@oriro/orirocli 0.1.0

package/skills/technical/gdpr-basics/SKILL.md

@@ -0,0 +1,145 @@
+---
+watermark: ORIRO
+name: gdpr-basics
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+
+
+
+
+
+
+
+
+  GDPR implementation guide — technical requirements, data mapping, consent management, privacy by design, and compliance for developers.
+
+
+
+  Sources: Google Search Central, GDPR text, AWS security documentation, Stripe API docs.
+---
+
+# GDPR Technical Implementation
+
+## Technical requirements for GDPR compliance
+
+### Consent management
+
+```ts
+// Store consent records — you must be able to prove consent
+interface ConsentRecord {
+  userId: string;
+  timestamp: Date;
+  ip: string;
+  userAgent: string;
+  consentVersion: string; // Version of your privacy policy
+  purposes: {
+    analytics: boolean;
+    marketing: boolean;
+    functional: boolean; // Usually pre-ticked if truly necessary
+  };
+}
+
+// Save to DB on consent
+await db.consentRecord.create({
+  data: {
+    userId: session.userId,
+    timestamp: new Date(),
+    ip: getClientIp(req),
+    userAgent: req.headers["user-agent"],
+    consentVersion: CURRENT_CONSENT_VERSION,
+    purposes: { analytics: true, marketing: false, functional: true },
+  },
+});
+```
+
+### Cookie consent banner requirements
+
+- Must present BEFORE setting non-essential cookies.
+- "Accept all" and "Reject all" buttons equally prominent.
+- Granular control must be available.
+- Pre-selected checkboxes for non-essential cookies = not valid consent.
+- Easy to withdraw consent (same ease as giving it).
+
+### Data subject rights implementation
+
+```ts
+// Data access request (must respond within 30 days)
+async function handleAccessRequest(userId: string) {
+  const userData = {
+    account: await db.user.findUnique({ where: { id: userId } }),
+    posts: await db.post.findMany({ where: { userId } }),
+    purchases: await db.order.findMany({ where: { userId } }),
+    consentHistory: await db.consentRecord.findMany({ where: { userId } }),
+    // Include all personal data you hold
+  };
+  return userData; // Send to user
+}
+
+// Deletion request (right to be forgotten)
+async function handleDeletionRequest(userId: string) {
+  // 1. Check if any legal obligation to retain (contracts, tax records — 7 years)
+  // 2. Anonymize or delete where no legal basis for retention
+  await db.user.update({
+    where: { id: userId },
+    data: {
+      email: `deleted-${userId}@deleted.invalid`,
+      name: "Deleted User",
+      phone: null,
+      deletedAt: new Date(),
+    },
+  });
+  // 3. Request deletion from third-party processors (analytics, email, CRM)
+  await analytics.deleteUser(userId);
+  await emailService.deleteContact(userId);
+}
+```
+
+## Data minimization
+
+Only collect what you actually use. Review forms — remove unnecessary fields.
+
+```ts
+// BAD: Collect everything
+const { name, email, phone, dob, address, employer, salary } = body;
+
+// GOOD: Collect only what you need for this service
+const { name, email } = body;
+```
+
+## Vendor management (Data Processing Agreements)
+
+Every vendor who processes personal data on your behalf needs a DPA.
+
+- Analytics (Mixpanel, Amplitude, PostHog)
+- Email (Mailchimp, SendGrid, Resend)
+- Cloud hosting (AWS, GCP, Vercel)
+- Support tools (Intercom, Zendesk)
+- Error tracking (Sentry)
+
+Most reputable vendors have standard DPAs (often in their terms or a self-serve portal).
+
+## Data breach response procedure
+
+```
+Hour 0-1: Identify and contain breach.
+Hour 1-4: Assess scope (what data, how many people, risk level).
+Hour 4-24: Internal notification chain. Legal counsel. DPO if you have one.
+Hour 24-72: Report to supervisory authority IF breach poses risk to individuals.
+           (In EU: your lead supervisory authority. UK ICO, CNIL France, BfDI Germany, etc.)
+Post-72h: If high risk to individuals: Notify affected individuals "without undue delay."
+```
+
+## Practical developer checklist
+
+- [ ] Privacy policy linked from all data collection points
+- [ ] Cookie consent before analytics/marketing cookies
+- [ ] Consent records stored with timestamp, version, IP
+- [ ] Access request process documented and tested
+- [ ] Deletion/anonymization process implemented
+- [ ] Data retention policy defined and enforced (auto-delete after X months)
+- [ ] All vendors have DPAs signed
+- [ ] Encryption at rest and in transit
+- [ ] Access controls and logging for personal data
+
+Sources: GDPR text (eur-lex.europa.eu — free), ICO guidance (ico.org.uk — free, best plain-language GDPR guides), EDPB guidelines (edpb.europa.eu — free)

package/skills/technical/launch-playbook/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/technical/launch-playbook/SKILL.md

