@cosmicdrift/kumiko-renderer 0.336.0 → 0.337.1

package/dist/app/kumiko-screen.js

@@ -1,9 +1,10 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { evalFieldCondition, isWriteFormEditSection, metricField, parseRefTarget, } from "@cosmicdrift/kumiko-framework/ui-types";
-import { buildOptionLabels, computeRelatedListSectionViewModel, fieldLabelKey, fieldOptionLabelKey, isSafeHref, } from "@cosmicdrift/kumiko-headless";
+import { applyFormatSpec, buildOptionLabels, computeRelatedListSectionViewModel, fieldLabelKey, fieldOptionLabelKey, isSafeHref, } from "@cosmicdrift/kumiko-headless";
 import { resolveActionIcon } from "@cosmicdrift/kumiko-types/action-icon";
 import { TENANT_CURRENCY_CONFIG_KEY } from "@cosmicdrift/kumiko-types/fields";
 import { Fragment, useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { Temporal } from "temporal-polyfill";
 import { QueryOptionLabel, resolveOptionsQueryPayload, } from "../components/query-options-select.js";
 import { extractCreatedId, extractIdField } from "../components/reference-create-dialog.js";
 import { RenderEdit, resolveRecordTitle, } from "../components/render-edit.js";
@@ -316,14 +317,9 @@ function formatSummaryValue(value, locale) {
         return new Intl.NumberFormat(locale, { style: "currency", currency: value.currency }).format(value.amount);
     }
     if (typeof value === "number")
-        return value.toLocaleString(locale);
+        return applyFormatSpec({ format: "number", locale }, value);
     if (typeof value === "string" && ISO_DATE_PATTERN.test(value)) {
-        return new Date(`${value}T00:00:00Z`).toLocaleDateString(locale, {
-            year: "numeric",
-            month: "2-digit",
-            day: "2-digit",
-            timeZone: "UTC",
-        });
+        return applyFormatSpec({ format: "date", locale }, value);
     }
     return value === null || value === undefined ? "" : String(value);
 }
@@ -365,6 +361,8 @@ function coerceMoneyValue(raw, fieldName, defaultCurrency) {
         warnPrefillParam(`money field "${fieldName}" got an object without a usable {amount, currency} shape — the prefill is ignored.`);
         return undefined;
     }
+    if (typeof value === "string" && value.trim() === "")
+        return undefined;
     const amount = Number(typeof value === "number" ? value : raw);
     if (!Number.isFinite(amount))
         return undefined;
@@ -373,12 +371,38 @@ function coerceMoneyValue(raw, fieldName, defaultCurrency) {
     warnPrefillParam(`money field "${fieldName}" was prefilled with a bare number and no currency is available — pass {"amount":<number>,"currency":"<ISO code>"} as the param value, otherwise the handler's schema rejects the submit.`);
     return amount;
 }
+// Mirrors isRepresentableAtScale in the framework's schema-builder, which the
+// renderer cannot import (server engine). Keep the tolerance identical so a
+// prefilled cell never passes here and fails the handler's schema.
+function isRepresentableAtScale(value, scale) {
+    const scaled = value * 10 ** scale;
+    const tolerance = Math.abs(scaled) * 8 * Number.EPSILON + Number.EPSILON;
+    return Math.abs(scaled - Math.round(scaled)) <= tolerance;
+}
+function isIsoInstant(value) {
+    try {
+        Temporal.Instant.from(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 const EMBEDDED_LIST_PREFILL_ROW_LIMIT = 500;
 function coerceEmbeddedCell(value, cell) {
     switch (cell.type) {
         case "number":
-        case "decimal":
             return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+        case "decimal":
+            return typeof value === "number" &&
+                Number.isFinite(value) &&
+                (cell.scale === undefined || isRepresentableAtScale(value, cell.scale))
+                ? value
+                : undefined;
+        case "date":
+            return typeof value === "string" && ISO_DATE_PATTERN.test(value) ? value : undefined;
+        case "timestamp":
+            return typeof value === "string" && isIsoInstant(value) ? value : undefined;
         case "money":
             // Row cells are signed minor units; the currency lives on the head, so a
             // top-level `{amount, currency}` in major units would land 100x off.
@@ -428,7 +452,7 @@ function coerceEmbeddedListRows(raw, fieldName, schema, maxItems) {
 function coercePrefillString(raw, name, shape, fallback, defaultCurrency, moneyCurrencyOverrides) {
     if (shape.type === "number") {
         const parsed = Number(raw);
-        return Number.isNaN(parsed) ? fallback : parsed;
+        return Number.isFinite(parsed) ? parsed : fallback;
     }
     if (shape.type === "money") {
         const coerced = coerceMoneyValue(raw, name, moneyCurrencyOverrides?.[name] ?? defaultCurrency);
@@ -706,6 +730,8 @@ function EntityEditUpdateForm({ schema, screen, entity, entityId, record, onRelo
     const handleRecordLeft = useCallback((action, resultData, deletedShownRecord) => {
         // Never return onto the just-deleted record.
         const target = deletedShownRecord && returnTarget?.entityId === entityId ? undefined : returnTarget;
+        if (deletedShownRecord)
+            onDeleted?.();
         if (action.redirect !== undefined) {
             navigateAfterRedirect({
                 nav,
@@ -718,9 +744,24 @@ function EntityEditUpdateForm({ schema, screen, entity, entityId, record, onRelo
             });
             return;
         }
-        navigateToReturnOr(nav, target, navigateToList);
-        onDeleted?.();
-    }, [nav, schema, appFeatures, returnTarget, record, entityId, navigateToList, onDeleted]);
+        navigateToReturnOr(nav, target, () => {
+            if (findEntityListScreen(schema, screen.entity) !== undefined)
+                navigateToList();
+            else if (onDeleted === undefined)
+                void onReload();
+        });
+    }, [
+        nav,
+        schema,
+        appFeatures,
+        returnTarget,
+        record,
+        entityId,
+        navigateToList,
+        onDeleted,
+        onReload,
+        screen.entity,
+    ]);
     const buildSectionActions = useCallback((actions) => buildRecordActions({
         actions,
         record,
@@ -959,9 +1000,10 @@ function DrawerHost({ schema, drawerAction, drawerScreen, drawerInitialValues, u
             closeAndReset();
     }, [hasUnsavedInput, closeAndReset]);
     // Drawer is an optional Core-Primitive (additive rollout) — same "skip +
-    // warn once" precedent as rowActions without a mounted DispatcherProvider
-    // above, instead of crashing when a web app hasn't upgraded its
-    // createKumikoApp wiring yet.
+    // warn" precedent as rowActions without a mounted DispatcherProvider above,
+    // instead of crashing when a web app hasn't upgraded its createKumikoApp
+    // wiring yet. The warning repeats per mount and whenever the action changes.
+    // Dev-time setup error, so no dedupe.
