huaweicloud-devkit 0.1.17

package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: huawei-modelarts
+description: "Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms."
+version: 1
+---
+
+# Huawei Cloud ModelArts
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud ModelArts <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for ModelArts. Covers training jobs, model deployment, notebook instances, and OBS integration.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
+| Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
+| Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
+| Model deployment needs quota | Online services may require service quota approval in new accounts |
+| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
+
+## Prerequisites
+
+- Training data must be stored in an OBS bucket (see `huawei-obs`)
+- Output path for trained models must be an OBS path
+- Notebook instances need a VPC/subnet (see `huawei-vpc`)
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List models | `ListModels --cli-region=<r> --project_id=<p>` |
+| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
+| List services | `ListServices --cli-region=<r> --project_id=<p>` |
+| List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
+| Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
+| Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
+
+Discover operation parameters with `--help` before executing any write operation.
+
+## Service Types
+
+| Type | Purpose |
+|------|---------|
+| Training Job | Train models on GPU/CPU resources |
+| Model | Register trained models for deployment |
+| Service (Online) | Deploy models as REST API endpoints |
+| Notebook | JupyterLab environments for development |
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| OBS path not found | Verify OBS bucket exists and path is correct |
+| Training job fails | Check training data format, resource quotas, and logs in console |
+
+## Cross-Skill References
+
+- **OBS storage**: See `huawei-obs` for bucket and training data management
+- **VPC/Subnet**: See `huawei-vpc` for notebook network configuration

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: huawei-obs
+description: "Use when creating, configuring, or managing OBS buckets and objects on Huawei Cloud. Covers bucket creation, lifecycle policies, versioning, static website hosting, CORS, access control (IAM/bucket policy/ACL), cross-region replication, event notifications, and presigned URLs. Triggers on: OBS, bucket, object storage, lifecycle, versioning, static website, CORS, presigned, replication. NOT for: EVS block storage (use huawei-ecs), SFS file storage, CBR backup (use huawei-cbr)."
+version: 1
+---
+
+# Huawei Cloud OBS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## Critical: OBS Command Syntax
+
+KooCLI OBS uses **obsutil-style** commands, NOT API-style operations. Always run `hcloud OBS help` (no `--`) before constructing commands:
+
+```bash
+hcloud OBS help           # NOT --help
+hcloud OBS help <command> # e.g. hcloud OBS help mb
+```
+
+| Wrong (API-style) | Correct (obsutil-style) |
+|-------------------|-------------------------|
+| `OBS CreateBucket` | `OBS mb obs://<bucket>` |
+| `OBS PutObject` | `OBS cp <file> obs://<bucket>/` |
+| `OBS DeleteBucket` | `OBS rm obs://<bucket> -r` |
+
+## Overview
+
+Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/object lifecycle, access control, static website hosting, and presigned URLs.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Bucket name is global | All users share bucket namespace |
+| Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |
+| Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
+| OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
+| Static website via CLI missing | KooCLI OBS lacks website config. Use REST API or console |
+| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Run `hcloud OBS config -i` (interactive) to create `~/.obsutilconfig`. This must be done OUTSIDE agent chat. |
+| **obsutil interactive prompts** | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive. |
+| **Directory upload adds prefix** | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
+
+## OBS Credential Setup (Required Before First Use)
+
+KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. Use the **same AK/SK** that you configured for hcloud. Run once outside agent chat:
+
+```bash
+# Preferred: interactive (safe, no AK/SK in shell history)
+hcloud OBS config -i
+# Follow prompts: AK, SK, endpoint (e.g. obs.cn-north-4.myhuaweicloud.com)
+
+# Alternative: non-interactive (use with caution — AK/SK in shell history)
+hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK>
+```
+
+## Common Workflows
+
+| Task | Command |
+|------|---------|
+| Create bucket | `hcloud OBS mb obs://<bucket> -location=<region>` |
+| List buckets/objects | `hcloud OBS ls [obs://<bucket>]` |
+| Upload file | `hcloud OBS cp <file> obs://<bucket>/<key>` |
+| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat` |
+| Download object | `hcloud OBS cp obs://<bucket>/<key> <local-path>` |
+| Set bucket ACL | `hcloud OBS chattri obs://<bucket> -acl=public-read` |
+| Set object ACL | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read` | Bucket ACL does NOT cascade — anonymous reads need both |
+| Set lifecycle | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>` |
+| Set bucket policy | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |
+| Set CORS | `hcloud OBS cors obs://<bucket> -method=put -localfile=<json>` |
+| Delete bucket | `hcloud OBS rm obs://<bucket> -r` (must be empty) |
+| Presigned URL | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` |
+| Object metadata | `hcloud OBS stat obs://<bucket>/<key>` |
+
+## Static Website Deployment Workflow
+
+See `references/static-website.md` for the full end-to-end workflow:
+Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Configure website (REST API/console)
+
+> KooCLI OBS does NOT support `SetBucketWebsite`. Configure static website hosting via REST API (`PUT /?website`) or the Huawei Cloud console.
+
+## Storage Classes
+
+| Class | Use Case | Min Storage | Retrieval Fee |
+|-------|----------|-------------|---------------|
+| STANDARD | Frequently accessed | None | No |
+| STANDARD_IA | Infrequent access | 30 days | Yes |
+| ARCHIVE | Long-term archive | 90 days | Yes (hours) |
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |
+| BucketAlreadyExists | Name taken globally -> Choose different name |
+| NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |
+| InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
+| EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |
+| OBS --help fails | KooCLI OBS uses `help` not `--help` -> Run `hcloud OBS help` |
+
+## Security Considerations
+
+- MUST block public access by default
+- MUST use HTTPS-only for buckets
+- SHOULD enable access logging for audit
+- SHOULD rotate presigned URL expiry (max 7 days)
+- MUST NOT store AK/SK in bucket policies
+
+## Cross-Skill References
+
+- **EIP**: See `huawei-vpc` for public network access
+- **DEW**: See `huawei-dew` for secret management
+
+## References
+
+- OBS Docs: https://support.huaweicloud.com/obs/
+- Static website: references/static-website.md
+- Lifecycle: references/bucket-lifecycle.md
+- Replication: references/replication.md

