FlowiseAI/Flowise · error · Error

Schema must start with z.object()

Error message

Schema must start with z.object()

What it means

After comment-stripping and whitespace normalization, parseSchemaStructure requires the cleaned schema to start literally with 'z.object('. The secure parser only supports top-level objects; bare z.array(...), z.string(), z.tuple(...), or any non-z.object root is rejected. Leading whitespace is fine (cleaning collapses it) but a different root constructor is not.

Source

Thrown at packages/components/src/secureZodParser.ts:62

    private static cleanSchemaString(schema: string): string {
        // Remove single-line comments
        schema = schema.replace(/\/\/.*$/gm, '')

        // Remove multi-line comments
        schema = schema.replace(/\/\*[\s\S]*?\*\//g, '')

        // Normalize whitespace
        schema = schema.replace(/\s+/g, ' ').trim()

        return schema
    }

    private static parseSchemaStructure(schema: string): any {
        // This is a simplified parser that handles common Zod patterns safely
        // It does NOT use eval/Function and only handles predefined safe patterns

        if (!schema.startsWith('z.object(')) {
            throw new Error('Schema must start with z.object()')
        }

        // Extract the object content
        const objectMatch = schema.match(/z\.object\(\s*\{([\s\S]*)\}\s*\)/)
        if (!objectMatch) {
            throw new Error('Invalid z.object() syntax')
        }

        const objectContent = objectMatch[1]
        return this.parseObjectProperties(objectContent)
    }

    private static parseObjectProperties(content: string): Record<string, any> {
        const properties: Record<string, any> = {}

        // Split by comma, but handle nested structures
        const props = this.splitProperties(content)

View on GitHub (pinned to abe4a8601a)

Solutions

1. Wrap the whole schema as a top-level object: z.object({ items: z.array(z.string()) }) instead of a bare z.array(...).
2. Ensure the first non-whitespace token is exactly 'z.object('.

Example fix

// before
'z.array(z.string())'

// after
'z.object({ items: z.array(z.string()) })'

function startsWithZObject(s: string): boolean {
  return s.replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '').replace(/\s+/g, ' ').trim().startsWith('z.object(')
}

const isTopLevelObjectSchema = (s: string): boolean =>
  s.replace(/\s+/g, ' ').trim().startsWith('z.object(')

When it happens

Trigger: Schema is 'z.array(z.string())', 'z.string()', 'z.tuple([...])', or begins with a variable/identifier other than 'z.object'.

Common situations: Authoring a top-level array or scalar schema; wrapping a schema in a helper variable; copying a partial schema fragment.

Related errors

• Failed to parse Zod schema: ${error.message}
• Invalid z.object() syntax
• Invalid object syntax
• Expected 'z' but got '${part}'
• Invalid base type: ${part}

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/f04dfd0086940237. Report an issue: GitHub.