller.ts:163,181),
 // fed by `deriveFormFields(screen)` in render-edit.tsx.
-export function buildFormSchema(entity, screen) {
+//
+// `unchangedFrom` is for payloadMode "changes" (update): a field still equal to
+// its loaded value never reaches the payload, so the server never presence-
+// checks it — a legacy row with a now-required empty field must stay saveable
+// when the user edits something else.
+export function buildFormSchema(entity, screen, unchangedFrom) {
     const fields = layoutEditFields(screen);
     return z
         .object({})
@@ -73,6 +78,10 @@ export function buildFormSchema(entity, screen) {
                 continue;
             if (isPresent(record[spec.field]))
                 continue;
+            if (unchangedFrom !== undefined &&
+                JSON.stringify(record[spec.field]) === JSON.stringify(unchangedFrom[spec.field])) {
+                continue;
+            }
             ctx.addIssue({
                 code: "custom",
                 path: [spec.field],

package/dist/app/kumiko-screen.d.ts

@@ -20,7 +20,12 @@ export declare function qualifyNavId(featureName: string, navId: string): string
 export { screenAccessAllows };
 export declare function KumikoScreen({ schema, qn, translate, entityId, onRowClick, onCopyLink, }: KumikoScreenProps): ReactNode;
 export declare function buildInitialValues(fields: Readonly<Record<string, unknown>>, defaultCurrency?: string, moneyCurrencyOverrides?: Readonly<Record<string, string>>): Readonly<Record<string, unknown>>;
+export declare function tenantCurrencyMoneyFieldNames(fields: Readonly<Record<string, unknown>>): readonly string[];
 export declare function literalCurrencyOverrides(fields: Readonly<Record<string, unknown>>): Readonly<Record<string, string>>;
+export declare function useMoneyCurrencyOverrides(fields: Readonly<Record<string, unknown>>, tenantFieldNames: readonly string[], fallback: string): {
+    readonly overrides: Readonly<Record<string, string>> | undefined;
+    readonly loading: boolean;
+};
 export type InitialValueSources = {
     readonly searchParams: Readonly<Record<string, string>>;
     readonly urlPrefillFields: readonly string[] | undefined;

package/dist/app/kumiko-screen.js

@@ -37,7 +37,7 @@ import { featureNameFromQualifiedScreenId, qualifyScreenId } from "./qualify-scr
 import { QueryErrorBanner, QueryLoadingBanner } from "./query-state-banners.js";
 import { ReferenceFacetBridges } from "./reference-facet-bridge.js";
 import { navigateToReturn, navigateToReturnOr, navigateWithReturnTo, ReturnHostProvider, useReturnHost, useReturnTarget, } from "./return-to.js";
-import { buildDefaultEditRowAction, buildProjectionRowActions, buildProjectionToolbarActions, buildRecordActions, evalRowExtractor, isWriteHandlerRowAction, navigateActionSearchParams, refetchAfterWrite, runProjectionRowNavigate, } from "./row-actions.js";
+import { buildDefaultEditRowAction, buildDrawerRowAction, buildProjectionRowActions, buildProjectionToolbarActions, buildRecordActions, evalRowExtractor, isWriteHandlerRowAction, navigateActionSearchParams, refetchAfterWrite, runProjectionRowNavigate, } from "./row-actions.js";
 import { findEditScreenFor, navigateTargetAllows, screenAccessAllows } from "./screen-access.js";
 import { SecretMintBody } from "./secret-mint-body.js";
 import { SecretsEditBody } from "./secrets-edit-body.js";
@@ -135,16 +135,19 @@ function entityWriteCommand(featureName, entity, verb) {
 // entityList-Screen für die Entity und navigiert dahin. Wird von
 // Create/Update/Delete genauso verwendet — alle drei haben "fertig
 // editiert, raus hier" als sinnvolles Default-Verhalten.
