opencode-starterkit 1.0.1

package/baseline/skill/cloudflare/references/miniflare/patterns.md

@@ -0,0 +1,211 @@
+# Testing Patterns
+
+## Basic Test Setup (node:test)
+
+```js
+import assert from "node:assert";
+import test, { after, before } from "node:test";
+import { Miniflare } from "miniflare";
+
+let mf;
+
+before(async () => {
+  mf = new Miniflare({
+    modules: true,
+    scriptPath: "src/index.js",
+    kvNamespaces: ["TEST_KV"],
+    bindings: { API_KEY: "test-key" },
+  });
+  await mf.ready;
+});
+
+test("fetch returns hello", async () => {
+  const res = await mf.dispatchFetch("http://localhost/");
+  assert.strictEqual(await res.text(), "Hello World");
+});
+
+test("kv operations", async () => {
+  const kv = await mf.getKVNamespace("TEST_KV");
+  await kv.put("key", "value");
+  
+  const res = await mf.dispatchFetch("http://localhost/kv");
+  assert.strictEqual(await res.text(), "value");
+});
+
+after(async () => {
+  await mf.dispose();
+});
+```
+
+## Build Before Tests
+
+```js
+import { spawnSync } from "node:child_process";
+
+before(() => {
+  spawnSync("npx wrangler build", { shell: true, stdio: "pipe" });
+});
+```
+
+## Testing Durable Objects
+
+```js
+test("durable object state", async () => {
+  const ns = await mf.getDurableObjectNamespace("COUNTER");
+  const id = ns.idFromName("test-counter");
+  const stub = ns.get(id);
+  
+  const res1 = await stub.fetch("http://localhost/increment");
+  assert.strictEqual(await res1.text(), "1");
+  
+  const res2 = await stub.fetch("http://localhost/increment");
+  assert.strictEqual(await res2.text(), "2");
+  
+  // Direct storage access
+  const storage = await mf.getDurableObjectStorage(id);
+  const count = await storage.get("count");
+  assert.strictEqual(count, 2);
+});
+```
+
+## Testing Queue Handlers
+
+```js
+test("queue message processing", async () => {
+  const worker = await mf.getWorker();
+  
+  const result = await worker.queue("my-queue", [
+    { id: "msg1", timestamp: new Date(), body: { userId: 123 }, attempts: 1 },
+  ]);
+  
+  assert.strictEqual(result.outcome, "ok");
+  
+  // Verify side effects
+  const kv = await mf.getKVNamespace("QUEUE_LOG");
+  const log = await kv.get("msg1");
+  assert.ok(log);
+});
+```
+
+## Testing Scheduled Events
+
+```js
+test("scheduled cron handler", async () => {
+  const worker = await mf.getWorker();
+  
+  const result = await worker.scheduled({
+    scheduledTime: new Date("2024-01-01T00:00:00Z"),
+    cron: "0 0 * * *",
+  });
+  
+  assert.strictEqual(result.outcome, "ok");
+});
+```
+
+## Isolated Test Data
+
+```js
+describe("user tests", () => {
+  let mf;
+  
+  beforeEach(async () => {
+    mf = new Miniflare({
+      scriptPath: "worker.js",
+      kvNamespaces: ["USERS"],
+      // In-memory: no persist
+    });
+  });
+  
+  afterEach(async () => {
+    await mf.dispose();
+  });
+  
+  test("create user", async () => {
+    // Fresh KV per test
+  });
+});
+```
+
+## Mock External Services
+
+```js
+new Miniflare({
+  workers: [
+    {
+      name: "main",
+      serviceBindings: { EXTERNAL_API: "mock-api" },
+      script: `/* main worker */`,
+    },
+    {
+      name: "mock-api",
+      script: `
+        addEventListener("fetch", (event) => {
+          event.respondWith(Response.json({ mocked: true }));
+        })
+      `,
