@@ -0,0 +1,14 @@
+---
+'@object-ui/types': patch
+---
+
+fix(types): the `@object-ui/types/zod` mirrors keep an unknown key instead of silently dropping it
+
+Clause-②: yes
+Metadata-protocol: none
+
+- **What changed.** 145 objects in the zod mirrors were strip-mode `z.object()`: a misspelled key parsed green and vanished, so `FormFieldSchema.safeParse({ name, type, labell: 'oops' })` succeeded with `labell` gone while `@objectstack/spec` refused it by name. Every one is now `.passthrough()` (`z.looseObject`), like `BaseSchema` already was. The tolerant face keeps the key; the strict authoring face (`StrictAnyComponentSchema`, used by `objectui validate`) still refuses it by name, so the two faces disagree only on keep-or-refuse, never on silently dropping.
+- **What a caller sees.** Nothing new is refused: every document that parsed before parses now. A parsed result now carries the unknown keys its input carried, and the inferred `z.input` / `z.infer` types of those objects gain zod's `[k: string]: unknown` index signature. A declared `interface` is not assignable to a type with that signature; if you assign an interface-typed value to a variable typed by one of these mirrors' `z.input`, type it through the interface or pass it to `parse()`.
+- **Guard.** `zod-mirror-parity.test.ts` now fails on any strip-mode object in `ui/packages/types/src/zod/`.
+
+What to do: nothing, unless you relied on a mirror dropping keys from its parse result; strip them yourself or read only the keys you need.
@@ -49,6 +49,6 @@
       "ui/packages/types"
     ],
     "registrySources": 922,
-    "registrySourcesSha256": "7a4b546825cb499c56c72e11df824357786d9619b78c8835591fbe91a6ae6110"
+    "registrySourcesSha256": "5fd9e0ebfb7dcc37cd51425ed367a00c968012c908c6351b3d736c99cb8b09b8"
   }
 }
@@ -78,6 +78,7 @@ import { describe, it, expect } from 'vitest';
 import {
   ButtonSchema,
   CommandItemSchema,
+  deriveStrictAuthoringSchema,
   MenuItemSchema,
   RadioGroupSchema,
   SelectOptionSchema,
@@ -174,11 +175,15 @@ describe('toast fixtures: the variant value is a declared member (objectui#6157,
   );
 });
 
-describe('command palette fixture: every item key survives a CommandItem parse', () => {
+describe('command palette fixture: every item key is a declared CommandItem key', () => {
   /**
-   * `CommandItemSchema` is a bare `z.object`, so an undeclared key is STRIPPED
-   * and `.success` stays true. Round-trip equality is what detects it.
+   * `CommandItemSchema` is non-strict, so an undeclared key does not fail its
+   * `.success`. It was a bare strip-mode `z.object` and round-trip equality
+   * detected the dropped key; since objectstack#25923 it is `.passthrough()` and
+   * KEEPS the key, so round-trip equality sees nothing either. The strict
+   * authoring twin is the instrument: it refuses an undeclared key by name.
    */
+  const StrictCommandItemSchema = deriveStrictAuthoringSchema(CommandItemSchema);
   const items = (
     (schemaOf('components-form-command/file-command-palette')
       .groups as Json[])[0].items as Json[]
@@ -188,14 +193,14 @@ describe('command palette fixture: every item key survives a CommandItem parse',
     expect(items).toHaveLength(3);
   });
 
-  it.each([0, 1, 2])('item %i loses no authored key when parsed', (i) => {
-    expect(CommandItemSchema.parse(items[i])).toEqual(items[i]);
+  it.each([0, 1, 2])('item %i authors only declared keys', (i) => {
+    expect(StrictCommandItemSchema.safeParse(items[i]).success).toBe(true);
   });
 
   it('counter-probe: an item carrying the removed `shortcut` key fails this same check', () => {
     const withInventedKey = { ...items[0], shortcut: ['Ctrl', 'N'] };
     expect(CommandItemSchema.safeParse(withInventedKey).success).toBe(true);
-    expect(CommandItemSchema.parse(withInventedKey)).not.toEqual(withInventedKey);
+    expect(StrictCommandItemSchema.safeParse(withInventedKey).success).toBe(false);
   });
 });
 
