@h-ai/cli 0.1.0-alpha.64 → 0.1.0-alpha.66

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/cli",
   "type": "module",
-  "version": "0.1.0-alpha.64",
+  "version": "0.1.0-alpha.66",
   "description": "Hai Framework CLI for project scaffolding and code generation.",
   "license": "Apache-2.0",
   "keywords": [
@@ -30,7 +30,7 @@
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
   "dependencies": {
-    "@h-ai/core": "0.1.0-alpha.64",
+    "@h-ai/core": "0.1.0-alpha.66",
     "cac": "^7.0.1",
     "chalk": "^6.0.1",
     "fast-wrap-ansi": "^0.2.2",
@@ -41,11 +41,12 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@h-ai/cache": "0.1.0-alpha.64",
-    "@h-ai/deploy": "0.1.0-alpha.64",
-    "@h-ai/reach": "0.1.0-alpha.64",
-    "@h-ai/reldb": "0.1.0-alpha.64",
-    "@h-ai/storage": "0.1.0-alpha.64",
+    "@h-ai/cache": "0.1.0-alpha.66",
+    "@h-ai/crypto": "0.1.0-alpha.66",
+    "@h-ai/deploy": "0.1.0-alpha.66",
+    "@h-ai/reach": "0.1.0-alpha.66",
+    "@h-ai/reldb": "0.1.0-alpha.66",
+    "@h-ai/storage": "0.1.0-alpha.66",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^26.6.5",
     "@types/prompts": "^2.4.9",
@@ -62,6 +63,7 @@
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "test": "vitest run",
+    "test:deploy-gates": "node tests/run-scaffold-gates.mjs --deploy",
     "test:e2e": "pnpm test:scaffold-gates",
     "test:scaffold-gates": "pnpm build && node tests/run-scaffold-gates.mjs",
     "test:watch": "vitest",

package/templates/apps/admin/src/routes/+layout.svelte.hbs

@@ -32,6 +32,8 @@
   <title>{page.data.appConfig.name}</title>
 </svelte:head>
 
-<div class='min-h-screen bg-base-200'>
-  {@render children()}
+<div class='min-h-screen flex flex-col bg-base-200'>
+  <header class='navbar border-b border-base-300 bg-base-100 px-6'><span class='text-lg font-semibold'>{page.data.appConfig.name}</span></header>
+  <div class='flex-1'>{@render children()}</div>
+  <footer class='border-t border-base-300 bg-base-100 p-3 text-center text-xs text-base-content/60'>{page.data.appConfig.name} · {page.data.appConfig.version} · {page.data.appConfig.env}</footer>
 </div>

package/templates/apps/api/.dockerignore.hbs

@@ -1,4 +1,5 @@
 .git
+**/*.tar
 .github
 .agents
 .claude
@@ -12,3 +13,6 @@ playwright-report
 test-results
 **/data
 *.log
+# 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
+**/.env.*
+**/.hai

package/templates/apps/api/.gitignore.hbs

@@ -5,10 +5,11 @@ dist
 build
 playwright-report
 test-results
-.env
-.env.*
-!.env.example
-!.env.example.hbs
 
-# hai deploy 产物（compose / .env.runtime / 镜像 tar / sidecar 凭据）
+# 构建与部署产物（镜像 / Compose tar / 私有运行配置）
 .hai/
+*.tar
+
+# 本机私有配置；公共 .env 与 dev/test/prod 环境文件纳入版本控制。
+.env.local
+.env.*.local

package/templates/apps/api/Dockerfile.hbs

@@ -1,5 +1,7 @@
 # syntax=docker/dockerfile:1.7
 FROM node:24-bookworm-slim AS build
+ARG SQLITE_PREBUILD_MIRROR
+ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -7,17 +9,16 @@ ENV CI=true
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
-COPY pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
-RUN pnpm build
+RUN pnpm compile
+RUN if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{api.servicePackageName}} --prod /prod/app
 
