constella 0.1.0

package/skills/stacks/frontend/react/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: react
+description: Component-based JavaScript library for building web and native UIs; consult for components, hooks, state, and rendering model.
+domain: stack
+category: frontend
+tags: [react, components, hooks, jsx, ui, spa]
+official_sources:
+  - https://react.dev/
+  - https://github.com/facebook/react
+verified: 2026-06-16
+---
+
+# React
+
+## Overview
+React is a JavaScript library for building user interfaces out of small, composable, stateful components. It uses a declarative model: you describe what the UI should look like for a given state, and React reconciles the DOM (or native views) to match. Read this when building component trees, managing local/shared state, or choosing how to bootstrap a React app.
+
+## Official sources
+- Docs: https://react.dev/
+- Repo: https://github.com/facebook/react
+- Install / download: https://react.dev/learn/creating-a-react-app
+
+## Install / setup
+React's docs recommend starting a new app with a framework. The most common scaffolds (copied verbatim from react.dev):
+
+```bash
+npx create-next-app@latest
+```
+
+```bash
+npx create-react-router@latest
+```
+
+Note: Create React App is deprecated; see react.dev/learn/creating-a-react-app for current recommendations.
+
+## Core concepts
+- **Components** — functions that return JSX describing UI; compose them to build whole interfaces.
+- **JSX** — HTML-like syntax that compiles to `React.createElement` calls; expressions go in `{}`.
+- **Props** — read-only inputs passed from parent to child; never mutate them.
+- **State & hooks** — `useState`, `useEffect`, `useContext`, `useReducer` etc. add memory and side effects to function components.
+- **Rendering & reconciliation** — React re-renders components when state/props change and diffs the result to apply minimal DOM updates.
+- **Keys** — stable identities for list items so React can track elements across renders.
+- **Purity** — components should render as pure functions of their props and state.
+
+## Best practices
+- Keep components pure: render based only on props and state, perform side effects in effects/event handlers (react.dev "Keeping Components Pure").
+- Lift shared state up to the closest common ancestor rather than duplicating it.
+- Give list items stable, unique `key` props (not array index when the list can reorder).
+- Prefer composition over inheritance; pass JSX via `children` and props.
+- Use the official React DevTools and the Rules of Hooks (call hooks at the top level, only from React functions).
+
+## Common pitfalls
+- Mutating state directly (`state.x = 1`) → create new objects/arrays and call the setter so React detects the change.
+- Calling hooks conditionally or inside loops → always call hooks unconditionally at the top of the component.
+- Overusing `useEffect` for derived data → compute values during render instead; effects are for synchronizing with external systems.
+
+## Examples
+```jsx
+import { useState } from 'react';
+
+function Counter() {
+  const [count, setCount] = useState(0);
+  return (
+    <button onClick={() => setCount((c) => c + 1)}>
+      Clicked {count} times
+    </button>
+  );
+}
+```
+
+## Further reading
+- https://react.dev/learn — official Quick Start and full Learn guide
+- https://react.dev/reference/react — API reference for hooks and components
+
+## Related skills
+- ../vue — alternative reactive UI framework
+- ../preact — tiny React-compatible alternative

package/skills/stacks/frontend/solidjs/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: solidjs
+description: Fine-grained reactive UI library with JSX and no virtual DOM; consult for signals, derived state, and Solid/SolidStart apps.
+domain: stack
+category: frontend
+tags: [solidjs, signals, reactivity, jsx, ui]
+official_sources:
+  - https://docs.solidjs.com/
+  - https://github.com/solidjs/solid
+verified: 2026-06-16
+---
+
+# SolidJS
+
+## Overview
+SolidJS is a declarative JavaScript UI library that uses JSX but compiles to fine-grained reactivity instead of a virtual DOM: only the exact DOM nodes affected by a state change are updated. Components run once to set up reactive graphs, which makes updates fast and predictable. Read this when working with signals, derived state, or scaffolding a Solid/SolidStart app.
+
+## Official sources
+- Docs: https://docs.solidjs.com/
+- Repo: https://github.com/solidjs/solid
+- Install / download: https://docs.solidjs.com/quick-start
+
+## Install / setup
+Solid's official scaffolder is `create-solid` (see docs.solidjs.com/quick-start). The repo README also documents starting from a template (copied verbatim from github.com/solidjs/solid):
+
+```bash
+npx degit solidjs/templates/js my-app
+cd my-app
+npm i
+npm run dev
+```
+
+For TypeScript, use `solidjs/templates/ts` in place of `solidjs/templates/js`.
