Replace z.any() in UI schemas, add cross-reference validation for seed data and navigation, add negative validation tests

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

packages/spec/src/stack.test.ts

@@ -847,3 +847,116 @@ describe('defineStack - Map Format Support', () => {
     expect(result.views![0].list?.type).toBe('grid');
   });
 });
+
+// ============================================================================
+// Negative / Inverse Validation Tests — Cross-Reference
+// ============================================================================
+
+describe('defineStack - Seed Data Cross-Reference Validation', () => {
+  const baseManifest = {
+    id: 'com.example.test',
+    name: 'test-project',
+    version: '1.0.0',
+    type: 'app' as const,
+  };
+
+  it('should detect seed data referencing undefined object', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'account', fields: { name: { type: 'text' } } },
+      ],
+      data: [
+        { object: 'ghost_object', records: [{ name: 'Test' }] },
+      ],
+    };
+    expect(() => defineStack(config)).toThrow('ghost_object');
+    expect(() => defineStack(config)).toThrow('cross-reference validation failed');
+  });
+
+  it('should pass when seed data references defined object', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'account', fields: { name: { type: 'text' } } },
+      ],
+      data: [
+        { object: 'account', records: [{ name: 'Acme Corp' }] },
+      ],
+    };
+    expect(() => defineStack(config)).not.toThrow();
+  });
+});
+
+describe('defineStack - Navigation Cross-Reference Validation', () => {
+  const baseManifest = {
+    id: 'com.example.test',
+    name: 'test-project',
+    version: '1.0.0',
+    type: 'app' as const,
+  };
+
+  it('should detect navigation referencing undefined object', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'task', fields: { title: { type: 'text' } } },
+      ],
+      apps: [
+        {
+          name: 'my_app',
+          label: 'My App',
+          navigation: [
+            { id: 'nav_missing', type: 'object' as const, label: 'Missing', objectName: 'nonexistent_object' },
+          ],
+        },
+      ],
+    };
+    expect(() => defineStack(config)).toThrow('nonexistent_object');
+  });
+
+  it('should detect navigation referencing undefined dashboard', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'task', fields: { title: { type: 'text' } } },
+      ],
+      dashboards: [
+        { name: 'sales_dashboard', label: 'Sales', widgets: [] },
+      ],
+      apps: [
+        {
+          name: 'my_app',
+          label: 'My App',
+          navigation: [
+            { id: 'nav_ghost', type: 'dashboard' as const, label: 'Missing', dashboardName: 'ghost_dashboard' },
+          ],
+        },
+      ],
+    };
+    expect(() => defineStack(config)).toThrow('ghost_dashboard');
+  });
+
+  it('should pass when all navigation references are valid', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'task', fields: { title: { type: 'text' } } },
+      ],
+      dashboards: [
+        { name: 'task_overview', label: 'Overview', widgets: [] },
+      ],
+      apps: [
+        {
+          name: 'my_app',
+          label: 'My App',
+          navigation: [
+            { id: 'nav_tasks', type: 'object' as const, label: 'Tasks', objectName: 'task' },
+            { id: 'nav_overview', type: 'dashboard' as const, label: 'Overview', dashboardName: 'task_overview' },
+          ],
+        },
+      ],
+    };
+    expect(() => defineStack(config)).not.toThrow();
+  });
+});

packages/spec/src/stack.zod.ts

@@ -332,6 +332,74 @@ function validateCrossReferences(config: ObjectStackDefinition): string[] {
     }
   }
 
+  // Validate seed data → object references
+  if (config.data) {
+    for (const dataset of config.data) {
+      if (dataset.object && !objectNames.has(dataset.object)) {
+        errors.push(
+          `Seed data references object '${dataset.object}' which is not defined in objects.`,
+        );
+      }
+    }
+  }
+
+  // Validate app navigation → object/dashboard/page/report references
+  if (config.apps) {
+    const dashboardNames = new Set<string>();
+    if (config.dashboards) {
+      for (const d of config.dashboards) {
+        dashboardNames.add(d.name);
+      }
+    }
+    const pageNames = new Set<string>();
+    if (config.pages) {
+      for (const p of config.pages) {
+        pageNames.add(p.name);
+      }
+    }
+    const reportNames = new Set<string>();
+    if (config.reports) {
+      for (const r of config.reports) {
+        reportNames.add(r.name);
+      }
+    }
+
+    for (const app of config.apps) {
+      if (!app.navigation) continue;
+      const checkNavItems = (items: unknown[], appName: string) => {
+        for (const item of items) {
+          if (!item || typeof item !== 'object') continue;
+          const nav = item as Record<string, unknown>;
+          if (nav.type === 'object' && typeof nav.objectName === 'string' && !objectNames.has(nav.objectName)) {
+            errors.push(
+              `App '${appName}' navigation references object '${nav.objectName}' which is not defined in objects.`,
+            );
+          }
+          if (nav.type === 'dashboard' && typeof nav.dashboardName === 'string' && dashboardNames.size > 0 && !dashboardNames.has(nav.dashboardName)) {
+            errors.push(
+              `App '${appName}' navigation references dashboard '${nav.dashboardName}' which is not defined in dashboards.`,
+            );
+          }
+          if (nav.type === 'page' && typeof nav.pageName === 'string' && pageNames.size > 0 && !pageNames.has(nav.pageName)) {
+            errors.push(
+              `App '${appName}' navigation references page '${nav.pageName}' which is not defined in pages.`,
+            );
+          }
+          if (nav.type === 'report' && typeof nav.reportName === 'string' && reportNames.size > 0 && !reportNames.has(nav.reportName)) {
+            errors.push(
+              `App '${appName}' navigation references report '${nav.reportName}' which is not defined in reports.`,
+            );
+          }
+          // Recurse into group children
+          if (nav.type === 'group' && Array.isArray(nav.children)) {
+            checkNavItems(nav.children, appName);
+          }
+        }
+      };
+      checkNavItems(app.navigation, app.name);
+    }
+  }
+
   return errors;
 }
 

packages/spec/src/ui/component.zod.ts

@@ -1,6 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { z } from 'zod';
+import { FilterConditionSchema } from '../data/filter.zod';
 import { I18nLabelSchema, AriaPropsSchema } from './i18n.zod';
 import { FeedItemType, FeedFilterMode } from '../data/feed.zod';
 
