zod-validation

Validate API fetch responses by treating the fetched JSON as `unknown` and parsing it with a Zod schema's `.parse()` method. You must handle any resulting `ZodError` by logging `error.format()` or re-throwing it to enforce boundary type safety.

Use Zod's `.safeParse()` for recoverable user form input errors where you want to handle failures gracefully. Use the throwing `.parse()` method for fatal failures when validating external data like API responses or environment variables.

The best way to validate environment variables, localStorage, and URL parameters is enforcing Zod schema validation at these client-side trust boundaries. This treats all inbound external data as `unknown` until a schema proves its shape.

Handle untyped JSON by forbidding any untyped handling and mandating explicit Zod schema validation. You must use `z.infer` to make schemas the source of truth, enforcing runtime type safety across all frontend and service layer boundaries.

Yes, Zod validation applies to user form input, URL parameters, and localStorage parsing. It uses non-throwing `.safeParse()` for these recoverable client-side errors and throwing `.parse()` for fatal external API response failures.

Runtime types break when making unsafe assumptions about external API data. You must enforce Zod schema validation at every trust boundary, treating inbound JSON as `unknown` and using `.parse()` to verify its shape before use.