+
+## Core concepts
+- **Signals** — `createSignal` returns a getter/setter pair; reading a signal in a tracked scope subscribes to it.
+- **Fine-grained reactivity** — components run once; only reactive reads re-run when their signals change (no re-render of the whole component).
+- **Derived state** — `createMemo` caches computed values; plain functions can also derive values.
+- **Effects** — `createEffect` runs side effects when its tracked dependencies change.
+- **JSX** — Solid compiles JSX to real DOM nodes and reactive bindings.
+- **Control flow** — `<Show>`, `<For>`, `<Switch>` components handle conditional and list rendering reactively.
+- **Stores** — `createStore` for nested reactive objects.
+
+## Best practices
+- Call signal getters inside the JSX/effect where you want reactivity, not destructured once outside tracking scope.
+- Use `<For>` instead of `Array.map` for keyed, efficient list rendering.
+- Use `createMemo` for expensive derived values to avoid recomputation.
+- Keep component bodies setup-only; put repeated logic in effects/memos, since the body runs just once.
+
+## Common pitfalls
+- Reading a signal outside a tracked scope → you get a static snapshot; read it where reactivity is needed.
+- Treating components like React (expecting re-renders) → Solid does not re-run component bodies on update.
+- Spreading/destructuring props early → access props lazily to preserve reactivity (or use `splitProps`).
+
+## Examples
+```jsx
+import { createSignal } from 'solid-js';
+
+function Counter() {
+  const [count, setCount] = createSignal(0);
+  return (
+    <button onClick={() => setCount(count() + 1)}>
+      Clicked {count()} times
+    </button>
+  );
+}
+```
+
+## Further reading
+- https://docs.solidjs.com/guides — guides and concepts
+- https://docs.solidjs.com/solid-start — SolidStart full-stack framework
+
+## Related skills
+- ../svelte — compiler-first reactive framework
+- ../react — JSX-based component library

package/skills/stacks/frontend/svelte/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: svelte
+description: Compiler-first UI framework that converts components to efficient JS with no runtime virtual DOM; consult for Svelte/SvelteKit apps.
+domain: stack
+category: frontend
+tags: [svelte, sveltekit, compiler, reactivity, ui]
+official_sources:
+  - https://svelte.dev/docs
+  - https://github.com/sveltejs/svelte
+verified: 2026-06-16
+---
+
+# Svelte
+
+## Overview
+Svelte is a UI framework that shifts work to a compile step: instead of shipping a runtime that diffs a virtual DOM, it compiles components into small, imperative JavaScript that surgically updates the DOM. SvelteKit is the official application framework built on top of it (routing, SSR, data loading). Read this when building Svelte components or a SvelteKit app.
+
+## Official sources
+- Docs: https://svelte.dev/docs
+- Repo: https://github.com/sveltejs/svelte
+- Install / download: https://svelte.dev/docs/svelte/getting-started
+
+## Install / setup
+The docs recommend SvelteKit; create a project with the `sv` CLI (copied verbatim from svelte.dev/docs/svelte/getting-started):
+
+```bash
+npx sv create myapp
+cd myapp
+npm install
+npm run dev
+```
+
+## Core concepts
+- **Compiler** — Svelte compiles `.svelte` components at build time; there is no runtime virtual DOM.
+- **Components** — `.svelte` files combine `<script>`, markup, and `<style>` (scoped by default).
+- **Runes (Svelte 5)** — `$state`, `$derived`, `$effect`, and `$props` declare reactive state and derived values.
+- **Props** — declared with `$props()` (Svelte 5); passed as attributes from parent.
+- **Bindings** — `bind:value` and event handlers (`onclick`) wire UI to state.
+- **Stores** — shared reactive state across components.
+- **SvelteKit** — filesystem routing, server/client load functions, and SSR/SSG.
+
+## Best practices
+- Use runes (`$state`, `$derived`) for reactivity in Svelte 5 rather than the older reactive-label syntax.
+- Keep styles in the component; Svelte scopes them automatically.
+- Use SvelteKit for routing, SSR, and data loading rather than wiring it by hand.
+- Derive values with `$derived` instead of manually keeping copies in sync.
