@mingfuyun/star-allinone 0.1.7 → 0.1.9

package/skills/shared/api-mock/references/mock-conventions.md

@@ -0,0 +1,90 @@
+# Mock Conventions
+
+Default output is conversation JSON. Do not create files, Umi routes, JavaScript, TypeScript, handlers, or server configuration unless the user explicitly asks for files.
+
+## Conversation output
+
+Label each response with HTTP method, API path, and scenario, then provide one strict JSON code block.
+
+```text
+GET /api/v1/devices/ — success
+```
+
+Rules:
+
+- Return the default success scenario unless the user requests another scenario.
+- Use separate labeled JSON blocks for success, empty, validation error, or permission error responses.
+- Preserve OpenAPI placeholders such as `{id}` in the label while using realistic concrete IDs in response data.
+- Do not mention an output filename unless writing a file was requested.
+
+When files are requested, write pure JSON at `mock/<api-path>/<method>.json`. Never generate `defineMock`, Umi imports, handlers, Faker, current timestamps, or unseeded randomness.
+
+## Response shapes
+
+Use the actual OpenAPI response schema even when it differs from these common envelopes.
+
+Ordinary success:
+
+```json
+{
+  "code": 0,
+  "message": "success",
+  "data": {
+    "id": "device-001",
+    "hostname": "edge-shanghai-001"
+  }
+}
+```
+
+Paginated list. Follow the nearest domain; common shapes are `{ results, count }` or `{ list, total }`:
+
+```json
+{
+  "code": 0,
+  "message": "success",
+  "data": {
+    "results": [
+      {
+        "id": "device-001",
+        "hostname": "edge-shanghai-001"
+      }
+    ],
+    "count": 1
+  }
+}
+```
+
+Business error:
+
+```json
+{
+  "code": 400,
+  "message": "参数校验失败",
+  "data": {
+    "hostname": ["该字段不能为空"]
+  }
+}
+```
+
+`MFRequest` unwraps `data` for service callers. Mock JSON must keep the complete backend envelope.
+
+## Scenario coverage
+
+- Default successful detail or operation response.
+- Normal list containing representative status and enum variants.
+- Empty list when requested: empty collection and matching total/count `0`.
+- Very long names and remarks for overflow testing.
+- Zero numeric values so UI code does not confuse zero with missing data.
+- Nullable and optional fields only where the contract permits them.
+- Validation and permission errors only when requested or documented.
+
+Static JSON cannot implement pagination, filtering, mutation continuity, or upload parsing. Represent those as separate labeled responses.
+
+## Contract checks
+
+1. Copy the exact path and method from OpenAPI and the service module.
+2. Resolve every `$ref` used by the selected response schema.
+3. Include every required property and preserve snake_case.
+4. Keep enum values, nullability, number/string types, and nested arrays consistent.
+5. Keep pagination totals consistent with the represented collection unless the fixture intentionally shows another page.
+6. Ensure every fenced JSON block is strict, parseable JSON: double-quoted keys and strings, no comments, no trailing commas.