@@ -482,11 +487,20 @@ describe('catalog corpus: every menubar item uses the declared MenuItem spelling
    * expose under any stable public name — and an introspection helper that
    * silently resolved to the wrong node would report a confident, wrong
    * vocabulary. Feeding the schema every candidate key and reading back what
-   * SURVIVES uses the strip behaviour itself as the instrument, so this control
-   * measures the shipped schema instead of the shape of zod's internals.
+   * SURVIVED used the strip behaviour itself as the instrument; since
+   * objectstack#25923 the mirror is `.passthrough()` and every key survives, so
+   * the instrument is now the strict authoring twin: a candidate key is
+   * declared when the base item plus that key alone is ACCEPTED by it. It still
+   * measures the shipped schema, not the shape of zod's internals.
    */
-  function declaredKeysOf(schema: { parse: (v: unknown) => unknown }, probe: Json): string[] {
-    return Object.keys(schema.parse(probe) as Json).sort();
+  const StrictMenuItemSchema = deriveStrictAuthoringSchema(MenuItemSchema);
+  function declaredKeysOf(base: Json, candidates: Json): string[] {
+    return [
+      ...Object.keys(base),
+      ...Object.keys(candidates).filter(
+        (key) => StrictMenuItemSchema.safeParse({ ...base, [key]: candidates[key] }).success,
+      ),
+    ].sort();
   }
 
   /** Depth-first over an items array, descending through submenu `children`. */
@@ -525,20 +539,14 @@ describe('catalog corpus: every menubar item uses the declared MenuItem spelling
   // both a `label` AND `separator: true` matches neither arm cleanly and is
   // not a meaningful "declared keys" instrument any more. `type` is no longer
   // part of this probe at all — see the dedicated refusal pins below, which
-  // is where it moved (a hard refusal, not a strip, can't be read back by
-  // `declaredKeysOf`'s "call `.parse` and see what survives" method, since a
-  // refusal never returns a value to read keys off).
-  const declaredCommandKeys = declaredKeysOf(MenuItemSchema, {
-    label: 'probe',
-    icon: 'file',
-    disabled: false,
-    shortcut: 'Ctrl+T',
-    value: 'probe',
-  });
-  const declaredDividerKeys = declaredKeysOf(MenuItemSchema, {
-    separator: true,
-    value: 'probe',
-  });
+  // is where it moved (`declaredKeysOf` asks the strict twin about one
+  // candidate key at a time; a key refused by a hard rule on the arm itself
+  // would read as "undeclared" there for the wrong reason).
+  const declaredCommandKeys = declaredKeysOf(
+    { label: 'probe' },
+    { icon: 'file', disabled: false, shortcut: 'Ctrl+T', value: 'probe' },
+  );
+  const declaredDividerKeys = declaredKeysOf({ separator: true }, { value: 'probe' });
   const items = allExamples().flatMap((e) => collectMenubarItems(e.schema, e.id));
 
   it('label/icon/disabled/shortcut survive on the command arm; the unknown `value` key does not — the control', () => {
@@ -957,11 +965,13 @@ describe('catalog corpus: no `select` option authors the undeclared `type` key (
     expect(declared).not.toContain('type');
 
     // ...and this is why the corpus assertion below is the instrument rather
-    // than a `.success` probe: the schema is a bare `z.object`, so it STRIPS
-    // the undeclared key and reports success.
+    // than a `.success` probe: the schema is non-strict, so it reports success
+    // on the undeclared key — it STRIPPED it while it was a bare `z.object`, and
+    // keeps it since objectstack#25923 made it `.passthrough()`. Either way the
+    // tolerant parse raises nothing.
     const parsed = SelectOptionSchema.safeParse({ label: 'Option 3', value: '3', type: 'option' });
     expect(parsed.success).toBe(true);
-    expect(Object.keys((parsed as unknown as { data: Json }).data)).not.toContain('type');
+    expect(Object.keys((parsed as unknown as { data: Json }).data)).toContain('type');
   });
 
   it('no `select` option authors `type`', () => {
 
@@ -66,7 +66,7 @@ import React from 'react';
 import { describe, it, expect } from 'vitest';
 import { render, screen, within, act } from '@testing-library/react';
 import '@testing-library/jest-dom';
-import { KanbanColumnSchema, ObjectKanbanSchema } from '@object-ui/types/zod';
+import { KanbanColumnSchema, ObjectKanbanSchema, deriveStrictAuthoringSchema } from '@object-ui/types/zod';
 
 import { KanbanRenderer } from '../index';
 // Pay the board's lazy chunk at import time rather than inside a `findBy`
@@ -121,15 +121,16 @@ describe('both published faces declare the key (objectui#9628)', () => {
     expect(parsed.success && (parsed.data as { collapsed?: boolean }).collapsed).toBe(true);
   });
 
