
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@ariestools/toolchain
Advanced tools
Unified TypeScript toolchain for XY Labs — build, lint, test, deploy with auto-detected package manager and React support
Unified TypeScript toolchain for XY Labs — build, lint, test, deploy with auto-detected package manager and React support
Using npm:
npm install {{name}}
Using yarn:
yarn add {{name}}
Using pnpm:
pnpm add {{name}}
Using bun:
bun add {{name}}
xy repo init)Scaffold a toolchain-ready repo. Omit the template to answer setup questions (monorepo, React, package manager, skills tier).
# Interactive (recommended for new projects)
npx --package=@ariestools/toolchain xy repo init
# Explicit template + name (non-interactive defaults)
pnpm xy repo init cli my-cli --pm pnpm --skills-tier xy
# Single-package React tooling
pnpm xy repo init cli my-app --no-monorepo --react --skills-tier xl1
Useful flags:
| Flag | Meaning |
|---|---|
--pm | pnpm (default) / yarn / npm / bun |
--monorepo / --no-monorepo | Workspace layout vs single package |
--react / --no-react | eslint-config-react-flat + tsconfig-react vs flat |
--skills-tier | none / xy / xyo / xl1 — install matching agent skills |
--skills-optional | With xl1, also install xl1-scaffold / xl1-build |
--skip-install / --skip-git | Skip post-scaffold steps |
-y / --yes | Accept wizard defaults (project name still required) |
package-compile / package-build / package-recompileTo add steps to a per-package build phase, override the matching script in your package's package.json and chain to the toolchain default via the matching -only bin:
{
"scripts": {
"package-compile": "package-compile-only && tsx scripts/generate-types.ts"
}
}
Do not call pnpm package-compile / yarn package-compile / pnpm run package-compile from the override — those re-enter the same npm script and recurse infinitely. The -only bin variants exist precisely so your override can invoke the toolchain default once and add work around it.
Available -only variants: package-compile-only, package-build-only, package-recompile-only.
Monolith packages can copy already-built runtime files into exact public output
paths without a package-local post-processing script. Configure
compile.monolith.copyEntries as platform → output path → source:
import type { XyConfig } from '@ariestools/toolchain'
const config: XyConfig = {
compile: {
mode: 'monolith',
monolith: {
copyEntries: {
neutral: {
'hash/worker/subtleHash-bundle.mjs':
'@xyo-network/sdk-protocol-core/hash/worker/subtleHash-bundle.mjs',
},
},
modules: [
{
name: 'hash',
export: true,
reexport: '@xyo-network/sdk-protocol-core/hash',
},
],
platforms: ['neutral'],
},
},
}
export default config
The example copies the dependency export byte-for-byte to
dist/neutral/hash/worker/subtleHash-bundle.mjs. The output key is also the
subpath suggested by xy publint --fix, so the corresponding package export is
./hash/worker/subtleHash-bundle.mjs.
Sources may be package export specifiers, paths relative to the compiling
package, or absolute paths. Copying runs only during emit, after normal monolith
compilation; --validate-only does not resolve or copy the configured sources.
Destinations must remain inside their configured dist/<platform> directory.
See the LICENSE file for license rights and limitations (LGPL-3.0-only).
FAQs
Unified TypeScript toolchain for XY Labs — build, lint, test, deploy with auto-detected package manager and React support
The npm package @ariestools/toolchain receives a total of 555 weekly downloads. As such, @ariestools/toolchain popularity was classified as not popular.
We found that @ariestools/toolchain demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.