     useEffect(() => {
         if (drawerAction !== null && Drawer === undefined) {
             // biome-ignore lint/suspicious/noConsole: dev-warning for a setup error
@@ -1757,20 +1799,29 @@ function primaryHeaderAction(actions) {
 function HeaderActionsBar({ actions, Button, Dialog, ActionOverflowMenu, onError, collapseAfterPrimary = false, compact = false, PageHeader, }) {
     const t = useTranslation();
     const [pendingAction, setPendingAction] = useState(null);
+    // Menu items have no button of their own to carry RenderEditActionButton's
+    // busy state; without it the menu can be reopened mid-write and fire the
+    // same writeHandler twice.
+    const [busyActionId, setBusyActionId] = useState(null);
     const trigger = async (action) => {
         onError(null);
+        setBusyActionId(action.id);
         try {
             await action.onPress();
         }
         catch (e) {
             onError(e instanceof Error ? e.message : String(e));
         }
+        finally {
+            setBusyActionId(null);
+        }
     };
     const toMenuItem = (action) => ({
         id: action.id,
         label: action.label,
         ...(action.icon !== undefined && { icon: action.icon }),
         variant: action.style === "danger" ? "danger" : "default",
+        ...(busyActionId !== null && { disabled: true }),
         onSelect: () => {
             if (needsActionConfirm(action)) {
                 setPendingAction(action);
@@ -2078,7 +2129,7 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
                             status: (_jsx(StatusBadge, { value: String(record[header.status] ?? ""), tone: headerStatusTone(header, record), testId: "kumiko-screen-projection-detail-status" })),
                         }), ...(hasHeaderActions && {
                             actions: (_jsx(Grid, { columns: "auto", testId: "kumiko-screen-projection-detail-actions", children: _jsx(HeaderActionsBar, { actions: headerActionsList, Button: Button, Dialog: Dialog, ActionOverflowMenu: ActionOverflowMenu, onError: setActionError, collapseAfterPrimary: true, compact: pageHeaderCompact, PageHeader: PageHeader }) })),
-                        }) }), MetricBand === undefined && headerSlot, (hasMetrics || headerSubtitleSlot !== undefined || headerSlot !== undefined) &&
+                        }) }), MetricBand === undefined && headerSubtitleSlot, MetricBand === undefined && headerSlot, (hasMetrics || headerSubtitleSlot !== undefined || headerSlot !== undefined) &&
                         (MetricBand !== undefined || hasMetrics) &&
                         metricsBlock(headerSubtitleSlot, MetricBand !== undefined ? headerSlot : undefined), actionErrorBanner] })) : ((hasHeaderCard || headerSlot !== undefined || recordTitle !== undefined) && (_jsxs(Card, { slots: {
                     ...(headerTitleSlot !== undefined && { title: headerTitleSlot }),
@@ -2309,6 +2360,32 @@ function isWriteOnlyTextField(fieldDef) {
 function hasStoredValue(stored) {
     return stored !== undefined && stored !== null && stored !== "";
 }
+const CONFIG_WRITE_ISSUE_PATH = "value";
+// write-helpers report every issue at `value`; in a batch that path is
+// meaningless to the form, so point it at the field whose command failed.
+function mapFailedConfigCommandIssuesToField(error, failedIndex, commandFieldNames) {
+    const fieldName = commandFieldNames[failedIndex];
+    const fields = error.details?.fields;
+    if (fieldName === undefined || fields === undefined)
+        return error;
+    return {
+        ...error,
+        details: {
+            ...error.details,
+            fields: fields.map((issue) => {
+                if (issue.path === CONFIG_WRITE_ISSUE_PATH)
+                    return { ...issue, path: fieldName };
+                if (issue.path.startsWith(`${CONFIG_WRITE_ISSUE_PATH}.`)) {
+                    return {
+                        ...issue,
+                        path: `${fieldName}${issue.path.slice(CONFIG_WRITE_ISSUE_PATH.length)}`,
+                    };
+                }
+                return issue;
+            }),
+        },
+    };
+}
 function ConfigEditBody({ schema, screen, translate, }) {
     const { ConfigCascadeView } = usePrimitives();
     const t = useTranslation();
@@ -2397,6 +2474,7 @@ function ConfigEditBody({ schema, screen, translate, }) {
     // Write durch ist, das Form bleibt dirty.
     const customSubmit = useCallback(async (snapshot) => {
         const commands = [];
+        const commandFieldNames = [];
         for (const [shortName, value] of Object.entries(snapshot.changes)) {
             const qualified = screen.configKeys[shortName];
             if (qualified === undefined)
@@ -2406,12 +2484,14 @@ function ConfigEditBody({ schema, screen, translate, }) {
             if (isWriteOnlyTextField(screen.fields[shortName])) {
                 // true (untouched/undone) and "" mean keep the stored secret; null removes it.
                 if (value === null) {
+                    commandFieldNames.push(shortName);
                     commands.push({
                         type: "config:write:reset",
                         payload: { key: qualified, scope: screen.scope },
                     });
                 }
                 else if (typeof value === "string" && value !== "") {
+                    commandFieldNames.push(shortName);
                     commands.push({
                         type: "config:write:set",
                         payload: { key: qualified, value, scope: screen.scope },
@@ -2425,12 +2505,14 @@ function ConfigEditBody({ schema, screen, translate, }) {
             // value. set can't do it: deleting the row is irreversible, reset is
             // the high-risk handler.
             if (ftype === "select" && fieldDef?.optionsQuery !== undefined && value === "") {
+                commandFieldNames.push(shortName);
                 commands.push({
                     type: "config:write:reset",
                     payload: { key: qualified, scope: screen.scope },
                 });
                 continue;
             }
+            commandFieldNames.push(shortName);
             commands.push({
                 type: "config:write:set",
                 payload: {
@@ -2445,7 +2527,11 @@ function ConfigEditBody({ schema, screen, translate, }) {
         }
         const result = await dispatcher.batch(commands);
         if (!result.isSuccess) {
-            return { validationBlocked: false, isSuccess: false, error: result.error };
+            return {
+                validationBlocked: false,
+                isSuccess: false,
+                error: mapFailedConfigCommandIssuesToField(result.error, result.failedIndex, commandFieldNames),
+            };
         }
         // Cascade-Disclosure + Maskenwerte nach dem Write nachziehen, sonst
         // bleibt die Anzeige stale bis Reload — gleiche refetch-Calls wie onReset.

