moai-adk 0.32.8__py3-none-any.whl → 0.41.0__py3-none-any.whl

moai_adk/templates/.claude/skills/moai-library-nextra/reference.md

@@ -0,0 +1,379 @@
+# moai-library-nextra Reference
+
+## API Reference
+
+### Theme Configuration API
+
+DocsThemeConfig Interface:
+- `logo`: React node for site logo
+- `logoLink`: URL for logo click
+- `project`: Project link configuration
+- `docsRepositoryBase`: Base URL for edit links
+- `sidebar`: Sidebar configuration options
+- `toc`: Table of contents options
+- `footer`: Footer configuration
+- `head`: Custom head elements
+- `search`: Search configuration
+- `useNextSeoProps`: SEO metadata function
+
+Sidebar Options:
+- `defaultMenuCollapseLevel`: Default collapse depth
+- `toggleButton`: Show toggle button
+- `autoCollapse`: Auto-collapse inactive sections
+
+TOC Options:
+- `backToTop`: Show back to top button
+- `float`: Float table of contents
+- `headingDepth`: Heading levels to include
+
+### Navigation API (\_meta.js)
+
+Page Configuration:
+```javascript
+{
+  "page-name": "Display Title",
+  "---": "",  // Separator
+  "external-link": {
+    "title": "Link Title",
+    "href": "https://example.com",
+    "newWindow": true
+  }
+}
+```
+
+Page Options:
+- `title`: Display title in sidebar
+- `type`: Page type (page, separator, menu)
+- `display`: Display mode (normal, hidden, children)
+- `theme`: Page-specific theme overrides
+
+### MDX Component API
+
+Built-in Components:
+- `Callout`: Alert/info boxes (type: info, warning, error, default)
+- `Tabs`: Tabbed content container
+- `Tab`: Individual tab item
+- `Cards`: Card grid container
+- `Card`: Individual card item
+- `Steps`: Step-by-step guide
+- `FileTree`: File structure visualization
+
+Callout Types:
+- `info`: Blue informational box
+- `warning`: Yellow warning box
+- `error`: Red error/danger box
+- `default`: Gray neutral box
+
+### Search API
+
+FlexSearch Configuration:
+- `placeholder`: Search input placeholder
+- `emptyResult`: Empty result message
+- `loading`: Loading indicator
+- `error`: Error message
+
+Search Customization:
+- Custom search endpoint
+- Result filtering
+- Keyboard shortcuts
+
+---
+
+## Configuration Options
+
+### next.config.js
+
+Nextra Plugin Configuration:
+```javascript
+const withNextra = require("nextra")({
+  theme: "nextra-theme-docs",
+  themeConfig: "./theme.config.tsx",
+  staticImage: true,
+  latex: true,
+  flexsearch: {
+    codeblocks: true
+  },
+  defaultShowCopyCode: true
+});
+
+module.exports = withNextra({
+  // Next.js config
+  reactStrictMode: true,
+  images: {
+    domains: ["example.com"]
+  }
+});
+```
+
+### theme.config.tsx
+
+Full Configuration Example:
+```typescript
+const config: DocsThemeConfig = {
+  // Branding
+  logo: <span>My Documentation</span>,
+  logoLink: "/",
+
+  // Repository
+  project: { link: "https://github.com/user/repo" },
+  docsRepositoryBase: "https://github.com/user/repo/tree/main",
+
+  // Navigation
+  sidebar: {
+    defaultMenuCollapseLevel: 1,
+    toggleButton: true,
+    autoCollapse: true
+  },
+
+  // Content
+  toc: {
+    backToTop: true,
+    float: true
+  },
+
+  // Footer
+  footer: {
+    text: `${new Date().getFullYear()} My Project`
+  },
+
+  // SEO
+  head: (
+    <>
+      <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+      <meta property="og:title" content="My Docs" />
+      <meta property="og:description" content="Documentation" />
+    </>
+  ),
+
+  useNextSeoProps() {
+    return {
+      titleTemplate: "%s - My Docs"
+    };
+  }
+};
+```
+
+### Internationalization (i18n)
+
+next.config.js i18n:
+```javascript
+module.exports = withNextra({
+  i18n: {
+    locales: ["en", "ko", "ja"],
+    defaultLocale: "en"
+  }
+});
+```
+
+Language-specific \_meta:
+```
+pages/
+  en/
+    _meta.json
+    index.mdx
+  ko/
+    _meta.json
+    index.mdx
+```
+
+---
+
+## Integration Patterns
+
+### Project Structure Pattern
+
+Recommended Directory Layout:
+```
+docs/
+  pages/
+    _app.tsx
+    _meta.json
+    index.mdx
+    getting-started/