package/skills/shared/api-to-service/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: {{sharedSkillName}}
+description: Generate frontend TypeScript API types, MFRequest service methods, aggregate exports, and contract-aligned mock artifacts for an explicitly selected API operation. Use when the user names an endpoint or operationId and asks to generate or update service, types, or mock data.
+---
+
+# API to Service
+
+This skill is fully shared. Generate only the requested `METHOD /path/` or `operationId`. Do not guess undocumented fields or change unrelated endpoints.
+
+Read before editing:
+
+1. `.star-allinone.json`
+2. [references/service-conventions.md](references/service-conventions.md)
+3. [references/api-artifact-generation.md](references/api-artifact-generation.md)
+4. `.agents/skills/shared-api-mock/references/mock-conventions.md` before producing JSON
+
+OpenAPI lookup order:
+
+1. `openapi` in `.star-allinone.json`
+2. A Swagger/OpenAPI file the user provided in this conversation
+3. Nearest existing domain `typings.d.ts` plus the live endpoint, reported as incomplete if no schema exists
+
+`serviceDir` defaults to `src/services` unless `.star-allinone.json` sets it.
+
+## Workflow
+
+1. Resolve one exact operation. If a path has multiple methods and intent is unclear, ask for the method. Never infer a destructive method.
+2. Recursively resolve parameters, request body, responses, and local `$ref`s. Neighboring methods that share a path are out of scope.
+3. Build the target matrix in `api-artifact-generation.md`. Compare existing types, methods, exports, and mocks. Classify create / update / reuse / conflict.
+4. Report contract conflicts before overwriting deployed behavior.
+5. Update `src/services/<Domain>/typings.d.ts`, the thin `MFRequest` method, and `src/services/index.ts` when the domain export is missing.
+6. Produce the default successful JSON mock. Add empty or error variants only when requested.
+7. Verify formatting, TypeScript, JSON parsing, exact method/path, and a focused diff.
+
+## Hard rules
+
+- Preserve backend snake_case, documented optionality, and `| null` nullability.
+- Type callers against unwrapped `data`. Do not model the transport envelope inside `T`.
+- Prefer named types. Do not use `Record<string, any>` or unexplained `any`.
+- Do not modify `src/services/request.tsx` for one endpoint without explicit approval.
+- Do not generate pages, hooks, or extra mock scenarios unless requested.
+- Never refresh a checked-in OpenAPI snapshot with `cp` or full-file replacement.
+
+## Verification
+
+```bash
+pnpm exec prettier --check <changed-service-and-json-files>
+pnpm exec tsc --noEmit
+```
+
+Parse changed JSON files. Search generated names, operationId, and exact API paths for omissions and collisions. Run `pnpm lint` for broad service changes. Cite the OpenAPI path, method, operationId, and schema names in the handoff.

package/skills/shared/api-to-service/references/api-artifact-generation.md

@@ -0,0 +1,70 @@
+# Specified API Artifact Generation
+
+## Accepted selectors
+
+Resolve a request using one of these forms:
+
+```text
+GET /api/v1/devices/
+PATCH /api/v1/devices/{id}/
+operationId: api_v1_devices_list
+```
+
+Preserve the documented path, including placeholders and trailing slash. Never infer a destructive method.
+
+If a path has multiple methods and intent does not identify one, stop and request the method.
+
+## Target matrix
+
+Before editing, establish this matrix for every requested operation:
+
+| Field            | Value                                              |
+| ---------------- | -------------------------------------------------- |
+| Method and path  | Exact OpenAPI operation                            |
+| operationId      | Documented identifier                              |
+| Domain           | Existing service domain or tag-derived domain      |
+| Parameters       | Path, query, header, and cookie schemas            |
+| Request body     | Content type and resolved schema                   |
+| Success response | Selected status, content type, and resolved schema |
+| Error responses  | Only those needed by the requested artifacts       |
+| Service method   | Existing or proposed public method name            |
+| Types            | Existing types to reuse and new types to create    |
+| Mock output      | Conversation JSON, or `mock/<api-path>/<method>.json` when files are requested |
+
+## Default artifacts
+
+Unless the user narrows the scope, generating `GET /api/v1/devices/` means:
+
+- Request, query, and path-parameter types.
+- Response, item, detail, pagination, enum, and nested object types required by that operation.
+- One thin `MFRequest` method.
+- Domain aggregate export when missing.
+- One deterministic successful JSON response.
+
+Do not generate a page, hook, model, component, test server, or extra mock scenario unless requested.
+
+## Schema closure
+
+Starting from parameters, request bodies, and selected responses:
+
+1. Collect every local `$ref`.
+2. Read the referenced component schema.
+3. Repeat for nested properties, items, `allOf`, `oneOf`, and `anyOf`.
+4. Stop only when all leaves are primitive, inline, or unsupported external references that are explicitly reported.
+
+Generate types only for schemas used by the selected operation. Reuse an existing project type only after verifying required fields, optionality, nullability, enums, and formats.
+
+## Existing artifact decisions
+
+- **Create:** no matching service, type, or mock exists.
+- **Update:** the artifact represents the selected operation but differs from the current contract.
+- **Reuse:** the existing artifact matches semantically; do not rewrite it for formatting or naming.
+- **Conflict:** deployed behavior intentionally differs or sources contradict; report before destructive changes.
+
+Never regenerate an entire service namespace because one endpoint changed.
+
+## OpenAPI snapshot
+
+Treat the project's OpenAPI/Swagger file as authoritative. Lookup order: `openapi` in `.star-allinone.json`, then a document provided in the conversation.
+
+Never refresh a checked-in snapshot with `cp`, full-file replacement, or unconditional formatter output. Report the delta and wait for confirmation before rewriting the snapshot.

