@allbluecn/web-app 0.11.0 → 0.11.1

package/src/server/serverFns/auth/{invitation.ts → verify-reminder.ts}

@@ -16,34 +16,17 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
-import { requireAdmin } from '@/server/auth-helpers'
+import { getCurrentSession } from '@/lib/session'
+import { ensureVerifyReminder } from '@/server/notifications/verify-reminder'
 
-const DEFAULT_CODE = '123123'
-
-export const createDefaultInvitationFn = createServerFn({ method: 'POST' })
+export const ensureVerifyReminderFn = createServerFn({ method: 'POST' })
   .validator(z.object({}))
   .handler(async () => {
-    const hasPermission = true
-
-    const existing = await prisma.invitationCode.findUnique({
-      where: { code: DEFAULT_CODE },
-    })
-    if (existing) {
-      return { message: 'Invitation code already exists', code: existing }
-    }
-
-    const expiresAt = new Date()
-    expiresAt.setDate(expiresAt.getDate() + 1)
-
-    const invCode = await prisma.invitationCode.create({
-      data: {
-        code: DEFAULT_CODE,
-        maxUses: 1,
-        expiresAt,
-      },
-    })
-
-    return { message: 'Default invitation code created', code: invCode }
+    const session = await getCurrentSession(getRequest())
+    const userId = session?.user?.id
+    if (!userId) return { reminded: false }
+    await ensureVerifyReminder(userId)
+    return { reminded: true }
   })