+function findEntityListScreen(schema, entityName) {
+    return schema.screens.find((s) => s.type === "entityList" && s.entity === entityName);
+}
 function useNavigateToListAfter(schema, entityName) {
     const nav = useNav();
     return useCallback(() => {
-        const list = schema.screens.find((s) => s.type === "entityList" && s.entity === entityName);
+        const list = findEntityListScreen(schema, entityName);
         if (!list)
             return;
         // schema.screens.id ist QN-form (registry-stamped); nav.navigate
         // erwartet Short-Form. Sonst landet die URL doppelt-qualifiziert.
         nav.navigate({ screenId: lastSegment(list.id) });
-    }, [nav, schema.screens, entityName]);
+    }, [nav, schema, entityName]);
 }
 // Default "+ Neu"-Navigation für die List-Toolbar: findet den ersten
 // entityEdit-Screen ohne entityId-Anhang und navigiert dorthin.
@@ -223,7 +226,7 @@ export function buildInitialValues(fields, defaultCurrency, moneyCurrencyOverrid
 // client-safe FieldDefinition subset, not the concrete MoneyFieldDef/
 // MoneyCurrencySource types, same idiom as the other field-shape narrowings
 // in this file (PrefillFieldShape etc.).
-function tenantCurrencyMoneyFieldNames(fields) {
+export function tenantCurrencyMoneyFieldNames(fields) {
     const names = [];
     for (const [name, def] of Object.entries(fields)) {
         const shape = def;
@@ -251,6 +254,7 @@ function resolveTenantCurrency(fieldNames, query, fallback) {
 // so a tenant-declared field whose config query errors or returns no value
 // lands here — same last resort as the entityEdit path's `?? "EUR"`.
 const ACTION_FORM_CURRENCY_FALLBACK = "EUR";
+const HEADER_CARD_DEFAULT_WIDTH = "4xl";
 // Shared by the update payload shape and the server-error path prefix so both can't drift.
 const UPDATE_CHANGES_KEY = "changes";
 // A money field naming a fixed ISO code (`currency: { kind: "literal", code }`,
@@ -274,7 +278,7 @@ export function literalCurrencyOverrides(fields) {
 // on a fast click submit, the wrong currency. Callers pass the tenant field
 // names themselves because an edit form only needs the fetch for fields the
 // record has no stored value for.
-function useMoneyCurrencyOverrides(fields, tenantFieldNames, fallback) {
+export function useMoneyCurrencyOverrides(fields, tenantFieldNames, fallback) {
     const query = useQuery("config:query:values", {}, { enabled: tenantFieldNames.length > 0 });
     const resolution = resolveTenantCurrency(tenantFieldNames, query, fallback);
     const resolvedTenantCurrency = resolution.status === "ready" ? resolution.currency : undefined;
@@ -481,7 +485,11 @@ export function mergeSearchParamsIntoInitial(fields, sources) {
             continue;
         if (shape.format === "password")
             continue;
-        if (drawerOverrides !== undefined && name in drawerOverrides) {
+        // An `undefined` override (row-extractor key whose row lacks the field)
+        // must not wipe the field default.
+        if (drawerOverrides !== undefined &&
+            Object.hasOwn(drawerOverrides, name) &&
+            drawerOverrides[name] !== undefined) {
             merged[name] = drawerOverrides[name];
             continue;
         }
@@ -662,7 +670,7 @@ function EntityEditUpdateForm({ schema, screen, entity, entityId, record, onRelo
         }
         return out;
     }, [entity.fields, entityDefaultCurrency, moneyCurrencyOverrides, record]);
-    const formSchema = useMemo(() => buildFormSchema(entity, screen), [entity, screen]);
+    const formSchema = useMemo(() => buildFormSchema(entity, screen, initial), [entity, screen, initial]);
     // Extension-Werte (z.B. customFields-jsonb) an extension-sections geben,
     // damit sie beim Edit den Bestand zeigen statt write-only zu sein.
     const extensionInitialValues = useMemo(() => {
@@ -695,6 +703,24 @@ function EntityEditUpdateForm({ schema, screen, entity, entityId, record, onRelo
     // pattern as ProjectionDetailBody.headerActions above (the edited record
     // stands in for the "row"), minus the cross-feature defaultEditAction
     // lookup that doesn't apply here (this screen already IS the edit form).
