fix(components): a form field resolves a field widget or the default input — never a ui-namespace SDUI node renderer

[os-support-ai]

Fixes#5254

Implements the maintainer ruling of 2026-08-19 (verbatim 「全部接受」), option B: form-field type resolution stops falling back to ui-namespace SDUI node renderers.

The located surface

The claim deliberately left the file surface unstated. Located by reading, it is one function in one file:

• packages/components/src/renderers/form/form.tsx — renderFieldComponent, plus the default arm of its field switch.

That is the only site in the repo doing this resolution: a ComponentRegistry.get on a field:-prefixed key appears exactly twice across packages/**, both in this file (the other is resolvesToRegisteredFieldWidget, which only mirrors the rule and already spelled it the way the ruling prescribes). No overlap with the in-flight #5269 (packages/plugin-view), #5299 (packages/plugin-dashboard) or #5257 (packages/core).

Re-derived on current origin/main first

The fallback still existed and still had the shape the card recorded. Measured at 3fbbea1f3, built-in path (no registerAllFields()), field { name: 'contact', type: 'email', max_length: 50 }:

ComponentRegistry.get('email') = true ComponentRegistry.get('field:email') = false
attrs=["class","id","max_length","field","aria-describedby","aria-invalid","type","value","name"]
maxlength=null field="[object Object]"

Two things the card recorded, and a third it did not: because the ui node renderer draws its own label, the control got a second label element on top of the form's own — two labels naming one control.

I also measured how wide the fallback actually was. It answered 126 bare names on the built-in path (div, h1, card, button, form, alert, badge, the display text widget …), and 116 with the fields package registered too.

The change

A form field's type now resolves a field:-namespaced widget or takes the builtin default input branch. The || ComponentRegistry.get(type) tail is gone, and with it the whole "non-field component reached through the bare-name fallback" branch — so renderFieldComponent now dispatches to exactly one contract (FieldWidgetComponentProps). A colon-qualified type resolves only when it names the field namespace, closing the same hole for ui:email rather than only the bare spelling.

⚠️ Clause-② — this IS a behaviour change, stated plainly

A spelling that resolved yesterday stops resolving. A form field whose type names a non-field component renders the default input instead of that component. That is the substance of the ruling, not a side effect of it, and the changeset is minor for that reason (never major — objectui's major is pinned to @objectstack's).

Not softening it, but scoping it honestly: with registerAllFields() — the production configuration — every affected type already resolved its own field: widget, and object-derived forms go through mapFieldTypeToFormType, which has always emitted the field:-prefixed id. Rendering these components as top-level SDUI nodes is untouched; this rule governs field resolution only.

The verification the ruling put on the implementer

"Implementer must verify the default branch renders a usable input for these types."

Measured answer: on its own, it does not.inputType on that branch is whatever the author wrote, and a plain { name, type: 'password' } authors none — so the branch rendered type="text" and put a secret on screen in clear text. That is the "worse than the leak" outcome, and it is why this PR also adds NATIVE_INPUT_FIELD_TYPES to the default branch: email and password are declared field types in @object-ui/types (EmailFieldMetadata / PasswordFieldMetadata) and keep the native input they always rendered. An explicitly authored inputType still wins.

So the visible rendering of an email / password field is unchanged; what goes away is the leak, the duplicate label and the dead ceiling. After the fix, same field as above:

attrs=["class","maxlength","id","aria-describedby","aria-invalid","type","name"]
type=email maxlength=50 (no `field`, no `max_length`, one label)

The table is deliberately those two only. Other declared types with a native HTML equivalent (url, phone, number, color, date) already took this branch as type="text" and are untouched — widening it would change fields this card neither moved nor measured.

Reverse verification — predicted before running, both legs

Fix committed first, then reverted, so both legs ran from a known state.

