create-yss-spec 3.4.5 → 3.4.7

package/template/.cursor/skills/yss-exception/SKILL.md

@@ -27,12 +27,14 @@ Read `references/source-index.md` as a path-hint index whenever the task depends
 6. In the `target-domain-model` profile, Domain owns stable error meaning and parameters but does not depend directly on YSS `BizException` or HTTP. Translate at the Web boundary after verifying the component handler precedence.
 7. MVC Profile 的稳定业务错误归 service/core；Repository 保留 cause；server 持有 HTTP 映射与脱敏。不要为了复用错误码引入 Domain 层或让 core 依赖 client。分层依据 `docs/agents/backend-architecture-profiles.md`。
 
-## Current Source Behavior
+## Boot 3 Current Source Behavior
 
-- `GlobalExceptionAdvice` currently maps BizException, unknown Exception, and RuntimeException to HTTP 400; the OpenAPI error contract must reflect or deliberately override that behavior.
-- The current RuntimeException handler returns `exception.getLocalizedMessage()` for many runtime failures; treat that as a response-information-leak risk and do not copy it into new APIs without an approved, sanitized error mapping.
-- `yss.exception.level` only controls a direct `printStackTrace()` branch when its value is exactly `debug`; it is not a general response-format switch.
-- Validation binding failures currently become `SysException(PARAM_VALIDATION_ERROR)`. Coordinate changes with `yss-validation` and contract tests.
+- 以下当前行为针对 `boot3-java17`；Boot 2 旧工程必须读取其独立索引，旧行为只用于迁移识别。
+- `GlobalExceptionAdvice` maps `BizException` to HTTP 400. Unknown `Exception`, `RuntimeException`, and `NullPointerException` map to HTTP 500 and return a sanitized `SysException` with `ResultErrorCode.INTERNAL_ERROR` instead of raw exception text.
+- `MaxUploadSizeExceededException` maps to HTTP 413 (`PAYLOAD_TOO_LARGE`) with `ResultErrorCode.MAX_UPLOAD_SIZE_EXCEEDED`.
+- System and unknown failures are recorded with the SLF4J logger. `yss.exception.level=debug` adds a logger-backed debug stack trace; it never calls `Throwable#printStackTrace()`.
+- Every handled response attaches or reuses a trace id in MDC and exposes it through the `X-Trace-Id` response header. The public body does not contain the raw localized exception or stack trace.
+- Validation binding failures become `SysException(PARAM_VALIDATION_ERROR)`. Coordinate changes with `yss-validation` and contract tests.
 
 ## Source-Backed Exception Semantics
 
@@ -45,11 +47,12 @@ Read `references/source-index.md` as a path-hint index whenever the task depends
 - Required dependency or starter module is present.
 - Error code/message are meaningful to API consumers.
 - Response messages are sanitized and do not expose raw RuntimeException or localized exception details.
+- HTTP assertions cover business 4xx, unknown/runtime 5xx, upload 413, and `X-Trace-Id`.
 - Business validation failures are not reported as unknown system errors.
-- Stack traces are preserved for unknown/system failures.
+- Stack traces are preserved in structured logger output for unknown/system failures, never printed directly to stderr or serialized to clients.
 - Retry guidance matches exception type.
 - Known system failures use `ExceptionFactory.sysException(..., cause)`; Application code does not replace them with ad-hoc `RuntimeException`.
-- Endpoint contract tests cover business, known-system, and unknown/runtime failures; unknown public messages never expose `getLocalizedMessage()`.
+- Endpoint contract tests cover business, known-system, unknown/runtime, and upload-limit failures; unknown public messages never expose `getLocalizedMessage()`.
 
 ## Do Not
 
@@ -57,6 +60,6 @@ Read `references/source-index.md` as a path-hint index whenever the task depends
 - Do not replace component extension points with business-local framework code.
 - Do not broaden the task into unrelated YSS components unless the user asks.
 
-## 新脚手架平台约束
+## 平台与源码门禁
 
-消费批准切片架构身份中的 `platform_configuration`，与工程 Manifest 核对后使用对应 YSS 组件。Boot 2.7 使用 `javax` Web/Validation API；Boot 3.5/4.1 使用 `jakarta`。Boot 4 按 Jackson 3、对应自动配置和 starter 适配；不替换 `javax.sql` 等 Java SE 包。平台不一致、兼容条目缺失或候选未验证时回合同编译器阻断，不在业务实现中升级或替换组件。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。
+接入、修改、代码生成或给出精确类名/配置前，读取 [后端组件平台与源码门禁](../yss-skill-source-index-refresh/references/backend-component-platform-compatibility.md)，从批准的 `platform_configuration.component_platform_line` 选择 `source-index.boot2-java8.md` 或 `source-index.boot3-java17.md`，并以 `--skill yss-exception --platform-line <line> --source-root <matching-root>` 运行统一 freshness 校验。平台线与源码根不匹配、组件 tree 不一致、组件子树 dirty、索引缺少平台信号，或 Manifest / 组件 GAV 缺少 verified 兼容证据时返回 `blocked`；不得回退另一代索引，也不在业务实现中升级、降级或替换 YSS 组件。既有工程只读分诊可继续，但不得据此宣称跨 Boot/JDK 兼容。

package/template/.cursor/skills/yss-exception/references/source-index.boot2-java8.md

