@nockdev/awf 6.2.0

package/.agent/skills/cross-cutting/deno/data/runtime.yaml

@@ -0,0 +1,260 @@
+# =============================================================================
+# Deno 2.2+ Runtime Patterns (Feb 2026)
+# =============================================================================
+# Core runtime APIs and server patterns
+
+metadata:
+  skill: deno
+  domain: runtime
+  version: "2.6.0"
+  updated: "2026-02-05"
+  patterns_count: 12
+
+patterns:
+  - id: deno001
+    name: Deno.serve
+    category: server
+    version: "2.0+"
+    description: High-performance HTTP server with async iterator support
+    text: http server web request response handler Deno.serve
+    example: |
+      Deno.serve({ port: 3000 }, async (req) => {
+        const url = new URL(req.url);
+        if (url.pathname === "/api") {
+          return Response.json({ status: "ok" });
+        }
+        return new Response("Hello World");
+      });
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/runtime/http_server_apis
+
+  - id: deno002
+    name: Deno.openKv
+    category: database
+    version: "1.32+"
+    description: Built-in key-value store with ACID transactions
+    text: kv key value store persistent database kvstore
+    example: |
+      const kv = await Deno.openKv();
+
+      // Set value
+      await kv.set(["users", "user1"], { name: "Alice" });
+
+      // Get value
+      const result = await kv.get(["users", "user1"]);
+      console.log(result.value);
+
+      // Atomic transactions
+      await kv.atomic()
+        .set(["count"], 1)
+        .commit();
+    severity: HIGH
+    docs_url: https://docs.deno.com/deploy/kv/manual
+
+  - id: deno003
+    name: "npm: specifier"
+    category: compatibility
+    version: "1.28+"
+    description: "Direct npm package usage with npm: prefix"
+    text: npm import package module compatibility node
+    example: |
+      // Import npm packages directly
+      import express from "npm:express@4";
+      import _ from "npm:lodash";
+
+      // Works with most npm packages
+      const app = express();
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/node/npm_specifiers
+
+  - id: deno004
+    name: "jsr: specifier"
+    category: registry
+    version: "2.0+"
+    description: JavaScript Registry (JSR) for type-safe modules
+    text: jsr javascript registry import module std standard
+    example: |
+      // Import from JSR
+      import { copy } from "jsr:@std/fs@1";
+      import { assertEquals } from "jsr:@std/assert@1";
+
+      // Standard library
+      import { parse } from "jsr:@std/yaml@1";
+    severity: HIGH
+    docs_url: https://jsr.io
+
+  - id: deno005
+    name: TypeScript Support
+    category: language
+    version: "1.0+"
+    description: First-class TypeScript support without configuration
+    text: typescript types strict native support type checking
+    example: |
+      // No tsconfig needed - just write .ts files
+      interface User {
+        id: number;
+        name: string;
+      }
+
+      function greet(user: User): string {
+        return `Hello, ${user.name}!`;
+      }
+
+      // Type check: deno check main.ts
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/advanced/typescript
+
+  - id: deno006
+    name: WebAssembly Support
+    category: wasm
+    version: "2.1+"
+    description: First-class WebAssembly module imports
+    text: webassembly wasm import module native performance
+    example: |
+      // Import Wasm directly
+      import { add } from "./math.wasm";
+
+      console.log(add(1, 2)); // 3
+
+      // Also works with fetch
+      const wasm = await WebAssembly.instantiateStreaming(
+        fetch("./module.wasm")
+      );
+    severity: MEDIUM
+    docs_url: https://docs.deno.com/runtime/manual/runtime/webassembly
+
+  - id: deno007
+    name: "jsr: in package.json"
+    category: compatibility
+    version: "2.6+"
+    description: Use JSR packages directly in package.json (Feb 2026)
+    text: jsr package.json npm compatibility registry dependencies
+    example: |
+      // package.json - Deno 2.6+ supports jsr: scheme
