# Navree > The complete backend framework for Rust. Modular, API-first and AI-native. Everything your backend needs, checked by the compiler. Navree is a batteries-included Rust framework for building secure, scalable server-side applications. Modules and dependency injection give every app the same clear structure, and auth, workspaces, an ORM, queues, search, real time, monitoring, deployment and AI come in the box. Every link below is a docs page as Markdown. All of them in one file: https://navree.com/llms-full.txt. Any page of https://navree.com/docs/ is also available as Markdown: replace the trailing slash of its URL with `.md`. ## Prologue - [Introduction](https://navree.com/docs/prologue/introduction.md): What Navree is, the ideas it is built on, what comes in the box, who it's for and how to read these docs. - [Release notes](https://navree.com/docs/prologue/release-notes.md): Navree 0.1.0, the first release: the framework's modules, workspaces, the tools and packages of the first-party ecosystem, AI-native tooling, the CLI and the reference CRM. - [Roadmap](https://navree.com/docs/prologue/roadmap.md): Where Navree goes after 0.1: the 1.0 API freeze, long-term support, more drivers and starter kits, Windows services and ongoing performance work. - [Contributing](https://navree.com/docs/prologue/contributing.md): How the Navree repository is laid out, the crate-layer rule and the test that enforces it, running the tests, code style, and contributing to these docs. ## Getting started - [Installation](https://navree.com/docs/getting-started/installation.md): Install Rust and the `navree` CLI, create an app with `navree new`, and run it with `navree dev`. - [Your first app](https://navree.com/docs/getting-started/your-first-app.md): Build a small task-list API with an entity, a migration, validation, JWT authentication, access rules and feature tests, from `navree new` to green tests. - [Configuration](https://navree.com/docs/getting-started/configuration.md): Typed configuration from `.env`, `config/app.toml` and `APP_*` environment variables: precedence, nesting, the application key and your own sections. - [Directory structure](https://navree.com/docs/getting-started/directory-structure.md): What every file of a new Navree app is for, where generated code goes, and how the framework's own repository is laid out. - [Starter kits](https://navree.com/docs/getting-started/starter-kits.md): Production-ready apps from one command: a SaaS kit with a Next.js and shadcn/ui front end, an API kit and a microservice kit. - [Deployment](https://navree.com/docs/getting-started/deployment.md): Build a release binary, configure it through the environment, run the server, queue workers and the scheduler under a process manager, and put it behind a reverse proxy. ## Architecture concepts - [Request lifecycle](https://navree.com/docs/architecture/request-lifecycle.md): What happens from `cargo run -- serve` to a response: the boot, every global layer in order, the route pipeline, the handler and the way back out. - [Modules](https://navree.com/docs/architecture/modules.md): How an app is composed from modules that declare imports, providers, controllers and exports, and how the module graph is checked at boot. - [Providers and dependency injection](https://navree.com/docs/architecture/providers.md): The type-keyed container: `#[injectable]` services, singleton, request and transient scopes, lazy handles, multi-bindings and overrides for tests. - [Lifecycle hooks](https://navree.com/docs/architecture/lifecycle-hooks.md): Run code when the app boots and when it shuts down: `on_init`, `on_bootstrap`, `on_shutdown`, background tasks and graceful shutdown. - [The crate hierarchy](https://navree.com/docs/architecture/crate-hierarchy.md): The layers of Navree crates, the rule that a crate depends only on the layers below it, the shared contracts that make that possible, and the test that enforces it. - [The facade and features](https://navree.com/docs/architecture/facade-and-features.md): The `navree` crate: one dependency that re-exports every module, a prelude, one Cargo feature per module (`full` by default), and using a single crate on its own. ## Architecture patterns - [Choosing an architecture](https://navree.com/docs/patterns/overview.md): The shapes of system Navree is built for, how to pick one by team size, deploy cadence, isolation and scale, and how an app moves between them without a rewrite. - [Modular monolith](https://navree.com/docs/patterns/modular-monolith.md): One binary, many modules with explicit boundaries: the default shape of a Navree app, checked at boot and the easiest one to split later. - [Microservices](https://navree.com/docs/patterns/microservices.md): Split modules into services that talk over NATS, Kafka, RabbitMQ, Redis Streams, MQTT, TCP or gRPC, with the same module code, guards and tests. - [Multi-tenant SaaS](https://navree.com/docs/patterns/multi-tenancy.md): Workspace-level multi-tenancy: resolving the workspace, checking membership, scoping every query, and choosing row, schema or database isolation. - [Event-driven](https://navree.com/docs/patterns/event-driven.md): Domain events, listeners, queued work and the transactional outbox: decouple modules inside one app, push changes to browsers and publish to other services. - [API-first](https://navree.com/docs/patterns/api-first.md): Treat the API as the product: versioned routes, validated DTOs, one JSON error shape, pagination and an OpenAPI 3.1 document generated from your code. - [Backend for frontend](https://navree.com/docs/patterns/backend-for-frontend.md): A web front end that never sees a token: a backend-for-frontend, in Next.js or Nuxt, holds the JWTs in httpOnly cookies, rotates them and calls the Navree API on the browser's behalf. ## The basics - [Routing and controllers](https://navree.com/docs/basics/routing.md): Controllers and route attributes, the API prefix and versions, absolute `!` paths, path and query parameters, route names and the route table. - [Access control on routes](https://navree.com/docs/basics/access-control.md): Deny by default: every route declares who may call it with `#[public]`, `#[authenticated]`, `#[roles]`, `#[permissions]` or `#[can]`, and refusals map to 401, 403 or 404. - [The request pipeline and middleware](https://navree.com/docs/basics/middleware.md): The global Tower layers Navree installs and their order, adding your own layers in the pipeline's slots, guards, per-route settings and layers on a single route. - [Requests and extractors](https://navree.com/docs/basics/requests.md): Reading paths, query strings, JSON and other bodies, headers, the request id, the client IP behind trusted proxies, the current user, and body limits; writing your own extractor. - [Validation](https://navree.com/docs/basics/validation.md): Validate request bodies and query strings with `Valid>` on garde, with field-level messages, `unique` / `exists` database rules, and international input: phone numbers, names and digits in any script, countries, locales and sanitized rich text. - [Responses and API resources](https://navree.com/docs/basics/responses.md): Return JSON, status codes and headers from handlers, shape entities into API resources, and send pages, downloads and streams. - [Errors](https://navree.com/docs/basics/errors.md): Navree's JSON error shape, the machine-readable `code` front ends translate, `AppError`, mapping your own and database errors to statuses, and how 5xx errors and panics are logged. - [Logging](https://navree.com/docs/basics/logging.md): Structured logging on tracing: levels per target, pretty or JSON output, redaction of secrets, rotating files and the per-request log line. - [Rate limiting](https://navree.com/docs/basics/rate-limiting.md): The per-IP limit every app gets, throttles on single routes, the login throttle, limits shared by every process with Redis, and how client addresses work behind proxies. - [CORS and security headers](https://navree.com/docs/basics/cors-and-security-headers.md): Allow browser front ends on other origins with exact-origin CORS, and the security headers Navree sends on every response. - [Sessions and CSRF](https://navree.com/docs/basics/sessions-and-csrf.md): The optional session module: encrypted session cookies, memory, database and Redis stores, CSRF protection for cookie clients, and when to use it instead of bearer tokens. ## Security - [Authentication](https://navree.com/docs/security/authentication.md): JWT access tokens, rotating refresh tokens with reuse detection, pluggable strategies, the `CurrentUser` extractor, platform administrators and trusted token exchange. - [Account flows](https://navree.com/docs/security/account-flows.md): Registration, password reset, email verification, profile and password changes, and TOTP two-factor authentication with recovery codes and a policy that requires it. - [Sessions and step-up](https://navree.com/docs/security/sessions.md): List and end a user's sessions, and ask for the password or a code again before sensitive actions with `#[recent_auth]`. - [Passwordless sign-in](https://navree.com/docs/security/passwordless.md): Magic links, emailed sign-in codes and passkeys (WebAuthn with ES256 and Ed25519), next to or instead of passwords. - [Impersonation](https://navree.com/docs/security/impersonation.md): Let support staff sign in as a user, with a required reason, guards on risky routes and the impersonator on every audit entry. - [Single sign-on](https://navree.com/docs/security/single-sign-on.md): SAML 2.0 and OpenID Connect sign-in per organization or workspace, verified email domains that route sign-in and can refuse passwords, and just-in-time provisioning with group to role mapping. - [Authorization](https://navree.com/docs/security/authorization.md): Roles, permissions and abilities, checked on routes, on loaded records and in SQL list filters, and shared with the front end. - [Encryption and hashing](https://navree.com/docs/security/encryption-and-hashing.md): The application key, AES-256-GCM encryption with key rotation, Argon2id password hashing and secure token helpers. - [Signatures and keys](https://navree.com/docs/security/signatures-and-keys.md): JSON Web Signatures with HS256, EdDSA, ES256 and RS256, JSON Web Keys and key sets, PKCS#8 keys such as Apple's `.p8` files, and key