opencode-starterkit 1.0.1

package/baseline/skill/cloudflare/references/snippets/patterns.md

@@ -0,0 +1,34 @@
+## Common Use Cases
+
+### 1. Header Manipulation
+**Use for**: Adding/removing/modifying request or response headers
+```javascript
+// Add timestamp header
+const timestamp = Date.now().toString(16);
+modifiedRequest.headers.set("X-Hex-Timestamp", timestamp);
+
+// Remove sensitive headers
+newResponse.headers.delete("X-Powered-By");
+newResponse.headers.delete("Server");
+
+// Set security headers
+newResponse.headers.set("X-Frame-Options", "DENY");
+newResponse.headers.set("X-Content-Type-Options", "nosniff");
+```
+
+### 2. Cookie Modification
+**Use for**: Setting dynamic cookies, expiry times, A/B testing
+```javascript
+const expiry = new Date(Date.now() + 7 * 86400000).toUTCString();
+const group = request.headers.get("userGroup") == "premium" ? "A" : "B";
+response.headers.append(
+  "Set-Cookie",
+  `testGroup=${group}; Expires=${expiry}; path=/`
+);
+```
+
+### 3. Bot Management
+**Use for**: Routing bots, honeypots, rate limiting
+```javascript
+// Access bot score from request.cf
+const botScore = reques

package/baseline/skill/cloudflare/references/spectrum/README.md

@@ -0,0 +1,16 @@
+# Cloudflare Spectrum Skill Reference
+
+## Overview
+
+Cloudflare Spectrum provides security and acceleration for ANY TCP or UDP-based application. It's a global Layer 4 (L4) reverse proxy running on Cloudflare's edge nodes that routes MQTT, email, file transfer, version control, games, and more through Cloudflare to mask origins and protec...
+
+## In This Reference
+
+- **[configuration.md](./configuration.md)** - Setup, deployment, configuration
+- **[api.md](./api.md)** - API endpoints, methods, interfaces
+- **[patterns.md](./patterns.md)** - Common patterns, use cases, examples
+- **[gotchas.md](./gotchas.md)** - Troubleshooting, best practices, limitations
+
+## See Also
+
+- [Cloudflare Docs](https://developers.cloudflare.com/)

package/baseline/skill/cloudflare/references/spectrum/api.md

@@ -0,0 +1,24 @@
+### API Endpoints
+
+```
+GET    /zones/{zone_id}/spectrum/apps                    # List apps
+POST   /zones/{zone_id}/spectrum/apps                    # Create app
+GET    /zones/{zone_id}/spectrum/apps/{app_id}           # Get app
+PUT    /zones/{zone_id}/spectrum/apps/{app_id}           # Update app
+DELETE /zones/{zone_id}/spectrum/apps/{app_id}           # Delete app
+
+GET    /zones/{zone_id}/spectrum/analytics/aggregate/current
+GET    /zones/{zone_id}/spectrum/analytics/events/bytime
+GET    /zones/{zone_id}/spectrum/analytics/events/summary
+```
+
+### Supported Protocols
+
+**Pro/Business Plans:**
+- Selected protocols only (check Cloudflare docs for current list)
+
+**Enterprise Plans:**
+- All TCP ports (1-65535)
+- All UDP ports (1-65535)
+- Port ranges
+- Custom protocols

package/baseline/skill/cloudflare/references/spectrum/configuration.md

@@ -0,0 +1,43 @@
+## Configuration Patterns
+
+### Basic TCP Application with Direct IP Origin
+
+```bash
+curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/spectrum/apps" \
+  --request POST \
+  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+  --json '{
+    "protocol": "tcp/22",
+    "dns": {
+      "type": "CNAME",
+      "name": "ssh.example.com"
+    },
+    "origin_direct": ["tcp://192.0.2.1:22"],
+    "proxy_protocol": "off",
+    "ip_firewall": true,
+    "tls": "off",
+    "edge_ips": {
+      "type": "dynamic",
+      "connectivity": "all"
+    },
+    "traffic_type": "direct",
+    "argo_smart_routing": true
+  }'
+```
+
+### TCP Application with CNAME Origin
+
+```bash
+curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/spectrum/apps" \
+  --request POST \
+  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+  --json '{
+    "dns": {
+      "type": "CNAME",
+      "name": "game.example.com"
+    },
+    "protocol": "tcp/27015",
+    "proxy_protocol": "v1",
+    "tls": "off",
+    "origin_dns": {
+ 

