"TypeScript makes it type-safe" is the sentence interviewers wait for so they can ask "at runtime too?". Types disappear at compile time; anything that enters the program from outside, HTTP bodies, query strings, environment variables, storage, third-party APIs, is unknown until something checks it. The senior pattern is schemas at the boundary that both validate and define the types.

Know

• Boundaries are where data enters: request bodies and params on the server, API responses on the client, localStorage/cookies, environment variables, webhooks, messages from workers or sockets. Inside the boundary, types are trustworthy because the boundary enforced them.
• Schema libraries: zod (v4, the default in the Vue ecosystem; z.object, z.infer, parse/safeParse, transforms, refinements, z.input vs z.output), valibot (modular and tree-shakable, ideal for client bundles), ArkType (TypeScript-syntax strings, very fast). All implement Standard Schema, a common interface that Nuxt UI forms, VeeValidate, h3 (readValidatedBody), TanStack and others accept, so the choice is per project, not per library integration.
• Derive, do not duplicate: type Product = z.infer<typeof productSchema>; the schema is the single source of truth and the type follows. Schemas live in shared/schemas so the Nuxt server route and the page import the same one.
• Where to validate in Nuxt: readValidatedBody(event, schema.parse), getValidatedQuery, getValidatedRouterParams on the server (throw 400 with issues); useRuntimeConfig values at startup in a Nitro plugin; API responses on the client only when the API is not yours (your own routes are typed end to end); form input through the form library.
• safeParse versus parse: parse throws a ZodError; safeParse returns { success, data | error } for flows where failure is expected (user input). Format issues for users with flatten()/treeifyError and for logs with the raw issue list.
• Branded types encode invariants the structural system cannot: UserId, Email, NonEmptyString; schemas produce them (z.string().email().brand<'Email'>()), so a validated value carries proof of validation in its type.
• Exhaustiveness with never in switch defaults and satisfies Record<Union, ...> for lookup tables, so adding a variant is a compile error everywhere it matters.
• Errors are unknown. catch (e) is unknown under useUnknownInCatchVariables; narrow with instanceof, a type guard, or Error.isError (ES2026). Model expected failures as data (Result<T, E> discriminated unions) and reserve exceptions for the unexpected; FetchError from ofetch carries status, statusText and typed data.
• Environment and config: parse process.env/runtimeConfig once at startup with a schema and fail fast; never as string an env variable.
• Cost: validation is not free on hot paths; validate at the edge once, not on every function call inside. Valibot's modular design and ArkType's speed matter when schemas run in the browser for every keystroke.

How it works

The boundary pattern end to end in Nuxt:

import { z } from 'zod'

export const productSchema = z.object({
  id: z.string().uuid().brand<'ProductId'>(),
  name: z.string().trim().min(1).max(120),
  status: z.enum(['draft', 'published', 'archived']),
  priceMinor: z.number().int().nonnegative(),
  tags: z.array(z.string()).max(10).default([]),
})
export type Product = z.output<typeof productSchema>
export type ProductId = Product['id']

export const createProductSchema = productSchema.omit({ id: true })
export type CreateProductInput = z.input<typeof createProductSchema> // tags optional on input, required on output

import { createProductSchema } from '#shared/schemas/product'

export default defineEventHandler(async (event) => {
  const input = await readValidatedBody(event, createProductSchema.parse) // 400 with issues in `data` on failure
  return useDb().products.create(input) // input is typed and *validated*; no cast anywhere
})

import { z } from 'zod'

const envSchema = z.object({
  stripeSecret: z.string().min(1),
  session: z.object({ maxAge: z.number().int().positive() }),
})

export default defineNitroPlugin(() => {
  // Fail fast at startup instead of discovering a missing secret on the first checkout.
  envSchema.parse(useRuntimeConfig())
})

Result types and typed errors on the client, plus a third-party API validated because it is not ours:

export type Result<T, E = { status: number, message: string }> = { ok: true, value: T } | { ok: false, error: E }

export async function tryFetch<T>(schema: { parse: (v: unknown) => T }, url: string): Promise<Result<T>> {
  try {
    const raw: unknown = await $fetch(url)
    return { ok: true, value: schema.parse(raw) } // validated: the third party changed a field? we learn here, not in a template
  }
  catch (e) {
    if (Error.isError(e) && 'status' in e) return { ok: false, error: { status: Number(e.status ?? 500), message: e.message } }
    return { ok: false, error: { status: 500, message: 'Unexpected error' } }
  }
}

Exhaustive lookup tables that fail to compile when a variant is added:

import type { Product } from '#shared/schemas/product'

export const STATUS_LABEL = {
  draft: 'Draft',
  published: 'Live',
  archived: 'Archived',
} satisfies Record<Product['status'], string> // add 'scheduled' to the schema and this line errors

Exercise

Be able to say