generation, in `navree::crypto::jose`. - [The audit log](https://navree.com/docs/security/audit-log.md): An audit trail of data changes, sign-ins, permission changes and access denials: recorded by default, queryable over HTTP and in code, and pruned on a schedule. ## Workspaces - [Workspaces](https://navree.com/docs/workspaces/introduction.md): Multi-tenancy at the workspace level, built in: workspaces, members, roles, invitations and data isolation. - [Resolving the workspace](https://navree.com/docs/workspaces/resolution.md): Find the current workspace from a header, a subdomain, a path prefix, a token claim or the workspace's own domain, and check that the user belongs to it. - [Members and roles](https://navree.com/docs/workspaces/members-and-roles.md): Add members, assign roles, define your own roles and check workspace-scoped permissions with navree-access. - [Invitations](https://navree.com/docs/workspaces/invitations.md): Invite people by email, accept by token, revoke and expire invitations. - [Data isolation](https://navree.com/docs/workspaces/isolation.md): Keep each workspace's data apart by row, by schema or by database. - [Organizations](https://navree.com/docs/workspaces/organizations.md): Group workspaces under an organization whose members reach all or some of them with one role, read across them, and ask to join. - [Partitions](https://navree.com/docs/workspaces/partitions.md): Split a workspace's data into named partitions, limit members to some of them, and scope every query to the partitions a request may touch. - [Shared libraries](https://navree.com/docs/workspaces/shared-libraries.md): Templates, courses and other content kept for the whole app, an organization or one workspace, read together by each workspace and cloned to be changed. - [Demo workspaces](https://navree.com/docs/workspaces/demo-workspaces.md): Workspaces seeded from fixtures for sales and onboarding, kept read-only or reset every night, and marked with `X-Navree-Demo` for a Live/Demo switch. ## Database - [Getting started](https://navree.com/docs/database/getting-started.md): Connect to TimescaleDB (the default), PostgreSQL, MySQL or SQLite, configure the pool and run your first queries with the ORM. - [Entities and repositories](https://navree.com/docs/database/entities-and-repositories.md): SeaORM entities next to the ORM's models: defining entities, relations and eager loading, UUID v7 keys, soft deletes by hand, and `Repo` for writes that record change events. - [The unit of work and transactions](https://navree.com/docs/database/unit-of-work.md): One lazy transaction per request, committed when the response succeeds; units of work in jobs and commands, after-commit hooks, row locks and change observers. - [Migrations](https://navree.com/docs/database/migrations.md): Module-owned migrations written with the schema builder: generating them, `up` and `down`, migration sets and their order, transactions, reading the database, data changes and SeaORM migrations. - [Running migrations](https://navree.com/docs/database/running-migrations.md): The migration commands: `migrate`, `migrate:status`, `--pretend`, rolling back by batch or step, reset, refresh and fresh, the production guard, migrating on boot, and the migrator's API for code and tests. - [Schema builder](https://navree.com/docs/database/schema-builder.md): Tables described in Rust and written as the right SQL for PostgreSQL, MySQL, MariaDB and SQLite: creating, altering, renaming and dropping tables, table options, SQLite rebuilds, reading the schema, previews without a database, and configuration. - [Columns](https://navree.com/docs/database/columns.md): Every column type of the schema builder and the SQL it writes on PostgreSQL, MySQL, MariaDB and SQLite; the helpers for keys, timestamps and polymorphic columns; modifiers, defaults, generated columns; and changing, renaming and dropping columns. - [Indexes and foreign keys](https://navree.com/docs/database/indexes-and-foreign-keys.md): Primary keys, unique, plain, partial, expression, full-text and spatial indexes with their options per database, foreign keys with their actions, check constraints, conventional names, and dropping and renaming them. - [Squashing migrations](https://navree.com/docs/database/squashing-migrations.md): `schema:dump` writes the schema your migrations produce as one SQL file, read from the database's catalogs; `migrate` loads it into an empty database and runs only the newer migrations. - [TimescaleDB](https://navree.com/docs/database/timescaledb.md): Navree's default database: why it is the default, running it locally and in production, which tables to make hypertables (Navree's own included), keys and ids, chunks, compression, retention, continuous aggregates and time-bucket queries. - [Seeding and factories](https://navree.com/docs/database/seeding-and-factories.md): Seeders for the data an app needs and demo data, the `db:seed` command, root seeders that call others, seeding without model events, and model factories for seeders and tests. - [Pagination](https://navree.com/docs/database/pagination.md): Offset pages in a `{data, meta}` response with `PageQuery`, `paginate` and `Page`, your own page parameters, and cursor pagination over UUID v7 keys. ## ORM - [Getting started](https://navree.com/docs/orm/getting-started.md): Navree's ORM: models as plain structs with `#[derive(Model)]`, typed columns, a query builder, relationships and records that track their changes, running in the request's unit of work. - [Models](https://navree.com/docs/orm/models.md): `#[derive(Model)]`: tables, keys, columns and timestamps; creating, reading, updating and deleting records; dirty tracking; and mass assignment from untyped input. - [Query builder](https://navree.com/docs/orm/query-builder.md): Typed conditions, groups, JSON and full-text search, selects, joins, aggregates, unions, row locks, mass updates, bulk inserts and upserts, queries without a model and raw SQL. - [Relationships](https://navree.com/docs/orm/relationships.md): Belongs to, has one and has many, many to many with pivot tables, has one of many, through relations and polymorphic relations: defining them, querying them, filtering by them and writing through them. - [Eager loading](https://navree.com/docs/orm/eager-loading.md): Load relationships for a whole result in one query per relation: nested and constrained loads, related counts and sums, loading after the fact, reading loaded relations, and stopping N+1 queries in development. - [Collections](https://navree.com/docs/orm/collections.md): `Collection`: the records a query returns, with methods that work by key and by column, loading relations for every record, a query of the same records, and serialization as an array. - [Pagination and streaming](https://navree.com/docs/orm/pagination-and-streaming.md): Pages for API responses (numbered, simple and cursor pages), and chunks, lazy streams and cursors for reading large results with constant memory. - [Casts and accessors](https://navree.com/docs/orm/casts-and-accessors.md): Store fields in another form: enums, JSON, fixed-scale decimals, formatted dates, encrypted and hashed secrets, binary ids, vectors, your own casts and fields across several columns; computed values with accessors, and mutators. - [Serialization](https://navree.com/docs/orm/serialization.md): What a record's JSON holds and in what order, hiding fields and appending computed ones, per-record changes, date formats, API resources with a `__type`, OpenAPI schemas from models, and records in queued jobs. - [Events and observers](https://navree.com/docs/orm/events-and-observers.md): Model events from `retrieved` to `restored`: observers, closure listeners, typed application events and real-time broadcasts, when each hears an event inside a unit of work, canceling writes, quiet operations, custom events and testing with `ModelEventFake`. - [Scopes and soft deletes](https://navree.com/docs/orm/scopes-and-soft-deletes.md): Local scopes as builder methods, global scopes every query applies, soft deletes with trashing, restoring and force deleting, and pruning old records with `model:prune`. - [Connections and transactions](https://navree.com/docs/orm/connections-and-transactions.md): Where ORM operations run: executors, the unit of work, transactions in commands and jobs, named connections, read replicas and reading from the writer, and watching the statements your code runs. - [Route model binding](https://navree.com/docs/orm/route-model-binding.md): `Bound` loads the record a route's path names, or answers 404: route keys, custom bindings, soft-deleted records and nested routes with `BoundChild`. - [Workspaces and access](https://navree.com/docs/orm/workspaces-and-access.md): Models scoped to the current workspace with `#[model(workspace)]`, models as access-control subjects with policies, list filters and record checks from the same rules, and `unique` and `exists` validation rules that query models. - [Factories](https://navree.com/docs/orm/factories.md): Model factories for tests and seeders: definitions with fake data, states, sequences, parents and children, many-to-many attachments, recycled records, hooks, and making, creating or bulk-inserting records. - [Testing](https://navree.com/docs/orm/testing.md): Database assertions on rows and records, counting queries, `#[navree::test]` with a database of its own per test, templates built once and copied, real PostgreSQL and MySQL servers, and seeding test apps. - [MongoDB](https://navree.com/docs/orm/mongodb.md): The ORM's models on MongoDB collections: `MongoModule`, ObjectId keys and embedded documents, queries compiled to filters and pipelines, relations, units of work on sessions, migrations, time-series and TTL collections, and what works differently. ## Digging deeper - [Cache](https://navree.com/docs/digging-deeper/cache.md): `Cache` and `Locks` from `CacheModule`: the in-memory store on moka, the Redis store shared by every process, `remember`, stale-while-revalidate, counters, tags and atomic locks. - [Redis](https://navree.com/docs/digging-deeper/redis.md): `RedisModule`: shared Redis connections, and Redis drivers so every process of your app shares the cache, locks, the queue, sessions, rate limits and WebSocket broadcasts. - [Events](https://navree.com/docs/digging-deeper/events.md): A