@@ -0,0 +1,50 @@
+# yss-exception Source Index
+
+Index schema: `backend-component-source-index-v2`
+Platform line: `boot2-java8`
+Generated: 2026-09-18T18:40:26.031Z
+Source commit: `a3be2b2e33dca4545782e2b31894aaa00d0305cd`
+Component worktree: `clean`
+Component tree `yss-microservice-components/yss-component-exception`: `e5d71e213f26cd7e52d419ded1c2f5e7b7fbf40b`
+Indexed source root: resolved at refresh time; set `YSS_SOURCE_ROOT_BOOT2_JAVA8` to reproduce or refresh.
+
+This file is generated by `yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs`. Do not hand-edit generated sections.
+
+Paths are relocatable source hints. Exact guidance requires a matching component tree and a clean indexed component subtree; the repository commit is trace metadata and may differ when unrelated components change.
+
+## Component Path Hints
+
+- `yss-microservice-components/yss-component-exception` (existed when indexed)
+
+## Documentation Files
+
+- `yss-microservice-components/yss-component-exception/readme.md`
+
+Component documentation is a discovery aid. For API signatures, conditions and defaults, prefer the indexed source facts below when documentation differs.
+
+## Maven Modules
+
+- `yss-microservice-components/yss-component-exception/pom.xml` — GAV `com.yss.cloud:yss-component-exception:2.0.0-SNAPSHOT`; parent `com.yss.cloud:yss-microservice-components:2.0.0-SNAPSHOT`
+
+## Platform Signals
+
+- Inherited Java signals: `1.8`.
+- Inherited Spring Boot signals: `2.7.18`.
+- Namespace source signals: `javax.*` in 1 main Java files; `jakarta.*` in 0 main Java files.
+- Auto-configuration metadata: 1 `spring.factories`; 0 `AutoConfiguration.imports` files.
+- These are source observations, not compatibility certification. Use the approved `platform_configuration` and verified compatibility evidence before integration or generation.
+
+## Key Java Entry Points
+
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ExceptionFactory.java` — `sha256:871070981022984dc5e991bcc6a250fb9fdda31efe94a6e151bd86dfebc7162b`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ResultErrorCode.java` — `sha256:cfc1ce146b99ba5d938bdc6bfb80758582e0c80cf1e37472967d5fdc334b8f81`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/YssGlobalExceptionProperties.java` — `sha256:706136214248b90965feadced7940fde2f649e9d5f19a3953d55756a7f56ea84`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/advice/GlobalExceptionAdvice.java` — `sha256:c4233e0fdfccb63330fc82d26e4defd8fb8985ba04cc23d8fa3d0e2cbc0183b5`
+
+## Freshness and Use
+
+- Locate the current source root using `YSS_SOURCE_ROOT_BOOT2_JAVA8`, CodeGraph, Maven artifact names or repository search.
+- Compare each indexed `Component tree` with `git rev-parse HEAD:<component-path>` and require the current component subtree to be clean before exact guidance.
+- Run `node ../yss-skill-source-index-refresh/scripts/check-backend-skill-source-index.mjs --skill <skill-id> --platform-line boot2-java8 --source-root <root>` from the canonical skill root before exact integration guidance.
+- A repository commit difference alone is not stale when the component tree is unchanged; a component tree mismatch or component-local dirty state is stale.
+- Read only the source entries needed for the current decision or troubleshooting path.

package/template/.cursor/skills/yss-exception/references/source-index.boot3-java17.md

@@ -0,0 +1,50 @@
+# yss-exception Source Index
+
+Index schema: `backend-component-source-index-v2`
+Platform line: `boot3-java17`
+Generated: 2026-09-18T18:40:26.031Z
+Source commit: `5041c41fbe96c25821bbc15f688c0521b8c97a3d`
+Component worktree: `clean`
+Component tree `yss-microservice-components/yss-component-exception`: `4d83019be2ede902b69eb5fe9fdad8739f0f9933`
+Indexed source root: resolved at refresh time; set `YSS_SOURCE_ROOT_BOOT3_JAVA17` to reproduce or refresh.
+
+This file is generated by `yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs`. Do not hand-edit generated sections.
+
+Paths are relocatable source hints. Exact guidance requires a matching component tree and a clean indexed component subtree; the repository commit is trace metadata and may differ when unrelated components change.
+
+## Component Path Hints
+
+- `yss-microservice-components/yss-component-exception` (existed when indexed)
+
+## Documentation Files
+
+- `yss-microservice-components/yss-component-exception/readme.md`
+
+Component documentation is a discovery aid. For API signatures, conditions and defaults, prefer the indexed source facts below when documentation differs.
+
+## Maven Modules
+
+- `yss-microservice-components/yss-component-exception/pom.xml` — GAV `com.yss.cloud:yss-component-exception:3.0.0-SNAPSHOT`; parent `com.yss.cloud:yss-microservice-components:3.0.0-SNAPSHOT`
+
+## Platform Signals
+
+- Inherited Java signals: `17`.
+- Inherited Spring Boot signals: `3.5.16`.
+- Namespace source signals: `javax.*` in 0 main Java files; `jakarta.*` in 1 main Java files.
+- Auto-configuration metadata: 0 `spring.factories`; 1 `AutoConfiguration.imports` files.
+- These are source observations, not compatibility certification. Use the approved `platform_configuration` and verified compatibility evidence before integration or generation.
+
+## Key Java Entry Points
+
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ExceptionFactory.java` — `sha256:871070981022984dc5e991bcc6a250fb9fdda31efe94a6e151bd86dfebc7162b`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ResultErrorCode.java` — `sha256:cfc1ce146b99ba5d938bdc6bfb80758582e0c80cf1e37472967d5fdc334b8f81`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/YssGlobalExceptionProperties.java` — `sha256:706136214248b90965feadced7940fde2f649e9d5f19a3953d55756a7f56ea84`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/advice/GlobalExceptionAdvice.java` — `sha256:56c2025e65b314c30ba2f6c51bead345fe8d81da892c10f5d5c20663e7f38949`
+
+## Freshness and Use
+
+- Locate the current source root using `YSS_SOURCE_ROOT_BOOT3_JAVA17`, CodeGraph, Maven artifact names or repository search.
+- Compare each indexed `Component tree` with `git rev-parse HEAD:<component-path>` and require the current component subtree to be clean before exact guidance.
+- Run `node ../yss-skill-source-index-refresh/scripts/check-backend-skill-source-index.mjs --skill <skill-id> --platform-line boot3-java17 --source-root <root>` from the canonical skill root before exact integration guidance.
+- A repository commit difference alone is not stale when the component tree is unchanged; a component tree mismatch or component-local dirty state is stale.
+- Read only the source entries needed for the current decision or troubleshooting path.