+    const handleRecordLeft = useCallback((action, resultData, deletedShownRecord) => {
+        // Never return onto the just-deleted record.
+        const target = deletedShownRecord && returnTarget?.entityId === entityId ? undefined : returnTarget;
+        if (action.redirect !== undefined) {
+            navigateAfterRedirect({
+                nav,
+                schema,
+                appFeatures,
+                returnTarget: target,
+                redirect: action.redirect,
+                resultData,
+                record,
+            });
+            return;
+        }
+        navigateToReturnOr(nav, target, navigateToList);
+        onDeleted?.();
+    }, [nav, schema, appFeatures, returnTarget, record, entityId, navigateToList, onDeleted]);
     const buildSectionActions = useCallback((actions) => buildRecordActions({
         actions,
         record,
@@ -704,33 +730,38 @@ function EntityEditUpdateForm({ schema, screen, entity, entityId, record, onRelo
         dispatcher,
         openDrawer,
         onWriteSuccess: onReload,
+        onRecordLeft: handleRecordLeft,
         defaultScreenTargetEntityId: entityId,
-    }), [record, effectiveTranslate, nav, host, dispatcher, openDrawer, onReload, entityId]);
+        defaultWritePayloadId: entityId,
+    }), [
+        record,
+        effectiveTranslate,
+        nav,
+        host,
+        dispatcher,
+        openDrawer,
+        onReload,
+        handleRecordLeft,
+        entityId,
+    ]);
     const headerActions = useMemo(() => buildSectionActions(screen.actions ?? []), [buildSectionActions, screen.actions]);
     const handleSubmitted = useCallback((result) => {
         if (!result.isSuccess)
             return;
         const redirect = screen.redirect;
         if (redirect !== undefined) {
-            if (returnToWinsOverRedirect(returnTarget, redirect, schema, appFeatures)) {
-                navigateToReturn(nav, returnTarget);
-            }
-            else if (typeof redirect === "string") {
-                // String form unchanged: navigates without an entityId, same as
-                // before the object form existed. The object form resolves like
-                // actionForm's — the update handler's success payload usually
-                // reports only this record's own id (event-store-executor-write.ts),
-                // so a parent FK named by `idFrom` falls back to the already-loaded
-                // `record`.
-                nav.navigate({ screenId: lastSegment(redirect) });
-            }
-            else {
-                const { screenId, entityId: targetEntityId } = resolveRedirectTarget(redirect, result.data, schema, appFeatures, record);
-                nav.navigate({
-                    screenId,
-                    ...(targetEntityId !== undefined && { entityId: targetEntityId }),
-                });
-            }
+            // The update handler's success payload usually reports only this
+            // record's own id (event-store-executor-write.ts), so a parent FK
+            // named by `idFrom` falls back to the already-loaded `record`.