package/skills/shared/api-to-service/references/service-conventions.md

@@ -0,0 +1,89 @@
+# Service Conventions
+
+Read `.star-allinone.json` first. `serviceDir` defaults to `src/services`. Overlay extra domain paths only when `.agents/project/conventions.md` exists.
+
+## Layout
+
+```text
+src/services/<Domain>/
+├── <domain>.ts
+└── typings.d.ts
+```
+
+Import the domain default export in `src/services/index.ts` and spread it into the aggregate object. Update an existing domain instead of creating a duplicate.
+
+Pages must not call axios or `src/services/request.tsx` directly. Consume methods through `import Service from '@/services'`.
+
+## Request mapping
+
+Inspect the project's `MFRequest` helper before generating. The common mapping is:
+
+| Contract              | Call                            |
+| --------------------- | ------------------------------- |
+| GET query             | `MFRequest.get(url, params)`    |
+| POST JSON             | `MFRequest.post(url, body)`     |
+| PATCH JSON            | `MFRequest.patch(url, body)`    |
+| PUT JSON              | `MFRequest.put(url, body)`      |
+| DELETE query          | `MFRequest.delete(url, params)` |
+| GET blob export       | `MFRequest.export(url, params)` |
+| POST multipart import | `MFRequest.import(url, params)` |
+
+Do not modify the shared request module for a single endpoint unless the transport capability is missing and the user approves the cross-cutting change.
+
+## Types
+
+- Put DTOs in `src/services/<Domain>/typings.d.ts` using the project's `declare namespace DOMAIN_API` pattern.
+- Pages must not redefine service DTOs.
+- Preserve backend snake_case.
+- Mark a field optional only when the contract may omit it. Use `| null` when it is present but nullable.
+- Prefer named types over `Record<string, any>` when the contract is known.
+- Use `Partial<T>` only for genuinely partial update or filter contracts.
+- Path parameters are explicit function arguments, not fields on the query type.
+- Service callers are typed against the unwrapped `data` payload. `MFRequest` resolves the outer envelope; do not duplicate `code`, `message`/`msg`, or `data` inside `T`.
+- Add concise Chinese JSDoc matching nearby services.
+
+```ts
+import MFRequest from '../request';
+
+/**
+ * 获取设备列表
+ */
+const getDevicesList = (params: DEVICES_API.IDevicesListForm) => {
+  return MFRequest.get('/api/v1/devices/', params);
+};
+
+export default { getDevicesList };
+```
+
+```ts
+declare namespace DEVICES_API {
+  type IDevicesListForm = {
+    page: number;
+    page_size: number;
+    keyword?: string;
+  };
+
+  type IDevicesListResponse = {
+    results: IDevicesListItem[];
+    count: number;
+  };
+}
+```
+
+If the nearest domain uses `{ list, total }` instead of `{ results, count }`, follow that domain. Do not invent a third pagination shape.
+
+## Endpoint checklist
+
+- Exact HTTP method and trailing slash.
+- Path variables and their types.
+- Query versus JSON body versus multipart.
+- Required, optional, and nullable fields.
+- Enum values and display fields.
+- Date/time and numeric units.
+- List pagination and sorting fields.
+- Download filename/content behavior.
+- Empty response semantics for create/update/delete.
+
+## MFRequest side effects
+
+Ordinary requests typically strip `undefined`, `null`, and empty strings. PATCH may convert `undefined` to `null`. Confirm the local wrapper before using `undefined` to mean “unchanged.”

