fix(TextInput): merge caller inputProps with the React Aria props

[tenphi]

Describe changes

Follow-up to #1357, which flagged this: every field that renders TextInputBase passes its React Aria hook's props down under the same inputProps name the caller uses, and nothing merged the two — one side silently replaced the other, in whichever direction the JSX happened to order them.

Component	JSX order	Effect
TextInput, TextArea, NumberInput, CommandTextArea	{...restProps} then inputProps={hookProps}	the caller's inputProps was dropped entirely
PasswordInput, SearchInput	inputProps={hookProps} then {...rest}	the hook's props were dropped — value tracking, generated ids and ARIA attributes replaced by the caller's object

The second row is the damaging one: passing inputProps to a PasswordInput quietly unwired the field.

Each component now merges the two with the repo's mergeProps, so a key the caller sets wins and event handlers are chained rather than replaced. data-input-type sits between them, so it still lands by default but stays overridable.

ColorInput also renders TextInputBase, but its CubeColorInputProps deliberately doesn't expose inputProps, so it's untouched.

Checklist

• Pipeline is passed
• Tests are added (including unit tests and stories in the storybook)
• Tests are passed successfully
• If you're adding a new component/new props, add stories that describe how this component/prop works
• Changeset(s) is(are) added
• You have passed the threshold of the library size
• Commit message follows commit guidelines

No stories added — this changes no rendered default, only what happens when a caller passes inputProps, which is not a story-visible state.

Closes: N/A

Other information

New spec: src/components/fields/input-props.test.tsx — 20 cases across the six components (caller props reach the input; the React Aria wiring survives, checked by typing and by the input keeping its generated id; a handler on a key the hook also sets is chained, not replaced; plus autoComplete through inputProps and an explicit prop beating the same key in inputProps).

11 of the 20 fail on main — verified by stashing only the six source files and re-running. The two "keep the React Aria wiring" failures are PasswordInput and SearchInput, exactly the two-sided bug above.

The autoComplete-through-inputProps case in autocomplete.test.tsx had to render TextInputBase directly because TextInput dropped inputProps; it stays there as a TextInputBase-level guard, with the TextInput route now covered in the new spec.

Verification run locally:

• pnpm test — 101 files, 2185 passed, 1 skipped
• pnpm test:browser — 12 files, 139 passed
• pnpm lint — Prettier clean, oxlint exits 0 (only pre-existing warnings in unrelated files)
• pnpm build, pnpm size — pass (511.81 kB / 515 kB limit)
• pnpm exec tsc --noEmit — 18 errors, same count as main (all pre-existing, none introduced in touched files)
• pnpm audit-docs — output byte-identical to main

---

Generated by Claude Code

---

Note

Medium Risk
Touches core form/search/password inputs and accessibility wiring; behavior change only when callers pass inputProps, but that path previously broke fields or ignored custom props.

Overview
Fixes a bug where inputProps from callers and React Aria hook props fought over the same name on six TextInputBase-based fields. Some components dropped the caller’s inputProps entirely; PasswordInput and SearchInput dropped the hook’s props, which broke value tracking, ids, and ARIA when inputProps was passed.

Each affected component now mergeProps hook props, internal markers like data-input-type (and combobox ARIA on CommandTextArea), then userInputProps, so caller keys win and shared handlers (e.g. onChange) are chained instead of replaced. Docs describe that merge behavior; a patch changeset and input-props.test.tsx cover all six components (passthrough, wiring survives typing, handler chaining, autoComplete precedence).

^{Reviewed by Cursor Bugbot for commit 33ece2f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cube-ui-kit	Ready	Preview	Aug 25, 2026 3:18pm

[changeset-bot]

🦋 Changeset detected

Latest commit: 33ece2f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cube-dev/ui-kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

📦 NPM canary release

Deployed canary version 0.0.0-canary-69f25fb.

[github-actions]

🏋️ Size limit report

Name	Size	Passed?
All	499.81 KB (+0.01% 🔺)	Yes 🎉
Tree shaking (just a Button)	118.96 KB (0% 🟰)	Yes 🎉

Compared against main at 9b2daec — run 32863692246, 2026-08-25T15:06:14Z.

To see which modules changed, download the size-limit-statoscope-report artifact from this run and open report.html.

[github-actions]

🧪 Storybook is successfully deployed!

• 👀 Review changes: https://www.chromatic.com/build?appId=626ee6db91d1c8004a912249&number=3989
• 👨‍🎨 Preview storybook: https://626ee6db91d1c8004a912249-rtotaixlvp.chromatic.com/