@cosmicdrift/kumiko-renderer 0.362.0 → 0.364.0

package/dist/app/content-preview.js

@@ -24,5 +24,8 @@ export function ContentPreview({ content, variables, contentFormat, }) {
     const safeVariables = contentFormat === "rich"
         ? Object.fromEntries(Object.entries(variables).map(([name, value]) => [name, escapeHtmlAttr(value)]))
         : variables;
-    return (_jsx(Editor, { id: id, value: substituteVariables(content, safeVariables), onChange: noop, variables: [], readOnly: true }));
+    // "document" keeps `{{x}}` as-is: substituting it into a button/link href would make the
+    // schema drop that node; variable chips stay visible.
+    const value = contentFormat === "document" ? content : substituteVariables(content, safeVariables);
+    return _jsx(Editor, { id: id, value: value, onChange: noop, variables: [], readOnly: true });
 }

package/dist/app/kumiko-screen.d.ts

@@ -1,5 +1,5 @@
 import type { ScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
-import type { ListRowViewModel, Translate } from "@cosmicdrift/kumiko-headless";
+import type { FormValues, ListRowViewModel, Translate } from "@cosmicdrift/kumiko-headless";
 import { type ReactNode } from "react";
 import { type ListSort } from "../hooks/use-list-url-state.js";
 import type { FeatureSchema } from "./feature-schema.js";
@@ -19,7 +19,7 @@ export { qualifyScreenId };
 export declare function qualifyNavId(featureName: string, navId: string): string;
 export { screenAccessAllows };
 export declare function KumikoScreen({ schema, qn, translate, entityId, onRowClick, onCopyLink, }: KumikoScreenProps): ReactNode;
-export declare function buildInitialValues(fields: Readonly<Record<string, unknown>>, defaultCurrency?: string, moneyCurrencyOverrides?: Readonly<Record<string, string>>): Readonly<Record<string, unknown>>;
+export declare function buildInitialValues(fields: Readonly<Record<string, unknown>>, defaultCurrency?: string, moneyCurrencyOverrides?: Readonly<Record<string, string>>): FormValues;
 export declare function tenantCurrencyMoneyFieldNames(fields: Readonly<Record<string, unknown>>): readonly string[];
 export declare function literalCurrencyOverrides(fields: Readonly<Record<string, unknown>>): Readonly<Record<string, string>>;
 export declare function useMoneyCurrencyOverrides(fields: Readonly<Record<string, unknown>>, tenantFieldNames: readonly string[], fallback: string | undefined): {

