@h-ai/cli 0.1.0-alpha.50 → 0.1.0-alpha.53

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/cli",
   "type": "module",
-  "version": "0.1.0-alpha.50",
+  "version": "0.1.0-alpha.53",
   "description": "Hai Framework CLI for project scaffolding and code generation.",
   "license": "Apache-2.0",
   "keywords": [
@@ -34,7 +34,7 @@
     "ora": "^9.1.0",
     "prompts": "^2.4.2",
     "yaml": "^2.7.0",
-    "@h-ai/core": "0.1.0-alpha.50"
+    "@h-ai/core": "0.1.0-alpha.53"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",

package/templates/apps/api/.dockerignore.hbs

@@ -0,0 +1,14 @@
+.git
+.github
+.agents
+.claude
+.codex
+.opencode
+.turbo
+build
+dist
+node_modules
+playwright-report
+test-results
+**/data
+*.log

package/templates/apps/api/Dockerfile.hbs

@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1.7
+FROM node:22-bookworm-slim AS build
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
+WORKDIR /workspace
+
+RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
+COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN pnpm build
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm --filter {{api.servicePackageName}} --prod deploy /prod/app
+
+FROM node:22-bookworm-slim AS runtime-base
+
+ENV NODE_ENV=production
+ENV HOST=0.0.0.0
+ENV PORT=3000
+WORKDIR /app
+
+COPY --from=build --chown=node:node /prod/app ./
+RUN mkdir -p /app/data && chown node:node /app/data
+
+USER node
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+CMD ["node", "dist/index.js"]
+
+FROM runtime-base AS runtime-with-data
+
+COPY --from=embedded-data --chown=node:node / /app/data/
+
+FROM runtime-base AS runtime

package/templates/apps/api/apps/{{projectName}}-service/README.md.hbs

@@ -9,6 +9,12 @@ pnpm --filter {{api.servicePackageName}} dev
 pnpm --filter {{api.servicePackageName}} test
 ```
 
+## 容器运行
+
+- 根目录运行 `pnpm docker:build` / `pnpm podman:build`；镜像监听 `0.0.0.0:3000`。
+- 配置默认打包自本目录 `config/`，可在运行时只读挂载到 `/app/config`，敏感值通过环境变量注入。
+- `data/` 可作为 SQLite/本地存储目录；`pnpm docker:build:data` / `pnpm podman:build:data` 会将其固化为镜像初始数据，生产写入应挂载 `/app/data` volume。
+
 ## 关键目录
 
 - `config/`：service 配置

package/templates/apps/api/apps/{{projectName}}-service/config/_core.yml.hbs

@@ -4,8 +4,8 @@
 
 name: {{projectName}} API Service
 version: 0.1.0
-env: development
-debug: false
+env: ${HAI_ENV:development}
+debug: ${HAI_DEBUG:false}
 
 defaultLocale: {{defaultLocale}}
 supportedLocales:

package/templates/apps/api/apps/{{projectName}}-service/config/_serv.yml.hbs

@@ -18,10 +18,10 @@ http:
   rpc: false
 
 cors:
-  origin: '*'
-  nativeOrigins: http://localhost,https://tauri.localhost,tauri://localhost,capacitor://localhost
-{{#if features.iam}}  credentials: true
-{{else}}  credentials: false
+  origin: ${HAI_CORS_ORIGIN:*}
+  nativeOrigins: ${HAI_CORS_NATIVEORIGINS:http://localhost,https://tauri.localhost,tauri://localhost,capacitor://localhost}
+{{#if features.iam}}  credentials: ${HAI_CORS_CREDENTIALS:true}
+{{else}}  credentials: ${HAI_CORS_CREDENTIALS:false}
 {{/if}}  allowedHeaders:
     - Authorization
     - Content-Type

package/templates/apps/api/apps/{{projectName}}-service/data/.gitkeep.hbs

@@ -0,0 +1 @@
+

package/templates/apps/api/apps/{{projectName}}-service/package.json.hbs

@@ -14,6 +14,8 @@
   "types": "./dist/index.d.ts",
   "files": [
     "dist",