+            navigateAfterRedirect({
+                nav,
+                schema,
+                appFeatures,
+                returnTarget,
+                redirect,
+                resultData: result.data,
+                record: overlayUpdatedProjection(record, result.data),
+            });
         }
         else {
             navigateToReturnOr(nav, returnTarget, navigateToList);
@@ -1236,26 +1267,7 @@ function EntityListBody({ schema, screen, entity, translate, onRowClick, }) {
                 };
             }
             if (action.kind === "drawer") {
-                const drawerAction = action;
-                const actionVisible = action.visible;
-                const actionIcon = resolveActionIcon(action.id, action.icon);
-                return {
-                    id: action.id,
-                    label: effectiveTranslate(action.label),
-                    ...(action.style !== undefined && { style: action.style }),
-                    ...(action.display !== undefined && { display: action.display }),
-                    confirmRequired: false,
-                    ...(actionIcon !== undefined && { icon: actionIcon }),
-                    onTrigger: (row) => {
-                        const initialValues = drawerAction.params !== undefined
-                            ? evalRowExtractor(drawerAction.params, row.values)
-                            : undefined;
-                        openDrawer(drawerAction, initialValues);
-                    },
-                    ...(actionVisible !== undefined && {
-                        isVisible: (row) => evalFieldCondition(actionVisible, row.values),
-                    }),
-                };
+                return buildDrawerRowAction(action, effectiveTranslate, openDrawer);
             }
             if (dispatcher === undefined)
                 return null;
@@ -1840,7 +1852,7 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
     // useQuery call re-runs too (it has no `live` subscription of its own).
     const [reloadNonce, setReloadNonce] = useState(0);
     const reloadDetail = useCallback(async () => {
-        await detailQuery.refetch();
+        await refetchAfterWrite(detailQuery.refetch);
         setReloadNonce((n) => n + 1);
     }, [detailQuery.refetch]);
     // Header actions render directly via RenderEditActionButton (fw#2713,
@@ -1859,7 +1871,49 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
     const userRoles = useUserRoles();
     const dispatcher = useOptionalDispatcher();
     const host = useReturnHost();
+    const returnTargetParam = useReturnTarget(screen.id);
+    // A singleton has no record route to come back to — same as entityEdit.
+    const returnTarget = screen.singleton === true ? undefined : returnTargetParam;
     const { drawerAction, drawerScreen, drawerInitialValues, openDrawer, closeDrawer } = useDrawerAction(schema);
+    const handleRecordLeft = useCallback((action, resultData, deletedShownRecord) => {
+        const record = detailQuery.data ?? {};
+        // Never return onto the just-deleted record.
+        const target = deletedShownRecord && returnTarget?.entityId === effectiveEntityId
+            ? undefined
+            : returnTarget;
+        if (action.redirect !== undefined) {
+            navigateAfterRedirect({
+                nav,
+                schema,
+                appFeatures,
+                returnTarget: target,
+                redirect: action.redirect,
+                resultData,
+                record,
+            });
+            return;
+        }
+        navigateToReturnOr(nav, target, () => {
+            const listScreen = screen.listScreenId ??
+                (screen.detailFor !== undefined
+                    ? findEntityListScreen(schema, screen.detailFor)?.id
+                    : undefined);
+            if (listScreen !== undefined)
+                nav.navigate({ screenId: lastSegment(listScreen) });
+            else
+                void detailQuery.refetch();
+        });
+    }, [
+        detailQuery.data,
+        detailQuery.refetch,
+        nav,
+        schema,
+        appFeatures,
+        returnTarget,
+        effectiveEntityId,
+        screen.listScreenId,
+        screen.detailFor,
+    ]);
     const editScreen = useMemo(() => {
         const detailFor = screen.detailFor;
         if (detailFor === undefined)
@@ -1907,6 +1961,7 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
         dispatcher,
         openDrawer,
         onWriteSuccess: detailQuery.refetch,
+        onRecordLeft: handleRecordLeft,
         sameEntityScreenId,
     }), [
         detailQuery.data,
@@ -1916,6 +1971,7 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
         host,
         dispatcher,
         openDrawer,
+        handleRecordLeft,
         sameEntityScreenId,
     ]);
     const headerActions = useMemo(() => {
@@ -1929,6 +1985,7 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
             dispatcher,
             openDrawer,
             onWriteSuccess: detailQuery.refetch,
+            onRecordLeft: handleRecordLeft,
             sameEntityScreenId,
         });
         if (defaultEditAction === undefined || declaredHasEdit)
@@ -1944,8 +2001,25 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
         detailQuery.data,
         detailQuery.refetch,
         openDrawer,
+        handleRecordLeft,
         sameEntityScreenId,
     ]);
+    const hasHeader = screen.header !== undefined;
+    const hasMetrics = screen.metrics !== undefined && screen.metrics.length > 0;
+    // ?? [] rather than threading `headerActions !== undefined` through every
+    // use below — an empty array is a safe no-op for .map/.length.