+    },
+  ],
+});
+```
+
+## Shared Storage Between Workers
+
+```js
+new Miniflare({
+  kvPersist: "./data",
+  workers: [
+    { name: "writer", kvNamespaces: { DATA: "shared" }, script: `...` },
+    { name: "reader", kvNamespaces: { DATA: "shared" }, script: `...` },
+  ],
+});
+```
+
+## Test Utils Pattern
+
+```js
+// test-utils.js
+export async function createTestWorker(overrides = {}) {
+  const mf = new Miniflare({
+    scriptPath: "dist/worker.js",
+    kvNamespaces: ["TEST_KV"],
+    bindings: { ENVIRONMENT: "test", ...overrides.bindings },
+    ...overrides,
+  });
+  await mf.ready;
+  return mf;
+}
+
+// test.js
+test("my test", async () => {
+  const mf = await createTestWorker({ bindings: { CUSTOM: "value" } });
+  try {
+    const res = await mf.dispatchFetch("http://localhost/");
+    assert.ok(res.ok);
+  } finally {
+    await mf.dispose();
+  }
+});
+```
+
+## Error Handling Tests
+
+```js
+test("handles 404", async () => {
+  const res = await mf.dispatchFetch("http://localhost/not-found");
+  assert.strictEqual(res.status, 404);
+});
+
+test("handles invalid input", async () => {
+  const res = await mf.dispatchFetch("http://localhost/api", {
+    method: "POST",
+    body: "invalid json",
+  });
+  assert.strictEqual(res.status, 400);
+});
+```
+
+## CI Integration
+
+Use in-memory storage (omit persist options) for CI speed. Use `dispatchFetch` instead of HTTP server to avoid port conflicts.
+
+See [gotchas.md](./gotchas.md) for troubleshooting common issues.

package/baseline/skill/cloudflare/references/network-interconnect/README.md

@@ -0,0 +1,60 @@
+# Cloudflare Network Interconnect (CNI)
+
+Private, high-performance connectivity to Cloudflare's network. **Enterprise-only**.
+
+## Connection Types
+
+**Direct**: Physical fiber in shared datacenter. 10/100 Gbps. You order cross-connect.
+
+**Partner**: Virtual via Console Connect, Equinix, Megaport, etc. Managed via partner SDN.
+
+**Cloud**: AWS Direct Connect or GCP Cloud Interconnect. Magic WAN only.
+
+## Dataplane Versions
+
+**v1 (Classic)**: GRE tunnel support, VLAN/BFD/LACP, asymmetric MTU (1500↓/1476↑), peering support.
+
+**v2 (Beta)**: No GRE, 1500 MTU both ways, no VLAN/BFD/LACP yet, ECMP instead.
+
+## Use Cases
+
+- **Magic Transit DSR**: DDoS protection, egress via ISP (v1/v2)
+- **Magic Transit + Egress**: DDoS + egress via CF (v1/v2)
+- **Magic WAN + Zero Trust**: Private backbone (v1 needs GRE, v2 native)
+- **Peering**: Public routes at PoP (v1 only)
+- **App Security**: WAF/Cache/LB (v1/v2 over Magic Transit)
+
+## Prerequisites
+
+- Enterprise plan
+- IPv4 /24+ or IPv6 /48+ prefixes
+- BGP ASN for v1
+- See [locations PDF](https://developers.cloudflare.com/network-interconnect/static/cni-locations-30-10-2025.pdf)
+
+## Specs
+
+- /31 point-to-point subnets
+- 10km max optical distance
+- 10G: 10GBASE-LR single-mode
+- 100G: 100GBASE-LR4 single-mode
+- **No SLA** (free service)
+- Backup Internet required
+
+## Throughput
+
+| Direction | 10G | 100G |
+|-----------|-----|------|
+| CF → Customer | 10 Gbps | 100 Gbps |
+| Customer → CF (peering) | 10 Gbps | 100 Gbps |
+| Customer → CF (Magic) | 1 Gbps/tunnel or CNI | 1 Gbps/tunnel or CNI |
+
+## Timeline
+
+2-4 weeks typical. Steps: request → config review → order connection → configure → test → enable health checks → activate → monitor.