-  it('CONTROL — an undeclared lane key is dropped rather than kept, so the two above are readings', () => {
-    const parsed = KanbanColumnSchema.safeParse({
-      id: 'todo',
-      title: 'To Do',
-      cards: [],
-      collapsedd: true,
-    });
-    expect(parsed.success).toBe(true);
-    expect(parsed.success && 'collapsedd' in (parsed.data as object)).toBe(false);
+  it('CONTROL — the strict twin refuses an undeclared lane key and accepts `collapsed`, so the two above are readings', () => {
+    // The tolerant mirror keeps an undeclared key since objectstack#25923 made
+    // every mirror object `.passthrough()` (it was dropped before), so survival
+    // through a tolerant parse no longer tells a declared key from an
+    // undeclared one. The strict authoring twin does: it refuses by name.
+    const strict = deriveStrictAuthoringSchema(KanbanColumnSchema);
+    const lane = { id: 'todo', title: 'To Do', cards: [] };
+    expect(KanbanColumnSchema.safeParse({ ...lane, collapsedd: true }).success).toBe(true);
+    expect(strict.safeParse({ ...lane, collapsedd: true }).success).toBe(false);
+    expect(strict.safeParse({ ...lane, collapsed: true }).success).toBe(true);
   });
 });
 
 
@@ -69,10 +69,13 @@ describe('AccordionItem: `icon` is retired from the authoring surface (objectui#
     expect(item.value).toBe('section-1');
   });
 
-  it('drops `icon` when parsing through the Zod mirror', () => {
-    // `z.object` is non-strict, so an authored `icon` is not an error — it is
-    // simply not part of the declared surface any more, and parse output is
-    // the observable statement of what that surface contains.
+  it('keeps `icon` as an undeclared key when parsing through the Zod mirror', () => {
+    // The mirror is non-strict, so an authored `icon` is not an error — it is
+    // simply not part of the declared surface any more. It was DROPPED from the
+    // parse output while the mirror was strip mode; since objectstack#25923 the
+    // mirror is `.passthrough()`, so it rides through undeclared (the strict
+    // authoring face refuses it by name). The shape test below is the statement
+    // of what the declared surface contains.
     const parsed = AccordionItemSchema.parse({
       value: 'section-1',
       title: 'Section 1',
@@ -84,8 +87,8 @@ describe('AccordionItem: `icon` is retired from the authoring surface (objectui#
       value: 'section-1',
       title: 'Section 1',
       content: 'Content for section 1',
+      icon: 'chevron',
     });
-    expect('icon' in parsed).toBe(false);
   });
 
   it('keeps `icon` out of the Zod schema shape', () => {
 
@@ -48,6 +48,7 @@ import { fileURLToPath } from 'node:url';
 
 import { describe, expect, it } from 'vitest';
 import { z } from 'zod';
+import type { WithoutCatchall } from './zod-catchall-type';
 
 import {
   AIConfigSchema,
@@ -79,8 +80,9 @@ type Expect<T extends true> = T;
 
 /** The mirror's own shape. */
 type ShapeOf<M> = M extends { shape: infer S } ? S : never;
-/** What a shape entry ACCEPTS (input side, so `.optional()` shows). */
-type InputOf<T> = T extends z.ZodType ? z.input<T> : never;
+/** What a shape entry ACCEPTS (input side, so `.optional()` shows), read without the
+ * `.passthrough()` catchall every mirror object carries since objectstack#25923 (`./zod-catchall-type`). */
+type InputOf<T> = T extends z.ZodType ? WithoutCatchall<z.input<T>> : never;
 /** The declaration's DECLARED keys — any index signature dropped (`BaseSchema` carried one until objectui#8347). */
 type DeclaredKeys<D> = Extract<
   keyof { [K in keyof D as string extends K ? never : number extends K ? never : K]: D[K] },
 
@@ -212,8 +212,8 @@ describe('objectui#7719 — the JSON face refuses `shortcut` by name', () => {
 
 /* ── (c) why it had to be a refusal — the SILENT STRIP, measured here ─────── */
 
