
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@brika/schema
Advanced tools
Unified schema package for BRIKA plugins and configuration.
Single source of truth — Define schemas once in Zod, get both runtime validation and IDE support.
✅ Zod schemas for runtime validation (TypeScript)
✅ JSON Schema auto-generated for IDE support
✅ Version synchronization - package.json version injected into schemas
✅ Single file to maintain - Zod is the source, JSON Schema is derived
bun add @brika/schema
import { PluginPackageSchema, validatePluginPackage } from "@brika/schema";
// Validate plugin package.json at runtime
const result = validatePluginPackage(packageData);
if (result.success) {
console.log("Valid plugin:", result.data);
} else {
console.error("Invalid plugin:", result.error);
}
// Or assert (throws on invalid)
import { assertPluginPackage } from "@brika/schema";
assertPluginPackage(packageData); // throws if invalid
In your plugin's package.json:
{
"$schema": "https://schema.brika.dev/plugin.schema.json",
"name": "@myorg/my-plugin",
"version": "1.0.0",
"engines": {
"brika": "^0.1.0"
}
}
Your IDE will automatically:
┌─────────────────┐
│ plugin.ts │ ← Source of truth (Zod)
│ (Zod Schema) │
└────────┬────────┘
│
├─── Runtime validation (TypeScript)
│
v
┌─────────────────┐
│ generate- │
│ schemas.ts │ ← Build script
└────────┬────────┘
│
│ Generates (z.toJSONSchema)
v
┌─────────────────┐
│ plugin.schema │ ← Generated JSON Schema
│ .json │
└────────┬────────┘
│
├─── Published to /schemas/
├─── Served via CDN
└─── IDE validation
// packages/schema/src/plugin.ts
export const PluginPackageSchema = z.object({
name: z.string().regex(/^@[a-z0-9-]+\/[a-z0-9-]+$/),
version: z.string().regex(semverPattern),
engines: z.object({
brika: z.string().regex(semverRangePattern),
}),
// ... more fields
});
bun run build
This:
package.json versionz.toJSONSchema()$iddist/plugin.schema.json# Smart publish with safety checks
bun run publish
# Force publish (skip version check)
bun run publish --force
# Dry run (see what would be published)
bun run publish --dry-run
The publish script automatically:
Runtime (Hub):
import { validatePluginPackage } from "@brika/schema";
const result = validatePluginPackage(pluginPackageJson);
IDE (Developers):
{
"$schema": "https://schema.brika.dev/0.1.0/plugin.schema.json"
}
Update Zod schema in src/plugin.ts:
export const PluginPackageSchema = z.object({
// ... existing fields
newField: z.string().optional().describe("New field description"),
});
Regenerate JSON Schema:
bun run build
Commit both files:
src/plugin.ts (source)../../schemas/plugin.schema.json (generated)Push to GitHub - Cloudflare Worker serves updated schema
bun run dev
Auto-regenerates JSON Schema on Zod changes.
✗ Maintain Zod schema manually
✗ Maintain JSON Schema manually
✗ Keep them in sync manually
✗ Update version in multiple places
✗ Risk of drift
✓ Maintain Zod schema only
✓ JSON Schema generated automatically
✓ Always in sync
✓ Version injected automatically
✓ No drift possible
The schema version comes from package.json:
{
"name": "@brika/schema",
"version": "0.1.0" ← This version
}
Gets injected into JSON Schema:
{
"$id": "https://schema.brika.dev/0.1.0/plugin.schema.json"
}
packages/schema/package.json versionbun run publishgit push --follow-tagsschema.brika.dev/x.y.z/...Or use npm's built-in version command:
npm version patch # 0.1.0 → 0.1.1
bun run publish
git push --follow-tags
Get TypeScript types from Zod:
import type { PluginPackage } from "@brika/schema";
const plugin: PluginPackage = {
name: "@myorg/plugin",
version: "1.0.0",
engines: {
brika: "^0.1.0"
}
};
import { validatePluginPackage } from "@brika/schema";
const valid = validatePluginPackage({
name: "@myorg/awesome-plugin",
version: "1.0.0",
engines: {
brika: "^0.1.0"
},
tools: [
{
id: "my-tool",
description: "Does something cool",
icon: "zap",
color: "#3b82f6"
}
]
});
console.log(valid.success); // true
const invalid = validatePluginPackage({
name: "not-scoped", // ❌ Must be scoped (@org/name)
version: "1.0", // ❌ Not valid semver
});
console.log(invalid.success); // false
console.log(invalid.error); // Zod error with details
// apps/hub/src/runtime/plugins/plugin-manager.ts
import { validatePluginPackage } from "@brika/schema";
async loadPlugin(packageJson: unknown) {
const result = validatePluginPackage(packageJson);
if (!result.success) {
throw new Error(`Invalid plugin: ${result.error}`);
}
// Use validated data
const plugin = result.data;
}
{
"$schema": "https://schema.brika.dev/plugin.schema.json",
"name": "@brika/plugin-timer",
"dependencies": {
"@brika/schema": "workspace:*"
}
}
npm install @brika/schema
import { PluginPackageSchema } from "@brika/schema";
// Validate your plugin programmatically
| Command | Description |
|---|---|
bun run build | Generate JSON Schema from Zod |
bun run dev | Watch mode - regenerate on changes |
bun run publish | Publish to npm with safety checks |
bun run publish --force | Force publish (skip version check) |
bun run publish --dry-run | See what would be published |
| File | Purpose |
|---|---|
src/plugin.ts | Source of truth - Zod schema |
src/generate-schemas.ts | Build script - Zod → JSON |
src/index.ts | Public exports |
dist/plugin.schema.json | Generated JSON Schema |
../../schemas/plugin.schema.json | Published to CDN |
This package will grow to include:
config.ts / config.schema.json - For brika.ymlautomation.ts / automation.schema.json - For workflow filesblock.ts / block.schema.json - For block definitionsAll following the same pattern:
Same as main BRIKA project.
FAQs
Unified schemas for BRIKA plugins and configuration
The npm package @brika/schema receives a total of 11 weekly downloads. As such, @brika/schema popularity was classified as not popular.
We found that @brika/schema demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.