{
  "$schema": "./references.schema.json",
  "version": 1,
  "lastReviewed": "2026-08-11",
  "purpose": "External standards and primary-source references VibeCode QA should cite when authoring stack-specific gold-standard KBs. This registry is not the VCQA rubric itself; it is the authority map for where each rubric should look first.",
  "policy": {
    "sourcePreference": [
      "Official specification",
      "Official project or vendor documentation",
      "Recognized independent standard body",
      "Mature ecosystem documentation",
      "Vendor-neutral implementation guide"
    ],
    "authoringRule": "VCQA standards should compose and cite these sources. Do not re-create broad framework doctrine when an upstream standard already exists; author only the stack shape, deployment constraints, detection mapping, exceptions, and anti-patterns needed to judge a repo.",
    "linkHealth": {
      "status": "checked-in-ci",
      "rule": "Every primary-source URL must return 2xx. Redirects fail unless expectedRedirectUrl is recorded on the reference.",
      "transientRule": "A definitive answer we do not want - 4xx, 5xx, an unexpected redirect, a dead hostname, a refused connection, an invalid certificate - is a registry defect and fails the build. A connection that times out or is reset is not an answer at all: it is retried up to three times, and if it still will not answer it is reported as a warning and the build proceeds, because third-party availability is not a property of our commit. Past three unreachable references the run fails instead - that is an outage rather than a flake, and link health has not actually been verified. Run validate-references.mjs --links-strict to make every unreachable reference fatal.",
      "versioningRule": "Where a publisher versions its documentation by date or release, cite the pinned upstream URL and state the edition in versionPolicy. An undated URL that redirects to whatever snapshot is current breaks CI on the publisher's next release, so expectedRedirectUrl is reserved for stable one-off redirects with no pinnable equivalent. A pinned citation ages deliberately and is refreshed on review, which is the intended behaviour for a standards registry."
    },
    "appliesToRule": "appliesTo contains only canonical VCQA standard or stack item IDs from registry.json/compositions.json. Descriptive discovery terms live in topics."
  },
  "categories": [
    {
      "id": "web-platform",
      "title": "Web platform",
      "description": "Baseline browser, markup, accessibility, and web API references.",
      "references": [
        {
          "id": "html-living-standard",
          "title": "HTML Living Standard",
          "publisher": "WHATWG",
          "url": "https://html.spec.whatwg.org/",
          "appliesTo": [],
          "useFor": [
            "HTML semantics",
            "forms",
            "navigation",
            "browser integration"
          ],
          "topics": [
            "html",
            "browser-app",
            "static-site",
            "spa",
            "ssr"
          ]
        },
        {
          "id": "wcag-22",
          "title": "Web Content Accessibility Guidelines (WCAG) 2.2",
          "publisher": "W3C WAI",
          "url": "https://www.w3.org/TR/WCAG22/",
          "appliesTo": [
            "docs-kb"
          ],
          "useFor": [
            "Accessibility conformance",
            "perceivable/operable/understandable/robust criteria"
          ],
          "topics": [
            "ui",
            "website",
            "web-app",
            "documentation-site"
          ]
        },
        {
          "id": "wai-aria",
          "title": "WAI-ARIA Authoring Practices Guide",
          "publisher": "W3C WAI",
          "url": "https://www.w3.org/WAI/ARIA/apg/",
          "appliesTo": [],
          "useFor": [
            "ARIA widget patterns",
            "keyboard interaction",
            "focus behavior"
          ],
          "topics": [
            "ui",
            "component-library",
            "web-app"
          ]
        },
        {
          "id": "mdn-web-docs",
          "title": "MDN Web Docs",
          "publisher": "Mozilla",
          "url": "https://developer.mozilla.org/en-US/docs/Web",
          "appliesTo": [],
          "useFor": [
            "Browser API behavior",
            "compatibility",
            "web platform explanations"
          ],
          "topics": [
            "browser-app",
            "javascript",
            "css",
            "html"
          ]
        }
      ]
    },
    {
      "id": "languages-runtimes",
      "title": "Languages and runtimes",
      "description": "Language, runtime, package manager, and CLI baseline references.",
      "references": [
        {
          "id": "typescript-tsconfig",
          "title": "TSConfig Reference",
          "publisher": "TypeScript",
          "url": "https://www.typescriptlang.org/tsconfig/",
          "appliesTo": [
            "typescript"
          ],
          "useFor": [
            "Strictness flags",
            "module resolution",
            "project references"
          ],
          "topics": [
            "tsconfig",
            "strict-types"
          ]
        },
        {
          "id": "typescript-handbook",
          "title": "TypeScript Handbook",
          "publisher": "TypeScript",
          "url": "https://www.typescriptlang.org/docs/handbook/intro.html",
          "appliesTo": [
            "typescript",
            "typescript-sdk"
          ],
          "useFor": [
            "Type modeling",
            "narrowing",
            "generics",
            "declaration files"
          ],
          "topics": [
            "library",
            "sdk",
            "app"
          ]
        },
        {
          "id": "node-docs",
          "title": "Node.js Documentation",
          "publisher": "OpenJS Foundation",
          "url": "https://nodejs.org/docs/latest/api/",
          "appliesTo": [
            "node-cli-internal-tool",
            "typescript-sdk"
          ],
          "useFor": [
            "Runtime APIs",
            "process behavior",
            "streams",
            "crypto",
            "file system"
          ],
          "topics": [
            "node-service",
            "node-cli",
            "node-library"
          ]
        },
        {
          "id": "node-security-best-practices",
          "title": "Node.js Security Best Practices",
          "publisher": "OpenJS Foundation",
          "url": "https://nodejs.org/learn/getting-started/security-best-practices",
          "appliesTo": [