package/template/.cursor/skills/yss-exception/references/source-index.md

@@ -1,35 +1,10 @@
-# yss-exception Source Index
+# yss-exception Source Index Router
 
-Generated: 2026-08-17T12:03:37.436Z
-Source commit: `38b556a5081e6c66c0c538cbc1ef839b19996ed3`
-Source worktree: `dirty`
-Indexed source root: resolved at refresh time; set `YSS_SOURCE_ROOT` to reproduce or refresh.
+Index schema: `backend-component-source-index-router-v1`
 
-This file is generated by `yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs`. Do not hand-edit generated sections.
+Select the source index from the approved `platform_configuration.component_platform_line`; do not infer a line from imports, a branch name or a requested upgrade.
 
-Paths below are source path hints captured at refresh time. If they do not exist in the current workspace, locate sources using `YSS_SOURCE_ROOT`, CodeGraph, package/class names, Maven artifact names, or repository search before assuming the source is unavailable.
+- `boot2-java8` — [Spring Boot 2.7 / Java 8 maintenance line](source-index.boot2-java8.md)
+- `boot3-java17` — [Spring Boot 3.5 / Java 17 mainline](source-index.boot3-java17.md)
 
-## Component Path Hints
-
-- `yss-microservice-components/yss-component-exception` (existed when indexed)
-
-## Documentation Files
-
-- `yss-microservice-components/yss-component-exception/readme.md`
-
-## Maven Modules
-
-- `yss-microservice-components/yss-component-exception`
-
-## Key Java Entry Points
-
-- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ExceptionFactory.java`
-- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ResultErrorCode.java`
-- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/YssGlobalExceptionProperties.java`
-- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/advice/GlobalExceptionAdvice.java`
-
-## Recommended Next Reads
-
-- Start with the documentation files above when learning component usage.
-- Search the key Java entry points for annotations, auto configuration, properties, aspects, interceptors, handlers, and result objects before changing application code.
-- Prefer existing component extension points over rewriting framework logic in business modules.
+Run the freshness checker with the same explicit `--platform-line` and its matching clean source root before exact integration guidance.

package/template/.cursor/skills/yss-formily/SKILL.md

@@ -18,10 +18,10 @@ description: 路由 YSS UI 业务页面中的 YFormily 场景；当查询、编
 | 字段显隐、值联动、异步 effects、跨字段副作用 | `formily-linkage-effects` |
 | 新增、编辑、查看模式，详情插槽或 disabled 规则 | `formily-mode-slot-detail` |
 | 分步录入、跨步骤校验、步骤状态 | `formily-step-flow` |
-| Modal / Drawer 的打开、回填、保存、关闭和回退 | `page-form-module` |
+| Modal / Drawer 的打开、回填、保存、关闭和回退 | `yss-ui-business-page-generation` 负责页面容器编排，并加载 `formily-foundation` 与实际命中的模式/联动专项 |
 | 从自然语言、截图或 Figma 生成 schema | `yss-formily-schema-generator` |
 
-一个任务可以同时加载多个专项 Skill。`page-form-module` 只在页面容器生命周期命中时加载，不作为本技能的固定依赖。
+一个任务可以同时加载多个专项 Skill。页面容器生命周期不是本技能的固定依赖；仅当任务是完整业务页面或弹层闭环时加载 `yss-ui-business-page-generation`。
 
 ## 边界
 

package/template/.cursor/skills/yss-frontend-scaffold-generator/SKILL.md

@@ -71,7 +71,7 @@ packages/package.json
 - 不携带 Data Quality 业务页面、默认管理员、生产接口、私网 Postman 同步、部署凭证或残缺 JSP 命令；当前支持 Qiankun 与 standalone，JSP 不在可用基线内。
 - 不得把 `apps/frontend/` 容器根登记为项目根；Harness 内每个前端项目必须有独立的 `apps/frontend/<project>/` 路径。
 - 不把模板示例页面当作业务功能交付。
-- 生成后仍需使用 `yss-ui-business-page-generation`、`component-selection-imports`、`yss-api-integration` 以及实际命中的表格、树、Formily 等专项 skill 实现业务页面。
+- 生成后仍需使用 `yss-ui`、`yss-ui-business-page-generation`、`yss-api-integration` 以及实际命中的表格、树、Formily 等专项 skill 实现业务页面。
 
