Primary question: Does a spatiotemporal composability model fit your TypeScript architecture while the root manifest is still private at version 0.0.0?
RepoDaily adoption score
RepoDaily rates this as 87/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
4 source(s) across 3 source category/categories, plus a RepoDaily-specific evidence module when available.
6 workflow step(s), 5 next-action step(s), and 2 command/install signal(s) were detected.
Trending momentum is +719 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 4 security note(s) and 3 explicit skip condition(s).
3 opportunity lens item(s), 4 alternative(s), and 4 type-specific section(s) support differentiation.
License source or license wording is present.
2 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
cordiverse/cordis sits at number 3 on the 2026-08-17 trending list with 719 new stars in the window, and its one-line description — 'Meta-Framework of Spatiotemporal Composability' — does most of the marketing. The phrase positions cordis not as an application framework but as a layer beneath one: a framework for building frameworks. 'Spatiotemporal composability' implies units that combine along two axes at once, structure and lifecycle. The root README, notably, offers no elaboration; its entire content is the path './packages/core/README.md'.
The license is unambiguous: MIT, with copyright (c) 2021-present Shigma. That is at least five years of claimed ownership, and MIT's terms permit use, copying, modification, merging, publication, distribution, sublicensing, and sale, provided the notice is retained. For anyone who prefers reading source over docs, this is the green light: fork it, study it, ship derivatives.
Structurally, the repository is a Yarn monorepo. The root manifest names itself @root/cordis, marks private: true, pins version 0.0.0, and declares two workspace globs — packages/* and external/*. Nothing installable lives at the root; the consumable surface is defined inside workspace packages, with core being the one the README names. The packageManager field locks [email protected], and the manifest sets 'type': 'module', making the whole tree ESM-first.
The toolchain reads as deliberately current: TypeScript ^5.9.3, vitest ^4.1.5 with @vitest/coverage-v8 for coverage, esbuild ^0.28.0 and vite ^7.3.2, eslint ^8.57.1 with the shared @cordisjs/eslint-config ^1.1.1, and yakumo ^3.2.1 orchestrating per-package tasks. One detail stands out: tsx is not the npm original but a pinned Cordiverse fork, npm:@cordiverse/[email protected], inherited by anyone who runs the test suite.
Why it is trending now
- 719 stars in the window and rank 3 on the 2026-08-17 list put cordis behind only two repositories for the day.
- The tagline itself is the hook: 'Meta-Framework of Spatiotemporal Composability' is unusual enough to pull clicks, and the root README's single-line pointer adds mystery rather than dispelling it.
- MIT licensing held by Shigma since 2021 makes reading, forking, and borrowing code friction-free from a legal standpoint.
- The manifest shows a current toolchain — TypeScript ^5.9.3, vitest ^4.1.5, esbuild ^0.28.0, vite ^7.3.2 — which suggests the code targets today's runtimes rather than legacy ones.
- A packages/*/external/* split hints at one-package-per-module organization, the kind of layout framework readers like to dissect.
Problem it solves
- Building many interdependent packages in one pass: `yarn build` fans out through yakumo to run esbuild for bundles and tsc for type declarations across workspaces.
- Running TypeScript-heavy CLI tooling without precompiling: `yarn yakumo` starts the CLI via `node --expose-internals --import tsx --import @cordisjs/unyaml`.
- Producing coverage in the format each consumer wants: `test:text`, `test:json`, and `test:html` each wipe the coverage directory with shx before rerunning with a specific reporter.
- Keeping lint uniform across every workspace: `yarn lint` runs `eslint --cache` against the shared @cordisjs/eslint-config ^1.1.1.
- Making installs reproducible for every contributor: `packageManager: [email protected]` pins the Yarn version inside the manifest itself.
How it works
- The root package.json declares two workspace globs — `external/*` and `packages/*` — so Yarn 4.14.1 treats every folder under them as a package inside one dependency graph.
- Documentation is delegated: the root README.md contains only the path './packages/core/README.md', making packages/core the documented entry point of the framework.
- `yarn build` executes `yakumo esbuild && yakumo tsc`, producing bundled output and TypeScript declarations for each workspace package.
- `yarn test` executes `yakumo vitest --import tsx`; three wrappers (`test:text`, `test:json`, `test:html`) rebuild coverage in text, JSON, or HTML form via @vitest/coverage-v8 ^4.1.5.
- `yarn yakumo` launches the yakumo ^3.2.1 CLI directly with `node --expose-internals`, loading tsx for TypeScript and @cordisjs/unyaml ^2.0.3 for YAML configuration.
- Everything is ESM: the root sets 'type' to 'module', and the tsx dependency is pinned to a Cordiverse fork (`npm:@cordiverse/[email protected]`).
Architecture read: what the file tree says
- Root manifest: name `@root/cordis`, `private: true`, `version 0.0.0`, 'type' 'module' — the root is a build harness, not a published artifact.
- Two workspace globs split code by role: `packages/*` for in-repo packages (core lives here, per the README pointer) and `external/*` for code kept at arm's length.
- yakumo ^3.2.1 coordinates per-package tasks; yakumo-esbuild ^3.0.2 and yakumo-tsc ^3.0.1 cover the two build phases, and yakumo-vitest ^1.3.3 wires the test runner.
