Skill · zod/zod-4 · v1.0.0 · MIT
Zod 4 Validation and Migration
Correct Zod 4 schemas at trust boundaries, and Zod 3 upgrades that keep messages, defaults and rules intact.
Teaches an agent the current Zod 4 API (checked against zod 4.6.7) for validating HTTP bodies, query strings, form posts, env config, webhooks and model output, and how to port Zod 3 code without silent behaviour changes. It concentrates on what agents trained on Zod 3 get wrong: ignored required_error/invalid_type_error/errorMap, the removed ZodError.errors, .default() vs .prefault(), exhaustive enum records, the stricter z.uuid(), required z.unknown() keys, schema-level messages that override check messages, coercion of "false" and "", permissive z.url(), check order with z.email().trim(), and cross-field refinements that are skipped next to field errors.
- Backend
- Frontend
- Security
- Migration
- build
- maintain
- secure
- zod
- typescript
- javascript
- nodejs
uplift
No runs exist for this digest.
Not measured for this digest.
Untested is not the same as useless: nobody has measured it yet. Proof comes from A/B runs on hidden tests:
npx sigil prove catalog/skills/zod/zod-4 --suite <suite> --runs 6trust level · submitted
- in the catalog: met
- structure check: not met
- static scan, no high findings: not met
- canary sandbox passed: not met
- maintainer approved: not met
canary sandbox
Not run for this digest.
static scan
Not run for this digest.
compatibility · targeted, compiled and evaluated are separate claims
| agent | targeted by author | compiled | evaluated in the lab | notes |
|---|---|---|---|---|
| Claude Code | targeted: yes | no record for compiled | no record for evaluated | |
| Codex | targeted: yes | no record for compiled | no record for evaluated | |
| Cursor | targeted: yes | no record for compiled | no record for evaluated | |
| GitHub Copilot | targeted: yes | no record for compiled | no record for evaluated | |
| Gemini CLI | targeted: yes | no record for compiled | no record for evaluated | |
| OpenCode | targeted: yes | no record for compiled | no record for evaluated |
declared permissions
- network
- none
- shell
- node, npm ls, npm test, npx tsc, rg
- filesystem
- write
- env
- none
Undeclared access is a finding in the scan and a tripwire in the canary.
source
- path
- catalog/skills/zod/zod-4
- authors
- dgesteves
- entry
- SKILL.md (agent-skill)
- registry
- 2026-11-02 · 5cb851d
install
$ npx sigil add zod/zod-4 --agent claude-codeNo compile record for Claude Code on this digest. Install never runs capability scripts, and refuses on any digest mismatch.
known limitations
- Written and verified against zod 4.6.7. Later 4.x releases may add APIs or tighten validators; check the release notes when the installed version is newer.
- Covers classic Zod. Zod Mini (zod/mini, @zod/mini) is mentioned but its functional API is not taught in depth.
- Default error message wording is not reproduced; upgrades that snapshot Zod 3 default messages will still need test updates.
- Does not cover framework integrations (tRPC, react-hook-form resolvers, Fastify type providers) beyond the z.input/z.output guidance.