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-create.md

@@ -0,0 +1,49 @@
+# OBS Bucket Creation Reference
+
+From Huawei Cloud marketplace best practices.
+
+## Naming Rules
+
+| Rule | Detail |
+|------|--------|
+| Length | 3-63 characters |
+| Characters | Lowercase letters, numbers, `-`, `.` |
+| No IP format | Cannot be IP address pattern |
+| No leading/trailing `-` or `.` | Start and end must be alphanumeric |
+| No `..` | Adjacent dots forbidden |
+| No `-.` or `.-` | Adjacent dot-hyphen combos forbidden |
+
+## Create Bucket
+
+```bash
+hcloud OBS mb obs://<bucket> [-acl=xxx] [-location=<r>] [-sc=xxx]
+```
+
+| Option | Values | Default |
+|--------|--------|---------|
+| `-acl` | private, public-read, public-read-write | private |
+| `-location` | cn-south-1, cn-north-4, ... | config default |
+| `-sc` | standard, warm, cold, deep-archive | standard |
+
+## Quick Verify
+
+```bash
+hcloud OBS ls
+hcloud OBS stat obs://<bucket>
+```
+
+## Storage Class Guide
+
+| Class | Access Frequency | Min Storage | Retrieval Cost |
+|-------|-----------------|-------------|----------------|
+| standard | Frequent | None | No |
+| warm | Infrequent | 30 days | Yes |
+| cold | Rare | 90 days | Yes |
+| deep-archive | Archive | 180 days | Yes |
+
+## Critical Rules
+
+- Bucket name is globally unique — test with `hcloud OBS stat` before creating
+- Region is immutable after creation
+- ACL does NOT cascade to objects — set both bucket-level and object-level access
+- OBS uses separate credentials (`~/.obsutilconfig`, configure via `hcloud OBS config -i`)