@@ -0,0 +1,95 @@
+---
+watermark: ORIRO
+name: launch-playbook
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+
+
+
+  Product launch — pre-launch checklist, launch strategy, distribution channels, press, community, and post-launch iteration.
+
+
+
+
+
+
+
+
+  Sources: Google Search Central, GDPR text, AWS security documentation, Stripe API docs.
+---
+
+# Product Launch
+
+## Pre-launch checklist (weeks before)
+
+### Technical
+
+- [ ] Performance: Core Web Vitals all green. Load test with expected traffic.
+- [ ] Monitoring: Error tracking (Sentry), uptime monitoring (Better Uptime, Checkly), logging.
+- [ ] Analytics: Events fire correctly. Conversion tracking verified.
+- [ ] SEO: Title tags, meta descriptions, OG images, sitemap submitted.
+- [ ] Email: SPF/DKIM/DMARC configured. Test all transactional emails.
+- [ ] Payments: End-to-end checkout tested. Webhook handling verified.
+- [ ] Auth: Login, signup, password reset all tested.
+- [ ] Mobile: Test on iOS Safari and Chrome Android specifically.
+- [ ] Error pages: 404, 500 pages are branded and helpful.
+- [ ] Security: HTTPS, security headers, rate limiting in place.
+- [ ] Backups: Database backups verified. Restore tested.
+
+### Business
+
+- [ ] Legal: Terms of Service, Privacy Policy live and linked.
+- [ ] Support: Customer support channel set up and staffed.
+- [ ] Billing: Pricing page live, billing portal works, receipts send.
+- [ ] Onboarding: First user experience tested with 5 real people who don't know the product.
+- [ ] Docs: Basic documentation or FAQ available.
+
+## Launch channels
+
+### ProductHunt
+
+**Prepare 2-4 weeks before:**
+
+- Schedule for Tuesday-Thursday (higher traffic).
+- Prepare: tagline, description, gallery (screenshots/video demo).
+- Video demo (60-90 seconds) significantly boosts launch performance.
+- Ask your network to support, but don't beg — authentic supporters only.
+- Be available to respond to comments all launch day.
+- Goal: Top 5 of the day for meaningful traffic.
+
+### Hacker News (Show HN)
+
+- "Show HN: [Product name] – [what it does in plain English]"
+- Post Tuesday-Thursday morning, 9-11am Eastern.
+- Don't self-promote in comments. Answer questions genuinely.
+- Technical audience. Be honest about limitations.
+
+### Twitter/X and LinkedIn
+
+- Build in public before launch. Share progress updates. Announce launch day.
+- Maker community: Tag relevant builders and communities.
+- LinkedIn for B2B products: Often higher engagement than expected.
+
+### Direct outreach
+
+- Beta users: Personal email. Ask for reviews, tweets, testimonials.
+- Industry journalists: 1:1 embargoed pitch 1-2 weeks before.
+- Relevant newsletters: Find 5-10 newsletters whose audience matches.
+- Communities (Reddit, Discord, Slack): Find relevant communities. Engage authentically BEFORE launch.
+
+## Launch day operations
+
+- All hands monitoring: Be in Slack/Discord. Watch dashboards.
+- Respond to every comment, message, support ticket quickly.
+- Fix critical bugs immediately. Have rollback plan ready.
+- Screenshot and save all social mentions.
+- Keep a running "issues" document.
+
+## Post-launch
+
+**Week 1:** Fix what's broken. Respond to every user. Gather feedback.
+**Month 1:** Identify the users who love it. Why? Build more of that.
+**Iteration:** "Build → Measure → Learn" cycle. Ship improvements every week.
+
+Sources: Gabriel Weinberg "Traction" (principles), ProductHunt launch guide (free), Hacker News community guidelines (free), First Round Capital launch resources

package/skills/technical/marketing-copy/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/technical/marketing-copy/SKILL.md

