[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M74GD8CABB6HGDFMQFQ0SCQR":3,"skill-same:01M74GD8CABB6HGDFMQFQ0SCQR":44},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":14,"repositoryHtmlUrl":27,"repositoryHomepageUrl":6,"ownerHtmlUrl":28,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":29,"install":30,"resources":43},"01M74GD8CABB6HGDFMQFQ0SCQR","deep-links",null,"Design deep-link routing — universal\u002Fapp links over custom schemes, deferred deep-link for install path, fallback web URL, signed param verification.","MohammadBafkar\u002Fpolymath","MohammadBafkar","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F34940462?v=4","01M74G540TQFZWK6KVAPKFVGNR","Mohammad Bafkar","01M74G541HG19QP9V5DQCJVKYE",0,"MIT","https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath\u002Fblob\u002Fmain\u002Fplugins\u002Fpolymath-mobile\u002Fskills\u002Fdeep-links\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: deep-links\ndescription: Design deep-link routing — universal\u002Fapp links over custom schemes, deferred deep-link for install path, fallback web URL, signed param verification.\n---\n\n# deep-links\n\n> Deep links bridge web + push + email into the app at the right screen. Output is a routing table + the fallback web URL + the verification story.\n\n**Mode:** analytical — judgment inside a fixed frame. Keep the output shape; every verdict cites its evidence; unknowns are marked `[TBD]` or `[VERIFY]`, never filled in.\n\n## When to use\n\n- A new app or major feature ships and the team needs to support inbound deep links.\n- Push payloads need a routing target (see `push-notifications`).\n- Marketing wants email links to open the app.\n\n## Inputs\n\n- The app's screens or routes that need inbound links (required) and the platforms (iOS, Android, both).\n- The web domain(s) you control (required for Universal\u002FApp Links — verification files are served from them).\n- Inbound channels (optional): push, email, ads, QR — deferred deep links matter for ads and QR to new users.\n- Link parameters are untrusted input: every route validates its parameters before acting, and no link triggers a state-changing action without user confirmation in the app.\n\n## Mechanism choice\n\n- **Universal Links (iOS) + App Links (Android)** — preferred. Verified via apple-app-site-association \u002F assetlinks.json. URL is a plain https URL; opens the app if installed, the web page otherwise.\n- **Custom URL schemes** (`myapp:\u002F\u002F...`) — deprecated for primary use. Can be hijacked; no verification. Only use as a fallback.\n- **Deferred deep links** (e.g. via attribution SDK or first-party server) — needed when the user clicks a link before installing the app. Captures intent during install so the app routes correctly on first open.\n\n## Procedure\n\n1. **Define a URL scheme** — humans see https:\u002F\u002Fexample.com\u002Frefunds\u002F\u003Cid> in their email, and the app handles `\u002Frefunds\u002F\u003Cid>`.\n2. **Set up verification**:\n   - iOS: serve `\u002F.well-known\u002Fapple-app-site-association` (AASA). Include the paths the app handles.\n   - Android: serve `\u002F.well-known\u002Fassetlinks.json`. Include the package name + SHA-256 of the signing key.\n3. **Routing table** in the app:\n   ```\n   \u002Frefunds\u002F:id              → RefundDetailScreen(refund_id)\n   \u002Forders\u002F:id               → OrderDetailScreen(order_id)\n   \u002Forders\u002F:id\u002Frefunds\u002Fnew   → NewRefundScreen(order_id)\n   \u002Fshare\u002F:token             → ShareLandingScreen(token) — public unauth path\n   ```\n4. **Auth-gated screens**: deep link → if signed-in, go to screen; if not, signed-out landing → after login, complete the deep link. **Never** drop the user on the home screen after auth. Validate the saved target against the routing table before following it — an unchecked \"return to\" URL is an open redirect.\n5. **Deferred deep-link support**: pre-install link click captured by the attribution SDK or by a first-party landing URL (server-side log + cookie). On first launch after install, app fetches the pending deep link and routes.