typed, in-process event bus: events, sync and queued listeners, emitting, ordering, transactions and errors. - [Queues](https://navree.com/docs/digging-deeper/queues.md): Background jobs on the database, memory or Redis driver: dispatching, delays, unique jobs, retries with backoff, failed jobs, `queue:work`, batches and operations, and testing with `QueueFake`. - [Batches and operations](https://navree.com/docs/digging-deeper/batches-and-operations.md): Job batches with `then`, `catch` and `finally` callbacks, progress reports from jobs, and operations: long work your users follow through an SSE stream or a private channel, cancel, and a watchdog brings back when it stalls. - [Task scheduling](https://navree.com/docs/digging-deeper/scheduling.md): Schedules on cron expressions, declared in modules: commands, jobs and functions, overlap prevention, single-node runs, `schedule:work` and `schedule:run`, in UTC, a time zone or each workspace's local time. - [Time zones](https://navree.com/docs/digging-deeper/time-zones.md): Zones for users, workspaces and organizations: the request's zone, local days and report windows, send windows, public holidays, local-time schedules and `AT TIME ZONE` with a checked zone. - [Mail](https://navree.com/docs/digging-deeper/mail.md): Mailables rendered from MiniJinja templates, with CSS inlined and a text body generated; the SMTP, SES, Mailgun, Postmark, Resend, log, array and failover transports; queued sending; configuration, previewing and testing. - [Mail delivery](https://navree.com/docs/digging-deeper/mail-delivery.md): Email APIs (SES, Mailgun, Postmark, Resend), transports per domain, workspace and organization, a delivery log fed by provider webhooks, suppressions, mail held for approval, open and click tracking, DKIM signing and sending-domain checks. - [Inbound mail](https://navree.com/docs/digging-deeper/inbound-mail.md): Receive mail: messages parsed with every header, body and attachment, sources for Amazon SES, Mailgun, Postmark, raw MIME and watched Microsoft 365 and Gmail mailboxes, mailboxes routed by address, signed reply addresses and the raw .eml kept on a disk. - [Notifications](https://navree.com/docs/digging-deeper/notifications.md): One notification over the mail, database, broadcast, Slack, Teams, SMS, WhatsApp and web push channels: notifiable users, read state, the `/api/notifications` routes, queueing and testing. - [Notification channels](https://navree.com/docs/digging-deeper/notification-channels.md): Slack, Microsoft Teams, SMS, WhatsApp and browser push for notifications: routes, drivers for Twilio, Vonage, Amazon SNS and the WhatsApp Cloud API, VAPID keys, the delivery log, STOP opt-outs, provider callbacks and a fake per channel. - [Notification preferences](https://navree.com/docs/digging-deeper/notification-preferences.md): What people and workspaces choose to receive: channels per category, digests that batch mail, quiet hours and send windows on the recipient's clock, held deliveries released by `notify:release`, the preference routes and per-workspace mail templates. - [File storage](https://navree.com/docs/digging-deeper/storage.md): Named disks on object_store (local, memory, S3, Google Cloud Storage, Azure): streaming, upload checks, signed links, direct browser uploads and disk sync. - [HTTP client](https://navree.com/docs/digging-deeper/http-client.md): Outgoing HTTP requests with retries, per-attempt timeouts, an SSRF guard and a fake for tests. - [Real-time broadcasting](https://navree.com/docs/digging-deeper/broadcasting.md): A Pusher-protocol WebSocket server inside your app: public, private and presence channels, channel authorisation, a signed relay for workers, a Redis backplane for several servers, and pusher-js on the front end. - [Views and templates](https://navree.com/docs/digging-deeper/views.md): MiniJinja templates for mail and other text: where they live, how modules embed them, escaping, filters and reloading. - [OpenAPI](https://navree.com/docs/digging-deeper/openapi.md): An OpenAPI 3.1 document generated from your routes at boot, a docs UI, exports for typed clients, and API resources. - [Health, metrics and telemetry](https://navree.com/docs/digging-deeper/health-and-metrics.md): Liveness and readiness endpoints, custom health checks, Prometheus metrics with an optional bearer token, and the typed telemetry events every module emits. - [Console commands and the CLI](https://navree.com/docs/digging-deeper/cli.md): The `navree` CLI (`new`, every `make:*` generator, `dev`), your app's own commands (`serve`, `migrate`, `queue:work`, ...), and writing your own. - [Maintenance mode](https://navree.com/docs/digging-deeper/maintenance-mode.md): Answer every request with a 503 while you deploy or migrate, with `down` and `up`, a retry hint, a message and paths that stay up. ## Front end - [Front end](https://navree.com/docs/frontend/introduction.md): Five npm packages for web front ends on a Navree API: a typed client, the backend-for-frontend, Next.js and Nuxt integrations, and navree.com's dark theme. - [The typed client](https://navree.com/docs/frontend/typed-client.md): `@navree/client`: a client typed from your API's OpenAPI document, `NavreeError` with Navree's error codes, list queries, pages, query keys and operations. - [Auth and the BFF](https://navree.com/docs/frontend/auth-and-bff.md): `@navree/bff`: httpOnly token cookies, single-flight refresh, two-factor sign-in, the Origin check, a streaming proxy, sessions for server rendering, and test helpers. - [Next.js](https://navree.com/docs/frontend/nextjs.md): `@navree/next`: the backend-for-frontend as route handlers, `auth()` and `client()` in server components, the proxy that guards pages, abilities, real-time channels, operations and workspaces in React. - [Nuxt](https://navree.com/docs/frontend/nuxt.md): `@navree/nuxt`: a Nuxt module with the backend-for-frontend as Nitro routes, a session gate, and auto-imported composables for sign-in, workspaces, the typed client, list queries, operations, real time and abilities. - [Data tables](https://navree.com/docs/frontend/data-tables.md): Lists driven by list queries: filters, sort, search and paging in the URL, sorted and paged on the server, rendered by `DataTable` (React) or `` (Vue) on TanStack Table. - [Theming](https://navree.com/docs/frontend/theming.md): `@navree/theme`: navree.com's dark theme as Tailwind CSS 4 tokens, shadcn/ui and shadcn-vue colors, self-hosted fonts and the tokens as data. - [Localization](https://navree.com/docs/frontend/localization.md): Front ends in several languages: `` for right-to-left locales, API errors translated by their code with next-intl or @nuxtjs/i18n, and the data table's labels. ## Microservices - [Microservices](https://navree.com/docs/microservices/introduction.md): Split an app into services that call each other and publish events over NATS, Kafka, RabbitMQ, Redis Streams, MQTT or TCP, with the same modules, guards, validation and unit of work as your HTTP routes. - [Transports](https://navree.com/docs/microservices/transports.md): Connect services over TCP, NATS, Kafka, RabbitMQ, Redis Streams or MQTT: settings, delivery guarantees, ordering, serialization and writing your own transport. - [Request-response](https://navree.com/docs/microservices/request-response.md): Answer messages with `#[message_pattern]` handlers and call them with `ServiceClient::send`: payloads, validation, access, the unit of work, deadlines, errors across services and testing with `MicroFake`. - [Events](https://navree.com/docs/microservices/events.md): Publish events with `ServiceClient::emit` and handle them with `#[event_pattern]`: fan-out across services, retries, dead letters, ordering, the transactional outbox and the inbox. - [gRPC](https://navree.com/docs/microservices/grpc.md): Serve gRPC, gRPC-Web and Connect from your modules with `#[grpc_service]` on tonic services, sharing dependency injection, guards, access rules and the unit of work with your routes. - [GraphQL](https://navree.com/docs/microservices/graphql.md): Serve a GraphQL API from your modules with `#[resolver]` on async-graphql: access rules on fields, validated inputs, per-request dataloaders, subscriptions over WebSockets and GraphiQL in development. - [Distributed tracing](https://navree.com/docs/microservices/tracing.md): Follow one request through every service with OpenTelemetry: spans for HTTP, outgoing calls, queries, jobs, cache and mail, W3C trace context across every hop, OTLP export, trace ids in your logs, and Lighthouse. ## AI - [Navree for AI](https://navree.com/docs/ai/introduction.md): Navree is AI-native on two sides: your coding agent builds with skills, Navigator and docs written for models, and your product uses models through the AI SDK, agents, RAG and MCP servers. - [Agent skills](https://navree.com/docs/ai/agent-skills.md): Skills that teach coding agents how to build with Navree, one per common task: what each covers, installing them with `navree skills:install` or `npx skills add`, how agents use them, and writing skills for your own app. - [Navigator](https://navree.com/docs/ai/navigator.md): `navree mcp`: the MCP server for your coding agent, with your app's routes, module graph, providers, database schema, read-only SQL, logs, configuration and docs matched to your Navree version. - [Docs for agents](https://navree.com/docs/ai/docs-for-agents.md): Every docs page as Markdown, `llms.txt` and `llms-full.txt` for models, Copy page and Open in Claude or ChatGPT on every page, and the AGENTS.md and CLAUDE.md that `navree new` writes. - [AI SDK](https://navree.com/docs/ai/ai-sdk.md): One `Ai` service for Anthropic, OpenAI, Google Gemini, Mistral, Ollama and AWS Bedrock: text, typed structured output, streaming over SSE or real time, failover between models, token budgets and `AiFake` for tests. - [Agents and tools](https://navree.com/docs/ai/agents-and-tools.md): Agents that call your services through typed `#[tool]` methods, under the signed-in user's permissions, with conversation memory, approvals, streaming, queued runs and `AiFake` tests. - [Embeddings and RAG](https://navree.com/docs/ai/embeddings-and-rag.md): Turn your records into vectors with `Embeddings`, keep them in pgvector, Qdrant or memory with `VectorStore`, index through the queue, and answer questions grounded in your own