package/dist/app/kumiko-screen.js

@@ -4,6 +4,7 @@ import { applyFormatSpec, buildOptionLabels, computeRelatedListSectionViewModel,
 import { resolveActionIcon } from "@cosmicdrift/kumiko-types/action-icon";
 import { TENANT_CURRENCY_CONFIG_KEY } from "@cosmicdrift/kumiko-types/fields";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { Fragment, useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { QueryOptionLabel, resolveOptionsQueryPayload, } from "../components/query-options-select.js";
 import { extractCreatedId, extractIdField } from "../components/reference-create-dialog.js";
@@ -50,7 +51,7 @@ import { findEditScreenFor, navigateTargetAllows, screenAccessAllows } from "./s
 import { SecretMintBody } from "./secret-mint-body.js";
 import { SecretsEditBody } from "./secrets-edit-body.js";
 import { useEmbeddedScreen } from "./use-embedded-screen.js";
-import { evalVisibleWhen } from "./visible-when.js";
+import { evalVisibleWhenAfterShown } from "./visible-when.js";
 import { dispatcherErrorText, WriteFailedError } from "./write-failed-error.js";
 export { qualifyScreenId };
 /** Mirrors qualifyScreenId for nav QNs (registry form `<feature>:nav:<short-id>`).
@@ -95,9 +96,13 @@ export function KumikoScreen({ schema, qn, translate, entityId, onRowClick, onCo
 function ScreenVisibilityGate({ featureName, visibleWhen, fallback, translate, children, }) {
     const { Banner, PageHeader } = usePrimitives();
     const pageHeaderSlotAvailable = usePageHeaderSlotAvailable();
-    const t = useTranslation();
     const result = useQuery(visibleWhen.query, {}, { live: true });
-    const verdict = evalVisibleWhen(visibleWhen, result);
+    const wasShown = useRef(false);
+    const verdict = evalVisibleWhenAfterShown(visibleWhen, result, wasShown.current);
+    useEffect(() => {
+        if (verdict === "visible")
+            wasShown.current = true;
+    }, [verdict]);
     if (verdict === "visible")
         return children;
     if (verdict === "loading") {
@@ -105,14 +110,19 @@ function ScreenVisibilityGate({ featureName, visibleWhen, fallback, translate, c
     }
     // The route still names the locked screen; its breadcrumb must not label what stands in for it.
     const hideLockedBreadcrumb = PageHeader !== undefined && pageHeaderSlotAvailable ? _jsx(PageHeader, { hideBreadcrumb: true }) : null;
-    return (_jsxs(_Fragment, { children: [hideLockedBreadcrumb, fallback !== undefined ? (_jsx(FallbackScreen, { featureName: featureName, fallback: fallback, translate: translate })) : (_jsx(Banner, { padded: true, variant: "info", testId: "kumiko-screen-unavailable", children: t("kumiko.screen.unavailable") }))] }));
+    return (_jsxs(_Fragment, { children: [hideLockedBreadcrumb, fallback !== undefined ? (_jsx(FallbackScreen, { featureName: featureName, fallback: fallback, translate: translate })) : (_jsx(ScreenUnavailableBanner, {}))] }));
+}
+function ScreenUnavailableBanner() {
+    const { Banner } = usePrimitives();
+    const t = useTranslation();
+    return (_jsx(Banner, { padded: true, variant: "info", testId: "kumiko-screen-unavailable", children: t("kumiko.screen.unavailable") }));
 }
 function FallbackScreen({ featureName, fallback, translate, }) {
     const target = useEmbeddedScreen(featureName, fallback);
-    const { Banner, Text } = usePrimitives();
-    if (target === undefined) {
-        return (_jsxs(Banner, { padded: true, variant: "error", testId: "kumiko-screen-not-found", children: ["Screen not found: ", _jsx(Text, { variant: "code", children: fallback })] }));
-    }
+    // Also undefined when the user lacks access to the fallback screen, which is
+    // not a framework error.
+    if (target === undefined)
+        return _jsx(ScreenUnavailableBanner, {});
     return _jsx(KumikoScreen, { schema: target.schema, qn: target.qn, translate: translate });
 }
 function renderScreenBody({ schema, screen, translate, entityId, onRowClick, onCopyLink, }) {
@@ -246,24 +256,29 @@ function useNavigateToCreateFor(schema, entityName, createScreen, createUnavaila
 // — used for a `money` field that declares `currency: { kind: "tenant" }`, so
 // its empty initial value carries the tenant's own currency instead of the
 // entity-wide default.
+function versionOf(record) {
+    const version = record["version"];
+    return typeof version === "number" ? version : 1;
+}
 export function buildInitialValues(fields, defaultCurrency, moneyCurrencyOverrides) {
     const out = {};
     for (const [name, def] of Object.entries(fields)) {
-        const shape = def;
-        if (shape.default !== undefined) {
-            out[name] = shape.default;
+        const type = propertyOf(def, "type");
+        const defaultValue = propertyOf(def, "default");
+        if (defaultValue !== undefined) {
+            out[name] = defaultValue;
             continue;
         }
         // An untouched optional number must not persist as a deliberate 0.
-        if (shape.type === "number" && shape.required !== true) {
+        if (type === "number" && propertyOf(def, "required") !== true) {
             out[name] = undefined;
             continue;
         }
-        if (shape.type === "embedded" && shape.multiple === true) {
+        if (type === "embedded" && propertyOf(def, "multiple") === true) {
             out[name] = [];
             continue;
         }
-        if (shape.type === "money") {
+        if (type === "money") {
             const currency = moneyCurrencyOverrides?.[name] ?? defaultCurrency;
             if (currency !== undefined) {
                 out[name] = { amount: 0, currency };
@@ -271,11 +286,11 @@ export function buildInitialValues(fields, defaultCurrency, moneyCurrencyOverrid
             }
         }
         out[name] =
-            shape.type === "boolean"
+            type === "boolean"
                 ? false
-                : shape.type === "number" || shape.type === "money"
+                : type === "number" || type === "money"
                     ? 0
-                    : shape.type === "multiSelect"
+                    : type === "multiSelect"
                         ? []
                         : "";
     }
@@ -290,9 +305,10 @@ export function buildInitialValues(fields, defaultCurrency, moneyCurrencyOverrid
 export function tenantCurrencyMoneyFieldNames(fields) {
     const names = [];
     for (const [name, def] of Object.entries(fields)) {
-        const shape = def;
-        if (shape.type === "money" && shape.currency?.kind === "tenant")
+        if (propertyOf(def, "type") === "money" &&
+            propertyOf(propertyOf(def, "currency"), "kind") === "tenant") {
             names.push(name);
+        }
     }
     return names;
 }
@@ -327,9 +343,11 @@ const UPDATE_CHANGES_KEY = "changes";
 export function literalCurrencyOverrides(fields) {
     const out = {};
     for (const [name, def] of Object.entries(fields)) {
-        const shape = def;
-        const code = shape.currency?.code;
-        if (shape.type === "money" && shape.currency?.kind === "literal" && code !== undefined) {
+        const currency = propertyOf(def, "currency");
+        const code = propertyOf(currency, "code");
+        if (propertyOf(def, "type") === "money" &&
+            propertyOf(currency, "kind") === "literal" &&
+            typeof code === "string") {
             out[name] = code;
         }
     }
@@ -375,7 +393,8 @@ const CURRENCY_CODE_PATTERN = /^[A-Za-z]{3}$/;
 function isMoneyValue(value) {
     if (typeof value !== "object" || value === null)
         return false;
-    const { amount, currency } = value;
+    const amount = propertyOf(value, "amount");
+    const currency = propertyOf(value, "currency");
     return (typeof amount === "number" &&
         Number.isFinite(amount) &&
         typeof currency === "string" &&
@@ -470,7 +489,11 @@ function isRepresentableAtScale(value, scale) {
