Add /migrate-webapi-selectall skill to replace deprecated Web API wildcard field settings

[Ramachandran R (r-ramachandran)]

Why

Power Pages is deprecating the wildcard (*) value for Webapi/<table>/fields site settings. A wildcard exposes every column of a table through the Web API — including columns the site never reads — and those sites will break when the wildcard is retired. Migrating by hand means reading every Web API call and every response consumer to work out which columns are actually required, which is impractical on a real site.

What this adds

A new user-invocable skill, /power-pages:migrate-webapi-selectall, that replaces each wildcard with the smallest explicit column list the site's own code proves it needs.

• Inventories every Webapi/<table>/fields setting across all configuration scopes and deployment profiles, classifying each as wildcard, explicit, missing, or duplicate.
• Traces each Web API call through its wrappers, query/body builders, response mappers, and consumers, then resolves the entity set to its logical table via Dataverse metadata — never by pluralizing a name.
• Derives columns from $select, $filter, $orderby, $apply, FetchXML, write payloads, @odata.bind lookups, and file/image routes. The response projection and the fields allowlist stay separate, so a filter-only column is never added to $select.
• Proposes an exact replacement for every wildcard, adds a $select where a read previously relied on implicit selection, and reviews already-explicit settings for missing or unnecessary columns.

Both site types are covered: traditional HTML/JavaScript/Liquid sites and React, Vue, Angular, or Astro code sites. Only authored source is analyzed — compiled bundles, content-hashed assets, source maps, and build output are excluded. If a call exists only in generated output, the skill raises a blocker instead of inferring columns from it.

Safety and scale

• Three approval gates (scope, plan, deployment). A partial wildcard plan is never offered, and cancelling always leaves the report intact.
• Verification repeats discovery from scratch rather than trusting earlier notes, and reconciles counts before reporting completion.
• Bounded, resumable batches with persistent CSV ledgers keep the workflow reliable at large number of configurations without issuing per-item Dataverse calls.

Reporting

Each run writes docs/webapi-selectall-migration/migration-report.html from a bundled template — wildcards with proposed fixes, already-explicit settings, call coverage, gaps, and verification results. The report is responsive and accessible, and reuses the existing Power Pages report styling. Reports exclude absolute paths, URLs, tokens, and data values; CSV ledgers are generated from header-only assets so the output format stays stable across runs.

Implementation notes

All semantic decisions stay with the agent. The only deterministic script is query-table-schema.js, which retrieves Dataverse table, attribute, and relationship metadata using sequential requests, retry/backoff, token refresh, and checkpoint resume.

The skill is registered in the plugin README, the approval-gate catalog (§6.32), and the skill-tracking table.