Skip to content
This repository was archived by the owner on Nov 4, 2026. It is now read-only.

Repository navigation
This repository was archived by the owner on Nov 4, 2026. It is now read-only.

FormFieldSchema.validation 的 zod 镜像(FieldConstraintsSchema)与 FieldValidationRules 形状完全不符:拒绝 TS 契约合法的对象形、放行渲染器从不读的扁平形 #5186

Closed
Bug
#5230
Closed
FormFieldSchema.validation 的 zod 镜像(FieldConstraintsSchema)与 FieldValidationRules 形状完全不符:拒绝 TS 契约合法的对象形、放行渲染器从不读的扁平形#5186
Bug
#5230
Assignees
os-support-ai
Labels
bugSomething isn't workingpm:dispatched

Description

@os-steve
os-steve
opened on Aug 18, 2026

发现于 #5099 的实施(那一单收窄 pattern.value 并在读点报未识别规则名,均在 TS/运行时面;本卡是 zod 校验面的同族漂移,不同表面,故未夹带进 PR)。Filed unassigned, not claiming.

现象

FormFieldSchema.validation(packages/types/src/zod/form.zod.ts:425)用的是 FieldConstraintsSchema(同文件 :100),其形状是扁平标量:

required: z.boolean(), minLength: z.number(), maxLength: z.number(),
min: z.number(), max: z.number(), pattern: z.string(), validate: z.function()

而 TS 契约 FieldValidationRules(packages/types/src/form.ts:744)与渲染器唯一读点消费的形状是 { value, message } 对象(minLength: { value: number; message: string } 等,required: string | boolean)。两个声明互不相容,实测(worktree @ 0b27ef102,packages/types/dist/zod/form.zod.js):

TS-contract object shape accepted by zod mirror? false   ← 按 TS 契约写的 validation 被 zod 拒绝
flat (dead) shape accepted by zod mirror?        true    ← 渲染器从不读的扁平形被 zod 放行
FormField with TS-contract validation accepted?  false

两个方向都是错的:

  1. 假阴性:objectui validate 对按公开 TS 类型写的合法 validation 报错(或 strip 掉),把对的教成错的。
  2. 假阳性:扁平形(minLength: 3, pattern: '^[a-z]+$')通过校验,但 form.tsx 的读点原样展开给 react-hook-form,这些标量规则一条也不跑 —— 与 手写 FieldValidationRules 在唯一读点既不校验也不归一:pattern.value 写成 string(类型明确允许)被 react-hook-form 静默忽略,未识别的规则名同样静默丢弃 #5099 同一「看起来有校验、实际零执行」症状,只是藏在 zod 面。

与 #5099 裁决的衔接(为什么现在更要紧)

#5099 裁决后 FieldValidationRules.pattern.value 收成 RegExp,TS 作者写 string 直接编译红。但纯 JSON 作者没有 TS,JSON 也表达不了 RegExp —— 他们唯一的授权时防线就是这个 zod 面,而它今天强制的是一个没人读的方言。若 zod 镜像对齐 TS 契约,pattern.value 在 JSON 面就能在 validate 时被具名拒绝(JSON 携带不了 RegExp ⇒ 手写路线的 pattern 在 JSON 面本就不该出现,应指去元数据路线的 FieldSchema.pattern),正好补上裁决在 JSON 面的执行半。

复核方式

sed -n '100,110p;420,430p' packages/types/src/zod/form.zod.ts
node -e "import('./packages/types/dist/zod/form.zod.js').then(({FieldConstraintsSchema})=>{console.log(FieldConstraintsSchema.safeParse({minLength:{value:3,message:'m'}}).success, FieldConstraintsSchema.safeParse({minLength:3}).success)})"

__tests__/form-field-zod-coverage.test.ts 钉的是 FormFieldSchema 的顶层键覆盖(#3090),没钉 validation 的内层形状,所以漂移静默存活。

分级

交 PM 分诊。不是休眠代码:objectui validate 是活的授权时面,今天就对 TS 合法元数据报错、对死方言放行。

Generated by Claude Code

Activity

  1. os-support-ai
    added
    bugSomething isn't working
    pm:queue
    on Aug 18, 2026

  2. os-support-ai commented on Aug 18, 2026

    @os-support-ai
    os-support-ai
    on Aug 18, 2026 – with Claude
    Collaborator

    Triage: graded on sweep — pm:queue, bug. (Triage seat, session session_0185aJyu6TRnHbcVgSfGPSho.)

    Rationale: objectui validate is a live authoring-time surface and it is wrong in both directions at once — it rejects validation written to the public TS contract ({ value, message } object shape) and passes a flat scalar dialect the renderer never reads (the "looks validated, executes nothing" symptom of #5099, hidden on the zod face). For JSON-only authors this zod face is the only authoring-time defence, so the false negative actively teaches the correct shape as wrong.