+
+## Common pitfalls
+- Mixing Svelte 4 reactive statements (`$:`) with Svelte 5 runes → follow one model per the version you target.
+- Expecting a virtual DOM diffing API → Svelte updates are compiled; think in terms of reactive declarations, not re-renders.
+- Forgetting that component CSS is scoped → use `:global(...)` when you intentionally need global styles.
+
+## Examples
+```svelte
+<script>
+  let count = $state(0);
+</script>
+
+<button onclick={() => count++}>
+  Clicked {count} times
+</button>
+```
+
+## Further reading
+- https://svelte.dev/docs/svelte/overview — Svelte language docs
+- https://svelte.dev/docs/kit — SvelteKit application framework
+
+## Related skills
+- ../vue — reactive SFC-based framework
+- ../solidjs — fine-grained reactive library

package/skills/stacks/frontend/vue/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: vue
+description: Progressive, incrementally adoptable JavaScript framework for building web UIs; consult for SFCs, reactivity, and composition API.
+domain: stack
+category: frontend
+tags: [vue, reactivity, sfc, composition-api, ui, spa]
+official_sources:
+  - https://vuejs.org/guide/
+  - https://github.com/vuejs/core
+verified: 2026-06-16
+---
+
+# Vue
+
+## Overview
+Vue is a progressive JavaScript framework for building user interfaces, designed to be incrementally adoptable from a sprinkle of interactivity to full single-page apps. It centers on declarative, reactive rendering and Single-File Components (`.vue`) that co-locate template, script, and styles. Read this when building Vue components, using the Composition API, or scaffolding a Vue project.
+
+## Official sources
+- Docs: https://vuejs.org/guide/
+- Repo: https://github.com/vuejs/core
+- Install / download: https://vuejs.org/guide/quick-start.html
+
+## Install / setup
+Scaffold a new project with the official `create-vue` tool (copied verbatim from vuejs.org/guide/quick-start.html):
+
+```bash
+npm create vue@latest
+```
+
+## Core concepts
+- **Reactivity** — `ref()` and `reactive()` create reactive state; the DOM updates automatically when it changes.
+- **Single-File Components (SFC)** — `.vue` files bundle `<template>`, `<script setup>`, and `<style>` together.
+- **Composition API** — `<script setup>` with `ref`, `computed`, `watch`, and lifecycle hooks for organizing logic by concern.
+- **Options API** — alternative object-based component style (`data`, `methods`, `computed`).
+- **Template directives** — `v-if`, `v-for`, `v-bind` (`:`), `v-on` (`@`), `v-model` for two-way binding.
+- **Computed & watchers** — `computed()` for derived cached values; `watch`/`watchEffect` for side effects.
+- **Components & props/emits** — pass data down via props, communicate up via emitted events.
+
+## Best practices
+- Prefer the Composition API with `<script setup>` for new projects (recommended in the docs for SFCs).
+- Use `computed` for derived state instead of recomputing in templates or watchers.
+- Always provide a unique `:key` when using `v-for`.
+- Use Pinia (the official state store) for cross-component shared state.
+- Pin the Vue version and use the official Vue DevTools for debugging.
+
+## Common pitfalls
+- Destructuring a `reactive()` object loses reactivity → keep the object intact or use `toRefs`.
+- Mutating props inside a child → emit an event or use `v-model` so the parent owns the state.
+- Using `v-if` and `v-for` on the same element → split them; `v-if` has higher precedence and the behavior is discouraged.
+
+## Examples
+```vue
+<script setup>
+import { ref } from 'vue';
+const count = ref(0);
+</script>
+
+<template>
+  <button @click="count++">Clicked {{ count }} times</button>
+</template>
+```
+
+## Further reading
+- https://vuejs.org/guide/introduction.html — full introduction and concepts
+- https://vuejs.org/guide/quick-start.html — quick start and tooling
+
+## Related skills
+- ../react — alternative component UI library
+- ../svelte — compiler-first reactive framework

package/skills/stacks/infra/ansible/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: ansible
+description: Ansible is Red Hat's agentless IT automation tool that configures systems and orchestrates deployments via YAML playbooks over SSH; consult when writing playbooks, roles, inventories, tasks, handlers, or using modules and collections to provision, configure, or deploy across many hosts.
