fix(components): a field:-prefixed secret field fails closed instead of rendering clear text (#5322)

[os-support-ai]

Fixes#5322

The defect, re-measured at this branch point

main at f2e11ae6f. On the built-in path (@object-ui/fields not registered), rendered through the real form renderer:

type registry hit rendered type attrs
field:password false text ["class","id","aria-describedby","aria-invalid","type","name"]
field:email false text (same)
password true password (PR5326 behaviour)
email true email (PR5326 behaviour)

A field:-prefixed id resolves nothing, takes renderFieldComponent's default arm, and misses NATIVE_INPUT_FIELD_TYPES because that table is keyed on the raw type. mapFieldTypeToFormType emits the prefixed id for every object-derived form, so this is the normal path: an object-derived password field put the secret on screen in clear text, and an object-derived email field lost its native keyboard and validation.

Pre-existing. The table is keyed on the raw type, so the prefixed spelling never matched it — the same reading was taken on origin/main before #5254 landed. #5254 / PR5326 neither introduced nor fixed this.

The shape chosen, and why

Triage ruled: "the unregistered-widget default must respect the declared input type, or refuse to render the value rather than degrade to clear text", with "for password specifically, prefer masking/refusal over best-effort rendering". Both limbs are used — on the spelling where each is correct, because the two spellings do not mean the same thing:

• A barepassword / email is a declared input type on the built-in path. It claims no registered widget; this branch is its intended home and its native input is the correct rendering, not a degrade. Untouched.
• A field:-prefixed id is a registry key. Reaching the default arm with one proves an unmet contract: the app declares a widget that is not registered.

So:

spelling	before	after
field:password	type="text" — secret in clear text	refusal — no input, no value in the DOM
field:email	type="text"	type="email"
password	type="password"	type="password" (unchanged)
email	type="email"	type="email" (unchanged)

Why refusal and not masking for field:password. Masking alone closes the leak, and it is exactly what the bare spelling does. It is not enough here, because here we additionally know the app shipped without the widget it declares: a masked box would invite the user to type a secret into a form whose password widget — strength meter, confirm pair, reveal toggle, submit handling — is absent, in a control that looks like it worked. The refusal is an inline role="alert" naming the missing widget id, plus a console.error whose text doubles as the fix instruction (registerAllFields()), mirroring RetiredFieldTombstone in packages/fields and this file's own spec-vocabulary boundary (#3090). Nothing is thrown — one unrenderable field must not take down the rest of a record form.

Why field:email gets the other limb. No leak, and the ruling's first limb applies directly: respect the declared type. Turning every unregistered field:* id into a refusal would change field:currency, field:qrcode and every other type this card neither moved nor measured, and would break every app that renders forms without registering fields.

Deliberately narrow: only password refuses, only under the field: namespace, and a registered field:password widget still wins. A ui:-qualified id renders exactly as it does today.

No new authorable key

The accept set is unchanged — no metadata key is declared, read, or widened. NATIVE_INPUT_FIELD_TYPES is now keyed on the declared type (normalizeFieldType, already in this file) instead of the raw one; the refusal keys on the field: prefix plus a two-line SECRET_FIELD_TYPES set. This narrows what renders; it accepts nothing new.

Verification

Pinned on the rendered output, not the resolver — the whole defect is that a resolver returning nothing still produced a plausible-looking control.

New file: packages/components/src/renderers/form/__tests__/form-prefixed-field-native-input.test.tsx, 16 tests, covering both spellings and both types plus the no-collateral cases (a registered field:password widget wins; field:currency still renders its text box; builtin input untouched; the declared ceiling still caps).

Verified at 6a668d777:

pnpm exec vitest run packages/components/src/renderers/form/__tests__/form-prefixed-field-native-input.test.tsx
Test Files 1 passed (1) Tests 16 passed (16)
pnpm exec vitest run packages/components/src/renderers/form packages/components/src/__tests__/form-renderers.test.tsx
Test Files 50 passed (50) Tests 352 passed (352)
pnpm exec vitest run packages/plugin-form packages/plugin-detail packages/fields
Test Files 250 passed (250) Tests 3200 passed (3200)
pnpm --filter @object-ui/components type-check exit 0
pnpm exec eslint (the two changed files) 0 errors
node scripts/check-control-bytes.mjs OK
check:i18n-keys / i18n-drift / doc-types / phantom-deps / self-import all rc=0

Run from the repo root with no -- before the paths, per scripts/vitest-invocation-guard.mjs.

