@h-ai/cli 0.1.0-alpha.65 → 0.1.0-alpha.67

package/templates/apps/fullstack/packages/{{projectName}}-serv/package.json.hbs

@@ -20,7 +20,6 @@
   ],
   "scripts": {
     "build": "tsup",
-    "build:prod": "pnpm build",
     "check": "pnpm typecheck",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",

package/templates/apps/fullstack/packages/{{projectName}}-shared/.gitignore.hbs

@@ -1,3 +1,10 @@
 node_modules
 .turbo
 src/lib/paraglide
+
+# 构建器生成的安装输入快照
+**/images/dependencies/
+
+# 项目本地缓存
+**/.pnpm-store/
+**/.cache/

package/templates/apps/fullstack/packages/{{projectName}}-shared/README.md.hbs

@@ -1,35 +1,48 @@
 # {{fullstack.sharedPackageName}}
 
+## Introduction
+
 Shared mini administration workspace for **{{projectName}}**. Web, Capacitor App and Tauri desktop use the same `AdminWorkspace`, responsive `AppShell`, typed API client and management store.
 
+## Core features
+
+- Shared management pages, forms, navigation and application state.
+- Typed encrypted API client and platform-specific token storage.
+- Themes, language preferences, onboarding and help.
+
+## Getting started
+
+### Behavior and configuration
+
 The behavior below describes the initial example. Roles, permissions, workflows, limits, preferences and audit policies can change with the user's requirements. Update conflicting implementation, tests and guidance together; preserve the applicable public API contracts and server security checks.
 
 - Administrators manage users, upload user avatars, assign the built-in administrator/user roles, edit role descriptions and query audit logs.
 - By default, ordinary users update their own profile, avatar, language, appearance and password. The server enforces the actual business permissions on every request.
+- The workspace uses the available window width. Tables scroll within their own area; settings panels form two columns on large screens and stack on phones.
 - `ManagementStore` owns API calls and business state; components render the state and forward user interactions.
 - Application name, version, environment and default locale come from the backend `app.info` contract, which reads `core` configuration. Do not duplicate these values in translations or frontend constants.
 - Requests, token refresh and JSON responses use the same `@h-ai/api-client` + `@h-ai/crypto` transport. Avatar uploads use encrypted JSON and validate PNG/JPEG/WebP content, with a 512 KiB limit.
 - Read metadata through the same initialized `managementApi.app.info()` client; inspect `success` before using `data`.
 
-All three Vite apps read the workspace root .env. Development and preview servers proxy /api to the local backend when no explicit API base is configured, so browser clients can use a single origin. In deployments, configure PUBLIC_API_BASE or the Web container runtime API origin for the actual service.
+Vite development and preview servers read the workspace root environment files and proxy /api to the backend. Builds do not load deployment environment files. Web containers receive their public API address at startup; native apps follow the platform configuration below.
 
 An origin-only API base uses `/api/v1`. For a custom service `http.apiPrefix`, include that path in `PUBLIC_API_BASE` or the runtime API base; the client preserves the configured path and restricts avatar URLs to its matching resource prefix.
 
-## Authentication and preferences
+### Authentication and preferences
 
 Web and browser previews keep access tokens in memory and refresh tokens in the server's httpOnly Cookie. Requests include credentials; reload restores the session through the encrypted refresh flow. Never store authentication tokens in localStorage.
 
-Capacitor native uses `createCapacitorTokenStorage()` and the trusted native token channel. Tauri native uses memory token storage and requires a new login after restarting the application. Native builds require a reachable `PUBLIC_API_BASE` in the workspace root `.env`; missing configuration produces a connection configuration error. Both send their frontend `clientName` and `X-HAI-Token-Transport: body`; the service verifies the allowed native origin before returning a refresh token in JSON.
+Capacitor native uses `createCapacitorTokenStorage()` and the trusted native token channel. Set its public API address in the App's `public/runtime-config.js` before compiling and syncing native assets. Tauri uses memory token storage and requires a new login after restart; set process `PUBLIC_API_BASE` before launching the installed application, and its Rust host injects the address. Both send `clientName` and `X-HAI-Token-Transport: body`; the service verifies the trusted native origin before returning a refresh token in JSON. Missing API configuration is an error, not a successful connection.
 
