diff --git a/.cursor/rules/with-lingui-add-resource.mdc b/.cursor/rules/with-lingui-add-resource.mdc
deleted file mode 100644
index 7148017..0000000
--- a/.cursor/rules/with-lingui-add-resource.mdc
+++ /dev/null
@@ -1,15 +0,0 @@
----
-description: "Add a new CRUD resource / scaffold (with-lingui)."
-globs: apps/with-lingui/src/api/**/*.ts,apps/with-lingui/src/mocks/**/*.ts,apps/with-lingui/src/routes/_auth/**/*.tsx,apps/with-lingui/e2e/**/*.spec.ts
-alwaysApply: false
----
-
-# with-lingui · Add resource (thin rule)
-
-**Single source of truth:**
-
-`apps/with-lingui/.github/instructions/add-resource.instructions.md`
-
-When adding a resource, follow that recipe (mirror the `users` example). On conflict, the `.instructions.md` file wins.
-
-`@apps/with-lingui/.github/instructions/add-resource.instructions.md`
diff --git a/.cursor/rules/with-lingui-api.mdc b/.cursor/rules/with-lingui-api.mdc
deleted file mode 100644
index 0df0532..0000000
--- a/.cursor/rules/with-lingui-api.mdc
+++ /dev/null
@@ -1,15 +0,0 @@
----
-description: "API clients, Zod schemas, HTTP, MSW handlers (with-lingui)."
-globs: apps/with-lingui/src/api/**/*.ts,apps/with-lingui/src/utils/http.ts,apps/with-lingui/src/mocks/handlers/**/*.ts,apps/with-lingui/src/mocks/createHandler.ts
-alwaysApply: false
----
-
-# with-lingui · API（薄规则）
-
-**唯一细则来源**：
-
-`apps/with-lingui/.github/instructions/api.instructions.md`
-
-编辑符合 `globs` 的文件时，遵守该文件中的约定；冲突以 `.instructions.md` 为准。
-
-`@apps/with-lingui/.github/instructions/api.instructions.md`
diff --git a/.cursor/rules/with-lingui-frontend.mdc b/.cursor/rules/with-lingui-frontend.mdc
deleted file mode 100644
index f848906..0000000
--- a/.cursor/rules/with-lingui-frontend.mdc
+++ /dev/null
@@ -1,15 +0,0 @@
----
-description: "React UI, routes, components, styles, layout, i18n, Ant Design (with-lingui)."
-globs: apps/with-lingui/src/**/*.{ts,tsx,css}
-alwaysApply: false
----
-
-# with-lingui · Frontend（薄规则）
-
-**唯一细则来源**（勿在此文件重复维护长文）：
-
-`apps/with-lingui/.github/instructions/frontend.instructions.md`
-
-编辑符合 `globs` 的文件时，遵守该文件中的 Do / Do Not / Validation；如有冲突，以 `.instructions.md` 为准。
-
-需要全文进上下文时，在对话里引用：`@apps/with-lingui/.github/instructions/frontend.instructions.md`。
diff --git a/.cursor/rules/with-lingui-refactor.mdc b/.cursor/rules/with-lingui-refactor.mdc
deleted file mode 100644
index 5963e5c..0000000
--- a/.cursor/rules/with-lingui-refactor.mdc
+++ /dev/null
@@ -1,15 +0,0 @@
----
-description: "Refactors without behavior change — dedupe, naming, structure (with-lingui)."
-globs: apps/with-lingui/src/**/*.{ts,tsx}
-alwaysApply: false
----
-
-# with-lingui · Refactor（薄规则）
-
-**唯一细则来源**：
-
-`apps/with-lingui/.github/instructions/refactor.instructions.md`
-
-做行为保持式重构时遵守该文件；与 frontend 规则同时命中时，**重构意图**以本文件指向的 refactor 指令为准，其余 UI 细节仍以 `frontend.instructions.md` 为准。
-
-`@apps/with-lingui/.github/instructions/refactor.instructions.md`
diff --git a/.cursor/rules/with-lingui-testing.mdc b/.cursor/rules/with-lingui-testing.mdc
deleted file mode 100644
index ea60c0a..0000000
--- a/.cursor/rules/with-lingui-testing.mdc
+++ /dev/null
@@ -1,15 +0,0 @@
----
-description: "Playwright e2e, MSW mocks, test config (with-lingui)."
-globs: apps/with-lingui/e2e/**/*.ts,apps/with-lingui/e2e/**/*.tsx,apps/with-lingui/src/mocks/**/*.ts,apps/with-lingui/playwright.config.ts
-alwaysApply: false
----
-
-# with-lingui · Testing（薄规则）
-
-**唯一细则来源**：
-
-`apps/with-lingui/.github/instructions/testing.instructions.md`
-
-编辑符合 `globs` 的文件时，遵守该文件中的约定；冲突以 `.instructions.md` 为准。
-
-`@apps/with-lingui/.github/instructions/testing.instructions.md`
diff --git a/.githooks/README.md b/.githooks/README.md
index 7425e1f..327b238 100644
--- a/.githooks/README.md
+++ b/.githooks/README.md
@@ -1,26 +1,30 @@
-# Git hooks（仓库根）
+# Git hooks (repository root)
 
-本目录为 **monorepo 根级** Git 钩子。提交时根据暂存文件路径，在对应子项目目录执行检查（例如 `apps/with-lingui` 下执行 `vp staged`，以便正确读取该目录的 `vite.config.ts`）。
+This directory holds **monorepo root-level** Git hooks. On commit, checks run in the matching subproject based on staged file paths (for example, `vp staged` under `apps/with-lingui` so that directory’s `vite.config.ts` is loaded correctly).
 
-模板应用目录内的 `.vite-hooks/`（如 `apps/with-lingui/.vite-hooks/`）留给 **模板单独拷贝出去使用**；在本仓库开发时请使用根级钩子，避免在仓库根执行 `vp staged` 找不到 `vite.config.ts`。
+Per-app `.vite-hooks/` under template apps (e.g. `apps/with-lingui/.vite-hooks/`) are for **copying a template out on its own**. When developing in this repo, use the root hooks so `vp staged` at the repo root does not fail to find `vite.config.ts`.
 
-## 启用方式（一次性）
+## Monorepo and `vp config`
 
-在仓库根目录执行：
+The root `package.json` `preinstall` sets `core.hooksPath=.githooks` before dependencies install and writes `vp.hooks.disabled=true` in **this clone** so parallel `prepare` scripts (`vp config`) from multiple workspaces do not fight over `.git/config` and cause lock conflicts. Template apps still use `"prepare": "vp config"`; when copied out alone they do not get the root `preinstall`.
+
+## Enabling (one-time)
+
+From the repository root:
 
 ```bash
 git config core.hooksPath .githooks
 ```
 
-或使用：
+Or:
 
 ```bash
 pnpm run setup:git-hooks
 ```
 
-验证：
+Verify:
 
 ```bash
 git config core.hooksPath
-# 应输出：.githooks
+# Expected: .githooks
 ```
diff --git a/.githooks/pre-commit b/.githooks/pre-commit
index 1664da5..bae6b61 100755
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -16,11 +16,11 @@ run_in_dir() {
 }
 
 if echo "$STAGED" | grep -q '^apps/with-lingui/'; then
-  run_in_dir apps/with-lingui vp staged
+  run_in_dir apps/with-lingui pnpm exec vp staged
 fi
 
 if echo "$STAGED" | grep -q '^apps/basic/'; then
-  run_in_dir apps/basic vp staged
+  run_in_dir apps/basic pnpm exec vp staged
 fi
 
 if echo "$STAGED" | grep -q '^packages/create/'; then
diff --git a/.gitignore b/.gitignore
index f63e72f..7c32fe6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,7 +42,7 @@ yarn-error.log*
 # Git worktrees
 .worktrees/
 
-# Cursor：仅共享项目规则；其余本机数据仍忽略（方案 A — 细则单源在 apps/with-lingui/.github/instructions）
+# Cursor: share project rules only; ignore other local Cursor data (agent rules: each app’s AGENTS.md)
 .cursor/*
 !.cursor/rules/
 !.cursor/rules/**
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..22d6f67
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,23 @@
+# antd-admin (monorepo)
+
+Enterprise admin templates and docs. **AI and coding rules live in each app’s `AGENTS.md`**, not here.
+
+## Layout
+
+| Path | Role |
+| --- | --- |
+| `apps/basic` | English Vite+ template — see `apps/basic/AGENTS.md` |
+| `apps/with-lingui` | Lingui i18n template — see `apps/with-lingui/AGENTS.md` |
+| `apps/docs` | Nextra docs site |
+| `packages/create` | `init-antd-admin` CLI |
+
+## Commands (repo root)
+
+- `pnpm install` — sets `core.hooksPath=.githooks` via `preinstall`
+- `pnpm dev` / `pnpm build` / `pnpm fmt` / `pnpm lint` — turbo across workspaces
+
+**Template app work:** `cd apps/basic` or `cd apps/with-lingui`, then use **`vp`** (`vp install`, `vp check`, …). Do not run app `vp staged` from root without that `cd`.
+
+## Git hooks
+
+`.githooks/pre-commit` runs checks by staged paths: `pnpm exec vp staged` in `apps/basic` / `apps/with-lingui`, typecheck for `packages/create`, lint for `apps/docs`.
diff --git a/README.md b/README.md
index 345d91d..1414b8f 100644
--- a/README.md
+++ b/README.md
@@ -6,8 +6,8 @@ Antd Admin provides production-style admin templates with modern frontend toolin
 
 Available templates:
 
-- `basic`: English-only setup
-- `with-lingui`: Bilingual setup (`en` + `zh`) with Lingui
+- `basic`: Admin template with plain-string UI copy (default English; no bundled Lingui)
+- `with-lingui`: Lingui i18n workflow (`en` + `zh`) with locale switching
 
 Scaffolding CLI:
 
@@ -20,6 +20,7 @@ Scaffolding CLI:
 - URL-synced table state (pagination, sorting, search)
 - Dark mode theme switching
 - Mock-first local development (no backend required)
+- Modular API layer (`defineApi` per domain, Zod schemas, shared `API_PREFIX`)
 - Typed API boundaries and reusable CRUD patterns
 - React 19 + Ant Design 6 + TanStack Router/Query + Zustand + Zod
 - Optional Lingui-based i18n workflow (`with-lingui`)
@@ -48,19 +49,23 @@ pnpm dlx init-antd-admin@latest my-app --example with-lingui --skip-install
 ### Common options
 
 
-| Option                       | Description                      |
-| ---------------------------- | -------------------------------- |
-| `[project-directory]`        | Target folder                    |
-| `-e, --example <name         | url>`                            |
-| `--example-path <path>`      | Subpath inside remote repository |
-| `-m, --package-manager <pm>` | `npm` / `pnpm` / `yarn` / `bun`  |
-| `--skip-install`             | Skip dependency install          |
-| `--skip-transforms`          | Skip rewrite transforms          |
-| `--no-git`                   | Skip git initialization          |
+| Option                       | Description                                |
+| ---------------------------- | ------------------------------------------ |
+| `[project-directory]`        | Target folder                              |
+| `-e, --example <name\|url>`  | Template name (`basic`, `with-lingui`) or URL |
+| `--example-path <path>`      | Subpath inside remote repository           |
+| `-m, --package-manager <pm>` | `npm` / `pnpm` / `yarn` / `bun`            |
+| `--skip-install`             | Skip dependency install                    |
+| `--skip-transforms`          | Skip rewrite transforms                    |
+| `--no-git`                   | Skip git initialization                    |
 
 
 For detailed CLI behavior, see `[packages/create/README.md](./packages/create/README.md)`.
 
+### AI / agent guidance
+
+Each template app keeps **`AGENTS.md`** as the single source of truth (Cursor, Claude Code, Codex, etc.). Monorepo overview: [AGENTS.md](./AGENTS.md) at the repo root.
+
 Production docs: [https://antd-admin-doc.zuiidea.top](https://antd-admin-doc.zuiidea.top)
 
 ## Links
diff --git a/apps/basic/.agents/skills/add-resource/SKILL.md b/apps/basic/.agents/skills/add-resource/SKILL.md
new file mode 100644
index 0000000..5816201
--- /dev/null
+++ b/apps/basic/.agents/skills/add-resource/SKILL.md
@@ -0,0 +1,71 @@
+---
+name: add-resource
+description: Add a new CRUD resource in antd-admin-basic (mirror users). Use when scaffolding roles, tenants, or any list+form resource with MSW, routes, menu, and e2e.
+---
+
+# Add Resource Recipe
+
+Add a list CRUD flow that mirrors **Users** (TanStack Router + Query + MSW). **No codegen** — copy and adapt by hand. References: `src/routes/_auth/users/` and matching `e2e/*.spec.ts`. UI copy is **English plain strings** (no i18n).
+
+## 0. Verification commands (after your changes)
+
+Run from the **app root** (this project directory — where `package.json` and `vite.config.ts` live):
+
+```bash
+pnpm run build             # refresh TanStack routeTree when routes change
+vp check --no-fmt
+pnpm run test:e2e -- e2e/<slug>.spec.ts
+```
+
+## 1. Zod and types (`src/api/<slug>/schemas.ts`)
+
+- Define `<Entity>Schema`, `Create<Entity>RequestSchema`, `Update<Entity>RequestSchema` (`Update` = `Create.partial()`).
+- For list `output`, reuse `PaginatedDataSchema(<Entity>Schema)` (unwrapped `data`; envelope stays in `request.ts`).
+- Add list query schema (e.g. `List<Entity>QuerySchema`) when the table has filters/pagination.
+- Export `type <Entity> = z.infer<typeof ...>`.
+
+## 2. Resource API module (`src/api/<slug>/index.ts`)
+
+- Export path constants if useful for MSW/docs.
+- Define APIs with `defineApi` from `@/api/request`: `list` / `create` / `update` / `delete` (and `queryKeys`).
+- `method` defaults to `GET`; mutations set `POST` / `PUT` / `DELETE`.
+- Use segmented `params` / `query` / `body` + `output`; do not call axios from routes.
+
+## 3. Mock data (`src/mocks/data.ts`)
+
+- Append a `MOCK_<ENTITIES>` array. For **admin** users, `permissions` must include `<slug>:view` (and create/edit/delete if you add writes), aligned with `GET /api/auth/permissions`.
+
+## 4. MSW (`src/mocks/handlers/<slug>.ts` + `handlers/index.ts`)
+
+- Follow `handlers/user.ts`: paginated `GET` + optional `keyword`, `POST` / `PUT` / `DELETE`; use `successWithSchema` / `paginatedWithSchema` / `successWithNullBody` for success and `errorResponse` for errors.
+- Register `...<slug>Handlers` in `handlers/index.ts`.
+
+## 5. Route page (`src/routes/_auth/<slug>/`)
+
+- `createFileRoute("/_auth/<slug>/")`, wiring `useResourceCRUD` with resource functions (`listX`, `createX`, …) and `queryKeys` from `@/api/<slug>` (recommended: `optimistic: { update: true, delete: true }`), plus `useCrudToasts`, `useUrlSearchState`, `useTableFitHeight` (see `users/` for splitting `-Toolbar` / `-FormModal`).
+- Use English string literals for labels, placeholders, and messages.
+
+## 6. Menu and permissions (`src/utils/appMenu.ts`)
+
+- Add a menu entry to `APP_MENU_TREE`: `path: "/<slug>"`, `permissions: ["<slug>:view"]`, `icon` using a Sidebar-registered key (see existing `IconLucide*` entries in `Sidebar`).
+- Keep behavior consistent with `canAccessPath` / 403.
+
+## 6b. Sidebar labels and icons (`src/components/Layout/Sidebar/index.tsx`)
+
+- In `MENU_LABELS`, add an English label for the menu item `name` (must match the `name` string from `appMenu`).
+- In `MENU_ICON_MAP`, map the new `icon` key to a `lucide-react` icon and add the matching `import`.
+
+## 7. E2E (`e2e/<slug>.spec.ts`)
+
+- Copy structure from `users.spec.ts`: `loginAsAdmin` → `goto /<slug>`, assert headers / search placeholder, etc.
+
+## 8. Verification
+
+- `vp check --no-fmt`
+- `pnpm run test:e2e` (focused spec) or full suite as needed
+- `pnpm run build` and watch chunk sizes in the log
+
+## Notes
+
+- Before adding or renaming files, confirm nothing already exists at that path so you do not overwrite hand-written code.
+- After manual schema edits, treat the diff as source of truth; there is no automatic merge.
diff --git a/apps/basic/.github/instructions/README.md b/apps/basic/.github/instructions/README.md
deleted file mode 100644
index 27850d7..0000000
--- a/apps/basic/.github/instructions/README.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# AI Instruction Files
-
-This directory contains scoped instruction files used by AI coding agents.
-
-## Files
-
-- `frontend.instructions.md`: UI/routes/components/style changes
-- `testing.instructions.md`: Playwright/MSW/test changes
-- `api.instructions.md`: API client/schema/handler changes
-- `refactor.instructions.md`: behavior-preserving cleanup and deduplication
-
-## Authoring Rules
-
-- Keep each file focused on one domain.
-- Put trigger phrases in `description` so agents can discover the file.
-- Use narrow `applyTo` patterns to avoid unnecessary context load.
-- Keep instructions executable: short Do/Do Not/Validation sections.
diff --git a/apps/basic/.github/instructions/api.instructions.md b/apps/basic/.github/instructions/api.instructions.md
deleted file mode 100644
index 24f0c26..0000000
--- a/apps/basic/.github/instructions/api.instructions.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-
-## applyTo: "src/api/**/\*.ts,src/utils/http.ts,src/mocks/handlers/**/\*.ts,src/mocks/createHandler.ts"
-
-description: "Use when editing API clients, schemas, HTTP behavior, response types, or MSW endpoint handlers. Keywords: api, http, schema, zod, handler, endpoint, auth, users."
-
-# API Instructions
-
-## Purpose
-
-Maintain strict API contracts and consistent server/client mock behavior.
-
-## Do
-
-- Keep request/response shapes schema-driven and type-safe.
-- Reuse endpoint constants and shared response helpers.
-- Keep handler response envelope consistent (`code`, `data`, `message`).
-- Ensure mock handlers reflect real API behavior and error semantics.
-- Keep naming stable for endpoint keys and mutation/query keys.
-
-## Do Not
-
-- Do not return ad-hoc response shapes for one-off convenience.
-- Do not bypass schema parsing in new client mutations/queries.
-- Do not mix unrelated domain endpoints in the same module.
-
-## Validation
-
-- Verify TypeScript and schema parsing paths compile cleanly.
-- Run: `vp check --no-fmt`
diff --git a/apps/basic/.github/instructions/frontend.instructions.md b/apps/basic/.github/instructions/frontend.instructions.md
deleted file mode 100644
index 1f88597..0000000
--- a/apps/basic/.github/instructions/frontend.instructions.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-
-## applyTo: "src/\*_/_.{ts,tsx,css}"
-
-description: "Use when editing React UI, route pages, components, styles, layout, i18n text, or Ant Design behavior. Keywords: frontend, component, page, ui, layout, style, antd, i18n."
-
-# Frontend Instructions
-
-## Purpose
-
-Keep frontend changes predictable, minimal, and reusable for AI-assisted edits.
-
-## Do
-
-- Preserve existing route contracts and UI behavior unless explicitly asked.
-- Prefer reusable components and hooks over copy-paste logic.
-- Keep styles token-driven using existing theme/store patterns.
-- For Ant Design styling, follow this priority: component native API (`variant`/`type`/`size`/`styles`/`classNames`) -> `theme.useToken()` with inline `style` -> `className` + external CSS.
-- Keep translations compatible with Lingui macros and catalogs.
-- Follow current folder conventions under src/components and src/routes.
-
-## Do Not
-
-- Do not introduce new UI libraries when Ant Design already covers the need.
-- Do not bypass existing theme/store abstractions with hardcoded global state.
-- Do not write CSS overrides first when props or semantic `styles` can express the same UI.
-- Do not refactor unrelated files in the same change.
-
-## Validation
-
-- Run: `vp check --no-fmt`
-- For UI flow changes, run focused e2e where possible.
diff --git a/apps/basic/.github/instructions/refactor.instructions.md b/apps/basic/.github/instructions/refactor.instructions.md
deleted file mode 100644
index 81e74f5..0000000
--- a/apps/basic/.github/instructions/refactor.instructions.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-
-## applyTo: "src/_/_.{ts,tsx}"
-
-description: "Use when refactoring existing code for deduplication, modularization, naming cleanup, or maintainability improvements without behavior changes. Keywords: refactor, cleanup, simplify, deduplicate, maintainability."
-
-# Refactor Instructions
-
-## Purpose
-
-Reduce duplication while preserving behavior and public contracts.
-
-## Do
-
-- Keep refactors incremental and scoped to one concern per change.
-- Prefer extracting shared utilities/hooks/components over large rewrites.
-- Preserve existing external behavior and route/store contracts.
-- Keep diffs reviewable with minimal unrelated formatting churn.
-- Add or update lightweight comments only when logic is non-obvious.
-
-## Do Not
-
-- Do not change runtime behavior unless explicitly requested.
-- Do not rename broadly across the codebase without clear benefit.
-- Do not delete tests that still cover unique critical scenarios.
-- Do not introduce large dependencies for minor convenience; prefer composition or small utilities.
-
-## Considerations
-
-- Bundle: Main app chunk is ~135KB (gzip ~41KB). Ant Design (vendor-antd) and TanStack (vendor-tanstack) are in separate chunks for parallel loading. Avoid adding large UI libraries when Ant Design covers the need.
-- Type safety: Keep validations at API boundaries (Zod schemas) rather than adding more runtime checks throughout the app.
-
-## Validation
-
-- Confirm no new diagnostics in touched files.
-- Run: `vp check --no-fmt`
-- For significant changes, verify bundle size impact: `vp build 2>&1 | grep "kB"`
diff --git a/apps/basic/.github/instructions/testing.instructions.md b/apps/basic/.github/instructions/testing.instructions.md
deleted file mode 100644
index b08d024..0000000
--- a/apps/basic/.github/instructions/testing.instructions.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-
-## applyTo: "tests/**/.ts,tests/**/_.tsx,src/mocks//_.ts,playwright.config.ts"
-
-description: "Use when adding or editing tests, Playwright cases, MSW handlers, mock data, or test configuration. Keywords: test, e2e, playwright, mock, msw, coverage."
-
-# Testing Instructions
-
-## Purpose
-
-Keep tests fast, deterministic, and aligned with core business flows.
-
-## Do
-
-- Prioritize core flows first (auth, users CRUD, permission gates).
-- Keep assertions user-visible and behavior-focused.
-- Reuse existing helper patterns in tests before adding new helpers.
-- Keep mock handlers and mock data synchronized with API schemas.
-- Prefer focused test runs over full-suite runs during iteration.
-
-## Do Not
-
-- Do not add brittle selectors tied to unstable DOM internals.
-- Do not expand fixture data without a clear scenario need.
-- Do not duplicate scenarios already covered by existing tests.
-
-## Validation
-
-- Run focused tests first, then broader checks if needed.
-- Run: `vp check --no-fmt`
diff --git a/apps/basic/AGENTS.md b/apps/basic/AGENTS.md
index 49ea51f..159fe07 100644
--- a/apps/basic/AGENTS.md
+++ b/apps/basic/AGENTS.md
@@ -1,84 +1,76 @@
-# Using Vite+, the Unified Toolchain for the Web
+# antd-admin-basic
 
-This project is using Vite+, a unified toolchain built on top of Vite, Rolldown, Vitest, tsdown, Oxlint, Oxfmt, and Vite Task. Vite+ wraps runtime management, package management, and frontend tooling in a single global CLI called `vp`. Vite+ is distinct from Vite, but it invokes Vite through `vp dev` and `vp build`.
+Vite+ template app (React 19, Ant Design 6, TanStack Router/Query, MSW). Default UI copy is English (no i18n). CLI details: [viteplus.dev](https://viteplus.dev).
 
-## Vite+ Workflow
+## Commands
 
-`vp` is a global binary that handles the full development lifecycle. Run `vp help` to print a list of commands and `vp <command> --help` for information about a specific command.
+Run from **this app root** (directory with `package.json` / `vite.config.ts`):
 
-### Start
+| Task                      | Command                                              |
+| ------------------------- | ---------------------------------------------------- |
+| Install deps              | `vp install` (after every pull)                      |
+| Dev / build / preview     | `vp dev`, `vp build`, `vp preview`                   |
+| Format / lint / typecheck | `vp check`, `vp check --no-fmt`, `vp lint`, `vp fmt` |
+| Unit tests                | `vp test run`                                        |
+| E2E                       | `pnpm run test:e2e` (or focused spec via Playwright) |
+| Add/remove deps           | `vp add`, `vp remove` — not raw `pnpm`/`npm`/`yarn`  |
 
-- create - Create a new project from a template
-- migrate - Migrate an existing project to Vite+
-- config - Configure hooks and agent integration
-- staged - Run linters on staged files
-- install (`i`) - Install dependencies
-- env - Manage Node.js versions
+**Pitfalls:** Do not install Vitest/Oxlint/Oxfmt/tsdown directly; use `vp`. Do not run `vp vitest` — use `vp test`. If a `package.json` script name conflicts with a built-in `vp` command, use `vp run <script>`. Import toolchain modules from `vite-plus` (e.g. `defineConfig`, test utils), not standalone `vite`/`vitest` packages.
 
-### Develop
+**Before finishing:** `vp check` and `vp test run`; run focused e2e when UI flows change.
 
-- dev - Run the development server
-- check - Run format, lint, and TypeScript type checks
-- lint - Lint code
-- fmt - Format code
-- test - Run tests
+---
 
-### Execute
+## Frontend
 
-- run - Run monorepo tasks
-- exec - Execute a command from local `node_modules/.bin`
-- dlx - Execute a package binary without installing it as a dependency
-- cache - Manage the task cache
+**Purpose:** Predictable, minimal UI changes under `src/`.
 
-### Build
+**Do:** Preserve route/UI contracts unless asked. Reuse components/hooks. Token-driven styles via theme/store. Ant Design styling order: component API → `theme.useToken()` + inline `style` → `className` + CSS. English plain string literals. Follow `src/components` and `src/routes` layout.
 
-- build - Build for production
-- pack - Build libraries
-- preview - Preview production build
+**Do not:** New UI libs when Ant Design suffices; bypass theme/store; CSS-first overrides when props/`styles` work; unrelated refactors in the same change.
 
-### Manage Dependencies
+**Validation:** `vp check --no-fmt`; focused e2e when flows change.
 
-Vite+ automatically detects and wraps the underlying package manager such as pnpm, npm, or Yarn through the `packageManager` field in `package.json` or package manager-specific lockfiles.
+---
 
-- add - Add packages to dependencies
-- remove (`rm`, `un`, `uninstall`) - Remove packages from dependencies
-- update (`up`) - Update packages to latest versions
-- dedupe - Deduplicate dependencies
-- outdated - Check for outdated packages
-- list (`ls`) - List installed packages
-- why (`explain`) - Show why a package is installed
-- info (`view`, `show`) - View package information from the registry
-- link (`ln`) / unlink - Manage local package links
-- pm - Forward a command to the package manager
+## API
 
-### Maintain
+**Purpose:** **schemas → `defineApi` modules → UI**; transport in `src/api/request.ts` only.
 
-- upgrade - Update `vp` itself to the latest version
+**Do:** Define APIs with `defineApi` in `src/api/<module>/index.ts` (`method` default `GET`; `params`/`query`/`body` + `output`). Zod in `src/api/<module>/schemas.ts`; shared helpers in `src/api/shared/`. MSW envelopes `{ code, data, message }` aligned with schemas. Co-locate query keys (e.g. `userQueryKeys`). `hydrateSession` from `@/api/auth` after login/register/session restore.
 
-These commands map to their corresponding tools. For example, `vp dev --port 3000` runs Vite's dev server and works the same as Vite. `vp test` runs JavaScript tests through the bundled Vitest. The version of all tools can be checked using `vp --version`. This is useful when researching documentation, features, and bugs.
+**Do not:** Call axios or `@/api/request` from routes/components — use resource functions (`listUsers`, …). Ad-hoc response shapes; skip schema parsing; mix unrelated domains in one module.
 
-## Common Pitfalls
+**Validation:** `vp check --no-fmt`.
 
-- **Using the package manager directly:** Do not use pnpm, npm, or Yarn directly. Vite+ can handle all package manager operations.
-- **Always use Vite commands to run tools:** Don't attempt to run `vp vitest` or `vp oxlint`. They do not exist. Use `vp test` and `vp lint` instead.
-- **Running scripts:** Vite+ commands take precedence over `package.json` scripts. If there is a `test` script defined in `scripts` that conflicts with the built-in `vp test` command, run it using `vp run test`.
-- **Do not install Vitest, Oxlint, Oxfmt, or tsdown directly:** Vite+ wraps these tools. They must not be installed directly. You cannot upgrade these tools by installing their latest versions. Always use Vite+ commands.
-- **Use Vite+ wrappers for one-off binaries:** Use `vp dlx` instead of package-manager-specific `dlx`/`npx` commands.
-- **Import JavaScript modules from `vite-plus`:** Instead of importing from `vite` or `vitest`, all modules should be imported from the project's `vite-plus` dependency. For example, `import { defineConfig } from 'vite-plus';` or `import { expect, test, vi } from 'vite-plus/test';`. You must not install `vitest` to import test utilities.
-- **Type-Aware Linting:** There is no need to install `oxlint-tsgolint`, `vp lint --type-aware` works out of the box.
+---
 
-## Review Checklist for Agents
+## Testing
 
-- Run `vp install` after pulling remote changes and before getting started.
-- Run `vp check` and `vp test` to validate changes.
+**Purpose:** Fast, deterministic tests for core flows (auth, users CRUD, permissions).
 
-## AI Instruction Files
+**Do:** User-visible assertions; reuse test helpers; keep mocks/schemas in sync; focused runs while iterating.
 
-This repository also uses scoped AI instruction files in `.github/instructions/`.
+**Do not:** Brittle DOM-internal selectors; bloated fixtures; duplicate scenarios.
 
-- `frontend.instructions.md` for UI/routes/components/style work
-- `testing.instructions.md` for Playwright/MSW/test updates
-- `api.instructions.md` for API/schema/handler changes
-- `refactor.instructions.md` for behavior-preserving cleanup
+**Validation:** Focused tests first; `vp check --no-fmt`.
 
-See `.github/instructions/README.md` for usage and authoring rules.
+---
+
+## Refactor
+
+**Purpose:** Less duplication, same behavior and public contracts.
+
+**Do:** One concern per change; extract shared utils/hooks/components; reviewable diffs; comments only when non-obvious.
+
+**Do not:** Behavior changes unless requested; broad renames; drop unique test coverage; heavy deps for tiny wins.
+
+**Considerations:** Main chunk ~135KB gzip ~41KB; vendor splits for antd/tanstack — avoid large extra UI libs. Validate at API boundaries (Zod), not app-wide runtime checks.
+
+**Validation:** `vp check --no-fmt`; significant changes → `vp build` and watch chunk sizes in log.
+
+---
+
+## Add CRUD resource
+
+Multi-step checklist (mirror **users**): use skill **`.agents/skills/add-resource/SKILL.md`** (invoke in Copilot/Codex/Claude or `@` that path in chat). After routes change, run `pnpm run build` to refresh `routeTree.gen.ts`.
diff --git a/apps/basic/README.md b/apps/basic/README.md
index acbe611..ceb548a 100644
--- a/apps/basic/README.md
+++ b/apps/basic/README.md
@@ -8,7 +8,7 @@
 
 <div align="center">
 
-English-only admin scaffold (no Lingui): MSW mocks, minimal RBAC, full CRUD, and Playwright E2E — built with React 19, Ant Design 6, and Vite+. For Lingui-based i18n (en + zh), use the sibling app [`apps/with-lingui`](../with-lingui/).
+Admin scaffold: MSW mocks, minimal RBAC, full CRUD, and Playwright E2E — built with React 19, Ant Design 6, and Vite+. AI-friendly with clear patterns, shared abstractions, **`AGENTS.md`** agent rules, and type-safe contracts at every boundary. Default UI language is English; for Lingui i18n (en + zh) out of the box, see [`apps/with-lingui`](../with-lingui/).
 
