@rune-kit/rune 2.8.0 → 2.11.0

package/extensions/content/skills/seo-patterns.md

@@ -1,67 +1,67 @@
----
-name: "seo-patterns"
-pack: "@rune/content"
-description: "JSON-LD, sitemap generation, canonical URLs, meta tags, Open Graph, Twitter Cards, robots.txt, Core Web Vitals optimization."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# seo-patterns
-
-SEO patterns — structured data (JSON-LD), sitemap generation, canonical URLs, meta tags, Open Graph, Twitter Cards, robots.txt, Core Web Vitals optimization.
-
-#### Workflow
-
-**Step 1 — Detect SEO implementation**
-Use Grep to find SEO code: `generateMetadata`, `Head`, `next-seo`, `json-ld`, `sitemap`, `robots.txt`, `og:title`, `twitter:card`. Read the metadata configuration and sitemap generation to understand: current meta tag strategy, structured data presence, and sitemap coverage.
-
-**Step 2 — Audit SEO completeness**
-Check for: missing or duplicate `<title>` tags, no meta description (or same description on every page), no Open Graph tags (poor social sharing), missing canonical URL (duplicate content risk), no JSON-LD structured data (no rich snippets in search), sitemap not listing all public pages, robots.txt blocking important paths, missing `alt` text on images, and no Core Web Vitals monitoring (LCP, CLS, INP).
-
-**Step 3 — Emit SEO patterns**
-Emit: metadata generator with per-page overrides, JSON-LD templates (Article, Product, FAQ, BreadcrumbList), dynamic sitemap generator, canonical URL helper, and Core Web Vitals reporter.
-
-#### Example
-
-```typescript
-// Next.js App Router — metadata + JSON-LD + sitemap
-import { type Metadata } from 'next';
-
-// Reusable metadata generator
-function createMetadata({ title, description, path, image, type = 'website' }: {
-  title: string; description: string; path: string; image?: string; type?: string;
-}): Metadata {
-  const url = `${process.env.SITE_URL}${path}`;
-  return {
-    title, description,
-    alternates: { canonical: url },
-    openGraph: { title, description, url, type, images: image ? [{ url: image, width: 1200, height: 630 }] : [] },
-    twitter: { card: 'summary_large_image', title, description, images: image ? [image] : [] },
-  };
-}
-
-// JSON-LD for blog posts
-function ArticleJsonLd({ post }: { post: Post }) {
-  const jsonLd = {
-    '@context': 'https://schema.org',
-    '@type': 'Article',
-    headline: post.title,
-    datePublished: post.publishedAt,
-    dateModified: post.updatedAt || post.publishedAt,
-    author: { '@type': 'Person', name: post.author.name },
-    image: post.ogImage,
-    description: post.excerpt,
-  };
-  return <script type="application/ld+json" dangerouslySetInnerHTML={{ __html: JSON.stringify(jsonLd) }} />;
-}
-
-// Dynamic sitemap — app/sitemap.ts
-export default async function sitemap() {
-  const posts = await getAllPublishedPosts();
-  const staticPages = ['', '/about', '/blog', '/contact'];
-  return [
-    ...staticPages.map(path => ({ url: `${process.env.SITE_URL}${path}`, lastModified: new Date(), changeFrequency: 'monthly' as const })),
-    ...posts.map(post => ({ url: `${process.env.SITE_URL}/blog/${post.slug}`, lastModified: new Date(post.updatedAt || post.publishedAt), changeFrequency: 'weekly' as const })),
-  ];
-}
-```
+---
+name: "seo-patterns"
+pack: "@rune/content"
+description: "JSON-LD, sitemap generation, canonical URLs, meta tags, Open Graph, Twitter Cards, robots.txt, Core Web Vitals optimization."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# seo-patterns
+
+SEO patterns — structured data (JSON-LD), sitemap generation, canonical URLs, meta tags, Open Graph, Twitter Cards, robots.txt, Core Web Vitals optimization.
+
+#### Workflow
+
+**Step 1 — Detect SEO implementation**
+Use Grep to find SEO code: `generateMetadata`, `Head`, `next-seo`, `json-ld`, `sitemap`, `robots.txt`, `og:title`, `twitter:card`. Read the metadata configuration and sitemap generation to understand: current meta tag strategy, structured data presence, and sitemap coverage.