+    const headerActionsList = headerActions ?? [];
+    const hasHeaderActions = headerActionsList.length > 0;
+    const hasHeaderCard = hasHeader || hasMetrics || hasHeaderActions;
+    // A header card (metric band, status, actions) needs more room than the
+    // 640px form column; screens with only a record title keep the narrow one.
+    const widensScreenFormColumn = hasHeaderCard &&
+        !hasTabs &&
+        screenFillsHeight(screen) &&
+        detailScreen.layout.width === undefined;
+    const renderedDetailScreen = useMemo(() => widensScreenFormColumn
+        ? { ...detailScreen, layout: { ...detailScreen.layout, width: HEADER_CARD_DEFAULT_WIDTH } }
+        : detailScreen, [detailScreen, widensScreenFormColumn]);
     if (effectiveEntityId === undefined && screen.singleton !== true) {
         return (_jsxs(Banner, { padded: true, variant: "error", testId: "kumiko-screen-projection-detail-missing-id", children: ["Screen ", _jsx(Text, { variant: "code", children: screen.id }), " (projectionDetail) needs a row id in the path \u2014 open it from a row action."] }));
     }
@@ -1959,18 +2033,11 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
     if (!record) {
         return (_jsx(Banner, { padded: true, variant: "error", testId: "kumiko-screen-record-missing", children: screen.singleton === true ? ("Record not found.") : (_jsxs(_Fragment, { children: ["Record ", _jsx(Text, { variant: "code", children: entityId }), " not found."] })) }));
     }
-    const hasHeader = screen.header !== undefined;
-    const hasMetrics = screen.metrics !== undefined && screen.metrics.length > 0;
-    // ?? [] rather than threading `headerActions !== undefined` through every
-    // use below — an empty array is a safe no-op for .map/.length.
-    const headerActionsList = headerActions ?? [];
-    const hasHeaderActions = headerActionsList.length > 0;
     // Grouped into the head Card alongside title/status/metrics (fw#2713):
     // these are actions on the record the head shows, not on whichever tab is
     // open, so they must stay in place across tab switches instead of
     // trailing the active tab's content in the card footer.
     const headerActionsContent = hasHeaderActions && (_jsx(Grid, { columns: "auto", testId: "kumiko-screen-projection-detail-actions", children: _jsx(HeaderActionsBar, { actions: headerActionsList, Button: Button, Dialog: Dialog, ActionOverflowMenu: ActionOverflowMenu, onError: setActionError }) }));
-    const hasHeaderCard = hasHeader || hasMetrics || hasHeaderActions;
     // Rendered as RenderEdit's headerRegion (not as JSX siblings before it) so
     // this shares the same page padding/width as the record's edit card below
     // it, instead of sitting flush against the screen edge (fw record-screen
@@ -2032,7 +2099,7 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
                         ...(count !== undefined && { count }),
                     };
                 }), activeId: activeSection.id ?? "", onSelect: (id) => nav.setSearchParams({ tab: id }) }))] }));
-    return (_jsxs(_Fragment, { children: [_jsx(RenderEdit, { screen: detailScreen, entity: entity, featureName: schema.featureName, initial: record, entityId: effectiveEntityId, customSubmit: async () => ({ isSuccess: true, validationBlocked: false, data: undefined }), onReload: reloadDetail, onRelatedListDrawerAction: openDrawer, ...(translate !== undefined && { translate }), ...(hasTabs && { hideSectionTitles: true }), ...(screenFillsHeight(screen) && { fillScreenHeight: true }), ...((hasHeaderCard ||
+    return (_jsxs(_Fragment, { children: [_jsx(RenderEdit, { screen: renderedDetailScreen, entity: entity, featureName: schema.featureName, initial: record, entityId: effectiveEntityId, customSubmit: async () => ({ isSuccess: true, validationBlocked: false, data: undefined }), onReload: reloadDetail, onRelatedListDrawerAction: openDrawer, ...(translate !== undefined && { translate }), ...(hasTabs && { hideSectionTitles: true }), ...(screenFillsHeight(screen) && { fillScreenHeight: true }), ...((hasHeaderCard ||
                     hasTabs ||
                     screen.slots?.header !== undefined ||
                     screen.recordTitleField !== undefined) && {
@@ -2046,18 +2113,24 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
 function redirectScreenTarget(redirect) {
     return typeof redirect === "string" ? redirect : redirect.screen;
 }
-// Checks this schema first, then every mounted feature — the target may live
-// in another (cross-feature) feature than the redirect's own screen.
