refactor(orpc): simplify architecture following KISS principle

- Fix NotFount.tsx typo -> NotFound.tsx
- Restructure ORPC: server -> middlewares -> procedures -> handlers
- Remove std-env dependency and over-engineered ephemeral detection
- Add procedures.ts as middleware composition layer
- Use globalThis for DB singleton (survives HMR)
- Preserve context in middleware (fix context merge bug)
- Remove unused ORPCContextWithDb type

.env.example

@@ -0,0 +1 @@
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/postgres

.gitignore

@@ -9,11 +9,6 @@
 # Bun build
 *.bun-build
 
-# SQLite database files
-*.db
-*.db-wal
-*.db-shm
-
 # Turborepo
 .turbo/
 

.vscode/extensions.json

@@ -2,8 +2,11 @@
   "recommendations": [
     "biomejs.biome",
     "hverlin.mise-vscode",
+    "mikestead.dotenv",
     "oven.bun-vscode",
     "redhat.vscode-yaml",
-    "tamasfe.even-better-toml"
+    "rust-lang.rust-analyzer",
+    "tamasfe.even-better-toml",
+    "tauri-apps.tauri-vscode"
   ]
 }

.vscode/settings.json

@@ -1,42 +1,48 @@
 {
+  // Disable the default formatter & linter, use biome instead
+  "prettier.enable": false,
+  "eslint.enable": false,
+
+  // Auto fix
+  "editor.codeActionsOnSave": {
+    "source.fixAll.biome": "explicit",
+    "source.organizeImports.biome": "explicit"
+  },
+  "editor.defaultFormatter": "biomejs.biome",
+  "editor.formatOnSave": true,
   "[javascript]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
   "[javascriptreact]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
+  "[typescript]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
   "[json]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
   "[jsonc]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
-  "[toml]": {
-    "editor.defaultFormatter": "tamasfe.even-better-toml"
-  },
-  "[typescript]": {
-    "editor.defaultFormatter": "biomejs.biome"
-  },
-  "[typescriptreact]": {
-    "editor.defaultFormatter": "biomejs.biome"
-  },
   "[yaml]": {
     "editor.defaultFormatter": "redhat.vscode-yaml"
   },
-  "editor.codeActionsOnSave": {
+  "[toml]": {
-    "source.fixAll.biome": "explicit",
+    "editor.defaultFormatter": "tamasfe.even-better-toml"
-    "source.organizeImports.biome": "explicit"
   },
-  "editor.defaultFormatter": "biomejs.biome",
-  "editor.formatOnSave": true,
   "files.associations": {
     ".env": "dotenv",
     ".env.*": "dotenv",
+    "**/tsconfig*.json": "jsonc",
     "**/biome.json": "jsonc",
-    "**/opencode.json": "jsonc",
+    "**/opencode.json": "jsonc"
-    "**/tsconfig.*.json": "jsonc",
-    "**/tsconfig.json": "jsonc"
   },
+
+  // TanStack Router
   "files.readonlyInclude": {
     "**/routeTree.gen.ts": true
   },

AGENTS.md

@@ -1,219 +1,193 @@
 # AGENTS.md - AI Coding Agent Guidelines
 
-Guidelines for AI agents working in this Bun monorepo.
-
 ## Project Overview
 
-> **This project uses [Bun](https://bun.sh) exclusively as both the JavaScript runtime and package manager. Do NOT use Node.js / npm / yarn / pnpm. All commands start with `bun` — use `bun install` for dependencies and `bun run <script>` for scripts. Always prefer `bun run <script>` over `bun <script>` to avoid conflicts with Bun built-in subcommands (e.g. `bun build` invokes Bun's bundler, NOT your package.json script). Never use `npm`, `npx`, or `node`.**
+TanStack Start fullstack app with Tauri desktop shell.
 
-- **Monorepo**: Bun workspaces + Turborepo orchestration
+| Layer | Tech |
-- **Runtime**: Bun (see `mise.toml` for version) — **NOT Node.js**
+|-------|------|
-- **Package Manager**: Bun — **NOT npm / yarn / pnpm**
+| Framework | TanStack Start (React SSR, file-based routing) |
-- **Apps**:
+| Runtime | Bun |
-  - `apps/server` - TanStack Start fullstack web app (see `apps/server/AGENTS.md`)
+| Language | TypeScript (strict mode) |
-  - `apps/desktop` - Electron desktop shell, sidecar server pattern (see `apps/desktop/AGENTS.md`)
+| Styling | Tailwind CSS v4 |
-- **Packages**: `packages/tsconfig` (shared TS configs)
+| Database | PostgreSQL + Drizzle ORM |
+| RPC | ORPC (contract-first, type-safe) |
+| Build | Vite + Turbo |
+| Linting | Biome |
+| Desktop | Tauri v2 (optional, see `src-tauri/AGENTS.md`) |
 
-## Build / Lint / Test Commands
+## Commands
 
-### Root Commands (via Turbo)
 ```bash
-bun run dev              # Start all apps in dev mode
+# Development
-bun run build            # Build all apps
+bun dev              # Start Tauri + Vite via Turbo
-bun run compile          # Compile server to standalone binary (current platform)
+bun dev:vite         # Vite only (localhost:3000)
-bun run compile:darwin   # Compile server for macOS (arm64 + x64)
+bun db:studio        # Drizzle Studio
-bun run compile:linux    # Compile server for Linux (x64 + arm64)
+
-bun run compile:windows  # Compile server for Windows x64
+# Build
-bun run dist             # Package desktop distributable (current platform)
+bun build            # Full build (Vite → compile → Tauri)
-bun run dist:linux       # Package desktop for Linux (x64 + arm64)
+bun build:vite       # Vite only (outputs to .output/)
-bun run dist:mac         # Package desktop for macOS (arm64 + x64)
+
-bun run dist:win         # Package desktop for Windows x64
+# Code Quality
-bun run fix              # Lint + format (Biome auto-fix)
+bun typecheck        # TypeScript check (tsc -b)
-bun run typecheck        # TypeScript check across monorepo
+bun fix              # Biome auto-fix (format + lint)
+
+# Database
+bun db:generate      # Generate migrations from schema
+bun db:migrate       # Run migrations
+bun db:push          # Push schema changes (dev only)
+
+# Testing (not configured yet)
+# When adding tests, use Vitest or Bun test runner:
+# bun test path/to/test.ts        # Single file
+# bun test -t "pattern"           # By test name
 ```
 
-### Server App (`apps/server`)
+## Code Style
-```bash
-bun run dev                   # Vite dev server (localhost:3000)
-bun run build                 # Production build -> .output/
-bun run compile               # Compile to standalone binary (current platform)
-bun run compile:darwin        # Compile for macOS (arm64 + x64)
-bun run compile:darwin:arm64  # Compile for macOS arm64
-bun run compile:darwin:x64    # Compile for macOS x64
-bun run compile:linux         # Compile for Linux (x64 + arm64)
-bun run compile:linux:arm64   # Compile for Linux arm64
-bun run compile:linux:x64     # Compile for Linux x64
-bun run compile:windows       # Compile for Windows (default: x64)
-bun run compile:windows:x64   # Compile for Windows x64
-bun run fix                   # Biome auto-fix
-bun run typecheck             # TypeScript check
 
-# Database (Drizzle)
+### Formatting (Biome enforced)
-bun run db:generate           # Generate migrations from schema
-bun run db:migrate            # Run migrations
-bun run db:push               # Push schema (dev only)
-bun run db:studio             # Open Drizzle Studio
-```
 
-### Desktop App (`apps/desktop`)
+- **Indent**: 2 spaces
-```bash
+- **Line endings**: LF
-bun run dev                   # electron-vite dev mode (requires server dev running)
+- **Quotes**: Single `'string'`
-bun run build                 # electron-vite build (main + preload)
+- **Semicolons**: As needed (ASI)
-bun run dist                  # Build + package for current platform
+- **Arrow parens**: Always `(x) => x`
-bun run dist:linux            # Build + package for Linux (x64 + arm64)
-bun run dist:linux:x64        # Build + package for Linux x64
-bun run dist:linux:arm64      # Build + package for Linux arm64
-bun run dist:mac              # Build + package for macOS (arm64 + x64)
-bun run dist:mac:arm64        # Build + package for macOS arm64
-bun run dist:mac:x64          # Build + package for macOS x64
-bun run dist:win              # Build + package for Windows x64
-bun run fix                   # Biome auto-fix
-bun run typecheck             # TypeScript check
-```
-
-### Testing
-No test framework configured yet. When adding tests:
-```bash
-bun test path/to/test.ts              # Run single test file
-bun test -t "pattern"                 # Run tests matching pattern
-```
-
-## Code Style (TypeScript)
-
-### Formatting (Biome)
-- **Indent**: 2 spaces | **Line endings**: LF
-- **Quotes**: Single `'` | **Semicolons**: Omit (ASI)
-- **Arrow parentheses**: Always `(x) => x`
 
 ### Imports
-Biome auto-organizes. Order: 1) External packages → 2) Internal `@/*` aliases → 3) Type imports (`import type { ... }`)
+
+Biome auto-organizes. Order: external → internal (`@/*`) → type-only imports.
 
 ```typescript
 import { createFileRoute } from '@tanstack/react-router'
 import { z } from 'zod'
-import { db } from '@/server/db'
+import { db } from '@/db'
 import type { ReactNode } from 'react'
 ```
 
-### TypeScript Strictness
+### TypeScript
-- `strict: true`, `noUncheckedIndexedAccess: true`, `noImplicitOverride: true`, `verbatimModuleSyntax: true`
-- Use `@/*` path aliases (maps to `src/*`)
 
-### Naming Conventions
+Strict mode with extra checks:
-| Type | Convention | Example |
+- `noUncheckedIndexedAccess: true` - array/object index returns `T | undefined`
-|------|------------|---------|
+- `noImplicitOverride: true`
-| Files (utils) | kebab-case | `auth-utils.ts` |
+- `verbatimModuleSyntax: true`
-| Files (components) | PascalCase | `UserProfile.tsx` |
+
-| Components | PascalCase arrow | `const Button = () => {}` |
+Path alias: `@/*` → `src/*`
-| Functions | camelCase | `getUserById` |
+
-| Constants | UPPER_SNAKE | `MAX_RETRIES` |
+### Naming
-| Types/Interfaces | PascalCase | `UserProfile` |
+
+| Entity | Convention | Example |
+|--------|------------|---------|
+| Files (utils) | kebab-case | `utils.ts`, `db-provider.ts` |
+| Files (components) | PascalCase | `NotFound.tsx` |
+| Routes | TanStack conventions | `routes/index.tsx`, `routes/__root.tsx` |
+| Components | PascalCase arrow functions | `const MyComponent = () => {}` |
+| Functions | camelCase | `handleSubmit` |
+| Constants | UPPER_SNAKE_CASE | `MAX_RETRIES` |
+| Types/Interfaces | PascalCase | `TodoItem`, `RouterContext` |
 
 ### React Patterns
-- Components: arrow functions (enforced by Biome)
-- Routes: TanStack Router file conventions (`export const Route = createFileRoute(...)`)
-- Data fetching: `useSuspenseQuery(orpc.feature.list.queryOptions())`
-- Let React Compiler handle memoization (no manual `useMemo`/`useCallback`)
-
-### Error Handling
-- Use `try-catch` for async operations; throw descriptive errors
-- ORPC: Use `ORPCError` with proper codes (`NOT_FOUND`, `INPUT_VALIDATION_FAILED`)
-- Never use empty catch blocks
-
-## Database (Drizzle ORM v1 beta + postgres-js)
-
-- **ORM**: Drizzle ORM `1.0.0-beta` (RQBv2)
-- **Driver**: `drizzle-orm/postgres-js` (NOT `bun-sql`)
-- **Validation**: `drizzle-orm/zod` (built-in, NOT separate `drizzle-zod` package)
-- **Relations**: Defined via `defineRelations()` in `src/server/db/relations.ts` (contains schema info, so `drizzle()` only needs `{ relations }`)
-- **Query style**: RQBv2 object syntax (`orderBy: { createdAt: 'desc' }`, `where: { id: 1 }`)
 
 ```typescript
-export const myTable = pgTable('my_table', {
+// Components: arrow functions (Biome enforces)
-  id: uuid().primaryKey().default(sql`uuidv7()`),
+const MyComponent = ({ title }: { title: string }) => {
-  name: text().notNull(),
+  return <div>{title}</div>
-  createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+}
-  updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow().$onUpdateFn(() => new Date()),
+
+// Routes: createFileRoute
+export const Route = createFileRoute('/')({
+  component: Home,
+  loader: async ({ context }) => {
+    await context.queryClient.ensureQueryData(orpc.todo.list.queryOptions())
+  },
+})
+
+// Data fetching: TanStack Query
+const query = useSuspenseQuery(orpc.todo.list.queryOptions())
+const mutation = useMutation(orpc.todo.create.mutationOptions())
+```
+
+### ORPC Pattern (Contract-First RPC)
+
+1. **Define contract** (`src/orpc/contracts/my-feature.ts`):
+```typescript
+import { oc } from '@orpc/contract'
+import { z } from 'zod'
+
+export const get = oc.input(z.object({ id: z.uuid() })).output(schema)
+export const create = oc.input(insertSchema).output(schema)
+```
+
+2. **Implement handler** (`src/orpc/handlers/my-feature.ts`):
+```typescript
+import { os } from '@/orpc/server'
+import { dbProvider } from '@/orpc/middlewares'
+
+export const get = os.myFeature.get
+  .use(dbProvider)
+  .handler(async ({ context, input }) => {
+    return await context.db.query.myTable.findFirst(...)
   })
 ```
 
-## Environment Variables
+3. **Register** in `contract.ts` and `router.ts`
+4. **Use** in components via `orpc.myFeature.get.queryOptions()`
 
-- Use `@t3-oss/env-core` with Zod validation in `src/env.ts`
+### Drizzle Schema
-- Server vars: no prefix | Client vars: `VITE_` prefix required
-- Never commit `.env` files
 
-## Dependency Management
+```typescript
+import { sql } from 'drizzle-orm'
+import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core'
 
-- All versions centralized in root `package.json` `catalog` field
+export const myTable = pgTable('my_table', {
-- Workspace packages use `"catalog:"` — never hardcode versions
+  id: uuid('id').primaryKey().default(sql`uuidv7()`),
-- Internal packages use `"workspace:*"` references
+  name: text('name').notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow().$onUpdateFn(() => new Date()),
+})
+```
 
-## Development Principles
+### Environment Variables
 
-> **These principles apply to ALL code changes. Agents MUST follow them on every task.**
+- Server: no prefix (e.g., `DATABASE_URL`)
-
+- Client: `VITE_` prefix required
-1. **No backward compatibility** — This project is in rapid iteration. Always use the latest API and patterns. Never keep deprecated code paths or old API fallbacks "just in case".
+- Validated via `@t3-oss/env-core` in `src/env.ts`
-2. **Always sync documentation** — When code changes, immediately update all related documentation (`AGENTS.md`, `README.md`, inline code examples). Code and docs must never drift apart. This includes updating code snippets in docs when imports, APIs, or patterns change.
-3. **Forward-only migration** — When upgrading dependencies, fully adopt the new API. Don't mix old and new patterns in the same codebase.
-
-## Critical Rules
-
-**DO:**
-- Run `bun run fix` before committing
-- Use `@/*` path aliases (not relative imports)
-- Include `createdAt`/`updatedAt` on all tables
-- Use `catalog:` for dependency versions
-- Update `AGENTS.md` and other docs whenever code patterns change
-
-**DON'T:**
-- Use `npm`, `npx`, `node`, `yarn`, `pnpm` — always use `bun` / `bunx`
-- Edit `src/routeTree.gen.ts` (auto-generated)
-- Use `as any`, `@ts-ignore`, `@ts-expect-error`
-- Commit `.env` files
-- Use empty catch blocks `catch(e) {}`
-- Hardcode dependency versions in workspace packages
-- Leave docs out of sync with code changes
-
-## Git Workflow
-
-1. Make changes following style guide
-2. `bun run fix` - auto-format and lint
-3. `bun run typecheck` - verify types
-4. `bun run dev` - test locally
-5. Commit with descriptive message
 
 ## Directory Structure
 
 ```
-.
+src/
-├── apps/
+├── components/          # Reusable React components
-│   ├── server/           # TanStack Start fullstack app
+├── db/
-│   │   ├── src/
+│   ├── schema/         # Drizzle schema definitions
-│   │   │   ├── client/   # ORPC client + TanStack Query utils
+│   └── index.ts        # Database instance
-│   │   │   ├── components/
+├── integrations/       # TanStack Query/Router setup
-│   │   │   ├── routes/   # File-based routing
+├── lib/                # Utility functions
-│   │   │   └── server/   # API layer + database
+├── orpc/
-│   │   │       ├── api/  # ORPC contracts, routers, middlewares
+│   ├── contracts/      # Input/output schemas
-│   │   │       └── db/   # Drizzle schema
+│   ├── handlers/       # Server procedure implementations
-│   │   └── AGENTS.md
+│   ├── middlewares/    # Middleware (e.g., dbProvider)
-│   └── desktop/          # Electron desktop shell
+│   ├── contract.ts     # Contract aggregation
-│       ├── src/
+│   ├── router.ts       # Router composition
-│       │   ├── main/
+│   └── client.ts       # Isomorphic client
-│       │   │   └── index.ts       # Main process entry
+├── routes/             # File-based routes
-│       │   └── preload/
+│   ├── __root.tsx      # Root layout
-│       │       └── index.ts       # Preload script
+│   └── api/rpc.$.ts    # ORPC HTTP endpoint
-│       ├── electron.vite.config.ts
+└── env.ts              # Environment validation
-│       ├── electron-builder.yml   # Packaging config
-│       └── AGENTS.md
-├── packages/
-│   └── tsconfig/         # Shared TS configs
-├── biome.json            # Linting/formatting config
-├── turbo.json            # Turbo task orchestration
-└── package.json          # Workspace root + dependency catalog
 ```
 