     const tolerance = Math.abs(scaled) * 8 * Number.EPSILON + Number.EPSILON;
     return Math.abs(scaled - Math.round(scaled)) <= tolerance;
 }
-function isIsoInstant(value) {
+// Server schema (`z.iso.datetime()`) accepts only a `Z` suffix, while
+// Temporal.Instant.from also takes numeric offsets.
+function isUtcIsoInstant(value) {
+    if (!value.endsWith("Z"))
+        return false;
     try {
         Temporal.Instant.from(value);
         return true;
@@ -480,6 +503,21 @@ function isIsoInstant(value) {
     }
 }
 const EMBEDDED_LIST_PREFILL_ROW_LIMIT = 500;
+// The server schema (`z.string().date()`) rejects calendar-invalid days like 2020-02-31.
+function isValidIsoDate(value) {
+    if (!ISO_DATE_PATTERN.test(value))
+        return false;
+    try {
+        Temporal.PlainDate.from(value, { overflow: "reject" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isDecimalWithinSafeRange(value, scale) {
+    return scale === undefined || Math.abs(value) <= Number.MAX_SAFE_INTEGER / 10 ** scale;
+}
 function coerceEmbeddedCell(value, cell) {
     switch (cell.type) {
         case "number":
@@ -487,13 +525,15 @@ function coerceEmbeddedCell(value, cell) {
         case "decimal":
             return typeof value === "number" &&
                 Number.isFinite(value) &&
-                (cell.scale === undefined || isRepresentableAtScale(value, cell.scale))
+                (cell.scale === undefined ||
+                    (isRepresentableAtScale(value, cell.scale) &&
+                        isDecimalWithinSafeRange(value, cell.scale)))
                 ? value
                 : undefined;
         case "date":
-            return typeof value === "string" && ISO_DATE_PATTERN.test(value) ? value : undefined;
+            return typeof value === "string" && isValidIsoDate(value) ? value : undefined;
         case "timestamp":
-            return typeof value === "string" && isIsoInstant(value) ? value : undefined;
+            return typeof value === "string" && isUtcIsoInstant(value) ? value : undefined;
         case "money":
             // Row cells are signed minor units; the currency lives on the head, so a
             // top-level `{amount, currency}` in major units would land 100x off.
@@ -526,7 +566,7 @@ function coerceEmbeddedListRows(raw, fieldName, schema, maxItems) {
         }
         const cellEntries = [];
         for (const [cellName, cell] of Object.entries(schema)) {
-            const cellValue = candidate[cellName];
+            const cellValue = propertyOf(candidate, cellName);
             if (cellValue === undefined || cellValue === null)
                 continue;
             const coerced = coerceEmbeddedCell(cellValue, cell);
@@ -542,6 +582,8 @@ function coerceEmbeddedListRows(raw, fieldName, schema, maxItems) {
 }
 function coercePrefillString(raw, name, shape, fallback, defaultCurrency, moneyCurrencyOverrides) {
     if (shape.type === "number") {
+        if (raw.trim() === "")
+            return fallback;
         const parsed = Number(raw);
         return Number.isFinite(parsed) ? parsed : fallback;
     }
@@ -762,7 +804,7 @@ function EntityEditUpdateBody({ schema, screen, entity, entityId, translate, onC
     // der ursprünglichen version sitzen — der buildPayload würde
     // weiter die stale version stampen und der Konflikt-Recovery wäre
     // kaputt.
-    const recordKey = record.version ?? 1;
+    const recordKey = versionOf(record);
     return (_jsx(EntityEditUpdateForm, { schema: schema, screen: screen, entity: entity, entityId: entityId, record: record, onReload: detailQuery.refetch, ...(translate !== undefined && { translate }), ...(onCopyLink !== undefined && { onCopyLink }), ...(autoReloadOnSave === true && { onSaved: () => void detailQuery.refetch() }), ...(onDeleted !== undefined && { onDeleted }) }, `${entityId}:${recordKey}`));
 }
 function EntityEditUpdateForm({ schema, screen, entity, entityId, record, onReload, translate, onCopyLink, onSaved, onDeleted, }) {
@@ -773,7 +815,7 @@ function EntityEditUpdateForm({ schema, screen, entity, entityId, record, onRelo
     // captured once and stamped into every update payload — if a
     // concurrent writer bumps it, the server returns a version-conflict
     // error and the user reloads.
-    const recordVersion = record.version ?? 1;
+    const recordVersion = versionOf(record);
     const entityDefaultCurrency = entity.defaultCurrency ?? "EUR";
     // A money field declaring `currency: { kind: "tenant" }` (fw#2933) resolves
     // its empty-value currency from the tenant-settings config key instead of
@@ -800,9 +842,7 @@ function EntityEditUpdateForm({ schema, screen, entity, entityId, record, onRelo
     // damit sie beim Edit den Bestand zeigen statt write-only zu sein.
     const extensionInitialValues = useMemo(() => {
         const cf = record["customFields"];
-        return cf !== null && typeof cf === "object" && !Array.isArray(cf)
-            ? cf
-            : undefined;
+        return isPlainObject(cf) ? cf : undefined;
     }, [record]);
     const writeCommand = entityWriteCommand(schema.featureName, screen.entity, "update");
     const deleteCommand = entityWriteCommand(schema.featureName, screen.entity, "delete");
@@ -1217,8 +1257,8 @@ function EntityListBody({ schema, screen, entity, translate, onRowClick, }) {
     const filterPayload = useMemo(() => buildFilterPayload(urlState.filters, (field) => {
         // entity.fields ist am Renderer-Layer schwach getypt (vom Schema
         // deserialisiert) — Boundary-Cast wie buildInitialValues.
-        const def = entity.fields[field];
-        return def?.type;
+        const type = propertyOf(entity.fields[field], "type");
+        return typeof type === "string" ? type : undefined;
     }), [urlState.filters, entity.fields]);
     // Entity-only additions (screen.filter, faceted filters) layer on top of
     // the shared buildListQueryPayload — projectionList has neither.
@@ -2190,8 +2230,12 @@ function ProjectionDetailBody({ schema, screen, translate, entityId, }) {
             (screen.detailFor !== undefined
                 ? findEntityListScreen(schema, screen.detailFor)?.id
                 : undefined);
-        return (_jsx(RecordNotFoundState, { translate: effectiveTranslate, ...(backListScreen !== undefined && {
-                onBack: () => nav.navigate({ screenId: lastSegment(backListScreen) }),
+        return (_jsx(RecordNotFoundState, { translate: effectiveTranslate, ...((returnTarget !== undefined || backListScreen !== undefined) && {
+                onBack: () => navigateToReturnOr(nav, returnTarget, () => {
+                    if (backListScreen !== undefined) {
+                        nav.navigate({ screenId: lastSegment(backListScreen) });
+                    }
+                }),
             }) }));
     }
     // Grouped into the head Card alongside title/status/metrics (fw#2713):
@@ -2379,7 +2423,7 @@ function navigateAfterRedirect(options) {
 function overlayUpdatedProjection(record, resultData) {
     if (typeof resultData !== "object" || resultData === null)
         return record;
-    const projection = resultData.data;
+    const projection = propertyOf(resultData, "data");
     if (typeof projection !== "object" || projection === null)
         return record;
     return { ...record, ...projection };
@@ -2628,7 +2672,7 @@ function ConfigEditBody({ schema, screen, translate, }) {
                 out[shortName] = defaults[shortName];
                 continue;
             }
-            const ftype = fieldDef.type;
+            const ftype = propertyOf(fieldDef, "type");
             // Field-Type-Coercion: config-Werte sind string|number|boolean,
             // aber der Form-State erwartet das passende Field-Native-Type.
             if (ftype === "number" || ftype === "money") {