+// A qualified redirect names its feature, so the search space is THAT feature
+// only — the current schema's own screens must not shadow it with a same
+// short-id screen of another type. An unqualified redirect searches this
+// schema first (own screen wins), then every mounted feature. A named feature
+// that isn't mounted (no provider / isolated test) falls back to this schema.
 function findRedirectTargetScreen(redirect, schema, appFeatures) {
     const redirectScreen = redirectScreenTarget(redirect);
     const targetId = lastSegment(redirectScreen);
     const targetFeatureName = featureNameFromQualifiedScreenId(redirectScreen);
-    return (schema.screens.find((s) => lastSegment(s.id) === targetId) ??
-        (targetFeatureName !== undefined
-            ? appFeatures
-                .find((f) => f.featureName === targetFeatureName)
-                ?.screens.find((s) => lastSegment(s.id) === targetId)
-            : appFeatures.flatMap((f) => f.screens).find((s) => lastSegment(s.id) === targetId)));
+    const targetFeature = targetFeatureName !== undefined
+        ? appFeatures.find((f) => f.featureName === targetFeatureName)
+        : undefined;
+    const searchSpace = targetFeature !== undefined
+        ? targetFeature.screens
+        : targetFeatureName === undefined
+            ? [...schema.screens, ...appFeatures.flatMap((f) => f.screens)]
+            : schema.screens;
+    return searchSpace.find((s) => lastSegment(s.id) === targetId);
 }
 // A redirect to a record screen ("show the result") is a deliberate forward
 // navigation and keeps precedence over returnTo.
@@ -2092,6 +2165,33 @@ function resolveRedirectTarget(redirect, submittedData, schema, appFeatures, fal
         (fallbackRecord !== undefined ? extractIdField(fallbackRecord, idField) : undefined);
     return { screenId: targetId, entityId };
 }
+// Success navigation for a configured redirect — shared by entityEdit's
+// save and writeHandler record actions. The string form navigates without an
+// entityId; the object form resolves like actionForm's, with `record` as the
+// fallback id source.
+function navigateAfterRedirect(options) {
+    const { nav, schema, appFeatures, returnTarget, redirect, resultData, record } = options;
+    if (returnToWinsOverRedirect(returnTarget, redirect, schema, appFeatures)) {
+        navigateToReturn(nav, returnTarget);
+        return;
+    }
+    if (typeof redirect === "string") {
+        nav.navigate({ screenId: lastSegment(redirect) });
+        return;
+    }
+    const { screenId, entityId } = resolveRedirectTarget(redirect, resultData, schema, appFeatures, record);
+    nav.navigate({ screenId, ...(entityId !== undefined && { entityId }) });
+}
+// The update payload nests the saved projection under `data`; a changed
+// parent FK lives there, not in the pre-edit `record`.