package/baseline/skill/cloudflare/references/spectrum/gotchas.md

@@ -0,0 +1,42 @@
+## Troubleshooting
+
+### Issue: Connection timeouts
+
+**Diagnosis:**
+```bash
+# Test connectivity to Spectrum app
+nc -zv app.example.com 22
+
+# Check DNS resolution
+dig app.example.com
+
+# Verify origin accepts Cloudflare IPs
+curl -v telnet://origin-ip:port
+```
+
+**Solutions:**
+- Verify origin firewall allows Cloudflare IPs
+- Check origin service is running and listening on correct port
+- Ensure DNS record is CNAME (not A/AAAA unless using BYOIP)
+
+### Issue: Client IP showing Cloudflare IP
+
+**Solution:** Enable Proxy Protocol
+
+```json
+{
+  "proxy_protocol": "v1"  // TCP: v1 or v2; UDP: simple
+}
+```
+
+Ensure origin application parses proxy protocol headers.
+
+### Issue: TLS errors
+
+**Diagnosis:**
+```bash
+openssl s_client -connect app.example.com:443 -showcerts
+```
+
+**Solutions:**
+- `tls: "flexible"`

package/baseline/skill/cloudflare/references/spectrum/patterns.md

@@ -0,0 +1,40 @@
+## Common Use Cases
+
+### 1. SSH Server Protection
+
+```bash
+curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/spectrum/apps" \
+  --request POST \
+  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+  --json '{
+    "protocol": "tcp/22",
+    "dns": {"type": "CNAME", "name": "ssh.example.com"},
+    "origin_direct": ["tcp://10.0.1.5:22"],
+    "ip_firewall": true,
+    "argo_smart_routing": true
+  }'
+```
+
+**Benefits:**
+- Hide origin IP from attackers
+- DDoS protection at L3/L4
+- Argo reduces latency
+- IP firewall for additional access control
+
+### 2. Game Server (e.g., Minecraft)
+
+```bash
+curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/spectrum/apps" \
+  --request POST \
+  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+  --json '{
+    "protocol": "tcp/25565",
+    "dns": {"type": "CNAME", "name": "mc.example.com"},
+    "origin_direct": ["tcp://192.168.1.10:25565"],
+    "proxy_protocol": "v1",
+    "argo_smart_routing": true
+  }'
+```
+
+**Benefits:**
+- Protection

package/baseline/skill/cloudflare/references/static-assets/README.md

@@ -0,0 +1,14 @@
+# Cloudflare Static Assets Skill Reference
+
+Expert guidance for deploying and configuring static assets with Cloudflare Workers. This skill covers configuration patterns, routing architectures, asset binding usage, and best practices for SPAs, SSG sites, and full-stack applications....
+
+## In This Reference
+
+- **[configuration.md](./configuration.md)** - Setup, deployment, configuration
+- **[api.md](./api.md)** - API endpoints, methods, interfaces
+- **[patterns.md](./patterns.md)** - Common patterns, use cases, examples
+- **[gotchas.md](./gotchas.md)** - Troubleshooting, best practices, limitations
+
+## See Also
+
+- [Cloudflare Docs](https://developers.cloudflare.com/)

package/baseline/skill/cloudflare/references/static-assets/api.md

@@ -0,0 +1,3 @@
+# API Reference
+
+See main documentation.

package/baseline/skill/cloudflare/references/static-assets/configuration.md

@@ -0,0 +1,47 @@
+## Configuration
+
+### Basic Setup
+
+Minimal configuration requires only `assets.directory`:
+
+```jsonc
+{
+  "name": "my-worker",
+  "compatibility_date": "2025-01-01",
+  "assets": {
+    "directory": "./dist"
+  }
+}
+```
+
+```toml
+name = "my-worker"
+compatibility_date = "2025-01-01"
+
+[assets]
+directory = "./dist"
+```
+
+### Full Configuration Options
+
+```jsonc
+{
+  "name": "my-worker",
+  "main": "src/index.ts",
+  "compatibility_date": "2025-01-01",
+  "assets": {
+    "directory": "./dist",
+    "binding": "ASSETS",
+    "not_found_handling": "single-page-application",
+    "html_handling": "auto-trailing-slash",
+    "run_worker_first": ["/api/*", "!/api/docs/*"]
+  }
+}
+```
+
+**Configuration keys:**
+
+- `directory` (string, required): Path to assets folder (e.g. `./dist`, `./public`, `./build`)
+- `binding` (string, optional): Name to access assets in Worker code (e.g. `env.ASSETS`)
+- `not_found_handling` (string, optional): Behavior when asset not found
+  - `"single-page-application"`: Serve `/index.html