- Direct runtime dependencies at the root: zero. All 15 root-level entries are devDependencies, so the framework's real dependency surface is defined inside each workspace package, not here.
Command surface: every script in the root manifest
- `yarn lint` → `eslint --cache`
- `yarn yakumo` → `node --expose-internals --import tsx --import @cordisjs/unyaml node_modules/yakumo/lib/cli.js`
- `yarn build` → `yarn yakumo esbuild && yarn yakumo tsc`
- `yarn test` → `yarn yakumo vitest --import tsx`
- `yarn test:text` / `test:json` / `test:html` → each runs `shx rm -rf coverage` first, then `yarn test --coverage --coverage.reporter <format>`
Maintenance risk: the 0.0.0 question
- The root manifest is `private: true` at `version 0.0.0` — nothing installs by version from this file; consumers depend on separately published workspace packages.
- The root README is a single line ('./packages/core/README.md'), so anyone landing on the repo must go one level down for any explanation.
- Raw URLs in the source pack mix branches: the README is served from `master` while LICENSE and package.json come from `main` — confirm the default branch before pinning any commit.
- tsx is pinned to a Cordiverse fork, `npm:@cordiverse/[email protected]`, meaning every test run depends on that fork tracking upstream tsx changes.
- eslint stays on the ^8.57.1 line while TypeScript sits at ^5.9.3; check that the shared @cordisjs/eslint-config ^1.1.1 still parses current syntax.
Adoption checklist before depending on cordis
- Identify which `packages/*` package you actually consume and read its own manifest and version number.
- Run `yarn test:html` once and open the coverage report to see which modules the suite genuinely exercises.
- Read packages/core/README.md end to end — it is the only documentation the root README names.
- Record the MIT terms (copyright 2021-present Shigma) in your third-party license inventory.
Who should pay attention?
Good fit if
- TypeScript projects that want to study an ESM-first, workspace-heavy framework layout before designing their own.
- Maintainers who want a working reference for yakumo-based multi-package builds with separate esbuild and tsc phases.
- Anyone vetting a framework under MIT terms who prefers reading source over marketing copy.
- Engineers researching context and composability models in TypeScript who will read packages/core directly.
Skip for now if
- Projects that need installable, versioned packages today — the root manifest is private at 0.0.0.
- Readers expecting a top-level README with a quickstart; the root README is one line long.
- Non-TypeScript codebases: the toolchain (tsx, tsc, vitest) assumes TypeScript end to end.
Risks and cautions
MIT-licensed, buildable, and testable from a clean clone, but the installable surface lives in workspace packages outside the root manifest, the test loader is a fork, and the root README documents nothing.
- Root `version 0.0.0` combined with `private: true` means the repository root itself ships nothing.
- Documentation sits one directory down in packages/core/README.md, not at the repo entry.
- `tsx` resolves to `npm:@cordiverse/[email protected]`, a fork you inherit the moment you run the suite.
- README served from `master` while LICENSE and package.json come from `main` — verify the default branch before relying on either.
- License is MIT, copyright (c) 2021-present Shigma: commercial use, modification, and redistribution are permitted with the notice retained.
- The license carries the standard 'AS IS' clause — no warranty of any kind — so security review remains your responsibility.
- All 15 root dependencies are devDependencies (build and test tooling); the runtime dependency list of each workspace package must be audited separately.
- No security policy, audit output, or CI badge appears anywhere in the source pack, so treat the security posture as unverified.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
Vue core (reactivity via @vue/runtime-core) | You want a long-tested composability and reactivity model with first-class documentation. | You buy into Vue's component rendering model rather than a standalone meta-framework. |
NestJS | You need a structured server-side TypeScript framework with modules and dependency injection built in. | Heavier, opinionated runtime built around decorators and a fixed module system. |
InversifyJS | You only need an IoC/DI container to compose TypeScript services. | Requires decorator metadata configuration (experimentalDecorators, emitDecoratorMetadata). |
tsyringe | You want a lightweight DI resolver from Microsoft with minimal setup. | Far smaller feature set than a full framework. |
What this trend reveals
Documentation gap at the front door
The root README is literally './packages/core/README.md'. A contributor who writes a real landing page — an install snippet plus one diagram of the packages/*/external/* split — removes the biggest friction for the 719 new arrivals.
Open the root README, count its lines (one), then time how long a newcomer needs to reach any runnable instruction starting from packages/core/README.md.
A copyable monorepo blueprint
The yakumo pipeline (`yakumo esbuild && yakumo tsc`, three coverage reporters, `eslint --cache`, pinned [email protected]) is a complete, working reference for any TypeScript monorepo.
Fork the repo, run `yarn build && yarn test:html`, and open coverage/index.html; if it passes, the blueprint transfers.
De-risking the tsx fork
Tests import tsx as npm:@cordiverse/[email protected]. Upstreaming the fix, or documenting why the fork exists, would remove a hidden dependency for everyone who runs the suite.
Diff the fork's package against upstream tsx 4.19.3, then swap in the upstream package and check whether `yarn test` still passes.
RepoDaily verdict
Cordis is a MIT-licensed, ESM-first TypeScript monorepo whose root is a build harness around packages/core; the tagline is intriguing, the toolchain is verifiably modern, and the diligence path is short — build it, test it, read packages/core.