package/dist/app/list-facets.js

@@ -239,10 +239,16 @@ function dayBoundInstant(date, bound, timeZone) {
         })
             .toString();
 }
+// A shared or hand-built URL can carry from > to; the handler's `from <= to`
+// refine would answer 422, so the bounds are put in order before conversion.
+function swapInvertedRange(range) {
+    const inverted = range.from !== "" && range.to !== "" && range.from > range.to;
+    return inverted ? { from: range.to, to: range.from } : range;
+}
 export function buildDateRangePayload(specs, urlFilters, timeZone) {
     const out = {};
     for (const spec of specs) {
-        const range = readDateRange(urlFilters, spec.field);
+        const range = swapInvertedRange(readDateRange(urlFilters, spec.field));
         for (const [bound, param] of [
             ["from", spec.fromParam],
             ["to", spec.toParam],

package/dist/app/return-to.js

@@ -105,7 +105,10 @@ export function navigateWithReturnTo(nav, target, host, params) {
  *  with them, so a chain unwinds one level per jump. */
 export function navigateToReturn(nav, target) {
     const raw = nav.searchParams[RETURN_TO_PARAM];
-    const state = raw === undefined ? NO_RETURN_STATE : splitReturnTo(raw).state;
+    // The state belongs to the host the raw value names; a caller-supplied
+    // target elsewhere must not inherit it.
+    const returnTo = raw === undefined ? undefined : splitReturnTo(raw);
+    const state = returnTo?.path === formatReturnTo(target) ? returnTo.state : NO_RETURN_STATE;
     nav.navigate(target);
     // The explicit null drops this screen's own returnTo on nav impls whose
     // navigate keeps the query.

package/dist/app/secrets-edit-body.js

@@ -1,10 +1,12 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useCallback, useMemo, useState } from "react";
 import { useDispatcher } from "../context/dispatcher-context.js";
+import { useUserRoles } from "../context/user-roles-context.js";
 import { useQuery } from "../hooks/use-query.js";
 import { useTranslation } from "../i18n.js";
 import { STICKY_PRIMARY_ACTION_PROP, usePrimitives } from "../primitives.js";
 import { QueryErrorBanner, QueryLoadingBanner } from "./query-state-banners.js";
+import { screenAccessAllows } from "./screen-access.js";
 import { dispatcherErrorText } from "./write-failed-error.js";
 function groupSectionsByTitle(sections) {
     const byTitle = new Map();
@@ -24,6 +26,10 @@ export function SecretsEditBody({ screen, translate }) {
     const effectiveTranslate = translate ?? t;
     const dispatcher = useDispatcher();
     const listQuery = useQuery("secrets:query:list", {});
+    const userRoles = useUserRoles();
+    // Hidden fields are excluded from rendering and submit alike; the server
+    // write gate stays authoritative.
+    const visibleFieldIds = useMemo(() => new Set(Object.keys(screen.secretKeys).filter((fieldId) => screenAccessAllows(screen.fieldAccess?.[fieldId], userRoles))), [screen.secretKeys, screen.fieldAccess, userRoles]);
     const [drafts, setDrafts] = useState({});
     const [submitting, setSubmitting] = useState(false);
     const [submitError, setSubmitError] = useState(null);
@@ -40,6 +46,8 @@ export function SecretsEditBody({ screen, translate }) {
     }, []);
     const handleSubmit = useCallback(async () => {
         const commands = Object.entries(screen.secretKeys).flatMap(([fieldId, qualified]) => {
+            if (!visibleFieldIds.has(fieldId))
+                return [];
             const value = drafts[fieldId]?.trim();
             return value ? [{ type: "secrets:write:set", payload: { key: qualified, value } }] : [];
         });
@@ -64,7 +72,14 @@ export function SecretsEditBody({ screen, translate }) {
         finally {
             setSubmitting(false);
         }
-    }, [dispatcher, drafts, screen.secretKeys, listQuery.refetch, effectiveTranslate]);
+    }, [
+        dispatcher,
+        drafts,
+        screen.secretKeys,
+        visibleFieldIds,
+        listQuery.refetch,
+        effectiveTranslate,
+    ]);
     const handleDelete = useCallback(async (qualified) => {
         setDeleting(true);
         try {
@@ -90,7 +105,12 @@ export function SecretsEditBody({ screen, translate }) {
     }
     // The generator emits one section per feature; features without a declared
     // title all fall under the generic "Secrets" heading and share one band.
-    const sectionGroups = groupSectionsByTitle(screen.sections);
+    const sectionGroups = groupSectionsByTitle(screen.sections)
+        .map((group) => ({
+        ...group,
+        fields: group.fields.filter((fieldId) => visibleFieldIds.has(fieldId)),
+    }))
+        .filter((group) => group.fields.length > 0);
     const unsavedCount = Object.values(drafts).filter((value) => value.trim() !== "").length;
     return (_jsxs(_Fragment, { children: [_jsxs(Form, { onSubmit: () => {
                     void handleSubmit();

