A command that packages a composed TypeScript API client as a publishable npm package, including built JavaScript, type declarations, package metadata, documentation, and examples. npm is the main package registry for JavaScript and TypeScript libraries.

Use it to build a zero-dependency TypeScript SDK, control included modules and exports, generate its README and package files, and prepare it for npm publishing.

It turns a development client into a distributable package that other projects can install from a registry.

bundle — Skill for Claude Code by finom/vovk

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add finom/vovk --skill bundle

Clone the repo

git clone --depth 1 https://github.com/finom/vovk

Made for: Claude Code.

Or install vovk, the plugin that ships this one along with the rest of its 15 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/finom/vovk/bundle/github.svg)](https://agentmods.dev/skills/finom/vovk/bundle)

Your own site

<a href="https://agentmods.dev/skills/finom/vovk/bundle"><img src="https://agentmods.dev/badge/skills/finom/vovk/bundle/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/finom/vovk/bundle"><img src="https://agentmods.dev/badge/skills/finom/vovk/bundle.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 250 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,335 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 5 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 49
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 161
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 217
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 226
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 229
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00250	$0.03335
Opus 5.5	$0.00100	$0.01334
Sonnet 5.5	$0.00050	$0.00667
Haiku 4.5	$0.00025	$0.00333

Measured 8d ago against content hash 9ba60bf101a7, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bundle scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

Vovk is bundler-agnostic — `esbuild`, `tsup`, `tsdown`, even `child_process` shell-out work. Only **tsdown** tested by Vovk's authors; docs warn: **pin `[email protected]`** until newer versions confirmed compatible.

skills/bundle/SKILL.md · 236 lines

How it starts

The opening of the file, as written. The whole thing — 236 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Vovk.ts `vovk bundle`

vovk bundle packages composed TypeScript client as zero-dep npm package — pre-built JS + .d.ts, auto-gen package.json, auto-gen README.md w/ samples, ready for npm publish. Release step: vovk generate → in-project client for dev; vovk bundle → distributable SDK installed from registry.

TypeScript-only. Despite name, ships no Python/Rust clients. Those have own templates (py / pySrc / rs / rsSrc) and own publish flows — see python and rust skills.

`bundle` vs `generate`

Command	Purpose	Output	When
`vovk generate`	In-project TypeScript client + OpenAPI spec	`src/client/` (or `client/` without `src/app`), `.vovk-schema/`	Every build (`prebuild` hook), on schema changes during `vovk dev`.
`vovk bundle`	Publishable npm package — pre-built JS + `.d.ts` + `package.json` + `README.md`	`dist/` ready for `npm publish`	Ship SDK outside Next.js app.

Don't run vovk bundle in normal dev; in-project client faster. Bundle when you need registry artifact.

How bundling works

Vovk gens TypeScript client into prebundleOutDir (default tmp_prebundle) via tsBase template — uncompiled .ts source.
Vovk calls your bundle.build({ entry, outDir, prebundleDir }) async fn. Plugs in any bundler (tsdown only tested one) to compile entry (the tmp_prebundle/index.ts) → JS + .d.ts under outDir (default dist).
Vovk emits package.json and README.md from packageJson and readme templates into outDir.
Vovk deletes prebundleOutDir unless keepPrebundleDir: true (handy for debugging prebundled source).

npx vovk bundle
npm publish dist

Published package consumed exactly like the in-project @/client:

import { UserRPC } from 'my-api-bundle';

await UserRPC.getUser({ params: { id: '123' } });

All TS-client features (call shape, withDefaults, type inference, schema access) survive bundle.

`bundle.build` — required entry point

Read the full file on GitHub · 236 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago Changed · -20 lines 9ba60bf101a7
9d ago Changed · +3 lines 3ecba32bf7a4
14d ago Changed · -2 lines abbcad62c805
20d ago Changed 0e8b4a01ca3a
1mo ago First seen · 255 lines · 250 tokens per session scan A 571e4c77238c

Subscribe to this mod's changes

bundle is a skill published in the GitHub repository finom/vovk (54 stars, last pushed today), licensed MIT. It adds 250 tokens to every session and 3,335 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Languages TypeScript ai-tools decorators nextjs nodejs rest-api rpc

psl-ast-layers

How to use the PSL syntax tree layers (green tree, red tree, strongly-typed AST classes) correctly. Use for any PSL-related work: PSL interpreters (contract-psl), helpers inside the psl-parser package, the language server, formatters, or anything else that consumes parse() output from @internal/psl-parser.

prisma/orm · 78 tokens

ast-visitor-pattern

Use the frozen-class/visitor pattern for discriminated unions that have multiple dispatch sites. Use when creating a new set of variants (commands, IR nodes, factory calls) that will be switched over in 2+ places, or when refactoring an existing union type that has grown multiple switch sites.

prisma/orm · 65 tokens

no-bare-casts

Writing as in TypeScript or TSX production code, modifying a file that contains a bare as cast, silencing a type error with a cast, encountering as unknown as, or reviewing a cast site.

prisma/orm · 52 tokens

client-setup

Create a vanilla tRPC client with createTRPCClient (), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typing.

trpc/trpc · 63 tokens

adapter-express

Mount tRPC as Express middleware with createExpressMiddleware() from @trpc/server/adapters/express. Access Express req/res in createContext via CreateExpressContextOptions. Mount at a path prefix like app.use('/trpc', ...). Avoid global express.json() conflicting with tRPC body parsing for FormData.

trpc/trpc · 67 tokens

trpc-router

Entry point for all tRPC skills. Decision tree routing by task: initTRPC.create(), t.router(), t.procedure, createTRPCClient, adapters, subscriptions, React Query, Next.js, links, middleware, validators, error handling, caching, FormData.

trpc/trpc · 59 tokens

bundle