package/skills/shared/commit-current-changes/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: {{sharedSkillName}}
+description: Review the active frontend project's changes and prepare a confirmation-gated Conventional Commit and optional push. Use when the user asks to review current changes, submit code, or commit and push. Never commit before explicit confirmation.
+---
+
+# Commit Current Changes
+
+This skill is fully shared. Review user-authorized working-tree changes, report findings and a commit proposal, and mutate Git only after explicit confirmation.
+
+## Write-operation gate
+
+Git writes are forbidden until both gates are complete in the current turn:
+
+1. **Review gate**: deliver a report with findings or `No issues found.`
+2. **Confirmation gate**: present exact file paths and the exact commit subject, then receive affirmative confirmation of that proposal. “提交代码” is not confirmation before the proposal exists.
+
+Before `git add`, `git commit`, or `git push`, re-check status and diff. If scope changed, stop and issue a new proposal. Never infer confirmation from urgency or a previous turn.
+
+## Workflow
+
+### 1. Scope
+
+Run `git status --short --branch`, `git diff --stat`, and `git diff`. Inspect cached diffs when staged changes exist. Do not include unrelated user-owned files. Follow recent `git log` language and naming.
+
+### 2. Review
+
+Read:
+
+1. `.agents/skills/shared-project-conventions/references/review-checklist.md`
+2. `.agents/skills/shared-project-conventions/references/quality-checklist.md`
+3. `.agents/skills/shared-project-conventions/references/architecture.md`
+
+This skill is fully shared. If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken shared hard rules.
+
+Classify only concrete security, data-loss, runtime, contract, validation, performance, accessibility, or maintainability risks as P0–P2.
+
+```text
+[P1] Short finding title — src/path/file.tsx:42
+Impact and reproduction/contract evidence.
+Fix: focused direction, without unrelated redesign.
+```
+
+### 3. Validate
+
+Always run `git diff --check`. Then run focused Prettier, ESLint, TypeScript, and the project's documented build in proportion to risk. Do not auto-fix. Do not propose commit while an unresolved P0/P1 or a current-change validation failure remains.
+
+### 4. Proposal
+
+Lead with findings. Then present optional improvements, validation results, change summary, exact files, branch/remote, and a concise Chinese Conventional Commit message (`feat` / `fix` / `refactor` / `chore` / `docs` / `test` / `style` / `perf` / `build` / `ci`). Stop and wait.
+
+### 5. After confirmation
+
+1. Re-inspect the working tree. If the diff changed, propose again.
+2. Stage only confirmed paths.
+3. Commit without `--no-verify` unless the user explicitly authorizes it. Do not amend unless requested.
+4. Push to upstream, or `git push -u origin HEAD` when none exists. Never force-push.
+5. Report hash, subject, files, validation, and remote branch.
+6. Stop. Do not run `$shared-publish-test` or any Yunxiao pipeline script after git push.
+
+A confirmed commit or push does not authorize the test pipeline. If the user later says `确认推送流水线` or `发布测试环境`, follow `.agents/skills/shared-publish-test/SKILL.md`.
+
+## Safety
+
+- Never expose credentials from diffs; stop if secrets are present.
+- Never use destructive Git commands to clean the working tree.
+- If push is rejected, report the reason and do not rewrite history without separate authorization.