-## See Also
+## Critical Rules
 
-- `apps/server/AGENTS.md` - Detailed TanStack Start / ORPC patterns
+- **DO NOT** edit `src/routeTree.gen.ts` (auto-generated)
-- `apps/desktop/AGENTS.md` - Electron desktop development guide
+- **DO NOT** commit `.env` files
+- **MUST** run `bun fix` before commits
+- **MUST** use `@/*` path alias (not relative imports)
+- **MUST** use React Compiler (no manual memoization needed)
+- **MUST** use `Readonly<T>` for immutable props
+
+## Git Workflow
+
+1. Make changes following style guide
+2. Run `bun fix` (format + lint)
+3. Run `bun typecheck` (type safety)
+4. Test with `bun dev`
+5. Commit with descriptive message

apps/desktop/.gitignore

@@ -1,3 +0,0 @@
-# electron-vite build output
-out/
-dist/

apps/desktop/AGENTS.md

@@ -1,95 +0,0 @@
-# AGENTS.md - Desktop App Guidelines
-
-Thin Electron shell hosting the fullstack server app.
-
-## Tech Stack
-
-> **⚠️ This project uses Bun as the package manager. Runtime is Electron (Node.js). Always use `bun run <script>` (not `bun <script>`) to avoid conflicts with Bun built-in subcommands. Never use `npm`, `npx`, `yarn`, or `pnpm`.**
-
-- **Type**: Electron desktop shell
-- **Design**: Server-driven desktop (thin native window hosting web app)
-- **Runtime**: Electron (Main/Renderer) + Sidecar server binary (Bun-compiled)
-- **Build Tool**: electron-vite (Vite-based, handles main + preload builds)
-- **Packager**: electron-builder (installers, signing, auto-update)
-- **Orchestration**: Turborepo
-
-## Architecture
-
-- **Server-driven design**: The desktop app is a "thin" native shell. It does not contain UI or business logic; it opens a BrowserWindow pointing to the `apps/server` TanStack Start application.
-- **Dev mode**: Opens a BrowserWindow pointing to `localhost:3000`. Requires `apps/server` to be running separately (Turbo handles this).
-- **Production mode**: Spawns a compiled server binary (from `resources/`) as a sidecar process, waits for readiness, then loads its URL.
-
-## Commands
-
-```bash
-bun run dev                    # electron-vite dev (requires server dev running)
-bun run build                  # electron-vite build (main + preload)
-bun run dist                   # Build + package for current platform
-bun run dist:linux             # Build + package for Linux (x64 + arm64)
-bun run dist:linux:x64         # Build + package for Linux x64
-bun run dist:linux:arm64       # Build + package for Linux arm64
-bun run dist:mac               # Build + package for macOS (arm64 + x64)
-bun run dist:mac:arm64         # Build + package for macOS arm64
-bun run dist:mac:x64           # Build + package for macOS x64
-bun run dist:win               # Build + package for Windows x64
-bun run fix                    # Biome auto-fix
-bun run typecheck              # TypeScript check
-```
-
-## Directory Structure
-
-```
-.
-├── src/
-│   ├── main/
-│   │   └── index.ts       # Main process (server lifecycle + BrowserWindow)
-│   └── preload/
-│       └── index.ts       # Preload script (security isolation)
-├── resources/             # Sidecar binaries (gitignored, copied from server build)
-├── out/                   # electron-vite build output (gitignored)
-├── electron.vite.config.ts
-├── electron-builder.yml   # Packaging configuration
-├── package.json
-├── turbo.json
-└── AGENTS.md
-```
-
-## Development Workflow
-
-1. **Start server**: `bun run dev` in `apps/server` (or use root `bun run dev` via Turbo).
-2. **Start desktop**: `bun run dev` in `apps/desktop`.
-3. **Connection**: Main process polls `localhost:3000` until responsive, then opens BrowserWindow.
-
-## Production Build Workflow
-
-From monorepo root, run `bun run dist` to execute the full pipeline automatically (via Turbo task dependencies):
-
-1. **Build server**: `apps/server` → `vite build` → `.output/`
-2. **Compile server**: `apps/server` → `bun compile.ts --target ...` → `out/server-{os}-{arch}`
-3. **Package desktop**: `apps/desktop` → `electron-vite build` + `electron-builder` → distributable
-
-The `electron-builder.yml` `extraResources` config reads binaries directly from `../server/out/`, no manual copy needed.
-
-To build for a specific platform explicitly, use `bun run dist:linux` / `bun run dist:mac` / `bun run dist:win` in `apps/desktop`.
-For single-arch output, use `bun run dist:linux:x64`, `bun run dist:linux:arm64`, `bun run dist:mac:x64`, or `bun run dist:mac:arm64`.
-
-## Development Principles
-
-> **These principles apply to ALL code changes. Agents MUST follow them on every task.**
-
-1. **No backward compatibility** — This project is in rapid iteration. Always use the latest API and patterns. Never keep deprecated code paths or old API fallbacks.
-2. **Always sync documentation** — When code changes, immediately update all related documentation (`AGENTS.md`, `README.md`, inline code examples). Code and docs must never drift apart.
-3. **Forward-only migration** — When upgrading dependencies, fully adopt the new API. Don't mix old and new patterns.
-
-## Critical Rules
-
-**DO:**
-- Use arrow functions for all utility functions.
-- Keep the desktop app as a thin shell — no UI or business logic.
-- Use `catalog:` for all dependency versions in `package.json`.
-
-**DON'T:**
-- Use `npm`, `npx`, `yarn`, or `pnpm`. Use `bun` for package management.
-- Include UI components or business logic in the desktop app.
-- Use `as any` or `@ts-ignore`.
-- Leave docs out of sync with code changes.

apps/desktop/biome.json

@@ -1,9 +0,0 @@
-{
-  "$schema": "../../node_modules/@biomejs/biome/configuration_schema.json",
-  "extends": "//",
-  "css": {
-    "parser": {
-      "tailwindDirectives": true
-    }
-  }
-}

apps/desktop/electron-builder.yml

@@ -1,48 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/electron-userland/electron-builder/refs/heads/master/packages/app-builder-lib/scheme.json
-appId: com.furtherverse.desktop
-productName: Furtherverse
-executableName: furtherverse
-
-npmRebuild: false
-asarUnpack:
-  - resources/**
-
-files:
-  - "!**/.vscode/*"
-  - "!src/*"
-  - "!electron.vite.config.{js,ts,mjs,cjs}"
-  - "!{.env,.env.*,bun.lock}"
-  - "!{tsconfig.json,tsconfig.node.json}"
-  - "!{AGENTS.md,README.md,CHANGELOG.md}"
-
-# macOS
-mac:
-  target:
-    - dmg
-  category: public.app-category.productivity
-  extraResources:
-    - from: ../server/out/server-darwin-${arch}
-      to: server
-dmg:
-  artifactName: ${productName}-${version}-${os}-${arch}.${ext}
-
-# Windows
-win:
-  target:
-    - portable
-  extraResources:
-    - from: ../server/out/server-windows-${arch}.exe
-      to: server.exe
-portable:
-  artifactName: ${productName}-${version}-${os}-${arch}-Portable.${ext}
-
-# Linux
-linux:
-  target:
-    - AppImage
-  category: Utility
-  extraResources:
-    - from: ../server/out/server-linux-${arch}
-      to: server
-appImage:
-  artifactName: ${productName}-${version}-${os}-${arch}.${ext}

apps/desktop/electron.vite.config.ts

@@ -1,11 +0,0 @@
-import tailwindcss from '@tailwindcss/vite'
-import react from '@vitejs/plugin-react'
-import { defineConfig } from 'electron-vite'
-
-export default defineConfig({
-  main: {},
-  preload: {},
-  renderer: {
-    plugins: [react(), tailwindcss()],
-  },
-})

apps/desktop/package.json

@@ -1,37 +0,0 @@
-{
-  "name": "@furtherverse/desktop",
-  "version": "1.0.0",
-  "private": true,
-  "main": "out/main/index.js",
-  "scripts": {
-    "build": "electron-vite build",
-    "dev": "electron-vite dev --watch",
-    "dist": "electron-builder",
-    "dist:linux": "bun run dist:linux:x64 && bun run dist:linux:arm64",
-    "dist:linux:arm64": "electron-builder --linux --arm64",
-    "dist:linux:x64": "electron-builder --linux --x64",
-    "dist:mac": "bun run dist:mac:arm64 && bun run dist:mac:x64",
-    "dist:mac:arm64": "electron-builder --mac --arm64",
-    "dist:mac:x64": "electron-builder --mac --x64",
-    "dist:win": "electron-builder --win --x64",
-    "fix": "biome check --write",
-    "typecheck": "tsc -b"
-  },
-  "dependencies": {
-    "motion": "catalog:",
-    "react": "catalog:",
-    "react-dom": "catalog:",
-    "tree-kill": "catalog:"
-  },
-  "devDependencies": {
-    "@furtherverse/tsconfig": "workspace:*",
-    "@tailwindcss/vite": "catalog:",
-    "@types/node": "catalog:",
-    "@vitejs/plugin-react": "catalog:",
-    "electron": "catalog:",
-    "electron-builder": "catalog:",
-    "electron-vite": "catalog:",
-    "tailwindcss": "catalog:",
-    "vite": "catalog:"
-  }
-}

apps/desktop/src/main/index.ts

@@ -1,198 +0,0 @@
-import { join } from 'node:path'
-import { app, BrowserWindow, dialog, session, shell } from 'electron'
-import { createSidecarRuntime } from './sidecar'
-
-const DEV_SERVER_URL = 'http://localhost:3000'
-const SAFE_EXTERNAL_PROTOCOLS = new Set(['https:', 'http:', 'mailto:'])
-
-let mainWindow: BrowserWindow | null = null
-let windowCreationPromise: Promise<void> | null = null
-let isQuitting = false
-
-const showErrorAndQuit = (title: string, detail: string) => {
-  if (isQuitting) {
-    return
-  }
-
-  dialog.showErrorBox(title, detail)
-  app.quit()
-}
-
-const sidecar = createSidecarRuntime({
-  devServerUrl: DEV_SERVER_URL,
-  isPackaged: app.isPackaged,
-  resourcesPath: process.resourcesPath,
-  isQuitting: () => isQuitting,
-  onUnexpectedStop: (detail) => {
-    showErrorAndQuit('Service Stopped', detail)
-  },
-})
-
-const toErrorMessage = (error: unknown): string => (error instanceof Error ? error.message : String(error))
-
-const canOpenExternally = (url: string): boolean => {
-  try {
-    const parsed = new URL(url)
-    return SAFE_EXTERNAL_PROTOCOLS.has(parsed.protocol)
-  } catch {
-    return false
-  }
-}
-
-const loadSplash = async (windowRef: BrowserWindow) => {
-  if (process.env.ELECTRON_RENDERER_URL) {
-    await windowRef.loadURL(process.env.ELECTRON_RENDERER_URL)
-    return
-  }
-
-  await windowRef.loadFile(join(__dirname, '../renderer/index.html'))
-}
-
-const createWindow = async () => {
-  if (mainWindow && !mainWindow.isDestroyed()) {
-    mainWindow.focus()
-    return
-  }
-
-  const windowRef = new BrowserWindow({
-    width: 1200,
-    height: 800,
-    show: false,
-    webPreferences: {
-      preload: join(__dirname, '../preload/index.js'),
-      sandbox: true,
-      contextIsolation: true,
-      nodeIntegration: false,
-    },
-  })
-  mainWindow = windowRef
-
-  windowRef.webContents.setWindowOpenHandler(({ url }) => {
-    if (!canOpenExternally(url)) {
-      if (!app.isPackaged) {
-        console.warn(`Blocked external URL: ${url}`)
-      }
-
-      return { action: 'deny' }
-    }
-
-    void shell.openExternal(url)
-    return { action: 'deny' }
-  })
-
-  windowRef.webContents.on('will-navigate', (event, url) => {
-    const allowed = [DEV_SERVER_URL, sidecar.lastResolvedUrl].filter((v): v is string => v != null)
-    const isAllowed = allowed.some((origin) => url.startsWith(origin))
-
-    if (!isAllowed) {
-      event.preventDefault()
-
-      if (canOpenExternally(url)) {
-        void shell.openExternal(url)
-      } else if (!app.isPackaged) {
-        console.warn(`Blocked navigation to: ${url}`)
-      }
-    }
-  })
-
-  windowRef.on('closed', () => {
-    if (mainWindow === windowRef) {
-      mainWindow = null
-    }
-  })
-
-  try {
-    await loadSplash(windowRef)
-  } catch (error) {
-    if (mainWindow === windowRef) {
-      mainWindow = null
-    }
-
-    if (!windowRef.isDestroyed()) {
-      windowRef.destroy()
-    }
-
-    throw error
-  }
-
-  if (!windowRef.isDestroyed()) {
-    windowRef.show()
-  }
-
-  const targetUrl = await sidecar.resolveUrl()
-  if (isQuitting || windowRef.isDestroyed()) {
-    return
-  }
-
-  try {
-    await windowRef.loadURL(targetUrl)
-  } catch (error) {
-    if (mainWindow === windowRef) {
-      mainWindow = null
-    }
-
-    if (!windowRef.isDestroyed()) {
-      windowRef.destroy()
-    }
-
-    throw error
-  }
-}
-
-const ensureWindow = async () => {
-  if (windowCreationPromise) {
-    return windowCreationPromise
-  }
-
-  windowCreationPromise = createWindow().finally(() => {
-    windowCreationPromise = null
-  })
-
-  return windowCreationPromise
-}
-
-const beginQuit = () => {
-  isQuitting = true
-  sidecar.stop()
-}
-
-const handleWindowCreationError = (error: unknown, context: string) => {
-  console.error(`${context}:`, error)
-  showErrorAndQuit(
-    "App Couldn't Start",
-    app.isPackaged
-      ? 'A required component failed to start. Please reinstall the app.'
-      : `${context}: ${toErrorMessage(error)}`,
-  )
-}
-
-app
-  .whenReady()
-  .then(() => {
-    session.defaultSession.setPermissionRequestHandler((_webContents, _permission, callback) => {
-      callback(false)
-    })
-
-    return ensureWindow()
-  })
-  .catch((error) => {
-    handleWindowCreationError(error, 'Failed to create window')
-  })
-
-app.on('window-all-closed', () => {
-  if (process.platform !== 'darwin') {
-    app.quit()
-  }
-})
-
-app.on('activate', () => {
-  if (isQuitting || BrowserWindow.getAllWindows().length > 0) {
-    return
-  }
-
-  ensureWindow().catch((error) => {
-    handleWindowCreationError(error, 'Failed to re-create window')
-  })
-})
-
-app.on('before-quit', beginQuit)

apps/desktop/src/main/sidecar.ts

@@ -1,256 +0,0 @@
-import { type ChildProcess, spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import { createServer } from 'node:net'
-import { join } from 'node:path'
-import killProcessTree from 'tree-kill'
-
-const SERVER_HOST = '127.0.0.1'
-const SERVER_READY_TIMEOUT_MS = 10_000
-const SERVER_REQUEST_TIMEOUT_MS = 1_500
-const SERVER_POLL_INTERVAL_MS = 250
-const SERVER_PROBE_PATHS = ['/api/health', '/']
-
-type SidecarState = {
-  process: ChildProcess | null
-  startup: Promise<string> | null
-  url: string | null
-}
-
-type SidecarRuntimeOptions = {
-  devServerUrl: string
-  isPackaged: boolean
-  resourcesPath: string
-  isQuitting: () => boolean
-  onUnexpectedStop: (detail: string) => void
-}
-
-type SidecarRuntime = {
-  resolveUrl: () => Promise<string>
-  stop: () => void
-  lastResolvedUrl: string | null
-}
-
-const sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms))
-
-const isProcessAlive = (processToCheck: ChildProcess | null): processToCheck is ChildProcess => {
-  if (!processToCheck || !processToCheck.pid) {
-    return false
-  }
-
-  return processToCheck.exitCode === null && !processToCheck.killed
-}
-
-const getAvailablePort = (): Promise<number> =>
-  new Promise((resolve, reject) => {
-    const server = createServer()
-    server.listen(0, () => {
-      const addr = server.address()
-      if (!addr || typeof addr === 'string') {
-        server.close()
-        reject(new Error('Failed to resolve port'))
-        return
-      }
-
-      server.close(() => resolve(addr.port))
-    })
-    server.on('error', reject)
-  })
-
-const isServerReady = async (url: string): Promise<boolean> => {
-  for (const probePath of SERVER_PROBE_PATHS) {
-    try {
-      const probeUrl = new URL(probePath, `${url}/`)
-      const response = await fetch(probeUrl, {
-        method: 'GET',
-        cache: 'no-store',
-        signal: AbortSignal.timeout(SERVER_REQUEST_TIMEOUT_MS),
-      })
-
-      if (response.status < 500) {
-        if (probePath === '/api/health' && response.status === 404) {
-          continue
-        }
-
-        return true
-      }
-    } catch {
-      // Expected: probe request fails while server is still starting up
-    }
-  }
-
-  return false
-}
-
-const waitForServer = async (url: string, isQuitting: () => boolean, processRef?: ChildProcess): Promise<boolean> => {
-  const start = Date.now()
-  while (Date.now() - start < SERVER_READY_TIMEOUT_MS && !isQuitting()) {
-    if (processRef && processRef.exitCode !== null) {
-      return false
-    }
-
-    if (await isServerReady(url)) {
-      return true
-    }
-
-    await sleep(SERVER_POLL_INTERVAL_MS)
-  }
-
-  return false
-}
-
-const resolveBinaryPath = (resourcesPath: string): string => {
-  const binaryName = process.platform === 'win32' ? 'server.exe' : 'server'
-  return join(resourcesPath, binaryName)
-}
-
-const formatUnexpectedStopMessage = (
-  isPackaged: boolean,
-  code: number | null,
-  signal: NodeJS.Signals | null,
-): string => {
-  if (isPackaged) {
-    return 'The background service stopped unexpectedly. Please restart the app.'
-  }
-
-  return `Server process exited unexpectedly (code ${code ?? 'unknown'}, signal ${signal ?? 'none'}).`
-}
-
-export const createSidecarRuntime = (options: SidecarRuntimeOptions): SidecarRuntime => {
-  const state: SidecarState = {
-    process: null,
-    startup: null,
-    url: null,
-  }
-
-  const resetState = (processRef?: ChildProcess) => {
-    if (processRef && state.process !== processRef) {
-      return
-    }
-
-    state.process = null
-    state.url = null
-  }
-
-  const stop = () => {
-    const runningServer = state.process
-    resetState()
-
-    if (!runningServer?.pid || runningServer.exitCode !== null) {
-      return
-    }
-
-    killProcessTree(runningServer.pid, 'SIGTERM', (error?: Error) => {
-      if (error) {
-        console.error('Failed to stop server process:', error)
-      }
-    })
-  }
-
-  const attachLifecycleHandlers = (processRef: ChildProcess) => {
-    processRef.on('error', (error) => {
-      if (state.process !== processRef) {
-        return
-      }
-
-      const hadReadyServer = state.url !== null
-      resetState(processRef)
-
-      if (!options.isQuitting() && hadReadyServer) {
-        options.onUnexpectedStop('The background service crashed unexpectedly. Please restart the app.')
-        return
-      }
-
-      console.error('Failed to start server process:', error)
-    })
-
-    processRef.on('exit', (code, signal) => {
-      if (state.process !== processRef) {
-        return
-      }
-
-      const hadReadyServer = state.url !== null
-      resetState(processRef)
-
-      if (!options.isQuitting() && hadReadyServer) {
-        options.onUnexpectedStop(formatUnexpectedStopMessage(options.isPackaged, code, signal))
-      }
-    })
-  }
-
-  const startPackagedServer = async (): Promise<string> => {
-    if (state.url && isProcessAlive(state.process)) {
-      return state.url
-    }
-
-    if (state.startup) {
-      return state.startup
-    }
-
-    state.startup = (async () => {
-      const binaryPath = resolveBinaryPath(options.resourcesPath)
-      if (!existsSync(binaryPath)) {
-        throw new Error(`Sidecar server binary is missing: ${binaryPath}`)
-      }
-
-      if (options.isQuitting()) {
-        throw new Error('Application is shutting down.')
-      }
-
-      const port = await getAvailablePort()
-      const nextServerUrl = `http://${SERVER_HOST}:${port}`
-      const processRef = spawn(binaryPath, [], {
-        env: {
-          ...process.env,
-          HOST: SERVER_HOST,
-          PORT: String(port),
-        },
-        stdio: 'ignore',
-        windowsHide: true,
-      })
-
-      processRef.unref()
-      state.process = processRef
-      attachLifecycleHandlers(processRef)
-
-      const ready = await waitForServer(nextServerUrl, options.isQuitting, processRef)
-      if (ready && isProcessAlive(processRef)) {
-        state.url = nextServerUrl
-        return nextServerUrl
-      }
-
-      const failureReason =
-        processRef.exitCode !== null
-          ? `The service exited early (code ${processRef.exitCode}).`
-          : `The service did not respond at ${nextServerUrl} within 10 seconds.`
-
-      stop()
-      throw new Error(failureReason)
-    })().finally(() => {
-      state.startup = null
-    })
-
-    return state.startup
-  }
-
-  const resolveUrl = async (): Promise<string> => {
-    if (options.isPackaged) {
-      return startPackagedServer()
-    }
-
-    const ready = await waitForServer(options.devServerUrl, options.isQuitting)
-    if (!ready) {
-      throw new Error('Dev server not responding. Run `bun dev` in apps/server first.')
-    }
-
-    state.url = options.devServerUrl
-    return options.devServerUrl
-  }
-
-  return {
-    resolveUrl,
-    stop,
-    get lastResolvedUrl() {
-      return state.url
-    },
-  }
-}

