opencode-skills-collection 4.1.14 → 4.1.16

package/bundled-skills/fp-taskeither-ref/SKILL.md

@@ -10,7 +10,7 @@ tags: [fp-ts, taskeither, async, promise, error-handling, quick-reference]
 
 # TaskEither Quick Reference
 
-TaskEither = async operation that can fail. Like `Promise<Either<E, A>>`.
+TaskEither = async operation that can fail. Its shape is `() => Promise<Either<E, A>>`: construction is lazy.
 
 ## When to Use
 - You need a quick fp-ts reference for async operations that can fail.
@@ -21,6 +21,7 @@ TaskEither = async operation that can fail. Like `Promise<Either<E, A>>`.
 
 ```typescript
 import * as TE from 'fp-ts/TaskEither'
+import * as T from 'fp-ts/Task'
 
 TE.right(value)          // Async success
 TE.left(error)           // Async failure
@@ -58,16 +59,22 @@ await pipe(
 ```typescript
 import { pipe } from 'fp-ts/function'
 import * as TE from 'fp-ts/TaskEither'
+import * as T from 'fp-ts/Task'
 
 // Wrap fetch
-const fetchUser = (id: string) => TE.tryCatch(
-  () => fetch(`/api/users/${id}`).then(r => r.json()),
+const fetchUser = (id: string, signal: AbortSignal) => TE.tryCatch(
+  async () => {
+    const response = await fetch(`/api/users/${encodeURIComponent(id)}`, { signal })
+    if (!response.ok) throw new Error(`HTTP ${response.status}`)
+    const body: unknown = await response.json()
+    return validateUser(body) // Application schema validator; throws on invalid data
+  },
   (e) => ({ type: 'NETWORK_ERROR', message: String(e) })
 )
 
 // Chain async calls
 pipe(
-  fetchUser('123'),
+  fetchUser('123', signal),
   TE.flatMap(user => fetchPosts(user.id)),
   TE.map(posts => posts.length)
 )
@@ -75,16 +82,16 @@ pipe(
 // Parallel calls
 import { sequenceT } from 'fp-ts/Apply'
 sequenceT(TE.ApplyPar)(
-  fetchUser('1'),
+  fetchUser('1', signal),
   fetchPosts('1'),
   fetchComments('1')
 )
 
 // With recovery
 pipe(
-  fetchUser('123'),
+  fetchUser('123', signal),
   TE.orElse(() => TE.right(defaultUser)),
-  TE.getOrElse(() => defaultUser)
+  TE.getOrElse(() => T.of(defaultUser))
 )
 ```
 
@@ -102,9 +109,12 @@ async function getUser(id: string) {
 }
 
 // ✅ TaskEither - errors typed and composable
-const getUser = (id: string) => pipe(
-  TE.tryCatch(() => fetch(`/api/users/${id}`), toNetworkError),
-  TE.flatMap(res => TE.tryCatch(() => res.json(), toParseError))
+const getUser = (id: string, signal: AbortSignal) => pipe(
+  TE.tryCatch(() => fetch(`/api/users/${encodeURIComponent(id)}`, { signal }), toNetworkError),
+  TE.flatMap(res => TE.tryCatch(async () => {
+    if (!res.ok) throw new Error(`HTTP ${res.status}`)
+    return validateUser(await res.json())
+  }, toParseError))
 )
 ```
 
@@ -114,3 +124,11 @@ Use TaskEither when you need **typed errors** for async operations.
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+## Reference scope
+
+These are fp-ts 2.x fragments. Supply application variables, types, validators and imports, and check the installed version. `map` does not catch thrown exceptions. `Task` has no typed error channel; an improperly wrapped promise can still reject. Use `tryCatch` at fallible boundaries.
+
+Supply a caller-owned timeout/abort signal and validate response schemas. Parallel application calls need bounded concurrency and authorization for their data, costs and effects; `ApplyPar` does not cancel work automatically on failure. Error callbacks must redact secrets and private payloads.
+
+Official API: [fp-ts modules](https://gcanti.github.io/fp-ts/modules/).

