zod

Use safeParse() instead of parse() for user input so validation failures return a result object instead of throwing exceptions. Check result.success, then read result.error.issues to display all validation problems to the user at once.

z.infer (z.output) captures the post-transform type of a schema, while z.input captures the pre-transform shape. Use z.input when a function accepts raw data before transforms run, and z.infer for validated output.

Use z.unknown() instead of z.any(). z.any() bypasses TypeScript's type system entirely, while z.unknown() forces type narrowing before the value can be used, preserving type safety.

Synchronous parse() cannot execute async refine or transform functions and throws an error. Use parseAsync() or safeParseAsync() whenever a schema includes asynchronous validation such as database lookups.

Use strict() to reject unknown keys when enforcing API contracts or catching schema mismatches. Use strip() (the default) to silently remove extra keys when cleaning data, and passthrough() only when proxying unvalidated fields.

Use Zod Mini, which is about 1.9kb gzipped compared to roughly 17kb for full Zod. Also cache schema instances at module level and lazy-load large schemas to reduce initial bundle and parse time.