apps/desktop/src/preload/index.ts

@@ -1 +0,0 @@
-export {}

apps/desktop/src/renderer/components/SplashApp.tsx

@@ -1,33 +0,0 @@
-import { motion } from 'motion/react'
-import logoImage from '../assets/logo.png'
-
-export const SplashApp = () => {
-  return (
-    <main className="m-0 flex h-screen w-screen cursor-default select-none items-center justify-center overflow-hidden bg-white font-sans antialiased">
-      <motion.section
-        animate={{ opacity: 1, y: 0 }}
-        className="flex flex-col items-center gap-8"
-        initial={{ opacity: 0, y: 4 }}
-        transition={{
-          duration: 1,
-          ease: [0.16, 1, 0.3, 1],
-        }}
-      >
-        <img alt="Logo" className="h-20 w-auto object-contain" draggable={false} src={logoImage} />
-
-        <div className="relative h-[4px] w-36 overflow-hidden rounded-full bg-zinc-100">
-          <motion.div
-            animate={{ x: '100%' }}
-            className="h-full w-full bg-zinc-800"
-            initial={{ x: '-100%' }}
-            transition={{
-              duration: 2,
-              ease: [0.4, 0, 0.2, 1],
-              repeat: Infinity,
-            }}
-          />
-        </div>
-      </motion.section>
-    </main>
-  )
-}

apps/desktop/src/renderer/index.html

@@ -1,12 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Furtherverse</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="./main.tsx"></script>
-  </body>
-</html>

apps/desktop/src/renderer/main.tsx

@@ -1,11 +0,0 @@
-import { StrictMode } from 'react'
-import { createRoot } from 'react-dom/client'
-import { SplashApp } from './components/SplashApp'
-import './styles.css'
-
-// biome-ignore lint/style/noNonNullAssertion: 一定存在
-createRoot(document.getElementById('root')!).render(
-  <StrictMode>
-    <SplashApp />
-  </StrictMode>,
-)

apps/desktop/tsconfig.app.json

@@ -1,8 +0,0 @@
-{
-  "extends": "@furtherverse/tsconfig/react.json",
-  "compilerOptions": {
-    "composite": true,
-    "types": ["vite/client"]
-  },
-  "include": ["src/renderer/**/*"]
-}

apps/desktop/tsconfig.json

@@ -1,11 +0,0 @@
-{
-  "files": [],
-  "references": [
-    {
-      "path": "./tsconfig.app.json"
-    },
-    {
-      "path": "./tsconfig.node.json"
-    }
-  ]
-}

apps/desktop/tsconfig.node.json

@@ -1,8 +0,0 @@
-{
-  "extends": "@furtherverse/tsconfig/base.json",
-  "compilerOptions": {
-    "composite": true,
-    "types": ["node"]
-  },
-  "include": ["src/main/**/*", "src/preload/**/*", "electron.vite.config.ts"]
-}

apps/desktop/turbo.json

@@ -1,41 +0,0 @@
-{
-  "$schema": "../../node_modules/turbo/schema.json",
-  "extends": ["//"],
-  "tasks": {
-    "build": {
-      "outputs": ["out/**"]
-    },
-    "dist": {
-      "dependsOn": ["build", "@furtherverse/server#compile"],
-      "outputs": ["dist/**"]
-    },
-    "dist:linux": {
-      "dependsOn": ["build", "@furtherverse/server#compile:linux:arm64", "@furtherverse/server#compile:linux:x64"],
-      "outputs": ["dist/**"]
-    },
-    "dist:linux:arm64": {
-      "dependsOn": ["build", "@furtherverse/server#compile:linux:arm64"],
-      "outputs": ["dist/**"]
-    },
-    "dist:linux:x64": {
-      "dependsOn": ["build", "@furtherverse/server#compile:linux:x64"],
-      "outputs": ["dist/**"]
-    },
-    "dist:mac": {
-      "dependsOn": ["build", "@furtherverse/server#compile:darwin:arm64", "@furtherverse/server#compile:darwin:x64"],
-      "outputs": ["dist/**"]
-    },
-    "dist:mac:arm64": {
-      "dependsOn": ["build", "@furtherverse/server#compile:darwin:arm64"],
-      "outputs": ["dist/**"]
-    },
-    "dist:mac:x64": {
-      "dependsOn": ["build", "@furtherverse/server#compile:darwin:x64"],
-      "outputs": ["dist/**"]
-    },
-    "dist:win": {
-      "dependsOn": ["build", "@furtherverse/server#compile:windows:x64"],
-      "outputs": ["dist/**"]
-    }
-  }
-}

apps/server/.env.example

@@ -1 +0,0 @@
-DATABASE_PATH=data.db

apps/server/AGENTS.md

@@ -1,279 +0,0 @@
-# AGENTS.md - Server App Guidelines
-
-TanStack Start fullstack web app with ORPC (contract-first RPC).
-
-## Tech Stack
-
-> **⚠️ This project uses Bun — NOT Node.js / npm. All commands use `bun`. Always use `bun run <script>` (not `bun <script>`) to avoid conflicts with Bun built-in subcommands. Never use `npm`, `npx`, or `node`.**
-
-- **Framework**: TanStack Start (React 19 SSR, file-based routing)
-- **Runtime**: Bun — **NOT Node.js**
-- **Package Manager**: Bun — **NOT npm / yarn / pnpm**
-- **Language**: TypeScript (strict mode)
-- **Styling**: Tailwind CSS v4
-- **Database**: PostgreSQL + Drizzle ORM v1 beta (`drizzle-orm/postgres-js`, RQBv2)
-- **State**: TanStack Query v5
-- **RPC**: ORPC (contract-first, type-safe)
-- **Build**: Vite + Nitro
-
-## Commands
-
-```bash
-# Development
-bun run dev                    # Vite dev server (localhost:3000)
-bun run db:studio              # Drizzle Studio GUI
-
-# Build
-bun run build                  # Production build → .output/
-bun run compile                # Compile to standalone binary (current platform, depends on build)
-bun run compile:darwin         # Compile for macOS (arm64 + x64)
-bun run compile:darwin:arm64   # Compile for macOS arm64
-bun run compile:darwin:x64     # Compile for macOS x64
-bun run compile:linux          # Compile for Linux (x64 + arm64)
-bun run compile:linux:arm64    # Compile for Linux arm64
-bun run compile:linux:x64      # Compile for Linux x64
-bun run compile:windows        # Compile for Windows (default: x64)
-bun run compile:windows:x64    # Compile for Windows x64
-
-# Code Quality
-bun run fix                    # Biome auto-fix
-bun run typecheck              # TypeScript check
-
-# Database
-bun run db:generate            # Generate migrations from schema
-bun run db:migrate             # Run migrations
-bun run db:push                # Push schema directly (dev only)
-
-# Testing (not yet configured)
-bun test path/to/test.ts       # Run single test
-bun test -t "pattern"          # Run tests matching pattern
-```
-
-## Directory Structure
-
-```
-src/
-├── client/                # Client-side code
-│   └── orpc.ts            # ORPC client + TanStack Query utils (single entry point)
-├── components/            # React components
-├── routes/                # TanStack Router file routes
-│   ├── __root.tsx         # Root layout
-│   ├── index.tsx          # Home page
-│   └── api/
-│       ├── $.ts           # OpenAPI handler + Scalar docs
-│       ├── health.ts      # Health check endpoint
-│       └── rpc.$.ts       # ORPC RPC handler
-├── server/                # Server-side code
-│   ├── api/               # ORPC layer
-│   │   ├── contracts/     # Input/output schemas (Zod)
-│   │   ├── middlewares/   # Middleware (db provider, auth)
-│   │   ├── routers/       # Handler implementations
-│   │   ├── interceptors.ts # Shared error interceptors
-│   │   ├── context.ts     # Request context
-│   │   ├── server.ts      # ORPC server instance
-│   │   └── types.ts       # Type exports
-│   └── db/
-│       ├── schema/        # Drizzle table definitions
-│       ├── fields.ts      # Shared field builders (id, createdAt, updatedAt)
-│       ├── relations.ts   # Drizzle relations (defineRelations, RQBv2)
-│       └── index.ts       # Database instance (postgres-js driver)
-├── env.ts                 # Environment variable validation
-├── router.tsx             # Router configuration
-├── routeTree.gen.ts       # Auto-generated (DO NOT EDIT)
-└── styles.css             # Tailwind entry
-```
-
-## ORPC Pattern
-
-### 1. Define Contract (`src/server/api/contracts/feature.contract.ts`)
-```typescript
-import { oc } from '@orpc/contract'
-import { createSelectSchema } from 'drizzle-orm/zod'
-import { z } from 'zod'
-import { featureTable } from '@/server/db/schema'
-
-const selectSchema = createSelectSchema(featureTable)
-
-export const list = oc.input(z.void()).output(z.array(selectSchema))
-export const create = oc.input(insertSchema).output(selectSchema)
-```
-
-### 2. Implement Router (`src/server/api/routers/feature.router.ts`)
-```typescript
-import { ORPCError } from '@orpc/server'
-import { db } from '../middlewares'
-import { os } from '../server'
-
-export const list = os.feature.list.use(db).handler(async ({ context }) => {
-  return await context.db.query.featureTable.findMany({
-    orderBy: { createdAt: 'desc' },
-  })
-})
-```
-
-### 3. Register in Index Files
-```typescript
-// src/server/api/contracts/index.ts
-import * as feature from './feature.contract'
-export const contract = { feature }
-
-// src/server/api/routers/index.ts
-import * as feature from './feature.router'
-export const router = os.router({ feature })
-```
-
-### 4. Use in Components
-```typescript
-import { useSuspenseQuery, useMutation } from '@tanstack/react-query'
-import { orpc } from '@/client/orpc'
-
-const { data } = useSuspenseQuery(orpc.feature.list.queryOptions())
-const mutation = useMutation(orpc.feature.create.mutationOptions())
-```
-
-## Database (Drizzle ORM v1 beta)
-
-- **Driver**: `drizzle-orm/postgres-js` (NOT `bun-sql`)
-- **Validation**: `drizzle-orm/zod` (built-in, NOT separate `drizzle-zod` package)
-- **Relations**: Defined via `defineRelations()` in `src/server/db/relations.ts`
-- **Query**: RQBv2 — use `db.query.tableName.findMany()` with object-style `orderBy` and `where`
-
-### Schema Definition
-```typescript
-import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core'
-import { sql } from 'drizzle-orm'
-
-export const myTable = pgTable('my_table', {
-  id: uuid().primaryKey().default(sql`uuidv7()`),
-  name: text().notNull(),
-  createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
-  updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow().$onUpdateFn(() => new Date()),
-})
-```
-
-### Relations (RQBv2)
-```typescript
-// src/server/db/relations.ts
-import { defineRelations } from 'drizzle-orm'
-import * as schema from './schema'
-
-export const relations = defineRelations(schema, (r) => ({
-  // Define relations here using r.one / r.many / r.through
-}))
-```
-
-### DB Instance
-```typescript
-// src/server/db/index.ts
-import { drizzle } from 'drizzle-orm/postgres-js'
-import { relations } from '@/server/db/relations'
-// In RQBv2, relations already contain schema info — no separate schema import needed
-
-const db = drizzle({
-  connection: env.DATABASE_URL,
-  relations,
-})
-```
-
-### RQBv2 Query Examples
-```typescript
-// Object-style orderBy (NOT callback style)
-const todos = await db.query.todoTable.findMany({
-  orderBy: { createdAt: 'desc' },
-})
-
-// Object-style where
-const todo = await db.query.todoTable.findFirst({
-  where: { id: someId },
-})
-```
-
-## Code Style
-
-### Formatting (Biome)
-- **Indent**: 2 spaces
-- **Quotes**: Single `'`
-- **Semicolons**: Omit (ASI)
-- **Arrow parens**: Always `(x) => x`
-
-### Imports
-Biome auto-organizes:
-1. External packages
-2. Internal `@/*` aliases
-3. Type imports (`import type { ... }`)
-
-```typescript
-import { createFileRoute } from '@tanstack/react-router'
-import { z } from 'zod'
-import { db } from '@/server/db'
-import type { ReactNode } from 'react'
-```
-
-### TypeScript
-- `strict: true`
-- `noUncheckedIndexedAccess: true` - array access returns `T | undefined`
-- Use `@/*` path aliases (maps to `src/*`)
-
-### Naming
-| Type | Convention | Example |
-|------|------------|---------|
-| Files (utils) | kebab-case | `auth-utils.ts` |
-| Files (components) | PascalCase | `UserProfile.tsx` |
-| Components | PascalCase arrow | `const Button = () => {}` |
-| Functions | camelCase | `getUserById` |
-| Types | PascalCase | `UserProfile` |
-
-### React
-- Use arrow functions for components (Biome enforced)
-- Use `useSuspenseQuery` for guaranteed data
-- Let React Compiler handle memoization (no manual `useMemo`/`useCallback`)
-
-## Environment Variables
-
-```typescript
-// src/env.ts - using @t3-oss/env-core
-import { createEnv } from '@t3-oss/env-core'
-import { z } from 'zod'
-
-export const env = createEnv({
-  server: {
-    DATABASE_URL: z.string().url(),
-  },
-  clientPrefix: 'VITE_',
-  client: {
-    VITE_API_URL: z.string().optional(),
-  },
-})
-```
-
-## Development Principles
-
-> **These principles apply to ALL code changes. Agents MUST follow them on every task.**
-
-1. **No backward compatibility** — This project is in rapid iteration. Always use the latest API and patterns. Never keep deprecated code paths or old API fallbacks.
-2. **Always sync documentation** — When code changes, immediately update all related documentation (`AGENTS.md`, `README.md`, inline code examples). Code and docs must never drift apart.
-3. **Forward-only migration** — When upgrading dependencies, fully adopt the new API. Don't mix old and new patterns.
-
-## Critical Rules
-
-**DO:**
-- Run `bun run fix` before committing
-- Use `@/*` path aliases
-- Include `createdAt`/`updatedAt` on all tables
-- Use `ORPCError` with proper codes
-- Use `drizzle-orm/zod` (NOT `drizzle-zod`) for schema validation
-- Use RQBv2 object syntax for `orderBy` and `where`
-- Update `AGENTS.md` and other docs whenever code patterns change
-
-**DON'T:**
-- Use `npm`, `npx`, `node`, `yarn`, `pnpm` — always use `bun` / `bunx`
-- Edit `src/routeTree.gen.ts` (auto-generated)
-- Use `as any`, `@ts-ignore`, `@ts-expect-error`
-- Commit `.env` files
-- Use empty catch blocks
-- Import from `drizzle-zod` (use `drizzle-orm/zod` instead)
-- Use RQBv1 callback-style `orderBy` / old `relations()` API
-- Use `drizzle-orm/bun-sql` driver (use `drizzle-orm/postgres-js`)
-- Pass `schema` to `drizzle()` constructor (only `relations` is needed in RQBv2)
-- Import `os` from `@orpc/server` in middleware — use `@/server/api/server` (the local typed instance)
-- Leave docs out of sync with code changes

apps/server/biome.json

@@ -1,12 +0,0 @@
-{
-  "$schema": "../../node_modules/@biomejs/biome/configuration_schema.json",
-  "extends": "//",
-  "files": {
-    "includes": ["**", "!**/routeTree.gen.ts"]
-  },
-  "css": {
-    "parser": {
-      "tailwindDirectives": true
-    }
-  }
-}

apps/server/compile.ts

@@ -1,64 +0,0 @@
-import { mkdir, rm } from 'node:fs/promises'
-import { parseArgs } from 'node:util'
-
-const ENTRYPOINT = '.output/server/index.mjs'
-const OUTDIR = 'out'
-
-const SUPPORTED_TARGETS: readonly Bun.Build.CompileTarget[] = [
-  'bun-windows-x64',
-  'bun-darwin-arm64',
-  'bun-darwin-x64',
-  'bun-linux-x64',
-  'bun-linux-arm64',
-]
-
-const isSupportedTarget = (value: string): value is Bun.Build.CompileTarget =>
-  (SUPPORTED_TARGETS as readonly string[]).includes(value)
-
-const { values } = parseArgs({
-  options: { target: { type: 'string' } },
-  strict: true,
-  allowPositionals: false,
-})
-
-const resolveTarget = (): Bun.Build.CompileTarget => {
-  if (values.target !== undefined) {
-    if (!isSupportedTarget(values.target)) {
-      throw new Error(`Invalid target: ${values.target}\nAllowed: ${SUPPORTED_TARGETS.join(', ')}`)
-    }
-    return values.target
-  }
-
-  const os = process.platform === 'win32' ? 'windows' : process.platform
-  const candidate = `bun-${os}-${process.arch}`
-  if (!isSupportedTarget(candidate)) {
-    throw new Error(`Unsupported host: ${process.platform}-${process.arch}`)
-  }
-  return candidate
-}
-
-const main = async () => {
-  const target = resolveTarget()
-  const suffix = target.replace('bun-', '')
-  const outfile = `server-${suffix}`
-
-  await mkdir(OUTDIR, { recursive: true })
-  await Promise.all([rm(`${OUTDIR}/${outfile}`, { force: true }), rm(`${OUTDIR}/${outfile}.exe`, { force: true })])
-
-  const result = await Bun.build({
-    entrypoints: [ENTRYPOINT],
-    outdir: OUTDIR,
-    compile: { outfile, target },
-  })
-
-  if (!result.success) {
-    throw new Error(result.logs.map(String).join('\n'))
-  }
-
-  console.log(`✓ ${target} → ${OUTDIR}/${outfile}`)
-}
-
-main().catch((err) => {
-  console.error('❌', err instanceof Error ? err.message : err)
-  process.exit(1)
-})

apps/server/drizzle.config.ts

@@ -1,12 +0,0 @@
-import { defineConfig } from 'drizzle-kit'
-
-const databasePath = process.env.DATABASE_PATH ?? 'data.db'
-
-export default defineConfig({
-  out: './drizzle',
-  schema: './src/server/db/schema/index.ts',
-  dialect: 'sqlite',
-  dbCredentials: {
-    url: databasePath,
-  },
-})

