# Zod 4 Validation and Migration

`zod/zod-4` · Skill · v1.0.0

Correct Zod 4 schemas at trust boundaries, and Zod 3 upgrades that keep messages, defaults and rules intact.

Teaches an agent the current Zod 4 API (checked against zod 4.6.7) for validating HTTP bodies, query strings, form posts, env config, webhooks and model output, and how to port Zod 3 code without silent behaviour changes. It concentrates on what agents trained on Zod 3 get wrong: ignored required_error/invalid_type_error/errorMap, the removed ZodError.errors, .default() vs .prefault(), exhaustive enum records, the stricter z.uuid(), required z.unknown() keys, schema-level messages that override check messages, coercion of "false" and "", permissive z.url(), check order with z.email().trim(), and cross-field refinements that are skipped next to field errors.

## Verdict

- level: **submitted** — In the catalog, not yet checked for this digest.
- uplift: **untested** — No runs exist for this digest.
- digest: `sha256:83f66d162f7d69ee9da347ba67f05e83bcc6377cee1d23e7d9ea3a2a03114d82`

## Uplift runs

None for this digest. Untested is not the same as useless: nobody has measured it yet.

## Security

No checks recorded for this digest.

## Compatibility

| agent | targeted | compiled | evaluated |
| --- | --- | --- | --- |
| Claude Code | yes | no record | no record |
| Codex | yes | no record | no record |
| Cursor | yes | no record | no record |
| GitHub Copilot | yes | no record | no record |
| Gemini CLI | yes | no record | no record |
| OpenCode | yes | no record | no record |

## Permissions

- network: none
- shell: node, npm ls, npm test, npx tsc, rg
- filesystem: write
- env: none

## Files

- `SKILL.md` 17240 B sha256:2e87cf3f179631fd7cab766b2ae722e9f429d1650e7979b45bbdfe65eec185ff
- `references/boundary-recipes.md` 7641 B sha256:b9873827fb60cbde5f07e735d22ae8b56c2d826972afb63bcf11fbc9eae5dac4
- `references/error-messages.md` 5881 B sha256:51ff7aae35111d59d47d9b561b9237f794ba3eb2f6b0db8283f3eacb148698f4
- `references/migration-v3-to-v4.md` 10414 B sha256:c934795fedd2dbb2d7e95465db84efa0ab5320a1dbf34f76778128b221f8e800
- `references/sources.md` 2331 B sha256:065331330980ece84969708265c4f10b5837fd0b92adc8b77b6ce91b589efe05

## Limitations

- Written and verified against zod 4.6.7. Later 4.x releases may add APIs or tighten validators; check the release notes when the installed version is newer.
- Covers classic Zod. Zod Mini (zod/mini, @zod/mini) is mentioned but its functional API is not taught in depth.
- Default error message wording is not reproduced; upgrades that snapshot Zod 3 default messages will still need test updates.
- Does not cover framework integrations (tRPC, react-hook-form resolvers, Fastify type providers) beyond the z.input/z.output guidance.

## Install

```sh
npx sigil add zod/zod-4 --agent claude-code,codex,cursor
```

Source: https://github.com/dgesteves/sigil/tree/5cb851d5b2f2f14446ddf631ef5e91bf9d3263dd/catalog/skills/zod/zod-4