 Language and theme preferences are saved in IAM user metadata, restored after login and synchronized with the shared/host Paraglide runtimes and `core.i18n`. The small reactive theme store delegates DOM updates and safe appearance caching to `@h-ai/ui/theme` (`applyTheme` / `getSavedTheme`); the framework uses the `theme` localStorage key. Appearance selectors live in personal settings and save through the authenticated profile contract.
 
-## Onboarding and help
+### Onboarding and help
 
 AdminWorkspace mounts the shared `@h-ai/ui/guide` controller and GuideHost after authentication. AppShell includes a help button; first-use invitations offer start, later and dismiss. Web stores preferences in Cookies, while App/Desktop use localStorage, scoped by the current user and tour version. Help articles link to the overview and profile tours.
 
 Extend `src/lib/stores/guide-store.ts` and the shared Chinese/English messages, then add stable data-guide attributes to existing components. Navigation uses the same ManagementStore. Keep business text as i18n callbacks and preserve the host's locale/scope binding. Browser tests cover completion, reload, replay, settings navigation and mobile help.
 
-## i18n and themes
+### i18n and themes
 
 Shared page copy belongs in `messages/{zh-CN,en-US}.json`. Frontend-specific copy belongs in each app's own messages directory. Keep `baseLocale` and `locales` aligned across all enabled projects, then run root `pnpm i18n:compile`; do not edit generated Paraglide files.
 
@@ -37,22 +50,30 @@ All frontend and shared projects load the installed message-format plugin from t
 
 The scaffold theme configuration determines the themes compiled into frontend CSS. Personal settings offer only those available themes. Customize the common layout in `src/lib/components/AppShell.svelte`, the management pages in adjacent components, and business behavior in `src/lib/stores/management-store.svelte.ts`.
 
-## Validation
+### Validation
 
-Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Shared API tests exercise real transport key exchange, encrypted request/response handling, configured core metadata and credential forwarding. Root browser tests cover administrator and ordinary-user workflows, avatar rendering, persisted preferences, password/session invalidation and narrow-screen layout. All selected Web/App/Desktop previews also exercise login, tours, help and profile navigation. Set `HAI_AUTH_EVIDENCE_DIR` to keep screenshots outside the test output directory. These browser checks do not replace native-shell or miniapp device acceptance.
+Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Shared API tests exercise real transport key exchange, encrypted request/response handling, configured core metadata and credential forwarding. Root browser tests cover administrator and ordinary-user workflows, avatar rendering, persisted preferences, password/session invalidation and narrow-screen layout. All selected Web/App/Desktop previews also exercise login, tours, help and profile navigation. Clean screenshots, reports, temporary projects, containers and helper processes in finally/teardown, including failure paths. These browser checks do not replace native-shell or miniapp device acceptance.
 
-## IAM configuration
+### IAM configuration
 
-The service's `config/_iam.yml` controls login methods, registration, password reset, agreements and `ui` branding. Email and SMS use providers/templates in `_reach.yml` or custom callbacks. `AuthPanel` uses the public configuration and framework auth actions to manage tokens, resend countdowns and errors. All service nodes must share the same database and Redis; memory cache is for a single process.
+The service's `config/_iam.yml` controls login methods, registration, password reset, agreements and `ui` branding. Email and SMS use providers/templates in `_reach.yml` or custom callbacks. `AuthPanel` uses the public configuration and framework auth actions to manage tokens, resend countdowns and errors. A single process can use memory cache. Multiple instances need shared database/cache, write routing and transport session affinity as described in the project README.
 
 Authentication defaults to a split layout. Set `ui.variant`, `title`, `subtitle`, `brandTitle`, `brandText`, `logoUrl` and `illustrationUrl` to customize login and registration. Without a `brandTitle`, the displayed application name comes from `app.info` and follows `core` configuration.
 
 LDAP and Reach are optional. Install ldapts in the IAM service workspace only when using its default LDAP client, then enable login.ldap and set connection settings. Custom onOtpSendEmail/onOtpSendSms/onPasswordResetRequest callbacks work without Reach and must reject on delivery failure. Agreements open in a Modal. LoginForm/RegisterForm support header/extraFields/footer snippets; AuthPanel forwards loginHeader/loginFields/loginFooter and registerHeader/registerFields/registerFooter. See the generated hai-iam/hai-ui skills for configuration and examples.
 
-协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
+Agreements accept Markdown text or a URL. Markdown takes precedence and opens in a safely rendered dialog.
 
 See `.agents/skills/hai-iam/reference.md` in the generated application for the complete contract.
 
