One size for a price, and no eye unless asked

A money box ran the width of whatever held it, which on a settings
screen was the whole row and in a narrow cell a sliver. It is core's
regular-text width everywhere now, and a panel that wants it wider says
so. The password reveal is off unless a field asks for it: core offers
that button where somebody sets a password they will type again, and an
API key pasted once and never shown back is not that.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Kwx2STJ4EaVaJofEJJ9Zo

Author: arraypress

README.md

@@ -94,7 +94,7 @@ Sanitising coerces; it does not refuse. `required` and `validate` do the
 refusing on the server: a value that fails is left where it was, every other
 field is saved, and the message is kept for the next render. Options can name
 a preset instead of listing choices. Any single-line input takes a `prefix`
-or a `suffix`, a password can be revealed, and a `maxlength` shows a count. A
+or a `suffix`, a password can offer a reveal, and a `maxlength` shows a count. A
 `region` follows the country beside it.
 
 ```php

assets/css/field-kit.css

@@ -3254,12 +3254,17 @@ span.field-kit__provider-logo {
    A flex box, not a block: the input is then the box's whole height, and
    the symbol centred on the box is centred on the input. As a block the
    box was taller than the input by the line's descender, and the symbol
-   sat a few pixels high of the digits beside it. */
+   sat a few pixels high of the digits beside it -- and it ran the width
+   of whatever held it, so a price on a settings screen was the width of
+   the desk and one in a narrow cell a sliver. It is core's regular-text
+   width now, wherever it is, and a panel that wants it wider says so. */
 .field-kit__money {
-	display: flex;
+	display: inline-flex;
 	align-items: stretch;
 	position: relative;
+	width: 25em;
 	max-width: 100%;
+	vertical-align: middle;
 }
 
 /* The symbol is a zone at the start of the input: centred in its own

src/Types/PasswordType.php

@@ -51,7 +51,10 @@ protected function input_type(): string {
 	protected function control( Field $field, Attributes $attributes ): string {
 		$input = parent::control( $field, $attributes );
 
-		if ( ! (bool) $field->get( 'reveal', true ) ) {
+		// Off unless asked for. Core offers the button where somebody is
+		// setting a password they will have to type again; an API key pasted
+		// once and never shown back is not that.
+		if ( ! (bool) $field->get( 'reveal', false ) ) {
 			return $input;
 		}
 

tests/PasswordRevealTest.php

@@ -23,7 +23,7 @@
 final class PasswordRevealTest extends TestCase {
 
 	public function test_the_toggle_is_cores_own(): void {
-		$html = $this->render( [] );
+		$html = $this->render( [ 'reveal' => true ] );
 
 		$this->assertStringContainsString( '<span class="field-kit__password"><input', $html );
 		$this->assertStringContainsString(
@@ -32,16 +32,16 @@ public function test_the_toggle_is_cores_own(): void {
 		);
 	}
 
-	public function test_it_is_on_unless_turned_off(): void {
-		$html = $this->render( [ 'reveal' => false ] );
+	public function test_it_is_off_unless_asked_for(): void {
+		$html = $this->render( [] );
 
 		$this->assertStringNotContainsString( 'field-kit__password', $html );
 		$this->assertStringNotContainsString( '<button', $html );
 		$this->assertStringContainsString( 'type="password"', $html );
 	}
 
 	public function test_the_stored_value_is_still_never_sent_to_the_page(): void {
-		$html = $this->render( [], 'hunter2' );
+		$html = $this->render( [ 'reveal' => true ], 'hunter2' );
 
 		$this->assertStringContainsString( 'value=""', $html );
 		$this->assertStringNotContainsString( 'hunter2', $html );