---
package: zod
version: "^3.23.0"
tier: core
decision: approved
date: 2026-05-14
deciders: [scaffolded]
adr: adr-016
filter-results:
  license: MIT
  types: native
  maintenance: active
  boundary-fit: pass
  shadow-check: pass
  eu-residency: n/a
  cve-scan: clean
  named-consumer: pass
verification-commands:
  - pnpm audit --audit-level=moderate
  - npm view zod license
accepted-cves: []
---

## Filter: license

MIT — on the workspace allowlist.

## Filter: types

Ships first-party TypeScript types in its distribution (`.d.ts` included).

## Filter: maintenance

Active. Regular releases by Colin McDonnell; widely adopted.

## Filter: boundary-fit

Core package. Zod is the workspace-canonical validation library locked in `core-shared` (ADR-016).

## Filter: shadow-check

Zod is already the workspace-locked validation library. No shadow.

## Filter: eu-residency

Pure computation; no network calls or vendor data transmission. n/a.

## Filter: cve-scan

No advisories at adoption time.

## Filter: named-consumer

`core-realtime` uses zod for channel descriptor and payload schema validation.

## Prompt: replaces

Nothing — zod is the pre-existing workspace validation library.

## Prompt: migration-cost-out

Mechanical: swap schema definitions at call sites. No data-format lock-in.

## Prompt: alternatives-considered

Zod is workspace-locked (see `core-shared`). A replacement would require a workspace-wide ADR; no alternative was evaluated here.