opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/cloudflare-pages/SKILL.md

@@ -0,0 +1,318 @@
+---
+name: cloudflare-pages
+description: Deploy static sites and full-stack apps on Cloudflare Pages with previews,
+  functions, and custom domains.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Cloudflare Pages
+
+Deploy frontend projects with preview builds, edge functions, and global CDN delivery on Cloudflare's network.
+
+## When to Use
+
+- Deploying static sites (React, Vue, Astro, Hugo, Next.js static export).
+- Full-stack applications using Pages Functions for server-side logic.
+- Projects that need automatic preview deployments per pull request.
+- Teams that want zero-config CDN with custom domain and TLS.
+- Migrating from Vercel, Netlify, or GitHub Pages to Cloudflare's ecosystem.
+
+## Prerequisites
+
+- Node.js 18+ and npm installed locally.
+- A Cloudflare account (free tier works for most projects).
+- Wrangler CLI installed: `npm install -g wrangler`.
+- Authenticated via `wrangler login` or `CLOUDFLARE_API_TOKEN` environment variable.
+- Source code in a Git repository (GitHub or GitLab for dashboard integration).
+
+## Project Setup via Wrangler
+
+### Create a New Project
+
+```bash
+# Create a new Pages project
+npx wrangler pages project create my-site
+
+# List existing projects
+npx wrangler pages project list
+
+# Delete a project (removes all deployments)
+npx wrangler pages project delete my-site
+```
+
+### Deploy from Local Build Output
+
+```bash
+# Build your framework first
+npm run build
+
+# Deploy the output directory
+npx wrangler pages deploy dist --project-name=my-site
+
+# Deploy with a custom branch name (triggers preview URL)
+npx wrangler pages deploy dist --project-name=my-site --branch=feature-auth
+
+# Deploy and get the deployment URL in JSON
+npx wrangler pages deploy dist --project-name=my-site --branch=main 2>&1 | tail -1
+```
+
+### List and Manage Deployments
+
+```bash
+# List recent deployments
+npx wrangler pages deployment list --project-name=my-site
+
+# Tail live logs from a deployment
+npx wrangler pages deployment tail --project-name=my-site --environment=production
+```
+
+## Dashboard Git Integration
+
+1. Navigate to **Workers & Pages > Create application > Pages**.
+2. Connect your GitHub or GitLab account.
+3. Select the repository and configure:
+   - **Production branch**: `main`
+   - **Build command**: `npm run build`
+   - **Build output directory**: `dist` (or `build`, `.next`, `public` depending on framework)
+4. Set environment variables per environment (Production vs Preview).
+
+### Framework Presets
+
+Cloudflare auto-detects frameworks. Override if needed:
+
+| Framework  | Build Command        | Output Directory |
+|------------|----------------------|------------------|
+| React CRA  | `npm run build`      | `build`          |
+| Vite       | `npm run build`      | `dist`           |
+| Next.js    | `npx @cloudflare/next-on-pages` | `.vercel/output/static` |
+| Astro      | `npm run build`      | `dist`           |
+| Hugo       | `hugo`               | `public`         |
+| SvelteKit  | `npm run build`      | `.svelte-kit/cloudflare` |
+
+## Preview Deployments
+
+Every non-production branch gets a unique preview URL automatically.
+
+```
+# URL format for preview deployments
+https://<commit-hash>.<project-name>.pages.dev
+https://<branch-name>.<project-name>.pages.dev
+```
+
+### Branch-Based Access Control
+
+```bash
+# Set preview branch patterns in wrangler.toml (Pages-specific)
+# Or configure via dashboard: Settings > Builds & deployments
+# Include branches: feature/*, staging
+# Exclude branches: dependabot/*
+```
+
+### Preview Comment on Pull Requests
+
+Enable the Cloudflare Pages GitHub App to post deployment URLs as PR comments. Configure under **Settings > Builds & deployments > Preview comment**.