package/baseline/skill/cloudflare/references/static-assets/gotchas.md

@@ -0,0 +1,44 @@
+## Best Practices
+
+### 1. Use Selective Worker-First Routing
+
+Instead of `run_worker_first = true`, use array patterns:
+
+```jsonc
+{
+  "assets": {
+    "run_worker_first": [
+      "/api/*",           // API routes
+      "/admin/*",         // Admin area
+      "!/admin/assets/*"  // Except admin assets
+    ]
+  }
+}
+```
+
+**Benefits:**
+- Reduces Worker invocations
+- Lowers costs
+- Improves asset delivery performance
+
+### 2. Leverage Navigation Request Optimization
+
+For SPAs, use `compatibility_date = "2025-04-01"` or later:
+
+```jsonc
+{
+  "compatibility_date": "2025-04-01",
+  "assets": {
+    "not_found_handling": "single-page-application"
+  }
+}
+```
+
+Navigation requests skip Worker invocation, reducing costs.
+
+### 3. Type Safety with Bindings
+
+Always type your environment:
+
+```typescript
+interface

package/baseline/skill/cloudflare/references/static-assets/patterns.md

@@ -0,0 +1,42 @@
+### Common Patterns
+
+**1. Forward request to assets:**
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    return env.ASSETS.fetch(request);
+  }
+};
+```
+
+**2. Fetch specific asset by path:**
+
+```typescript
+const response = await env.ASSETS.fetch("https://assets.local/logo.png");
+```
+
+**3. Modify request before fetching asset:**
+
+```typescript
+const url = new URL(request.url);
+url.pathname = "/index.html";
+return env.ASSETS.fetch(new Request(url, request));
+```
+
+**4. Transform asset response:**
+
+```typescript
+const response = await env.ASSETS.fetch(request);
+const modifiedResponse = new Response(response.body, response);
+modifiedResponse.headers.set("X-Custom-Header", "value");
+modifiedResponse.headers.set("Cache-Control", "public, max-age=3600");
+return modifiedResponse;
+```
+
+**5. Conditional asset serving:**
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const url = new URL(request.url);