package/dist/components/embedded-list-field.d.ts

@@ -7,4 +7,4 @@ export type EmbeddedListFieldProps = {
     readonly allIssues: Readonly<Record<string, readonly FieldIssue[]>>;
     readonly featureName: string;
 };
-export declare function EmbeddedListField({ field, id, onChange, allIssues, featureName, }: EmbeddedListFieldProps): ReactNode;
+export declare function EmbeddedListField(props: EmbeddedListFieldProps): ReactNode;

package/dist/components/embedded-list-field.js

@@ -99,7 +99,17 @@ function coerceCellValue(column, text, currency) {
         }
     }
 }
-export function EmbeddedListField({ field, id, onChange, allIssues, featureName, }) {
+// The reference-column queries are hooks called in a loop, so their count must
+// stay fixed per mount. Keying on the reference cells remounts when that set
+// changes (field-level access, in-place entity swap) instead of breaking hook order.
+export function EmbeddedListField(props) {
+    const referenceKey = (props.field.embeddedListCells ?? [])
+        .filter((c) => c.type === "reference")
+        .map((c) => `${c.field}:${c.refFeature ?? ""}:${c.refEntity ?? ""}`)
+        .join("|");
+    return _jsx(EmbeddedListFieldInner, { ...props }, referenceKey);
+}
+function EmbeddedListFieldInner({ field, id, onChange, allIssues, featureName, }) {
     const { EmbeddedListInput } = usePrimitives();
     const t = useTranslation();
     const [pasteWarning, setPasteWarning] = useState(null);
@@ -109,7 +119,7 @@ export function EmbeddedListField({ field, id, onChange, allIssues, featureName,
     const referenceCells = cells.filter((c) => c.type === "reference");
     const referenceSources = referenceCells.map((cell) => referenceOptionSource(cell, cell.refFeature ?? featureName, cell.refEntity ?? ""));
     const referenceQueries = referenceSources.map((source) => 
-    // biome-ignore lint/correctness/useHookAtTopLevel: referenceCells comes from the entity-schema definition — fixed for the screen's lifetime, not a real conditional-hook risk.
+    // biome-ignore lint/correctness/useHookAtTopLevel: the wrapper keys this component on the reference-cell set, so the hook count is fixed per mount.
     useQuery(source.queryQn, {
         limit: REFERENCE_COMBOBOX_LIMIT,
     }));

package/dist/components/related-list-section.js

@@ -1,5 +1,5 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { evalFieldCondition, normalizeListColumn, parseRefTarget, } from "@cosmicdrift/kumiko-framework/ui-types";
+import { evalFieldCondition, normalizeListColumn, parseRefTarget, relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-framework/ui-types";
 import { useCallback, useMemo, useState } from "react";
 import { useAppFeatures } from "../app/app-features-context.js";
 import { buildFilterFacets, buildFilterPayload, mergeReferenceFacetOptions, resolveProjectionFacetSpecs, } from "../app/list-facets.js";
@@ -49,9 +49,12 @@ function warnRelatedListEmptyStateDrawerDropped(actionId) {
 }
 function buildRowGrouping(groupBy, translate, locale) {
     return {
-        keyOf: (row) => String(row.values[groupBy.field] ?? ""),
-        startsCollapsed: (key) => groupBy.collapsedWhen !== undefined && key === String(groupBy.collapsedWhen),
+        keyOf: (row) => relatedListGroupKey(row.values[groupBy.field]),
+        startsCollapsed: (key) => groupBy.collapsedWhen !== undefined && key === relatedListGroupKey(groupBy.collapsedWhen),
         headerLabel: (key, rows) => {
+            const labelKey = relatedListGroupHeaderLabel(groupBy, key);
+            if (labelKey === undefined)
+                return undefined;
             const dates = groupBy.dateField === undefined
                 ? []
                 : rows
@@ -59,7 +62,7 @@ function buildRowGrouping(groupBy, translate, locale) {
                     .filter((value) => value !== "")
                     .sort();
             const latest = dates[dates.length - 1];
-            return translate(groupBy.labels?.[key] ?? groupBy.label, {
+            return translate(labelKey, {
                 count: rows.length,
                 value: key,
                 lastDate: latest === undefined
@@ -164,10 +167,9 @@ export function RelatedListSection({ section, parentId, record, featureName, tra
     }, [ownRefetch, onAfterWrite]);
     const onFilterChange = useCallback((field, values) => setFilters((prev) => ({ ...prev, [field]: values })), []);
     const onFilterReset = useCallback(() => setFilters({}), []);
-    // Sorted client-side over the already-loaded rows — this section has no
-    // pager (see `payload` above: a one-shot fetch, no cursor/offset), so the
-    // loaded set already IS the full display set and there is no "other page"
-    // a client-side sort could misleadingly hide (fw#2722).
+    // Sorted client-side over the already-loaded rows only. The section has no
+    // pager (one-shot fetch); when that fetch is truncated (`nextCursor` set) the
+    // truncation banner below tells the user the sorted set is partial.
     const [sort, setSort] = useState(section.defaultSort ?? null);
     const sortAccessors = useMemo(() => {
         const accessors = {};

