refactor(server): extract ZIP security checks into reusable safe-zip module

Node.js publicEncrypt({ oaepHash }) 会将 OAEP hash 和 MGF1 hash
绑定为同一算法，而 Java OAEPWithSHA-256AndMGF1Padding 默认使用
SHA-256(OAEP) + SHA-1(MGF1)。改用 node-forge 独立配置两个哈希，
确保密文可被管理平台正确解密。

.gitignore

@@ -9,6 +9,11 @@
 # Bun build
 *.bun-build
 
+# SQLite database files
+*.db
+*.db-wal
+*.db-shm
+
 # Turborepo
 .turbo/
 

.vscode/extensions.json

@@ -2,11 +2,8 @@
   "recommendations": [
     "biomejs.biome",
     "hverlin.mise-vscode",
-    "mikestead.dotenv",
     "oven.bun-vscode",
     "redhat.vscode-yaml",
-    "rust-lang.rust-analyzer",
-    "tamasfe.even-better-toml",
-    "tauri-apps.tauri-vscode"
+    "tamasfe.even-better-toml"
   ]
 }

.vscode/settings.json

@@ -1,49 +1,42 @@
 {
-  // Disable the default formatter & linter, use biome instead
-  "prettier.enable": false,
-  "eslint.enable": false,
-
-  // Auto fix
-  "editor.codeActionsOnSave": {
-    "source.fixAll.biome": "explicit",
-    "source.organizeImports.biome": "explicit"
-  },
-  "editor.defaultFormatter": "biomejs.biome",
-  "editor.formatOnSave": true,
   "[javascript]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
   "[javascriptreact]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
-  "[typescript]": {
-    "editor.defaultFormatter": "biomejs.biome"
-  },
-  "[typescriptreact]": {
-    "editor.defaultFormatter": "biomejs.biome"
-  },
   "[json]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
   "[jsonc]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
-  "[yaml]": {
-    "editor.defaultFormatter": "redhat.vscode-yaml"
-  },
   "[toml]": {
     "editor.defaultFormatter": "tamasfe.even-better-toml"
   },
+  "[typescript]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "biomejs.biome"
+  },
+  "[yaml]": {
+    "editor.defaultFormatter": "redhat.vscode-yaml"
+  },
+  "editor.codeActionsOnSave": {
+    "source.fixAll.biome": "explicit",
+    "source.organizeImports.biome": "explicit"
+  },
+  "editor.defaultFormatter": "biomejs.biome",
+  "editor.formatOnSave": true,
   "files.associations": {
     ".env": "dotenv",
     ".env.*": "dotenv",
-    "**/tsconfig.json": "jsonc",
-    "**/tsconfig.*.json": "jsonc",
     "**/biome.json": "jsonc",
-    "**/opencode.json": "jsonc"
+    "**/opencode.json": "jsonc",
+    "**/tsconfig.*.json": "jsonc",
+    "**/tsconfig.json": "jsonc"
   },
-
-  // TanStack Router
   "files.readonlyInclude": {
     "**/routeTree.gen.ts": true
   },