-## Form layouts
+### Form layouts
+
+The user editor uses `FormLayout columns={2} labelPosition="left"`. Personal settings fill the available width and use two columns on wide screens, with stacked labels and a single avatar editor. Narrow containers automatically stack cards, fields and labels. UI controls and CRUD forms show client validation on blur, update errors while correcting input and validate untouched fields on submit. Field errors follow the current UI language. The management store syncs locale through the lightweight `@h-ai/ui/i18n` entry, without loading components or tour CSS. Configure `colSpan` on FormField to override automatic spans for textareas, uploads and multiple choices.
+
+## Development and testing
+
+Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Browser checks cover shared workflows; test native shells on their target platforms separately.
+
+## License
 
-The user editor uses `FormLayout columns={2} labelPosition="left"`. Personal settings use a bounded page width, stacked labels and a single avatar editor. Narrow containers automatically stack fields and labels. UI controls and CRUD forms show client validation on blur, update errors while correcting input and validate untouched fields on submit. Field errors follow the current UI language. The management store syncs locale through the lightweight `@h-ai/ui/i18n` entry, without loading components or tour CSS. Configure `colSpan` on FormField to override automatic spans for textareas, uploads and multiple choices.
+Apache-2.0

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/AppShell.svelte.hbs

@@ -34,7 +34,7 @@
   {#if menuOpen}
     <BareButton class="fixed inset-0 z-30 bg-black/30 lg:hidden" ariaLabel={m.close_menu()} onclick={() => { menuOpen = false }} />
   {/if}
-  <aside class="fixed inset-y-0 left-0 z-40 flex w-60 flex-col border-r border-base-content/8 bg-base-100 transition-transform duration-200 lg:sticky lg:top-0 lg:h-dvh lg:translate-x-0 {menuOpen ? 'translate-x-0' : '-translate-x-full'}">
+  <aside class="fixed inset-y-0 left-0 z-40 flex w-60 shrink-0 flex-col border-r border-base-content/8 bg-base-100 transition-transform duration-200 lg:sticky lg:top-0 lg:h-dvh lg:translate-x-0 {menuOpen ? 'translate-x-0' : '-translate-x-full'}">
     <div class="flex h-16 items-center gap-3 border-b border-base-content/8 px-5">
       <span class="grid size-8 shrink-0 place-items-center rounded-lg bg-primary text-primary-content"><span class="icon-[tabler--hexagon-letter-h] size-5"></span></span>
       <span class="truncate text-sm font-semibold" data-testid="app-name">{store.info?.name}</span>
@@ -66,7 +66,7 @@
         <Button variant="ghost" size="sm" loading={store.saving} onclick={() => void store.logout()} data-testid="logout">{m.logout()}</Button>
       </div>
     </header>
-    <main class="mx-auto w-full max-w-7xl flex-1 p-4 pb-8 sm:p-6 lg:p-8" data-guide="admin-content">{@render children()}</main>
+    <main class="w-full min-w-0 flex-1 p-4 pb-8 sm:p-6 lg:p-8" data-guide="admin-content">{@render children()}</main>
     <footer class="border-t border-base-content/8 px-6 py-3 text-center text-xs text-base-content/35">{store.info?.name} · v{store.info?.version}</footer>
   </div>
 </div>

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/pages/settings.svelte.hbs

@@ -14,13 +14,13 @@
   const themeOptions = AVAILABLE_THEMES.map(theme => ({ value: theme, label: getThemeInfo(theme)?.name ?? theme }))
 </script>
 
-<section class='mx-auto w-full max-w-4xl space-y-6' data-testid='settings-page'>
-  <div>
+<section class='grid w-full min-w-0 gap-6 xl:grid-cols-2' data-testid='settings-page'>
+  <div class='xl:col-span-2'>
     <h1 class='text-xl font-semibold tracking-tight'>{m.settings_title()}</h1>
     <p class='mt-1 text-sm text-base-content/50'>{m.settings_description()}</p>
   </div>
   {#if store.user}
-    <Card title={m.profile_title()} bordered shadow={false} data-guide='admin-profile-form'>
+    <Card class='xl:row-span-2' title={m.profile_title()} bordered shadow={false} data-guide='admin-profile-form'>
       <div class='mb-5 flex flex-wrap items-center gap-3 border-b border-base-content/8 pb-4'>
         <p class='min-w-0 break-all text-sm text-base-content/55'>@{store.user.username}</p>
         <Badge size='sm' variant='ghost'>{store.isAdmin ? m.role_admin() : m.role_user()}</Badge>

package/templates/apps/fullstack/packages/{{projectName}}-shared/tests/api-client.test.ts.hbs