+
+**Step 2 — Audit SEO completeness**
+Check for: missing or duplicate `<title>` tags, no meta description (or same description on every page), no Open Graph tags (poor social sharing), missing canonical URL (duplicate content risk), no JSON-LD structured data (no rich snippets in search), sitemap not listing all public pages, robots.txt blocking important paths, missing `alt` text on images, and no Core Web Vitals monitoring (LCP, CLS, INP).
+
+**Step 3 — Emit SEO patterns**
+Emit: metadata generator with per-page overrides, JSON-LD templates (Article, Product, FAQ, BreadcrumbList), dynamic sitemap generator, canonical URL helper, and Core Web Vitals reporter.
+
+#### Example
+
+```typescript
+// Next.js App Router — metadata + JSON-LD + sitemap
+import { type Metadata } from 'next';
+
+// Reusable metadata generator
+function createMetadata({ title, description, path, image, type = 'website' }: {
+  title: string; description: string; path: string; image?: string; type?: string;
+}): Metadata {
+  const url = `${process.env.SITE_URL}${path}`;
+  return {
+    title, description,
+    alternates: { canonical: url },
+    openGraph: { title, description, url, type, images: image ? [{ url: image, width: 1200, height: 630 }] : [] },
+    twitter: { card: 'summary_large_image', title, description, images: image ? [image] : [] },
+  };
+}
+
+// JSON-LD for blog posts
+function ArticleJsonLd({ post }: { post: Post }) {
+  const jsonLd = {
+    '@context': 'https://schema.org',
+    '@type': 'Article',
+    headline: post.title,
+    datePublished: post.publishedAt,
+    dateModified: post.updatedAt || post.publishedAt,
+    author: { '@type': 'Person', name: post.author.name },
+    image: post.ogImage,
+    description: post.excerpt,
+  };
+  return <script type="application/ld+json" dangerouslySetInnerHTML={{ __html: JSON.stringify(jsonLd) }} />;
+}
+
+// Dynamic sitemap — app/sitemap.ts
+export default async function sitemap() {
+  const posts = await getAllPublishedPosts();
+  const staticPages = ['', '/about', '/blog', '/contact'];
+  return [
+    ...staticPages.map(path => ({ url: `${process.env.SITE_URL}${path}`, lastModified: new Date(), changeFrequency: 'monthly' as const })),
+    ...posts.map(post => ({ url: `${process.env.SITE_URL}/blog/${post.slug}`, lastModified: new Date(post.updatedAt || post.publishedAt), changeFrequency: 'weekly' as const })),
+  ];
+}
+```

package/extensions/content/skills/video-repurpose.md

@@ -1,153 +1,153 @@
----
-name: "video-repurpose"
-pack: "@rune/content"
-description: "Long-form video → short-form clip pipeline. Transcribe, identify viral segments, reformat to vertical (9:16), add animated captions, insert B-roll."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# video-repurpose
-
-Long-form video → short-form clip pipeline. Transcribe, identify viral segments, reformat to vertical (9:16), add animated captions, insert B-roll. Covers the full pipeline from YouTube URL or file upload to platform-ready export.
-
-#### Workflow
-
-**Step 1 — Ingest source video**
-Two paths:
-- URL: Use `yt-dlp` to download (with exponential backoff, browser-mimicking headers for anti-bot):
-  ```bash
-  yt-dlp -f "bestvideo[height<=1080]+bestaudio/best[height<=1080]" \
-    --merge-output-format mp4 \
-    --retry-sleep 5 --retries 3 \
-    -o "source_%(id)s.%(ext)s" "<url>"
-  ```
-- File upload: Validate format (mp4/mov/webm), check duration (warn if > 2 hours — processing time scales non-linearly)
-
-Cache key: `sha256(source_type|processing_mode|url_or_hash)` — avoid reprocessing same video.
-
-**Step 2 — Transcribe with word-level timestamps**
-Use AssemblyAI (97%+ accuracy, 20+ languages) or Whisper (self-hosted):
-```typescript
-interface WordTimestamp {
-  text: string;
-  start: number;  // milliseconds
-  end: number;
-  confidence: number;
-}
-
-interface Transcript {
-  words: WordTimestamp[];
-  text: string;
-  language: string;
-  duration: number;
-}
-```
-Sharp edge: Whisper `large-v3` halluccinates on silence — preprocess with silence detection and split audio at gaps > 2s.
