@ultrakit/ultrakit 0.0.0

package/dist/template/.opencode/skill/cloudflare/references/waf/configuration.md

@@ -0,0 +1,44 @@
+### Wrangler Integration
+
+While Wrangler primarily manages Workers, WAF configuration is typically done via:
+- Dashboard UI
+- Cloudflare API directly
+- Terraform provider
+- Pulumi provider
+
+**Related Wrangler Operations**:
+- Deploy Workers that benefit from WAF protection
+- Configure zone settings that complement WAF
+- Use `wrangler.toml` for environment-specific configurations
+
+**Example: Using Cloudflare API from Worker**:
+```typescript
+// Worker that calls WAF API
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const response = await fetch(
+      `https://api.cloudflare.com/client/v4/zones/${env.ZONE_ID}/rulesets`,
+      {
+        headers: {
+          'Authorization': `Bearer ${env.CF_API_TOKEN}`,
+          'Content-Type': 'application/json',
+        },
+      }
+    );
+    return response;
+  },
+};
+```
+
+### TypeScript SDK Usage
+
+**Installation**:
+```bash
+npm install cloudflare
+# or
+pnpm add cloudflare
+```
+
+**Basic Setup**:
+```typescript
+import Cloud

package/dist/template/.opencode/skill/cloudflare/references/waf/gotchas.md

@@ -0,0 +1,24 @@
+### Common Issues & Solutions
+
+**Issue**: False positives blocking legitimate traffic
+**Solution**: 
+- Start with `log` action to monitor
+- Use WAF exceptions for specific endpoints
+- Override managed ruleset rules to less aggressive actions
+- Combine attack score with path filters
+
+**Issue**: Rate limiting blocking legitimate users behind NAT
+**Solution**:
+- Use "IP with NAT support" characteristic (Business+)
+- Add additional characteristics (headers, cookies)
+- Increase rate limits for shared IPs
+- Use counting expressions to filter what counts
+
+**Issue**: Rules not applying as expected
+**Solution**:
+- Check rule order and priority
+- Verify expression syntax with Security Events
+- Ensure ruleset is deployed to correct phase
+- Check for conflicting skip or allow rules
+
+**Issue**: Managed

package/dist/template/.opencode/skill/cloudflare/references/waf/patterns.md

@@ -0,0 +1,29 @@
+### Common Issues & Solutions
+
+**Issue**: False positives blocking legitimate traffic
+**Solution**: 
+- Start with `log` action to monitor
+- Use WAF exceptions for specific endpoints
+- Override managed ruleset rules to less aggressive actions
+- Combine attack score with path filters
+
+**Issue**: Rate limiting blocking legitimate users behind NAT
+**Solution**:
+- Use "IP with NAT support" characteristic (Business+)
+- Add additional characteristics (headers, cookies)
+- Increase rate limits for shared IPs
+- Use counting expressions to filter what counts
+
+**Issue**: Rules not applying as expected
+**Solution**:
+- Check rule order and priority
+- Verify expression syntax with Security Events
+- Ensure ruleset is deployed to correct phase
+- Check for conflicting skip or allow rules
+
+**Issue**: Managed ruleset causing performance issues
+**Solution**:
+- Use exceptions to skip ruleset for static assets
+- Override ruleset to disable unused rule categories
+- Consider using zone-specific configuration
+-

package/dist/template/.opencode/skill/cloudflare/references/web-analytics/README.md

@@ -0,0 +1,19 @@
+# Cloudflare Web Analytics Skill Reference
+
+Comprehensive guide for implementing Cloudflare Web Analytics - a privacy-first web analytics solution that provides performance metrics and user insights without compromising visitor privacy.
+
+## Overview
+
+Cloudflare Web Analytics is a free, privacy-focused analytics service that:
+- Measures Core W...
+
+## In This Reference
+
+- **[configuration.md](./configuration.md)** - Setup, deployment, configuration
+- **[api.md](./api.md)** - API endpoints, methods, interfaces
+- **[patterns.md](./patterns.md)** - Common patterns, use cases, examples
+- **[gotchas.md](./gotchas.md)** - Troubleshooting, best practices, limitations
+
+## See Also
+
+- [Cloudflare Docs](https://developers.cloudflare.com/)

