{ "name": "Navree agent skills", "description": "Skills that teach coding agents how to build with Navree, one per common task. Install them with `navree skills:install` or `npx skills add NavreeHQ/navree`.", "docs": "https://navree.com/docs/ai/agent-skills/", "skills": [ { "name": "navree", "description": "Navree, the complete backend framework for Rust: what it is, how a Navree app is laid out, the rules every change follows, and which navree-* skill to load for each task. Use when working in any project whose Cargo.toml depends on `navree` or whose code uses `navree::prelude`, `#[module]`, `#[injectable]` or `#[controller]`, or when the user mentions Navree.", "url": "https://navree.com/skills/navree/SKILL.md", "files": [ "SKILL.md", "references/crates.md" ] }, { "name": "navree-access-control", "description": "Authorization with navree-access: `#[roles]`, `#[permissions]` and `#[can]` route checks, subjects and custom actions, the ability rules in `src/abilities.rs`, record checks with `Authorized`, per-user SQL list filters with `Accessible`, field checks, `AccessService`, the `access:*` commands and testing rules. Use when deciding who may do what, adding a role, permission or policy, protecting a route beyond \"signed in\", filtering a list to what the user may see, or explaining an unexpected 403.", "url": "https://navree.com/skills/navree-access-control/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-ai", "description": "Language models in a Navree app with navree-ai: the opt-in `ai` facade feature, `AiModule` and the `ai` config section (providers anthropic, openai and OpenAI-compatible servers, gemini, mistral, ollama, bedrock; named models with fallbacks), the `Ai` service (`ai.text`, `ai.structured::` with a JSON Schema from utoipa's `ToSchema` and `.validated()` garde rules, `ai.stream` as a `TextStream` that is also an SSE response, `chunked`, `on_finish`), attachments, failover and retries, per-user token budgets, metrics, `AiError` statuses, agents (`Agent`, `#[agent]`, `#[tool]`, `#[tool(read_only)]`, `#[tool(needs_approval)]`, `#[can]` / `#[permissions]` / `#[roles]` on tools, `AgentRun`, `ai.agent::()` with `acting_as`, `conversation`, `prompt`, `structured`, `stream`, `approve`, `reject`), conversation memory (`Conversations`, `ai:prune`), `Embeddings`, `VectorStore` (memory, pgvector, Qdrant) with `Filter`s, `Chunker`, `ai.rerank`, `navree make:agent`, and `AiFake` / `FakeReply` / `ai.fake = true` in tests. Use when adding AI features (summaries, drafts, extraction, classification, chat, an assistant that calls your services, answers from your own data), configuring providers or models, writing or testing agents and tools, indexing text into vectors, or debugging an AI request that fails with 503, 429, 502, 500, `AiError::Config`, `NoFakeReply`, an SSRF refusal, or a tool the model is never offered.", "url": "https://navree.com/skills/navree-ai/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-auth", "description": "Authentication with navree-auth: `AuthModule`, the `/api/auth/*` routes, JWT access tokens and rotating refresh tokens, `CurrentUser`, `AuthService`, account flows (registration, password reset, email verification, profile and password changes), TOTP two-factor and a policy requiring it, sessions and step-up (`#[recent_auth]`), impersonation (`#[not_while_impersonating]`, `Actor`), magic links, emailed codes, passkeys, platform administrators, trusted token exchange, custom strategies such as API keys, the login throttle and tests with real tokens. Use when adding sign-in or sign-up, reading the signed-in user, configuring tokens or the signing key, building password reset, two-factor or passwordless sign-in, listing or ending sessions, guarding sensitive routes, letting support impersonate users, adding API keys, or testing authenticated requests.", "url": "https://navree.com/skills/navree-auth/SKILL.md", "files": [ "SKILL.md", "references/account-flows.md", "references/sessions-and-sign-in.md" ] }, { "name": "navree-billing", "description": "Billing with navree-billing (facade feature `billing`, opt-in): `BillingModule` and the `billing` config section (plans, prices, trial days, seats, meters, Stripe and Paddle keys), the `Billable` trait for workspaces, users or your own types, the `Billing` service (checkout builder, `subscription`/`subscribed`, swap, quantity, cancel, resume, pause, trials without a subscription, metered usage, invoices, the customer portal), the `Subscribed` extractor (402), the `/api/billing` routes, signed webhooks (`Stripe-Signature`, `Paddle-Signature`) stored in `billing_events` and processed by the `billing.process_event` job, the billing events, the `billing:*` commands and `BillingFake` (`billing.provider = \"fake\"`). Use when adding subscriptions or paid plans, gating features by plan, recording usage, testing payment flows, or debugging a 400/402/409/502 from billing or a webhook that does nothing.", "url": "https://navree.com/skills/navree-billing/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-browser-testing", "description": "Browser tests with navree-browser: `Browser::launch()` / `Browser::builder()` (headless Chrome, Chromium or Edge over the Chrome DevTools Protocol), `Page` actions (`type_into`, `append`, `select`, `check`, `attach`, `press`, `click`, `keys`, `drag`, `scroll_to`, `back`, `refresh`), assertions that wait (`assert_see`, `assert_path_is`, `assert_count`, `assert_no_console_errors`, ...), `wait_for_request`, targets (`#css`, `@testid`, label or button text, `Target::containing/nth`, `within`), failure screenshots under `target/navree-browser//`, `TestServer` (an app on a real port), `FrontEnd`/`WebSession` (a Next.js front end with a BFF pointed at the test's app), `Viewport::phone()`, the `NAVREE_BROWSER_*` variables and `navree browser:install`. Use when testing a user journey end to end in a real browser (sign-in forms, the front end and its BFF, drag and drop, phone layouts), when a browser test fails or flakes, when CI has no Chrome, or when reading a navree-browser failure report.", "url": "https://navree.com/skills/navree-browser-testing/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-cache-and-http-client", "description": "Caching, locks and outgoing HTTP in Navree: `Cache` (`remember`, `flexible`, counters, tags), atomic `Locks`, and `HttpClient` with retries, timeouts, the SSRF policy and `HttpClient::fake()` for tests. Use when caching an expensive computation or third-party answer, limiting an action per user, preventing two tasks from running at once, calling an external API or webhook, or faking outgoing HTTP in tests.", "url": "https://navree.com/skills/navree-cache-and-http-client/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-cli-generators", "description": "Uses the `navree` CLI: `navree new`, every `make:*` generator with the files it writes and what it registers, the marker comments, `navree dev`, forwarding to the app's own commands, and console commands with `CommandSpec`. Use when generating any code in a Navree app (module, controller, service, entity, migration, job, event, listener, mail, notification, policy, command, test, MCP server), running an app command such as migrate or queue:work, or adding a custom command.", "url": "https://navree.com/skills/navree-cli-generators/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-config", "description": "Configures a Navree app: `.env`, `config/app.toml` and `APP_*` environment variables and their precedence, the application key and its rotation, typed `ConfigSection`s with validation and `Secret`, reading `Config`, custom sources and configuration in tests. Use when adding a setting or a config section for a module, reading an environment variable, setting APP_KEY, keeping secrets out of logs, or when a setting doesn't take effect.", "url": "https://navree.com/skills/navree-config/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-controllers-and-routing", "description": "Adds HTTP endpoints to a Navree app: `#[controller]` and route attributes, the `/api` prefix and versions, path and query parameters, extractors, response types, access attributes, throttles, guards, hand-written routes, custom extractors and route tests. Use when adding an endpoint, route, controller or route parameter, reading headers or the client IP, or debugging a 401, 403, 404, 405 or 415 on a route.", "url": "https://navree.com/skills/navree-controllers-and-routing/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-custom-domains", "description": "Custom domains with navree-domains: `DomainsModule` and the `domains` config section, `Domains::add` with `NewDomain` and the DNS records it returns (TXT at `_domain-verification.