-
-**Step 3 — Identify viral segments via LLM**
-Send transcript to LLM with structured output schema:
-```typescript
-interface ViralSegment {
-  startMs: number;
-  endMs: number;
-  hookType: 'question' | 'statement' | 'statistic' | 'story' | 'contrast';
-  title: string;
-  score: ViralityScore;
-  bRollOpportunities: Array<{ timestampMs: number; query: string }>;
-}
-
-interface ViralityScore {
-  hookStrength: number;   // 0-25: first 3 seconds grab attention?
-  engagement: number;     // 0-25: keeps viewer watching?
-  value: number;          // 0-25: teaches or entertains?
-  shareability: number;   // 0-25: would viewer share this?
-  total: number;          // 0-100
-}
-```
-
-Filters:
-- Discard segments < 5 seconds or < 3 words
-- Recalculate total if subscores don't add up (LLM math errors)
-- Sort by total score, return top 3-7 segments per video
-
-**Step 4 — Reformat to vertical (9:16) with face-centered crop**
-Triple-fallback face detection for crop anchor:
-1. **MediaPipe** (fastest, most accurate for single face)
-2. **OpenCV DNN** (good for multiple faces)
-3. **Haar cascade** (last resort, highest false positive rate)
-
-Temporal consistency: filter out detection jumps > 20% frame width between consecutive frames (false positives). Smooth crop position with rolling average (5 frames) to avoid jitter.
-
-Fast path: if clip needs no captions or crop changes, use ffmpeg stream copy (no re-encoding) for 10x speed.
-
-**Step 5 — Add animated captions**
-Word-synchronized captions from transcript timestamps. Template system:
-| Template | Style | Use Case |
-|----------|-------|----------|
-| `bold-highlight` | Active word in accent color, bold | Educational content |
-| `karaoke` | Word-by-word reveal, green highlight | Motivational, podcast |
-| `subtitle` | Bottom-center, semi-transparent bg | Professional, interview |
-| `pop` | Scale animation on each word | Energetic, entertainment |
-
-Caption rendering: pre-render text as image overlays (MoviePy TextClip or Pillow), composite onto video at word timestamps.
-
-**Step 6 — Insert B-roll (optional)**
-Search stock footage API (Pexels) for AI-identified insertion points:
-```typescript
-async function findBRoll(query: string, orientation: 'portrait' | 'landscape'): Promise<StockClip> {
-  const results = await pexels.videos.search({ query, orientation, per_page: 5 });
-  // Score by: duration match, HD quality, relevance
-  return results.videos
-    .map(v => ({ ...v, score: scoreBRoll(v, targetDuration) }))
-    .sort((a, b) => b.score - a.score)[0];
-}
-```
-Composite with crossfade transition (0.5s) at identified timestamps.
-
-**Step 7 — Export with platform presets**
-| Platform | Aspect | Max Duration | Resolution | Codec |
-|----------|--------|-------------|------------|-------|
-| TikTok | 9:16 | 10 min | 1080×1920 | H.264 |
-| Instagram Reels | 9:16 | 90s | 1080×1920 | H.264 |
-| YouTube Shorts | 9:16 | 60s | 1080×1920 | H.264 |
-| Twitter/X | 16:9 or 1:1 | 2m20s | 1280×720 | H.264 |
-
-#### Example
-
-```typescript
-// Complete pipeline orchestration
-async function repurposeVideo(sourceUrl: string, options: RepurposeOptions): Promise<Clip[]> {
-  // Step 1: Ingest
-  const cacheKey = sha256(`url|${options.mode}|${sourceUrl}`);
-  const cached = await cache.get(cacheKey);
-  if (cached) return cached;
-
-  const sourcePath = await downloadVideo(sourceUrl);
-
-  // Step 2: Transcribe
-  const transcript = await transcribe(sourcePath, { model: options.mode === 'fast' ? 'nano' : 'default' });
-
-  // Step 3: Identify segments
-  const segments = await identifyViralSegments(transcript, {
-    minDuration: 10_000,
-    maxDuration: 60_000,
-    maxSegments: 7,
-  });
-
-  // Step 4-6: Process each segment in parallel
-  const clips = await Promise.all(
-    segments.map(async (segment) => {
-      const raw = await extractSegment(sourcePath, segment.startMs, segment.endMs);
-      const vertical = await cropToVertical(raw, { faceDetection: true });
-      const captioned = await addCaptions(vertical, transcript.words, segment, options.captionTemplate);
-      const withBRoll = options.bRoll
-        ? await insertBRoll(captioned, segment.bRollOpportunities)
-        : captioned;
-      return { ...segment, outputPath: withBRoll };
-    })
-  );
-
-  await cache.set(cacheKey, clips);
-  return clips;
-}
-```
+---
+name: "video-repurpose"
+pack: "@rune/content"
+description: "Long-form video → short-form clip pipeline. Transcribe, identify viral segments, reformat to vertical (9:16), add animated captions, insert B-roll."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# video-repurpose
+
+Long-form video → short-form clip pipeline. Transcribe, identify viral segments, reformat to vertical (9:16), add animated captions, insert B-roll. Covers the full pipeline from YouTube URL or file upload to platform-ready export.