+domain: stack
+category: infra
+tags: [ansible, automation, configuration-management, devops, infrastructure, yaml, playbook]
+official_sources:
+  - https://docs.ansible.com/
+  - https://github.com/ansible/ansible
+  - https://docs.ansible.com/projects/ansible/latest/installation_guide/intro_installation.html
+verified: 2026-06-17
+---
+
+# Ansible
+
+## Overview
+Ansible is an open-source, agentless IT automation engine for configuration management, application deployment, and orchestration. It connects to managed nodes over SSH (or WinRM) and applies idempotent tasks described declaratively in YAML playbooks, requiring no software installed on the targets. Read this when authoring playbooks/roles, defining inventories, or automating multi-host configuration.
+
+## Official sources
+- Docs: https://docs.ansible.com/
+- Repo: https://github.com/ansible/ansible
+- Install: https://docs.ansible.com/projects/ansible/latest/installation_guide/intro_installation.html
+
+## Install / setup
+```bash
+python3 -m pip install --user ansible
+```
+Source: https://docs.ansible.com/projects/ansible/latest/installation_guide/intro_installation.html
+
+## Core concepts
+- **Control node** — machine where Ansible runs; managed nodes need only SSH and Python.
+- **Inventory** — list of managed hosts, grouped, in INI or YAML (`-i inventory`).
+- **Playbook** — ordered YAML file mapping plays (host groups) to tasks.
+- **Task** — a single call to a module (e.g. `ansible.builtin.copy`); strives for idempotency.
+- **Module** — reusable unit of work executed on a host; ships in collections.
+- **Role** — packaged, reusable structure of tasks, handlers, vars, and templates.
+- **Handler** — task triggered by `notify`, run once at the end (e.g. restart a service).
+- **Collection** — distributable bundle of modules, roles, and plugins (via Ansible Galaxy).
+
+## Best practices
+- Write idempotent tasks so repeated runs converge without side effects (https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_intro.html).
+- Organize reusable automation into roles with a standard directory layout (https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_reuse_roles.html).
+- Encrypt secrets at rest with Ansible Vault instead of plaintext vars (https://docs.ansible.com/ansible/latest/vault_guide/index.html).
+- Reference modules by fully qualified collection name, e.g. `ansible.builtin.copy` (https://docs.ansible.com/ansible/latest/collections/index.html).
+- Install Galaxy dependencies via `requirements.yml` for reproducibility (https://docs.ansible.com/ansible/latest/galaxy/user_guide.html).
+
+## Common pitfalls
+- Using `command`/`shell` for things a module handles → breaks idempotency; prefer the dedicated module.
+- Hardcoding passwords/keys in playbooks → store them in Ansible Vault.
+- Host unreachable due to SSH/key issues → verify with `ansible all -m ping -i inventory`.
+
+## Examples
+```yaml
+- name: Ensure nginx is installed and running
+  hosts: web
+  become: true
+  tasks:
+    - name: Install nginx
+      ansible.builtin.package:
+        name: nginx
+        state: present
+    - name: Start nginx
+      ansible.builtin.service:
+        name: nginx
+        state: started
+        enabled: true
+```
+
+## Further reading
+- https://docs.ansible.com/ansible/latest/playbook_guide/index.html — playbook authoring guide
+- https://galaxy.ansible.com/ — Ansible Galaxy collections/roles hub
+- https://docs.ansible.com/ansible/latest/collections/ansible/builtin/index.html — builtin module index
+
+## Related skills
+- ../terraform — provision infrastructure that Ansible then configures
+- ../vagrant — spin up local VMs to test playbooks against

package/skills/stacks/infra/aws/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: aws
+description: Amazon Web Services cloud platform and AWS CLI; consult for compute, storage, networking, IAM, and scripting AWS resources.
+domain: stack
+category: infra
+tags: [cloud, aws, iam, ec2, s3, cli]
+official_sources:
+  - https://docs.aws.amazon.com/
+  - https://github.com/aws/aws-cli
+verified: 2026-06-16
+---
+
+# AWS (Amazon Web Services)
+
+## Overview
+AWS is a broad cloud platform offering compute (EC2, Lambda), storage (S3, EBS), databases, networking (VPC), and identity (IAM), among hundreds of services. The AWS CLI (`aws`) is the unified command-line tool for managing these resources and scripting automation. Read this when you need to provision, manage, or script AWS infrastructure.