+      _meta.json
+      installation.mdx
+      configuration.mdx
+    guides/
+      _meta.json
+      basic.mdx
+      advanced.mdx
+    api/
+      _meta.json
+      reference.mdx
+  public/
+    images/
+    og-image.png
+  components/
+    CustomComponent.tsx
+  styles/
+    custom.css
+  theme.config.tsx
+  next.config.js
+  package.json
+```
+
+### Custom Component Integration
+
+Creating Custom Components:
+1. Create component in `components/` directory
+2. Import in MDX files
+3. Use standard React patterns
+
+Global Component Registration:
+```typescript
+// pages/_app.tsx
+import type { AppProps } from "next/app";
+import { CustomComponent } from "../components/CustomComponent";
+
+const components = {
+  CustomComponent
+};
+
+export default function App({ Component, pageProps }: AppProps) {
+  return <Component {...pageProps} components={components} />;
+}
+```
+
+### Static Export Pattern
+
+Static HTML Generation:
+```javascript
+// next.config.js
+module.exports = withNextra({
+  output: "export",
+  images: {
+    unoptimized: true
+  },
+  trailingSlash: true
+});
+```
+
+Build Command:
+```bash
+npm run build
+# Output in /out directory
+```
+
+### Theme Customization Pattern
+
+CSS Variables Override:
+```css
+/* styles/custom.css */
+:root {
+  --nextra-primary-hue: 212deg;
+  --nextra-primary-saturation: 100%;
+  --nextra-content-width: 90rem;
+}
+
+.dark {
+  --nextra-bg: 17 17 17;
+}
+```
+
+Tailwind Integration:
+```javascript
+// tailwind.config.js
+module.exports = {
+  content: [
+    "./pages/**/*.{js,ts,jsx,tsx,mdx}",
+    "./components/**/*.{js,ts,jsx,tsx}",
+    "./theme.config.tsx"
+  ]
+};
+```
+
+---
+
+## Troubleshooting
+
+### Build Errors
+
+Symptoms: Build fails, module not found
+
+Solutions:
+1. Clear `.next` cache: `rm -rf .next`
+2. Reinstall dependencies: `rm -rf node_modules && npm install`
+3. Check Next.js/Nextra version compatibility
+4. Verify theme.config.tsx syntax
+
+### MDX Parsing Errors
+
+Symptoms: MDX syntax errors, component not rendering
+
+Solutions:
+1. Check JSX syntax in MDX files
+2. Verify component imports are correct
+3. Ensure no unescaped special characters
+4. Check for unclosed tags
+
+### Search Not Working
+
+Symptoms: Search returns no results, index empty
+
+Solutions:
+1. Verify FlexSearch is enabled in next.config.js
+2. Rebuild the search index: `npm run build`
+3. Check for build errors in search indexing
+4. Verify content files are in pages directory
+
+### i18n Issues
+
+Symptoms: Wrong language, missing translations
+
+Solutions:
+1. Verify locale configuration in next.config.js
+2. Check \_meta.json exists for each locale
+3. Confirm URL structure matches locale pattern
+4. Verify default locale setting
+
+### Styling Issues
+
+Symptoms: Incorrect styles, theme not applying
+
+Solutions:
+1. Check CSS import order
+2. Verify Tailwind configuration
+3. Clear browser cache
+4. Check for CSS specificity conflicts
+
+---
+
+## External Resources
+
+### Official Documentation
+
+- [Nextra Documentation](https://nextra.site/)
+- [Next.js Documentation](https://nextjs.org/docs)
+- [MDX Documentation](https://mdxjs.com/)
+- [FlexSearch](https://github.com/nextapps-de/flexsearch)
+
+### Deployment Guides
+
+- [Vercel Deployment](https://vercel.com/docs)
+- [GitHub Pages with Next.js](https://nextjs.org/docs/pages/building-your-application/deploying/static-exports)
+- [Netlify Deployment](https://docs.netlify.com/)
+
+### Theme Resources
+
+- Nextra Theme Docs (documentation sites)
+- Nextra Theme Blog (blog sites)
+- Custom theme development guide
+
+### Related Skills
+
+- `moai-docs-generation`: Automated documentation generation
+- `moai-workflow-docs`: Documentation workflow management
+- `moai-domain-frontend`: Frontend development patterns
+- `moai-library-mermaid`: Diagram integration
+
+### Complementary Tools
+
+- Mermaid.js: Diagram generation
+- KaTeX: Math rendering
+- Shiki: Code syntax highlighting
+- next-sitemap: SEO sitemap generation
+
+---
+
+Version: 2.0.0
+Last Updated: 2025-12-06