\n6. **Parameter verification**: signed\u002FJWT params for sensitive operations (e.g. magic-link login, password reset). Treat deep-link inputs as **untrusted**; verify on the server.\n7. **Fallback web URL**: every deep link MUST have a working https URL that handles the case when the app isn't installed. Quality of the fallback is a feature.\n\n## Output\n\n```text\nDeep-link design: refund-service\n\nURL space:\n  https:\u002F\u002Fexample.com\u002Frefunds\u002F\u003Crefund_id>\n  https:\u002F\u002Fexample.com\u002Forders\u002F\u003Corder_id>\n  https:\u002F\u002Fexample.com\u002Forders\u002F\u003Corder_id>\u002Frefunds\u002Fnew\n  https:\u002F\u002Fexample.com\u002Fshare\u002F\u003Cshare_token>\n\nVerification:\n  iOS:     \u002F.well-known\u002Fapple-app-site-association (paths: \u002Frefunds\u002F*, \u002Forders\u002F*, \u002Fshare\u002F*)\n  Android: \u002F.well-known\u002Fassetlinks.json (package: com.example.refund, SHA-256: \u003Cfingerprint>)\n\nRouting (in-app):\n  \u002Frefunds\u002F:id            → RefundDetail   (auth required; resume after login)\n  \u002Forders\u002F:id             → OrderDetail    (auth required; resume after login)\n  \u002Forders\u002F:id\u002Frefunds\u002Fnew → NewRefund      (auth required)\n  \u002Fshare\u002F:token           → ShareLanding   (public; token JWT-verified)\n\nAuth-gated:\n  Save target URL → signed-in flow → on success, complete the original deep\n  link instead of going home.\n\nDeferred deep links:\n  Server-side: first-party landing URL captures the intent + sets a 1-day\n  cookie. App on first launch fetches \u002Fpending-deep-link with the cookie.\n\nUntrusted-input contract:\n  All :id and :token params are validated server-side. The share-token is a\n  short-lived JWT signed with our key.\n\nFallback web URL:\n  Every URL works in a browser. \u002Frefunds\u002F\u003Cid> renders a read-only HTML\n  receipt for users without the app. Quality of the fallback is in scope.\n```\n\n## Quality bar\n\n- Universal\u002FApp Links over custom schemes for primary inbound.\n- AASA + assetlinks.json files served from the actual domain.\n- Auth-gated routes resume the deep link after login (don't dump to home).\n- Sensitive params verified server-side; treat all deep-link input as untrusted.\n- Fallback web URL works.\n\n## Anti-patterns to avoid\n\n- `myapp:\u002F\u002F` as the only entry point. Hijackable; no verification.\n- Routing param trusted without server-side validation.\n- After-login redirect drops user on home, losing the deep-link intent.\n- No fallback web URL — half your audience can't open it.\n- Deferred deep links handled \"best effort\"; if they're load-bearing, validate.\n","# deep-links\n\n> Deep links bridge web + push + email into the app at the right screen. Output is a routing table + the fallback web URL + the verification story.\n\n**Mode:** analytical — judgment inside a fixed frame. Keep the output shape; every verdict cites its evidence; unknowns are marked `[TBD]` or `[VERIFY]`, never filled in.\n\n## When to use\n\n- A new app or major feature ships and the team needs to support inbound deep links.\n- Push payloads need a routing target (see `push-notifications`).\n- Marketing wants email links to open the app.\n\n## Inputs\n\n- The app's screens or routes that need inbound links (required) and the platforms (iOS, Android, both).\n- The web domain(s) you control (required for Universal\u002FApp Links — verification files are served from them).\n- Inbound channels (optional): push, email, ads, QR — deferred deep links matter for ads and QR to new users.\n- Link parameters are untrusted input: every route validates its parameters before acting, and no link triggers a state-changing action without user confirmation in the app.\n\n## Mechanism choice\n\n- **Universal Links (iOS) + App Links (Android)** — preferred. Verified via apple-app-site-association \u002F assetlinks.json. URL is a plain https URL; opens the app if installed, the web page otherwise.