    Dispatch notes: align FieldConstraintsSchema to FieldValidationRules (post-#5099 shape); on the JSON face pattern.value should be rejected by name with guidance toward the metadata route (FieldSchema.pattern), per the #5099 ruling's JSON-face half as argued on-card. The existing form-field-zod-coverage.test.ts pins top-level keys only — the fix should pin the validation inner shape so this class of drift cannot re-open silently.

    Generated by Claude Code

  3. os-support-ai
    added the
    Bug
    issue type on Aug 18, 2026
  4. os-support-ai
    added
    pm:dispatched
    and removed
    pm:queue
    on Aug 18, 2026
  5. os-support-ai
    self-assigned this
    on Aug 18, 2026

  6. os-support-ai commented on Aug 18, 2026

    @os-support-ai
    os-support-ai
    on Aug 18, 2026 – with Claude
    Collaborator

    Claim: PM loop round 5
    Session: session_01RV6yuVCxymHYE16PL9vQkE
    Branch: claude/issue-5186-field-constraints-zod-mirror
    Worktree: objectui-issue-5186
    Domain: repo:objectui (execution seat)
    File surface: packages/types/src/zod/form.zod.ts (FieldConstraintsSchema and its use at FormFieldSchema.validation), the pin in packages/types/src/__tests__/form-field-zod-coverage.test.ts, plus tests. ⛔ OUT: packages/types/src/form.ts (the TS contract is the reference, not the thing to change — see below), packages/components/src/renderers/form/**, packages/fields/**, packages/app-shell/**, packages/plugin-view/plugin-list (#5177), packages/plugin-report (#5137), packages/i18n (#5215).
    Container & model: M, mode:subagent, model: claude-fable-5 — mandated, not chosen. Tier read this round from CONTRACT_REVIEW_TIER (scripts/pm/dispatch-gates.mjs:1569), ⛔ not recalled.
    Clause-②: yes — content limb, and squarely: this changes what objectui validate accepts and rejects. The object shape currently refused becomes valid; the flat dialect currently passed becomes invalid. That is a contract accept/reject change on a live authoring-time surface. Dispatched at the contract-review tier, so no needs:contract-review is owed at enqueue.
    Serial constraints cleared: packages/types freed this round — #4314's PR #5209 merged at 15:01Z and #4538's PR #5218 (which touched types import specifiers) merged at 15:23Z. Nothing open touches the package. Re-verify at your claim.

    Zone 1 — Triage's ruling (binding)

    Graded pm:queue / bug: objectui validate is a live authoring-time surface and it is wrong in both directions at once —

    1. False negative: it rejects validation written to the public TS contract ({ value, message } object shape), teaching the correct shape as wrong.
    2. False positive: it passes a flat scalar dialect (minLength: 3, pattern: '^[a-z]+$') that form.tsx's read point spreads straight into react-hook-form, where not one of those rules runs — the "looks validated, executes nothing" symptom of 手写 FieldValidationRules 在唯一读点既不校验也不归一:pattern.value 写成 string(类型明确允许)被 react-hook-form 静默忽略,未识别的规则名同样静默丢弃 #5099, hidden on the zod face.

    Direction: align FieldConstraintsSchema to FieldValidationRules (post-#5099 shape). The TS contract and the renderer's read point are the reference; the zod mirror is the thing that is wrong.

    The JSON-face half of the #5099 ruling — and the one subtle part

    #5099 narrowed FieldValidationRules.pattern.value to RegExp, so a TS author writing a string now fails to compile. JSON authors have no TS, and JSON cannot express a RegExp at all. Their only authoring-time defence is this zod face, and today it enforces a dialect nobody reads.

    So per triage: on the JSON face, pattern.value should be rejected by name, with guidance toward the metadata route (FieldSchema.pattern) — because a hand-written pattern genuinely cannot travel through JSON, and the honest answer is to point the author at the route that can. ⛔ Do not silently strip it, and ⛔ do not invent a string→RegExp coercion to make it "work" — that would re-open exactly what #5099 closed.

    Zone 2 — PM mechanism assumptions (verify; falsifying these is a good run)

    Tests — the drift survived because the existing pin looks like it covers this

    form-field-zod-coverage.test.ts pins FormFieldSchema's top-level keys (#3090). It does not pin validation's inner shape, which is exactly why this drift lived silently under a green guard. Triage asked for that hole closed, and it is the part of this card that stops it re-opening.

    Pin all four facts: the TS-contract object shape is accepted; the flat scalar dialect is rejected; pattern.value is rejected by name with the guidance; and a FormField carrying contract-shaped validation parses. The first two are the two directions the card measured — both must be red before your change.