data, with sources and the user's permissions. - [MCP servers](https://navree.com/docs/ai/mcp-servers.md): Expose your app's tools, resources and prompts to Claude, ChatGPT, Cursor and any MCP client, over streamable HTTP or stdio, with Navree auth or OAuth and per-tool permissions. ## Packages - [Search](https://navree.com/docs/packages/search.md): Full-text and vector search over your entities with `#[derive(Searchable)]`, on PostgreSQL, Meilisearch, Typesense or an embedded Tantivy index, kept in sync through the queue. - [Billing](https://navree.com/docs/packages/billing.md): Subscriptions, trials, seats, metered usage, invoices and the customer portal for users or workspaces, with Stripe or Paddle and verified webhooks processed on the queue. - [Feature flags](https://navree.com/docs/packages/feature-flags.md): Define flags as types with `#[flag]`, turn them on per user, per workspace, by plan or by percentage, check them with `Flags` or `#[requires_flag]`, and store them in your database with a cache in front. - [Settings](https://navree.com/docs/packages/settings.md): Typed settings with `#[derive(Settings)]`, stored for the whole app, an organization, a workspace or a user, inherited field by field, with the source of every value. - [OAuth server](https://navree.com/docs/packages/oauth-server.md): Issue access tokens to third-party apps with OAuth 2.1 and OpenID Connect: authorization code with PKCE, client credentials, device code and refresh grants, scopes mapped to permissions, consent and personal access tokens. - [Social sign-in](https://navree.com/docs/packages/social-sign-in.md): Sign people in with Google, GitHub, Apple, Microsoft, GitLab, Slack, LinkedIn, Discord, X or any OpenID Connect provider, link the accounts to Navree users and issue normal Navree tokens. - [Webhooks](https://navree.com/docs/packages/webhooks.md): Send HMAC-signed webhooks from your events, with queue-backed retries, a delivery log and endpoint management, and verify incoming webhooks from Stripe, GitHub, Paddle, AWS SNS, Google Pub/Sub, Microsoft Graph, Twilio, Slack, Mailgun, Postmark and any Standard Webhooks sender. - [Integrations](https://navree.com/docs/packages/integrations.md): Connect each workspace or organization to Microsoft 365, Google Workspace, Slack, any OAuth 2.0 API or an API key: admin consent, service accounts, encrypted credentials, token refresh, least-privilege scope sets, health checks and typed clients. - [Directory sync](https://navree.com/docs/packages/directory-sync.md): Keep each customer's people in step with their directory: a SCIM 2.0 server for identity providers, and pull connectors for Microsoft Graph, Google Workspace, Okta, LDAP and Active Directory, synced into your model through a sink, in runs with dry runs, a deactivation limit and progress. - [Custom domains](https://navree.com/docs/packages/custom-domains.md): Workspaces on their own domains: DNS verification, automatic TLS through an on-demand proxy or certificates the app gets itself over ACME, the `domain` workspace resolver, managed DNS zones and certificate expiry reports. - [Documents](https://navree.com/docs/packages/documents.md): Render PDF from HTML templates or documents built in code, laid out in process or printed by headless Chrome, in any script, write Word files, merge and stamp PDFs, and queue renders to a storage disk. - [Media](https://navree.com/docs/packages/media.md): Attach files to your models in collections, convert images into thumbnails and responsive variants, download remote files safely, unpack zip archives, extract text from PDF, DOCX and HTML, and process video with FFmpeg. - [Imports and exports](https://navree.com/docs/packages/imports-and-exports.md): CSV and Excel exports from typed rows, streamed or queued to a disk with a signed link, and imports with encoding detection, header mapping, row validation, a staging preview, duplicate handling and error files. - [Workflows](https://navree.com/docs/packages/workflows.md): Durable workflows in code: `#[workflow]` async functions whose steps are stored and replayed, sleeps of minutes or months, event waits with timeouts, versions, cancellation and retries. - [Automations](https://navree.com/docs/packages/automations.md): End-user automations: `#[trigger]`, `#[condition]` and `#[action]` blocks with JSON Schemas for an editor, versioned definitions per workspace, enrollments, simulation and templates. - [Localization](https://navree.com/docs/packages/localization.md): Translate your app with Fluent files and `t!`: plurals and variables, the locale negotiated from the user, the workspace or `Accept-Language`, and translated validation messages, mail and notifications. - [Browser testing](https://navree.com/docs/packages/browser-testing.md): Drive a real Chrome from your Rust tests over the Chrome DevTools Protocol: visit pages, fill forms, press buttons and assert on what a user sees, with automatic waiting and a screenshot on every failure. ## Tools - [Lighthouse](https://navree.com/docs/tools/lighthouse.md): Application monitoring inside your app: exceptions, slow requests and queries, failed jobs and outgoing HTTP, grouped into issues, with alerts, a dashboard, a JSON API and MCP tools for agents. - [Logbook](https://navree.com/docs/tools/logbook.md): A local debugging timeline of every request, query, job, mail, event, cache call and log line, with filters by tag and user, and request replay. - [Fleet](https://navree.com/docs/tools/fleet.md): A queue dashboard and worker supervisor: auto-balanced workers per queue, throughput, wait times and runtimes, failed jobs, pause and continue, and long-wait alerts. - [Helm](https://navree.com/docs/tools/helm.md): An admin panel generated from your entities, with fields, filters, search, actions and metrics checked against the access rules your API already enforces. - [Harbor](https://navree.com/docs/tools/harbor.md): Provision Ubuntu servers over SSH and ship zero-downtime, health-checked releases, with rollbacks, encrypted secrets, several servers, container images and push-to-deploy. - [Dock](https://navree.com/docs/tools/dock.md): Run TimescaleDB (or plain PostgreSQL), Redis, Meilisearch, Mailpit, MinIO and NATS for local development with one command, in Docker or Podman, with your app already pointed at them. ## Testing - [Getting started](https://navree.com/docs/testing/getting-started.md): Test a Navree app the way it runs: `TestApp` boots your modules in-process, with a fresh SQLite database per test, and `cargo test` runs it all. - [HTTP tests](https://navree.com/docs/testing/http-tests.md): Call your API in-process with `TestClient`, act as a signed-in user, and assert on statuses, headers, JSON and errors; plus the CRM's test kit pattern. - [Database tests](https://navree.com/docs/testing/database-tests.md): A fresh SQLite database per test, preparing data with factories, seeders and the API, and asserting on rows, change events and audit entries. - [Fakes](https://navree.com/docs/testing/fakes.md): Replace the edges of your app in tests: the queue, mail, the clock, outgoing HTTP, authentication and file storage, and how to observe events and broadcasts. - [Isolation tests](https://navree.com/docs/testing/isolation-tests.md): Generate cross-workspace tests from a module's route table: reading, changing or deleting another workspace's record is a 404, lists never show it, and creates never land in it. - [Conformity checks](https://navree.com/docs/testing/conformity-checks.md): `navree check` verifies what the compiler can't: every route documented, every entity classified, workspace data reached only through `WorkspaceRepo`, translations and migrations. `navree gate` runs it with fmt, clippy, the tests and the front end in one command. ## Example application - [A tour of the CRM](https://navree.com/docs/example-app/crm-tour.md): The reference CRM built with Navree: feature crates, roles and abilities, the deal pipeline, events, real time, scheduled reminders, its Next.js and Nuxt front ends with their BFF, and the tests. ## Agent skills Step-by-step instructions for coding agents, one per common task. Index: https://navree.com/skills/index.json. - [navree](https://navree.com/skills/navree/SKILL.md): Navree, the complete backend framework for Rust: what it is, how a Navree app is laid out, the rules every change follows, and which navree-* skill to load for each task. - [navree-access-control](https://navree.com/skills/navree-access-control/SKILL.md): Authorization with navree-access: `#[roles]`, `#[permissions]` and `#[can]` route checks, subjects and custom actions, the ability rules in `src/abilities.rs`, record checks with `Authorized`, per-user SQL list filters with `Accessible`, field checks, `AccessService`, the `access:*` commands and testing rules. - [navree-ai](https://navree.com/skills/navree-ai/SKILL.md): Language models in a Navree app with navree-ai: the opt-in `ai` facade feature, `AiModule` and the `ai` config section (providers anthropic, openai and OpenAI-compatible servers, gemini, mistral, ollama, bedrock; named models with fallbacks), the `Ai` service (`ai.text`, `ai.structured::` with a JSON Schema from utoipa's `ToSchema` and `.validated()` garde rules, `ai.stream` as a `TextStream` that is also an SSE response, `chunked`, `on_finish`), attachments, failover and retries, per-user token budgets, metrics, `AiError` statuses, agents (`Agent`, `#[agent]`, `#[tool]`, `#[tool(read_only)]`, `#[tool(needs_approval)]`, `#[can]` / `#[permissions]` / `#[roles]` on tools, `AgentRun`, `ai.agent::()` with `acting_as`, `conversation`, `prompt`, `structured`, `stream`, `approve`, `reject`), conversation memory (`Conversations`, `ai:prune`), `Embeddings`, `VectorStore` (memory, pgvector, Qdrant) with `Filter`s, `Chunker`, `ai.rerank`, `navree make:agent`, and `AiFake` / `FakeReply` / `ai.fake = true` in tests. - [navree-auth](https://navree.com/skills/navree-auth/SKILL.md): Authentication with navree-auth: `AuthModule`, the `/api/auth/*` routes, JWT access tokens and rotating refresh tokens, `CurrentUser`, `AuthService`, account flows (registration, password reset, email verification, profile and password changes), TOTP two-factor and a policy requiring it, sessions and step-up (`#[recent_auth]`), impersonation (`#[not_while_impersonating]`, `Actor`), magic links, emailed