Zod Schema

Use this capability whenever a change touches Zod — a schema being written, a parse being placed, a payload being decoded, or an error being surfaced. It owns the schema layer: the shape, the parse call, the type that shape yields, the error it produces, and the codec that carries data between a wire format and a domain model.

It does not own four neighbouring questions, each owned by a capability of its own:

• Whether an input is untrusted at all, and so must be checked — an application-security capability's judgment. This skill assumes that judgment is made and says how Zod carries it out.
• That a hook exists for the parse to sit inside — a route handler, a server function, a form action — a framework capability's fact.
• When a fetched payload is refetched, cached, or invalidated — a server-state capability's concern. This skill only puts a parse inside the query function it owns.
• How a component receives, renders, and is tested against the parsed result — a component-development capability's concern.

Where a rule here has a counterpart in one of those, this skill states the Zod mechanism and names the other as owner.

Version discipline. This skill is written against Zod 4 only. Zod 3 is out of scope as a supported line: no migration path, no zod/v3 guidance, and no rule stated in its Zod 3 form. The one place Zod 3 appears is as a detection signal — a list of superseded idioms, so stale code can be recognised and replaced with the current form. That is a Zod 4 rule about a Zod 4 codebase, not coverage of Zod 3. The boundary matters more than usual here, because Zod 3 answers still outrank Zod 4 answers across tutorials, forum posts, and model recall — and most Zod 3 idioms still compile against a Zod 4 install, so "it runs" is not evidence a rule is current. Zod 4 also moves within its own major: z.xor, z.invertCodec, and the .brand direction parameter all arrived after 4.0. Every version-sensitive statement here names what it was verified against, and where a surface is known to move the rule is a lookup — consult the installed version's own documentation at https://zod.dev/ — rather than a frozen API name. Treat an unversioned claim about a Zod API, in this skill or anywhere else, as suspect.

Verified against zod@4.4.3, published 2026-05-04 — https://zod.dev/ — with TypeScript 5.5+ and strict: true as stated prerequisites. Each reference file carries its own Verified against line with the upstream page its rules were checked against.

Out of scope. Zod 3 in every form. The 4.5.0-canary line, which no rule here was derived against. Other validation libraries except where a boundary is shared with one — Standard Schema interop is covered, Valibot's or ArkType's own APIs are not. Code generation tools that emit Zod schemas are named where they change what you must still write by hand, but their own configuration is theirs.