package/dist/components/render-edit-logic.d.ts

@@ -1,7 +1,10 @@
-import type { EditFieldViewModel, EditSectionViewModel, SubmitResult } from "@cosmicdrift/kumiko-headless";
+import type { DispatcherError, EditFieldViewModel, EditSectionViewModel, SubmitResult } from "@cosmicdrift/kumiko-headless";
 export declare function hasEditableSection(sections: readonly EditSectionViewModel[]): boolean;
 export declare function resolveExtensionEntityId(entityIdProp: string | null | undefined, vmId: string | null): string | null;
 export declare function shouldNotifyCaller(result: SubmitResult<unknown>, extensionsPersisted: boolean): boolean;
+export declare function issueRootField(path: string): string;
 export declare function hasIssueWithoutRenderedField(issuePaths: readonly string[], sections: readonly EditSectionViewModel[]): boolean;
 export declare function hasIssueWithoutVisibleField(issuePaths: readonly string[], fields: readonly EditFieldViewModel[]): boolean;
+export declare function findFirstErroringSectionIndex(sections: readonly EditSectionViewModel[], issuePaths: readonly string[]): number | undefined;
 export declare function filterEditSections(sections: readonly EditSectionViewModel[], fieldsFilter: readonly string[] | undefined): readonly EditSectionViewModel[];
+export declare function isDispatcherRejection(value: unknown): value is DispatcherError;

package/dist/components/render-edit-logic.js

@@ -27,19 +27,29 @@ export function resolveExtensionEntityId(entityIdProp, vmId) {
 export function shouldNotifyCaller(result, extensionsPersisted) {
     return !(result.isSuccess && !extensionsPersisted);
 }
-// Matched on the first path segment (embedded-list rows are dotted, e.g. `tasks.2.title`).
+// Embedded-list rows are dotted (e.g. `tasks.2.title`); the form field is the first segment.
+export function issueRootField(path) {
+    return path.split(".")[0] ?? path;
+}
 // No issues at all counts as unmatched, so the caller keeps the banner.
 export function hasIssueWithoutRenderedField(issuePaths, sections) {
-    const renderedFields = sections
-        .filter((s) => s.kind === "fields" && (s.visible || s.fields.length === 0))
-        .flatMap((s) => (s.kind === "fields" ? s.fields : []));
+    const renderedFields = sections.flatMap((s) => s.kind === "fields" && s.visible ? s.fields : []);
     return hasIssueWithoutVisibleField(issuePaths, renderedFields);
 }
 export function hasIssueWithoutVisibleField(issuePaths, fields) {
     if (issuePaths.length === 0)
         return true;
     const visibleFields = new Set(fields.filter((f) => f.visible).map((f) => f.field));
-    return issuePaths.some((path) => !visibleFields.has(path.split(".")[0] ?? path));
+    return issuePaths.some((path) => !visibleFields.has(issueRootField(path)));
+}
+// Same visibility rule as hasIssueWithoutRenderedField: a hidden field shows
+// no error, so jumping to its step would strand the user on an error-less step.
+export function findFirstErroringSectionIndex(sections, issuePaths) {
+    const erroredFields = new Set(issuePaths.map(issueRootField));
+    const index = sections.findIndex((s) => s.kind === "fields" &&
+        s.visible &&
+        s.fields.some((f) => f.visible && erroredFields.has(f.field)));
+    return index === -1 ? undefined : index;
 }
 // Extension, relatedList and writeForm sections skip the `fields` filter
 // (writeForm's fields belong to its own independent form, not the host's);
@@ -64,3 +74,13 @@ export function filterEditSections(sections, fieldsFilter) {
     }
     return result;
 }
+// `onDelete` is typed `() => void`-compatible, so a caller can return any value
+// at runtime (a WriteResult, `true`); only a real DispatcherError is a rejection.
+export function isDispatcherRejection(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "code" in value &&
+        typeof value.code === "string" &&
+        "i18nKey" in value &&
+        typeof value.i18nKey === "string");
+}