AGENTS.md

@@ -0,0 +1,219 @@
+# AGENTS.md - AI Coding Agent Guidelines
+
+Guidelines for AI agents working in this Bun monorepo.
+
+## Project Overview
+
+> **This project uses [Bun](https://bun.sh) exclusively as both the JavaScript runtime and package manager. Do NOT use Node.js / npm / yarn / pnpm. All commands start with `bun` — use `bun install` for dependencies and `bun run <script>` for scripts. Always prefer `bun run <script>` over `bun <script>` to avoid conflicts with Bun built-in subcommands (e.g. `bun build` invokes Bun's bundler, NOT your package.json script). Never use `npm`, `npx`, or `node`.**
+
+- **Monorepo**: Bun workspaces + Turborepo orchestration
+- **Runtime**: Bun (see `mise.toml` for version) — **NOT Node.js**
+- **Package Manager**: Bun — **NOT npm / yarn / pnpm**
+- **Apps**:
+  - `apps/server` - TanStack Start fullstack web app (see `apps/server/AGENTS.md`)
+  - `apps/desktop` - Electron desktop shell, sidecar server pattern (see `apps/desktop/AGENTS.md`)
+- **Packages**: `packages/tsconfig` (shared TS configs)
+
+## Build / Lint / Test Commands
+
+### Root Commands (via Turbo)
+```bash
+bun run dev              # Start all apps in dev mode
+bun run build            # Build all apps
+bun run compile          # Compile server to standalone binary (current platform)
+bun run compile:darwin   # Compile server for macOS (arm64 + x64)
+bun run compile:linux    # Compile server for Linux (x64 + arm64)
+bun run compile:windows  # Compile server for Windows x64
+bun run dist             # Package desktop distributable (current platform)
+bun run dist:linux       # Package desktop for Linux (x64 + arm64)
+bun run dist:mac         # Package desktop for macOS (arm64 + x64)
+bun run dist:win         # Package desktop for Windows x64
+bun run fix              # Lint + format (Biome auto-fix)
+bun run typecheck        # TypeScript check across monorepo
+```
+
+### Server App (`apps/server`)
+```bash
+bun run dev                   # Vite dev server (localhost:3000)
+bun run build                 # Production build -> .output/
+bun run compile               # Compile to standalone binary (current platform)
+bun run compile:darwin        # Compile for macOS (arm64 + x64)
+bun run compile:darwin:arm64  # Compile for macOS arm64
+bun run compile:darwin:x64    # Compile for macOS x64
+bun run compile:linux         # Compile for Linux (x64 + arm64)
+bun run compile:linux:arm64   # Compile for Linux arm64
+bun run compile:linux:x64     # Compile for Linux x64
+bun run compile:windows       # Compile for Windows (default: x64)
+bun run compile:windows:x64   # Compile for Windows x64
+bun run fix                   # Biome auto-fix
+bun run typecheck             # TypeScript check
+
+# Database (Drizzle)
+bun run db:generate           # Generate migrations from schema
+bun run db:migrate            # Run migrations
+bun run db:push               # Push schema (dev only)
+bun run db:studio             # Open Drizzle Studio
+```
+
+### Desktop App (`apps/desktop`)
+```bash
+bun run dev                   # electron-vite dev mode (requires server dev running)
+bun run build                 # electron-vite build (main + preload)
+bun run dist                  # Build + package for current platform
+bun run dist:linux            # Build + package for Linux (x64 + arm64)
+bun run dist:linux:x64        # Build + package for Linux x64
+bun run dist:linux:arm64      # Build + package for Linux arm64
+bun run dist:mac              # Build + package for macOS (arm64 + x64)
+bun run dist:mac:arm64        # Build + package for macOS arm64
+bun run dist:mac:x64          # Build + package for macOS x64
+bun run dist:win              # Build + package for Windows x64
+bun run fix                   # Biome auto-fix
+bun run typecheck             # TypeScript check
+```
+
+### Testing
+No test framework configured yet. When adding tests:
+```bash
+bun test path/to/test.ts              # Run single test file
+bun test -t "pattern"                 # Run tests matching pattern
+```
+
+## Code Style (TypeScript)
+
+### Formatting (Biome)
+- **Indent**: 2 spaces | **Line endings**: LF
+- **Quotes**: Single `'` | **Semicolons**: Omit (ASI)
+- **Arrow parentheses**: Always `(x) => x`
+
+### Imports
+Biome auto-organizes. Order: 1) External packages → 2) Internal `@/*` aliases → 3) Type imports (`import type { ... }`)
+
+```typescript
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { db } from '@/server/db'
+import type { ReactNode } from 'react'
+```
+
+### TypeScript Strictness
+- `strict: true`, `noUncheckedIndexedAccess: true`, `noImplicitOverride: true`, `verbatimModuleSyntax: true`
+- Use `@/*` path aliases (maps to `src/*`)
+
+### Naming Conventions
+| Type | Convention | Example |
+|------|------------|---------|
+| Files (utils) | kebab-case | `auth-utils.ts` |
+| Files (components) | PascalCase | `UserProfile.tsx` |
+| Components | PascalCase arrow | `const Button = () => {}` |
+| Functions | camelCase | `getUserById` |
+| Constants | UPPER_SNAKE | `MAX_RETRIES` |
+| Types/Interfaces | PascalCase | `UserProfile` |
+
+### React Patterns
+- Components: arrow functions (enforced by Biome)
+- Routes: TanStack Router file conventions (`export const Route = createFileRoute(...)`)
+- Data fetching: `useSuspenseQuery(orpc.feature.list.queryOptions())`
+- Let React Compiler handle memoization (no manual `useMemo`/`useCallback`)
+
+### Error Handling
+- Use `try-catch` for async operations; throw descriptive errors
+- ORPC: Use `ORPCError` with proper codes (`NOT_FOUND`, `INPUT_VALIDATION_FAILED`)
+- Never use empty catch blocks
+
+## Database (Drizzle ORM v1 beta + postgres-js)
+
+- **ORM**: Drizzle ORM `1.0.0-beta` (RQBv2)
+- **Driver**: `drizzle-orm/postgres-js` (NOT `bun-sql`)
+- **Validation**: `drizzle-orm/zod` (built-in, NOT separate `drizzle-zod` package)
+- **Relations**: Defined via `defineRelations()` in `src/server/db/relations.ts` (contains schema info, so `drizzle()` only needs `{ relations }`)
+- **Query style**: RQBv2 object syntax (`orderBy: { createdAt: 'desc' }`, `where: { id: 1 }`)
+
+```typescript
+export const myTable = pgTable('my_table', {
+  id: uuid().primaryKey().default(sql`uuidv7()`),
+  name: text().notNull(),
+  createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow().$onUpdateFn(() => new Date()),
+})
+```
+
+## Environment Variables
+
+- Use `@t3-oss/env-core` with Zod validation in `src/env.ts`
+- Server vars: no prefix | Client vars: `VITE_` prefix required
+- Never commit `.env` files
+
+## Dependency Management
+
+- All versions centralized in root `package.json` `catalog` field
+- Workspace packages use `"catalog:"` — never hardcode versions
+- Internal packages use `"workspace:*"` references
+
+## Development Principles
+
+> **These principles apply to ALL code changes. Agents MUST follow them on every task.**
+
+1. **No backward compatibility** — This project is in rapid iteration. Always use the latest API and patterns. Never keep deprecated code paths or old API fallbacks "just in case".
+2. **Always sync documentation** — When code changes, immediately update all related documentation (`AGENTS.md`, `README.md`, inline code examples). Code and docs must never drift apart. This includes updating code snippets in docs when imports, APIs, or patterns change.
+3. **Forward-only migration** — When upgrading dependencies, fully adopt the new API. Don't mix old and new patterns in the same codebase.
+
+## Critical Rules
+
+**DO:**
+- Run `bun run fix` before committing
+- Use `@/*` path aliases (not relative imports)
+- Include `createdAt`/`updatedAt` on all tables
+- Use `catalog:` for dependency versions
+- Update `AGENTS.md` and other docs whenever code patterns change
+
+**DON'T:**
+- Use `npm`, `npx`, `node`, `yarn`, `pnpm` — always use `bun` / `bunx`
+- Edit `src/routeTree.gen.ts` (auto-generated)
+- Use `as any`, `@ts-ignore`, `@ts-expect-error`
+- Commit `.env` files
+- Use empty catch blocks `catch(e) {}`
+- Hardcode dependency versions in workspace packages
+- Leave docs out of sync with code changes
+
+## Git Workflow
+
+1. Make changes following style guide
+2. `bun run fix` - auto-format and lint
+3. `bun run typecheck` - verify types
+4. `bun run dev` - test locally
+5. Commit with descriptive message
+
+## Directory Structure
+
+```
+.
+├── apps/
+│   ├── server/           # TanStack Start fullstack app
+│   │   ├── src/
+│   │   │   ├── client/   # ORPC client + TanStack Query utils
+│   │   │   ├── components/
+│   │   │   ├── routes/   # File-based routing
+│   │   │   └── server/   # API layer + database
+│   │   │       ├── api/  # ORPC contracts, routers, middlewares
+│   │   │       └── db/   # Drizzle schema
+│   │   └── AGENTS.md
+│   └── desktop/          # Electron desktop shell
+│       ├── src/
+│       │   ├── main/
+│       │   │   └── index.ts       # Main process entry
+│       │   └── preload/
+│       │       └── index.ts       # Preload script
+│       ├── electron.vite.config.ts
+│       ├── electron-builder.yml   # Packaging config
+│       └── AGENTS.md
+├── packages/
+│   └── tsconfig/         # Shared TS configs
+├── biome.json            # Linting/formatting config
+├── turbo.json            # Turbo task orchestration
+└── package.json          # Workspace root + dependency catalog
+```
+
+## See Also
+
+- `apps/server/AGENTS.md` - Detailed TanStack Start / ORPC patterns
+- `apps/desktop/AGENTS.md` - Electron desktop development guide

apps/desktop/.gitignore

@@ -1,24 +1,3 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-pnpm-debug.log*
-lerna-debug.log*
-
-node_modules
-dist
-dist-ssr
-*.local
-
-# Editor directories and files
-.vscode/*
-!.vscode/extensions.json
-.idea
-.DS_Store
-*.suo
-*.ntvs*
-*.njsproj
-*.sln
-*.sw?
+# electron-vite build output
+out/
+dist/