`, CNAME to `domains.target`, A/AAAA for apex domains), verification (`verify`, `verify_due`, `domains:verify --due`, giving up, rechecks), the `domain` workspace resolver (`workspace.resolvers = [\"domain\", ...]`, `DomainWorkspace`) and the `CurrentDomain` extractor, automatic TLS (`tls = \"on_demand\"` with the ask endpoint `/_domains/allow` and Harbor's `[web.custom_domains]`, or `tls = \"acme\"` with `InstantAcme`, HTTP-01 answers, sealed keys, `DomainCertificates` and `HttpsServer`), managed Cloudflare zones, certificate expiry reports (`domains:certificates`, `DomainCertificateExpiring`, Lighthouse), the `/api/domains` routes, and tests with `DnsFake`, `AcmeFake`, `ProbeFake` and `DnsProviderFake`. Use when a workspace needs its own domain, when a domain stays pending, or when certificates for customers' domains fail.", "url": "https://navree.com/skills/navree-custom-domains/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-database", "description": "Works with the database layer of a Navree app: the `database` configuration and its databases (TimescaleDB by default, PostgreSQL, MySQL/MariaDB, SQLite), the per-request unit of work (`Uow`), transactions in jobs and commands, SeaORM entities with UUID v7 keys and `Repo` writes with change events, seeders and `db:seed`, `navree::db::paginate`, soft deletes by hand, and TimescaleDB hypertables. Models and queries are the `navree-orm` skill, migrations the `navree-migrations` skill. Use when configuring the database, writing data outside a request, working with SeaORM entities or `Repo`, writing a seeder, or debugging \"database is locked\", 409 conflicts or writes that are not saved.", "url": "https://navree.com/skills/navree-database/SKILL.md", "files": [ "SKILL.md", "references/migrations.md", "references/seeding-and-pagination.md", "references/timescaledb.md" ] }, { "name": "navree-deployment", "description": "Deploys a Navree app: the release build, what to copy, production settings (APP_KEY, migrations, trusted proxies, metrics token), running `serve`, `queue:work` and `schedule:work` under systemd, migrations as a deploy step, nginx in front, health checks and containers. Use when shipping a Navree app to a server or container, writing systemd units, an nginx config or a Dockerfile, choosing production settings, or preparing a deploy runbook.", "url": "https://navree.com/skills/navree-deployment/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-directory", "description": "Directory sync with navree-directory: `DirectoryModule` and the `directory` config section, connections per workspace or organization (`scim`, `microsoft` with Graph delta queries, `google`, `okta` through navree-integrations' scope set `directory`, `ldap` for LDAP and Active Directory, or a `DirectorySource` of your own), the SCIM 2.0 server at `/scim/v2` (bearer token per connection, filters, PATCH), `impl DirectorySink` to map `DirectoryUser`/`DirectoryGroup` into your model, sync runs (`Directory::sync`, `sync_now`, dry runs, the deactivation limit and `approve`, partial runs, operations), the events, `/api/directory/*` routes, `directory:sync` and `directory:runs`, and tests with `Directory::fake()`/`DirectoryFake`, wiremock or an LDAP server. Use when provisioning a customer's employees from Entra ID, Okta, Google Workspace or Active Directory into your app, when an identity provider's SCIM setup fails, or when a run is held, partial or failed.", "url": "https://navree.com/skills/navree-directory/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-dock", "description": "Runs a Navree app's local services with Dock: `dock.toml`, `navree dock:add`, `navree dock up/down/status/logs/env/shell`, `navree dock:remove`, the settings Dock gives the app (`APP_DATABASE__URL`, `APP_MAIL__TRANSPORT`, `REDIS_URL`, ...), the `.env` block, Docker or Podman (`NAVREE_DOCK_RUNTIME`) and CI. Use when the app needs its database (TimescaleDB, Navree's default, or plain PostgreSQL), Redis, Meilisearch, Mailpit, MinIO or NATS on a developer machine or in CI, when `navree dock` fails (port taken, not ready, Docker not answering), or when tests must run against TimescaleDB.", "url": "https://navree.com/skills/navree-dock/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-documents", "description": "PDF and Word documents with navree-documents: the opt-in `documents` facade feature, `DocumentsModule` and the `documents` config section, `Documents::pdf(name, &data)` and `render(&Render)`, `.html` templates (navree-view syntax, `locale`/`dir` variables) for two engines: the native engine (default, in process: the HTML subset it reads, inline styles, `@page`, `header`/`footer` elements with `pageNumber`/`totalPages` spans, tables with repeating headers, images from the template tree, bundled Noto Sans/Serif/Mono, Arabic, Hebrew and Devanagari fonts, font dirs, tagged PDF) and headless Chrome (full CSS, assets from the template tree, `/_navree/fonts.css`, blocked network, the page pool, `documents.chrome.path`/`endpoint`, `NAVREE_BROWSER_CHROME`), `PrintOptions` for both, `PdfDocument` built in code and `render_document`, engine choice (`documents.engine`, `Render::engine`), right-to-left text, `Pdf` responses and `download`/`inline`, `Pdf::merge`, `stamp`, `overlay`, `text()` in tests, `Docx`, `save`, `queue` with `QueuedDocument` and `status`, `queue_operation` (a queued export behind a navree-queue operation users follow, `RENDER_FAILED_MESSAGE`), the `documents.render` job, its progress and its `.failed` record, `m.document_files`, the `documents:render` and `documents:fonts` commands, and `DocumentsFake`. Use when generating certificates, invoices, reports or exports as PDF or DOCX, adding a document template, building a PDF in code, rendering Arabic, Hebrew or other right-to-left documents, stamping or merging PDFs, queueing a long export, testing a document's text, moving a template off Typst, or debugging TemplateNotFound, a template error, a 503 from an engine, CSS the native engine ignores, or tofu boxes instead of letters.", "url": "https://navree.com/skills/navree-documents/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-errors-and-responses", "description": "Returns errors and responses the Navree way: `AppError` constructors, the `{statusCode, message, error, code, errors}` JSON shape, machine-readable error codes (`with_code`, `navree::http::codes`, `http.errors.code`) that front ends translate, `?` and 500s, `map_error` for your own error types, database error mapping, status codes, headers, downloads, streaming and API resources with `__type`. Use when a handler must return a specific status, message or code, an error type needs an HTTP status, a front end must show a refusal in the user's language, a response needs headers or a file, or an error response doesn't have the expected shape.", "url": "https://navree.com/skills/navree-errors-and-responses/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-events-and-broadcasting", "description": "Events and real time in Navree: typed events on the `EventBus`, sync and queued listeners, delivery and transactions, and the Pusher-protocol WebSocket server (`RealtimeModule`) with private and presence channels, channel authorizers, `dyn Broadcaster`, the relay for workers and Pusher JavaScript clients. Use when decoupling side effects with events or listeners, pushing live updates to browsers, authorizing private or presence channels, or broadcasting from jobs.", "url": "https://navree.com/skills/navree-events-and-broadcasting/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-flags", "description": "Feature flags with navree-flags: the opt-in `flags` facade feature, `FlagsModule` and the `flags` config