package/dist/components/render-edit.js

@@ -1,6 +1,6 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { evalFieldCondition, isFieldsEditSection, normalizeEditField, PROJECTION_DETAIL_ENTITY, sectionFieldSpecs, } from "@cosmicdrift/kumiko-framework/ui-types";
-import { computeEditViewModel, relevantFieldIssues, zodErrorToFieldIssues, } from "@cosmicdrift/kumiko-headless";
+import { computeEditViewModel, groupIssuesByPath, relevantFieldIssues, zodErrorToFieldIssues, } from "@cosmicdrift/kumiko-headless";
 import { RenderEditActionButton } from "./render-edit-action-button.js";
 import { AllFieldsRequiredProvider } from "./render-field.js";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
@@ -17,7 +17,7 @@ import { usePageHeaderCompact, usePageHeaderSlotAvailable } from "../page-header
 import { FOOTER_ACTION_ROLE_PROP, NARROW_LABEL_PROP, STICKY_PRIMARY_ACTION_PROP, shouldRenderActionsIconOnly, usePrimitives, } from "../primitives.js";
 import { GridCellForField } from "./grid-cell-for-field.js";
 import { RelatedListSection } from "./related-list-section.js";
-import { filterEditSections, hasEditableSection, hasIssueWithoutRenderedField, resolveExtensionEntityId, shouldNotifyCaller, } from "./render-edit-logic.js";
+import { filterEditSections, findFirstErroringSectionIndex, hasEditableSection, hasIssueWithoutRenderedField, isDispatcherRejection, resolveExtensionEntityId, shouldNotifyCaller, } from "./render-edit-logic.js";
 import { WriteFormSection } from "./write-form-section.js";
 // Qualified names of the bundled `form-draft` feature. Hardcoded because the
 // renderer must not depend on @cosmicdrift/kumiko-bundled-features; a screen
@@ -95,21 +95,32 @@ function deriveFormFields(screen) {
     return out;
 }
 // Dry-run parse against `schema` — NOT controller.validate(), which writes
-// field errors into the snapshot. Issues are filtered exactly like the
-// controller's validate(): hidden fields never count, `scope` narrows.
-function dryRunFieldIssues(schema, snapshot, scope, includeRoot) {
+// field errors into the snapshot. Undefined when the values parse cleanly.
+// Parse once, then narrow per scope with scopedDryRunIssues: the wizard step
+// check would otherwise re-parse the whole form per section on every keystroke.
+function dryRunParse(schema, snapshot) {
     const parsed = schema.safeParse(snapshot.values);
     if (parsed.success)
-        return [];
+        return undefined;
     const hiddenFields = new Set(Object.entries(snapshot.fields)
         .filter(([, state]) => !state.visible)
         .map(([fieldKey]) => fieldKey));
-    return relevantFieldIssues(zodErrorToFieldIssues(parsed.error), {
-        hiddenFields,
+    return { issues: zodErrorToFieldIssues(parsed.error), hiddenFields };
+}
+// Issues are filtered exactly like the controller's validate(): hidden
+// fields never count, `scope` narrows.
+function scopedDryRunIssues(parse, scope, includeRoot) {
+    if (parse === undefined)
+        return [];
+    return relevantFieldIssues(parse.issues, {
+        hiddenFields: parse.hiddenFields,
         ...(scope !== undefined && { scope }),
         includeRoot,
     });
 }
+function dryRunFieldIssues(schema, snapshot, scope, includeRoot) {
+    return scopedDryRunIssues(dryRunParse(schema, snapshot), scope, includeRoot);
+}
 // Index-independent: indices shift when a fields section hides.
 function wizardStepKey(section, index) {
     const declaredId = section.kind === "fields" || section.kind === "extension" ? section.id : undefined;
@@ -130,11 +141,10 @@ function isEmptyFormValue(value) {
 // select/boolean are excluded from the "holds user data" check: they are
 // often pre-filled (defaults, server-set values), so they say nothing about
 // whether the step was filled in. They still count through the validation.
-function isFieldsStepFilled(section, schema, snapshot) {
+function isFieldsStepFilled(section, parse) {
     const fieldNames = section.fields.map((f) => f.field);
-    if (schema !== undefined && dryRunFieldIssues(schema, snapshot, fieldNames, false).length > 0) {
+    if (scopedDryRunIssues(parse, fieldNames, false).length > 0)
         return false;
-    }
     return section.fields.some((f) => f.visible &&
         !f.readOnly &&
         f.type !== "boolean" &&
@@ -296,8 +306,9 @@ export function RenderEdit(props) {
     // Both stepped layouts show one section at a time and keep the rest mounted
     // but inert. A tabs layout on a host without the Tabs primitive has no strip
     // to switch with, so it falls back to rendering every section stacked rather
-    // than stranding the user on section 0 (fw#3134).
-    const isStepped = isWizard || (isTabs && Tabs !== undefined);
+    // than stranding the user on section 0 (fw#3134). Same fallback when the
+    // WizardStepGroup wrapper is missing.
+    const isStepped = isWizard || (isTabs && Tabs !== undefined && WizardStepGroup !== undefined);
     const fields = useMemo(() => deriveFormFields(screen), [screen]);
     // Must be computed before submitConfig/useForm bakes it in (the controller
     // freezes it on first render). This is the unfiltered field-name set from
@@ -671,12 +682,14 @@ export function RenderEdit(props) {
     const wizardDoneSteps = useMemo(() => {
         if (!isWizard || isCreateMode)
             return undefined;
-        const snapshotForDryRun = { values: snapshot.values, fields: snapshot.fields };
+        const parse = schema === undefined
+            ? undefined
+            : dryRunParse(schema, { values: snapshot.values, fields: snapshot.fields });
         return filteredSections.map((section, index) => {
             if (passedStepKeys.has(wizardStepKey(section, index)))
                 return true;
             if (section.kind === "fields")
-                return isFieldsStepFilled(section, schema, snapshotForDryRun);
+                return isFieldsStepFilled(section, parse);
             return (section.kind === "extension" &&
                 extensionStepComplete[wizardStepKey(section, index)] === true);
         });
@@ -856,9 +869,7 @@ export function RenderEdit(props) {
     // jump targets by design: they validate through the controlled-mode
     // controls.validate() API and own no field specs to match against.
     function findFirstErroringStep(fieldPaths) {
-        const erroredFields = new Set(fieldPaths.map((p) => p.split(".")[0]));
-        const idx = filteredSections.findIndex((s) => s.kind === "fields" && s.fields.some((f) => erroredFields.has(f.field)));
-        return idx === -1 ? undefined : idx;
+        return findFirstErroringSectionIndex(filteredSections, fieldPaths);
     }
     async function handleSubmit(options) {
         // Enter in the active step triggers the native form submit (Next is
@@ -967,6 +978,11 @@ export function RenderEdit(props) {
             else {
                 const fieldIssues = result.error.details?.fields ?? [];
                 const issuePaths = fieldIssues.map((i) => i.path);
+                // controller.submit() writes server issues into the controller itself;
+                // customSubmit bypasses it, so push them here to reach the fields.
+                if (customSubmit !== undefined && fieldIssues.length > 0) {
+                    controller.setErrors(groupIssuesByPath(fieldIssues));
+                }
                 // A server field error on a step the form isn't currently showing is
                 // otherwise invisible — jump to the first step that contains one of
                 // the errored fields. For tabs this is what keeps the submit from
@@ -1216,6 +1232,7 @@ export function RenderEdit(props) {
                             ], children: _jsx(Text, { children: translate(draftCandidates.length === 1
                                     ? "kumiko.form.draft.resume-single"
                                     : "kumiko.form.draft.resume-multiple") }) })), isWizard && !stepRail && (_jsxs(_Fragment, { children: [Progress !== undefined && (_jsx(Progress, { value: (currentStep + 1) / (lastStepIndex + 1), testId: "render-edit-wizard-progress" })), StepBar === undefined ? (_jsx(Text, { variant: "small", testId: "render-edit-wizard-step-label", children: compactStepLabel })) : (_jsx(StepBar, { steps: filteredSections.map((section) => section.title ?? ""), currentIndex: currentStep, compactLabel: compactStepLabel, onStepSelect: handleWizardStepSelect, ...updateModeStepBarProps, testId: "render-edit-wizard-steps", compactTestId: "render-edit-wizard-step-label" }))] })), isTabs &&
+                            isStepped &&
                             (() => {
                                 // No Tabs primitive registered → every section renders stacked
                                 // (stepHidden below is gated on the same condition), which is the
@@ -1380,7 +1397,7 @@ export function RenderEdit(props) {
                                 const rejection = await onDelete();
                                 // A rejected delete (e.g. a preDelete hook) carries its reason in
                                 // the field issues; the top-level key is only "validation failed".
-                                if (rejection !== undefined) {
+                                if (isDispatcherRejection(rejection)) {
                                     const [issue, ...otherIssues] = rejection.details?.fields ?? [];
                                     setExtraDeleteIssues(otherIssues);
                                     setFormError(issue === undefined