+
+## Official sources
+- Docs: https://docs.aws.amazon.com/
+- Repo (AWS CLI): https://github.com/aws/aws-cli
+- CLI install: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+
+## Install / setup
+Linux (x86_64), copied verbatim from the official install page:
+```bash
+curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+unzip awscliv2.zip
+sudo ./aws/install
+```
+
+## Core concepts
+- Regions & Availability Zones: resources live in a region, which contains isolated AZs for fault tolerance.
+- IAM: identities (users, roles) and policies that grant least-privilege permissions to AWS actions and resources.
+- EC2 & Lambda: virtual machines for long-running compute vs. event-driven serverless functions.
+- S3: object storage organized into buckets with fine-grained access policies.
+- VPC: a logically isolated virtual network with subnets, route tables, and security groups.
+- Credentials & profiles: the CLI resolves credentials from environment variables, shared config/credentials files, and named profiles.
+
+## Best practices
+- Grant least-privilege IAM policies and prefer roles over long-lived access keys (per AWS IAM best practices).
+- Avoid using the account root user for everyday tasks; create scoped IAM identities instead.
+- Scope resources to the correct region and use multiple AZs for high availability.
+- In CI, use short-lived role credentials (e.g. OIDC-assumed roles) rather than embedding static keys.
+
+## Common pitfalls
+- Running a CLI command with no/incorrect `--region` or profile → it targets the wrong region or fails to find resources.
+- Over-broad IAM policies (`Action: "*"`) → security risk; scope to specific actions and resources.
+- Public S3 bucket misconfiguration → unintended data exposure; verify bucket policies and Block Public Access.
+
+## Examples
+```bash
+# Configure credentials and a default region
+aws configure
+
+# List S3 buckets and copy a file
+aws s3 ls
+aws s3 cp ./report.csv s3://my-bucket/report.csv
+```
+
+## Further reading
+- https://docs.aws.amazon.com/cli/latest/userguide/ — AWS CLI user guide
+- https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html — IAM best practices
+
+## Related skills
+- ../gcp — comparable hyperscale cloud platform
+- ../kubernetes — container orchestration often run on AWS (EKS)

package/skills/stacks/infra/azure/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: azure
+description: Microsoft Azure is Microsoft's public cloud platform managed via the az CLI; consult when provisioning Azure resources, authenticating with az login, scripting deployments, working with resource groups, ARM/Bicep templates, AKS, App Service, storage accounts, or managing Azure subscriptions from the command line.
+domain: stack
+category: infra
+tags: [azure, cloud, microsoft, az-cli, devops, infrastructure, iac]
+official_sources:
+  - https://learn.microsoft.com/en-us/cli/azure/
+  - https://github.com/Azure/azure-cli
+  - https://learn.microsoft.com/en-us/cli/azure/install-azure-cli
+verified: 2026-06-17
+---
+
+# Microsoft Azure
+
+## Overview
+Microsoft Azure is Microsoft's public cloud platform for compute, storage, networking, databases, and managed services. The Azure CLI (`az`) is the cross-platform command-line tool for creating and managing those resources via scripts or interactive commands. Read this when you need to authenticate to Azure, provision or query resources, or automate deployments from the terminal.
+
+## Official sources
+- Docs: https://learn.microsoft.com/en-us/cli/azure/
+- Repo: https://github.com/Azure/azure-cli
+- Install: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli
+
+## Install / setup
+```bash
+# Windows (Windows Package Manager)
+winget install --exact --id Microsoft.AzureCLI
+# then authenticate
+az login
+```
+Source: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-windows
+
+## Core concepts
+- **Subscription** — billing/management boundary; each resource lives under one subscription (`az account show`).
+- **Resource group** — logical container grouping related resources sharing lifecycle and region.
+- **Resource provider** — service namespace (e.g. `Microsoft.Compute`) that must be registered to use its resources.
+- **ARM / Bicep** — Azure Resource Manager is the deployment/control plane; Bicep is the declarative IaC DSL that compiles to ARM JSON.
+- **Region** — physical datacenter location (e.g. `eastus`) where resources are deployed.
+- **RBAC** — role-based access control assigns roles (Owner, Contributor, Reader) to identities at a scope.
+- **Managed identity** — Azure-managed service principal so resources authenticate without stored secrets.
+- **az login** — interactive (browser/device-code) or service-principal authentication establishing CLI context.
+
+## Best practices
+- Use resource groups to align resource lifecycle and apply tags for cost tracking (https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/overview).