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-lifecycle.md

@@ -0,0 +1,26 @@
+# OBS Bucket Lifecycle
+
+> KooCLI OBS uses obsutil-style commands. `OBS CreateBucket` → `OBS mb`. `SetBucketWebsite` is NOT supported in KooCLI OBS (use API/SDK).
+
+## Create Bucket
+hcloud OBS mb obs://<bucket> -location=<region>
+
+## Lifecycle Rules (JSON)
+{
+  "Rules": [{
+    "ID": "move-to-ia-after-30d",
+    "Status": "Enabled",
+    "Filter": {"Prefix": ""},
+    "Transitions": [{"Days": 30, "StorageClass": "STANDARD_IA"}],
+    "Expiration": {"Days": 365}
+  }]
+}
+
+## Apply
+hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<lifecycle.json>
+
+## Static Website
+Not available via KooCLI OBS CLI. Use `hcloud OBS chattri obs://<bucket> -acl=public-read` for bucket ACL, or use API/SDK for website configuration.
+
+## Cross-Region Replication
+Requires: source bucket versioning enabled, destination bucket in different region, replication IAM role.

package/plugins/huaweicloud-core/skills/huawei-obs/references/common-pitfalls.md

@@ -0,0 +1,100 @@
+# OBS Common Pitfalls
+
+基于真实测试暴露的陷阱和避坑方法。
+
+## OBS 命令格式陷阱
+
+OBS 使用 **obsutil-style** 子命令，不是 API-style 操作名：
+
+| 错误写法（API-style） | 正确写法（obsutil-style） |
+|----------------------|--------------------------|
+| `OBS --help` | `hcloud OBS help`（无 `--`，`help` 是子命令） |
+| `OBS CreateBucket` | `hcloud OBS mb obs://<bucket>` |
+| `OBS PutObject` | `hcloud OBS cp <file> obs://<bucket>/` |
+| `OBS DeleteBucket` | `hcloud OBS rm obs://<bucket> -r` |
+| `OBS ListBuckets` | `hcloud OBS ls` |
+
+## 独立凭证配置
+
+KooCLI OBS 使用独立的凭证文件 `~/.obsutilconfig`，**不是** `~/.hcloud/config.json`。
+
+```bash
+# OBS 命令报 "Please set ak, sk and endpoint" 时运行：
+hcloud OBS config -i
+# 交互式输入：AK、SK、endpoint（如 obs.cn-north-4.myhuaweicloud.com）
+# 这必须由用户在 agent 对话外手动执行
+```
+
+## 目录上传语义
+
+`hcloud OBS cp <dir>/ obs://bucket/ -r` 将本地**文件夹名作为对象前缀**：
+
+```
+本地结构:
+  devkit/
+    index.html
+    assets/app.js
+
+上传后 OBS 结构:
+  obs://bucket/devkit/index.html     ← 多了 devkit/ 前缀
+  obs://bucket/devkit/assets/app.js
+
+预期结构:
+  obs://bucket/index.html
+  obs://bucket/assets/app.js
+```
+
+**规避方法**：
+1. 先 `-dryRun` 预览实际键名，再执行真实上传
+2. 或先将本地目录重命名为目标前缀名，如 `mv devkit/ root/` 后上传 `root/`
+3. 或使用 `-flat` 参数（如支持）
+
+## 静态网站托管
+
+KooCLI OBS **不支持** `SetBucketWebsite` 命令。配置静态网站托管需要：
+
+1. **REST API**: `PUT /?website` 到桶的 endpoint
+2. **控制台**: OBS 控制台 → 桶 → 静态网站托管 → 开启
+
+插件只能完成"上传文件 + 设置 ACL"，静态托管开关需用户手动完成。
+
+## 权限模型（三层）
+
+| 层级 | 作用域 | 优先级 |
+|------|--------|--------|
+| IAM Policy | 用户/用户组 | 最高 |
+| Bucket Policy | 桶级 | 中 |
+| ACL | 对象级 | 最低 |
+
+**关键规则**：三层中**最严格**的生效。Bucket Policy 设为 public-read，但 IAM deny 了 → 结果是 deny。
+
+**静态网站场景**：必须同时设置桶级 AND 对象级 `-acl=public-read`，因为 ACL 不级联。
+
+```bash
+# 桶级
+hcloud OBS chattri obs://<bucket> -acl=public-read
+# 对象级（必须单独执行）
+hcloud OBS chattri obs://<bucket>/index.html -acl=public-read
+```
+
+## 桶命名约束
+
+- 全局唯一，所有用户共享命名空间
+- 小写字母、数字、连字符
+- 3-63 字符
+- 不能以连字符开头或结尾
+- 不能是 IP 地址格式
+
+## 版本控制陷阱
+
+- 开启后**无法关闭**，只能暂停
+- 删除桶前必须清空所有版本和删除标记
+- 版本存储按对象大小计费
+
+## 安全注意事项
+
+- MUST 默认阻止公网访问
+- MUST 启用 HTTPS-only
+- SHOULD 开启访问日志
+- 预签名 URL 最大 7 天有效期
+- AK/SK 绝对不能写入 Bucket Policy