package/dist/components/render-field.js

@@ -446,11 +446,14 @@ function numberValue(v) {
 // stored-config coercion) is MAJOR units too — every producer in this repo
 // hands rehydrateMoney's `{amount,…}` shape or a raw major-unit number, never
 // pre-scaled minor units.
+// A stored row can carry a legacy/imported currency that is not an ISO-4217
+// shape; Intl.NumberFormat throws a RangeError on it and would crash the screen.
+const ISO_CURRENCY_CODE = /^[A-Z]{3}$/;
 function resolveMoneyCurrency(value, fieldCurrency) {
-    if (typeof value === "object" &&
-        value !== null &&
-        typeof value.currency === "string") {
-        return value.currency;
+    if (typeof value === "object" && value !== null && "currency" in value) {
+        const { currency } = value;
+        if (typeof currency === "string" && ISO_CURRENCY_CODE.test(currency))
+            return currency;
     }
     return fieldCurrency ?? "EUR";
 }

package/dist/components/render-list.js

@@ -1,6 +1,6 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { computeListViewModel } from "@cosmicdrift/kumiko-headless";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { extensionSectionName, useExtensionSectionComponent } from "../app/extension-sections.js";
 import { useReferenceLookup } from "../hooks/use-reference-lookup.js";
 import { useTranslation } from "../i18n.js";
@@ -30,16 +30,25 @@ export function RenderList(props) {
     // mount and can flush after a keystroke landing in the same commit,
     // resetting localQ and swallowing the input.
     const [syncedSearchValue, setSyncedSearchValue] = useState(searchValue);
+    // The parent may echo our own debounced emit back late (router/URL round
+    // trip); adopting that stale echo would erase keys typed in between.
+    const lastEmittedRef = useRef(undefined);
     if (searchValue !== syncedSearchValue) {
         setSyncedSearchValue(searchValue);
-        setLocalQ(searchValue ?? "");
+        if (searchValue !== lastEmittedRef.current) {
+            setLocalQ(searchValue ?? "");
+            lastEmittedRef.current = undefined;
+        }
     }
     useEffect(() => {
         if (onSearchChange === undefined)
             return;
         if (localQ === (searchValue ?? ""))
             return;
-        const timer = setTimeout(() => onSearchChange(localQ), SEARCH_DEBOUNCE_MS);
+        const timer = setTimeout(() => {
+            lastEmittedRef.current = localQ;
+            onSearchChange(localQ);
+        }, SEARCH_DEBOUNCE_MS);
         return () => clearTimeout(timer);
     }, [localQ, searchValue, onSearchChange]);
     const vm = useMemo(() => computeListViewModel({ screen, entity, rows, translate, featureName }), [screen, entity, rows, translate, featureName]);

package/dist/components/write-form-section.js

@@ -100,8 +100,7 @@ export function WriteFormSection({ section, featureName, translate, hideTitle, o
                 headerActions: titleRowActions,
             }, testId: `write-form-${section.title ?? section.handler}`, children: content }));
     }
-    // Routed through Section's `actions` slot (same mechanism render-edit.tsx
-    // uses via Form's `actions`) so the button gets the established right-
-    // aligned footer treatment instead of stretching full-width inline.
+    // Submit plus caller actions share the title row's actions slot (submit is
+    // lifted into the footer instead when onFooterAction is set).
     return (_jsx(Section, { ...(section.title !== undefined && { title: section.title }), ...(section.description !== undefined && { subtitle: section.description }), ...(section.icon !== undefined && { icon: section.icon }), actions: titleRowActions, testId: `write-form-${section.title ?? section.handler}`, children: content }));
 }