 ## Output
 

package/template/.cursor/skills/yss-frontend-scaffold-generator/assets/data-quality-v1/README.md

@@ -2,7 +2,7 @@
 
 Data Quality v1 通用骨架：Vue 3 / Ant Design Vue 4 / YSS UI，默认浅色、14px 正文、32px 控件。`packages/` 是应用根。YSS 按需注册，新增页面再按实现合同引入表格或表单组件。骨架不含业务页面、用户权限、生产 API 地址或部署凭证。
 
-使用 Node >=22.12、pnpm 10.15、TypeScript5.9.3；在用户级 npm 配置中设置企业 @yss-ui registry 和认证，然后运行 `pnpm install --frozen-lockfile`。检查使用 `pnpm lint:check`、`pnpm type-check`、`pnpm build` 和 `pnpm build:standalone`。
+使用 Node >=22.12、pnpm 12.4.2、TypeScript5.9.3；在用户级 npm 配置中设置企业 @yss-ui registry 和认证，然后运行 `pnpm install --frozen-lockfile`。检查使用 `pnpm lint:check`、`pnpm type-check`、`pnpm build` 和 `pnpm build:standalone`。
 
 `pnpm dev` 独立预览；Qiankun 注册名为 `__MICROAPP_NAME__`、默认激活路由 `__BASE_ROUTE__`，门户传入 `container` / `routerBase` / `bridgeVersion: 1` / `themeConfig.mode`。资源部署路径由 `VITE_PUBLIC_BASE` 明确设置，不能从路由猜测。复制 `packages/.env.example` 到 `.env.local` 配置本地代理。
 

package/template/.cursor/skills/yss-frontend-scaffold-generator/assets/data-quality-v1/package.json

@@ -2,10 +2,10 @@
   "name": "__APP_NAME__",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@10.15.0",
+  "packageManager": "pnpm@12.4.2",
   "engines": {
     "node": ">=22.12.0",
-    "pnpm": ">=10.15.0 <11"
+    "pnpm": ">=12.4.2 <13"
   },
   "scripts": {
     "dev": "pnpm -C packages dev",

package/template/.cursor/skills/yss-frontend-scaffold-generator/assets/data-quality-v1/pnpm-lock.yaml