package/dist/app/secret-mint-body.js

@@ -1,4 +1,5 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { useCallback, useMemo, useRef, useState } from "react";
 import { RenderEdit } from "../components/render-edit.js";
 import { useTranslation } from "../i18n.js";
@@ -14,7 +15,7 @@ function extractRevealValue(data, field) {
         return undefined;
     if (!Object.hasOwn(data, field))
         return undefined;
-    return data[field];
+    return propertyOf(data, field);
 }
 function extractCarriedValues(data, carry) {
     const carried = {};

package/dist/app/visible-when.d.ts

@@ -2,3 +2,4 @@ import type { DashboardPanelVisibility } from "@cosmicdrift/kumiko-framework/ui-
 import type { UseQueryResult } from "../hooks/use-query.js";
 export type VisibleWhenVerdict = "loading" | "visible" | "hidden" | "error";
 export declare function evalVisibleWhen(visibleWhen: DashboardPanelVisibility, result: UseQueryResult<Readonly<Record<string, unknown>>> | undefined): VisibleWhenVerdict;
+export declare function evalVisibleWhenAfterShown(visibleWhen: DashboardPanelVisibility, result: UseQueryResult<Readonly<Record<string, unknown>>> | undefined, wasShown: boolean): VisibleWhenVerdict;

package/dist/app/visible-when.js

@@ -9,3 +9,10 @@ export function evalVisibleWhen(visibleWhen, result) {
         return result.loading ? "loading" : "hidden";
     return result.data[visibleWhen.field] === visibleWhen.eq ? "visible" : "hidden";
 }
+// Once the content was shown, a failed refetch must not unmount it (and drop unsaved
+// form input) while the last good data still matches; the first evaluation stays fail-closed.
+export function evalVisibleWhenAfterShown(visibleWhen, result, wasShown) {
+    const verdict = evalVisibleWhen(visibleWhen, result);
+    const lastGoodDataMatches = result?.data?.[visibleWhen.field] === visibleWhen.eq;
+    return verdict === "error" && wasShown && lastGoodDataMatches ? "visible" : verdict;
+}