package/dist/primitives.d.ts

@@ -250,13 +250,14 @@ export type InputProps = {
     /** Closed FieldIconKey vocabulary (FIELD_ICONS registry, renderer-web). */
     readonly icon?: FieldIconKey;
     /** `<input step>`. "any" disables the native stepMismatch constraint
-     *  (needed for decimal fields — integer fields leave this unset). */
+     *  (needed for decimal fields — integer fields leave this unset).
+     *  Ignored by the web renderer, whose number input is a text field. */
     readonly step?: number | "any";
     /** BCP-47 tag for the grouped display and the decimal separator when typing. */
     readonly locale?: string;
     /** `false` shows the value without a thousands separator (e.g. a year). */
     readonly grouping?: boolean;
-    /** Integer-only entry (bigInt): fractional input is rejected on blur. */
+    /** Integer-only entry (bigInt): fractional drafts are not emitted via `onChange`. */
     readonly integer?: boolean;
     /** Resolved display suffix (static or from a sibling field) — never
      *  part of the numeric value. */
@@ -584,10 +585,12 @@ export type DataTableDateRangeFacet = {
     readonly to: string;
 };
 /** Splits rows into collapsible groups (order of first appearance). A
- *  renderer without grouping support shows the flat list. */
+ *  renderer without grouping support shows the flat list. A group whose
+ *  `headerLabel` is undefined shows its rows without a header and never
+ *  collapses. */
 export type DataTableRowGrouping = {
     readonly keyOf: (row: ListRowViewModel) => string;
-    readonly headerLabel: (groupKey: string, rows: readonly ListRowViewModel[]) => string;
+    readonly headerLabel: (groupKey: string, rows: readonly ListRowViewModel[]) => string | undefined;
     readonly startsCollapsed: (groupKey: string) => boolean;
 };
 export type DataTableProps = {
@@ -713,8 +716,8 @@ export type DataTableProps = {
     /** Uses the shared screen padding (wider bottom inset) instead of the
      *  table's symmetric embedded inset — for a table that IS the screen body
      *  (entityList/projectionList), so a list screen ends at the same footer
-     *  distance as a form or custom screen (fw#2640). Hosts set this or
-     *  `scrollBody`, not both: the wider bottom inset competes with
+     *  distance as a form or custom screen (fw#2640). Ignored when
+     *  `scrollBody` is true: the wider bottom inset would compete with
      *  `scrollBody`'s flex-fill height budget.
      *  Default false: unchanged symmetric inset for an embedded table. */
     readonly screenPadding?: boolean;

package/dist/sse/live-events.d.ts

@@ -2,10 +2,12 @@ import { type ReactNode } from "react";
 export type LiveEvent = {
     readonly type: string;
     readonly data: {
-        readonly id: string;
+        /** Absent on anonymous connections: the signal would reveal hidden rows. */
+        readonly id?: string;
         readonly aggregateType: string;
         readonly eventType: string;
-        readonly version: number;
+        /** Absent on anonymous connections, like `id`. */
+        readonly version?: number;
         readonly createdAt: string;
     };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-renderer",
-  "version": "0.336.0",
+  "version": "0.337.1",
   "description": "Platform-agnostic React renderer for Kumiko screens. Contains the shared logic — primitives-contract, hooks, KumikoScreen, navigation & SSE abstractions — that any platform-specific renderer (web, native) composes. No DOM, no EventSource, no react-dom.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -15,9 +15,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.336.0",
-    "@cosmicdrift/kumiko-headless": "0.336.0",
-    "@cosmicdrift/kumiko-types": "0.336.0",
+    "@cosmicdrift/kumiko-framework": "0.337.1",
+    "@cosmicdrift/kumiko-headless": "0.337.1",
+    "@cosmicdrift/kumiko-types": "0.337.1",
     "react": "^19.2.6",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
@@ -28,7 +28,7 @@
     "@types/react-dom": "^19.2.3",
     "jsdom": "^29.1.1",
     "react-dom": "^19.2.6",
-    "@cosmicdrift/kumiko-locale-de": "0.336.0"
+    "@cosmicdrift/kumiko-locale-de": "0.337.1"
   },
   "repository": {
     "type": "git",

package/src/changes.json

@@ -1,4 +1,42 @@
 [
+  {
+    "version": "0.337.1",
+    "type": "improvement",
+    "title": "Secrets screen hides keys the user cannot write",
+    "detail": "The generated secrets screen now hides fixed secret keys the current user may not write according to the key's `writeRoles`, and drops sections left without visible keys. The generator emits a per-field `fieldAccess` map on the screen for this. It only affects what the UI shows; the server-side write check is unchanged and still decides."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "configEdit shows server validation errors at the affected field",
+    "detail": "`config:write:set` reports its issues at path `value`. The configEdit submit maps the issues of the failed batch command (`failedIndex`) to that command's field, and RenderEdit puts server field issues from a `customSubmit` into the form controller, the same way `controller.submit()` does. The banner stays for issues no rendered field can show and for network failures.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.337.0",
+    "type": "breaking",
+    "title": "DataTableRowGrouping.headerLabel may return undefined",
+    "detail": "`DataTableRowGrouping.headerLabel` returns `string | undefined`. `undefined` means the group has no header: the default web DataTable renders its rows without a header row and never collapses them.",
+    "migration": "Custom DataTable primitives that render `rowGrouping` handle `undefined` from `headerLabel` by rendering the group's rows without a header."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Tabs fallback, error-tab jump, list search echo and money currency no longer misbehave",
+    "detail": "A tabs layout on a host with `Tabs` but no `WizardStepGroup` now falls back to a stacked form instead of throwing. After a server validation error the form jumps to the first tab that actually shows the errored field, skipping tabs where it is hidden. A delete handler that returns a non-error value no longer shows an empty error banner. The list search box keeps keystrokes typed while the parent echoes the previous search value late. A money value whose stored currency is not a three-letter code falls back to the field currency instead of crashing the screen. Embedded-list reference columns remount instead of breaking hook order when the column set changes. The wizard step check parses the form once per change instead of once per step."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Header subtitle without MetricBand and navigateToReturn state no longer misbehave",
+    "detail": "A projectionDetail header subtitle stays visible on a host with `PageHeader` but no `MetricBand`. `navigateToReturn` applies the restored host state only when the return target is the host the `returnTo` value names, so a caller-supplied target no longer inherits a foreign host's tab, filters and nested `returnTo`. The `screenPadding` and `scrollBody` docs now state that `scrollBody` wins, and the number input docs match the web behavior."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Screen actions and URL prefill no longer leave stale, doubled or invalid state",
+    "detail": "An entityEdit delete action with a `redirect` now still reports the deletion to its host, and a delete with no entity list screen reloads the record instead of leaving the form on the deleted record. Overflow-menu actions are disabled while one is running, so a second click can no longer fire the write twice. URL prefill ignores an empty money param, non-finite number params, embedded-list cells with too many decimals or invalid dates, and a dateRange filter with `from` after `to` is put in order before it reaches the handler."
+  },
   {
     "version": "0.336.0",
     "type": "breaking",