apps/desktop/AGENTS.md

@@ -0,0 +1,95 @@
+# AGENTS.md - Desktop App Guidelines
+
+Thin Electron shell hosting the fullstack server app.
+
+## Tech Stack
+
+> **⚠️ This project uses Bun as the package manager. Runtime is Electron (Node.js). Always use `bun run <script>` (not `bun <script>`) to avoid conflicts with Bun built-in subcommands. Never use `npm`, `npx`, `yarn`, or `pnpm`.**
+
+- **Type**: Electron desktop shell
+- **Design**: Server-driven desktop (thin native window hosting web app)
+- **Runtime**: Electron (Main/Renderer) + Sidecar server binary (Bun-compiled)
+- **Build Tool**: electron-vite (Vite-based, handles main + preload builds)
+- **Packager**: electron-builder (installers, signing, auto-update)
+- **Orchestration**: Turborepo
+
+## Architecture
+
+- **Server-driven design**: The desktop app is a "thin" native shell. It does not contain UI or business logic; it opens a BrowserWindow pointing to the `apps/server` TanStack Start application.
+- **Dev mode**: Opens a BrowserWindow pointing to `localhost:3000`. Requires `apps/server` to be running separately (Turbo handles this).
+- **Production mode**: Spawns a compiled server binary (from `resources/`) as a sidecar process, waits for readiness, then loads its URL.
+
+## Commands
+
+```bash
+bun run dev                    # electron-vite dev (requires server dev running)
+bun run build                  # electron-vite build (main + preload)
+bun run dist                   # Build + package for current platform
+bun run dist:linux             # Build + package for Linux (x64 + arm64)
+bun run dist:linux:x64         # Build + package for Linux x64
+bun run dist:linux:arm64       # Build + package for Linux arm64
+bun run dist:mac               # Build + package for macOS (arm64 + x64)
+bun run dist:mac:arm64         # Build + package for macOS arm64
+bun run dist:mac:x64           # Build + package for macOS x64
+bun run dist:win               # Build + package for Windows x64
+bun run fix                    # Biome auto-fix
+bun run typecheck              # TypeScript check
+```
+
+## Directory Structure
+
+```
+.
+├── src/
+│   ├── main/
+│   │   └── index.ts       # Main process (server lifecycle + BrowserWindow)
+│   └── preload/
+│       └── index.ts       # Preload script (security isolation)
+├── resources/             # Sidecar binaries (gitignored, copied from server build)
+├── out/                   # electron-vite build output (gitignored)
+├── electron.vite.config.ts
+├── electron-builder.yml   # Packaging configuration
+├── package.json
+├── turbo.json
+└── AGENTS.md
+```
+
+## Development Workflow
+
+1. **Start server**: `bun run dev` in `apps/server` (or use root `bun run dev` via Turbo).
+2. **Start desktop**: `bun run dev` in `apps/desktop`.
+3. **Connection**: Main process polls `localhost:3000` until responsive, then opens BrowserWindow.
+
+## Production Build Workflow
+
+From monorepo root, run `bun run dist` to execute the full pipeline automatically (via Turbo task dependencies):
+
+1. **Build server**: `apps/server` → `vite build` → `.output/`
+2. **Compile server**: `apps/server` → `bun compile.ts --target ...` → `out/server-{os}-{arch}`
+3. **Package desktop**: `apps/desktop` → `electron-vite build` + `electron-builder` → distributable
+
+The `electron-builder.yml` `extraResources` config reads binaries directly from `../server/out/`, no manual copy needed.
+
+To build for a specific platform explicitly, use `bun run dist:linux` / `bun run dist:mac` / `bun run dist:win` in `apps/desktop`.
+For single-arch output, use `bun run dist:linux:x64`, `bun run dist:linux:arm64`, `bun run dist:mac:x64`, or `bun run dist:mac:arm64`.
+
+## Development Principles
+
+> **These principles apply to ALL code changes. Agents MUST follow them on every task.**
+
+1. **No backward compatibility** — This project is in rapid iteration. Always use the latest API and patterns. Never keep deprecated code paths or old API fallbacks.
+2. **Always sync documentation** — When code changes, immediately update all related documentation (`AGENTS.md`, `README.md`, inline code examples). Code and docs must never drift apart.
+3. **Forward-only migration** — When upgrading dependencies, fully adopt the new API. Don't mix old and new patterns.
+
+## Critical Rules
+
+**DO:**
+- Use arrow functions for all utility functions.
+- Keep the desktop app as a thin shell — no UI or business logic.
+- Use `catalog:` for all dependency versions in `package.json`.
+
+**DON'T:**
+- Use `npm`, `npx`, `yarn`, or `pnpm`. Use `bun` for package management.
+- Include UI components or business logic in the desktop app.
+- Use `as any` or `@ts-ignore`.
+- Leave docs out of sync with code changes.

apps/desktop/biome.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../../node_modules/@biomejs/biome/configuration_schema.json",
+  "extends": "//",
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    }
+  }
+}