package/baseline/skill/cloudflare/references/stream/README.md

@@ -0,0 +1,103 @@
+# Cloudflare Stream
+
+Serverless live and on-demand video streaming platform with one API.
+
+## Overview
+
+Cloudflare Stream provides video upload, storage, encoding, and delivery without managing infrastructure. Runs on Cloudflare's global network.
+
+### Key Features
+- **On-demand video**: Upload, encode, store, deliver
+- **Live streaming**: RTMPS/SRT ingestion with ABR
+- **Direct creator uploads**: End users upload without API keys
+- **Signed URLs**: Token-based access control
+- **Analytics**: Server-side metrics via GraphQL
+- **Webhooks**: Processing notifications
+- **Captions**: Upload or AI-generate subtitles
+- **Watermarks**: Apply branding to videos
+- **Downloads**: Enable MP4 offline viewing
+
+## Core Concepts
+
+### Video Upload Methods
+1. **API Upload (TUS protocol)**: Direct server upload
+2. **Upload from URL**: Import from external source
+3. **Direct Creator Uploads**: User-generated content (recommended)
+
+### Playback Options
+1. **Stream Player (iframe)**: Built-in, optimized player
+2. **Custom Player (HLS/DASH)**: Video.js, HLS.js integration
+3. **Thumbnails**: Static or animated previews
+
+### Access Control
+- **Public**: No restrictions
+- **requireSignedURLs**: Token-based access
+- **allowedOrigins**: Domain restrictions
+- **Access Rules**: Geo/IP restrictions in tokens
+
+### Live Streaming
+- RTMPS/SRT ingest from OBS, FFmpeg
+- Automatic recording to on-demand
+- Simulcast to YouTube, Twitch, etc.
+- WebRTC support for browser streaming
+
+## Quick Start
+
+**Upload video via API**
+```bash
+curl -X POST \
+  "https://api.cloudflare.com/client/v4/accounts/{account_id}/stream/copy" \
+  -H "Authorization: Bearer <TOKEN>" \
+  -H "Content-Type: application/json" \
+  -d '{"url": "https://example.com/video.mp4"}'
+```
+
+**Embed player**
+```html
+<iframe
+  src="https://customer-<CODE>.cloudflarestream.com/<VIDEO_ID>/iframe"
+  style="border: none;"
+  height="720" width="1280"
+  allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;"
+  allowfullscreen="true"
+></iframe>
+```
+
+**Create live input**
+```bash
+curl -X POST \
+  "https://api.cloudflare.com/client/v4/accounts/{account_id}/stream/live_inputs" \
+  -H "Authorization: Bearer <TOKEN>" \
+  -H "Content-Type: application/json" \
+  -d '{"recording": {"mode": "automatic"}}'
+```
+
+## Limits
+
+- Max file size: 30 GB
+- Max frame rate: 60 fps (recommended)
+- Supported formats: MP4, MKV, MOV, AVI, FLV, MPEG-2 TS/PS, MXF, LXF, GXF, 3GP, WebM, MPG, QuickTime
+
+## Pricing
+
+- $5/1000 min stored
+- $1/1000 min delivered
+
+## Resources
+
+- Dashboard: https://dash.cloudflare.com/?to=/:account/stream
+- API Docs: https://developers.cloudflare.com/api/resources/stream/
+- Stream Docs: https://developers.cloudflare.com/stream/
+
+## In This Reference
+
+- [configuration.md](./configuration.md) - Setup, environment variables, wrangler config
+- [api.md](./api.md) - Upload, playback, live streaming, management APIs
+- [patterns.md](./patterns.md) - Full-stack flows, state management, best practices
+- [gotchas.md](./gotchas.md) - Error codes, troubleshooting, limits
+
+## See Also
+
+- [workers](../workers/) - Deploy Stream APIs in Workers
+- [pages](../pages/) - Integrate Stream with Pages
+- [workers-ai](../workers-ai/) - AI-generate captions