@@ -75,11 +75,11 @@ describe('shared API transport', () => {
     expect(server.requests.at(-1)?.headers.get('x-request-client')).toBe('configured-client')
   })
 
-  it('uses the API origin injected at container startup', async () => {
+  it.each([false, true])('uses the injected API origin when native configuration is required: %s', async (requireApiBase) => {
     Object.assign(globalThis, { __HAI_PUBLIC_CONFIG__: { apiBase: 'https://runtime.example.com' } })
     const server = createServerFetch()
     try {
-      expect((await initializeManagementApi({ fetchFn: server.fetchFn })).success).toBe(true)
+      expect((await initializeManagementApi({ fetchFn: server.fetchFn, requireApiBase })).success).toBe(true)
       expect((await managementApi.app.info()).success).toBe(true)
       expect(server.requests.every(request => request.url.startsWith('https://runtime.example.com/api/v1/'))).toBe(true)
     }

package/templates/apps/h5/src/routes/+layout.svelte.hbs

@@ -61,14 +61,14 @@
 </svelte:head>
 
 <div class='hai-mobile-viewport'>
-  <div class='hai-mobile-shell max-w-lg'>
+  <div class='hai-mobile-shell min-w-0'>
     <AppBar title={page.data.appConfig.name} safeArea fixed={false} />
     <main class='hai-mobile-main'>{@render children()}</main>
     <footer class='border-t border-base-300 bg-base-100 p-2 text-center text-xs text-base-content/60'>
       {page.data.appConfig.name} · {page.data.appConfig.version} · {page.data.appConfig.env}
     </footer>
     {#if !isAuthPage}
-      <BottomNav items={navItems} active={activeNav} onchange={handleNavigation} centered maxWidth='lg' safeArea />
+      <BottomNav items={navItems} active={activeNav} onchange={handleNavigation} centered maxWidth='none' safeArea />
     {/if}
   </div>
 </div>

package/templates/apps/mobile-app/index.html.hbs

@@ -5,6 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <meta name="theme-color" content="#2563eb" />
     <title></title>
+    <script src="/runtime-config.js"></script>
   </head>
   <body>
     <div id="app"></div>

package/templates/apps/mobile-app/public/runtime-config.js

@@ -0,0 +1 @@
+globalThis.__HAI_PUBLIC_CONFIG__ ??= {}

package/templates/apps/mobile-app/src/App.svelte.hbs

@@ -100,7 +100,7 @@
 </script>
 
 <div class='hai-mobile-viewport'>
-  <div class='hai-mobile-shell max-w-lg'>
+  <div class='hai-mobile-shell min-w-0'>
     <AppBar title={appConfig.name} safeArea fixed={false} class='bg-base-100/95 backdrop-blur border-base-content/8' />
     <main class='hai-mobile-main'>
       {#if booting}
@@ -129,7 +129,7 @@
 {{#if features.iam}}
     {#if authenticated && !booting && !bootError}
 {{/if}}
-      <BottomNav items={navItems} active={router.path.slice(1)} onchange={handleTabChange} safeArea centered maxWidth='lg' />
+      <BottomNav items={navItems} active={router.path.slice(1)} onchange={handleTabChange} safeArea centered maxWidth='none' />
 {{#if features.iam}}
     {/if}
 {{/if}}

package/templates/apps/mobile-app/src/lib/api.ts.hbs

@@ -10,7 +10,8 @@ const DEFAULT_API_BASE = 'http://localhost:3000/api/v1'
 let initialized = false
 
 export function resolveApiBase(): string {
-  return import.meta.env.PUBLIC_API_BASE ?? DEFAULT_API_BASE
+  const runtime = (globalThis as typeof globalThis & { __HAI_PUBLIC_CONFIG__?: { apiBase?: string } }).__HAI_PUBLIC_CONFIG__
+  return runtime?.apiBase || import.meta.env.PUBLIC_API_BASE || DEFAULT_API_BASE
 }
 
 export async function usesNativeTokenStorage(): Promise<boolean> {

package/templates/apps/mobile-app/src/lib/app-config.ts.hbs

@@ -5,8 +5,9 @@ declare const __APP_CORE_CONFIG__: Pick<CoreConfig, 'name' | 'version' | 'env' |
   logging?: Pick<NonNullable<CoreConfig['logging']>, 'level' | 'format'>
 }
 