apps/server/package.json

@@ -1,62 +0,0 @@
-{
-  "name": "@furtherverse/server",
-  "version": "1.0.0",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "build": "bunx --bun vite build",
-    "compile": "bun compile.ts",
-    "compile:darwin": "bun run compile:darwin:arm64 && bun run compile:darwin:x64",
-    "compile:darwin:arm64": "bun compile.ts --target bun-darwin-arm64",
-    "compile:darwin:x64": "bun compile.ts --target bun-darwin-x64",
-    "compile:linux": "bun run compile:linux:x64 && bun run compile:linux:arm64",
-    "compile:linux:arm64": "bun compile.ts --target bun-linux-arm64",
-    "compile:linux:x64": "bun compile.ts --target bun-linux-x64",
-    "compile:windows": "bun run compile:windows:x64",
-    "compile:windows:x64": "bun compile.ts --target bun-windows-x64",
-    "db:generate": "bun --bun drizzle-kit generate",
-    "db:migrate": "bun --bun drizzle-kit migrate",
-    "db:push": "bun --bun drizzle-kit push",
-    "db:studio": "bun --bun drizzle-kit studio",
-    "dev": "bunx --bun vite dev",
-    "fix": "biome check --write",
-    "typecheck": "tsc --noEmit"
-  },
-  "dependencies": {
-    "@furtherverse/crypto": "workspace:*",
-    "@orpc/client": "catalog:",
-    "@orpc/contract": "catalog:",
-    "@orpc/openapi": "catalog:",
-    "@orpc/server": "catalog:",
-    "@orpc/tanstack-query": "catalog:",
-    "@orpc/zod": "catalog:",
-    "@t3-oss/env-core": "catalog:",
-    "@tanstack/react-query": "catalog:",
-    "@tanstack/react-router": "catalog:",
-    "@tanstack/react-router-ssr-query": "catalog:",
-    "@tanstack/react-start": "catalog:",
-    "drizzle-orm": "catalog:",
-    "jszip": "catalog:",
-    "react": "catalog:",
-    "react-dom": "catalog:",
-    "systeminformation": "catalog:",
-    "uuid": "catalog:",
-    "zod": "catalog:"
-  },
-  "devDependencies": {
-    "@furtherverse/tsconfig": "workspace:*",
-    "@tailwindcss/vite": "catalog:",
-    "@tanstack/devtools-vite": "catalog:",
-    "@tanstack/react-devtools": "catalog:",
-    "@tanstack/react-query-devtools": "catalog:",
-    "@tanstack/react-router-devtools": "catalog:",
-    "@types/bun": "catalog:",
-    "@vitejs/plugin-react": "catalog:",
-    "babel-plugin-react-compiler": "catalog:",
-    "drizzle-kit": "catalog:",
-    "nitro": "catalog:",
-    "tailwindcss": "catalog:",
-    "vite": "catalog:",
-    "vite-tsconfig-paths": "catalog:"
-  }
-}

apps/server/src/client/orpc.ts

@@ -1,27 +0,0 @@
-import { createORPCClient } from '@orpc/client'
-import { RPCLink } from '@orpc/client/fetch'
-import { createRouterClient } from '@orpc/server'
-import { createTanstackQueryUtils } from '@orpc/tanstack-query'
-import { createIsomorphicFn } from '@tanstack/react-start'
-import { getRequestHeaders } from '@tanstack/react-start/server'
-import { router } from '@/server/api/routers'
-import type { RouterClient } from '@/server/api/types'
-
-const getORPCClient = createIsomorphicFn()
-  .server(() =>
-    createRouterClient(router, {
-      context: () => ({
-        headers: getRequestHeaders(),
-      }),
-    }),
-  )
-  .client(() => {
-    const link = new RPCLink({
-      url: `${window.location.origin}/api/rpc`,
-    })
-    return createORPCClient<RouterClient>(link)
-  })
-
-const client: RouterClient = getORPCClient()
-
-export const orpc = createTanstackQueryUtils(client)

apps/server/src/routes/api/$.ts

@@ -1,45 +0,0 @@
-import { OpenAPIHandler } from '@orpc/openapi/fetch'
-import { OpenAPIReferencePlugin } from '@orpc/openapi/plugins'
-import { onError } from '@orpc/server'
-import { ZodToJsonSchemaConverter } from '@orpc/zod/zod4'
-import { createFileRoute } from '@tanstack/react-router'
-import { name, version } from '@/../package.json'
-import { handleValidationError, logError } from '@/server/api/interceptors'
-import { router } from '@/server/api/routers'
-
-const handler = new OpenAPIHandler(router, {
-  plugins: [
-    new OpenAPIReferencePlugin({
-      docsProvider: 'scalar',
-      schemaConverters: [new ZodToJsonSchemaConverter()],
-      specGenerateOptions: {
-        info: {
-          title: name,
-          version,
-          description: 'UX 授权服务 OpenAPI 文档：设备授权、任务解密、摘要加密与报告签名打包接口。',
-        },
-      },
-      docsPath: '/docs',
-      specPath: '/spec.json',
-    }),
-  ],
-  interceptors: [onError(logError)],
-  clientInterceptors: [onError(handleValidationError)],
-})
-
-export const Route = createFileRoute('/api/$')({
-  server: {
-    handlers: {
-      ANY: async ({ request }) => {
-        const { response } = await handler.handle(request, {
-          prefix: '/api',
-          context: {
-            headers: request.headers,
-          },
-        })
-
-        return response ?? new Response('Not Found', { status: 404 })
-      },
-    },
-  },
-})

apps/server/src/routes/api/health.ts

@@ -1,27 +0,0 @@
-import { createFileRoute } from '@tanstack/react-router'
-import { name, version } from '@/../package.json'
-
-const createHealthResponse = (): Response =>
-  Response.json(
-    {
-      status: 'ok',
-      service: name,
-      version,
-      timestamp: new Date().toISOString(),
-    },
-    {
-      status: 200,
-      headers: {
-        'cache-control': 'no-store',
-      },
-    },
-  )
-
-export const Route = createFileRoute('/api/health')({
-  server: {
-    handlers: {
-      GET: async () => createHealthResponse(),
-      HEAD: async () => new Response(null, { status: 200 }),
-    },
-  },
-})

apps/server/src/routes/api/rpc.$.ts

@@ -1,27 +0,0 @@
-import { onError } from '@orpc/server'
-import { RPCHandler } from '@orpc/server/fetch'
-import { createFileRoute } from '@tanstack/react-router'
-import { handleValidationError, logError } from '@/server/api/interceptors'
-import { router } from '@/server/api/routers'
-
-const handler = new RPCHandler(router, {
-  interceptors: [onError(logError)],
-  clientInterceptors: [onError(handleValidationError)],
-})
-
-export const Route = createFileRoute('/api/rpc/$')({
-  server: {
-    handlers: {
-      ANY: async ({ request }) => {
-        const { response } = await handler.handle(request, {
-          prefix: '/api/rpc',
-          context: {
-            headers: request.headers,
-          },
-        })
-
-        return response ?? new Response('Not Found', { status: 404 })
-      },
-    },
-  },
-})

apps/server/src/routes/index.tsx

@@ -1,21 +0,0 @@
-import { createFileRoute } from '@tanstack/react-router'
-
-export const Route = createFileRoute('/')({
-  component: Home,
-})
-
-function Home() {
-  return (
-    <div className="min-h-screen bg-slate-50 flex items-center justify-center font-sans">
-      <div className="text-center space-y-4">
-        <h1 className="text-3xl font-bold text-slate-900 tracking-tight">UX Server</h1>
-        <p className="text-slate-500">
-          API:&nbsp;
-          <a href="/api" className="text-indigo-600 hover:text-indigo-700 underline">
-            /api
-          </a>
-        </p>
-      </div>
-    </div>
-  )
-}

apps/server/src/server/api/context.ts

@@ -1,25 +0,0 @@
-import type { DB } from '@/server/db'
-
-/**
- * 基础 Context - 所有请求都包含的上下文
- */
-export interface BaseContext {
-  headers: Headers
-}
-
-/**
- * 数据库 Context - 通过 db middleware 扩展
- */
-export interface DBContext extends BaseContext {
-  db: DB
-}
-
-/**
- * 认证 Context - 通过 auth middleware 扩展（未来使用）
- *
- * @example
- * export interface AuthContext extends DBContext {
- *   userId: string
- *   user: User
- * }
- */

apps/server/src/server/api/contracts/config.contract.ts

@@ -1,82 +0,0 @@
-import { oc } from '@orpc/contract'
-import { z } from 'zod'
-
-const configOutput = z
-  .object({
-    licence: z.string().nullable().describe('当前本地 licence，未设置时为 null'),
-    fingerprint: z.string().describe('UX 本机计算得到的设备特征码（SHA-256）'),
-    hasPgpPrivateKey: z.boolean().describe('是否已配置 OpenPGP 私钥'),
-  })
-  .meta({
-    examples: [
-      {
-        licence: 'LIC-8F2A-XXXX',
-        fingerprint: '9a3b7c1d2e4f5a6b8c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b',
-        hasPgpPrivateKey: true,
-      },
-      {
-        licence: null,
-        fingerprint: '9a3b7c1d2e4f5a6b8c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b',
-        hasPgpPrivateKey: false,
-      },
-    ],
-  })
-
-export const get = oc
-  .route({
-    method: 'POST',
-    path: '/config/get',
-    operationId: 'configGet',
-    summary: '读取本机身份配置',
-    description:
-      '返回 UX 本地持久化的 licence、本机设备特征码（fingerprint）以及 OpenPGP 私钥配置状态。工具箱端可据此判断是否已完成本地身份初始化。',
-    tags: ['Config'],
-  })
-  .input(z.object({}))
-  .output(configOutput)
-
-export const setLicence = oc
-  .route({
-    method: 'POST',
-    path: '/config/set-licence',
-    operationId: 'configSetLicence',
-    summary: '写入本地 licence',
-    description:
-      '写入或更新本机持久化的 licence。设备特征码（fingerprint）始终由 UX 本机自动计算，无需外部传入。此接口应在设备授权流程前调用。',
-    tags: ['Config'],
-  })
-  .input(
-    z
-      .object({
-        licence: z.string().min(1).describe('本地持久化的 licence'),
-      })
-      .meta({
-        examples: [{ licence: 'LIC-8F2A-XXXX' }],
-      }),
-  )
-  .output(configOutput)
-
-export const setPgpPrivateKey = oc
-  .route({
-    method: 'POST',
-    path: '/config/set-pgp-private-key',
-    operationId: 'configSetPgpPrivateKey',
-    summary: '写入本地 OpenPGP 私钥',
-    description:
-      '写入或更新本机持久化的 OpenPGP 私钥（ASCII armored 格式），用于报告签名。私钥与设备绑定，调用报告签名接口时 UX 自动读取，无需每次传入。',
-    tags: ['Config'],
-  })
-  .input(
-    z
-      .object({
-        pgpPrivateKey: z.string().min(1).describe('OpenPGP 私钥（ASCII armored 格式）'),
-      })
-      .meta({
-        examples: [
-          {
-            pgpPrivateKey: '-----BEGIN PGP PRIVATE KEY BLOCK-----\n\nxcMGBGd...\n-----END PGP PRIVATE KEY BLOCK-----',
-          },
-        ],
-      }),
-  )
-  .output(configOutput)

apps/server/src/server/api/contracts/crypto.contract.ts

@@ -1,150 +0,0 @@
-import { oc } from '@orpc/contract'
-import { z } from 'zod'
-
-export const encryptDeviceInfo = oc
-  .route({
-    method: 'POST',
-    path: '/crypto/encrypt-device-info',
-    operationId: 'encryptDeviceInfo',
-    summary: '生成设备授权二维码密文',
-    description:
-      '将本机 licence 与 fingerprint 组装为 JSON，使用平台 RSA 公钥（RSA-OAEP + SHA-256）加密后返回 Base64 密文，供工具箱生成设备授权二维码。参见《工具箱端 - 设备授权二维码生成指南》。',
-    tags: ['Crypto'],
-  })
-  .input(
-    z
-      .object({
-        platformPublicKey: z.string().min(1).describe('平台公钥（Base64，SPKI DER）'),
-      })
-      .meta({
-        examples: [
-          {
-            platformPublicKey:
-              'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzDlZvMDVaL+fjl05Hi182JOAUAaN4gh9rOF+1NhKfO4J6e0HLy8lBuylp3A4xoTiyUejNm22h0dqAgDSPnY/xZR76POFTD1soHr2LaFCN8JAbQ96P8gE7wC9qpoTssVvIVRH7QbVd260J6eD0Szwcx9cg591RSN69pMpe5IVRi8T99Hhql6/wnZHORPr18eESLOY93jRskLzc0q18r68RRoTJiQf+9YC8ub5iKp7rCjVnPi1UbIYmXmL08tk5mksYA0NqWQAa1ofKxx/9tQtB9uTjhTxuTu94XU9jlGU87qaHZs+kpqa8CAbYYJFbSP1xHwoZzpU2jpw2aF22HBYxwIDAQAB',
-          },
-        ],
-      }),
-  )
-  .output(
-    z
-      .object({
-        encrypted: z.string().describe('Base64 密文（用于设备授权二维码）'),
-      })
-      .meta({
-        examples: [
-          {
-            encrypted: 'dGhpcyBpcyBhIGJhc2U2NCBlbmNvZGVkIFJTQS1PQUVQIGVuY3J5cHRlZCBkZXZpY2UgaW5mby4uLg==',
-          },
-        ],
-      }),
-  )
-
-export const decryptTask = oc
-  .route({
-    method: 'POST',
-    path: '/crypto/decrypt-task',
-    operationId: 'decryptTask',
-    summary: '解密任务二维码数据',
-    description:
-      '使用本机 licence 与 fingerprint 派生 AES-256-GCM 密钥（SHA-256），解密 App 任务二维码中的 Base64 密文，返回任务信息明文。参见《工具箱端 - 任务二维码解密指南》。',
-    tags: ['Crypto'],
-  })
-  .input(
-    z
-      .object({
-        encryptedData: z.string().min(1).describe('Base64 编码的 AES-256-GCM 密文（来自任务二维码扫描结果）'),
-      })
-      .meta({
-        examples: [
-          {
-            encryptedData: 'uWUcAmp6UQd0w3G3crdsd4613QCxGLoEgslgXJ4G2hQhpQdjtghtQjCBUZwB/JO+NRgH1vSTr8dqBJRq7Qh4nug==',
-          },
-        ],
-      }),
-  )
-  .output(
-    z
-      .object({
-        decrypted: z.string().describe('解密后的任务信息 JSON 字符串'),
-      })
-      .meta({
-        examples: [
-          {
-            decrypted:
-              '{"taskId":"TASK-20260115-4875","enterpriseId":"1173040813421105152","orgName":"超艺科技有限公司","inspectionId":"702286470691215417","inspectionPerson":"警务通","issuedAt":1734571234567}',
-          },
-        ],
-      }),
-  )
-
-export const encryptSummary = oc
-  .route({
-    method: 'POST',
-    path: '/crypto/encrypt-summary',
-    operationId: 'encryptSummary',
-    summary: '加密摘要信息',
-    description:
-      '使用本机 licence 与 fingerprint 通过 HKDF-SHA256 派生密钥，以 AES-256-GCM 加密检查摘要明文并返回 Base64 密文，供工具箱生成摘要信息二维码。参见《工具箱端 - 摘要信息二维码生成指南》。',
-    tags: ['Crypto'],
-  })
-  .input(
-    z
-      .object({
-        salt: z.string().min(1).describe('HKDF salt（即 taskId，从任务二维码中获取）'),
-        plaintext: z.string().min(1).describe('待加密的摘要信息 JSON 明文'),
-      })
-      .meta({
-        examples: [
-          {
-            salt: 'TASK-20260115-4875',
-            plaintext:
-              '{"enterpriseId":"1173040813421105152","inspectionId":"702286470691215417","summary":"检查摘要信息：发现3个高危漏洞，5个中危漏洞","timestamp":1734571234567}',
-          },
-        ],
-      }),
-  )
-  .output(
-    z
-      .object({
-        encrypted: z.string().describe('Base64 密文（用于摘要信息二维码）'),
-      })
-      .meta({
-        examples: [
-          {
-            encrypted: 'uWUcAmp6UQd0w3G3crdsd4613QCxGLoEgslgXJ4G2hQhpQdjtghtQjCBUZwB/JO+NRgH1vSTr8dqBJRq7Qh4nug==',
-          },
-        ],
-      }),
-  )
-
-export const signAndPackReport = oc
-  .route({
-    method: 'POST',
-    path: '/crypto/sign-and-pack-report',
-    operationId: 'signAndPackReport',
-    summary: '签名并打包检查报告',
-    description:
-      '上传包含 summary.json 的原始报告 ZIP，UX 自动从 ZIP 中提取 summary.json，使用本地存储的 licence/fingerprint 计算设备签名（HKDF + HMAC-SHA256），并使用本地 OpenPGP 私钥生成分离式签名。返回包含 summary.json（含 deviceSignature）、META-INF/manifest.json、META-INF/signature.asc 的签名报告 ZIP。参见《工具箱端 - 报告加密与签名生成指南》。',
-    tags: ['Crypto', 'Report'],
-  })
-  .input(
-    z.object({
-      rawZip: z
-        .file()
-        .mime(['application/zip', 'application/x-zip-compressed'])
-        .describe(
-          '原始报告 ZIP 文件（必须包含 summary.json，以及 assets.json、vulnerabilities.json、weakPasswords.json、漏洞评估报告.html 等报告文件）',
-        ),
-      outputFileName: z
-        .string()
-        .min(1)
-        .optional()
-        .describe('返回 ZIP 文件名（可选，默认 signed-report.zip）')
-        .meta({ examples: ['signed-report.zip'] }),
-    }),
-  )
-  .output(
-    z
-      .file()
-      .describe('签名后报告 ZIP 文件（二进制响应，包含 summary.json、META-INF/manifest.json、META-INF/signature.asc）'),
-  )

apps/server/src/server/api/contracts/index.ts

@@ -1,9 +0,0 @@
-import * as config from './config.contract'
-import * as crypto from './crypto.contract'
-
-export const contract = {
-  config,
-  crypto,
-}
-
-export type Contract = typeof contract

apps/server/src/server/api/interceptors.ts

@@ -1,26 +0,0 @@
-import { ORPCError, ValidationError } from '@orpc/server'
-import { z } from 'zod'
-
-export const logError = (error: unknown) => {
-  console.error(error)
-}
-
-export const handleValidationError = (error: unknown) => {
-  if (error instanceof ORPCError && error.code === 'BAD_REQUEST' && error.cause instanceof ValidationError) {
-    // If you only use Zod you can safely cast to ZodIssue[] (per ORPC official docs)
-    const zodError = new z.ZodError(error.cause.issues as z.core.$ZodIssue[])
-
-    throw new ORPCError('INPUT_VALIDATION_FAILED', {
-      status: 422,
-      message: z.prettifyError(zodError),
-      data: z.flattenError(zodError),
-      cause: error.cause,
-    })
-  }
-
-  if (error instanceof ORPCError && error.code === 'INTERNAL_SERVER_ERROR' && error.cause instanceof ValidationError) {
-    throw new ORPCError('OUTPUT_VALIDATION_FAILED', {
-      cause: error.cause,
-    })
-  }
-}

apps/server/src/server/api/middlewares/db.middleware.ts

@@ -1,11 +0,0 @@
-import { os } from '@/server/api/server'
-import { getDB } from '@/server/db'
-
-export const db = os.middleware(async ({ context, next }) => {
-  return next({
-    context: {
-      ...context,
-      db: getDB(),
-    },
-  })
-})