package/dist/components/availability-options-select.d.ts

@@ -1,6 +1,6 @@
 import type { EditFieldViewModel } from "@cosmicdrift/kumiko-headless";
 import type { OptionsQueryPayload } from "@cosmicdrift/kumiko-types/fields";
-import type { ReactNode } from "react";
+import { type ReactNode } from "react";
 export type SelectOptionEntry = {
     readonly value: string;
     readonly label: string;
@@ -9,14 +9,14 @@ export type SelectOptionEntry = {
 };
 export declare function staticSelectOptions(field: EditFieldViewModel): readonly SelectOptionEntry[];
 export declare function mergeOptionAvailability(options: readonly SelectOptionEntry[], rows: readonly unknown[], current: string): readonly SelectOptionEntry[];
-export declare function filterUnavailableOptions(options: readonly SelectOptionEntry[], rows: readonly unknown[], currentValues: readonly string[]): readonly SelectOptionEntry[];
+export declare function filterUnavailableOptions(options: readonly SelectOptionEntry[], rows: readonly unknown[], heldValues: ReadonlySet<string>): readonly SelectOptionEntry[];
 type AvailabilityOptionsMultiSelectProps = {
     readonly field: EditFieldViewModel;
     readonly query: string;
-    readonly currentValues: readonly string[];
+    readonly initialValues: readonly string[];
     readonly children: (options: readonly SelectOptionEntry[]) => ReactNode;
 };
-export declare function AvailabilityOptionsMultiSelect({ field, query, currentValues, children, }: AvailabilityOptionsMultiSelectProps): ReactNode;
+export declare function AvailabilityOptionsMultiSelect({ field, query, initialValues, children, }: AvailabilityOptionsMultiSelectProps): ReactNode;
 type AvailabilityOptionsSelectProps = {
     readonly field: EditFieldViewModel;
     readonly query: string;

package/dist/components/availability-options-select.js

@@ -1,4 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+import { useRef } from "react";
 import { useQuery } from "../hooks/use-query.js";
 import { usePrimitives } from "../primitives.js";
 import { resolveOptionsQueryPayload } from "./query-options-select.js";
@@ -36,21 +37,27 @@ export function mergeOptionAvailability(options, rows, current) {
         };
     });
 }
-// Combobox primitives cannot disable a single option, so unavailable ones are
-// dropped; an already selected value stays listed so it can still be removed.
-export function filterUnavailableOptions(options, rows, currentValues) {
+// Unavailable options are dropped unless the target already held them when the
+// form mounted; those stay listed but disabled, because the write path keeps
+// values the caller cannot grant and an unchecked one could never be re-checked.
+export function filterUnavailableOptions(options, rows, heldValues) {
     const unavailable = new Set();
     for (const row of rows) {
         if (isAvailabilityRow(row) && row.disabled === true)
             unavailable.add(row.value);
     }
-    return options.filter((option) => !unavailable.has(option.value) || currentValues.includes(option.value));
+    return options.flatMap((option) => {
+        if (!unavailable.has(option.value))
+            return [option];
+        return heldValues.has(option.value) ? [{ ...option, disabled: true }] : [];
+    });
 }
 // Until the result arrives, and when the query fails, every static option is
 // shown; the write path enforces the rule either way.
-export function AvailabilityOptionsMultiSelect({ field, query, currentValues, children, }) {
+export function AvailabilityOptionsMultiSelect({ field, query, initialValues, children, }) {
     const { data } = useQuery(query, {});
-    return children(filterUnavailableOptions(staticSelectOptions(field), data?.rows ?? [], currentValues));
+    const heldAtMount = useRef(new Set(initialValues));
+    return children(filterUnavailableOptions(staticSelectOptions(field), data?.rows ?? [], heldAtMount.current));
 }
 // Select with static options whose availability (SelectFieldDef.optionsAvailabilityQuery)
 // comes from a query, so it has to be a mounted component for useQuery. Until the

package/dist/components/multi-select-checkboxes.d.ts

@@ -3,6 +3,7 @@ import type { ReactNode } from "react";
 export type MultiSelectCheckboxOption = {
     readonly value: string;
     readonly label: string;
+    readonly disabled?: boolean;
 };
 export type MultiSelectCheckboxesProps = {
     readonly field: EditFieldViewModel;