package/bundled-skills/fp-types-ref/SKILL.md

@@ -41,7 +41,7 @@ import { pipe, flow } from 'fp-ts/function'
 import * as O from 'fp-ts/Option'      // Maybe exists
 import * as E from 'fp-ts/Either'      // Success or failure
 import * as TE from 'fp-ts/TaskEither' // Async + failure
-import * as T from 'fp-ts/Task'        // Async (no failure)
+import * as T from 'fp-ts/Task'        // Lazy async; no typed error channel
 import * as A from 'fp-ts/Array'       // Array utilities
 ```
 
@@ -50,7 +50,7 @@ import * as A from 'fp-ts/Array'       // Array utilities
 | Need | Code |
 |------|------|
 | Wrap nullable | `O.fromNullable(value)` |
-| Default value | `O.getOrElse(() => default)` |
+| Default value | `O.getOrElse(() => fallbackValue)` |
 | Transform if exists | `O.map(fn)` |
 | Chain optionals | `O.flatMap(fn)` |
 | Wrap try/catch | `E.tryCatch(() => risky(), toError)` |
@@ -77,3 +77,9 @@ pipe(result, E.match(
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
 - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+## Reference scope
+
+These are fp-ts 2.x fragments. Supply application variables, types, validators and imports, and check the installed version. `map` does not catch thrown exceptions. `Task` has no typed error channel; an improperly wrapped promise can still reject. Use `tryCatch` at fallible boundaries.
+
+Official API: [fp-ts modules](https://gcanti.github.io/fp-ts/modules/).

package/bundled-skills/framework-migration-legacy-modernize/SKILL.md

@@ -27,7 +27,6 @@ Orchestrate a comprehensive legacy system modernization using the strangler fig
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Phase 1: Legacy Assessment and Risk Analysis
 

package/bundled-skills/free-design-resources/SKILL.md

@@ -11,6 +11,14 @@ tags: [sme, design-tools, free-licences, fonts, icons, images, templates, access
 tools: []
 source_repo: WHOISABHISHEKADHIKARI/sme-ops-system-builder
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `../../references/free-design-resource-map.md`
+
+Obtain the required material from the [declared upstream source](https://github.com/WHOISABHISHEKADHIKARI/sme-ops-system-builder), or from a user-provided installation of that source. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # Free Design Resources
 

package/bundled-skills/frontend-api-integration-patterns/SKILL.md

@@ -148,25 +148,27 @@ useEffect(() => {
 
 ### 4. Retry with Exponential Backoff
 
-Retry only transient failures (5xx or network errors).
+Retry only explicitly replay-safe operations and classified transient failures. The default performs one attempt. Do not classify arbitrary programming or parsing exceptions as network errors. Honor provider Retry-After and a total deadline in the real adapter; do not enable this simple backoff for rate-limit responses. The POST prediction example intentionally does not enable retries unless the backend contract independently guarantees replay safety.
 
 ```js id="8n3zcf"
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-const fetchWithBackoff = async (fn, retries = 3, delay = 300) => {
+const fetchWithBackoff = async (fn, retries = 3, delay = 300, replaySafe = false) => {
   try {
     return await fn();
   } catch (err) {
     const isAbort = err.name === "AbortError";
     const isHttpError = typeof err.status === "number";
-    const isRetryable = !isAbort && (!isHttpError || err.status >= 500);
+    const isNetworkFailure = err.code === "NETWORK_ERROR";
+    const isRetryable = replaySafe && !isAbort &&
+      (isNetworkFailure || (isHttpError && err.status >= 500));
 
     if (retries <= 0 || !isRetryable) throw err;
 
     const nextDelay = delay * 2 + Math.random() * 100;
     await sleep(nextDelay);
 
-    return fetchWithBackoff(fn, retries - 1, nextDelay);
+    return fetchWithBackoff(fn, retries - 1, nextDelay, replaySafe);
   }
 };
 ```
@@ -219,21 +221,22 @@ const controllerRef = useRef(null);
 
 const handlePredict = async (input) => {
   controllerRef.current?.abort();
-  controllerRef.current = new AbortController();
+  const controller = new AbortController();
+  controllerRef.current = controller;
 
   try {
     const result = await fetchWithBackoff(() =>
       apiClient("/predict", {
         method: "POST",
         body: JSON.stringify({ text: input }),
-        signal: controllerRef.current.signal,
+        signal: controller.signal,
       })
     );
 
-    setOutput(result);
+    if (!controller.signal.aborted && controllerRef.current === controller) setOutput(result);
   } catch (err) {
     if (err.name === "AbortError") return;
-    setError(err.message);
+    if (controllerRef.current === controller) setError(err.message);
   }
 };
 ```

package/bundled-skills/frontend-data-contracts/SKILL.md

@@ -13,7 +13,7 @@ license_source: https://github.com/stareezy-1/frontend-architecture-skill/blob/m
 # Frontend Data Contracts (typed network boundary)
 ## When to Use
 
-Use this skill when you need a portable, framework-agnostic discipline for type safety at the network edge of any React or React Native app. Establishes one typed API client as the single fetch boundary, a parse-don't-validate rule that turns wire JSON into trusted domain types before it enters the app, a single...
+Use this skill when you need a portable, framework-agnostic discipline for type safety at the network edge of any React or React Native app. Establishes one typed API client as the single fetch boundary, a parse-don't-validate rule that turns wire JSON into trusted domain types before it enters the app, runtime parsing, normalized errors and branded identifiers.
 