apps/desktop/copy.ts

@@ -1,470 +0,0 @@
-import * as path from 'node:path'
-import { Schema } from '@effect/schema'
-import { $ } from 'bun'
-import { Console, Context, Data, Effect, Layer } from 'effect'
-
-// ============================================================================
-// Domain Models & Schema
-// ============================================================================
-
-/**
- * Bun 构建目标后缀
- */
-const BunTargetSuffixSchema = Schema.Literal(
-  'windows-x64',
-  'darwin-arm64',
-  'darwin-x64',
-  'linux-x64',
-  'linux-arm64',
-)
-
-/**
- * Tauri sidecar 目标三元组
- */
-const TauriTargetSchema = Schema.Literal(
-  'x86_64-pc-windows-msvc',
-  'aarch64-apple-darwin',
-  'x86_64-apple-darwin',
-  'x86_64-unknown-linux-gnu',
-  'aarch64-unknown-linux-gnu',
-)
-
-/**
- * 目标映射配置
- */
-const TargetMappingSchema = Schema.Struct({
-  bunSuffix: BunTargetSuffixSchema,
-  tauriTarget: TauriTargetSchema,
-})
-
-type TargetMapping = Schema.Schema.Type<typeof TargetMappingSchema>
-
-/**
- * 复制配置
- */
-const CopyConfigSchema = Schema.Struct({
-  sourceDir: Schema.String.pipe(Schema.nonEmptyString()),
-  targetDir: Schema.String.pipe(Schema.nonEmptyString()),
-  baseName: Schema.String.pipe(Schema.nonEmptyString()),
-  mappings: Schema.Array(TargetMappingSchema).pipe(Schema.minItems(1)),
-})
-
-type CopyConfig = Schema.Schema.Type<typeof CopyConfigSchema>
-
-/**
- * 复制结果
- */
-const CopyResultSchema = Schema.Struct({
-  bunSuffix: BunTargetSuffixSchema,
-  tauriTarget: TauriTargetSchema,
-  sourceFile: Schema.String,
-  targetFile: Schema.String,
-  success: Schema.Boolean,
-})
-
-type CopyResult = Schema.Schema.Type<typeof CopyResultSchema>
-
-// ============================================================================
-// Error Models
-// ============================================================================
-
-class ConfigError extends Data.TaggedError('ConfigError')<{
-  readonly message: string
-  readonly cause: unknown
-}> {}
-
-class FileSystemError extends Data.TaggedError('FileSystemError')<{
-  readonly operation: string
-  readonly path: string
-  readonly cause: unknown
-}> {}
-
-class CopyError extends Data.TaggedError('CopyError')<{
-  readonly source: string
-  readonly target: string
-  readonly cause: unknown
-}> {}
-
-// ============================================================================
-// Services
-// ============================================================================
-
-/**
- * 配置服务
- */
-class CopyConfigService extends Context.Tag('CopyConfigService')<
-  CopyConfigService,
-  CopyConfig
->() {
-  /**
-   * 从原始数据创建并验证配置
-   */
-  static fromRaw = (raw: unknown) =>
-    Effect.gen(function* () {
-      const decoded = yield* Schema.decodeUnknown(CopyConfigSchema)(raw)
-      return decoded
-    }).pipe(
-      Effect.catchAll((error) =>
-        Effect.fail(
-          new ConfigError({
-            message: '配置验证失败',
-            cause: error,
-          }),
-        ),
-      ),
-    )
-
-  /**
-   * 默认配置 Layer
-   */
-  static readonly Live = Layer.effect(
-    CopyConfigService,
-    CopyConfigService.fromRaw({
-      sourceDir: path.join(__dirname, '..', 'server', 'out'),
-      targetDir: path.join(__dirname, 'src-tauri', 'binaries'),
-      baseName: 'server',
-      mappings: [
-        {
-          bunSuffix: 'windows-x64',
-          tauriTarget: 'x86_64-pc-windows-msvc',
-        },
-        {
-          bunSuffix: 'darwin-arm64',
-          tauriTarget: 'aarch64-apple-darwin',
-        },
-        {
-          bunSuffix: 'darwin-x64',
-          tauriTarget: 'x86_64-apple-darwin',
-        },
-        {
-          bunSuffix: 'linux-x64',
-          tauriTarget: 'x86_64-unknown-linux-gnu',
-        },
-        {
-          bunSuffix: 'linux-arm64',
-          tauriTarget: 'aarch64-unknown-linux-gnu',
-        },
-      ],
-    } satisfies CopyConfig),
-  )
-}
-
-/**
- * 文件系统服务
- */
-class FileSystemService extends Context.Tag('FileSystemService')<
-  FileSystemService,
-  {
-    readonly ensureDir: (dir: string) => Effect.Effect<void, FileSystemError>
-    readonly fileExists: (
-      filePath: string,
-    ) => Effect.Effect<boolean, FileSystemError>
-    readonly dirExists: (
-      dirPath: string,
-    ) => Effect.Effect<boolean, FileSystemError>
-    readonly copyFile: (
-      source: string,
-      target: string,
-    ) => Effect.Effect<void, CopyError>
-  }
->() {
-  static readonly Live = Layer.succeed(FileSystemService, {
-    ensureDir: (dir: string) =>
-      Effect.tryPromise({
-        try: async () => {
-          await $`mkdir -p ${dir}`
-        },
-        catch: (cause: unknown) =>
-          new FileSystemError({
-            operation: 'ensureDir',
-            path: dir,
-            cause,
-          }),
-      }),
-
-    fileExists: (filePath: string) =>
-      Effect.tryPromise({
-        try: async () => {
-          const file = Bun.file(filePath)
-          return await file.exists()
-        },
-        catch: (cause: unknown) =>
-          new FileSystemError({
-            operation: 'fileExists',
-            path: filePath,
-            cause,
-          }),
-      }),
-
-    dirExists: (dirPath: string) =>
-      Effect.tryPromise({
-        try: async () => {
-          const { default: fs } = await import('node:fs/promises')
-          try {
-            const stat = await fs.stat(dirPath)
-            return stat.isDirectory()
-          } catch {
-            return false
-          }
-        },
-        catch: (cause: unknown) =>
-          new FileSystemError({
-            operation: 'dirExists',
-            path: dirPath,
-            cause,
-          }),
-      }),
-
-    copyFile: (source: string, target: string) =>
-      Effect.tryPromise({
-        try: async () => {
-          await $`cp ${source} ${target}`
-        },
-        catch: (cause: unknown) =>
-          new CopyError({
-            source,
-            target,
-            cause,
-          }),
-      }),
-  })
-}
-
-/**
- * 复制服务
- */
-class CopyService extends Context.Tag('CopyService')<
-  CopyService,
-  {
-    readonly copyBinary: (
-      config: CopyConfig,
-      mapping: TargetMapping,
-    ) => Effect.Effect<CopyResult, CopyError | FileSystemError>
-    readonly copyAllBinaries: (
-      config: CopyConfig,
-    ) => Effect.Effect<ReadonlyArray<CopyResult>, CopyError | FileSystemError>
-  }
->() {
-  static readonly Live = Layer.effect(
-    CopyService,
-    Effect.gen(function* () {
-      const fs = yield* FileSystemService
-
-      return {
-        copyBinary: (config: CopyConfig, mapping: TargetMapping) =>
-          Effect.gen(function* () {
-            const { sourceDir, targetDir, baseName } = config
-            const { bunSuffix, tauriTarget } = mapping
-
-            // 确定文件扩展名（Windows 需要 .exe）
-            const ext = tauriTarget.includes('windows') ? '.exe' : ''
-
-            // 构建源文件和目标文件路径
-            const sourceFile = path.join(
-              sourceDir,
-              `${baseName}-${bunSuffix}${ext}`,
-            )
-            const targetFile = path.join(
-              targetDir,
-              `${baseName}-${tauriTarget}${ext}`,
-            )
-
-            // 检查源文件是否存在
-            const exists = yield* fs.fileExists(sourceFile)
-            if (!exists) {
-              yield* Console.log(`⚠️  跳过 ${bunSuffix}: 源文件不存在`)
-              return {
-                bunSuffix,
-                tauriTarget,
-                sourceFile,
-                targetFile,
-                success: false,
-              } satisfies CopyResult
-            }
-
-            // 复制文件
-            yield* fs.copyFile(sourceFile, targetFile)
-
-            yield* Console.log(`✓ ${bunSuffix} → ${tauriTarget}`)
-            yield* Console.log(`  ${sourceFile}`)
-            yield* Console.log(`  → ${targetFile}\n`)
-
-            return {
-              bunSuffix,
-              tauriTarget,
-              sourceFile,
-              targetFile,
-              success: true,
-            } satisfies CopyResult
-          }),
-
-        copyAllBinaries: (config: CopyConfig) =>
-          Effect.gen(function* () {
-            const effects = config.mappings.map((mapping) =>
-              Effect.gen(function* () {
-                const { sourceDir, targetDir, baseName } = config
-                const { bunSuffix, tauriTarget } = mapping
-
-                const ext = tauriTarget.includes('windows') ? '.exe' : ''
-                const sourceFile = path.join(
-                  sourceDir,
-                  `${baseName}-${bunSuffix}${ext}`,
-                )
-                const targetFile = path.join(
-                  targetDir,
-                  `${baseName}-${tauriTarget}${ext}`,
-                )
-
-                const exists = yield* fs.fileExists(sourceFile)
-                if (!exists) {
-                  yield* Console.log(`⚠️  跳过 ${bunSuffix}: 源文件不存在`)
-                  return {
-                    bunSuffix,
-                    tauriTarget,
-                    sourceFile,
-                    targetFile,
-                    success: false,
-                  } satisfies CopyResult
-                }
-
-                yield* fs.copyFile(sourceFile, targetFile)
-
-                yield* Console.log(`✓ ${bunSuffix} → ${tauriTarget}`)
-                yield* Console.log(`  ${sourceFile}`)
-                yield* Console.log(`  → ${targetFile}\n`)
-
-                return {
-                  bunSuffix,
-                  tauriTarget,
-                  sourceFile,
-                  targetFile,
-                  success: true,
-                } satisfies CopyResult
-              }),
-            )
-
-            return yield* Effect.all(effects, { concurrency: 'unbounded' })
-          }),
-      }
-    }),
-  )
-}
-
-/**
- * 报告服务
- */
-class ReporterService extends Context.Tag('ReporterService')<
-  ReporterService,
-  {
-    readonly printSummary: (
-      results: ReadonlyArray<CopyResult>,
-    ) => Effect.Effect<void>
-  }
->() {
-  static readonly Live = Layer.succeed(ReporterService, {
-    printSummary: (results: ReadonlyArray<CopyResult>) =>
-      Effect.gen(function* () {
-        const successful = results.filter((r) => r.success)
-        const failed = results.filter((r) => !r.success)
-
-        yield* Console.log('\n📦 复制摘要:')
-        yield* Console.log(`  ✅ 成功: ${successful.length}`)
-        yield* Console.log(`  ⚠️  跳过: ${failed.length}`)
-
-        if (successful.length > 0) {
-          yield* Console.log('\n成功复制的文件:')
-          for (const result of successful) {
-            yield* Console.log(
-              `  • ${result.bunSuffix} → ${result.tauriTarget}`,
-            )
-          }
-        }
-
-        if (failed.length > 0) {
-          yield* Console.log('\n跳过的文件:')
-          for (const result of failed) {
-            yield* Console.log(`  • ${result.bunSuffix} (源文件不存在)`)
-          }
-        }
-      }),
-  })
-}
-
-// ============================================================================
-// Main Program
-// ============================================================================
-
-const program = Effect.gen(function* () {
-  const config = yield* CopyConfigService
-  const fs = yield* FileSystemService
-  const copier = yield* CopyService
-  const reporter = yield* ReporterService
-
-  yield* Console.log('📦 开始复制二进制文件到 Tauri sidecar 目录...\n')
-
-  // 1. 检查源目录
-  const sourceExists = yield* fs.dirExists(config.sourceDir)
-  if (!sourceExists) {
-    yield* Console.error(`❌ 源目录不存在: ${config.sourceDir}`)
-    yield* Console.log(
-      '💡 提示: 请先在 apps/server 中运行 bun run compile 构建服务器二进制文件',
-    )
-    return yield* Effect.fail(
-      new FileSystemError({
-        operation: 'checkSourceDir',
-        path: config.sourceDir,
-        cause: '源目录不存在',
-      }),
-    )
-  }
-
-  // 2. 创建目标目录
-  yield* fs.ensureDir(config.targetDir)
-  yield* Console.log(`✓ 目标目录: ${config.targetDir}\n`)
-
-  // 3. 并行复制所有二进制文件
-  const results = yield* copier.copyAllBinaries(config)
-
-  // 4. 输出摘要
-  yield* reporter.printSummary(results)
-
-  return results
-})
-
-// ============================================================================
-// Layer Composition
-// ============================================================================
-
-const MainLayer = Layer.mergeAll(
-  CopyConfigService.Live,
-  FileSystemService.Live,
-  CopyService.Live.pipe(Layer.provide(FileSystemService.Live)),
-  ReporterService.Live,
-)
-
-// ============================================================================
-// Runner
-// ============================================================================
-
-const runnable = program.pipe(
-  Effect.provide(MainLayer),
-  Effect.catchTags({
-    ConfigError: (error) =>
-      Console.error(`❌ 配置错误: ${error.message}`, error.cause),
-    FileSystemError: (error) =>
-      Console.error(
-        `❌ 文件系统错误 [${error.operation}]: ${error.path}`,
-        error.cause,
-      ),
-    CopyError: (error) =>
-      Console.error(
-        `❌ 复制失败: ${error.source} → ${error.target}`,
-        error.cause,
-      ),
-  }),
-  Effect.tapErrorCause((cause) => Console.error('❌ 未预期的错误:', cause)),
-)
-
-Effect.runPromise(runnable).catch(() => {
-  process.exit(1)
-})

