fix(components): enforce the declared max_length ceiling on the form default fallback branch

[os-support-ai]

Fixes#5253

The last arm of the built-in form's field switch — the default fallback, serving a type that is neither a BUILTIN_FIELD_TYPES member nor resolvable from the registry under field: + type or the bare type — spread its props straight onto the rendered Input and never read the declared ceiling. It is the same defect #5201 fixed one arm earlier in the same switch, and it survived that card because #5201's triage ruling scoped the work to the input branch.

Measured before-state

Re-measured on current main (87d9202b1, i.e. after#5201's PR merged), rendering the built-in branch with no registerAllFields() and a field of type: 'zzunknown', dumping getAttributeNames() and getAttribute('maxlength'):

max_length: 50 → attrs=["class","max_length","id","aria-describedby","aria-invalid","type","name"] maxlength=null max_length="50"
maxLength: 50 → attrs=["class","maxlength","id","aria-describedby","aria-invalid","type","name"] maxlength="50"
both (50/80) → attrs=["class","maxlength","max_length","id",…] maxlength="50"
neither → attrs=["class","id","aria-describedby","aria-invalid","type","name"] maxlength=null

This reproduces the filer's measurement exactly, so #5201's merge did not cover this branch. One declaration split into two outcomes by spelling: camelCase maxLength capped by coincidence (it happens to name a real DOM attribute), while the legacy max_length capped nothing at all and landed as a stray, inert max_length="50" attribute — invalid HTML that reads like a working cap to whoever greps this file next. Two independent defects.

After the change, all four rows read maxlength="50" / no attribute respectively, with no stray key:

max_length: 50 → attrs=["class","maxlength","id","aria-describedby","aria-invalid","type","name"] maxlength="50" max_length=null
both (50/80) → attrs=["class","maxlength","id",…] maxlength="50"
neither → attrs=["class","id","aria-describedby","aria-invalid","type","name"] maxlength=null

Why this is a fix, not a renderer-side tolerance

max_length is a live authoring spelling (AGENTS.md #0.1 does not bite here): the registered field:* widgets have dual-read maxLength ?? max_length since framework#1878 §3, all three producers of a form field normalize it (ObjectForm, sectionFields, EmbeddableForm.applyDefaultMaxLengths), and @object-ui/types declares it on several field types. This branch serves a hand-authored FormSchema handed straight to the renderer, where there is no normalizing producer in between and the author is the producer — so it was the one reader in the repo that dropped the declaration.

Sibling implementations mirrored

The fix shape is inherited from triage, not chosen here — a local destructure, copied from the two landed siblings in the same file:

• case 'input' (内建 form 分支的 input 字段:legacy max_length 拼法拿不到任何 maxlength 上限,只在 DOM 上留下一个失效属性 #5201) — const { max_length: _maxLengthLegacy, ...inputProps } = domFieldProps as any; plus maxLength ?? max_length, applied after the spread (the 字段 widget 的错误提示键:spec 声明 error,objectui 渲染 errorMessage(declared ≠ enforced) #3222 discipline).
• case 'textarea' (内建 form 分支的长文本字段完全没有字数计数,同一个 maxLength 在两条渲染路径上给出两种体验 #3439) — the same two lines against fieldProps, then stripRendererOnlyProps.

⛔ The shared stripRendererOnlyProps table is deliberately untouched. It feeds checkbox, switch, select and this fallback alike, so widening it would silently change three branches this card neither fixes nor tests — the alternative triage explicitly rejected. The only occurrence of that helper's name in this diff is inside an explanatory comment.

Out of scope and unchanged: this branch still does not do the input arm's value={… ?? ''} normalization, and no {n}/{max} counter is added (the counter half remains the undecided design question #5201 left open).

Tests — both halves asserted

New file packages/components/src/renderers/form/__tests__/form-builtin-default-branch-max-length.test.tsx, copying #5201's criteria: every case reads getAttributeNames()andgetAttribute('maxlength'), because the missing cap and the stray attribute are two distinct defects and either assertion alone passes against half the bug. Six cases: a routing guard proving the default arm is really the path under test (counter-probed against a populated registry, so the two undefined lookups are a reading and not an empty registry), camelCase still capping, legacy max_length now capping, no stray key on the DOM, canonical winning when both are declared, and an uncapped field left byte-for-byte as it was.