package/plugins/huaweicloud-core/skills/huawei-obs/references/static-website.md

@@ -0,0 +1,56 @@
+# OBS Static Website Deployment
+
+## Workflow
+
+```
+1. Build project     → npm run build / yarn build
+2. Create OBS bucket  → hcloud OBS mb obs://<bucket> -location=<region>
+3. Bulk upload        → hcloud OBS cp <build-dir>/ obs://<bucket>/ -r -f -flat -acl=public-read
+4. Set bucket ACL     → hcloud OBS chattri obs://<bucket> -acl=public-read
+5. Set object ACLs    → hcloud OBS chattri obs://<bucket>/ -r -f -acl=public-read
+6. Configure website  → REST API (KooCLI OBS lacks this feature)
+7. Verify             → curl http://<bucket>.obs-website.<region>.myhuaweicloud.com
+```
+
+## Step-by-Step (Vue/Vite Example)
+
+```bash
+# 1. Build
+npm run build                  # outputs to dist/
+
+# 2. Create bucket in target region
+hcloud OBS mb obs://my-static-site -location=cn-north-4
+
+# 3. Upload entire build directory (recursive, force, flatten, public ACL)
+hcloud OBS cp dist/ obs://my-static-site/ -r -f -flat -acl=public-read
+
+# 4. Set bucket ACL (required for static website access)
+hcloud OBS chattri obs://my-static-site -acl=public-read
+
+# 5. Set object ACLs recursively (objects don't inherit bucket ACL automatically)
+hcloud OBS chattri obs://my-static-site/ -r -f -acl=public-read
+
+# 5. Configure static website hosting
+# KooCLI OBS does NOT support this. Use one of:
+# Option A — REST API:
+#   PUT /?website HTTP/1.1
+#   Host: my-static-site.obs.cn-north-4.myhuaweicloud.com
+#   Body: {"IndexDocument": {"Suffix": "index.html"}, "ErrorDocument": {"Key": "error.html"}}
+#   (requires AK/SK signature)
+# Option B — Huawei Cloud Console:
+#   Console → OBS → Bucket → Basic Settings → Static Website Hosting
+
+# 6. Verify
+curl http://my-static-site.obs-website.cn-north-4.myhuaweicloud.com
+```
+
+## Key Gotchas
+
+- **Build output dir varies**: `dist/` (Vite), `build/` (CRA), `out/` (Next.js). Check `package.json` scripts.
+- **Bucket name must be DNS-compliant**: lowercase, numbers, hyphens only. No underscores or uppercase.
+- **Region matters**: Website endpoint depends on bucket region. `obs-website.<region>.myhuaweicloud.com`.
+- **Index.html routing**: For SPA apps (Vue Router, React Router), set `ErrorDocument` to `index.html` as well.
+- **Cache invalidation**: New uploads don't clear CDN cache. Add `?v=<timestamp>` to asset references or use OBS versioning.
+- **Always use `-f`**: Without `-f`, obsutil prompts "Please input (y/n)" on large uploads — Agent hangs (TIMEOUT).
+- **Use `-flat` for root files**: Without `-flat`, `dist/` becomes `bucket/dist/` prefix. Static sites need files at bucket root.
+- **Objects don't inherit bucket ACL**: Setting bucket to public-read does NOT make individual objects public. You must also set object-level ACL with `chattri obs://<bucket>/ -r -f -acl=public-read` or use `-acl=public-read` during upload.

