Console: set zod jitless so the boot does not probe eval #13511

Filing-gate category: ① user-visible defect with a named landing site (follow-up owed by landed work: objectstack#25569). Maintainer approved this follow-up (12d).

Reader who acts: the objectui card thread that takes this; one-line change in the Console boot (apps/console/src/main.tsx) plus a test.

Dedupe: repo:objectstack-ai/objectui jitless → 0 hits; zod eval → 0 hits.

Problem

zod v4 decides whether to use its JIT by running Function('') once inside a try/catch (allowsEval). Under the Console document's content-security-policy (objectstack#25569), 'unsafe-eval' is absent whenever the react-pages tier is off (OS_PAGE_REACT=off), so every document load reports one script-src eval refusal. Nothing breaks, but:

• each load sends a CSP violation report, which buries real ones for operators who collect reports;
• once the react-pages tier defaults to off (security order S3), this becomes every deployment.

reach: measured once through the public UI — browser smoke on objectstack#25569's branch with OS_PAGE_REACT=off: exactly one eval refusal per document load, traced to zod's allowsEval probe in the Console bundle. (Not yet measured with jitless set; the card's acceptance check covers that.)

Proposed change

Call z.config({ jitless: true }) at the top of the Console boot, before any schema is built. zod then skips the probe and uses its interpreter path. Apply it unconditionally: the JIT gain on the Console's schemas is negligible, and one code path is simpler than switching on the tier.

Acceptance

• A unit test asserts the Console boot sets jitless (or that building and parsing a schema never calls Function).
• With OS_PAGE_REACT=off and objectstack#25569's policy, a Console load reports no eval violation.

Business rationale: operators who turn on CSP reporting should see only real violations; without this, every page load files a false one.

Generated by Claude Code