 [![antd](https://img.shields.io/badge/AntD-^6.0.0-1890ff?style=flat-square&logo=ant-design)](https://github.com/ant-design/ant-design)
 [![react](https://img.shields.io/badge/React-19.2-61dafb?style=flat-square&logo=react)](https://react.dev)
@@ -31,19 +31,20 @@ English-only admin scaffold (no Lingui): MSW mocks, minimal RBAC, full CRUD, and
 | Async State  | [TanStack Query v5](https://tanstack.com/query)                        |
 | Local State  | [Zustand](https://zustand.docs.pmnd.rs) (persisted auth & settings)    |
 | Validation   | [Zod v4](https://zod.dev) (schemas, API contracts, form validation)    |
-| UI language  | English strings in source (no i18n framework)                          |
+| UI copy      | Plain strings in source (default English); no bundled i18n stack       |
 | Icons        | [lucide-react](https://lucide.dev/guide/packages/lucide-react)         |
 | API Mocking  | [MSW 2.x](https://mswjs.io) (Service Worker based)                     |
 | E2E Testing  | [Playwright](https://playwright.dev)                                   |
-| Language     | TypeScript 5.9 (strict mode)                                           |
+| Language     | TypeScript (strict mode)                                               |
 
 ## Features
 
 - **JWT Authentication** — Login with access/refresh token flow, persisted via Zustand
 - **Dynamic Menu & RBAC** — Backend-driven sidebar menu with permission guards and 403 page
 - **URL-First State** — Table search params (page, pageSize, keyword, sort) synced to URL
-- **English-only** — No Lingui or locale catalogs; Ant Design uses a fixed `en_US` locale. See [`apps/with-lingui`](../with-lingui/) for bilingual LinguiJS.
+- **Default locale** — UI copy in plain strings (English by default); Ant Design `ConfigProvider` uses `en_US`.
 - **Dark Mode** — One-click toggle with Ant Design theme algorithm
+- **Modular API layer** — `defineApi` modules under `src/api/<domain>/`, shared Zod helpers, single `API_PREFIX`
 - **Full Type Safety** — Zod schemas validate API boundaries at runtime where used
 - **Zero-Config Mocking** — MSW intercepts API calls in development, no backend needed
 
@@ -96,15 +97,22 @@ pnpm run test:unit
 
 ```bash
 pnpm run test:e2e
-pnpm run test:e2e:core
+pnpm run test:e2e -- e2e/login.spec.ts e2e/users.spec.ts   # core flows only
 pnpm run test:e2e:ui   # interactive UI mode
 ```
 
 ## Project Structure
 
 ```text
+AGENTS.md                      # Agent rules (frontend/api/testing/refactor)
+.agents/skills/add-resource/   # CRUD scaffold checklist (Skill)
 src/
-├── api/                       # Zod models + endpoint contracts
+├── api/                       # HTTP + contracts (see “API layer” below)
+│   ├── request.ts             # axios, defineApi, token refresh, envelope unwrap
+│   ├── schemas.ts             # deprecated barrel; prefer @/api/shared and module schemas
+│   ├── shared/                # API_PREFIX, pagination, params, menu, envelope helpers
+│   ├── auth/                  # paths, schemas, login/register/hydrateSession
+│   └── users/                 # schemas, listUsers CRUD, userQueryKeys, path constants
 ├── components/                # Reusable UI primitives and layout shells
 │   ├── Layout/                # MainLayout, Header, Sidebar, UserMenu, AppFooter
 │   ├── DataTable/             # Shared table frame/skeleton/empty state
@@ -143,7 +151,7 @@ src/
 │   ├── 404/index.tsx
 │   └── index.tsx
 ├── stores/                    # Persisted auth/settings stores
-├── utils/                     # HTTP client, constants, session/menu helpers
+├── utils/                     # constants, app menu helpers
 ├── main.tsx                   # App bootstrap (MSW init + React render)
 └── routeTree.gen.ts           # Generated TanStack route tree
 
@@ -156,16 +164,32 @@ e2e/                           # Playwright E2E suites
 └── url-state.spec.ts
 ```
 
-## Language & i18n
+## API layer
 
-This template is **English-only**: user-facing copy lives in components and routes as plain strings; there is no Lingui catalog or language switcher.
+Data flow: **Zod schemas → `defineApi` in `src/api/<module>/index.ts` → routes/components call resource functions** (never axios or `@/api/request` directly).
 
-For **LinguiJS** (English + Chinese, `.po` extract/compile, and Ant Design locale switching), use [`apps/with-lingui`](../with-lingui/).
+| Piece             | Role                                                                                              |
+| ----------------- | ------------------------------------------------------------------------------------------------- |
+| `request.ts`      | Shared HTTP client, `{ code, data, message }` handling, 401 refresh                               |
+| `shared/`         | `API_PREFIX` (`/api`), pagination/query helpers, shared menu types                                |
+| `auth/`, `users/` | Domain schemas + `defineApi` exports; MSW handlers import the same path constants                 |
+| `schemas.ts`      | Compatibility re-exports; new code should import from `@/api/shared` and `@/api/<module>/schemas` |
+
+Change the REST prefix in one place: `src/api/shared/prefix.ts` (`API_PREFIX`).
+
+## Language
+
+User-facing copy lives in components and routes as plain strings. **Default language is English**; Ant Design is wired to `en_US` in `__root.tsx`. This template does not include a locale switcher or translation catalogs—you can add your own i18n library or start from the [`with-lingui`](../with-lingui/) template for LinguiJS (en + zh).
 
 ## Extending the template
 
+- **New CRUD resource:** Follow `.agents/skills/add-resource/SKILL.md` (mirror `users`), then `vp check --no-fmt`.
 - **Real backend:** Point `VITE_API_BASE_URL` in env and disable or remove MSW in `main.tsx` when you no longer need mocks.
-- **Add i18n:** Start from [`apps/with-lingui`](../with-lingui/) or port Lingui setup from that app; this `basic` tree intentionally omits it.
+- **Add i18n:** Integrate your preferred stack, or copy patterns from [`apps/with-lingui`](../with-lingui/).
+
+### AI guidance
+
+**Single source of truth:** **`AGENTS.md`** in this app. New CRUD flows: `@.agents/skills/add-resource/SKILL.md`.
 
 ## Developer Notes
 
diff --git a/apps/basic/package.json b/apps/basic/package.json
index f0edb02..2053696 100644
--- a/apps/basic/package.json
+++ b/apps/basic/package.json
@@ -19,6 +19,7 @@
     "@tanstack/react-query": "^5.104.3",
     "@tanstack/react-router": "^1.170.45",
     "antd": "^6.6.6",
+    "axios": "^1.20.0",
     "lucide-react": "^1.59.0",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
diff --git a/apps/basic/public/mockServiceWorker.js b/apps/basic/public/mockServiceWorker.js
index 0c970ef..04919bb 100644
--- a/apps/basic/public/mockServiceWorker.js
+++ b/apps/basic/public/mockServiceWorker.js
@@ -7,114 +7,111 @@
  * - Please do NOT modify this file.
  */
 
-const PACKAGE_VERSION = '2.15.0'
-const INTEGRITY_CHECKSUM = '03cb67ac84128e63d7cd722a6e5b7f1e'
-const IS_MOCKED_RESPONSE = Symbol('isMockedResponse')
-const activeClientIds = new Set()
+const PACKAGE_VERSION = "2.15.0";
+const INTEGRITY_CHECKSUM = "03cb67ac84128e63d7cd722a6e5b7f1e";
+const IS_MOCKED_RESPONSE = Symbol("isMockedResponse");
+const activeClientIds = new Set();
 
-addEventListener('install', function () {
-  self.skipWaiting()
-})
+addEventListener("install", function () {
+  self.skipWaiting();
+});
 
-addEventListener('activate', function (event) {
-  event.waitUntil(self.clients.claim())
-})
+addEventListener("activate", function (event) {
+  event.waitUntil(self.clients.claim());
+});
 
-addEventListener('message', async function (event) {
-  const clientId = Reflect.get(event.source || {}, 'id')
+addEventListener("message", async function (event) {
+  const clientId = Reflect.get(event.source || {}, "id");
 
   if (!clientId || !self.clients) {
-    return
+    return;
   }
 
-  const client = await self.clients.get(clientId)
+  const client = await self.clients.get(clientId);
 
   if (!client) {
-    return
+    return;
   }
 
   const allClients = await self.clients.matchAll({
-    type: 'window',
-  })
+    type: "window",
+  });
 
   switch (event.data) {
-    case 'KEEPALIVE_REQUEST': {
+    case "KEEPALIVE_REQUEST": {
       sendToClient(client, {
-        type: 'KEEPALIVE_RESPONSE',
-      })
-      break
+        type: "KEEPALIVE_RESPONSE",
+      });
+      break;
     }
 
-    case 'INTEGRITY_CHECK_REQUEST': {
+    case "INTEGRITY_CHECK_REQUEST": {
       sendToClient(client, {
-        type: 'INTEGRITY_CHECK_RESPONSE',
+        type: "INTEGRITY_CHECK_RESPONSE",
         payload: {
           packageVersion: PACKAGE_VERSION,
           checksum: INTEGRITY_CHECKSUM,
         },
-      })
-      break
+      });
+      break;
     }
 
-    case 'MOCK_ACTIVATE': {
-      activeClientIds.add(clientId)
+    case "MOCK_ACTIVATE": {
+      activeClientIds.add(clientId);
 
       sendToClient(client, {
-        type: 'MOCKING_ENABLED',
+        type: "MOCKING_ENABLED",
         payload: {
           client: {
             id: client.id,
             frameType: client.frameType,
           },
         },
-      })
-      break
+      });
+      break;
     }
 
-    case 'CLIENT_CLOSED': {
-      activeClientIds.delete(clientId)
+    case "CLIENT_CLOSED": {
+      activeClientIds.delete(clientId);
 
       const remainingClients = allClients.filter((client) => {
-        return client.id !== clientId
-      })
+        return client.id !== clientId;
+      });
 
       // Unregister itself when there are no more clients
       if (remainingClients.length === 0) {
-        self.registration.unregister()
+        self.registration.unregister();
       }
 
-      break
+      break;
     }
   }
-})
+});
 
-addEventListener('fetch', function (event) {
-  const requestInterceptedAt = Date.now()
+addEventListener("fetch", function (event) {
+  const requestInterceptedAt = Date.now();
 
   // Bypass navigation requests.
-  if (event.request.mode === 'navigate') {
-    return
+  if (event.request.mode === "navigate") {
+    return;
   }
 
   // Opening the DevTools triggers the "only-if-cached" request
   // that cannot be handled by the worker. Bypass such requests.
-  if (
-    event.request.cache === 'only-if-cached' &&
-    event.request.mode !== 'same-origin'
-  ) {
-    return
+  if (event.request.cache === "only-if-cached" && event.request.mode !== "same-origin") {
+    return;
   }
 
   // Bypass all requests when there are no active clients.
   // Prevents the self-unregistered worked from handling requests
   // after it's been terminated (still remains active until the next reload).
   if (activeClientIds.size === 0) {
-    return
+    return;
   }
 
-  const requestId = crypto.randomUUID()
-  event.respondWith(handleRequest(event, requestId, requestInterceptedAt))
-})
+  const requestId = crypto.randomUUID();
+  event.respondWith(handleRequest(event, requestId, requestInterceptedAt));
+});
 
 /**
  * @param {FetchEvent} event
@@ -122,20 +119,15 @@ addEventListener('fetch', function (event) {
  * @param {number} requestInterceptedAt
  */
 async function handleRequest(event, requestId, requestInterceptedAt) {
-  const client = await resolveMainClient(event)
-  const requestCloneForEvents = event.request.clone()
-  const response = await getResponse(
-    event,
-    client,
-    requestId,
-    requestInterceptedAt,
-  )
+  const client = await resolveMainClient(event);
+  const requestCloneForEvents = event.request.clone();
+  const response = await getResponse(event, client, requestId, requestInterceptedAt);
 
   // Send back the response clone for the "response:*" life-cycle events.
   // Ensure MSW is active and ready to handle the message, otherwise
   // this message will pend indefinitely.
   if (client && activeClientIds.has(client.id)) {
-    const serializedRequest = await serializeRequest(requestCloneForEvents)
+    const serializedRequest = await serializeRequest(requestCloneForEvents);
 
     // Omit the body of server-sent event stream responses.
     // Cloning such responses would prevent client-side stream cancelations
@@ -143,17 +135,17 @@ async function handleRequest(event, requestId, requestInterceptedAt) {
     // source once both of its branches cancel) and would buffer the
     // entire stream into the unconsumed clone indefinitely.
     const isEventStreamResponse = response.headers
-      .get('content-type')
+      .get("content-type")
       ?.toLowerCase()
-      .startsWith('text/event-stream')
+      .startsWith("text/event-stream");
 
     // Clone the response so both the client and the library could consume it.
-    const responseClone = isEventStreamResponse ? null : response.clone()
+    const responseClone = isEventStreamResponse ? null : response.clone();
 
     sendToClient(
       client,
       {
-        type: 'RESPONSE',
+        type: "RESPONSE",
         payload: {
           isMockedResponse: IS_MOCKED_RESPONSE in response,
           request: {
@@ -169,13 +161,11 @@ async function handleRequest(event, requestId, requestInterceptedAt) {
           },
         },
       },
-      responseClone && responseClone.body
-        ? [serializedRequest.body, responseClone.body]
-        : [],
-    )
+      responseClone && responseClone.body ? [serializedRequest.body, responseClone.body] : [],
+    );
   }
 
-  return response
+  return response;
 }
 
 /**
@@ -187,30 +177,30 @@ async function handleRequest(event, requestId, requestInterceptedAt) {
  * @returns {Promise<Client | undefined>}
  */
 async function resolveMainClient(event) {
-  const client = await self.clients.get(event.clientId)
+  const client = await self.clients.get(event.clientId);
 
   if (activeClientIds.has(event.clientId)) {
-    return client
+    return client;
   }
 
-  if (client?.frameType === 'top-level') {
-    return client
+  if (client?.frameType === "top-level") {
+    return client;
   }
 
   const allClients = await self.clients.matchAll({
-    type: 'window',
-  })
+    type: "window",
+  });
 
   return allClients
     .filter((client) => {
       // Get only those clients that are currently visible.
-      return client.visibilityState === 'visible'
+      return client.visibilityState === "visible";
     })
     .find((client) => {
       // Find the client ID that's recorded in the
       // set of clients that have registered the worker.
-      return activeClientIds.has(client.id)
-    })
+      return activeClientIds.has(client.id);
+    });
 }
 
 /**
@@ -223,36 +213,34 @@ async function resolveMainClient(event) {
 async function getResponse(event, client, requestId, requestInterceptedAt) {
   // Clone the request because it might've been already used
   // (i.e. its body has been read and sent to the client).
-  const requestClone = event.request.clone()
+  const requestClone = event.request.clone();
 
   function passthrough() {
     // Cast the request headers to a new Headers instance
     // so the headers can be manipulated with.
-    const headers = new Headers(requestClone.headers)
+    const headers = new Headers(requestClone.headers);
 
     // Remove the "accept" header value that marked this request as passthrough.
     // This prevents request alteration and also keeps it compliant with the
     // user-defined CORS policies.
-    const acceptHeader = headers.get('accept')
+    const acceptHeader = headers.get("accept");
     if (acceptHeader) {
-      const values = acceptHeader.split(',').map((value) => value.trim())
-      const filteredValues = values.filter(
-        (value) => value !== 'msw/passthrough',
-      )
+      const values = acceptHeader.split(",").map((value) => value.trim());
+      const filteredValues = values.filter((value) => value !== "msw/passthrough");
 
       if (filteredValues.length > 0) {
-        headers.set('accept', filteredValues.join(', '))
+        headers.set("accept", filteredValues.join(", "));
       } else {
-        headers.delete('accept')
+        headers.delete("accept");
       }
     }
 
-    return fetch(requestClone, { headers })
+    return fetch(requestClone, { headers });
   }
 
   // Bypass mocking when the client is not active.
   if (!client) {
-    return passthrough()
+    return passthrough();
   }
 
   // Bypass initial page load requests (i.e. static assets).
@@ -260,15 +248,15 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
   // means that MSW hasn't dispatched the "MOCK_ACTIVATE" event yet
   // and is not ready to handle requests.
   if (!activeClientIds.has(client.id)) {
-    return passthrough()
+    return passthrough();
   }
 
   // Notify the client that a request has been intercepted.
-  const serializedRequest = await serializeRequest(event.request)
+  const serializedRequest = await serializeRequest(event.request);
   const clientMessage = await sendToClient(
     client,
     {
-      type: 'REQUEST',
+      type: "REQUEST",
       payload: {
         id: requestId,
         interceptedAt: requestInterceptedAt,
@@ -276,19 +264,19 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
       },
     },
     [serializedRequest.body],
-  )
+  );
 
   switch (clientMessage.type) {
-    case 'MOCK_RESPONSE': {
-      return respondWithMock(clientMessage.data)
+    case "MOCK_RESPONSE": {
+      return respondWithMock(clientMessage.data);
     }
 
-    case 'PASSTHROUGH': {
-      return passthrough()
+    case "PASSTHROUGH": {
+      return passthrough();
     }
   }
 
-  return passthrough()
+  return passthrough();
 }
 
 /**
@@ -299,21 +287,18 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
  */
 function sendToClient(client, message, transferrables = []) {
   return new Promise((resolve, reject) => {
-    const channel = new MessageChannel()
+    const channel = new MessageChannel();
 
     channel.port1.onmessage = (event) => {
       if (event.data && event.data.error) {
-        return reject(event.data.error)
+        return reject(event.data.error);
       }
 
-      resolve(event.data)
-    }
+      resolve(event.data);
+    };
 
-    client.postMessage(message, [
-      channel.port2,
-      ...transferrables.filter(Boolean),
-    ])
-  })
+    client.postMessage(message, [channel.port2, ...transferrables.filter(Boolean)]);
+  });
 }
 
 /**
@@ -326,17 +311,17 @@ function respondWithMock(response) {
   // instance will have status code set to 0. Since it's not possible to create
   // a Response instance with status code 0, handle that use-case separately.
   if (response.status === 0) {
-    return Response.error()
+    return Response.error();
   }
 
-  const mockedResponse = new Response(response.body, response)
+  const mockedResponse = new Response(response.body, response);
 
   Reflect.defineProperty(mockedResponse, IS_MOCKED_RESPONSE, {
     value: true,
     enumerable: true,
-  })
+  });
 