@@ -1,3 +1,161 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      pnpm:
+        specifier: 12.4.2
+        version: 12.4.2
+
+packages:
+
+  '@pnpm/exe.android-arm64@12.4.2':
+    resolution: {integrity: sha512-E255MbcQ0V1577M2BV0ajWuP7KmTPYA0jqZnk3rK6Lq3kTvZWulMMb7iqRmnLsQbyWTkMEB2CfyM70loVDA8xg==}
+    cpu: [arm64]
+    os: [android]
+
+  '@pnpm/exe.android-x64@12.4.2':
+    resolution: {integrity: sha512-J1pSeCUwuKxMG70ZzpWn8JzElxiEa8NN/3N0SlZRtU2xbztChaJCKF3HaBNIj9yPfeofWzJo/lwNvDDjraQuZw==}
+    cpu: [x64]
+    os: [android]
+
+  '@pnpm/exe.darwin-arm64@12.4.2':
+    resolution: {integrity: sha512-A0WDo8iErfZBXgrLseQxw8i8Y9ctUpOEl/Uu+cubnTzpD8tT9ykIB548L8YTM2WD4OS+ZOHSxy8aGZcvKq8PaQ==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/exe.darwin-x64@12.4.2':
+    resolution: {integrity: sha512-MSgJdovBWHcb5DEOvfPH9yNi/T5O1Xa4ess+E1ESGo/5yuty7S4JoiIjami+fsNXfnoQMlwsMUqYU4zAvBcNCw==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/exe.freebsd-x64@12.4.2':
+    resolution: {integrity: sha512-h2YumlQSNvgbRPv+RXwABohX65f9bOBZn+jMIt7bFDISZPCzQ+Nvpt6Awbp4ip5PwQgYxbu5iREJ1fHE39Fm8A==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@pnpm/exe.linux-arm64-musl@12.4.2':
+    resolution: {integrity: sha512-LwSEtSEDTv6S51YLs3YvSkPyun/QmfMic1UGICUkPWFu6ByP43RdMlkKvmVkfGhAYCpnxO057vrmyJqtfZrPCA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-arm64@12.4.2':
+    resolution: {integrity: sha512-2dSiDXyhx+RTHsewxex8f/jVjqQXWJ2oow4kCVHEWdZKeBpgMxvZ6fHkTAUBJXgqhbKIDHvuNlZBP7gJfUWL5A==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-ppc64@12.4.2':
+    resolution: {integrity: sha512-8Itc+jQk+MTz04LS9D1RcH+VctAWmzM4l1cJQ+Sx7pAJNo7EKHdRMbC0Tok1jyQ7eEHNJZD5EleYneZqWfZM+g==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-riscv64@12.4.2':
+    resolution: {integrity: sha512-hleOeqhTVpH+z9RVMGnxvU4ZnrkBUClWjCbHD9u6kwyqhGSpevoU1wTGish+CBRhmIgMAy9pAfFpqhbAKOKNfw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-s390x@12.4.2':
+    resolution: {integrity: sha512-LAsQRRdP9aToENR6dtcIJ9l+e1zMYOX0tQcLGpRyLPVBQcYRLlvAPcmDshsiIHQjp05SDa9FI0czX1ZQ1a7a/A==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-x64-musl@12.4.2':
+    resolution: {integrity: sha512-kzfzH2/0BWdTABK14Yj5a1xsdkTEQUp2eXEPNakaD9jKL025lq3hyaKHIz/gIZaPDMe/1bFFK/En4ztFlbBJxw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-x64@12.4.2':
+    resolution: {integrity: sha512-/pbt0UVTa8NMDhzOWLQRfZ6G9ROKXlJPZtx845BqyWfc7hCrWXhTLBd70yO2y8+E+IWN3oHM1s/JsIQNGk1yvg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.win32-arm64@12.4.2':
+    resolution: {integrity: sha512-PsW19e4dAUNpZ0cS9flaxFuAmpt2dKlH/Vvi8TZ4qyJjjQzue/CEsWm+6wKVP4CJ7IT8RdL4qh+soOPWIgF2Zw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/exe.win32-x64@12.4.2':
+    resolution: {integrity: sha512-+xGoeE0g55ztWvl8i5QqdmNfW3nIrTVcoQrNshEOwxthm9Ag48oXton3uxOA3/SANyz5AXexEjj2KO20NnOrEw==}
+    cpu: [x64]
+    os: [win32]
+
+  pnpm@12.4.2:
+    resolution: {integrity: sha512-CK3GYTGAJ1x8ntraOdzwjJxhrU5+rzMKTzRh8QKw+QdCNFTRF/mOctR/7wYWBwZE17/8lzpqV/UJCm18NosHyQ==}
+    engines: {node: '>=18.*'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/exe.android-arm64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.android-x64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.darwin-arm64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.darwin-x64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.freebsd-x64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-arm64-musl@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-arm64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-ppc64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-riscv64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-s390x@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-x64-musl@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-x64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.win32-arm64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.win32-x64@12.4.2':
+    optional: true
+
+  pnpm@12.4.2:
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.4.2
+      '@pnpm/exe.android-x64': 12.4.2
+      '@pnpm/exe.darwin-arm64': 12.4.2
+      '@pnpm/exe.darwin-x64': 12.4.2
+      '@pnpm/exe.freebsd-x64': 12.4.2
+      '@pnpm/exe.linux-arm64': 12.4.2
+      '@pnpm/exe.linux-arm64-musl': 12.4.2
+      '@pnpm/exe.linux-ppc64': 12.4.2
+      '@pnpm/exe.linux-riscv64': 12.4.2
+      '@pnpm/exe.linux-s390x': 12.4.2
+      '@pnpm/exe.linux-x64': 12.4.2
+      '@pnpm/exe.linux-x64-musl': 12.4.2
+      '@pnpm/exe.win32-arm64': 12.4.2
+      '@pnpm/exe.win32-x64': 12.4.2
+
+---
 lockfileVersion: '9.0'
 
 settings:

package/template/.cursor/skills/yss-frontend-scaffold-generator/references/data-quality-v1.manifest.json

@@ -17,10 +17,10 @@
     ".gitignore": "sha256:fb8288522033f645a728dfb53cef24a11824bdbec858b93279d4809924b4539d",
     ".npmrc.example": "sha256:cee4433295152854b58babea9072215a2d84b8de086d218b15ffb7e84f1fe9e1",
     "DESIGN.md": "sha256:e84a6c175840efe9663a2d0aba37f5635c053f47452bb146d1025d65665b1bec",
-    "README.md": "sha256:6d8ed1aed45267f3c581733a7d12b0b891dc94c800d1416a0b172355031b4b96",
+    "README.md": "sha256:745bd31b3397876fc239bde12378bc265a1a8d1626159f188de76873951d471a",
     "micro-config.json": "sha256:8266b0eb806696d6bb2023a0d1e72113cdffc355bb0fafd8b2095d727f827711",
     "orval.config.ts": "sha256:d918458e4ee972ae94740899dd15701530bdc31fd758240fc00e96aba3ba9b3a",
-    "package.json": "sha256:29cd516ba688ae3a3625b4f3a3921c47825134cff27622732ef942c4129c7222",
+    "package.json": "sha256:51a73185fac255062e4f3eaa415017f9c9886d5e3aac4ff483694c49ae810ba7",
     "packages/.env.development": "sha256:e698b56d83ad282c221e2c8067bc4e3e90789c610fd31da2489bd3ac2d8efc5f",
     "packages/.env.example": "sha256:b8cf60af269af3f4dc3c167df88045af949683b302bd9b77e50fb77fa1adf81f",
     "packages/.env.production": "sha256:b0a96ab02559a99fc95c37b967f604675686c8de336731a1721d54f43b047249",
@@ -43,7 +43,7 @@
     "packages/src/views/Welcome.vue": "sha256:0498edee6e25b45644a2d12c6fded1e3c0fda830c9196d4fc5389b94fb1a0e0d",
     "packages/tsconfig.json": "sha256:40e27bb07cd4ae8c0c636b5d9581fe378d00e21acb28423cc2a08bfa1a67c11f",
     "packages/vite.config.ts": "sha256:d3c1775bdca54e1b0f2b267a7dae992cc61836891588e93e02caa49184cb2ab2",
-    "pnpm-lock.yaml": "sha256:dd05bbc9c948cb47de017fa215806d04f0f9f143d3c953b43076a62e5fd85d9b",
+    "pnpm-lock.yaml": "sha256:ddab6b19cb74c769ba1cd3854d3eb0649843e8136811b7cbf2800c3084f73949",
     "pnpm-workspace.yaml": "sha256:d5cdbd2e0a167297976d11695d1593a4e71694ed462120569e20e98fd9c63fbe"
   }
 }

package/template/.cursor/skills/yss-frontend-scaffold-generator/scripts/scaffold-generator.test.mjs