+function overlayUpdatedProjection(record, resultData) {
+    if (typeof resultData !== "object" || resultData === null)
+        return record;
+    const projection = resultData.data;
+    if (typeof projection !== "object" || projection === null)
+        return record;
+    return { ...record, ...projection };
+}
 // Action-Form-Body — non-CRUD Write-Handler-driven Form. Re-uses
 // RenderEdit über synthetisierte EntityDefinition + EntityEditScreen-
 // Definition (siehe action-form-shim.ts für die Schulden-Doku). Die
@@ -2203,6 +2303,12 @@ const CONFIG_SCOPE_SOURCE = {
     tenant: "tenant-row",
     system: "system-row",
 };
+function isWriteOnlyTextField(fieldDef) {
+    return fieldDef?.type === "text" && fieldDef.writeOnly === true;
+}
+function hasStoredValue(stored) {
+    return stored !== undefined && stored !== null && stored !== "";
+}
 function ConfigEditBody({ schema, screen, translate, }) {
     const { ConfigCascadeView } = usePrimitives();
     const t = useTranslation();
@@ -2235,6 +2341,15 @@ function ConfigEditBody({ schema, screen, translate, }) {
                 continue;
             }
             const stored = valuesQuery.data[qualified]?.value;
+            // The read carries a mask (or nothing); only whether a value exists is
+            // meaningful, so the field gets the writeOnly wire shape true / null.
+            // The read is the effective value: an inherited one is not "set" on this
+            // scope, and a reset here would remove nothing.
+            if (isWriteOnlyTextField(fieldDef)) {
+                const ownedByThisScope = valuesQuery.data[qualified]?.source === CONFIG_SCOPE_SOURCE[screen.scope];
+                out[shortName] = ownedByThisScope && hasStoredValue(stored) ? true : null;
+                continue;
+            }
             if (stored === undefined) {
                 out[shortName] = defaults[shortName];
                 continue;
@@ -2253,7 +2368,7 @@ function ConfigEditBody({ schema, screen, translate, }) {
             }
         }
         return out;
-    }, [valuesQuery.data, screen.fields, screen.configKeys]);
+    }, [valuesQuery.data, screen.fields, screen.configKeys, screen.scope]);
     // Cascade-Lookup: qualifiedKey → ConfigCascade für die
     // Cascade-Anzeige unter jedem Feld. Defensive `levels`-Shape-Check
     // damit fremde Query-Mocks (z.B. configEdit-Unit-Tests die nur
@@ -2288,6 +2403,22 @@ function ConfigEditBody({ schema, screen, translate, }) {
                 continue;
             const fieldDef = screen.fields[shortName];
             const ftype = fieldDef?.type;
+            if (isWriteOnlyTextField(screen.fields[shortName])) {
+                // true (untouched/undone) and "" mean keep the stored secret; null removes it.
+                if (value === null) {
+                    commands.push({
+                        type: "config:write:reset",
+                        payload: { key: qualified, scope: screen.scope },
+                    });
+                }
+                else if (typeof value === "string" && value !== "") {
+                    commands.push({
+                        type: "config:write:set",
+                        payload: { key: qualified, value, scope: screen.scope },
+                    });
+                }
+                continue;
+            }
             // A query-backed select is cleared to "" when its dependent value became
             // invalid. config:write:set would store that as an empty override (the
             // badge shows "Mandant" with no value); reset falls back to the inherited

package/dist/app/nav.d.ts

@@ -47,6 +47,11 @@ export type NavApi = {
 };
 export declare function parsePath(pathname: string, hasWorkspaces?: boolean): NavRoute | undefined;
 export declare function formatPath(target: ScreenTarget): string;
+export declare function findDetailForScreen(features: readonly FeatureSchema[], entity: string): {
+    readonly featureName: string;
+    readonly screenId: string;
+    readonly screen: FeatureSchema["screens"][number];
+} | undefined;
 /** Non-throwing existence check for findDetailForScreen — lets a caller pick
  *  a different default (fw#2164's row-click fallback) instead of resolving. */
 export declare function hasDetailScreen(features: readonly FeatureSchema[], entity: string): boolean;

package/dist/app/nav.js

@@ -9,8 +9,21 @@ import { lastSegment } from "./qn.js";
 // Alles nach den ersten 2/3 Segmenten wird ignoriert — kumikos
 // Navigation-Grammatik nested nicht weiter. Nested-Routes wäre eine
 // Spec-Änderung, nicht ein URL-Shape-Unfall.