+
+## See Also
+
+- [configuration.md](./configuration.md) - BGP, routing, setup
+- [api.md](./api.md) - API endpoints, SDKs
+- [patterns.md](./patterns.md) - HA, hybrid cloud, failover
+- [gotchas.md](./gotchas.md) - Troubleshooting, limits

package/baseline/skill/cloudflare/references/network-interconnect/api.md

@@ -0,0 +1,240 @@
+# CNI API Reference
+
+See [README.md](./README.md) for overview.
+
+## Base
+
+```
+https://api.cloudflare.com/client/v4
+Auth: Authorization: Bearer <token>
+```
+
+## Interconnects
+
+### List
+```http
+GET /accounts/{account_id}/cni/interconnects
+```
+Query: `page`, `per_page`
+
+### Create
+```http
+POST /accounts/{account_id}/cni/interconnects
+```
+Body: `account`, `slot_id`, `type`, `facility`, `speed`, `name`, `description`
+
+### Get
+```http
+GET /accounts/{account_id}/cni/interconnects/{icon}
+```
+
+### Status
+```http
+GET /accounts/{account_id}/cni/interconnects/{icon}/status
+```
+Returns: `active` | `unhealthy` | `pending`
+
+### LOA
+```http
+GET /accounts/{account_id}/cni/interconnects/{icon}/loa
+```
+Returns PDF.
+
+### Delete
+```http
+DELETE /accounts/{account_id}/cni/interconnects/{icon}
+```
+
+## CNI Objects (BGP config)
+
+### List
+```http
+GET /accounts/{account_id}/cni/cnis
+```
+
+### Create
+```http
+POST /accounts/{account_id}/cni/cnis
+```
+Body: `account`, `cust_ip`, `cf_ip`, `bgp_asn`, `bgp_password`, `vlan`
+
+### Get/Update/Delete
+```http
+GET /accounts/{account_id}/cni/cnis/{cni}
+PUT /accounts/{account_id}/cni/cnis/{cni}
+DELETE /accounts/{account_id}/cni/cnis/{cni}
+```
+
+## Slots
+
+### List
+```http
+GET /accounts/{account_id}/cni/slots
+```
+Query: `facility`, `occupied`
+
+### Get
+```http
+GET /accounts/{account_id}/cni/slots/{slot}
+```
+
+## Settings
+
+### Get/Update
+```http
+GET /accounts/{account_id}/cni/settings
+PUT /accounts/{account_id}/cni/settings
+```
+Body: `default_asn`
+
+## TypeScript SDK
+
+```typescript
+import Cloudflare from 'cloudflare';
+
+const client = new Cloudflare({ apiToken: process.env.CF_TOKEN });
+
+// List
+await client.networkInterconnects.interconnects.list({ account_id: id });
+
+// Create
+await client.networkInterconnects.interconnects.create({
+  account_id: id,
+  account: id,
+  slot_id: 'slot_abc',
+  type: 'direct',
+  facility: 'EWR1',
+  speed: '10G',
+  name: 'prod-interconnect',
+});
+
+// Status
+await client.networkInterconnects.interconnects.get(accountId, iconId);
+
+// LOA (use fetch)
+const res = await fetch(`https://api.cloudflare.com/client/v4/accounts/${id}/cni/interconnects/${iconId}/loa`, {
+  headers: { Authorization: `Bearer ${token}` },
+});
+await fs.writeFile('loa.pdf', Buffer.from(await res.arrayBuffer()));
+
+// CNI object
+await client.networkInterconnects.cnis.create({
+  account_id: id,
+  account: id,
+  cust_ip: '192.0.2.1/31',
+  cf_ip: '192.0.2.0/31',
+  bgp_asn: 65000,
+  vlan: 100,
+});
+
+// Slots
+await client.networkInterconnects.slots.list({
+  account_id: id,
+  occupied: false,
+});
+```
+
+## Python SDK
+
+```python
+from cloudflare import Cloudflare
+
+client = Cloudflare(api_token=os.environ["CF_TOKEN"])
+
+# List
+client.network_interconnects.interconnects.list(account_id=id)
+
+# Create
+client.network_interconnects.interconnects.create(
+    account_id=id,
+    account=id,
+    slot_id="slot_abc",
+    type="direct",
+    facility="EWR1",
+    speed="10G",
+    name="prod-interconnect",
+)
+
+# Status
+client.network_interconnects.interconnects.get(account_id=id, icon=icon_id)
+
+# LOA
+import requests
+res = requests.get(