apps/server/src/server/api/middlewares/index.ts

@@ -1 +0,0 @@
-export * from './db.middleware'

apps/server/src/server/api/routers/config.router.ts

@@ -1,32 +0,0 @@
-import { validatePgpPrivateKey } from '@furtherverse/crypto'
-import { ORPCError } from '@orpc/server'
-import { ensureUxConfig, setUxLicence, setUxPgpPrivateKey } from '@/server/ux-config'
-import { db } from '../middlewares'
-import { os } from '../server'
-
-const toConfigOutput = (config: { licence: string | null; fingerprint: string; pgpPrivateKey: string | null }) => ({
-  licence: config.licence,
-  fingerprint: config.fingerprint,
-  hasPgpPrivateKey: config.pgpPrivateKey != null,
-})
-
-export const get = os.config.get.use(db).handler(async ({ context }) => {
-  const config = await ensureUxConfig(context.db)
-  return toConfigOutput(config)
-})
-
-export const setLicence = os.config.setLicence.use(db).handler(async ({ context, input }) => {
-  const config = await setUxLicence(context.db, input.licence)
-  return toConfigOutput(config)
-})
-
-export const setPgpPrivateKey = os.config.setPgpPrivateKey.use(db).handler(async ({ context, input }) => {
-  await validatePgpPrivateKey(input.pgpPrivateKey).catch((error) => {
-    throw new ORPCError('BAD_REQUEST', {
-      message: `Invalid PGP private key: ${error instanceof Error ? error.message : 'unable to parse'}`,
-    })
-  })
-
-  const config = await setUxPgpPrivateKey(context.db, input.pgpPrivateKey)
-  return toConfigOutput(config)
-})

apps/server/src/server/api/routers/crypto.router.ts

@@ -1,183 +0,0 @@
-import {
-  aesGcmDecrypt,
-  aesGcmEncrypt,
-  hkdfSha256,
-  hmacSha256Base64,
-  pgpSignDetached,
-  rsaOaepEncrypt,
-  sha256,
-  sha256Hex,
-} from '@furtherverse/crypto'
-import { ORPCError } from '@orpc/server'
-import JSZip from 'jszip'
-import { z } from 'zod'
-import { extractSafeZipFiles, ZipValidationError } from '@/server/safe-zip'
-import { getUxConfig } from '@/server/ux-config'
-import { db } from '../middlewares'
-import { os } from '../server'
-
-const summaryPayloadSchema = z
-  .object({
-    taskId: z.string().min(1, 'summary.json must contain a non-empty taskId'),
-    checkId: z.union([z.string(), z.number()]).optional(),
-    inspectionId: z.union([z.string(), z.number()]).optional(),
-    orgId: z.union([z.string(), z.number()]).optional(),
-    enterpriseId: z.union([z.string(), z.number()]).optional(),
-    summary: z.string().optional(),
-  })
-  .loose()
-
-const requireIdentity = async (dbInstance: Parameters<typeof getUxConfig>[0]) => {
-  const config = await getUxConfig(dbInstance)
-  if (!config || !config.licence) {
-    throw new ORPCError('PRECONDITION_FAILED', {
-      message: 'Local identity is not initialized. Call config.get and then config.setLicence first.',
-    })
-  }
-  return config as typeof config & { licence: string }
-}
-
-export const encryptDeviceInfo = os.crypto.encryptDeviceInfo.use(db).handler(async ({ context, input }) => {
-  const config = await requireIdentity(context.db)
-
-  const deviceInfoJson = JSON.stringify({
-    licence: config.licence,
-    fingerprint: config.fingerprint,
-  })
-
-  const encrypted = rsaOaepEncrypt(deviceInfoJson, input.platformPublicKey)
-  return { encrypted }
-})
-
-export const decryptTask = os.crypto.decryptTask.use(db).handler(async ({ context, input }) => {
-  const config = await requireIdentity(context.db)
-
-  const key = sha256(config.licence + config.fingerprint)
-  const decrypted = aesGcmDecrypt(input.encryptedData, key)
-  return { decrypted }
-})
-
-export const encryptSummary = os.crypto.encryptSummary.use(db).handler(async ({ context, input }) => {
-  const config = await requireIdentity(context.db)
-
-  const ikm = config.licence + config.fingerprint
-  const aesKey = hkdfSha256(ikm, input.salt, 'inspection_report_encryption')
-  const encrypted = aesGcmEncrypt(input.plaintext, aesKey)
-  return { encrypted }
-})
-
-export const signAndPackReport = os.crypto.signAndPackReport.use(db).handler(async ({ context, input }) => {
-  const config = await requireIdentity(context.db)
-
-  if (!config.pgpPrivateKey) {
-    throw new ORPCError('PRECONDITION_FAILED', {
-      message: 'PGP private key is not configured. Call config.setPgpPrivateKey first.',
-    })
-  }
-
-  const rawZipBytes = Buffer.from(await input.rawZip.arrayBuffer())
-
-  const zipFiles = await extractSafeZipFiles(rawZipBytes).catch((error) => {
-    if (error instanceof ZipValidationError) {
-      throw new ORPCError('BAD_REQUEST', { message: error.message })
-    }
-    throw error
-  })
-
-  // Extract and validate summary.json from the ZIP
-  const summaryFile = zipFiles.find((f) => f.name === 'summary.json')
-  if (!summaryFile) {
-    throw new ORPCError('BAD_REQUEST', {
-      message: 'rawZip must contain a summary.json file',
-    })
-  }
-
-  let rawJson: unknown
-  try {
-    rawJson = JSON.parse(Buffer.from(summaryFile.bytes).toString('utf-8'))
-  } catch {
-    throw new ORPCError('BAD_REQUEST', {
-      message: 'summary.json in the ZIP is not valid JSON',
-    })
-  }
-
-  const parsed = summaryPayloadSchema.safeParse(rawJson)
-  if (!parsed.success) {
-    throw new ORPCError('BAD_REQUEST', {
-      message: `Invalid summary.json: ${z.prettifyError(parsed.error)}`,
-    })
-  }
-
-  const summaryPayload = parsed.data
-  const checkId = String(summaryPayload.checkId ?? summaryPayload.inspectionId ?? '')
-  const orgId = summaryPayload.orgId ?? summaryPayload.enterpriseId ?? ''
-
-  // Helper: find file in ZIP and compute its SHA256 hash
-  const requireFileHash = (name: string): string => {
-    const file = zipFiles.find((f) => f.name === name)
-    if (!file) {
-      throw new ORPCError('BAD_REQUEST', { message: `rawZip must contain ${name}` })
-    }
-    return sha256Hex(Buffer.from(file.bytes))
-  }
-
-  // Compute SHA256 of each content file (fixed order, matching Kotlin reference)
-  const assetsSha256 = requireFileHash('assets.json')
-  const vulnerabilitiesSha256 = requireFileHash('vulnerabilities.json')
-  const weakPasswordsSha256 = requireFileHash('weakPasswords.json')
-  const reportHtmlSha256 = requireFileHash('漏洞评估报告.html')
-
-  // Compute device signature
-  // signPayload = taskId + inspectionId + assetsSha256 + vulnerabilitiesSha256 + weakPasswordsSha256 + reportHtmlSha256
-  // (plain concatenation, no separators, fixed order — matching Kotlin reference)
-  const ikm = config.licence + config.fingerprint
-  const signingKey = hkdfSha256(ikm, 'AUTH_V3_SALT', 'device_report_signature')
-
-  const signPayload = `${summaryPayload.taskId}${checkId}${assetsSha256}${vulnerabilitiesSha256}${weakPasswordsSha256}${reportHtmlSha256}`
-  const deviceSignature = hmacSha256Base64(signingKey, signPayload)
-
-  // Build final summary.json with flat structure (matching Kotlin reference)
-  const finalSummary = {
-    orgId,
-    checkId,
-    taskId: summaryPayload.taskId,
-    licence: config.licence,
-    fingerprint: config.fingerprint,
-    deviceSignature,
-    summary: summaryPayload.summary ?? '',
-  }
-  const summaryBytes = Buffer.from(JSON.stringify(finalSummary), 'utf-8')
-
-  // Build manifest.json (fixed file list, matching Kotlin reference)
-  const manifestFiles: Record<string, string> = {
-    'summary.json': sha256Hex(summaryBytes),
-    'assets.json': assetsSha256,
-    'vulnerabilities.json': vulnerabilitiesSha256,
-    'weakPasswords.json': weakPasswordsSha256,
-    '漏洞评估报告.html': reportHtmlSha256,
-  }
-
-  const manifestBytes = Buffer.from(JSON.stringify({ files: manifestFiles }, null, 2), 'utf-8')
-  const signatureAsc = await pgpSignDetached(manifestBytes, config.pgpPrivateKey)
-
-  // Pack signed ZIP
-  const signedZip = new JSZip()
-  signedZip.file('summary.json', summaryBytes)
-  for (const item of zipFiles) {
-    if (item.name !== 'summary.json') {
-      signedZip.file(item.name, item.bytes)
-    }
-  }
-  signedZip.file('META-INF/manifest.json', manifestBytes)
-  signedZip.file('META-INF/signature.asc', signatureAsc)
-
-  const signedZipBytes = await signedZip.generateAsync({
-    type: 'uint8array',
-    compression: 'DEFLATE',
-    compressionOptions: { level: 9 },
-  })
-
-  return new File([Buffer.from(signedZipBytes)], input.outputFileName ?? 'signed-report.zip', {
-    type: 'application/zip',
-  })
-})

apps/server/src/server/api/routers/index.ts

@@ -1,8 +0,0 @@
-import { os } from '../server'
-import * as config from './config.router'
-import * as crypto from './crypto.router'
-
-export const router = os.router({
-  config,
-  crypto,
-})

apps/server/src/server/api/server.ts

@@ -1,5 +0,0 @@
-import { implement } from '@orpc/server'
-import type { BaseContext } from './context'
-import { contract } from './contracts'
-
-export const os = implement(contract).$context<BaseContext>()

apps/server/src/server/api/types.ts

@@ -1,6 +0,0 @@
-import type { ContractRouterClient, InferContractRouterInputs, InferContractRouterOutputs } from '@orpc/contract'
-import type { Contract } from './contracts'
-
-export type RouterClient = ContractRouterClient<Contract>
-export type RouterInputs = InferContractRouterInputs<Contract>
-export type RouterOutputs = InferContractRouterOutputs<Contract>

apps/server/src/server/db/fields.ts

@@ -1,36 +0,0 @@
-import { integer, text } from 'drizzle-orm/sqlite-core'
-import { v7 as uuidv7 } from 'uuid'
-
-export const pk = (name = 'id') =>
-  text(name)
-    .primaryKey()
-    .$defaultFn(() => uuidv7())
-
-export const createdAt = (name = 'created_at') =>
-  integer(name, { mode: 'timestamp_ms' })
-    .notNull()
-    .$defaultFn(() => new Date())
-
-export const updatedAt = (name = 'updated_at') =>
-  integer(name, { mode: 'timestamp_ms' })
-    .notNull()
-    .$defaultFn(() => new Date())
-    .$onUpdateFn(() => new Date())
-
-export const generatedFields = {
-  id: pk('id'),
-  createdAt: createdAt('created_at'),
-  updatedAt: updatedAt('updated_at'),
-}
-
-const createGeneratedFieldKeys = <T extends Record<string, unknown>>(fields: T): Record<keyof T, true> => {
-  return Object.keys(fields).reduce(
-    (acc, key) => {
-      acc[key as keyof T] = true
-      return acc
-    },
-    {} as Record<keyof T, true>,
-  )
-}
-
-export const generatedFieldKeys = createGeneratedFieldKeys(generatedFields)

apps/server/src/server/db/index.ts

@@ -1,26 +0,0 @@
-import { Database } from 'bun:sqlite'
-import { drizzle } from 'drizzle-orm/bun-sqlite'
-import { env } from '@/env'
-import { relations } from '@/server/db/relations'
-
-export const createDB = () => {
-  const sqlite = new Database(env.DATABASE_PATH)
-  sqlite.exec('PRAGMA journal_mode = WAL')
-  sqlite.exec('PRAGMA foreign_keys = ON')
-  return drizzle({ client: sqlite, relations })
-}
-
-export type DB = ReturnType<typeof createDB>
-
-export const getDB = (() => {
-  let db: DB | null = null
-
-  return (singleton = true): DB => {
-    if (!singleton) {
-      return createDB()
-    }
-
-    db ??= createDB()
-    return db
-  }
-})()

apps/server/src/server/db/relations.ts

@@ -1,4 +0,0 @@
-import { defineRelations } from 'drizzle-orm'
-import * as schema from './schema'
-
-export const relations = defineRelations(schema, () => ({}))

apps/server/src/server/db/schema/index.ts

@@ -1 +0,0 @@
-export * from './ux-config'

apps/server/src/server/db/schema/ux-config.ts

@@ -1,10 +0,0 @@
-import { sqliteTable, text } from 'drizzle-orm/sqlite-core'
-import { generatedFields } from '../fields'
-
-export const uxConfigTable = sqliteTable('ux_config', {
-  ...generatedFields,
-  singletonKey: text('singleton_key').notNull().unique().default('default'),
-  licence: text('licence'),
-  fingerprint: text('fingerprint').notNull(),
-  pgpPrivateKey: text('pgp_private_key'),
-})

apps/server/src/server/device-fingerprint.ts

@@ -1,10 +0,0 @@
-import { sha256Hex } from '@furtherverse/crypto'
-import { system } from 'systeminformation'
-
-export const computeDeviceFingerprint = async (): Promise<string> => {
-  const { uuid, serial, model, manufacturer } = await system()
-  const source = [uuid, serial, model, manufacturer].join('|')
-  const hash = sha256Hex(source)
-
-  return hash
-}

apps/server/src/server/safe-zip.ts

@@ -1,96 +0,0 @@
-import type { JSZipObject } from 'jszip'
-import JSZip from 'jszip'
-
-export class ZipValidationError extends Error {
-  override name = 'ZipValidationError'
-}
-
-export interface ZipFileItem {
-  name: string
-  bytes: Uint8Array
-}
-
-export interface SafeZipOptions {
-  maxRawBytes?: number
-  maxEntries?: number
-  maxSingleFileBytes?: number
-  maxTotalUncompressedBytes?: number
-}
-
-const DEFAULTS = {
-  maxRawBytes: 50 * 1024 * 1024,
-  maxEntries: 64,
-  maxSingleFileBytes: 20 * 1024 * 1024,
-  maxTotalUncompressedBytes: 60 * 1024 * 1024,
-} satisfies Required<SafeZipOptions>
-
-const normalizePath = (name: string): string => name.replaceAll('\\', '/')
-
-const isUnsafePath = (name: string): boolean => {
-  const normalized = normalizePath(name)
-  const segments = normalized.split('/')
-
-  return (
-    normalized.startsWith('/') ||
-    normalized.includes('\0') ||
-    segments.some((segment) => segment === '..' || segment.trim().length === 0)
-  )
-}
-
-export const extractSafeZipFiles = async (
-  rawBytes: Uint8Array | Buffer,
-  options?: SafeZipOptions,
-): Promise<ZipFileItem[]> => {
-  const opts = { ...DEFAULTS, ...options }
-
-  if (rawBytes.byteLength === 0 || rawBytes.byteLength > opts.maxRawBytes) {
-    throw new ZipValidationError('ZIP is empty or exceeds max size limit')
-  }
-
-  const zip = await JSZip.loadAsync(rawBytes, { checkCRC32: true }).catch(() => {
-    throw new ZipValidationError('Not a valid ZIP file')
-  })
-
-  const entries = Object.values(zip.files) as JSZipObject[]
-  if (entries.length > opts.maxEntries) {
-    throw new ZipValidationError(`ZIP contains too many entries: ${entries.length}`)
-  }
-
-  let totalUncompressedBytes = 0
-  const files: ZipFileItem[] = []
-  const seen = new Set<string>()
-
-  for (const entry of entries) {
-    if (entry.dir) {
-      continue
-    }
-
-    if (isUnsafePath(entry.name)) {
-      throw new ZipValidationError(`ZIP contains unsafe entry path: ${entry.name}`)
-    }
-
-    const normalizedName = normalizePath(entry.name)
-    if (seen.has(normalizedName)) {
-      throw new ZipValidationError(`ZIP contains duplicate entry: ${normalizedName}`)
-    }
-    seen.add(normalizedName)
-
-    const content = await entry.async('uint8array')
-    if (content.byteLength > opts.maxSingleFileBytes) {
-      throw new ZipValidationError(`ZIP entry too large: ${normalizedName}`)
-    }
-
-    totalUncompressedBytes += content.byteLength
-    if (totalUncompressedBytes > opts.maxTotalUncompressedBytes) {
-      throw new ZipValidationError('ZIP total uncompressed content exceeds max size limit')
-    }
-
-    files.push({ name: normalizedName, bytes: content })
-  }
-
-  if (files.length === 0) {
-    throw new ZipValidationError('ZIP has no file entries')
-  }
-
-  return files
-}

apps/server/src/server/ux-config.ts

@@ -1,56 +0,0 @@
-import { eq } from 'drizzle-orm'
-import type { DB } from '@/server/db'
-import { uxConfigTable } from '@/server/db/schema'
-import { computeDeviceFingerprint } from './device-fingerprint'
-
-const UX_CONFIG_KEY = 'default'
-
-export const getUxConfig = async (db: DB) => {
-  return await db.query.uxConfigTable.findFirst({
-    where: { singletonKey: UX_CONFIG_KEY },
-  })
-}
-
-export const ensureUxConfig = async (db: DB) => {
-  const fingerprint = await computeDeviceFingerprint()
-  const existing = await getUxConfig(db)
-
-  if (existing) {
-    if (existing.fingerprint !== fingerprint) {
-      const rows = await db
-        .update(uxConfigTable)
-        .set({ fingerprint })
-        .where(eq(uxConfigTable.id, existing.id))
-        .returning()
-      return rows[0] as (typeof rows)[number]
-    }
-    return existing
-  }
-
-  const rows = await db
-    .insert(uxConfigTable)
-    .values({
-      singletonKey: UX_CONFIG_KEY,
-      fingerprint,
-      licence: null,
-    })
-    .returning()
-
-  return rows[0] as (typeof rows)[number]
-}
-
-export const setUxLicence = async (db: DB, licence: string) => {
-  const config = await ensureUxConfig(db)
-
-  const rows = await db.update(uxConfigTable).set({ licence }).where(eq(uxConfigTable.id, config.id)).returning()
-
-  return rows[0] as (typeof rows)[number]
-}
-
-export const setUxPgpPrivateKey = async (db: DB, pgpPrivateKey: string) => {
-  const config = await ensureUxConfig(db)
-
-  const rows = await db.update(uxConfigTable).set({ pgpPrivateKey }).where(eq(uxConfigTable.id, config.id)).returning()
-
-  return rows[0] as (typeof rows)[number]
-}

apps/server/src/styles.css

@@ -1 +0,0 @@
-@import "tailwindcss";

apps/server/tsconfig.json

@@ -1,9 +0,0 @@
-{
-  "extends": "@furtherverse/tsconfig/react.json",
-  "compilerOptions": {
-    "baseUrl": ".",
-    "paths": {
-      "@/*": ["./src/*"]
-    }
-  }
-}