-  return mockedResponse
+  return mockedResponse;
 }
 
 /**
@@ -357,5 +342,5 @@ async function serializeRequest(request) {
     referrerPolicy: request.referrerPolicy,
     body: await request.arrayBuffer(),
     keepalive: request.keepalive,
-  }
+  };
 }
diff --git a/apps/basic/src/api/auth.ts b/apps/basic/src/api/auth.ts
deleted file mode 100644
index 2d4314e..0000000
--- a/apps/basic/src/api/auth.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import type {
-  AuthTokens,
-  LoginRequest,
-  User,
-  MenuItem,
-  PermissionsList,
-  RegisterRequest,
-} from "./schemas";
-
-export const AUTH_ENDPOINTS = {
-  login: "/api/auth/login",
-  register: "/api/auth/register",
-  refresh: "/api/auth/refresh",
-  logout: "/api/auth/logout",
-  user: "/api/auth/user",
-  permissions: "/api/auth/permissions",
-} as const;
-
-export type { AuthTokens, LoginRequest, User, MenuItem, PermissionsList, RegisterRequest };
diff --git a/apps/basic/src/api/auth/index.ts b/apps/basic/src/api/auth/index.ts
new file mode 100644
index 0000000..435bd78
--- /dev/null
+++ b/apps/basic/src/api/auth/index.ts
@@ -0,0 +1,63 @@
+import { z } from "zod/v4";
+import { defineApi } from "@/api/request";
+import {
+  AuthTokensSchema,
+  AuthUserResponseSchema,
+  LoginRequestSchema,
+  PermissionsListSchema,
+  RegisterRequestSchema,
+} from "@/api/auth/schemas";
+import type {
+  AuthTokens,
+  LoginRequest,
+  PermissionsList,
+  RegisterRequest,
+} from "@/api/auth/schemas";
+import { UserSchema, type User } from "@/api/users/schemas";
+import { AUTH_ENDPOINTS } from "@/api/auth/paths";
+import { APP_MENU_TREE, filterMenuTreeByPermissions } from "@/utils/appMenu";
+import { useAuthStore } from "@/stores/auth";
+
+export { AUTH_ENDPOINTS } from "@/api/auth/paths";
+
+export const login = defineApi({
+  method: "POST",
+  path: AUTH_ENDPOINTS.login,
+  body: LoginRequestSchema,
+  output: AuthTokensSchema,
+});
+
+export const register = defineApi({
+  method: "POST",
+  path: AUTH_ENDPOINTS.register,
+  body: RegisterRequestSchema,
+  output: AuthTokensSchema,
+});
+
+export const logout = defineApi({
+  method: "POST",
+  path: AUTH_ENDPOINTS.logout,
+  output: z.null(),
+});
+
+export const getAuthUser = defineApi({
+  path: AUTH_ENDPOINTS.user,
+  output: AuthUserResponseSchema,
+});
+
+export const getPermissions = defineApi({
+  path: AUTH_ENDPOINTS.permissions,
+  output: PermissionsListSchema,
+});
+
+/** Fetches user + permissions, then updates auth store `user` and sidebar `menus`. */
+export async function hydrateSession(): Promise<void> {
+  const [userBase, permissions] = await Promise.all([getAuthUser(), getPermissions()]);
+  const user = UserSchema.parse({ ...userBase, permissions });
+  const menus = filterMenuTreeByPermissions(APP_MENU_TREE, permissions);
+  const { setUser, setMenus } = useAuthStore.getState();
+  setUser(user);
+  setMenus(menus);
+}
+
+export type { AuthTokens, LoginRequest, User, PermissionsList, RegisterRequest };
diff --git a/apps/basic/src/api/auth/paths.ts b/apps/basic/src/api/auth/paths.ts
new file mode 100644
index 0000000..4891120
--- /dev/null
+++ b/apps/basic/src/api/auth/paths.ts
@@ -0,0 +1,12 @@
+import { API_PREFIX } from "@/api/shared/prefix";
+
+const AUTH_BASE = `${API_PREFIX}/auth`;
+
+export const AUTH_ENDPOINTS = {
+  login: `${AUTH_BASE}/login`,
+  register: `${AUTH_BASE}/register`,
+  refresh: `${AUTH_BASE}/refresh`,
+  logout: `${AUTH_BASE}/logout`,
+  user: `${AUTH_BASE}/user`,
+  permissions: `${AUTH_BASE}/permissions`,
+} as const;
diff --git a/apps/basic/src/api/auth/schemas.ts b/apps/basic/src/api/auth/schemas.ts
new file mode 100644
index 0000000..9b22c4e
--- /dev/null
+++ b/apps/basic/src/api/auth/schemas.ts
@@ -0,0 +1,48 @@
+import { z } from "zod/v4";
+import { UserSchema } from "@/api/users/schemas";
+
+/** GET `/api/auth/user` body (no `permissions`; load via `/api/auth/permissions`). */
+export const AuthUserResponseSchema = UserSchema.omit({ permissions: true });
+export type AuthUserResponse = z.infer<typeof AuthUserResponseSchema>;
+
+export const AuthTokensSchema = z.object({
+  accessToken: z.string().min(1),
+  refreshToken: z.string().min(1),
+});
+
+export type AuthTokens = z.infer<typeof AuthTokensSchema>;
+
+export const RefreshTokenRequestSchema = z.object({
+  refreshToken: z.string().min(1),
+});
+
+export type RefreshTokenRequest = z.infer<typeof RefreshTokenRequestSchema>;
+
+export const LoginRequestSchema = z.object({
+  username: z.string().min(1),
+  password: z.string().min(1),
+});
+
+export type LoginRequest = z.infer<typeof LoginRequestSchema>;
+
+/** Ant Design Form may submit `""` for an empty optional email */
+const registerOptionalEmailSchema = z
+  .union([z.string(), z.undefined()])
+  .transform((v) => {
+    if (v === undefined) return undefined;
+    const t = String(v).trim();
+    return t === "" ? undefined : t;
+  })
+  .pipe(z.union([z.string().email(), z.undefined()]));
+
+export const RegisterRequestSchema = z.object({
+  username: z.string().min(1),
+  password: z.string().min(6),
+  email: registerOptionalEmailSchema,
+});
+
+export type RegisterRequest = z.infer<typeof RegisterRequestSchema>;
+
+export const PermissionsListSchema = z.array(z.string());
+
+export type PermissionsList = z.infer<typeof PermissionsListSchema>;
diff --git a/apps/basic/src/api/request.ts b/apps/basic/src/api/request.ts
new file mode 100644
index 0000000..0a9ab36
--- /dev/null
+++ b/apps/basic/src/api/request.ts
@@ -0,0 +1,302 @@
+import axios, { type AxiosError, type InternalAxiosRequestConfig } from "axios";
+import { z } from "zod/v4";
+import { API_BASE_URL } from "@/utils/constants";
+import { AuthTokensSchema, RefreshTokenRequestSchema } from "@/api/auth/schemas";
+import { getAccessToken, useAuthStore } from "@/stores/auth";
+
+import { AUTH_ENDPOINTS } from "@/api/auth/paths";
+
+/** Avoid importing `@/api/auth` index here (circular with `defineApi` consumers). */
+const REFRESH_PATH = AUTH_ENDPOINTS.refresh;
+
+export class ApiError extends Error {
+  code: number;
+  constructor(code: number, message: string) {
+    super(message);
+    this.name = "ApiError";
+    this.code = code;
+  }
+}
+
+export class HttpError extends Error {
+  status: number;
+  constructor(status: number, message: string) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+  }
+}
+
+type HttpRouter = {
+  navigate: (opts: { to: string }) => void | Promise<void>;
+};
+
+let httpRouter: HttpRouter | null = null;
+
+export function installHttpRouter(router: HttpRouter): void {
+  httpRouter = router;
+}
+
+function navigateTo403(): void {
+  void httpRouter?.navigate({ to: "/403" });
+}
+
+function navigateToLogin(): void {
+  void httpRouter?.navigate({ to: "/login" });
+}
+
+type RequestConfig = InternalAxiosRequestConfig & {
+  skipAuthRefresh?: boolean;
+  _retry?: boolean;
+};
+
+export type CallOptions = {
+  signal?: AbortSignal;
+};
+
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+
+type Envelope = {
+  code?: number;
+  data?: unknown;
+  message?: string;
+};
+
+function cleanParams(params?: Record<string, unknown>): Record<string, unknown> | undefined {
+  if (!params) return undefined;
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(params)) {
+    if (value != null) out[key] = value;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
+function unwrapEnvelope(json: unknown): unknown {
+  if (json == null || typeof json !== "object") return json;
+  const envelope = json as Envelope;
+  if (envelope.code !== undefined && envelope.code !== 0) {
+    throw new ApiError(envelope.code, envelope.message ?? "Unknown error");
+  }
+  if (envelope.code !== undefined && envelope.data !== undefined) {
+    return envelope.data;
+  }
+  return json;
+}
+
+const client = axios.create({
+  baseURL: API_BASE_URL,
+  timeout: 15_000,
+  headers: { "Content-Type": "application/json" },
+});
+
+client.interceptors.request.use((config) => {
+  const token = getAccessToken();
+  if (token) {
+    config.headers.Authorization = `Bearer ${token}`;
+  }
+  return config;
+});
+
+let inflightRefresh: Promise<boolean> | null = null;
+
+async function doRefreshSessionTokens(): Promise<boolean> {
+  const { tokens, setTokens, logout } = useAuthStore.getState();
+  const refreshToken = tokens?.refreshToken;
+  if (!refreshToken) {
+    logout();
+    navigateToLogin();
+    return false;
+  }
+
+  const body = RefreshTokenRequestSchema.parse({ refreshToken });
+
+  try {
+    const res = await client.post(REFRESH_PATH, body, {
+      skipAuthRefresh: true,
+    } as RequestConfig);
+    const next = AuthTokensSchema.parse(res.data);
+    setTokens(next);
+    return true;
+  } catch {
+    logout();
+    navigateToLogin();
+    return false;
+  }
+}
+
+async function refreshSessionTokens(): Promise<boolean> {
+  if (inflightRefresh) return inflightRefresh;
+  inflightRefresh = doRefreshSessionTokens().finally(() => {
+    inflightRefresh = null;
+  });
+  return inflightRefresh;
+}
+
+client.interceptors.response.use(
+  (response) => {
+    response.data = unwrapEnvelope(response.data);
+    return response;
+  },
+  async (error: AxiosError) => {
+    const status = error.response?.status;
+    const config = error.config as RequestConfig | undefined;
+
+    if (
+      status === 401 &&
+      config &&
+      !config._retry &&
+      !config.skipAuthRefresh &&
+      config.url !== REFRESH_PATH &&
+      !config.url?.endsWith(REFRESH_PATH)
+    ) {
+      config._retry = true;
+      const refreshed = await refreshSessionTokens();
+      if (refreshed) {
+        return client.request(config);
+      }
+      throw new HttpError(401, "Unauthorized");
+    }
+
+    if (status === 403) {
+      navigateTo403();
+      throw new HttpError(403, "Forbidden");
+    }
+
+    if (status != null) {
+      throw new HttpError(status, `HTTP ${status}: ${error.response?.statusText ?? "Error"}`);
+    }
+
+    throw error;
+  },
+);
+
+async function transportRequest<T>(opts: {
+  method: HttpMethod;
+  url: string;
+  params?: Record<string, unknown>;
+  body?: unknown;
+  signal?: AbortSignal;
+  skipAuthRefresh?: boolean;
+}): Promise<T> {
+  const res = await client.request<T>({
+    method: opts.method,
+    url: opts.url,
+    params: cleanParams(opts.params),
+    data: opts.body,
+    signal: opts.signal,
+    skipAuthRefresh: opts.skipAuthRefresh,
+  } as RequestConfig);
+  return res.data;
+}
+
+type ApiDefConfig<
+  TParams extends z.ZodType | undefined,
+  TQuery extends z.ZodType | undefined,
+  TBody extends z.ZodType | undefined,
+  TOut extends z.ZodType,
+> = {
+  method?: HttpMethod;
+  path: string;
+  params?: TParams;
+  query?: TQuery;
+  body?: TBody;
+  output: TOut;
+};
+
+type CallArgs<
+  TParams extends z.ZodType | undefined,
+  TQuery extends z.ZodType | undefined,
+  TBody extends z.ZodType | undefined,
+> = TParams extends z.ZodType
+  ? TQuery extends z.ZodType
+    ? TBody extends z.ZodType
+      ? { params: z.infer<TParams>; query: z.infer<TQuery>; body: z.infer<TBody> }
+      : { params: z.infer<TParams>; query: z.infer<TQuery> }
+    : TBody extends z.ZodType
+      ? { params: z.infer<TParams>; body: z.infer<TBody> }
+      : z.infer<TParams>
+  : TQuery extends z.ZodType
+    ? TBody extends z.ZodType
+      ? { query: z.infer<TQuery>; body: z.infer<TBody> }
+      : z.infer<TQuery>
+    : TBody extends z.ZodType
+      ? z.infer<TBody>
+      : void;
+
+function renderPath(path: string, params?: Record<string, unknown>): string {
+  if (!params) return path;
+  let url = path;
+  for (const [key, value] of Object.entries(params)) {
+    url = url.replace(`:${key}`, encodeURIComponent(String(value)));
+  }
+  return url;
+}
+
+export function defineApi<
+  TParams extends z.ZodType | undefined = undefined,
+  TQuery extends z.ZodType | undefined = undefined,
+  TBody extends z.ZodType | undefined = undefined,
+  TOut extends z.ZodType = z.ZodType,
+>(
+  def: ApiDefConfig<TParams, TQuery, TBody, TOut>,
+): (
+  ...args: CallArgs<TParams, TQuery, TBody> extends void
+    ? [options?: CallOptions]
+    : [args: CallArgs<TParams, TQuery, TBody>, options?: CallOptions]
+) => Promise<z.infer<TOut>> {
+  const method: HttpMethod = def.method ?? "GET";
+  const segmentCount = (def.params ? 1 : 0) + (def.query ? 1 : 0) + (def.body ? 1 : 0);
+
+  return async (...allArgs: unknown[]): Promise<z.infer<TOut>> => {
+    let callArgs: unknown;
+    let options: CallOptions | undefined;
+
+    if (segmentCount === 0) {
+      options = allArgs[0] as CallOptions | undefined;
+    } else {
+      callArgs = allArgs[0];
+      options = allArgs[1] as CallOptions | undefined;
+    }
+
+    let params: Record<string, unknown> | undefined;
+    let query: Record<string, unknown> | undefined;
+    let body: unknown;
+
+    if (segmentCount === 0) {
+      // no input segments
+    } else if (segmentCount === 1) {
+      if (def.params) {
+        params = def.params.parse(callArgs) as Record<string, unknown>;
+      } else if (def.query) {
+        query = def.query.parse(callArgs) as Record<string, unknown>;
+      } else if (def.body) {
+        body = def.body.parse(callArgs);
+      }
+    } else {
+      const shaped = (callArgs ?? {}) as {
+        params?: unknown;
+        query?: unknown;
+        body?: unknown;
+      };
+      if (def.params) {
+        params = def.params.parse(shaped.params) as Record<string, unknown>;
+      }
+      if (def.query) {
+        query = def.query.parse(shaped.query) as Record<string, unknown>;
+      }
+      if (def.body) {
+        body = def.body.parse(shaped.body);
+      }
+    }
+
+    const data = await transportRequest<unknown>({
+      method,
+      url: renderPath(def.path, params),
+      params: query,
+      body: def.body ? body : undefined,
+      signal: options?.signal,
+    });
+
+    return def.output.parse(data) as z.infer<TOut>;
+  };
+}
diff --git a/apps/basic/src/api/schemas.ts b/apps/basic/src/api/schemas.ts
index 429abac..9544b0a 100644
--- a/apps/basic/src/api/schemas.ts
+++ b/apps/basic/src/api/schemas.ts
@@ -1,155 +1,4 @@
-import { z } from "zod/v4";
-
-export const UserSchema = z.object({
-  id: z.string(),
-  username: z.string(),
-  avatar: z.string().nullable(),
-  email: z.string().nullable(),
-  roles: z.array(z.string()),
-  permissions: z.array(z.string()),
-});
-
-export type User = z.infer<typeof UserSchema>;
-
-/** GET `/api/auth/user` body (no `permissions`; load via `/api/auth/permissions`). */
-export const AuthUserResponseSchema = UserSchema.omit({ permissions: true });
-export type AuthUserResponse = z.infer<typeof AuthUserResponseSchema>;
-
-export const AuthTokensSchema = z.object({
-  accessToken: z.string().min(1),
-  refreshToken: z.string().min(1),
-});
-
-export type AuthTokens = z.infer<typeof AuthTokensSchema>;
-
-export const RefreshTokenRequestSchema = z.object({
-  refreshToken: z.string().min(1),
-});
-
-export type RefreshTokenRequest = z.infer<typeof RefreshTokenRequestSchema>;
-
-export const LoginRequestSchema = z.object({
-  username: z.string().min(1),
-  password: z.string().min(1),
-});
-
-export type LoginRequest = z.infer<typeof LoginRequestSchema>;
-
-/** Ant Design Form may submit `""` for an empty optional email */
-const registerOptionalEmailSchema = z
-  .union([z.string(), z.undefined()])
-  .transform((v) => {
-    if (v === undefined) return undefined;
-    const t = String(v).trim();
-    return t === "" ? undefined : t;
-  })
-  .pipe(z.union([z.string().email(), z.undefined()]));
-
-export const RegisterRequestSchema = z.object({
-  username: z.string().min(1),
-  password: z.string().min(6),
-  email: registerOptionalEmailSchema,
-});
-
-export type RegisterRequest = z.infer<typeof RegisterRequestSchema>;
-
-export const PermissionsListSchema = z.array(z.string());
-
-export type PermissionsList = z.infer<typeof PermissionsListSchema>;
-
-const BaseMenuNodeSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  icon: z.string().nullable(),
-  permissions: z.array(z.string()).nullable(),
-  sort: z.int(),
-  hidden: z.boolean(),
-});
-
-export type MenuItem =
-  | (z.infer<typeof BaseMenuNodeSchema> & {
-      kind: "item";
-      path: string;
-      children: MenuItem[] | null;
-    })
-  | (z.infer<typeof BaseMenuNodeSchema> & {
-      kind: "group";
-      path: null;
-      children: MenuItem[];
-    });
-
-export const MenuItemSchema: z.ZodType<MenuItem> = z.lazy(() =>
-  z.discriminatedUnion("kind", [
-    BaseMenuNodeSchema.extend({
-      kind: z.literal("item"),
-      path: z.string(),
-      children: z.array(MenuItemSchema).nullable(),
-    }),
-    BaseMenuNodeSchema.extend({
-      kind: z.literal("group"),
-      path: z.null(),
-      children: z.array(MenuItemSchema),
-    }),
-  ]),
-);
-
-export function ApiResponseSchema<T extends z.ZodTypeAny>(dataSchema: T) {
-  return z.object({
-    code: z.int(),
-    data: dataSchema,
-    message: z.string(),
-  });
-}
-
-export type ApiResponse<T> = {
-  code: number;
-  data: T;
-  message: string;
-};
-
-export function PaginatedResponseSchema<T extends z.ZodTypeAny>(itemSchema: T) {
-  return z.object({
-    code: z.int(),
-    data: z.object({
-      list: z.array(itemSchema),
-      total: z.int(),
-    }),
-    message: z.string(),
-  });
-}
-
-export type PaginatedData<T> = {
-  list: T[];
-  total: number;
-};
-
-export const SearchParamsSchema = z.object({
-  page: z.number().int().positive().catch(1),
-  pageSize: z.number().int().positive().catch(10),
-  sortField: z.string().nullable().catch(null),
-  sortOrder: z.enum(["ascend", "descend"]).nullable().catch(null),
-});
-
-export type SearchParams = z.infer<typeof SearchParamsSchema>;
-
-/** Ant Design Input submits `""` when empty; treat as null for optional email */
-const createUserEmailSchema = z
-  .union([z.string(), z.null(), z.undefined()])
-  .transform((v) => {
-    if (v == null) return null;
-    const t = String(v).trim();
-    return t === "" ? null : t;
-  })
-  .pipe(z.union([z.string().email(), z.null()]));
-
-export const CreateUserRequestSchema = z.object({
-  username: z.string().min(1),
-  email: createUserEmailSchema,
-  roles: z.array(z.string()).min(1),
-});
-
-export type CreateUserRequest = z.infer<typeof CreateUserRequestSchema>;
-
-export const UpdateUserRequestSchema = CreateUserRequestSchema.partial();
-
-export type UpdateUserRequest = z.infer<typeof UpdateUserRequestSchema>;
+/** @deprecated Import from `@/api/<module>/schemas` or `@/api/shared`; re-exports for compatibility. */
+export * from "@/api/shared";
+export * from "@/api/users/schemas";
+export * from "@/api/auth/schemas";
diff --git a/apps/basic/src/api/shared/envelope.ts b/apps/basic/src/api/shared/envelope.ts
new file mode 100644
index 0000000..7d855e7
--- /dev/null
+++ b/apps/basic/src/api/shared/envelope.ts
@@ -0,0 +1,26 @@
+import { z } from "zod/v4";
+
+export function ApiResponseSchema<T extends z.ZodTypeAny>(dataSchema: T) {
+  return z.object({
+    code: z.int(),
+    data: dataSchema,
+    message: z.string(),
+  });
+}
+
+export type ApiResponse<T> = {
+  code: number;
+  data: T;
+  message: string;
+};
+
+export function PaginatedResponseSchema<T extends z.ZodTypeAny>(itemSchema: T) {
+  return z.object({
+    code: z.int(),
+    data: z.object({
+      list: z.array(itemSchema),
+      total: z.int(),
+    }),
+    message: z.string(),
+  });
+}
diff --git a/apps/basic/src/api/shared/index.ts b/apps/basic/src/api/shared/index.ts
new file mode 100644
index 0000000..3a98f45
--- /dev/null
+++ b/apps/basic/src/api/shared/index.ts
@@ -0,0 +1,5 @@
+export * from "./envelope";
+export * from "./menu";
+export * from "./pagination";
+export * from "./params";
+export * from "./prefix";
diff --git a/apps/basic/src/api/shared/menu.ts b/apps/basic/src/api/shared/menu.ts
new file mode 100644
index 0000000..2488dfe
--- /dev/null
+++ b/apps/basic/src/api/shared/menu.ts
@@ -0,0 +1,37 @@
+import { z } from "zod/v4";
+
+const BaseMenuNodeSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  icon: z.string().nullable(),
+  permissions: z.array(z.string()).nullable(),
+  sort: z.int(),
+  hidden: z.boolean(),
+});
+
+export type MenuItem =
+  | (z.infer<typeof BaseMenuNodeSchema> & {
+      kind: "item";
+      path: string;
+      children: MenuItem[] | null;
+    })
+  | (z.infer<typeof BaseMenuNodeSchema> & {
+      kind: "group";
+      path: null;
+      children: MenuItem[];
+    });
+
+export const MenuItemSchema: z.ZodType<MenuItem> = z.lazy(() =>
+  z.discriminatedUnion("kind", [
+    BaseMenuNodeSchema.extend({
+      kind: z.literal("item"),
+      path: z.string(),
+      children: z.array(MenuItemSchema).nullable(),
+    }),
+    BaseMenuNodeSchema.extend({
+      kind: z.literal("group"),
+      path: z.null(),
+      children: z.array(MenuItemSchema),
+    }),
+  ]),
+);
diff --git a/apps/basic/src/api/shared/pagination.ts b/apps/basic/src/api/shared/pagination.ts
new file mode 100644
index 0000000..37a388b
--- /dev/null
+++ b/apps/basic/src/api/shared/pagination.ts
@@ -0,0 +1,14 @@
+import { z } from "zod/v4";
+
+export type PaginatedData<T> = {
+  list: T[];
+  total: number;
+};
+
+/** Unwrapped list payload (envelope `data`); use as `defineApi` `output`. */
+export function PaginatedDataSchema<T extends z.ZodTypeAny>(itemSchema: T) {
+  return z.object({
+    list: z.array(itemSchema),
+    total: z.int(),
+  });
+}
diff --git a/apps/basic/src/api/shared/params.ts b/apps/basic/src/api/shared/params.ts
new file mode 100644
index 0000000..9cee2d6
--- /dev/null
+++ b/apps/basic/src/api/shared/params.ts
@@ -0,0 +1,16 @@
+import { z } from "zod/v4";
+
+export const IdParamsSchema = z.object({
+  id: z.string().min(1),
+});
+
+export type IdParams = z.infer<typeof IdParamsSchema>;
+
+export const SearchParamsSchema = z.object({
+  page: z.number().int().positive().catch(1),
+  pageSize: z.number().int().positive().catch(10),
+  sortField: z.string().nullable().catch(null),
+  sortOrder: z.enum(["ascend", "descend"]).nullable().catch(null),
+});
+
+export type SearchParams = z.infer<typeof SearchParamsSchema>;
diff --git a/apps/basic/src/api/shared/prefix.ts b/apps/basic/src/api/shared/prefix.ts
new file mode 100644
index 0000000..b463808
--- /dev/null
+++ b/apps/basic/src/api/shared/prefix.ts
@@ -0,0 +1,2 @@
+/** REST API path prefix (no trailing slash). */
+export const API_PREFIX = "/api" as const;
diff --git a/apps/basic/src/api/user.ts b/apps/basic/src/api/user.ts
deleted file mode 100644
index 74a5e93..0000000
--- a/apps/basic/src/api/user.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import type { CreateUserRequest, UpdateUserRequest, User } from "./schemas";
-
-export const USER_ENDPOINTS = {
-  list: "/api/users",
-  create: "/api/users",
-  update: (id: string) => `/api/users/${id}`,
-  delete: (id: string) => `/api/users/${id}`,
-} as const;
-
-export type { CreateUserRequest, UpdateUserRequest, User };
diff --git a/apps/basic/src/api/users/index.ts b/apps/basic/src/api/users/index.ts
new file mode 100644
index 0000000..3bae8b0
--- /dev/null
+++ b/apps/basic/src/api/users/index.ts
@@ -0,0 +1,55 @@
+import { z } from "zod/v4";
+import { defineApi } from "@/api/request";
+import { IdParamsSchema } from "@/api/shared/params";
+import { PaginatedDataSchema } from "@/api/shared/pagination";
+import {
+  CreateUserRequestSchema,
+  ListUsersQuerySchema,
+  UpdateUserRequestSchema,
+  UserSchema,
+} from "@/api/users/schemas";
+import type {
+  CreateUserRequest,
+  ListUsersQuery,
+  UpdateUserRequest,
+  User,
+} from "@/api/users/schemas";
+import { API_PREFIX } from "@/api/shared/prefix";
+
+export const USERS_PATH = `${API_PREFIX}/users`;
+export const USERS_MEMBER_PATH = `${USERS_PATH}/:id`;
+
+export const userQueryKeys = {
+  all: ["users"] as const,
+  list: (query: ListUsersQuery) => [...userQueryKeys.all, "list", query] as const,
+};
+
+export const listUsers = defineApi({
+  path: USERS_PATH,
+  query: ListUsersQuerySchema,
+  output: PaginatedDataSchema(UserSchema),
+});
+
+export const createUser = defineApi({
+  method: "POST",
+  path: USERS_PATH,
+  body: CreateUserRequestSchema,
+  output: UserSchema,
+});
+
+export const updateUser = defineApi({
+  method: "PUT",
+  path: USERS_MEMBER_PATH,
+  params: IdParamsSchema,
+  body: UpdateUserRequestSchema,
+  output: UserSchema,
+});
+
+export const deleteUser = defineApi({
+  method: "DELETE",
+  path: USERS_MEMBER_PATH,
+  params: IdParamsSchema,
+  output: z.null(),
+});
+
+export type { CreateUserRequest, ListUsersQuery, UpdateUserRequest, User };
diff --git a/apps/basic/src/api/users/schemas.ts b/apps/basic/src/api/users/schemas.ts
new file mode 100644
index 0000000..51562ba
--- /dev/null
+++ b/apps/basic/src/api/users/schemas.ts
@@ -0,0 +1,45 @@
+import { z } from "zod/v4";
+
+export const UserSchema = z.object({
+  id: z.string(),
+  username: z.string(),
+  avatar: z.string().nullable(),
+  email: z.string().nullable(),
+  roles: z.array(z.string()),
+  permissions: z.array(z.string()),
+});
+
+export type User = z.infer<typeof UserSchema>;
+
+export const ListUsersQuerySchema = z.object({
+  limit: z.number().int().positive().optional(),
+  offset: z.number().int().nonnegative().optional(),
+  keyword: z.string().optional(),
+  role: z.string().optional(),
+  sortField: z.string().optional(),
+  sortOrder: z.enum(["ascend", "descend"]).optional(),
+});
+
+export type ListUsersQuery = z.infer<typeof ListUsersQuerySchema>;
+
+/** Ant Design Input submits `""` when empty; treat as null for optional email */
+const createUserEmailSchema = z
+  .union([z.string(), z.null(), z.undefined()])
+  .transform((v) => {
+    if (v == null) return null;
+    const t = String(v).trim();
+    return t === "" ? null : t;
+  })
+  .pipe(z.union([z.string().email(), z.null()]));
+
+export const CreateUserRequestSchema = z.object({
+  username: z.string().min(1),
+  email: createUserEmailSchema,
+  roles: z.array(z.string()).min(1),
+});
+
+export type CreateUserRequest = z.infer<typeof CreateUserRequestSchema>;
+
+export const UpdateUserRequestSchema = CreateUserRequestSchema.partial();
+
+export type UpdateUserRequest = z.infer<typeof UpdateUserRequestSchema>;
diff --git a/apps/basic/src/components/DataTable/index.tsx b/apps/basic/src/components/DataTable/index.tsx
index a8388bd..b6061ba 100644
--- a/apps/basic/src/components/DataTable/index.tsx
+++ b/apps/basic/src/components/DataTable/index.tsx
@@ -1,4 +1,4 @@
-import { Flex, Table, theme } from "antd";
+import { Table, theme } from "antd";
 import type { TableProps } from "antd";
 import type { CSSProperties, ReactElement, ReactNode, Ref } from "react";
 import { useMemo } from "react";
@@ -20,9 +20,9 @@ export type DataTableProps<RecordType extends object = object> = {
   /** When `lockScrollHeight`, optional fixed outer `height` (usually same as max height) */
   frameHeight?: number;
   /** Flex column wrapping frame + optional `bottomExtra` */
-  layoutRef?: Ref<HTMLDivElement | null>;
+  layoutRef?: Ref<HTMLDivElement>;
   /** Bordered box around the table (e.g. for `scrollHeight` vs `clientHeight` checks) */
-  frameRef?: Ref<HTMLDivElement | null>;
+  frameRef?: Ref<HTMLDivElement>;
   /** Optional content below the bordered table frame */
   bottomExtra?: ReactNode;
 } & TableProps<RecordType>;
@@ -77,14 +77,15 @@ export function DataTable<RecordType extends object = object>(
   );
 
   return (
-    <Flex
+    <div
       ref={layoutRef}
-      vertical
-      gap={token.marginSM}
       style={{
         flex: "1 1 0%",
         minHeight: 0,
         overflow: "hidden",
+        display: "flex",
+        flexDirection: "column",
+        gap: token.marginSM,
       }}
     >
       <div ref={frameRef} style={outerStyle}>
@@ -120,6 +121,6 @@ export function DataTable<RecordType extends object = object>(
         </div>
       </div>
       {bottomExtra}
-    </Flex>
+    </div>
   );
 }
diff --git a/apps/basic/src/main.tsx b/apps/basic/src/main.tsx
index 15e368d..2941295 100644
--- a/apps/basic/src/main.tsx
+++ b/apps/basic/src/main.tsx
@@ -4,8 +4,8 @@ import { RouterProvider, createRouter } from "@tanstack/react-router";
 import { routeTree } from "./routeTree.gen";
 import { useAuthStore } from "./stores/auth";
 import { useSettingsStore } from "./stores/settings";
-import { fetchSessionAndApplyToStore } from "./utils/session";
-import { installHttpRouter } from "./utils/http";
+import { hydrateSession } from "./api/auth";
+import { installHttpRouter } from "./api/request";
 
 const router = createRouter({ routeTree });
 installHttpRouter(router);
@@ -29,7 +29,7 @@ enableMocking()
     const { isAuthenticated, tokens } = useAuthStore.getState();
     if (isAuthenticated && tokens) {
       try {
-        await fetchSessionAndApplyToStore();
+        await hydrateSession();
       } catch {
         useAuthStore.getState().logout();
       }
diff --git a/apps/basic/src/mocks/handlers/auth.ts b/apps/basic/src/mocks/handlers/auth.ts
index fe197d5..0ee71d4 100644
--- a/apps/basic/src/mocks/handlers/auth.ts
+++ b/apps/basic/src/mocks/handlers/auth.ts
@@ -15,6 +15,7 @@ import {
   RefreshTokenRequestSchema,
   RegisterRequestSchema,
 } from "@/api/schemas";
+import { AUTH_ENDPOINTS } from "@/api/auth/paths";
 
 const GUEST_REFRESH = "mock-guest-refresh";
 const REGISTERED_ACCESS = "mock-registered-access";
@@ -32,7 +33,7 @@ function isRegisteredAuth(authorization: string | null): boolean {
 }
 
 export const authHandlers = [
-  http.post("/api/auth/login", async ({ request }) => {
+  http.post(AUTH_ENDPOINTS.login, async ({ request }) => {
     await withDelay(300);
     let json: unknown;
     try {
@@ -60,7 +61,7 @@ export const authHandlers = [
     return errorResponse(ERROR_CODES.INVALID_CREDENTIALS, "Invalid username or password");
   }),
 
-  http.post("/api/auth/register", async ({ request }) => {
+  http.post(AUTH_ENDPOINTS.register, async ({ request }) => {
     await withDelay(300);
     let json: unknown;
     try {
@@ -90,7 +91,7 @@ export const authHandlers = [
     });
   }),
 
-  http.post("/api/auth/refresh", async ({ request }) => {
+  http.post(AUTH_ENDPOINTS.refresh, async ({ request }) => {
     await withDelay(100);
     let json: unknown;
     try {
@@ -123,9 +124,9 @@ export const authHandlers = [
     });
   }),
 
-  http.post("/api/auth/logout", () => successWithNullBody()),
+  http.post(AUTH_ENDPOINTS.logout, () => successWithNullBody()),
 
-  http.get("/api/auth/user", ({ request }) => {
+  http.get(AUTH_ENDPOINTS.user, ({ request }) => {
     const auth = request.headers.get("authorization");
     if (isRegisteredAuth(auth)) {
       const session = mockRegisteredSession;
@@ -146,7 +147,7 @@ export const authHandlers = [
     return successWithSchema(AuthUserResponseSchema, userWithoutPermissions);
   }),
 
-  http.get("/api/auth/permissions", ({ request }) => {
+  http.get(AUTH_ENDPOINTS.permissions, ({ request }) => {
     const auth = request.headers.get("authorization");
     if (isRegisteredAuth(auth) && mockRegisteredSession) {
       return successWithSchema(PermissionsListSchema, ["user:view"] as string[]);
diff --git a/apps/basic/src/mocks/handlers/user.ts b/apps/basic/src/mocks/handlers/user.ts
index bc81598..014783c 100644
--- a/apps/basic/src/mocks/handlers/user.ts
+++ b/apps/basic/src/mocks/handlers/user.ts
@@ -10,13 +10,14 @@ import {
   successWithSchema,
   successWithNullBody,
 } from "../createHandler";
+import { USERS_MEMBER_PATH, USERS_PATH } from "@/api/users";
 
 let users = [...MOCK_USERS];
 
 export const EXPIRED_ACCESS_TOKEN = "__EXPIRED_ACCESS__";
 
 export const userHandlers = [
-  http.get("/api/users", async ({ request }) => {
+  http.get(USERS_PATH, async ({ request }) => {
     await withDelay(200);
     const auth = request.headers.get("authorization");
     if (auth === `Bearer ${EXPIRED_ACCESS_TOKEN}`) {
@@ -33,7 +34,7 @@ export const userHandlers = [
     return paginatedWithSchema(UserSchema, { list, total: filtered.length });
   }),
 
-  http.post("/api/users", async ({ request }) => {
+  http.post(USERS_PATH, async ({ request }) => {
     await withDelay(200);
     const body = (await request.json()) as Record<string, unknown>;
     const newUser = {
@@ -48,7 +49,7 @@ export const userHandlers = [
     return successWithSchema(UserSchema, newUser);
   }),
 
-  http.put("/api/users/:id", async ({ params, request }) => {
+  http.put(USERS_MEMBER_PATH, async ({ params, request }) => {
     await withDelay(200);
     const body = (await request.json()) as Record<string, unknown>;
     const idx = users.findIndex((u) => u.id === params.id);
@@ -59,7 +60,7 @@ export const userHandlers = [
     return successWithSchema(UserSchema, users[idx]);
   }),
 
-  http.delete("/api/users/:id", async ({ params }) => {
+  http.delete(USERS_MEMBER_PATH, async ({ params }) => {
     await withDelay(200);
     users = users.filter((u) => u.id !== params.id);
     return successWithNullBody();
diff --git a/apps/basic/src/routes/_auth.tsx b/apps/basic/src/routes/_auth.tsx
index 3417be4..59ed32f 100644
--- a/apps/basic/src/routes/_auth.tsx
+++ b/apps/basic/src/routes/_auth.tsx
@@ -2,7 +2,7 @@ import { createFileRoute, redirect } from "@tanstack/react-router";
 import { useAuthStore } from "@/stores/auth";
 import { MainLayout } from "@/components/Layout/MainLayout";
 import { canAccessPath, normalizeAppPath } from "@/utils/appMenu";
-import { fetchSessionAndApplyToStore } from "@/utils/session";
+import { hydrateSession } from "@/api/auth";
 
 export const Route = createFileRoute("/_auth")({
   beforeLoad: async ({ location }) => {
@@ -13,7 +13,7 @@ export const Route = createFileRoute("/_auth")({
 
     if (tokens && !user) {
       try {
-        await fetchSessionAndApplyToStore();
+        await hydrateSession();
       } catch {
         useAuthStore.getState().logout();
         throw redirect({ to: "/login" });
diff --git a/apps/basic/src/routes/_auth/users/index.tsx b/apps/basic/src/routes/_auth/users/index.tsx
index 11f8895..a273e4e 100644
--- a/apps/basic/src/routes/_auth/users/index.tsx
+++ b/apps/basic/src/routes/_auth/users/index.tsx
@@ -2,9 +2,7 @@ import { createFileRoute, useNavigate } from "@tanstack/react-router";
 import { Avatar, Button, Space, Form, App, Dropdown, theme, Tag, Flex } from "antd";
 import type { TablePaginationConfig } from "antd/es/table/interface";
 import { useMemo, useRef, useState } from "react";
-import { httpClient } from "@/utils/http";
-import { USER_ENDPOINTS } from "@/api/user";
-import { PaginatedResponseSchema, UserSchema, CreateUserRequestSchema } from "@/api/schemas";
+import { createUser, deleteUser, listUsers, updateUser, userQueryKeys } from "@/api/users";
 import type { User, CreateUserRequest } from "@/api/schemas";
 import { z } from "zod/v4";
 import { MoreVertical, Pencil, Trash2 } from "lucide-react";
@@ -32,8 +30,6 @@ export const Route = createFileRoute("/_auth/users/")({
   component: UsersPage,
 });
 
-const paginatedUserSchema = PaginatedResponseSchema(UserSchema);
-
 function UsersPage() {
   const search = Route.useSearch();
   const navigate = useNavigate({ from: Route.fullPath });
@@ -62,36 +58,26 @@ function UsersPage() {
     resourceKey: "users",
   });
 
+  const listQuery = {
+    limit: search.limit,
+    offset: search.offset,
+    keyword: search.keyword || undefined,
+    role: search.role || undefined,
+    sortField: search.sortField ?? undefined,
+    sortOrder: search.sortOrder ?? undefined,
+  };
+
   const { data, isLoading, createMutation, updateMutation, deleteMutation } = useResourceCRUD<
     { list: User[]; total: number },
     CreateUserRequest,
     CreateUserRequest & { id: string }
   >({
-    queryKey: [
-      "users",
-      search.limit,
-      search.offset,
-      search.keyword,
-      search.role,
-      search.sortField,
-      search.sortOrder,
-    ],
-    queryFn: () =>
-      httpClient.get(USER_ENDPOINTS.list, {
-        params: {
-          limit: search.limit,
-          offset: search.offset,
-          keyword: search.keyword || undefined,
-          role: search.role || undefined,
-          sortField: search.sortField ?? undefined,
-          sortOrder: search.sortOrder ?? undefined,
-        },
-      }),
-    select: (raw) => paginatedUserSchema.shape.data.parse(raw),
-    createFn: (values) =>
-      httpClient.post(USER_ENDPOINTS.create, CreateUserRequestSchema.parse(values)),
-    updateFn: ({ id, ...values }) => httpClient.put(USER_ENDPOINTS.update(id), values),
-    deleteFn: (id) => httpClient.delete(USER_ENDPOINTS.delete(id)),
+    queryKey: userQueryKeys.list(listQuery),
+    queryFn: () => listUsers(listQuery),
+    select: (raw) => raw as { list: User[]; total: number },
+    createFn: (values) => createUser(values),
+    updateFn: ({ id, ...values }) => updateUser({ params: { id }, body: values }),
+    deleteFn: (id) => deleteUser({ id }),
     optimistic: { update: true, delete: true },
     createLifecycle: {
       onSuccess: (values) => {
diff --git a/apps/basic/src/routes/login/index.tsx b/apps/basic/src/routes/login/index.tsx
index 1b20199..17bff27 100644
--- a/apps/basic/src/routes/login/index.tsx
+++ b/apps/basic/src/routes/login/index.tsx
@@ -2,12 +2,10 @@ import { createFileRoute, Link, redirect, useNavigate } from "@tanstack/react-ro
 import { Form, Input, Button, Card, App, theme, Typography, Flex, Checkbox, Space } from "antd";
 import type { CSSProperties } from "react";
 import { useMutation } from "@tanstack/react-query";
-import { httpClient } from "@/utils/http";
 import { useAuthStore } from "@/stores/auth";
 import { useSettingsStore } from "@/stores/settings";
-import { AUTH_ENDPOINTS } from "@/api/auth";
-import { LoginRequestSchema, AuthTokensSchema } from "@/api/schemas";
-import { fetchSessionAndApplyToStore } from "@/utils/session";
+import { hydrateSession, login } from "@/api/auth";
+import { LoginRequestSchema } from "@/api/schemas";
 import type { LoginRequest } from "@/api/schemas";
 import { APP_BRAND_NAME, APP_FAVICON_SRC } from "@/utils/constants";
 import { Theme } from "@/components/Icon";
@@ -35,11 +33,9 @@ function LoginPage() {
 
   const loginMutation = useMutation({
     mutationFn: async (values: LoginRequest) => {
-      const parsed = LoginRequestSchema.parse(values);
-      const tokens = await httpClient.post(AUTH_ENDPOINTS.login, parsed);
-      const validTokens = AuthTokensSchema.parse(tokens);
-      setTokens(validTokens);
-      await fetchSessionAndApplyToStore();
+      const tokens = await login(values);
+      setTokens(tokens);
+      await hydrateSession();
     },
     onSuccess: () => {
       message.success("Login successful");
diff --git a/apps/basic/src/routes/register/index.tsx b/apps/basic/src/routes/register/index.tsx
index 62c8256..8bdfe34 100644
--- a/apps/basic/src/routes/register/index.tsx
+++ b/apps/basic/src/routes/register/index.tsx
@@ -2,11 +2,9 @@ import { Link, createFileRoute, redirect, useNavigate } from "@tanstack/react-ro
 import { Form, Input, Button, Card, App, theme, Typography, Flex } from "antd";
 import type { CSSProperties } from "react";
 import { useMutation } from "@tanstack/react-query";
-import { httpClient } from "@/utils/http";
 import { useAuthStore } from "@/stores/auth";
-import { AUTH_ENDPOINTS } from "@/api/auth";
-import { AuthTokensSchema, RegisterRequestSchema } from "@/api/schemas";
-import { fetchSessionAndApplyToStore } from "@/utils/session";
+import { hydrateSession, register } from "@/api/auth";
+import { RegisterRequestSchema } from "@/api/schemas";
 import type { RegisterRequest } from "@/api/auth";
 import { APP_BRAND_NAME, APP_FAVICON_SRC } from "@/utils/constants";
 import { Aurora } from "@/components/Aurora";
@@ -31,11 +29,9 @@ function RegisterPage() {
 