package/skills/shared/design-to-page/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: {{sharedSkillName}}
+description: Implement frontend pages from designs using the active project's React, Umi, Ant Design Pro, service, permission, routing, and component conventions. Use when translating Figma, screenshots, wireframes, or UI specs into page code.
+---
+
+# Design to Page
+
+Translate a design into repository-native code. Reuse existing architecture; do not invent a parallel stack.
+
+Before implementation, read:
+
+1. `.star-allinone.json`
+2. [references/page-conventions.md](references/page-conventions.md)
+3. [references/overlays.md](references/overlays.md) for any modal, drawer, or confirmation
+4. `.agents/skills/shared-project-conventions/references/architecture.md`
+
+If `.agents/project/conventions.md` exists, use it only for extra paths.
+
+Inspect the nearest existing page of the same type before proposing files.
+
+## Workflow
+
+1. List visible states: default, loading, empty, error, disabled, overflow, permission, and narrow-screen.
+2. Resolve ambiguities that affect APIs, route ownership, permissions, or component boundaries. For minor visual gaps, follow the closest precedent and state the assumption.
+3. Write a short implementation contract: route, sections, query fields, columns, actions, APIs, permissions, states, and files.
+4. Implement the smallest complete vertical slice. Keep columns and actions outside render. Keep overlay concerns in focused components.
+5. API-backed pages include types, `MFRequest` methods, aggregate exports, and page consumption in the same change. Use `.agents/skills/shared-api-to-service/SKILL.md` for missing services. Use `.agents/skills/shared-api-mock/SKILL.md` for deterministic data. Do not embed production fake data.
+6. Compare desktop and narrow layouts against the design. Fix structure and spacing before decoration.
+7. Run focused verification. Do not claim visual fidelity without inspecting the rendered page.
+
+## Hard rules
+
+- React function components, TypeScript, Ant Design 5, Pro Components, Less.
+- `ProForm` for business forms. `MFProTable` for management lists.
+- Overlays from `@mingfuyun/star-allinone`: `CustomDrawer`, `BaseModal`, `HocModal`.
+- Every `await` uses `try-catch`; loading restores in `finally`; `validateFields()` failures are logged and stop the request.
+- Mutations guard duplicate submit, show feedback, and reload affected lists.
+- Do not add a UI library, state library, or CSS-in-JS system without approval.
+- Do not refactor unrelated code.
+
+## Verification
+
+```bash
+pnpm exec prettier --check <changed-files>
+pnpm exec tsc --noEmit
+```
+
+Run `pnpm lint` for broad or shared changes. Run the project's documented build command when routes, entry, or multiple pages change.

package/skills/shared/design-to-page/references/overlays.md

@@ -0,0 +1,73 @@
+# Overlays
+
+Use this reference for every modal, confirmation dialog, and drawer. Import `@mingfuyun/star-allinone/dist/styles.css` once from the application entry, not from feature components.
+
+## Required components
+
+- `CustomDrawer` for create, edit, detail, or configuration drawers.
+- `BaseModal` for forms, selections, confirmations, previews, and other dialogs.
+- Wrap feature overlays with `HocModal` so pages open them through a ref.
+- Keep Ant Design and Pro Components for overlay content.
+- Use `ProForm` for every editable overlay form.
+
+Do not add new direct feature-level imports of Ant Design `Drawer`, `Modal`, or `Modal.confirm`.
+
+## Ref contract
+
+```tsx
+export interface ItemDrawerRef {
+  show: (args?: { record?: DOMAIN_API.Item }) => void;
+  hide: () => void;
+}
+```
+
+The wrapped component receives `visible`, `handleCancel`, and the args passed to `show`. Render the overlay once and open it from the page:
+
+```tsx
+const drawerRef = useRef<ItemDrawerRef>(null);
+drawerRef.current?.show({ record });
+<ItemDrawer ref={drawerRef} reload={() => tableRef.current?.reload()} />;
+```
+
+Do not duplicate open/visible, selected-record, and close state in the page when `HocModal` can own it.
+
+## Drawer pattern
+
+Use `CustomDrawer` confirmation controls and disable the ProForm submitter. Reset or initialize fields whenever the overlay becomes visible.
+
+```tsx
+const handleConfirm = async () => {
+  try {
+    const values = await formRef.current?.validateFields();
+    setLoading(true);
+    await saveItem(values);
+    message.success('操作成功');
+    reload();
+    handleCancel();
+  } catch (error) {
+    console.error('提交失败:', error);
+  } finally {
+    setLoading(false);
+  }
+};
+```
+
+Validation failure must stop the request. Restore confirmation loading in `finally`. Never leave an empty `catch`.
+
+## Modal pattern
+
+Use `BaseModal` with `visible`, `onOk`, `onCancel`, and `confirmLoading`. Use `footer={null}` for read-only dialogs. Use `destroyOnClose` when stale internal state would leak across openings.
+
+## Responsibilities
+
+- Page: table refs, business entry points, and opening an overlay.
+- Overlay: visibility, selected record, form initialization, validation, submitting state, feedback, close, and reload callback.
+- Service: requests and API types.
+- Feature constants: columns and action definitions; never overlay state.
+
+## Verification
+
+- Open the same overlay for create, edit, close, and reopen; confirm no stale values remain.
+- Confirm validation prevents closing and duplicate submission.
+- Confirm async failure leaves the overlay open and restores the action button.
+- Check long content, narrow screens, footer visibility, mask behavior, and keyboard closing.

