1. Why JSON.parse() Returns any & The Security Risks

In standard JavaScript and TypeScript, calling `JSON.parse(str)` returns type `any`. This forces the compiler to trust that whatever properties you access exist at runtime. If an API payload changes, your app will crash with `TypeError: Cannot read properties of undefined`. To enforce strict type safety, assign the result of `JSON.parse()` to `unknown`.

Unsafe vs Safe Type-Casting in TypeScript 
interface User {
  id: number;
  name: string;
  email: string;
}

// ❌ UNSAFE: Bypasses TypeScript type compiler
const unsafeUser: User = JSON.parse('{"id": 1}'); 
console.log(unsafeUser.email.toLowerCase()); // Runtime Crash!

// ✅ SAFE: Use unknown + Type Verification
const rawData: unknown = JSON.parse('{"id": 1, "name": "Alex", "email": "alex@dev.com"}');
Explanation: Assigning to unknown forces TypeScript to require runtime validation before property dereferencing.

2. Writing Custom Type Guard Predicates

Custom type guards use TypeScript's `is` keyword (`target is Type`) to inform the compiler that a variable has been narrowed to a specific interface or type alias after passing runtime structural checks.

Custom Type Predicate Guard Example 
function isUser(obj: unknown): obj is User {
  return (
    typeof obj === 'object' &&
    obj !== null &&
    'id' in obj && typeof (obj as User).id === 'number' &&
    'name' in obj && typeof (obj as User).name === 'string' &&
    'email' in obj && typeof (obj as User).email === 'string'
  );
}

if (isUser(rawData)) {
  // TypeScript now safely knows rawData is User!
  console.log(rawData.name.toUpperCase());
}
Explanation: The type predicate function guarantees runtime safety without needing external libraries.

3. Zero-Boilerplate Schema Validation with Zod

Writing manual type guards for large, nested JSON payloads is tedious and error-prone. Zod allows developers to define a single runtime validation schema and automatically infer TypeScript static types from it.

Runtime Validation & Inferring Static Types with Zod 
import { z } from 'zod';

const UserSchema = z.object({
  id: z.number(),
  name: z.string(),
  email: z.string().email(),
  role: z.enum(['admin', 'user']).default('user'),
});

// Infer static TypeScript type
type User = z.infer<typeof UserSchema>;

// Parse & Validate Runtime Payload
try {
  const user: User = UserSchema.parse(JSON.parse(apiResponse));
  console.log(user.role);
} catch (error) {
  console.error('Invalid API JSON Payload:', error);
}
Explanation: Zod parses raw JSON, strips unexpected fields if configured, and guarantees 100% type safety.