+    f"https://api.cloudflare.com/client/v4/accounts/{id}/cni/interconnects/{icon_id}/loa",
+    headers={"Authorization": f"Bearer {token}"}
+)
+with open("loa.pdf", "wb") as f:
+    f.write(res.content)
+
+# CNI object
+client.network_interconnects.cnis.create(
+    account_id=id,
+    account=id,
+    cust_ip="192.0.2.1/31",
+    cf_ip="192.0.2.0/31",
+    bgp_asn=65000,
+    vlan=100,
+)
+
+# Slots
+client.network_interconnects.slots.list(
+    account_id=id,
+    occupied=False,
+)
+```
+
+## cURL
+
+```bash
+export CF_TOKEN="token"
+export ACCOUNT_ID="id"
+
+# List
+curl "https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/cni/interconnects" \
+  -H "Authorization: Bearer ${CF_TOKEN}"
+
+# Create
+curl -X POST "https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/cni/interconnects" \
+  -H "Authorization: Bearer ${CF_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "account": "'${ACCOUNT_ID}'",
+    "slot_id": "slot_abc",
+    "type": "direct",
+    "facility": "EWR1",
+    "speed": "10G",
+    "name": "prod-interconnect"
+  }'
+
+# Status
+curl "https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/cni/interconnects/${ICON_ID}/status" \
+  -H "Authorization: Bearer ${CF_TOKEN}"
+
+# LOA
+curl "https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/cni/interconnects/${ICON_ID}/loa" \
+  -H "Authorization: Bearer ${CF_TOKEN}" \
+  --output loa.pdf
+
+# CNI object
+curl -X POST "https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/cni/cnis" \
+  -H "Authorization: Bearer ${CF_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "account": "'${ACCOUNT_ID}'",
+    "cust_ip": "192.0.2.1/31",
+    "cf_ip": "192.0.2.0/31",
+    "bgp_asn": 65000,
+    "vlan": 100
+  }'
+
+# Slots
+curl "https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/cni/slots?occupied=false" \
+  -H "Authorization: Bearer ${CF_TOKEN}"
+```
+
+## Resources
+
+- [API Docs](https://developers.cloudflare.com/api/resources/network_interconnects/)
+- [TypeScript SDK](https://github.com/cloudflare/cloudflare-typescript)
+- [Python SDK](https://github.com/cloudflare/cloudflare-python)

package/baseline/skill/cloudflare/references/network-interconnect/configuration.md

@@ -0,0 +1,127 @@
+# CNI Configuration
+
+See [README.md](./README.md) for overview.
+
+## Workflow (2-4 weeks)
+
+1. **Submit request** (Week 1): Contact account team, provide type/location/use case
+2. **Review config** (Week 1-2, v1 only): Approve IP/VLAN/spec doc
+3. **Order connection** (Week 2-3):
+   - **Direct**: Get LOA, order cross-connect from facility
+   - **Partner**: Order virtual circuit in partner portal
+   - **Cloud**: Order Direct Connect/Cloud Interconnect, send LOA+VLAN to CF
+4. **Configure** (Week 3): Both sides configure per doc
+5. **Test** (Week 3-4): Ping, verify BGP, check routes
+6. **Health checks** (Week 4): Configure [Magic Transit](https://developers.cloudflare.com/magic-transit/how-to/configure-tunnel-endpoints/#add-tunnels) or [Magic WAN](https://developers.cloudflare.com/magic-wan/configuration/manually/how-to/configure-tunnel-endpoints/#add-tunnels) health checks
+7. **Activate** (Week 4): Route traffic, verify flow
+8. **Monitor**: Enable [maintenance notifications](https://developers.cloudflare.com/network-interconnect/monitoring-and-alerts/#enable-cloudflare-status-maintenance-notification)
+
+## BGP Configuration
+
+**v1 Requirements:**
+- BGP ASN (provide during setup)
+- /31 subnet for peering
+- Optional: BGP password
+
+**v2:** Simplified, less BGP config needed.