Leg 1 — restore the bare-name fallback, keep all tests. Predicted 8 red, named in advance; observed exactly those 8, no others:

assertion	predicted	observed
never leaks the field metadata object	RED	RED
never leaks max_length, ceiling caps	RED	RED
exactly ONE label	RED	RED
stops routing a field into a non-field component (card)	RED	RED
authored inputType wins	RED	RED
carrier: no bare-name component in the field slot	RED	RED
carrier: renders the builtin default input instead	RED	RED
host-group: bare-name gets no group	RED	RED

Leg 2 — revert only NATIVE_INPUT_FIELD_TYPES. Predicted 2 red; observed exactly 2, with the failure text that is the ruling's answer in one line:

AssertionError: expected 'text' to be 'password'
AssertionError: expected 'text' to be 'email'

Assertions green on BOTH legs — pinning nothing on their own, said rather than counted: the registry-reading premise test, still resolves a field: widget, ui node renderers still reachable as NODES, builtin type on its own branch, and (leg 1 only) the three "usable input" assertions, since the old fallback also produced a native email/password input. They are counter-probes and routing guards, not evidence of the fix.

Every zero is counter-probed with a known-present neighbouring term — ComponentRegistry.get('form') / get('card') / get('barenameprobe') / get('plaindisplay') are asserted truthy next to each toBeUndefined() / toBeNull(), so no assertion can pass on an empty registry.

Build artifact between the edit and the thing under test

None for the tests. The root vitest.config.mts aliases every @object-ui/* specifier to that package's src/, so vitest reads the edited source directly; no dist/ sits in between. A build is required for type-check (it reads dependencies' .d.ts), and the first run in this fresh worktree failed with TS2307: Cannot find module '@object-ui/core' for that reason alone. After pnpm --filter '@object-ui/components^...' build it passes.

Fixture triage

Two existing tests pinned the removed branch and were rewritten rather than re-spelled, because their assertions passed precisely because the fallback existed:

• form-field-carrier.test.tsx — the block asserting a bare-name component receives the universal schema node. Correct about a rule that no longer exists; now asserts the field is not routed there at all, and takes the builtin input.
• form-readonly-host-group.test.tsx — kept [fields] 非 group-labelled widget 的只读替换显示丢掉 host 下发的整份 plumbing —— label 的 for 悬空、description 零消费者(email / url / phone 实测) #4788's own assertion (no group wrapper for a non-field-widget) and replaced only the half that asserted the field reached the bare-name probe.

Both keep a counter-probe showing the component is still registered and still resolvable — it is simply no longer reachable as a field.

Tests (all from repo root, canonical pnpm exec vitest run + the file path; no --)

Run on the final commit e20ea0d22:

scope	result
packages/components/src/renderers/form + the two form-renderer suites	50 files, 340 passed
packages/components (full)	166 files, 1508 passed
packages/plugin-form + packages/plugin-detail	143 files, 1398 passed
packages/plugin-viewplugin-listreactlayoutfields	230 files, 3445 passed
packages/app-shell	449 files, 4332 passed, 1 skipped
pnpm --filter @object-ui/components type-check	pass (after building the dep closure)
check:control-bytes / check:self-import / check:esm-specifiers	pass
eslint on the changed files	0 errors (77 pre-existing warnings; any-count unchanged at 45)

Vitest was run from the repository root every time — packages/components owns a standalone vitest.config.ts and is one of the 11 packages objectui#5313 measured assertCanonicalVitestInvocation as NOT covering, so the guard was not relied on.

Filed separately, not fixed here

#5322 — a field:-prefixed password / email field (what mapFieldTypeToFormType emits) renders type="text" when its widget is not registered, showing a secret in clear text. Measured as pre-existing and unchanged by this PR on both sides of the change. Left to its own card exactly as the ruling directs, rather than widened into this one.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Main entry (gzip)	25.3 KB	350 KB
Entry file	index-CuENH-rI.js	—
Status	PASS	—