package/plugins/huaweicloud-core/skills/huawei-rds/SKILL.md

@@ -0,0 +1,181 @@
+---
+name: huawei-rds
+description: "Use when creating, configuring, managing, or troubleshooting RDS instances on Huawei Cloud. Covers MySQL, PostgreSQL, SQL Server. Triggers: RDS, MySQL, PostgreSQL, database instance, backup, read replica. NOT for: GaussDB (use huawei-gaussdb), DDS (use huawei-dds-dcs)."
+version: 1
+---
+
+# Huawei Cloud RDS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud RDS <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Prerequisites
+
+Before creating an RDS instance, you MUST have:
+- A VPC and subnet (see `huawei-vpc`)
+- A security group with database port open (MySQL=3306, PostgreSQL=5432, SQL Server=1433)
+- Run `hcloud RDS ListFlavors --database_name=<engine> --cli-region=<r>` to get spec codes
+
+## KooCLI Command Format
+
+```
+hcloud RDS <Operation> --cli-region=<region> [--key=value ...]
+```
+
+| Rule | Detail |
+|------|--------|
+| Service name | `RDS` (uppercase) |
+| Operation | PascalCase: `ListInstances`, `CreateManualBackup` |
+| Params | `--key=value` format. JSON params: `--key='{"k":"v"}'` |
+| Array params | 1-based: `--instance_ids.1=xxx` |
+| Password param | Conflicts with KooCLI system param; pipe `echo \|` to bypass |
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Engine version immutable | Cannot change MySQL to PostgreSQL in-place |
+| Automated backups use OBS | Backup storage incurs separate charges. Set retention period explicitly |
+| Storage auto-scaling off by default | Enable before storage runs out or instance goes read-only |
+| `--password` conflicts with KooCLI | Non-interactive: `printf "b\n" \| hcloud RDS CreateInstance ...` to select API param. Or use `--cli-jsonInput` |
+| Volume type must match flavor | General→CLOUDSSD; Dedicated→CLOUDSSD\|ESSD; ARM→ULTRAHIGH |
+| Flavor not in region | Always `ListFlavors` first. Spec codes vary by region |
+| Restore creates new instance | No in-place restore. Verify target flavor before restoring |
+
+## Instance Management
+
+### List
+```bash
+hcloud RDS ListInstances --cli-region=<r>
+hcloud RDS ListFlavors --database_name=<engine> --cli-region=<r>
+hcloud RDS ListDatastores --database_name=<engine> --cli-region=<r>
+hcloud RDS ListEngineFlavors --instance_id=<id> --cli-region=<r>
+```
+
+### Create Instance
+```bash
+hcloud RDS CreateInstance --cli-region=<r> \
+  --name=<name> \
+  --datastore.type=<engine> \
+  --datastore.version=<version> \
+  --flavor_ref=<flavor-id> \
+  --volume.type=<vol-type> \
+  --volume.size=<size> \
+  --vpc_id=<vpc-id> \
+  --subnet_id=<subnet-id> \
+  --security_group_id=<sg-id> \
+  --availability_zone=<az> \
+  --charge_info.charge_mode=<mode> \
+  --password=<pw>
+```
+
+> `--password` conflicts with a KooCLI system param. Pipe `echo "b\n" |` before the command or use `--cli-jsonInput` (see Critical Warnings).
+
+| Param | Required | Note |
+|-------|----------|------|
+| `--name` | Yes | Instance name |
+| `--datastore` | Yes | `--datastore.type=<engine> --datastore.version=<version>` |
+| `--flavor_ref` | Yes | From `ListFlavors` output |
+| `--volume` | Yes | Type matching: General→CLOUDSSD, Dedicated→CLOUDSSD\|ESSD, ARM→ULTRAHIGH |
+| `--vpc_id` | Yes | Must exist in target region |
+| `--subnet_id` | Yes | Must exist in target region |
+| `--security_group_id` | Yes | Must have DB port open |
+| `--availability_zone` | Yes | Use AZ code from `NovaListAvailabilityZones` |
+| `--charge_info` | No | `--charge_info.charge_mode=<mode>`. Default postPaid (pay-per-use). Run `--help` for options |
+| `--password` | Yes | 8-32 chars, uppercase+lowercase+digit+special |
+| `--port` | No | Default 3306 (MySQL) / 5432 (PG) / 1433 (SQL Server) |
+
+### Modify / Resize
+```bash