apps/server/turbo.json

@@ -1,47 +0,0 @@
-{
-  "$schema": "../../node_modules/turbo/schema.json",
-  "extends": ["//"],
-  "tasks": {
-    "build": {
-      "env": ["NODE_ENV", "VITE_*"],
-      "inputs": ["src/**", "public/**", "package.json", "tsconfig.json", "vite.config.ts"],
-      "outputs": [".output/**"]
-    },
-    "compile": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    },
-    "compile:darwin": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    },
-    "compile:darwin:arm64": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    },
-    "compile:darwin:x64": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    },
-    "compile:linux": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    },
-    "compile:linux:arm64": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    },
-    "compile:linux:x64": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    },
-    "compile:windows": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    },
-    "compile:windows:x64": {
-      "dependsOn": ["build"],
-      "outputs": ["out/**"]
-    }
-  }
-}

biome.json

@@ -6,13 +6,13 @@
     "useIgnoreFile": true
   },
   "files": {
+    "includes": ["**", "!**/routeTree.gen.ts"],
     "ignoreUnknown": false
   },
   "formatter": {
     "enabled": true,
     "indentStyle": "space",
-    "lineEnding": "lf",
+    "lineEnding": "lf"
-    "lineWidth": 120
   },
   "linter": {
     "enabled": true,

build.ts

@@ -0,0 +1,289 @@
+import { Schema } from '@effect/schema'
+import { $ } from 'bun'
+import { Console, Context, Data, Effect, Layer } from 'effect'
+
+// ============================================================================
+// Domain Models & Schema
+// ============================================================================
+
+const targetMap = {
+  'bun-windows-x64': 'x86_64-pc-windows-msvc',
+  'bun-darwin-arm64': 'aarch64-apple-darwin',
+  'bun-darwin-x64': 'x86_64-apple-darwin',
+  'bun-linux-x64': 'x86_64-unknown-linux-gnu',
+  'bun-linux-arm64': 'aarch64-unknown-linux-gnu',
+} as const
+
+const BunTargetSchema = Schema.Literal(
+  'bun-windows-x64',
+  'bun-darwin-arm64',
+  'bun-darwin-x64',
+  'bun-linux-x64',
+  'bun-linux-arm64',
+)
+
+type BunTarget = Schema.Schema.Type<typeof BunTargetSchema>
+
+const BuildConfigSchema = Schema.Struct({
+  entrypoint: Schema.String.pipe(Schema.nonEmptyString()),
+  outputDir: Schema.String.pipe(Schema.nonEmptyString()),
+  targets: Schema.Array(BunTargetSchema).pipe(Schema.minItems(1)),
+})
+
+type BuildConfig = Schema.Schema.Type<typeof BuildConfigSchema>
+
+const BuildResultSchema = Schema.Struct({
+  target: BunTargetSchema,
+  outputs: Schema.Array(Schema.String),
+})
+
+type BuildResult = Schema.Schema.Type<typeof BuildResultSchema>
+
+// ============================================================================
+// Error Models (使用 Data.TaggedError)
+// ============================================================================
+
+class CleanError extends Data.TaggedError('CleanError')<{
+  readonly dir: string
+  readonly cause: unknown
+}> {}
+
+class BuildError extends Data.TaggedError('BuildError')<{
+  readonly target: BunTarget
+  readonly cause: unknown
+}> {}
+
+class ConfigError extends Data.TaggedError('ConfigError')<{
+  readonly message: string
+  readonly cause: unknown
+}> {}
+
+// ============================================================================
+// Services
+// ============================================================================
+
+/**
+ * 配置服务
+ */
+class BuildConfigService extends Context.Tag('BuildConfigService')<
+  BuildConfigService,
+  BuildConfig
+>() {
+  /**
+   * 从原始数据创建并验证配置
+   */
+  static fromRaw = (raw: unknown) =>
+    Effect.gen(function* () {
+      const decoded = yield* Schema.decodeUnknown(BuildConfigSchema)(raw)
+      return decoded
+    }).pipe(
+      Effect.catchAll((error) =>
+        Effect.fail(
+          new ConfigError({
+            message: '配置验证失败',
+            cause: error,
+          }),
+        ),
+      ),
+    )
+
+  /**
+   * 默认配置 Layer
+   */
+  static readonly Live = Layer.effect(
+    BuildConfigService,
+    BuildConfigService.fromRaw({
+      entrypoint: '.output/server/index.mjs',
+      // outputDir: 'out',
+      outputDir: 'src-tauri/binaries',
+      targets: ['bun-windows-x64', 'bun-darwin-arm64', 'bun-linux-x64'],
+    }),
+  )
+}
+
+/**
+ * 文件系统服务
+ */
+class FileSystemService extends Context.Tag('FileSystemService')<
+  FileSystemService,
+  {
+    readonly cleanDir: (dir: string) => Effect.Effect<void, CleanError>
+  }
+>() {
+  static readonly Live = Layer.succeed(FileSystemService, {
+    cleanDir: (dir: string) =>
+      Effect.tryPromise({
+        try: async () => {
+          await $`rm -rf ${dir}`
+        },
+        catch: (cause: unknown) =>
+          new CleanError({
+            dir,
+            cause,
+          }),
+      }),
+  })
+}
+
+/**
+ * 构建服务
+ */
+class BuildService extends Context.Tag('BuildService')<
+  BuildService,
+  {
+    readonly buildForTarget: (
+      config: BuildConfig,
+      target: BunTarget,
+    ) => Effect.Effect<BuildResult, BuildError>
+    readonly buildAll: (
+      config: BuildConfig,
+    ) => Effect.Effect<ReadonlyArray<BuildResult>, BuildError>
+  }
+>() {
+  static readonly Live = Layer.succeed(BuildService, {
+    buildForTarget: (config: BuildConfig, target: BunTarget) =>
+      Effect.gen(function* () {
+        yield* Console.log(`🔨 开始构建: ${target}`)
+
+        const output = yield* Effect.tryPromise({
+          try: () =>
+            Bun.build({
+              entrypoints: [config.entrypoint],
+              compile: {
+                outfile: `app-${targetMap[target]}`,
+                target: target,
+              },
+              outdir: config.outputDir,
+            }),
+          catch: (cause: unknown) =>
+            new BuildError({
+              target,
+              cause,
+            }),
+        })
+
+        const paths = output.outputs.map((item: { path: string }) => item.path)
+
+        return {
+          target,
+          outputs: paths,
+        } satisfies BuildResult
+      }),
+
+    buildAll: (config: BuildConfig) =>
+      Effect.gen(function* () {
+        const effects = config.targets.map((target) =>
+          Effect.gen(function* () {
+            yield* Console.log(`🔨 开始构建: ${target}`)
+
+            const output = yield* Effect.tryPromise({
+              try: () =>
+                Bun.build({
+                  entrypoints: [config.entrypoint],
+                  compile: {
+                    outfile: `app-${targetMap[target]}`,
+                    target: target,
+                  },
+                  outdir: config.outputDir,
+                }),
+              catch: (cause: unknown) =>
+                new BuildError({
+                  target,
+                  cause,
+                }),
+            })
+
+            const paths = output.outputs.map(
+              (item: { path: string }) => item.path,
+            )
+
+            return {
+              target,
+              outputs: paths,
+            } satisfies BuildResult
+          }),
+        )
+        return yield* Effect.all(effects, { concurrency: 'unbounded' })
+      }),
+  })
+}
+
+/**
+ * 报告服务
+ */
+class ReporterService extends Context.Tag('ReporterService')<
+  ReporterService,
+  {
+    readonly printSummary: (
+      results: ReadonlyArray<BuildResult>,
+    ) => Effect.Effect<void>
+  }
+>() {
+  static readonly Live = Layer.succeed(ReporterService, {
+    printSummary: (results: ReadonlyArray<BuildResult>) =>
+      Effect.gen(function* () {
+        yield* Console.log('\n📦 构建完成:')
+        for (const result of results) {
+          yield* Console.log(`  ${result.target}:`)
+          for (const path of result.outputs) {
+            yield* Console.log(`    - ${path}`)
+          }
+        }
+      }),
+  })
+}
+
+// ============================================================================
+// Main Program
+// ============================================================================
+
+const program = Effect.gen(function* () {
+  const config = yield* BuildConfigService
+  const fs = yield* FileSystemService
+  const builder = yield* BuildService
+  const reporter = yield* ReporterService
+
+  // 1. 清理输出目录
+  yield* fs.cleanDir(config.outputDir)
+  yield* Console.log(`✓ 已清理输出目录: ${config.outputDir}`)
+
+  // 2. 并行构建所有目标
+  const results = yield* builder.buildAll(config)
+
+  // 3. 输出构建摘要
+  yield* reporter.printSummary(results)
+
+  return results
+})
+
+// ============================================================================
+// Layer Composition
+// ============================================================================
+
+const MainLayer = Layer.mergeAll(
+  BuildConfigService.Live,
+  FileSystemService.Live,
+  BuildService.Live,
+  ReporterService.Live,
+)
+
+// ============================================================================
+// Runner
+// ============================================================================
+
+const runnable = program.pipe(
+  Effect.provide(MainLayer),
+  Effect.catchTags({
+    CleanError: (error) =>
+      Console.error(`❌ 清理目录失败: ${error.dir}`, error.cause),
+    BuildError: (error) =>
+      Console.error(`❌ 构建失败 [${error.target}]:`, error.cause),
+    ConfigError: (error) =>
+      Console.error(`❌ 配置错误: ${error.message}`, error.cause),
+  }),
+  Effect.tapErrorCause((cause) => Console.error('❌ 未预期的错误:', cause)),
+)
+
+Effect.runPromise(runnable).catch(() => {
+  process.exit(1)
+})

bunfig.toml

@@ -1,2 +0,0 @@
-[install]
-publicHoistPattern = ["@types/*", "bun-types", "nitro*"]

docs/摘要+zip/EncryptionTestController.kt

@@ -1,432 +0,0 @@
-package top.tangyh.lamp.filing.controller.compress
-
-import com.fasterxml.jackson.databind.ObjectMapper
-import io.swagger.annotations.Api
-import io.swagger.annotations.ApiOperation
-import io.swagger.annotations.ApiParam
-import org.springframework.validation.annotation.Validated
-import org.springframework.web.bind.annotation.*
-import top.tangyh.basic.annotation.log.WebLog
-import top.tangyh.basic.base.R
-import top.tangyh.lamp.filing.dto.management.UploadInspectionFileV2Request
-import top.tangyh.lamp.filing.utils.AesGcmUtil
-import top.tangyh.lamp.filing.utils.HkdfUtil
-import top.tangyh.lamp.filing.utils.PgpSignatureUtil
-import java.util.*
-
-/**
- * 加密测试工具类
- * 
- * 用于生成加密后的 encrypted 数据，测试 uploadInspectionFileV2Encrypted 接口
- * 
- * 使用说明：
- * 1. 调用 /compression/test/generateEncrypted 接口
- * 2. 传入 licence、fingerprint、taskId 和明文数据
- * 3. 获取加密后的 Base64 字符串
- * 4. 使用返回的 encrypted 数据测试 uploadInspectionFileV2Encrypted 接口
- */
-@Validated
-@RestController
-@RequestMapping("/compression/test")
-@Api(value = "EncryptionTest", tags = ["加密测试工具"])
-class EncryptionTestController {
-
-    private val objectMapper = ObjectMapper()
-    
-    companion object {
-        private const val DEFAULT_PGP_PRIVATE_KEY = """-----BEGIN PGP PRIVATE KEY BLOCK-----
-
-lFgEaSZqXBYJKwYBBAHaRw8BAQdARzZ5JXreuTeTgMFwYcw0Ju7aCWmXuUMmQyff
-5vmN8RQAAP4nli0R/MTNtgx9+g5ZPyAj8XSAnjHaW9u2UJQxYhMIYw8XtBZpdHRj
-PGl0dGNAaXR0Yy5zaC5jbj6IkwQTFgoAOxYhBG8IkI1kmkNpEu8iuqWu91t6SEzN
-BQJpJmpcAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEKWu91t6SEzN
-dSQBAPM5llVG0X6SBa4YM90Iqyb2jWvlNjstoF8jjPVny1CiAP4hIOUvb686oSA0
-OrS3AuICi7X/r+JnSo1Z7pngUA3VC5xdBGkmalwSCisGAQQBl1UBBQEBB0BouQlG
-hIL0bq7EbaB55s+ygLVFOfhjFA8E4fwFBFJGVAMBCAcAAP98ZXRGgzld1XUa5ZGx
-cTE+1qGZY4E4BVIeqkVxdg5tqA64iHgEGBYKACAWIQRvCJCNZJpDaRLvIrqlrvdb
-ekhMzQUCaSZqXAIbDAAKCRClrvdbekhMzcaSAQDB/4pvDuc7SploQg1fBYobFm5P
-vxguByr8I+PrYWKKOQEAnaeXT4ipi1nICXFiigztsIl2xTth3D77XG6pZUU/Zw8=
-=/k1H
------END PGP PRIVATE KEY BLOCK-----"""
-        
-        private const val DEFAULT_PGP_PASSPHRASE = ""
-    }
-
-    /**
-     * 生成加密数据请求 DTO
-     */
-    data class GenerateEncryptedRequest(
-        @ApiParam(value = "授权码", required = true)
-        val licence: String,
-        
-        @ApiParam(value = "硬件指纹", required = true)
-        val fingerprint: String,
-        
-        @ApiParam(value = "任务ID", required = true)
-        val taskId: String,
-        
-        @ApiParam(value = "企业ID", required = true)
-        val enterpriseId: Long,
-        
-        @ApiParam(value = "检查ID", required = true)
-        val inspectionId: Long,
-        
-        @ApiParam(value = "摘要信息", required = true)
-        val summary: String
-    )
-
-    /**
-     * 生成加密数据响应 DTO
-     */
-    data class GenerateEncryptedResponse(
-        val encrypted: String,
-        val requestBody: UploadInspectionFileV2Request,
-        val plaintext: String,
-        val keyDerivationInfo: KeyDerivationInfo
-    )
-
-    /**
-     * 密钥派生信息
-     */
-    data class KeyDerivationInfo(
-        val ikm: String,
-        val salt: String,
-        val info: String,
-        val keyLength: Int,
-        val keyHex: String
-    )
-
-    /**
-     * 生成加密数据
-     * 
-     * 模拟工具箱端的加密逻辑：
-     * 1. 使用 HKDF-SHA256 派生 AES 密钥
-     *    - ikm = licence + fingerprint
-     *    - salt = taskId
-     *    - info = "inspection_report_encryption"
-     *    - length = 32 bytes
-     * 
-     * 2. 使用 AES-256-GCM 加密数据
-     *    - 格式：IV (12字节) + Ciphertext + Tag (16字节)
-     *    - Base64 编码返回
-     * 
-     * @param request 生成加密数据请求
-     * @return 加密后的数据和完整的请求体
-     */
-    @ApiOperation(value = "生成加密数据", notes = "生成加密后的 encrypted 数据，用于测试 uploadInspectionFileV2Encrypted 接口")
-    @PostMapping("/generateEncrypted")
-    @WebLog(value = "'生成加密数据:'", request = false)
-    fun generateEncrypted(
-        @RequestBody request: GenerateEncryptedRequest
-    ): R<GenerateEncryptedResponse> {
-        return try {
-            // 1. 组装明文数据（JSON格式）
-            val timestamp = System.currentTimeMillis()
-            val plaintextMap = mapOf(
-                "enterpriseId" to request.enterpriseId.toString(),
-                "inspectionId" to request.inspectionId.toString(),
-                "summary" to request.summary,
-                "timestamp" to timestamp
-            )
-            val plaintext = objectMapper.writeValueAsString(plaintextMap)
-
-            // 2. 使用 HKDF-SHA256 派生 AES 密钥
-            // ikm = licence + fingerprint
-            // salt = taskId（工具箱从二维码获取，平台从请求获取）
-            // info = "inspection_report_encryption"（固定值）
-            // length = 32 bytes
-            val ikm = "${request.licence}${request.fingerprint}"
-            val salt = request.taskId.toString()
-            val info = "inspection_report_encryption"
-            val keyLength = 32
-
-            val aesKey = HkdfUtil.deriveKey(ikm, salt, info, keyLength)
-
-            // 3. 使用 AES-256-GCM 加密数据
-            val encrypted = AesGcmUtil.encrypt(plaintext, aesKey)
-
-            // 4. 组装完整的请求体（appid 需要前端自己赋值）
-            val requestBody = UploadInspectionFileV2Request().apply {
-                this.appid = "test-appid" // 测试用的 appid，实际使用时前端会赋值
-                this.taskId = request.taskId
-                this.encrypted = encrypted
-            }
-
-            // 5. 返回加密数据和密钥派生信息
-            val response = GenerateEncryptedResponse(
-                encrypted = encrypted,
-                requestBody = requestBody,
-                plaintext = plaintext,
-                keyDerivationInfo = KeyDerivationInfo(
-                    ikm = ikm,
-                    salt = salt,
-                    info = info,
-                    keyLength = keyLength,
-                    keyHex = aesKey.joinToString("") { "%02x".format(it) }
-                )
-            )
-
-            R.success(response, "加密数据生成成功")
-        } catch (e: Exception) {
-            R.fail("生成加密数据失败: ${e.message}")
-        }
-    }
-
-    /**
-     * 快速生成测试数据（使用默认值）
-     * 
-     * @return 加密后的数据和完整的请求体
-     */
-    @ApiOperation(value = "快速生成测试数据", notes = "使用默认值快速生成加密数据，用于快速测试")
-    @GetMapping("/generateTestData")
-    @WebLog(value = "'快速生成测试数据:'", request = false)
-    fun generateTestData(): R<GenerateEncryptedResponse> {
-        return try {
-            // 使用默认测试数据
-            val request = GenerateEncryptedRequest(
-                licence = "TEST-LICENCE-001",
-                fingerprint = "TEST-FINGERPRINT-001",
-                taskId = "TASK-20260115-4875",
-                enterpriseId = 1173040813421105152L,
-                inspectionId = 702286470691215417L,
-                summary = "测试摘要信息"
-            )
-
-            generateEncrypted(request).data?.let {
-                R.success(it, "测试数据生成成功")
-            } ?: R.fail("生成测试数据失败")
-        } catch (e: Exception) {
-            R.fail("生成测试数据失败: ${e.message}")
-        }
-    }
-
-    /**
-     * 验证加密数据（解密测试）
-     * 
-     * 用于验证生成的加密数据是否能正确解密
-     * 
-     * @param encrypted 加密后的 Base64 字符串
-     * @param licence 授权码
-     * @param fingerprint 硬件指纹
-     * @param taskId 任务ID
-     * @return 解密后的明文数据
-     */
-    @ApiOperation(value = "验证加密数据", notes = "解密加密数据，验证加密是否正确")
-    @PostMapping("/verifyEncrypted")
-    @WebLog(value = "'验证加密数据:'", request = false)
-    fun verifyEncrypted(
-        @ApiParam(value = "加密后的 Base64 字符串", required = true)
-        @RequestParam encrypted: String,
-        
-        @ApiParam(value = "授权码", required = true)
-        @RequestParam licence: String,
-        
-        @ApiParam(value = "硬件指纹", required = true)
-        @RequestParam fingerprint: String,
-        
-        @ApiParam(value = "任务ID", required = true)
-        @RequestParam taskId: String
-    ): R<Map<String, Any>> {
-        return try {
-            // 1. 使用相同的密钥派生规则派生密钥
-            val ikm = "$licence$fingerprint"
-            val salt = taskId.toString()
-            val info = "inspection_report_encryption"
-            val aesKey = HkdfUtil.deriveKey(ikm, salt, info, 32)
-
-            // 2. 解密数据
-            val decrypted = AesGcmUtil.decrypt(encrypted, aesKey)
-
-            // 3. 解析 JSON
-            @Suppress("UNCHECKED_CAST")
-            val dataMap = objectMapper.readValue(decrypted, Map::class.java) as Map<String, Any>
-
-            R.success(dataMap, "解密成功")
-        } catch (e: Exception) {
-            R.fail("解密失败: ${e.message}")
-        }
-    }
-
-    /**
-     * 生成加密报告 ZIP 文件请求 DTO
-     */
-    data class GenerateEncryptedZipRequest(
-        @ApiParam(value = "授权码", required = true)
-        val licence: String,
-        
-        @ApiParam(value = "硬件指纹", required = true)
-        val fingerprint: String,
-        
-        @ApiParam(value = "任务ID", required = true)
-        val taskId: String,
-        
-        @ApiParam(value = "企业ID", required = true)
-        val enterpriseId: Long,
-        
-        @ApiParam(value = "检查ID", required = true)
-        val inspectionId: Long,
-        
-        @ApiParam(value = "摘要信息", required = true)
-        val summary: String,
-        
-        @ApiParam(value = "资产信息 JSON", required = true)
-        val assetsJson: String,
-        
-        @ApiParam(value = "漏洞信息 JSON", required = true)
-        val vulnerabilitiesJson: String,
-        
-        @ApiParam(value = "弱密码信息 JSON", required = true)
-        val weakPasswordsJson: String,
-        
-        @ApiParam(value = "漏洞评估报告 HTML", required = true)
-        val reportHtml: String,
-        
-        @ApiParam(value = "PGP 私钥（可选，不提供则跳过 PGP 签名）", required = false)
-        val pgpPrivateKey: String? = null,
-        
-        @ApiParam(value = "PGP 私钥密码（可选）", required = false)
-        val pgpPassphrase: String? = null
-    )
-
-    /**
-     * 生成加密报告 ZIP 文件
-     * 
-     * 按照文档《工具箱端-报告加密与签名生成指南.md》生成加密报告 ZIP 文件
-     * 
-     * @param request 生成请求
-     * @return ZIP 文件（二进制流）
-     */
-    @ApiOperation(value = "生成加密报告 ZIP", notes = "生成带设备签名的加密报告 ZIP 文件，可被 uploadInspectionFileV2 接口解密")
-    @PostMapping("/generateEncryptedZip")
-    @WebLog(value = "'生成加密报告 ZIP:'", request = false)
-    fun generateEncryptedZip(
-        @RequestBody request: GenerateEncryptedZipRequest,
-        response: javax.servlet.http.HttpServletResponse
-    ) {
-        try {
-            // 1. 准备文件内容
-            val assetsContent = request.assetsJson.toByteArray(Charsets.UTF_8)
-            val vulnerabilitiesContent = request.vulnerabilitiesJson.toByteArray(Charsets.UTF_8)
-            val weakPasswordsContent = request.weakPasswordsJson.toByteArray(Charsets.UTF_8)
-            val reportHtmlContent = request.reportHtml.toByteArray(Charsets.UTF_8)
-
-            // 2. 生成设备签名
-            // 2.1 密钥派生
-            val ikm = "${request.licence}${request.fingerprint}"
-            val salt = "AUTH_V3_SALT"
-            val info = "device_report_signature"
-            val derivedKey = HkdfUtil.deriveKey(ikm, salt, info, 32)
-
-            // 2.2 计算文件 SHA256
-            fun sha256Hex(content: ByteArray): String {
-                val digest = java.security.MessageDigest.getInstance("SHA-256")
-                return digest.digest(content).joinToString("") { "%02x".format(it) }
-            }
-
-            val assetsSha256 = sha256Hex(assetsContent)
-            val vulnerabilitiesSha256 = sha256Hex(vulnerabilitiesContent)
-            val weakPasswordsSha256 = sha256Hex(weakPasswordsContent)
-            val reportHtmlSha256 = sha256Hex(reportHtmlContent)
-
-            // 2.3 组装签名数据（严格顺序）
-            val signPayload = buildString {
-                append(request.taskId)
-                append(request.inspectionId)
-                append(assetsSha256)
-                append(vulnerabilitiesSha256)
-                append(weakPasswordsSha256)
-                append(reportHtmlSha256)
-            }
-
-            // 2.4 计算 HMAC-SHA256
-            val mac = javax.crypto.Mac.getInstance("HmacSHA256")
-            val secretKey = javax.crypto.spec.SecretKeySpec(derivedKey, "HmacSHA256")
-            mac.init(secretKey)
-            val signatureBytes = mac.doFinal(signPayload.toByteArray(Charsets.UTF_8))
-            val deviceSignature = Base64.getEncoder().encodeToString(signatureBytes)
-
-            // 2.5 生成 summary.json
-            val summaryMap = mapOf(
-                "orgId" to request.enterpriseId,
-                "checkId" to request.inspectionId,
-                "taskId" to request.taskId,
-                "licence" to request.licence,
-                "fingerprint" to request.fingerprint,
-                "deviceSignature" to deviceSignature,
-                "summary" to request.summary
-            )
-            val summaryContent = objectMapper.writeValueAsString(summaryMap).toByteArray(Charsets.UTF_8)
-
-            // 3. 生成 manifest.json
-            val filesHashes = mapOf(
-                "summary.json" to sha256Hex(summaryContent),
-                "assets.json" to assetsSha256,
-                "vulnerabilities.json" to vulnerabilitiesSha256,
-                "weakPasswords.json" to weakPasswordsSha256,
-                "漏洞评估报告.html" to reportHtmlSha256
-            )
-            val manifest = mapOf("files" to filesHashes)
-            val manifestContent = objectMapper.writeValueAsString(manifest).toByteArray(Charsets.UTF_8)
-
-            // 4. 生成 signature.asc
-            val privateKey = request.pgpPrivateKey?.takeIf { it.isNotBlank() } ?: DEFAULT_PGP_PRIVATE_KEY
-            val passphrase = request.pgpPassphrase ?: DEFAULT_PGP_PASSPHRASE
-            
-            val signatureAsc = try {
-                PgpSignatureUtil.generateDetachedSignature(
-                    manifestContent,
-                    privateKey,
-                    passphrase
-                )
-            } catch (e: Exception) {
-                throw RuntimeException("生成 PGP 签名失败: ${e.message}", e)
-            }
-
-            // 5. 打包 ZIP 文件到内存
-            val baos = java.io.ByteArrayOutputStream()
-            java.util.zip.ZipOutputStream(baos).use { zipOut ->
-                zipOut.putNextEntry(java.util.zip.ZipEntry("summary.json"))
-                zipOut.write(summaryContent)
-                zipOut.closeEntry()
-
-                zipOut.putNextEntry(java.util.zip.ZipEntry("assets.json"))
-                zipOut.write(assetsContent)
-                zipOut.closeEntry()
-
-                zipOut.putNextEntry(java.util.zip.ZipEntry("vulnerabilities.json"))
-                zipOut.write(vulnerabilitiesContent)
-                zipOut.closeEntry()
-
-                zipOut.putNextEntry(java.util.zip.ZipEntry("weakPasswords.json"))
-                zipOut.write(weakPasswordsContent)
-                zipOut.closeEntry()
-
-                zipOut.putNextEntry(java.util.zip.ZipEntry("漏洞评估报告.html"))
-                zipOut.write(reportHtmlContent)
-                zipOut.closeEntry()
-
-                zipOut.putNextEntry(java.util.zip.ZipEntry("META-INF/manifest.json"))
-                zipOut.write(manifestContent)
-                zipOut.closeEntry()
-
-                zipOut.putNextEntry(java.util.zip.ZipEntry("META-INF/signature.asc"))
-                zipOut.write(signatureAsc)
-                zipOut.closeEntry()
-            }
-
-            val zipBytes = baos.toByteArray()
-
-            // 6. 设置响应头并输出
-            response.contentType = "application/octet-stream"
-            response.setHeader("Content-Disposition", "attachment; filename=\"report_${request.taskId}.zip\"")
-            response.setHeader("Content-Length", zipBytes.size.toString())
-            response.outputStream.write(zipBytes)
-            response.outputStream.flush()
-        } catch (e: Exception) {
-            response.reset()
-            response.contentType = "application/json; charset=UTF-8"
-            response.writer.write("{\"code\": 500, \"msg\": \"生成 ZIP 文件失败: ${e.message}\"}")
-        }
-    }
-}
-