 FROM node:24-bookworm-slim AS runtime-base
 
 ENV NODE_ENV=production
-ENV HAI_CORE_ENV=production
 ENV HOST=0.0.0.0
 ENV PORT=3000
 WORKDIR /app
@@ -31,8 +32,4 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 CMD ["node", "dist/index.js"]
 
-FROM runtime-base AS runtime-with-data
-
-COPY --from=embedded-data --chown=node:node / /app/data/
-
 FROM runtime-base AS runtime

package/templates/apps/api/apps/{{projectName}}-contract/package.json.hbs

@@ -19,8 +19,10 @@
   ],
   "scripts": {
     "build": "tsup",
+    "check": "pnpm typecheck",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
     "test": "vitest run",
     "test:watch": "vitest",
     "clean": "rimraf dist .turbo"

package/templates/apps/api/apps/{{projectName}}-service/README.md.hbs

@@ -11,9 +11,9 @@ pnpm --filter {{api.servicePackageName}} test
 
 ## 容器运行
 
-- 根目录运行 `pnpm docker:build` / `pnpm podman:build`；镜像监听 `0.0.0.0:3000`。
+从工程根运行 `pnpm build --target docker` 构建并导出镜像，再运行 `pnpm deploy --env test`。deploy 只消费已构建镜像；含 Web 时一并发布 API/Web。网络不通用 `pnpm deploy --env prod --bundle-only`，按输出说明手工搬运 tar。
 - 配置默认打包自本目录 `config/`，可在运行时只读挂载到 `/app/config`，敏感值通过环境变量注入。
-- `data/` 可作为 SQLite/本地存储目录；`pnpm docker:build:data` / `pnpm podman:build:data` 会将其固化为镜像初始数据，生产写入应挂载 `/app/data` volume。
+从工程根运行 `pnpm build --target docker` 构建并导出镜像，再运行 `pnpm deploy --env test`。deploy 只消费已构建镜像；含 Web 时一并发布 API/Web。网络不通用 `pnpm deploy --env prod --bundle-only`，按输出说明手工搬运 tar。
 
 ## 关键目录
 

package/templates/apps/api/apps/{{projectName}}-service/config/_core.yml.hbs

@@ -4,8 +4,8 @@
 
 name: {{projectName}} API Service
 version: 0.1.0
-env: ${HAI_ENV:development}
-debug: ${HAI_DEBUG:false}
+env: ${HAI_CORE_ENV:development}
+debug: ${HAI_CORE_DEBUG:false}
 
 logging:
   level: info

package/templates/apps/api/apps/{{projectName}}-service/config/_serv.yml.hbs

@@ -18,10 +18,10 @@ http:
   rpc: false
 
 cors:
-  origin: ${HAI_CORS_ORIGIN:*}
-  nativeOrigins: ${HAI_CORS_NATIVEORIGINS:http://localhost,https://tauri.localhost,tauri://localhost,capacitor://localhost}
-{{#if features.iam}}  credentials: ${HAI_CORS_CREDENTIALS:true}
-{{else}}  credentials: ${HAI_CORS_CREDENTIALS:false}
+  origin: ${HAI_SERV_CORS_ORIGIN:*}
+  nativeOrigins: ${HAI_SERV_CORS_NATIVEORIGINS:http://localhost,https://tauri.localhost,tauri://localhost,capacitor://localhost}
+{{#if features.iam}}  credentials: ${HAI_SERV_CORS_CREDENTIALS:true}
+{{else}}  credentials: ${HAI_SERV_CORS_CREDENTIALS:false}
 {{/if}}  allowedHeaders:
     - Authorization
     - Content-Type

package/templates/apps/api/apps/{{projectName}}-service/package.json.hbs

@@ -21,13 +21,19 @@
   ],
   "scripts": {
     "build": "tsup",
+    "check": "pnpm typecheck",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
     "test": "vitest run",
     "test:watch": "vitest",
     "clean": "rimraf dist .turbo",
-    "dev": "pnpm build && node dist/index.js",
-    "start": "node dist/index.js"
+    "dev": "pnpm build && node --env-file=.env --env-file=.env.dev --env-file-if-exists=.env.local dist/index.js",
+    "start": "node --env-file=.env --env-file=.env.prod --env-file-if-exists=.env.local dist/index.js",
+    "dev:test": "pnpm build && node --env-file=.env --env-file=.env.test --env-file-if-exists=.env.local dist/index.js",
+    "dev:prod": "pnpm build && pnpm start",
+    "start:test": "node --env-file=.env --env-file=.env.test --env-file-if-exists=.env.local dist/index.js",
+    "start:prod": "pnpm start"
   },
   "dependencies": {
     "@h-ai/core": "{{haiPackageSpecifier}}",

package/templates/apps/api/hai.build.json.hbs

@@ -0,0 +1 @@
+{ "images": [{ "name": "app", "target": "runtime", "containerPort": 3000 }] }

package/templates/apps/api/package.json.hbs

@@ -8,16 +8,21 @@
   "description": "Typed hai API workspace with separated contract and service packages.",
   "scripts": {
     "dev": "pnpm --filter {{api.servicePackageName}} dev",
-    "compile": "pnpm typecheck && pnpm build",
-    "build": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present build",
-    "docker:build": "docker build --target runtime -t {{projectName}}:latest .",
-    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./apps/{{projectName}}-service/data -t {{projectName}}:latest .",
-    "podman:build": "podman build --format docker --jobs=1 --target runtime -t {{projectName}}:latest .",
-    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./apps/{{projectName}}-service/data -t {{projectName}}:latest .",
+    "start": "pnpm --filter {{api.servicePackageName}} start",
+    "start:test": "pnpm --filter {{api.servicePackageName}} start:test",
+    "start:prod": "pnpm --filter {{api.servicePackageName}} start:prod",
+    "dev:test": "pnpm --filter {{api.servicePackageName}} dev:test",
+    "dev:prod": "pnpm --filter {{api.servicePackageName}} dev:prod",
+    "compile": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present build",
+    "build": "hai build",
+    "deploy": "hai deploy apps/{{projectName}}-service",
+    "check": "pnpm typecheck",
     "typecheck": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present typecheck",
     "lint": "eslint *.js *.ts e2e && pnpm -r --if-present lint",
+    "lint:fix": "eslint *.js *.ts e2e --fix && pnpm -r --if-present lint:fix",
     "test": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present test",
-    "test:e2e": "pnpm build && playwright test",
+    "test:watch": "pnpm -r --parallel --if-present test:watch",
+    "test:e2e": "pnpm compile && node scripts/run-e2e.mjs",
     "clean": "pnpm -r --if-present clean && rimraf node_modules .turbo"
   },
   "dependencies": {
@@ -25,6 +30,7 @@
     "{{api.contractPackageName}}": "workspace:*"
   },
   "devDependencies": {
+    "@h-ai/cli": "{{haiPackageSpecifier}}",
     "@h-ai/api-client": "{{haiPackageSpecifier}}",
 {{#if features.crypto}}
     "@h-ai/crypto": "{{haiPackageSpecifier}}",

package/templates/apps/fullstack/.dockerignore.hbs

@@ -1,4 +1,5 @@
 .git
+**/*.tar
 Dockerfile
 .github
 .agents
@@ -6,9 +7,6 @@ Dockerfile
 .codex
 .opencode
 .turbo
-.env
-.env.*
-!.env.example
 **/build
 **/dist
 **/node_modules
@@ -17,3 +15,6 @@ playwright-report
 test-results
 **/data
 *.log
+# 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
+**/.env.*
+**/.hai

package/templates/apps/fullstack/.gitignore.hbs

@@ -1,17 +1,31 @@
+# 构建产物目录
 node_modules
-**/data/
-.turbo
-dist
 build
+dist
+.turbo
+android
+ios
 **/src/lib/paraglide
-playwright-report
-test-results
-.env
-.env.*
-!.env.example
-!.env.example.hbs
 **/src-tauri/gen/
 **/src-tauri/target/
+**/hash-core/target/
+
+# 日志测试目录
+*.log
+test-results/
+playwright-report/
 
-# hai deploy 产物（compose / .env.runtime / 镜像 tar / sidecar 凭据）
+
+# 系统文件
+.DS_Store
+
+# 本地数据目录
+**/data/
+
+# 构建与部署产物（镜像 / Compose tar / 私有运行配置）
 .hai/
+*.tar
+
+# 本机私有配置；公共 .env 与 dev/test/prod 环境文件纳入版本控制。
+.env.local
+.env.*.local

package/templates/apps/fullstack/Dockerfile.hbs

@@ -1,5 +1,7 @@
 # syntax=docker/dockerfile:1.7
 FROM node:24-bookworm-slim AS build
+ARG SQLITE_PREBUILD_MIRROR
+ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -7,20 +9,20 @@ ENV CI=true
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
-COPY pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
+# 本地 file: 归档和 workspace 文件必须先进入上下文，离线材料不能只复制 lockfile。
 COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
-RUN pnpm build
+RUN pnpm compile
 
 FROM build AS service-build
 
+RUN if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{fullstack.servPackageName}} --prod /prod/service
 
 FROM node:24-bookworm-slim AS service
 
 ENV NODE_ENV=production
-ENV HAI_CORE_ENV=production
 ENV HOST=0.0.0.0
 ENV PORT=3000
 WORKDIR /app
@@ -34,10 +36,6 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 CMD ["node", "dist/index.js"]
 
-FROM service AS runtime-with-data
-
-COPY --from=embedded-data --chown=node:node / /app/data/
-
 FROM service AS runtime
 
 {{#if fullstack.frontends.web}}

package/templates/apps/fullstack/apps/{{projectName}}-app/README.md.hbs

@@ -29,9 +29,6 @@ pnpm --filter {{projectName}}-app package
 pnpm --filter {{projectName}}-app cap:build:android:debug
 pnpm --filter {{projectName}}-app cap:build:android:release
 pnpm --filter {{projectName}}-app cap:build:ios
-
-# 当前模板的 deploy 入口默认执行 package，可按目标商店或 CI 平台替换
-pnpm --filter {{projectName}}-app deploy
 ```
 
 部署前确认 `PUBLIC_API_BASE` 在 `.env` 中指向可访问的后端服务。Android 模拟器访问宿主机通常使用 `http://10.0.2.2:3000`。

package/templates/apps/fullstack/apps/{{projectName}}-app/package.json.hbs

@@ -9,13 +9,16 @@
   "scripts": {
     "paraglide:compile": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide",
     "paraglide:watch": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide --watch",
+    "dev:test": "vite --mode test",
+    "dev:prod": "vite --mode prod",
     "dev": "vite dev --host 127.0.0.1 --port {{fullstack.ports.app}}",
     "build": "pnpm paraglide:compile && vite build",
     "package": "pnpm cap:sync",
-    "deploy": "pnpm package",
     "preview": "vite preview --host 127.0.0.1 --port {{fullstack.ports.app}} --strictPort",
+    "check": "pnpm typecheck",
     "typecheck": "pnpm paraglide:compile && svelte-check --tsconfig ./tsconfig.json",
     "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
     "test": "pnpm paraglide:compile && vitest run --passWithNoTests",
     "test:watch": "pnpm paraglide:compile && vitest",
     "clean": "rimraf dist build android ios .turbo src/lib/paraglide",
@@ -50,6 +53,7 @@
     "@capacitor/preferences": "{{fullstack.packageSpecifiers.capacitorPreferences}}",
     "@capacitor/push-notifications": "{{fullstack.packageSpecifiers.capacitorPushNotifications}}",
     "@capacitor/status-bar": "{{fullstack.packageSpecifiers.capacitorStatusBar}}",
+    "@h-ai/core": "{{haiPackageSpecifier}}",
     "@iconify-json/tabler": "{{fullstack.packageSpecifiers.iconifyJsonTabler}}",
     "@iconify/tailwind4": "{{fullstack.packageSpecifiers.iconifyTailwind}}",
     "@inlang/paraglide-js": "{{fullstack.packageSpecifiers.inlangParaglide}}",

package/templates/apps/fullstack/apps/{{projectName}}-app/vite.config.ts.hbs

@@ -2,21 +2,25 @@
 {{#if fullstack.frontends.app}}
 import process from 'node:process'
 import { fileURLToPath } from 'node:url'
+import { core } from '@h-ai/core'
 import { haiOptimizeExclude, haiPrebundledDeps } from '@h-ai/ui/vite'
 import { paraglideVitePlugin } from '@inlang/paraglide-js'
 import { svelte } from '@sveltejs/vite-plugin-svelte'
 import tailwindcss from '@tailwindcss/vite'
-import { loadEnv } from 'vite'
 import { defineConfig } from 'vitest/config'
 
 const envDir = fileURLToPath(new URL('../../', import.meta.url))
 
-export default defineConfig(({ mode }) => {
-  const env = loadEnv(mode, envDir, 'PUBLIC_')
+export default defineConfig(({ mode, command }) => {
+  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
+  if (!envResult.success)
+    throw new Error(envResult.error.message)
+  const env = envResult.data
+  Object.assign(process.env, env)
   const target = (env.PUBLIC_API_BASE || process.env.SERVICE_BASE_URL || 'http://127.0.0.1:3000').replace(/\/api\/v1\/?$/, '')
   const proxy = { '/api': { target, changeOrigin: true } }
   return {
-    envDir,
+    envDir: false,
     server: { proxy },
     preview: { proxy },
     build: {

package/templates/apps/fullstack/apps/{{projectName}}-desktop/README.md.hbs

@@ -26,14 +26,11 @@ pnpm --filter {{projectName}}-desktop tauri:dev
 # 编译 WebView 前端产物到 dist/
 pnpm --filter {{projectName}}-desktop build
 
-# 打包桌面安装包
-pnpm --filter {{projectName}}-desktop package
-
-# 当前模板的 deploy 入口默认执行 package，可按发布平台替换
-pnpm --filter {{projectName}}-desktop deploy
+# 在工程根打包桌面安装包；在对应系统构建 windows / linux / macos
+pnpm build --target desktop --platform windows --arch x64
 ```
 
-打包前需要安装 Rust 工具链和 Tauri 平台依赖。生产环境部署时同步调整 `.env` 中的 `PUBLIC_API_BASE` 与 `src-tauri/tauri.conf.json` 的 `connect-src` 白名单。
+打包前需要安装 Rust 工具链和 Tauri 平台依赖。构建不读取 .env.prod/.env.local；启动已安装程序前设置进程 PUBLIC_API_BASE（HTTP(S)，不含凭据、查询和片段）。Rust 会在页面加载前注入公开地址，仅将该 Origin 加入 CSP；不需要为 test/prod 重打安装包。缺省连接 http://localhost:3000/api/v1。
 
 ## IAM 认证配置
 

package/templates/apps/fullstack/apps/{{projectName}}-desktop/package.json.hbs

@@ -9,11 +9,14 @@
   "scripts": {
     "paraglide:compile": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide",
     "paraglide:watch": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide --watch",
+    "dev:test": "vite --mode test",
+    "dev:prod": "vite --mode prod",
     "dev": "vite dev --host 127.0.0.1 --port {{fullstack.ports.desktop}}",
-    "build": "pnpm paraglide:compile && vite build",
+    "compile": "pnpm paraglide:compile && vite build",
+    "build": "pnpm compile",
     "package": "pnpm tauri:build",
-    "deploy": "pnpm package",
     "preview": "vite preview --host 127.0.0.1 --port {{fullstack.ports.desktop}} --strictPort",
+    "check": "pnpm typecheck",
     "typecheck": "pnpm paraglide:compile && svelte-check --tsconfig ./tsconfig.json",
     "lint": "eslint src vite.config.ts svelte.config.js",
     "lint:fix": "eslint src vite.config.ts svelte.config.js --fix",
@@ -31,6 +34,7 @@
   },
   "devDependencies": {
     "@antfu/eslint-config": "{{fullstack.packageSpecifiers.antfuEslintConfig}}",
+    "@h-ai/core": "{{haiPackageSpecifier}}",
     "@iconify-json/tabler": "{{fullstack.packageSpecifiers.iconifyJsonTabler}}",
     "@iconify/tailwind4": "{{fullstack.packageSpecifiers.iconifyTailwind}}",
     "@inlang/paraglide-js": "{{fullstack.packageSpecifiers.inlangParaglide}}",

package/templates/apps/fullstack/apps/{{projectName}}-desktop/src-tauri/src/lib.rs.hbs

@@ -1,16 +1,87 @@
 {{! @skipIfEmpty }}
 {{#if fullstack.frontends.desktop}}
+use std::collections::HashMap;
+use tauri::utils::config::{Csp, CspDirectiveSources};
+
+/// 校验运行期 API 地址；例如 `https://api.example.test/api/v1`，不接收认证信息或查询参数。
+fn parse_runtime_api(value: &str) -> Result<tauri::Url, &'static str> {
+    let url = tauri::Url::parse(value).map_err(|_| "Invalid PUBLIC_API_BASE")?;
+    if !["http", "https"].contains(&url.scheme())
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.query().is_some()
+        || url.fragment().is_some()
+    {
+        return Err(
+            "PUBLIC_API_BASE must be an HTTP(S) URL without credentials, query or fragment",
+        );
+    }
+    Ok(url)
+}
+
+/// 仅将当前运行期 API 的 origin 加入 CSP；不放宽到所有 HTTP/HTTPS 站点。
+fn runtime_csp(policy: Csp, origin: &str) -> Csp {
+    let mut directives: HashMap<String, CspDirectiveSources> = policy.into();
+    for name in ["connect-src", "img-src"] {
+        directives.entry(name.to_string()).or_default().push(origin);
+    }
+    directives.into()
+}
+
 #[tauri::command]
 fn greet(name: &str) -> String {
-    format!("Hello, {}! Welcome to {{projectName}} Desktop.", name)
+    format!("Hello, {}! Welcome to Desktop.", name)
 }
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
+    // 构建不读取部署环境；启动时从进程 PUBLIC_API_BASE 获取公开地址。
+    let api = parse_runtime_api(
+        &std::env::var("PUBLIC_API_BASE")
+            .unwrap_or_else(|_| "http://localhost:3000/api/v1".to_string()),
+    )
+    .expect("Invalid runtime API configuration");
+    let mut context = tauri::generate_context!();
+    if let Some(policy) = context.config_mut().app.security.csp.take() {
+        context.config_mut().app.security.csp =
+            Some(runtime_csp(policy, &api.origin().ascii_serialization()));
+    }
+    let script = format!(
+        "globalThis.__HAI_PUBLIC_CONFIG__={};",
+        serde_json::json!({ "apiBase": api.as_str() })
+    );
     tauri::Builder::default()
         .plugin(tauri_plugin_shell::init())
+        .append_invoke_initialization_script(script)
         .invoke_handler(tauri::generate_handler![greet])
-        .run(tauri::generate_context!())
+        .run(context)
         .expect("error while running tauri application");
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn validates_runtime_address_and_scopes_csp() {
+        let api = parse_runtime_api("https://api.example.test:8443/custom/v2").unwrap();
+        let policy = runtime_csp(
+            Csp::Policy("default-src 'self'; connect-src 'self'".into()),
+            &api.origin().ascii_serialization(),
+        );
+        let directives: HashMap<String, CspDirectiveSources> = policy.into();
+        let sources: Vec<String> = directives["connect-src"].clone().into();
+        assert!(sources.contains(&"https://api.example.test:8443".to_string()));
+        assert!(!sources.contains(&"https:".to_string()));
+        for value in [
+            "file:///tmp/config",
+            "https://user:secret@host",
+            "https://host/?token=secret",
+            "relative",
+        ] {
+            assert!(parse_runtime_api(value).is_err());
+        }
+    }
+}
 {{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-desktop/src-tauri/tauri.conf.json.hbs

@@ -3,11 +3,11 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": {{json fullstack.appName}},
-  "version": "0.1.0",
+  "version": "../../../package.json",
   "identifier": "com.hai.{{fullstack.nativeAppIdSegment}}.desktop",
   "build": {
     "beforeDevCommand": "pnpm dev",
-    "beforeBuildCommand": "pnpm build",
+    "beforeBuildCommand": "pnpm compile",
     "devUrl": "http://localhost:{{fullstack.ports.desktop}}",
     "frontendDist": "../dist"
   },

package/templates/apps/fullstack/apps/{{projectName}}-desktop/vite.config.ts.hbs

@@ -2,23 +2,27 @@
 {{#if fullstack.frontends.desktop}}
 import process from 'node:process'
 import { fileURLToPath } from 'node:url'
+import { core } from '@h-ai/core'
 import { haiOptimizeExclude, haiPrebundledDeps } from '@h-ai/ui/vite'
 import { paraglideVitePlugin } from '@inlang/paraglide-js'
 import { svelte } from '@sveltejs/vite-plugin-svelte'
 import tailwindcss from '@tailwindcss/vite'
-import { loadEnv } from 'vite'
 import { defineConfig } from 'vitest/config'
 
 const host = process.env.TAURI_DEV_HOST
 const envDir = fileURLToPath(new URL('../../', import.meta.url))
 
-export default defineConfig(({ mode }) => {
-  const env = loadEnv(mode, envDir, 'PUBLIC_')
+export default defineConfig(({ mode, command }) => {
+  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
+  if (!envResult.success)
+    throw new Error(envResult.error.message)
+  const env = envResult.data
+  Object.assign(process.env, env)
   const target = (env.PUBLIC_API_BASE || process.env.SERVICE_BASE_URL || 'http://127.0.0.1:3000').replace(/\/api\/v1\/?$/, '')
   const proxy = { '/api': { target, changeOrigin: true } }
 
   return {
-    envDir,
+    envDir: false,
     preview: { proxy },
     build: {
       rolldownOptions: {

package/templates/apps/fullstack/apps/{{projectName}}-web/README.md.hbs

@@ -20,14 +20,10 @@ pnpm --filter {{projectName}}-web dev
 
 # 编译 Web 前端
 pnpm --filter {{projectName}}-web build
-
-# 打包部署产物；默认等同 build，可按目标平台替换
-pnpm --filter {{projectName}}-web package
-
-# 当前模板的 deploy 入口默认执行 package，可替换为 CDN / 容器发布脚本
-pnpm --filter {{projectName}}-web deploy
 ```
 
+从工程根运行 `pnpm build --target docker` 构建并导出镜像。启用 deploy 功能后，运行根命令 `pnpm deploy --env test`，一次发布 API/Web；网络不通时用 `pnpm deploy --env prod --bundle-only`，按输出说明手工搬运 tar。部署不重新构建。
+
 ## IAM 认证配置
 
 服务端 `config/_iam.yml` 统一控制登录、注册、重置、协议与 `ui` 品牌。邮件/短信可用 `_reach.yml` 中的 Provider/标准模板或自定义发送回调。`AuthPanel` 使用安全公开配置及框架认证动作；无需在页面适配 Token、验证码倒计时和错误提示。所有节点共享同一 DB 与 Redis；Memory 仅用于单进程。