moai_adk/templates/.claude/skills/moai-library-shadcn/SKILL.md

@@ -1,18 +1,21 @@
 ---
-name: moai-library-shadcn
-aliases: [moai-library-shadcn]
-category: library
-description: Moai Lib Shadcn Ui - Professional implementation guide
+name: "moai-library-shadcn"
+description: "Moai Lib Shadcn Ui - Professional implementation guide"
 version: 2.0.0
+category: "library"
 modularized: true
-tags:
- - library
- - shadcn
- - enterprise
- - development
- - ui
-updated: 2025-11-27
-status: active
+tags: ['library', 'shadcn', 'enterprise', 'development', 'ui']
+aliases: ['moai-library-shadcn']
+updated: 2026-01-08
+status: "active"
+allowed-tools:
+  - Read
+  - Grep
+  - Glob
+  - mcp__context7__resolve-library-id
+  - mcp__context7__get-library-docs
+---
+
 ## Quick Reference (30 seconds)
 
 # Enterprise shadcn/ui Component Library Expert
@@ -340,7 +343,7 @@ export function LoginForm() {
 - [shadcn Components](modules/shadcn-components.md) - Advanced component patterns and implementation
 - [shadcn Theming](modules/shadcn-theming.md) - Theme system and customization strategies
 - `moai-domain-uiux` - Design system architecture and principles
-- `moai-lang-unified` - TypeScript best practices
+- `moai-lang-typescript` - TypeScript best practices
 - `code-frontend` - Frontend development patterns
 
 ---

moai_adk/templates/.claude/skills/moai-library-shadcn/modules/shadcn-theming.md

@@ -370,4 +370,4 @@ module.exports = {
 ---
 
 Last Updated: 2025-11-26
-Related: [Main Skill](../SKILL.md), [shadcn Components](shadcn-components.md)
+Related: [Main Skill](../SKILL.md), [Component Architecture](component-architecture.md)