            "node-cli-internal-tool"
          ],
          "useFor": [
            "Node runtime security posture",
            "dependency and input handling guidance"
          ],
          "topics": [
            "node-service",
            "node-cli",
            "server-side-javascript"
          ]
        },
        {
          "id": "npm-package-json",
          "title": "package.json",
          "publisher": "npm",
          "url": "https://docs.npmjs.com/cli/v11/configuring-npm/package-json/",
          "appliesTo": [],
          "useFor": [
            "Package metadata",
            "bin",
            "exports",
            "files",
            "scripts",
            "engines"
          ],
          "topics": [
            "npm-package",
            "library",
            "cli",
            "workspace"
          ]
        },
        {
          "id": "pnpm-workspaces",
          "title": "pnpm Workspaces",
          "publisher": "pnpm",
          "url": "https://pnpm.io/workspaces",
          "appliesTo": [],
          "useFor": [
            "Workspace layout",
            "workspace protocol",
            "recursive scripts"
          ],
          "topics": [
            "monorepo",
            "workspace",
            "typescript-project-references"
          ]
        },
        {
          "id": "dart-effective",
          "title": "Effective Dart",
          "publisher": "Dart",
          "url": "https://dart.dev/effective-dart",
          "appliesTo": [
            "dart"
          ],
          "useFor": [
            "Dart style",
            "documentation",
            "usage and design guidance"
          ],
          "topics": [
            "flutter"
          ]
        },
        {
          "id": "melos-docs",
          "title": "Melos Documentation",
          "publisher": "Invertase",
          "url": "https://melos.invertase.dev/",
          "appliesTo": [
            "melos"
          ],
          "useFor": [
            "Dart and Flutter monorepo package orchestration",
            "bootstrap scripts",
            "workspace analyze/test commands"
          ],
          "topics": [
            "dart-workspace",
            "flutter-workspace",
            "monorepo"
          ]
        }
      ]
    },
    {
      "id": "frontend-frameworks",
      "title": "Frontend frameworks and build tools",
      "description": "Framework authorities to reference from stack-specific UI standards.",
      "references": [
        {
          "id": "react-docs",
          "title": "React Documentation",
          "publisher": "Meta / React",
          "url": "https://react.dev/",
          "appliesTo": [
            "react",
            "react-spa",
            "react-ssr"
          ],
          "useFor": [
            "Components",
            "hooks",
            "state",
            "effects",
            "React compiler guidance"
          ],
          "topics": []
        },
        {
          "id": "react-rules-of-hooks",
          "title": "Rules of Hooks",
          "publisher": "React",
          "url": "https://react.dev/reference/rules/rules-of-hooks",
          "appliesTo": [
            "react"
          ],
          "useFor": [
            "Hook call placement",
            "custom hook constraints",
            "lint mapping"
          ],
          "topics": [
            "react-components",
            "hooks"
          ]
        },
        {
          "id": "react-router-docs",
          "title": "React Router Documentation",
          "publisher": "React Router",
          "url": "https://reactrouter.com/",
          "appliesTo": [
            "react-spa",
            "react-router"
          ],
          "useFor": [
            "Routing modes",
            "data routers",
            "framework mode",
            "SPA fallback implications"
          ],
          "topics": [
            "react-fullstack"
          ]
        },
        {
          "id": "vite-guide",
          "title": "Vite Guide",
          "publisher": "Vite",
          "url": "https://vite.dev/guide/",
          "appliesTo": [
            "vite"
          ],
          "useFor": [
            "Dev server",
            "production build",
            "static deployment",
            "env variables"
          ],
          "topics": [
            "spa",
            "frontend-build"
          ]
        },
        {
          "id": "vite-static-deploy",
          "title": "Deploying a Static Site",
          "publisher": "Vite",
          "url": "https://vite.dev/guide/static-deploy",
          "appliesTo": [
            "vite"
          ],
          "useFor": [
            "Static hosting expectations",
            "SPA deployment guidance"
          ],
          "topics": [
            "static-site",
            "spa"
          ]
        },
        {
          "id": "vite-env-and-mode",
          "title": "Env Variables and Modes",
          "publisher": "Vite",
          "url": "https://vite.dev/guide/env-and-mode",
          "appliesTo": [
            "vite"
          ],
          "useFor": [
            "Client-exposed environment variables",
            "mode-specific config",
            "public env prefixes"
          ],
          "topics": [
            "spa",
            "client-env"
          ]
        },
        {
          "id": "next-docs",
          "title": "Next.js Documentation",
          "publisher": "Vercel",
          "url": "https://nextjs.org/docs",
          "appliesTo": [
            "react-ssr"
          ],
          "useFor": [
            "App Router",
            "server components",
            "route handlers",
            "deployment"
          ],
          "topics": [
            "nextjs",
            "react-fullstack"
          ]
        },
        {
          "id": "next-data-security",
          "title": "Data Security",
          "publisher": "Next.js",
          "url": "https://nextjs.org/docs/app/guides/data-security",
          "appliesTo": [],
          "useFor": [
            "Server component data boundaries",
            "DTOs",
            "sensitive data handling"
          ],
          "topics": [
            "nextjs",
            "react-server-components",
            "server-data"
          ]
        },
        {
          "id": "vue-docs",
          "title": "Vue.js Guide",
          "publisher": "Vue",
          "url": "https://vuejs.org/guide/introduction.html",
          "appliesTo": [],
          "useFor": [
            "Composition API",
            "SFCs",
            "reactivity",
            "app structure"
          ],
          "topics": [
            "vue",
            "vue-spa",
            "vue-ssr"