+      {
+        "dependencies": {
+          "@std/fs": "jsr:@std/fs@1",
+          "@std/yaml": "jsr:@std/yaml@1",
+          "express": "npm:express@4"
+        }
+      }
+
+      // Run: deno install && deno run main.ts
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/node/npm_specifiers
+
+  - id: deno008
+    name: "deno init --npm"
+    category: tooling
+    version: "2.1+"
+    description: Scaffold projects using npm templates (Vite, Next.js, etc.)
+    text: init scaffold template npm vite nextjs project setup
+    example: |
+      # Create Vite project
+      deno init --npm vite
+
+      # Create other npm-based projects
+      deno init --npm create-remix
+      deno init --npm nuxi
+
+      # Run the project
+      cd my-project && deno task dev
+    severity: MEDIUM
+    docs_url: https://docs.deno.com/runtime/manual/tools/init
+
+  # ✅ NEW: Deno 2.2-2.3 Features (Feb-May 2025)
+  - id: deno009
+    name: Built-in OpenTelemetry
+    category: observability
+    version: "2.2+"
+    description: |
+      Native OpenTelemetry support for logs, metrics, traces.
+      Auto-instruments console.log, Deno.serve, fetch.
+    text: opentelemetry otel tracing metrics logs observability monitoring
+    example: |
+      // ✅ Deno 2.2+: Enable OpenTelemetry
+      // Run: OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317 deno run main.ts
+
+      // Auto-instrumented:
+      Deno.serve((req) => {
+        console.log("Request received"); // → Log exported
+        return new Response("Hello");    // → Span exported
+      });
+
+      // Manual instrumentation with npm package
+      import { trace } from "npm:@opentelemetry/api";
+
+      const tracer = trace.getTracer("my-app");
+      const span = tracer.startSpan("custom-operation");
+      span.end();
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/observability
+
+  - id: deno010
+    name: Local npm Packages
+    category: development
+    version: "2.3+"
+    description: Use local npm packages for testing and development
+    text: local npm development test link packages nodeModulesDir
+    example: |
+      // deno.json - Configure local npm packages
+      {
+        "nodeModulesDir": "auto",  // or "manual"
+        "imports": {
+          "my-local-pkg": "./packages/my-local-pkg"
+        }
+      }
+
+      // Use local package
+      import { myFunction } from "my-local-pkg";
+
+      // Install: deno install
+      // Works like npm link for local development
+    severity: MEDIUM
+    docs_url: https://docs.deno.com/runtime/manual/node
+
+  - id: deno011
+    name: Improved deno compile
+    category: tooling
+    version: "2.3+"
+    description: |
+      Compiled binaries support FFI and Node native add-ons.
+      Deno.build.standalone boolean for runtime detection.
+    text: compile standalone binary ffi native addon executable
+    example: |
+      // ✅ Compiled binary with FFI support
+      // Requires: deno compile --allow-ffi
+
+      import { dlopen } from "bun:ffi"; // Works in compiled binary
+
+      // Detect if running as standalone
+      if (Deno.build.standalone) {
+        console.log("Running as compiled executable");
+      }
+
+      // Exclude files from bundle
+      // deno compile --exclude=dev.config.ts main.ts
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/tools/compiler
+
+  - id: deno012
+    name: Explicit Resource Management
+    category: language
+    version: "2.3+"
+    description: TypeScript 5.8 using keyword for automatic resource cleanup
+    text: using resource management dispose cleanup async
+    example: |
+      // ✅ Deno 2.3+: Explicit resource management
+      async function readFile() {
+        using file = await Deno.open("data.txt");
+        // File is automatically closed when scope exits
+        
+        const content = await file.readable.getReader().read();
+        return content;
+      }
+
+      // Async version
+      await using db = await Deno.openKv();
+      // KV is automatically closed
+    severity: MEDIUM
+    docs_url: https://docs.deno.com/runtime/manual/advanced/typescript