package/baseline/skill/cloudflare/references/stream/api.md

@@ -0,0 +1,204 @@
+# Stream API Reference
+
+Upload, playback, live streaming, and management APIs.
+
+## Upload APIs
+
+### Direct Creator Upload (Recommended)
+
+**Backend: Create upload URL**
+```typescript
+async function createUploadURL(accountId: string, apiToken: string) {
+  const response = await fetch(
+    `https://api.cloudflare.com/client/v4/accounts/${accountId}/stream/direct_upload`,
+    {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        maxDurationSeconds: 3600,
+        expiry: new Date(Date.now() + 3600000).toISOString(),
+        requireSignedURLs: true,
+        meta: { creator: 'user-123' }
+      })
+    }
+  );
+  const data = await response.json();
+  return { uploadURL: data.result.uploadURL, uid: data.result.uid };
+}
+```
+
+**Frontend: Upload to Stream**
+```typescript
+async function uploadVideo(file: File, uploadURL: string) {
+  const formData = new FormData();
+  formData.append('file', file);
+  return fetch(uploadURL, { method: 'POST', body: formData }).then(r => r.json());
+}
+```
+
+### Upload from URL
+
+```bash
+curl -X POST \
+  "https://api.cloudflare.com/client/v4/accounts/{account_id}/stream/copy" \
+  -H "Authorization: Bearer <TOKEN>" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "url": "https://example.com/video.mp4",
+    "meta": {"name": "My Video"},
+    "requireSignedURLs": false
+  }'
+```
+
+## Playback APIs
+
+### Embed Player (iframe)
+
+```html
+<iframe
+  src="https://customer-<CODE>.cloudflarestream.com/<VIDEO_ID>/iframe?autoplay=true&muted=true"
+  style="border: none;" height="720" width="1280"
+  allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;"
+  allowfullscreen="true"
+></iframe>
+```
+
+### HLS/DASH Manifest URLs
+
+```typescript
+// HLS
+const hlsUrl = `https://customer-<CODE>.cloudflarestream.com/${videoId}/manifest/video.m3u8`;
+
+// DASH
+const dashUrl = `https://customer-<CODE>.cloudflarestream.com/${videoId}/manifest/video.mpd`;
+```
+
+### Thumbnails
+
+```typescript
+// At specific time (seconds)
+const thumb = `https://customer-<CODE>.cloudflarestream.com/${videoId}/thumbnails/thumbnail.jpg?time=10s`;
+
+// By percentage
+const thumbPct = `https://customer-<CODE>.cloudflarestream.com/${videoId}/thumbnails/thumbnail.jpg?time=50%`;
+
+// Animated GIF
+const gif = `https://customer-<CODE>.cloudflarestream.com/${videoId}/thumbnails/thumbnail.gif`;
+```
+
+## Signed URLs
+
+```typescript
+// Low volume (<1k/day): Use API
+async function getSignedToken(accountId: string, videoId: string, apiToken: string) {
+  const response = await fetch(
+    `https://api.cloudflare.com/client/v4/accounts/${accountId}/stream/${videoId}/token`,
+    {
+      method: 'POST',
+      headers: { 'Authorization': `Bearer ${apiToken}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        exp: Math.floor(Date.now() / 1000) + 3600,
+        accessRules: [{ type: 'ip.geoip.country', action: 'allow', country: ['US'] }]
+      })
+    }
+  );
+  return (await response.json()).result.token;
+}
+
+// High volume: Self-sign with RS256 JWT using crypto.subtle (see patterns.md)
+```
+
+## Live Streaming APIs
+
+### Create Live Input
+
+```typescript
+async function createLiveInput(accountId: string, apiToken: string) {
+  const response = await fetch(
+    `https://api.cloudflare.com/client/v4/accounts/${accountId}/stream/live_inputs`,
+    {
+      method: 'POST',
+      headers: { 'Authorization': `Bearer ${apiToken}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        recording: { mode: 'automatic', timeoutSeconds: 30 },
+        deleteRecordingAfterDays: 30
+      })
+    }
+  );
+  const { result } = await response.json();
+  return {
+    uid: result.uid,
+    rtmps: { url: result.rtmps.url, streamKey: result.rtmps.streamKey },
+    srt: { url: result.srt.url, streamId: result.srt.streamId, passphrase: result.srt.passphrase }
+  };
+}
+```
+
+### Check Live Status
+
+```typescript
+async function getLiveStatus(accountId: string, liveInputId: string, apiToken: string) {
+  const response = await fetch(
+    `https://api.cloudflare.com/client/v4/accounts/${accountId}/stream/live_inputs/${liveInputId}`,
+    { headers: { 'Authorization': `Bearer ${apiToken}` } }
+  );
+  const { result } = await response.json();
+  return { isLive: result.status?.current?.state === 'connected', recording: result.recording };
+}
+```
+
+### Create Live Output (Simulcast)
+
+```typescript
+async function createLiveOutput(
+  accountId: string, liveInputId: string, apiToken: string,
+  outputUrl: string, streamKey: string
+) {
+  return fetch(
+    `https://api.cloudflare.com/client/v4/accounts/${accountId}/stream/live_inputs/${liveInputId}/outputs`,
+    {
+      method: 'POST',
+      headers: { 'Authorization': `Bearer ${apiToken}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ url: `${outputUrl}/${streamKey}`, enabled: true })
+    }
+  ).then(r => r.json());
+}
+```
+
+## Video Management APIs
+
+```typescript
+// List videos
+async function listVideos(accountId: string, apiToken: string, search?: string) {
+  const params = new URLSearchParams(search ? { search } : {});
+  return fetch(
+    `https://api.cloudflare.com/client/v4/accounts/${accountId}/stream?${params}`,
+    { headers: { 'Authorization': `Bearer ${apiToken}` } }
+  ).then(r => r.json());
+}
+
+// Update video
+async function updateVideo(accountId: string, videoId: string, apiToken: string, updates: unknown) {
+  return fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/stream/${videoId}`, {
+    method: 'POST',
+    headers: { 'Authorization': `Bearer ${apiToken}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify(updates)
+  }).then(r => r.json());
+}
+
+// Delete, clip: similar pattern with DELETE/POST
+```
+
+## In This Reference
+
+- [README.md](./README.md) - Overview and quick start
+- [configuration.md](./configuration.md) - Setup and config
+- [patterns.md](./patterns.md) - Full-stack flows, best practices
+- [gotchas.md](./gotchas.md) - Error codes, troubleshooting
+
+## See Also
+
+- [workers](../workers/) - Deploy Stream APIs in Workers