package/dist/components/multi-select-checkboxes.js

@@ -14,8 +14,11 @@ export function MultiSelectCheckboxes({ field, id, options, value, onChange, })
     const allSelected = options.length > 0 && options.every((opt) => selected.has(opt.value));
     // Always emits in `field.options` order (MultiSelectFieldDef's documented
     // ordering guarantee), never in click/selection order.
+    // Disabled options are pinned: they keep their current state whatever is toggled.
     const emitOrdered = (next) => {
-        onChange(options.filter((opt) => next.has(opt.value)).map((opt) => opt.value));
+        onChange(options
+            .filter((opt) => (opt.disabled === true ? selected.has(opt.value) : next.has(opt.value)))
+            .map((opt) => opt.value));
     };
     const toggleOption = (optionValue, checked) => {
         const next = new Set(selected);
@@ -35,5 +38,5 @@ export function MultiSelectCheckboxes({ field, id, options, value, onChange, })
                     : t("kumiko.field.multiSelect.select-all") }), _jsx(Grid, { columns: field.columns ?? 2, testId: `${id}-checkboxes`, 
                 // Field's label targets `id`, which no checkbox carries here; point the
                 // group at Field's `${id}-label` element instead.
-                ariaLabelledBy: `${id}-label`, ...(field.maxRows !== undefined && { maxRows: field.maxRows }), children: options.map((opt) => (_jsx(GridCell, { children: _jsx(Field, { id: `${id}-${opt.value}`, label: opt.label, layout: "inline", children: _jsx(Input, { kind: "boolean", id: `${id}-${opt.value}`, name: `${id}-${opt.value}`, value: selected.has(opt.value), onChange: (checked) => toggleOption(opt.value, checked), disabled: disabled }) }) }, opt.value))) })] }));
+                ariaLabelledBy: `${id}-label`, ...(field.maxRows !== undefined && { maxRows: field.maxRows }), children: options.map((opt) => (_jsx(GridCell, { children: _jsx(Field, { id: `${id}-${opt.value}`, label: opt.label, layout: "inline", children: _jsx(Input, { kind: "boolean", id: `${id}-${opt.value}`, name: `${id}-${opt.value}`, value: selected.has(opt.value), onChange: (checked) => toggleOption(opt.value, checked), disabled: disabled || opt.disabled === true }) }) }, opt.value))) })] }));
 }

package/dist/components/reference-create-dialog.js

@@ -1,4 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { useMemo } from "react";
 import { buildInitialValues, tenantCurrencyMoneyFieldNames, useMoneyCurrencyOverrides, } from "../app/kumiko-screen.js";
 import { toKebab } from "../app/qn.js";
@@ -24,7 +25,7 @@ export function extractIdField(data, field) {
         return undefined;
     if (!Object.hasOwn(data, field))
         return undefined;
-    const value = data[field];
+    const value = propertyOf(data, field);
     return typeof value === "string" ? value : undefined;
 }
 export function extractCreatedId(data) {

package/dist/components/render-edit.js

@@ -1,6 +1,7 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { evalFieldCondition, isFieldsEditSection, normalizeEditField, PROJECTION_DETAIL_ENTITY, sectionFieldSpecs, } from "@cosmicdrift/kumiko-framework/ui-types";
 import { computeEditViewModel, groupIssuesByPath, relevantFieldIssues, zodErrorToFieldIssues, } from "@cosmicdrift/kumiko-headless";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { RenderEditActionButton } from "./render-edit-action-button.js";
 import { AllFieldsRequiredProvider } from "./render-field.js";
 import { useActionMenuItems } from "./use-action-menu-items.js";
@@ -49,9 +50,13 @@ function newDraftPrefix(screenId) {
 // `crypto.randomUUID` is missing in non-secure contexts and React Native/Hermes
 // without a polyfill — guard like dispatcher-live.ts's generateRequestId.
 function mintDraftId() {
-    const c = globalThis.crypto;
-    if (typeof c?.randomUUID === "function")
-        return c.randomUUID();
+    const webCrypto = propertyOf(globalThis, "crypto");
+    const randomUUID = propertyOf(webCrypto, "randomUUID");
+    if (typeof randomUUID === "function") {
+        const id = Reflect.apply(randomUUID, webCrypto, []);
+        if (typeof id === "string")
+            return id;
+    }
     return `draft-${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
 }
 // End-to-end renderer für einen entityEdit screen. Rendert aus-
@@ -551,7 +556,7 @@ export function RenderEdit(props) {
                 // was in flight — their input wins over the stored draft.
                 if (controller.getSnapshot().isDirty || hasNavigatedRef.current)
                     return;
-                // @cast-boundary form-draft blob: `values` round-trips through an opaque
+                // @cast-boundary form-values draft blob: `values` round-trips through an opaque
                 // jsonb column and comes back untyped.
                 controller.setValues(draft.values);
                 setRawStep(Math.max(draft.stepIndex, 0));