codes, passkeys, platform administrators, trusted token exchange, custom strategies such as API keys, the login throttle and tests with real tokens. - [navree-billing](https://navree.com/skills/navree-billing/SKILL.md): Billing with navree-billing (facade feature `billing`, opt-in): `BillingModule` and the `billing` config section (plans, prices, trial days, seats, meters, Stripe and Paddle keys), the `Billable` trait for workspaces, users or your own types, the `Billing` service (checkout builder, `subscription`/`subscribed`, swap, quantity, cancel, resume, pause, trials without a subscription, metered usage, invoices, the customer portal), the `Subscribed` extractor (402), the `/api/billing` routes, signed webhooks (`Stripe-Signature`, `Paddle-Signature`) stored in `billing_events` and processed by the `billing.process_event` job, the billing events, the `billing:*` commands and `BillingFake` (`billing.provider = "fake"`). - [navree-browser-testing](https://navree.com/skills/navree-browser-testing/SKILL.md): Browser tests with navree-browser: `Browser::launch()` / `Browser::builder()` (headless Chrome, Chromium or Edge over the Chrome DevTools Protocol), `Page` actions (`type_into`, `append`, `select`, `check`, `attach`, `press`, `click`, `keys`, `drag`, `scroll_to`, `back`, `refresh`), assertions that wait (`assert_see`, `assert_path_is`, `assert_count`, `assert_no_console_errors`, ...), `wait_for_request`, targets (`#css`, `@testid`, label or button text, `Target::containing/nth`, `within`), failure screenshots under `target/navree-browser//`, `TestServer` (an app on a real port), `FrontEnd`/`WebSession` (a Next.js front end with a BFF pointed at the test's app), `Viewport::phone()`, the `NAVREE_BROWSER_*` variables and `navree browser:install`. - [navree-cache-and-http-client](https://navree.com/skills/navree-cache-and-http-client/SKILL.md): Caching, locks and outgoing HTTP in Navree: `Cache` (`remember`, `flexible`, counters, tags), atomic `Locks`, and `HttpClient` with retries, timeouts, the SSRF policy and `HttpClient::fake()` for tests. - [navree-cli-generators](https://navree.com/skills/navree-cli-generators/SKILL.md): Uses the `navree` CLI: `navree new`, every `make:*` generator with the files it writes and what it registers, the marker comments, `navree dev`, forwarding to the app's own commands, and console commands with `CommandSpec`. - [navree-config](https://navree.com/skills/navree-config/SKILL.md): Configures a Navree app: `.env`, `config/app.toml` and `APP_*` environment variables and their precedence, the application key and its rotation, typed `ConfigSection`s with validation and `Secret`, reading `Config`, custom sources and configuration in tests. - [navree-controllers-and-routing](https://navree.com/skills/navree-controllers-and-routing/SKILL.md): Adds HTTP endpoints to a Navree app: `#[controller]` and route attributes, the `/api` prefix and versions, path and query parameters, extractors, response types, access attributes, throttles, guards, hand-written routes, custom extractors and route tests. - [navree-custom-domains](https://navree.com/skills/navree-custom-domains/SKILL.md): Custom domains with navree-domains: `DomainsModule` and the `domains` config section, `Domains::add` with `NewDomain` and the DNS records it returns (TXT at `_domain-verification.`, CNAME to `domains.target`, A/AAAA for apex domains), verification (`verify`, `verify_due`, `domains:verify --due`, giving up, rechecks), the `domain` workspace resolver (`workspace.resolvers = ["domain", ...]`, `DomainWorkspace`) and the `CurrentDomain` extractor, automatic TLS (`tls = "on_demand"` with the ask endpoint `/_domains/allow` and Harbor's `[web.custom_domains]`, or `tls = "acme"` with `InstantAcme`, HTTP-01 answers, sealed keys, `DomainCertificates` and `HttpsServer`), managed Cloudflare zones, certificate expiry reports (`domains:certificates`, `DomainCertificateExpiring`, Lighthouse), the `/api/domains` routes, and tests with `DnsFake`, `AcmeFake`, `ProbeFake` and `DnsProviderFake`. - [navree-database](https://navree.com/skills/navree-database/SKILL.md): Works with the database layer of a Navree app: the `database` configuration and its databases (TimescaleDB by default, PostgreSQL, MySQL/MariaDB, SQLite), the per-request unit of work (`Uow`), transactions in jobs and commands, SeaORM entities with UUID v7 keys and `Repo` writes with change events, seeders and `db:seed`, `navree::db::paginate`, soft deletes by hand, and TimescaleDB hypertables. - [navree-deployment](https://navree.com/skills/navree-deployment/SKILL.md): Deploys a Navree app: the release build, what to copy, production settings (APP_KEY, migrations, trusted proxies, metrics token), running `serve`, `queue:work` and `schedule:work` under systemd, migrations as a deploy step, nginx in front, health checks and containers. - [navree-directory](https://navree.com/skills/navree-directory/SKILL.md): Directory sync with navree-directory: `DirectoryModule` and the `directory` config section, connections per workspace or organization (`scim`, `microsoft` with Graph delta queries, `google`, `okta` through navree-integrations' scope set `directory`, `ldap` for LDAP and Active Directory, or a `DirectorySource` of your own), the SCIM 2.0 server at `/scim/v2` (bearer token per connection, filters, PATCH), `impl DirectorySink` to map `DirectoryUser`/`DirectoryGroup` into your model, sync runs (`Directory::sync`, `sync_now`, dry runs, the deactivation limit and `approve`, partial runs, operations), the events, `/api/directory/*` routes, `directory:sync` and `directory:runs`, and tests with `Directory::fake()`/`DirectoryFake`, wiremock or an LDAP server. - [navree-dock](https://navree.com/skills/navree-dock/SKILL.md): Runs a Navree app's local services with Dock: `dock.toml`, `navree dock:add`, `navree dock up/down/status/logs/env/shell`, `navree dock:remove`, the settings Dock gives the app (`APP_DATABASE__URL`, `APP_MAIL__TRANSPORT`, `REDIS_URL`, ...), the `.env` block, Docker or Podman (`NAVREE_DOCK_RUNTIME`) and CI. - [navree-documents](https://navree.com/skills/navree-documents/SKILL.md): PDF and Word documents with navree-documents: the opt-in `documents` facade feature, `DocumentsModule` and the `documents` config section, `Documents::pdf(name, &data)` and `render(&Render)`, `.html` templates (navree-view syntax, `locale`/`dir` variables) for two engines: the native engine (default, in process: the HTML subset it reads, inline styles, `@page`, `header`/`footer` elements with `pageNumber`/`totalPages` spans, tables with repeating headers, images from the template tree, bundled Noto Sans/Serif/Mono, Arabic, Hebrew and Devanagari fonts, font dirs, tagged PDF) and headless Chrome (full CSS, assets from the template tree, `/_navree/fonts.css`, blocked network, the page pool, `documents.chrome.path`/`endpoint`, `NAVREE_BROWSER_CHROME`), `PrintOptions` for both, `PdfDocument` built in code and `render_document`, engine choice (`documents.engine`, `Render::engine`), right-to-left text, `Pdf` responses and `download`/`inline`, `Pdf::merge`, `stamp`, `overlay`, `text()` in tests, `Docx`, `save`, `queue` with `QueuedDocument` and `status`, `queue_operation` (a queued export behind a navree-queue operation users follow, `RENDER_FAILED_MESSAGE`), the `documents.render` job, its progress and its `.failed` record, `m.document_files`, the `documents:render` and `documents:fonts` commands, and `DocumentsFake`. - [navree-errors-and-responses](https://navree.com/skills/navree-errors-and-responses/SKILL.md): Returns errors and responses the Navree way: `AppError` constructors, the `{statusCode, message, error, code, errors}` JSON shape, machine-readable error codes (`with_code`, `navree::http::codes`, `http.errors.code`) that front ends translate, `?` and 500s, `map_error` for your own error types, database error mapping, status codes, headers, downloads, streaming and API resources with `__type`. - [navree-events-and-broadcasting](https://navree.com/skills/navree-events-and-broadcasting/SKILL.md): Events and real time in Navree: typed events on the `EventBus`, sync and queued listeners, delivery and transactions, and the Pusher-protocol WebSocket server (`RealtimeModule`) with private and presence channels, channel authorizers, `dyn Broadcaster`, the relay for workers and Pusher JavaScript clients. - [navree-flags](https://navree.com/skills/navree-flags/SKILL.md): Feature flags with navree-flags: the opt-in `flags` facade feature, `FlagsModule` and the `flags` config section, flags as types with `#[flag]` (`name`, `default`, `expose`) registered with `FlagsModule::for_feature::()` or `m.flag::()`, checks with `CurrentFlags`, `Arc` and `FlagScope` (user, workspace, both, everyone), `#[requires_flag(F)]` on routes (404, or 403 with `status = 403`), overrides, the global state, percentage rollouts with stable buckets, rollouts by plan through a `dyn PlanResolver`, the kill switch, `GET /api/flags` for the front end, `/api/admin/flags` (`flags.manage`), the `flags:*` commands, caching, `flag.changed` events and audit entries, and `FlagsFake` / `flags.store = "memory"` in tests. - [navree-fleet](https://navree.com/skills/navree-fleet/SKILL.md): Queue workers under Fleet with navree-fleet (facade feature `fleet`, in `full`): `FleetModule` and the `fleet` config section (supervisors with queues, `balance = auto|simple|off`, min/max processes, concurrency, recycling limits `max_jobs`/`max_memory_mb`/`max_time_secs`, `fleet.only`, `fleet.long_wait`, snapshots and trimming), the `fleet` master command and its `fleet:work` child processes, `fleet:status`/`fleet:pause`/`fleet:continue`/`fleet:terminate`/`fleet:forget`, the `Fleet` service (pause/resume, masters, status, workload, long_waits, failed jobs retry/retry_all/forget, pending and completed jobs, metrics), the `/_fleet` dashboard and its API behind the `Fleet` abilities `view`/`operate` (`fleet.view`, `fleet.operate`), the `fleet_*` gauges on `/metrics`, `LongWaitDetected`, and testing with `FakeSpawner`, `InProcessSpawner` and `next_allocation`. - [navree-frontend-next](https://navree.com/skills/navree-frontend-next/SKILL.md): Build a Next.js front end on a Navree API with the @navree packages: `@navree/next` (route handlers that keep Navree's access and rotating refresh tokens in httpOnly cookies, `auth()` and `client()` in server