-/** Vite 经 core 加载后注入的公开配置，修改 YAML 后重新构建客户端。 */
-export const appConfig = __APP_CORE_CONFIG__
+/** 构建包含公开默认值；预览或容器启动时的公开配置覆盖默认值，不重建静态资源。 */
+const runtime = (globalThis as typeof globalThis & { __HAI_PUBLIC_CONFIG__?: { core?: Partial<typeof __APP_CORE_CONFIG__> } }).__HAI_PUBLIC_CONFIG__?.core
+export const appConfig = { ...__APP_CORE_CONFIG__, ...runtime, logging: { ...__APP_CORE_CONFIG__.logging, ...runtime?.logging } }
 
 export function initClientCore(): void {
   core.init({ logging: appConfig.logging })

package/templates/apps/mobile-app/src/lib/pages/home.svelte.hbs

@@ -12,8 +12,8 @@
   const { nativeRuntime, nativeTokenStorage }: Props = $props()
 </script>
 
-<section class='space-y-4 p-4 pb-6'>
-  <div class='bg-primary text-primary-content rounded-2xl p-5 shadow-sm'>
+<section class='grid gap-4 p-4 pb-6 lg:grid-cols-2'>
+  <div class='lg:col-span-2 bg-primary text-primary-content rounded-2xl p-5 shadow-sm'>
     <p class='text-sm opacity-75'>{m.hero_eyebrow()}</p>
     <h1 class='mt-1 text-2xl font-bold'>{m.hero_title()}</h1>
     <p class='mt-2 text-sm opacity-80'>{m.hero_subtitle()}</p>

package/templates/apps/website/src/routes/+layout.svelte.hbs

@@ -49,7 +49,7 @@
 </svelte:head>
 
 <div class='min-h-screen flex flex-col'>
-  <header class='navbar bg-base-100 shadow-sm'>
+  <header class='navbar flex-wrap bg-base-100 shadow-sm'>
     <div class='flex-1'>
 {{#if hasI18n}}
       <a href={resolve('/', {})} class='btn btn-ghost text-xl font-black tracking-tight'>{page.data.appConfig.name}</a>
@@ -57,8 +57,8 @@
       <a href={resolve('/', {})} class='btn btn-ghost text-xl font-black tracking-tight'>{page.data.appConfig.name}</a>
 {{/if}}
     </div>
-    <nav class='flex-none'>
-      <ul class='menu menu-horizontal px-1'>
+    <nav class='w-full flex-none sm:w-auto'>
+      <ul class='menu menu-horizontal flex-wrap px-1'>
         {#each navItems as item (item.path)}
           <li><a href={resolve(item.path, {})}>{item.label}</a></li>
         {/each}

package/templates/apps/website/src/routes/services/+page.svelte.hbs

@@ -31,7 +31,7 @@
 {{/if}}
 </svelte:head>
 
-<section class='py-16 px-4 max-w-4xl mx-auto'>
+<section class='mx-auto w-full max-w-[120rem] px-4 py-16 sm:px-6 lg:px-8'>
 {{#if hasI18n}}
   <PageHeader title={m.page_services_title()} description={m.page_services_desc()} />
 {{else}}

package/templates/base/.dockerignore.hbs

@@ -1,22 +1,27 @@
-.git
+**/.git
+**/node_modules
+**/.pnpm-store
+**/.cache
+**/.svelte-kit
+**/.turbo
+**/build
+**/dist
+**/coverage
+**/playwright-report
+**/test-results
+**/src-tauri/target
+**/hash-core/target
+tmp
+**/*.tar
 .github
 .agents
 .claude
 .codex
 .opencode
-.svelte-kit
-.turbo
 android
-build
-dist
 ios
-node_modules
-playwright-report
-test-results
 **/data
 *.log
-# 仅排除本机私有配置，与 Git 处理一致；公共 .env 与 dev/test/prod 随上下文构建。
-**/.env.local
-**/.env.*.local
-**/.env.runtime
-**/.hai/deploy
+# 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
+**/.env.*
+**/.hai

package/templates/base/.gitignore.hbs

@@ -25,9 +25,17 @@ playwright-report/
 # 本地数据目录
 **/data/
 
-# hai deploy 产物（compose / .env.runtime / 镜像 tar / sidecar 凭据）
+# 构建与部署产物（镜像 / Compose tar / 私有运行配置）
 .hai/
+*.tar
 