+    "config",
+    "data",
     "README.md"
   ],
   "scripts": {

package/templates/apps/api/package.json.hbs

@@ -9,6 +9,10 @@
     "dev": "pnpm --filter {{api.servicePackageName}} dev",
     "compile": "pnpm typecheck && pnpm build",
     "build": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present build",
+    "docker:build": "docker build --target runtime -t {{projectName}}:latest .",
+    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./apps/{{projectName}}-service/data -t {{projectName}}:latest .",
+    "podman:build": "podman build --format docker --jobs=1 --target runtime -t {{projectName}}:latest .",
+    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./apps/{{projectName}}-service/data -t {{projectName}}:latest .",
     "typecheck": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present typecheck",
     "lint": "pnpm -r --if-present lint",
     "test": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present test",

package/templates/apps/fullstack/.dockerignore.hbs

@@ -0,0 +1,16 @@
+.git
+Dockerfile
+.github
+.agents
+.claude
+.codex
+.opencode
+.turbo
+**/build
+**/dist
+**/node_modules
+node_modules
+playwright-report
+test-results
+**/data
+*.log

package/templates/apps/fullstack/Dockerfile.hbs

@@ -0,0 +1,58 @@
+# syntax=docker/dockerfile:1.7
+FROM node:22-bookworm-slim AS build
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
+WORKDIR /workspace
+
+RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
+COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN pnpm build
+
+FROM build AS service-build
+
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm --filter {{fullstack.servPackageName}} --prod deploy /prod/service
+
+FROM node:22-bookworm-slim AS service
+
+ENV NODE_ENV=production
+ENV HOST=0.0.0.0
+ENV PORT=3000
+WORKDIR /app
+
+COPY --from=service-build --chown=node:node /prod/service ./
+RUN mkdir -p /app/data && chown node:node /app/data
+
+USER node
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+CMD ["node", "dist/index.js"]
+
+FROM service AS runtime-with-data
+
+COPY --from=embedded-data --chown=node:node / /app/data/
+
+FROM service AS runtime
+
+{{#if fullstack.frontends.web}}
+FROM nginxinc/nginx-unprivileged:1.29-alpine AS web
+
+ENV PUBLIC_API_BASE=
+ENV NGINX_ENVSUBST_FILTER=PUBLIC_API_BASE_BASE64
+ENV NGINX_ENVSUBST_OUTPUT_DIR=/tmp/hai-runtime-config
+
+RUN mkdir -p /tmp/hai-runtime-config
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --chmod=755 docker/19-runtime-config.envsh /docker-entrypoint.d/19-runtime-config.envsh
+COPY docker/runtime-config.js.template /etc/nginx/templates/runtime-config.js.template
+COPY --from=build /workspace/apps/{{projectName}}-web/dist /usr/share/nginx/html
+
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget -Y off -q -O /dev/null http://127.0.0.1:8080/health || exit 1
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/index.html.hbs

@@ -6,10 +6,11 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>{{projectName}} Web</title>
+    <script src="/runtime-config.js"></script>
   </head>
   <body>
     <div id="app"></div>
     <script type="module" src="/src/main.ts"></script>
   </body>
 </html>
-{{/if}}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/public/runtime-config.js.hbs

@@ -0,0 +1 @@
+globalThis.__HAI_PUBLIC_CONFIG__ = {}