package/dist/components/render-field.js

@@ -1,6 +1,7 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { isFormatSpec, SYSTEM_REFERENCE_LABELS, } from "@cosmicdrift/kumiko-framework/ui-types";
 import { applyFormatSpec, currencyDecimals, } from "@cosmicdrift/kumiko-headless";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { createContext, useCallback, useContext, useMemo, useState } from "react";
 import { useAppFeatures } from "../app/app-features-context.js";
 import { useColumnRenderer } from "../app/column-renderers.js";
@@ -159,7 +160,7 @@ function ReferenceInput({ field, id, hasError, onChange, Input, featureName, })
         }
         setCreatedWithoutIdWarning(false);
         if (isMultiple) {
-            const current = Array.isArray(field.value) ? field.value : [];
+            const current = stringArrayOf(field.value);
             onChange([...current, newId]);
         }
         else {
@@ -194,9 +195,7 @@ function ReferenceInput({ field, id, hasError, onChange, Input, featureName, })
     };
     const createDialog = (_jsxs(_Fragment, { children: [canCreate && refCreateScreen && refEntityDef && (_jsx(ReferenceCreateDialog, { open: createOpen, onClose: () => setCreateOpen(false), onCreated: handleCreated, featureName: refFeature, screen: refCreateScreen, entity: refEntityDef })), createdWithoutIdWarning && (_jsx(Banner, { variant: "error", children: t("kumiko.field.reference-created-no-id") }))] }));
     if (isMultiple) {
-        const arrayValue = Array.isArray(field.value)
-            ? field.value
-            : [];
+        const arrayValue = stringArrayOf(field.value);
         return (_jsxs(_Fragment, { children: [_jsx(Input, { kind: "combobox", ...baseInputProps, multiple: true, value: arrayValue, onChange: (v) => onChange(v) }), createDialog] }));
     }
     const stringValue = field.value === undefined || field.value === null ? "" : String(field.value);
@@ -228,7 +227,7 @@ function FieldRendererOutput({ field, renderer, row, appLocale, }) {
         // when set; coalesce undefined (spread override) back to appLocale (#2332).
         return (_jsx(Text, { testId: `field-value-${field.field}`, children: applyFormatSpec({
                 ...renderer,
-                locale: renderer.locale ?? appLocale,
+                locale: stringPropertyOf(renderer, "locale") ?? appLocale,
             }, field.value, t) }));
     }
     if (componentName !== undefined) {
@@ -254,9 +253,7 @@ function ReadOnlyReferenceValue({ field, featureName, }) {
         limit: REFERENCE_COMBOBOX_LIMIT,
     });
     const ids = isMultiple
-        ? Array.isArray(field.value)
-            ? field.value
-            : []
+        ? stringArrayOf(field.value)
         : typeof field.value === "string" && field.value !== ""
             ? [field.value]
             : [];
@@ -354,10 +351,10 @@ function renderInput({ field, id, hasError, onChange, Input, appLocale, Banner,
         case "tz":
             return (_jsx(Input, { kind: "tz", ...common, value: stringValue(field.value), onChange: (v) => onChange(v) }));
         case "multiSelect": {
-            const arrayValue = Array.isArray(field.value) ? field.value : [];
-            const renderMultiSelect = (options) => field.display === "checkboxes" ? (_jsx(MultiSelectCheckboxes, { field: field, id: id, options: options, value: arrayValue, onChange: (v) => onChange(v) })) : (_jsx(Input, { kind: "combobox", ...common, multiple: true, value: arrayValue, onChange: (v) => onChange(v), options: options }));
+            const arrayValue = stringArrayOf(field.value);
+            const renderMultiSelect = (options) => field.display === "checkboxes" ? (_jsx(MultiSelectCheckboxes, { field: field, id: id, options: options, value: arrayValue, onChange: (v) => onChange(v) })) : (_jsx(Input, { kind: "combobox", ...common, multiple: true, value: arrayValue, onChange: (v) => onChange(withPinnedValues(v, options, arrayValue)), options: options }));
             if (field.selectOptionsAvailabilityQuery !== undefined && field.readOnly !== true) {
-                return (_jsx(AvailabilityOptionsMultiSelect, { field: field, query: field.selectOptionsAvailabilityQuery.query, currentValues: arrayValue, children: renderMultiSelect }));
+                return (_jsx(AvailabilityOptionsMultiSelect, { field: field, query: field.selectOptionsAvailabilityQuery.query, initialValues: arrayValue, children: renderMultiSelect }));
             }
             return renderMultiSelect(staticSelectOptions(field));
         }
@@ -452,8 +449,11 @@ const ISO_CURRENCY_CODE = /^[A-Z]{3}$/;
 function resolveMoneyCurrency(value, fieldCurrency) {
     if (typeof value === "object" && value !== null && "currency" in value) {
         const { currency } = value;
-        if (typeof currency === "string" && ISO_CURRENCY_CODE.test(currency))
-            return currency;
+        if (typeof currency === "string") {
+            const normalized = currency.toUpperCase();
+            if (ISO_CURRENCY_CODE.test(normalized))
+                return normalized;
+        }
     }
     return fieldCurrency ?? "EUR";
 }
@@ -474,13 +474,30 @@ function resolveNumberUnit(unit, row) {
     const trimmed = sibling.trim();
     return trimmed.length > 0 && trimmed.length <= MAX_SIBLING_UNIT_LENGTH ? trimmed : undefined;
 }
+function stringArrayOf(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string")
+        : [];
+}
+// The combobox cannot disable a single option, so removals of disabled options
+// the form already holds are merged back.
+function withPinnedValues(next, options, current) {
+    const missingPinned = options
+        .filter((opt) => opt.disabled === true && current.includes(opt.value) && !next.includes(opt.value))
+        .map((opt) => opt.value);
+    return missingPinned.length === 0 ? next : [...next, ...missingPinned];
+}
+function stringPropertyOf(value, key) {
+    const property = propertyOf(value, key);
+    return typeof property === "string" ? property : undefined;
+}
 function moneyMinorValue(v, currency) {
     if (v === undefined || v === null || v === "")
         return "";
     if (typeof v === "number")
         return Math.round(v * 10 ** currencyDecimals(currency));
     if (typeof v === "object") {
-        const amount = v.amount;
+        const amount = propertyOf(v, "amount");
         if (typeof amount === "number")
             return Math.round(amount * 10 ** currencyDecimals(currency));
     }
@@ -498,11 +515,11 @@ function moneyPayload(minorUnits, currency) {
 // (noch nicht gesetzt) → "" als Empty-Sentinel, analog money/timestamp.
 function locatedValue(v) {
     if (v !== null && typeof v === "object" && "at" in v && "tz" in v) {
-        const o = v;
+        const utc = propertyOf(v, "utc");
         return {
-            at: typeof o.at === "string" ? o.at : "",
-            tz: typeof o.tz === "string" ? o.tz : "",
-            ...(typeof o.utc === "string" && { utc: o.utc }),
+            at: typeof v.at === "string" ? v.at : "",
+            tz: typeof v.tz === "string" ? v.tz : "",
+            ...(typeof utc === "string" && { utc }),
         };
     }
     return "";