+function decodeSegments(segments) {
+    try {
+        return segments.map((segment) => decodeURIComponent(segment));
+    }
+    catch {
+        // Malformed percent-escape ("%zz") — treat the URL as no route.
+        return undefined;
+    }
+}
 export function parsePath(pathname, hasWorkspaces) {
-    const parts = pathname.split("/").filter((p) => p !== "");
+    const rawParts = pathname.split("/").filter((p) => p !== "");
+    // Only the segments the grammar uses are decoded; ignored trailing ones may be junk.
+    const parts = decodeSegments(rawParts.slice(0, hasWorkspaces === true ? 3 : 2));
+    if (parts === undefined)
+        return undefined;
     if (hasWorkspaces === true) {
         const [workspaceId, screenId, entityId] = parts;
         if (workspaceId === undefined || workspaceId === "")
@@ -41,17 +54,17 @@ export function formatPath(target) {
     segments.push(target.screenId);
     if (target.entityId !== undefined)
         segments.push(target.entityId);
-    return `/${segments.join("/")}`;
+    return `/${segments.map((segment) => encodeURIComponent(segment)).join("/")}`;
 }
 // Shared entity→detailFor-screen lookup — resolveTarget's ObjectTarget
 // branch and hasDetailScreen (create-app's row-click default, fw#2164) both
 // need "is there a detail screen for this entity", one to resolve it, the
 // other to just check before falling back to a different default.
-function findDetailForScreen(features, entity) {
+export function findDetailForScreen(features, entity) {
     for (const feature of features) {
         for (const screen of feature.screens) {
             if (screen.detailFor === entity)
-                return { featureName: feature.featureName, screenId: screen.id };
+                return { featureName: feature.featureName, screenId: screen.id, screen };
         }
     }
     return undefined;

package/dist/app/reference-facet-bridge.js

@@ -2,14 +2,21 @@ import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 // One bridge component per reference facet, mirroring ReferenceLookupBridge —
 // facet count varies per screen, so the hook can't be called in a loop.
 import { useEffect } from "react";
+import { REFERENCE_LIST_LOOKUP_LIMIT } from "../hooks/reference-limits.js";
 import { useReferenceLookup } from "../hooks/use-reference-lookup.js";
 function ReferenceFacetOptionsBridge({ field, refEntity, refFeature, labelField, onOptions, }) {
     const lookup = useReferenceLookup(refFeature, refEntity, labelField);
     useEffect(() => {
         if (lookup.loading)
             return;
+        // The lookup is one capped list fetch; a full page means the facet may be
+        // missing values the user wants to filter by.
+        if (lookup.map.size >= REFERENCE_LIST_LOOKUP_LIMIT) {
+            // biome-ignore lint/suspicious/noConsole: dev-warning, facet options are silently truncated
+            console.warn(`[kumiko] reference facet "${field}" shows only the first ${REFERENCE_LIST_LOOKUP_LIMIT} ${refEntity} rows; further values cannot be filtered by`);
+        }
         onOptions(field, [...lookup.map.entries()].map(([value, label]) => ({ value, label })));
-    }, [lookup.loading, lookup.map, field, onOptions]);
+    }, [lookup.loading, lookup.map, field, refEntity, onOptions]);
     return null;
 }
 // One invisible bridge per "reference" facet spec, each publishing its