          ]
        },
        {
          "id": "vue-style-guide",
          "title": "Vue Style Guide",
          "publisher": "Vue",
          "url": "https://vuejs.org/style-guide/",
          "appliesTo": [],
          "useFor": [
            "Vue-specific conventions",
            "component naming",
            "anti-patterns"
          ],
          "topics": [
            "vue",
            "vue-components"
          ]
        },
        {
          "id": "svelte-docs",
          "title": "Svelte Documentation",
          "publisher": "Svelte",
          "url": "https://svelte.dev/docs",
          "appliesTo": [],
          "useFor": [
            "Svelte syntax",
            "runes",
            "compiler warnings",
            "component model"
          ],
          "topics": [
            "svelte",
            "sveltekit"
          ]
        },
        {
          "id": "sveltekit-docs",
          "title": "SvelteKit Documentation",
          "publisher": "Svelte",
          "url": "https://svelte.dev/docs/kit/introduction",
          "appliesTo": [],
          "useFor": [
            "Routing",
            "load functions",
            "server endpoints",
            "deployment adapters"
          ],
          "topics": [
            "sveltekit",
            "svelte-fullstack",
            "svelte-ssr"
          ]
        },
        {
          "id": "angular-docs",
          "title": "Angular Documentation",
          "publisher": "Google / Angular",
          "url": "https://angular.dev/",
          "appliesTo": [],
          "useFor": [
            "Signals",
            "templates",
            "dependency injection",
            "Angular CLI"
          ],
          "topics": [
            "angular",
            "angular-spa"
          ]
        },
        {
          "id": "astro-docs",
          "title": "Astro Documentation",
          "publisher": "Astro",
          "url": "https://docs.astro.build/",
          "appliesTo": [],
          "useFor": [
            "Content collections",
            "islands architecture",
            "static/SSR output"
          ],
          "topics": [
            "astro",
            "static-site",
            "content-site"
          ]
        }
      ]
    },
    {
      "id": "edge-cloudflare",
      "title": "Cloudflare edge stack",
      "description": "Cloudflare platform references for Pages, Workers, D1, Durable Objects, and SaaS isolation.",
      "references": [
        {
          "id": "cloudflare-pages-functions",
          "title": "Pages Functions",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/pages/functions/",
          "appliesTo": [
            "cloudflare-pages-fullstack",
            "cloudflare-pages-functions",
            "react-spa-on-cloudflare-pages"
          ],
          "useFor": [
            "Functions directory",
            "middleware",
            "routing",
            "bindings",
            "runtime configuration"
          ],
          "topics": [
            "pages-functions"
          ]
        },
        {
          "id": "cloudflare-pages-functions-routing",
          "title": "Pages Functions Routing",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/pages/functions/routing/",
          "appliesTo": [
            "cloudflare-pages-functions",
            "cloudflare-pages-fullstack"
          ],
          "useFor": [
            "File-based routes",
            "dynamic segments",
            "route matching"
          ],
          "topics": [
            "pages-functions"
          ]
        },
        {
          "id": "cloudflare-pages-functions-middleware",
          "title": "Pages Functions Middleware",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/pages/functions/middleware/",
          "appliesTo": [
            "cloudflare-pages-functions"
          ],
          "useFor": [
            "Middleware chains",
            "error handling",
            "authentication middleware"
          ],
          "topics": [
            "pages-functions",
            "auth-middleware",
            "api-edge"
          ]
        },
        {
          "id": "cloudflare-pages-preview-deployments",
          "title": "Pages Preview Deployments",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/pages/configuration/preview-deployments/",
          "appliesTo": [
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Preview URLs",
            "preview aliases",
            "Access protection",
            "preview indexing posture"
          ],
          "topics": [
            "cloudflare-pages",
            "preview-deployments"
          ]
        },
        {
          "id": "cloudflare-pages-branch-build-controls",
          "title": "Pages Branch Build Controls",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/pages/configuration/branch-build-controls/",
          "appliesTo": [
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Production branch control",
            "preview branch control",
            "release policy"
          ],
          "topics": [
            "cloudflare-pages",
            "release-branches"
          ]
        },
        {
          "id": "cloudflare-pages-direct-upload-ci",
          "title": "Direct Upload with Continuous Integration",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/pages/how-to/use-direct-upload-with-continuous-integration/",
          "appliesTo": [
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "CI-managed Pages deploys",
            "artifact promotion",
            "deployment traceability"
          ],
          "topics": [
            "cloudflare-pages",
            "ci-deploy"
          ]
        },
        {
          "id": "cloudflare-workers",
          "title": "Workers Documentation",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/workers/",
          "appliesTo": [
            "cloudflare-workers",
            "cloudflare-worker-mcp-server"
          ],
          "useFor": [
            "Worker runtime",
            "bindings",
            "compatibility dates",
            "deployment"
          ],
          "topics": [
            "cloudflare-worker",
            "edge-api",
            "mcp-worker"
          ]
        },
        {
          "id": "cloudflare-workers-best-practices",
          "title": "Workers Best Practices",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/workers/best-practices/",
          "appliesTo": [
            "cloudflare-workers"
          ],
          "useFor": [
            "Worker production patterns",
            "anti-patterns",
            "performance and reliability"
          ],
          "topics": [