+
+## Pages Functions
+
+Pages Functions provide server-side logic deployed alongside your static site. Place files in a `functions/` directory at the project root.
+
+### Basic API Route
+
+```typescript
+// functions/api/hello.ts
+export const onRequestGet: PagesFunction = async (context) => {
+  return new Response(JSON.stringify({ message: "Hello from the edge" }), {
+    headers: { "Content-Type": "application/json" },
+  });
+};
+
+// functions/api/users/[id].ts — dynamic route parameter
+export const onRequestGet: PagesFunction = async (context) => {
+  const userId = context.params.id;
+  return new Response(JSON.stringify({ userId }), {
+    headers: { "Content-Type": "application/json" },
+  });
+};
+```
+
+### Middleware
+
+```typescript
+// functions/_middleware.ts — runs before all routes
+export const onRequest: PagesFunction = async (context) => {
+  const authHeader = context.request.headers.get("Authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+  return context.next();
+};
+```
+
+### Functions with Bindings
+
+```typescript
+// functions/api/data.ts — using KV and D1 bindings
+interface Env {
+  MY_KV: KVNamespace;
+  MY_DB: D1Database;
+  MY_BUCKET: R2Bucket;
+}
+
+export const onRequestGet: PagesFunction<Env> = async (context) => {
+  // Read from KV
+  const cached = await context.env.MY_KV.get("key");
+  if (cached) return new Response(cached);
+
+  // Query D1
+  const result = await context.env.MY_DB.prepare(
+    "SELECT * FROM items LIMIT 10"
+  ).all();
+
+  // Cache in KV
+  await context.env.MY_KV.put("key", JSON.stringify(result.results), {
+    expirationTtl: 300,
+  });
+
+  return Response.json(result.results);
+};
+```
+
+## Wrangler Configuration
+
+```toml
+# wrangler.toml — Pages project configuration
+name = "my-site"
+compatibility_date = "2024-09-01"
+pages_build_output_dir = "dist"
+
+# KV namespace binding
+[[kv_namespaces]]
+binding = "MY_KV"
+id = "abc123def456"
+
+# D1 database binding
+[[d1_databases]]
+binding = "MY_DB"
+database_name = "my-app-db"
+database_id = "xxxx-yyyy-zzzz"
+
+# R2 bucket binding
+[[r2_buckets]]
+binding = "MY_BUCKET"
+bucket_name = "app-assets"
+
+# Environment variables
+[vars]
+API_BASE_URL = "https://api.example.com"
+```
+
+## Headers and Redirects
+
+### Custom Headers
+
+```
+# public/_headers
+/assets/*
+  Cache-Control: public, max-age=31536000, immutable
+
+/*
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=()
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'
+
+/api/*
+  Access-Control-Allow-Origin: https://example.com
+  Access-Control-Allow-Methods: GET, POST, OPTIONS
+```
+
+### Redirects
+
+```
+# public/_redirects
+/old-page  /new-page  301
+/blog/:slug  /posts/:slug  301
+/docs/*  https://docs.example.com/:splat  302
+/home  /  302
+```
+
+## Custom Domains
+
+```bash
+# Add a custom domain via Cloudflare dashboard:
+# Pages project > Custom domains > Set up a custom domain
+
+# Or via API
+curl -X POST "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/pages/projects/my-site/domains" \
+  -H "Authorization: Bearer $CF_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"name":"www.example.com"}'
+```
+
+## CI/CD Integration
+
+### GitHub Actions
+
+```yaml
+# .github/workflows/deploy.yml
+name: Deploy to Cloudflare Pages
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy dist --project-name=my-site
+```
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| Build fails with out-of-memory | Build exceeds 1 GB RAM limit | Reduce dependencies; use `NODE_OPTIONS=--max_old_space_size=768` |