moai_adk/templates/.claude/skills/moai-platform-auth0/SKILL.md

@@ -0,0 +1,283 @@
+---
+name: "moai-platform-auth0"
+description: "Auth0 security specialist covering attack protection, multi-factor authentication, token security, sender constraining, and compliance. Use when implementing Auth0 security features, configuring attack defenses, setting up MFA, or meeting regulatory requirements."
+version: 1.0.0
+category: "security"
+modularized: true
+tags: ['auth0', 'security', 'mfa', 'attack-protection', 'tokens', 'dpop', 'mtls', 'compliance', 'fapi', 'gdpr']
+updated: 2026-01-08
+status: "active"
+allowed-tools:
+  - Read
+  - Write
+  - Edit
+  - Grep
+  - Glob
+  - WebFetch
+  - WebSearch
+  - Bash
+context7-libraries: "/auth0/docs"
+---
+
+# Auth0 Security Specialist
+
+Comprehensive security skill for Auth0 implementations covering attack protection, multi-factor authentication, token security, sender constraining (DPoP/mTLS), and regulatory compliance (FAPI, GDPR, HIPAA).
+
+## Quick Reference
+
+### Security Feature Categories
+
+Attack Protection:
+- Bot Detection: CAPTCHA challenges for suspicious traffic
+- Breached Password Detection: Blocks compromised credentials
+- Brute Force Protection: Limits failed login attempts per account
+- Suspicious IP Throttling: Rate limits high-velocity attacks
+
+Multi-Factor Authentication:
+- Push notifications via Auth0 Guardian
+- One-time passwords (TOTP)
+- WebAuthn with security keys and biometrics
+- SMS/voice verification and Adaptive MFA
+
+Token Security:
+- JWT structure and validation
+- Access token management with scopes
+- Refresh token rotation and expiration
+- Token revocation strategies
+
+Sender Constraining:
+- DPoP: Application-layer token binding
+- mTLS: Transport-layer certificate binding
+
+Compliance: FAPI, GDPR, HIPAA/HITECH, PCI DSS, ISO 27001, SOC 2
+
+### Dashboard Navigation
+
+Attack Protection: Dashboard > Security > Attack Protection
+MFA Configuration: Dashboard > Security > Multi-factor Auth
+Security Center: Dashboard > Security > Security Center
+
+### Essential Setup Checklist
+
+1. Enable Bot Detection with appropriate sensitivity
+2. Activate Breached Password Detection
+3. Configure Brute Force Protection thresholds
+4. Enable Suspicious IP Throttling
+5. Set up at least one MFA factor
+6. Configure token expiration policies
+
+---
+
+## Implementation Guide
+
+### Attack Protection
+
+Bot Detection: Navigate to Dashboard > Security > Attack Protection > Bot Detection. Configure sensitivity (Low/Medium/High) and response type (Auth Challenge recommended, Simple CAPTCHA, or third-party). IP AllowList supports up to 100 addresses/CIDR ranges.
+
+Supported flows: Universal Login, Classic Login, Lock.js v12.4.0+, native apps. Unsupported: Enterprise connections, social login, cross-origin authentication.
+
+Breached Password Detection: Enable for signup and login. Response actions include blocking compromised credentials and user/admin notifications. Standard Detection has 7-13 months detection time; Credential Guard (Enterprise) reduces to 12-36 hours. Test with passwords starting with AUTH0-TEST-.
+
+Brute Force Protection: Default threshold is 10 failed attempts (configurable 1-100). Protection mechanisms include IP-based blocking and account lockout. Blocks remove after 30 days, password change, admin removal, or user unblock link.
+
+Suspicious IP Throttling: Velocity-based detection for high-volume attacks. Responds with HTTP 429. Configure separate thresholds for login (daily) and signup (per minute) attempts.
+
+For details: modules/attack-protection-overview.md
+
+### Multi-Factor Authentication
+
+Factor Configuration: Navigate to Dashboard > Security > Multi-factor Auth.
+
+Independent Factors (at least one required):
+- WebAuthn with FIDO Security Keys
+- One-time Password (OTP/TOTP)
+- Push Notifications via Auth0 Guardian
+- Phone Message (SMS/Voice)
+- Cisco Duo Security
+
+Dependent Factors: WebAuthn Biometrics, Email, Recovery codes
+
+MFA Policies: Never, Use Adaptive MFA (Enterprise), Always
+
+WebAuthn: Provides passwordless MFA with security keys or biometrics. Single interaction for multi-factor authentication, phishing-resistant.
+
+Adaptive MFA (Enterprise): Evaluates risk signals per transaction:
+- NewDevice: Device not used in past 30 days
+- ImpossibleTravel: Geographic anomalies
+- UntrustedIP: Suspicious activity history
+
+High-risk transactions require verification regardless of existing MFA sessions.
+
+Step-Up Authentication: Enhanced verification for sensitive operations. APIs use scopes; web apps verify ID token claims.
+
+For details: modules/mfa-overview.md, modules/adaptive-mfa.md
+
+### Token Security
+
+JWT Fundamentals: RFC 7519 standard. Auth0 issues signed JWTs (JWS). Structure includes Header, Payload (claims), and Signature. Always validate signatures, never store sensitive data in payloads, use HTTPS only.
+
+Access Tokens: Authorize API access with scopes. Types: Opaque (require introspection) and JWT (self-contained). Key claims: iss, sub, aud, scope, exp. Default lifetime: 86400 seconds (24 hours).
+
+Refresh Tokens: Enable session continuity. Maximum 200 active per user per application. Security features: Rotation (invalidates predecessor), expiring tokens (idle/absolute), revocation via Management API.