\n- **Custom URL schemes** (`myapp:\u002F\u002F...`) — deprecated for primary use. Can be hijacked; no verification. Only use as a fallback.\n- **Deferred deep links** (e.g. via attribution SDK or first-party server) — needed when the user clicks a link before installing the app. Captures intent during install so the app routes correctly on first open.\n\n## Procedure\n\n1. **Define a URL scheme** — humans see https:\u002F\u002Fexample.com\u002Frefunds\u002F\u003Cid> in their email, and the app handles `\u002Frefunds\u002F\u003Cid>`.\n2. **Set up verification**:\n   - iOS: serve `\u002F.well-known\u002Fapple-app-site-association` (AASA). Include the paths the app handles.\n   - Android: serve `\u002F.well-known\u002Fassetlinks.json`. Include the package name + SHA-256 of the signing key.\n3. **Routing table** in the app:\n   ```\n   \u002Frefunds\u002F:id              → RefundDetailScreen(refund_id)\n   \u002Forders\u002F:id               → OrderDetailScreen(order_id)\n   \u002Forders\u002F:id\u002Frefunds\u002Fnew   → NewRefundScreen(order_id)\n   \u002Fshare\u002F:token             → ShareLandingScreen(token) — public unauth path\n   ```\n4. **Auth-gated screens**: deep link → if signed-in, go to screen; if not, signed-out landing → after login, complete the deep link. **Never** drop the user on the home screen after auth. Validate the saved target against the routing table before following it — an unchecked \"return to\" URL is an open redirect.\n5. **Deferred deep-link support**: pre-install link click captured by the attribution SDK or by a first-party landing URL (server-side log + cookie). On first launch after install, app fetches the pending deep link and routes.\n6. **Parameter verification**: signed\u002FJWT params for sensitive operations (e.g. magic-link login, password reset). Treat deep-link inputs as **untrusted**; verify on the server.\n7. **Fallback web URL**: every deep link MUST have a working https URL that handles the case when the app isn't installed. Quality of the fallback is a feature.\n\n## Output\n\n```text\nDeep-link design: refund-service\n\nURL space:\n  https:\u002F\u002Fexample.com\u002Frefunds\u002F\u003Crefund_id>\n  https:\u002F\u002Fexample.com\u002Forders\u002F\u003Corder_id>\n  https:\u002F\u002Fexample.com\u002Forders\u002F\u003Corder_id>\u002Frefunds\u002Fnew\n  https:\u002F\u002Fexample.com\u002Fshare\u002F\u003Cshare_token>\n\nVerification:\n  iOS:     \u002F.well-known\u002Fapple-app-site-association (paths: \u002Frefunds\u002F*, \u002Forders\u002F*, \u002Fshare\u002F*)\n  Android: \u002F.well-known\u002Fassetlinks.json (package: com.example.refund, SHA-256: \u003Cfingerprint>)\n\nRouting (in-app):\n  \u002Frefunds\u002F:id            → RefundDetail   (auth required; resume after login)\n  \u002Forders\u002F:id             → OrderDetail    (auth required; resume after login)\n  \u002Forders\u002F:id\u002Frefunds\u002Fnew → NewRefund      (auth required)\n  \u002Fshare\u002F:token           → ShareLanding   (public; token JWT-verified)\n\nAuth-gated:\n  Save target URL → signed-in flow → on success, complete the original deep\n  link instead of going home.\n\nDeferred deep links:\n  Server-side: first-party landing URL captures the intent + sets a 1-day\n  cookie. App on first launch fetches \u002Fpending-deep-link with the cookie.\n\nUntrusted-input contract:\n  All :id and :token params are validated server-side. The share-token is a\n  short-lived JWT signed with our key.\n\nFallback web URL:\n  Every URL works in a browser. \u002Frefunds\u002F\u003Cid> renders a read-only HTML\n  receipt for users without the app. Quality of the fallback is in scope.\n```\n\n## Quality bar\n\n- Universal\u002FApp Links over custom schemes for primary inbound.\n- AASA + assetlinks.json files served from the actual domain.\n- Auth-gated routes resume the deep link after login (don't dump to home).\n- Sensitive params verified server-side; treat all deep-link input as untrusted.\n- Fallback web URL works.