+hcloud RDS StartInstanceRestartAction --instance_id=<id> --cli-region=<r>
+hcloud RDS StartResizeFlavorAction --instance_id=<id> --flavor_ref=<new-id> --cli-region=<r>
+hcloud RDS StartInstanceEnlargeVolumeAction --instance_id=<id> --volume_size=<gb> --cli-region=<r>
+hcloud RDS StartFailover --instance_id=<id> --cli-region=<r>
+hcloud RDS UpdateInstanceAlias --instance_id=<id> --alias=<new-name> --cli-region=<r>
+```
+
+### Delete
+```bash
+hcloud RDS DeleteInstance --instance_id=<id> --cli-region=<r>
+```
+
+## Backup & Recovery
+
+```bash
+hcloud RDS ShowBackupPolicy --instance_id=<id> --cli-region=<r>
+hcloud RDS SetBackupPolicy --instance_id=<id> --backup_policy='{"keep_days":7,"period":"1,2,3,4,5,6,7","start_time":"00:00-01:00"}' --cli-region=<r>
+hcloud RDS ListBackups --instance_id=<id> --cli-region=<r>
+hcloud RDS CreateManualBackup --instance_id=<id> --name=<name> --cli-region=<r>
+hcloud RDS ShowRecoveryTimeWindow --instance_id=<id> --cli-region=<r>
+hcloud RDS CreateRestoreInstance --instance_id=<id> --backup_id=<id> --name=<new-name> --flavor_ref=<id> --cli-region=<r>
+```
+
+> Manual backup deletion is irreversible. Verify backup ID before deleting.
+
+## Read Replicas
+
+```bash
+hcloud RDS CreateReadReplica --replica_of_id=<primary-id> --name=<name> --flavor_ref=<id> --volume.type=<vol-type> --volume.size=<size> --cli-region=<r>
+```
+
+## Fault Diagnosis
+
+```bash
+hcloud RDS ListErrorLogs --instance_id=<id> --start_date=2024-01-01T00:00:00Z --end_date=2024-01-31T23:59:59Z --cli-region=<r>
+hcloud RDS ListSlowLogs --instance_id=<id> --start_date=... --end_date=... --cli-region=<r>
+hcloud RDS ShowReplicationStatus --instance_id=<id> --cli-region=<r>
+hcloud RDS ListInstanceDiagnosis --cli-region=<r>
+```
+
+## Connecting
+
+```bash
+hcloud RDS ListInstances --cli-region=<r>  # get private_ips + port
+mysql -h <private_ip> -P 3306 -u root -p --ssl-mode=REQUIRED
+psql -h <private_ip> -p 5432 -U root -d postgres
+```
+
+> hcloud does NOT support SQL execution. Use a database client.
+> For public access, bind an EIP (see `huawei-vpc`).
+
+## Mutating Operations (Require Approval)
+
+| Operation | Effect |
+|-----------|--------|
+| `CreateInstance` | New instance (billing starts) |
+| `DeleteInstance` | Irreversible data loss |
+| `StartResizeFlavorAction` | Brief interruption during switchover |
+| `StartInstanceEnlargeVolumeAction` | Online, but irreversible |
+| `StartFailover` | Primary-standby switchover |
+| `CreateRestoreInstance` | Creates new instance from backup |
+| `CreateManualBackup` | Incurs OBS storage charges |
+| `DeleteManualBackup` | Irreversible |
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|-------------------|
+| Connection refused | SG missing DB port. Add ingress rule |
+| Storage full | Manual resize or enable auto-scaling |
+| DBS.280241 Invalid storage type | Volume type doesn't match flavor group |
+| DBS.280448 Sold out | Try different volume type or AZ |
+| Replication lag | Check `ShowReplicationStatus`. Consider read replica |
+| Instance stuck BUILDING | Check task status: `hcloud RDS ListTasks` |
+| SYS.0403 | SCP policy denies this operation (e.g. security group rules, EIP binding). See `huawei-vpc` troubleshooting |
+| EIP.7905 | EIP quota exceeded — cannot create new EIP for public access. See `huawei-vpc` troubleshooting |
+
+## Security
+
+- MUST use security groups, not open 0.0.0.0/0
+- MUST enable SSL for connections
+- MUST store passwords in DEW/CSMS (see `huawei-dew`)
+- SHOULD enable audit logs for compliance
+- SHOULD set backup policy with >= 7 day retention
+
+## Cross-Skill References
+
+- VPC/Subnet/Security Group: `huawei-vpc`
+- DEW secrets: `huawei-dew`
+- EIP for public access: `huawei-vpc`
+- OBS for backup storage: `huawei-obs`

package/plugins/huaweicloud-core/skills/huawei-smn-dms/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: huawei-smn-dms
+description: "Use when creating or managing SMN topics/subscriptions/messages or DMS Kafka/RabbitMQ/RocketMQ queues on Huawei Cloud. Triggers: SMN, DMS, notification, message queue, Kafka, RabbitMQ, RocketMQ, topic, subscription. NOT for: APIG (use huawei-apig), FunctionGraph triggers (use huawei-functiongraph)."
+version: 1
+---
+
+# Huawei Cloud SMN / DMS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud SMN <Operation> --help` or `hcloud DMS <Operation> --help` before constructing commands.
+
+## Overview
+
+Domain expertise for SMN (Simple Message Notification) and DMS (Distributed Message Service). SMN is used for notifications and alerts. DMS covers Kafka, RabbitMQ, and RocketMQ instances.
+
+## SMN
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Subscription confirmation | HTTP/HTTPS subscriptions need endpoint ping-back confirmation |
+| Email subscription delay | Email subscriptions require user to click confirmation link |
+| SMS charge per message | Template SMS incurs per-delivery charges |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List topics | `ListTopics --cli-region=<r> --project_id=<p>` |
+| Create topic | `CreateTopic --cli-region=<r> --project_id=<p>` |
+| Add subscription | `AddSubscription --cli-region=<r> --project_id=<p>` |
+| List subscriptions | `ListSubscriptions --cli-region=<r> --project_id=<p>` |
+| Create message template | `CreateMessageTemplate --cli-region=<r> --project_id=<p>` |
+| Publish message | `PublishMessage --cli-region=<r> --project_id=<p>` |
+| Delete topic | `DeleteTopic --cli-region=<r> --project_id=<p>` |
+
+## DMS
+
+### Service Types
+
+| Type | KooCLI Service |
+|------|---------------|
+| Kafka | `hcloud DMS` |
+| RabbitMQ | `hcloud DMS` |
+| RocketMQ | `hcloud DMS` |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create Kafka instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| List Kafka topics | `ListTopics --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| Subscription not confirmed | SMN subscriptions need endpoint/user confirmation |
+| DMS instance creation fails | Check VPC/subnet availability and engine version |
+
+## Cross-Skill References
+
+- **CES alarms**: See `huawei-cloud-eye` for SMN-based alarm notifications
+- **VPC**: See `huawei-vpc` for DMS instance networking