 # 本机私有配置；公共 .env 与 dev/test/prod 环境文件纳入版本控制。
 .env.local
 .env.*.local
+
+# 构建器生成的安装输入快照
+**/images/dependencies/
+
+# 项目本地缓存
+**/.pnpm-store/
+**/.cache/

package/templates/base/e2e/app.spec.ts.hbs

@@ -23,6 +23,16 @@ test('home page renders from browser', async ({ page }) => {
   await expect(page.locator('main, section').first()).toBeVisible()
   await expect(page.locator('header').first()).toBeVisible()
   await expect(page.locator('footer').first()).toBeAttached()
+  // 大屏使用可用空间，窄屏由组件内部滚动，不能撑宽整个页面。
+  for (const width of [390, 1440, 1920, 2560, 3840]) {
+    await page.setViewportSize({ width, height: 960 })
+    const availableWidth = await page.evaluate(() => document.documentElement.clientWidth)
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+    const shell = page.locator('.hai-mobile-shell')
+    if (await shell.count())
+      expect((await shell.boundingBox())!.width).toBeGreaterThan(availableWidth - 2)
+  }
+  await page.setViewportSize({ width: 390, height: 844 })
 {{#if_eq appType 'h5'}}
   // 在手机宽度验证导航真正切换路由，避免样式失效但首页渲染测试仍通过。
   const nav = page.locator('nav')

package/templates/base/hai.build.json.hbs

@@ -0,0 +1 @@
+{ "images": [{ "name": "app", "dockerfile": "images/app.Dockerfile", "containerPort": {{#if isSvelteOnlyApp}}8080{{else}}3000{{/if}} }] }

package/templates/base/images/app.Dockerfile.hbs

@@ -0,0 +1,64 @@
+{{#if isSvelteOnlyApp}}
+FROM node:24.22.1-bookworm-slim AS build
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
+ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
+WORKDIR /workspace
+
+RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY images/dependencies/ ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
+COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN pnpm compile
+
+FROM nginxinc/nginx-unprivileged:1.29.8-alpine AS runtime
+
+COPY --chmod=755 images/web/19-runtime-config.sh /docker-entrypoint.d/19-hai-runtime-config.sh
+COPY images/web/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /workspace/dist /usr/share/nginx/html
+
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1
+{{else}}
+FROM node:24.22.1-bookworm-slim AS build
+ARG SQLITE_PREBUILD_MIRROR=
+ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
+ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
+WORKDIR /workspace
+
+RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY images/dependencies/ ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
+COPY . .
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN pnpm compile
+RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{projectName}} --prod /prod/app
+
+FROM node:24.22.1-bookworm-slim AS runtime-base
+
+ENV NODE_ENV=production
+ENV HOST=0.0.0.0
+ENV PORT=3000
+WORKDIR /app
+
+COPY --from=build --chown=node:node /prod/app ./
+RUN mkdir -p /app/data && chown node:node /app/data
+
+USER node
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+CMD ["node", "build"]
+
+{{/if}}

package/templates/base/{docker → images/web}/nginx.conf.hbs

@@ -9,6 +9,12 @@ server {
     try_files $uri $uri/ /index.html;
   }
 
+  location = /runtime-config.js {
+    alias /tmp/hai-runtime-config/runtime-config.js;
+    add_header Cache-Control "no-store";
+    default_type application/javascript;
+  }
+
   location = /health {
     access_log off;
     add_header Content-Type text/plain;