+
+#### Workflow
+
+**Step 1 — Ingest source video**
+Two paths:
+- URL: Use `yt-dlp` to download (with exponential backoff, browser-mimicking headers for anti-bot):
+  ```bash
+  yt-dlp -f "bestvideo[height<=1080]+bestaudio/best[height<=1080]" \
+    --merge-output-format mp4 \
+    --retry-sleep 5 --retries 3 \
+    -o "source_%(id)s.%(ext)s" "<url>"
+  ```
+- File upload: Validate format (mp4/mov/webm), check duration (warn if > 2 hours — processing time scales non-linearly)
+
+Cache key: `sha256(source_type|processing_mode|url_or_hash)` — avoid reprocessing same video.
+
+**Step 2 — Transcribe with word-level timestamps**
+Use AssemblyAI (97%+ accuracy, 20+ languages) or Whisper (self-hosted):
+```typescript
+interface WordTimestamp {
+  text: string;
+  start: number;  // milliseconds
+  end: number;
+  confidence: number;
+}
+
+interface Transcript {
+  words: WordTimestamp[];
+  text: string;
+  language: string;
+  duration: number;
+}
+```
+Sharp edge: Whisper `large-v3` halluccinates on silence — preprocess with silence detection and split audio at gaps > 2s.
+
+**Step 3 — Identify viral segments via LLM**
+Send transcript to LLM with structured output schema:
+```typescript
+interface ViralSegment {
+  startMs: number;
+  endMs: number;
+  hookType: 'question' | 'statement' | 'statistic' | 'story' | 'contrast';
+  title: string;
+  score: ViralityScore;
+  bRollOpportunities: Array<{ timestampMs: number; query: string }>;
+}
+
+interface ViralityScore {
+  hookStrength: number;   // 0-25: first 3 seconds grab attention?
+  engagement: number;     // 0-25: keeps viewer watching?
+  value: number;          // 0-25: teaches or entertains?
+  shareability: number;   // 0-25: would viewer share this?
+  total: number;          // 0-100
+}
+```
+
+Filters:
+- Discard segments < 5 seconds or < 3 words
+- Recalculate total if subscores don't add up (LLM math errors)
+- Sort by total score, return top 3-7 segments per video
+
+**Step 4 — Reformat to vertical (9:16) with face-centered crop**
+Triple-fallback face detection for crop anchor:
+1. **MediaPipe** (fastest, most accurate for single face)
+2. **OpenCV DNN** (good for multiple faces)
+3. **Haar cascade** (last resort, highest false positive rate)
+
+Temporal consistency: filter out detection jumps > 20% frame width between consecutive frames (false positives). Smooth crop position with rolling average (5 frames) to avoid jitter.
+
+Fast path: if clip needs no captions or crop changes, use ffmpeg stream copy (no re-encoding) for 10x speed.
+
+**Step 5 — Add animated captions**
+Word-synchronized captions from transcript timestamps. Template system:
+| Template | Style | Use Case |
+|----------|-------|----------|
+| `bold-highlight` | Active word in accent color, bold | Educational content |
+| `karaoke` | Word-by-word reveal, green highlight | Motivational, podcast |
+| `subtitle` | Bottom-center, semi-transparent bg | Professional, interview |
+| `pop` | Scale animation on each word | Energetic, entertainment |
+
+Caption rendering: pre-render text as image overlays (MoviePy TextClip or Pillow), composite onto video at word timestamps.