apps/desktop/electron-builder.yml

@@ -0,0 +1,48 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/electron-userland/electron-builder/refs/heads/master/packages/app-builder-lib/scheme.json
+appId: com.furtherverse.desktop
+productName: Furtherverse
+executableName: furtherverse
+
+npmRebuild: false
+asarUnpack:
+  - resources/**
+
+files:
+  - "!**/.vscode/*"
+  - "!src/*"
+  - "!electron.vite.config.{js,ts,mjs,cjs}"
+  - "!{.env,.env.*,bun.lock}"
+  - "!{tsconfig.json,tsconfig.node.json}"
+  - "!{AGENTS.md,README.md,CHANGELOG.md}"
+
+# macOS
+mac:
+  target:
+    - dmg
+  category: public.app-category.productivity
+  extraResources:
+    - from: ../server/out/server-darwin-${arch}
+      to: server
+dmg:
+  artifactName: ${productName}-${version}-${os}-${arch}.${ext}
+
+# Windows
+win:
+  target:
+    - portable
+  extraResources:
+    - from: ../server/out/server-windows-${arch}.exe
+      to: server.exe
+portable:
+  artifactName: ${productName}-${version}-${os}-${arch}-Portable.${ext}
+
+# Linux
+linux:
+  target:
+    - AppImage
+  category: Utility
+  extraResources:
+    - from: ../server/out/server-linux-${arch}
+      to: server
+appImage:
+  artifactName: ${productName}-${version}-${os}-${arch}.${ext}

apps/desktop/electron.vite.config.ts

@@ -0,0 +1,11 @@
+import tailwindcss from '@tailwindcss/vite'
+import react from '@vitejs/plugin-react'
+import { defineConfig } from 'electron-vite'
+
+export default defineConfig({
+  main: {},
+  preload: {},
+  renderer: {
+    plugins: [react(), tailwindcss()],
+  },
+})