package/templates/base/package.json.hbs

@@ -1,7 +1,7 @@
 {
   "engines": { "node": "^22.22.2 || ^24.15.0 || >=26.0.0" },
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.65",
+  "version": "0.1.0-alpha.67",
   "private": true,
   "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
@@ -23,8 +23,11 @@
     "dev": "vite dev",
     "dev:test": "vite dev --mode test",
     "dev:prod": "vite dev --mode prod",
-    "build": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}vite build",
-    "build:prod": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}vite build --mode prod",
+    "compile": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}vite build",
+    "build": "hai build",
+{{#if features.deploy}}
+    "deploy": "hai deploy",
+{{/if}}
 {{#unless isSvelteOnlyApp}}
     "start": "node --env-file=.env --env-file=.env.prod --env-file-if-exists=.env.local build/index.js",
     "start:test": "node --env-file=.env --env-file=.env.test --env-file-if-exists=.env.local build/index.js",
@@ -37,26 +40,20 @@
     "lint:fix": "eslint . --fix",
     "test": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}vitest run",
     "test:watch": "vitest",
-    "test:e2e": "playwright test",
-    "clean": "{{#if isSvelteOnlyApp}}rimraf dist build android ios .turbo src/lib/paraglide{{else}}rimraf .svelte-kit build .turbo{{/if}}",
-    "docker:build": "docker build --target runtime -t {{projectName}}:latest .",
-{{#unless isSvelteOnlyApp}}
-    "docker:build:data": "docker build --target runtime-with-data --build-context embedded-data=./data -t {{projectName}}:latest .",
-{{/unless}}
-    "podman:build": "podman build --format docker --jobs=1 --target runtime -t {{projectName}}:latest ."{{#unless isSvelteOnlyApp}},
-    "podman:build:data": "podman build --format docker --jobs=1 --target runtime-with-data --build-context embedded-data=./data -t {{projectName}}:latest ."{{/unless}}{{#if isCapacitorApp}},
+    "test:e2e": "node scripts/run-e2e.mjs",
+    "clean": "{{#if isSvelteOnlyApp}}rimraf dist build android ios .turbo src/lib/paraglide{{else}}rimraf .svelte-kit build .turbo{{/if}}"{{#if isCapacitorApp}},
     "cap:add:android": "cap add android",
     "cap:add:ios": "cap add ios",
-    "cap:sync": "pnpm build && cap sync",
-    "cap:sync:android": "pnpm build && cap sync android",
-    "cap:sync:ios": "pnpm build && cap sync ios",
+    "cap:sync": "pnpm compile && cap sync",
+    "cap:sync:android": "pnpm compile && cap sync android",
+    "cap:sync:ios": "pnpm compile && cap sync ios",
     "cap:android": "cap open android",
     "cap:ios": "cap open ios",
     "cap:run:android": "cap run android",
     "cap:run:ios": "cap run ios",
-    "cap:build:android:debug": "pnpm build && cap sync android && cd android && gradlew.bat assembleDebug",
-    "cap:build:android:release": "pnpm build && cap sync android && cap build android --androidreleasetype APK",
-    "cap:build:ios": "pnpm build && cap sync ios && cap build ios"{{/if}}
+    "cap:build:android:debug": "pnpm compile && cap sync android && cd android && gradlew.bat assembleDebug",
+    "cap:build:android:release": "pnpm compile && cap sync android && cap build android --androidreleasetype APK",
+    "cap:build:ios": "pnpm compile && cap sync ios && cap build ios"{{/if}}
   },
   "dependencies": {
   {{#if isSvelteOnlyApp}}
@@ -78,16 +75,20 @@
     "@h-ai/payment": "{{haiPackageSpecifier}}"{{/if}}{{#if features.vecdb}},
     "@h-ai/vecdb": "{{haiPackageSpecifier}}"{{/if}}{{#if features.datapipe}},
     "@h-ai/datapipe": "{{haiPackageSpecifier}}"{{/if}}{{#if features.scheduler}},
-    "@h-ai/scheduler": "{{haiPackageSpecifier}}"{{/if}}{{#if features.deploy}},
-    "@h-ai/deploy": "{{haiPackageSpecifier}}"{{/if}}{{#if features.api-client}},
+    "@h-ai/scheduler": "{{haiPackageSpecifier}}"{{/if}}{{#if features.api-client}},
     "@h-ai/api-client": "{{haiPackageSpecifier}}"{{/if}}{{#if features.capacitor}},
     "@h-ai/capacitor": "{{haiPackageSpecifier}}"{{/if}}{{#if isCapacitorApp}}{{#unless features.api-client}},
     "@h-ai/api-client": "{{haiPackageSpecifier}}"{{/unless}}{{#unless features.capacitor}},
     "@h-ai/capacitor": "{{haiPackageSpecifier}}"{{/unless}}{{/if}},
+    "sm-crypto": "0.5.7",
     "zod": "{{versions.zod}}"
 {{/if}}
   },
   "devDependencies": {
+{{#if features.deploy}}
+    "@h-ai/deploy": "{{haiPackageSpecifier}}",
+{{/if}}
+    "@h-ai/cli": "{{haiPackageSpecifier}}",
 {{#if isSvelteOnlyApp}}
     "@h-ai/core": "{{haiPackageSpecifier}}",
 {{/if}}