+- Prefer managed identities over storing credentials in code or config (https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview).
+- Define infrastructure with Bicep/ARM templates for repeatable, reviewable deployments (https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/overview).
+- Run `az login --use-device-code` on headless/remote machines where no browser is available (https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli).
+- Keep the CLI current with `az upgrade` to get latest commands and fixes (https://learn.microsoft.com/en-us/cli/azure/update-azure-cli).
+
+## Common pitfalls
+- Forgetting to set the active subscription on multi-sub accounts → run `az account set --subscription <id>` before creating resources.
+- `az` not found after install on Windows → close and reopen the terminal so PATH refreshes.
+- Resource provider not registered → run `az provider register --namespace Microsoft.<Service>` and wait for it to complete.
+
+## Examples
+```bash
+az group create --name myRG --location eastus
+az storage account create \
+  --name mystorage$RANDOM \
+  --resource-group myRG \
+  --location eastus \
+  --sku Standard_LRS
+```
+
+## Further reading
+- https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/ — Bicep IaC language reference
+- https://learn.microsoft.com/en-us/cli/azure/reference-index — full `az` command reference
+- https://learn.microsoft.com/en-us/azure/architecture/ — Azure Architecture Center patterns
+
+## Related skills
+- ../terraform — provision Azure resources declaratively with the azurerm provider
+- ../ansible — configure Azure VMs and orchestrate post-provisioning

package/skills/stacks/infra/circleci/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: circleci
+description: CircleCI is a cloud and self-hosted CI/CD platform configured via a .circleci/config.yml file; consult when defining jobs, workflows, executors, orbs, caching, contexts, or runners, and when debugging pipeline syntax (version 2.1) or build failures.
+domain: stack
+category: infra
+tags: [circleci, ci-cd, automation, pipeline, devops, infrastructure, yaml]
+official_sources:
+  - https://circleci.com/docs/
+  - https://github.com/CircleCI-Public
+  - https://circleci.com/docs/guides/getting-started/getting-started/
+verified: 2026-06-17
+---
+
+# CircleCI
+
+## Overview
+CircleCI is a continuous integration and delivery platform that runs pipelines defined in a single `.circleci/config.yml` file at the root of your repository. It executes jobs in fully isolated cloud executors (Docker, Linux, macOS, Windows) or on self-hosted runners, orchestrated by workflows. Read this when authoring or debugging CircleCI config, wiring up jobs and workflows, or reusing logic with orbs.
+
+## Official sources
+- Docs: https://circleci.com/docs/
+- Repo: https://github.com/CircleCI-Public
+- Install: https://circleci.com/docs/guides/getting-started/getting-started/
+
+## Install / setup
+```yaml
+# .circleci/config.yml
+version: 2.1
+jobs:
+  build:
+    docker:
+      - image: cimg/base:current
+    steps:
+      - checkout
+      - run: echo "Hello, CircleCI"
+```
+Source: https://circleci.com/docs/guides/getting-started/introduction-to-yaml-configurations/
+
+## Core concepts
+- **config.yml** — single YAML file under `.circleci/` defining the entire pipeline; `version: 2.1` is current.
+- **Job** — a collection of `steps` run in a single executor; the unit of work.
+- **Step** — an individual action such as `checkout` or `run`.
+- **Executor** — the environment a job runs in (`docker`, `machine`, `macos`, `windows`).
+- **Workflow** — orchestrates jobs with ordering, fan-out/fan-in, and conditional/parallel execution.
+- **Orb** — reusable, shareable package of config (jobs, commands, executors).
+- **Context** — named, secured set of environment variables shared across projects.
+- **Self-hosted runner** — your own machine executing jobs for the CircleCI control plane.
+
+## Best practices
+- Use `version: 2.1` to unlock orbs, reusable commands, and pipeline parameters (https://circleci.com/docs/reference/configuration-reference/).
+- Organize multi-job pipelines with workflows for parallelism and dependencies (https://circleci.com/docs/guides/orchestrate/workflows/).
+- Cache dependencies with `save_cache`/`restore_cache` to speed up builds (https://circleci.com/docs/guides/optimize/caching/).
+- Store secrets in Contexts or project environment variables, never in config (https://circleci.com/docs/guides/security/contexts/).
+- Reuse vetted logic via the orb registry instead of copy-pasting steps (https://circleci.com/developer/orbs).
