Show a notice when a saved field value was rejected

[masnwilliams]

summary

When a site explicitly rejects a stored credential, the pause records replace_existing on the field so the user can be told the saved value is no longer usable. Nothing rendered it: the canonical projection dropped the flag, and neither field type declared it, so the form re-rendered as an ordinary empty input with no indication of why it was asked again.

changes

• declare replace_existing on ManagedAuthField and DiscoveredField
• carry it in fieldsFromCanonical, which previously copied six keys and stopped
• render a notice above the field hint, so a rejected field that also has a hint keeps both
• add the fieldReplaceExistingNotice label and the inputReplaceNotice appearance slot

The notice uses the existing --kma-color-danger token and the same typography as .kma-input-hint; no new design values.

ordering

Based on #20, which introduces fieldsFromCanonical. Review that first; this diff is only the flag.

The API side ships in kernel/kernel#3094, which adds replace_existing to the DiscoveredField schema. Until that deploys the flag only arrives on canonical fields, which this handles; afterwards it arrives on both and both paths render.

tests

bun test, bun run typecheck, bun run build, and prettier --check all pass.

Four pure cases in state.test.ts:

• canonical field with the flag reaches the rendered field
• canonical field without it leaves the property unset rather than inventing false
• legacy discovered_fields pass the flag through untouched, which is the path that goes live first
• toStrictEqual on the whole projected field, not a subset. The existing tests use toMatchObject, which is why a dropped key passes unnoticed — this one fails if the projection forgets any property the form renders

The first and fourth were verified to fail with the fieldsFromCanonical line reverted; the legacy and unset cases stay green in both states.

Not covered: the render itself. The package has no DOM test setup, so UnifiedAuthForm has no test at any level and this change does not add one.

---

Note

Low Risk
UI-only messaging and optional field metadata plumbing in managed-auth-react; no auth or credential handling changes.

Overview
When the backend sets replace_existing on a field (saved credential rejected by the site), the auth form now shows a danger-styled notice under the input instead of a blank field with no explanation.

replace_existing is added to ManagedAuthField and DiscoveredField, forwarded through fieldsFromCanonical (which also merges legacy placeholder / hint by ref), and rendered in UnifiedAuthForm above the field hint when both apply. Customization uses fieldReplaceExistingNotice and the inputReplaceNotice appearance slot; default copy and .kma-input-replace-notice styling reuse existing danger/hint tokens.

state.test.ts adds coverage for canonical, legacy, and full projected field shape so dropped flags are caught.

^{Reviewed by Cursor Bugbot for commit 32fd50b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
managed-auth-react-demo	Ready	Preview	Aug 5, 2026 11:44pm