components, the proxy that guards pages and refreshes tokens, `DataTable` and `useListQuery`, `useOperation`, workspaces, `AbilityProvider`/``, `RealtimeProvider`/`useChannel`), `@navree/client` (the typed client generated with `navree openapi:client`, `NavreeError` with error codes, list queries, query keys) and `@navree/theme` (navree.com's dark theme for Tailwind 4 and shadcn/ui). - [navree-frontend-nuxt](https://navree.com/skills/navree-frontend-nuxt/SKILL.md): Build a Nuxt (3.13+ or 4) front end on a Navree API with the `@navree/nuxt` module: the backend-for-frontend as Nitro routes (httpOnly token cookies, single-flight refresh, two-factor sign-in, CSRF, `/broadcasting/auth`), a session gate that guards pages and refreshes tokens before server rendering, and auto-imported `useNavreeAuth`, `useWorkspace`, `useNavreeClient`, `useListQuery`, `useOperation`, `useChannel`, `useAbility`, `` and ``; with `@navree/client` (the typed client from `navree openapi:client`, `NavreeError` with codes) and `@navree/theme` (navree.com's dark theme for Tailwind 4 and shadcn-vue). - [navree-graphql](https://navree.com/skills/navree-graphql/SKILL.md): GraphQL with navree-graphql (facade feature `graphql`, opt-in): `GraphqlModule` and the `graphql` config section, `#[resolver]` impl blocks with `#[query]`, `#[mutation]` and `#[subscription]` fields, access attributes on fields (`#[public]`, `#[authenticated]`, `#[roles]`, `#[permissions]`, `#[can(.., from = "id")]`), `ContextExt` (`ctx.uow()`, `ctx.principal()`, `ctx.authorized`, `ctx.accessible`, `ctx.loader`), `Valid` arguments, per-request dataloaders, subscriptions over WebSockets with `EventStream`, errors with `extensions.code`, GraphiQL, depth and complexity limits and `graphql:schema --check`. - [navree-grpc](https://navree.com/skills/navree-grpc/SKILL.md): gRPC with navree-grpc: `GrpcModule` and the `grpc` config section, `.proto` code generation in `build.rs` without a system protoc (protox + tonic-prost-build `compile_fds`), `#[grpc_service(server = XServer)]` on a tonic service impl with Navree extractors (`Uow`, `CurrentPrincipal`, `Authorized`, `Accessible`, `CurrentWorkspace`) and `Valid>`, access attributes and guards on methods (deny by default), interceptors, `m.grpc_service::()` and `m.grpc_descriptors(..)`, the AppError to gRPC status mapping (`status_from_error`, `error_from_status`), streaming, deadlines, gRPC-Web and Connect (JSON and protobuf) on the HTTP port or `grpc.addr`, health and reflection, `GrpcChannels` clients (`grpc.clients.`), and `TestChannel` tests. - [navree-harbor](https://navree.com/skills/navree-harbor/SKILL.md): Deploys a Navree app to Ubuntu servers with Harbor: `harbor.toml` (servers, roles, processes, `[env]`, encrypted `[secrets]`), `navree harbor:init`, `navree harbor:provision` (Caddy with TLS, PostgreSQL, Redis, ufw, the `navree` user, systemd units), `navree deploy` (build, upload, migrate, blue-green switch after a health check, automatic revert, pruning), `navree deploy:rollback`, `navree harbor:secrets`, environments (`--env`, `NAVREE_HARBOR_ENV`), several servers, a front end, `navree build:image` and `navree harbor:ci github`. - [navree-helm](https://navree.com/skills/navree-helm/SKILL.md): Helm, the admin panel of navree-helm: the `helm` facade feature (in `full`), `HelmModule` and the `helm` config section, `navree make:resource `, the `Resource` trait (LABEL, SINGULAR, GROUP, ICON, TITLE, SEARCH, SLUG, PER_PAGE, DEFAULT_SORT, ORDER, fields, filters, actions, metrics, query, create, update, delete), `Field`, `Filter`, `Action` / `ActionContext` / `ActionResult`, `Metric`, `HelmPage` and `m.helm_page(..)`, `SaveContext` and `FormData::parse`, file fields on storage disks, the access rules every screen checks (`helm.view`, then read, create, update, delete and action abilities on each record and field), the audit entries, sign-in, CSRF and the strict CSP, and testing through `/admin/api`. - [navree-i18n](https://navree.com/skills/navree-i18n/SKILL.md): Localization with navree-i18n: the opt-in `i18n` facade feature, `I18nModule` and the `i18n` config section (`default_locale`, `locales`, `dir`, `negotiation`, `query_param`, `cookie`, `missing`, `reload`, `bidi_isolation`, `routes`), Fluent files in `locales//*.ftl` (plurals, variables, terms, attributes, `NUMBER()`, `DATETIME()`), `embed_locales!`, `t!` and `args!`, `Money` arguments, the `Locale` extractor and `Locale::scope`/`Locale::current`, the `I18n` service (`t`, `has`, `locales`, saved user and workspace locales), negotiation from the query, the user, the workspace, a cookie and `Accept-Language`, `PUT /api/me/locale` and `GET /api/i18n/locales`, translated validation messages (`validation-`, `field-`, seven shipped languages), `t()`/`locale()` and locale-aware `money`/`date` in templates, notifications in the recipient's locale, and `i18n:check`, `i18n:missing`, `i18n:publish validation`. - [navree-inbound-mail](https://navree.com/skills/navree-inbound-mail/SKILL.md): Receives mail in a Navree app: mailboxes routed by address (`m.mailbox("reply+{token}@in.acme.test", handler)`, `mailbox_with::`), `InboundMail` (headers, bodies, attachments, forwarded messages, `reply_text`, `is_auto_reply`), signed reply addresses (`ReplyTokens`), raw `.eml` files on a storage disk, the SES, Mailgun, Postmark and raw MIME sources under `/api/mail/inbound`, Microsoft 365 and Gmail mailboxes watched through integration connections (`MailboxWatches`), `InboundMailReceived`, and `MailFake::receive` in tests. - [navree-integrations](https://navree.com/skills/navree-integrations/SKILL.md): Workspace and organization connections to third-party APIs with navree-integrations: `IntegrationsModule` and the `integrations` config section, providers (`microsoft` admin consent and app-only Graph tokens, `google` service accounts with domain-wide delegation, `slack` installs, any `oauth2` API, `api_key`), the `/api/integrations/*` routes, scope sets (`ScopeSet`, `for_feature`, per-scope-set app registrations), the `Integrations` service, typed clients (`GraphClient`, `GoogleClient`, `SlackClient`, `IntegrationClient`) and the `Connection` extractor, token refresh under a lock, `integrations:check` health checks and `ConnectionUnhealthy`, and tests with `Integrations::fake()`/`IntegrationsFake` or wiremock. - [navree-jose](https://navree.com/skills/navree-jose/SKILL.md): JSON Web Signatures and JSON Web Keys with `navree::crypto::jose` (crate navree-crypto, facade feature `crypto`, in `full`): `SigningKey` (`from_pem` for PKCS#8, PKCS#1 and SEC 1 keys such as Apple `.p8` files, `from_jwk`, `hmac`, `generate_ed25519`, `generate_es256`, `with_kid`, `with_thumbprint_kid`, `with_algorithm`, `sign_jwt`, `sign_json`, `sign_jws`, `to_pkcs8_pem`, `public_jwk`), `VerifyingKey` (`from_pem`, `from_certificate_der`, `from_jwk`, `rsa`, `ec`, `ed25519`, `hmac`, `verify_der`, `verify_legacy_sha1`), `Jws::parse`, `verify`, `verify_with(&JwkSet)` and `claims::()`, `Jwk` and `JwkSet` (thumbprints, `to_public`), the algorithms HS256/384/512, EdDSA, ES256/384, RS256/384/512 and PS256/384/512, and `JoseError`. - [navree-lighthouse](https://navree.com/skills/navree-lighthouse/SKILL.md): Application monitoring with navree-lighthouse: the `lighthouse` facade feature (in `full`), `LighthouseModule::from_config()` / `for_root(LighthouseOptions)` and the `lighthouse` config section, what it records through its telemetry sink (5xx and panics, slow requests and queries, failed jobs and scheduled tasks, failing outgoing calls), issues grouped by fingerprint with statuses (open, resolved, resolved in the next release, ignored), reporting handled errors with `Arc` (`report`, `capture(Report::..)`, `tag_current`), sampling and the buffer, alerts (email, Slack, signed Standard Webhooks, your own `AlertChannel` via `m.alert_channel::()`, `lighthouse.alert` jobs, cooldown, spikes, `raise_alert`), the `/_lighthouse` dashboard and its sign-in, the JSON API under `/_lighthouse/api` behind the `view` and `resolve` abilities (`lighthouse.view`, `lighthouse.resolve`), MCP tools for agents (`lighthouse_list_issues`, `lighthouse_get_issue`, `lighthouse_resolve_issue`, ..., the resource `lighthouse://issues/{id}` and the prompt `fix-lighthouse-issue`, with the `mcp` feature and `McpModule`), `lighthouse:prune` and `lighthouse:test-alerts`, a separate database, and `LighthouseFake` in tests. - [navree-logbook](https://navree.com/skills/navree-logbook/SKILL.md): Debug a Navree app locally with navree-logbook: `LogbookModule` and the `logbook` config section, the timeline UI at `/_logbook`, watchers (requests with headers and bodies, queries, jobs, mail, events, cache, logs, exceptions, outgoing HTTP, notifications, data changes, scheduled tasks), the filter language (`user:`, `tag:`, `status:4xx`, `route:`, `type:`, `slow`, `failed`, `duration>200`, `batch:`, `trace:`), `Logbook::tag` and `Logbook::dump`, duplicate-query (N+1) detection, request replay as the same user, `logbook:clear`, and the test API (`last_request().queries()`, `duplicate_queries()`). - [navree-mail-and-notifications](https://navree.com/skills/navree-mail-and-notifications/SKILL.md): Sends email and notifications from a Navree app: mail transports (SMTP, SES, Mailgun, Postmark, Resend, log, array, failover), MiniJinja mail templates with CSS inlined and a generated text body, `TemplateMail`, `Mailable` and queued mail, and notifications over the database, mail and broadcast channels with `/api/notifications`. - [navree-mail-delivery](https://navree.com/skills/navree-mail-delivery/SKILL.md): Delivers mail for a multi-tenant Navree app: the SES, Mailgun, Postmark and Resend transports, named transports (`mailer.via`), transports per sending domain, workspace and organization (`TransportResolver`, `mailer.for_scope`), the delivery log fed by provider webhooks (`Deliveries`, `MailBounced`), suppressions, mail held for approval (`Outbox`), open and click tracking, DKIM signing and SPF/DKIM/DMARC checks (`mail:domains`). - [navree-mcp](https://navree.com/skills/navree-mcp/SKILL.md): Adds an MCP server to a Navree app with navree-mcp: `McpModule` and the `mcp.