section, flags as types with `#[flag]` (`name`, `default`, `expose`) registered with `FlagsModule::for_feature::()` or `m.flag::()`, checks with `CurrentFlags`, `Arc` and `FlagScope` (user, workspace, both, everyone), `#[requires_flag(F)]` on routes (404, or 403 with `status = 403`), overrides, the global state, percentage rollouts with stable buckets, rollouts by plan through a `dyn PlanResolver`, the kill switch, `GET /api/flags` for the front end, `/api/admin/flags` (`flags.manage`), the `flags:*` commands, caching, `flag.changed` events and audit entries, and `FlagsFake` / `flags.store = \"memory\"` in tests. Use when hiding a feature until it is released, rolling one out to some users, workspaces or plans, adding a kill switch, serving flags to a front end, testing code behind a flag, or debugging a flag that is unexpectedly on or off, a route that answers 404, or `FlagsError::Unregistered`.", "url": "https://navree.com/skills/navree-flags/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-fleet", "description": "Queue workers under Fleet with navree-fleet (facade feature `fleet`, in `full`): `FleetModule` and the `fleet` config section (supervisors with queues, `balance = auto|simple|off`, min/max processes, concurrency, recycling limits `max_jobs`/`max_memory_mb`/`max_time_secs`, `fleet.only`, `fleet.long_wait`, snapshots and trimming), the `fleet` master command and its `fleet:work` child processes, `fleet:status`/`fleet:pause`/`fleet:continue`/`fleet:terminate`/`fleet:forget`, the `Fleet` service (pause/resume, masters, status, workload, long_waits, failed jobs retry/retry_all/forget, pending and completed jobs, metrics), the `/_fleet` dashboard and its API behind the `Fleet` abilities `view`/`operate` (`fleet.view`, `fleet.operate`), the `fleet_*` gauges on `/metrics`, `LongWaitDetected`, and testing with `FakeSpawner`, `InProcessSpawner` and `next_allocation`. Use when running queue workers in production, balancing them across queues, pausing workers, adding the queue dashboard, alerting on queue backlogs, or debugging workers that do not start, restart in a loop, or ignore a pause.", "url": "https://navree.com/skills/navree-fleet/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-frontend-next", "description": "Build a Next.js front end on a Navree API with the @navree packages: `@navree/next` (route handlers that keep Navree's access and rotating refresh tokens in httpOnly cookies, `auth()` and `client()` in server components, the proxy that guards pages and refreshes tokens, `DataTable` and `useListQuery`, `useOperation`, workspaces, `AbilityProvider`/``, `RealtimeProvider`/`useChannel`), `@navree/client` (the typed client generated with `navree openapi:client`, `NavreeError` with error codes, list queries, query keys) and `@navree/theme` (navree.com's dark theme for Tailwind 4 and shadcn/ui). Use when creating or changing a web app that talks to a Navree API in React or Next.js, wiring sign-in, refresh, two-factor or sign-out, calling the API from server or client components, building list screens with filters, sorting and paging, subscribing to private channels, following an operation's progress, translating API errors, or theming an app like navree.com.", "url": "https://navree.com/skills/navree-frontend-next/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-frontend-nuxt", "description": "Build a Nuxt (3.13+ or 4) front end on a Navree API with the `@navree/nuxt` module: the backend-for-frontend as Nitro routes (httpOnly token cookies, single-flight refresh, two-factor sign-in, CSRF, `/broadcasting/auth`), a session gate that guards pages and refreshes tokens before server rendering, and auto-imported `useNavreeAuth`, `useWorkspace`, `useNavreeClient`, `useListQuery`, `useOperation`, `useChannel`, `useAbility`, `` and ``; with `@navree/client` (the typed client from `navree openapi:client`, `NavreeError` with codes) and `@navree/theme` (navree.com's dark theme for Tailwind 4 and shadcn-vue). Use when creating or changing a Nuxt or Vue app that talks to a Navree API, wiring sign-in or sign-out, calling the API in pages, server routes or during SSR, building list screens, subscribing to private channels, following operations, translating API errors with @nuxtjs/i18n, or theming like navree.com. The reference app, with the full app UI (sidebar shell, command palette) and Playwright tests, is apps/crm-nuxt.", "url": "https://navree.com/skills/navree-frontend-nuxt/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-graphql", "description": "GraphQL with navree-graphql (facade feature `graphql`, opt-in): `GraphqlModule` and the `graphql` config section, `#[resolver]` impl blocks with `#[query]`, `#[mutation]` and `#[subscription]` fields, access attributes on fields (`#[public]`, `#[authenticated]`, `#[roles]`, `#[permissions]`, `#[can(.., from = \"id\")]`), `ContextExt` (`ctx.uow()`, `ctx.principal()`, `ctx.authorized`, `ctx.accessible`, `ctx.loader`), `Valid` arguments, per-request dataloaders, subscriptions over WebSockets with `EventStream`, errors with `extensions.code`, GraphiQL, depth and complexity limits and `graphql:schema --check`. Use when adding a GraphQL API or field to a Navree app, writing a resolver, dataloader or subscription, testing GraphQL, or debugging a GraphQL error code, a 400/415 from /graphql, a WebSocket close code (4401, 4403, 4408) or a boot error about resolvers.", "url": "https://navree.com/skills/navree-graphql/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-grpc", "description": "gRPC with navree-grpc: `GrpcModule` and the `grpc` config section, `.proto` code generation in `build.rs` without a system protoc (protox + tonic-prost-build `compile_fds`), `#[grpc_service(server = XServer)]` on a tonic service impl with Navree extractors (`Uow`, `CurrentPrincipal`, `Authorized`, `Accessible`, `CurrentWorkspace`) and `Valid>`, access attributes and guards on methods (deny by default), interceptors, `m.grpc_service::()` and `m.grpc_descriptors(..)`, the AppError to gRPC status mapping (`status_from_error`, `error_from_status`), streaming, deadlines, gRPC-Web and Connect (JSON and protobuf) on the HTTP port or `grpc.addr`, health and reflection, `GrpcChannels` clients (`grpc.clients.`), and `TestChannel` tests. Use when adding a gRPC API to a Navree app, exposing a service to other languages or to browsers over gRPC-Web or Connect, calling another gRPC service, testing gRPC methods, or debugging a call that fails with UNAUTHENTICATED, PERMISSION_DENIED, INVALID_ARGUMENT, UNIMPLEMENTED, DEADLINE_EXCEEDED, a 415, or a boot error about a gRPC method.", "url": "https://navree.com/skills/navree-grpc/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-harbor", "description": "Deploys a Navree app to Ubuntu servers with Harbor: `harbor.toml` (servers, roles, processes, `[env]`, encrypted `[secrets]`), `navree harbor:init`, `navree harbor:provision` (Caddy with TLS, PostgreSQL, Redis, ufw, the `navree` user, systemd units), `navree deploy` (build, upload, migrate, blue-green switch after a health check, automatic revert, pruning), `navree deploy:rollback`, `navree harbor:secrets`, environments (`--env`, `NAVREE_HARBOR_ENV`), several servers, a front end, `navree build:image` and `navree harbor:ci github`. Use when shipping a Navree app to a VPS, adding a server or worker, storing a production secret, rolling back, debugging a failed deploy or health check, building a container image, or setting up push-to-deploy.", "url": "https://navree.com/skills/navree-harbor/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-helm", "description": "Helm, the admin panel of navree-helm: the `helm` facade feature (in `full`), `HelmModule` and the `helm` config section, `navree make:resource `, the `Resource` trait (LABEL, SINGULAR, GROUP, ICON, TITLE, SEARCH, SLUG, PER_PAGE, DEFAULT_SORT, ORDER, fields, filters, actions, metrics, query, create, update, delete), `Field`, `Filter`, `Action` / `ActionContext` / `ActionResult`, `Metric`, `HelmPage` and `m.helm_page(..)