package/templates/base/svelte.config.js.hbs

@@ -56,6 +56,8 @@ const config = {
     runes: true,
   },
   kit: {
+    // 环境文件由 Vite 的 core loader 统一加载；Kit 不再二次读取根目录私有配置。
+    env: { dir: './.svelte-kit' },
 {{#if isCapacitorApp}}
     adapter: adapter({
       pages: 'build',

package/templates/base/vite.config.ts.hbs

@@ -22,9 +22,12 @@ import { sveltekit } from '@sveltejs/kit/vite'
 import tailwindcss from '@tailwindcss/vite'
 {{/if}}
 import { defineConfig } from 'vite'
+{{#if isSvelteOnlyApp}}
+import { publicRuntimeConfig } from './scripts/vite-runtime-config.js'
+{{/if}}
 
-export default defineConfig(({ mode }) => {
-  const envResult = core.config.loadEnvFiles({ mode, envDir: process.cwd() })
+export default defineConfig(({ mode, command }) => {
+  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir: process.cwd() })
   if (!envResult.success)
     throw new Error(envResult.error.message)
   const env = envResult.data
@@ -50,6 +53,7 @@ export default defineConfig(({ mode }) => {
 {{/if}}
     plugins: [
   {{#if isSvelteOnlyApp}}
+      publicRuntimeConfig({ apiBase: process.env.PUBLIC_API_BASE, core: appConfig }),
       svelte(),
   {{else}}
       sveltekit(),
@@ -76,7 +80,9 @@ export default defineConfig(({ mode }) => {
 {{/if}}
 {{#unless isSvelteOnlyApp}}
     ssr: {
-      noExternal: [/@h-ai\//],
+      noExternal: ['@h-ai/ui', '@h-ai/kit'],
+      // sm-crypto 同时列入生产依赖，避免 adapter-node 再次打包其动态 require。
+      external: ['@h-ai/core', 'sm-crypto'],
     },
 {{/unless}}
     server: {

package/templates/shared/.gitattributes

@@ -0,0 +1,11 @@
+# Windows 构建机交付 Linux 启动脚本时必须保留 LF，避免 /bin/sh 解释器失效。
+*.sh text eol=lf
+*.sh.hbs text eol=lf
+*.envsh text eol=lf
+*.envsh.hbs text eol=lf
+
+# Linux 容器引擎读取忽略规则和构建文件时统一使用 LF。
+.dockerignore text eol=lf
+*.dockerignore text eol=lf
+Dockerfile text eol=lf
+*.Dockerfile text eol=lf

package/templates/shared/container-runtime-config.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+
+# 只编码公开白名单；Base64 不会把环境值中的引号或换行解释为 JavaScript。
+encode() { printf '%s' "$1" | base64 | tr -d '\n'; }
+mkdir -p /tmp/hai-runtime-config
+cat > /tmp/hai-runtime-config/runtime-config.js <<EOF
+{
+  const decode = value => new TextDecoder().decode(Uint8Array.from(atob(value), character => character.charCodeAt(0)));
+  const nonempty = object => Object.fromEntries(Object.entries(object).filter(([, value]) => value !== ''));
+  const core = nonempty({
+    name: decode('$(encode "${HAI_CORE_NAME:-}")'),
+    version: decode('$(encode "${HAI_CORE_VERSION:-}")'),
+    env: decode('$(encode "${HAI_CORE_ENV:-}")'),
+    defaultLocale: decode('$(encode "${HAI_CORE_DEFAULTLOCALE:-}")')
+  });
+  const logging = nonempty({
+    level: decode('$(encode "${HAI_CORE_LOGGING_LEVEL:-}")'),
+    format: decode('$(encode "${HAI_CORE_LOGGING_FORMAT:-}")')
+  });
+  if (Object.keys(logging).length) core.logging = logging;
+  const config = nonempty({
+    apiBase: decode('$(encode "${PUBLIC_API_BASE:-}")'),
+    apiTransport: decode('$(encode "${PUBLIC_API_TRANSPORT:-}")'),
+    apiKeyExchangePath: decode('$(encode "${PUBLIC_API_KEY_EXCHANGE_PATH:-}")')
+  });
+  if (Object.keys(core).length) config.core = core;
+  globalThis.__HAI_PUBLIC_CONFIG__ = { ...globalThis.__HAI_PUBLIC_CONFIG__, ...config };
+}
+EOF