Reverse verification

form.tsx reverted to origin/main with the new test file kept, then re-run:

Test Files 1 failed (1) Tests 6 failed | 10 passed (16)
× renders NO input at all
AssertionError: expected an input element to be null
× renders a visible refusal naming the widget that is missing
× keeps a seeded secret out of the DOM entirely
Received: "… type="text" value="hunter2" name="pw3" …"
× writes the fix instruction to the console
× does not take the rest of the form down with it
× renders the native email input, still named and labelled
AssertionError: expected 'text' to be 'email'

type="text" appears in the failure text on the field:password legs, and the seeded-secret leg prints the pre-fix DOM carrying value="hunter2" in clear text. The 10 that stay green are the bare-spelling pins and the no-collateral cases — i.e. the file would also catch a fix that traded one spelling for the other. form.tsx was restored from the commit afterwards (git checkout HEAD -- …), verified byte-identical by an empty git diff HEAD.

Build artifacts

None on any leg. The root vitest.config.mts aliases every @object-ui/* specifier to that package's src/, and the renderer under test is imported through a relative path, so no dist/ sits between the edit and the thing under test. The dependency closure (pnpm --filter '@object-ui/components^...' build) was built only because type-check resolves @object-ui/core and @object-ui/types through their published .d.ts — without it that leg fails with TS2307 Cannot find module, which reads like a source error and is not one.

check:doc-snippets was not run locally: it refuses to start until every package it resolves against has a built dist/, unrelated to this change. CI builds first and runs it there.

Notes

• The visible refusal is developer copy, not end-user copy (an app in this state is misconfigured), so it is plain English with no i18n key — the same call RetiredFieldTombstone makes.
• +1 eslint warning on form.tsx (react-refresh/only-export-components, for the new component), the same warning the two neighbouring built-in-branch components already carry. --max-warnings is deliberately unset in lint.yml.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Main entry (gzip)	25.3 KB	350 KB
Entry file	index-BInyohVQ.js	—
Status	PASS	—

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (index.js)	9.83KB	3.70KB
app-shell (runtime-config.js)	7.42KB	2.32KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	1.17KB	0.53KB
auth (AuthProvider.js)	29.34KB	7.05KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	6.35KB	2.43KB
auth (index.js)	2.77KB	1.22KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.02KB	0.89KB
auth (useIsWorkspaceAdmin.js)	1.61KB	0.85KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	506.94KB	113.61KB
core (index.js)	4.11KB	1.62KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	159.80KB	44.34KB
fields (index.js)	237.07KB	59.46KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.42KB	1.39KB
i18n (pickLocalized.js)	3.69KB	1.73KB
i18n (provider.js)	23.13KB	7.63KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	30.51KB	7.57KB
i18n (useSafeTranslation.js)	7.77KB	3.13KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.35KB	3.31KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.42KB	1.42KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.81KB	0.83KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.62KB	12.83KB
plugin-charts (index.js)	64.75KB	18.37KB
plugin-chatbot (index.js)	181.21KB	43.14KB
plugin-dashboard (index.js)	128.07KB	32.77KB
plugin-designer (index.js)	212.39KB	42.83KB
plugin-detail (index.js)	241.46KB	60.56KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	124.19KB	30.20KB
plugin-gantt (index.js)	164.10KB	39.87KB
plugin-grid (index.js)	197.30KB	53.06KB
plugin-kanban (index.js)	52.93KB	14.60KB
plugin-list (index.js)	111.66KB	27.13KB
plugin-map (index.js)	20.08KB	6.62KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.49KB	11.93KB
plugin-timeline (index.js)	26.68KB	7.66KB
plugin-tree (index.js)	8.50KB	2.88KB
plugin-view (index.js)	84.52KB	20.67KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	3.77KB	1.33KB
react (SchemaRenderer.js)	36.10KB	12.26KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.33KB	0.69KB
react (schema-input.js)	1.45KB	0.83KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (index.js)	4.77KB	2.16KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	10.76KB	3.17KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	6.92KB	2.40KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	0.20KB	0.18KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-retry.js)	4.32KB	2.02KB
types (index.js)	3.08KB	1.53KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	0.20KB	0.18KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped