@xylabs/toolchain
Unified TypeScript toolchain for XY Labs — build, lint, test, deploy with auto-detected package manager and React support
37
Versions
LGPL-3.0-only
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
joelbcarterjordantrouwrphansen91jonesmacatrouw
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Minor publish-metadata gap, no behavioral change; trusted high-volume publisher. | ai | |
| source-diff | net-exec-file:dist/bin/source-map-explorer.mjs | AI (source-diff): Bundled source-map-explorer CLI; child_process/fs usage is legitimate tool function. | ai | |
| source-diff | obfuscated-file:dist/bin/skills.mjs | AI (source-diff): Rolldown-bundled vendored CLI, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/bin/source-map-explorer.mjs | AI (source-diff): Rolldown-bundled vendored CLI, not true obfuscation. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Package explicitly declared as deprecated stub redirecting to successor package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Sparse metadata expected for an intentional deprecation stub. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): yaml is a well-established, safe library; addition is benign for this toolchain package. | ai | |
| dependencies | unvetted-dep:parse-git-config | AI (dependencies): parse-git-config is a well-known utility; appropriate for a build toolchain. | ai | |
| dependencies | unvetted-dep:license-checker | AI (dependencies): license-checker is a well-known utility; appropriate runtime dep for a build toolchain. | ai | |
| dependencies | unvetted-dep:types-package-json | AI (dependencies): types-package-json is a type definitions package; safe for a TypeScript toolchain. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): @types/node is framework-scoped and loaded by convention in TypeScript toolchains. | ai | |
| phantom-deps | phantom-dep:vite | AI (phantom-deps): vite is a legitimate runtime dep for this toolchain; loaded via config convention, not direct import. | ai |
Versions (showing 37 of 137)
| Version | Deps | Published |
|---|---|---|
| 7.13.12 | 25 / 18 | |
| 7.13.11 | 25 / 18 | |
| 7.13.10 | 25 / 18 | |
| 7.13.9 | 25 / 18 | |
| 7.13.8 | 25 / 18 | |
| 7.13.7 | 25 / 18 | |
| 7.13.6 | 25 / 18 | |
| 7.13.5 | 25 / 18 | |
| 7.13.4 | 25 / 18 | |
| 7.13.3 | 25 / 18 | |
| 7.13.2 | 25 / 18 | |
| 7.13.1 | 25 / 18 | |
| 7.13.0 | 25 / 18 | |
| 7.12.3 | 25 / 14 | |
| 7.12.2 | 25 / 14 | |
| 7.12.1 | 25 / 14 | |
| 7.12.0 | 25 / 14 | |
| 7.11.12 | 25 / 14 | |
| 7.11.11 | 25 / 14 | |
| 7.11.10 | 25 / 14 | |
| 7.11.9 | 25 / 14 | |
| 7.11.8 | 25 / 14 | |
| 7.11.7 | 25 / 14 | |
| 7.11.6 | 25 / 14 | |
| 7.11.5 | 25 / 14 | |
| 7.11.4 | 25 / 14 | |
| 7.11.3 | 25 / 14 | |
| 7.11.2 | 3 / 38 | |
| 7.11.0 | 25 / 16 | |
| 7.10.9 | 25 / 16 | |
| 7.10.8 | 25 / 16 | |
| 7.10.7 | 26 / 17 | |
| 7.10.5 | 26 / 16 | |
| 7.10.4 | 26 / 16 | |
| 7.10.3 | 26 / 16 | |
| 7.10.2 | 26 / 16 | |
| 7.10.1 | 26 / 16 |