*` keys, `#[mcp_server]` with `#[mcp_tool]`, `#[mcp_resource]` and `#[mcp_prompt]`, typed and validated arguments (`Deserialize` + utoipa `ToSchema` + garde `Validate`), per-item access attributes, `McpContext`, `McpNotifier`, streamable HTTP at `/mcp`, stdio with `mcp:serve --user`, bearer or OAuth (RFC 9728) auth, and `McpTestClient`. - [navree-media](https://navree.com/skills/navree-media/SKILL.md): Files attached to models with navree-media: the opt-in `media` facade feature (and `media-ffmpeg`), `MediaModule` and the `media` config section, `impl HasMedia` (`MEDIA_TYPE`, `MEDIA_TABLE`, `media_key`, `media_collections`), collections (`single_file`, `only_keep_latest`, `accepts`, `max_size`, `disk`, `conversions_disk`), `MediaModule::for_feature::()` / `m.media_model::()`, `Media::add(&model, collection, MediaSource)` with `bytes`/`url`/`disk`/`file` sources and `PendingMedia::save(&uow)`, the `media` table (`MediaRecord`, a navree-orm model) and `MediaItem`, `resource()` with URLs and `srcset`s, `get`/`first`/`all`/`list(MediaQuery)`, `save`/`reorder`/`delete`/`clear`/`delete_all` and deleting with the model, `Conversion` (fit, format, quality, greyscale, blur, responsive, nonqueued, frame_at, transcode), the `media.conversions` job (`GenerateConversions`), `media:regenerate` and `queue_regenerate`, metadata stripping, `images::{convert, probe, strip_metadata, rasterize_svg}`, remote files through the SSRF guard, `archive::{Archive, ArchiveLimits, ZipBuilder}` and `unpack`, `text::extract` for PDF/DOCX/HTML, video and audio through FFmpeg (`Transcode`, `Ffmpeg`, `FfmpegFake`), `MediaError` codes, and `MediaFake`. - [navree-microservices](https://navree.com/skills/navree-microservices/SKILL.md): Messages and events between services with navree-micro: `MicroModule` (`for_root(Transport::..)`, `from_config()`, the `micro` config section and `APP_MICRO__*`), `#[message_handlers]` with `#[message_pattern]` (request-response; options `dedupe`, `concurrency`) and `#[event_pattern]` (options `max_attempts`, `ordered`, `broadcast`, `concurrency`), `m.message_handlers::()`, `m.forward_event::()` / `forward_event_keyed` / `receive_event`, extractors `Payload`, `Valid>`, `MessageContext` plus every request extractor (`Uow`, `CurrentPrincipal`, `Authorized`, ...), access attributes and guards (deny by default), `ServiceClient::send` (timeout, retries, bearer, without_auth, header) and `emit` (key, header, immediately), `MicroError` and its HTTP mapping, the outbox, the inbox, retries, dead letters (`DeadLetters`, `micro:failed`, `micro:retry`, `micro:flush`), the TCP, memory, NATS, Kafka, RabbitMQ, Redis Streams and MQTT transports (features `micro`, `micro-nats`, `micro-kafka`, `micro-rabbitmq`, `micro-redis`, `micro-mqtt`), hybrid `serve` and `micro:listen`, named clients, trace context, a custom `MicroTransport` and the conformance suite, and `MicroFake` tests. - [navree-migrations](https://navree.com/skills/navree-migrations/SKILL.md): Writes and runs database migrations in a Navree app with the schema builder (`navree::schema`): `navree make:migration`, `schema.create` and `schema.table` blueprints, column types and modifiers per database, indexes and foreign keys, changing, renaming and dropping columns, SQLite table rebuilds, module-owned `MigrationSet`s and their order, transactions and `within_transaction`, `migrate` with `--pretend` and `--step`, `migrate:status`, rollbacks, `migrate:refresh` and `migrate:fresh`, the production guard, `Migrator` in tests, and squashing with `schema:dump`. - [navree-module-conformity](https://navree.com/skills/navree-module-conformity/SKILL.md): Audits a Navree module or app for conformity and tenant isolation: `navree check` (module graph, then `conformity:check`: `api.docs` with `api.require_docs` and `api.undocumented`, `workspace.entities`, `workspace.repo` with the `navree:allow(workspace-repo)` marker, `workspace.tables`, `i18n.translations`, `db.migrations`), `TestApp::isolation_suite::()` cross-workspace tests from a module's route table and factories (`IsolationSuiteExt::factory`, `.record`, `.body`, `.skip`, `Tenancy`), custom checks with `ConformityCheck`, and `navree gate` (fmt, clippy, tests, check and the front end under a machine lock). - [navree-modules-and-di](https://navree.com/skills/navree-modules-and-di/SKILL.md): Structures Navree code into modules wired by dependency injection: `#[module]` keys, `#[injectable]` providers and scopes, values, trait objects, factories, named and lazy providers, configurable modules (`for_root`, `from_config`, `for_feature`) and the boot-time graph errors. - [navree-navigator](https://navree.com/skills/navree-navigator/SKILL.md): Uses Navigator, Navree's MCP server for coding agents (`navree mcp`), and installs the Navree agent skills (`navree skills:install`). - [navree-new-app](https://navree.com/skills/navree-new-app/SKILL.md): Creates and runs a new Navree app: installing the navree CLI, `navree new` and its options (`--database`, TimescaleDB by default), the starter kits (`--kit saas|api|micro`: a multi-tenant SaaS with a Next.js front end, the same API alone, or a microservice workspace), starting the database with `navree dock up`, APP_KEY, `navree dev`, the generated files, the first feature module and adding Navree to an existing Cargo package. - [navree-notification-channels](https://navree.com/skills/navree-notification-channels/SKILL.md): Sends Navree notifications over Slack (webhooks, bot tokens), Microsoft Teams (webhooks, proactive bot messages), SMS (Twilio, Vonage, Amazon SNS), WhatsApp (Twilio, the WhatsApp Cloud API) and browser push (VAPID): `route_*` on the notifiable, `to_*` on the notification, the `notify.*` driver tables, E.164 numbers, STOP opt-outs (`OptOuts`), push subscriptions (`notify:vapid`, `/api/notifications/push-subscriptions`), the delivery log (`notification_deliveries`, `DeliveryLog`), provider callbacks (`/api/webhooks/notify/*`), connection tokens from integrations and the channel fakes. - [navree-notification-preferences](https://navree.com/skills/navree-notification-preferences/SKILL.md): Lets people and workspaces choose which Navree notifications reach them and when: categories (`#[notification(category = .., digest = .., urgent)]`, `NotifyModule::for_feature`), channel switches per category in `Preferences` (`NotificationPreferences`, `GET`/`PATCH /api/notifications/preferences` and `/workspace`), required categories, digests that batch mail (hourly, daily, weekly at 09:00 on the recipient's clock), quiet hours, send windows (`Notification::send_window`), held deliveries (`notification_deferrals`, `notify:release`), the recipient's zone and workspace (`Notifiable::time_zone`, `workspace_id`) and per-workspace mail templates and style (`notification-templates` settings, `TemplateOverrides`). - [navree-oauth](https://navree.com/skills/navree-oauth/SKILL.md): The OAuth 2.1 / OpenID Connect server of navree-oauth: `OAuthServerModule` and the `oauth` config section (scopes mapped to permission strings, `consent_url`, `device_url`, TTLs, Ed25519 signing keys), clients (`OAuthClients`, `NewClient`, `navree oauth:client`), the authorization code flow with PKCE and the consent API your front end calls, client credentials, device and refresh grants, `OAuthToken` in handlers, `insufficient_scope`, personal access tokens (`PersonalAccessTokens`), introspection, revocation, discovery, JWKS, userinfo, dynamic registration and `navree_oauth::testing`. - [navree-openapi](https://navree.com/skills/navree-openapi/SKILL.md): Documents a Navree API with the OpenAPI 3.1 document generated at boot: `ApiModule`, `#[api(..)]` on routes, utoipa `ToSchema` resources, page schemas, `m.api_schema`, the schema boot errors, `openapi:export` and typed clients. - [navree-orm](https://navree.com/skills/navree-orm/SKILL.md): Works with data through Navree's ORM (`navree::orm`): `#[derive(Model)]` models with typed column constants, the query builder, records with dirty tracking (`create`, `save`, `delete`), `#[relations]` and eager loading with `with(..)`, `#[scopes]`, soft deletes, casts and accessors, serialization, model events and observers, pagination and streams, mass assignment, factories, `#[navree::test]` databases and assertions, route model binding (`Bound`), workspace-scoped models and access-control subjects, and MongoDB models. - [navree-performance](https://navree.com/skills/navree-performance/SKILL.md): Make a Navree app faster per request, or check that a change didn't make it slower: the request-pipeline benchmarks (`cargo bench -p navree --bench pipeline`), the `database` pool settings (`test_before_acquire`, `idle_timeout_secs`, `max_lifetime_secs`, `max_connections`) and `database.transaction_settings`, what the fixed HTTP layers cost and when they merge into one middleware, which modules make `Repo` writes serialize change events, reading through the pool instead of a transaction, and the service locator in hot paths. - [navree-queues-and-scheduling](https://navree.com/skills/navree-queues-and-scheduling/SKILL.md): Background work in Navree: `Job` types, registering and dispatching jobs, job options (retries, backoff, timeouts, unique jobs), jobs inside transactions, `queue:work` and failed jobs, job batches with `then`/`catch`/`finally`, job progress, operations (user-visible long work with an SSE stream, a private channel, cancel and a watchdog), `QueueFake`, and cron-style schedules with `m.schedule` run by `schedule:work` or `schedule:run`. - [navree-redis](https://navree.com/skills/navree-redis/SKILL.md): Redis with navree-redis: `RedisModule` and the `redis` config section (`url`, `prefix`, `connect_timeout_ms`, `response_timeout_ms`, `connections..url`, `APP_REDIS__URL`, the `REDIS_URL` fallback), the `Redis` connections (`manager()`, `key()`, `named()`, `dedicated()`, `pubsub()`), the Redis drivers selected by name (`cache.store = "redis"`, `queue.driver = "redis"`, `session.store = "redis"`, `realtime.backplane = "redis"`), shared rate limits with `RateLimiter::hit`, the `redis` health check, key layout and production settings (eviction, persistence). - [navree-search](https://navree.com/skills/navree-search/SKILL.md): Full-text and vector search with navree-search: `SearchModule` and the `search` config section, `#[derive(Searchable)]` (or a hand-written `Searchable` with related data), engines (`postgres` with SQLite FTS5 in tests, `meilisearch`, `typesense`, `tantivy`, `memory`), syncing through the queue (`search.sync` queued/inline/off, the `search.sync` job `SyncDocuments`, `reindex`, `without_syncing`), the `Search` service and query builder (filters, ranges, sorts, `accessible`, `workspace`, `paginate`, `hits` and highlights, `across`), vectors (`#[searchable(embed)]`, `Embeddings`, pgvector/Qdrant/memory, `similar`, `similar_to`, `hybrid`), the `search:import`/`flush`/`settings`/`status` commands and test helpers. - [navree-security-checklist](https://navree.com/skills/navree-security-checklist/SKILL.md): A pre-release security review for Navree apps covering deny-by-default routes, abilities and list filters, validation, tokens, rate limits and trusted proxies, CORS and security headers, CSRF for cookie sessions, secrets and APP_KEY, the audit log, uploads, SSRF and operations, with the commands that check each item. - [navree-settings](https://navree.com/skills/navree-settings/SKILL.md): Typed settings with inheritance in navree-settings: the `settings` facade feature (in `full`), `SettingsModule` and the `settings` config section, settings types with `#[derive(Settings)]` (`key`, `scopes(global, organization, workspace, user)`, `permission`, `read_permission`) registered with `SettingsModule::for_feature::()` or `m.settings::()`, `Scope`, resolution field by field down global → organization → workspace → user with a `Source` per field, `Resolved`, the `Setting` extractor, `Settings::update` (garde-validated, errors by field), `inherit` and `reset` in a unit of work, `settings.updated` audit entries and `settings.changed` events, cache tags per key and level, `GET`/`PATCH`/`DELETE /api/settings/{key}?scope=` with `{data, sources, overridden}`, the `settings:*` commands, the Helm Settings screens, and `SettingsFake` / `settings.store = "memory"` in tests. - [navree-sheets](https://navree.com/skills/navree-sheets/SKILL.md): CSV and Excel imports and exports with navree-sheets: the `sheets` facade feature (in `full`), `SheetsModule` and the `sheets` config section (`sheets.csv`, `sheets.exports`, `sheets.imports`), export rows with `#[derive(Exportable)]` (`sheet`, `header`, `format`, `width`, `with`, `skip`), `Cell` and `IntoCell`, `Download::csv`/`csv_stream`/`xlsx` (byte-order mark, formula escaping, typed XLSX cells), the `Exports` service, translated headers (`HeaderCatalog`, `HeaderTranslator`, Fluent with `i18n`), named exports (`Export`, `m.export::()`, `GET`/`POST /api/exports/{name}`, queued to a disk with a signed link through an operation), import rows with `#[derive(Deserialize, Validate, Importable)]` (`header`, `aliases`, `required`, `optional`, `skip`), importers (`Import`, `m.importer::()`, `key`, `existing`, `insert`, `update`, `completed`, `RowRejected`), uploads (`POST /api/imports`, `Imports::upload`, `Upload`, `UploadOptions`), encoding detection (UTF-16, Windows-1256, Shift_JIS), CSV, TSV, XLSX, XLS and ODS reading, header mapping (automatic, saved, chosen; `needs_mapping`, `PUT /api/imports/{id}/mapping`), the staging preview (`import_rows`, `GET /api/imports/{id}/rows`), `DuplicateMode` skip/update/fail, batched apply with progress, error files, templates, `sheets:prune`, and tests with the memory queue and disk. - [navree-social](https://navree.com/skills/navree-social/SKILL.md): Social sign-in with navree-social: `SocialModule` and the `social` config section, providers (google, github, apple, microsoft, gitlab, slack, linkedin, discord, x, any `oidc` issuer, `custom` via `SocialProvider`), the `/api/auth/social/*` routes, the `Social` service (`redirect`, `user`, `sign_in`, `link`, `unlink`, `accounts`, `token`), linked accounts and `link_by_email`, two-factor on social sign-ins, stored provider tokens, and tests with `Social::fake()`/`SocialFake` or a wiremock provider. - [navree-sso](https://navree.com/skills/navree-sso/SKILL.md): Enterprise single sign-on with navree-sso: `SsoModule` and the `sso` config section, SAML 2.0 and OpenID Connect connections owned by the app, an organization or a workspace (`SsoOwner`), verified email domains (DNS TXT) with `POST /api/sso/discover` and password enforcement (`sso_required`), just-in-time provisioning with group to role mapping (`Provisioning`, `RoleRule`, `SsoUserProvisioned`), the `/api/sso/*` routes and the `sso.manage` management routes, the `Sso` service, `complete_url` and the one-time code exchange, and tests with `SsoFake` and `StaticTxtResolver`. - [navree-storage](https://navree.com/skills/navree-storage/SKILL.md): Stores and serves files in a Navree app with `StorageModule`: named disks (local, memory, S3 and S3-compatible stores such as MinIO, Cloudflare R2 and DigitalOcean Spaces, Google Cloud Storage, Azure), reading, writing and streaming files, multipart uploads checked by content with `store_upload`, direct browser uploads with `presigned_put` and `accept_upload`, public and signed temporary URLs, and copying files between disks with `storage:sync`. - [navree-telemetry](https://navree.com/skills/navree-telemetry/SKILL.md): Telemetry events and tracing with navree-telemetry and navree-observe: the typed events every module emits (`RequestHandled`, `QueryExecuted`, `JobProcessed`, `JobFailed`, `ScheduledTaskRan`, `MailSent`, `NotificationSent`, `CacheEvent`, `HttpClientRequest`, `ExceptionReported`, `LogRecord`), sinks (`TelemetrySink`, `Interest`, `m.telemetry_sink::()`), the zero-cost rule, `Telemetry::current().report_exception`, `TelemetryContext` (request and job context, `propagate` for spawned tasks), W3C `traceparent` in and out, the `observe.tracing` section, OTLP export behind the opt-in `otel` feature, `current_trace_id`, and `TelemetryRecorder` / `SpanRecorder` in tests. - [navree-testing](https://navree.com/skills/navree-testing/SKILL.md): Tests Navree apps in-process with `navree::testing`: `TestApp` with a fresh SQLite database per test, `TestClient` requests, `acting_as`, response assertions, booting the whole app, database assertions and the fakes (queue, mail, clock, outgoing HTTP, storage, broadcasts). - [navree-time-zones](https://navree.com/skills/navree-time-zones/SKILL.md): Counts dates, reports and messages on the clock of the person or workspace they are for, with `TimeModule` (navree-time): checked IANA `Zone`s with PostgreSQL-safe names, the request's zone (`CurrentZone`: user, workspace, organization, default), `LocalDay` and `DayRange` turned into UTC bounds, `WithZone` responses, `SendWindow` working hours with weekends and `Holidays`, `AT TIME ZONE` SQL with a checked zone, schedules with `in_zone` and `per_workspace_local`, workspace and organization `timezone`/`country`, `ZonesFake` in tests. - [navree-validation](https://navree.com/skills/navree-validation/SKILL.md): Validates request input in Navree with garde DTOs and the `Valid` and `ValidAsync` extractors, including Navree's extra rules, required fields, nested data, database `unique`/`exists` rules, international input (E.164 `Phone`, sanitized `SafeHtml` rich text, names in any script, native digits with `Folded`, `Country`, `Locale`), custom rules and messages, manual `ValidationErrors` and the 400 response shape. - [navree-webhooks](https://navree.com/skills/navree-webhooks/SKILL.md): Webhooks with navree-webhooks: `WebhooksModule` and the `webhooks` config section, outgoing webhooks from events (`WebhookEvent`, `WebhooksModule::for_feature::()`, `m.webhook_type`, `Webhooks::dispatch_json`), endpoints and secrets (`create_endpoint`, `rotate_secret`, `whsec_` secrets), Standard Webhooks signing (`webhook-id`, `webhook-timestamp`, `webhook-signature`), the retry schedule, disabling failing endpoints, the delivery log and the `/api/webhooks` routes, and incoming webhooks verified with `VerifiedWebhook` (`Stripe`, `GitHub`, `Paddle`, `StandardWebhooks`, `AwsSns`, `GooglePubSub`, `MicrosoftGraph`, `Twilio`, `Slack`, `Mailgun`, `Postmark`, `Vonage`, `Meta`, `Hmac`, custom `WebhookVerifier`s with `verify_incoming`, handshakes, `mark_processed`). - [navree-workflows](https://navree.com/skills/navree-workflows/SKILL.md): Durable workflows and end-user automations with navree-workflows: the `workflows` facade feature (in `full`), `WorkflowsModule` and the `workflows` config section (`store`, `lease_secs`, `queue`, `routes`, `automations`, `automation_routes`, `prune_after_days`), `#[workflow]` async functions on an input type (`name`, `version`, `min_version`), `WorkflowCtx` (`step`, `step_with` and `StepOptions` retries, `sleep`, `sleep_until`, `wait_for::` with `EventMatch` and timeouts, `now`, `version`), `m.workflow::()`, `WorkflowsModule::for_feature::()`, `m.workflow_event::()`, `Workflows::start`/`start_with`/`spawn` with `StartOptions` (key, workspace, delay), run statuses, replay rules, leases and takeovers, the `workflows.run` job and `workflows:tick`, versions, cancel and retry, `/api/workflows`, `workflows:*` commands, `WorkflowsFake`; automations: `#[trigger]` (`type`, `label`, `subject`, `workspace`, `event`), `#[condition]`, `#[action]` (`preview`), the `field` condition, `AutomationCtx`, `m.trigger/condition/action::()`, `AutomationTemplate`, definitions (action, condition, delay and wait nodes), validation with JSON pointers, drafts, publish, versions, pause, enrollment policies, simulation, `/api/automations`. - [navree-workspaces](https://navree.com/skills/navree-workspaces/SKILL.md): Multi-tenancy with navree-workspace: `WorkspaceModule` and the `workspace` config section, `CurrentWorkspace` and the `InWorkspace` guard (header, subdomain, path prefix or JWT claim), workspace roles (`owner`, `admin`, `member`, `viewer`, app-defined) feeding navree-access, `WorkspaceRepo` and `WorkspaceScoped`, row isolation with PostgreSQL row-level security (`RlsPolicy`), schema and database isolation (`workspace_migrations`, `WorkspaceUow`, `WorkspaceDatabases`), invitations, events and the `/api/workspaces` routes; organizations above workspaces (`workspace.organizations`, `Organizations`, `OrgMembers`, `OrgRole`, `WorkspaceSelector`, `CurrentOrganization`, `InOrganization`, `OrgRepo`, access requests, `/api/organizations`) and partitions inside them (`workspace.partitions`, `Partitions`, `PartitionScoped`, `PartitionScope`, `CurrentPartition`, `PartitionRepo`, `X-Partition`); shared libraries (`Library`, `LibraryColumns`, `m.library::()`, `LibraryRepo`, `LibraryScope`, clone on use, `library_read_only`); demo workspaces (`DemoSeeder`, fixtures, `workspace.demo` read-only or nightly reset, `X-Navree-Demo`).