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (index.js)	9.83KB	3.70KB
app-shell (runtime-config.js)	7.42KB	2.32KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	8.92KB	3.41KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	1.17KB	0.53KB
auth (AuthProvider.js)	29.33KB	7.05KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.13KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.64KB	2.21KB
auth (SocialSignInButtons.js)	9.60KB	3.89KB
auth (UserMenu.js)	3.40KB	1.22KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.79KB
auth (createAuthenticatedFetch.js)	6.34KB	2.43KB
auth (index.js)	2.71KB	1.22KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.02KB	0.88KB
auth (useIsWorkspaceAdmin.js)	1.61KB	0.85KB
collaboration (CommentThread.js)	26.07KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.65KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.75KB	113.40KB
core (index.js)	4.11KB	1.62KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	159.80KB	44.34KB
fields (index.js)	237.07KB	59.46KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.42KB	1.39KB
i18n (pickLocalized.js)	3.69KB	1.73KB
i18n (provider.js)	23.13KB	7.63KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	29.43KB	7.15KB
i18n (useSafeTranslation.js)	7.77KB	3.13KB
layout (index.js)	39.16KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.74KB
mobile (index.js)	1.50KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.71KB	0.42KB
mobile (useResponsiveConfig.js)	1.36KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.35KB	3.31KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.42KB	1.42KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.91KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.52KB
permissions (usePermissions.js)	1.81KB	0.83KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.62KB	12.83KB
plugin-charts (index.js)	64.75KB	18.37KB
plugin-chatbot (index.js)	181.21KB	43.14KB
plugin-dashboard (index.js)	127.92KB	32.80KB
plugin-designer (index.js)	212.39KB	42.83KB
plugin-detail (index.js)	241.46KB	60.56KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	124.19KB	30.20KB
plugin-gantt (index.js)	164.10KB	39.87KB
plugin-grid (index.js)	198.22KB	53.28KB
plugin-kanban (index.js)	52.93KB	14.60KB
plugin-list (index.js)	111.66KB	27.13KB
plugin-map (index.js)	20.08KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.49KB	11.93KB
plugin-timeline (index.js)	26.68KB	7.66KB
plugin-tree (index.js)	8.50KB	2.88KB
plugin-view (index.js)	84.55KB	20.67KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.44KB	0.22KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	3.77KB	1.33KB
react (SchemaRenderer.js)	36.10KB	12.26KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.33KB	0.69KB
react (schema-input.js)	1.45KB	0.83KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (index.js)	4.77KB	2.16KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	10.76KB	3.17KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	6.92KB	2.40KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	0.20KB	0.18KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-retry.js)	4.32KB	2.02KB
types (index.js)	3.08KB	1.53KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	0.20KB	0.18KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[os-support-ai]

ACCEPT — PM review, round 16.

• Path surface (git diff --name-only origin/main... @ e20ea0d, base 8477be5): 5 files — packages/components/src/renderers/form/form.tsx, three sibling tests, one changeset. Entirely inside the declared surface; zero governed-surface hits (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/).
• Gates: every gate job completed: success on e20ea0d — Lint, Type Check, Test shards 1–4, Build & E2E, Build Docs, Doc Snippet / Doc Component Type Check, Changeset Declaration / Bump Policy / Fixed Group, Bundle Analysis, Control Byte Scan, Internal Docs Link Check, Skill Guide Path Check. No cancelled, no in_progress. (Test (coverage) and dependabot are ordinary skips.)
• Bump: minor on @object-ui/components, breaking semantics spelled out in the changeset body — correct under the pinned-major policy. ⛔ not major.
• The ruling's required verification came back negative, and that is why this PR is right. Option B removed the bare-name fallback; the dev then measured the default branch and found it derives <input type> from inputType, which a plain { name, type: 'password' } never authors — the field would have rendered type="text" and shown a secret in clear text. The deliberately two-entry NATIVE_INPUT_FIELD_TYPES table (keyed on EmailFieldMetadata / PasswordFieldMetadata) closes exactly that hole and nothing wider; an explicitly authored inputType still wins. Reporting the negative instead of asserting the ruling held is the behaviour the dispatch asked for.

Merging.

---

Generated by Claude Code