@@ -184,7 +185,7 @@ export const ElementNumberPropsSchema = z.object({
   field: z.string().optional().describe('Field to aggregate'),
   aggregate: z.enum(['count', 'sum', 'avg', 'min', 'max'])
     .describe('Aggregation function'),
-  filter: z.any().optional().describe('Filter criteria'),
+  filter: FilterConditionSchema.optional().describe('Filter criteria'),
   format: z.enum(['number', 'currency', 'percent']).optional().describe('Number display format'),
   prefix: z.string().optional().describe('Prefix text (e.g. "$")'),
   suffix: z.string().optional().describe('Suffix text (e.g. "%")'),
@@ -247,7 +248,7 @@ export const ElementRecordPickerPropsSchema = z.object({
   object: z.string().describe('Object to pick records from'),
   displayField: z.string().describe('Field to display as the record label'),
   searchFields: z.array(z.string()).optional().describe('Fields to search against'),
-  filter: z.any().optional().describe('Filter criteria for available records'),
+  filter: FilterConditionSchema.optional().describe('Filter criteria for available records'),
   multiple: z.boolean().optional().default(false).describe('Allow multiple record selection'),
   targetVariable: z.string().optional().describe('Page variable to bind selected record ID(s)'),
   placeholder: I18nLabelSchema.optional().describe('Placeholder text'),

packages/spec/src/ui/dashboard.test.ts

@@ -1597,3 +1597,91 @@ describe('DashboardWidgetSchema - pivot/funnel/grouped-bar types', () => {
     expect(dashboard.widgets[2].measures).toHaveLength(3);
   });
 });
+
+// ============================================================================
+// Negative / Inverse Validation Tests
+// ============================================================================
+
+describe('DashboardWidgetSchema - Negative Validation', () => {
+  it('should reject widget without layout', () => {
+    expect(() => DashboardWidgetSchema.parse({
+      title: 'Bad Widget',
+      type: 'metric',
+    })).toThrow();
+  });
+
+  it('should reject widget with invalid type enum', () => {
+    expect(() => DashboardWidgetSchema.parse({
+      type: 'nonexistent_chart',
+      layout: { x: 0, y: 0, w: 4, h: 2 },
+    })).toThrow();
+  });
+
+  it('should reject widget with non-numeric layout values', () => {
+    expect(() => DashboardWidgetSchema.parse({
+      type: 'metric',
+      layout: { x: 'a', y: 0, w: 4, h: 2 },
+    })).toThrow();
+  });
+
+  it('should reject widget with incomplete layout', () => {
+    expect(() => DashboardWidgetSchema.parse({
+      type: 'metric',
+      layout: { x: 0, y: 0 },
+    })).toThrow();
+  });
+
+  it('should reject widget with invalid aggregate enum', () => {
+    expect(() => DashboardWidgetSchema.parse({
+      type: 'metric',
+      aggregate: 'median',
+      layout: { x: 0, y: 0, w: 4, h: 2 },
+    })).toThrow();
+  });
+});
+
+describe('DashboardSchema - Negative Validation', () => {
+  it('should reject dashboard without name', () => {
+    expect(() => DashboardSchema.parse({
+      label: 'No Name Dashboard',
+      widgets: [],
+    })).toThrow();
+  });
+
+  it('should reject dashboard without label', () => {
+    expect(() => DashboardSchema.parse({
+      name: 'no_label',
+      widgets: [],
+    })).toThrow();
+  });
+
+  it('should reject dashboard without widgets', () => {
+    expect(() => DashboardSchema.parse({
+      name: 'no_widgets',
+      label: 'Missing Widgets',
+    })).toThrow();
+  });
+
+  it('should reject dashboard with camelCase name', () => {
+    expect(() => DashboardSchema.parse({
+      name: 'salesDashboard',
+      label: 'Bad Name',
+      widgets: [],
+    })).toThrow();
+  });
+});
+
+describe('GlobalFilterSchema - Negative Validation', () => {
+  it('should reject filter without field', () => {
+    expect(() => GlobalFilterSchema.parse({
+      label: 'No Field',
+    })).toThrow();
+  });
+
+  it('should reject filter with invalid type enum', () => {
+    expect(() => GlobalFilterSchema.parse({
+      field: 'status',
+      type: 'invalid_type',
+    })).toThrow();
+  });
+});

packages/spec/src/ui/dashboard.zod.ts

@@ -186,15 +186,15 @@ export const GlobalFilterSchema = z.object({
 
   /** Static options for select/lookup filters */
   options: z.array(z.object({
-    value: z.any(),
+    value: z.union([z.string(), z.number(), z.boolean()]).describe('Option value'),
     label: I18nLabelSchema,
   })).optional().describe('Static filter options'),
 
   /** Dynamic data binding for filter options */
   optionsFrom: GlobalFilterOptionsFromSchema.optional().describe('Dynamic filter options from object'),
 
   /** Default filter value */
-  defaultValue: z.any().optional().describe('Default filter value'),
+  defaultValue: z.union([z.string(), z.number(), z.boolean()]).optional().describe('Default filter value'),
 
   /** Filter application scope */
   scope: z.enum(['dashboard', 'widget']).default('dashboard').describe('Filter application scope'),