 
 > Portable skill — readable by Claude Code, OpenCode, Codex, Cursor, Windsurf, and others.
@@ -28,6 +28,10 @@ There is exactly one place this transformation happens, and nothing untyped esca
 
 ---
 
+## Example contract
+
+The snippets marked “essence” are architecture sketches with omitted project dependencies and methods, not a complete client. A generic `get<Invoice>` type parameter is only a compile-time assertion: it cannot establish runtime validity. Require the actual schema parse before treating a value as an Invoice, normalize parser failures into the project error type, and keep authorization independent of both schema validation and branded IDs. Bind adapter behavior to the installed library version; do not assume an unsupported per-query callback exists.
+
 ## 0. The five core ideas
 
 1. **One client is the only fetch boundary.** A single typed `apiClient` wraps `fetch`. Components and hooks never call `fetch`/`axios` directly — the boundary is enforceable in review and lint.

package/bundled-skills/frontend-mobile-development-component-scaffold/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: frontend-mobile-development-component-scaffold
-description: "You are a React component architecture expert specializing in scaffolding production-ready, accessible, and performant components. Generate complete component implementations with TypeScript, tests, s"
+description: "Scaffold React and React Native components with TypeScript, accessibility, tests, styles, and documentation."
 risk: critical
 source: community
 date_added: "2026-02-27"

package/bundled-skills/frontend-mobile-security-xss-scan/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: frontend-mobile-security-xss-scan
-description: "You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection poi"
+description: "Inspect frontend code for XSS injection points, unsafe DOM manipulation, and missing sanitization."
 risk: critical
 source: community
 date_added: "2026-02-27"

package/bundled-skills/frontend-slides/SKILL.md

@@ -207,6 +207,7 @@ If images were provided, the slide outline already incorporates them from Step 1
 When converting PowerPoint files:
 
 1. **Extract content** — Run `python scripts/extract-pptx.py <input.pptx> <output_dir>` (install python-pptx if needed: `pip install python-pptx`)
+   Treat untrusted PPTX files as data and extract into a new, isolated output directory; the script writes `extracted-slides.json` and image assets there, replacing same-named files.
 2. **Confirm with user** — Present extracted slide titles, content summaries, and image counts
 3. **Style selection** — Proceed to Phase 2 for style discovery
 4. **Generate HTML** — Convert to chosen style, preserving all text, images (from assets/), slide order, and speaker notes (as HTML comments)

package/bundled-skills/frontend-slides-frontend-slides/SKILL.md

@@ -9,6 +9,21 @@ date_added: 2026-07-01
 license: MIT
 license_source: https://github.com/zarazhangrui/frontend-slides/blob/main/LICENSE
 ---
+## Bundled upstream support
+
+Supporting files are included at skill-relative paths. See [UPSTREAM-NOTICE.md](UPSTREAM-NOTICE.md) for their pinned sources, licenses, hashes, and import changes.
+
+## Restored helper safety
+
+The PDF exporter starts a loopback-only server restricted to the selected deck directory. Playwright and Chromium must already be installed in the deck project; the helper does not download them. Review the HTML and local assets before opening them in a browser.
+
+## Supporting material availability
+
+These paths remain unavailable in this catalog copy:
+
+- `<support-root>/scripts/deploy.sh`
+
+Do not invoke a step that requires one of these files. Obtain the original material and review its dependencies, license, and effects before use. Independent inline steps and the bundled helpers can proceed within the user’s authorized scope.
 
 # Frontend Slides
 ## When to Use

package/bundled-skills/frontend-slides-frontend-slides/UPSTREAM-LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Zara Zhang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bundled-skills/frontend-slides-frontend-slides/UPSTREAM-NOTICE.md

@@ -0,0 +1,14 @@
+# Upstream helpers for frontend-slides-frontend-slides
+
+The files listed below were recovered from [zarazhangrui/frontend-slides](https://github.com/zarazhangrui/frontend-slides) at commit `9906a34d640d2111f724544cbc50f7f130569ae1`. The repository ID is `1143767804`.
+
+They retain the upstream **MIT** license reproduced in [UPSTREAM-LICENSE.txt](UPSTREAM-LICENSE.txt). This notice applies to the listed support files; it does not replace the license metadata of other catalog files. Preserve the upstream license and this attribution when redistributing them.
+
+License wording is unchanged; text-only trailing whitespace and EOF blank lines are normalized. Original license: https://github.com/zarazhangrui/frontend-slides/blob/9906a34d640d2111f724544cbc50f7f130569ae1/LICENSE
+
+| Local file | Original upstream path | Original Git blob SHA | Import changes |
+| --- | --- | --- | --- |
+| `scripts/extract-pptx.py` | `scripts/extract-pptx.py` | `498e2a5e4c9d3f11bec09a3ca54cd6731491a0e3` | content unchanged |
+| `scripts/export-pdf.sh` | `scripts/export-pdf.sh` | `8493d84faea2752cc065f313ac917641e7902b98` | stored without executable bit; invoke via its interpreter; AAS security adaptation: loopback-only confined static server; requires preinstalled Playwright and Chromium and performs no automatic dependency or browser downloads |
+
+PDF export uses the AAS-authored `scripts/lib/confined-server.mjs`, licensed under the repository MIT license. It binds only to `127.0.0.1`, checks the Host header, permits only GET/HEAD, and maps requests to files indexed and checked inside the selected deck before the server starts. Traversal and symlinks outside the deck are rejected. The index is bounded to 10,000 files and skips `.git`, `.next`, `.cache`, and `node_modules`. The exporter requires Playwright and Chromium to already exist in the deck project; it does not install packages or download browser binaries. If dependencies are missing it prints the explicit install commands and exits. The regression test is repository-owned at `tools/scripts/tests/upstream_helper_server.test.js`. The upstream deployment helper is excluded for unsafe asset-path handling and temporary-directory cleanup.