drizzle.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from 'drizzle-kit'
+import { env } from '@/env'
+
+export default defineConfig({
+  out: './drizzle',
+  schema: './src/db/schema/index.ts',
+  dialect: 'postgresql',
+  dbCredentials: {
+    url: env.DATABASE_URL,
+  },
+})

mise.toml

@@ -1,3 +1,4 @@
 [tools]
-bun = "1"
 node = "24"
+bun = "1"
+rust = 'latest'

package.json

@@ -1,72 +1,64 @@
 {
-  "name": "@furtherverse/monorepo",
+  "name": "fullstack-starter",
-  "version": "1.0.0",
   "private": true,
   "type": "module",
-  "workspaces": [
-    "apps/*",
-    "packages/*"
-  ],
   "scripts": {
-    "build": "turbo run build",
+    "build": "turbo build:tauri",
-    "compile": "turbo run compile",
+    "build:compile": "bun build.ts",
-    "compile:darwin": "turbo run compile:darwin",
+    "build:tauri": "NO_STRIP=1 tauri build",
-    "compile:linux": "turbo run compile:linux",
+    "build:vite": "vite build",
-    "compile:windows": "turbo run compile:windows",
+    "db:generate": "drizzle-kit generate",
-    "dev": "turbo run dev",
+    "db:migrate": "drizzle-kit migrate",
-    "dist": "turbo run dist",
+    "db:push": "drizzle-kit push",
-    "dist:linux": "turbo run dist:linux",
+    "db:studio": "drizzle-kit studio",
-    "dist:mac": "turbo run dist:mac",
+    "dev": "turbo dev:tauri",
-    "dist:win": "turbo run dist:win",
+    "dev:tauri": "tauri dev",
-    "fix": "turbo run fix",
+    "dev:vite": "vite dev",
-    "typecheck": "turbo run typecheck"
+    "fix": "biome check --write",
+    "typecheck": "tsc -b"
   },
-  "devDependencies": {
+  "dependencies": {
-    "@biomejs/biome": "^2.4.5",
+    "@orpc/client": "^1.13.4",
-    "turbo": "^2.8.13",
+    "@orpc/contract": "^1.13.4",
-    "typescript": "^5.9.3"
+    "@orpc/server": "^1.13.4",
-  },
+    "@orpc/tanstack-query": "^1.13.4",
-  "catalog": {
+    "@orpc/zod": "^1.13.4",
-    "@orpc/client": "^1.13.6",
-    "@orpc/contract": "^1.13.6",
-    "@orpc/openapi": "^1.13.6",
-    "@orpc/server": "^1.13.6",
-    "@orpc/tanstack-query": "^1.13.6",
-    "@orpc/zod": "^1.13.6",
     "@t3-oss/env-core": "^0.13.10",
-    "@tailwindcss/vite": "^4.2.1",
+    "@tanstack/react-query": "^5.90.20",
-    "@tanstack/devtools-vite": "^0.5.3",
+    "@tanstack/react-router": "^1.158.1",
-    "@tanstack/react-devtools": "^0.9.9",
+    "@tanstack/react-router-ssr-query": "^1.158.1",
-    "@tanstack/react-query": "^5.90.21",
+    "@tanstack/react-start": "^1.158.3",
-    "@tanstack/react-query-devtools": "^5.91.3",
+    "@tauri-apps/api": "^2.10.1",
-    "@tanstack/react-router": "^1.166.2",
+    "drizzle-orm": "^0.45.1",
-    "@tanstack/react-router-devtools": "^1.166.2",
+    "drizzle-zod": "^0.8.3",
-    "@tanstack/react-router-ssr-query": "^1.166.2",
+    "postgres": "^3.4.8",
-    "@tanstack/react-start": "^1.166.2",
-    "@types/bun": "^1.3.10",
-    "@types/node": "^24.11.0",
-    "@vitejs/plugin-react": "^5.1.4",
-    "babel-plugin-react-compiler": "^1.0.0",
-    "drizzle-kit": "1.0.0-beta.15-859cf75",
-    "drizzle-orm": "1.0.0-beta.15-859cf75",
-    "electron": "^34.0.0",
-    "electron-builder": "^26.8.1",
-    "electron-vite": "^5.0.0",
-    "jszip": "^3.10.1",
-    "motion": "^12.35.0",
-    "nitro": "npm:nitro-nightly@3.0.1-20260227-181935-bfbb207c",
-    "openpgp": "^6.0.1",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
-    "tailwindcss": "^4.2.1",
-    "tree-kill": "^1.2.2",
-    "uuid": "^13.0.0",
-    "vite": "^8.0.0-beta.16",
-    "vite-tsconfig-paths": "^6.1.1",
-    "systeminformation": "^5.31.3",
     "zod": "^4.3.6"
   },
+  "devDependencies": {
+    "@biomejs/biome": "^2.3.14",
+    "@effect/platform": "^0.94.3",
+    "@effect/schema": "^0.75.5",
+    "@tailwindcss/vite": "^4.1.18",
+    "@tanstack/devtools-vite": "^0.4.1",
+    "@tanstack/react-devtools": "^0.9.4",
+    "@tanstack/react-query-devtools": "^5.91.3",
+    "@tanstack/react-router-devtools": "^1.158.1",
+    "@tauri-apps/cli": "^2.10.0",
+    "@types/bun": "^1.3.8",
+    "@vitejs/plugin-react": "^5.1.3",
+    "babel-plugin-react-compiler": "^1.0.0",
+    "drizzle-kit": "^0.31.8",
+    "effect": "^3.19.16",
+    "nitro": "npm:nitro-nightly@latest",
+    "tailwindcss": "^4.1.18",
+    "turbo": "^2.8.3",
+    "typescript": "^5.9.3",
+    "vite": "^8.0.0-beta.13",
+    "vite-tsconfig-paths": "^6.0.5"
+  },
   "overrides": {
-    "@types/node": "catalog:"
+    "@tanstack/query-core": "^5.90.20"
   }
 }

packages/crypto/package.json

@@ -1,18 +0,0 @@
-{
-  "name": "@furtherverse/crypto",
-  "version": "1.0.0",
-  "private": true,
-  "type": "module",
-  "exports": {
-    ".": "./src/index.ts"
-  },
-  "dependencies": {
-    "node-forge": "^1.3.3",
-    "openpgp": "catalog:"
-  },
-  "devDependencies": {
-    "@furtherverse/tsconfig": "workspace:*",
-    "@types/bun": "catalog:",
-    "@types/node-forge": "^1.3.14"
-  }
-}

packages/crypto/src/aes-gcm.ts

@@ -1,53 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
-
-const GCM_IV_LENGTH = 12 // 96 bits
-const GCM_TAG_LENGTH = 16 // 128 bits
-const ALGORITHM = 'aes-256-gcm'
-
-/**
- * AES-256-GCM encrypt.
- *
- * Output format (before Base64): [IV (12 bytes)] + [ciphertext] + [auth tag (16 bytes)]
- *
- * @param plaintext - UTF-8 string to encrypt
- * @param key - 32-byte AES key
- * @returns Base64-encoded encrypted data
- */
-export const aesGcmEncrypt = (plaintext: string, key: Buffer): string => {
-  const iv = randomBytes(GCM_IV_LENGTH)
-  const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: GCM_TAG_LENGTH })
-
-  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()])
-  const tag = cipher.getAuthTag()
-
-  // Layout: IV + ciphertext + tag
-  const combined = Buffer.concat([iv, encrypted, tag])
-  return combined.toString('base64')
-}
-
-/**
- * AES-256-GCM decrypt.
- *
- * Input format (after Base64 decode): [IV (12 bytes)] + [ciphertext] + [auth tag (16 bytes)]
- *
- * @param encryptedBase64 - Base64-encoded encrypted data
- * @param key - 32-byte AES key
- * @returns Decrypted UTF-8 string
- */
-export const aesGcmDecrypt = (encryptedBase64: string, key: Buffer): string => {
-  const data = Buffer.from(encryptedBase64, 'base64')
-
-  if (data.length < GCM_IV_LENGTH + GCM_TAG_LENGTH) {
-    throw new Error('Encrypted data too short: must contain IV + tag at minimum')
-  }
-
-  const iv = data.subarray(0, GCM_IV_LENGTH)
-  const tag = data.subarray(data.length - GCM_TAG_LENGTH)
-  const ciphertext = data.subarray(GCM_IV_LENGTH, data.length - GCM_TAG_LENGTH)
-
-  const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: GCM_TAG_LENGTH })
-  decipher.setAuthTag(tag)
-
-  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()])
-  return decrypted.toString('utf-8')
-}

packages/crypto/src/hash.ts

@@ -1,15 +0,0 @@
-import { createHash } from 'node:crypto'
-
-/**
- * Compute SHA-256 hash and return raw Buffer.
- */
-export const sha256 = (data: string | Buffer): Buffer => {
-  return createHash('sha256').update(data).digest()
-}
-
-/**
- * Compute SHA-256 hash and return lowercase hex string.
- */
-export const sha256Hex = (data: string | Buffer): string => {
-  return createHash('sha256').update(data).digest('hex')
-}

packages/crypto/src/hkdf.ts

@@ -1,15 +0,0 @@
-import { hkdfSync } from 'node:crypto'
-
-/**
- * Derive a key using HKDF-SHA256.
- *
- * @param ikm - Input keying material (string, will be UTF-8 encoded)
- * @param salt - Salt value (string, will be UTF-8 encoded)
- * @param info - Info/context string (will be UTF-8 encoded)
- * @param length - Output key length in bytes (default: 32 for AES-256)
- * @returns Derived key as Buffer
- */
-export const hkdfSha256 = (ikm: string, salt: string, info: string, length = 32): Buffer => {
-  const derived = hkdfSync('sha256', ikm, salt, info, length)
-  return Buffer.from(derived)
-}

packages/crypto/src/hmac.ts

@@ -1,23 +0,0 @@
-import { createHmac } from 'node:crypto'
-
-/**
- * Compute HMAC-SHA256 and return Base64-encoded signature.
- *
- * @param key - HMAC key (Buffer)
- * @param data - Data to sign (UTF-8 string)
- * @returns Base64-encoded HMAC-SHA256 signature
- */
-export const hmacSha256Base64 = (key: Buffer, data: string): string => {
-  return createHmac('sha256', key).update(data, 'utf-8').digest('base64')
-}
-
-/**
- * Compute HMAC-SHA256 and return raw Buffer.
- *
- * @param key - HMAC key (Buffer)
- * @param data - Data to sign (UTF-8 string)
- * @returns HMAC-SHA256 digest as Buffer
- */
-export const hmacSha256 = (key: Buffer, data: string): Buffer => {
-  return createHmac('sha256', key).update(data, 'utf-8').digest()
-}

