@zag-js/types

Repo package mentioncaution

The repository name does not match @zag-js/types and its README does not mention the package, so the package-to-repository relationship is less transparent; the monorepo context and organization backing partly compensate.

Repo toolingcaution

The repository uses established TypeScript, Vite, tsup, SWC, npm, and esbuild tooling; no security scanning tools were detected, leaving a modest transparency gap.

Security policycaution

No repository security policy was detected, which reduces disclosure transparency, but the active repository and workflow audit provide some compensating project evidence.

Workflow auditcaution

All three workflows were analyzed with no detected injection or high-severity findings, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions; this is a workflow hygiene caution, not a severe risk on its own.