+| Functions return 404 | `functions/` directory not at project root | Move `functions/` to repo root, not inside `src/` |
+| Preview URL shows old content | Browser cache or stale deployment | Hard refresh; check deployment list for latest commit hash |
+| Custom domain shows SSL error | DNS not proxied through Cloudflare | Enable orange cloud (proxy) on the CNAME record |
+| `_headers` file ignored | File not in build output directory | Place in `public/` so it copies to `dist/` during build |
+| Bindings undefined in Functions | Missing `wrangler.toml` or dashboard config | Add bindings in `wrangler.toml` and redeploy |
+| 1 MB function size limit exceeded | Too many dependencies bundled | Tree-shake; move large deps to KV or R2 |
+
+## Related Skills
+
+- cloudflare-workers (`cloudflare-workers`) - Edge backend logic and API routes
+- cloudflare-r2 (`cloudflare-r2`) - Object storage for assets and uploads
+- cloudflare-zero-trust (`cloudflare-zero-trust`) - Protect preview deployments with Access policies
+- cdn-setup (`cdn-setup`) - General CDN configuration patterns
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/cloudflare-r2/SKILL.md

@@ -0,0 +1,353 @@
+---
+name: cloudflare-r2
+description: Manage Cloudflare R2 buckets, lifecycle, and signed URLs. Use for low-egress
+  object storage and media delivery.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Cloudflare R2
+
+S3-compatible object storage with zero egress fees, built on Cloudflare's global network.
+
+## When to Use
+
+- Storing user uploads, media files, backups, or static assets.
+- Replacing AWS S3 to eliminate egress costs for read-heavy workloads.
+- Serving files at the edge via Workers or public bucket access.
+- Building multi-cloud storage that avoids vendor lock-in (S3 API compatible).
+- Storing ML model artifacts, training data, or inference results.
+
+## Prerequisites
+
+- Cloudflare account with R2 enabled (dashboard > R2 > subscribe).
+- Wrangler CLI v3+ installed: `npm install -g wrangler`.
+- Authenticated via `wrangler login` or `CLOUDFLARE_API_TOKEN`.
+- For S3 API access: R2 API token created under **R2 > Manage R2 API Tokens**.
+
+## Bucket Management with Wrangler
+
+### Create and List Buckets
+
+```bash
+# Create a new bucket
+npx wrangler r2 bucket create app-assets
+
+# Create a bucket in a specific region (hint for data locality)
+npx wrangler r2 bucket create eu-uploads --location=eu
+
+# List all buckets
+npx wrangler r2 bucket list
+
+# Delete an empty bucket
+npx wrangler r2 bucket delete old-bucket
+```
+
+### Object Operations
+
+```bash
+# Upload a single file
+npx wrangler r2 object put app-assets/images/logo.png --file=./logo.png
+
+# Upload with content type
+npx wrangler r2 object put app-assets/data/report.json \
+  --file=./report.json \
+  --content-type="application/json"
+
+# Download an object
+npx wrangler r2 object get app-assets/images/logo.png --file=./downloaded-logo.png
+
+# Delete an object
+npx wrangler r2 object delete app-assets/images/old-logo.png
+
+# Get object metadata
+npx wrangler r2 object head app-assets/images/logo.png
+```
+
+## S3-Compatible API Access
+
+R2 supports the S3 API, so existing tools (AWS CLI, boto3, s3cmd) work out of the box.
+
+### Generate R2 API Tokens
+
+1. Go to **R2 > Manage R2 API Tokens > Create API token**.
+2. Select permissions: Object Read & Write, or Object Read only.
+3. Scope to specific buckets if possible.
+4. Save the Access Key ID and Secret Access Key.