+
+**Step 6 — Insert B-roll (optional)**
+Search stock footage API (Pexels) for AI-identified insertion points:
+```typescript
+async function findBRoll(query: string, orientation: 'portrait' | 'landscape'): Promise<StockClip> {
+  const results = await pexels.videos.search({ query, orientation, per_page: 5 });
+  // Score by: duration match, HD quality, relevance
+  return results.videos
+    .map(v => ({ ...v, score: scoreBRoll(v, targetDuration) }))
+    .sort((a, b) => b.score - a.score)[0];
+}
+```
+Composite with crossfade transition (0.5s) at identified timestamps.
+
+**Step 7 — Export with platform presets**
+| Platform | Aspect | Max Duration | Resolution | Codec |
+|----------|--------|-------------|------------|-------|
+| TikTok | 9:16 | 10 min | 1080×1920 | H.264 |
+| Instagram Reels | 9:16 | 90s | 1080×1920 | H.264 |
+| YouTube Shorts | 9:16 | 60s | 1080×1920 | H.264 |
+| Twitter/X | 16:9 or 1:1 | 2m20s | 1280×720 | H.264 |
+
+#### Example
+
+```typescript
+// Complete pipeline orchestration
+async function repurposeVideo(sourceUrl: string, options: RepurposeOptions): Promise<Clip[]> {
+  // Step 1: Ingest
+  const cacheKey = sha256(`url|${options.mode}|${sourceUrl}`);
+  const cached = await cache.get(cacheKey);
+  if (cached) return cached;
+
+  const sourcePath = await downloadVideo(sourceUrl);
+
+  // Step 2: Transcribe
+  const transcript = await transcribe(sourcePath, { model: options.mode === 'fast' ? 'nano' : 'default' });
+
+  // Step 3: Identify segments
+  const segments = await identifyViralSegments(transcript, {
+    minDuration: 10_000,
+    maxDuration: 60_000,
+    maxSegments: 7,
+  });
+
+  // Step 4-6: Process each segment in parallel
+  const clips = await Promise.all(
+    segments.map(async (segment) => {
+      const raw = await extractSegment(sourcePath, segment.startMs, segment.endMs);
+      const vertical = await cropToVertical(raw, { faceDetection: true });
+      const captioned = await addCaptions(vertical, transcript.words, segment, options.captionTemplate);
+      const withBRoll = options.bRoll
+        ? await insertBRoll(captioned, segment.bRollOpportunities)
+        : captioned;
+      return { ...segment, outputPath: withBRoll };
+    })
+  );
+
+  await cache.set(cacheKey, clips);
+  return clips;
+}
+```

package/extensions/devops/PACK.md

@@ -1,101 +1,101 @@
----
-name: "@rune/devops"
-description: DevOps patterns — Docker, CI/CD pipelines, monitoring setup, server configuration, SSL/domain management, edge/serverless deployment, and infrastructure-as-code.
-metadata:
-  author: runedev
-  version: "0.3.0"
-  layer: L4
-  price: "$12"
-  target: DevOps engineers
-  format: split
----
-
-# @rune/devops
-
-## Purpose
-
-Infrastructure work done without patterns leads to snowflake configs: Dockerfiles that rebuild entire node_modules on every code change, CI pipelines that run 40 minutes because nothing is cached, servers with no monitoring until the first outage, SSL certificates that expire silently, serverless functions that leak state across requests, and infrastructure provisioned by hand that can't be reproduced. This pack provides battle-tested patterns for containerization, continuous delivery, production observability, server hardening, edge/serverless deployment, and infrastructure-as-code — each skill detects what you have, audits it against best practices, and emits the fixed config.