package/dist/template/.opencode/skill/cloudflare/references/web-analytics/api.md

@@ -0,0 +1,52 @@
+## API Access (GraphQL)
+
+While Web Analytics is primarily dashboard-based, Cloudflare provides GraphQL API access for advanced queries.
+
+### Authentication
+
+```bash
+# API Token with "Web Analytics Read" permission
+curl -X POST https://api.cloudflare.com/client/v4/graphql \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data '{"query": "..."}'
+```
+
+### Example Queries
+
+**Get page views by path:**
+
+```graphql
+query {
+  viewer {
+    accounts(filter: {accountTag: "YOUR_ACCOUNT_ID"}) {
+      rumPageloadEventsAdaptiveGroups(
+        filter: {
+          date_geq: "2024-01-01"
+          date_lt: "2024-01-31"
+        }
+        limit: 100
+      ) {
+        dimensions {
+          blob1 # Page path
+        }
+        sum {
+          visits
+          pageViews
+        }
+        avg {
+          sampleInterval
+        }
+      }
+    }
+  }
+}
+```
+
+**Get Core Web Vitals:**
+
+```graphql
+query {
+  viewer {
+    accounts(filter: {accountTag: "YOUR_ACCOUNT_ID"}) {
+    

package/dist/template/.opencode/skill/cloudflare/references/web-analytics/configuration.md

@@ -0,0 +1,31 @@
+## Setup Methods
+
+### 1. Sites Proxied Through Cloudflare (Automatic)
+
+For sites already on Cloudflare's proxy:
+
+1. **Dashboard setup:**
+   - Navigate to Web Analytics in Cloudflare dashboard
+   - Click "Add a site"
+   - Select hostname from dropdown → "Done"
+   - Analytics enabled by default (beacon auto-injected)
+
+2. **Configuration options:**
+   - **Enable** - Full auto-injection for all visitors
+   - **Enable, excluding visitor data in the EU** - No injection for EU visitors
+   - **Enable with JS Snippet installation** - Manual snippet required
+   - **Disable** - Turn off analytics
+
+**Important:** If `Cache-Control: public, no-transform` header is set, auto-injection fails. Beacon must be added manually.
+
+### 2. Sites Not Proxied Through Cloudflare (Manual)
+
+For non-proxied sites (limit: 10 sites):
+
+1. Dashboard: Web Analytics → "Add a site"
+2. Enter hostname manually → "Done"
+3. Copy JS snippet from "Manage site"
+4. Add snippet before closing `</body>` tag:
+
+```html
+<!-- Cloudflar

package/dist/template/.opencode/skill/cloudflare/references/web-analytics/gotchas.md

@@ -0,0 +1,28 @@
+## Troubleshooting
+
+### Beacon Not Loading
+
+**Issue:** Script not appearing on page
+
+**Solutions:**
+1. Check `Cache-Control` header - remove `no-transform` if present
+2. Verify beacon placement before `</body>`
+3. Check CSP (Content Security Policy) allows `static.cloudflareinsights.com`
+4. For proxied sites: Ensure auto-injection enabled in dashboard
+
+**CSP Fix:**
+```html
+<meta http-equiv="Content-Security-Policy" 
+      content="script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com;">
+```
+
+### No Data Appearing
+
+**Issue:** Dashboard shows no analytics
+
+**Solutions:**
+1. Wait 5-10 minutes after setup (data ingestion delay)
+2. Verify token is correct in `data-cf-beacon`
+3. Check browser console for beacon errors
+4. Confirm site has real traffic (test by visiting pages)
+5.

package/dist/template/.opencode/skill/cloudflare/references/web-analytics/patterns.md

