Best practices for Zod schema validation and type inference in TypeScript applications.
Install
npx skills add https://github.com/mindrally/skills --skill zod-schema-validationSKILL.md
Zod Schema Validation
You are an expert in Zod schema validation and type inference for TypeScript applications.
Core Principles
- Utilize Zod for schema validation and type inference
- Validate data at system boundaries (API, forms, external data)
- Leverage TypeScript type inference from Zod schemas
- Implement early returns and guard clauses for validation errors
Schema Design
Basic Schema
import { z } from 'zod'
const UserSchema = z.object({
id: z.string().uuid(),
email: z.string().email(),
name: z.string().min(1).max(100),
age: z.number().int().positive().optional(),
role: z.enum(['admin', 'user', 'guest']),
createdAt: z.date(),
})
type User = z.infer<typeof UserSchema>
Best Practices
- Define schemas close to where they're used
- Use
.inferto derive TypeScript types - Compose schemas using
.extend(),.merge(),.pick(),.omit() - Create reusable base schemas for common patterns
Validation Patterns
Safe Parsing
const result = UserSchema.safeParse(data)
if (!result.success) {
console.error(result.error.format())
return
}
// result.data is typed as User
Transform and Refine
const schema = z.string()
.transform((val) => val.trim().toLowerCase())
.refine((val) => val.length > 0, 'Cannot be empty')
Form Integration
- Use Zod with react-hook-form via
@hookform/resolvers/zod - Define form schemas that match your form structure
- Handle validation errors in UI appropriately
- Use
.partial()for optional update forms
API Validation
- Validate request bodies in API routes
- Validate query parameters and path params
- Return structured error responses
- Use discriminated unions for different response types
Error Handling
- Implement custom error messages for better UX
- Use
.format()for structured error output - Create custom error maps for i18n support
- Handle nested object errors appropriately
Advanced Patterns
Discriminated Unions
const ResultSchema = z.discriminatedUnion('status', [
z.object({ status: z.literal('success'), data: UserSchema }),
z.object({ status: z.literal('error'), message: z.string() }),
])
Recursive Schemas
const CategorySchema: z.ZodType<Category> = z.lazy(() =>
z.object({
name: z.string(),
children: z.array(CategorySchema),
})
)
Performance
- Precompile schemas that are used frequently
- Avoid creating schemas inside render functions
- Use
.passthrough()or.strict()intentionally - Consider partial validation for large objects
Related skills
entra-app-registrationmicrosoft606KGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.azure-messagingmicrosoft595KTroubleshoot and resolve issues with Azure Messaging SDKs for Event Hubs and Service Bus. Covers connection failures, authentication errors, message processing issues, and SDK configuration problems. WHEN: event hub SDK error, service bus SDK issue, messaging connection failure, AMQP error, event processor host issue, message lock lost, message lock expired, lock renewal, lock renewal batch, send timeout, receiver disconnected, SDK troubleshooting, azure messaging SDK, event hub consumer, servicentra-agent-idmicrosoft328KProvision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registsupabasesupabase298KUse when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector); deb