package/src/server/serverFns/changelog/__tests__/subscribe.test.ts

@@ -0,0 +1,119 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const sendTemplateEmailMock = vi.hoisted(() => vi.fn().mockResolvedValue({ sent: true }))
+
+const emailSubscriberMock = vi.hoisted(() => ({
+  findUnique: vi.fn(),
+  upsert: vi.fn(),
+  updateMany: vi.fn(),
+}))
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: { emailSubscriber: emailSubscriberMock },
+}))
+
+vi.mock('@/server/middlewares/rate-limit', () => ({
+  checkAuthRateLimit: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('@/server/email', () => ({
+  sendTemplateEmail: (...args: unknown[]) => sendTemplateEmailMock(...args),
+  generateEmailToken: () => 'tok-' + 'x'.repeat(64),
+}))
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    let validator: { safeParse: (d: unknown) => { success: boolean; data?: unknown } } | undefined
+    let handler: ((args: { data: unknown }) => Promise<unknown>) | undefined
+    const chain = {
+      validator(v: unknown) {
+        validator = v as { safeParse: (d: unknown) => { success: boolean; data?: unknown } }
+        return chain
+      },
+      handler(h: unknown) {
+        handler = h as (args: { data: unknown }) => Promise<unknown>
+        return async (args: { data: unknown }) => {
+          if (validator) {
+            const parsed = validator.safeParse(args.data)
+            if (!parsed.success) throw new Error('zod validation failed')
+            args = { data: parsed.data }
+          }
+          return handler!(args)
+        }
+      },
+    }
+    return chain
+  },
+}))
+
+import { subscribeChangelogFn, confirmChangelogSubscriptionFn } from '../subscribe'
+
+const invoke = async (fn: unknown, data: unknown) =>
+  (fn as (args: { data: unknown }) => Promise<unknown>)({ data })
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('subscribeChangelogFn', () => {
+  it('已 confirmed 且未退订 → already，不发邮件', async () => {
+    emailSubscriberMock.findUnique.mockResolvedValue({
+      id: '1', email: 'a@b.com', confirmedAt: new Date(), unsubscribedAt: null,
+    })
+    const r = await invoke(subscribeChangelogFn, { email: 'A@B.com' })
+    expect(r).toEqual({ status: 'already' })
+    expect(emailSubscriberMock.upsert).not.toHaveBeenCalled()
+    expect(sendTemplateEmailMock).not.toHaveBeenCalled()
+  })
+
+  it('未 confirmed → upsert 新 token 并发确认邮件', async () => {
+    emailSubscriberMock.findUnique.mockResolvedValue({
+      id: '1', email: 'a@b.com', confirmedAt: null, unsubscribedAt: null,
+    })
+    emailSubscriberMock.upsert.mockResolvedValue({})
+    const r = await invoke(subscribeChangelogFn, { email: 'a@b.com', locale: 'en' })
+    expect(r).toEqual({ status: 'pending' })
+    const upsert = emailSubscriberMock.upsert.mock.calls[0][0]
+    expect(upsert.where).toEqual({ email: 'a@b.com' })
+    expect(upsert.update.confirmToken).toBe('tok-' + 'x'.repeat(64))
+    expect(upsert.update.locale).toBe('en')
+    expect(upsert.update.createdAt).toBeInstanceOf(Date)
+    const email = sendTemplateEmailMock.mock.calls[0][0]
+    expect(email.key).toBe('product.changelog-confirm')
+    expect(email.to).toBe('a@b.com')
+    expect(email.locale).toBe('en')
+    expect(String(email.vars.confirmUrl)).toContain('/changelog/confirm?token=tok-')
+  })
+
+  it('已退订 → 重新发确认邮件', async () => {
+    emailSubscriberMock.findUnique.mockResolvedValue({
+      id: '1', email: 'a@b.com', confirmedAt: new Date(), unsubscribedAt: new Date(),
+    })
+    emailSubscriberMock.upsert.mockResolvedValue({})
+    const r = await invoke(subscribeChangelogFn, { email: 'a@b.com' })
+    expect(r).toEqual({ status: 'pending' })
+    expect(sendTemplateEmailMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('email 为空 → zod 拒绝', async () => {
+    await expect(invoke(subscribeChangelogFn, { email: 'nope' })).rejects.toThrow()
+  })
+})
+
+describe('confirmChangelogSubscriptionFn', () => {
+  it('updateMany 命中 1 行 → ok', async () => {
+    emailSubscriberMock.updateMany.mockResolvedValue({ count: 1 })
+    const r = await invoke(confirmChangelogSubscriptionFn, { token: 't' })
+    expect(r).toEqual({ ok: true })
+    const where = emailSubscriberMock.updateMany.mock.calls[0][0].where
+    expect(where.confirmToken).toBe('t')
+    expect(where.confirmedAt).toBeNull()
+    expect(where.createdAt.gte).toBeInstanceOf(Date)
+  })
+
+  it('token 无效或已确认或过期 → count 0 → not ok（防并发双写）', async () => {
+    emailSubscriberMock.updateMany.mockResolvedValue({ count: 0 })
+    const r = await invoke(confirmChangelogSubscriptionFn, { token: 'bad' })
+    expect(r).toEqual({ ok: false })
+  })
+})