package/.agent/skills/cross-cutting/deno/data/security.yaml

@@ -0,0 +1,168 @@
+# =============================================================================
+# Deno 2.1+ Security & Permissions Patterns (Feb 2026)
+# =============================================================================
+# Security-first permission model
+
+metadata:
+  skill: deno
+  domain: security
+  version: "2.1.0"
+  updated: "2026-02-05"
+  patterns_count: 9
+
+patterns:
+  - id: deno010
+    name: Permission Flags
+    category: permissions
+    version: "1.0+"
+    description: Explicit permission grants for file, network, environment access
+    text: permissions allow net read write env run ffi flags security
+    example: |
+      # Allow network access to specific hosts
+      deno run --allow-net=api.example.com,localhost:3000 server.ts
+
+      # Allow read access to specific directory
+      deno run --allow-read=/app/data config.ts
+
+      # Allow environment variables
+      deno run --allow-env=DATABASE_URL,API_KEY app.ts
+    severity: CRITICAL
+    docs_url: https://docs.deno.com/runtime/manual/basics/permissions
+
+  - id: deno011
+    name: --allow-net
+    category: permissions
+    version: "1.0+"
+    description: Network access permission with host/port restrictions
+    text: allow net network http fetch websocket permission
+    example: |
+      # Unrestricted network access (dangerous)
+      deno run --allow-net app.ts
+
+      # Restricted to specific hosts
+      deno run --allow-net=api.example.com app.ts
+
+      # Restricted to specific ports
+      deno run --allow-net=:8080 app.ts
+    severity: CRITICAL
+    docs_url: https://docs.deno.com/runtime/manual/basics/permissions#network-access
+
+  - id: deno012
+    name: --allow-read/write
+    category: permissions
+    version: "1.0+"
+    description: File system access permissions with path restrictions
+    text: allow read write file filesystem permission directory
+    example: |
+      # Read specific files/directories
+      deno run --allow-read=./config,./data app.ts
+
+      # Write to specific directory
+      deno run --allow-write=./output,./logs app.ts
+
+      # Combine read and write
+      deno run --allow-read=./src --allow-write=./dist build.ts
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/basics/permissions#file-system-access
+
+  - id: deno013
+    name: --allow-env
+    category: permissions
+    version: "1.0+"
+    description: Environment variable access with wildcards (2.1+)
+    text: allow env environment variable permission wildcard
+    example: |
+      # Specific variables
+      deno run --allow-env=DATABASE_URL,API_KEY app.ts
+
+      # Wildcard patterns (Deno 2.1+)
+      deno run --allow-env=AWS_* app.ts
+
+      # All env vars (dangerous)
+      deno run --allow-env app.ts
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/basics/permissions#environment-variables
+
+  - id: deno014
+    name: --allow-run
+    category: permissions
+    version: "1.0+"
+    description: Subprocess execution permission (potential privilege escalation)
+    text: allow run subprocess execute command shell permission
+    example: |
+      # Allow specific commands
+      deno run --allow-run=git,npm script.ts
+
+      # WARNING: Unrestricted run can escalate privileges
+      # deno run --allow-run script.ts  # Dangerous!
+
+      // In code:
+      const cmd = new Deno.Command("git", { args: ["status"] });
+      const output = await cmd.output();
+    severity: CRITICAL
+    docs_url: https://docs.deno.com/runtime/manual/basics/permissions#running-subprocesses
+
+  - id: deno015
+    name: deno audit
+    category: security
+    version: "2.0+"
+    description: Audit dependencies for known vulnerabilities
+    text: audit security vulnerability scan dependencies check
+    example: |
+      # Audit all dependencies
+      deno audit
+
+      # Check specific lock file
+      deno audit --lock=deno.lock
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/tools/dependency_inspector
+
+  - id: deno016
+    name: Permission Prompts
+    category: permissions
+    version: "2.1+"
+    description: Interactive permission prompts with stack traces for debugging
+    text: permission prompt interactive stack trace debug
+    example: |
+      # Run without --allow flags to get interactive prompts
+      deno run server.ts
+
+      # Deno will ask:
+      # ⚠️ Deno requests net access to "api.example.com".
+      #    at server.ts:5:20
+      # Allow? [y/n/A] (y = yes, n = no, A = allow all)
+    severity: MEDIUM
+    docs_url: https://docs.deno.com/runtime/manual/basics/permissions
+
+  - id: deno017
+    name: Deny Permissions
+    category: permissions
+    version: "2.0+"
+    description: Explicitly deny specific permissions
+    text: deny permission restrict block security
+    example: |
+      # Deny network but allow other permissions
+      deno run --allow-all --deny-net=evil.com app.ts
+
+      # Deny write to system directories
+      deno run --allow-write --deny-write=/etc,/system app.ts
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/basics/permissions#denying-access
+
+  - id: deno018
+    name: DENO_AUDIT_PERMISSIONS
+    category: security
+    version: "2.0+"
+    description: Generate audit log of all permission requests for security review
+    text: audit permissions log security trace monitoring env variable
+    example: |
+      # Enable permission audit logging
+      export DENO_AUDIT_PERMISSIONS=1
+      deno run server.ts
+
+      # Output shows all permission requests with stack traces:
+      # [audit] read: ./config.json at main.ts:5:10
+      # [audit] net: api.example.com at server.ts:15:3
+      # [audit] env: DATABASE_URL at db.ts:8:12
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/basics/permissions

