typebox VS zod

I was using TypeBox but switched to Zod. I like TypeBox but I found I don't actually need my schema to be a JSON Schema and the one time I did want a JSON Schema it was hard to get actual JSON back out of TypeBox.

The thing I like about Zod is the "refinements" and "transforms" and the new "overwrite" in Zod 4 was just what I wanted.

TypeBox does have a transform (https://github.com/sinclairzx81/typebox?tab=readme-ov-file#t...) but you can't transform and then apply more validations and then maybe another transform, etc. For example, I like to trim strings before checking length.

My hunch was that Zod v4 started using eval (or, more precisely, JIT compilation via new Function) for validation. This isn’t a bad thing — libraries like TypeBox, ArkType, and even Sury use similar techniques for speed.

Sury uses new Function under the hood. This approach makes it the fastest schema library available, but also means it cannot be used in environments that don't allow dynamic code evaluation, like CloudFlare Workers. Most users won't be affected, but might be an issue for some. Regarding safety of the approach you shouldn't be worried. Everything embeded to the generated code is escaped and thoroughly tested. Also, other libraries like TypeBox and Zod@4 use new Function under the hood as well.

The original library only supports Zod. While Zod is excellent, many developers use alternatives like Valibot, ArkType, and TypeBox. hono-openapi is validator-agnostic, offering first-class support for multiple libraries.

If you were willing to bring additional zod tooling or move to something like TypeBox (https://github.com/sinclairzx81/typebox), the json schema would be a direct derivation of the tools' input schemas in code.

I'd recommend TypeBox[1] as an alternative, which has a runtime “compiler” for generating optimized JS functions from the type objects. It also produces a JSON schema, which can be useful for generating API docs and API clients if needed.

It also has a companion library[2] for generating TypeBox validators from TypeScript definitions, which I'm currently using in an RPC library I'm working on.

[1]: https://github.com/sinclairzx81/typebox

Big fan of your work and impressed by your productivity. Currently reading https://www.oreilly.com/library/view/unifying-business-data/....

Currently experimenting with programmatic generation of json schemas via https://github.com/sinclairzx81/typebox. Trying to maximize reuse of schema components.

Was wondering if JSON BinPack is a good serialization format to sign json documents? Can it be used to somehow canonicalize json?

The documentation can be found here.

So far I like the commonly used approach in the Typescript community best:

1. Create your Schema using https://zod.dev or https://github.com/sinclairzx81/typebox

2. Generate your Types from the schema. It's very simple to create partial or composite types, e.g. UpdateModel, InsertModels, Arrays of them, etc.

3. Most modern Frameworks have first class support for validation, like is a great example Fastify (with typebox). Just reuse your schema definition.

That is very easy, obvious and effective.

📦 Installed with: npm install zod Docs: https://zod.dev/

Type safe and uses Zod.

Zod Documentation - TypeScript schema validation

Zod Validation Library

A config is where we describe what the tool does; we give a descriptive name and a description that describes the tool's intended purpose. We can also include input and output JSON schemas (supports zod out of the box) among other options. Only the description and name are required.

If you’re already using Zod, its `.brand()` method gives you branded types with built-in validation. This is especially handy for APIs or form inputs.

In this article, we will review execa usage in zod source code.

Support Yup, Zod, AJV, Superstruct, Joi and others

If you are coming from JavaScript or TypeScript, this is what you are used to do with JSON.parse and zod. And you are right, in Haskell, this is quite verbose and boilerplate-driven. But it is quite principled and type-safe. For example, you can parse and map, but cannot perform IO operations when defining your ToJSON and FromJSON instances. Also, you cannot have multiple JSON representations of the same data type (so-called type-class instance coherence in Haskell). You need newtype wrappers for that:

Author here. I wrote a fairly detailed writeup here[0] for those who are interested in the reasons for this approach.

Ultimately you're right that npm doesn't work well to manage the situation Zod finds itself in. But Zod is subject to a bunch of constraints that virtually no other libraries are subject to. There are dozens or hundreds of libraries that directly import interfaces/classes from "zod" and use them in their own public-facing API.

Since these libraries are directly coupled to Zod, they would need to publish a new major version whenever Zod does. That's ultimately reasonable in isolation, but in Zod's case it would trigger a "version avalanche" would just be painful for everyone involved. Selfishly, I suspect it would result in a huge swath of the ecosystem pinning on v3 forever.

The approach I ended up using is analogous to what Golang does. In essence a given package never publishes new breaking versions: they just add a new subpath when a new breaking release is made. In the TypeScript ecosystem, this means libraries can configure a single peer dependency on zod@^3.25.0 and support both versions simultaneously by importing what they need from "zod/v3" and "zod/v4". It provides a nice opt-in incremental upgrade path for end-users of Zod too.

[0] https://github.com/colinhacks/zod/issues/4371