fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
3d52f2de85abc9a4e88aceacf4622df8b3440e4a
agentic-dev/docs/library-decisions/2026-05-14-zod.md
Danijel Martinek f77e6ea881 chore(template): clean-slate template snapshot from bb4a0c7 
Curated, product-agnostic snapshot of the post-story-04 tree: demo
content deleted, auth-only reference feature, web-next shell, all gates
green. Product-specific docs, ADRs 027-029, PRDs/epics/archive, editor
library traces, and product naming are curated out; generic template
repairs (coverage provider devDeps, root test:coverage script, live
lint fixes, root-only release-please) are kept. See TEMPLATE.md for
provenance, curation list, and usage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
2026-07-12 20:40:54 +02:00

3.2 KiB
Raw Blame History

package, version, tier, decision, date, deciders, adr, lastRevalidated, is-sub-processor, processes-pii, filter-results, verification-commands, accepted-cves
package version tier decision date deciders adr lastRevalidated is-sub-processor processes-pii filter-results verification-commands accepted-cves
zod ^3.24.0 core approved 2026-05-14
Danijel Martinek
null 2026-05-19 false false
license types maintenance boundary-fit shadow-check eu-residency cve-scan named-consumer socketRisk
MIT native active pass pass n/a clean pass clean
npm view zod license
npm view zod version
pnpm audit --audit-level=moderate

Filter: license

npm view zod license returns MIT. MIT is on the allowlist.

Filter: types

Zod is authored in TypeScript and ships its own .d.ts declaration files. No separate @types/zod package is needed.

Filter: maintenance

Actively maintained. The 3.x line is the current stable major. Regular releases; the zod 4.x release is in active development. Strong community and ecosystem.

Filter: boundary-fit

Zod is the workspace-standard schema validation library. Every use case exports xInputSchema and xOutputSchema as z.ZodObject instances (CLAUDE.md Key Conventions). Feature packages, core packages, and the tRPC layer all use Zod for input validation and output parsing. No boundary rules restrict Zod to a specific tier.

Filter: shadow-check

Zod is the sole schema validation library in the workspace. No competing validator (Valibot, Yup, Joi, etc.) is present or proposed. The shadow-check filter from _template.md explicitly names Zod as a workspace-locked library.

Filter: eu-residency

Zod is a pure runtime validation library with no network communication, telemetry, or data transmission. EU residency does not apply.

Filter: cve-scan

pnpm audit --audit-level=moderate reports no advisories against zod at the time of this trace.

Filter: named-consumer

All five feature packages use Zod for use-case input/output schemas. core-shared uses Zod for tRPC input validation and error schemas. core-audit uses Zod for audit event schemas. core-dsr uses Zod for dsrRouter procedure input schemas. Named, non-hypothetical consumers exist today.

Prompt: replaces

Zod replaces ad-hoc manual validation (typeof x === "string") that would not scale to the use-case schema pattern mandated by CLAUDE.md. No prior schema library was in the workspace.

Prompt: migration-cost-out

Hard. Zod's z.ZodObject types are woven into the public API surface of every use case (xInputSchema, xOutputSchema, IXUseCase). The tRPC router layer reads Zod schemas directly. Migrating out would require replacing schema definitions across all feature packages, updating the tRPC integration, and touching the conformance ESLint rules that reference Zod types.

Prompt: alternatives-considered

  1. Valibot — Smaller bundle size but at the time of adoption had less mature TypeScript inference for the factory-function use-case pattern.
  2. Manual typeof / JSON Schema — Zero dependency but does not produce TypeScript types automatically; incompatible with the xInputSchema/xOutputSchema contract pattern.