+
+## Common pitfalls
+- Misindented YAML silently breaks the pipeline → validate with the CircleCI CLI (`circleci config validate`) or VS Code extension.
+- Stale caches from an unchanging cache key → include a checksum of the lockfile in the key.
+- Committing secrets into config.yml → move them into Contexts or env vars in project settings.
+
+## Examples
+```yaml
+workflows:
+  build-and-test:
+    jobs:
+      - build
+      - test:
+          requires:
+            - build
+```
+
+## Further reading
+- https://circleci.com/docs/reference/configuration-reference/ — full config.yml reference
+- https://circleci.com/developer/orbs — orb registry
+- https://circleci.com/docs/guides/orchestrate/workflows/ — workflows guide
+
+## Related skills
+- ../jenkins — self-hosted CI/CD server alternative
+- ../terraform — provision infrastructure invoked from CircleCI jobs

package/skills/stacks/infra/cloudflare/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: cloudflare
+description: Cloudflare CDN, DNS, WAF, Workers edge compute, and Tunnels; consult for edge delivery, DNS, and exposing private origins securely.
+domain: stack
+category: infra
+tags: [cdn, dns, edge, tunnel, workers, waf]
+official_sources:
+  - https://developers.cloudflare.com/
+  - https://github.com/cloudflare/cloudflared
+verified: 2026-06-16
+---
+
+# Cloudflare
+
+## Overview
+Cloudflare is a global network that sits in front of your sites and services to provide CDN caching, DNS, TLS, a Web Application Firewall, and edge compute (Workers). `cloudflared` additionally creates outbound-only Tunnels so you can expose a local or private origin without opening inbound firewall ports. Read this when you need to accelerate, protect, or securely publish a web service.
+
+## Official sources
+- Docs: https://developers.cloudflare.com/
+- Repo (cloudflared): https://github.com/cloudflare/cloudflared
+- Tunnel install methods: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/
+
+## Install / setup
+`cloudflared` is distributed as OS packages and binaries (Homebrew, Debian/RPM, Windows, Docker) rather than a single universal script. On macOS with Homebrew:
+```bash
+brew install cloudflared
+```
+See the repo and docs for Linux package and Docker installs.
+
+## Core concepts
+- CDN & caching: edge nodes cache origin responses; cache behavior is controlled by cache rules and response headers.
+- DNS: Cloudflare acts as authoritative DNS; records can be proxied (orange-cloud, traffic flows through Cloudflare) or DNS-only (grey-cloud).
+- WAF & security: managed and custom rules filter malicious requests at the edge before they reach the origin.
+- Workers: serverless JavaScript/Wasm functions that run on the edge close to users.
+- Tunnel (cloudflared): an outbound-only daemon that proxies traffic from Cloudflare's network to your origin, avoiding inbound port exposure.
+- Zero Trust (Access/Gateway): identity-aware policies gate access to applications and networks.
+
+## Best practices
+- Proxy (orange-cloud) records you want protected/cached; keep records DNS-only when the service must not route through Cloudflare.
+- Prefer Tunnels over opening inbound firewall ports for private origins, since cloudflared connects outbound only (see Cloudflare One docs).
+- Use cache rules and appropriate `Cache-Control` headers rather than relying on defaults to avoid caching dynamic/private responses.
+- Put authentication-sensitive apps behind Zero Trust Access policies instead of relying on network obscurity.
+
+## Common pitfalls
+- Proxying a record that needs the visitor's real IP → the origin sees Cloudflare IPs; read `CF-Connecting-IP` instead of the socket address.
+- Caching authenticated or per-user responses → set proper cache bypass rules or no-store headers.
+- Running a Tunnel without scoping its public hostname/routes → unintended exposure; define ingress rules explicitly.
+
+## Examples
+```bash
+# Authenticate cloudflared and create a named tunnel
+cloudflared tunnel login
+cloudflared tunnel create my-app
+
+# Route a hostname to the tunnel and run it
+cloudflared tunnel route dns my-app app.example.com
+cloudflared tunnel run my-app
+```
+
+## Further reading
+- https://developers.cloudflare.com/workers/ — edge compute
+- https://developers.cloudflare.com/cloudflare-one/ — Zero Trust and Tunnels
+
+## Related skills
+- ../tailscale — alternative private-network/VPN approach for device connectivity