
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
One-function SDK for creating .uix files from AI-generated code.
npm install @dotuix/ai
For AI agents using tool calls, use
@dotuix/mcpinstead. This package is for AI-generated Node.js / TypeScript scripts that build.uixfiles programmatically.
import { createUIX } from "@dotuix/ai";
const path = await createUIX({
manifest: {
uix: "1.0",
id: "com.example.myapp",
name: "My App",
version: "1.0.0",
entry: "index.html",
mode: "window",
},
files: {
"index.html": `<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><title>My App</title></head>
<body>
<h1>Hello from .uix</h1>
<script src="app.js"></script>
</body>
</html>`,
"app.js": `(async () => {
const manifest = await uix.manifest();
document.querySelector('h1').textContent = manifest.name;
})();`,
},
});
console.log(path); // /tmp/dotuix-xxx/my-app.uix — ready to open in the viewer
That's it. createUIX handles:
ai.generatedBy and ai.generatedAt in the manifestdotuix pack to produce the .uix filecreateUIX(options: CreateUIXOptions): Promise<string>
Returns the absolute path to the packed .uix file.
CreateUIXOptions| Field | Type | Required | Description |
|---|---|---|---|
manifest | Record<string, unknown> | Yes | manifest.json content. The ai block is merged and stamped automatically. |
files | Record<string, string> | Yes | Source files as { "relative/path": "utf-8 content" }. Do not include manifest.json. |
output | string | No | Absolute path for the output .uix file. Defaults to a temp directory. |
generatedBy | string | No | Overrides ai.generatedBy. Defaults to "@dotuix/ai". |
ai provenance blockEvery .uix created via createUIX gets an ai block stamped in its
manifest.json:
{
"ai": {
"generatedBy": "@dotuix/ai",
"generatedAt": "2026-05-19T12:00:00Z"
}
}
Pass capabilities in your manifest to declare what the app does:
manifest: {
// ...
ai: {
capabilities: ["search", "chat"],
},
},
The final manifest will have generatedBy and generatedAt merged in.
| Scenario | Use |
|---|---|
| Talking to Claude Desktop / Cursor / Copilot | @dotuix/mcp |
AI writes a Node.js script that creates a .uix | @dotuix/ai |
| Packing a manually written app | @dotuix/cli (dotuix pack) |
| Programmatic pack/unpack/validate in any context | @dotuix/core |
@dotuix/cli installed globally: npm install -g @dotuix/cliFAQs
One-function SDK for creating .uix files from AI-generated code
The npm package @dotuix/ai receives a total of 3 weekly downloads. As such, @dotuix/ai popularity was classified as not popular.
We found that @dotuix/ai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.