packages/crypto/src/index.ts

@@ -1,6 +0,0 @@
-export { aesGcmDecrypt, aesGcmEncrypt } from './aes-gcm'
-export { sha256, sha256Hex } from './hash'
-export { hkdfSha256 } from './hkdf'
-export { hmacSha256, hmacSha256Base64 } from './hmac'
-export { generatePgpKeyPair, pgpSignDetached, pgpVerifyDetached, validatePgpPrivateKey } from './pgp'
-export { rsaOaepEncrypt } from './rsa-oaep'

packages/crypto/src/pgp.ts

@@ -1,79 +0,0 @@
-import * as openpgp from 'openpgp'
-
-/**
- * Generate an OpenPGP RSA key pair.
- *
- * @param name - User name for the key
- * @param email - User email for the key
- * @returns ASCII-armored private and public keys
- */
-export const generatePgpKeyPair = async (
-  name: string,
-  email: string,
-): Promise<{ privateKey: string; publicKey: string }> => {
-  const { privateKey, publicKey } = await openpgp.generateKey({
-    type: 'rsa',
-    rsaBits: 2048,
-    userIDs: [{ name, email }],
-    format: 'armored',
-  })
-
-  return { privateKey, publicKey }
-}
-
-/**
- * Create a detached OpenPGP signature for the given data.
- *
- * @param data - Raw data to sign (Buffer or Uint8Array)
- * @param armoredPrivateKey - ASCII-armored private key
- * @returns ASCII-armored detached signature (signature.asc content)
- */
-export const validatePgpPrivateKey = async (armoredKey: string): Promise<void> => {
-  await openpgp.readPrivateKey({ armoredKey })
-}
-
-export const pgpSignDetached = async (data: Uint8Array, armoredPrivateKey: string): Promise<string> => {
-  const privateKey = await openpgp.readPrivateKey({ armoredKey: armoredPrivateKey })
-  const message = await openpgp.createMessage({ binary: data })
-
-  const signature = await openpgp.sign({
-    message,
-    signingKeys: privateKey,
-    detached: true,
-    format: 'armored',
-  })
-
-  return signature as string
-}
-
-/**
- * Verify a detached OpenPGP signature.
- *
- * @param data - Original data (Buffer or Uint8Array)
- * @param armoredSignature - ASCII-armored detached signature
- * @param armoredPublicKey - ASCII-armored public key
- * @returns true if signature is valid
- */
-export const pgpVerifyDetached = async (
-  data: Uint8Array,
-  armoredSignature: string,
-  armoredPublicKey: string,
-): Promise<boolean> => {
-  const publicKey = await openpgp.readKey({ armoredKey: armoredPublicKey })
-  const signature = await openpgp.readSignature({ armoredSignature })
-  const message = await openpgp.createMessage({ binary: data })
-
-  const verificationResult = await openpgp.verify({
-    message,
-    signature,
-    verificationKeys: publicKey,
-  })
-
-  const { verified } = verificationResult.signatures[0]!
-  try {
-    await verified
-    return true
-  } catch {
-    return false
-  }
-}

packages/crypto/src/rsa-oaep.ts

@@ -1,32 +0,0 @@
-import forge from 'node-forge'
-
-/**
- * RSA-OAEP encrypt with platform public key.
- *
- * Matches Java's {@code Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding")}
- * with **default SunJCE parameters**:
- *
- * | Parameter | Value  |
- * |-----------|--------|
- * | OAEP hash | SHA-256|
- * | MGF1 hash | SHA-1  |
- *
- * Node.js `crypto.publicEncrypt({ oaepHash })` ties both hashes together,
- * so we use `node-forge` which allows independent configuration.
- *
- * @param plaintext - UTF-8 string to encrypt
- * @param publicKeyBase64 - Platform RSA public key (X.509 / SPKI DER, Base64)
- * @returns Base64-encoded ciphertext
- */
-export const rsaOaepEncrypt = (plaintext: string, publicKeyBase64: string): string => {
-  const derBytes = forge.util.decode64(publicKeyBase64)
-  const asn1 = forge.asn1.fromDer(derBytes)
-  const publicKey = forge.pki.publicKeyFromAsn1(asn1) as forge.pki.rsa.PublicKey
-
-  const encrypted = publicKey.encrypt(plaintext, 'RSA-OAEP', {
-    md: forge.md.sha256.create(),
-    mgf1: { md: forge.md.sha1.create() },
-  })
-
-  return forge.util.encode64(encrypted)
-}

packages/crypto/tsconfig.json

@@ -1,7 +0,0 @@
-{
-  "extends": "@furtherverse/tsconfig/bun.json",
-  "compilerOptions": {
-    "rootDir": "src"
-  },
-  "include": ["src"]
-}

packages/tsconfig/base.json

@@ -1,26 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/tsconfig",
-  "display": "Base",
-  "compilerOptions": {
-    "target": "esnext",
-    "lib": ["ESNext"],
-    "module": "preserve",
-    "skipLibCheck": true,
-
-    "moduleResolution": "bundler",
-    "allowImportingTsExtensions": true,
-    "verbatimModuleSyntax": true,
-    "moduleDetection": "force",
-    "noEmit": true,
-
-    "strict": true,
-    "noUnusedLocals": false,
-    "noUnusedParameters": false,
-    "erasableSyntaxOnly": true,
-    "noFallthroughCasesInSwitch": true,
-    "noUncheckedSideEffectImports": true,
-    "noUncheckedIndexedAccess": true,
-    "noImplicitOverride": true
-  },
-  "exclude": ["node_modules"]
-}

packages/tsconfig/bun.json

@@ -1,8 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/tsconfig",
-  "display": "Bun",
-  "extends": "./base.json",
-  "compilerOptions": {
-    "types": ["bun-types"]
-  }
-}

packages/tsconfig/package.json

@@ -1,11 +0,0 @@
-{
-  "name": "@furtherverse/tsconfig",
-  "version": "1.0.0",
-  "private": true,
-  "type": "module",
-  "exports": {
-    "./base.json": "./base.json",
-    "./bun.json": "./bun.json",
-    "./react.json": "./react.json"
-  }
-}

packages/tsconfig/react.json

@@ -1,9 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/tsconfig",
-  "display": "React",
-  "extends": "./base.json",
-  "compilerOptions": {
-    "lib": ["ESNext", "DOM", "DOM.Iterable"],
-    "jsx": "react-jsx"
-  }
-}

src-tauri/.gitignore

@@ -0,0 +1,10 @@
+# Generated by Cargo
+# will have compiled files and executables
+/target/
+
+# Generated by Tauri
+# will have schema files for capabilities auto-completion
+/gen/schemas
+
+# Tauri Sidecar
+binaries/

src-tauri/AGENTS.md

@@ -0,0 +1,357 @@
+# AGENTS.md - Tauri Shell 项目开发指南
+
+本文档为 AI 编程助手和开发者提供项目规范、构建命令和代码风格指南。
+
+## 项目概览
+
+- **项目类型**: Tauri v2 桌面应用（轻量级壳子）
+- **后端**: Rust (Edition 2021)
+- **架构**: Sidecar 模式 - Sidecar App 承载主要业务逻辑
+- **设计理念**: Tauri 仅提供原生桌面能力（文件对话框、系统通知等），Web 逻辑全部由 Sidecar App 处理
+- **开发模式**: 使用 localhost:3000（需手动启动开发服务器）
+- **生产模式**: 自动启动 Sidecar 二进制
+- **异步运行时**: Tokio
+- **Rust 版本**: 1.92.0+
+- **工具管理**: 使用 mise 管理 Rust 和 Tauri CLI 版本（见 `mise.toml`）
+
+## 构建、测试、运行命令
+
+### 开发运行
+```bash
+# 开发模式运行 (需要先启动开发服务器)
+# 终端 1: 启动前端开发服务器
+bun run dev
+
+# 终端 2: 启动 Tauri 应用
+tauri dev
+
+# 或者使用单命令并行启动（需要配置 package.json）
+bun run dev:tauri
+```
+
+**开发模式说明**：
+- 开发模式下，Tauri 直接连接到 `localhost:3000`（不启动 sidecar 二进制）
+- 需要手动运行 `bun run dev` 来启动开发服务器
+- 支持热重载（HMR），无需重启 Tauri 应用
+
+### 构建
+```bash
+# 开发构建 (debug mode)
+cargo build
+
+# 生产构建
+cargo build --release
+
+# Tauri 应用打包 (生成安装程序)
+tauri build
+```
+
+### 代码检查
+```bash
+# 编译检查 (不生成二进制)
+cargo check
+
+# Clippy 代码质量检查
+cargo clippy
+
+# Clippy 严格模式 (所有警告视为错误)
+cargo clippy -- -D warnings
+
+# 代码格式化检查
+cargo fmt -- --check
+
+# 自动格式化代码
+cargo fmt
+```
+
+### 测试
+```bash
+# 运行所有测试
+cargo test
+
+# 运行单个测试 (按名称过滤)
+cargo test test_function_name
+
+# 运行特定模块的测试
+cargo test module_name::
+
+# 显示测试输出 (包括 println!)
+cargo test -- --nocapture
+
+# 运行单个测试并显示输出
+cargo test test_name -- --nocapture
+```
+
+### 清理
+```bash
+# 清理构建产物
+cargo clean
+```
+
+## 项目结构
+
+```
+app-desktop/
+├── src/
+│   ├── main.rs          # 入口文件 (仅调用 lib::run)
+│   ├── lib.rs           # 核心应用逻辑 (注册插件、命令、状态)
+│   ├── commands/
+│   │   └── mod.rs       # 原生桌面功能命令 (文件对话框、通知等)
+│   └── sidecar.rs       # Sidecar 进程管理 (启动、端口扫描、清理)
+├── binaries/            # Sidecar 二进制文件
+│   └── app-*   # Sidecar App 可执行文件 (示例: app)
+├── capabilities/        # Tauri v2 权限配置
+│   └── default.json
+├── icons/               # 应用图标资源
+├── gen/schemas/         # 自动生成的 Schema (不要手动编辑)
+├── Cargo.toml          # Rust 项目配置
+├── tauri.conf.json     # Tauri 应用配置
+├── build.rs            # Rust 构建脚本
+└── mise.toml           # 开发工具版本管理
+```
+
+## Rust 代码风格指南
+
+### 导入 (Imports)
+
+- 使用标准库、外部 crate、当前 crate 的顺序，用空行分隔
+- 按字母顺序排列
+- 优先使用具体导入而非通配符 `*`
+
+```rust
+// ✅ 推荐
+use std::sync::Mutex;
+use std::time::Duration;
+
+use tauri::Manager;
+use tauri_plugin_shell::ShellExt;
+use tauri_plugin_shell::process::{CommandEvent, CommandChild};
+
+// ❌ 避免
+use tauri::*;
+```
+
+### 命名规范
+
+- **函数和变量**: `snake_case`
+- **类型、结构体、枚举、Trait**: `PascalCase`
+- **常量和静态变量**: `SCREAMING_SNAKE_CASE`
+- **生命周期参数**: 简短小写字母，如 `'a`, `'b`
+
+```rust
+// ✅ 推荐
+struct SidecarProcess(Mutex<Option<CommandChild>>);
+const DEFAULT_PORT: u16 = 3000;
+async fn find_available_port(start: u16) -> u16 { }
+
+// ❌ 避免
+struct sidecar_process { }
+const defaultPort: u16 = 3000;
+```
+
+### 类型注解
+
+- 函数参数必须有类型注解
+- 函数返回值必须明确声明 (除非返回 `()`)
+- 优先使用具体类型而非 `impl Trait` (除非必要)
+- 使用 `&str` 而非 `String` 作为只读字符串参数
+
+```rust
+// ✅ 推荐
+#[tauri::command]
+fn greet(name: &str) -> String {
+    format!("Hello, {}!", name)
+}
+
+async fn is_port_available(port: u16) -> bool {
+    tokio::net::TcpListener::bind(format!("127.0.0.1:{}", port))
+        .await
+        .is_ok()
+}
+```
+
+### 错误处理
+
+- 使用 `Result<T, E>` 返回可能失败的操作
+- 使用 `expect()` 时提供有意义的错误消息 (中文)
+- 避免 `unwrap()` 在生产代码中，除非逻辑上保证不会 panic
+- 使用 `?` 操作符传播错误
+- 记录关键错误信息到控制台
+
+```rust
+// ✅ 推荐
+let sidecar = app_handle
+    .shell()
+    .sidecar("app")
+    .expect("无法找到 app sidecar");
+
+let (mut rx, child) = sidecar.spawn().expect("启动 sidecar 失败");
+
+// 日志记录
+eprintln!("✗ Sidecar App 启动失败");
+println!("✓ Sidecar App 启动成功！");
+
+// ❌ 避免
+let data = read_file().unwrap();  // 无上下文信息
+```
+
+### 异步代码
+
+- 使用 `async/await` 而非手动创建 Future
+- Tauri 内部使用 `tauri::async_runtime::spawn` 启动异步任务
+- 使用 Tokio 的异步 API (如 `tokio::net::TcpListener`)
+- 避免阻塞异步运行时 (使用 `tokio::task::spawn_blocking`)
+
+```rust
+// ✅ 推荐
+tauri::async_runtime::spawn(async move {
+    let port = find_available_port(3000).await;
+    // ...
+});
+```
+
+### 格式化
+
+- 使用 `cargo fmt` 自动格式化
+- 缩进: 4 空格
+- 行宽: 100 字符 (rustfmt 默认)
+- 结构体和枚举的字段每行一个 (如果超过一定长度)
+- 链式调用适当换行提高可读性
+
+### 注释
+
+- 使用中文注释说明复杂逻辑
+- 代码块前添加简短说明注释
+- 避免显而易见的注释
+
+```rust
+// ✅ 推荐
+// 全局状态：存储 Sidecar App 进程句柄
+struct SidecarProcess(Mutex<Option<CommandChild>>);
+
+// 检查端口是否可用
+async fn is_port_available(port: u16) -> bool { }
+```
+
+## Tauri 特定规范
+
+### 模块组织
+
+- **`lib.rs`**: 主入口，负责注册插件、命令、状态管理
+- **`commands/mod.rs`**: 所有 Tauri 命令集中定义，命令必须是 `pub fn`
+- **`sidecar.rs`**: Sidecar 进程管理逻辑，导出公共 API（`spawn_sidecar`, `cleanup_sidecar_process`）
+
+```rust
+// lib.rs - 模块声明
+mod commands;
+mod sidecar;
+
+use sidecar::SidecarProcess;
+
+// 注册命令时使用模块路径
+.invoke_handler(tauri::generate_handler![commands::greet])
+```
+
+### 命令定义
+
+- 使用 `#[tauri::command]` 宏标记命令
+- 命令函数必须是公开的或在 `invoke_handler` 中注册
+- 参数类型必须实现 `serde::Deserialize`
+- 返回类型必须实现 `serde::Serialize`
+
+```rust
+#[tauri::command]
+fn greet(name: &str) -> String {
+    format!("Hello, {}!", name)
+}
+
+// 在 Builder 中注册
+.invoke_handler(tauri::generate_handler![greet])
+```
+
+### 状态管理
+
+- 使用 `app.manage()` 注册全局状态
+- 状态必须实现 `Send + Sync`
+- 使用 `Mutex` 或 `RwLock` 保证线程安全
+
+```rust
+struct SidecarProcess(Mutex<Option<CommandChild>>);
+
+// 注册状态
+app.manage(SidecarProcess(Mutex::new(None)));
+
+// 访问状态
+if let Some(state) = app_handle.try_state::<SidecarProcess>() {
+    *state.0.lock().unwrap() = Some(child);
+}
+```
+
+### Sidecar 进程管理
+
+- Sidecar 二进制必须在 `tauri.conf.json` 的 `bundle.externalBin` 中声明
+- 使用 `app.shell().sidecar()` 启动 sidecar
+- 在应用退出时清理子进程 (监听 `RunEvent::ExitRequested`)
+
+```rust
+// 启动 sidecar
+let sidecar = app_handle
+    .shell()
+    .sidecar("app")
+    .expect("无法找到 app sidecar")
+    .env("PORT", port.to_string());
+
+// 清理进程
+match event {
+    tauri::RunEvent::ExitRequested { .. } | tauri::RunEvent::Exit => {
+        if let Some(child) = process.take() {
+            let _ = child.kill();
+        }
+    }
+    _ => {}
+}
+```
+
+## 依赖管理
+
+- 在 `Cargo.toml` 中明确声明依赖版本
+- 使用语义化版本 (如 `"2"` 表示兼容 2.x.x)
+- 仅启用需要的 feature 以减少编译时间和二进制大小
+
+```toml
+tauri = { version = "2", features = [] }
+tauri-plugin-opener = "2"
+tauri-plugin-shell = "2"
+serde = { version = "1", features = ["derive"] }
+tokio = { version = "1", features = ["net"] }
+```
+
+## 开发工具
+
+推荐安装以下 VSCode 扩展:
+- `tauri-apps.tauri-vscode` - Tauri 官方支持
+- `rust-lang.rust-analyzer` - Rust 语言服务器
+
+## 最佳实践
+
+1. **开发环境配置**: 
+   - 开发模式下需先启动前端开发服务器（`bun run dev`），再启动 Tauri（`tauri dev`）
+   - 生产构建自动打包 sidecar 二进制，无需额外配置
+2. **进程生命周期**: 始终在应用退出时清理子进程和资源
+3. **端口管理**: 
+   - 开发模式固定使用 3000 端口（与开发服务器匹配）
+   - 生产模式使用端口扫描避免硬编码端口冲突
+4. **超时处理**: 异步操作设置合理的超时时间 (如 5 秒)
+5. **日志**: 使用表情符号 (✓/✗/🔧/🚀) 和中文消息提供清晰的状态反馈
+6. **错误退出**: 关键错误时调用 `std::process::exit(1)`
+7. **窗口配置**: 使用 `WebviewWindowBuilder` 动态创建窗口
+
+## 提交代码前检查清单
+
+- [ ] `cargo fmt` 格式化通过
+- [ ] `cargo clippy` 无警告
+- [ ] `cargo check` 编译通过
+- [ ] `cargo test` 测试通过
+- [ ] 更新相关注释和文档
+- [ ] 检查是否有 `unwrap()` 需要替换为 `expect()`
+- [ ] 验证 Tauri 应用正常启动和退出

src-tauri/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "app-desktop"
+version = "0.1.0"
+description = "A Tauri App"
+authors = ["imbytecat"]
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[lib]
+# The `_lib` suffix may seem redundant but it is necessary
+# to make the lib name unique and wouldn't conflict with the bin name.
+# This seems to be only an issue on Windows, see https://github.com/rust-lang/cargo/issues/8519
+name = "app_desktop_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = [] }
+tauri-plugin-shell = "2"
+serde = { version = "1", features = ["derive"] }
+tokio = { version = "1", features = ["net"] }

src-tauri/build.rs

@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build()
+}

src-tauri/capabilities/default.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Capability for the main window",
+  "windows": ["main"],
+  "local": true,
+  "remote": {
+    "urls": [
+      "http://localhost:*",
+      "http://127.0.0.1:*",
+      "http{s}?://localhost(:\\d+)?/*"
+    ]
+  },
+  "permissions": [
+    "core:default",
+    "core:window:allow-set-title",
+    {
+      "identifier": "shell:allow-execute",
+      "allow": [
+        {
+          "name": "binaries/app",
+          "sidecar": true
+        }
+      ]
+    }
+  ]
+}