@@ -0,0 +1,126 @@
+---
+watermark: ORIRO
+name: marketing-copy
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+
+
+
+
+
+
+
+
+
+
+
+  Marketing copywriting — headlines, landing pages, email subject lines, CTAs, and conversion-focused writing.
+  Sources: Google Search Central, GDPR text, AWS security documentation, Stripe API docs.
+---
+
+# Marketing Copywriting
+
+## The fundamental principle: benefits, not features
+
+**Feature:** "256GB storage"
+**Benefit:** "Store 50,000 songs and never delete a photo again"
+
+**Feature:** "Real-time collaboration"
+**Benefit:** "Your whole team edits together — no more 'final_v3_ACTUAL_FINAL.doc'"
+
+Always answer: "So what? What does this mean for me?"
+
+## Headlines — where 80% of the work happens
+
+### Proven headline formulas
+
+**The problem-solution:**
+"Stop losing customers to 3am cart abandonment. Never miss a sale again."
+
+**The outcome:**
+"Your first app, live in 24 hours — even if you've never written code."
+
+**The numbered list:**
+"7 reasons your cold emails go unread (and how to fix all of them today)"
+
+**The question:**
+"What if your product could sell itself while you sleep?"
+
+**The bold claim + proof:**
+"We 10x'd conversion rates in 90 days. Here's the exact process."
+
+**The before/after:**
+"From $0 to $47,000 MRR in 18 months. No prior startup experience."
+
+### Clarity beats clever
+
+Your reader is skimming. Clever requires effort. Clear is frictionless.
+Bad: "Unlock the potential of tomorrow's commerce, today."
+Good: "Build your online store in 30 minutes."
+
+## Landing page structure
+
+**Above the fold (what they see without scrolling):**
+
+1. Headline: Clear, compelling, instantly communicates the core value.
+2. Subheadline: Supports headline. Adds specificity.
+3. Hero image/video: Shows the product in use.
+4. Primary CTA: One button. Clear action. ("Start free trial", "Get early access")
+
+**Below the fold:** 5. Social proof: Logos, numbers, testimonials. Early as possible. 6. Problem/solution: Amplify the pain, then show your solution. 7. Features → Benefits: For each feature, the underlying benefit. 8. Testimonials: Real quotes. Real names. Real photos. 9. Pricing: Clear, honest, anchored. 10. FAQ: Objection handling. 11. Final CTA: Repeat the primary CTA.
+
+## Email subject lines
+
+### What drives opens
+
+**Curiosity:** "The mistake I made on my first launch"
+**Personalization:** "[Name], your weekly report is ready"
+**Specificity:** "Increase email open rates by 37% (one change)"
+**Benefit + urgency:** "Your free trial expires in 24 hours"
+**Plain/conversational:** "Quick question" (B2B especially)
+
+**Rules:**
+
+- Under 50 characters for mobile (preview)
+- Test with 5 people before sending: "Would you open this?"
+- Never mislead (destroys trust + violates CAN-SPAM/GDPR)
+- Preview text is your second subject line — use it
+
+## CTA (Call to Action) copy
+
+### Verb-first, specific, benefit-oriented
+
+Weak CTAs: "Submit," "Click here," "Learn more," "Continue"
+Strong CTAs: "Start building for free," "Get my free guide," "Save 20% today," "Book a 15-min demo"
+
+**Button copy formula:** [Verb] + [Specific outcome/object]
+"Start your free trial" / "Download the template" / "Calculate my savings"
+
+**Reduce friction:** "No credit card required" under sign-up buttons increases conversion 10-20%.
+
+## Testimonials that convert
+
+### What makes a great testimonial
+
+**Weak:** "Great product! Highly recommend." — John S.
+**Strong:** "We went from 2 hours/week manually updating spreadsheets to a 5-minute automated sync. That's 8 hours a month back. Worth every penny." — Sarah Chen, Operations Manager at Acme Corp (300 employees)
+
+Elements of a converting testimonial:
+
+- Specific outcome with numbers
+- Named person (first + last)
+- Title and company
+- Photo (increases trust significantly)
+- Directly addresses a common objection
+
+## Copywriting for technical products
+
+**Tech buyers are still human.** Don't hide behind jargon.
+**Translating tech specs:**
+Jargon: "99.99% uptime SLA with automated failover"
+Human: "Your app is always on. When a server fails, traffic switches in milliseconds. No downtime, ever."
+
+**Explain the 'so what':** "SOC 2 Type II certified" → "We've had independent auditors verify your data is protected by the highest enterprise security standards."
+
+Sources: David Ogilvy "Ogilvy on Advertising" (principles), Claude Hopkins "Scientific Advertising" (public domain), CopyHackers (copyhackers.com — free content), Joanna Wiebe copywriting resources (free), Swipe-worthy.com (free copywriting examples)

package/skills/technical/marketplace-builder/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/technical/marketplace-builder/SKILL.md