            "cloudflare-worker",
            "edge-api"
          ]
        },
        {
          "id": "cloudflare-workers-environments",
          "title": "Workers Environments",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/workers/wrangler/environments/",
          "appliesTo": [
            "cloudflare-workers",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Environment-specific configuration",
            "binding selection",
            "deployment isolation"
          ],
          "topics": [
            "cloudflare-worker",
            "wrangler"
          ]
        },
        {
          "id": "cloudflare-workers-bindings",
          "title": "Workers Bindings",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/workers/runtime-apis/bindings/",
          "appliesTo": [
            "cloudflare-workers",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Resource bindings",
            "runtime configuration",
            "service boundaries"
          ],
          "topics": [
            "cloudflare-worker",
            "bindings"
          ]
        },
        {
          "id": "cloudflare-workers-secrets",
          "title": "Workers Secrets",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/workers/configuration/secrets/",
          "appliesTo": [
            "cloudflare-workers",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Secret configuration",
            "secret scope",
            "secret handling"
          ],
          "topics": [
            "cloudflare-worker",
            "secrets"
          ]
        },
        {
          "id": "cloudflare-workers-preview-urls",
          "title": "Workers Preview URLs",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/workers/versions-and-deployments/preview-urls/",
          "appliesTo": [
            "cloudflare-workers",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Worker preview exposure",
            "preview URL policy"
          ],
          "topics": [
            "cloudflare-worker",
            "preview-deployments"
          ]
        },
        {
          "id": "cloudflare-workers-versions-deployments",
          "title": "Workers Versions and Deployments",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/workers/versions-and-deployments/",
          "appliesTo": [
            "cloudflare-workers",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Worker versions",
            "deployments",
            "rollback and promotion evidence"
          ],
          "topics": [
            "cloudflare-worker",
            "deployment-versioning"
          ]
        },
        {
          "id": "cloudflare-d1",
          "title": "D1 Documentation",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/d1/",
          "appliesTo": [
            "cloudflare-d1",
            "cloudflare-pages-fullstack",
            "cloudflare-workers"
          ],
          "useFor": [
            "D1 database model",
            "bindings",
            "local/remote database behavior"
          ],
          "topics": [
            "d1-database",
            "cloudflare-worker"
          ]
        },
        {
          "id": "cloudflare-d1-migrations",
          "title": "D1 Migrations",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/d1/reference/migrations/",
          "appliesTo": [
            "cloudflare-d1"
          ],
          "useFor": [
            "SQL migration files",
            "migrations folder",
            "versioned database changes"
          ],
          "topics": [
            "d1-database",
            "database-migrations"
          ]
        },
        {
          "id": "cloudflare-d1-prepared-statements",
          "title": "D1 Prepared Statement Methods",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/d1/worker-api/prepared-statements/",
          "appliesTo": [
            "cloudflare-d1"
          ],
          "useFor": [
            "Prepared statements",
            "parameter binding",
            "query result APIs"
          ],
          "topics": [
            "d1-database",
            "query-safety",
            "edge-sql"
          ]
        },
        {
          "id": "cloudflare-d1-environments",
          "title": "D1 Environments",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/d1/configuration/environments/",
          "appliesTo": [
            "cloudflare-d1"
          ],
          "useFor": [
            "Preview database IDs",
            "environment-specific D1 bindings"
          ],
          "topics": [
            "d1-database",
            "cloudflare-environments",
            "preview-database"
          ]
        },
        {
          "id": "cloudflare-d1-time-travel",
          "title": "D1 Time Travel and Backups",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/d1/reference/time-travel/",
          "appliesTo": [
            "cloudflare-d1",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Point-in-time restore",
            "backup bookmarks",
            "restore runbooks"
          ],
          "topics": [
            "d1-database",
            "backup"
          ]
        },
        {
          "id": "cloudflare-d1-import-export",
          "title": "D1 Import and Export Data",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/d1/best-practices/import-export-data/",
          "appliesTo": [
            "cloudflare-d1",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Tenant data export",
            "restore/fix-forward runbooks",
            "data preservation"
          ],
          "topics": [
            "d1-database",
            "backup"
          ]
        },
        {
          "id": "cloudflare-durable-objects",
          "title": "Durable Objects Documentation",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/durable-objects/",
          "appliesTo": [
            "durable-objects",
            "cloudflare-worker-mcp-server"
          ],
          "useFor": [
            "Durable Object model",
            "bindings",
            "storage",
            "stateful coordination"
          ],
          "topics": [
            "stateful-worker",
            "mcp-worker"
          ]
        },
        {
          "id": "cloudflare-durable-objects-best-practices",
          "title": "Durable Objects Best Practices",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/durable-objects/best-practices/",
          "appliesTo": [
            "durable-objects"
          ],
          "useFor": [
            "Object design",
            "storage",
            "RPC",
            "error handling",
            "anti-patterns"
          ],
          "topics": [
            "stateful-worker"
