srstomp/sdk-development
plugins/pokayokay/skills/sdk-development/SKILL.md
Use when building TypeScript SDKs, extracting shared code into packages, creating developer tooling libraries, designing clean API surfaces, or publishing to npm (public or private). Covers typed clients, error handling, multi-target bundling (ESM/CJS/browser).
$ install --global
skillsauthnpx skillsauth add srstomp/pokayokay sdk-developmentInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 1, 2026, 1:18 AM133.7s1 file scanned
SKILL.md
- name:
- sdk-development
- description:
- Use when building TypeScript SDKs, extracting shared code into packages, creating developer tooling libraries, designing clean API surfaces, or publishing to npm (public or private). Covers typed clients, error handling, multi-target bundling (ESM/CJS/browser).
SDK Development
Create professional TypeScript SDKs from scratch or by extraction.
Key Principles
- Clean public API — Export only what consumers need, hide internals
- Type everything — Full type coverage for config, methods, responses, and errors
- Meaningful errors — Typed error classes with codes and context
- Sensible defaults — Works out of the box with minimal config
- Framework agnostic — Core SDK has no framework dependencies; add bindings separately
Quick Start Checklist
- Analyze scope: new SDK or extraction from existing app
- Design public API surface (exports, types, config)
- Implement client with typed methods and error handling
- Configure build for ESM/CJS/types (tsup recommended)
- Write tests (unit + integration) and examples
- Publish to npm with proper package.json exports field
References
| Reference | Description | |-----------|-------------| | extraction-scope-and-boundaries.md | Scope identification, dependency analysis, boundary definition | | extraction-usages-and-planning.md | Finding usages, test coverage, phased extraction plan | | package-structure-and-clients.md | SDK layout, client design patterns (single, modular, factory) | | configuration-and-api-design.md | Config interfaces, defaults, barrel exports, method signatures | | internal-architecture-and-best-practices.md | HTTP client, state management, tree-shaking, environment agnostic | | type-design.md | Strict types, branded types, generics, discriminated unions | | error-handling-and-async.md | Error class hierarchy, retry logic, request queues, token management | | events-storage-and-logging.md | Event emitter, storage abstraction, logger interface | | build-tools-and-output.md | tsup config, output formats, package.json exports, TypeScript config | | bundle-optimization-and-distribution.md | Bundle size, multi-platform builds, dual packages, monorepo | | publishing-and-registries.md | npm publishing, private registries, versioning, changelogs | | ci-cd-and-documentation.md | GitHub Actions, documentation, pre-publish checklist, deprecation |
Related Skills
srstomp/worktrees
development
VerifiedTrustedCommunity
Git worktree management for isolated task development
6SKILL.mdUpdated Apr 27, 2026
srstomp/work-session
development
VerifiedTrustedCommunity
Use when starting AI development sessions, resuming interrupted work, managing multi-session projects, or orchestrating work with human checkpoint control (supervised, semi-auto, auto, or unattended modes).
6SKILL.mdUpdated Apr 27, 2026
srstomp/verification-before-completion
testing
VerifiedTrustedCommunity
Use before claiming work is done, fixed, passing, ready to commit, ready to PR, or ready to mark complete. Requires fresh verification evidence and explicit command output before success claims.
6SKILL.mdUpdated Apr 27, 2026
srstomp/testing-strategy
development
VerifiedTrustedCommunity
Use when designing test architecture, building API test suites, validating API contracts, setting up component or E2E testing, managing test data, debugging flaky tests, reviewing coverage strategy, or organizing test files. Covers test pyramid, mocking (MSW), frontend (React Testing Library, Playwright), and CI integration.
6SKILL.mdUpdated Apr 27, 2026