+
+### AWS CLI Configuration
+
+```bash
+# Configure a named profile for R2
+aws configure --profile r2
+# Access Key ID: <your-r2-access-key>
+# Secret Access Key: <your-r2-secret-key>
+# Region: auto
+# Output: json
+
+# Use the R2 endpoint
+export R2_ENDPOINT="https://<ACCOUNT_ID>.r2.cloudflarestorage.com"
+
+# List buckets
+aws s3 ls --endpoint-url=$R2_ENDPOINT --profile=r2
+
+# Sync a directory
+aws s3 sync ./dist s3://app-assets/static/ \
+  --endpoint-url=$R2_ENDPOINT \
+  --profile=r2
+
+# Copy a file
+aws s3 cp ./backup.tar.gz s3://app-assets/backups/backup-$(date +%Y%m%d).tar.gz \
+  --endpoint-url=$R2_ENDPOINT \
+  --profile=r2
+
+# List objects with prefix
+aws s3 ls s3://app-assets/images/ \
+  --endpoint-url=$R2_ENDPOINT \
+  --profile=r2
+
+# Remove objects by prefix
+aws s3 rm s3://app-assets/tmp/ --recursive \
+  --endpoint-url=$R2_ENDPOINT \
+  --profile=r2
+```
+
+### Python boto3 Client
+
+```python
+import boto3
+
+s3 = boto3.client(
+    "s3",
+    endpoint_url="https://<ACCOUNT_ID>.r2.cloudflarestorage.com",
+    aws_access_key_id="<R2_ACCESS_KEY>",
+    aws_secret_access_key="<R2_SECRET_KEY>",
+    region_name="auto",
+)
+
+# Upload file
+s3.upload_file("./report.pdf", "app-assets", "reports/report.pdf")
+
+# Generate presigned URL (valid for 1 hour)
+url = s3.generate_presigned_url(
+    "get_object",
+    Params={"Bucket": "app-assets", "Key": "reports/report.pdf"},
+    ExpiresIn=3600,
+)
+print(url)
+
+# List objects
+response = s3.list_objects_v2(Bucket="app-assets", Prefix="images/", MaxKeys=100)
+for obj in response.get("Contents", []):
+    print(f"{obj['Key']} - {obj['Size']} bytes")
+```
+
+## Worker Bindings
+
+Bind R2 buckets to Workers or Pages Functions for server-side access without API tokens.
+
+### Wrangler Configuration
+
+```toml
+# wrangler.toml
+name = "asset-worker"
+main = "src/index.ts"
+compatibility_date = "2024-09-01"
+
+[[r2_buckets]]
+binding = "ASSETS"
+bucket_name = "app-assets"
+
+[[r2_buckets]]
+binding = "UPLOADS"
+bucket_name = "user-uploads"
+```
+
+### Worker with R2 Operations
+
+```typescript
+// src/index.ts
+interface Env {
+  ASSETS: R2Bucket;
+  UPLOADS: R2Bucket;
+}
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const url = new URL(request.url);
+
+    // GET — serve file from R2
+    if (request.method === "GET") {
+      const key = url.pathname.slice(1); // strip leading /
+      const object = await env.ASSETS.get(key);
+
+      if (!object) {
+        return new Response("Not Found", { status: 404 });
+      }
+
+      const headers = new Headers();
+      object.writeHttpMetadata(headers);
+      headers.set("etag", object.httpEtag);
+      headers.set("cache-control", "public, max-age=86400");
+
+      return new Response(object.body, { headers });
+    }
+
+    // PUT — upload file to R2
+    if (request.method === "PUT") {
+      const key = url.pathname.slice(1);
+      const contentType = request.headers.get("content-type") || "application/octet-stream";
+
+      await env.UPLOADS.put(key, request.body, {
+        httpMetadata: { contentType },
+        customMetadata: { uploadedAt: new Date().toISOString() },
+      });
+
+      return new Response(JSON.stringify({ key, status: "uploaded" }), {
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    // DELETE — remove file
+    if (request.method === "DELETE") {
+      const key = url.pathname.slice(1);
+      await env.UPLOADS.delete(key);
+      return new Response(null, { status: 204 });
+    }
+
+    return new Response("Method Not Allowed", { status: 405 });
+  },
+};
+```
+
+### Presigned URL Generation in a Worker
+
+```typescript
+// Generate time-limited signed URLs using Workers
+import { AwsClient } from "aws4fetch";
+
+interface Env {
+  R2_ACCESS_KEY: string;
+  R2_SECRET_KEY: string;
+  R2_ACCOUNT_ID: string;
+}
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const aws = new AwsClient({
+      accessKeyId: env.R2_ACCESS_KEY,
+      secretAccessKey: env.R2_SECRET_KEY,
+    });
+
+    const url = new URL(request.url);
+    const key = url.searchParams.get("key");
+    if (!key) return new Response("Missing key", { status: 400 });
+
+    const r2Url = `https://${env.R2_ACCOUNT_ID}.r2.cloudflarestorage.com/app-assets/${key}`;
+
+    const signed = await aws.sign(new Request(r2Url), {
+      aws: { signQuery: true },
+    });
+
+    return Response.json({ url: signed.url });
+  },
+};
+```
+
+## Public Bucket Access
+
+Enable public access to serve files directly without a Worker.