`, `SaveContext` and `FormData::parse`, file fields on storage disks, the access rules every screen checks (`helm.view`, then read, create, update, delete and action abilities on each record and field), the audit entries, sign-in, CSRF and the strict CSP, and testing through `/admin/api`. Use when adding an admin panel or back office, exposing an entity at `/admin`, adding a filter, bulk action, metric card or custom admin page, saving admin edits through a service, or debugging a resource missing from the menu, a 403 or 404 in the panel, a boot error naming a resource, or a field shown read-only.", "url": "https://navree.com/skills/navree-helm/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-i18n", "description": "Localization with navree-i18n: the opt-in `i18n` facade feature, `I18nModule` and the `i18n` config section (`default_locale`, `locales`, `dir`, `negotiation`, `query_param`, `cookie`, `missing`, `reload`, `bidi_isolation`, `routes`), Fluent files in `locales//*.ftl` (plurals, variables, terms, attributes, `NUMBER()`, `DATETIME()`), `embed_locales!`, `t!` and `args!`, `Money` arguments, the `Locale` extractor and `Locale::scope`/`Locale::current`, the `I18n` service (`t`, `has`, `locales`, saved user and workspace locales), negotiation from the query, the user, the workspace, a cookie and `Accept-Language`, `PUT /api/me/locale` and `GET /api/i18n/locales`, translated validation messages (`validation-`, `field-`, seven shipped languages), `t()`/`locale()` and locale-aware `money`/`date` in templates, notifications in the recipient's locale, and `i18n:check`, `i18n:missing`, `i18n:publish validation`. Use when translating an app or a message, adding a locale, formatting numbers, money or dates for a locale, choosing how a request's locale is picked, translating validation errors or mail, testing translated output, or debugging a message that shows its id, the wrong language, a boot failure naming an .ftl file, or a `t!` panic.", "url": "https://navree.com/skills/navree-i18n/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-inbound-mail", "description": "Receives mail in a Navree app: mailboxes routed by address (`m.mailbox(\"reply+{token}@in.acme.test\", handler)`, `mailbox_with::`), `InboundMail` (headers, bodies, attachments, forwarded messages, `reply_text`, `is_auto_reply`), signed reply addresses (`ReplyTokens`), raw `.eml` files on a storage disk, the SES, Mailgun, Postmark and raw MIME sources under `/api/mail/inbound`, Microsoft 365 and Gmail mailboxes watched through integration connections (`MailboxWatches`), `InboundMailReceived`, and `MailFake::receive` in tests. Use when handling replies to notifications or tickets, a support or reporting address, forwarded phishing reports, or any mail the app receives.", "url": "https://navree.com/skills/navree-inbound-mail/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-integrations", "description": "Workspace and organization connections to third-party APIs with navree-integrations: `IntegrationsModule` and the `integrations` config section, providers (`microsoft` admin consent and app-only Graph tokens, `google` service accounts with domain-wide delegation, `slack` installs, any `oauth2` API, `api_key`), the `/api/integrations/*` routes, scope sets (`ScopeSet`, `for_feature`, per-scope-set app registrations), the `Integrations` service, typed clients (`GraphClient`, `GoogleClient`, `SlackClient`, `IntegrationClient`) and the `Connection` extractor, token refresh under a lock, `integrations:check` health checks and `ConnectionUnhealthy`, and tests with `Integrations::fake()`/`IntegrationsFake` or wiremock. Use when a customer connects Microsoft 365, Google Workspace, Slack, an OAuth API or an API key to their workspace, when a feature calls Graph, the Google Admin SDK or Slack on a tenant's behalf, or when debugging `integration_not_connected`, `integration_reauthorization_required`, `invalid_state` or an unhealthy connection.", "url": "https://navree.com/skills/navree-integrations/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-jose", "description": "JSON Web Signatures and JSON Web Keys with `navree::crypto::jose` (crate navree-crypto, facade feature `crypto`, in `full`): `SigningKey` (`from_pem` for PKCS#8, PKCS#1 and SEC 1 keys such as Apple `.p8` files, `from_jwk`, `hmac`, `generate_ed25519`, `generate_es256`, `with_kid`, `with_thumbprint_kid`, `with_algorithm`, `sign_jwt`, `sign_json`, `sign_jws`, `to_pkcs8_pem`, `public_jwk`), `VerifyingKey` (`from_pem`, `from_certificate_der`, `from_jwk`, `rsa`, `ec`, `ed25519`, `hmac`, `verify_der`, `verify_legacy_sha1`), `Jws::parse`, `verify`, `verify_with(&JwkSet)` and `claims::()`, `Jwk` and `JwkSet` (thumbprints, `to_public`), the algorithms HS256/384/512, EdDSA, ES256/384, RS256/384/512 and PS256/384/512, and `JoseError`. Use when signing a JWT another service verifies (a partner assertion, Apple's client secret, a service account's token), verifying a token another service signed (ID tokens against a provider's JWKS, OIDC push tokens, a partner's callback), publishing a JWKS endpoint, loading or generating a private key, or debugging `NoKey`, `BadSignature`, `UnsupportedAlgorithm` or `InvalidKey`.", "url": "https://navree.com/skills/navree-jose/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-lighthouse", "description": "Application monitoring with navree-lighthouse: the `lighthouse` facade feature (in `full`), `LighthouseModule::from_config()` / `for_root(LighthouseOptions)` and the `lighthouse` config section, what it records through its telemetry sink (5xx and panics, slow requests and queries, failed jobs and scheduled tasks, failing outgoing calls), issues grouped by fingerprint with statuses (open, resolved, resolved in the next release, ignored), reporting handled errors with `Arc` (`report`, `capture(Report::..)`, `tag_current`), sampling and the buffer, alerts (email, Slack, signed Standard Webhooks, your own `AlertChannel` via `m.alert_channel::()`, `lighthouse.alert` jobs, cooldown, spikes, `raise_alert`), the `/_lighthouse` dashboard and its sign-in, the JSON API under `/_lighthouse/api` behind the `view` and `resolve` abilities (`lighthouse.view`, `lighthouse.resolve`), MCP tools for agents (`lighthouse_list_issues`, `lighthouse_get_issue`, `lighthouse_resolve_issue`, ..., the resource `lighthouse://issues/{id}` and the prompt `fix-lighthouse-issue`, with the `mcp` feature and `McpModule`), `lighthouse:prune` and `lighthouse:test-alerts`, a separate database, and `LighthouseFake` in tests. Use when adding monitoring to an app, reporting an error you handle, configuring alerts, giving someone or an agent access to the dashboard, its API or its MCP tools, writing tests that assert on reports, or debugging why an error is not an issue, why an alert was not sent, or why the dashboard answers 401, 403 or 404.", "url": "https://navree.com/skills/navree-lighthouse/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-logbook", "description": "Debug a Navree app locally with navree-logbook: `LogbookModule` and the `logbook` config section, the timeline UI at `/_logbook`, watchers (requests with headers and bodies, queries, jobs, mail, events, cache, logs, exceptions, outgoing HTTP, notifications, data changes, scheduled tasks), the filter language (`user:`, `tag:`, `status:4xx`, `route:`, `type:`, `slow`, `failed`, `duration>200`, `batch:`, `trace:`), `Logbook::tag` and `Logbook::dump`, duplicate-query (N+1) detection, request replay as the same user, `logbook:clear`, and the test API (`last_request().queries()`, `duplicate_queries()`). Use when you need to see what a request, job or scheduled task did, find an N+1 query, assert the number of queries in a test, replay a failing request, or when `/_logbook` answers 404 or records nothing.", "url": "https://navree.com/skills/navree-logbook/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-mail-and-notifications", "description": "Sends email and notifications from a Navree app: mail transports (SMTP, SES, Mailgun, Postmark, Resend, log, array, failover), MiniJinja mail templates with CSS inlined and a generated text body, `TemplateMail`, `Mailable` and queued mail, and notifications over the database, mail and broadcast channels with `/api/notifications`. Use when sending an email, adding or editing a mail template, configuring SMTP, notifying users in-app, by mail or live, or asserting on sent mail in tests.", "url": "https://navree.com/skills/navree-mail-and-notifications/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-mail-delivery", "description": "Delivers mail for a multi-tenant Navree app: the SES, Mailgun, Postmark and Resend transports, named transports (`mailer.via`), transports per sending domain, workspace and organization (`TransportResolver`, `mailer.for_scope`), the delivery log fed by provider webhooks (`Deliveries`, `MailBounced`), suppressions, mail held for approval (`Outbox`), open and click tracking, DKIM signing and SPF/DKIM/DMARC checks (`mail:domains`). Use when sending through an email API, letting customers bring their own mail provider or domain, handling bounces and complaints, logging or tracking mail, holding mail for approval, or checking a sending domain.", "url": "https://navree.com/skills/navree-mail-delivery/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-mcp", "description": "Adds an MCP server to a Navree app with navree-mcp: `McpModule` and the `mcp.*` keys, `#[mcp_server]` with `#[mcp_tool]`, `#[mcp_resource]` and `#[mcp_prompt]`, typed and validated arguments (`Deserialize` + utoipa `ToSchema` + garde `Validate`), per-item access attributes, `McpContext`, `McpNotifier`, streamable HTTP at `/mcp`, stdio with `mcp:serve --user`, bearer or OAuth (RFC 9728) auth, and `McpTestClient`. Use when the product should expose tools, resources or prompts to Claude, ChatGPT, Cursor or any MCP client, when `navree make:mcp` was run, or when an MCP tool is missing from a client's list, answers \"Unknown tool\", a 401, 403 or 404, or a server fails to boot.", "url": "https://navree.com/skills/navree-mcp/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-media", "description": "Files attached to models with navree-media: the opt-in `media` facade feature (and `media-ffmpeg`), `MediaModule` and the `media` config section, `impl HasMedia` (`MEDIA_TYPE`, `MEDIA_TABLE`, `media_key`, `media_collections`), collections (`single_file`, `only_keep_latest`, `accepts`, `max_size`, `disk`, `conversions_disk`), `MediaModule::for_feature::()` / `m.media_model::()`, `Media::add(&model, collection, MediaSource)` with `bytes`/`url`/`disk`/`file` sources and `PendingMedia::save(&uow)`, the `media` table (`MediaRecord`, a navree-orm model) and `MediaItem`, `resource()` with URLs and `srcset`s, `get`/`first`/`all`/`list(MediaQuery)`, `save`/`reorder`/`delete`/`clear`/`delete_all` and deleting with the model, `Conversion` (fit, format, quality, greyscale, blur, responsive, nonqueued, frame_at, transcode), the `media.conversions` job (`GenerateConversions`), `media:regenerate` and `queue_regenerate`, metadata stripping, `images::{convert, probe, strip_metadata, rasterize_svg}`, remote files through the SSRF guard, `archive::{Archive, ArchiveLimits, ZipBuilder}` and `unpack`, `text::extract` for PDF/DOCX/HTML, video and audio through FFmpeg (`Transcode`, `Ffmpeg`, `FfmpegFake`), `MediaError` codes, and `MediaFake`. Use when adding uploads, thumbnails, avatars, logos, galleries or attachments to a model, re-hosting a remote image, generating WebP or responsive images, unpacking a zip or SCORM package, extracting text from documents for search or RAG, making video posters or transcodes, testing uploads, or debugging file_type_not_allowed, payload_too_large, remote_file_blocked, invalid_image, unsafe_archive or missing conversions.", "url": "https://navree.com/skills/navree-media/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-microservices", "description": "Messages and events between services with navree-micro: `MicroModule` (`for_root(Transport::..)`, `from_config()`, the `micro` config section and `APP_MICRO__*`), `#[message_handlers]` with `#[message_pattern]` (request-response; options `dedupe`, `concurrency`) and `#[event_pattern]` (options `max_attempts`, `ordered`, `broadcast`, `concurrency`), `m.message_handlers::()`, `m.forward_event::()` / `forward_event_keyed` / `receive_event`, extractors `Payload`, `Valid>`, `MessageContext` plus every request extractor (`Uow`, `CurrentPrincipal`, `Authorized`, ...), access attributes and guards (deny by default), `ServiceClient::send` (timeout, retries, bearer, without_auth, header) and `emit` (key, header, immediately), `MicroError` and its HTTP mapping, the outbox, the inbox, retries, dead letters (`DeadLetters`, `micro:failed`, `micro:retry`, `micro:flush`), the TCP, memory, NATS, Kafka, RabbitMQ, Redis Streams and MQTT transports (features `micro`, `micro-nats`, `micro-kafka`, `micro-rabbitmq`, `micro-redis`, `micro-mqtt`), hybrid `serve` and `micro:listen`, named clients, trace context, a custom `MicroTransport` and the conformance suite, and `MicroFake` tests. Use when splitting a Navree module into a service, adding message or event handlers, calling another service, publishing events to other services, picking or configuring a broker, testing handlers or stubbing services, or debugging a 401/403/400/502/503/504 from a `send`, events that are not delivered, delivered twice or dead-lettered, or a boot error about a pattern.", "url": "https://navree.com/skills/navree-microservices/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-migrations", "description": "Writes and runs database migrations in a Navree app with the schema builder (`navree::schema`): `navree make:migration`, `schema.create` and `schema.table` blueprints, column types and modifiers per database, indexes and foreign keys, changing, renaming and dropping columns, SQLite table rebuilds, module-owned `MigrationSet`s and their order, transactions and `within_transaction`, `migrate` with `--pretend` and `--step`, `migrate:status`, rollbacks, `migrate:refresh` and `migrate:fresh`, the production guard, `Migrator` in tests, and squashing with `schema:dump`. Use when adding or changing a table, column, index or foreign key, when a migration fails, runs in the wrong order or half-applies on MySQL, or when running, rolling back, previewing or squashing migrations.", "url": "https://navree.com/skills/navree-migrations/SKILL.md", "files": [ "SKILL.md", "references/columns-and-indexes.md" ] }, { "name": "navree-module-conformity", "description": "Audits a Navree module or app for conformity and tenant isolation: `navree check` (module graph, then `conformity:check`: `api.docs` with `api.require_docs` and `api.undocumented`, `workspace.entities`, `workspace.repo` with the `navree:allow(workspace-repo)` marker, `workspace.tables`, `i18n.translations`, `db.migrations`), `TestApp::isolation_suite::()` cross-workspace tests from a module's route table and factories (`IsolationSuiteExt::factory`, `.record`, `.body`, `.skip`, `Tenancy`), custom checks with `ConformityCheck`, and `navree gate` (fmt, clippy, tests, check and the front end under a machine lock). Use when finishing or reviewing a module, before a push or release, when adding a workspace-owned entity or route, when `navree check` or an isolation suite fails, or when data might leak between workspaces.", "url": "https://navree.com/skills/navree-module-conformity/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-modules-and-di", "description": "Structures Navree code into modules wired by dependency injection: `#[module]` keys, `#[injectable]` providers and scopes, values, trait objects, factories, named and lazy providers, configurable modules (`for_root`, `from_config`, `for_feature`) and the boot-time graph errors. Use when adding or wiring a service, splitting a feature into a module, sharing a service between modules, registering something in `wire`, or fixing errors such as \"cannot resolve\", \"private to module\", \"configured more than once\" or \"provider dependency cycle\".", "url": "https://navree.com/skills/navree-modules-and-di/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-navigator", "description": "Uses Navigator, Navree's MCP server for coding agents (`navree mcp`), and installs the Navree agent skills (`navree skills:install`). Covers connecting Claude Code, Cursor, Codex or VS Code; the twelve read-only tools (`app_info`, `list_routes`, `module_graph`, `list_providers`, `list_commands`, `describe_schema`, `query_database`, `read_logs`, `last_error`, `read_config`, `search_docs`, `read_doc`) and, when