@@ -66,6 +66,11 @@ const saveBundle = () => writeFileSync(contractFile, JSON.stringify(bundle));
 saveBundle();
 const bundled = generate({ contractFile, outputDir: bundle.target_output_dir });
 assert.equal(bundled.template.checkout, undefined);
+const bundledPackage = JSON.parse(readFileSync(path.join(bundle.target_output_dir, 'package.json')));
+assert.equal(bundledPackage.packageManager, 'pnpm@12.4.2');
+assert.equal(bundledPackage.engines.node, '>=22.12.0');
+assert.equal(bundledPackage.engines.pnpm, '>=12.4.2 <13');
+assert.match(readFileSync(path.join(bundle.target_output_dir, 'README.md'), 'utf8'), /pnpm 12\.4\.2/);
 assert.equal(JSON.parse(readFileSync(path.join(bundle.target_output_dir, 'packages/package.json'))).dependencies['ant-design-vue'], '4.2.6');
 assert.equal(JSON.parse(readFileSync(path.join(bundle.target_output_dir, 'packages/src/config/theme.json'))).algorithm, 'default');
 for (const forbidden of ['.npmrc', 'node_modules', '.git', 'packages/src/views/datasource/index.vue', 'scripts/sync-openapi.js']) assert.equal(existsSync(path.join(bundle.target_output_dir, forbidden)), false, forbidden);

package/template/.cursor/skills/yss-hook/SKILL.md

@@ -13,7 +13,7 @@ description: Use when YSS Vue 页面涉及 vue-hooks-plus/useRequest、分页、
 - Vue Hooks Plus `useRequest`: `https://inhiblabcore.github.io/vue-hooks-plus/zh/hooks/useRequest/quick-start`
 - Local reference index: `references/frontend-docs.md`
 
-本技能负责请求执行、分页/筛选参数、选择状态、响应映射和页面级调度。接口导入与 Orval mutator 使用 `yss-api-integration`；页面布局和组件选型从 `yss-ui` 路由到 `page-skeleton`、`component-selection-imports` 及具体组件 Skill；高度计算分别使用 `yss-use-table-height` 或 `yss-use-tree-height`。
+本技能负责请求执行、分页/筛选参数、选择状态、响应映射、异步竞态和页面级调度。接口导入与 Orval mutator 使用 `yss-api-integration`；页面布局和组件选型从 `yss-ui` 路由到 `yss-ui-business-page-generation` 及具体组件 Skill；表格和树高度分别服从 `ytable-usage`、`yedit-table-usage`、`ytree-usage`。
 
 官方 `@yss-ui/hooks` 当前公开 `useFullscreen`、`useTreeHeight`、`useTableHeight`、`useLoading`、`usePollingTask` 与 `useUrlState`。`useRequest`、防抖、缓存或重试不属于这套公开 YSS Hooks 契约。仅当项目已批准 `vue-hooks-plus` 及其具体版本时，才可使用第 3 节的 `useRequest`；不得把它命名或包装成 YSS 官方 API。
 
@@ -34,6 +34,7 @@ description: Use when YSS Vue 页面涉及 vue-hooks-plus/useRequest、分页、
 - 将请求执行、参数合并、响应映射与数据竞争处理放在 `hooks/useXxx.ts`；页面只保留布局、事件绑定和渲染。
 - 以业务域划分 Hook，而不是为每个微小工具函数各建一个 Hook。
 - 每个对外动作都必须有明确的 loading、成功、失败和数据陈旧策略；不要把这些分支留给模板或页面组件。
+- 组件内不直接修改 `props`；双向绑定使用 `emit('update:xxx')`。模板不承载复杂业务表达式，优先下沉 `computed` 或业务 Hook；避免无边界的深层 `watch`，只观察明确依赖源。
 
 ## 2. 列表 / 分页 Hook
 
@@ -185,7 +186,7 @@ const polling = usePollingTask(async ({ isCurrent, signal }) => {
 
 - `useUrlState()`：返回扁平字符串 `state`、`setState`、`clearKeys`、`clearState`。`setState` 合并状态，`undefined`、`null`、空字符串删除键。默认 `mode: 'replace'`、`strategy: 'history'`；需要路由守卫或导航语义时用 `strategy: 'router'`。
 - `useFullscreen(target, options?)`：返回 `isFullscreen`、`enterFullscreen`、`exitFullscreen`、`toggleFullscreen`、`isEnabled`。浏览器真全屏需要用户手势；`pageFullscreen` 是 CSS 模拟全屏，可配置 `className`、`zIndex`，并可用 `escTip` 控制提示。
-- `useTreeHeight` 与 `useTableHeight` 通过 `ResizeObserver` 计算可用高度。树的 `extraOffset` 仅用于 YTree 内置 `filterable` 搜索区；表格可配置 `boundaryRef` 避免尺寸反馈循环，并可扣除分页、工具栏或新增按钮高度。具体布局约束交由 `yss-use-tree-height` / `yss-use-table-height`。
+- `useTreeHeight` 与 `useTableHeight` 通过 `ResizeObserver` 计算可用高度。树的 `extraOffset` 仅用于 YTree 内置 `filterable` 搜索区；表格可配置 `boundaryRef` 避免尺寸反馈循环，并可扣除分页、工具栏或新增按钮高度。具体布局约束交由 `ytree-usage` / `ytable-usage` / `yedit-table-usage`。
 
