Install
$ agentstack add skill-kwaa-skills-kwaa-typescript-infra ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
TypeScript infrastructure
General
- Inspect and preserve existing repository conventions before applying these preferences.
- Prefer ESM, strict TypeScript, shared root configuration, and small package-level scripts.
- Keep library, Node.js, application, documentation, and generated-code concerns separate.
- Do not add tooling without a concrete task or quality gate that uses it.
- Use
kwaa-typescript-tastefor source-level TypeScript design and style.
pnpm workspace
- Pin pnpm with the root
packageManagerfield. - Keep the workspace root private and set
"type": "module". - Define package groups explicitly in
pnpm-workspace.yaml. - Use
workspace:for internal dependencies. - Enable
trustPolicy: no-downgradewhen supported. - Keep
onlyBuiltDependenciesminimal.
Catalogs
Use named catalogs in pnpm-workspace.yaml:
| Catalog | Purpose | | --- | --- | | prod | Production dependencies | | inlined | Dependencies inlined by the bundler | | dev | Linting, building, and testing tools | | frontend | Frontend libraries |
Avoid the default catalog. Adjust names and add focused catalogs for project-specific compatibility matrices.
Checking npm package versions
Use fast-npm-meta instead of fetching the full registry metadata:
pnpm dlx fast-npm-meta version vite
pnpm dlx fast-npm-meta version "react@^19.2"
pnpm dlx fast-npm-meta version vite react react-dom
pnpm dlx fast-npm-meta version vite --json
pnpm dlx fast-npm-meta full vite
Prefer this over npm view version when only package versions or dist-tags are needed.
TypeScript
Prefer @moeru/tsconfig for portable library code:
{
"extends": "@moeru/tsconfig",
"include": ["packages/**/src", "packages/**/test"]
}
Use its Node.js preset for configs and scripts:
{
"extends": "@moeru/tsconfig/tsconfig.node.json",
"include": ["**/*.config.ts", "**/scripts/**/*.ts"]
}
Keep the root config solution-style:
{
"references": [
{ "path": "./tsconfig.lib.json" },
{ "path": "./tsconfig.node.json" }
],
"files": []
}
- Keep strictness enabled; fix types instead of weakening compiler options.
- Keep Node.js APIs out of portable library modules.
Linting
Prefer @moeru/eslint-config with a small flat config:
import { defineConfig } from '@moeru/eslint-config'
export default defineConfig()
.append({
ignores: ['src/generated/**/*.ts'],
})
- Use focused overrides and ignore generated files explicitly.
- Provide
pnpm lintand supportpnpm lint --fix. - Add Oxlint only when lint speed is a demonstrated concern. Keep ESLint as the source of truth and avoid duplicated rule configuration.
- Use
.editorconfigwith UTF-8, LF, two spaces, final newlines, and trimmed trailing whitespace.
Testing
- Use Vitest with shared root configuration.
- Keep package tests in
test/unless the repository already colocates them. - Use
describeandit. - Use snapshots for complex stable outputs, generated schemas, protocol events, and binary fixtures.
- Prefer deterministic fixtures or explicit local-service setup over developer-machine state.
- Limit workspace concurrency when tests share constrained resources.
Packages and publishing
- Publish pure ESM unless compatibility requirements demand otherwise.
- Keep packages focused; use aggregate packages only as convenience entry points.
- Set
"sideEffects": falseonly when accurate. - Export source during workspace development and built files when publishing:
{
"exports": "./src/index.ts",
"files": ["dist"],
"publishConfig": {
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./package.json": "./package.json"
},
"main": "./dist/index.js",
"types": "./dist/index.d.ts"
}
}
- Declare every public subpath explicitly, including
./package.json. - Put runtime dependencies in
dependencies, optional host integrations inpeerDependencies, and tooling indevDependencies. - Prefer pkgroll or tsdown for low-configuration ESM library builds.
- Inspect packed contents and export resolution before publishing.
Optional acceleration
- Add Turborepo only when dependency-aware caching benefits the workspace.
- Keep
turbo.jsonsmall and declare build outputs such asdist/**. - Let package scripts own tasks and Turbo only orchestrate them.
- Treat Oxlint similarly: add it for measurable lint performance benefits, not by default.
Versioning
- Use one workspace version for packages released as a coordinated suite; otherwise preserve independent versions.
- Prefer an explicit version-bump tool over manual package edits.
- Build all publishable packages before release.
- Use npm provenance when the release environment supports trusted publishing.
Final checks
Run lint, build, and relevant tests. Verify package exports, dependency classes, packed contents, and that published consumers resolve built JavaScript and declarations.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: kwaa
- Source: kwaa/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.