@fui-org/fui-cli 1.3.2 → 2.1.0

package/skills/fui-skill-cli/references/ui-table-cell-patterns.md

@@ -1,318 +0,0 @@
-# FUI Table Cell Patterns — f-table & in-cell controls
-
-> Owns: **in-cell `f-table` controls (`t-*`), `ctrl-update`, show-select, chip-group, `t-button` vs `t-menu`**. Table props: [component-table.md](component-table.md).
-
-Patterns for `f-table` and in-cell controls (`t-check`, `t-button`, `t-select`, `t-menu`, `ctrl-update`, `show-select`, `v-chip-group`), from project **security-manager**.
-
-> See also: [ui-patterns.md](ui-patterns.md) (data/watch/toolbar), [ui-dialog-patterns.md](ui-dialog-patterns.md), [component-table.md](component-table.md).
-
----
-
-## 1. Basic f-table with fixed header
-
-```json
-{
-  "el": "f-table",
-  "attr": {
-    "label": "User list",
-    ":items-per-page": 50,
-    ":height": -16,
-    ":items": "dsUser",
-    "item-key": "UserID",
-    ":hide-default-footer": false,
-    ":item-class": "item => item.ChuaKichHoat>0 ? 'danger' : ''",
-    ":headers": [
-      { "align": "center", "text": "UserID", "value": "UserID" },
-      { "text": "Username", "value": "UserName" },
-      { "text": "Fullname", "value": "FullName" }
-    ]
-  },
-  "w": 12
-}
-```
-
-- **Table height RULE (lint D9)**: the module's main data table declares `":height": -16` — f-table **measures its real position** after layout (`getBoundingClientRect().top`), fills to the screen bottom leaving 16px, and enables `fixed-header`. Data scrolls **inside the table** only, header stays put, no nested page scrollbars. Updates on window resize and when `items` changes.
-
-  | `:height`   | Behavior                                                                                              |
-  | ----------- | ----------------------------------------------------------------------------------------------------- |
-  | _(omitted)_ | Grows with row count — intentional short/lookup tables; wrong for the main table (whole page scrolls) |
-  | `<= 0`      | Fill to bottom leaving `abs(height)` px — **standard for main table**                                 |
-  | `> 0`       | Fixed px — **table inside a dialog** (e.g. `":height": 360`)                                          |
-
-  Same three modes apply to `f-sheet` — see [fsheet.md](fsheet.md) §Height.
-
-  ⚠ Old pattern `":height": "$( window ).height()-285"` is **deprecated** — it forces guessing total toolbar/filter/menu height; wrong guess = short or overflowing. It returns a **positive** number so it still works as fixed px (doesn't break) but loses auto-measure; lint D9 warns so you replace it with `-16`.
-
-- `:item-class`: conditional row highlight — `"item => item.Active==0 ? 'danger' : ''"`
-
----
-
-## 2. t-check — toggle in cell
-
-In `headers`, renders a checkbox/icon toggle that fires an API on click.
-
-```json
-{
-  "text": "Active",
-  "value": "Enable",
-  "align": "center",
-  "el": "t-check",
-  "attr": {
-    "on-icon": "mdi-check",
-    "off-icon": "mdi-lock",
-    ":action": [
-      { "API": "/SM_Users_SetActive", "IN": { "UserID": "item.UserID" } },
-      { "dsUser": [] },
-      { "CALL": "getUser" }
-    ]
-  }
-}
-```
-
----
-
-## 3. t-button — button in cell
-
-Button/icon with an action in a cell; supports dynamic icons.
-
-```json
-{
-  "text": "Allow",
-  "value": "Locked",
-  "align": "center",
-  "el": "t-button",
-  "attr": {
-    "color": "primary",
-    ":outlined": false,
-    ":icon-text": "`${ item.Locked==0 ? 'mdi-check-bold':'mdi-lock'}`",
-    ":action": [
-      { "API": "/SM_Computer_SetLocked", "IN": { "ComputerID": "item.ComputerID" } },
-      { "dsComputer": [] },
-      { "CALL": "getComputer" }
-    ]
-  }
-}
-```
-
----
-
-## 4. t-select — inline dropdown in cell
-
-Edit a field in the table; fires an API on selection.