-
-## Triggers
-
-- Auto-trigger: when `Dockerfile`, `docker-compose.yml`, `.github/workflows/`, `.gitlab-ci.yml`, `nginx.conf`, `Caddyfile` detected in project
-- `/rune docker` — audit and optimize container configuration
-- `/rune ci-cd` — audit and optimize CI/CD pipeline
-- `/rune monitoring` — set up or audit production monitoring
-- `/rune server-setup` — audit server configuration
-- `/rune ssl-domain` — manage SSL certificates and domain config
-- `/rune edge-serverless` — audit and configure edge/serverless deployment
-- `/rune infra-as-code` — audit and structure Terraform/Pulumi/CDK infrastructure
-- `/rune chaos-testing` — design and run resilience experiments
-- `/rune kubernetes` — audit and emit production-ready Kubernetes manifests
-- Called by `deploy` (L2) when deployment infrastructure needs setup
-- Called by `launch` (L1) when preparing production environment
-
-## Skills Included
-
-| Skill | Model | Description |
-|-------|-------|-------------|
-| [docker](skills/docker.md) | sonnet | Dockerfile and docker-compose patterns — multi-stage builds, layer optimization, security hardening, development vs production configs. |
-| [ci-cd](skills/ci-cd.md) | sonnet | CI/CD pipeline configuration — GitHub Actions, GitLab CI, build matrices, test parallelization, deployment gates, semantic release. |
-| [monitoring](skills/monitoring.md) | sonnet | Production monitoring setup — Prometheus, Grafana, alerting rules, SLO/SLI definitions, log aggregation, distributed tracing. |
-| [server-setup](skills/server-setup.md) | sonnet | Server configuration — Nginx/Caddy reverse proxy, systemd services, firewall rules, SSH hardening, automatic updates. |
-| [ssl-domain](skills/ssl-domain.md) | sonnet | SSL certificate management and domain configuration — Let's Encrypt automation, DNS records, CDN setup, redirect rules. |
-| [chaos-testing](skills/chaos-testing.md) | sonnet | Resilience testing — inject controlled failures to verify circuit breakers, retry logic, graceful degradation, and recovery procedures. |
-| [kubernetes](skills/kubernetes.md) | sonnet | Kubernetes resource patterns — Deployments, Services, ConfigMaps, resource limits, health probes, HPA, network policies, and RBAC. |
-| [edge-serverless](skills/edge-serverless.md) | sonnet | Edge and serverless deployment patterns — Cloudflare Workers, Vercel Edge Functions, AWS Lambda, Deno Deploy. Runtime constraints, cold starts, streaming, state management. |
-| [infra-as-code](skills/infra-as-code.md) | sonnet | Infrastructure-as-Code patterns — Terraform, Pulumi, and CDK. State management, module organization, secret handling, drift detection, CI/CD integration. |
-
-## Tech Stack Support
-
-| Platform | Container | CI/CD | Reverse Proxy |
-|----------|-----------|-------|---------------|
-| AWS (EC2/ECS/Lambda) | Docker | GitHub Actions | Nginx / ALB |
-| GCP (Cloud Run/GKE) | Docker | Cloud Build / GitHub Actions | Caddy / Cloud LB |
-| Vercel | Serverless | Built-in | Built-in |
-| DigitalOcean (Droplet/App Platform) | Docker | GitHub Actions | Nginx / Caddy |
-| VPS (any) | Docker | GitHub Actions (self-hosted) | Nginx / Caddy |
-| Cloudflare Workers | Wrangler | GitHub Actions / Wrangler deploy | Workers Routes |
-| Deno Deploy | Deno runtime | deployctl / GitHub Actions | Built-in |
-| Fly.io | Docker/Firecracker | flyctl / GitHub Actions | Fly Proxy |
-
-## Connections
-
-```
-Calls → verification (L3): validate configs syntax and test infrastructure changes
-Calls → sentinel (L2): security audit on server and container configuration
-Calls → sentinel-env (L3): edge-serverless validates runtime prerequisites before deployment
-Called By ← deploy (L2): deployment infrastructure setup
-Called By ← launch (L1): production environment preparation
-Called By ← cook (L1): when DevOps task detected
-Called By ← scaffold (L1): infra-as-code generates infrastructure alongside project bootstrap
-edge-serverless → docker: containerized apps may deploy to serverless container platforms (Cloud Run, Fly.io)
-infra-as-code → ci-cd: IaC changes flow through CI/CD with plan-and-apply pipeline
-infra-as-code → monitoring: IaC provisions monitoring infrastructure (alerts, dashboards)
-```
-
-## Sharp Edges
-
-| Failure Mode | Severity | Mitigation |
-|---|---|---|
-| Docker multi-stage build references wrong stage name causing empty final image | HIGH | Validate `COPY --from=` stage names match defined stages; emit build test command |
-| CI caching key uses lockfile that doesn't exist (e.g., `pnpm-lock.yaml` when using npm) | HIGH | Detect actual package manager from lockfile presence before emitting cache config |
-| Monitoring metrics have high cardinality labels (user ID as label) causing Prometheus OOM | CRITICAL | Constrain label values to bounded sets (method, route, status) — never use IDs as labels |
-| SSH hardening locks out user (key-only auth before key is added) | CRITICAL | Emit config change AND key setup in correct order; include rollback instructions |
-| SSL certificate renewal fails silently after initial setup | HIGH | Emit renewal test command (`certbot renew --dry-run`) and cron verification |
-| Nginx config syntax error takes down production proxy | HIGH | Always emit `nginx -t` test command before reload; suggest blue-green proxy config |
-
-## Done When
-
-- Dockerfile emits multi-stage, non-root, health-checked, layer-optimized build
-- CI/CD pipeline has caching, parallelization, deployment gates, and status checks
-- Monitoring covers RED metrics, structured logging, and SLO-based alerting
-- Server hardened: key-only SSH, firewall, security headers, rate limiting
-- SSL automated with renewal verification
-- Edge/serverless config audited: no anti-patterns (floating promises, global state, unbounded buffering), correct platform bindings, streaming patterns applied
-- IaC structured: remote state with locking, modular layout, environment separation, CI/CD pipeline for plan/apply, `prevent_destroy` on critical resources
-- All emitted configs tested with syntax validation commands
-- Structured report emitted for each skill invoked
-
-## Cost Profile
-
-~16,000–28,000 tokens per full pack run (all 9 skills). Individual skill: ~2,000–4,500 tokens. Sonnet default. Use haiku for config detection scans; escalate to sonnet for config generation and security audit.