package/dist/components/write-form-section.js

@@ -14,11 +14,10 @@ function buildWriteFormSchema(fields) {
         .object({})
         .passthrough()
         .superRefine((values, ctx) => {
-        const record = values;
         for (const field of fields) {
             if (field.readOnly || !field.visible || !field.required)
                 continue;
-            if (isPresent(record[field.field]))
+            if (isPresent(values[field.field]))
                 continue;
             ctx.addIssue({
                 code: "custom",

package/dist/i18n-defaults.js

@@ -261,6 +261,7 @@ export const kumikoDefaultTranslations = {
         "errors.internal": "Something went wrong. Please try again later.",
         "errors.rate_limited": "Too many requests. Please try again shortly.",
         "errors.rate_limit_unavailable": "Rate limiting is temporarily unavailable. Please try again shortly.",
+        "errors.puppeteer_unavailable": "The PDF service is not reachable. PDFs cannot be created right now.",
         "errors.cap.exceeded": "Limit reached. Upgrade your plan or wait for the next period.",
         "errors.download.urlMissing": "Download unavailable — please try again.",
         "auth.errors.originNotAllowed": "Requests from this origin are not allowed.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-renderer",
-  "version": "0.362.0",
+  "version": "0.364.0",
   "description": "Platform-agnostic React renderer for Kumiko screens. Contains the shared logic — primitives-contract, hooks, KumikoScreen, navigation & SSE abstractions — that any platform-specific renderer (web, native) composes. No DOM, no EventSource, no react-dom.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -15,9 +15,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.362.0",
-    "@cosmicdrift/kumiko-headless": "0.362.0",
-    "@cosmicdrift/kumiko-types": "0.362.0",
+    "@cosmicdrift/kumiko-framework": "0.364.0",
+    "@cosmicdrift/kumiko-headless": "0.364.0",
+    "@cosmicdrift/kumiko-types": "0.364.0",
     "react": "^19.2.6",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3"
@@ -28,7 +28,7 @@
     "@types/react-dom": "^19.2.3",
     "jsdom": "^29.1.1",
     "react-dom": "^19.2.6",
-    "@cosmicdrift/kumiko-locale-de": "0.362.0"
+    "@cosmicdrift/kumiko-locale-de": "0.364.0"
   },
   "repository": {
     "type": "git",

package/src/changes.json

@@ -1,4 +1,28 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A failed refetch of a visibleWhen gate no longer unmounts a screen that is already showing",
+    "detail": "ScreenVisibilityGate used to fail closed on every error, so one failed live refetch (SSE reconnect, a short 5xx) removed the content and reset unsaved form input. Only the first evaluation fails closed now; after the content was shown, an error keeps it mounted as long as the last good data still matches the condition. The dashboard panel retry path is unchanged."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A held multiSelect value that optionsAvailabilityQuery marks unavailable stays listed but cannot be removed",
+    "detail": "The keep-listed set is taken from the values present when the field mounted, not from the live value. In the checkbox grid the entry is rendered disabled and select-all/deselect-all leave it as is; in the combobox a removal is merged back into the value. Previously unchecking such a role hid it for good while the write path kept it, so the form reported a removal that never happened. A stored lower-case currency code such as usd is normalised to upper case instead of falling back to the field currency, and array values with a non-string element keep their string entries instead of being treated as empty."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Screen fallback access, projectionDetail back navigation and stricter prefill",
+    "detail": "A visibleWhen fallback screen the user may not access now shows the standard unavailable notice instead of a \"Screen not found\" error. The not-found state of a projectionDetail honours returnTo for its back button. Embedded-list prefill rejects calendar-invalid dates, timestamps with numeric offsets and decimals beyond the safe range, and an empty number param keeps the field default instead of becoming 0."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "propertyOf type guard and fewer unchecked casts in the UI packages",
+    "detail": "\"@cosmicdrift/kumiko-types/type-guards\" exports propertyOf, which reads one property off an unknown value. Headless, renderer, renderer-web and dispatcher-live replace unchecked as-casts and globalThis probes with it and with narrowing. Behavior stays the same for well-formed input; a format spec, upload response or stream event with a wrongly typed property is now ignored instead of passed through."
+  },
   {
     "version": "0.362.0",
     "type": "improvement",