@@ -0,0 +1,52 @@
+## Common Use Cases
+
+### 1. Performance Monitoring
+
+Track Core Web Vitals to identify slow-loading elements:
+
+```typescript
+// Debug poor LCP scores
+// 1. Enable Web Analytics
+// 2. Dashboard → Core Web Vitals → LCP section
+// 3. Debug View shows top 5 problematic elements
+// 4. Use element CSS selector in browser console:
+document.querySelector('.hero-image') // Example element
+// 5. Optimize identified elements (lazy loading, compression, etc.)
+```
+
+### 2. Bot Traffic Filtering
+
+Exclude bots to see real user metrics:
+
+```
+Dashboard filters:
+- Exclude Bots: Yes
+→ Shows human traffic only
+```
+
+### 3. Multi-Site Analytics
+
+Track multiple properties under one account:
+
+```
+Proxied sites: Unlimited
+Non-proxied: Up to 10 sites
+
+View by dimension:
+- Site: example.com
+- Site: blog.example.com
+→ Compare traffic across properties
+```
+
+### 4. Geographic Analysis
+
+Understand visitor distribution:
+
+```
+Filter by:
+- Country: United States
+- Device type: Mobile
+→ Mobile traffic from US
+```
+
+### 5. 

package/dist/template/.opencode/skill/cloudflare/references/workerd/README.md

@@ -0,0 +1,47 @@
+# Workerd Runtime
+
+V8-based JS/Wasm runtime powering Cloudflare Workers. Use as app server, dev tool, or HTTP proxy.
+
+## When to Use
+- Local Workers development (via Wrangler)
+- Self-hosted Workers runtime
+- Custom embedded runtime
+- Debugging runtime-specific issues
+
+## Key Features
+- **Standards-based**: Fetch API, Web Crypto, Streams, WebSocket
+- **Nanoservices**: Service bindings with local call performance
+- **Capability security**: Explicit bindings prevent SSRF
+- **Backwards compatible**: Version = max compat date supported
+
+## Architecture
+```
+Config (workerd.capnp)
+├── Services (workers/endpoints)
+├── Sockets (HTTP/HTTPS listeners)
+└── Extensions (global capabilities)
+```
+
+## Quick Start
+```bash
+workerd serve config.capnp
+workerd compile config.capnp myConfig -o binary
+workerd test config.capnp
+```
+
+## Core Concepts
+- **Service**: Named endpoint (worker/network/disk/external)
+- **Binding**: Capability-based resource access (KV/DO/R2/services)
+- **Compatibility date**: Feature gate (always set!)
+- **Modules**: ES modules (recommended) or service worker syntax
+
+## See Also
+- [configuration.md](./configuration.md) - Config format, services, bindings
+- [api.md](./api.md) - Runtime APIs, C++ embedding
+- [patterns.md](./patterns.md) - Multi-service, DO, proxies
+- [gotchas.md](./gotchas.md) - Common errors, debugging
+
+## References
+- [GitHub](https://github.com/cloudflare/workerd)
+- [Compat Dates](https://developers.cloudflare.com/workers/configuration/compatibility-dates/)
+- [workerd.capnp](https://github.com/cloudflare/workerd/blob/main/src/workerd/server/workerd.capnp)

