Repo brief: sinclairzx81/typebox

Generated by RepoPilot · document generated 2026-09-12 · concise human review Evidence snapshot · analyzed 2026-09-12T23:28:58.316Z · commit 8f8d861ba204

Verdict

Mixed — Single-maintainer risk — review before adopting

• Last commit 2d ago
• 5 active contributors
• MIT licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

TypeBox is a runtime JSON Schema type builder that generates in-memory JSON Schema objects while simultaneously producing equivalent TypeScript static types. It allows developers to define schemas once using a fluent API (e.g., Type.Object({ x: Type.Number() })) and use the same definition for both TypeScript compile-time type checking and runtime JSON Schema validation, eliminating schema/type duplication. Modular single-package structure: src/compile/ handles schema compilation and code generation, src/format/ implements JSON Schema format validation (email, UUID, URI, IDNA hostnames, etc.), src/guard/ provides runtime type guards, and src/schema/ contains the core…

Start here

Open these first:

• src/index.ts — Main entry point exporting the Type builder API and all public utilities.
• src/schema/engine/index.ts — Central validator engine dispatcher routing JSON Schema keywords to implementation handlers.
• src/compile/compile.ts — Core compilation logic transforming TypeBox schemas into executable validator code.
• src/schema/build.ts — Schema builder and composition logic that constructs validated JSON Schema objects.
• src/format/_registry.ts — Format validation registry managing string format handlers (date, email, URI, etc).

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

git clone https://github.com/sinclairzx81/typebox.git
cd typebox
npm install

Repository manifest files (package.json, tsconfig.json) are not shown; consult those for exact dev dependencies and build targets before running npm scripts.

Daily commands:

Package manifest not fully shown in supplied data. Infer from typical TypeScript project: npm run build (compile TS to JS) and npm test (run test suite). Verify actual scripts in package.json before executing.

Key cautions & unknowns

• Single-maintainer risk — top contributor 94% of recent commits
• Scorecard: default branch unprotected (0/10)
• No environment variables or external service dependencies evident from supplied data. Traps to verify: (1) The src/compile/code.ts code generator may have subtle differences between Node.js and browser…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard
• License evidence

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.