apps/desktop/package.json

@@ -2,18 +2,36 @@
   "name": "@furtherverse/desktop",
   "version": "1.0.0",
   "private": true,
-  "type": "module",
+  "main": "out/main/index.js",
   "scripts": {
-    "build": "bun run copy && tauri build",
-    "copy": "rm -rf binaries && bun --bun copy.ts",
-    "dev": "bun run copy && tauri dev"
+    "build": "electron-vite build",
+    "dev": "electron-vite dev --watch",
+    "dist": "electron-builder",
+    "dist:linux": "bun run dist:linux:x64 && bun run dist:linux:arm64",
+    "dist:linux:arm64": "electron-builder --linux --arm64",
+    "dist:linux:x64": "electron-builder --linux --x64",
+    "dist:mac": "bun run dist:mac:arm64 && bun run dist:mac:x64",
+    "dist:mac:arm64": "electron-builder --mac --arm64",
+    "dist:mac:x64": "electron-builder --mac --x64",
+    "dist:win": "electron-builder --win --x64",
+    "fix": "biome check --write",
+    "typecheck": "tsc -b"
+  },
+  "dependencies": {
+    "motion": "catalog:",
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "tree-kill": "catalog:"
   },
   "devDependencies": {
-    "@effect/schema": "catalog:",
     "@furtherverse/tsconfig": "workspace:*",
-    "@tauri-apps/cli": "catalog:",
-    "@types/bun": "catalog:",
-    "effect": "catalog:",
-    "typescript": "catalog:"
+    "@tailwindcss/vite": "catalog:",
+    "@types/node": "catalog:",
+    "@vitejs/plugin-react": "catalog:",
+    "electron": "catalog:",
+    "electron-builder": "catalog:",
+    "electron-vite": "catalog:",
+    "tailwindcss": "catalog:",
+    "vite": "catalog:"
   }
 }

apps/desktop/src-tauri/.gitignore

@@ -1,10 +0,0 @@
-# Generated by Cargo
-# will have compiled files and executables
-/target/
-
-# Generated by Tauri
-# will have schema files for capabilities auto-completion
-/gen/schemas
-
-# Tauri Sidecar
-binaries/