   const registerMutation = useMutation({
     mutationFn: async (values: RegisterRequest) => {
-      const parsed = RegisterRequestSchema.parse(values);
-      const tokens = await httpClient.post(AUTH_ENDPOINTS.register, parsed);
-      const validTokens = AuthTokensSchema.parse(tokens);
-      setTokens(validTokens);
-      await fetchSessionAndApplyToStore();
+      const tokens = await register(values);
+      setTokens(tokens);
+      await hydrateSession();
     },
     onSuccess: () => {
       message.success("Account created successfully");
diff --git a/apps/basic/src/utils/http.ts b/apps/basic/src/utils/http.ts
deleted file mode 100644
index 4ab53dc..0000000
--- a/apps/basic/src/utils/http.ts
+++ /dev/null
@@ -1,172 +0,0 @@
-import { API_BASE_URL } from "./constants";
-import { AUTH_ENDPOINTS } from "@/api/auth";
-import { AuthTokensSchema, RefreshTokenRequestSchema } from "@/api/schemas";
-import { getAccessToken, useAuthStore } from "@/stores/auth";
-
-export class ApiError extends Error {
-  code: number;
-  constructor(code: number, message: string) {
-    super(message);
-    this.name = "ApiError";
-    this.code = code;
-  }
-}
-
-export class HttpError extends Error {
-  status: number;
-  constructor(status: number, message: string) {
-    super(message);
-    this.name = "HttpError";
-    this.status = status;
-  }
-}
-
-type RequestOptions = Omit<RequestInit, "method" | "body"> & {
-  params?: Record<string, string | number | null | undefined>;
-};
-
-type HttpRouter = {
-  navigate: (opts: { to: string }) => void | Promise<void>;
-};
-
-let httpRouter: HttpRouter | null = null;
-
-export function installHttpRouter(router: HttpRouter): void {
-  httpRouter = router;
-}
-
-let inflightRefresh: Promise<boolean> | null = null;
-
-async function doRefreshSessionTokens(): Promise<boolean> {
-  const { tokens, setTokens, logout } = useAuthStore.getState();
-  const refreshToken = tokens?.refreshToken;
-  if (!refreshToken) {
-    logout();
-    navigateToLogin();
-    return false;
-  }
-
-  const body = RefreshTokenRequestSchema.parse({ refreshToken });
-  const url = buildUrl(AUTH_ENDPOINTS.refresh);
-
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body),
-    });
-
-    if (!res.ok) {
-      logout();
-      navigateToLogin();
-      return false;
-    }
-
-    const json: unknown = await res.json();
-    const envelope = json as { code?: number; data?: unknown; message?: string };
-    if (envelope.code !== undefined && envelope.code !== 0) {
-      logout();
-      navigateToLogin();
-      return false;
-    }
-
-    const next = AuthTokensSchema.parse(envelope.data ?? envelope);
-    setTokens(next);
-    return true;
-  } catch {
-    logout();
-    navigateToLogin();
-    return false;
-  }
-}
-
-async function refreshSessionTokens(): Promise<boolean> {
-  if (inflightRefresh) return inflightRefresh;
-
-  inflightRefresh = doRefreshSessionTokens().finally(() => {
-    inflightRefresh = null;
-  });
-  return inflightRefresh;
-}
-
-function buildUrl(path: string, params?: RequestOptions["params"]): string {
-  const base = path.startsWith("http") ? path : `${API_BASE_URL}${path}`;
-  if (!params) return base;
-  const url = new URL(base, window.location.origin);
-  for (const [key, value] of Object.entries(params)) {
-    if (value != null) url.searchParams.set(key, String(value));
-  }
-  return url.toString();
-}
-
-function getAuthHeaders(): Record<string, string> {
-  const token = getAccessToken();
-  if (token) return { Authorization: `Bearer ${token}` };
-  return {};
-}
-
-function navigateTo403(): void {
-  void httpRouter?.navigate({ to: "/403" });
-}
-
-function navigateToLogin(): void {
-  void httpRouter?.navigate({ to: "/login" });
-}
-
-async function request<T>(
-  method: string,
-  path: string,
-  body?: unknown,
-  options?: RequestOptions,
-  isAfterRefresh = false,
-): Promise<T> {
-  const url = buildUrl(path, options?.params);
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-    ...getAuthHeaders(),
-    ...(options?.headers as Record<string, string>),
-  };
-
-  const res = await fetch(url, {
-    method,
-    headers,
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-    ...options,
-  });
-
-  if (res.status === 401 && !isAfterRefresh && path !== AUTH_ENDPOINTS.refresh) {
-    const refreshed = await refreshSessionTokens();
-    if (refreshed) {
-      return request<T>(method, path, body, options, true);
-    }
-    throw new HttpError(401, "Unauthorized");
-  }
-
-  if (res.status === 403) {
-    navigateTo403();
-    throw new HttpError(403, "Forbidden");
-  }
-
-  if (!res.ok) {
-    throw new HttpError(res.status, `HTTP ${res.status}: ${res.statusText}`);
-  }
-
-  const json: unknown = await res.json();
-  const envelope = json as { code?: number; data?: unknown; message?: string };
-
-  if (envelope.code !== undefined && envelope.code !== 0) {
-    throw new ApiError(envelope.code, envelope.message ?? "Unknown error");
-  }
-
-  return (envelope.data !== undefined ? envelope.data : json) as T;
-}
-
-export const httpClient = {
-  get: <T>(path: string, options?: RequestOptions) => request<T>("GET", path, undefined, options),
-  post: <T>(path: string, body?: unknown, options?: RequestOptions) =>
-    request<T>("POST", path, body, options),
-  put: <T>(path: string, body?: unknown, options?: RequestOptions) =>
-    request<T>("PUT", path, body, options),
-  delete: <T>(path: string, options?: RequestOptions) =>
-    request<T>("DELETE", path, undefined, options),
-};
diff --git a/apps/basic/src/utils/session.ts b/apps/basic/src/utils/session.ts
deleted file mode 100644
index 45892f5..0000000
--- a/apps/basic/src/utils/session.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { httpClient } from "@/utils/http";
-import { AUTH_ENDPOINTS } from "@/api/auth";
-import { AuthUserResponseSchema, PermissionsListSchema, UserSchema } from "@/api/schemas";
-import { APP_MENU_TREE, filterMenuTreeByPermissions } from "@/utils/appMenu";
-import { useAuthStore } from "@/stores/auth";
-
-/** Fetches `/api/auth/user` and `/api/auth/permissions`, then updates `user` and sidebar `menus`. */
-export async function fetchSessionAndApplyToStore(): Promise<void> {
-  const [userBase, permissions] = await Promise.all([
-    httpClient.get(AUTH_ENDPOINTS.user).then((d) => AuthUserResponseSchema.parse(d)),
-    httpClient.get(AUTH_ENDPOINTS.permissions).then((d) => PermissionsListSchema.parse(d)),
-  ]);
-  const user = UserSchema.parse({ ...userBase, permissions });
-  const menus = filterMenuTreeByPermissions(APP_MENU_TREE, permissions);
-  const { setUser, setMenus } = useAuthStore.getState();
-  setUser(user);
-  setMenus(menus);
-}
diff --git a/apps/docs/content/en/backend/proxying-api-requests.mdx b/apps/docs/content/en/backend/proxying-api-requests.mdx
index 4adfbd7..8b964d1 100644
--- a/apps/docs/content/en/backend/proxying-api-requests.mdx
+++ b/apps/docs/content/en/backend/proxying-api-requests.mdx
@@ -1,14 +1,36 @@
 ---
 title: Proxying API Requests
-description: Configure API proxying between frontend and backend
+description: MSW, API base URL, and wiring a real backend
 ---
 
 # Proxying API Requests
 
-Use a proxy layer in development to avoid CORS issues and keep API endpoints configurable.
+## MSW (default in development)
 
-Recommended approach:
+Templates use **MSW** to intercept HTTP in development. Handlers live under `src/mocks/handlers`. You can demo login, menus, and user CRUD without a real backend.
 
-- Define a consistent API prefix.
-- Route requests by environment.
-- Keep backend base URLs in environment variables.
+The **worker directory** is configured via `package.json` **`msw.workerDirectory`** as `public`.
+
+## API layer (templates)
+
+Data flow: **Zod schemas → `defineApi` in `src/api/<module>/index.ts` → routes/components call resource functions** (`listUsers`, `login`, …). Do not import axios or `@/api/request` from UI code.
+
+```text
+src/api/
+├── request.ts       # axios, envelope unwrap, token refresh
+├── schemas.ts       # deprecated barrel; prefer @/api/shared and module schemas
+├── shared/          # API_PREFIX, pagination, params, menu helpers
+├── auth/            # paths, schemas, login / hydrateSession
+└── users/           # schemas, CRUD APIs, userQueryKeys, path constants
+```
+
+- REST path prefix: **`API_PREFIX`** in `src/api/shared/prefix.ts` (default `/api`). Auth and user paths (`AUTH_ENDPOINTS`, `USERS_PATH`) and **MSW handlers** import the same constants.
+- New domains: mirror **`users`** — see each app **`.agents/skills/add-resource/SKILL.md`** and **`AGENTS.md`**.
+
+## Talking to a real API
+
+Transport lives in **`src/api/request.ts` (axios)**. `baseURL` comes from **`VITE_API_BASE_URL`** (`src/utils/constants.ts`). Call **`defineApi` exports** from `src/api/<module>/index.ts` — not axios from pages.
+
+Point `VITE_API_BASE_URL` at your gateway and disable or bypass MSW per `main.tsx` / env flags when you no longer need mocks.
+
+For CORS, configure the gateway the browser can reach, or proxy **`API_PREFIX`** (default `/api`) in `vite.config.ts` `server.proxy`.
diff --git a/apps/docs/content/en/getting-started/folder-structure.mdx b/apps/docs/content/en/getting-started/folder-structure.mdx
index 29759da..48b6677 100644
--- a/apps/docs/content/en/getting-started/folder-structure.mdx
+++ b/apps/docs/content/en/getting-started/folder-structure.mdx
@@ -23,6 +23,28 @@ description: Key directories and responsibilities in the repository
 - `apps/docs`: Documentation site (Nextra + Next.js)
 - `packages`: Shared packages and utilities
 
+## Template app `src/` (basic / with-lingui)
+
+Both templates share the same layout; **with-lingui** adds `src/locales/` and Lingui scripts.
+
+```text
+src/
+├── api/
+│   ├── request.ts     # Transport (axios, defineApi, token refresh)
+│   ├── schemas.ts     # Compatibility re-exports
+│   ├── shared/        # API_PREFIX, pagination, params, menu helpers
+│   ├── auth/          # Auth paths, schemas, login / hydrateSession
+│   └── users/         # User CRUD, query keys, path constants
+├── components/
+├── hooks/
+├── mocks/             # MSW handlers (same path constants as api modules)
+├── routes/
+├── stores/
+└── utils/             # Constants, menu tree — not HTTP transport
+```
+
+See **[Proxying API Requests](/en/backend/proxying-api-requests)** for the API layer and MSW/backend wiring.
+
 ## Recommendation
 
 When creating reusable logic, prioritize placing it in `packages` rather than duplicating in app folders.
diff --git a/apps/docs/content/en/getting-started/supported-features.mdx b/apps/docs/content/en/getting-started/supported-features.mdx
index 4932b6a..09d5d29 100644
--- a/apps/docs/content/en/getting-started/supported-features.mdx
+++ b/apps/docs/content/en/getting-started/supported-features.mdx
@@ -9,7 +9,7 @@ The templates include:
 
 - User login and permission-based routing
 - Dashboard and reusable business pages
-- Request abstraction and API proxy support
+- Modular API layer (`defineApi`, Zod schemas, shared `API_PREFIX`) and dev proxy / MSW
 - Theme and layout customization
 - Mock data support with MSW
 - Unit tests and E2E tests
diff --git a/apps/docs/content/en/templates/basic.mdx b/apps/docs/content/en/templates/basic.mdx
index 09b47e7..8705608 100644
--- a/apps/docs/content/en/templates/basic.mdx
+++ b/apps/docs/content/en/templates/basic.mdx
@@ -1,6 +1,6 @@
 ---
 title: basic
-description: Lightweight admin template for single-language projects
+description: Admin template with plain-string UI (default English)
 ---
 
 # basic
@@ -9,15 +9,18 @@ description: Lightweight admin template for single-language projects
 
 ## Good Fit
 
-- Internal tools
-- Small-to-medium dashboard projects
-- Teams not requiring i18n yet
+- Internal tools and dashboards
+- Teams that want a full scaffold first and may add i18n later
+- Projects comfortable with English as the default UI language
 
 ## Highlights
 
-- Clean route organization
-- Common data table and form patterns
-- Practical defaults for request handling and page layout
+- Modular **`src/api/`** (`defineApi` per domain, shared **`API_PREFIX`**, Zod at boundaries)
+- Clean route organization and reusable CRUD hooks
+- MSW mocks aligned with the same path constants as the API modules
+- **`AGENTS.md`** and **`.agents/skills/add-resource/`** for AI-assisted scaffolding
+
+Full tree and scripts: [apps/basic/README.md](https://github.com/zuiidea/antd-admin/blob/master/apps/basic/README.md).
 
 ## Start Development
 
diff --git a/apps/docs/content/en/templates/index.mdx b/apps/docs/content/en/templates/index.mdx
index 5080f40..b4a5e30 100644
--- a/apps/docs/content/en/templates/index.mdx
+++ b/apps/docs/content/en/templates/index.mdx
@@ -7,10 +7,10 @@ description: Choose between basic and with-lingui templates
 
 This repository provides two templates:
 
-- **[basic](/en/templates/basic)**: Minimal setup, English UI by default.
-- **[with-lingui](/en/templates/with-lingui)**: Includes Lingui i18n workflow and bilingual setup.
+- **[basic](/en/templates/basic)**: Full admin template; UI copy as plain strings (default English).
+- **[with-lingui](/en/templates/with-lingui)**: Same stack plus Lingui i18n (`en` + `zh`) and locale switching.
 
 ## How to Choose
 
-- Choose **basic** if you only need one language.
-- Choose **with-lingui** if you need structured multilingual support from day one.
+- Choose **basic** for the default stack without a bundled i18n workflow (you can add i18n later).
+- Choose **with-lingui** when you want Lingui catalogs and bilingual UI from day one.
diff --git a/apps/docs/content/en/templates/with-lingui.mdx b/apps/docs/content/en/templates/with-lingui.mdx
index 3520acd..8914d22 100644
--- a/apps/docs/content/en/templates/with-lingui.mdx
+++ b/apps/docs/content/en/templates/with-lingui.mdx
@@ -15,9 +15,11 @@ description: Admin template with Lingui internationalization
 
 ## Highlights
 
-- Lingui message extraction and compilation flow
-- Language resource organization
-- Built-in language switching patterns
+- Same **`src/api/`** layout as **basic** (shared transport, `API_PREFIX`, `auth/` / `users/` modules)
+- Lingui message extraction and compilation flow (`i18n:extract`, `i18n:compile`, `i18n:check`)
+- Built-in **en** / **zh** switching with Ant Design locale wiring
+
+Full tree and scripts: [apps/with-lingui/README.md](https://github.com/zuiidea/antd-admin/blob/master/apps/with-lingui/README.md).
 
 ## Start Development
 
diff --git a/apps/docs/content/en/testing/running-tests.mdx b/apps/docs/content/en/testing/running-tests.mdx
index 91ae2c3..027de7d 100644
--- a/apps/docs/content/en/testing/running-tests.mdx
+++ b/apps/docs/content/en/testing/running-tests.mdx
@@ -7,12 +7,19 @@ description: Run unit and e2e tests in this repository
 
 Run tests from repository root or per app.
 
-Common commands:
+From a template app directory (`apps/basic` or `apps/with-lingui`):
+
+```bash
+pnpm run test:unit
+pnpm run test:e2e
+pnpm run test:e2e -- e2e/login.spec.ts e2e/users.spec.ts   # focused core flows
+pnpm run test:e2e:ui
+```
+
+Monorepo-wide (if configured):
 
 ```bash
 pnpm -r test
-pnpm --filter ./apps/basic test
-pnpm --filter ./apps/with-lingui test
 ```
 
-Set up CI to run tests on pull requests before merge.
+Set up CI to run `vp check` and E2E on pull requests before merge. See each app **`AGENTS.md`** for toolchain rules.
diff --git a/apps/docs/content/en/welcome/documentation-intro.mdx b/apps/docs/content/en/welcome/documentation-intro.mdx
index 6048ab5..7450836 100644
--- a/apps/docs/content/en/welcome/documentation-intro.mdx
+++ b/apps/docs/content/en/welcome/documentation-intro.mdx
@@ -11,11 +11,11 @@ If this is your first time here:
 
 1. Read **[Getting Started](/en/getting-started)** for setup and scripts.
 2. Compare templates in **[Templates](/en/templates)**.
-3. Go to **[Backend Integration](/en/backend/proxying-api-requests)** if you need API setup.
+3. Go to **[Backend Integration](/en/backend/proxying-api-requests)** for MSW, the modular **`src/api/`** layer, and real backend wiring.
 
 ## Repo Structure
 
-- `apps/basic`: English-only admin template
+- `apps/basic`: Admin template (default English UI; add your own i18n or use `with-lingui`)
 - `apps/with-lingui`: Internationalized template with Lingui
 - `apps/docs`: Documentation site
 
diff --git a/apps/docs/content/zh/backend/proxying-api-requests.mdx b/apps/docs/content/zh/backend/proxying-api-requests.mdx
index 1772bc7..19d9081 100644
--- a/apps/docs/content/zh/backend/proxying-api-requests.mdx
+++ b/apps/docs/content/zh/backend/proxying-api-requests.mdx
@@ -11,8 +11,26 @@ description: MSW、API 基地址与对接真实后端
 
 **Worker 目录**由 `package.json` 的 **`msw.workerDirectory`** 配置为 `public`，与 [public 目录](/styles-and-assets/public-folder) 说明一致。
 
+## API 层（模板约定）
+
+数据流：**Zod schema → `src/api/<module>/index.ts` 中的 `defineApi` → 路由/组件只调用资源函数**（如 `listUsers`、`login`）。页面不要 import axios 或 `@/api/request`。
+
+```text
+src/api/
+├── request.ts       # axios、响应 envelope、token 刷新
+├── schemas.ts       # 兼容 re-export；新代码用 @/api/shared 与各 module schemas
+├── shared/          # API_PREFIX、分页/查询/菜单等共用 schema
+├── auth/            # paths、schemas、登录与 hydrateSession
+└── users/           # schemas、CRUD、userQueryKeys、路径常量
+```
+
+- REST 前缀：**`API_PREFIX`**（`src/api/shared/prefix.ts`，默认 `/api`）。`AUTH_ENDPOINTS`、`USERS_PATH` 与 **MSW handlers** 共用同一套常量。
+- 新增资源：对照 **`users`**，见各应用 **`.agents/skills/add-resource/SKILL.md`** 与 **`AGENTS.md`**。
+
 ## 对接真实 API
 
-将 **`src/utils/http.ts`（或项目内统一 HTTP 封装）** 中的 **baseURL** 指向真实网关，并按环境关闭或绕过 MSW 初始化（具体开关以模板 `main.tsx` / 环境变量为准）。
+模板传输层为 **`src/api/request.ts`（axios）**：`baseURL` 来自环境变量 **`VITE_API_BASE_URL`**（见 `src/utils/constants.ts`）。业务调用请走 **`src/api/<module>/index.ts`** 导出的 `defineApi` 函数，不要在页面里直连 axios。
 
-跨域时需由**浏览器可访问**的网关配置 **CORS**；或通过开发代理将 `/api` 转发到后端（在 `vite.config.ts` 配置 `server.proxy`，按团队规范填写目标地址）。
+将 `VITE_API_BASE_URL` 指向真实网关，并按环境关闭或绕过 MSW 初始化（具体开关以模板 `main.tsx` / 环境变量为准）。
+
+跨域时需由**浏览器可访问**的网关配置 **CORS**；或通过开发代理将 **`API_PREFIX`（默认 `/api`）** 转发到后端（在 `vite.config.ts` 配置 `server.proxy`，按团队规范填写目标地址）。
diff --git a/apps/docs/content/zh/getting-started/available-scripts.mdx b/apps/docs/content/zh/getting-started/available-scripts.mdx
index fc4819d..b95d16c 100644
--- a/apps/docs/content/zh/getting-started/available-scripts.mdx
+++ b/apps/docs/content/zh/getting-started/available-scripts.mdx
@@ -29,7 +29,7 @@ description: package.json 中与开发相关的 npm 脚本
 |------|------|
 | `pnpm run test:unit` | Vitest 单元测试 |
 | `pnpm run test:e2e` | Playwright 全部 E2E |
-| `pnpm run test:e2e:core` | 核心场景子集（登录、users CRUD、refresh、RBAC、URL 状态） |
+| `pnpm run test:e2e -- e2e/login.spec.ts e2e/users.spec.ts` | 核心流程（登录 + users CRUD） |
 | `pnpm run test:e2e:ui` | Playwright UI 模式 |
 
 ## With Lingui 专有
diff --git a/apps/docs/content/zh/getting-started/folder-structure.mdx b/apps/docs/content/zh/getting-started/folder-structure.mdx
index 7444f61..d44681f 100644
--- a/apps/docs/content/zh/getting-started/folder-structure.mdx
+++ b/apps/docs/content/zh/getting-started/folder-structure.mdx
@@ -9,16 +9,23 @@ description: 模板应用 src 目录职责说明
 
 ```
 src/
-├── api/           # Zod schema、接口常量与类型
+├── api/
+│   ├── request.ts     # 传输层（axios、defineApi、刷新 token）
+│   ├── schemas.ts     # 兼容 barrel
+│   ├── shared/        # API_PREFIX、分页/params/menu 等
+│   ├── auth/          # 认证 API 与 paths
+│   └── users/         # 用户 CRUD 与 query keys
 ├── components/    # 通用 UI（表格壳、表单弹窗、布局等）
 ├── hooks/         # 主题、权限、CRUD 等组合逻辑
 ├── locales/       # Lingui：仅 with-lingui（en/zh .po）
-├── mocks/         # MSW handlers 与浏览器 worker
+├── mocks/         # MSW handlers（路径与 api 模块常量一致）
 ├── routes/        # TanStack Router 文件路由
 ├── stores/        # Zustand（auth、settings 等持久化）
-└── utils/         # HTTP 客户端、常量等
+└── utils/         # 常量、菜单等（不含 HTTP 客户端）
 ```
 
+API 约定详见 [开发代理与 Mock](/backend/proxying-api-requests)。
+
 更完整的树状说明见：
 
 - [apps/basic/README.md](https://github.com/zuiidea/antd-admin/blob/master/apps/basic/README.md)
diff --git a/apps/docs/content/zh/getting-started/supported-features.mdx b/apps/docs/content/zh/getting-started/supported-features.mdx
index 1ad5e75..b4356b5 100644
--- a/apps/docs/content/zh/getting-started/supported-features.mdx
+++ b/apps/docs/content/zh/getting-started/supported-features.mdx
@@ -13,7 +13,8 @@ description: 两模板共同具备的产品与技术能力
 - **动态菜单与 RBAC**：服务端菜单、路由权限、403
 - **表格 URL 状态**：分页、关键字、排序等与查询参数同步
 - **MSW**：开发环境 Mock，无需真实后端即可跑通流程
-- **Playwright E2E**：覆盖登录、CRUD、鉴权刷新、RBAC、URL 状态等（`test:e2e:core` 为核心子集）
+- **模块化 API**：`defineApi` 分域、`API_PREFIX`、MSW 与真实后端共用路径常量
+- **Playwright E2E**：覆盖登录、CRUD、鉴权刷新、RBAC、URL 状态等（可用 `pnpm run test:e2e -- e2e/login.spec.ts e2e/users.spec.ts` 跑核心流程）
 
 **With Lingui** 额外包含：LinguiJS 中英文、Ant Design locale 随语言切换、`.po` 抽取/编译工作流。
 
diff --git a/apps/docs/content/zh/getting-started/updating-releases.mdx b/apps/docs/content/zh/getting-started/updating-releases.mdx
index b82d72f..cb4543a 100644
--- a/apps/docs/content/zh/getting-started/updating-releases.mdx
+++ b/apps/docs/content/zh/getting-started/updating-releases.mdx
@@ -8,7 +8,7 @@ description: 依赖与模板演进时的建议
 ## 依赖升级
 
 - 使用 **Vite+**（`vp`）管理依赖，避免绕过 `vp` 直接大面积 `pnpm up` 导致与模板锁定的工具链不一致。
-- 升级 **Ant Design / TanStack / React** 大版本前，建议先阅读官方迁移说明，并在单分支上跑通 `vp check`、`test:unit`、`test:e2e:core` 与 `vp build`。
+- 升级 **Ant Design / TanStack / React** 大版本前，建议先阅读官方迁移说明，并在单分支上跑通 `vp check`、`test:unit`、`pnpm run test:e2e`（或指定核心 spec）与 `vp build`。
 
 ## 跟随本仓库模板
 
diff --git a/apps/docs/content/zh/templates/basic.mdx b/apps/docs/content/zh/templates/basic.mdx
index 657f956..ca83769 100644
--- a/apps/docs/content/zh/templates/basic.mdx
+++ b/apps/docs/content/zh/templates/basic.mdx
@@ -1,6 +1,6 @@
 ---
 title: Basic 模板
-description: apps/basic — 英文-only 模板说明摘要
+description: apps/basic — 默认英文界面的管理后台模板
 ---
 
 # Basic 模板
@@ -9,11 +9,13 @@ description: apps/basic — 英文-only 模板说明摘要
 
 ## 定位
 
-英文界面、**不包含 Lingui**；Ant Design 使用固定 **`en_US`** locale。依赖相对精简，适合只需英文后台或自行接入其它 i18n 方案的团队。
+完整的管理后台模板，UI 文案以源码中的 plain strings 为主，**默认语言为英文**；Ant Design 固定 **`en_US`**。未内置 Lingui 与语言切换，可自行接入 i18n，或选用 **with-lingui** 模板。
 
 ## 技术栈摘要
 
-构建：[Vite+](https://viteplus.dev)；UI：Ant Design 6；路由：TanStack Router；数据：TanStack Query；本地状态：Zustand；校验：Zod；Mock：MSW；E2E：Playwright。
+构建：[Vite+](https://viteplus.dev)；UI：Ant Design 6；路由：TanStack Router；数据：TanStack Query；本地状态：Zustand；校验：Zod；API：`defineApi` 分模块（`src/api/shared/`、`auth/`、`users/`）；Mock：MSW；E2E：Playwright。
+
+API 与 Mock 约定见 [开发代理与 Mock](/backend/proxying-api-requests)。
 
 ## 常用命令
 
diff --git a/apps/docs/content/zh/templates/index.mdx b/apps/docs/content/zh/templates/index.mdx
index 3352f23..c8c29eb 100644
--- a/apps/docs/content/zh/templates/index.mdx
+++ b/apps/docs/content/zh/templates/index.mdx
@@ -12,14 +12,14 @@ asIndexPage: true
 | 项目 | `apps/basic` | `apps/with-lingui` |
 |------|----------------|---------------------|
 | **package.json `name`** | `antd-admin-basic` | `antd-admin` |
-| **Lingui（i18n）** | 无（英文界面） | 有（`@lingui/core`、`@lingui/react`，en / zh） |
+| **Lingui（i18n）** | 无内置（默认英文界面） | 有（`@lingui/core`、`@lingui/react`，en / zh） |
 | **Ant Design `ConfigProvider` locale** | 固定 `antd/locale/en_US` | 随设置切换：`en` → `en_US`，`zh` → `zh_CN`（见 `src/routes/__root.tsx`） |
 | **Zustand persist（settings）`name`** | `settings-storage-basic` | `settings-storage` |
 
 ## 选型建议
 
-- 只要英文、希望依赖最少：选 **[Basic](/templates/basic)**。
-- 需要中英文切换、Lingui 工作流与 Ant Design 随语言联动：选 **[With Lingui](/templates/with-lingui)**。
+- 希望先上手完整模板、默认英文、后续可自行加 i18n：选 **[Basic](/templates/basic)**。
+- 需要开箱即用的中英文切换、Lingui 工作流与 Ant Design 随语言联动：选 **[With Lingui](/templates/with-lingui)**。
 
 ## 子页面
 
diff --git a/apps/docs/content/zh/templates/with-lingui.mdx b/apps/docs/content/zh/templates/with-lingui.mdx
index e220578..c4d8641 100644
--- a/apps/docs/content/zh/templates/with-lingui.mdx
+++ b/apps/docs/content/zh/templates/with-lingui.mdx
@@ -13,7 +13,7 @@ description: apps/with-lingui — 中英双语与 Lingui 工作流
 
 ## 技术栈补充
 
-在 Basic 技术栈基础上增加 Lingui 6；`src/locales/{en,zh}/messages.po` 为翻译源；`lingui.config.ts` 与 Vite 插件见应用内配置。
+在 Basic 技术栈基础上增加 Lingui 6；**`src/api/` 目录与 Basic 同构**（`shared/`、`auth/`、`users/`）。`src/locales/{en,zh}/messages.po` 为翻译源；`lingui.config.ts` 与 Vite 插件见应用内配置。
 
 ## 国际化命令
 
@@ -33,4 +33,4 @@ vp dev
 
 ## 权威文档
 
-完整技术栈表、功能列表、目录树、E2E 子集说明、以及 **Cursor 与 `.github/instructions` 的 AI 指引** 以 **[apps/with-lingui/README.md](https://github.com/zuiidea/antd-admin/blob/master/apps/with-lingui/README.md)** 为准。
+完整技术栈表、功能列表、目录树、E2E 子集说明、以及 **AI 指引（`AGENTS.md`）** 以 **[apps/with-lingui/README.md](https://github.com/zuiidea/antd-admin/blob/master/apps/with-lingui/README.md)** 为准。
diff --git a/apps/docs/content/zh/testing/running-tests.mdx b/apps/docs/content/zh/testing/running-tests.mdx
index ef87278..d4644c9 100644
--- a/apps/docs/content/zh/testing/running-tests.mdx
+++ b/apps/docs/content/zh/testing/running-tests.mdx
@@ -17,7 +17,8 @@ pnpm run test:unit
 
 ```bash
 pnpm run test:e2e          # 全部
-pnpm run test:e2e:core     # 核心子集（登录、users、refresh、RBAC、URL 状态）
+pnpm run test:e2e -- e2e/login.spec.ts e2e/users.spec.ts   # 核心流程
+pnpm run test:e2e -- e2e/auth-refresh.spec.ts e2e/rbac.spec.ts e2e/url-state.spec.ts
 ```
 
 首次在机器上跑 E2E 前，按 Playwright 文档安装浏览器依赖（`pnpm exec playwright install` 等，以官方说明为准）。
diff --git a/apps/docs/content/zh/welcome/documentation-intro.mdx b/apps/docs/content/zh/welcome/documentation-intro.mdx
index c926d97..d8031b4 100644
--- a/apps/docs/content/zh/welcome/documentation-intro.mdx
+++ b/apps/docs/content/zh/welcome/documentation-intro.mdx
@@ -19,7 +19,7 @@ description: 本文档的阅读方式与章节说明
 | **样式与资源** | 全局样式、CSS Modules、静态资源、public、代码分割 |
 | **构建应用** | 路由、环境变量、性能、生产构建 |
 | **测试** | 单元测试与 E2E |
-| **后端对接** | MSW Mock、API 基地址与代理思路 |
+| **后端对接** | MSW、`src/api/` 模块化与 `API_PREFIX`、真实 API 与代理 |
 | **部署** | 构建产物与部署注意点 |
 
 更完整的模板说明仍以仓库内 **`apps/*/README.md`** 为准；本站用中文串联常用路径，减少在 GitHub 间跳转的成本。
diff --git a/apps/with-lingui/.github/instructions/add-resource.instructions.md b/apps/with-lingui/.agents/skills/add-resource/SKILL.md
similarity index 64%
rename from apps/with-lingui/.github/instructions/add-resource.instructions.md
rename to apps/with-lingui/.agents/skills/add-resource/SKILL.md
index 0cbc3bc..5b034de 100644
--- a/apps/with-lingui/.github/instructions/add-resource.instructions.md
+++ b/apps/with-lingui/.agents/skills/add-resource/SKILL.md
@@ -1,30 +1,35 @@
 ---
-applyTo: "src/api/**/*.ts,src/mocks/**/*.ts,src/routes/_auth/**/*.tsx,e2e/**/*.spec.ts"
-description: "Use when adding a new CRUD resource (roles, tenants, etc.). Keywords: add resource, new resource, scaffold, CRUD page."
+name: add-resource
+description: Add a new CRUD resource in with-lingui (mirror users). Use when scaffolding roles, tenants, or any list+form resource with MSW, routes, menu, and e2e.
 ---
 
 # Add Resource Recipe
 
-Add a list CRUD flow in `apps/with-lingui` that mirrors **Users** (TanStack Router + Query + MSW + Lingui). There is **no** codegen script: **copy and adapt by hand** using the steps below, or have an Agent follow this checklist. Primary references: `src/routes/_auth/users/` and the matching `e2e/*.spec.ts` files.
+Add a list CRUD flow that mirrors **Users** (TanStack Router + Query + MSW + Lingui). **No codegen** — copy and adapt by hand. References: `src/routes/_auth/users/` and matching `e2e/*.spec.ts`.
 
 ## 0. Verification commands (after your changes)
 
+Run from the **app root** (this project directory — where `package.json` and `vite.config.ts` live):
+
 ```bash
-cd apps/with-lingui
 pnpm run build             # refresh TanStack routeTree when routes change
 pnpm exec vp check --no-fmt
 pnpm run test:e2e -- e2e/<slug>.spec.ts
 ```
 
-## 1. Zod and types (`src/api/schemas.ts`)
+## 1. Zod and types (`src/api/<slug>/schemas.ts`)
 
 - Define `<Entity>Schema`, `Create<Entity>RequestSchema`, `Update<Entity>RequestSchema` (`Update` = `Create.partial()`).
-- Reuse `PaginatedResponseSchema(<Entity>Schema)` for list responses.
+- For list `output`, reuse `PaginatedDataSchema(<Entity>Schema)` (unwrapped `data`; envelope stays in `request.ts`).
+- Add list query schema (e.g. `List<Entity>QuerySchema`) when the table has filters/pagination.
 - Export `type <Entity> = z.infer<typeof ...>`.
 
-## 2. Endpoint constants (`src/api/<slug>.ts`)
+## 2. Resource API module (`src/api/<slug>/index.ts`)
 
-- Export `<SLUG_UPPER>_ENDPOINTS`: `list` / `create` / `update(id)` / `delete(id)` with paths like `/api/<slug>`.
+- Export path constants if useful for MSW/docs.
+- Define APIs with `defineApi` from `@/api/request`: `list` / `create` / `update` / `delete` (and `queryKeys`).
+- `method` defaults to `GET`; mutations set `POST` / `PUT` / `DELETE`.
+- Use segmented `params` / `query` / `body` + `output`; do not call axios from routes.
 
 ## 3. Mock data (`src/mocks/data.ts`)
 
@@ -37,7 +42,7 @@ pnpm run test:e2e -- e2e/<slug>.spec.ts
 
 ## 5. Route page (`src/routes/_auth/<slug>/`)
 
-- `createFileRoute("/_auth/<slug>/")`, wiring `useResourceCRUD` (recommended: `optimistic: { update: true, delete: true }`), `useCrudToasts`, `useUrlSearchState`, `useTableFitHeight` (see `users/` for splitting `-Toolbar` / `-FormModal`).
+- `createFileRoute("/_auth/<slug>/")`, wiring `useResourceCRUD` with resource functions (`listX`, `createX`, …) and `queryKeys` from `@/api/<slug>` (recommended: `optimistic: { update: true, delete: true }`), plus `useCrudToasts`, `useUrlSearchState`, `useTableFitHeight` (see `users/` for splitting `-Toolbar` / `-FormModal`).
 - **Lingui**: run `pnpm run i18n:extract && pnpm run i18n:compile` for new copy (or `vp exec lingui …`).
 
 ## 6. Menu and permissions (`src/utils/appMenu.ts`)
diff --git a/apps/with-lingui/.github/instructions/README.md b/apps/with-lingui/.github/instructions/README.md
deleted file mode 100644
index 87f921e..0000000
--- a/apps/with-lingui/.github/instructions/README.md
+++ /dev/null
@@ -1,18 +0,0 @@
-# AI Instruction Files
-
-This directory contains scoped instruction files used by AI coding agents.
-
-## Files
-
-- `frontend.instructions.md`: UI/routes/components/style changes
-- `testing.instructions.md`: Playwright/MSW/test changes
-- `api.instructions.md`: API client/schema/handler changes
-- `refactor.instructions.md`: behavior-preserving cleanup and deduplication
-- `add-resource.instructions.md`: add a new CRUD resource (manual / Agent checklist; mirror `users`)
-
-## Authoring Rules
-
-- Keep each file focused on one domain.
-- Put trigger phrases in `description` so agents can discover the file.
-- Use narrow `applyTo` patterns to avoid unnecessary context load.
-- Keep instructions executable: short Do/Do Not/Validation sections.
diff --git a/apps/with-lingui/.github/instructions/api.instructions.md b/apps/with-lingui/.github/instructions/api.instructions.md
deleted file mode 100644
index dbf2253..0000000
--- a/apps/with-lingui/.github/instructions/api.instructions.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-applyTo: "src/api/**/*.ts,src/utils/http.ts,src/mocks/handlers/**/*.ts,src/mocks/createHandler.ts"
-description: "Use when editing API clients, schemas, HTTP behavior, response types, or MSW endpoint handlers. Keywords: api, http, schema, zod, handler, endpoint, auth, users."
----
-
-# API Instructions
-
-## Purpose
-
-Maintain strict API contracts and consistent server/client mock behavior.
-
-## Do
-
-- Keep request/response shapes schema-driven and type-safe.
-- Reuse endpoint constants and shared response helpers.
-- Keep handler response envelope consistent (`code`, `data`, `message`).
-- MSW success payloads: use `successWithSchema` / `paginatedWithSchema` / `successWithNullBody` from `src/mocks/createHandler.ts` so responses match Zod contracts before `HttpResponse.json`.
-- Ensure mock handlers reflect real API behavior and error semantics.
-- Keep naming stable for endpoint keys and mutation/query keys.
-
-## Do Not
-
-- Do not return ad-hoc response shapes for one-off convenience.
-- Do not bypass schema parsing in new client mutations/queries.
-- Do not mix unrelated domain endpoints in the same module.
-
-## Validation
-
-- Verify TypeScript and schema parsing paths compile cleanly.
-- Run: `pnpm exec vp check --no-fmt`
-- After changing `createHandler` or handler envelopes: `pnpm run test:unit` (includes `src/mocks/createHandler.test.ts`).
diff --git a/apps/with-lingui/.github/instructions/frontend.instructions.md b/apps/with-lingui/.github/instructions/frontend.instructions.md
deleted file mode 100644
index 263fda0..0000000
--- a/apps/with-lingui/.github/instructions/frontend.instructions.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-applyTo: "src/**/*.{ts,tsx,css}"
-description: "Use when editing React UI, route pages, components, styles, layout, i18n text, or Ant Design behavior. Keywords: frontend, component, page, ui, layout, style, antd, i18n."
----
-
-# Frontend Instructions
-
-## Purpose
-
-Keep frontend changes predictable, minimal, and reusable for AI-assisted edits.
-
-## Do
-
-- Preserve existing route contracts and UI behavior unless explicitly asked.
-- Prefer reusable components and hooks over copy-paste logic.
-- Keep styles token-driven using existing theme/store patterns.
-- For Ant Design styling, follow this priority: component native API (`variant`/`type`/`size`/`styles`/`classNames`) -> `theme.useToken()` with inline `style` -> `className` + external CSS.
-- Keep translations compatible with Lingui macros and catalogs.
-- Follow current folder conventions under src/components and src/routes.
-
-## Do Not
-
-- Do not introduce new UI libraries when Ant Design already covers the need.
-- Do not bypass existing theme/store abstractions with hardcoded global state.
-- Do not write CSS overrides first when props or semantic `styles` can express the same UI.
-- Do not refactor unrelated files in the same change.
-
-## Validation
-
-- Run: `pnpm exec vp check --no-fmt`
-- For UI flow changes, run focused e2e where possible.
diff --git a/apps/with-lingui/.github/instructions/refactor.instructions.md b/apps/with-lingui/.github/instructions/refactor.instructions.md
deleted file mode 100644
index de28975..0000000
--- a/apps/with-lingui/.github/instructions/refactor.instructions.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-applyTo: "src/**/*.{ts,tsx}"
-description: "Use when refactoring existing code for deduplication, modularization, naming cleanup, or maintainability improvements without behavior changes. Keywords: refactor, cleanup, simplify, deduplicate, maintainability."
----
-
-# Refactor Instructions
-
-## Purpose
-
-Reduce duplication while preserving behavior and public contracts.
-
-## Do
-
-- Keep refactors incremental and scoped to one concern per change.
-- Prefer extracting shared utilities/hooks/components over large rewrites.
-- Preserve existing external behavior and route/store contracts.
-- Keep diffs reviewable with minimal unrelated formatting churn.
-- Add or update lightweight comments only when logic is non-obvious.
-
-## Do Not
-
-- Do not change runtime behavior unless explicitly requested.
-- Do not rename broadly across the codebase without clear benefit.
-- Do not delete tests that still cover unique critical scenarios.
-- Do not introduce large dependencies for minor convenience; prefer composition or small utilities.
-
-## Considerations
-
-- Bundle: Main app chunk is ~135KB (gzip ~41KB). Ant Design (vendor-antd) and TanStack (vendor-tanstack) are in separate chunks for parallel loading. Avoid adding large UI libraries when Ant Design covers the need.
-- Type safety: Keep validations at API boundaries (Zod schemas) rather than adding more runtime checks throughout the app.
-
-## Validation
-
-- Confirm no new diagnostics in touched files.
-- Run: `pnpm exec vp check --no-fmt`
-- For significant changes, verify bundle size impact: `pnpm run build 2>&1 | grep "kB"`
diff --git a/apps/with-lingui/.github/instructions/testing.instructions.md b/apps/with-lingui/.github/instructions/testing.instructions.md
deleted file mode 100644
index cb3c763..0000000
--- a/apps/with-lingui/.github/instructions/testing.instructions.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-
-## applyTo: "e2e/**/\*.ts,e2e/**/_.tsx,src/mocks/\*\*/_.ts,playwright.config.ts"
-
-description: "Use when adding or editing tests, Playwright cases, MSW handlers, mock data, or test configuration. Keywords: test, e2e, playwright, mock, msw, coverage."
-
-# Testing Instructions
-
-## Purpose
-
-Keep tests fast, deterministic, and aligned with core business flows.
-
-## Do
-
-- Prioritize core flows first (auth, users CRUD, permission gates).
-- Keep assertions user-visible and behavior-focused.
-- Reuse existing helper patterns in tests before adding new helpers.
-- Keep mock handlers and mock data synchronized with API schemas.
-- Prefer focused test runs over full-suite runs during iteration.
-
-## Do Not
-
-- Do not add brittle selectors tied to unstable DOM internals.
-- Do not expand fixture data without a clear scenario need.
-- Do not duplicate scenarios already covered by existing tests.
-
-## Validation
-
-- Run focused tests first, then broader checks if needed.
-- Run: `pnpm exec vp check --no-fmt`
-- Unit / hook logic (Vitest): `pnpm run test:unit` — tests live under `src/**/*.test.ts`.
diff --git a/apps/with-lingui/AGENTS.md b/apps/with-lingui/AGENTS.md
index 233591c..19557ac 100644
--- a/apps/with-lingui/AGENTS.md
+++ b/apps/with-lingui/AGENTS.md
@@ -1,89 +1,79 @@
-# Using Vite+, the Unified Toolchain for the Web
+# antd-admin (with-lingui)
 
-This project is using Vite+, a unified toolchain built on top of Vite, Rolldown, Vitest, tsdown, Oxlint, Oxfmt, and Vite Task. Vite+ wraps runtime management, package management, and frontend tooling in a single global CLI called `vp`. Vite+ is distinct from Vite, but it invokes Vite through `vp dev` and `vp build`.
+Vite+ template app (React 19, Ant Design 6, Lingui i18n, TanStack Router/Query, MSW). CLI details: [viteplus.dev](https://viteplus.dev).
 
-## Vite+ Workflow
+## Commands
 
-`vp` is a global binary that handles the full development lifecycle. Run `vp help` to print a list of commands and `vp <command> --help` for information about a specific command.
+Run from **this app root** (directory with `package.json` / `vite.config.ts`):
 
-### Start
+| Task                      | Command                                                                      |
+| ------------------------- | ---------------------------------------------------------------------------- |
+| Install deps              | `vp install` (after every pull)                                              |
+| Dev / build / preview     | `vp dev`, `vp build`, `vp preview`                                           |
+| Format / lint / typecheck | `vp check`, `vp check --no-fmt`, `vp lint`, `vp fmt`                         |
+| Unit tests                | `vp test run` (`src/**/*.test.ts`)                                           |
+| E2E                       | `pnpm run test:e2e` / `test:e2e:core`                                        |
+| i18n                      | `pnpm run i18n:extract && pnpm run i18n:compile` after new translatable copy |
+| Add/remove deps           | `vp add`, `vp remove` — not raw `pnpm`/`npm`/`yarn`                          |
 
-- create - Create a new project from a template
-- migrate - Migrate an existing project to Vite+
-- config - Configure hooks and agent integration
-- staged - Run linters on staged files
-- install (`i`) - Install dependencies
-- env - Manage Node.js versions
+**Pitfalls:** Do not install Vitest/Oxlint/Oxfmt/tsdown directly; use `vp`. Do not run `vp vitest` — use `vp test`. If a `package.json` script name conflicts with a built-in `vp` command, use `vp run <script>`. Import toolchain modules from `vite-plus`, not standalone `vite`/`vitest` packages.
 
-### Develop
+**Before finishing:** `vp check` and `vp test run`; run focused e2e when UI flows change.
 
-- dev - Run the development server
-- check - Run format, lint, and TypeScript type checks
-- lint - Lint code
-- fmt - Format code
-- test - Run tests
+**Monorepo:** If this app lives under [antd-admin](https://github.com/zuiidea/antd-admin), read repo-root `AGENTS.md` for turbo/git hooks; still run `vp` from this directory.
 
-### Execute
+---
 
-- run - Run monorepo tasks
-- exec - Execute a command from local `node_modules/.bin`
-- dlx - Execute a package binary without installing it as a dependency
-- cache - Manage the task cache
+## Frontend
 
-### Build
+**Purpose:** Predictable, minimal UI changes under `src/`.
 
-- build - Build for production
-- pack - Build libraries
-- preview - Preview production build
+**Do:** Preserve route/UI contracts unless asked. Reuse components/hooks. Token-driven styles. Ant Design styling order: component API → `theme.useToken()` + inline `style` → `className` + CSS. Lingui macros/catalogs for copy. Follow `src/components` and `src/routes` layout.
 
-### Manage Dependencies
+**Do not:** New UI libs when Ant Design suffices; bypass theme/store; CSS-first overrides when props/`styles` work; unrelated refactors in the same change.
 
-Vite+ automatically detects and wraps the underlying package manager such as pnpm, npm, or Yarn through the `packageManager` field in `package.json` or package manager-specific lockfiles.
+**Validation:** `pnpm exec vp check --no-fmt`; focused e2e when flows change.
 
-- add - Add packages to dependencies
-- remove (`rm`, `un`, `uninstall`) - Remove packages from dependencies
-- update (`up`) - Update packages to latest versions
-- dedupe - Deduplicate dependencies
-- outdated - Check for outdated packages
-- list (`ls`) - List installed packages
-- why (`explain`) - Show why a package is installed
-- info (`view`, `show`) - View package information from the registry
-- link (`ln`) / unlink - Manage local package links
-- pm - Forward a command to the package manager
+---
 
-### Maintain
+## API
 
-- upgrade - Update `vp` itself to the latest version
+**Purpose:** **schemas → `defineApi` modules → UI**; transport in `src/api/request.ts` only.
 
-These commands map to their corresponding tools. For example, `vp dev --port 3000` runs Vite's dev server and works the same as Vite. `vp test` runs JavaScript tests through the bundled Vitest. The version of all tools can be checked using `vp --version`. This is useful when researching documentation, features, and bugs.
+**Do:** Define APIs with `defineApi` in `src/api/<module>/index.ts` (`method` default `GET`; `params`/`query`/`body` + `output`). Zod in `src/api/<module>/schemas.ts`; shared helpers in `src/api/shared/`. MSW envelopes `{ code, data, message }` aligned with schemas. Co-locate query keys (e.g. `userQueryKeys`). `hydrateSession` from `@/api/auth` after login/register/session restore.
 
-## Common Pitfalls
+**Do not:** Call axios or `@/api/request` from routes/components — use resource functions (`listUsers`, …). Ad-hoc response shapes; skip schema parsing; mix unrelated domains in one module.
 
-- **Using the package manager directly:** Do not use pnpm, npm, or Yarn directly. Vite+ can handle all package manager operations.
-- **Always use Vite commands to run tools:** Don't attempt to run `vp vitest` or `vp oxlint`. They do not exist. Use `vp test` and `vp lint` instead.
-- **Running scripts:** Vite+ commands take precedence over `package.json` scripts. If there is a `test` script defined in `scripts` that conflicts with the built-in `vp test` command, run it using `vp run test`.
-- **Do not install Vitest, Oxlint, Oxfmt, or tsdown directly:** Vite+ wraps these tools. They must not be installed directly. You cannot upgrade these tools by installing their latest versions. Always use Vite+ commands.
-- **Use Vite+ wrappers for one-off binaries:** Use `vp dlx` instead of package-manager-specific `dlx`/`npx` commands.
-- **Import JavaScript modules from `vite-plus`:** Instead of importing from `vite` or `vitest`, all modules should be imported from the project's `vite-plus` dependency. For example, `import { defineConfig } from 'vite-plus';` or `import { expect, test, vi } from 'vite-plus/test';`. You must not install `vitest` to import test utilities.
-- **Type-Aware Linting:** There is no need to install `oxlint-tsgolint`, `vp lint --type-aware` works out of the box.
+**Validation:** `vp check --no-fmt`.
 
-## Review Checklist for Agents
+---
 
-- Run `vp install` after pulling remote changes and before getting started.
-- Run `vp check` and `vp test` to validate changes.
+## Testing
 
-## Monorepo git hooks
+**Purpose:** Fast, deterministic tests for core flows (auth, users CRUD, permissions).
 
-When this app lives under a monorepo, `git config core.hooksPath` may point at `.vite-hooks/_` here while commits run with the **repository root** as cwd. The checked-in `.vite-hooks/pre-commit` script dispatches `vp staged` into `apps/with-lingui` and `apps/basic` based on staged paths (and runs `pnpm --dir packages/create run check-types` for matching `packages/create` sources) so each app’s `vite.config.ts` is found.
+**Do:** User-visible assertions; reuse test helpers; keep mocks/schemas in sync; focused runs while iterating.
 
-## AI Instruction Files
+**Do not:** Brittle DOM-internal selectors; bloated fixtures; duplicate scenarios.
 
-This repository also uses scoped AI instruction files in `.github/instructions/`.
+**Validation:** Focused tests first; `pnpm exec vp check --no-fmt`; unit/hooks: `pnpm run test:unit`.
 
-- `frontend.instructions.md` for UI/routes/components/style work
-- `testing.instructions.md` for Playwright/MSW/test updates
-- `api.instructions.md` for API/schema/handler changes
-- `refactor.instructions.md` for behavior-preserving cleanup
-- `add-resource.instructions.md` for adding a new CRUD resource (checklist; mirror `users`)
+---
 
-See `.github/instructions/README.md` for usage and authoring rules.
+## Refactor
+
+**Purpose:** Less duplication, same behavior and public contracts.
+
+**Do:** One concern per change; extract shared utils/hooks/components; reviewable diffs; comments only when non-obvious.
+
+**Do not:** Behavior changes unless requested; broad renames; drop unique test coverage; heavy deps for tiny wins.
+
+**Considerations:** Main chunk ~135KB gzip ~41KB; vendor splits for antd/tanstack — avoid large extra UI libs. Validate at API boundaries (Zod), not app-wide runtime checks.
+
+**Validation:** `pnpm exec vp check --no-fmt`; significant changes → `vp build` and watch chunk sizes in log.
+
+---
+
+## Add CRUD resource
+
+Multi-step checklist (mirror **users**): use skill **`.agents/skills/add-resource/SKILL.md`** (invoke in Copilot/Codex/Claude or `@` that path in chat). After routes change, run `pnpm run build` to refresh `routeTree.gen.ts`.
diff --git a/apps/with-lingui/README.md b/apps/with-lingui/README.md
index 55f37ad..290d54f 100644
--- a/apps/with-lingui/README.md
+++ b/apps/with-lingui/README.md
@@ -2,8 +2,6 @@
 
 Balanced admin scaffold: i18n (Lingui), MSW mocks, minimal RBAC, full CRUD, and Playwright E2E — built with React 19, Ant Design 6, and Vite+. AI-friendly with clear patterns, shared abstractions, scoped AI instructions, and type-safe contracts at every boundary.
 
-**AI rules (Cursor):** `.cursor/rules/with-lingui-*.mdc` at the repo root mirrors `apps/with-lingui/.github/instructions/*.instructions.md` (same intent; `globs` align with each file’s `applyTo`). Prefer updating **both** when you change guidance.
-
 [antd](https://github.com/ant-design/ant-design)
 [react](https://react.dev)
 [vite](https://viteplus.dev)
@@ -27,7 +25,7 @@ Balanced admin scaffold: i18n (Lingui), MSW mocks, minimal RBAC, full CRUD, and
 | Icons        | [lucide-react](https://lucide.dev/guide/packages/lucide-react)         |
 | API Mocking  | [MSW 2.x](https://mswjs.io) (Service Worker based)                     |
 | E2E Testing  | [Playwright](https://playwright.dev)                                   |
-| Language     | TypeScript 5.9 (strict mode)                                           |
+| Language     | TypeScript (strict mode)                                               |
 
 ## Features
 
@@ -36,6 +34,7 @@ Balanced admin scaffold: i18n (Lingui), MSW mocks, minimal RBAC, full CRUD, and
 - **URL-First State** — Table search params (page, pageSize, keyword, sort) synced to URL
 - **i18n** — LinguiJS with English (`en`) and Chinese (`zh`); Ant Design locales wired in root
 - **Dark Mode** — One-click toggle with Ant Design theme algorithm
+- **Modular API layer** — `defineApi` modules under `src/api/<domain>/`, shared Zod helpers, single `API_PREFIX`
 - **Full Type Safety** — Zod schemas validate API boundaries at runtime where used
 - **Zero-Config Mocking** — MSW intercepts API calls in development, no backend needed
 
@@ -88,7 +87,7 @@ pnpm run test:unit
 
 ```bash
 pnpm run test:e2e
-pnpm run test:e2e:core
+pnpm run test:e2e -- e2e/login.spec.ts e2e/users.spec.ts   # core flows only
 pnpm run test:e2e:ui   # interactive UI mode
 ```
 
@@ -102,15 +101,21 @@ vp exec lingui extract -- --clean
 vp exec lingui compile
 
 # CI-oriented check: extract + ensure no pending locale diff
-pnpm run i18n:extract && git diff --exit-code -- src/locales
+pnpm run i18n:check
 ```
 
 ## Project Structure
 
 ```
-.github/instructions/          # Scoped AI guidance (frontend/testing/api/refactor/add-resource)
+AGENTS.md                      # Agent rules (frontend/api/testing/refactor)
+.agents/skills/add-resource/   # CRUD scaffold checklist (Skill)
 src/
-├── api/                       # Zod models + endpoint contracts
+├── api/                       # HTTP + contracts (see “API layer” below)
+│   ├── request.ts             # axios, defineApi, token refresh, envelope unwrap
+│   ├── schemas.ts             # deprecated barrel; prefer @/api/shared and module schemas
+│   ├── shared/                # API_PREFIX, pagination, params, menu, envelope helpers
+│   ├── auth/                  # paths, schemas, login/register/hydrateSession
+│   └── users/                 # schemas, listUsers CRUD, userQueryKeys, path constants
 ├── components/                # Reusable UI primitives and layout shells
 │   ├── Layout/                # MainLayout, Header, Sidebar, UserMenu, AppFooter
 │   ├── DataTable/             # Shared table frame/skeleton/empty state
@@ -153,7 +158,7 @@ src/
 │   ├── 404/index.tsx
 │   └── index.tsx
 ├── stores/                    # Persisted auth/settings stores
-├── utils/                     # HTTP client, constants, session/menu helpers
+├── utils/                     # constants, app menu helpers
 ├── main.tsx                   # App bootstrap (MSW init + React render)
 └── routeTree.gen.ts           # Generated TanStack route tree
 
@@ -167,9 +172,13 @@ e2e/                           # Playwright E2E suites
 
 ```
 
+## API layer
+
+Same layout as [`apps/basic`](../basic/): **schemas → `defineApi` in `src/api/<module>/index.ts` → UI imports `@/api/users`, `@/api/auth`, etc.** Transport stays in `request.ts`; path constants (`API_PREFIX`, `AUTH_ENDPOINTS`, `USERS_PATH`) are shared with MSW handlers.
+
 ## Internationalization (i18n)
 
-The project uses [LinguiJS](https://lingui.dev) with compile-time macros. Locales: `**en**` (source) and `**zh**`.
+The project uses [LinguiJS](https://lingui.dev) with compile-time macros. Locales: **en** (source) and **zh**.
 
 ### Workflow
 
@@ -182,15 +191,13 @@ Ant Design strings follow the active locale via `ConfigProvider` in `__root.tsx`
 
 ## Extending the template
 
-- **New CRUD resource:** See `.github/instructions/add-resource.instructions.md` (checklist; copy from `users`), then `pnpm run i18n:extract && pnpm run i18n:compile`, wire Sidebar labels/icons if needed (§6b in that doc), and `pnpm exec vp check --no-fmt`.
+- **New CRUD resource:** Follow `.agents/skills/add-resource/SKILL.md` (mirror `users`), then `pnpm run i18n:extract && pnpm run i18n:compile`, and `pnpm run check`.
 - **Real backend:** Point `VITE_API_BASE_URL` in env and disable or remove MSW in `main.tsx` when you no longer need mocks.
 - **Drop i18n:** Remove Lingui packages, vite/swc plugins, and replace `t` macros with plain strings (larger refactor).
 
-### AI instruction files
+### AI guidance
 
-**Single source of truth**: `apps/with-lingui/.github/instructions/` (`*.instructions.md`). Both humans and agents should maintain and review guidance from this directory.
-
-**Cursor**: The root `.cursor/rules/with-lingui-*.mdc` files are intentionally thin rules (Approach A), containing only scope and pointer paths. Keep `globs` aligned with each instruction file's `applyTo`; for full details, reference the target `.instructions.md` file in chat with `@` or open it directly.
+**Single source of truth:** **`AGENTS.md`** in this app (commands + Frontend/API/Testing/Refactor rules). New CRUD flows: `@.agents/skills/add-resource/SKILL.md`.
 
 ## Developer Notes
 
diff --git a/apps/with-lingui/package.json b/apps/with-lingui/package.json
index 5cfe60f..5b8527c 100644
--- a/apps/with-lingui/package.json
+++ b/apps/with-lingui/package.json
@@ -24,6 +24,7 @@
     "@tanstack/react-query": "^5.104.3",
     "@tanstack/react-router": "^1.170.45",
     "antd": "^6.6.6",
+    "axios": "^1.20.0",
     "lucide-react": "^1.59.0",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
diff --git a/apps/with-lingui/public/mockServiceWorker.js b/apps/with-lingui/public/mockServiceWorker.js
index 0c970ef..04919bb 100644
--- a/apps/with-lingui/public/mockServiceWorker.js
+++ b/apps/with-lingui/public/mockServiceWorker.js
@@ -7,114 +7,111 @@
  * - Please do NOT modify this file.
  */
 
-const PACKAGE_VERSION = '2.15.0'
-const INTEGRITY_CHECKSUM = '03cb67ac84128e63d7cd722a6e5b7f1e'
-const IS_MOCKED_RESPONSE = Symbol('isMockedResponse')
-const activeClientIds = new Set()
+const PACKAGE_VERSION = "2.15.0";
+const INTEGRITY_CHECKSUM = "03cb67ac84128e63d7cd722a6e5b7f1e";
+const IS_MOCKED_RESPONSE = Symbol("isMockedResponse");
+const activeClientIds = new Set();
 
-addEventListener('install', function () {
-  self.skipWaiting()
-})
+addEventListener("install", function () {
+  self.skipWaiting();
+});
 
-addEventListener('activate', function (event) {
-  event.waitUntil(self.clients.claim())
-})
+addEventListener("activate", function (event) {
+  event.waitUntil(self.clients.claim());
+});
 
-addEventListener('message', async function (event) {
-  const clientId = Reflect.get(event.source || {}, 'id')
+addEventListener("message", async function (event) {
+  const clientId = Reflect.get(event.source || {}, "id");
 
   if (!clientId || !self.clients) {
-    return
+    return;
   }
 
-  const client = await self.clients.get(clientId)
+  const client = await self.clients.get(clientId);
 
   if (!client) {
-    return
+    return;
   }
 
   const allClients = await self.clients.matchAll({
-    type: 'window',
-  })
+    type: "window",
+  });
 
   switch (event.data) {
-    case 'KEEPALIVE_REQUEST': {
+    case "KEEPALIVE_REQUEST": {
       sendToClient(client, {
-        type: 'KEEPALIVE_RESPONSE',
-      })
-      break
+        type: "KEEPALIVE_RESPONSE",
+      });
+      break;
     }
 
-    case 'INTEGRITY_CHECK_REQUEST': {
+    case "INTEGRITY_CHECK_REQUEST": {
       sendToClient(client, {
-        type: 'INTEGRITY_CHECK_RESPONSE',
+        type: "INTEGRITY_CHECK_RESPONSE",
         payload: {
           packageVersion: PACKAGE_VERSION,
           checksum: INTEGRITY_CHECKSUM,
         },
-      })
-      break
+      });
+      break;
     }
 
-    case 'MOCK_ACTIVATE': {
-      activeClientIds.add(clientId)
+    case "MOCK_ACTIVATE": {
+      activeClientIds.add(clientId);
 
       sendToClient(client, {
-        type: 'MOCKING_ENABLED',
+        type: "MOCKING_ENABLED",
         payload: {
           client: {
             id: client.id,
             frameType: client.frameType,
           },
         },
-      })
-      break
+      });
+      break;
     }
 
-    case 'CLIENT_CLOSED': {
-      activeClientIds.delete(clientId)
+    case "CLIENT_CLOSED": {
+      activeClientIds.delete(clientId);
 
       const remainingClients = allClients.filter((client) => {
-        return client.id !== clientId
-      })
+        return client.id !== clientId;
+      });
 
       // Unregister itself when there are no more clients
       if (remainingClients.length === 0) {
-        self.registration.unregister()
+        self.registration.unregister();
       }
 
-      break
+      break;
     }
   }
-})
+});
 
-addEventListener('fetch', function (event) {
-  const requestInterceptedAt = Date.now()
+addEventListener("fetch", function (event) {
+  const requestInterceptedAt = Date.now();
 
   // Bypass navigation requests.
-  if (event.request.mode === 'navigate') {
-    return
+  if (event.request.mode === "navigate") {
+    return;
   }
 
   // Opening the DevTools triggers the "only-if-cached" request
   // that cannot be handled by the worker. Bypass such requests.
-  if (
-    event.request.cache === 'only-if-cached' &&
-    event.request.mode !== 'same-origin'
-  ) {
-    return
+  if (event.request.cache === "only-if-cached" && event.request.mode !== "same-origin") {
+    return;
   }
 
   // Bypass all requests when there are no active clients.
   // Prevents the self-unregistered worked from handling requests
   // after it's been terminated (still remains active until the next reload).
   if (activeClientIds.size === 0) {
-    return
+    return;
   }
 
-  const requestId = crypto.randomUUID()
-  event.respondWith(handleRequest(event, requestId, requestInterceptedAt))
-})
+  const requestId = crypto.randomUUID();
+  event.respondWith(handleRequest(event, requestId, requestInterceptedAt));
+});
 
 /**
  * @param {FetchEvent} event
@@ -122,20 +119,15 @@ addEventListener('fetch', function (event) {
  * @param {number} requestInterceptedAt
  */
 async function handleRequest(event, requestId, requestInterceptedAt) {
-  const client = await resolveMainClient(event)
-  const requestCloneForEvents = event.request.clone()
-  const response = await getResponse(
-    event,
-    client,
-    requestId,
-    requestInterceptedAt,
-  )
+  const client = await resolveMainClient(event);
+  const requestCloneForEvents = event.request.clone();
+  const response = await getResponse(event, client, requestId, requestInterceptedAt);
 
   // Send back the response clone for the "response:*" life-cycle events.
   // Ensure MSW is active and ready to handle the message, otherwise
   // this message will pend indefinitely.
   if (client && activeClientIds.has(client.id)) {
-    const serializedRequest = await serializeRequest(requestCloneForEvents)
+    const serializedRequest = await serializeRequest(requestCloneForEvents);
 
     // Omit the body of server-sent event stream responses.
     // Cloning such responses would prevent client-side stream cancelations
@@ -143,17 +135,17 @@ async function handleRequest(event, requestId, requestInterceptedAt) {
     // source once both of its branches cancel) and would buffer the
     // entire stream into the unconsumed clone indefinitely.
     const isEventStreamResponse = response.headers
-      .get('content-type')
+      .get("content-type")
       ?.toLowerCase()
-      .startsWith('text/event-stream')
+      .startsWith("text/event-stream");
 
     // Clone the response so both the client and the library could consume it.
-    const responseClone = isEventStreamResponse ? null : response.clone()
+    const responseClone = isEventStreamResponse ? null : response.clone();
 
     sendToClient(
       client,
       {
-        type: 'RESPONSE',
+        type: "RESPONSE",
         payload: {
           isMockedResponse: IS_MOCKED_RESPONSE in response,
           request: {
@@ -169,13 +161,11 @@ async function handleRequest(event, requestId, requestInterceptedAt) {
           },
         },
       },
-      responseClone && responseClone.body
-        ? [serializedRequest.body, responseClone.body]
-        : [],
-    )
+      responseClone && responseClone.body ? [serializedRequest.body, responseClone.body] : [],
+    );
   }
 
-  return response
+  return response;
 }
 
 /**
@@ -187,30 +177,30 @@ async function handleRequest(event, requestId, requestInterceptedAt) {
  * @returns {Promise<Client | undefined>}
  */
 async function resolveMainClient(event) {
-  const client = await self.clients.get(event.clientId)
+  const client = await self.clients.get(event.clientId);
 
   if (activeClientIds.has(event.clientId)) {
-    return client
+    return client;
   }
 
-  if (client?.frameType === 'top-level') {
-    return client
+  if (client?.frameType === "top-level") {
+    return client;
   }
 
   const allClients = await self.clients.matchAll({
-    type: 'window',
-  })
+    type: "window",
+  });
 
   return allClients
     .filter((client) => {
       // Get only those clients that are currently visible.
-      return client.visibilityState === 'visible'
+      return client.visibilityState === "visible";
     })
     .find((client) => {
       // Find the client ID that's recorded in the
       // set of clients that have registered the worker.
-      return activeClientIds.has(client.id)
-    })
+      return activeClientIds.has(client.id);
+    });
 }
 
 /**
@@ -223,36 +213,34 @@ async function resolveMainClient(event) {
 async function getResponse(event, client, requestId, requestInterceptedAt) {
   // Clone the request because it might've been already used
   // (i.e. its body has been read and sent to the client).
-  const requestClone = event.request.clone()
+  const requestClone = event.request.clone();
 
   function passthrough() {
     // Cast the request headers to a new Headers instance
     // so the headers can be manipulated with.
-    const headers = new Headers(requestClone.headers)
+    const headers = new Headers(requestClone.headers);
 
     // Remove the "accept" header value that marked this request as passthrough.
     // This prevents request alteration and also keeps it compliant with the
     // user-defined CORS policies.
-    const acceptHeader = headers.get('accept')
+    const acceptHeader = headers.get("accept");
     if (acceptHeader) {
-      const values = acceptHeader.split(',').map((value) => value.trim())
-      const filteredValues = values.filter(
-        (value) => value !== 'msw/passthrough',
-      )
+      const values = acceptHeader.split(",").map((value) => value.trim());
+      const filteredValues = values.filter((value) => value !== "msw/passthrough");
 
       if (filteredValues.length > 0) {
-        headers.set('accept', filteredValues.join(', '))
+        headers.set("accept", filteredValues.join(", "));
       } else {
-        headers.delete('accept')
+        headers.delete("accept");
       }
     }
 
-    return fetch(requestClone, { headers })
+    return fetch(requestClone, { headers });
   }
 
   // Bypass mocking when the client is not active.
   if (!client) {
-    return passthrough()
+    return passthrough();
   }
 
   // Bypass initial page load requests (i.e. static assets).
@@ -260,15 +248,15 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
   // means that MSW hasn't dispatched the "MOCK_ACTIVATE" event yet
   // and is not ready to handle requests.
   if (!activeClientIds.has(client.id)) {
-    return passthrough()
+    return passthrough();
   }
 
   // Notify the client that a request has been intercepted.
-  const serializedRequest = await serializeRequest(event.request)
+  const serializedRequest = await serializeRequest(event.request);
   const clientMessage = await sendToClient(
     client,
     {
-      type: 'REQUEST',
+      type: "REQUEST",
       payload: {
         id: requestId,
         interceptedAt: requestInterceptedAt,
@@ -276,19 +264,19 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
       },
     },
     [serializedRequest.body],
-  )
+  );
 
   switch (clientMessage.type) {
-    case 'MOCK_RESPONSE': {
-      return respondWithMock(clientMessage.data)
+    case "MOCK_RESPONSE": {
+      return respondWithMock(clientMessage.data);
     }
 
-    case 'PASSTHROUGH': {
-      return passthrough()
+    case "PASSTHROUGH": {
+      return passthrough();
     }
   }
 
-  return passthrough()
+  return passthrough();
 }
 
 /**
@@ -299,21 +287,18 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
  */
 function sendToClient(client, message, transferrables = []) {
   return new Promise((resolve, reject) => {
-    const channel = new MessageChannel()
+    const channel = new MessageChannel();
 
     channel.port1.onmessage = (event) => {
       if (event.data && event.data.error) {
-        return reject(event.data.error)
+        return reject(event.data.error);
       }
 
-      resolve(event.data)
-    }
+      resolve(event.data);
+    };
 
-    client.postMessage(message, [
-      channel.port2,
-      ...transferrables.filter(Boolean),
-    ])
-  })
+    client.postMessage(message, [channel.port2, ...transferrables.filter(Boolean)]);
+  });
 }
 
 /**
@@ -326,17 +311,17 @@ function respondWithMock(response) {
   // instance will have status code set to 0. Since it's not possible to create
   // a Response instance with status code 0, handle that use-case separately.
   if (response.status === 0) {
-    return Response.error()
+    return Response.error();
   }
 
-  const mockedResponse = new Response(response.body, response)
+  const mockedResponse = new Response(response.body, response);
 
   Reflect.defineProperty(mockedResponse, IS_MOCKED_RESPONSE, {
     value: true,
     enumerable: true,
-  })
+  });
 
-  return mockedResponse
+  return mockedResponse;
 }
 
 /**
@@ -357,5 +342,5 @@ async function serializeRequest(request) {
     referrerPolicy: request.referrerPolicy,
     body: await request.arrayBuffer(),
     keepalive: request.keepalive,
-  }
+  };
 }
diff --git a/apps/with-lingui/src/api/auth.ts b/apps/with-lingui/src/api/auth.ts
deleted file mode 100644
index 2d4314e..0000000
--- a/apps/with-lingui/src/api/auth.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import type {
-  AuthTokens,
-  LoginRequest,
-  User,
-  MenuItem,
-  PermissionsList,
-  RegisterRequest,
-} from "./schemas";
-
-export const AUTH_ENDPOINTS = {
-  login: "/api/auth/login",
-  register: "/api/auth/register",
-  refresh: "/api/auth/refresh",
-  logout: "/api/auth/logout",
-  user: "/api/auth/user",
-  permissions: "/api/auth/permissions",
-} as const;
-
-export type { AuthTokens, LoginRequest, User, MenuItem, PermissionsList, RegisterRequest };
diff --git a/apps/with-lingui/src/api/auth/index.ts b/apps/with-lingui/src/api/auth/index.ts
new file mode 100644
index 0000000..435bd78
--- /dev/null
+++ b/apps/with-lingui/src/api/auth/index.ts
@@ -0,0 +1,63 @@
+import { z } from "zod/v4";
+import { defineApi } from "@/api/request";
+import {
+  AuthTokensSchema,
+  AuthUserResponseSchema,
+  LoginRequestSchema,
+  PermissionsListSchema,
+  RegisterRequestSchema,
+} from "@/api/auth/schemas";
+import type {
+  AuthTokens,
+  LoginRequest,
+  PermissionsList,
+  RegisterRequest,
+} from "@/api/auth/schemas";
+import { UserSchema, type User } from "@/api/users/schemas";
+import { AUTH_ENDPOINTS } from "@/api/auth/paths";
+import { APP_MENU_TREE, filterMenuTreeByPermissions } from "@/utils/appMenu";
+import { useAuthStore } from "@/stores/auth";
+
+export { AUTH_ENDPOINTS } from "@/api/auth/paths";
+
+export const login = defineApi({
+  method: "POST",
+  path: AUTH_ENDPOINTS.login,
+  body: LoginRequestSchema,
+  output: AuthTokensSchema,
+});
+
+export const register = defineApi({
+  method: "POST",
+  path: AUTH_ENDPOINTS.register,
+  body: RegisterRequestSchema,
+  output: AuthTokensSchema,
+});
+
+export const logout = defineApi({
+  method: "POST",
+  path: AUTH_ENDPOINTS.logout,
+  output: z.null(),
+});
+
+export const getAuthUser = defineApi({
+  path: AUTH_ENDPOINTS.user,
+  output: AuthUserResponseSchema,
+});
+
+export const getPermissions = defineApi({
+  path: AUTH_ENDPOINTS.permissions,
+  output: PermissionsListSchema,
+});
+
+/** Fetches user + permissions, then updates auth store `user` and sidebar `menus`. */
+export async function hydrateSession(): Promise<void> {
+  const [userBase, permissions] = await Promise.all([getAuthUser(), getPermissions()]);
+  const user = UserSchema.parse({ ...userBase, permissions });
+  const menus = filterMenuTreeByPermissions(APP_MENU_TREE, permissions);
+  const { setUser, setMenus } = useAuthStore.getState();
+  setUser(user);
+  setMenus(menus);
+}
+
+export type { AuthTokens, LoginRequest, User, PermissionsList, RegisterRequest };
diff --git a/apps/with-lingui/src/api/auth/paths.ts b/apps/with-lingui/src/api/auth/paths.ts
new file mode 100644
index 0000000..4891120
--- /dev/null
+++ b/apps/with-lingui/src/api/auth/paths.ts
@@ -0,0 +1,12 @@
+import { API_PREFIX } from "@/api/shared/prefix";
+
+const AUTH_BASE = `${API_PREFIX}/auth`;
+
+export const AUTH_ENDPOINTS = {
+  login: `${AUTH_BASE}/login`,
+  register: `${AUTH_BASE}/register`,
+  refresh: `${AUTH_BASE}/refresh`,
+  logout: `${AUTH_BASE}/logout`,
+  user: `${AUTH_BASE}/user`,
+  permissions: `${AUTH_BASE}/permissions`,
+} as const;
diff --git a/apps/with-lingui/src/api/auth/schemas.ts b/apps/with-lingui/src/api/auth/schemas.ts
new file mode 100644
index 0000000..9b22c4e
--- /dev/null
+++ b/apps/with-lingui/src/api/auth/schemas.ts
@@ -0,0 +1,48 @@
+import { z } from "zod/v4";
+import { UserSchema } from "@/api/users/schemas";
+
+/** GET `/api/auth/user` body (no `permissions`; load via `/api/auth/permissions`). */
+export const AuthUserResponseSchema = UserSchema.omit({ permissions: true });
+export type AuthUserResponse = z.infer<typeof AuthUserResponseSchema>;
+
+export const AuthTokensSchema = z.object({
+  accessToken: z.string().min(1),
+  refreshToken: z.string().min(1),
+});
+
+export type AuthTokens = z.infer<typeof AuthTokensSchema>;
+
+export const RefreshTokenRequestSchema = z.object({
+  refreshToken: z.string().min(1),
+});
+
+export type RefreshTokenRequest = z.infer<typeof RefreshTokenRequestSchema>;
+
+export const LoginRequestSchema = z.object({
+  username: z.string().min(1),
+  password: z.string().min(1),
+});
+
+export type LoginRequest = z.infer<typeof LoginRequestSchema>;
+
+/** Ant Design Form may submit `""` for an empty optional email */
+const registerOptionalEmailSchema = z
+  .union([z.string(), z.undefined()])
+  .transform((v) => {
+    if (v === undefined) return undefined;
+    const t = String(v).trim();
+    return t === "" ? undefined : t;
+  })
+  .pipe(z.union([z.string().email(), z.undefined()]));
+
+export const RegisterRequestSchema = z.object({
+  username: z.string().min(1),
+  password: z.string().min(6),
+  email: registerOptionalEmailSchema,
+});
+
+export type RegisterRequest = z.infer<typeof RegisterRequestSchema>;
+
+export const PermissionsListSchema = z.array(z.string());
+
+export type PermissionsList = z.infer<typeof PermissionsListSchema>;
diff --git a/apps/with-lingui/src/api/request.ts b/apps/with-lingui/src/api/request.ts
new file mode 100644
index 0000000..0a9ab36
--- /dev/null
+++ b/apps/with-lingui/src/api/request.ts
@@ -0,0 +1,302 @@
+import axios, { type AxiosError, type InternalAxiosRequestConfig } from "axios";
+import { z } from "zod/v4";
+import { API_BASE_URL } from "@/utils/constants";
+import { AuthTokensSchema, RefreshTokenRequestSchema } from "@/api/auth/schemas";
+import { getAccessToken, useAuthStore } from "@/stores/auth";
+
+import { AUTH_ENDPOINTS } from "@/api/auth/paths";
+
+/** Avoid importing `@/api/auth` index here (circular with `defineApi` consumers). */
+const REFRESH_PATH = AUTH_ENDPOINTS.refresh;
+
+export class ApiError extends Error {
+  code: number;
+  constructor(code: number, message: string) {
+    super(message);
+    this.name = "ApiError";
+    this.code = code;
+  }
+}
+
+export class HttpError extends Error {
+  status: number;
+  constructor(status: number, message: string) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+  }
+}
+
+type HttpRouter = {
+  navigate: (opts: { to: string }) => void | Promise<void>;
+};
+
+let httpRouter: HttpRouter | null = null;
+
+export function installHttpRouter(router: HttpRouter): void {
+  httpRouter = router;
+}
+
+function navigateTo403(): void {
+  void httpRouter?.navigate({ to: "/403" });
+}
+
+function navigateToLogin(): void {
+  void httpRouter?.navigate({ to: "/login" });
+}
+
+type RequestConfig = InternalAxiosRequestConfig & {
+  skipAuthRefresh?: boolean;
+  _retry?: boolean;
+};
+
+export type CallOptions = {
+  signal?: AbortSignal;
+};
+
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+
+type Envelope = {
+  code?: number;
+  data?: unknown;
+  message?: string;
+};
+
+function cleanParams(params?: Record<string, unknown>): Record<string, unknown> | undefined {
+  if (!params) return undefined;
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(params)) {
+    if (value != null) out[key] = value;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
+function unwrapEnvelope(json: unknown): unknown {
+  if (json == null || typeof json !== "object") return json;
+  const envelope = json as Envelope;
+  if (envelope.code !== undefined && envelope.code !== 0) {
+    throw new ApiError(envelope.code, envelope.message ?? "Unknown error");
+  }
+  if (envelope.code !== undefined && envelope.data !== undefined) {
+    return envelope.data;
+  }
+  return json;
+}
+
+const client = axios.create({
+  baseURL: API_BASE_URL,
+  timeout: 15_000,
+  headers: { "Content-Type": "application/json" },
+});
+
+client.interceptors.request.use((config) => {
+  const token = getAccessToken();
+  if (token) {
+    config.headers.Authorization = `Bearer ${token}`;
+  }
+  return config;
+});
+
+let inflightRefresh: Promise<boolean> | null = null;
+
+async function doRefreshSessionTokens(): Promise<boolean> {
+  const { tokens, setTokens, logout } = useAuthStore.getState();
+  const refreshToken = tokens?.refreshToken;
+  if (!refreshToken) {
+    logout();
+    navigateToLogin();
+    return false;
+  }
+
+  const body = RefreshTokenRequestSchema.parse({ refreshToken });
+
+  try {
+    const res = await client.post(REFRESH_PATH, body, {
+      skipAuthRefresh: true,
+    } as RequestConfig);
+    const next = AuthTokensSchema.parse(res.data);
+    setTokens(next);
+    return true;
+  } catch {
+    logout();
+    navigateToLogin();
+    return false;
+  }
+}
+
+async function refreshSessionTokens(): Promise<boolean> {
+  if (inflightRefresh) return inflightRefresh;
+  inflightRefresh = doRefreshSessionTokens().finally(() => {
+    inflightRefresh = null;
+  });
+  return inflightRefresh;
+}
+
+client.interceptors.response.use(
+  (response) => {
+    response.data = unwrapEnvelope(response.data);
+    return response;
+  },
+  async (error: AxiosError) => {
+    const status = error.response?.status;
+    const config = error.config as RequestConfig | undefined;
+
+    if (
+      status === 401 &&
+      config &&
+      !config._retry &&
+      !config.skipAuthRefresh &&
+      config.url !== REFRESH_PATH &&
+      !config.url?.endsWith(REFRESH_PATH)
+    ) {
+      config._retry = true;
+      const refreshed = await refreshSessionTokens();
+      if (refreshed) {
+        return client.request(config);
+      }
+      throw new HttpError(401, "Unauthorized");
+    }
+
+    if (status === 403) {
+      navigateTo403();
+      throw new HttpError(403, "Forbidden");
+    }
+
+    if (status != null) {
+      throw new HttpError(status, `HTTP ${status}: ${error.response?.statusText ?? "Error"}`);
+    }
+
+    throw error;
+  },
+);
+
+async function transportRequest<T>(opts: {
+  method: HttpMethod;
+  url: string;
+  params?: Record<string, unknown>;
+  body?: unknown;
+  signal?: AbortSignal;
+  skipAuthRefresh?: boolean;
+}): Promise<T> {
+  const res = await client.request<T>({
+    method: opts.method,
+    url: opts.url,
+    params: cleanParams(opts.params),
+    data: opts.body,
+    signal: opts.signal,
+    skipAuthRefresh: opts.skipAuthRefresh,
+  } as RequestConfig);
+  return res.data;
+}
+
+type ApiDefConfig<
+  TParams extends z.ZodType | undefined,
+  TQuery extends z.ZodType | undefined,
+  TBody extends z.ZodType | undefined,
+  TOut extends z.ZodType,
+> = {
+  method?: HttpMethod;
+  path: string;
+  params?: TParams;
+  query?: TQuery;
+  body?: TBody;
+  output: TOut;
+};
+
+type CallArgs<
+  TParams extends z.ZodType | undefined,
+  TQuery extends z.ZodType | undefined,
+  TBody extends z.ZodType | undefined,
+> = TParams extends z.ZodType
+  ? TQuery extends z.ZodType
+    ? TBody extends z.ZodType
+      ? { params: z.infer<TParams>; query: z.infer<TQuery>; body: z.infer<TBody> }
+      : { params: z.infer<TParams>; query: z.infer<TQuery> }
+    : TBody extends z.ZodType
+      ? { params: z.infer<TParams>; body: z.infer<TBody> }
+      : z.infer<TParams>
+  : TQuery extends z.ZodType
+    ? TBody extends z.ZodType
+      ? { query: z.infer<TQuery>; body: z.infer<TBody> }
+      : z.infer<TQuery>
+    : TBody extends z.ZodType
+      ? z.infer<TBody>
+      : void;
+
+function renderPath(path: string, params?: Record<string, unknown>): string {
+  if (!params) return path;
+  let url = path;
+  for (const [key, value] of Object.entries(params)) {
+    url = url.replace(`:${key}`, encodeURIComponent(String(value)));
+  }
+  return url;
+}
+
+export function defineApi<
+  TParams extends z.ZodType | undefined = undefined,
+  TQuery extends z.ZodType | undefined = undefined,
+  TBody extends z.ZodType | undefined = undefined,
+  TOut extends z.ZodType = z.ZodType,
+>(
+  def: ApiDefConfig<TParams, TQuery, TBody, TOut>,
+): (
+  ...args: CallArgs<TParams, TQuery, TBody> extends void
+    ? [options?: CallOptions]
+    : [args: CallArgs<TParams, TQuery, TBody>, options?: CallOptions]
+) => Promise<z.infer<TOut>> {
+  const method: HttpMethod = def.method ?? "GET";
+  const segmentCount = (def.params ? 1 : 0) + (def.query ? 1 : 0) + (def.body ? 1 : 0);
+
+  return async (...allArgs: unknown[]): Promise<z.infer<TOut>> => {
+    let callArgs: unknown;
+    let options: CallOptions | undefined;
+
+    if (segmentCount === 0) {
+      options = allArgs[0] as CallOptions | undefined;
+    } else {
+      callArgs = allArgs[0];
+      options = allArgs[1] as CallOptions | undefined;
+    }
+
+    let params: Record<string, unknown> | undefined;
+    let query: Record<string, unknown> | undefined;
+    let body: unknown;
+
+    if (segmentCount === 0) {
+      // no input segments
+    } else if (segmentCount === 1) {
+      if (def.params) {
+        params = def.params.parse(callArgs) as Record<string, unknown>;
+      } else if (def.query) {
+        query = def.query.parse(callArgs) as Record<string, unknown>;
+      } else if (def.body) {
+        body = def.body.parse(callArgs);
+      }
+    } else {
+      const shaped = (callArgs ?? {}) as {
+        params?: unknown;
+        query?: unknown;
+        body?: unknown;
+      };
+      if (def.params) {
+        params = def.params.parse(shaped.params) as Record<string, unknown>;
+      }
+      if (def.query) {
+        query = def.query.parse(shaped.query) as Record<string, unknown>;
+      }
+      if (def.body) {
+        body = def.body.parse(shaped.body);
+      }
+    }
+
+    const data = await transportRequest<unknown>({
+      method,
+      url: renderPath(def.path, params),
+      params: query,
+      body: def.body ? body : undefined,
+      signal: options?.signal,
+    });
+
+    return def.output.parse(data) as z.infer<TOut>;
+  };
+}
diff --git a/apps/with-lingui/src/api/schemas.ts b/apps/with-lingui/src/api/schemas.ts
index cbe72d4..9544b0a 100644
--- a/apps/with-lingui/src/api/schemas.ts
+++ b/apps/with-lingui/src/api/schemas.ts
@@ -1,154 +1,4 @@
-import { z } from "zod/v4";
-
-export const UserSchema = z.object({
-  id: z.string(),
-  username: z.string(),
-  avatar: z.string().nullable(),
-  email: z.string().nullable(),
-  roles: z.array(z.string()),
-  permissions: z.array(z.string()),
-});
-
-export type User = z.infer<typeof UserSchema>;
-
-export const AuthUserResponseSchema = UserSchema.omit({ permissions: true });
-export type AuthUserResponse = z.infer<typeof AuthUserResponseSchema>;
-
-export const AuthTokensSchema = z.object({
-  accessToken: z.string().min(1),
-  refreshToken: z.string().min(1),
-});
-
-export type AuthTokens = z.infer<typeof AuthTokensSchema>;
-
-export const RefreshTokenRequestSchema = z.object({
-  refreshToken: z.string().min(1),
-});
-
-export type RefreshTokenRequest = z.infer<typeof RefreshTokenRequestSchema>;
-
-export const LoginRequestSchema = z.object({
-  username: z.string().min(1),
-  password: z.string().min(1),
-});
-
-export type LoginRequest = z.infer<typeof LoginRequestSchema>;
-
-/** Ant Design Form may submit `""` for an empty optional email */
-const registerOptionalEmailSchema = z
-  .union([z.string(), z.undefined()])
-  .transform((v) => {
-    if (v === undefined) return undefined;
-    const t = String(v).trim();
-    return t === "" ? undefined : t;
-  })
-  .pipe(z.union([z.string().email(), z.undefined()]));
-
-export const RegisterRequestSchema = z.object({
-  username: z.string().min(1),
-  password: z.string().min(6),
-  email: registerOptionalEmailSchema,
-});
-
-export type RegisterRequest = z.infer<typeof RegisterRequestSchema>;
-
-export const PermissionsListSchema = z.array(z.string());
-
-export type PermissionsList = z.infer<typeof PermissionsListSchema>;
-
-const BaseMenuNodeSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  icon: z.string().nullable(),
-  permissions: z.array(z.string()).nullable(),
-  sort: z.int(),
-  hidden: z.boolean(),
-});
-
-export type MenuItem =
-  | (z.infer<typeof BaseMenuNodeSchema> & {
-      kind: "item";
-      path: string;
-      children: MenuItem[] | null;
-    })
-  | (z.infer<typeof BaseMenuNodeSchema> & {
-      kind: "group";
-      path: null;
-      children: MenuItem[];
-    });
-
-export const MenuItemSchema: z.ZodType<MenuItem> = z.lazy(() =>
-  z.discriminatedUnion("kind", [
-    BaseMenuNodeSchema.extend({
-      kind: z.literal("item"),
-      path: z.string(),
-      children: z.array(MenuItemSchema).nullable(),
-    }),
-    BaseMenuNodeSchema.extend({
-      kind: z.literal("group"),
-      path: z.null(),
-      children: z.array(MenuItemSchema),
-    }),
-  ]),
-);
-
-export function ApiResponseSchema<T extends z.ZodTypeAny>(dataSchema: T) {
-  return z.object({
-    code: z.int(),
-    data: dataSchema,
-    message: z.string(),
-  });
-}
-
-export type ApiResponse<T> = {
-  code: number;
-  data: T;
-  message: string;
-};
-
-export function PaginatedResponseSchema<T extends z.ZodTypeAny>(itemSchema: T) {
-  return z.object({
-    code: z.int(),
-    data: z.object({
-      list: z.array(itemSchema),
-      total: z.int(),
-    }),
-    message: z.string(),
-  });
-}
-
-export type PaginatedData<T> = {
-  list: T[];
-  total: number;
-};
-
-export const SearchParamsSchema = z.object({
-  page: z.number().int().positive().catch(1),
-  pageSize: z.number().int().positive().catch(10),
-  sortField: z.string().nullable().catch(null),
-  sortOrder: z.enum(["ascend", "descend"]).nullable().catch(null),
-});
-
-export type SearchParams = z.infer<typeof SearchParamsSchema>;
-
-/** Ant Design Input submits `""` when empty; treat as null for optional email */
-const createUserEmailSchema = z
-  .union([z.string(), z.null(), z.undefined()])
-  .transform((v) => {
-    if (v == null) return null;
-    const t = String(v).trim();
-    return t === "" ? null : t;
-  })
-  .pipe(z.union([z.string().email(), z.null()]));
-
-export const CreateUserRequestSchema = z.object({
-  username: z.string().min(1),
-  email: createUserEmailSchema,
-  roles: z.array(z.string()).min(1),
-});
-
-export type CreateUserRequest = z.infer<typeof CreateUserRequestSchema>;
-
-export const UpdateUserRequestSchema = CreateUserRequestSchema.partial();
-
-export type UpdateUserRequest = z.infer<typeof UpdateUserRequestSchema>;
+/** @deprecated Import from `@/api/<module>/schemas` or `@/api/shared`; re-exports for compatibility. */
+export * from "@/api/shared";
+export * from "@/api/users/schemas";
+export * from "@/api/auth/schemas";
diff --git a/apps/with-lingui/src/api/shared/envelope.ts b/apps/with-lingui/src/api/shared/envelope.ts
new file mode 100644
index 0000000..7d855e7
--- /dev/null
+++ b/apps/with-lingui/src/api/shared/envelope.ts
@@ -0,0 +1,26 @@
+import { z } from "zod/v4";
+
+export function ApiResponseSchema<T extends z.ZodTypeAny>(dataSchema: T) {
+  return z.object({
+    code: z.int(),
+    data: dataSchema,
+    message: z.string(),
+  });
+}
+
+export type ApiResponse<T> = {
+  code: number;
+  data: T;
+  message: string;
+};
+
+export function PaginatedResponseSchema<T extends z.ZodTypeAny>(itemSchema: T) {
+  return z.object({
+    code: z.int(),
+    data: z.object({
+      list: z.array(itemSchema),
+      total: z.int(),
+    }),
+    message: z.string(),
+  });
+}
diff --git a/apps/with-lingui/src/api/shared/index.ts b/apps/with-lingui/src/api/shared/index.ts
new file mode 100644
index 0000000..3a98f45
--- /dev/null
+++ b/apps/with-lingui/src/api/shared/index.ts
@@ -0,0 +1,5 @@
+export * from "./envelope";
+export * from "./menu";
+export * from "./pagination";
+export * from "./params";
+export * from "./prefix";
diff --git a/apps/with-lingui/src/api/shared/menu.ts b/apps/with-lingui/src/api/shared/menu.ts
new file mode 100644
index 0000000..2488dfe
--- /dev/null
+++ b/apps/with-lingui/src/api/shared/menu.ts
@@ -0,0 +1,37 @@
+import { z } from "zod/v4";
+
+const BaseMenuNodeSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  icon: z.string().nullable(),
+  permissions: z.array(z.string()).nullable(),
+  sort: z.int(),
+  hidden: z.boolean(),
+});
+
+export type MenuItem =
+  | (z.infer<typeof BaseMenuNodeSchema> & {
+      kind: "item";
+      path: string;
+      children: MenuItem[] | null;
+    })
+  | (z.infer<typeof BaseMenuNodeSchema> & {
+      kind: "group";
+      path: null;
+      children: MenuItem[];
+    });
+
+export const MenuItemSchema: z.ZodType<MenuItem> = z.lazy(() =>
+  z.discriminatedUnion("kind", [
+    BaseMenuNodeSchema.extend({
+      kind: z.literal("item"),
+      path: z.string(),
+      children: z.array(MenuItemSchema).nullable(),
+    }),
+    BaseMenuNodeSchema.extend({
+      kind: z.literal("group"),
+      path: z.null(),
+      children: z.array(MenuItemSchema),
+    }),
+  ]),
+);
diff --git a/apps/with-lingui/src/api/shared/pagination.ts b/apps/with-lingui/src/api/shared/pagination.ts
new file mode 100644
index 0000000..37a388b
--- /dev/null
+++ b/apps/with-lingui/src/api/shared/pagination.ts
@@ -0,0 +1,14 @@
+import { z } from "zod/v4";
+
+export type PaginatedData<T> = {
+  list: T[];
+  total: number;
+};
+
+/** Unwrapped list payload (envelope `data`); use as `defineApi` `output`. */
+export function PaginatedDataSchema<T extends z.ZodTypeAny>(itemSchema: T) {
+  return z.object({
+    list: z.array(itemSchema),
+    total: z.int(),
+  });
+}
diff --git a/apps/with-lingui/src/api/shared/params.ts b/apps/with-lingui/src/api/shared/params.ts
new file mode 100644
index 0000000..9cee2d6
--- /dev/null
+++ b/apps/with-lingui/src/api/shared/params.ts
@@ -0,0 +1,16 @@
+import { z } from "zod/v4";
+
+export const IdParamsSchema = z.object({
+  id: z.string().min(1),
+});
+
+export type IdParams = z.infer<typeof IdParamsSchema>;
+
+export const SearchParamsSchema = z.object({
+  page: z.number().int().positive().catch(1),
+  pageSize: z.number().int().positive().catch(10),
+  sortField: z.string().nullable().catch(null),
+  sortOrder: z.enum(["ascend", "descend"]).nullable().catch(null),
+});
+
+export type SearchParams = z.infer<typeof SearchParamsSchema>;
diff --git a/apps/with-lingui/src/api/shared/prefix.ts b/apps/with-lingui/src/api/shared/prefix.ts
new file mode 100644
index 0000000..b463808
--- /dev/null
+++ b/apps/with-lingui/src/api/shared/prefix.ts
@@ -0,0 +1,2 @@
+/** REST API path prefix (no trailing slash). */
+export const API_PREFIX = "/api" as const;
diff --git a/apps/with-lingui/src/api/user.ts b/apps/with-lingui/src/api/user.ts
deleted file mode 100644
index 74a5e93..0000000
--- a/apps/with-lingui/src/api/user.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import type { CreateUserRequest, UpdateUserRequest, User } from "./schemas";
-
-export const USER_ENDPOINTS = {
-  list: "/api/users",
-  create: "/api/users",
-  update: (id: string) => `/api/users/${id}`,
-  delete: (id: string) => `/api/users/${id}`,
-} as const;
-
-export type { CreateUserRequest, UpdateUserRequest, User };
diff --git a/apps/with-lingui/src/api/users/index.ts b/apps/with-lingui/src/api/users/index.ts
new file mode 100644
index 0000000..3bae8b0
--- /dev/null
+++ b/apps/with-lingui/src/api/users/index.ts
@@ -0,0 +1,55 @@
+import { z } from "zod/v4";
+import { defineApi } from "@/api/request";
+import { IdParamsSchema } from "@/api/shared/params";
+import { PaginatedDataSchema } from "@/api/shared/pagination";
+import {
+  CreateUserRequestSchema,
+  ListUsersQuerySchema,
+  UpdateUserRequestSchema,
+  UserSchema,
+} from "@/api/users/schemas";
+import type {
+  CreateUserRequest,
+  ListUsersQuery,
+  UpdateUserRequest,
+  User,
+} from "@/api/users/schemas";
+import { API_PREFIX } from "@/api/shared/prefix";
+
+export const USERS_PATH = `${API_PREFIX}/users`;
+export const USERS_MEMBER_PATH = `${USERS_PATH}/:id`;
+
+export const userQueryKeys = {
+  all: ["users"] as const,
+  list: (query: ListUsersQuery) => [...userQueryKeys.all, "list", query] as const,
+};
+
+export const listUsers = defineApi({
+  path: USERS_PATH,
+  query: ListUsersQuerySchema,
+  output: PaginatedDataSchema(UserSchema),
+});
+
+export const createUser = defineApi({
+  method: "POST",
+  path: USERS_PATH,
+  body: CreateUserRequestSchema,
+  output: UserSchema,
+});
+
+export const updateUser = defineApi({
+  method: "PUT",
+  path: USERS_MEMBER_PATH,
+  params: IdParamsSchema,
+  body: UpdateUserRequestSchema,
+  output: UserSchema,
+});
+
+export const deleteUser = defineApi({
+  method: "DELETE",
+  path: USERS_MEMBER_PATH,
+  params: IdParamsSchema,
+  output: z.null(),
+});
+
+export type { CreateUserRequest, ListUsersQuery, UpdateUserRequest, User };
diff --git a/apps/with-lingui/src/api/users/schemas.ts b/apps/with-lingui/src/api/users/schemas.ts
new file mode 100644
index 0000000..51562ba
--- /dev/null
+++ b/apps/with-lingui/src/api/users/schemas.ts
@@ -0,0 +1,45 @@
+import { z } from "zod/v4";
+
+export const UserSchema = z.object({
+  id: z.string(),
+  username: z.string(),
+  avatar: z.string().nullable(),
+  email: z.string().nullable(),
+  roles: z.array(z.string()),
+  permissions: z.array(z.string()),
+});
+
+export type User = z.infer<typeof UserSchema>;
+
+export const ListUsersQuerySchema = z.object({
+  limit: z.number().int().positive().optional(),
+  offset: z.number().int().nonnegative().optional(),
+  keyword: z.string().optional(),
+  role: z.string().optional(),
+  sortField: z.string().optional(),
+  sortOrder: z.enum(["ascend", "descend"]).optional(),
+});
+
+export type ListUsersQuery = z.infer<typeof ListUsersQuerySchema>;
+
+/** Ant Design Input submits `""` when empty; treat as null for optional email */
+const createUserEmailSchema = z
+  .union([z.string(), z.null(), z.undefined()])
+  .transform((v) => {
+    if (v == null) return null;
+    const t = String(v).trim();
+    return t === "" ? null : t;
+  })
+  .pipe(z.union([z.string().email(), z.null()]));
+
+export const CreateUserRequestSchema = z.object({
+  username: z.string().min(1),
+  email: createUserEmailSchema,
+  roles: z.array(z.string()).min(1),
+});
+
+export type CreateUserRequest = z.infer<typeof CreateUserRequestSchema>;
+
+export const UpdateUserRequestSchema = CreateUserRequestSchema.partial();
+
+export type UpdateUserRequest = z.infer<typeof UpdateUserRequestSchema>;
diff --git a/apps/with-lingui/src/components/DataTable/index.tsx b/apps/with-lingui/src/components/DataTable/index.tsx
index 5a48327..debc7a7 100644
--- a/apps/with-lingui/src/components/DataTable/index.tsx
+++ b/apps/with-lingui/src/components/DataTable/index.tsx
@@ -1,4 +1,4 @@
-import { Flex, Table, theme } from "antd";
+import { Table, theme } from "antd";
 import type { TableProps } from "antd";
 import type { CSSProperties, ReactElement, ReactNode, Ref } from "react";
 import { useMemo } from "react";
@@ -12,8 +12,8 @@ export type DataTableProps<RecordType extends object = object> = {
   lockScrollHeight?: boolean;
   maxHeight?: number;
   frameHeight?: number;
-  layoutRef?: Ref<HTMLDivElement | null>;
-  frameRef?: Ref<HTMLDivElement | null>;
+  layoutRef?: Ref<HTMLDivElement>;
+  frameRef?: Ref<HTMLDivElement>;
   bottomExtra?: ReactNode;
 } & TableProps<RecordType>;
 
@@ -67,14 +67,15 @@ export function DataTable<RecordType extends object = object>(
   );
 
   return (
-    <Flex
+    <div
       ref={layoutRef}
-      vertical
-      gap={token.marginSM}
       style={{
         flex: "1 1 0%",
         minHeight: 0,
         overflow: "hidden",
+        display: "flex",
+        flexDirection: "column",
+        gap: token.marginSM,
       }}
     >
       <div ref={frameRef} style={outerStyle}>
@@ -110,6 +111,6 @@ export function DataTable<RecordType extends object = object>(
         </div>
       </div>
       {bottomExtra}
-    </Flex>
+    </div>
   );
 }
diff --git a/apps/with-lingui/src/main.tsx b/apps/with-lingui/src/main.tsx
index 34467d8..ca0050a 100644
--- a/apps/with-lingui/src/main.tsx
+++ b/apps/with-lingui/src/main.tsx
@@ -6,7 +6,7 @@ import { i18n } from "@lingui/core";
 import { loadLocaleCatalog } from "./locales/loadLocaleCatalog";
 import { useSettingsStore } from "./stores/settings";
 import { useAuthStore } from "./stores/auth";
-import { installHttpRouter } from "./utils/http";
+import { installHttpRouter } from "./api/request";
 
 const router = createRouter({ routeTree });
 installHttpRouter(router);
diff --git a/apps/with-lingui/src/mocks/handlers/auth.ts b/apps/with-lingui/src/mocks/handlers/auth.ts
index fe197d5..0ee71d4 100644
--- a/apps/with-lingui/src/mocks/handlers/auth.ts
+++ b/apps/with-lingui/src/mocks/handlers/auth.ts
@@ -15,6 +15,7 @@ import {
   RefreshTokenRequestSchema,
   RegisterRequestSchema,
 } from "@/api/schemas";
+import { AUTH_ENDPOINTS } from "@/api/auth/paths";
 
 const GUEST_REFRESH = "mock-guest-refresh";
 const REGISTERED_ACCESS = "mock-registered-access";
@@ -32,7 +33,7 @@ function isRegisteredAuth(authorization: string | null): boolean {
 }
 
 export const authHandlers = [
-  http.post("/api/auth/login", async ({ request }) => {
+  http.post(AUTH_ENDPOINTS.login, async ({ request }) => {
     await withDelay(300);
     let json: unknown;
     try {
@@ -60,7 +61,7 @@ export const authHandlers = [
     return errorResponse(ERROR_CODES.INVALID_CREDENTIALS, "Invalid username or password");
   }),
 
-  http.post("/api/auth/register", async ({ request }) => {
+  http.post(AUTH_ENDPOINTS.register, async ({ request }) => {
     await withDelay(300);
     let json: unknown;
     try {
@@ -90,7 +91,7 @@ export const authHandlers = [
     });
   }),
 
-  http.post("/api/auth/refresh", async ({ request }) => {
+  http.post(AUTH_ENDPOINTS.refresh, async ({ request }) => {
     await withDelay(100);
     let json: unknown;
     try {
@@ -123,9 +124,9 @@ export const authHandlers = [
     });
   }),
 
-  http.post("/api/auth/logout", () => successWithNullBody()),
+  http.post(AUTH_ENDPOINTS.logout, () => successWithNullBody()),
 
-  http.get("/api/auth/user", ({ request }) => {
+  http.get(AUTH_ENDPOINTS.user, ({ request }) => {
     const auth = request.headers.get("authorization");
     if (isRegisteredAuth(auth)) {
       const session = mockRegisteredSession;
@@ -146,7 +147,7 @@ export const authHandlers = [
     return successWithSchema(AuthUserResponseSchema, userWithoutPermissions);
   }),
 
-  http.get("/api/auth/permissions", ({ request }) => {
+  http.get(AUTH_ENDPOINTS.permissions, ({ request }) => {
     const auth = request.headers.get("authorization");
     if (isRegisteredAuth(auth) && mockRegisteredSession) {
       return successWithSchema(PermissionsListSchema, ["user:view"] as string[]);
diff --git a/apps/with-lingui/src/mocks/handlers/user.ts b/apps/with-lingui/src/mocks/handlers/user.ts
index bc81598..014783c 100644
--- a/apps/with-lingui/src/mocks/handlers/user.ts
+++ b/apps/with-lingui/src/mocks/handlers/user.ts
@@ -10,13 +10,14 @@ import {
   successWithSchema,
   successWithNullBody,
 } from "../createHandler";
+import { USERS_MEMBER_PATH, USERS_PATH } from "@/api/users";
 
 let users = [...MOCK_USERS];
 
 export const EXPIRED_ACCESS_TOKEN = "__EXPIRED_ACCESS__";
 
 export const userHandlers = [
-  http.get("/api/users", async ({ request }) => {
+  http.get(USERS_PATH, async ({ request }) => {
     await withDelay(200);
     const auth = request.headers.get("authorization");
     if (auth === `Bearer ${EXPIRED_ACCESS_TOKEN}`) {
@@ -33,7 +34,7 @@ export const userHandlers = [
     return paginatedWithSchema(UserSchema, { list, total: filtered.length });
   }),
 
-  http.post("/api/users", async ({ request }) => {
+  http.post(USERS_PATH, async ({ request }) => {
     await withDelay(200);
     const body = (await request.json()) as Record<string, unknown>;
     const newUser = {
@@ -48,7 +49,7 @@ export const userHandlers = [
     return successWithSchema(UserSchema, newUser);
   }),
 
-  http.put("/api/users/:id", async ({ params, request }) => {
+  http.put(USERS_MEMBER_PATH, async ({ params, request }) => {
     await withDelay(200);
     const body = (await request.json()) as Record<string, unknown>;
     const idx = users.findIndex((u) => u.id === params.id);
@@ -59,7 +60,7 @@ export const userHandlers = [
     return successWithSchema(UserSchema, users[idx]);
   }),
 
-  http.delete("/api/users/:id", async ({ params }) => {
+  http.delete(USERS_MEMBER_PATH, async ({ params }) => {
     await withDelay(200);
     users = users.filter((u) => u.id !== params.id);
     return successWithNullBody();
diff --git a/apps/with-lingui/src/routes/_auth.tsx b/apps/with-lingui/src/routes/_auth.tsx
index 3417be4..59ed32f 100644
--- a/apps/with-lingui/src/routes/_auth.tsx
+++ b/apps/with-lingui/src/routes/_auth.tsx
@@ -2,7 +2,7 @@ import { createFileRoute, redirect } from "@tanstack/react-router";
 import { useAuthStore } from "@/stores/auth";
 import { MainLayout } from "@/components/Layout/MainLayout";
 import { canAccessPath, normalizeAppPath } from "@/utils/appMenu";
-import { fetchSessionAndApplyToStore } from "@/utils/session";
+import { hydrateSession } from "@/api/auth";
 
 export const Route = createFileRoute("/_auth")({
   beforeLoad: async ({ location }) => {
@@ -13,7 +13,7 @@ export const Route = createFileRoute("/_auth")({
 
     if (tokens && !user) {
       try {
-        await fetchSessionAndApplyToStore();
+        await hydrateSession();
       } catch {
         useAuthStore.getState().logout();
         throw redirect({ to: "/login" });
diff --git a/apps/with-lingui/src/routes/_auth/users/index.tsx b/apps/with-lingui/src/routes/_auth/users/index.tsx
index 1b01a8b..ee8d491 100644
--- a/apps/with-lingui/src/routes/_auth/users/index.tsx
+++ b/apps/with-lingui/src/routes/_auth/users/index.tsx
@@ -3,9 +3,7 @@ import { Avatar, Button, Space, Form, App, Dropdown, theme, Tag, Flex } from "an
 import type { TablePaginationConfig } from "antd/es/table/interface";
 import { useLingui } from "@lingui/react/macro";
 import { useMemo, useRef, useState } from "react";
-import { httpClient } from "@/utils/http";
-import { USER_ENDPOINTS } from "@/api/user";
-import { PaginatedResponseSchema, UserSchema, CreateUserRequestSchema } from "@/api/schemas";
+import { createUser, deleteUser, listUsers, updateUser, userQueryKeys } from "@/api/users";
 import type { User, CreateUserRequest } from "@/api/schemas";
 import { z } from "zod/v4";
 import { MoreVertical, Pencil, Trash2 } from "lucide-react";
@@ -33,8 +31,6 @@ export const Route = createFileRoute("/_auth/users/")({
   component: UsersPage,
 });
 
-const paginatedUserSchema = PaginatedResponseSchema(UserSchema);
-
 function UsersPage() {
   const search = Route.useSearch();
   const navigate = useNavigate({ from: Route.fullPath });
@@ -64,36 +60,26 @@ function UsersPage() {
     resourceKey: "users",
   });
 
+  const listQuery = {
+    limit: search.limit,
+    offset: search.offset,
+    keyword: search.keyword || undefined,
+    role: search.role || undefined,
+    sortField: search.sortField ?? undefined,
+    sortOrder: search.sortOrder ?? undefined,
+  };
+
   const { data, isLoading, createMutation, updateMutation, deleteMutation } = useResourceCRUD<
     { list: User[]; total: number },
     CreateUserRequest,
     CreateUserRequest & { id: string }
   >({
-    queryKey: [
-      "users",
-      search.limit,
-      search.offset,
-      search.keyword,
-      search.role,
-      search.sortField,
-      search.sortOrder,
-    ],
-    queryFn: () =>
-      httpClient.get(USER_ENDPOINTS.list, {
-        params: {
-          limit: search.limit,
-          offset: search.offset,
-          keyword: search.keyword || undefined,
-          role: search.role || undefined,
-          sortField: search.sortField ?? undefined,
-          sortOrder: search.sortOrder ?? undefined,
-        },
-      }),
-    select: (raw) => paginatedUserSchema.shape.data.parse(raw),
-    createFn: (values) =>
-      httpClient.post(USER_ENDPOINTS.create, CreateUserRequestSchema.parse(values)),
-    updateFn: ({ id, ...values }) => httpClient.put(USER_ENDPOINTS.update(id), values),
-    deleteFn: (id) => httpClient.delete(USER_ENDPOINTS.delete(id)),
+    queryKey: userQueryKeys.list(listQuery),
+    queryFn: () => listUsers(listQuery),
+    select: (raw) => raw as { list: User[]; total: number },
+    createFn: (values) => createUser(values),
+    updateFn: ({ id, ...values }) => updateUser({ params: { id }, body: values }),
+    deleteFn: (id) => deleteUser({ id }),
     optimistic: { update: true, delete: true },
     createLifecycle: {
       onSuccess: (values) => {
diff --git a/apps/with-lingui/src/routes/login/index.tsx b/apps/with-lingui/src/routes/login/index.tsx
index 8d7c028..59dbace 100644
--- a/apps/with-lingui/src/routes/login/index.tsx
+++ b/apps/with-lingui/src/routes/login/index.tsx
@@ -3,12 +3,10 @@ import { Form, Input, Button, Card, App, theme, Typography, Flex, Checkbox } fro
 import type { CSSProperties } from "react";
 import { useMutation } from "@tanstack/react-query";
 import { useLingui } from "@lingui/react/macro";
-import { httpClient } from "@/utils/http";
 import { useAuthStore } from "@/stores/auth";
 import { useSettingsStore } from "@/stores/settings";
-import { AUTH_ENDPOINTS } from "@/api/auth";
-import { LoginRequestSchema, AuthTokensSchema } from "@/api/schemas";
-import { fetchSessionAndApplyToStore } from "@/utils/session";
+import { hydrateSession, login } from "@/api/auth";
+import { LoginRequestSchema } from "@/api/schemas";
 import type { LoginRequest } from "@/api/schemas";
 import { APP_BRAND_NAME, APP_FAVICON_SRC } from "@/utils/constants";
 import { AppFooter } from "@/components/Layout/AppFooter";
@@ -35,11 +33,9 @@ function LoginPage() {
 
   const loginMutation = useMutation({
     mutationFn: async (values: LoginRequest) => {
-      const parsed = LoginRequestSchema.parse(values);
-      const tokens = await httpClient.post(AUTH_ENDPOINTS.login, parsed);
-      const validTokens = AuthTokensSchema.parse(tokens);
-      setTokens(validTokens);
-      await fetchSessionAndApplyToStore();
+      const tokens = await login(values);
+      setTokens(tokens);
+      await hydrateSession();
     },
     onSuccess: () => {
       message.success(t`Login successful`);
diff --git a/apps/with-lingui/src/routes/register/index.tsx b/apps/with-lingui/src/routes/register/index.tsx
index 8fc985b..02d1a0a 100644
--- a/apps/with-lingui/src/routes/register/index.tsx
+++ b/apps/with-lingui/src/routes/register/index.tsx
@@ -3,11 +3,9 @@ import { Form, Input, Button, Card, App, theme, Typography, Flex } from "antd";
 import type { CSSProperties } from "react";
 import { useMutation } from "@tanstack/react-query";
 import { useLingui } from "@lingui/react/macro";
-import { httpClient } from "@/utils/http";
 import { useAuthStore } from "@/stores/auth";
-import { AUTH_ENDPOINTS } from "@/api/auth";
-import { AuthTokensSchema, RegisterRequestSchema } from "@/api/schemas";
-import { fetchSessionAndApplyToStore } from "@/utils/session";
+import { hydrateSession, register } from "@/api/auth";
+import { RegisterRequestSchema } from "@/api/schemas";
 import type { RegisterRequest } from "@/api/auth";
 import { APP_BRAND_NAME, APP_FAVICON_SRC } from "@/utils/constants";
 import { Aurora } from "@/components/Aurora";
@@ -33,11 +31,9 @@ function RegisterPage() {
 
   const registerMutation = useMutation({
     mutationFn: async (values: RegisterRequest) => {
-      const parsed = RegisterRequestSchema.parse(values);
-      const tokens = await httpClient.post(AUTH_ENDPOINTS.register, parsed);
-      const validTokens = AuthTokensSchema.parse(tokens);
-      setTokens(validTokens);
-      await fetchSessionAndApplyToStore();
+      const tokens = await register(values);
+      setTokens(tokens);
+      await hydrateSession();
     },
     onSuccess: () => {
       message.success(t`Account created successfully`);
diff --git a/apps/with-lingui/src/utils/http.ts b/apps/with-lingui/src/utils/http.ts
deleted file mode 100644
index 4ab53dc..0000000
--- a/apps/with-lingui/src/utils/http.ts
+++ /dev/null
@@ -1,172 +0,0 @@
-import { API_BASE_URL } from "./constants";
-import { AUTH_ENDPOINTS } from "@/api/auth";
-import { AuthTokensSchema, RefreshTokenRequestSchema } from "@/api/schemas";
-import { getAccessToken, useAuthStore } from "@/stores/auth";
-
-export class ApiError extends Error {
-  code: number;
-  constructor(code: number, message: string) {
-    super(message);
-    this.name = "ApiError";
-    this.code = code;
-  }
-}
-
-export class HttpError extends Error {
-  status: number;
-  constructor(status: number, message: string) {
-    super(message);
-    this.name = "HttpError";
-    this.status = status;
-  }
-}
-
-type RequestOptions = Omit<RequestInit, "method" | "body"> & {
-  params?: Record<string, string | number | null | undefined>;
-};
-
-type HttpRouter = {
-  navigate: (opts: { to: string }) => void | Promise<void>;
-};
-
-let httpRouter: HttpRouter | null = null;
-
-export function installHttpRouter(router: HttpRouter): void {
-  httpRouter = router;
-}
-
-let inflightRefresh: Promise<boolean> | null = null;
-
-async function doRefreshSessionTokens(): Promise<boolean> {
-  const { tokens, setTokens, logout } = useAuthStore.getState();
-  const refreshToken = tokens?.refreshToken;
-  if (!refreshToken) {
-    logout();
-    navigateToLogin();
-    return false;
-  }
-
-  const body = RefreshTokenRequestSchema.parse({ refreshToken });
-  const url = buildUrl(AUTH_ENDPOINTS.refresh);
-
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body),
-    });
-
-    if (!res.ok) {
-      logout();
-      navigateToLogin();
-      return false;
-    }
-
-    const json: unknown = await res.json();
-    const envelope = json as { code?: number; data?: unknown; message?: string };
-    if (envelope.code !== undefined && envelope.code !== 0) {
-      logout();
-      navigateToLogin();
-      return false;
-    }
-
-    const next = AuthTokensSchema.parse(envelope.data ?? envelope);
-    setTokens(next);
-    return true;
-  } catch {
-    logout();
-    navigateToLogin();
-    return false;
-  }
-}
-
-async function refreshSessionTokens(): Promise<boolean> {
-  if (inflightRefresh) return inflightRefresh;
-
-  inflightRefresh = doRefreshSessionTokens().finally(() => {
-    inflightRefresh = null;
-  });
-  return inflightRefresh;
-}
-
-function buildUrl(path: string, params?: RequestOptions["params"]): string {
-  const base = path.startsWith("http") ? path : `${API_BASE_URL}${path}`;
-  if (!params) return base;
-  const url = new URL(base, window.location.origin);
-  for (const [key, value] of Object.entries(params)) {
-    if (value != null) url.searchParams.set(key, String(value));
-  }
-  return url.toString();
-}
-
-function getAuthHeaders(): Record<string, string> {
-  const token = getAccessToken();
-  if (token) return { Authorization: `Bearer ${token}` };
-  return {};
-}
-
-function navigateTo403(): void {
-  void httpRouter?.navigate({ to: "/403" });
-}
-
-function navigateToLogin(): void {
-  void httpRouter?.navigate({ to: "/login" });
-}
-
-async function request<T>(
-  method: string,
-  path: string,
-  body?: unknown,
-  options?: RequestOptions,
-  isAfterRefresh = false,
-): Promise<T> {
-  const url = buildUrl(path, options?.params);
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-    ...getAuthHeaders(),
-    ...(options?.headers as Record<string, string>),
-  };
-
-  const res = await fetch(url, {
-    method,
-    headers,
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-    ...options,
-  });
-
-  if (res.status === 401 && !isAfterRefresh && path !== AUTH_ENDPOINTS.refresh) {
-    const refreshed = await refreshSessionTokens();
-    if (refreshed) {
-      return request<T>(method, path, body, options, true);
-    }
-    throw new HttpError(401, "Unauthorized");
-  }
-
-  if (res.status === 403) {
-    navigateTo403();
-    throw new HttpError(403, "Forbidden");
-  }
-
-  if (!res.ok) {
-    throw new HttpError(res.status, `HTTP ${res.status}: ${res.statusText}`);
-  }
-
-  const json: unknown = await res.json();
-  const envelope = json as { code?: number; data?: unknown; message?: string };
-
-  if (envelope.code !== undefined && envelope.code !== 0) {
-    throw new ApiError(envelope.code, envelope.message ?? "Unknown error");
-  }
-
-  return (envelope.data !== undefined ? envelope.data : json) as T;
-}
-
-export const httpClient = {
-  get: <T>(path: string, options?: RequestOptions) => request<T>("GET", path, undefined, options),
-  post: <T>(path: string, body?: unknown, options?: RequestOptions) =>
-    request<T>("POST", path, body, options),
-  put: <T>(path: string, body?: unknown, options?: RequestOptions) =>
-    request<T>("PUT", path, body, options),
-  delete: <T>(path: string, options?: RequestOptions) =>
-    request<T>("DELETE", path, undefined, options),
-};
diff --git a/apps/with-lingui/src/utils/session.ts b/apps/with-lingui/src/utils/session.ts
deleted file mode 100644
index 2ea3aa2..0000000
--- a/apps/with-lingui/src/utils/session.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { httpClient } from "@/utils/http";
-import { AUTH_ENDPOINTS } from "@/api/auth";
-import { AuthUserResponseSchema, PermissionsListSchema, UserSchema } from "@/api/schemas";
-import { APP_MENU_TREE, filterMenuTreeByPermissions } from "@/utils/appMenu";
-import { useAuthStore } from "@/stores/auth";
-
-export async function fetchSessionAndApplyToStore(): Promise<void> {
-  const [userBase, permissions] = await Promise.all([
-    httpClient.get(AUTH_ENDPOINTS.user).then((d) => AuthUserResponseSchema.parse(d)),
-    httpClient.get(AUTH_ENDPOINTS.permissions).then((d) => PermissionsListSchema.parse(d)),
-  ]);
-  const user = UserSchema.parse({ ...userBase, permissions });
-  const menus = filterMenuTreeByPermissions(APP_MENU_TREE, permissions);
-  const { setUser, setMenus } = useAuthStore.getState();
-  setUser(user);
-  setMenus(menus);
-}
diff --git a/docs/specs/2026-04-24-with-lingui-optimization-plan.md b/docs/specs/2026-04-24-with-lingui-optimization-plan.md
index e9123c5..1566df3 100644
--- a/docs/specs/2026-04-24-with-lingui-optimization-plan.md
+++ b/docs/specs/2026-04-24-with-lingui-optimization-plan.md
@@ -3,7 +3,7 @@
 > 状态：已部分落地（更新于 2026-04-27）
 > 计划日期：2026-04-24
 > 范围：以 `apps/with-lingui` 为主模板（`apps/basic` 为英文、无 Lingui 的对照应用；**CRUD 页面级示例仅以 `users` 为样板**，不设第二示例资源）
-> 面向：人类贡献者 + AI Agent（结合 `.github/instructions/` 指令体系执行）
+> 面向：人类贡献者 + AI Agent（**现行**：各 app 的 `AGENTS.md` + `.agents/skills/`；下文若提及 `.github/instructions/*.instructions.md` 为历史方案）
 
 ## 0. 背景
 
diff --git a/package.json b/package.json
index bfb184c..c980e89 100644
--- a/package.json
+++ b/package.json
@@ -6,14 +6,13 @@
   "scripts": {
     "build": "turbo run build",
     "dev": "turbo run dev",
+    "fmt": "turbo run fmt",
     "lint": "turbo run lint",
-    "format": "prettier --write \"**/*.{ts,tsx,md}\"",
+    "preinstall": "git config core.hooksPath .githooks && git config --local vp.hooks.disabled true",
     "setup:git-hooks": "git config core.hooksPath .githooks && git config core.hooksPath"
   },
   "devDependencies": {
-    "eslint": "^8.57.0",
-    "prettier": "^3.2.5",
-    "turbo": "^2.9.6"
+    "turbo": "^2.11.9"
   },
   "packageManager": "pnpm@10.33.2",
   "pnpm": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 820f902..8cd031b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,15 +11,9 @@ importers:
 
   .:
     devDependencies:
-      eslint:
-        specifier: ^8.57.0
-        version: 8.57.1
-      prettier:
-        specifier: ^3.2.5
-        version: 3.8.3
       turbo:
-        specifier: ^2.9.6
-        version: 2.9.6
+        specifier: ^2.11.9
+        version: 2.11.9
 
   apps/basic:
     dependencies:
@@ -32,6 +26,9 @@ importers:
       antd:
         specifier: ^6.6.6
         version: 6.6.6(react-dom@19.3.1(react@19.3.1))(react@19.3.1)
+      axios:
+        specifier: ^1.20.0
+        version: 1.20.0
       lucide-react:
         specifier: ^1.59.0
         version: 1.59.0(@types/react@19.3.0)(react@19.3.1)
@@ -133,6 +130,9 @@ importers:
       antd:
         specifier: ^6.6.6
         version: 6.6.6(react-dom@19.3.1(react@19.3.1))(react@19.3.1)
+      axios:
+        specifier: ^1.20.0
+        version: 1.20.0
       lucide-react:
         specifier: ^1.59.0
         version: 1.59.0(@types/react@19.3.0)(react@19.3.1)
@@ -616,18 +616,10 @@ packages:
     resolution: {integrity: sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@eslint/eslintrc@2.1.4':
-    resolution: {integrity: sha512-269Z39MS6wVJtsoUl10L60WdkhJVdPG24Q4eZTH3nnF6lpvSShEK3wQjDX9JRWAUPvPh7COouPpU9IrqaZFvtQ==}
-    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
-
   '@eslint/eslintrc@3.3.5':
     resolution: {integrity: sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/js@8.57.1':
-    resolution: {integrity: sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q==}
-    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
-
   '@eslint/object-schema@3.0.5':
     resolution: {integrity: sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
@@ -679,19 +671,10 @@ packages:
     resolution: {integrity: sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==}
     engines: {node: '>=18.18.0'}
 
-  '@humanwhocodes/config-array@0.13.0':
-    resolution: {integrity: sha512-DZLEEqFWQFiyK6h5YIeynKx7JlvCYWL0cImfSRXZ9l4Sg2efkFGTuFf6vzXjK1cq6IYkU+Eg/JizXw+TD2vRNw==}
-    engines: {node: '>=10.10.0'}
-    deprecated: Use @eslint/config-array instead
-
   '@humanwhocodes/module-importer@1.0.1':
     resolution: {integrity: sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
     engines: {node: '>=12.22'}
 
-  '@humanwhocodes/object-schema@2.0.3':
-    resolution: {integrity: sha512-93zYdMES/c1D69yZiKDBj0V24vqNzB/koF26KPaagAfd3P/4gUlh3Dys5ogAK+Exi9QyzlD8x/08Zt7wIKcDcA==}
-    deprecated: Use @eslint/object-schema instead
-
   '@humanwhocodes/retry@0.4.3':
     resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
     engines: {node: '>=18.18'}
@@ -2356,33 +2339,33 @@ packages:
   '@ts-morph/common@0.28.1':
     resolution: {integrity: sha512-W74iWf7ILp1ZKNYXY5qbddNaml7e9Sedv5lvU1V8lftlitkc9Pq1A+jlH23ltDgWYeZFFEqGCD1Ies9hqu3O+g==}
 
-  '@turbo/darwin-64@2.9.6':
-    resolution: {integrity: sha512-X/56SnVXIQZBLKwniGTwEQTGmtE5brSACnKMBWpY3YafuxVYefrC2acamfjgxP7BG5w3I+6jf0UrLoSzgPcSJg==}
+  '@turbo/darwin-64@2.11.9':
+    resolution: {integrity: sha512-OkW+EESJjo248CThWe9DfuUqzGcRwHe1DXKWRw9DSZ0lMkocKbbwNMjWVCiO+WNBcARDM0ibu0c9SbuIe4mw6w==}
     cpu: [x64]
     os: [darwin]
 
-  '@turbo/darwin-arm64@2.9.6':
-    resolution: {integrity: sha512-aalBeSl4agT/QtYGDyf/XLajedWzUC9Vg/pm/YO6QQ93vkQ91Vz5uK1ta5RbVRDozQSz4njxUNqRNmOXDzW+qw==}
+  '@turbo/darwin-arm64@2.11.9':
+    resolution: {integrity: sha512-NIbFEogMaIyOi2egLH7XtuW0DXmPOpydnanyB3rw/WXCPYl1OAFRPHPGixIaakGnfNLey8LMmKemgNtqtFKdcg==}
     cpu: [arm64]
     os: [darwin]
 
-  '@turbo/linux-64@2.9.6':
-    resolution: {integrity: sha512-YKi05jnNHaD7vevgYwahpzGwbsNNTwzU2c7VZdmdFm7+cGDP4oREUWSsainiMfRqjRuolQxBwRn8wf1jmu+YZA==}
+  '@turbo/linux-64@2.11.9':
+    resolution: {integrity: sha512-RkD/Atqqek2WNnYJlmPogZpXjAW+cSsPXDn7E0mufSNN86ClXCSKme/BBYMeIvPoFZ4egPJLF+JpYkuuNkMYhg==}
     cpu: [x64]
-    os: [linux]
+    os: [android, linux]
 
-  '@turbo/linux-arm64@2.9.6':
-    resolution: {integrity: sha512-02o/ZS69cOYEDczXvOB2xmyrtzjQ2hVFtWZK1iqxXUfzMmTjZK4UumrfNnjckSg+gqeBfnPRHa0NstA173Ik3g==}
+  '@turbo/linux-arm64@2.11.9':
+    resolution: {integrity: sha512-iW/0YGS9D9YlgD4ad2IEEolD9PuNJGdkEI650AELLln8YaGsloiH8QyTUnajjxPufMuY/eWRWxO+PMBYsGvVlA==}
     cpu: [arm64]
-    os: [linux]
+    os: [android, linux]
 
-  '@turbo/windows-64@2.9.6':
-    resolution: {integrity: sha512-wVdQjvnBI15wB6JrA+43CtUtagjIMmX6XYO758oZHAsCNSxqRlJtdyujih0D8OCnwCRWiGWGI63zAxR0hO6s9g==}
+  '@turbo/windows-64@2.11.9':
+    resolution: {integrity: sha512-rg/kuQmSm9m/z8W5HYHLMSnTbLDXBs/9liVZh9YnfkGYm0DlFj2SV9/0fQy/EpJTq81O36kMb7p8Fmt9f67ocA==}
     cpu: [x64]
     os: [win32]
 
-  '@turbo/windows-arm64@2.9.6':
-    resolution: {integrity: sha512-1XUUyWW0W6FTSqGEhU8RHVqb2wP1SPkr7hIvBlMEwH9jr+sJQK5kqeosLJ/QaUv4ecSAd1ZhIrLoW7qslAzT4A==}
+  '@turbo/windows-arm64@2.11.9':
+    resolution: {integrity: sha512-PgjBpLPW/WDsKzeBmNuw2QHtPxT/PtcloN3rHFTqVyMsqkLlyHVJbSusuhYoYFdi08lZ9Stryw66UOuPg/yW0w==}
     cpu: [arm64]
     os: [win32]
 
@@ -2645,6 +2628,7 @@ packages:
 
   '@ungap/structured-clone@1.3.0':
     resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
+    deprecated: Potential CWE-502 - Update to 1.3.1 or higher
 
   '@unrs/resolver-binding-android-arm-eabi@1.11.1':
     resolution: {integrity: sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==}
@@ -2938,6 +2922,7 @@ packages:
   '@xmldom/xmldom@0.9.10':
     resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==}
     engines: {node: '>=14.6'}
+    deprecated: this version has critical issues, please update to the latest version
 
   '@yuku-codegen/binding-android-arm64@0.9.5':
     resolution: {integrity: sha512-jrOY5WM+AaAqkv51fHP1x28ifto4WgcZVzodLUyMU1jMWn5Sq+VciRdk/n8E0Ey5w4p4cWWE+m5GfXWOYh7Kzw==}
@@ -3108,6 +3093,10 @@ packages:
     engines: {node: '>=0.4.0'}
     hasBin: true
 
+  agent-base@6.0.2:
+    resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
+    engines: {node: '>= 6.0.0'}
+
   ajv@6.15.0:
     resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
 
@@ -3207,6 +3196,9 @@ packages:
     resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
     engines: {node: '>= 0.4'}
 
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
   available-typed-arrays@1.0.7:
     resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
     engines: {node: '>= 0.4'}
@@ -3215,6 +3207,9 @@ packages:
     resolution: {integrity: sha512-zBQouZixDTbo3jMGqHKyePxYxr1e5W8UdTmBQ7sNtaA9M2bE32daxxPLS/jojhKOHxQ7LWwPjfiwf/fhaJWzlg==}
     engines: {node: '>=4'}
 
+  axios@1.20.0:
+    resolution: {integrity: sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==}
+
   axobject-query@4.1.0:
     resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
     engines: {node: '>= 0.4'}
@@ -3390,6 +3385,10 @@ packages:
   color-name@1.1.4:
     resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
 
+  combined-stream@1.0.8:
+    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+    engines: {node: '>= 0.8'}
+
   comma-separated-tokens@2.0.3:
     resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
 
@@ -3661,6 +3660,10 @@ packages:
   delaunator@5.1.0:
     resolution: {integrity: sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==}
 
+  delayed-stream@1.0.0:
+    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+    engines: {node: '>=0.4.0'}
+
   dequal@2.0.3:
     resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
     engines: {node: '>=6'}
@@ -3680,10 +3683,6 @@ packages:
     resolution: {integrity: sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
     engines: {node: '>=0.10.0'}
 
-  doctrine@3.0.0:
-    resolution: {integrity: sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==}
-    engines: {node: '>=6.0.0'}
-
   dom-accessibility-api@0.5.16:
     resolution: {integrity: sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==}
 
@@ -3842,10 +3841,6 @@ packages:
     peerDependencies:
       eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7
 
-  eslint-scope@7.2.2:
-    resolution: {integrity: sha512-dOt21O7lTMhDM+X9mB4GX+DZrZtCUJPL/wlcTqxyrx5IvO0IYtILdtrQGQp+8n5S0gwSVmOf9NQrjMOgfQZlIg==}
-    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
-
   eslint-scope@9.1.2:
     resolution: {integrity: sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
@@ -3872,12 +3867,6 @@ packages:
       jiti:
         optional: true
 
-  eslint@8.57.1:
-    resolution: {integrity: sha512-ypowyDxpVSYpkXr9WPv2PAZCtNip1Mv5KTW0SCurXv/9iOpcrH9PaqUElksqEB6pChqHGDRCFTyrZlGhnLNGiA==}
-    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
-    deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
-    hasBin: true
-
   esm@3.2.25:
     resolution: {integrity: sha512-U1suiZ2oDVWv4zPO56S0NcR5QriEahGtdN2OR6FiOG4WJvcjBVFB0qI4+eKoWFH483PKGuLuu6V8Z4T5g63UVA==}
     engines: {node: '>=6'}
@@ -3890,10 +3879,6 @@ packages:
     resolution: {integrity: sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  espree@9.6.1:
-    resolution: {integrity: sha512-oruZaFkjorTpF32kDSI5/75ViwGeZginGGy2NoOSg3Q9bnwlnmDm4HLnkl0RE3n+njDXR037aY1+x58Z/zFdwQ==}
-    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
-
   esquery@1.7.0:
     resolution: {integrity: sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==}
     engines: {node: '>=0.10'}
@@ -3986,10 +3971,6 @@ packages:
       picomatch:
         optional: true
 
-  file-entry-cache@6.0.1:
-    resolution: {integrity: sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==}
-    engines: {node: ^10.12.0 || >=12.0.0}
-
   file-entry-cache@8.0.0:
     resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
     engines: {node: '>=16.0.0'}
@@ -4005,10 +3986,6 @@ packages:
   fix-dts-default-cjs-exports@1.0.1:
     resolution: {integrity: sha512-pVIECanWFC61Hzl2+oOCtoJ3F17kglZC/6N94eRWycFgBH35hHx0Li604ZIzhseh97mf2p0cv7vVrOZGoqhlEg==}
 
-  flat-cache@3.2.0:
-    resolution: {integrity: sha512-CYcENa+FtcUKLmhhqyctpclsq7QF38pKjZHsGNiSQF5r4FtoKDWabFDl3hzaEQMvT1LHEysw5twgLvpYYb4vbw==}
-    engines: {node: ^10.12.0 || >=12.0.0}
-
   flat-cache@4.0.1:
     resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
     engines: {node: '>=16'}
@@ -4016,17 +3993,27 @@ packages:
   flatted@3.4.2:
     resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
 
+  follow-redirects@1.16.1:
+    resolution: {integrity: sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      debug: '*'
+    peerDependenciesMeta:
+      debug:
+        optional: true
+
   for-each@0.3.5:
     resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
     engines: {node: '>= 0.4'}
 
+  form-data@4.0.6:
+    resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
+    engines: {node: '>= 6'}
+
   format@0.2.2:
     resolution: {integrity: sha512-wzsgA6WOq+09wrU1tsJ09udeR/YZRaeArL9e1wPbFg3GG2yDnC2ldKpxs4xunpFF9DgqCqOIra3bc1HWrJ37Ww==}
     engines: {node: '>=0.4.x'}
 
-  fs.realpath@1.0.0:
-    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
-
   fsevents@2.3.3:
     resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
@@ -4092,14 +4079,6 @@ packages:
     resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
     engines: {node: '>=10.13.0'}
 
-  glob@7.2.3:
-    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
-    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
-
-  globals@13.24.0:
-    resolution: {integrity: sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==}
-    engines: {node: '>=8'}
-
   globals@14.0.0:
     resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
     engines: {node: '>=18'}
@@ -4116,9 +4095,6 @@ packages:
     resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
     engines: {node: '>= 0.4'}
 
-  graphemer@1.4.0:
-    resolution: {integrity: sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==}
-
   graphql@16.13.2:
     resolution: {integrity: sha512-5bJ+nf/UCpAjHM8i06fl7eLyVC9iuNAjm9qzkiu2ZGhM0VscSvS6WDPfAwkdkBuoXGM9FJSbKl6wylMwP9Ktig==}
     engines: {node: ^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0}
@@ -4149,8 +4125,8 @@ packages:
     resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
     engines: {node: '>= 0.4'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hast-util-from-dom@5.0.1:
@@ -4210,6 +4186,10 @@ packages:
   html-void-elements@3.0.0:
     resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==}
 
+  https-proxy-agent@5.0.1:
+    resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
+    engines: {node: '>= 6'}
+
   human-signals@5.0.0:
     resolution: {integrity: sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ==}
     engines: {node: '>=16.17.0'}
@@ -4238,13 +4218,6 @@ packages:
     resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
     engines: {node: '>=0.8.19'}
 
-  inflight@1.0.6:
-    resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
-    deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
-
-  inherits@2.0.4:
-    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
-
   inline-style-parser@0.2.7:
     resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==}
 
@@ -4362,10 +4335,6 @@ packages:
     resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
     engines: {node: '>=0.12.0'}
 
-  is-path-inside@3.0.3:
-    resolution: {integrity: sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==}
-    engines: {node: '>=8'}
-
   is-plain-obj@4.1.0:
     resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==}
     engines: {node: '>=12'}
@@ -4626,9 +4595,6 @@ packages:
   lodash-es@4.18.1:
     resolution: {integrity: sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==}
 
-  lodash.merge@4.6.2:
-    resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
-
   log-symbols@7.0.1:
     resolution: {integrity: sha512-ja1E3yCr9i/0hmBVaM0bfwDjnGy8I/s6PP4DFp+yP+a+mrHO4Rm7DtmnqROTUkHIkqffC84YY7AeqX6oFk0WFg==}
     engines: {node: '>=18'}
@@ -4864,6 +4830,14 @@ packages:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
 
+  mime-db@1.52.0:
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
+
   mimic-fn@4.0.0:
     resolution: {integrity: sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==}
     engines: {node: '>=12'}
@@ -5032,9 +5006,6 @@ packages:
   obug@2.1.1:
     resolution: {integrity: sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==}
 
-  once@1.4.0:
-    resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
-
   onetime@6.0.0:
     resolution: {integrity: sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==}
     engines: {node: '>=12'}
@@ -5131,10 +5102,6 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
-  path-is-absolute@1.0.1:
-    resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
-    engines: {node: '>=0.10.0'}
-
   path-key@3.1.1:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
@@ -5232,11 +5199,6 @@ packages:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
 
-  prettier@3.8.3:
-    resolution: {integrity: sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==}
-    engines: {node: '>=14'}
-    hasBin: true
-
   prettier@3.9.10:
     resolution: {integrity: sha512-skGHTH1Yb9QvaTC4hWnRTzEYtCpApF0UMBPz+t/0ZPzP8ihefo/btKd+QA7pUE0fEwA1SbS/NmhyEcstdXOIdA==}
     engines: {node: '>=14'}
@@ -5256,6 +5218,10 @@ packages:
   property-information@7.1.0:
     resolution: {integrity: sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==}
 
+  proxy-from-env@2.1.0:
+    resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==}
+    engines: {node: '>=10'}
+
   pseudolocale@3.1.0:
     resolution: {integrity: sha512-jBidehQu5WO8zbFUod0ETJYoVPxZ0ixsdI9B8ilkE0eA+YTydxHA7ujNdU4YhTexD5yH5Griv9r5CuXx+nwFUA==}
     engines: {node: '>=24.0.0'}
@@ -5451,11 +5417,6 @@ packages:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
 
-  rimraf@3.0.2:
-    resolution: {integrity: sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==}
-    deprecated: Rimraf versions prior to v4 are no longer supported
-    hasBin: true
-
   robust-predicates@3.0.3:
     resolution: {integrity: sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==}
 
@@ -5728,9 +5689,6 @@ packages:
     resolution: {integrity: sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==}
     engines: {node: '>=20'}
 
-  text-table@0.2.0:
-    resolution: {integrity: sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==}
-
   thenify-all@1.6.0:
     resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
     engines: {node: '>=0.8'}
@@ -5858,8 +5816,8 @@ packages:
       typescript:
         optional: true
 
-  turbo@2.9.6:
-    resolution: {integrity: sha512-+v2QJey7ZUeUiuigkU+uFfklvNUyPI2VO2vBpMYJA+a1hKFLFiKtUYlRHdb3P9CrAvMzi0upbjI4WT+zKtqkBg==}
+  turbo@2.11.9:
+    resolution: {integrity: sha512-k2ev5dv9OgP2pJwaPuydkZdid+haX2U5TDGcPtpAz0gb0nbRR3eXY/cpfrlvHih52YRTxWIcRVKc0ri3C2Scrg==}
     hasBin: true
 
   twoslash-protocol@0.3.8:
@@ -5874,10 +5832,6 @@ packages:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
 
-  type-fest@0.20.2:
-    resolution: {integrity: sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==}
-    engines: {node: '>=10'}
-
   type-fest@5.6.0:
     resolution: {integrity: sha512-8ZiHFm91orbSAe2PSAiSVBVko18pbhbiB3U9GglSzF/zCGkR+rxpHx6sEMCUm4kxY4LjDIUGgCfUMtwfZfjfUA==}
     engines: {node: '>=20'}
@@ -6175,9 +6129,6 @@ packages:
     resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
     engines: {node: '>=10'}
 
-  wrappy@1.0.2:
-    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
-
   ws@8.20.0:
     resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==}
     engines: {node: '>=10.0.0'}
@@ -6639,11 +6590,6 @@ snapshots:
       eslint: 10.2.1(jiti@2.7.0)
       eslint-visitor-keys: 3.4.3
 
-  '@eslint-community/eslint-utils@4.9.1(eslint@8.57.1)':
-    dependencies:
-      eslint: 8.57.1
-      eslint-visitor-keys: 3.4.3
-
   '@eslint-community/regexpp@4.12.2': {}
 
   '@eslint/config-array@0.23.5':
@@ -6662,20 +6608,6 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
-  '@eslint/eslintrc@2.1.4':
-    dependencies:
-      ajv: 6.15.0
-      debug: 4.4.3
-      espree: 9.6.1
-      globals: 13.24.0
-      ignore: 5.3.2
-      import-fresh: 3.3.1
-      js-yaml: 4.1.1
-      minimatch: 3.1.5
-      strip-json-comments: 3.1.1
-    transitivePeerDependencies:
-      - supports-color
-
   '@eslint/eslintrc@3.3.5':
     dependencies:
       ajv: 6.15.0
@@ -6690,8 +6622,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@eslint/js@8.57.1': {}
-
   '@eslint/object-schema@3.0.5': {}
 
   '@eslint/plugin-kit@0.7.1':
@@ -6750,18 +6680,8 @@ snapshots:
 
   '@humanfs/types@0.15.0': {}
 
-  '@humanwhocodes/config-array@0.13.0':
-    dependencies:
-      '@humanwhocodes/object-schema': 2.0.3
-      debug: 4.4.3
-      minimatch: 3.1.5
-    transitivePeerDependencies:
-      - supports-color
-
   '@humanwhocodes/module-importer@1.0.1': {}
 
-  '@humanwhocodes/object-schema@2.0.3': {}
-
   '@humanwhocodes/retry@0.4.3': {}
 
   '@iconify/types@2.0.0': {}
@@ -8199,22 +8119,22 @@ snapshots:
       path-browserify: 1.0.1
       tinyglobby: 0.2.17
 
-  '@turbo/darwin-64@2.9.6':
+  '@turbo/darwin-64@2.11.9':
     optional: true
 
-  '@turbo/darwin-arm64@2.9.6':
+  '@turbo/darwin-arm64@2.11.9':
     optional: true
 
-  '@turbo/linux-64@2.9.6':
+  '@turbo/linux-64@2.11.9':
     optional: true
 
-  '@turbo/linux-arm64@2.9.6':
+  '@turbo/linux-arm64@2.11.9':
     optional: true
 
-  '@turbo/windows-64@2.9.6':
+  '@turbo/windows-64@2.11.9':
     optional: true
 
-  '@turbo/windows-arm64@2.9.6':
+  '@turbo/windows-arm64@2.11.9':
     optional: true
 
   '@tybys/wasm-util@0.10.1':
@@ -8878,6 +8798,12 @@ snapshots:
 
   acorn@8.16.0: {}
 
+  agent-base@6.0.2:
+    dependencies:
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
   ajv@6.15.0:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -9047,12 +8973,24 @@ snapshots:
 
   async-function@1.0.0: {}
 
+  asynckit@0.4.0: {}
+
   available-typed-arrays@1.0.7:
     dependencies:
       possible-typed-array-names: 1.1.0
 
   axe-core@4.11.3: {}
 
+  axios@1.20.0:
+    dependencies:
+      follow-redirects: 1.16.1
+      form-data: 4.0.6
+      https-proxy-agent: 5.0.1
+      proxy-from-env: 2.1.0
+    transitivePeerDependencies:
+      - debug
+      - supports-color
+
   axobject-query@4.1.0: {}
 
   babel-dead-code-elimination@1.0.12:
@@ -9220,6 +9158,10 @@ snapshots:
 
   color-name@1.1.4: {}
 
+  combined-stream@1.0.8:
+    dependencies:
+      delayed-stream: 1.0.0
+
   comma-separated-tokens@2.0.3: {}
 
   commander@13.1.0: {}
@@ -9500,6 +9442,8 @@ snapshots:
     dependencies:
       robust-predicates: 3.0.3
 
+  delayed-stream@1.0.0: {}
+
   dequal@2.0.3: {}
 
   detect-libc@2.1.2: {}
@@ -9514,10 +9458,6 @@ snapshots:
     dependencies:
       esutils: 2.0.3
 
-  doctrine@3.0.0:
-    dependencies:
-      esutils: 2.0.3
-
   dom-accessibility-api@0.5.16: {}
 
   dompurify@3.4.1:
@@ -9562,7 +9502,7 @@ snapshots:
       has-property-descriptors: 1.0.2
       has-proto: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       internal-slot: 1.1.0
       is-array-buffer: 3.0.5
       is-callable: 1.2.7
@@ -9631,11 +9571,11 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   es-shim-unscopables@1.1.0:
     dependencies:
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   es-to-primitive@1.3.0:
     dependencies:
@@ -9758,7 +9698,7 @@ snapshots:
       eslint: 10.2.1(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
       eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.59.1(eslint@10.2.1(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.1(eslint@10.2.1(jiti@2.7.0))(typescript@6.0.3))(eslint@10.2.1(jiti@2.7.0)))(eslint@10.2.1(jiti@2.7.0)))(eslint@10.2.1(jiti@2.7.0))
-      hasown: 2.0.3
+      hasown: 2.0.4
       is-core-module: 2.16.1
       is-glob: 4.0.3
       minimatch: 3.1.5
@@ -9786,7 +9726,7 @@ snapshots:
       damerau-levenshtein: 1.0.8
       emoji-regex: 9.2.2
       eslint: 10.2.1(jiti@2.7.0)
-      hasown: 2.0.3
+      hasown: 2.0.4
       jsx-ast-utils: 3.3.5
       language-tags: 1.0.9
       minimatch: 3.1.5
@@ -9815,7 +9755,7 @@ snapshots:
       es-iterator-helpers: 1.3.2
       eslint: 10.2.1(jiti@2.7.0)
       estraverse: 5.3.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       jsx-ast-utils: 3.3.5
       minimatch: 3.1.5
       object.entries: 1.1.9
@@ -9827,11 +9767,6 @@ snapshots:
       string.prototype.matchall: 4.0.12
       string.prototype.repeat: 1.0.0
 
-  eslint-scope@7.2.2:
-    dependencies:
-      esrecurse: 4.3.0
-      estraverse: 5.3.0
-
   eslint-scope@9.1.2:
     dependencies:
       '@types/esrecurse': 4.3.1
@@ -9882,49 +9817,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint@8.57.1:
-    dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1)
-      '@eslint-community/regexpp': 4.12.2
-      '@eslint/eslintrc': 2.1.4
-      '@eslint/js': 8.57.1
-      '@humanwhocodes/config-array': 0.13.0
-      '@humanwhocodes/module-importer': 1.0.1
-      '@nodelib/fs.walk': 1.2.8
-      '@ungap/structured-clone': 1.3.0
-      ajv: 6.15.0
-      chalk: 4.1.2
-      cross-spawn: 7.0.6
-      debug: 4.4.3
-      doctrine: 3.0.0
-      escape-string-regexp: 4.0.0
-      eslint-scope: 7.2.2
-      eslint-visitor-keys: 3.4.3
-      espree: 9.6.1
-      esquery: 1.7.0
-      esutils: 2.0.3
-      fast-deep-equal: 3.1.3
-      file-entry-cache: 6.0.1
-      find-up: 5.0.0
-      glob-parent: 6.0.2
-      globals: 13.24.0
-      graphemer: 1.4.0
-      ignore: 5.3.2
-      imurmurhash: 0.1.4
-      is-glob: 4.0.3
-      is-path-inside: 3.0.3
-      js-yaml: 4.1.1
-      json-stable-stringify-without-jsonify: 1.0.1
-      levn: 0.4.1
-      lodash.merge: 4.6.2
-      minimatch: 3.1.5
-      natural-compare: 1.4.0
-      optionator: 0.9.4
-      strip-ansi: 6.0.1
-      text-table: 0.2.0
-    transitivePeerDependencies:
-      - supports-color
-
   esm@3.2.25: {}
 
   espree@10.4.0:
@@ -9939,12 +9831,6 @@ snapshots:
       acorn-jsx: 5.3.2(acorn@8.16.0)
       eslint-visitor-keys: 5.0.1
 
-  espree@9.6.1:
-    dependencies:
-      acorn: 8.16.0
-      acorn-jsx: 5.3.2(acorn@8.16.0)
-      eslint-visitor-keys: 3.4.3
-
   esquery@1.7.0:
     dependencies:
       estraverse: 5.3.0
@@ -10054,10 +9940,6 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.7
 
-  file-entry-cache@6.0.1:
-    dependencies:
-      flat-cache: 3.2.0
-
   file-entry-cache@8.0.0:
     dependencies:
       flat-cache: 4.0.1
@@ -10077,12 +9959,6 @@ snapshots:
       mlly: 1.8.2
       rollup: 4.60.2
 
-  flat-cache@3.2.0:
-    dependencies:
-      flatted: 3.4.2
-      keyv: 4.5.4
-      rimraf: 3.0.2
-
   flat-cache@4.0.1:
     dependencies:
       flatted: 3.4.2
@@ -10090,13 +9966,21 @@ snapshots:
 
   flatted@3.4.2: {}
 
+  follow-redirects@1.16.1: {}
+
   for-each@0.3.5:
     dependencies:
       is-callable: 1.2.7
 
-  format@0.2.2: {}
+  form-data@4.0.6:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.4
+      mime-types: 2.1.35
 
-  fs.realpath@1.0.0: {}
+  format@0.2.2: {}
 
   fsevents@2.3.3:
     optional: true
@@ -10109,7 +9993,7 @@ snapshots:
       call-bound: 1.0.4
       define-properties: 1.2.1
       functions-have-names: 1.2.3
-      hasown: 2.0.3
+      hasown: 2.0.4
       is-callable: 1.2.7
 
   functions-have-names@1.2.3: {}
@@ -10132,7 +10016,7 @@ snapshots:
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       math-intrinsics: 1.1.0
 
   get-proto@1.0.1:
@@ -10164,19 +10048,6 @@ snapshots:
     dependencies:
       is-glob: 4.0.3
 
-  glob@7.2.3:
-    dependencies:
-      fs.realpath: 1.0.0
-      inflight: 1.0.6
-      inherits: 2.0.4
-      minimatch: 3.1.5
-      once: 1.4.0
-      path-is-absolute: 1.0.1
-
-  globals@13.24.0:
-    dependencies:
-      type-fest: 0.20.2
-
   globals@14.0.0: {}
 
   globals@16.4.0: {}
@@ -10188,8 +10059,6 @@ snapshots:
 
   gopd@1.2.0: {}
 
-  graphemer@1.4.0: {}
-
   graphql@16.13.2: {}
 
   hachure-fill@0.5.2: {}
@@ -10212,7 +10081,7 @@ snapshots:
     dependencies:
       has-symbols: 1.1.0
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
@@ -10374,6 +10243,13 @@ snapshots:
 
   html-void-elements@3.0.0: {}
 
+  https-proxy-agent@5.0.1:
+    dependencies:
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
   human-signals@5.0.0: {}
 
   iconv-lite@0.6.3:
@@ -10395,19 +10271,12 @@ snapshots:
 
   imurmurhash@0.1.4: {}
 
-  inflight@1.0.6:
-    dependencies:
-      once: 1.4.0
-      wrappy: 1.0.2
-
-  inherits@2.0.4: {}
-
   inline-style-parser@0.2.7: {}
 
   internal-slot@1.1.0:
     dependencies:
       es-errors: 1.3.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       side-channel: 1.1.0
 
   internmap@1.0.1: {}
@@ -10452,7 +10321,7 @@ snapshots:
 
   is-core-module@2.16.1:
     dependencies:
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   is-data-view@1.0.2:
     dependencies:
@@ -10512,8 +10381,6 @@ snapshots:
 
   is-number@7.0.0: {}
 
-  is-path-inside@3.0.3: {}
-
   is-plain-obj@4.1.0: {}
 
   is-regex@1.2.1:
@@ -10521,7 +10388,7 @@ snapshots:
       call-bound: 1.0.4
       gopd: 1.2.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   is-set@2.0.3: {}
 
@@ -10731,8 +10598,6 @@ snapshots:
 
   lodash-es@4.18.1: {}
 
-  lodash.merge@4.6.2: {}
-
   log-symbols@7.0.1:
     dependencies:
       is-unicode-supported: 2.1.0
@@ -11279,6 +11144,12 @@ snapshots:
       braces: 3.0.3
       picomatch: 2.3.2
 
+  mime-db@1.52.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
   mimic-fn@4.0.0: {}
 
   mimic-function@5.0.1: {}
@@ -11510,10 +11381,6 @@ snapshots:
 
   obug@2.1.1: {}
 
-  once@1.4.0:
-    dependencies:
-      wrappy: 1.0.2
-
   onetime@6.0.0:
     dependencies:
       mimic-fn: 4.0.0
@@ -11710,8 +11577,6 @@ snapshots:
 
   path-exists@4.0.0: {}
 
-  path-is-absolute@1.0.1: {}
-
   path-key@3.1.1: {}
 
   path-key@4.0.0: {}
@@ -11779,8 +11644,6 @@ snapshots:
 
   prelude-ls@1.2.1: {}
 
-  prettier@3.8.3: {}
-
   prettier@3.9.10: {}
 
   pretty-format@27.5.1:
@@ -11803,6 +11666,8 @@ snapshots:
 
   property-information@7.1.0: {}
 
+  proxy-from-env@2.1.0: {}
+
   pseudolocale@3.1.0:
     dependencies:
       commander: 13.1.0
@@ -12095,10 +11960,6 @@ snapshots:
 
   reusify@1.1.0: {}
 
-  rimraf@3.0.2:
-    dependencies:
-      glob: 7.2.3
-
   robust-predicates@3.0.3: {}
 
   rollup@4.60.2:
@@ -12453,8 +12314,6 @@ snapshots:
 
   tagged-tag@1.0.0: {}
 
-  text-table@0.2.0: {}
-
   thenify-all@1.6.0:
     dependencies:
       thenify: 3.3.1
@@ -12572,14 +12431,14 @@ snapshots:
       - tsx
       - yaml
 
-  turbo@2.9.6:
+  turbo@2.11.9:
     optionalDependencies:
-      '@turbo/darwin-64': 2.9.6
-      '@turbo/darwin-arm64': 2.9.6
-      '@turbo/linux-64': 2.9.6
-      '@turbo/linux-arm64': 2.9.6
-      '@turbo/windows-64': 2.9.6
-      '@turbo/windows-arm64': 2.9.6
+      '@turbo/darwin-64': 2.11.9
+      '@turbo/darwin-arm64': 2.11.9
+      '@turbo/linux-64': 2.11.9
+      '@turbo/linux-arm64': 2.11.9
+      '@turbo/windows-64': 2.11.9
+      '@turbo/windows-arm64': 2.11.9
 
   twoslash-protocol@0.3.8: {}
 
@@ -12595,8 +12454,6 @@ snapshots:
     dependencies:
       prelude-ls: 1.2.1
 
-  type-fest@0.20.2: {}
-
   type-fest@5.6.0:
     dependencies:
       tagged-tag: 1.0.0
@@ -13117,8 +12974,6 @@ snapshots:
       string-width: 4.2.3
       strip-ansi: 6.0.1
 
-  wrappy@1.0.2: {}
-
   ws@8.20.0: {}
 
   y18n@5.0.8: {}
diff --git a/turbo.json b/turbo.json
index 1e88ed3..0c8e698 100644
--- a/turbo.json
+++ b/turbo.json
@@ -16,6 +16,7 @@
             ]
         },
         "lint": {},
+        "fmt": {},
         "dev": {
             "cache": false,
             "persistent": true