+---
+name: "@rune/devops"
+description: DevOps patterns — Docker, CI/CD pipelines, monitoring setup, server configuration, SSL/domain management, edge/serverless deployment, and infrastructure-as-code.
+metadata:
+  author: runedev
+  version: "0.3.0"
+  layer: L4
+  price: "$12"
+  target: DevOps engineers
+  format: split
+---
+
+# @rune/devops
+
+## Purpose
+
+Infrastructure work done without patterns leads to snowflake configs: Dockerfiles that rebuild entire node_modules on every code change, CI pipelines that run 40 minutes because nothing is cached, servers with no monitoring until the first outage, SSL certificates that expire silently, serverless functions that leak state across requests, and infrastructure provisioned by hand that can't be reproduced. This pack provides battle-tested patterns for containerization, continuous delivery, production observability, server hardening, edge/serverless deployment, and infrastructure-as-code — each skill detects what you have, audits it against best practices, and emits the fixed config.
+
+## Triggers
+
+- Auto-trigger: when `Dockerfile`, `docker-compose.yml`, `.github/workflows/`, `.gitlab-ci.yml`, `nginx.conf`, `Caddyfile` detected in project
+- `/rune docker` — audit and optimize container configuration
+- `/rune ci-cd` — audit and optimize CI/CD pipeline
+- `/rune monitoring` — set up or audit production monitoring
+- `/rune server-setup` — audit server configuration
+- `/rune ssl-domain` — manage SSL certificates and domain config
+- `/rune edge-serverless` — audit and configure edge/serverless deployment
+- `/rune infra-as-code` — audit and structure Terraform/Pulumi/CDK infrastructure
+- `/rune chaos-testing` — design and run resilience experiments
+- `/rune kubernetes` — audit and emit production-ready Kubernetes manifests
+- Called by `deploy` (L2) when deployment infrastructure needs setup
+- Called by `launch` (L1) when preparing production environment
+
+## Skills Included
+
+| Skill | Model | Description |
+|-------|-------|-------------|
+| [docker](skills/docker.md) | sonnet | Dockerfile and docker-compose patterns — multi-stage builds, layer optimization, security hardening, development vs production configs. |
+| [ci-cd](skills/ci-cd.md) | sonnet | CI/CD pipeline configuration — GitHub Actions, GitLab CI, build matrices, test parallelization, deployment gates, semantic release. |
+| [monitoring](skills/monitoring.md) | sonnet | Production monitoring setup — Prometheus, Grafana, alerting rules, SLO/SLI definitions, log aggregation, distributed tracing. |
+| [server-setup](skills/server-setup.md) | sonnet | Server configuration — Nginx/Caddy reverse proxy, systemd services, firewall rules, SSH hardening, automatic updates. |
+| [ssl-domain](skills/ssl-domain.md) | sonnet | SSL certificate management and domain configuration — Let's Encrypt automation, DNS records, CDN setup, redirect rules. |
+| [chaos-testing](skills/chaos-testing.md) | sonnet | Resilience testing — inject controlled failures to verify circuit breakers, retry logic, graceful degradation, and recovery procedures. |
+| [kubernetes](skills/kubernetes.md) | sonnet | Kubernetes resource patterns — Deployments, Services, ConfigMaps, resource limits, health probes, HPA, network policies, and RBAC. |
+| [edge-serverless](skills/edge-serverless.md) | sonnet | Edge and serverless deployment patterns — Cloudflare Workers, Vercel Edge Functions, AWS Lambda, Deno Deploy. Runtime constraints, cold starts, streaming, state management. |
+| [infra-as-code](skills/infra-as-code.md) | sonnet | Infrastructure-as-Code patterns — Terraform, Pulumi, and CDK. State management, module organization, secret handling, drift detection, CI/CD integration. |