 ## 8. 返回契约与自检
 

package/template/.cursor/skills/yss-implementation-contract-compiler/SKILL.md

@@ -75,3 +75,5 @@ Slice v3 的任务进度、缺口和实时就绪结果不回写合同。源事
 ## 后端脚手架平台承接
 
 消费生命周期已确认的架构与 `platform_configuration` v2；不得自行选择、批准或静默升级 Boot/Java。平台清单执行 `scripts/backend-platforms` 查询；只允许已验证 YSS 组合，新生成缺少配置或证据即阻断。决定、合同、Manifest 与下游架构身份须绑定同一平台及兼容摘要。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。
+
+后端 Slice 解析出 `component_binding: required` 的 capability 或其主 Skill 时，必须在同一平台兼容条目中逐项解析 `component_capabilities`。编译结果保存 `component_bindings` 与 `component_bindings_digest`；未登记、未验证、架构证据缺失、构件坐标冲突或摘要漂移均阻断。旧合同含组件 Skill 但没有组件绑定时直接 `stale`，重新编译并交生命周期批准，禁止自动补字段后沿用原批准。

package/template/.cursor/skills/yss-implementation-contract-compiler/references/boundaries.md

@@ -20,7 +20,7 @@
 | --- | --- | --- |
 | `writing.lifecycle-document` | `i-have-adhd` | `guidance` |
 | `architecture.technical-design` | `yss-technical-design` | `guidance`, `integration`, `review-input` |
-| `architecture.mvc-design` | `yss-mvc-design` | `guidance`, `integration`, `review-input` |
+| `architecture.mvc-design` | `yss-technical-design` | `guidance`, `integration`, `review-input` |
 | `layer.mvc-service` | `yss-application` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
 | `layer.mvc-persistence` | `yss-repository` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
 | `layer.mvc-web` | `yss-web-controller` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
@@ -48,7 +48,7 @@
 | `scaffold.ddd` | `yss-ddd-scaffold-generator` | `integration`, `component-maintenance` |
 | `scaffold.layered-mvc` | `yss-layered-mvc-scaffold-generator` | `integration`, `component-maintenance` |
 | `scaffold.frontend-vue3` | `yss-frontend-scaffold-generator` | `integration`, `component-maintenance` |
-| `project-init.mvc-data-analysis` | `yss-mvc-data-analysis-project-initializer` | `component-maintenance` |
+| `project-init.mvc-data-analysis` | `yss-layered-mvc-scaffold-generator` | `component-maintenance` |
 | `migration.springboot3` | `yss-up-springboot3` | `guidance`, `integration`, `troubleshooting`, `component-maintenance`, `review-input` |
 
 ## Narrow Recipes
@@ -118,7 +118,6 @@
 | `yss-prototype-stage` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-prototype-stage` | `prototype-review` | `review-only` | — |
 | `yss-prototype-stage` | `yss-design-system` | `coordination-only` | — |
-| `yss-ddd-scaffold-generator` | `yss-backend-scaffold-parent` | `context-required` | — |
 | `yss-ddd-scaffold-generator` | `alibaba-java-code-style` | `context-required` | — |
 | `yss-layered-mvc-scaffold-generator` | `alibaba-java-code-style` | `context-required` | — |
 | `yss-domain` | `alibaba-java-code-style` | `context-required` | — |
@@ -127,8 +126,7 @@
 | `yss-domain` | `lombok` | `context-conditional` | `pojo` |
 | `yss-technical-design` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-technical-design` | `yss-tactical-design` | `coordination-only` | `domain-driven` |
-| `yss-technical-design` | `yss-mvc-design` | `coordination-only` | `layered-mvc` |
-| `yss-mvc-design` | `yss-openapi-draft-review` | `review-only` | `api-impact` |
+| `yss-technical-design` | `yss-openapi-draft-review` | `review-only` | `api-impact` |
 | `yss-tactical-design` | `domain-modeling` | `coordination-only` | — |
 | `yss-tactical-design` | `yss-openapi-draft-review` | `review-only` | `api-impact` |
 | `yss-tactical-design` | `yss-repository` | `component-dependency` | `data-impact` |
@@ -152,7 +150,7 @@
 | `yss-validation` | `yss-exception` | `component-dependency` | — |
 | `yss-security-algorithm` | `yss-exception` | `component-dependency` | — |
 | `yss-exception` | `yss-dto` | `context-required` | — |
-| `yss-ui-business-page-generation` | `component-selection-imports` | `context-conditional` | `components` |
+| `yss-ui-business-page-generation` | `yss-ui` | `context-required` | — |
 | `yss-ui-business-page-generation` | `yss-hook` | `context-conditional` | `hooks` |
 | `yss-ui-business-page-generation` | `yss-formily` | `context-conditional` | `form` |
 | `yss-ui-business-page-generation` | `yss-api-integration` | `context-conditional` | `api` |