-describe('objectui#7719 — a bare non-declaration strips in silence; it refuses nothing', () => {
-  it('an UNDECLARED sibling key is accepted and STRIPPED — it never reaches `.data`', () => {
+describe('objectui#7719 — a bare non-declaration refuses nothing', () => {
+  it('an UNDECLARED sibling key is accepted — it is not refused', () => {
     // THE LOAD-BEARING ROW of this file: without it, "leaving `shortcut`
     // undeclared would not have refused it" is unfalsifiable prose. Here it is a
     // reading taken on this very schema. `keyboardShortcut` is declared nowhere;
@@ -228,10 +228,16 @@ describe('objectui#7719 — a bare non-declaration strips in silence; it refuses
     // PROVING REMOVAL: append `.passthrough()` to the object inside the `z.lazy`
     // and the second assertion reds (the key survives) while the first stays
     // green — which is exactly how this row tells the two mechanisms apart.
+    //
+    // objectstack#25923 made that object `.passthrough()` — every mirror object
+    // is, so none drops an authored key in silence — and the key now SURVIVES
+    // into `.data`, as on `DetailViewSchema`. The load-bearing half is
+    // unchanged: the parse SUCCEEDS, so leaving `shortcut` undeclared would
+    // still not have refused it.
     const r = MenuItemSchema.safeParse({ type: 'item', label: 'Profile', keyboardShortcut: 'Ctrl+P' });
     expect(r.success).toBe(true);
     if (!r.success) return;
-    expect(Object.keys(r.data as Record<string, unknown>)).not.toContain('keyboardShortcut');
+    expect(Object.keys(r.data as Record<string, unknown>)).toContain('keyboardShortcut');
   });
 
   it('and the tombstoned key does NOT get that treatment — the pair is the whole argument', () => {
 
@@ -95,6 +95,7 @@
 
 import { describe, it, expect } from 'vitest';
 import type { z } from 'zod';
+import type { WithoutCatchall } from './zod-catchall-type';
 import type { BaseSchema } from '../base';
 import type { ExpressionWire } from '../expression';
 import { BaseSchema as Mirror } from '../zod/base.zod';
@@ -123,9 +124,13 @@ export type assertionWireShape = Expect<
   Equal< ExpressionWire, string | { dialect?: string; source: string } >
 >;
 
-/** The two faces of the wire type are one union. */
+/**
+ * The two faces of the wire type are one union — the zod face read without the
+ * `.passthrough()` catchall its envelope carries since objectstack#25923
+ * (`./zod-catchall-type`), which refuses nothing.
+ */
 export type assertionTwinParity = Expect<
-  Equal< ExpressionWire, z.input< typeof ExpressionWireSchema > >
+  Equal< ExpressionWire, WithoutCatchall< z.input< typeof ExpressionWireSchema > > >
 >;
 
 /** The helper can FAIL -- the old union is not the new one. */
 
@@ -210,9 +210,11 @@ describe('objectui#6896 — the counter-probe: a deletion would restore the sile
   });
 
   it('an UNDECLARED key still rides through — the silence a tombstone is measured against', () => {
+    // It rides through UNREFUSED; since objectstack#25923 the mirror is
+    // `.passthrough()`, so the key is kept in the output rather than dropped.
     const result = ChartDataSeriesSchema.safeParse({ ...LIVE_SERIES, notAKeyAtAll: 'anything' });
     expect(result.success).toBe(true);
-    if (result.success) expect(result.data).not.toHaveProperty('notAKeyAtAll');
+    if (result.success) expect(result.data).toHaveProperty('notAKeyAtAll', 'anything');
   });
 });
 
 
@@ -161,13 +161,15 @@ describe('objectui#7694 — when BOTH spellings are written the document is refu
     if (r.success) expect(r.data).toEqual({ name: 'r', type: 'line' });
   });
 
-  it('CONTROL — a truly undeclared key is STILL stripped in silence: the object is non-strict, which is why the arm exists', () => {
+  it('CONTROL — a truly undeclared key is STILL accepted: the object is non-strict, which is why the arm exists', () => {
     // The deletion-not-chosen. This is what `chartType` looked like on the
     // base, and what it would look like again if someone "simplified" the arm
-    // away. `chart-series-keys-7546.test.ts` (e) pins the same fact.
+    // away. `chart-series-keys-7546.test.ts` (e) pins the same fact. It was
+    // stripped while the mirror was strip mode; since objectstack#25923 the
+    // mirror is `.passthrough()` and the key is kept.
     const r = ChartDataSeriesSchema.safeParse({ name: 'r', notAKeyAtAll: 'x' });
     expect(r.success).toBe(true);
-    if (r.success) expect(r.data).not.toHaveProperty('notAKeyAtAll');
+    if (r.success) expect(r.data).toHaveProperty('notAKeyAtAll', 'x');
   });
 });
Original file line number	Diff line number	Diff line change
`@@ -49,6 +49,6 @@`
`49`	`49`	`"ui/packages/types"`
`50`	`50`	`],`
`51`	`51`	`"registrySources": 922,`
`52`		`- "registrySourcesSha256": "7a4b546825cb499c56c72e11df824357786d9619b78c8835591fbe91a6ae6110"`
	`52`	`+ "registrySourcesSha256": "5fd9e0ebfb7dcc37cd51425ed367a00c968012c908c6351b3d736c99cb8b09b8"`
`53`	`53`	`}`
`54`	`54`	`}`