          ]
        },
        {
          "id": "cloudflare-saas-data-isolation",
          "title": "SaaS Data Isolation",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/use-cases/saas/data-isolation/",
          "appliesTo": [
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Tenant data isolation",
            "Cloudflare SaaS architecture references"
          ],
          "topics": [
            "multi-tenant-saas",
            "cloudflare-saas",
            "tenant-isolation"
          ]
        },
        {
          "id": "cloudflare-access-service-tokens",
          "title": "Service tokens",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/",
          "appliesTo": [],
          "useFor": [
            "Service token behavior",
            "Access policy integration"
          ],
          "topics": [
            "cloudflare-access",
            "machine-auth",
            "edge-perimeter"
          ]
        },
        {
          "id": "cloudflare-agents-mcp",
          "title": "Model Context Protocol (MCP)",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/agents/model-context-protocol/",
          "appliesTo": [
            "cloudflare-worker-mcp-server"
          ],
          "useFor": [
            "MCP on Cloudflare Workers and Agents",
            "remote MCP server implementation"
          ],
          "topics": [
            "mcp-worker",
            "agents"
          ]
        },
        {
          "id": "cloudflare-workers-github-actions",
          "title": "Workers CI/CD with GitHub Actions",
          "publisher": "Cloudflare",
          "url": "https://developers.cloudflare.com/workers/ci-cd/external-cicd/github-actions/",
          "appliesTo": [
            "cloudflare-workers",
            "github-actions",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Wrangler deployment from GitHub Actions",
            "CI/CD setup",
            "Cloudflare deploy automation"
          ],
          "topics": [
            "cloudflare-worker"
          ]
        }
      ]
    },
    {
      "id": "apis-auth-and-ai",
      "title": "APIs, auth, validation, and AI protocols",
      "description": "Contract, authentication, authorization, schema, and AI-tool protocol references.",
      "references": [
        {
          "id": "openapi",
          "title": "OpenAPI Specification",
          "publisher": "OpenAPI Initiative",
          "url": "https://spec.openapis.org/oas/latest.html",
          "appliesTo": [
            "typescript-sdk"
          ],
          "useFor": [
            "HTTP API contracts",
            "client generation",
            "operation schemas"
          ],
          "topics": [
            "rest-api",
            "sdk",
            "api-contract"
          ]
        },
        {
          "id": "json-schema",
          "title": "JSON Schema",
          "publisher": "JSON Schema",
          "url": "https://json-schema.org/specification",
          "appliesTo": [],
          "useFor": [
            "JSON validation",
            "machine-readable schemas",
            "config contracts"
          ],
          "topics": [
            "api-contract",
            "validation",
            "configuration"
          ]
        },
        {
          "id": "zod-docs",
          "title": "Zod Documentation",
          "publisher": "Zod",
          "url": "https://zod.dev/",
          "appliesTo": [
            "zod-validation"
          ],
          "useFor": [
            "Runtime validation",
            "schema inference",
            "safe parsing"
          ],
          "topics": [
            "runtime-validation",
            "typescript-boundaries"
          ]
        },
        {
          "id": "oauth-21",
          "title": "OAuth 2.1 Authorization Framework",
          "publisher": "IETF",
          "url": "https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1",
          "appliesTo": [
            "cloudflare-worker-mcp-server"
          ],
          "useFor": [
            "Authorization code flow",
            "PKCE",
            "bearer token handling"
          ],
          "topics": [
            "oauth",
            "authorization",
            "remote-mcp",
            "web-app-auth"
          ]
        },
        {
          "id": "openid-connect-core",
          "title": "OpenID Connect Core",
          "publisher": "OpenID Foundation",
          "url": "https://openid.net/specs/openid-connect-core-1_0.html",
          "appliesTo": [],
          "useFor": [
            "ID tokens",
            "claims",
            "authentication flows"
          ],
          "topics": [
            "oidc",
            "login",
            "identity"
          ]
        },
        {
          "id": "mcp-spec",
          "title": "Model Context Protocol Specification",
          "publisher": "Model Context Protocol",
          "url": "https://modelcontextprotocol.io/specification/2025-11-25",
          "appliesTo": [
            "mcp-server"
          ],
          "useFor": [
            "Protocol messages",
            "tools",
            "resources",
            "prompts",
            "transports"
          ],
          "topics": [
            "mcp-client",
            "ai-tools"
          ]
        },
        {
          "id": "mcp-authorization",
          "title": "MCP Authorization",
          "publisher": "Model Context Protocol",
          "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization",
          "appliesTo": [
            "cloudflare-worker-mcp-server",
            "mcp-server"
          ],
          "useFor": [
            "Remote MCP authorization",
            "resource server behavior",
            "protected resource metadata"
          ],
          "topics": [
            "remote-mcp",
            "oauth"
          ]
        },
        {
          "id": "mcp-security",
          "title": "MCP Security Best Practices",
          "publisher": "Model Context Protocol",
          "url": "https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices",
          "versionPolicy": "Pinned to dated documentation 2026-07-28.",
          "appliesTo": [
            "mcp-server"
          ],
          "useFor": [
            "Tool poisoning defenses",
            "authorization risks",
            "prompt injection considerations"
          ],
          "topics": [
            "mcp-client",
            "ai-tools"
          ]
        },
        {
          "id": "mcp-typescript-sdk",
          "title": "MCP TypeScript SDK",
          "publisher": "Model Context Protocol",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk",
          "appliesTo": [