package/templates/apps/fullstack/apps/{{projectName}}-web/tests/api.test.ts.hbs

@@ -24,5 +24,32 @@ describe('fetchAppInfo', () => {
 
     expect(info.name).toBe('{{fullstack.servPackageName}}')
   })
+
+  it('uses API origin injected at container startup', async () => {
+    Object.assign(globalThis, {
+      __HAI_PUBLIC_CONFIG__: { apiBase: 'https://api.example.com' },
+    })
+    let requestedUrl = ''
+    const fetchFn: typeof fetch = async (input) => {
+      requestedUrl = input instanceof Request ? input.url : String(input)
+      return new Response(JSON.stringify({
+        success: true,
+        data: {
+          name: '{{fullstack.servPackageName}}',
+          version: '0.1.0',
+          startedAt: '2026-01-01T00:00:00.000Z',
+          frontends: ['web'],
+        },
+      }), { headers: { 'content-type': 'application/json' } })
+    }
+
+    try {
+      await fetchAppInfo({ fetchFn })
+      expect(requestedUrl).toContain('https://api.example.com/api/v1')
+    }
+    finally {
+      Reflect.deleteProperty(globalThis, '__HAI_PUBLIC_CONFIG__')
+    }
+  })
 })
 {{/if}}

package/templates/apps/fullstack/docker/19-runtime-config.envsh.hbs

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# 使用 Base64 跨越 shell、envsubst 与 JavaScript 字符串边界，避免 URL 字符改变脚本语义。
+PUBLIC_API_BASE_BASE64="$(printf '%s' "${PUBLIC_API_BASE:-}" | base64 | tr -d '\n')"
+export PUBLIC_API_BASE_BASE64

package/templates/apps/fullstack/docker/nginx.conf.hbs

@@ -0,0 +1,24 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+server {
+  listen 8080;
+  server_name _;
+  root /usr/share/nginx/html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  location = /runtime-config.js {
+    alias /tmp/hai-runtime-config/runtime-config.js;
+    add_header Cache-Control "no-store";
+    default_type application/javascript;
+  }
+
+  location = /health {
+    access_log off;
+    add_header Content-Type text/plain;
+    return 200 'ok';
+  }
+}
+{{/if}}

package/templates/apps/fullstack/docker/runtime-config.js.template.hbs

@@ -0,0 +1,3 @@
+globalThis.__HAI_PUBLIC_CONFIG__ = {
+  apiBase: new TextDecoder().decode(Uint8Array.from(atob('${PUBLIC_API_BASE_BASE64}'), value => value.charCodeAt(0))),
+}

package/templates/apps/fullstack/package.json.hbs

@@ -11,6 +11,12 @@
     "dev": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm --parallel --filter {{fullstack.servPackageName}}{{#each fullstack.frontendApps}} --filter {{packageName}}{{/each}} dev",
     "compile": "pnpm typecheck && pnpm build",
     "build": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm -r --if-present build",
+    "docker:build": "docker build --target runtime -t {{projectName}}:latest .",
+    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./packages/{{projectName}}-serv/data -t {{projectName}}:latest ."{{#if fullstack.frontends.web}},
+    "docker:build:web": "docker build --target web -t {{projectName}}-web:latest ."{{/if}},
+    "podman:build": "podman build --format docker --jobs=1 --target runtime -t {{projectName}}:latest .",
+    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./packages/{{projectName}}-serv/data -t {{projectName}}:latest ."{{#if fullstack.frontends.web}},
+    "podman:build:web": "podman build --format docker --jobs=1 --target web -t {{projectName}}-web:latest ."{{/if}},
     "package": "pnpm build{{#if fullstack.frontends.web}} && pnpm --filter {{projectName}}-web package{{/if}}{{#if fullstack.frontends.app}} && pnpm --filter {{projectName}}-app package{{/if}}{{#if fullstack.frontends.desktop}} && pnpm --filter {{projectName}}-desktop package{{/if}}",
     "deploy": "pnpm package",
     "typecheck": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm -r --if-present typecheck",

package/templates/apps/fullstack/packages/{{projectName}}-serv/README.md.hbs

@@ -15,3 +15,11 @@
 
 - `pnpm --filter {{fullstack.servPackageName}} dev`
 - `pnpm --filter {{fullstack.servPackageName}} test`
+
+## 容器运行
+
+- 根目录 `pnpm docker:build` / `pnpm podman:build` 直接生成本服务镜像；Web 使用独立的 `docker:build:web` / `podman:build:web` 镜像。
+- 服务镜像直接由 `@h-ai/serv` 对外监听，配置挂载点为 `/app/config`，数据目录为 `/app/data`，不包含额外转发进程。
+- Web 镜像不烘焙 API 地址；启动时使用 `-e PUBLIC_API_BASE=https://api.example.com` 注入，同一镜像可部署到不同环境。未设置时 Web 默认请求自身 origin。
+- YAML 配置使用 `${ENV_NAME:default}` 接收运行时环境变量；不要把密钥写入镜像。
+- 将 SQLite/本地存储放入本目录 `data/` 后运行 `pnpm docker:build:data` / `pnpm podman:build:data`，可生成带初始数据的镜像，持续写入仍应使用 volume。

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_core.yml.hbs

@@ -8,7 +8,7 @@
 
 name: {{fullstack.servPackageName}}
 version: 0.1.0
-env: development
-debug: false
+env: ${HAI_ENV:development}
+debug: ${HAI_DEBUG:false}
 
 defaultLocale: {{fullstack.i18n.baseLocale}}

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_serv.yml.hbs

@@ -21,9 +21,9 @@ http:
   rpc: false
 
 cors:
-  origin: '*'
-  nativeOrigins: http://localhost,https://tauri.localhost,tauri://localhost,capacitor://localhost
-  credentials: false
+  origin: ${HAI_CORS_ORIGIN:*}
+  nativeOrigins: ${HAI_CORS_NATIVEORIGINS:http://localhost,https://tauri.localhost,tauri://localhost,capacitor://localhost}
+  credentials: ${HAI_CORS_CREDENTIALS:false}
   allowedHeaders:
     - Authorization
     - Content-Type

package/templates/apps/fullstack/packages/{{projectName}}-serv/data/.gitkeep.hbs

@@ -0,0 +1 @@
+

package/templates/apps/fullstack/packages/{{projectName}}-serv/package.json.hbs

@@ -11,6 +11,12 @@
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "files": [
+    "config",
+    "data",
+    "dist",
+    "README.md"
+  ],
   "scripts": {
     "build": "tsup",
     "typecheck": "tsc --noEmit",

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/api/api-client.ts.hbs

@@ -38,7 +38,16 @@ export async function fetchAppInfo(options: FetchAppInfoOptions = {}): Promise<A
 }
 
 function resolveDefaultApiOrigin(): string {
-  return import.meta.env.PUBLIC_API_BASE ?? DEFAULT_API_ORIGIN
+  return resolveRuntimeApiOrigin()
+    || import.meta.env.PUBLIC_API_BASE
+    || (typeof globalThis.location === 'undefined' ? DEFAULT_API_ORIGIN : globalThis.location.origin)
+}
+
+function resolveRuntimeApiOrigin(): string | undefined {
+  const runtimeConfig = (globalThis as typeof globalThis & {
+    __HAI_PUBLIC_CONFIG__?: { apiBase?: string }
+  }).__HAI_PUBLIC_CONFIG__
+  return runtimeConfig?.apiBase
 }
 
 function normalizeApiBaseUrl(value: string): string {

package/templates/base/.dockerignore.hbs

@@ -0,0 +1,17 @@
+.git
+.github
+.agents
+.claude
+.codex
+.opencode
+.svelte-kit
+.turbo
+android
+build
+dist
+ios
+node_modules
+playwright-report
+test-results
+**/data
+*.log

package/templates/base/.gitignore.hbs

@@ -13,4 +13,5 @@ ios
 .DS_Store
 test-results/
 playwright-report/
-data/
+data/*
+!**/data/.gitkeep

package/templates/base/Dockerfile.hbs

@@ -0,0 +1,62 @@
+# syntax=docker/dockerfile:1.7
+{{#if isSvelteOnlyApp}}
+FROM node:22-bookworm-slim AS build
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
+WORKDIR /workspace
+
+RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
+COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN pnpm build
+
+FROM nginxinc/nginx-unprivileged:1.29-alpine AS runtime
+
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /workspace/dist /usr/share/nginx/html
+
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1
+{{else}}
+FROM node:22-bookworm-slim AS build
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
+WORKDIR /workspace
+
+RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
+COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN pnpm build
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm --filter {{projectName}} --prod deploy /prod/app
+
+FROM node:22-bookworm-slim AS runtime-base
+
+ENV NODE_ENV=production
+ENV HOST=0.0.0.0
+ENV PORT=3000
+WORKDIR /app
+
+COPY --from=build --chown=node:node /prod/app ./
+RUN mkdir -p /app/data && chown node:node /app/data
+
+USER node
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+CMD ["node", "build"]
+
+FROM runtime-base AS runtime-with-data
+
+COPY --from=embedded-data --chown=node:node / /app/data/
+
+FROM runtime-base AS runtime
+{{/if}}

package/templates/base/docker/nginx.conf.hbs

@@ -0,0 +1,18 @@
+{{! @skipIfEmpty }}
+{{#if isSvelteOnlyApp}}
+server {
+  listen 8080;
+  server_name _;
+  root /usr/share/nginx/html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  location = /health {
+    access_log off;
+    add_header Content-Type text/plain;
+    return 200 'ok';
+  }
+}
+{{/if}}

package/templates/base/package.json.hbs

@@ -1,11 +1,19 @@
 {
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.50",
+  "version": "0.1.0-alpha.53",
   "private": true,
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
   "keywords": ["hai", {{#unless isSvelteOnlyApp}}"sveltekit", {{/unless}}"svelte5", "{{appType}}"],
   "license": "Apache-2.0",
   "type": "module",
+{{#unless isSvelteOnlyApp}}
+  "files": [
+    "build",
+    "config",
+    "data",
+    "package.json"
+  ],
+{{/unless}}
   "scripts": {
 {{#if hasI18n}}
     "paraglide:compile": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide",
@@ -19,7 +27,13 @@
     "test": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}vitest run",
     "test:watch": "vitest",
     "test:e2e": "playwright test",
-    "clean": "{{#if isSvelteOnlyApp}}rimraf dist build android ios .turbo src/lib/paraglide{{else}}rimraf .svelte-kit build .turbo{{/if}}"{{#if isCapacitorApp}},
+    "clean": "{{#if isSvelteOnlyApp}}rimraf dist build android ios .turbo src/lib/paraglide{{else}}rimraf .svelte-kit build .turbo{{/if}}",
+    "docker:build": "docker build --target runtime -t {{projectName}}:latest .",
+{{#unless isSvelteOnlyApp}}
+    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./data -t {{projectName}}:latest .",
+{{/unless}}
+    "podman:build": "podman build --format docker --jobs=1 --target runtime -t {{projectName}}:latest ."{{#unless isSvelteOnlyApp}},
+    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./data -t {{projectName}}:latest ."{{/unless}}{{#if isCapacitorApp}},
     "cap:add:android": "cap add android",
     "cap:add:ios": "cap add ios",
     "cap:sync": "pnpm build && cap sync",
@@ -78,11 +92,7 @@
     "@capacitor/push-notifications": "^8.0.1",
     "@capacitor/status-bar": "^8.0.1",
 {{else}}
-{{#if_eq appType 'api'}}
     "@sveltejs/adapter-node": "^5.5.4",
-{{else}}
-    "@sveltejs/adapter-auto": "^7.0.1",
-{{/if_eq}}
 {{/if}}
 {{#unless isSvelteOnlyApp}}
     "@sveltejs/kit": "^2.61.1",

package/templates/base/svelte.config.js.hbs

@@ -8,15 +8,7 @@ import process from 'node:process'
 import { autoImportHaiUi } from '@h-ai/ui/auto-import'
 {{/if}}
 {{#unless isSvelteOnlyApp}}
-{{#if isCapacitorApp}}
-import adapter from '@sveltejs/adapter-static'
-{{else}}
-{{#if_eq appType 'api'}}
 import adapter from '@sveltejs/adapter-node'
-{{else}}
-import adapter from '@sveltejs/adapter-auto'
-{{/if_eq}}
-{{/if}}
 {{/unless}}
 import { vitePreprocess } from '@sveltejs/vite-plugin-svelte'
 

package/templates/skills/hai-ai/SKILL.md

@@ -337,6 +337,10 @@ if (!playable.success)
 - 平台不支持的输入方式（如 OpenAI/MiMo 的持续音频输入）会抛 `AUDIO_UNSUPPORTED_INPUT`，不伪装成实时。
 - 浏览器/移动端经 `@h-ai/serv` 统一语音 WebSocket 入口访问；客户端用已登录 HTTP 请求获取短期一次性 ticket，`@h-ai/ai/client` 通过 `audio.getTicket` 建连，不把 IAM access token 放入 URL。浏览器客户端区分正常结束、取消（`AUDIO_CANCELLED`）与 `end` 前异常断连（`AUDIO_CONNECTION_FAILED`）；服务端 error 帧保留领域错误码，`synthesize` 不返回未完成的部分音频。
 
+### 本地 CPU 模型服务
+
+hai-framework 源码仓库提供 `pnpm model <name> --device cpu` 与 `pnpm model:run <name>`，默认优先使用 Podman，可构建/启动 `faster-whisper-large-v3`、`indextts-2.5`、`qwen3-4b`。三套权重均优先从清单锁定的 ModelScope revision 下载并复用容器 volume，Hugging Face 只作回退。Whisper/IndexTTS 仍配置为 `audio.models[].baseUrl`，Qwen3-4B 仍配置为 OpenAI-compatible `llm.models[].baseUrl`；部署位置不进入 Provider 名称。离线部署使用准备权重后的 bundled 镜像。
+
 ## 文生图（Image）
 
 `ai.image` 只暴露稳定的提示词、模型别名、像素尺寸、可选参考图和图片字节；OpenAI、Google、Qwen、Seedream 与 Pollinations 的请求结构、鉴权、响应解析和临时 URL 下载均封装在内部 Provider。

package/templates/skills/hai-app-create/SKILL.md

@@ -354,6 +354,20 @@ core.init() → reldb.init() → cache.init() → iam.init() → createBusinessT
 
 ---
 
+## 容器交付
+
+- 保持脚手架根目录 `Dockerfile`、`.dockerignore` 与 `package.json` 中 `docker:build*` / `podman:build*` 命令同步。
+- Podman 多阶段构建保持 `--format docker --jobs=1`；前者保留 `HEALTHCHECK`，后者避免部分 Podman 5.8/Buildah 组合在并行 stage 构建时触发内部 semaphore panic。
+- 先复制 lockfile 与 workspace 配置执行 `pnpm fetch`，再复制源码并离线安装、构建；避免源码变化重复下载依赖，同时兼容新增 workspace。
+- SvelteKit 服务使用 Node adapter；纯 Vite 前端使用带 SPA fallback 的静态镜像；fullstack 的 Service 与 Web 分别交付，Service 直接监听且不增加转发进程。
+- Web 的 `PUBLIC_*` 部署配置在容器启动时生成静态运行时配置，不作为 build arg 烘焙，确保同一镜像可跨环境部署。
+- 配置文件随镜像提供，并允许只读挂载覆盖；密钥只通过环境变量或 `--env-file` 注入。
+- 普通构建不携带 `data/`；只有用户明确运行 `docker:build:data` / `podman:build:data` 时才通过 named build context 嵌入 SQLite/本地存储初始快照。
+- 数据库和本地存储的持续写入必须落到 volume，不能依赖镜像可写层。
+- 完成前实际启动镜像，验证健康端点、非 root 用户、环境变量覆盖、配置挂载和预置数据读取。
+
+---
+
 ## 检查清单
 
 - [ ] **TDD 流程已执行**：先写测试 → 确认失败 → 再实现 → 确认通过
@@ -365,6 +379,7 @@ core.init() → reldb.init() → cache.init() → iam.init() → createBusinessT
 - [ ] 日志级别正确（读 debug / 写 debug+info / 失败 warn|error）
 - [ ] 禁止 `console.log`、`any`、硬编码密钥
 - [ ] 用户可见文本走 i18n
+- [ ] Docker / Podman 镜像可启动，配置/环境变量/数据目录行为已验证
 - [ ] 新增表有索引定义
 - [ ] 组件优先使用 `@h-ai/ui`
 - [ ] `pnpm typecheck && pnpm lint && pnpm test` 通过