apps/desktop/src-tauri/AGENTS.md

@@ -1,357 +0,0 @@
-# AGENTS.md - Tauri Shell 项目开发指南
-
-本文档为 AI 编程助手和开发者提供项目规范、构建命令和代码风格指南。
-
-## 项目概览
-
-- **项目类型**: Tauri v2 桌面应用（轻量级壳子）
-- **后端**: Rust (Edition 2021)
-- **架构**: Sidecar 模式 - Sidecar App 承载主要业务逻辑
-- **设计理念**: Tauri 仅提供原生桌面能力（文件对话框、系统通知等），Web 逻辑全部由 Sidecar App 处理
-- **开发模式**: 使用 localhost:3000（需手动启动开发服务器）
-- **生产模式**: 自动启动 Sidecar 二进制
-- **异步运行时**: Tokio
-- **Rust 版本**: 1.92.0+
-- **工具管理**: 使用 mise 管理 Rust 和 Tauri CLI 版本（见 `mise.toml`）
-
-## 构建、测试、运行命令
-
-### 开发运行
-```bash
-# 开发模式运行 (需要先启动开发服务器)
-# 终端 1: 启动前端开发服务器
-bun run dev
-
-# 终端 2: 启动 Tauri 应用
-tauri dev
-
-# 或者使用单命令并行启动（需要配置 package.json）
-bun run dev:tauri
-```
-
-**开发模式说明**：
-- 开发模式下，Tauri 直接连接到 `localhost:3000`（不启动 sidecar 二进制）
-- 需要手动运行 `bun run dev` 来启动开发服务器
-- 支持热重载（HMR），无需重启 Tauri 应用
-
-### 构建
-```bash
-# 开发构建 (debug mode)
-cargo build
-
-# 生产构建
-cargo build --release
-
-# Tauri 应用打包 (生成安装程序)
-tauri build
-```
-
-### 代码检查
-```bash
-# 编译检查 (不生成二进制)
-cargo check
-
-# Clippy 代码质量检查
-cargo clippy
-
-# Clippy 严格模式 (所有警告视为错误)
-cargo clippy -- -D warnings
-
-# 代码格式化检查
-cargo fmt -- --check
-
-# 自动格式化代码
-cargo fmt
-```
-
-### 测试
-```bash
-# 运行所有测试
-cargo test
-
-# 运行单个测试 (按名称过滤)
-cargo test test_function_name
-
-# 运行特定模块的测试
-cargo test module_name::
-
-# 显示测试输出 (包括 println!)
-cargo test -- --nocapture
-
-# 运行单个测试并显示输出
-cargo test test_name -- --nocapture
-```
-
-### 清理
-```bash
-# 清理构建产物
-cargo clean
-```
-
-## 项目结构
-
-```
-server-desktop/
-├── src/
-│   ├── main.rs          # 入口文件 (仅调用 lib::run)
-│   ├── lib.rs           # 核心应用逻辑 (注册插件、命令、状态)
-│   ├── commands/
-│   │   └── mod.rs       # 原生桌面功能命令 (文件对话框、通知等)
-│   └── sidecar.rs       # Sidecar 进程管理 (启动、端口扫描、清理)
-├── binaries/            # Sidecar 二进制文件
-│   └── app-*   # Sidecar App 可执行文件 (示例: app)
-├── capabilities/        # Tauri v2 权限配置
-│   └── default.json
-├── icons/               # 应用图标资源
-├── gen/schemas/         # 自动生成的 Schema (不要手动编辑)
-├── Cargo.toml          # Rust 项目配置
-├── tauri.conf.json     # Tauri 应用配置
-├── build.rs            # Rust 构建脚本
-└── mise.toml           # 开发工具版本管理
-```
-
-## Rust 代码风格指南
-
-### 导入 (Imports)
-
-- 使用标准库、外部 crate、当前 crate 的顺序，用空行分隔
-- 按字母顺序排列
-- 优先使用具体导入而非通配符 `*`
-
-```rust
-// ✅ 推荐
-use std::sync::Mutex;
-use std::time::Duration;
-
-use tauri::Manager;
-use tauri_plugin_shell::ShellExt;
-use tauri_plugin_shell::process::{CommandEvent, CommandChild};
-
-// ❌ 避免
-use tauri::*;
-```
-
-### 命名规范
-
-- **函数和变量**: `snake_case`
-- **类型、结构体、枚举、Trait**: `PascalCase`
-- **常量和静态变量**: `SCREAMING_SNAKE_CASE`
-- **生命周期参数**: 简短小写字母，如 `'a`, `'b`
-
-```rust
-// ✅ 推荐
-struct SidecarProcess(Mutex<Option<CommandChild>>);
-const DEFAULT_PORT: u16 = 3000;
-async fn find_available_port(start: u16) -> u16 { }
-
-// ❌ 避免
-struct sidecar_process { }
-const defaultPort: u16 = 3000;
-```
-
-### 类型注解
-
-- 函数参数必须有类型注解
-- 函数返回值必须明确声明 (除非返回 `()`)
-- 优先使用具体类型而非 `impl Trait` (除非必要)
-- 使用 `&str` 而非 `String` 作为只读字符串参数
-
-```rust
-// ✅ 推荐
-#[tauri::command]
-fn greet(name: &str) -> String {
-    format!("Hello, {}!", name)
-}
-
-async fn is_port_available(port: u16) -> bool {
-    tokio::net::TcpListener::bind(format!("127.0.0.1:{}", port))
-        .await
-        .is_ok()
-}
-```
-
-### 错误处理
-
-- 使用 `Result<T, E>` 返回可能失败的操作
-- 使用 `expect()` 时提供有意义的错误消息 (中文)
-- 避免 `unwrap()` 在生产代码中，除非逻辑上保证不会 panic
-- 使用 `?` 操作符传播错误
-- 记录关键错误信息到控制台
-
-```rust
-// ✅ 推荐
-let sidecar = app_handle
-    .shell()
-    .sidecar("app")
-    .expect("无法找到 app sidecar");
-
-let (mut rx, child) = sidecar.spawn().expect("启动 sidecar 失败");
-
-// 日志记录
-eprintln!("✗ Sidecar App 启动失败");
-println!("✓ Sidecar App 启动成功！");
-
-// ❌ 避免
-let data = read_file().unwrap();  // 无上下文信息
-```
-
-### 异步代码
-
-- 使用 `async/await` 而非手动创建 Future
-- Tauri 内部使用 `tauri::async_runtime::spawn` 启动异步任务
-- 使用 Tokio 的异步 API (如 `tokio::net::TcpListener`)
-- 避免阻塞异步运行时 (使用 `tokio::task::spawn_blocking`)
-
-```rust
-// ✅ 推荐
-tauri::async_runtime::spawn(async move {
-    let port = find_available_port(3000).await;
-    // ...
-});
-```
-
-### 格式化
-
-- 使用 `cargo fmt` 自动格式化
-- 缩进: 4 空格
-- 行宽: 100 字符 (rustfmt 默认)
-- 结构体和枚举的字段每行一个 (如果超过一定长度)
-- 链式调用适当换行提高可读性
-
-### 注释
-
-- 使用中文注释说明复杂逻辑
-- 代码块前添加简短说明注释
-- 避免显而易见的注释
-
-```rust
-// ✅ 推荐
-// 全局状态：存储 Sidecar App 进程句柄
-struct SidecarProcess(Mutex<Option<CommandChild>>);
-
-// 检查端口是否可用
-async fn is_port_available(port: u16) -> bool { }
-```
-
-## Tauri 特定规范
-
-### 模块组织
-
-- **`lib.rs`**: 主入口，负责注册插件、命令、状态管理
-- **`commands/mod.rs`**: 所有 Tauri 命令集中定义，命令必须是 `pub fn`
-- **`sidecar.rs`**: Sidecar 进程管理逻辑，导出公共 API（`spawn_sidecar`, `cleanup_sidecar_process`）
-
-```rust
-// lib.rs - 模块声明
-mod commands;
-mod sidecar;
-
-use sidecar::SidecarProcess;
-
-// 注册命令时使用模块路径
-.invoke_handler(tauri::generate_handler![commands::greet])
-```
-
-### 命令定义
-
-- 使用 `#[tauri::command]` 宏标记命令
-- 命令函数必须是公开的或在 `invoke_handler` 中注册
-- 参数类型必须实现 `serde::Deserialize`
-- 返回类型必须实现 `serde::Serialize`
-
-```rust
-#[tauri::command]
-fn greet(name: &str) -> String {
-    format!("Hello, {}!", name)
-}
-
-// 在 Builder 中注册
-.invoke_handler(tauri::generate_handler![greet])
-```
-
-### 状态管理
-
-- 使用 `app.manage()` 注册全局状态
-- 状态必须实现 `Send + Sync`
-- 使用 `Mutex` 或 `RwLock` 保证线程安全
-
-```rust
-struct SidecarProcess(Mutex<Option<CommandChild>>);
-
-// 注册状态
-app.manage(SidecarProcess(Mutex::new(None)));
-
-// 访问状态
-if let Some(state) = app_handle.try_state::<SidecarProcess>() {
-    *state.0.lock().unwrap() = Some(child);
-}
-```
-
-### Sidecar 进程管理
-
-- Sidecar 二进制必须在 `tauri.conf.json` 的 `bundle.externalBin` 中声明
-- 使用 `app.shell().sidecar()` 启动 sidecar
-- 在应用退出时清理子进程 (监听 `RunEvent::ExitRequested`)
-
-```rust
-// 启动 sidecar
-let sidecar = app_handle
-    .shell()
-    .sidecar("app")
-    .expect("无法找到 app sidecar")
-    .env("PORT", port.to_string());
-
-// 清理进程
-match event {
-    tauri::RunEvent::ExitRequested { .. } | tauri::RunEvent::Exit => {
-        if let Some(child) = process.take() {
-            let _ = child.kill();
-        }
-    }
-    _ => {}
-}
-```
-
-## 依赖管理
-
-- 在 `Cargo.toml` 中明确声明依赖版本
-- 使用语义化版本 (如 `"2"` 表示兼容 2.x.x)
-- 仅启用需要的 feature 以减少编译时间和二进制大小
-
-```toml
-tauri = { version = "2", features = [] }
-tauri-plugin-opener = "2"
-tauri-plugin-shell = "2"
-serde = { version = "1", features = ["derive"] }
-tokio = { version = "1", features = ["net"] }
-```
-
-## 开发工具
-
-推荐安装以下 VSCode 扩展:
-- `tauri-apps.tauri-vscode` - Tauri 官方支持
-- `rust-lang.rust-analyzer` - Rust 语言服务器
-
-## 最佳实践
-
-1. **开发环境配置**: 
-   - 开发模式下需先启动前端开发服务器（`bun run dev`），再启动 Tauri（`tauri dev`）
-   - 生产构建自动打包 sidecar 二进制，无需额外配置
-2. **进程生命周期**: 始终在应用退出时清理子进程和资源
-3. **端口管理**: 
-   - 开发模式固定使用 3000 端口（与开发服务器匹配）
-   - 生产模式使用端口扫描避免硬编码端口冲突
-4. **超时处理**: 异步操作设置合理的超时时间 (如 5 秒)
-5. **日志**: 使用表情符号 (✓/✗/🔧/🚀) 和中文消息提供清晰的状态反馈
-6. **错误退出**: 关键错误时调用 `std::process::exit(1)`
-7. **窗口配置**: 使用 `WebviewWindowBuilder` 动态创建窗口
-
-## 提交代码前检查清单
-
-- [ ] `cargo fmt` 格式化通过
-- [ ] `cargo clippy` 无警告
-- [ ] `cargo check` 编译通过
-- [ ] `cargo test` 测试通过
-- [ ] 更新相关注释和文档
-- [ ] 检查是否有 `unwrap()` 需要替换为 `expect()`
-- [ ] 验证 Tauri 应用正常启动和退出

apps/desktop/src-tauri/Cargo.toml

@@ -1,24 +0,0 @@
-[package]
-name = "server-desktop"
-version = "0.1.0"
-description = "A Tauri App"
-authors = ["imbytecat"]
-edition = "2021"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[lib]
-# The `_lib` suffix may seem redundant but it is necessary
-# to make the lib name unique and wouldn't conflict with the bin name.
-# This seems to be only an issue on Windows, see https://github.com/rust-lang/cargo/issues/8519
-name = "server_desktop_lib"
-crate-type = ["staticlib", "cdylib", "rlib"]
-
-[build-dependencies]
-tauri-build = { version = "2", features = [] }
-
-[dependencies]
-tauri = { version = "2", features = [] }
-tauri-plugin-shell = "2"
-serde = { version = "1", features = ["derive"] }
-tokio = { version = "1", features = ["net"] }