-
-```json
-{
-  "text": "SystemRight",
-  "value": "SysRight",
-  "el": "t-select",
-  "width": "250px",
-  "attr": {
-    "class": "flex-md-grow-0 my-2",
-    ":items": "vueData.dsSystemRight",
-    "item-text": "Note",
-    "item-value": "SysRight",
-    ":action": [
-      {
-        "CONFIRM": "Bạn có chắc cập nhật System Right cho user này không?",
-        "API": "/SM_UserModule_UpdateSystemRight",
-        "IN": {
-          "ModuleID": "sModuleID",
-          "UserID": "item.UserID",
-          "SysRight": "item.SysRight"
-        },
-        "CALLBACK": { "MESS": "Cập nhật thành công." }
-      }
-    ]
-  }
-}
-```
-
----
-
-## 5. t-menu — context menu in table (menuChucNang)
-
-Define menu items in `data[]`, reference via `t-menu` in headers.
-
-**Step 1 — `menuChucNang` in `data[]`:**
-
-```json
-{
-  "menuChucNang": [
-    {
-      "color": "primary",
-      "icon-text": "mdi-account-details",
-      "text": "Update Info",
-      "action": [
-        {
-          "addNew": 0,
-          "dongChon": "item",
-          "sUserID": "item.UserID",
-          "sUserName": "item.UserName",
-          "sLastName": "item.LastName",
-          "sFirstName": "item.FirstName"
-        },
-        { "dlUserInfo": true }
-      ]
-    },
-    {
-      "color": "primary",
-      "icon-text": "mdi-shield-account-outline",
-      "text": "User Permission",
-      "action": [
-        {
-          "dongChon": "item",
-          "sUserID": "item.UserID",
-          "sFullName": "item.FullName"
-        },
-        {
-          "FUN": "openWindow",
-          "IN": {
-            "id": "`WinPer",
-            "title": "`User Permission",
-            "url": "`/UserPermission"
-          }
-        }
-      ]
-    }
-  ]
-}
-```
-
-**Step 2 — `t-menu` in `headers`:**
-
-```json
-{
-  "el": "t-menu",
-  "width": "120px",
-  "align": "center",
-  "text": "Update",
-  "value": "Update",
-  "attr": { ":items": "vueData.menuChucNang" }
-}
-```
-
-- `"dongChon": "item"` — stores the current record in `dongChon`
-- `"sUserID": "item.UserID"` etc. — copy item fields into state
-- `{ "dlXxx": true }` — open the dialog after state is ready
-
----
-
-## 6. ctrl-update CRUD
-
-CRUD directly in the table — no manual dialog.
-
-```json
-{
-  "el": "f-table",
-  "attr": {
-    ":items": "dsFunctionRight",
-    "item-key": "FunctionID",
-    ":headers": [
-      { "text": "Code", "value": "FunctionCode" },
-      { "text": "Name", "value": "FunctionName" },
-      { "text": "Update", "value": "ctrl-update" }
-    ],
-    ":update-form": [
-      {
-        "el": "v-text-field",
-        "w": 12,
-        "attr": { "v-model": "FunctionCode", "label": "Function Code", ":required": true }
-      },
-      {
-        "el": "v-text-field",
-        "w": 12,
-        "attr": { "v-model": "FunctionName", "label": "Function Name" }
-      }
-    ],
-    ":update-api": {
-      "new": {
-        "API": "/SM_Function_Insert",
-        "IN": { "ModuleID": "sModuleID", "FunctionCode": "item.FunctionCode", "FunctionName": "item.FunctionName" },
-        "CALLBACK": { "CALL": "getFunctionRight" }
-      },
-      "edit": {
-        "API": "/SM_Function_Update",
-        "IN": {
-          "FunctionID": "item.FunctionID",
-          "FunctionCode": "item.FunctionCode",
-          "FunctionName": "item.FunctionName"
-        },
-        "CALLBACK": { "CALL": "getFunctionRight" }
-      },
-      "delete": {
-        "CONFIRM": "Bạn có chắc muốn xóa quyền này không?",
-        "API": "/SM_Function_Delete",
-        "IN": { "FunctionID": "item.FunctionID" },
-        "CALLBACK": [{ "MESS": "Xóa thành công" }, { "CALL": "getFunctionRight" }]
-      }
-    }
-  }
-}
-```
-
-Use ctrl-update for simple edit forms (2–5 fields) with no complex layout.
-
----
-
-## 7. f-table with show-select (multi-select)
-
-```json
-{
-  "el": "f-table",
-  "attr": {
-    ":show-select": true,
-    "v-model": "sUserSelected",
-    ":items": "dsUsers",
-    "item-key": "UserID",
-    ":items-per-page": -1,
-    ":hide-default-footer": true,
-    ":update-api": { "default-item": { "xAA": [] } },
-    ":headers": [...]
-  }
-}
-```
-
-- `v-model`: array of selected items
-- `:update-api.default-item`: injects default fields into each item on load (here `xAA: []` for chip-group)
-
----
-
-## 8. v-chip-group in cell
-
-Tag list in a cell; click opens a dialog.
-
-```json
-{
-  "text": "FunctionRight",
-  "value": "FunctionName",
-  "el": "v-chip-group",
-  "attr": {
-    "v-model": "item.xAA",
-    "column": true,
-    "v-if": "item.FunctionName"
-  },
-  "innerHTML": [
-    {
-      "el": "v-chip",
-      "attr": {
-        ":small": true,
-        "color": "primary",
-        "outlined": "",
-        "v-for": "fn in item.FunctionName",
-        ":key": "fn",
-        "v-on:click": "vueData.dlFunction = true; CALL(setFunction(item, item.FunctionName));"
-      },
-      "innerHTML": "<div>{{fn.FunctionCode}}-{{fn.FunctionName}}</div>"
-    }
-  ]
-}
-```
-
----
-
-## `t-button` vs `t-menu`
-
-- **`t-button`**: the only action is viewing/loading related data → one direct click
-- **`t-menu`**: several actions **or** a state-changing action (Kích hoạt, Chốt điểm, Xóa...)
-
-> Don't wrap "Xem chi tiết" in `t-menu` — adds a wasted click; use `t-button`. See Master-Detail in [ui-layout-patterns.md](ui-layout-patterns.md).

package/skills/fui-skill-cli/references/ui-templates.md

@@ -1,22 +0,0 @@
-# UI Templates — `examples/`
-
-> Owns: **the 4 sample files in `examples/` and how to reuse them**. `controls`/action rules: [controls-patterns.md](controls-patterns.md); detailed f-table patterns: [component-table.md](component-table.md).
-
-`examples/` holds **real reference files**, not blank templates to copy whole. Read them for correct syntax/patterns, then rewrite for the actual business case.
-
-## Files
-
-| File                    | Use when                                                                                                                                                                                                                   |
-| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `component.vue`         | Sample custom Vue component (`uc-*`) — standard `<template>` + `<script>`, no `name:`, no `components:{}`, no `<style>`                                                                                                    |
-| `module-patterns.json`  | **Full module reference** — data/watch/controls combined: menuChucNang, TypeLoad, addNew flag dialog, nested IF/THEN/ELSE, bulk action, openWindow+button+ctrlhotkey, `_.find`, pushRouter, inline f-menu, row-prop-object |
-| `f-table-patterns.json` | **In-depth f-table reference** — all props, every header type (`t-check`/`t-select`/`t-button`/`t-link`/`t-menu`/`v-chip-group`/`v-icon`/divider), full `ctrl-update`, f-table in a dialog, default-item-only              |
-| `project-patterns.json` | **`project.json` reference** — full project config: menuLeft/menu/menuStyle/menuComponent/domainSetting, `right` by SystemRight+FunctionRight, relation to module.json `set` (per-page override of title/menu/apiDomain)   |
-
-## How to use
-
-1. Identify the case → open the matching file above.
-2. Take **only the pattern needed** (one action, one header, one dialog block) — never the whole file.
-3. Replace APIs with real endpoints; rename fields/labels for the business case.
-4. Merge into the module's existing `data` / `controls` / `watch`.
-5. Run `fui module validate` then `fui module outline` before publishing.

package/skills/fui-skill-cli/references/verification.md

@@ -1,236 +0,0 @@
-# FUI Definition-of-Done Checklists
-
-> Owns: **definition-of-done checklists before publish (module.json, `.vue`, SP, deploy)** and **symptom → verification tier matrix**. Flags: `fui <command> --help`.
-
-Each item is a gate: not ready while any required item is unchecked.
-
----
-
-## Pick the tier by SYMPTOM (read before rendering)
-
-Tiers differ ~100× in cost per run:
-
-| Tier | Command                        | Cost                 | Sees                                                |
-| ---- | ------------------------------ | -------------------- | --------------------------------------------------- |
-| 1    | `fui module validate`          | instant, file-only   | static rule/reference errors                        |
-| 2    | `fui module outline`           | instant              | layout, orphan actions, dialogs nobody opens        |
-| 3    | `fui module simulate`          | ~1 s                 | flow: action chain, watch, what OUT assigns         |
-| 4    | `fui component preview`        | browser, 1 component | bugs in one `uc-*.vue`                              |
-| 5    | `fui module simulate --render` | browser, ~10–30 s    | **real visuals**: layout, height, style, responsive |
-
-`fui module check` = tiers 1–3 in one step.
-
-**Start at the cheapest tier that catches the symptom**, never tier 5 by default. Tier 5 alone sees visuals but can't say **why**.
-
-| Symptom                                                                             | Cheapest tier                                                                     | Why                                                                                                                                                                                              |
-| ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Blank page, **no** JS error, **no** `[Vue warn]`                                    | **1**                                                                             | statement inside a `:attr` — Vue swallows template compile errors                                                                                                                                |
-| `[Vue warn] Property or method "x" is not defined`                                  | **1**                                                                             | variable not in `data[]`                                                                                                                                                                         |
-| Button does nothing                                                                 | **1** (CALL target) → **3**                                                       |                                                                                                                                                                                                  |
-| `Unknown custom element: <f-…>` / empty component                                   | **1**                                                                             | wrong name or missing required import                                                                                                                                                            |
-| Chart draws nothing                                                                 | **1** (missing `echarts.min.js`/`fechart.js`, most cases) → **5** (0-size canvas) |                                                                                                                                                                                                  |
-| Misaligned columns, cramped row                                                     | **2** (Σw > 12)                                                                   |                                                                                                                                                                                                  |
-| Dialog won't open                                                                   | **2** (`⚠ không thấy lệnh mở`) → **3**                                            |                                                                                                                                                                                                  |
-| Wrong action order · infinite watch loop · CONFIRM/MESS wrong branch                | **3**                                                                             |                                                                                                                                                                                                  |
-| Wrong numbers · `undefined`/`NaN` on page                                           | **3**                                                                             | almost always `OUT`/mapData on the wrong key, not display                                                                                                                                        |
-| API returns unexpected shape                                                        | `fui sp verify` (static, **calls no endpoint**)                                   | infers from the real SP body + generates `--mocks` for tier 3. Only metadata reads: `OBJECT_DEFINITION` when no local `.sql`, `sys.database_permissions` with `--check-grant`; never runs the SP |
-| One `uc-*.vue` wrong                                                                | **4**                                                                             | once proven, remaining bugs are assembly                                                                                                                                                         |
-| Horizontal overflow · wrong height · leaking style · bad spacing · broken on mobile | **5**                                                                             | only tier seeing geometry                                                                                                                                                                        |
-| Import/asset not loaded                                                             | **5**, section `⛔ MÔI TRƯỜNG THIẾU FILE`                                         | environment error — **don't** edit the module for it                                                                                                                                             |
-| Suspected "platform library bug"                                                    | **5**, check `⛔ ASSET CŨ` FIRST                                                  | stale asset ⇒ on-disk copy ran; CDN conclusions worthless                                                                                                                                        |
-| **Permission-gated** button/menu hidden for real users but shown in preview         | **1** after `fui right function list`                                             | undefined code ⇒ `rightTest()` always false, no JS error. Tiers 3/5 **pre-grant** scanned codes so they always show — [permission-system.md](permission-system.md)                               |
-
-**Stale assets:** `--render` revalidates every asset per run (conditional GET; trace shows `N revalidate 304`). `⛔ ASSET CŨ, KHÔNG XÁC MINH ĐƯỢC` = network failed, on-disk copy ran ⇒ "library X has a bug" from that run is **unusable**; reconnect and re-render, or `--refresh-assets`. `ℹ️ ASSET PLATFORM ĐÃ ĐỔI` = platform file changed between runs — behavior changed without a `module.json` edit ⇒ look there first.
-
-**Read the `--render` report top-down:** `═══ CHẨN ĐOÁN ═══` groups failures by **where to fix** — `[MÔI TRƯỜNG]` (fix first; the others may be consequences) · `[MODULE]` (module.json/script.js/component) · `[HIỂN THỊ]` (DOM audit + image). `↪` = cheaper tier that should have caught it.
-
-**STOP re-rendering** when `Δ so với lượt trước` shows _no metric changed_: the fix missed the bug. Drop to tiers 1–3 to learn why, then return.
-
----
-
-## Module Checklist
-
-### Structure
-
-- [ ] `_moduleInfo.json` has `ModuleID`, `ModuleName`, `Framework`, `mTitle`, `HTMLOnly`
-- [ ] `module.json` is valid JSON (no trailing commas, no comments) — re-read after every long edit to catch a comma after the last array/object element
-- [ ] Custom components ⇒ `components/_components.json` lists all `uc-*.vue`
-- [ ] External JS/CSS ⇒ `imports/_imports.json` exists
-
-### module.json — Data
-
-- [ ] All state declared in `data[]` before use in actions
-- [ ] Every named action reachable (`CALL`, `watch` or button click)
-- [ ] No hardcoded IDs — use `vueData.someVar`, not literal numbers
-- [ ] `OUT` keys match state names exactly (case-sensitive)
-
-### module.json — Actions
-
-- [ ] Every `API` has `IN` and `OUT` (or `CALLBACK`)
-- [ ] Every delete has `CONFIRM` before `API`
-- [ ] Every mutation has a `CALLBACK` that reloads data or shows `MESS`
-- [ ] Literal strings in `IN`: backtick prefix or single quotes — ``"`winId"`` or `"'text'"`
-- [ ] `IF/THEN/ELSE` branches have matching action structures
-- [ ] No raw `EXE` duplicating logic expressible as actions
-
-### module.json — Controls
-
-- [ ] `controls` starts with `{ "prop": "fluid grid-list-md", "rows": [...] }`
-- [ ] Every `cols` item has `w`
-- [ ] `v-on:click`, not `@click`
-- [ ] No `children` — nest with `innerHTML` array
-- [ ] Permission gates on `col: { "v-if": "vueData.user.SystemRight>=N" }` (not `attr`)
-- [ ] **Every gated `FunctionRight`/`SystemRight` code EXISTS** — ran `fui right function list`/`fui right system list` (also builds the cache `fui module validate` checks); missing ⇒ `fui right function new`/`fui right system new` FIRST. Invented codes hide controls silently while **preview still shows them** — [permission-system.md](permission-system.md)
-- [ ] `v-if` uses `vueData.` prefix for state
-- [ ] Dialogs use `el: "hidden-container"`, one per dialog
-
-### module.json — Watch
-
-- [ ] Keys reference declared state
-- [ ] `deep-watch` for nested object/array
-- [ ] No watch calls an action that re-triggers itself (infinite loop)
-
-### UI Quality
-
-- [ ] Vuetify classes/props before inline `style` (FUI V2 = Vuetify 1.5, FUI V3 = Vuetify 3)
-- [ ] `f-*` over raw `v-*` when an equivalent exists
-- [ ] Tables: `f-table`, not `v-data-table` — CRUD and read-only (read-only = no `:update-api`)
-- [ ] Totals via `sum-format` (object → total row; string → text line below) — never hand-built
-- [ ] Charts: **`f-echart`** only — not `v-chart`, `<canvas>`, other libs; follow **default display conventions** in components-echart.md
-- [ ] Date/time: `f-date`/`f-time`, not `v-text-field` + manual parsing
-
-### Import JS/CSS
-
-- [ ] Each component needing imports (table in `component-quickref.md`): checked with `fui import list`
-- [ ] Missing ⇒ `fui import new` per file
-- [ ] Component removed ⇒ if its import is unused elsewhere, `fui import delete`
-- [ ] **`f-echart`**: both imports, in order:
-  - `/include/chart/echarts.min.js`
-  - `/include/chart/fechart.js`
-
-### Validate before publish
-
-- [ ] New module with UI + API: UI built with hardcoded `data[]` + visual QA (`fui module simulate --render`) BEFORE the API contract and SPs — [fullstack-workflow.md](fullstack-workflow.md)
-- [ ] `fui module validate` after editing `module.json` — fix every **error** (missing CALL target, `@`/`#` shorthand, `children`, bad grid...)
-- [ ] Read each warning — may be intentional (unlisted component, optional param...), never skip unread
-- [ ] **`[design]`** warnings (colored dialog toolbar, red delete button, odd dialog width, no floating label, delete without CONFIRM, redundant Close button, hand-built v-snackbar/v-alert instead of MESS/MESSBOX, main f-table/f-sheet without `":height": -16` so the page scrolls instead of the table...) — **must fix** unless the user explicitly asked otherwise this session
-- [ ] Strict mode (`FUI_MCP_STRICT=1`): errors BLOCK publish
-- [ ] `fui module outline`, READ the tree: row Σw ≤12? `⚠ không thấy lệnh mở`? `⚠ không thấy nơi gọi`? `⚠ không thấy dùng`?
-- [ ] Complex runtime logic (action chain, watch cascade, dialog flow): `fui module simulate` with main-flow `--scenario` + `--mocks` (shape from `fui sp verify` snippet) + asserts — fix every `⚠` and ✘ first. Your `--mocks` always win; a static API with NO mock whose SP is confirmed read-only (`fui sp verify`/local `.sql`) is called for real (max 8 calls/run, cached in `_testdata/`) instead of `{data:[]}` — see the "Live/Cache data" line. SPs with writes are never called
-- [ ] **`--mocks` for existing SPs come from `fui sp verify`, never guessed** — on `🚨 CẤU TRÚC MOCK CHƯA ĐƯỢC KIỂM CHỨNG`, stop, run `fui sp verify`, copy the snippet verbatim (no hand edits). Invented shapes only for SPs not yet deployed
-- [ ] **Final visual QA (Playwright available)**: `fui module simulate --render --vue-data '{..demo data..}' --mocks '{...}'`. READ the screenshot (always inline; big PNG → JPEG) + DOM audit (empty app, overflow, "undefined"/"NaN", broken image, 0-size chart canvas) + JS errors/`[Vue warn]` + final vueData; fix and re-render until clean. **`⛔ MÔI TRƯỜNG THIẾU FILE` first**: environment error — run its suggested command (`fui project sync`/`fui module get`); errors below may be consequences, don't edit module.json for them. How to read screenshots: `ui-screenshot-review.md`. Chart/animation missing → raise `--settle-ms` (e.g. 1500). Open dialog captured as `render-dialog.jpg`. Mobile use → extra run `--device mobile`. No Playwright → skip (command returns install steps)
-- [ ] **Changed project level + module level** (project component/import, `project.json`/menu): publish **project level FIRST**, then render — `--render` loads `$projectData`, project components and project CSS from the server (`_aset`); module-level parts render locally (iterate freely, publish later). **Project components are hard-blocked** (no bypass flag) if a local `uc-*.vue` differs from the server bundle: `fui component preview` → `fui component new`/`update` → render. Blocked because server is newer (web IDE edit) → `fui project sync`, never push over
-
-### Publish — only what changed
-
-- [ ] Only `module.json` → `fui module publish json` (no preview/approval)
-- [ ] `header.html` / `body.html` / title → `fui module preview` → user approves → `fui module publish html --approval <token>` (includes module.json)
-- [ ] `script.js` (even emptied) → `fui module publish script` — **⚠️ `publish html` does not clear an empty script on the server**
-- [ ] `uc-*.vue` → `fui component new` (first) / `fui component update` (later), per file — `update` hard-errors if absent on server, never creates
-- [ ] Several parts → one command each, in turn
-
-For `fui module publish html`: preview ran and diff reviewed · user explicitly confirmed · approval token in hand.
-
----
-
-## Stored Procedure Checklist
-
-### Naming
-
-- [ ] `spAPI_{Entity}{Action}`, Action = `List`/`Select`/`Insert`/`Update`/`Delete`/`Save` (e.g. `spAPI_ContractList`, `spAPI_ContractInsert`)
-- [ ] No spaces, no `sp_`/`SP_` prefix
-
-### Parameters
-
-- [ ] `@sys_UserID int` in all writes (INSERT/UPDATE/DELETE)
-- [ ] `@sys_SystemRight int` when checking permission
-- [ ] Input params before system params; no unused params
-
-### Security
-
-- [ ] Permission check at top: `IF @sys_SystemRight < N BEGIN RAISERROR(N'[Unauthorized]Bạn không có quyền...', 16, 1) RETURN END` — severity always `16`; `[Unauthorized]` prefix required so tAPI returns HTTP 401 ([tapi-reference.md](tapi-reference.md) §5)
-- [ ] No SQL string concatenation (parameterize)
-- [ ] `.sql` has **NO `GRANT EXECUTE`** — tAPI sends one batch, no `GO`, so a GRANT after `END` is **swallowed into the SP body** and runs on every call, silently. `fui sp deploy` grants new procedures and **re-queries `sys.database_permissions` to confirm**
-- [ ] `fui sp deploy` shows `✓ [public] đã có quyền EXECUTE`; on `❗` run exactly the printed GRANT (**don't redeploy**). `fui exec` deploys have no auto-grant (fui warns with the command). Later doubts: `fui sp verify <name> --check-grant`
-
-### Logic
-
-- [ ] Returns exactly the columns `OUT` expects
-- [ ] Errors: `RAISERROR(N'...', 16, 1)` then `RETURN`, never silent
-- [ ] Transactions for multi-step writes
-- [ ] Reviewed statically (read body, reason about branches/edge cases) — never smoke-tested against the live endpoint
-
-### Deploy
-
-- [ ] `fui sp save` first (local only)
-- [ ] Full body reviewed in the local file
-- [ ] Summary to user: SP name, CREATE/ALTER, affected tables
-- [ ] User explicitly confirmed before `fui sp deploy`
-- [ ] Any API (read or write) about to be wired into module.json → `fui sp verify` once: static shape/error contract + param check, **no endpoint call** (metadata reads only, as above)
-- [ ] **Write** APIs: verify by reading the body (`fui sp get`/`fui sp verify`) — WHERE, transaction, RAISERROR; test the UI flow with `fui module simulate --mocks '{...}'` (snippet from `fui sp verify`), never the real API
-
----
-
-## Vue Component Checklist (`uc-*.vue`)
-
-### File
-
-- [ ] Name starts with `uc-`; registered in `_components.json`
-- [ ] `<style scoped>`: every selector prefixed with the component's own class — `scoped` does NOT scope (server concatenates `ComCSS`), bare selectors leak. [component-design.md](component-design.md)
-- [ ] No backtick template strings in `<template>`
-
-### API Design
-
-- [ ] Inputs are typed `props`; neutral names (`items`, `value`, `label`)
-- [ ] Emits events (`input`, `change`, `select`, `action`), never mutates parent state
-- [ ] Loading, empty, error states handled (prop or slot)
-
-### Behavior
-
-- [ ] No data fetching unless explicitly data-owning
-- [ ] No hardcoded route/module paths
-- [ ] No permission logic — gating stays in `module.json`
-
-### Verify in isolation (before assembling / pushing)
-
-- [ ] `fui component preview` with **≥2 cases**: normal + edge (empty list / very long string / missing field) — edge cases fail most
-- [ ] READ **desktop and mobile** screenshots (default): no overflow, no break at 390px, no "undefined"/"NaN"
-- [ ] No JS error / `[Vue warn]`
-- [ ] Interactive ⇒ `scenario` with `click`/`set` + `assert` passes (use `nth`, not `item`/`index`)
-- [ ] Self-sizing (chart, table) ⇒ also a low-height `viewport`
-- [ ] **Project-level component**: push (`fui component new`/`update`) RIGHT AFTER a clean preview — module `--render` hard-blocks on mismatch
-
----
-
-## Import File Checklist
-
-- [ ] File type matches `ContentType` (`.js` → `application/javascript`, `.css` → `text/css`)
-- [ ] `sort` >= 40 for new imports (1–39 reserved)
-- [ ] Content tested locally before `fui import upload`
-- [ ] No tokens/passwords in JS/CSS
-- [ ] Updating ⇒ `fui import get` first
-
----
-
-## Debug — errors after publish
-
-1. **Re-read every file changed in that publish first**; don't jump elsewhere
-2. Looks right ⇒ `fui module preview` for server vs local diff
-3. Preview shows `Controls: 0` / `Data keys: 0` ⇒ server holds a broken old version — push again
-4. Only when local is confirmed correct: check other files (header.html, script.js, imports)
-
----
-
-## Quick Risk Gate
-
-Before any mutating command:
-
-| Question                                   | If NO →                        |
-| ------------------------------------------ | ------------------------------ |
-| Read-only command?                         | Confirm intent with user       |
-| Summary shown to user?                     | Show it, then wait             |
-| 🔴 Destructive?                            | Require explicit confirmation  |
-| `fui module publish html`: approval token? | Run `fui module preview` first |
-| `fui sp deploy`: user saw the SP body?     | Show it, wait for OK           |
-
-Per-command classification: [tools-registry.md](tools-registry.md).