/minimal-web-baas-demo

name: minimal-web-baas-demo
description: "Fast path for a minimal CloudBase Web + database demo (最小前后端 / 最小可用 fullstack / Lovable-like BaaS). Defaults to @cloudbase/js-sdk client CRUD (NoSQL app.database / PG app.rdb), MCP-only schema, preview-first, and forbids cloud functions unless secrets, cron/background jobs, or logic that security rules/RLS cannot express. Use for 搭一套 demo、留言板、Todo、Notes、Kanban, or when users say 带云函数+云数据库 but only need CRUD. NOT for production multi-service backends, CloudRun, WeChat Mini Programs, or tasks that truly need server secrets."
version: 2.37.6
license: MIT
alwaysApply: false

Sibling skills (local only)

Sibling CloudBase skills ship beside this skill. Use local relative paths such as `../web-development/SKILL.md`.

If a referenced sibling skill file is missing from this environment, ask the user to install the full CloudBase plugin (or the missing skill). Do **not** HTTP-fetch remote skill or protocol markdown into the agent context.

Minimal Web BaaS Demo (fast path)

Goal: **minutes to an interactive Web + database preview**, not a cloud-function middleware stack.

This skill is the product equivalent of CloudBase Sites SessionStart **Rule 5** (BaaS-first data persistence).

Activation Contract

Use this first when

• The user asks for a **minimal fullstack / 前后端 demo**, message board, Todo, Notes, Kanban, or Lovable/Supabase-like quick app on CloudBase Web.
• The user says "带云函数+云数据库" but the real need is CRUD + preview (reinterpret as Web SDK → database).

Do NOT use for

• WeChat Mini Programs (`wx.cloud`) — use `../miniprogram-development/SKILL.md`.
• True server workloads: payments callbacks, SMS providers, secret third-party keys, cron/ETL, WebSockets — use `../cloud-functions/SKILL.md` or `../cloudrun-development/SKILL.md`.
• Large multi-module products that need `../spec-workflow/SKILL.md`.

Hard rules (align with Sites SessionStart Rule 5)

1. **BaaS-first data path**

• **Schema / admin:** Prefer MCP management tools. Do not ask the user to create collections/tables in the console. If MCP tools are missing in this session, configure MCP for next time and use `tcb` CLI (`../cloudbase-cli/SKILL.md`) for equivalent schema/admin ops.
• NoSQL: `writeNoSqlDatabaseStructure` (create collection / indexes) + permission tools as needed; CLI: NoSQL commands in `cloudbase-cli`.
• PostgreSQL: follow `../postgresql-development-cloudbase/SKILL.md` (`queryPgDatabase` / `managePgDatabase` / migrations); CLI parity via `tcb db pg …` when MCP is unavailable.
• **Reads / writes:** `@cloudbase/js-sdk` in the browser.
• NoSQL: `app.database()` → `db.collection(...).get()/add()/update()/watch(...)`.
• PG: `app.rdb().from(...)`.
• Prefer the template helper (often `src/utils/cloudbase.ts`). Do not invent a second SDK wrapper.

2. **Cloud functions are forbidden by default**

• Todo / Notes / Chat / Kanban / "最小前后端 demo" → **zero** cloud functions.
• Even if the user says "带云函数", deliver Web SDK → DB and explain in one sentence that cloud functions are not required for CRUD.
• Create a cloud function **only when**:
• (a) the logic cannot be expressed as database security rules / RLS, **and**
• (b) it needs server-side secrets / third-party API keys, **or** it is a scheduled / background job not triggered by a user click.

3. **Package discipline**

• Browser: `@cloudbase/js-sdk` only.
• Never install `@cloudbase/node-sdk` (or random stubs) in frontend code.

4. **Preview first, deploy second**

• Ship local list + add (or equivalent CRUD) before static hosting / CloudApp deploy.
• Custom domains, DNS, rollback runbooks → only if the user explicitly asks.
• Skip Playwright / agent-browser unless the user asks to test.

5. **UI ceremony for this path**

• Reuse the template look. **Do not** load `ui-design` four-part specs for a minimal demo unless the user asks for visual redesign.
• "Make me a X app" = X **is** the homepage (`HomePage` / `App`), not a nested demo route beside the welcome page.

6. **Anonymous (or real) session before NoSQL CRUD — js-sdk 3.x + publishable key**

• With `@cloudbase/js-sdk` **3.x** initialized via publishable `accessKey`, call **`await auth.signInAnonymously()`** (or an equivalent authenticated session) **before** any NoSQL `app.database()` `get` / `add` / `update` / `watch`.
• Skipping this yields **gateway 401**. `checkLogin()` / `getSession()` alone does **not** create a usable write session.
• Minimal example:

const auth = app.auth
const { error } = await auth.signInAnonymously()
if (error) throw error
const db = app.database()
await db.collection('messages').get()

Capability sniff order (partners + agents)

Use this order for every minimal Web + DB demo. **Do not reorder.** Cloud functions stay off the critical path.

0. Connector pre-enabled (or shortest Trust path)     ← host / partner packaging
1. Template warmup // parallel with credential wait   ← downloadTemplate + install
2. queryEnv(action="info")                            ← sniff env + RuntimeBackends
3. Lock ONE DB plane (NoSQL | PG)                    ← new relational work is PG; MySQL only if the env already has it
4. MCP schema + minimal permissions                   ← writeNoSql* / PG migrate
5. Browser @cloudbase/js-sdk CRUD                     ← app.database() / app.rdb()
6. Local preview (list + add)                         ← then ask before deploy
7. Cloud functions                                    ← skip (count = 0) unless secrets/cron/rules-cannot-express

Stack priority for this path: **Web SDK CRUD > MCP schema > template warmup > cloud functions**.

Standard playbook

1. **Warm template in parallel with credentials** (see partner notes below): `downloadTemplate` (`react` default, `vue` if requested) → `npm install` / `pnpm install`. 2. `queryEnv(action="info")` → lock **one** DB plane (NoSQL **or** PG). New relational work us