the app includes Lighthouse, its five (`lighthouse_list_issues`, `lighthouse_get_issue`, `lighthouse_slow_routes`, `lighthouse_slow_queries`, `lighthouse_failed_jobs`); the options `--path`, `--no-build`, `--allow-remote-database` and `--docs-offline`; the log file the log tools need; and the security limits. Use when setting up an agent on a Navree app, when a Navigator tool returns an error (a build error, a refused query, no log file, a remote database), before adding a route, wiring a provider or writing a migration, or when asked why a request failed or what is slow.", "url": "https://navree.com/skills/navree-navigator/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-new-app", "description": "Creates and runs a new Navree app: installing the navree CLI, `navree new` and its options (`--database`, TimescaleDB by default), the starter kits (`--kit saas|api|micro`: a multi-tenant SaaS with a Next.js front end, the same API alone, or a microservice workspace), starting the database with `navree dock up`, APP_KEY, `navree dev`, the generated files, the first feature module and adding Navree to an existing Cargo package. Use when the user wants to start a Navree project, scaffold a Rust API, a SaaS or a microservice with Navree, run a fresh app or kit, or asks what `navree new` generated.", "url": "https://navree.com/skills/navree-new-app/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-notification-channels", "description": "Sends Navree notifications over Slack (webhooks, bot tokens), Microsoft Teams (webhooks, proactive bot messages), SMS (Twilio, Vonage, Amazon SNS), WhatsApp (Twilio, the WhatsApp Cloud API) and browser push (VAPID): `route_*` on the notifiable, `to_*` on the notification, the `notify.*` driver tables, E.164 numbers, STOP opt-outs (`OptOuts`), push subscriptions (`notify:vapid`, `/api/notifications/push-subscriptions`), the delivery log (`notification_deliveries`, `DeliveryLog`), provider callbacks (`/api/webhooks/notify/*`), connection tokens from integrations and the channel fakes. Use when texting users, posting to Slack or Teams, sending WhatsApp messages or push notifications, handling STOP replies or delivery statuses, or testing any of these.", "url": "https://navree.com/skills/navree-notification-channels/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-notification-preferences", "description": "Lets people and workspaces choose which Navree notifications reach them and when: categories (`#[notification(category = .., digest = .., urgent)]`, `NotifyModule::for_feature`), channel switches per category in `Preferences` (`NotificationPreferences`, `GET`/`PATCH /api/notifications/preferences` and `/workspace`), required categories, digests that batch mail (hourly, daily, weekly at 09:00 on the recipient's clock), quiet hours, send windows (`Notification::send_window`), held deliveries (`notification_deferrals`, `notify:release`), the recipient's zone and workspace (`Notifiable::time_zone`, `workspace_id`) and per-workspace mail templates and style (`notification-templates` settings, `TemplateOverrides`). Use when building a notification preference screen, batching mail into a digest, not texting people at night, sending reminders in business hours, letting tenants restyle notification mail, or testing any of these with a fixed clock.", "url": "https://navree.com/skills/navree-notification-preferences/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-oauth", "description": "The OAuth 2.1 / OpenID Connect server of navree-oauth: `OAuthServerModule` and the `oauth` config section (scopes mapped to permission strings, `consent_url`, `device_url`, TTLs, Ed25519 signing keys), clients (`OAuthClients`, `NewClient`, `navree oauth:client`), the authorization code flow with PKCE and the consent API your front end calls, client credentials, device and refresh grants, `OAuthToken` in handlers, `insufficient_scope`, personal access tokens (`PersonalAccessTokens`), introspection, revocation, discovery, JWKS, userinfo, dynamic registration and `navree_oauth::testing`. Use when letting third-party apps, CLIs, TVs, integrations or AI clients act for your users, issuing personal access tokens for scripts, building a consent or device page, scoping what a token may do, or debugging a 401/403/invalid_grant from OAuth tokens.", "url": "https://navree.com/skills/navree-oauth/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-openapi", "description": "Documents a Navree API with the OpenAPI 3.1 document generated at boot: `ApiModule`, `#[api(..)]` on routes, utoipa `ToSchema` resources, page schemas, `m.api_schema`, the schema boot errors, `openapi:export` and typed clients. Use when adding API documentation, describing request or response bodies, fixing a schema-conflict or missing-schema boot error, exporting the document, or generating a typed TypeScript client.", "url": "https://navree.com/skills/navree-openapi/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-orm", "description": "Works with data through Navree's ORM (`navree::orm`): `#[derive(Model)]` models with typed column constants, the query builder, records with dirty tracking (`create`, `save`, `delete`), `#[relations]` and eager loading with `with(..)`, `#[scopes]`, soft deletes, casts and accessors, serialization, model events and observers, pagination and streams, mass assignment, factories, `#[navree::test]` databases and assertions, route model binding (`Bound`), workspace-scoped models and access-control subjects, and MongoDB models. Use when adding or changing a model, writing a query, relation, eager load, scope, cast, observer, factory or model test, binding a model to a route, or debugging lazy-loading, missing-attribute or mass-assignment errors, N+1 queries or a 404 from `find_or_fail`.", "url": "https://navree.com/skills/navree-orm/SKILL.md", "files": [ "SKILL.md", "references/models-in-depth.md", "references/queries.md", "references/relationships.md", "references/testing-and-factories.md" ] }, { "name": "navree-performance", "description": "Make a Navree app faster per request, or check that a change didn't make it slower: the request-pipeline benchmarks (`cargo bench -p navree --bench pipeline`), the `database` pool settings (`test_before_acquire`, `idle_timeout_secs`, `max_lifetime_secs`, `max_connections`) and `database.transaction_settings`, what the fixed HTTP layers cost and when they merge into one middleware, which modules make `Repo` writes serialize change events, reading through the pool instead of a transaction, and the service locator in hot paths. Use when throughput or latency matters, when a load test shows Navree using its CPUs while the database idles, or before changing navree-http, navree-db or navree-kernel code on the request path.", "url": "https://navree.com/skills/navree-performance/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-queues-and-scheduling", "description": "Background work in Navree: `Job` types, registering and dispatching jobs, job options (retries, backoff, timeouts, unique jobs), jobs inside transactions, `queue:work` and failed jobs, job batches with `then`/`catch`/`finally`, job progress, operations (user-visible long work with an SSE stream, a private channel, cancel and a watchdog), `QueueFake`, and cron-style schedules with `m.schedule` run by `schedule:work` or `schedule:run`. Use when moving slow work out of a request, adding a job or worker, splitting an import or export into a batch, showing progress to users, retrying or inspecting failed jobs, running something every minute, hour or day, or testing jobs and schedules.", "url": "https://navree.com/skills/navree-queues-and-scheduling/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-redis", "description": "Redis with navree-redis: `RedisModule` and the `redis` config section (`url`, `prefix`, `connect_timeout_ms`, `response_timeout_ms`, `connections..url`, `APP_REDIS__URL`, the `REDIS_URL` fallback), the `Redis` connections (`manager()`, `key()`, `named()`, `dedicated()`, `pubsub()`), the Redis drivers selected by name (`cache.store = \"redis\"`, `queue.driver = \"redis\"`, `session.store = \"redis\"`, `realtime.backplane = \"redis\"`), shared rate limits with `RateLimiter::hit`, the `redis` health check, key layout and production settings (eviction, persistence). Use when an app runs several processes or servers that must share the cache, locks, jobs, sessions, rate limits or WebSocket broadcasts and presence; when moving any of those to Redis; when running raw Redis commands; or when debugging `needs RedisModule` boot errors, `realtime.backplane needs realtime.secret`, readiness down for `redis`, jobs or sessions lost to eviction, or broadcasts that don't reach clients on another server.", "url": "https://navree.com/skills/navree-redis/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-search", "description": "Full-text and vector search with navree-search: `SearchModule` and the `search` config section, `#[derive(Searchable)]` (or a hand-written `Searchable` with related data), engines (`postgres` with SQLite FTS5 in tests, `meilisearch`, `typesense`, `tantivy`, `memory`), syncing through the queue (`search.sync` queued/inline/off, the `search.sync` job `SyncDocuments`, `reindex`, `without_syncing`), the `Search` service and query builder (filters, ranges, sorts, `accessible`, `workspace`, `paginate`, `hits` and highlights, `across`), vectors (`#[searchable(embed)]`, `Embeddings`, pgvector/Qdrant/memory, `similar`, `similar_to`, `hybrid`), the `search:import`/`flush`/`settings`/`status` commands and test helpers. Use when adding a search box or command palette, making an entity searchable, picking or configuring a search engine, rebuilding an index, or debugging missing, stale or leaking search results.", "url": "https://navree.com/skills/navree-search/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-security-checklist", "description": "A pre-release security review for Navree apps covering deny-by-default routes, abilities and list filters, validation, tokens, rate limits and trusted proxies, CORS and security headers, CSRF for cookie sessions, secrets and APP_KEY, the audit log, uploads, SSRF and operations, with the commands that check each item. Use before shipping or deploying, during a security review or audit, or when asked whether a Navree app is safe to release.", "url": "https://navree.com/skills/navree-security-checklist/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-settings", "description": "Typed settings with inheritance in navree-settings: the `settings` facade feature (in `full`), `SettingsModule` and the `settings` config section, settings types with `#[derive(Settings)]` (`key`, `scopes(global, organization, workspace, user)`, `permission`, `read_permission`) registered with `SettingsModule::for_feature::()` or `m.settings::()`, `Scope`, resolution field by field down global → organization → workspace → user with a `Source` per field, `Resolved`, the `Setting` extractor, `Settings::update` (garde-validated, errors by field), `inherit` and `reset` in a unit of work, `settings.updated` audit entries and `settings.changed` events, cache tags per key and level, `GET`/`PATCH`/`DELETE /api/settings/{key}?scope=` with `{data, sources, overridden}`, the `settings:*` commands, the Helm Settings screens, and `SettingsFake` / `settings.store = \"memory\"` in tests. Use when adding settings an app, organization, workspace or user can change, showing where a value comes from, building a settings screen, resetting a field to inherit, testing code that reads settings, or debugging a value that does not apply, a 400 on a settings write, or `SettingsError::Unregistered`.", "url": "https://navree.com/skills/navree-settings/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-sheets", "description": "CSV and Excel imports and exports with navree-sheets: the `sheets` facade feature (in `full`), `SheetsModule` and the `sheets` config section (`sheets.csv`, `sheets.exports`, `sheets.imports`), export rows with `#[derive(Exportable)]` (`sheet`, `header`, `format`, `width`, `with`, `skip`), `Cell` and `IntoCell`, `Download::csv`/`csv_stream`/`xlsx` (byte-order mark, formula escaping, typed XLSX cells), the `Exports` service, translated headers (`HeaderCatalog`, `HeaderTranslator`, Fluent with `i18n`), named exports (`Export`, `m.export::()`, `GET`/`POST /api/exports/{name}`, queued to a disk with a signed link through an operation), import rows with `#[derive(Deserialize, Validate, Importable)]` (`header`, `aliases`, `required`, `optional`, `skip`), importers (`Import`, `m.importer::()`, `key`, `existing`, `insert`, `update`, `completed`, `RowRejected`), uploads (`POST /api/imports`, `Imports::upload`, `Upload`, `UploadOptions`), encoding detection (UTF-16, Windows-1256, Shift_JIS), CSV, TSV, XLSX, XLS and ODS reading, header mapping (automatic, saved, chosen; `needs_mapping`, `PUT /api/imports/{id}/mapping`), the staging preview (`import_rows`, `GET /api/imports/{id}/rows`), `DuplicateMode` skip/update/fail, batched apply with progress, error files, templates, `sheets:prune`, and tests with the memory queue and disk. Use when adding a CSV or Excel export or a download button, queueing a big export, importing users, contacts or any records from a spreadsheet, building a column-mapping or import-preview screen, handling Arabic or other non-UTF-8 files from Excel, or debugging garbled characters, an import stuck in `needs_mapping`, a 409 on apply, or rows that were skipped.", "url": "https://navree.com/skills/navree-sheets/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-social", "description": "Social sign-in with navree-social: `SocialModule` and the `social` config section, providers (google, github, apple, microsoft, gitlab, slack, linkedin, discord, x, any `oidc` issuer, `custom` via `SocialProvider`), the `/api/auth/social/*` routes, the `Social` service (`redirect`, `user`, `sign_in`, `link`, `unlink`, `accounts`, `token`), linked accounts and `link_by_email`, two-factor on social sign-ins, stored provider tokens, and tests with `Social::fake()`/`SocialFake` or a wiremock provider. Use when adding \"Continue with Google/GitHub/Apple/...\" buttons, single sign-on with Okta, Auth0, Keycloak or Entra ID, connecting providers from a settings page, calling a provider's API on a user's behalf, or debugging a 400 `Invalid or expired state`, 403, 409 or 502 from a social route.", "url": "https://navree.com/skills/navree-social/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-sso", "description": "Enterprise single sign-on with navree-sso: `SsoModule` and the `sso` config section, SAML 2.0 and OpenID Connect connections owned by the app, an organization or a workspace (`SsoOwner`), verified email domains (DNS TXT) with `POST /api/sso/discover` and password enforcement (`sso_required`), just-in-time provisioning with group to role mapping (`Provisioning`, `RoleRule`, `SsoUserProvisioned`), the `/api/sso/*` routes and the `sso.manage` management routes, the `Sso` service, `complete_url` and the one-time code exchange, and tests with `SsoFake` and `StaticTxtResolver`. Use when a customer asks for Okta, Entra ID (Azure AD), Google Workspace, AD FS, Ping or Keycloak sign-in per tenant, when setting up an identity provider's ACS URL, entity id or redirect URI, when forcing a company's people to use SSO, or when debugging `invalid_saml_response`, `invalid_state`, `unverified_domain`, `email_taken`, `sso_not_assigned` or `sso_required`.", "url": "https://navree.com/skills/navree-sso/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-storage", "description": "Stores and serves files in a Navree app with `StorageModule`: named disks (local, memory, S3 and S3-compatible stores such as MinIO, Cloudflare R2 and DigitalOcean Spaces, Google Cloud Storage, Azure), reading, writing and streaming files, multipart uploads checked by content with `store_upload`, direct browser uploads with `presigned_put` and `accept_upload`, public and signed temporary URLs, and copying files between disks with `storage:sync`. Use when accepting file uploads, uploading straight to a bucket, serving or downloading stored files, generating expiring download links, moving files between disks, or configuring where files are kept.", "url": "https://navree.com/skills/navree-storage/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-telemetry", "description": "Telemetry