zod 4.1.12: Validate untrusted input with a zod schema and read the error shape

{"case":{"caseId":"case:sha256:1a6cf2c03d0b6a706dd67614c53c9fdb79e9b7605aec05af07fb3ee7d5c919a3","constraints":{"moduleSystem":"esm","runtime":"node"},"contract":["parse a valid object and assert the typed result","safeParse an invalid object and assert success is false","assert the issue carries a path and a code"],"goal":"Validate untrusted input with a zod schema and read the error shape","kind":"HOW","packages":["pkg:npm/zod@4.1.12"],"schemaVersion":1,"symbols":["z.object","z.string","safeParse"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","ecosystem":"npm","executionContext":"node","moduleSystem":"esm","os":"linux","packageManager":"npm","runtime":"node","runtimeVersion":"22","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/zod@4.1.12"],"schemaVersion":1,"symbols":["z.object","z.string","safeParse"],"verifierAdapter":"node-typescript@1"}

{
  "name": "csx-sample-zod-parse-validate",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "csx-sample-zod-parse-validate",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "zod": "4.1.12"
      }
    },
    "node_modules/zod": {
      "version": "4.1.12",
      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.12.tgz",
      "integrity": "sha512-JInaHOamG8pt5+Ey8kGmdcAcg3OL9reK8ltczgHTAwNhMys/6ThXHityHxVV2p3fkw/c+MAvBHFVYHFZDmjMCQ==",
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/colinhacks"
      }
    }
  }
}

{
  "name": "csx-sample-zod-parse-validate",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "license": "MIT-0",
  "dependencies": {
    "zod": "4.1.12"
  }
}

import { z } from 'zod';

// One schema, two ways to use it: parse throws, safeParse returns a result
// object. safeParse is what you want at a trust boundary.
export const User = z.object({
  email: z.string().email(),
  age: z.number().int().min(0),
});

export function parseUser(input) {
  return User.parse(input);
}

export function checkUser(input) {
  const result = User.safeParse(input);
  if (result.success) return { ok: true, value: result.data };
  return { ok: false, issues: result.error.issues };
}

import { strict as assert } from 'node:assert';
import { parseUser, checkUser } from '../src/index.mjs';

const valid = { email: 'dev@example.com', age: 30 };
assert.deepEqual(parseUser(valid), valid);

const good = checkUser(valid);
assert.equal(good.ok, true);
assert.equal(good.value.email, valid.email);

const bad = checkUser({ email: 'not-an-email', age: -1 });
assert.equal(bad.ok, false);
assert.ok(bad.issues.length >= 1);
for (const issue of bad.issues) {
  assert.ok(Array.isArray(issue.path), 'each issue carries a path');
  assert.equal(typeof issue.code, 'string', 'each issue carries a code');
}
console.log('CONTRACT PASS: zod parse/safeParse behave as documented');