+
+Best Practices:
+- Treat signing keys as critical credentials
+- Prefer RS256 over HS256 for public key validation
+- Store tokens server-side when possible
+- Cache and reuse until expiration
+
+For details: modules/tokens-overview.md, modules/token-best-practices.md
+
+### Sender Constraining
+
+DPoP (Application Layer): Binds tokens to client-generated asymmetric key pairs.
+
+Steps: Generate key pair (ES256 recommended), create DPoP Proof JWT, send via DPoP header, include updated proof with each API request.
+
+Proof JWT Structure:
+- Header: typ (dpop+jwt), alg, jwk (public key)
+- Payload: jti, htm, htu, iat, ath (for API calls)
+
+Public clients must handle use_dpop_nonce errors.
+
+mTLS (Transport Layer): Binds tokens to X.509 certificates.
+
+Process: Client establishes mTLS connection, Auth0 calculates certificate SHA-256 thumbprint, embeds in token cnf claim as x5t#S256. Resource server validates thumbprint.
+
+Requirements: Confidential clients only, Enterprise Plan with HRI add-on, PKI infrastructure.
+
+For details: modules/dpop-implementation.md, modules/mtls-sender-constraining.md
+
+### Compliance
+
+Highly Regulated Identity (Enterprise + HRI add-on):
+- Strong Customer Authentication: Minimum two independent factors
+- Dynamic Linking: Transaction details in authorization
+- PAR: Pushed Authorization Requests
+- JAR: JWT-Secured Authorization Requests
+- JWE: Access token encryption
+- Private Key JWT and mTLS authentication
+
+GDPR Compliance:
+- Customer as Data Controller, Auth0 as Data Processor
+- User rights: Access, portability (JSON export), erasure, consent management
+- Security: Profile encryption, breach detection, brute-force protection
+
+Certifications: ISO 27001/27017/27018, SOC 2 Type 2, CSA STAR, FAPI 1 Advanced OP, HIPAA BAA available, PCI DSS compliant models
+
+For details: modules/highly-regulated-identity.md, modules/gdpr-compliance.md
+
+---
+
+## Advanced Patterns
+
+### Security Center Monitoring
+
+Access from Dashboard > Security > Security Center.
+
+Threat Categories:
+- Credential Stuffing: Machine-driven compromise attempts
+- Signup Attacks: Automated account creation
+- MFA Bypass: Circumvention attempts
+
+Filtering: Time period (up to 14 days), applications, connections. Auto-aggregation by minute/hour/day.
+
+Metrics: Bot detection counts, IP throttling events, brute force triggers, breached password alerts, MFA success/failure rates.
+
+### Application Credentials
+
+Client Secret (Default): Symmetric, simple but vulnerable to interception.
+
+Private Key JWT (Enterprise): Asymmetric key pairs, private key never transmitted, short-lived assertions. Recommended for enhanced security.
+
+mTLS for OAuth (HRI): X.509 certificates, strongest protection.
+
+Key Management: Register up to two public keys for zero-downtime rotation. Algorithms: RS256, RS384, PS256.
+
+### Continuous Session Protection
+
+Use Auth0 Actions for session context during token refresh events.
+
+Capabilities: IP/ASN monitoring, device tracking, expiration management, anomaly detection.
+
+Dynamic management: Customize lifetimes by user attributes, organization, or role.
+
+---
+
+## Module Reference
+
+Attack Protection:
+- modules/attack-protection-overview.md
+- modules/bot-detection.md
+- modules/breached-password-detection.md
+- modules/brute-force-protection.md
+- modules/suspicious-ip-throttling.md
+- modules/akamai-integration.md
+- modules/attack-protection-log-events.md
+- modules/state-parameters.md
+
+MFA:
+- modules/mfa-overview.md
+- modules/mfa-factors.md
+- modules/webauthn-fido.md
+- modules/adaptive-mfa.md
+- modules/guardian-configuration.md
+- modules/step-up-authentication.md
+- modules/mfa-api-management.md
+- modules/customize-mfa.md
+- modules/ropg-flow-mfa.md
+
+Tokens:
+- modules/tokens-overview.md
+- modules/jwt-fundamentals.md
+- modules/id-tokens.md
+- modules/access-tokens.md
+- modules/delegation-tokens.md
+- modules/refresh-tokens.md
+- modules/token-revocation.md
+- modules/token-best-practices.md
+
+Sender Constraining:
+- modules/dpop-implementation.md
+- modules/mtls-sender-constraining.md
+
+Compliance:
+- modules/compliance-overview.md
+- modules/fapi-implementation.md
+- modules/highly-regulated-identity.md
+- modules/gdpr-compliance.md
+- modules/certifications.md
+- modules/tenant-access-control.md
+- modules/customer-managed-keys.md
+
+Security Operations:
+- modules/security-center.md
+- modules/application-credentials.md
+- modules/continuous-session-protection.md
+- modules/security-guidance.md
+- modules/mdl-verification.md
+
+---
+
+## Usage Guide
+
+This skill provides comprehensive Auth0 security guidance. Use it for:
+- Attack Protection configuration
+- Multi-Factor Authentication setup
+- Token security implementation
+- Sender constraining (DPoP/mTLS)
+- Compliance verification (FAPI, GDPR, HIPAA)
+
+For comprehensive security reviews, use the expert-security agent included in this plugin.
+
+---
+
+## Resources
+
+Official Documentation:
+- https://auth0.com/docs/secure
+- https://auth0.com/docs/secure/attack-protection
+- https://auth0.com/docs/secure/multi-factor-authentication
+- https://auth0.com/docs/secure/tokens
+- https://auth0.com/docs/secure/sender-constraining
+- https://auth0.com/docs/secure/data-privacy-and-compliance