fix(policy): when using zod4, during handling of @password, schemas from different zod versions may be mixed up

[ymc9]

No description provided.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds runtime support for multiple Zod versions (v3 and v4) by introducing a version-selection mechanism in the policy utility layer, and converts zod imports to type-only in two validation modules to reduce runtime dependencies.

Changes

Cohort / File(s)	Summary
Multi-version Zod support packages/runtime/src/enhancements/node/policy/policy-utils.ts	Introduces runtime Zod version detection via a useZod selector that chooses between v3 and v4 implementations based on schema structure (_def property check). Applied to field schema construction and password field overrides. Minor multi-line formatting adjustment to adjacent conditional logic.
Type-only imports packages/runtime/src/validation.ts, packages/runtime/src/zod-utils.ts	Converts runtime zod imports to type-only imports (import type { z } from 'zod'), eliminating runtime module loading while preserving type safety in compile-time type positions.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• PR #2005: Modifies policy-utils.ts password field override handling in the context of Zod schema compatibility.
• PR #2234: Addresses multi-version Zod runtime handling and compatibility in zod-utils.ts.
• PR #2216: Modifies the same files (policy-utils.ts, validation.ts) with related Zod import and usage changes.

Pre-merge checks and finishing touches

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	No description was provided by the author, making it impossible to verify if it relates to the changeset.	Add a description explaining the bug, its impact, and how the fix addresses the Zod version mixing issue.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: fixing a bug where different Zod versions could be mixed during @password schema handling.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/zod4-mix-up

---

📜 Recent review details

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 961603a and 5aac7a4.

⛔ Files ignored due to path filters (1)

• package.json is excluded by !**/*.json

📒 Files selected for processing (3)

• packages/runtime/src/enhancements/node/policy/policy-utils.ts
• packages/runtime/src/validation.ts
• packages/runtime/src/zod-utils.ts

🧰 Additional context used

🧬 Code graph analysis (1)

packages/runtime/src/enhancements/node/policy/policy-utils.ts (1)

packages/runtime/src/local-helpers/lower-case-first.ts (1)

• lowerCaseFirst (1-3)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: build-test (20.x)
• GitHub Check: dependency-review
• GitHub Check: build-test (20.x)
• GitHub Check: build-test (20.x)

🔇 Additional comments (5)

packages/runtime/src/validation.ts (1)

1-1: LGTM! Type-only import is appropriate.

The change to a type-only import is correct since z is only used for type annotations (z.ZodType, z.ZodError) and not at runtime. This aligns with the multi-version Zod support strategy.

packages/runtime/src/zod-utils.ts (1)

2-2: LGTM! Type-only import is correct.

The change is safe since Z (uppercase) is exclusively used for type annotations (e.g., Z.ZodSchema, Z.ZodObject), while all runtime Zod operations use the lowercase z parameter passed into functions.

packages/runtime/src/enhancements/node/policy/policy-utils.ts (3)

4-6: LGTM! Multi-version Zod support structure is sound.

The import strategy enables runtime support for both Zod v3 and v4 by importing both versions while keeping type imports separate. This provides the foundation for version-specific schema handling.

---

1547-1556: Formatting improvement noted.

The conditional block has been reformatted to multi-line for better readability. No functional change.

---

381-398: The code snippet provided does not match the review comment's content.

The code shown at lines 381-398 contains the getFieldOverrideUpdateAuthGuard function, which handles policy-level authorization guards and has no connection to Zod schema version detection. The actual Zod version detection logic using schema._def ? zod3 : zod4 exists elsewhere in the file (line 1381 in the overridePasswordFields function), not at the specified lines. Please correct the line numbers and code snippet.

Likely an incorrect or invalid review comment.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}