+
+**Example v1 BGP:**
+```
+Router ID: 192.0.2.1
+Peer IP: 192.0.2.0
+Remote ASN: 13335
+Local ASN: 65000
+Password: [optional]
+VLAN: 100
+```
+
+## Cloud Interconnect Setup
+
+### AWS Direct Connect (Beta)
+
+**Requirements:** Magic WAN, AWS Dedicated Direct Connect 1/10 Gbps.
+
+**Process:**
+1. Contact CF account team
+2. Choose location
+3. Order in AWS portal
+4. AWS provides LOA + VLAN ID
+5. Send to CF account team
+6. Wait ~4 weeks
+
+**Post-setup:** Add [static routes](https://developers.cloudflare.com/magic-wan/configuration/manually/how-to/configure-routes/#configure-static-routes) to Magic WAN. Enable [bidirectional health checks](https://developers.cloudflare.com/magic-wan/configuration/manually/how-to/configure-tunnel-endpoints/#legacy-bidirectional-health-checks).
+
+### GCP Cloud Interconnect (Beta)
+
+**Setup via Dashboard:**
+1. Interconnects → Create → Cloud Interconnect → Google
+2. Provide name, MTU (match GCP VLAN attachment), speed
+3. Enter VLAN attachment pairing key
+4. Confirm order
+
+**Routing to GCP:** Add [static routes](https://developers.cloudflare.com/magic-wan/configuration/manually/how-to/configure-routes/#configure-static-routes). BGP routes from GCP Cloud Router **ignored**.
+
+**Routing to CF:** Configure [custom learned routes](https://cloud.google.com/network-connectivity/docs/router/how-to/configure-custom-learned-routes) in Cloud Router. Request prefixes from CF account team.
+
+## Monitoring
+
+**Dashboard Status:**
+- **Active**: Link up, sufficient light, Ethernet negotiated
+- **Unhealthy**: Link down, no/low light (<-20 dBm), can't negotiate
+- **Pending**: Cross-connect incomplete, device unresponsive, RX/TX swapped
+
+**Alerts:**
+
+**CNI Connection Maintenance** (Magic Networking only):
+```
+Dashboard → Notifications → Add
+Product: Cloudflare Network Interconnect
+Type: Connection Maintenance Alert
+```
+Warnings up to 2 weeks advance. 6hr delay for new additions.
+
+**Cloudflare Status Maintenance** (entire PoP):
+```
+Dashboard → Notifications → Add
+Product: Cloudflare Status
+Filter PoPs: gru,fra,lhr
+```
+
+**Find PoP code:**
+```
+Dashboard → Magic Transit/WAN → Configuration → Interconnects
+Select CNI → Note Data Center (e.g., "gru-b")
+Use first 3 letters: "gru"
+```
+
+## Best Practices
+
+**Design:**
+- Choose locations with device diversity
+- Plan redundancy from start
+- Select appropriate dataplane for use case
+- Document capacity + growth
+
+**Ordering:**
+- Verify facility codes match LOA
+- Confirm single-mode fiber
+- Check optic types (10GBASE-LR/100GBASE-LR4)
+
+**Config:**
+- /31 subnets
+- BGP passwords
+- BFD for v1
+- Test ping before BGP
+
+**Production:**
+- Enable maintenance notifications immediately
+- Monitor status programmatically
+- Test backup connectivity regularly
+- Document escalation paths
+
+**Security:**
+- Minimum API token permissions
+- Rotate BGP passwords
+- BGP route filtering
+- Monitor unexpected advertisements
+- Use Magic Firewall