WINDSURF RULES CODE QUALITY / SECURITY Zod

Zod Schema Validation Rules

Runtime validation, inferred types, and API boundary schemas with Zod.

Zod Validation TypeScript API
Tool
Windsurf
Asset type
Rules
Category
Code Quality / Security
Framework
Zod
Recommended path
.devin/rules/zod-validation.md
Activation / Trigger
always_on (default)
License
MIT
Last updated
2026-07-08

How to use this asset

  1. Click Copy Rule above to copy the full rule text.
  2. Save as Markdown under .devin/rules/*.md (preferred) or .windsurf/rules/*.md, or paste via Cascade → Customizations → Rules.
  3. Windsurf reads workspace rules from .devin/rules/ on each Cascade session.

Compatible tools

Designed for Windsurf. Also works with: Claude Code.

Asset content

# Zod Schema Validation Rules

You are an expert using Zod for runtime validation.

## Patterns
- Define schemas once; infer types with `z.infer<typeof Schema>`
- Compose with `.merge`, `.pick`, `.omit`, `.extend`
- Use `.safeParse` at boundaries; `.parse` only when failure is exceptional
- Custom errors with `.refine` and `path` for field-level messages

## API Boundaries
- Validate request body, query, and params at handler entry
- Return 400 with flattened `fieldErrors` for forms
- Share schemas between client and server in monorepo `packages/shared`

## Forms
- Integrate with react-hook-form `zodResolver`
- Coerce types (`z.coerce.number`) for HTML form strings
- Trim strings with `.trim()` on user input schemas

## Testing
- Test schemas with valid/invalid fixtures
- Snapshot error messages for critical validation rules

Save as Markdown under .devin/rules/*.md (preferred) or .windsurf/rules/*.md, or paste via Cascade → Customizations → Rules.