package/skills/shared/design-to-page/references/page-conventions.md

@@ -0,0 +1,85 @@
+# Page Conventions
+
+Read `.star-allinone.json` first. Use extra component paths or permission helpers from `.agents/project/conventions.md` only when that file exists.
+
+## Stack and locations
+
+- Umi Max, React function components, TypeScript, Ant Design 5, Ant Design Pro Components, Less.
+- Pages: `src/pages/<Feature>/`.
+- Shared components: `src/components/`.
+- Shared hooks: `src/hooks/`.
+- Routes: `config/route.ts`.
+- Services: `src/services/index.ts` via `import Service from '@/services'`.
+- Import application modules through `@/`; use relative imports inside the same feature.
+
+## File split
+
+Keep the smallest complete vertical slice. A standard query-form plus table page usually looks like:
+
+```text
+src/pages/<Feature>/
+├── index.tsx
+├── index.less
+└── components/ or sibling files
+    ├── List.tsx        # optional when the page is large
+    └── const.tsx       # columns, actions, toolbar, maps
+```
+
+Put substantial columns, action builders, status maps, and select options outside render functions. Do not create a second `const.tsx` inside a child component when the page already has one.
+
+Styles live in the current page directory. Reuse shared mixins such as `@/styles/proTable.less`; do not import another feature's Less file.
+
+## Tables
+
+- Prefer `MFProTable` for management lists. Use Ant Design `Table` only for a deliberately simple static shell.
+- Extract `fetchData` as an `async` method. Do not inline request logic in JSX props.
+- Wrap `await` in `try-catch` and return a table-safe empty shape on failure.
+- Adapt backend pagination to the table contract. Common backend shapes are `{ results, count }` or `{ list, total }`; the table adapter is typically `{ code, data: { list, total } }`. Follow the nearest page.
+- Use a stable `rowKey`. Wide tables use `scroll` with `x: 'max-content'`.
+- Render missing display values as `'-'` unless the design requires another empty state.
+- Keep the latest normalized query values available when export or secondary actions reuse them.
+- Watch falsy bugs such as `value || fallback` when `0`, `false`, or `''` is valid.
+
+If the table persists column visibility, order, or fixed state, use the project's column-state hook. Do not read or write `localStorage` in page code. Register new storage keys in the project's cache-reset UI when one exists.
+
+## Forms
+
+- Use `ProForm` as the business form container in pages, drawers, and modals.
+- Prefer `ProFormText`, `ProFormSelect`, `ProFormTextArea`, and related fields.
+- Ant Design `Form` may provide `useForm`, `useWatch`, or `ProForm.Item` integration. Do not introduce a rendered `<Form>` container.
+- Default overlay forms to `layout="horizontal"` with a stable label width. Toolbar query forms stay `layout="inline"`.
+- Normalize submitted values before calling services. Do not send empty strings, `undefined`, or presentation-only fields unless the API requires them.
+- Reset both form controls and the active query state.
+
+## Overlays
+
+Follow [overlays.md](overlays.md). Use `CustomDrawer`, `BaseModal`, and `HocModal` from `@mingfuyun/star-allinone`. Do not add new feature-level Ant Design `Modal` or `Drawer` shells.
+
+## Permissions and routes
+
+- Preserve runtime menu and button permissions with the project's wrappers (`WithPermission`, `TablePermissionActions`, `withAuth`, `actionColumn.permission`, or the equivalent named in project conventions).
+- Do not treat hidden buttons as authorization. Backend enforcement must remain.
+- Add explicit routes in `config/route.ts` when the page needs navigation. Preserve `/403`, `/404`, and nested menu behavior.
+
+## Async behavior
+
+- Every `await` lives in `try-catch`, including handlers, loaders, and submissions.
+- Put `validateFields()` inside the `try`. Log the caught error with `console.error` and do not continue to the request.
+- Restore loading in `finally`. Never use an empty `catch`.
+- Mutations disable or guard duplicate submission, show user-facing feedback, and reload affected lists.
+- Destructive actions require confirmation. Use `BaseModal` + `HocModal`. Do not use `Modal.confirm`.
+- Close overlays must clear form values, loading, selected records, and other async state.
+
+## Service integration
+
+- API-backed pages include types, service methods, aggregate exports, and page consumption in the same change.
+- Do not embed production fake data or invented response fields.
+- If the backend contract is unavailable, label proposed methods, paths, and fields as proposed.
+- Pair missing services with `.agents/skills/shared-api-to-service/SKILL.md`. Pair missing deterministic data with `.agents/skills/shared-api-mock/SKILL.md`.
+
+## Styling and fidelity
+
+- Scope Less below a feature class. Use `:global` only for library internals.
+- Do not add a UI library, state library, or CSS-in-JS system without approval.
+- Cover loading, empty, error, disabled, permission, overflow, duplicate-submit, and narrow-screen behavior.
+- Do not claim visual fidelity without inspecting the rendered page; otherwise say verification was static only.