events and tracing with navree-telemetry and navree-observe: the typed events every module emits (`RequestHandled`, `QueryExecuted`, `JobProcessed`, `JobFailed`, `ScheduledTaskRan`, `MailSent`, `NotificationSent`, `CacheEvent`, `HttpClientRequest`, `ExceptionReported`, `LogRecord`), sinks (`TelemetrySink`, `Interest`, `m.telemetry_sink::()`), the zero-cost rule, `Telemetry::current().report_exception`, `TelemetryContext` (request and job context, `propagate` for spawned tasks), W3C `traceparent` in and out, the `observe.tracing` section, OTLP export behind the opt-in `otel` feature, `current_trace_id`, and `TelemetryRecorder` / `SpanRecorder` in tests. Use when receiving requests, queries, jobs, mail or log lines in your own code (metrics, audit, a monitoring tool), exporting traces to an OpenTelemetry backend, reporting a handled error, keeping a trace across `tokio::spawn`, asserting on emitted events or spans in tests, or debugging a missing event, span or trace id.", "url": "https://navree.com/skills/navree-telemetry/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-testing", "description": "Tests Navree apps in-process with `navree::testing`: `TestApp` with a fresh SQLite database per test, `TestClient` requests, `acting_as`, response assertions, booting the whole app, database assertions and the fakes (queue, mail, clock, outgoing HTTP, storage, broadcasts). Use when writing or fixing tests for a route, service, job, listener, migration or command, when a test needs a signed-in user, fixed time, fake mail or queue, or when tests are flaky or slow.", "url": "https://navree.com/skills/navree-testing/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-time-zones", "description": "Counts dates, reports and messages on the clock of the person or workspace they are for, with `TimeModule` (navree-time): checked IANA `Zone`s with PostgreSQL-safe names, the request's zone (`CurrentZone`: user, workspace, organization, default), `LocalDay` and `DayRange` turned into UTC bounds, `WithZone` responses, `SendWindow` working hours with weekends and `Holidays`, `AT TIME ZONE` SQL with a checked zone, schedules with `in_zone` and `per_workspace_local`, workspace and organization `timezone`/`country`, `ZonesFake` in tests. Use when a report counts days, a reminder must arrive in working hours, a cron task should run at local time or per workspace, a user or workspace picks a time zone, or a zone name breaks PostgreSQL.", "url": "https://navree.com/skills/navree-time-zones/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-validation", "description": "Validates request input in Navree with garde DTOs and the `Valid` and `ValidAsync` extractors, including Navree's extra rules, required fields, nested data, database `unique`/`exists` rules, international input (E.164 `Phone`, sanitized `SafeHtml` rich text, names in any script, native digits with `Folded`, `Country`, `Locale`), custom rules and messages, manual `ValidationErrors` and the 400 response shape. Use when writing a request body or query DTO, adding or customizing validation rules or messages, accepting phone numbers, rich text, non-Latin names or digits, checking uniqueness against the database, or when a test expects a 400 with `errors`.", "url": "https://navree.com/skills/navree-validation/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-webhooks", "description": "Webhooks with navree-webhooks: `WebhooksModule` and the `webhooks` config section, outgoing webhooks from events (`WebhookEvent`, `WebhooksModule::for_feature::()`, `m.webhook_type`, `Webhooks::dispatch_json`), endpoints and secrets (`create_endpoint`, `rotate_secret`, `whsec_` secrets), Standard Webhooks signing (`webhook-id`, `webhook-timestamp`, `webhook-signature`), the retry schedule, disabling failing endpoints, the delivery log and the `/api/webhooks` routes, and incoming webhooks verified with `VerifiedWebhook` (`Stripe`, `GitHub`, `Paddle`, `StandardWebhooks`, `AwsSns`, `GooglePubSub`, `MicrosoftGraph`, `Twilio`, `Slack`, `Mailgun`, `Postmark`, `Vonage`, `Meta`, `Hmac`, custom `WebhookVerifier`s with `verify_incoming`, handshakes, `mark_processed`). Use when sending webhooks to customers' URLs, letting users manage webhook endpoints, receiving Stripe, GitHub, Paddle, SES-over-SNS, Pub/Sub or Gmail push, Graph change notifications, Twilio, Slack, Mailgun, Postmark or other signed callbacks, testing deliveries or signatures, or debugging a webhook that is not sent, not retried, refused with 400 `Invalid webhook signature`, or an endpoint that got disabled.", "url": "https://navree.com/skills/navree-webhooks/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-workflows", "description": "Durable workflows and end-user automations with navree-workflows: the `workflows` facade feature (in `full`), `WorkflowsModule` and the `workflows` config section (`store`, `lease_secs`, `queue`, `routes`, `automations`, `automation_routes`, `prune_after_days`), `#[workflow]` async functions on an input type (`name`, `version`, `min_version`), `WorkflowCtx` (`step`, `step_with` and `StepOptions` retries, `sleep`, `sleep_until`, `wait_for::` with `EventMatch` and timeouts, `now`, `version`), `m.workflow::()`, `WorkflowsModule::for_feature::()`, `m.workflow_event::()`, `Workflows::start`/`start_with`/`spawn` with `StartOptions` (key, workspace, delay), run statuses, replay rules, leases and takeovers, the `workflows.run` job and `workflows:tick`, versions, cancel and retry, `/api/workflows`, `workflows:*` commands, `WorkflowsFake`; automations: `#[trigger]` (`type`, `label`, `subject`, `workspace`, `event`), `#[condition]`, `#[action]` (`preview`), the `field` condition, `AutomationCtx`, `m.trigger/condition/action::()`, `AutomationTemplate`, definitions (action, condition, delay and wait nodes), validation with JSON pointers, drafts, publish, versions, pause, enrollment policies, simulation, `/api/automations`. Use when a feature waits days or for an event (onboarding sequences, reminders, trials, dunning, follow-ups, approvals), when a multi-step process must survive restarts or retry steps, or when users build their own automations, rules or sequences in an editor; also to debug a run stuck in `waiting` or `running`, a step that ran twice, `UnregisteredEvent`, or an automation that does not enroll.", "url": "https://navree.com/skills/navree-workflows/SKILL.md", "files": [ "SKILL.md" ] }, { "name": "navree-workspaces", "description": "Multi-tenancy with navree-workspace: `WorkspaceModule` and the `workspace` config section, `CurrentWorkspace` and the `InWorkspace` guard (header, subdomain, path prefix or JWT claim), workspace roles (`owner`, `admin`, `member`, `viewer`, app-defined) feeding navree-access, `WorkspaceRepo` and `WorkspaceScoped`, row isolation with PostgreSQL row-level security (`RlsPolicy`), schema and database isolation (`workspace_migrations`, `WorkspaceUow`, `WorkspaceDatabases`), invitations, events and the `/api/workspaces` routes; organizations above workspaces (`workspace.organizations`, `Organizations`, `OrgMembers`, `OrgRole`, `WorkspaceSelector`, `CurrentOrganization`, `InOrganization`, `OrgRepo`, access requests, `/api/organizations`) and partitions inside them (`workspace.partitions`, `Partitions`, `PartitionScoped`, `PartitionScope`, `CurrentPartition`, `PartitionRepo`, `X-Partition`); shared libraries (`Library`, `LibraryColumns`, `m.library::()`, `LibraryRepo`, `LibraryScope`, clone on use, `library_read_only`); demo workspaces (`DemoSeeder`, fixtures, `workspace.demo` read-only or nightly reset, `X-Navree-Demo`). Use when building a SaaS or team feature, adding data that belongs to a workspace (team, organization, tenant), grouping workspaces under a company or partner, splitting a workspace's data by domain or region, checking permissions per workspace or organization, inviting users, seeding a demo or sales workspace, shipping templates or courses that every tenant sees, extends and clones, or debugging a 400/403/404 from a workspace or organization route or data leaking between workspaces or partitions.", "url": "https://navree.com/skills/navree-workspaces/SKILL.md", "files": [ "SKILL.md" ] } ] }