moostjs

Use when working with the Moost framework (moost, @moostjs/event-http/cli/wf/ws, @moostjs/swagger, @moostjs/otel, @moostjs/vite, create-moost) to build decorator-driven TypeScript apps for HTTP, CLI, WebSocket, Workflow events, or custom adapters. Covers controllers, controller subclassing (@Inherit), handler/parameter/response decorators, DI, interceptors, pipes, auth guards, framework errors, common metadata decorators, Wooks composables, adapter authoring, quick apps, workflow outlets/state strategies, WebSocket rooms/testing, logging, app-init hooks (@MoostInit), the Vite plugin (dev/build, middleware, SSR/SPA, deployment), event context/scoping, Swagger/OpenAPI generation, and OTel tracing/metrics. Not for plain @wooksjs/* apps without Moost decorators (use the wooksjs skill), nor auth/RBAC — @moostjs/arbac is deprecated; use the aooth packages (@aooth/auth-moost, @aooth/arbac-moost) and their own docs/skill.

Use when working with `@atscript/*` packages or `.as` files. `.as` = single source of truth for types, metadata, and validation constraints. Covers `.as` syntax, `@meta.*` / `@expect.*` / custom annotations, primitives, the `asc` CLI + `atscript.config.*`, generated `.as.d.ts` / `.as.js` / `atscript.d.ts`, runtime helpers (`Validator`, `coerceForType`, JSON Schema, serialize), `unplugin-atscript`, `@atscript/moost-validator` (validation + coercion pipes), VSCode LSP, and plugin authoring. Out of scope: `@db.*` annotations, schema sync, DB adapters → use the atscript-db skill; `@ui.*` annotations, vue-form, vue-table → use the atscript-ui skill.

Use when adding authentication or authorization to a Moost app — login, JWT/session tokens, password+MFA (TOTP), SMS OTP, RBAC roles/guards, magic links, password reset, invites, OAuth2/OIDC federated login, or BE the OAuth/OIDC provider (CLI SSO, `@aooth/login-client`; MCP-connector DCR (RFC 7591) + client_secret_post, refresh_token grant, RFC 8414/9728 discovery metadata). Covers `@aooth/user`, `@aooth/auth`, `@aooth/idp`, `@aooth/arbac`, `@aooth/auth-moost`, `@aooth/arbac-moost` — the aoothjs auth+authz stack for moost/atscript apps. Triggers on `.as` models extending `AoothUserCredentials` / `AoothArbacUserCredentials`, `@arbac.*` / `@aooth.user.*` annotations, refresh rotation, `AuthWorkflow` seams, `FederatedLoginService`, `ConsentStore`, consent-only authorize (`resolveAuthzReauthPolicy`), or `authGuardInterceptor` / `arbacAuthorizeInterceptor`. Out of scope: moost internals (`moostjs`), `.as`/`asc` (`atscript`), `@atscript/db`/`moost-db` (`atscript-db`), `@ui.*`/SPA components (`atscript-ui`).