package/dist/template/.opencode/skill/cloudflare/references/workerd/api.md

@@ -0,0 +1,199 @@
+# Workerd APIs
+
+## Worker Code (JS/TS)
+
+### ES Modules (Recommended)
+```javascript
+export default {
+  async fetch(request, env, ctx) {
+    // env: bindings, ctx: ExecutionContext
+    const value = await env.KV.get("key");
+    const response = await env.API.fetch(request);
+    
+    ctx.waitUntil(logRequest(request));  // Background task
+    return new Response("OK");
+  },
+  
+  async adminApi(request, env, ctx) {   // Named entrypoint
+    return new Response("Admin");
+  },
+  
+  async queue(batch, env, ctx) {        // Queue consumer
+    for (const msg of batch.messages) {
+      await processMessage(msg.body);
+    }
+  },
+  
+  async scheduled(event, env, ctx) {    // Cron
+    ctx.waitUntil(runTask(env));
+  }
+};
+```
+
+### TypeScript Types
+```typescript
+interface Env {
+  API: Fetcher;
+  CACHE: KVNamespace;
+  STORAGE: R2Bucket;
+  ROOMS: DurableObjectNamespace;
+  API_KEY: string;
+  CONFIG: {apiUrl: string};
+}
+
+export default {
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+    const data = await env.CACHE.get("key");
+    return new Response(data);
+  }
+};
+```
+
+### Service Worker Syntax
+```javascript
+addEventListener('fetch', event => {
+  event.respondWith(handleRequest(event.request));
+});
+
+async function handleRequest(request) {
+  // Bindings as globals
+  const value = await KV.get("key");
+  return new Response("OK");
+}
+```
+
+### Durable Objects
+```javascript
+export class Room {
+  constructor(state, env) {
+    this.state = state;
+    this.env = env;
+  }
+  
+  async fetch(request) {
+    const url = new URL(request.url);
+    
+    if (url.pathname === "/state") {
+      const value = await this.state.storage.get("counter");
+      return new Response(value || "0");
+    }
+    
+    if (url.pathname === "/increment") {
+      const value = (await this.state.storage.get("counter")) || 0;
+      await this.state.storage.put("counter", value + 1);
+      return new Response(String(value + 1));
+    }
+    
+    return new Response("Not found", {status: 404});
+  }
+}
+```
+
+### RPC Between Services
+```javascript
+// Caller
+export default {
+  async fetch(request, env, ctx) {
+    const user = await env.AUTH.validateToken(request.headers.get("Authorization"));
+    return new Response(`Hello ${user.name}`);
+  }
+};
+
+// Callee
+export default {
+  async validateToken(token) {
+    return {id: 123, name: "Alice"};  // Return structured data
+  }
+};
+```
+
+## Web Platform APIs
+
+### Fetch
+- `fetch()`, `Request`, `Response`, `Headers`
+- `AbortController`, `AbortSignal`
+
+### Streams
+- `ReadableStream`, `WritableStream`, `TransformStream`
+- Byte streams, BYOB readers
+
+### Web Crypto
+- `crypto.subtle` (encrypt/decrypt/sign/verify)
+- `crypto.randomUUID()`, `crypto.getRandomValues()`
+
+### Encoding
+- `TextEncoder`, `TextDecoder`
+- `atob()`, `btoa()`
+
+### Web Standards
+- `URL`, `URLSearchParams`
+- `Blob`, `File`, `FormData`
+- `WebSocket`, `EventSource` (SSE)
+- `HTMLRewriter`
+
+### Performance
+- `performance.now()`, `performance.timeOrigin`
+- `setTimeout()`, `setInterval()`, `queueMicrotask()`
+
+### Console
+- `console.log()`, `console.error()`, `console.warn()`
+
+### Node.js Compat (`nodejs_compat` flag)
+- `node:*` imports
+- `process.env`, `Buffer`
+- Subset of Node.js APIs
+
+## CLI Commands
+
+### Serve
+```bash
+workerd serve config.capnp [constantName]
+workerd serve config.capnp --socket-addr http=*:3000
+workerd serve config.capnp --socket-fd http=3       # Systemd
+workerd serve config.capnp --verbose
+workerd serve config.capnp --compat-date=2024-01-15
+```
+
+### Compile
+```bash
+workerd compile config.capnp constantName -o binary
+./binary
+```
+
+### Test
+```bash
+workerd test config.capnp
+workerd test config.capnp --test-only=my-test.js
+```
+
+## Wrangler Integration
+```bash
+export MINIFLARE_WORKERD_PATH="/path/to/workerd"
+wrangler dev
+```
+
+**wrangler.toml**:
+```toml
+name = "my-worker"
+main = "src/index.js"
+compatibility_date = "2024-01-15"
+compatibility_flags = ["nodejs_compat"]
+
+[[kv_namespaces]]
+binding = "CACHE"
+id = "abc123"
+
+[[r2_buckets]]
+binding = "STORAGE"
+bucket_name = "my-bucket"
+
+[[durable_objects.bindings]]
+name = "ROOMS"
+class_name = "Room"
+script_name = "my-worker"
+```
+
+## C++ Embedder API
+Not covered here. See [workerd source](https://github.com/cloudflare/workerd) for embedding runtime in C++ applications.
+
+See [patterns.md](./patterns.md) for usage examples, [configuration.md](./configuration.md) for config details.