Zod 4

Apply the TypeScript 7 and JavaScript ES2026 prompts first. These rules cover Zod 4 object strictness, coercion, defaults, unions, refinements, transforms, serialization boundaries, errors, recursive schemas, JSON Schema, and resource limits.

Object and collection schemas

• Use z.strictObject({...}) at security boundaries: z.object() silently strips unknown keys by default, z.looseObject() passes them through, and .catchall() accepts those matching its catchall schema.
• Keep ownership, role, tenant, status, price, audit, and server-generated fields out of client-input schemas.
• Set minimum and maximum lengths for strings, arrays, sets, maps, records, and binary-like data.
• Constrain record keys and values and do not treat a generic record as a safe domain object.
• Use separate schemas for create, update, persistence, internal state, and public output.

Parsing, coercion, and defaults

• Use parse or safeParse at the actual runtime boundary and never rely on inferred TypeScript types alone.
• Avoid coercion where boolean, numeric, date, identifier, or null conversions could change security meaning.
• Account for JavaScript coercion exactly: z.coerce.string() calls String, z.coerce.number() calls Number, and z.coerce.boolean() calls Boolean, so strings such as "false" are truthy.
• For environment-style booleans, use z.stringbool({truthy, falsy, case}) with an explicit vocabulary; its default is case-insensitive and accepts true/1/yes/on/y/enabled and corresponding false terms.
• Do not use defaults or catch values to silently