package/skills/shared/impact-analysis/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: {{sharedSkillName}}
+description: Analyze frontend Git changes and trace affected routes, pages, services, permissions, shared components, mocks, and regression checks. Read-only. Use for PR or pre-submit impact analysis.
+---
+
+# Impact Analysis
+
+This skill does not modify files.
+
+## Workflow
+
+1. Read `git status`, `git diff --stat`, `git diff`, and changed files. Include staged diffs when present.
+2. For each changed file, trace static imports, service calls, route references (`config/route.ts`), and permission references.
+3. Expand shared files: `MFProTable`, `src/services/request.tsx`, permission components, column-state hooks, overlay shells, and app bootstrap.
+4. Check matching `typings.d.ts`, mocks, drawers/modals, table columns, and menu/route config.
+5. Classify impact: direct callers, indirect pages, API/permission contracts, build/release risk.
+6. Give a minimal automated and manual regression path for each item. An import is not proof of runtime impact.
+
+Read `.agents/skills/shared-project-conventions/references/review-checklist.md` for shared files that must be expanded. If `.agents/project/review-rules.md` exists, also expand any extra domain files it names.
+
+## Output
+
+- Change summary
+- Direct files and pages
+- Possibly affected APIs, permissions, and mocks
+- High-risk shared components and their callers
+- Recommended automated checks and manual paths
+- Risks that cannot be confirmed statically, with why
+
+Use repository facts only. Do not invent backend behavior.

package/skills/shared/project-conventions/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: {{sharedSkillName}}
+description: Apply the active frontend project's architecture, API, business, permission, performance, testing, and naming conventions to generated or reviewed code.
+---
+
+# Project Conventions
+
+Use this skill for every non-trivial change. Preserve existing patterns and make the smallest scoped change.
+
+Read in this order:
+
+1. `.star-allinone.json`
+2. [references/architecture.md](references/architecture.md)
+3. [references/review-checklist.md](references/review-checklist.md)
+
+Shared rules are complete for review, commit, mock, and service generation. If `.agents/project/conventions.md` exists, use it only for extra paths or domain invariants. It must not weaken the shared hard rules below.
+
+## Hard rules
+
+- Pages consume `import Service from '@/services'`. No direct axios or request-helper calls from pages.
+- DTOs live in `src/services/<Domain>/typings.d.ts`. Pages do not redefine them.
+- Reuse `MFProTable`, `ProForm`, `CustomDrawer`, `BaseModal`, `HocModal`, and existing permission wrappers.
+- Backend field names stay in service types. Convert only at an adapter boundary.
+- Async surfaces handle loading, empty, error, retry, unauthorized, and duplicate-submit.
+- No unexplained `any`, `as any`, `@ts-ignore`, or `Record<string, any>` when the contract is known.
+- No new UI/state library without approval.
+
+## Completion
+
+Report changed files, API operations used, states covered, validation commands and results, and remaining gaps.