+
+## Tech Stack Support
+
+| Platform | Container | CI/CD | Reverse Proxy |
+|----------|-----------|-------|---------------|
+| AWS (EC2/ECS/Lambda) | Docker | GitHub Actions | Nginx / ALB |
+| GCP (Cloud Run/GKE) | Docker | Cloud Build / GitHub Actions | Caddy / Cloud LB |
+| Vercel | Serverless | Built-in | Built-in |
+| DigitalOcean (Droplet/App Platform) | Docker | GitHub Actions | Nginx / Caddy |
+| VPS (any) | Docker | GitHub Actions (self-hosted) | Nginx / Caddy |
+| Cloudflare Workers | Wrangler | GitHub Actions / Wrangler deploy | Workers Routes |
+| Deno Deploy | Deno runtime | deployctl / GitHub Actions | Built-in |
+| Fly.io | Docker/Firecracker | flyctl / GitHub Actions | Fly Proxy |
+
+## Connections
+
+```
+Calls → verification (L3): validate configs syntax and test infrastructure changes
+Calls → sentinel (L2): security audit on server and container configuration
+Calls → sentinel-env (L3): edge-serverless validates runtime prerequisites before deployment
+Called By ← deploy (L2): deployment infrastructure setup
+Called By ← launch (L1): production environment preparation
+Called By ← cook (L1): when DevOps task detected
+Called By ← scaffold (L1): infra-as-code generates infrastructure alongside project bootstrap
+edge-serverless → docker: containerized apps may deploy to serverless container platforms (Cloud Run, Fly.io)
+infra-as-code → ci-cd: IaC changes flow through CI/CD with plan-and-apply pipeline
+infra-as-code → monitoring: IaC provisions monitoring infrastructure (alerts, dashboards)
+```
+
+## Sharp Edges
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| Docker multi-stage build references wrong stage name causing empty final image | HIGH | Validate `COPY --from=` stage names match defined stages; emit build test command |
+| CI caching key uses lockfile that doesn't exist (e.g., `pnpm-lock.yaml` when using npm) | HIGH | Detect actual package manager from lockfile presence before emitting cache config |
+| Monitoring metrics have high cardinality labels (user ID as label) causing Prometheus OOM | CRITICAL | Constrain label values to bounded sets (method, route, status) — never use IDs as labels |
+| SSH hardening locks out user (key-only auth before key is added) | CRITICAL | Emit config change AND key setup in correct order; include rollback instructions |
+| SSL certificate renewal fails silently after initial setup | HIGH | Emit renewal test command (`certbot renew --dry-run`) and cron verification |
+| Nginx config syntax error takes down production proxy | HIGH | Always emit `nginx -t` test command before reload; suggest blue-green proxy config |
+
+## Done When
+
+- Dockerfile emits multi-stage, non-root, health-checked, layer-optimized build
+- CI/CD pipeline has caching, parallelization, deployment gates, and status checks
+- Monitoring covers RED metrics, structured logging, and SLO-based alerting
+- Server hardened: key-only SSH, firewall, security headers, rate limiting
+- SSL automated with renewal verification
+- Edge/serverless config audited: no anti-patterns (floating promises, global state, unbounded buffering), correct platform bindings, streaming patterns applied
+- IaC structured: remote state with locking, modular layout, environment separation, CI/CD pipeline for plan/apply, `prevent_destroy` on critical resources
+- All emitted configs tested with syntax validation commands
+- Structured report emitted for each skill invoked
+
+## Cost Profile
+
+~16,000–28,000 tokens per full pack run (all 9 skills). Individual skill: ~2,000–4,500 tokens. Sonnet default. Use haiku for config detection scans; escalate to sonnet for config generation and security audit.