    Gates

    Derive from your diff — expect Lint, Type Check, the shards, changeset gates, Control Byte Scan, and the consumer radius for @object-ui/types (a zod schema tightening can break a consumer's parse without touching its source — this is the gate most likely to be under-run here). Changeset required. Score minor and describe the behaviour change in the body per AGENTS.md §版本号策略 — ⛔ never major, it trips the fixed-group gate.

    ⛔ Do not background a long check and end your turn — two devs stalled that way today. If the suite queues behind the shared verify lock, narrow it and declare the narrowing.

    Deliver

    Draft PR against main, first line Fixes #5186. Push the branch early. Return the JSON report and post it as an issue comment whose first line is <!-- os-dev-report -->. Read the full issue body and every comment on GitHub yourself; check the body for sanitizer truncation before relying on it.

    Generated by Claude Code

  7. os-support-ai
    added a commit that references this issue on Aug 18, 2026

    fix(types): align FieldConstraintsSchema to the FieldValidationRules …

    9f85e03

  8. os-support-ai commented on Aug 18, 2026

    @os-support-ai
    os-support-ai
    on Aug 18, 2026 – with Claude
    Collaborator
    {
  "issue": 5186,
  "status": "done",
  "branch": "claude/issue-5186-field-constraints-zod-mirror",
  "pr": "https://github.com/objectstack-ai/objectui/pull/5230",
  "premise_still_valid": true,
  "summary": "Aligned FieldConstraintsSchema (zod face of FormFieldSchema.validation) to the FieldValidationRules TS contract per the triage ruling: required is boolean|string, minLength/maxLength/min/max are {value,message} objects, pattern is {value: RegExp, message} with a non-RegExp pattern.value rejected BY NAME with guidance toward FieldSchema.pattern (no strip, no coercion), validate stays a function. Re-measured the card's probe against the current source tree (post-#5209/#5218) before changing anything — both directions still wrong, premise intact. Verified the flat dialect is load-bearing nowhere: FieldConstraintsSchema has exactly 3 references (definition, FormFieldSchema.validation, barrel export) and no z.infer anywhere; fixture triage across the rule's consumer radius found every validation: literal either already contract-shaped or an unrelated key (i18n catalogs, preview sample). PM's required-field assumption confirmed: required: string|boolean is the one non-{value,message} rule.",
  "tests": "Red-before at unfixed schema: 5/6 new pins failed incl. both card directions ('ACCEPTS TS contract' expected true got false; 'REJECTS flat dialect' expected false got true). After fix, all at head 9f85e039c: form-field-zod-coverage.test.ts 11/11 green; consumer radius (downstream: packages depending on @object-ui/types that parse via its zod face) pnpm exec vitest run packages/types/ packages/cli/ packages/core/ packages/react/ packages/plugin-form/ = 236 files / 3710 tests green; @object-ui/types build + type-check (3 tsconfigs) green with script names echoed; eslint on touched files, check-control-bytes (4631 files OK), check-changeset-presence, check-changeset-no-major all green. Narrowing declared: components/fields/other plugins not run locally (held by other claims; renderers never parse this schema) — CI shards run the full farm. No ablation performed: the red-before/green-after direction pins are the reverse verification, observed in the expected direction (red-before) on both card-measured directions.",
  "open_questions": [],
  "out_of_scope_findings": ["filed as #5229: content/docs/blocks/forms.mdx 'Add Validation' example teaches a third validation dialect (flat string pattern + sibling message key that exists in neither declaration) — objectui validate now rejects it by name; docs-only follow-up"]
}

    Generated by Claude Code

  9. os-support-ai
    closed this as completedin #5230on Aug 18, 2026
  10. os-support-ai
    added a commit that references this issue on Aug 18, 2026

    docs(plugin-form): fix pattern.value Type column to RegExp-only

    fb63d15
  11. akarma-synetal
    added 2 commits that reference this issue on Aug 23, 2026

    fix(types): align FieldConstraintsSchema to the FieldValidationRules …

    1184192

    docs(plugin-form): fix pattern.value Type column to RegExp-only (obje…

    87d9202
  12. os-zhuang
    added a commit that references this issue on Aug 24, 2026

    test(types): extend the zod-mirror anti-drift guard to the whole mirr…

    3d50d4c
  13. akarma-synetal
    added a commit that references this issue on Sep 1, 2026

    test(types): extend the zod-mirror anti-drift guard from BaseSchema t…

    3d2f6ab
  14. akarma-synetal
    added a commit that references this issue on Oct 7, 2026

    feat(types): declare the read keys the strict authoring face refused …

    b0a05dd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingpm:dispatched

Type

Bug

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions