@h-ai/cli 0.1.0-alpha.65 → 0.1.0-alpha.66

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/cli",
   "type": "module",
-  "version": "0.1.0-alpha.65",
+  "version": "0.1.0-alpha.66",
   "description": "Hai Framework CLI for project scaffolding and code generation.",
   "license": "Apache-2.0",
   "keywords": [
@@ -30,7 +30,7 @@
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
   "dependencies": {
-    "@h-ai/core": "0.1.0-alpha.65",
+    "@h-ai/core": "0.1.0-alpha.66",
     "cac": "^7.0.1",
     "chalk": "^6.0.1",
     "fast-wrap-ansi": "^0.2.2",
@@ -41,12 +41,12 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@h-ai/cache": "0.1.0-alpha.65",
-    "@h-ai/crypto": "0.1.0-alpha.65",
-    "@h-ai/deploy": "0.1.0-alpha.65",
-    "@h-ai/reach": "0.1.0-alpha.65",
-    "@h-ai/reldb": "0.1.0-alpha.65",
-    "@h-ai/storage": "0.1.0-alpha.65",
+    "@h-ai/cache": "0.1.0-alpha.66",
+    "@h-ai/crypto": "0.1.0-alpha.66",
+    "@h-ai/deploy": "0.1.0-alpha.66",
+    "@h-ai/reach": "0.1.0-alpha.66",
+    "@h-ai/reldb": "0.1.0-alpha.66",
+    "@h-ai/storage": "0.1.0-alpha.66",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^26.6.5",
     "@types/prompts": "^2.4.9",

package/templates/apps/api/.dockerignore.hbs

@@ -1,4 +1,5 @@
 .git
+**/*.tar
 .github
 .agents
 .claude
@@ -12,8 +13,6 @@ playwright-report
 test-results
 **/data
 *.log
-# 仅排除本机私有配置，与 Git 处理一致；公共 .env 与 dev/test/prod 随上下文构建。
-**/.env.local
-**/.env.*.local
-**/.env.runtime
-**/.hai/deploy
+# 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
+**/.env.*
+**/.hai

package/templates/apps/api/.gitignore.hbs

@@ -6,8 +6,9 @@ build
 playwright-report
 test-results
 
-# hai deploy 产物（compose / .env.runtime / 镜像 tar / sidecar 凭据）
+# 构建与部署产物（镜像 / Compose tar / 私有运行配置）
 .hai/
+*.tar
 
 # 本机私有配置；公共 .env 与 dev/test/prod 环境文件纳入版本控制。
 .env.local

package/templates/apps/api/Dockerfile.hbs

@@ -2,10 +2,6 @@
 FROM node:24-bookworm-slim AS build
 ARG SQLITE_PREBUILD_MIRROR
 ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
-ARG HAI_DEPLOY_ENVIRONMENT=prod
-ARG HAI_CORE_ENV=production
-ENV HAI_DEPLOY_ENVIRONMENT=$HAI_DEPLOY_ENVIRONMENT
-ENV HAI_CORE_ENV=$HAI_CORE_ENV
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -13,21 +9,16 @@ ENV CI=true
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
-COPY pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
-RUN pnpm build
+RUN pnpm compile
 RUN if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{api.servicePackageName}} --prod /prod/app
 
 FROM node:24-bookworm-slim AS runtime-base
-ARG HAI_DEPLOY_ENVIRONMENT=prod
-ARG HAI_CORE_ENV=production
 
 ENV NODE_ENV=production
-ENV HAI_DEPLOY_ENVIRONMENT=$HAI_DEPLOY_ENVIRONMENT
-ENV HAI_CORE_ENV=$HAI_CORE_ENV
 ENV HOST=0.0.0.0
 ENV PORT=3000
 WORKDIR /app
@@ -41,8 +32,4 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 CMD ["node", "dist/index.js"]
 
-FROM runtime-base AS runtime-with-data
-
-COPY --from=embedded-data --chown=node:node / /app/data/
-
 FROM runtime-base AS runtime

package/templates/apps/api/apps/{{projectName}}-service/README.md.hbs

@@ -11,9 +11,9 @@ pnpm --filter {{api.servicePackageName}} test
 
 ## 容器运行
 
-- 根目录运行 `pnpm docker:build` / `pnpm podman:build`；镜像监听 `0.0.0.0:3000`。
+从工程根运行 `pnpm build --target docker` 构建并导出镜像，再运行 `pnpm deploy --env test`。deploy 只消费已构建镜像；含 Web 时一并发布 API/Web。网络不通用 `pnpm deploy --env prod --bundle-only`，按输出说明手工搬运 tar。
 - 配置默认打包自本目录 `config/`，可在运行时只读挂载到 `/app/config`，敏感值通过环境变量注入。
-- `data/` 可作为 SQLite/本地存储目录；`pnpm docker:build:data` / `pnpm podman:build:data` 会将其固化为镜像初始数据，生产写入应挂载 `/app/data` volume。
+从工程根运行 `pnpm build --target docker` 构建并导出镜像，再运行 `pnpm deploy --env test`。deploy 只消费已构建镜像；含 Web 时一并发布 API/Web。网络不通用 `pnpm deploy --env prod --bundle-only`，按输出说明手工搬运 tar。
 
 ## 关键目录
 

package/templates/apps/api/apps/{{projectName}}-service/package.json.hbs

@@ -21,7 +21,6 @@
   ],
   "scripts": {
     "build": "tsup",
-    "build:prod": "pnpm build",
     "check": "pnpm typecheck",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",

package/templates/apps/api/hai.build.json.hbs

@@ -0,0 +1 @@
+{ "images": [{ "name": "app", "target": "runtime", "containerPort": 3000 }] }

package/templates/apps/api/package.json.hbs

@@ -13,20 +13,16 @@
     "start:prod": "pnpm --filter {{api.servicePackageName}} start:prod",
     "dev:test": "pnpm --filter {{api.servicePackageName}} dev:test",
     "dev:prod": "pnpm --filter {{api.servicePackageName}} dev:prod",
-    "compile": "pnpm typecheck && pnpm build",
-    "build": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present build",
-    "docker:build": "docker build --target runtime -t {{projectName}}:latest .",
-    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./apps/{{projectName}}-service/data -t {{projectName}}:latest .",
-    "podman:build": "podman build --format docker --jobs=1 --target runtime -t {{projectName}}:latest .",
-    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./apps/{{projectName}}-service/data -t {{projectName}}:latest .",
+    "compile": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present build",
+    "build": "hai build",
+    "deploy": "hai deploy apps/{{projectName}}-service",
     "check": "pnpm typecheck",
     "typecheck": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present typecheck",
     "lint": "eslint *.js *.ts e2e && pnpm -r --if-present lint",
     "lint:fix": "eslint *.js *.ts e2e --fix && pnpm -r --if-present lint:fix",
     "test": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present test",
     "test:watch": "pnpm -r --parallel --if-present test:watch",
-    "build:prod": "pnpm build",
-    "test:e2e": "pnpm build && playwright test",
+    "test:e2e": "pnpm compile && node scripts/run-e2e.mjs",
     "clean": "pnpm -r --if-present clean && rimraf node_modules .turbo"
   },
   "dependencies": {
@@ -34,6 +30,7 @@
     "{{api.contractPackageName}}": "workspace:*"
   },
   "devDependencies": {
+    "@h-ai/cli": "{{haiPackageSpecifier}}",
     "@h-ai/api-client": "{{haiPackageSpecifier}}",
 {{#if features.crypto}}
     "@h-ai/crypto": "{{haiPackageSpecifier}}",

package/templates/apps/fullstack/.dockerignore.hbs

@@ -1,4 +1,5 @@
 .git
+**/*.tar
 Dockerfile
 .github
 .agents
@@ -14,8 +15,6 @@ playwright-report
 test-results
 **/data
 *.log
-# 仅排除本机私有配置，与 Git 处理一致；公共 .env 与 dev/test/prod 随上下文构建。
-**/.env.local
-**/.env.*.local
-**/.env.runtime
-**/.hai/deploy
+# 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
+**/.env.*
+**/.hai

package/templates/apps/fullstack/.gitignore.hbs

@@ -22,8 +22,9 @@ playwright-report/
 # 本地数据目录
 **/data/
 
-# hai deploy 产物（compose / .env.runtime / 镜像 tar / sidecar 凭据）
+# 构建与部署产物（镜像 / Compose tar / 私有运行配置）
 .hai/
+*.tar
 
 # 本机私有配置；公共 .env 与 dev/test/prod 环境文件纳入版本控制。
 .env.local

package/templates/apps/fullstack/Dockerfile.hbs

@@ -2,10 +2,6 @@
 FROM node:24-bookworm-slim AS build
 ARG SQLITE_PREBUILD_MIRROR
 ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
-ARG HAI_DEPLOY_ENVIRONMENT=prod
-ARG HAI_CORE_ENV=production
-ENV HAI_DEPLOY_ENVIRONMENT=$HAI_DEPLOY_ENVIRONMENT
-ENV HAI_CORE_ENV=$HAI_CORE_ENV
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -13,11 +9,11 @@ ENV CI=true
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
-COPY pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
+# 本地 file: 归档和 workspace 文件必须先进入上下文，离线材料不能只复制 lockfile。
 COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
-RUN pnpm build
+RUN pnpm compile
 
 FROM build AS service-build
 
@@ -25,12 +21,8 @@ RUN if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3;
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{fullstack.servPackageName}} --prod /prod/service
 
 FROM node:24-bookworm-slim AS service
-ARG HAI_DEPLOY_ENVIRONMENT=prod
-ARG HAI_CORE_ENV=production
 
 ENV NODE_ENV=production
-ENV HAI_DEPLOY_ENVIRONMENT=$HAI_DEPLOY_ENVIRONMENT
-ENV HAI_CORE_ENV=$HAI_CORE_ENV
 ENV HOST=0.0.0.0
 ENV PORT=3000
 WORKDIR /app
@@ -44,10 +36,6 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 CMD ["node", "dist/index.js"]
 
-FROM service AS runtime-with-data
-
-COPY --from=embedded-data --chown=node:node / /app/data/
-
 FROM service AS runtime
 
 {{#if fullstack.frontends.web}}

package/templates/apps/fullstack/apps/{{projectName}}-app/README.md.hbs

@@ -29,9 +29,6 @@ pnpm --filter {{projectName}}-app package
 pnpm --filter {{projectName}}-app cap:build:android:debug
 pnpm --filter {{projectName}}-app cap:build:android:release
 pnpm --filter {{projectName}}-app cap:build:ios
-
-# 当前模板的 deploy 入口默认执行 package，可按目标商店或 CI 平台替换
-pnpm --filter {{projectName}}-app deploy
 ```
 
 部署前确认 `PUBLIC_API_BASE` 在 `.env` 中指向可访问的后端服务。Android 模拟器访问宿主机通常使用 `http://10.0.2.2:3000`。

package/templates/apps/fullstack/apps/{{projectName}}-app/package.json.hbs

@@ -13,9 +13,7 @@
     "dev:prod": "vite --mode prod",
     "dev": "vite dev --host 127.0.0.1 --port {{fullstack.ports.app}}",
     "build": "pnpm paraglide:compile && vite build",
-    "build:prod": "pnpm paraglide:compile && vite build --mode prod",
     "package": "pnpm cap:sync",
-    "deploy": "pnpm package",
     "preview": "vite preview --host 127.0.0.1 --port {{fullstack.ports.app}} --strictPort",
     "check": "pnpm typecheck",
     "typecheck": "pnpm paraglide:compile && svelte-check --tsconfig ./tsconfig.json",

package/templates/apps/fullstack/apps/{{projectName}}-app/vite.config.ts.hbs

@@ -11,8 +11,8 @@ import { defineConfig } from 'vitest/config'
 
 const envDir = fileURLToPath(new URL('../../', import.meta.url))
 
-export default defineConfig(({ mode }) => {
-  const envResult = core.config.loadEnvFiles({ mode, envDir })
+export default defineConfig(({ mode, command }) => {
+  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
   if (!envResult.success)
     throw new Error(envResult.error.message)
   const env = envResult.data

package/templates/apps/fullstack/apps/{{projectName}}-desktop/README.md.hbs

@@ -26,14 +26,11 @@ pnpm --filter {{projectName}}-desktop tauri:dev
 # 编译 WebView 前端产物到 dist/
 pnpm --filter {{projectName}}-desktop build
 
-# 打包桌面安装包
-pnpm --filter {{projectName}}-desktop package
-
-# 当前模板的 deploy 入口默认执行 package，可按发布平台替换
-pnpm --filter {{projectName}}-desktop deploy
+# 在工程根打包桌面安装包；在对应系统构建 windows / linux / macos
+pnpm build --target desktop --platform windows --arch x64
 ```
 
-打包前需要安装 Rust 工具链和 Tauri 平台依赖。生产环境部署时同步调整 `.env` 中的 `PUBLIC_API_BASE` 与 `src-tauri/tauri.conf.json` 的 `connect-src` 白名单。
+打包前需要安装 Rust 工具链和 Tauri 平台依赖。构建不读取 .env.prod/.env.local；启动已安装程序前设置进程 PUBLIC_API_BASE（HTTP(S)，不含凭据、查询和片段）。Rust 会在页面加载前注入公开地址，仅将该 Origin 加入 CSP；不需要为 test/prod 重打安装包。缺省连接 http://localhost:3000/api/v1。
 
 ## IAM 认证配置
 

package/templates/apps/fullstack/apps/{{projectName}}-desktop/package.json.hbs

@@ -12,10 +12,9 @@
     "dev:test": "vite --mode test",
     "dev:prod": "vite --mode prod",
     "dev": "vite dev --host 127.0.0.1 --port {{fullstack.ports.desktop}}",
-    "build": "pnpm paraglide:compile && vite build",
-    "build:prod": "pnpm paraglide:compile && vite build --mode prod",
+    "compile": "pnpm paraglide:compile && vite build",
+    "build": "pnpm compile",
     "package": "pnpm tauri:build",
-    "deploy": "pnpm package",
     "preview": "vite preview --host 127.0.0.1 --port {{fullstack.ports.desktop}} --strictPort",
     "check": "pnpm typecheck",
     "typecheck": "pnpm paraglide:compile && svelte-check --tsconfig ./tsconfig.json",

package/templates/apps/fullstack/apps/{{projectName}}-desktop/src-tauri/src/lib.rs.hbs

@@ -1,16 +1,87 @@
 {{! @skipIfEmpty }}
 {{#if fullstack.frontends.desktop}}
+use std::collections::HashMap;
+use tauri::utils::config::{Csp, CspDirectiveSources};
+
+/// 校验运行期 API 地址；例如 `https://api.example.test/api/v1`，不接收认证信息或查询参数。
+fn parse_runtime_api(value: &str) -> Result<tauri::Url, &'static str> {
+    let url = tauri::Url::parse(value).map_err(|_| "Invalid PUBLIC_API_BASE")?;
+    if !["http", "https"].contains(&url.scheme())
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.query().is_some()
+        || url.fragment().is_some()
+    {
+        return Err(
+            "PUBLIC_API_BASE must be an HTTP(S) URL without credentials, query or fragment",
+        );
+    }
+    Ok(url)
+}
+
+/// 仅将当前运行期 API 的 origin 加入 CSP；不放宽到所有 HTTP/HTTPS 站点。
+fn runtime_csp(policy: Csp, origin: &str) -> Csp {
+    let mut directives: HashMap<String, CspDirectiveSources> = policy.into();
+    for name in ["connect-src", "img-src"] {
+        directives.entry(name.to_string()).or_default().push(origin);
+    }
+    directives.into()
+}
+
 #[tauri::command]
 fn greet(name: &str) -> String {
-    format!("Hello, {}! Welcome to {{projectName}} Desktop.", name)
+    format!("Hello, {}! Welcome to Desktop.", name)
 }
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
+    // 构建不读取部署环境；启动时从进程 PUBLIC_API_BASE 获取公开地址。
+    let api = parse_runtime_api(
+        &std::env::var("PUBLIC_API_BASE")
+            .unwrap_or_else(|_| "http://localhost:3000/api/v1".to_string()),
+    )
+    .expect("Invalid runtime API configuration");
+    let mut context = tauri::generate_context!();
+    if let Some(policy) = context.config_mut().app.security.csp.take() {
+        context.config_mut().app.security.csp =
+            Some(runtime_csp(policy, &api.origin().ascii_serialization()));
+    }
+    let script = format!(
+        "globalThis.__HAI_PUBLIC_CONFIG__={};",
+        serde_json::json!({ "apiBase": api.as_str() })
+    );
     tauri::Builder::default()
         .plugin(tauri_plugin_shell::init())
+        .append_invoke_initialization_script(script)
         .invoke_handler(tauri::generate_handler![greet])
-        .run(tauri::generate_context!())
+        .run(context)
         .expect("error while running tauri application");
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn validates_runtime_address_and_scopes_csp() {
+        let api = parse_runtime_api("https://api.example.test:8443/custom/v2").unwrap();
+        let policy = runtime_csp(
+            Csp::Policy("default-src 'self'; connect-src 'self'".into()),
+            &api.origin().ascii_serialization(),
+        );
+        let directives: HashMap<String, CspDirectiveSources> = policy.into();
+        let sources: Vec<String> = directives["connect-src"].clone().into();
+        assert!(sources.contains(&"https://api.example.test:8443".to_string()));
+        assert!(!sources.contains(&"https:".to_string()));
+        for value in [
+            "file:///tmp/config",
+            "https://user:secret@host",
+            "https://host/?token=secret",
+            "relative",
+        ] {
+            assert!(parse_runtime_api(value).is_err());
+        }
+    }
+}
 {{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-desktop/src-tauri/tauri.conf.json.hbs

@@ -3,11 +3,11 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": {{json fullstack.appName}},
-  "version": "0.1.0",
+  "version": "../../../package.json",
   "identifier": "com.hai.{{fullstack.nativeAppIdSegment}}.desktop",
   "build": {
     "beforeDevCommand": "pnpm dev",
-    "beforeBuildCommand": "pnpm build",
+    "beforeBuildCommand": "pnpm compile",
     "devUrl": "http://localhost:{{fullstack.ports.desktop}}",
     "frontendDist": "../dist"
   },

package/templates/apps/fullstack/apps/{{projectName}}-desktop/vite.config.ts.hbs

@@ -12,8 +12,8 @@ import { defineConfig } from 'vitest/config'
 const host = process.env.TAURI_DEV_HOST
 const envDir = fileURLToPath(new URL('../../', import.meta.url))
 
-export default defineConfig(({ mode }) => {
-  const envResult = core.config.loadEnvFiles({ mode, envDir })
+export default defineConfig(({ mode, command }) => {
+  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
   if (!envResult.success)
     throw new Error(envResult.error.message)
   const env = envResult.data

package/templates/apps/fullstack/apps/{{projectName}}-web/README.md.hbs

@@ -20,14 +20,10 @@ pnpm --filter {{projectName}}-web dev
 
 # 编译 Web 前端
 pnpm --filter {{projectName}}-web build
-
-# 打包部署产物；默认等同 build，可按目标平台替换
-pnpm --filter {{projectName}}-web package
-
-# 当前模板的 deploy 入口默认执行 package，可替换为 CDN / 容器发布脚本
-pnpm --filter {{projectName}}-web deploy
 ```
 
+从工程根运行 `pnpm build --target docker` 构建并导出镜像。启用 deploy 功能后，运行根命令 `pnpm deploy --env test`，一次发布 API/Web；网络不通时用 `pnpm deploy --env prod --bundle-only`，按输出说明手工搬运 tar。部署不重新构建。
+
 ## IAM 认证配置
 
 服务端 `config/_iam.yml` 统一控制登录、注册、重置、协议与 `ui` 品牌。邮件/短信可用 `_reach.yml` 中的 Provider/标准模板或自定义发送回调。`AuthPanel` 使用安全公开配置及框架认证动作；无需在页面适配 Token、验证码倒计时和错误提示。所有节点共享同一 DB 与 Redis；Memory 仅用于单进程。

package/templates/apps/fullstack/apps/{{projectName}}-web/package.json.hbs

@@ -13,9 +13,7 @@
     "dev:prod": "vite --mode prod",
     "dev": "vite dev --host 127.0.0.1 --port {{fullstack.ports.web}}",
     "build": "pnpm paraglide:compile && vite build",
-    "build:prod": "pnpm paraglide:compile && vite build --mode prod",
     "package": "pnpm build",
-    "deploy": "pnpm package",
     "preview": "vite preview --host 127.0.0.1 --port {{fullstack.ports.web}} --strictPort",
     "check": "pnpm typecheck",
     "typecheck": "pnpm paraglide:compile && svelte-check --tsconfig ./tsconfig.json",

package/templates/apps/fullstack/apps/{{projectName}}-web/vite.config.ts.hbs

@@ -11,8 +11,8 @@ import { defineConfig } from 'vitest/config'
 
 const envDir = fileURLToPath(new URL('../../', import.meta.url))
 
-export default defineConfig(({ mode }) => {
-  const envResult = core.config.loadEnvFiles({ mode, envDir })
+export default defineConfig(({ mode, command }) => {
+  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
   if (!envResult.success)
     throw new Error(envResult.error.message)
   const env = envResult.data

package/templates/apps/fullstack/e2e/fullstack.spec.ts.hbs

@@ -96,6 +96,7 @@ test('branded authentication, profile layout and blur validation work across scr
   await capture(page, '{{projectName}}-register-mobile.png', testInfo.outputPath('register-mobile.png'))
   expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
   await page.reload()
+  await expect(page.getByTestId('login-form')).toBeVisible()
   await capture(page, '{{projectName}}-login-mobile.png', testInfo.outputPath('login-mobile.png'))
   await page.setViewportSize({ width: 1440, height: 960 })
   await login(page, 'admin', adminPassword)

package/templates/apps/fullstack/hai.build.json.hbs

@@ -0,0 +1,7 @@
+{
+  "images": [
+    { "name": "app", "target": "runtime", "containerPort": 3000 }{{#if fullstack.frontends.web}},
+    { "name": "web", "target": "web", "containerPort": 8080 }{{/if}}
+  ]{{#if fullstack.frontends.desktop}},
+  "desktop": ["apps/{{projectName}}-desktop"]{{/if}}
+}

package/templates/apps/fullstack/package.json.hbs

@@ -15,24 +15,16 @@
     "start:prod": "pnpm --filter {{fullstack.servPackageName}} start:prod",
     "dev:test": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm --parallel --filter {{fullstack.servPackageName}}{{#each fullstack.frontendApps}} --filter {{packageName}}{{/each}} dev:test",
     "dev:prod": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm --parallel --filter {{fullstack.servPackageName}}{{#each fullstack.frontendApps}} --filter {{packageName}}{{/each}} dev:prod",
-    "build:prod": "pnpm build && pnpm -r --if-present build:prod",
-    "compile": "pnpm typecheck && pnpm build",
-    "build": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm -r --if-present build",
-    "docker:build": "docker build --target runtime -t {{projectName}}:latest .",
-    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./packages/{{projectName}}-serv/data -t {{projectName}}:latest ."{{#if fullstack.frontends.web}},
-    "docker:build:web": "docker build --target web -t {{projectName}}-web:latest ."{{/if}},
-    "podman:build": "podman build --format docker --jobs=1 --target runtime -t {{projectName}}:latest .",
-    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./packages/{{projectName}}-serv/data -t {{projectName}}:latest ."{{#if fullstack.frontends.web}},
-    "podman:build:web": "podman build --format docker --jobs=1 --target web -t {{projectName}}-web:latest ."{{/if}},
-    "package": "pnpm build{{#if fullstack.frontends.web}} && pnpm --filter {{projectName}}-web package{{/if}}{{#if fullstack.frontends.app}} && pnpm --filter {{projectName}}-app package{{/if}}{{#if fullstack.frontends.desktop}} && pnpm --filter {{projectName}}-desktop package{{/if}}",
-    "deploy": "pnpm package",
+    "compile": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm -r --if-present build",
+    "build": "hai build",
+    "deploy": "hai deploy packages/{{projectName}}-serv",
     "check": "pnpm typecheck",
     "typecheck": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm -r --if-present typecheck",
     "lint": "eslint *.js *.ts e2e && pnpm -r --if-present lint",
     "lint:fix": "eslint *.js *.ts e2e --fix && pnpm -r --if-present lint:fix",
     "test": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm -r --if-present test",
     "test:watch": "pnpm -r --parallel --if-present test:watch",
-    "test:e2e": "pnpm build && playwright test",
+    "test:e2e": "pnpm compile && node scripts/run-e2e.mjs",
     "clean": "pnpm -r --if-present clean && rimraf node_modules .turbo"
   },
   "dependencies": {
@@ -41,6 +33,7 @@
     "{{fullstack.sharedPackageName}}": "workspace:*"
   },
   "devDependencies": {
+    "@h-ai/cli": "{{haiPackageSpecifier}}",
 {{#if features.deploy}}
     "@h-ai/deploy": "{{haiPackageSpecifier}}",
 {{/if}}

package/templates/apps/fullstack/packages/{{projectName}}-serv/README.md.hbs

@@ -35,11 +35,11 @@ CLI 已生成根目录 `.env.local`，`HAI_ADMIN_DEFAULT_PASSWORD` 为每个项
 
 ## 容器运行
 
-- 根目录 `pnpm docker:build` / `pnpm podman:build` 直接生成本服务镜像；Web 使用独立的 `docker:build:web` / `podman:build:web` 镜像。
+从工程根运行 `pnpm build --target docker` 构建并导出镜像。启用 deploy 功能后，运行根命令 `pnpm deploy --env test`；含 Web 镜像时一并发布 API/Web，部署不重新构建。网络不通时用 `pnpm deploy --env prod --bundle-only`，按说明手工搬运 tar。
+
 - 服务镜像直接由 `@h-ai/serv` 对外监听，配置挂载点为 `/app/config`，数据目录为 `/app/data`，不包含额外转发进程。
 - Web 镜像不烘焙 API 地址；启动时使用 `-e PUBLIC_API_BASE=https://api.example.com` 注入，同一镜像可部署到不同环境。未设置时 Web 默认请求自身 origin。
 - YAML 配置使用 `${ENV_NAME:default}` 接收运行时环境变量；不要把密钥写入镜像。
-- 将 SQLite/本地存储放入本目录 `data/` 后运行 `pnpm docker:build:data` / `pnpm podman:build:data`，可生成带初始数据的镜像，持续写入仍应使用 volume。
 
 ## IAM 认证配置
 

package/templates/apps/fullstack/packages/{{projectName}}-serv/package.json.hbs

@@ -20,7 +20,6 @@
   ],
   "scripts": {
     "build": "tsup",
-    "build:prod": "pnpm build",
     "check": "pnpm typecheck",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",

package/templates/apps/fullstack/packages/{{projectName}}-shared/README.md.hbs

@@ -39,7 +39,7 @@ The scaffold theme configuration determines the themes compiled into frontend CS
 
 ## Validation
 
-Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Shared API tests exercise real transport key exchange, encrypted request/response handling, configured core metadata and credential forwarding. Root browser tests cover administrator and ordinary-user workflows, avatar rendering, persisted preferences, password/session invalidation and narrow-screen layout. All selected Web/App/Desktop previews also exercise login, tours, help and profile navigation. Set `HAI_AUTH_EVIDENCE_DIR` to keep screenshots outside the test output directory. These browser checks do not replace native-shell or miniapp device acceptance.
+Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Shared API tests exercise real transport key exchange, encrypted request/response handling, configured core metadata and credential forwarding. Root browser tests cover administrator and ordinary-user workflows, avatar rendering, persisted preferences, password/session invalidation and narrow-screen layout. All selected Web/App/Desktop previews also exercise login, tours, help and profile navigation. Clean screenshots, reports, temporary projects, containers and helper processes in finally/teardown, including failure paths. These browser checks do not replace native-shell or miniapp device acceptance.
 
 ## IAM configuration
 

package/templates/apps/mobile-app/index.html.hbs

@@ -5,6 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <meta name="theme-color" content="#2563eb" />
     <title></title>
+    <script src="/runtime-config.js"></script>
   </head>
   <body>
     <div id="app"></div>

package/templates/apps/mobile-app/public/runtime-config.js

@@ -0,0 +1 @@
+globalThis.__HAI_PUBLIC_CONFIG__ ??= {}

package/templates/apps/mobile-app/src/lib/api.ts.hbs

@@ -10,7 +10,8 @@ const DEFAULT_API_BASE = 'http://localhost:3000/api/v1'
 let initialized = false
 
 export function resolveApiBase(): string {
-  return import.meta.env.PUBLIC_API_BASE ?? DEFAULT_API_BASE
+  const runtime = (globalThis as typeof globalThis & { __HAI_PUBLIC_CONFIG__?: { apiBase?: string } }).__HAI_PUBLIC_CONFIG__
+  return runtime?.apiBase || import.meta.env.PUBLIC_API_BASE || DEFAULT_API_BASE
 }
 
 export async function usesNativeTokenStorage(): Promise<boolean> {

package/templates/apps/mobile-app/src/lib/app-config.ts.hbs

@@ -5,8 +5,9 @@ declare const __APP_CORE_CONFIG__: Pick<CoreConfig, 'name' | 'version' | 'env' |
   logging?: Pick<NonNullable<CoreConfig['logging']>, 'level' | 'format'>
 }
 
-/** Vite 经 core 加载后注入的公开配置，修改 YAML 后重新构建客户端。 */
-export const appConfig = __APP_CORE_CONFIG__
+/** 构建包含公开默认值；预览或容器启动时的公开配置覆盖默认值，不重建静态资源。 */
+const runtime = (globalThis as typeof globalThis & { __HAI_PUBLIC_CONFIG__?: { core?: Partial<typeof __APP_CORE_CONFIG__> } }).__HAI_PUBLIC_CONFIG__?.core
+export const appConfig = { ...__APP_CORE_CONFIG__, ...runtime, logging: { ...__APP_CORE_CONFIG__.logging, ...runtime?.logging } }
 
 export function initClientCore(): void {
   core.init({ logging: appConfig.logging })

package/templates/base/.dockerignore.hbs

@@ -1,4 +1,5 @@
 .git
+**/*.tar
 .github
 .agents
 .claude
@@ -15,8 +16,6 @@ playwright-report
 test-results
 **/data
 *.log
-# 仅排除本机私有配置，与 Git 处理一致；公共 .env 与 dev/test/prod 随上下文构建。
-**/.env.local
-**/.env.*.local
-**/.env.runtime
-**/.hai/deploy
+# 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
+**/.env.*
+**/.hai