            "mcp-server",
            "typescript",
            "node",
            "cloudflare-workers"
          ],
          "useFor": [
            "Server implementation patterns",
            "tool schemas",
            "transport support"
          ],
          "topics": [
            "worker"
          ]
        }
      ]
    },
    {
      "id": "security-ci-testing",
      "title": "Security, CI, and testing",
      "description": "Security verification, CI hardening, and automated test references.",
      "references": [
        {
          "id": "owasp-asvs",
          "title": "Application Security Verification Standard",
          "publisher": "OWASP",
          "url": "https://owasp.org/www-project-application-security-verification-standard/",
          "appliesTo": [],
          "useFor": [
            "Security requirements",
            "authentication",
            "access control",
            "session handling"
          ],
          "topics": [
            "web-app-security",
            "api-security",
            "secure-development"
          ]
        },
        {
          "id": "owasp-cheat-sheets",
          "title": "OWASP Cheat Sheet Series",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/",
          "appliesTo": [
            "security"
          ],
          "useFor": [
            "Topic-specific secure implementation guidance"
          ],
          "topics": [
            "web-app",
            "api",
            "auth"
          ]
        },
        {
          "id": "owasp-csrf-cheat-sheet",
          "title": "Cross-Site Request Forgery Prevention Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "CSRF controls",
            "same-site cookies",
            "origin checks",
            "custom headers"
          ],
          "topics": [
            "web-app",
            "cookie-auth",
            "mutating-requests"
          ]
        },
        {
          "id": "owasp-session-management",
          "title": "Session Management Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "Session ID handling",
            "cookie attributes",
            "timeout and renewal"
          ],
          "topics": [
            "session-auth",
            "web-app-auth",
            "cookies"
          ]
        },
        {
          "id": "owasp-multi-tenant-security",
          "title": "Multi Tenant Security Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Multi_Tenant_Security_Cheat_Sheet.html",
          "appliesTo": [
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Tenant isolation risks",
            "multi-tenant security design",
            "shared-resource risk"
          ],
          "topics": [
            "multi-tenant-saas",
            "tenant-isolation"
          ]
        },
        {
          "id": "owasp-authorization-cheat-sheet",
          "title": "Authorization Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html",
          "appliesTo": [
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Server-side authorization",
            "least privilege",
            "tenant access checks"
          ],
          "topics": [
            "authorization",
            "access-control"
          ]
        },
        {
          "id": "owasp-secrets-management-cheat-sheet",
          "title": "Secrets Management Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html",
          "appliesTo": [
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Secret lifecycle",
            "rotation",
            "revocation",
            "safe logging"
          ],
          "topics": [
            "secrets",
            "credential-management"
          ]
        },
        {
          "id": "owasp-input-validation-cheat-sheet",
          "title": "Input Validation Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "Boundary validation",
            "allowlisting",
            "runtime input parsing"
          ],
          "topics": [
            "input-validation",
            "api-security",
            "runtime-validation"
          ]
        },
        {
          "id": "owasp-sql-injection-prevention",
          "title": "SQL Injection Prevention Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "Parameterized queries",
            "safe query APIs",
            "SQL injection prevention"
          ],
          "topics": [
            "sql",
            "database",
            "query-safety"
          ]
        },
        {
          "id": "owasp-injection-prevention",
          "title": "Injection Prevention Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "Injection-prone interpreter boundaries",
            "command/query construction"
          ],
          "topics": [
            "injection",
            "command-execution",
            "interpreter-boundaries"
          ]
        },
        {
          "id": "owasp-ssrf-prevention",
          "title": "Server Side Request Forgery Prevention Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "Outbound URL constraints",
            "SSRF prevention",
            "allowlisting"
          ],
          "topics": [
            "ssrf",
            "outbound-fetch",
            "webhooks"
          ]
        },
        {
          "id": "owasp-xss-prevention",
          "title": "Cross Site Scripting Prevention Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "Output encoding",
            "HTML sanitization",
            "dangerous browser sinks"
          ],
          "topics": [
            "xss",
            "browser-output",
            "html-rendering"
          ]
        },
        {
          "id": "owasp-error-handling-cheat-sheet",
          "title": "Error Handling Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "Safe errors",
            "exception handling",
            "information disclosure prevention"
          ],
          "topics": [
            "error-handling",
            "api-security",
            "safe-output"
          ]
        },
        {
          "id": "owasp-logging-cheat-sheet",
          "title": "Logging Cheat Sheet",
          "publisher": "OWASP",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html",
          "appliesTo": [],
          "useFor": [
            "Security events",
            "safe logging",
            "audit evidence"
          ],
          "topics": [
            "logging",
            "audit",
            "incident-response"
          ]
        },
        {
          "id": "github-actions-secure-use",
          "title": "Secure use reference",
          "publisher": "GitHub",
          "url": "https://docs.github.com/en/actions/reference/security/secure-use",
          "appliesTo": [