Reverse verification

Predicted before running, with the pre-fix form.tsx restored and the new tests kept:

test	predicted	observed
routing guard	green	green
camelCase caps	green	green
legacy max_length caps	red	red — expected null to be '50'
no stray attribute	red	red — expected [ 'class', 'max_length', … ] to not include 'max_length'
canonical wins	red on the 2nd assertion only	red on the 2nd assertion only — expected [ 'class', 'maxlength', …(6) ] to not include 'max_length'
uncapped unchanged	green	green

Tests 3 failed | 3 passed (6) — predicted and observed agree, including that the "canonical wins" case fails only on its stray-attribute half while its cap assertion was already green pre-fix. That is the concrete demonstration that a cap-only test would have let the invalid attribute survive.

No rebuild gates this ablation: the subject is reached through a relative source import (../../../renderers → ./form), not across a package exports → dist/ boundary, so the mutation reaches the tested code directly. Restoring afterwards left the working tree byte-identical to the committed fix (git status clean) and the suite back at 6/6 green.

Verification

All run from the repo root at commit 6ce9edfcd with a clean working tree:

• pnpm exec vitest run packages/components/ — 163 files, 1479 tests passed, covering the sibling input/textarea ceiling suites and the checkbox/switch/select arms that share the untouched strip table
• pnpm --filter @object-ui/components type-check — clean (tsc --noEmit && tsc -p tsconfig.test.json, so the new test file is covered; the script name echoed, confirming it was not a zero-match no-op)
• pnpm --filter @object-ui/components lint — 0 errors (891 pre-existing package-baseline warnings)
• pnpm --workspace-concurrency=2 --filter '@object-ui/components^...' build — dependency closure builds clean
• node scripts/check-control-bytes.mjs — OK (4664 files), plus a direct grep -naP over the three changed files
• node scripts/check-changeset-presence.mjs — OK, 1 changeset declared
• check:self-import, check:esm-specifiers, check:phantom-deps — all green

Changeset: patch on @object-ui/components (never major — 39 packages share one fixed group).

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Main entry (gzip)	25.3 KB	350 KB
Entry file	index-BG_rSeu4.js	—
Status	PASS	—

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (index.js)	9.83KB	3.70KB
app-shell (runtime-config.js)	7.42KB	2.32KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	8.92KB	3.41KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	1.17KB	0.53KB
auth (AuthProvider.js)	29.33KB	7.05KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.13KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.64KB	2.21KB
auth (SocialSignInButtons.js)	9.60KB	3.89KB
auth (UserMenu.js)	3.40KB	1.22KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.79KB
auth (createAuthenticatedFetch.js)	6.34KB	2.43KB
auth (index.js)	2.71KB	1.22KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.02KB	0.88KB
auth (useIsWorkspaceAdmin.js)	1.61KB	0.85KB
collaboration (CommentThread.js)	26.07KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.65KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.27KB	113.31KB
core (index.js)	4.11KB	1.62KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	159.80KB	44.34KB
fields (index.js)	237.07KB	59.46KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.42KB	1.39KB
i18n (pickLocalized.js)	3.69KB	1.73KB
i18n (provider.js)	23.13KB	7.63KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	29.43KB	7.15KB
i18n (useSafeTranslation.js)	7.77KB	3.13KB
layout (index.js)	39.16KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.74KB
mobile (index.js)	1.50KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.71KB	0.42KB
mobile (useResponsiveConfig.js)	1.36KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.35KB	3.31KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.42KB	1.42KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.91KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.52KB
permissions (usePermissions.js)	1.81KB	0.83KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.62KB	12.83KB
plugin-charts (index.js)	64.75KB	18.37KB
plugin-chatbot (index.js)	181.21KB	43.14KB
plugin-dashboard (index.js)	128.04KB	32.75KB
plugin-designer (index.js)	212.39KB	42.83KB
plugin-detail (index.js)	241.46KB	60.56KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	123.77KB	30.07KB
plugin-gantt (index.js)	164.10KB	39.87KB
plugin-grid (index.js)	198.22KB	53.27KB
plugin-kanban (index.js)	52.93KB	14.60KB
plugin-list (index.js)	111.66KB	27.13KB
plugin-map (index.js)	19.96KB	6.56KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	42.84KB	11.77KB
plugin-timeline (index.js)	26.68KB	7.66KB
plugin-tree (index.js)	8.50KB	2.88KB
plugin-view (index.js)	84.08KB	20.59KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.44KB	0.22KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	3.77KB	1.33KB
react (SchemaRenderer.js)	31.56KB	10.70KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.33KB	0.69KB
react (schema-input.js)	1.45KB	0.83KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (index.js)	4.77KB	2.16KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	10.76KB	3.17KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	6.92KB	2.40KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	0.20KB	0.18KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-retry.js)	4.32KB	2.02KB
types (index.js)	3.08KB	1.53KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	0.20KB	0.18KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped