@imfusion/web-ui 0.5.0 → 0.5.1-dev.11.g2e949f6d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imfusion/web-ui",
-  "version": "0.5.0",
+  "version": "0.5.1-dev.11.g2e949f6d",
   "description": "The official Web UI component library for ImFusion web apps",
   "author": "ImFusion GmbH",
   "license": "UNLICENSED",
@@ -9,10 +9,17 @@
     "access": "restricted"
   },
   "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "imports": {
+    "#/*": "./src/*",
+    "#/storybook/*": "./.storybook/*"
+  },
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "web-ui-install-skills": "./bin/install-skill.js"
+    "web-ui-install": "bin/install.js"
   },
   "exports": {
     ".": {
@@ -36,39 +43,40 @@
     "bin"
   ],
   "scripts": {
-    "codegen:docgen": "tsx src/docgen/gen-docgen.ts",
-    "codegen:llms": "tsx src/llms/gen-llms.ts",
-    "codegen:watch": "tsx watch src/codegen/run.ts",
-    "codegen:storybook": "tsx src/codegen/run.ts --storybook",
-    "codegen": "tsx src/codegen/run.ts",
-    "build": "npm run codegen && rm -rf dist && vite build && npm run codegen:docgen && npm run codegen:llms",
     "dev": "tsx scripts/dev.ts",
     "dev:host": "tsx scripts/dev.ts --host",
     "dev:lib": "concurrently -n codegen,lib -c yellow,blue \"npm run codegen:watch\" \"vite build --watch\"",
-    "typecheck": "npm run codegen && tsc -p tsconfig.lib.json --noEmit && tsc -p .storybook/tsconfig.json --noEmit",
+    "build": "npm run codegen && rm -rf dist && vite build && npm run codegen:docgen && npm run codegen:llms",
+    "build:storybook": "npm run codegen:storybook && storybook build",
+    "storybook": "npm run codegen:storybook && storybook dev -p 6006 --no-open",
+    "storybook:free-ports": "tsx scripts/free-storybook-ports.ts",
+    "codegen": "tsx src/codegen/run.ts",
+    "codegen:watch": "tsx watch src/codegen/run.ts",
+    "codegen:storybook": "tsx src/codegen/run.ts --storybook",
+    "codegen:docgen": "tsx src/docgen/gen-docgen.ts",
+    "codegen:llms": "tsx src/llms/gen-llms.ts",
+    "verify:format": "prettier --check .",
+    "verify:lint": "eslint . --cache --max-warnings=0",
+    "verify:typecheck": "npm run codegen && tsc -p tsconfig.lib.json --noEmit && tsc -p .storybook/tsconfig.json --noEmit",
+    "verify:tests": "vitest run",
+    "verify:deps": "tsx scripts/check-pinned-dependencies.ts",
+    "verify:staged": "tsx scripts/verify/staged.ts",
+    "verify:full": "tsx scripts/verify/full.ts && npm run verify:tests",
     "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "lint": "eslint . --cache --max-warnings=0",
-    "lint:fix": "eslint . --cache --fix",
+    "lint": "eslint . --cache --fix",
     "lint:inspect": "npx @eslint/config-inspector@latest",
+    "test:unit": "vitest run --project unit",
+    "test:stories": "vitest run --project storybook",
+    "test:watch": "vitest",
     "skills:eval": "node src/llms/evals/run.mjs",
     "skills:eval:dev": "WEB_UI_SKILL_EVAL_ROOT=/private/tmp/web-ui-dev-skill-evals WEB_UI_SKILL_EVAL_RESULTS_DIR=.agents/evals/results WEB_UI_SKILL_EVAL_REPORT_PATH=.agents/evals/REPORT.md WEB_UI_SKILL_EVAL_SKILL_FAMILY=web-ui-dev WEB_UI_SKILL_EVAL_WORKSPACE_LABEL='development repository' node src/llms/evals/run.mjs --scenarios-dir .agents/evals/scenarios --setup .agents/evals/setup-env.sh",
     "skills:eval:compare": "node src/llms/evals/compare.mjs",
     "skills:eval:report": "node src/llms/evals/report.mjs",
-    "storybook": "npm run codegen:storybook && storybook dev -p 6006 --no-open",
-    "storybook:free-ports": "tsx scripts/free-storybook-ports.ts",
-    "build:storybook": "npm run codegen:storybook && storybook build",
-    "test": "vitest run",
-    "test:unit": "vitest run --project unit",
-    "test:stories": "vitest run --project storybook",
-    "test:watch": "vitest",
-    "verify:preflight": "tsx scripts/verify/full.ts",
-    "verify:full": "npm run verify:preflight && npm run test",
     "worktree:create": "tsx scripts/worktrees.ts create",
     "worktree:close": "tsx scripts/worktrees.ts close",
     "worktree:discard": "tsx scripts/worktrees.ts discard",
     "knip": "knip",
-    "prepare": "git config core.hooksPath .githooks && git config pull.rebase true && git config merge.ff only"
+    "git:config": "git config core.hooksPath .githooks && git config pull.rebase true && git config merge.ff only"
   },
   "peerDependencies": {
     "@imfusion/sdk": "^1.0.0",

package/src/docgen/doc.gen.json

@@ -1281,7 +1281,7 @@
         {
           "name": "variant",
           "required": false,
-          "type": "| \"inherit\"\n| \"main\"\n| \"support\"\n| \"minor\"\n| \"brand\"\n| null",
+          "type": "| \"inherit\"\n| \"main\"\n| \"support\"\n| \"minor\"\n| \"brand\"\n| \"oncolor\"\n| null",
           "defaultValue": "brand",
           "description": ""
         }

package/src/llms/skills/imf-web-ui/SKILL.md

@@ -2,8 +2,8 @@
 name: imf-web-ui
 description:
   "Entry point for UI work in a project that depends on @imfusion/web-ui. Decides whether guidance is needed at all, then
-  routes to the right companion skill — component reference, UX guidance, or frontend patterns. Load when adding or editing
-  UI in a consumer repo."
+  routes to the right companion skill — component reference, UX guidance, or frontend conventions. Load when adding or
+  editing UI in a consumer repo."
 ---
 
 # imf-web-ui
@@ -24,16 +24,25 @@ Guidance skills exist to fill gaps, not to add ceremony to clear tasks.
 
 ## Routing
 
-| The task at hand                                                                                     | Open                           |
-| ---------------------------------------------------------------------------------------------------- | ------------------------------ |
-| Using a specific component; checking props, sub-components, or defaults                              | `imf-web-ui-components`        |
-| First-time setup, or components rendering unstyled/broken                                            | `imf-web-ui-setup`             |
-| Building/reshaping a screen or flow; choosing between components; layout, density, hierarchy, states | `imf-web-ui-ux`                |
-| Writing wrappers or custom UI around the library; styling beyond defaults; state or code structure   | `imf-web-ui-frontend-patterns` |
+| The task at hand                                                                                      | Open                              |
+| ----------------------------------------------------------------------------------------------------- | --------------------------------- |
+| Using a specific component; checking props, sub-components, or defaults                               | `imf-web-ui-components`           |
+| First-time setup, adding a library dependency, or components rendering unstyled/broken                | `imf-web-ui-library-setup`        |
+| Building/reshaping a screen or flow; choosing between components; layout, density, hierarchy, states  | `imf-web-ui-ux`                   |
+| Writing wrappers or custom UI; styling beyond defaults; adding files; TypeScript, naming, testing     | `imf-web-ui-frontend-conventions` |
+| Setting up or auditing an **ImFusion** repo's tooling: formatting, linting, hooks, scripts, structure | `imf-web-ui-frontend-setup`       |
+
+The last row is narrow on purpose. It's for "what is this project missing?" — a question about the repo as a whole. Being
+asked to add one config file is just that edit; make it, and don't open a skill to do so.
 
 Tasks routinely span two: building a screen usually means `imf-web-ui-ux` for the shape and `imf-web-ui-components` for the
 APIs. That's normal — open both, in that order.
 
+## The stack
+
+TanStack is the recommended tooling library — routing, server state, forms, tables. When a task needs one of those and the
+project has no incumbent, propose it, and read the library's own docs (`npx @tanstack/cli`) rather than working from memory.
+
 ## When to interview the human
 
 `imf-web-ui-ux` contains a short per-feature interview. Run it **only** when both hold:

package/src/llms/skills/imf-web-ui-agent-setup/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: imf-web-ui-agent-setup
+description:
+  "Install or update the LLM/agent tooling @imfusion/web-ui ships in a consumer repo: the vendored imf-web-ui-* skills, the
+  AGENTS.md fence, the agent lifecycle hooks, and the staleness wiring. Wraps npx web-ui-install and adds the judgment the
+  binary can't have — reading what the repo already registers before adding anything. Load when setting up agent tooling in a
+  consumer app, when skills are stale, or when hooks should be installed or adapted. Not for project tooling
+  (imf-web-ui-frontend-setup) or library wiring (imf-web-ui-library-setup)."
+---
+
+# imf-web-ui-agent-setup
+
+Sets up or updates the agent side of a consumer repo. The binary does the mechanics; this skill does the judgment.
+
+## Skills
+
+`npx web-ui-install` installs or refreshes the vendored `imf-web-ui-*` skills (interactive target choice on first run,
+remembered after; `--reconfigure` re-opens it). It also refreshes the `<!-- imf-web-ui:begin/end -->` fence in an existing
+`AGENTS.md`. Stale check: `.imf-web-ui-skill-version.json` in each installed skill vs. the installed package version — older
+marker means re-run the binary, never hand-diff skill contents.
+
+## Hooks
+
+Three agent lifecycle hooks ship as templates in [`templates/hooks/`](templates/hooks/), registration in
+[`templates/settings.json`](templates/settings.json):
+
+- **SessionStart** — once per session: the conventions baseline is vendored, load it before writing.
+- **UserPromptSubmit** — a one-line conventions reminder per prompt. Per-prompt, not per-tool-call: a PreToolUse reminder
+  would re-inject the same text on every edit.
+- **PostToolUse** (advisory) — file-scope checks on the touched file after every Edit/Write, failures fed straight back.
+  Never exits non-zero.
+- **`baseline-staleness.sh`** — not registered as an agent hook; the repo's pre-commit calls it
+  ([`git.md`](../imf-web-ui-frontend-conventions/references/git.md), Staleness at commit time).
+
+**Read `.claude/settings.json` before installing.** Then pick per event:
+
+- **Nothing registered** → install as shipped: `npx web-ui-install --hooks` copies the scripts to `.agents/hooks/imf-web-ui/`
+  (installer-owned, refreshed wholesale) and merges the registrations without touching existing entries.
+- **The repo already covers an event** (its own session reminder, its own post-edit verify) → don't stack a second hook on
+  it. Use the template as a starting point instead: fold the missing behaviour into the repo's existing script, or adapt the
+  template and register that. Surface the situation and let the human pick.
+
+## Not this skill
+
+- Project tooling, docs structure, the audit checklist → `imf-web-ui-frontend-setup` (which delegates agent tooling here)
+- Library wiring (styles import, provider) → `imf-web-ui-library-setup`

package/src/llms/skills/imf-web-ui-agent-setup/templates/hooks/baseline-staleness.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+# Advisory baseline-staleness check, meant to be called from the repo's pre-commit hook.
+# Compares the installed imf-web-ui skill markers against the installed package version
+# and warns on drift. Always exits 0 — staleness never blocks a commit.
+PKG=node_modules/@imfusion/web-ui/package.json
+[ -f "$PKG" ] || exit 0
+CURRENT=$(node -p "require('./$PKG').version" 2>/dev/null) || exit 0
+
+for marker in .agents/skills/imf-web-ui-*/.imf-web-ui-skill-version.json; do
+  [ -f "$marker" ] || continue
+  INSTALLED=$(node -p "require('./$marker').version" 2>/dev/null) || continue
+  if [ "$INSTALLED" != "$CURRENT" ]; then
+    echo "imf-web-ui skills are stale ($INSTALLED installed, package is $CURRENT) — run: npx web-ui-install"
+    break
+  fi
+done
+exit 0

package/src/llms/skills/imf-web-ui-agent-setup/templates/hooks/post-tool-use.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+# PostToolUse (Edit|Write): advisory file-scope checks on the touched file. Never exits
+# non-zero, so a mid-flight refactor can't trap the agent. Resolve the repo from the edited
+# file, not cwd, which is not guaranteed for hooks.
+FILE=$(jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -f "$FILE" ] || exit 0
+
+ROOT=$(cd "$(dirname "$FILE")" && git rev-parse --show-toplevel 2>/dev/null) || exit 0
+cd "$ROOT" || exit 0
+
+case "$FILE" in
+  *.ts | *.tsx | *.js | *.jsx)
+    [ -x ./node_modules/.bin/eslint ] && ./node_modules/.bin/eslint --cache "$FILE" 2>&1
+    ;;
+esac
+case "$FILE" in
+  *.ts | *.tsx | *.js | *.jsx | *.css | *.json | *.md)
+    [ -x ./node_modules/.bin/prettier ] && ./node_modules/.bin/prettier --check "$FILE" 2>&1
+    ;;
+esac
+exit 0

package/src/llms/skills/imf-web-ui-agent-setup/templates/hooks/session-start.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+# SessionStart: point the agent at the vendored conventions baseline once per session.
+echo "The ImFusion frontend conventions baseline is vendored in .agents/skills/ (imf-web-ui-frontend-conventions and siblings). Load the relevant skill before writing code, styles, or docs; repo docs in docs/ carry only what is unique to this repo."
+exit 0

package/src/llms/skills/imf-web-ui-agent-setup/templates/hooks/user-prompt-submit.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+# UserPromptSubmit: one-line conventions reminder per prompt.
+echo "Conventions check: if this task touches code, styles, data fetching, or docs, consult the matching imf-web-ui-* skill in .agents/skills/ before acting."
+exit 0

package/src/llms/skills/imf-web-ui-agent-setup/templates/settings.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR/.agents/hooks/imf-web-ui/session-start.sh\""
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR/.agents/hooks/imf-web-ui/user-prompt-submit.sh\""
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|MultiEdit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR/.agents/hooks/imf-web-ui/post-tool-use.sh\"",
+            "statusMessage": "Verifying file"
+          }
+        ]
+      }
+    ]
+  }
+}

package/src/llms/skills/imf-web-ui-components/SKILL.md

@@ -3,7 +3,7 @@ name: imf-web-ui-components
 description:
   "Look up @imfusion/web-ui component APIs without reading their source: the two-hop lookup (identity index -> prop data),
   compound components, and integrations. Load when you need the props, sub-components, or defaults of a specific component —
-  not for choosing between components (imf-web-ui-ux) or first-time setup (imf-web-ui-setup)."
+  not for choosing between components (imf-web-ui-ux) or first-time setup (imf-web-ui-library-setup)."
 ---
 
 # imf-web-ui-components

package/src/llms/skills/imf-web-ui-frontend-conventions/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: imf-web-ui-frontend-conventions
+description:
+  "The ImFusion frontend conventions baseline — in-house conventions, valid in every ImFusion frontend and usable by anyone
+  who likes them. A router over topic references: library boundary, React, components, TypeScript, styling, data layer,
+  project structure, testing, stack, npm project, tooling config, git, assets, docs structure. Load when writing wrapper
+  components, custom UI, styling beyond the defaults, adding new files to a consumer app, writing repo docs, touching tool
+  config, or choosing any dependency."
+---
+
+# imf-web-ui-frontend-conventions
+
+The ImFusion frontend baseline. In-house conventions, not industry claims — they encode how ImFusion frontends are built, and
+anyone else is welcome to them.
+
+**The project wins.** These defaults fill vacuums: if the host project already has a convention — a styling system, a state
+library, a folder shape — that stands. They are not a license to refactor a consumer codebase toward this document.
+
+**Alignment mode.** The exception is intent: when the user asks to _align_ the repo with the baseline ("align", "alignment"
+is the flag), the project-wins guard lifts. Deviations then become migration findings — proposed as a plan, still nothing
+changed until the human approves.
+
+## The references
+
+Each topic lives in one reference. Read the one whose moment you're in; starting a new feature usually wants several.
+
+| Reference                                               | Covers                                                              | Read when                                         |
+| ------------------------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------- |
+| [library-boundary.md](references/library-boundary.md)   | staying behind `@imfusion/web-ui`, wrappers, type derivation, peers | touching anything that renders library components |
+| [react.md](references/react.md)                         | component roles, state kinds and owners, effects discipline         | writing new screens, components, or wrappers      |
+| [components.md](references/components.md)               | component anatomy on disk: grouping, folders, colocation            | adding a component file                           |
+| [typescript.md](references/typescript.md)               | functional style, types, naming                                     | writing any code                                  |
+| [styling.md](references/styling.md)                     | native CSS Modules, tokens, the override contract                   | writing CSS or styling beyond the defaults        |
+| [data.md](references/data.md)                           | `api/`+`http/` shape, Zod boundary, query/mutation patterns         | adding an API topic, a fetch, or a mutation       |
+| [project-structure.md](references/project-structure.md) | the `src/` tree, file naming, imports                               | adding files rather than editing existing ones    |
+| [testing.md](references/testing.md)                     | what's worth testing and what isn't                                 | writing or reviewing tests                        |
+| [stack.md](references/stack.md)                         | the topic→tool map, when a library owns a layer                     | choosing or adding any dependency                 |
+| [npm-project.md](references/npm-project.md)             | `package.json`, the `verify:*` script set, dependency pinning       | running or adding a script, adding a dependency   |
+| [tooling.md](references/tooling.md)                     | Prettier, ESLint, tsconfig, staged-files config baselines           | touching tool config                              |
+| [git.md](references/git.md)                             | `git:config`, verify scopes, staleness at commit time               | wiring hooks or the commit path                   |
+| [assets.md](references/assets.md)                       | image formats, the WebP recipe                                      | adding images or other static assets              |
+| [docs-structure.md](references/docs-structure.md)       | what a repo documents, where, how it's written                      | writing or restructuring repo docs                |
+
+`imf-web-ui-frontend-setup` bootstraps and audits a repo against this baseline.

package/src/llms/skills/imf-web-ui-frontend-conventions/references/assets.md

@@ -0,0 +1,23 @@
+# Assets
+
+Import everything from `src/assets/` so the bundler fingerprints and bundles it. Never reference an image by public-path
+string.
+
+## Photographs — WebP
+
+```bash
+magick source.png -resize 2000x -quality 80 -define webp:method=6 src/assets/name.webp
+```
+
+- Quality 80 is visually lossless on photos and routinely cuts file size by an order of magnitude.
+- `method=6` is the densest encoding. It's a one-off cost at conversion time, so take the smaller file.
+- Cap the long edge at 2000px — nothing on the market resolves more in a content image.
+- No `<picture>` fallback needed; WebP is supported everywhere since 2020.
+
+## Other formats
+
+- **Alpha, or pixels that must stay exact** → PNG, optimized with `oxipng` or `pngquant`.
+- **Icons, logos, line art** → inline SVG component, so it inherits `currentColor` and follows the theme.
+
+These rules apply to assets as they're added or touched. Existing assets in another format are not findings to sweep —
+convert opportunistically, when you're working on them anyway.

package/src/llms/skills/imf-web-ui-frontend-conventions/references/components.md

@@ -0,0 +1,63 @@
+# Components
+
+How a component lives on disk and how dumb it stays. Roles, state, and effects in full are [react.md](react.md); styling is
+[styling.md](styling.md).
+
+## As dumb as possible
+
+Data comes from outside — props-fed, never self-fetching. Presentational logic (formatting a label, deriving a display state)
+is fine; owning data is not:
+
+```tsx
+// components/user-card/user-card.tsx
+interface Props {
+  name: string;
+  role: string;
+  onEdit: () => void;
+}
+
+export function UserCard({ name, role, onEdit }: Props) {
+  return (
+    <Card.Root>
+      <Card.Content>
+        <Typo>{name}</Typo>
+        <Chip>{role}</Chip>
+      </Card.Content>
+      <Card.Footer>
+        <Button onClick={onEdit}>Edit</Button>
+      </Card.Footer>
+    </Card.Root>
+  );
+}
+```
+
+No query hook, no store access, no route awareness — the component renders what it's given and reports events upward. Local
+UI state (`isOpen`, a draft value) is allowed; anything whose truth lives elsewhere is not ([react.md](react.md)).
+
+## Grouping
+
+`components/` groups by kind — a layout component under `layouts/`, not beside a domain widget. Flat is fine while there are
+few; let the grouping follow what the project actually has rather than imposing it up front. The kinds worth separating are
+the component roles in [react.md](react.md).
+
+## One file or a folder
+
+A component gets a folder once it has more than one file — sub-components, styles, tests — with an `index.ts` that only
+re-exports:
+
+```
+components/data-table/
+  data-table.tsx
+  data-table-row.tsx
+  data-table.module.css
+  index.ts
+```
+
+Imports then read `#/components/data-table` and the inside can be restructured without touching call sites. Single-file
+components stay single files, directly in their group.
+
+## Colocation
+
+The stylesheet is colocated as `<component>.module.css` next to the component, and only dumb components have one — a
+container that wants CSS is asking for a layout component instead ([react.md](react.md)). Tests and local types sit next to
+their subject too. A file you have to hunt for in a parallel tree gets edited less carefully.

package/src/llms/skills/imf-web-ui-frontend-conventions/references/data.md

@@ -0,0 +1,130 @@
+# Data
+
+How data enters, moves through, and leaves an ImFusion frontend. This is the in-house pattern **for TanStack Query + Router**
+— the default stack ([stack.md](stack.md)). A project on a different data layer keeps the boundary principles (validate at
+the edge, errors as values) but not necessarily this file layout.
+
+## The shape
+
+```
+src/
+  api/<topic>/       # one folder per API topic
+    <topic>.ts       #   queryOptions / mutationOptions
+    query-key.ts     #   key factory, topic as the first segment
+    types.ts         #   Zod schemas + z.infer types
+    use-<thing>.ts   #   hooks wrapping the options for components
+  http/              # transport: client, error normalisation — the only transport-aware place
+```
+
+A query lives next to its key factory and its schemas, so a query key is never spelled out at a call site. Anything
+transport-level (base client, error normalisation) lives in `http/` and nowhere else.
+
+## The network boundary validates
+
+The network is the only place untyped data enters the app, so it is the only place that validates. Everything a backend sends
+is parsed against a Zod schema at that edge; the TypeScript types are derived from the schemas with `z.infer`, never
+hand-written. A hand-written response type is a claim about the backend that nothing checks.
+
+The transport in `http/` is deliberately untyped: it returns `unknown` and leaves the parse to the caller, so no call site
+can accidentally skip validation.
+
+## Errors are values
+
+A failed request becomes an `ApiError` carrying a machine-readable code — it crosses the boundary the same way values do, not
+as an exception caught ad hoc. The frontend owns the mapping from codes to what the user reads.
+
+## The pattern, end to end
+
+The key factory — topic as the first segment, one function per key shape:
+
+```ts
+// api/user/query-key.ts
+const TOPIC = "user" as const;
+
+export const userKeys = {
+  all: [TOPIC] as const,
+  me: () => [TOPIC, "me"] as const,
+  detail: (id: string) => [TOPIC, "detail", id] as const
+};
+```
+
+Query options — key from the factory, parse at the boundary:
+
+```ts
+// api/user/user.ts
+import { queryOptions } from "@tanstack/react-query";
+
+import { bffClient } from "#/http/bff-client";
+import { userKeys } from "./query-key";
+import { userSchema } from "./types";
+
+export const userQueryOptions = () =>
+  queryOptions({
+    queryKey: userKeys.me(),
+    queryFn: async () => userSchema.parse(await bffClient("/me"))
+  });
+```
+
+The hook a component consumes:
+
+```ts
+// api/user/use-user.ts
+import { useSuspenseQuery } from "@tanstack/react-query";
+
+import { userQueryOptions } from "./user";
+
+export const useUser = () => useSuspenseQuery(userQueryOptions());
+```
+
+The options and their hook can start colocated in one file — options right beside the hook that consumes them — and split
+into separate files when the topic's complexity demands it.
+
+Mutations follow the same shape with `mutationOptions`, the dirtied topic first in the `mutationKey`:
+
+```ts
+// api/user/user.ts
+export const updateUserMutationOptions = () =>
+  mutationOptions({
+    mutationKey: [...userKeys.all, "update"],
+    mutationFn: async (patch: UserPatch) => userSchema.parse(await bffClient("/me", { method: "PATCH", body: patch }))
+  });
+```
+
+Routes prefetch in the `loader` with `context.queryClient.ensureQueryData(userQueryOptions())`, components read with the
+`useSuspenseQuery` hook. Give the route a `pendingComponent`; let errors bubble to the nearest `errorComponent`.
+
+## Automatic invalidation
+
+Mutations don't invalidate by hand at every call site — the query client does it centrally, keyed off the mutation's topic. A
+`MutationCache` `onSuccess` invalidates `mutationKey[0]`, on by default via `meta.autoInvalidate`; that's why every
+mutation's key leads with the topic it dirties:
+
+```ts
+// query-client.ts
+export function createQueryClient() {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      mutations: { meta: { autoInvalidate: true } }
+    },
+    mutationCache: new MutationCache({
+      onSuccess: async (_data, _variables, _context, mutation) => {
+        if (!mutation.meta?.autoInvalidate) return;
+        const topic = mutation.options.mutationKey?.[0];
+        if (topic !== undefined) await queryClient.invalidateQueries({ queryKey: [topic] });
+      }
+    })
+  });
+  return queryClient;
+}
+```
+
+Opt out per mutation with `meta: { autoInvalidate: false }` when a coarse topic-wide refetch is wrong (a huge list, a
+targeted optimistic update), and invalidate precisely through the key factory instead. Background reading:
+[query invalidation](https://tanstack.com/query/latest/docs/framework/react/guides/query-invalidation) and
+[automatic invalidation after mutations](https://tkdodo.eu/blog/automatic-query-invalidation-after-mutations).
+
+## Testing the data layer
+
+Stub the network at the `fetch` boundary and let the real query client run: the test then exercises the same parse and error
+path production does. Schemas, clients, and query options are where behaviour worth asserting lives — the general philosophy
+is [testing.md](testing.md).

package/src/llms/skills/imf-web-ui-frontend-conventions/references/docs-structure.md

@@ -0,0 +1,44 @@
+# Documentation structure
+
+What a repo documents, where, and how it's written. `imf-web-ui-frontend-setup` scaffolds this shape from its `templates/`
+and audits it.
+
+## The shape
+
+```
+<app>/
+  README.md            # humans: what the app is, setup, scripts
+  AGENTS.md            # agents: stack, pointers into docs/ — restates nothing
+  docs/
+    index.md           # registers every doc with a one-line "covers" summary
+    <topic>.md         # repo-unique content only
+```
+
+## Repo docs hold only what is unique to the repo
+
+The litmus, applied sentence by sentence: **would this be true in every ImFusion frontend? Then it's baseline — it lives in
+the installed skill references, don't restate it.** The baseline is already in the repo, vendored under
+`.agents/skills/imf-web-ui-frontend-conventions/`, human-readable and versioned.
+
+Where the repo deviates from the baseline, the doc says so as a **named deviation** — what the baseline prescribes, what this
+repo does instead, and why. A deviation written as freestanding convention gets copied into the next repo as if it were house
+style.
+
+## How docs are written
+
+- **Docs explain concepts; code is the source of truth for facts.** A doc captures the why — invariants, rationale,
+  decisions. It never restates a fact that lives in code (a script definition, a type shape, a config value): point at the
+  file instead. A copied fact rots the moment the code changes.
+- **State what is — no decision residue.** Positive, present-tense statements about the current state. Never narrate the
+  delta from a past decision or refute alternatives nobody raised ("there is no X mode", "Y was dropped") — that history
+  belongs in commits and tickets. A negation earns its place only as a guardrail or to preempt a wrong assumption a present
+  reader would actually arrive at.
+- **Boy Scout rule.** Discovered rot — a stale pointer, a doc contradicting the code — is always your responsibility: fix it
+  in place if trivial, otherwise report it. The two failure modes are equal: stepping over rot, and cramming unrelated
+  cleanup into an unrelated change.
+
+## Staleness at commit time
+
+Docs are checked when they can go stale: at the commit. A staged change that invalidates a doc — a renamed script, a moved
+folder, a changed flow — updates that doc **in the same commit**, not in a follow-up. Pre-commit carries the advisory
+staleness checks (vendored baseline, docs) — the mechanics are in [git.md](git.md).

package/src/llms/skills/imf-web-ui-frontend-conventions/references/git.md

@@ -0,0 +1,33 @@
+# Git
+
+## git:config
+
+One script holds the repo's git configuration, run by hand once per clone (the README names it):
+
+```
+git config core.hooksPath .githooks && git config pull.rebase true && git config merge.ff only
+```
+
+Hooks live in a tracked directory; history strategy doesn't depend on personal git config. Two silent failure modes to check
+for: `git:config` never run (hooks exist only on the machine that configured by hand), and `core.hooksPath` pointing at a
+directory that doesn't exist. Config **and** directory.
+
+## Verify scopes
+
+Two blocking, one advisory:
+
+- **staged** — `verify:staged`, called by the pre-commit hook: lint, format, restage. Fast; a passing commit is not CI green.
+- **full** — `verify:full`: the build plus every `verify:*` check. What CI runs.
+- **files** — post-edit agent hook. Advisory, never exits non-zero, so a mid-flight refactor can't trap the agent.
+
+One script owns each scope's step list; npm scripts and hooks only launch them. Name by depth, not by occasion — a
+`preflight` needs explaining and invites a near-identical sibling, and two of those drift into "passes locally, fails in CI".
+
+## Staleness at commit time
+
+Pre-commit also runs the advisory staleness checks — warn, never block:
+
+- **Vendored baseline** — `.agents/hooks/imf-web-ui/baseline-staleness.sh` compares the installed `imf-web-ui-*` skill
+  markers against the installed package version; the fix it names is `npx web-ui-install`.
+- **Docs** — a staged change that invalidates a doc updates that doc in the same commit
+  ([docs-structure.md](docs-structure.md)). Where the repo has an agent commit workflow, a staged docs audit belongs in it.