@@ -0,0 +1,105 @@
+---
+watermark: ORIRO
+disable-model-invocation: true
+name: marketplace-builder
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: >
+
+
+  Marketplace platforms — two-sided marketplaces, trust and safety, payments split, seller/buyer flows, and marketplace mechanics.
+
+
+
+  Sources: Stripe docs, Anthropic docs, Sanity/Contentful docs, industry-specific technical resources.
+---
+
+# Marketplace Platform Development
+
+## Two-sided marketplace fundamentals
+
+### The chicken-and-egg problem
+
+Most critical challenge: need supply to attract demand, need demand to attract supply.
+**Strategies:**
+
+- Single-side first: Build supply first (often cheaper/easier), then demand.
+- Fake it until real: Manually fulfill early orders (DoorDash founders delivered themselves).
+- Subsidy: Pay one side to participate initially.
+- Niche focus: Dominate a narrow niche completely before expanding.
+
+### Trust and safety
+
+Both sides must trust each other and the platform.
+**Verification:** Identity verification (driver's license, ID), professional licenses where needed, background checks.
+**Ratings and reviews:** Both sides rate each other. Fraud detection for fake reviews.
+**Escrow:** Hold buyer's payment until service/product delivered. Dispute resolution mechanism.
+**Insurance:** Platform liability coverage. Many marketplace gig workers need coverage.
+
+## Payment architecture
+
+### Connected accounts (Stripe Connect)
+
+```ts
+// Create seller account
+const account = await stripe.accounts.create({
+  type: "express", // or 'standard', 'custom'
+  country: "US",
+  email: seller.email,
+  capabilities: { card_payments: { requested: true }, transfers: { requested: true } },
+});
+
+// Save account.id to seller profile
+await db.seller.update({ where: { id: sellerId }, data: { stripeAccountId: account.id } });
+
+// Create onboarding link
+const accountLink = await stripe.accountLinks.create({
+  account: account.id,
+  refresh_url: `${baseUrl}/sellers/connect/refresh`,
+  return_url: `${baseUrl}/sellers/connect/complete`,
+  type: "account_onboarding",
+});
+return redirect(accountLink.url);
+```
+
+### Payment split (platform fee)
+
+```ts
+// Charge buyer; split payment to seller minus platform fee
+const paymentIntent = await stripe.paymentIntents.create({
+  amount: totalAmount,
+  currency: "usd",
+  // Platform takes 20%
+  application_fee_amount: Math.round(totalAmount * 0.2),
+  transfer_data: {
+    destination: seller.stripeAccountId, // Seller receives 80%
+  },
+});
+```
+
+## Dispute resolution
+
+**Pre-dispute:** Clear expectations set before transaction (photos, descriptions, terms).
+**During dispute:** Message system captures all communication. Evidence submission.
+**Resolution:** Automated rules for clear cases. Human review for complex cases.
+**Escalation:** Clear escalation path. SLA for resolution.
+**Chargebacks:** Platform liability policy. Seller protection terms.
+
+## Key metrics for marketplaces
+
+**GMV (Gross Merchandise Value):** Total transaction value. Top-line for marketplaces.
+**Take rate:** Platform fee / GMV. Sustainable take rate by vertical: delivery ~15-30%, gig services ~15-25%, rental ~10-15%.
+**Liquidity:** % of listings that result in transactions. Low liquidity = supply-demand mismatch.
+**NPS by buyer and seller separately:** Two audiences, different needs.
+**Repeat transaction rate:** % of buyers/sellers who transact again. Key retention signal.
+
+## Trust signals
+
+- Verification badges (ID, background check, professional license)
+- Review scores with volume (100 reviews + 4.8 stars > 5 reviews + 5.0 stars)
+- Response time indicator
+- "Member since" duration
+- Transaction count
+- Verified payment method
+
+Sources: a16z marketplace guides (free), Andreessen Horowitz marketplace content (free), Stripe Connect documentation (stripe.com/docs/connect — free), Platform Revolution (Parker/Van Alstyne — principles)

package/skills/technical/mobile-pwa/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.