package/.agent/skills/cross-cutting/deno/data/tooling.yaml

@@ -0,0 +1,133 @@
+# =============================================================================
+# Deno 2.1+ Development Tools Patterns (Feb 2026)
+# =============================================================================
+# CLI tools and development utilities
+
+metadata:
+  skill: deno
+  domain: tooling
+  version: "2.1.0"
+  updated: "2026-02-05"
+  patterns_count: 6
+
+patterns:
+  - id: deno020
+    name: Deno.test
+    category: testing
+    version: "1.0+"
+    description: Built-in test runner with BDD-style syntax
+    text: test runner describe expect assert unit integration
+    example: |
+      import { assertEquals } from "jsr:@std/assert";
+
+      Deno.test("addition works", () => {
+        assertEquals(1 + 2, 3);
+      });
+
+      Deno.test({
+        name: "async test",
+        async fn() {
+          const result = await fetch("http://localhost:3000");
+          assertEquals(result.status, 200);
+        },
+      });
+
+      // Run: deno test --watch --coverage
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/basics/testing
+
+  - id: deno021
+    name: deno compile
+    category: cli
+    version: "1.6+"
+    description: Compile to standalone executable with embedded assets (2.1+)
+    text: compile standalone executable binary deploy embed assets
+    example: |
+      # Basic compile
+      deno compile --output=myapp main.ts
+
+      # With embedded assets (Deno 2.1+)
+      deno compile --include=./assets --output=myapp main.ts
+
+      # Cross-compilation
+      deno compile --target=x86_64-unknown-linux-gnu main.ts
+      deno compile --target=x86_64-pc-windows-msvc main.ts
+    severity: HIGH
+    docs_url: https://docs.deno.com/runtime/manual/tools/compiler
+
+  - id: deno022
+    name: deno task
+    category: cli
+    version: "1.20+"
+    description: Define project-specific scripts like npm scripts
+    text: task script runner deno.json npm scripts
+    example: |
+      // deno.json
+      {
+        "tasks": {
+          "dev": "deno run --watch --allow-all server.ts",
+          "test": "deno test --coverage",
+          "build": "deno compile --output=dist/app main.ts"
+        }
+      }
+
+      # Run: deno task dev
+    severity: MEDIUM
+    docs_url: https://docs.deno.com/runtime/manual/tools/task_runner
+
+  - id: deno023
+    name: deno add/remove
+    category: cli
+    version: "2.0+"
+    description: Simplified dependency management
+    text: add remove install dependency package management
+    example: |
+      # Add JSR packages
+      deno add @std/fs @std/yaml
+
+      # Add npm packages
+      deno add npm:express npm:lodash
+
+      # Remove packages
+      deno remove @std/fs
+
+      # Install all dependencies
+      deno install
+    severity: MEDIUM
+    docs_url: https://docs.deno.com/runtime/manual/basics/modules
+
+  - id: deno024
+    name: deno outdated
+    category: cli
+    version: "2.1+"
+    description: Check for outdated dependencies
+    text: outdated dependencies update check version
+    example: |
+      # Check outdated deps
+      deno outdated
+
+      # Update to latest versions
+      deno outdated --update
+
+      # Check specific packages
+      deno outdated @std/fs
+    severity: LOW
+    docs_url: https://docs.deno.com/runtime/manual/basics/modules
+
+  - id: deno025
+    name: dx (package runner)
+    category: cli
+    version: "2.0+"
+    description: Run npm packages without install (like npx)
+    text: dx npx package runner execute binary
+    example: |
+      # Run prettier without installing
+      dx prettier --write .
+
+      # Run eslint
+      dx eslint .
+
+      # Run tsc
+      dx typescript --version
+    severity: MEDIUM
+    docs_url: https://docs.deno.com/runtime/manual/tools/dx

package/.agent/skills/cross-cutting/docker/META.yaml

@@ -0,0 +1,65 @@
+name: docker
+version: "6.2.0"
+category: infrastructure
+tier: 3
+
+desc: "Docker containerization patterns for builds, security, and deployment. Covers Compose v5, Hardened Images, Build Cloud, Bake."
+
+patterns:
+  total: 18
+  domains:
+    build: 5
+    compose: 5
+    security: 4
+    runtime: 4
+
+hsa:
+  enabled: true
+  adapter: docker_adapter.py
+
+triggers:
+  file_patterns:
+    - "Dockerfile"
+    - "Dockerfile.*"
+    - "docker-compose.yml"
+    - "compose.yml"
+    - "docker-bake.hcl"
+  keywords:
+    # Docker
+    - docker
+    - dockerfile
+    - container
+    - image
+    - docker build
+    - docker run
+    # Compose
+    - docker compose
+    - compose
+    - multicontainer
+    - services
+    - compose v5
+    # Build
+    - buildx
+    - multi-stage
+    - buildkit
+    - docker bake
+    - build cloud
+    # Security
+    - hardened image
+    - rootless
+    - distroless
+    - container security
+  intents:
+    - create dockerfile
+    - optimize docker
+    - secure container
+    - docker compose
+
+related_skills:
+  - kubernetes
+  - ci-cd
+  - aws
+  - security
+
+prevent_confusion_with:
+  - kubernetes: "docker is for container building, kubernetes is orchestration"