package/src/server/serverFns/changelog/subscribe.ts

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { sendTemplateEmail, generateEmailToken } from '@/server/email'
+
+const CONFIRM_TOKEN_TTL_MS = 24 * 60 * 60 * 1000
+const CONFIRM_TEMPLATE_KEY = 'product.changelog-confirm'
+
+const appUrl = () => process.env.VITE_APP_URL ?? 'http://localhost:3000'
+
+const normalizeLocale = (locale: string | undefined) => (locale === 'en' ? 'en' : 'zh')
+
+export interface ChangelogSubscribeResult {
+  status: 'already' | 'pending'
+}
+
+export const subscribeChangelogFn = createServerFn({ method: 'POST' })
+  .validator(
+    z.object({
+      email: z.string().email().transform((v) => v.toLowerCase()),
+      locale: z.string().optional(),
+    }),
+  )
+  .handler(async ({ data }): Promise<ChangelogSubscribeResult> => {
+    await checkAuthRateLimit('changelogSubscribe', 5, 15 * 60 * 1000)
+
+    const email = data.email
+    const existing = await prisma.emailSubscriber.findUnique({ where: { email } })
+    if (existing?.confirmedAt && !existing.unsubscribedAt) {
+      return { status: 'already' }
+    }
+
+    const confirmToken = generateEmailToken()
+    const locale = normalizeLocale(data.locale)
+    const now = new Date()
+    await prisma.emailSubscriber.upsert({
+      where: { email },
+      create: { email, locale, confirmToken },
+      // 重订阅时清零 unsubscribedAt，让已退订用户重新订阅后回到「已确认」状态（confirmedAt 保留）。
+      update: { confirmToken, locale, createdAt: now, unsubscribedAt: null },
+    })
+
+    await sendTemplateEmail({
+      key: CONFIRM_TEMPLATE_KEY,
+      to: email,
+      locale,
+      vars: { confirmUrl: `${appUrl()}/changelog/confirm?token=${confirmToken}` },
+    }).catch((err) => {
+      console.error('changelog confirm email failed', {
+        templateKey: CONFIRM_TEMPLATE_KEY,
+        reason: err instanceof Error ? err.message : String(err),
+      })
+    })
+
+    return { status: 'pending' }
+  })
+
+export interface ChangelogConfirmResult {
+  ok: boolean
+}
+
+export const confirmChangelogSubscriptionFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ token: z.string().min(1) }))
+  .handler(async ({ data }): Promise<ChangelogConfirmResult> => {
+    const floor = new Date(Date.now() - CONFIRM_TOKEN_TTL_MS)
+    const claimed = await prisma.emailSubscriber.updateMany({
+      where: { confirmToken: data.token, confirmedAt: null, createdAt: { gte: floor } },
+      data: { confirmedAt: new Date() },
+    })
+    return { ok: claimed.count === 1 }
+  })

package/src/server/serverFns/email-unsubscribe.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { verifyUnsubscribeToken } from '@/server/email/deliverability'
+
+export interface UnsubscribeByEmailTokenResult {
+  ok: boolean
+  mechanism?: 'user' | 'subscriber'
+}
+
+export const unsubscribeByEmailTokenFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ token: z.string().min(1) }))
+  .handler(async ({ data }): Promise<UnsubscribeByEmailTokenResult> => {
+    // 防 token 爆破扫描：单 IP 15 分钟内最多 20 次
+    await checkAuthRateLimit('unsubscribe', 20, 15 * 60 * 1000)
+
+    // 机制 1：注册用户 HMAC 无状态 token（对 userId+email+category 签名，10 年有效）
+    // 命中即 upsert EmailPreference，一键全退（本页不做分类精确退订）
+    const payload = verifyUnsubscribeToken(data.token)
+    if (payload) {
+      await prisma.emailPreference.upsert({
+        where: { userId: payload.userId },
+        create: { userId: payload.userId, unsubscribedAll: true },
+        update: { unsubscribedAll: true },
+      })
+      return { ok: true, mechanism: 'user' }
+    }
+
+    // 机制 2：订阅者 DB token（changelog 确认/退订共用 confirmToken）
+    // 幂等保护：仅未退订记录可退订；重复点击已退订链接返回 ok 而非 fail（避免骚扰）
+    const now = new Date()
+    const claimed = await prisma.emailSubscriber.updateMany({
+      where: { confirmToken: data.token, unsubscribedAt: null },
+      data: { unsubscribedAt: now },
+    })
+    if (claimed.count > 0) return { ok: true, mechanism: 'subscriber' }
+
+    // 重复退订幂等返回：token 命中但已退订 → 也返回 ok（用户可能重复点击链接）
+    const alreadyUnsubscribed = await prisma.emailSubscriber.findUnique({
+      where: { confirmToken: data.token },
+      select: { unsubscribedAt: true },
+    })
+    if (alreadyUnsubscribed?.unsubscribedAt) {
+      return { ok: true, mechanism: 'subscriber' }
+    }
+
+    return { ok: false }
+  })

package/src/server/serverFns/notifications.ts

@@ -11,10 +11,13 @@ import {
   type NotificationItem,
   type NotificationListResult,
   type CategoryFrequencies,
+  type CategoryEmailFlags,
 } from '@allbluecn/kernel'
 import {
   getOrCreatePreferences,
   DEFAULT_CATEGORIES,
+  DEFAULT_EMAIL_CATEGORIES,
+  normalizeEmailCategories,
 } from '@/server/notifications/notification-service'
 
 const PAGE_SIZE = 20
@@ -132,6 +135,10 @@ export const getNotificationPreferencesFn = createServerFn({ method: 'GET' })
 
 const preferencesSchema = z.object({
   categories: z.record(z.string(), z.enum(NOTIFICATION_FREQUENCIES)),
+  // 外部直连 serverFn 时可能不传 emailCategories，normalize 兜底全 false
+  emailCategories: z
+    .record(z.enum(NOTIFICATION_CATEGORIES), z.boolean())
+    .optional(),
   dndEnabled: z.boolean(),
   dndStart: z.string().regex(/^\d{2}:\d{2}$/),
   dndEnd: z.string().regex(/^\d{2}:\d{2}$/),
@@ -152,17 +159,20 @@ export const updateNotificationPreferencesFn = createServerFn({
         categories[c] = v as CategoryFrequencies[NotificationCategory]
       }
     }
+    const emailCategories = normalizeEmailCategories(data.emailCategories)
     await prisma.notificationPreference.upsert({
       where: { userId },
       create: {
         userId,
         categories,
+        emailCategories,
         dndEnabled: data.dndEnabled,
         dndStart: data.dndStart,
         dndEnd: data.dndEnd,
       },
       update: {
         categories,
+        emailCategories,
         dndEnabled: data.dndEnabled,
         dndStart: data.dndStart,
         dndEnd: data.dndEnd,

package/src/server/serverFns/team.ts

@@ -6,7 +6,7 @@ import { prisma } from '@allbluecn/database'
 import { requireAuth } from '@/server/auth-helpers'
 import { requireTeamSeats } from '@/server/resources'
 import { auditLog } from '@/server/audit'
-import { getEmailSender } from '@/server/email/sender'
+import { sendTemplateEmail } from '@/server/email'
 import { USER_BRIEF_SELECT } from '@/server/team-access'
 
 const INVITE_EXPIRES_DAYS = 7
@@ -100,12 +100,17 @@ export const createTeamInvitationFn = createServerFn({ method: 'POST' })
         select: OWNER_SELECT,
       })
       const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
-      await getEmailSender().send({
+      await sendTemplateEmail({
+        key: 'team.invite',
         to: email,
-        subject: `${owner?.username ?? '有人'} 邀请你加入 AllBlue 团队`,
-        html: `<p><a href="${appUrl}/invite/${token}">接受邀请</a></p>`,
-        text: `接受邀请：${appUrl}/invite/${token}`,
-      })
+        locale: 'zh',
+        vars: {
+          ownerUsername: owner?.username ?? '',
+          inviteUrl: `${appUrl}/invite/${token}`,
+          expiresAt: expiresAt.toISOString().slice(0, 10),
+        },
+        replyTo: owner?.email ?? undefined,
+      }).catch(() => undefined)
     }
 
     await auditLog({
@@ -247,13 +252,23 @@ export const resendTeamInvitationFn = createServerFn({ method: 'POST' })
       },
     })
     if (inv.channel === 'email' && inv.email) {
+      const owner = await prisma.user.findUnique({
+        where: { id: ownerId },
+        select: OWNER_SELECT,
+      })
       const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
-      await getEmailSender().send({
+      const newExpiresAt = new Date(Date.now() + INVITE_EXPIRES_DAYS * 24 * 60 * 60 * 1000)
+      await sendTemplateEmail({
+        key: 'team.invite',
         to: inv.email,
-        subject: 'AllBlue 团队邀请（重发）',
-        html: `<p><a href="${appUrl}/invite/${token}">接受邀请</a></p>`,
-        text: `接受邀请：${appUrl}/invite/${token}`,
-      })
+        locale: 'zh',
+        vars: {
+          ownerUsername: owner?.username ?? '',
+          inviteUrl: `${appUrl}/invite/${token}`,
+          expiresAt: newExpiresAt.toISOString().slice(0, 10),
+        },
+        replyTo: owner?.email ?? undefined,
+      }).catch(() => undefined)
     }
     return { success: true, token }
   })
@@ -683,6 +698,16 @@ export const applyTeamInvitationFn = createServerFn({ method: 'POST' })
           where: { id: inv.id },
           data: { status: 'pending_approval', applicantEmail: email },
         })
+        const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+        await sendTemplateEmail({
+          key: 'team.apply-notify',
+          to: inv.owner.email ?? '',
+          userId: inv.owner.id,
+          vars: {
+            applicantEmail: email,
+            approveUrl: `${appUrl}/settings/team`,
+          },
+        }).catch(() => undefined)
       }
       return { success: true, requiresApproval: true, duplicate: !!existing }
     }
@@ -843,5 +868,18 @@ export const approveTeamInvitationFn = createServerFn({ method: 'POST' })
       action: 'team.invite.approve',
       metadata: { seatType: data.seatType },
     })
+
+    const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+    const recipientEmail = inv.email ?? inv.applicantEmail
+    if (recipientEmail) {
+      await sendTemplateEmail({
+        key: 'team.approved',
+        to: recipientEmail,
+        vars: {
+          inviteUrl: `${appUrl}/invite/${inv.token}`,
+        },
+      }).catch(() => undefined)
+    }
+
     return { success: true }
   })

package/vite.shared.ts

@@ -30,7 +30,7 @@
 
 import { defineConfig, type PluginOption } from 'vite'
 import path from 'node:path'
-import { readFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { execFileSync } from 'node:child_process'
 
 // 从 apps/web/package.json 读取版本号，构建时注入到客户端/SSR
@@ -80,6 +80,90 @@ function prismaDirnamePolyfill(rootDir: string): PluginOption {
   }
 }
 
+function cssTreeRuntimeAssetsPlugin(rootDir: string): PluginOption {
+  return {
+    name: 'css-tree-runtime-assets',
+    async closeBundle() {
+      // nitro 把 css-tree / jsdom（isomorphic-dompurify 依赖）外部化打平为
+      // _libs/*.mjs，其内部运行时 require 的资源文件不随 trace 拷贝 ——
+      // closeBundle 后按产物的解析路径补齐，否则冷启动 ENOENT 全站 500。
+      const { mkdir, readdir, copyFile } = await import('node:fs/promises')
+      const funcDir = path.resolve(rootDir, '.vercel/output/functions/__server.func')
+      const pnpmDir = path.resolve(rootDir, '../../node_modules/.pnpm')
+      try {
+        // a) jsdom 的 xhr-sync-worker.js（运行时相对 require）
+        const isoVdirs = (await readdir(pnpmDir)).filter((d) => d.startsWith('isomorphic-dompurify@'))
+        for (const v of isoVdirs) {
+          const worker = path.join(pnpmDir, v, 'node_modules/jsdom/lib/jsdom/living/xhr/xhr-sync-worker.js')
+          if (existsSync(worker)) {
+            await mkdir(path.join(funcDir, '_libs'), { recursive: true })
+            await copyFile(worker, path.join(funcDir, '_libs/xhr-sync-worker.js'))
+          }
+        }
+        // a2) jsdom XHR 的 syncWorker resolve 在 bundle 后路径失真（真实 worker 文件
+        //     已拷贝到 _libs 根，仍解析失败则降级空串——服务端 syncWorker 走 null 分支）
+        const isoLib = path.join(funcDir, '_libs/isomorphic-dompurify.mjs')
+        {
+          const { readFile, writeFile } = await import('node:fs/promises')
+          let code = await readFile(isoLib, 'utf8')
+          const target = '__require.resolve("./xhr-sync-worker.js")'
+          if (code.includes(target)) {
+            code = code.replaceAll(
+              target,
+              '(()=>{try{return __require.resolve("./xhr-sync-worker.js")}catch{return ""}})()',
+            )
+            await writeFile(isoLib, code)
+          }
+        }
+        // b) css-tree data/patch.json（dom-selector 内 createRequire('../data/patch.json')）
+        //    css-tree 是 transitive 包，从 .pnpm 虚拟目录扫描定位
+        const ctVdirs = (await readdir(pnpmDir)).filter((d) => d.startsWith('css-tree@'))
+        let cssTreePkg: string | null = null
+        for (const v of ctVdirs) {
+          const cand = path.join(pnpmDir, v, 'node_modules/css-tree')
+          if (existsSync(path.join(cand, 'data/patch.json'))) {
+            cssTreePkg = cand
+            break
+          }
+        }
+        if (!cssTreePkg) throw new Error('css-tree data/patch.json 未找到')
+        const patchDestDir = path.join(funcDir, '_libs/data')
+        await mkdir(patchDestDir, { recursive: true })
+        await copyFile(path.join(cssTreePkg, 'data/patch.json'), path.join(patchDestDir, 'patch.json'))
+        // c) mdn-data css json（require('mdn-data/css/*.json') 向上解析 node_modules）
+        const mdnCssDir = path.join(path.dirname(cssTreePkg), 'mdn-data/css')
+        const dest = path.join(funcDir, 'node_modules/mdn-data/css')
+        await mkdir(dest, { recursive: true })
+        for (const f of await readdir(mdnCssDir)) {
+          if (f.endsWith('.json')) await copyFile(path.join(mdnCssDir, f), path.join(dest, f))
+        }
+      } catch (e) {
+        console.error('[css-tree-runtime-assets] 资源补齐失败:', e instanceof Error ? e.message : e)
+      }
+    },
+  }
+}
+
+function runtimeResourceInlinePlugin(): PluginOption {
+  return {
+    name: 'runtime-resource-inline',
+    transform(code, id) {
+      // jsdom 模块顶层同步读取默认样式表，nitro 打平 bundle 后
+      // __dirname 相对路径失效，冷启动 ENOENT 全站 500 → 构建期内联
+      if (id.includes('jsdom') && id.includes('computed-style.js') && code.includes('default-stylesheet.css')) {
+        const cssPath = path.resolve(path.dirname(id), '../../../browser/default-stylesheet.css')
+        const css = readFileSync(cssPath, 'utf8')
+        const replaced = code.replace(
+          /fs\.readFileSync\(\s*path\.resolve\(__dirname,\s*"\.\.\/\.\.\/\.\.\/browser\/default-stylesheet\.css"\),\s*\{\s*encoding:\s*"utf-8"\s*\}\s*\)/,
+          JSON.stringify(css),
+        )
+        if (replaced !== code) return { code: replaced, map: null }
+      }
+      return undefined
+    },
+  }
+}
+
 function tiptapAliasPlugin(rootDir: string): PluginOption {
   const tiptapSrc = path.resolve(rootDir, '../../packages/tiptap/src')
   return {
@@ -108,7 +192,7 @@ export function createWebViteConfig(opts: WebViteConfigOptions) {
   const appUpdateDate = getAppUpdateDate(opts.rootDir)
   return defineConfig(async () => {
     const deployTarget = process.env.DEPLOY_TARGET
-    const plugins: PluginOption[] = [...opts.basePlugins, tiptapAliasPlugin(opts.rootDir)]
+    const plugins: PluginOption[] = [...opts.basePlugins, tiptapAliasPlugin(opts.rootDir), runtimeResourceInlinePlugin()]
 
     // Vercel 平台自动注入 VERCEL_ENV 环境变量，nitro 插件始终挂载。DEPLOY_TARGET=vercel
     // 保留作为本地兼容触发器（Pro 仓 build.sh 及本地 vercel preview 均依赖它）。
@@ -116,7 +200,7 @@ export function createWebViteConfig(opts: WebViteConfigOptions) {
     if (isVercelTarget) {
       const { nitro } = await import('nitro/vite')
       plugins.splice(2, 0, nitro({ preset: 'vercel' }))
-      plugins.push(prismaDirnamePolyfill(opts.rootDir))
+      plugins.push(prismaDirnamePolyfill(opts.rootDir), cssTreeRuntimeAssetsPlugin(opts.rootDir))
     }
 
     if (deployTarget === 'cloudflare') {