\n\n## Anti-patterns to avoid\n\n- `myapp:\u002F\u002F` as the only entry point. Hijackable; no verification.\n- Routing param trusted without server-side validation.\n- After-login redirect drops user on home, losing the deep-link intent.\n- No fallback web URL — half your audience can't open it.\n- Deferred deep links handled \"best effort\"; if they're load-bearing, validate.\n",{"name":5,"description":7},"main","23f6e21841a39580c9da2b5ec941f39dda17cd86","plugins\u002Fpolymath-mobile\u002Fskills\u002Fdeep-links","https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath","https:\u002F\u002Fgithub.com\u002FMohammadBafkar","2026-10-29 18:34:59",{"source":8,"skillName":5,"commands":31,"prompt":41,"zipAvailable":42},[32,35,38],{"tool":33,"command":34},"npx","npx skills add MohammadBafkar\u002Fpolymath --skill deep-links",{"tool":36,"command":37},"bunx","bunx skills add MohammadBafkar\u002Fpolymath --skill deep-links",{"tool":39,"command":40},"pnpm","pnpm dlx skills add MohammadBafkar\u002Fpolymath --skill deep-links","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath\u002Fblob\u002Fmain\u002Fplugins\u002Fpolymath-mobile\u002Fskills\u002Fdeep-links\u002FSKILL.md",true,[],[45,52,59,66,73,80],{"skillNo":46,"name":47,"nameZh":6,"description":48,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":49,"categories":50,"keywords":51,"publishedAt":19},"01M74GN87EBRHM9N87M7AP1HDD","runbook","Write or refresh an operational runbook for an alert\u002Fsymptom; structured as TL;DR + Pre-checks + Steps + Verification + Rollback + Escalation.","https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath\u002Fblob\u002Fmain\u002Fplugins\u002Fpolymath-writing\u002Fskills\u002Frunbook\u002FSKILL.md",[],[],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":58,"publishedAt":19},"01M74GN5GPKEC1JEKP2DFQNEQJ","rfc","Draft a lightweight design RFC to docs\u002Frfcs\u002F\u003Cslug>.md; Summary, Motivation, Detailed design, Drawbacks, Alternatives, Unresolved questions. A proposal to debate, not a recorded decision (adr).","https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath\u002Fblob\u002Fmain\u002Fplugins\u002Fpolymath-writing\u002Fskills\u002Frfc\u002FSKILL.md",[],[],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":19},"01M74GN2F4CWPMV4X09TG4E304","editorial-pass","Review and tighten prose in a Markdown artifact for a target tone (terse, formal, friendly) without dropping information; preserve quotations and load-bearing constraints.","https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath\u002Fblob\u002Fmain\u002Fplugins\u002Fpolymath-writing\u002Fskills\u002Feditorial-pass\u002FSKILL.md",[],[],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":19},"01M74GMZWGYMZ37C4DYGT6P23G","architecture-review-facilitation","Run an architecture review as a process — entry criteria, reviewer checklist, decision log, and follow-up actions — pairing the design artifact with a red-team pass.","https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath\u002Fblob\u002Fmain\u002Fplugins\u002Fpolymath-writing\u002Fskills\u002Farchitecture-review-facilitation\u002FSKILL.md",[],[],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":19},"01M74GMXVX0YX3ETDXS527XDGM","architecture-doc","Write a C4-style architecture document; System Context + Containers (+ Components when interesting) with mermaid diagrams. Describes structure, not a decision (adr) or proposal (rfc).","https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath\u002Fblob\u002Fmain\u002Fplugins\u002Fpolymath-writing\u002Fskills\u002Farchitecture-doc\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":19},"01M74GMVG1WSMCK066S3KE6V5K","adr","Write an Architecture Decision Record (Michael Nygard format) to docs\u002Fadrs\u002FNNNN-\u003Cslug>.md; frontmatter validated by the ADR artifact schema. Records a made decision, not a proposal to debate (rfc).","https:\u002F\u002Fgithub.com\u002FMohammadBafkar\u002Fpolymath\u002Fblob\u002Fmain\u002Fplugins\u002Fpolymath-writing\u002Fskills\u002Fadr\u002FSKILL.md",[],[]]