runtime-validation

• SKILL.mdcore · 2,346 bytes
• references/rule.mddoc · 7,520 bytes

# Validate external data at runtime with a schema library

TypeScript gives you confidence at compile time, but data from the network, user input, and storage arrives at runtime as raw, untyped values. A backend schema change, a misconfigured API, or malicious input can produce data that does not match your TypeScript types — and the compiler will never warn you. Runtime validation with a schema library catches these mismatches at the boundary, surfaces clear error messages, and prevents type-unsafe data from propagating through your application.

## Quick Reference

- TypeScript types are compile-time only — they are completely erased at runtime
- API responses can differ from their declared types without causing a compile error
- A Zod schema simultaneously validates data and infers the TypeScript type
- Validate at trust boundaries only — not inside every internal function call

## Check

Identify all places in this code where external data enters the application (fetch calls, localStorage reads, env variable access, form submissions) and report which ones lack runtime schema validation.