            "github-actions"
          ],
          "useFor": [
            "Workflow permissions",
            "untrusted code",
            "third-party actions",
            "secret handling"
          ],
          "topics": [
            "ci",
            "supply-chain"
          ]
        },
        {
          "id": "github-actions-oidc",
          "title": "Security hardening your deployments",
          "publisher": "GitHub",
          "url": "https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments",
          "appliesTo": [
            "github-actions"
          ],
          "useFor": [
            "OIDC for cloud deployments",
            "environment protection",
            "deployment hardening"
          ],
          "topics": [
            "deployment",
            "oidc"
          ]
        },
        {
          "id": "github-actions-deployment-environments",
          "title": "Deployments and Environments",
          "publisher": "GitHub",
          "url": "https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments",
          "appliesTo": [
            "github-actions",
            "tenant-deployed-cloudflare-saas"
          ],
          "useFor": [
            "Environment protection rules",
            "deployment approvals",
            "environment-scoped secrets"
          ],
          "topics": [
            "deployment-environments"
          ]
        },
        {
          "id": "vitest-guide",
          "title": "Vitest Guide",
          "publisher": "Vitest",
          "url": "https://vitest.dev/guide/",
          "appliesTo": [
            "vite"
          ],
          "useFor": [
            "Test runner setup",
            "coverage",
            "watch vs run mode"
          ],
          "topics": [
            "unit-tests",
            "typescript-tests"
          ]
        },
        {
          "id": "playwright-best-practices",
          "title": "Playwright Best Practices",
          "publisher": "Microsoft / Playwright",
          "url": "https://playwright.dev/docs/best-practices",
          "appliesTo": [],
          "useFor": [
            "Locator strategy",
            "test isolation",
            "resilient browser tests"
          ],
          "topics": [
            "e2e-tests",
            "browser-tests",
            "web-app"
          ]
        },
        {
          "id": "testing-library-guiding-principles",
          "title": "Testing Library Guiding Principles",
          "publisher": "Testing Library",
          "url": "https://testing-library.com/docs/guiding-principles/",
          "appliesTo": [
            "react"
          ],
          "useFor": [
            "User-centered test style",
            "DOM queries",
            "implementation-detail avoidance"
          ],
          "topics": [
            "component-tests",
            "ui-tests",
            "vue",
            "svelte"
          ]
        }
      ]
    },
    {
      "id": "apps-extensions-and-packaging",
      "title": "Apps, extensions, and packaging",
      "description": "Editor, desktop, mobile, and distribution references.",
      "references": [
        {
          "id": "vscode-extension-api",
          "title": "Extension API",
          "publisher": "Visual Studio Code",
          "url": "https://code.visualstudio.com/api",
          "appliesTo": [
            "vscode-extension"
          ],
          "useFor": [
            "Extension structure",
            "activation events",
            "commands",
            "webviews",
            "testing"
          ],
          "topics": [
            "editor-extension"
          ]
        },
        {
          "id": "vscode-extension-publishing",
          "title": "Publishing Extensions",
          "publisher": "Visual Studio Code",
          "url": "https://code.visualstudio.com/api/working-with-extensions/publishing-extension",
          "appliesTo": [
            "vscode-extension"
          ],
          "useFor": [
            "Marketplace metadata",
            "engines.vscode",
            "VSIX packaging",
            "publisher requirements"
          ],
          "topics": [
            "marketplace"
          ]
        },
        {
          "id": "vscode-extension-runtime-security",
          "title": "Extension Runtime Security",
          "publisher": "Visual Studio Code",
          "url": "https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security",
          "appliesTo": [
            "vscode-extension"
          ],
          "useFor": [
            "Extension trust boundaries",
            "runtime permissions",
            "user risk model"
          ],
          "topics": [
            "extension-security"
          ]
        },
        {
          "id": "github-actions-metadata",
          "title": "Metadata syntax for GitHub Actions",
          "publisher": "GitHub",
          "url": "https://docs.github.com/en/actions/reference/workflows-and-actions/metadata-syntax",
          "appliesTo": [
            "github-action"
          ],
          "useFor": [
            "action.yml schema",
            "inputs",
            "outputs",
            "runs",
            "branding"
          ],
          "topics": [
            "action-yml"
          ]
        },
        {
          "id": "github-actions-creating-actions",
          "title": "Creating actions",
          "publisher": "GitHub",
          "url": "https://docs.github.com/en/actions/how-tos/create-and-publish-actions",
          "appliesTo": [
            "github-action"
          ],
          "useFor": [
            "JavaScript actions",
            "composite actions",
            "Docker actions"
          ],
          "topics": [
            "ci-automation"
          ]
        },
        {
          "id": "tauri-docs",
          "title": "Tauri Documentation",
          "publisher": "Tauri",
          "url": "https://v2.tauri.app/",
          "appliesTo": [
            "tauri"
          ],
          "useFor": [
            "Tauri app structure",
            "commands",
            "capabilities",
            "plugins",
            "bundling"
          ],
          "topics": [
            "desktop-app",
            "rust-webview"
          ]
        },
        {
          "id": "electron-docs",
          "title": "Electron Documentation",
          "publisher": "Electron",
          "url": "https://www.electronjs.org/docs/latest/",
          "appliesTo": [],
          "useFor": [
            "Main/renderer process boundaries",
            "IPC",
            "security",
            "packaging"
          ],
          "topics": [
            "electron",
            "desktop-app"
