{"record":{"id":"f04dfd0086940237","repo":"FlowiseAI/Flowise","slug":"schema-must-start-with-z-object","errorCode":null,"errorMessage":"Schema must start with z.object()","messagePattern":"Schema must start with z\\.object\\(\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/secureZodParser.ts","lineNumber":62,"sourceCode":"    private static cleanSchemaString(schema: string): string {\n        // Remove single-line comments\n        schema = schema.replace(/\\/\\/.*$/gm, '')\n\n        // Remove multi-line comments\n        schema = schema.replace(/\\/\\*[\\s\\S]*?\\*\\//g, '')\n\n        // Normalize whitespace\n        schema = schema.replace(/\\s+/g, ' ').trim()\n\n        return schema\n    }\n\n    private static parseSchemaStructure(schema: string): any {\n        // This is a simplified parser that handles common Zod patterns safely\n        // It does NOT use eval/Function and only handles predefined safe patterns\n\n        if (!schema.startsWith('z.object(')) {\n            throw new Error('Schema must start with z.object()')\n        }\n\n        // Extract the object content\n        const objectMatch = schema.match(/z\\.object\\(\\s*\\{([\\s\\S]*)\\}\\s*\\)/)\n        if (!objectMatch) {\n            throw new Error('Invalid z.object() syntax')\n        }\n\n        const objectContent = objectMatch[1]\n        return this.parseObjectProperties(objectContent)\n    }\n\n    private static parseObjectProperties(content: string): Record<string, any> {\n        const properties: Record<string, any> = {}\n\n        // Split by comma, but handle nested structures\n        const props = this.splitProperties(content)\n","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/secureZodParser.ts#L44-L80","documentation":"After comment-stripping and whitespace normalization, parseSchemaStructure requires the cleaned schema to start literally with 'z.object('. The secure parser only supports top-level objects; bare z.array(...), z.string(), z.tuple(...), or any non-z.object root is rejected. Leading whitespace is fine (cleaning collapses it) but a different root constructor is not.","triggerScenarios":"Schema is 'z.array(z.string())', 'z.string()', 'z.tuple([...])', or begins with a variable/identifier other than 'z.object'.","commonSituations":"Authoring a top-level array or scalar schema; wrapping a schema in a helper variable; copying a partial schema fragment.","solutions":["Wrap the whole schema as a top-level object: z.object({ items: z.array(z.string()) }) instead of a bare z.array(...).","Ensure the first non-whitespace token is exactly 'z.object('."],"exampleFix":"// before\n'z.array(z.string())'\n\n// after\n'z.object({ items: z.array(z.string()) })'","handlingStrategy":"validation","validationCode":"function startsWithZObject(s: string): boolean {\n  return s.replace(/\\/\\/.*$/gm, '').replace(/\\/\\*[\\s\\S]*?\\*\\//g, '').replace(/\\s+/g, ' ').trim().startsWith('z.object(')\n}","typeGuard":"const isTopLevelObjectSchema = (s: string): boolean =>\n  s.replace(/\\s+/g, ' ').trim().startsWith('z.object(')","tryCatchPattern":null,"preventionTips":["Always root the schema in z.object({...}).","Wrap top-level arrays/scalars inside an object: { items: z.array(...) }."],"tags":["zod","schema","parsing"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}