package/template/.cursor/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml

@@ -143,6 +143,14 @@ resolution_contract:
   deterministic_order: [recipe-declaration, dependency-topology, skill-id]
   digest_change_status: stale
   stale_action: recompile-and-return-to-lifecycle-approval
+  component_bindings:
+    when: any-required-capability-provider-kind-is-yss-component
+    platform_configuration: required-v2
+    catalog_source: docs/engineering/backend-platforms.json
+    required_fields: [component_bindings, component_bindings_digest]
+    exact_artifact_binding: [group_id, artifact_id, declared_version, resolved_version, pom_sha256, jar_sha256, source_tree]
+    digest_change_status: stale
+    old_contract_without_binding: stale-and-recompile-no-auto-upgrade
 
 context_plan:
   required: [required_context_refs, on_demand_context_refs, context_stop_rule, missing_context_action]
@@ -157,7 +165,7 @@ project_scaffold_contract_schema:
   delivery_roles:
     backend:
       scaffold_kinds: [backend-ddd, backend-layered-mvc, backend-mvc-data-analysis]
-      generators: [yss-ddd-scaffold-generator, yss-layered-mvc-scaffold-generator, yss-mvc-data-analysis-project-initializer]
+      generators: [yss-ddd-scaffold-generator, yss-layered-mvc-scaffold-generator]
       requires: [scaffold_request_id, architecture_family, decision_ref, decision_id, decision_digest, project_name, base_package, maven_coordinates, profiles, module_profile, design_prerequisites]
       design_prerequisites:
         required: [technical_design, data_architecture_decision, api_contract_decision, engineering_contract_approval_ref]
@@ -253,7 +261,7 @@ scaffold_contract_schema:
     lifecycle_approves: [approved]
     generator_consumes: []
     after_generation:
-      domain-driven: [yss-backend-scaffold-parent, yss-implementation-contract-compiler]
+      domain-driven: [yss-implementation-contract-compiler]
       layered-mvc: [yss-implementation-contract-compiler]
   work_unit:
     required: [id, behavior, primary_skill, supporting_skills, tdd_mode, allowed_write_paths, expected_evidence, verification_commands, controlled_generation]
@@ -330,6 +338,7 @@ full_reroute_triggers:
   - scaffold-architecture-decision-changed
   - scaffold-profile-changed
   - scaffold-module-resolution-changed
+  - component-binding-drift
   - api-schema-impact
   - database-schema-impact
   - state-machine-impact
@@ -355,6 +364,7 @@ full_reroute_triggers:
 
 reroute_destinations:
   scaffold-baseline-drift: stage7-scaffold-revalidation
+  component-binding-drift: stage7-contract-recompile
   api-schema-impact: system-data-architecture-and-contract-review
   database-schema-impact: data-architecture-and-migration-review
   state-machine-impact: spec-system-data-and-contract-review
@@ -410,6 +420,10 @@ execution_result_required:
   - deviations
   - new_impacts
   - not_applicable_reason
+execution_result_component_binding:
+  when: resolution.component_bindings-present
+  required: consumed_contract.component_bindings_digest
+  mismatch: component-binding-mismatch
 seam_deferred_required: [risk, owner, follow_up_ticket, verification_plan, target_version_or_release_date]
 deviation_required: [rule, reason, approval_ref]
 not_applicable_required: [item, reason]
@@ -432,3 +446,14 @@ backend_platform_contract:
   new_generation_requires: [exact-boot-java, confirmed-decision, matching-yss-coordinates, verified-compatibility-entry]
   candidate_generation: maintenance-only
   candidate_downstream: blocked
+  component_capabilities:
+    registry_marker: provider-kind-yss-component
+    mapping_key: provider-binding-id
+    foundational_capabilities: [contract.dto-wire, contract.request-validation, contract.error-mapping, framework.mybatis]
+    specialized_capabilities: [component.cache, component.current-user-context, component.audit-log, component.excel-import-export, component.distributed-id, component.security-algorithm, component.gateway-resilience]
+    exact_artifact_evidence: [group_id, artifact_id, declared_version, resolved_version, pom_sha256, jar_sha256, source_tree]
+    verified_architecture_required: true
+    unlisted_or_blocked: component-unavailable-for-platform
+    missing_evidence: component-evidence-missing
+    coordinate_conflict: component-artifact-coordinate-conflict
+    drift: component-binding-drift

package/template/.cursor/skills/yss-implementation-contract-compiler/references/yss-skill-execution-result.md

@@ -17,6 +17,7 @@ execution_result:
     contract_version:
     registry_digest:
     compiler_contract_digest:
+    component_bindings_digest: # 合同含 component_bindings 时必填
     quality_baseline_ref:
     context_plan_ref:
   changed_files:
@@ -57,7 +58,7 @@ execution_result:
 
 实现合同编译器必须验证：
 
-1. `consumed_contract.contract_version` 与当前批准版本一致，两个 resolution digest 与批准合同一致且保持 current。
+1. `consumed_contract.contract_version` 与当前批准版本一致，Registry、编译器以及适用的 `component_bindings_digest` 与批准合同一致且保持 current。
 2. `changed_files` 全部位于工作单元和切片允许路径内。
 3. `expected_evidence_files` 全部存在并能回指行为。
 4. 验证命令包含实际结果和时间；计划命令不算证据。