          ]
        },
        {
          "id": "flutter-docs",
          "title": "Flutter Documentation",
          "publisher": "Flutter",
          "url": "https://docs.flutter.dev/",
          "appliesTo": [
            "flutter"
          ],
          "useFor": [
            "Flutter app structure",
            "widgets",
            "testing",
            "deployment"
          ],
          "topics": [
            "mobile-app",
            "desktop-app"
          ]
        },
        {
          "id": "firebase-flutter-setup",
          "title": "Add Firebase to your Flutter app",
          "publisher": "Firebase",
          "url": "https://firebase.google.com/docs/flutter/setup",
          "appliesTo": [
            "firebase",
            "flutter",
            "flutter-firebase-app"
          ],
          "useFor": [
            "FlutterFire setup",
            "Firebase CLI and FlutterFire CLI configuration",
            "platform app registration"
          ],
          "topics": [
            "flutterfire",
            "firebase-core",
            "mobile-app",
            "web-app"
          ]
        }
      ]
    },
    {
      "id": "architecture-docs",
      "title": "Architecture and documentation",
      "description": "Architecture decision and knowledge-base references.",
      "references": [
        {
          "id": "adr-github",
          "title": "Architecture Decision Records",
          "publisher": "Michael Nygard / joelparkerhenderson",
          "url": "https://github.com/architecture-decision-record/architecture-decision-record",
          "appliesTo": [
            "docs-kb"
          ],
          "useFor": [
            "ADR structure",
            "decision history",
            "docs-as-architecture"
          ],
          "topics": [
            "adr",
            "architecture-docs",
            "knowledge-base"
          ]
        },
        {
          "id": "c4-model",
          "title": "The C4 Model",
          "publisher": "Structurizr",
          "url": "https://c4model.com/",
          "appliesTo": [],
          "useFor": [
            "Context/container/component/code diagrams",
            "architecture communication"
          ],
          "topics": [
            "architecture-docs",
            "system-design",
            "diagrams"
          ]
        },
        {
          "id": "diataxis",
          "title": "Diataxis",
          "publisher": "Diataxis",
          "url": "https://diataxis.fr/",
          "appliesTo": [
            "docs-kb"
          ],
          "useFor": [
            "Tutorial/how-to/reference/explanation structure"
          ],
          "topics": [
            "documentation",
            "knowledge-base",
            "developer-docs"
          ]
        },
        {
          "id": "zensical-docs",
          "title": "Zensical Documentation",
          "publisher": "Zensical",
          "url": "https://zensical.org/docs/",
          "appliesTo": [
            "docs-kb"
          ],
          "useFor": [
            "Zensical site configuration",
            "Markdown authoring",
            "static docs publishing"
          ],
          "topics": [
            "zensical",
            "documentation-site",
            "kb-publishing"
          ]
        },
        {
          "id": "mkdocs-material",
          "title": "Material for MkDocs",
          "publisher": "Material for MkDocs",
          "url": "https://squidfunk.github.io/mkdocs-material/",
          "appliesTo": [
            "docs-kb"
          ],
          "useFor": [
            "Docs navigation",
            "search",
            "admonitions",
            "theme configuration"
          ],
          "topics": [
            "mkdocs",
            "documentation-site"
          ]
        }
      ]
    },
    {
      "id": "firebase-backend",
      "title": "Firebase backend platform",
      "description": "Firebase Auth, Firestore, Functions, Hosting, rules, and emulator references for client-backed apps.",
      "references": [
        {
          "id": "firebase-functions",
          "title": "Cloud Functions for Firebase",
          "publisher": "Firebase",
          "url": "https://firebase.google.com/docs/functions",
          "appliesTo": [
            "firebase",
            "flutter-firebase-app",
            "node"
          ],
          "useFor": [
            "server-side Firebase functions",
            "runtime configuration",
            "backend mutation boundaries"
          ],
          "topics": [
            "cloud-functions",
            "server-side-javascript",
            "firebase-admin"
          ]
        },
        {
          "id": "firebase-firestore-security-rules",
          "title": "Get started with Cloud Firestore Security Rules",
          "publisher": "Firebase",
          "url": "https://firebase.google.com/docs/firestore/security/get-started",
          "appliesTo": [
            "firebase",
            "flutter-firebase-app"
          ],
          "useFor": [
            "Firestore rules authoring",
            "rules simulator expectations",
            "client data access boundaries"
          ],
          "topics": [
            "firestore",
            "security-rules",
            "tenant-isolation"
          ]
        },
        {
          "id": "firebase-rules-unit-tests",
          "title": "Build unit tests for Firebase Security Rules",
          "publisher": "Firebase",
          "url": "https://firebase.google.com/docs/rules/unit-tests",
          "appliesTo": [
            "firebase",
            "flutter-firebase-app",
            "testing"
          ],
          "useFor": [
            "Emulator-backed rules tests",
            "local rules validation",
            "automated security-rule test gates"
          ],
          "topics": [
            "firestore",
            "security-rules",
            "emulator",
            "rules-tests"
          ]
        },
        {
          "id": "firebase-hosting-github-integration",
          "title": "Deploy to live and preview channels via GitHub pull requests",
          "publisher": "Firebase",
          "url": "https://firebase.google.com/docs/hosting/github-integration",
          "appliesTo": [
            "firebase",
            "flutter-firebase-app",
            "github-actions"
          ],
          "useFor": [
            "Firebase Hosting deploy automation",
            "preview channels",
            "GitHub Actions deployment evidence"
          ],
          "topics": [
            "firebase-hosting",
            "preview-deployments",
            "ci-deploy"
          ]
        }
      ]
    }
  ]
}