+
+1. Go to **R2 > bucket > Settings > Public access**.
+2. Enable and set a custom domain (e.g., `assets.example.com`).
+3. Objects are accessible at `https://assets.example.com/<key>`.
+
+```bash
+# Or enable via the r2.dev subdomain (for testing)
+# Bucket Settings > R2.dev subdomain > Allow Access
+# URL: https://pub-<hash>.r2.dev/<key>
+```
+
+## Lifecycle Rules
+
+Configure automatic object expiration or transition.
+
+```bash
+# Set lifecycle rules via the Cloudflare dashboard:
+# R2 > bucket > Settings > Object lifecycle rules
+
+# Or via API
+curl -X PUT "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/r2/buckets/app-assets/lifecycle" \
+  -H "Authorization: Bearer $CF_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "rules": [
+      {
+        "id": "expire-tmp-files",
+        "enabled": true,
+        "conditions": { "prefix": "tmp/" },
+        "actions": { "deleteObject": { "daysAfterCreationDate": 7 } }
+      },
+      {
+        "id": "expire-old-logs",
+        "enabled": true,
+        "conditions": { "prefix": "logs/" },
+        "actions": { "deleteObject": { "daysAfterCreationDate": 90 } }
+      }
+    ]
+  }'
+```
+
+## CORS Configuration
+
+```bash
+# Set CORS policy for browser-based uploads
+curl -X PUT "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/r2/buckets/app-assets/cors" \
+  -H "Authorization: Bearer $CF_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "corsRules": [
+      {
+        "allowedOrigins": ["https://example.com"],
+        "allowedMethods": ["GET", "PUT", "HEAD"],
+        "allowedHeaders": ["Content-Type", "Authorization"],
+        "maxAgeSeconds": 3600
+      }
+    ]
+  }'
+```
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| `NoSuchBucket` error via S3 API | Wrong endpoint or bucket name | Verify endpoint is `https://<ACCOUNT_ID>.r2.cloudflarestorage.com` |
+| `SignatureDoesNotMatch` | Incorrect secret key or endpoint mismatch | Regenerate R2 API token; ensure region is `auto` |
+| Uploads succeed but GET returns 404 | Key path mismatch (leading slash) | R2 keys should not start with `/` |
+| Slow uploads for large files | Single-stream upload | Use multipart upload; set `--expected-size` with wrangler |
+| CORS errors in browser | Missing CORS config on bucket | Add CORS rules for your origin domain |
+| Worker binding returns `undefined` | `wrangler.toml` binding name mismatch | Verify `binding` name matches `Env` interface property |
+| Public access returns 403 | Public access not enabled | Enable in bucket Settings > Public access |
+
+## Related Skills
+
+- cloudflare-workers (`cloudflare-workers`) - Signed URL generation and edge file serving
+- cloudflare-pages (`cloudflare-pages`) - Pages Functions with R2 bindings
+- cdn-setup (`cdn-setup`) - CDN configuration for asset delivery
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+