apps/desktop/src-tauri/build.rs

@@ -1,3 +0,0 @@
-fn main() {
-    tauri_build::build()
-}

apps/desktop/src-tauri/capabilities/default.json

@@ -1,27 +0,0 @@
-{
-  "$schema": "../gen/schemas/desktop-schema.json",
-  "identifier": "default",
-  "description": "Capability for the main window",
-  "windows": ["main"],
-  "local": true,
-  "remote": {
-    "urls": [
-      "http://localhost:*",
-      "http://127.0.0.1:*",
-      "http{s}?://localhost(:\\d+)?/*"
-    ]
-  },
-  "permissions": [
-    "core:default",
-    "core:window:allow-set-title",
-    {
-      "identifier": "shell:allow-execute",
-      "allow": [
-        {
-          "name": "binaries/app",
-          "sidecar": true
-        }
-      ]
-    }
-  ]
-}

apps/desktop/src-tauri/src/commands/mod.rs

@@ -1,8 +0,0 @@
-// 原生桌面功能命令
-// 未来可能包含: 文件对话框、系统通知、剪贴板等
-
-// 示例命令 (可根据需要删除或替换)
-#[tauri::command]
-pub fn greet(name: &str) -> String {
-    format!("Hello, {}! You've been greeted from Rust!", name)
-}

apps/desktop/src-tauri/src/lib.rs

@@ -1,33 +0,0 @@
-use tauri::Manager;
-
-// 模块声明
-mod commands;
-mod sidecar;
-
-use sidecar::SidecarProcess;
-
-#[cfg_attr(mobile, tauri::mobile_entry_point)]
-pub fn run() {
-    tauri::Builder::default()
-        .plugin(tauri_plugin_shell::init())
-        .setup(|app| {
-            // 注册全局状态
-            app.manage(SidecarProcess(std::sync::Mutex::new(None)));
-
-            // 启动 Sidecar 进程
-            let app_handle = app.handle().clone();
-            sidecar::spawn_sidecar(app_handle);
-
-            Ok(())
-        })
-        .invoke_handler(tauri::generate_handler![commands::greet])
-        .build(tauri::generate_context!())
-        .expect("error while building tauri application")
-        .run(|app_handle, event| {
-            // 监听应用退出事件，清理 Sidecar 进程
-            if let tauri::RunEvent::Exit = event {
-                // 只在 Exit 事件时清理，避免重复执行
-                sidecar::cleanup_sidecar_process(app_handle);
-            }
-        });
-}

apps/desktop/src-tauri/src/main.rs

@@ -1,6 +0,0 @@
-// Prevents additional console window on Windows in release, DO NOT REMOVE!!
-#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
-
-fn main() {
-    server_desktop_lib::run()
-}

apps/desktop/src-tauri/src/sidecar.rs

@@ -1,166 +0,0 @@
-use std::sync::Mutex;
-use std::time::Duration;
-
-use tauri::Manager;
-use tauri_plugin_shell::process::{CommandChild, CommandEvent};
-use tauri_plugin_shell::ShellExt;
-
-// ===== 配置常量 =====
-
-/// Sidecar App 启动超时时间（秒）
-const STARTUP_TIMEOUT_SECS: u64 = 5;
-
-/// 默认起始端口
-const DEFAULT_PORT: u16 = 3000;
-
-/// 端口扫描范围（从起始端口开始扫描的端口数量）
-const PORT_SCAN_RANGE: u16 = 100;
-
-/// 窗口默认宽度
-const DEFAULT_WINDOW_WIDTH: f64 = 1200.0;
-
-/// 窗口默认高度
-const DEFAULT_WINDOW_HEIGHT: f64 = 800.0;
-
-/// 窗口标题
-const WINDOW_TITLE: &str = "Tauri App";
-
-// ===== 数据结构 =====
-
-/// 全局状态：存储 Sidecar 进程句柄
-pub struct SidecarProcess(pub Mutex<Option<CommandChild>>);
-
-// 检查端口是否可用（未被占用）
-async fn is_port_available(port: u16) -> bool {
-    tokio::net::TcpListener::bind(format!("127.0.0.1:{}", port))
-        .await
-        .is_ok()
-}
-
-// 查找可用端口
-async fn find_available_port(start: u16) -> u16 {
-    for port in start..start + PORT_SCAN_RANGE {
-        if is_port_available(port).await {
-            return port;
-        }
-    }
-    start // 回退到起始端口
-}
-
-/// 启动 Sidecar 进程并创建主窗口
-pub fn spawn_sidecar(app_handle: tauri::AppHandle) {
-    // 检测是否为开发模式
-    let is_dev = cfg!(debug_assertions);
-
-    if is_dev {
-        // 开发模式：直接创建窗口连接到 Vite 开发服务器
-        println!("🔧 开发模式");
-
-        match tauri::WebviewWindowBuilder::new(
-            &app_handle,
-            "main",
-            tauri::WebviewUrl::External("http://localhost:3000".parse().unwrap()),
-        )
-        .title(WINDOW_TITLE)
-        .inner_size(DEFAULT_WINDOW_WIDTH, DEFAULT_WINDOW_HEIGHT)
-        .center()
-        .build()
-        {
-            Ok(_) => println!("✓ 开发窗口创建成功"),
-            Err(e) => {
-                eprintln!("✗ 窗口创建失败: {}", e);
-            }
-        }
-
-        return;
-    }
-
-    // 生产模式：启动 sidecar 二进制
-    tauri::async_runtime::spawn(async move {
-        println!("🚀 生产模式");
-
-        // 查找可用端口
-        let port = find_available_port(DEFAULT_PORT).await;
-        println!("使用端口: {}", port);
-
-        // 启动 sidecar
-        let sidecar = app_handle
-            .shell()
-            .sidecar("server")
-            .expect("无法找到 app")
-            .env("PORT", port.to_string());
-
-        let (mut rx, child) = sidecar.spawn().expect("启动 sidecar 失败");
-
-        // 保存进程句柄到全局状态
-        if let Some(state) = app_handle.try_state::<SidecarProcess>() {
-            *state.0.lock().unwrap() = Some(child);
-        }
-
-        // 监听 stdout，等待服务器就绪信号
-        let start_time = std::time::Instant::now();
-        let timeout = Duration::from_secs(STARTUP_TIMEOUT_SECS);
-        let mut app_ready = false;
-
-        while let Some(event) = rx.recv().await {
-            if let CommandEvent::Stdout(line) = event {
-                let output = String::from_utf8_lossy(&line);
-                println!("App: {}", output);
-
-                // 检测 App 启动成功的标志
-                if output.contains("Listening on:") || output.contains("localhost") {
-                    app_ready = true;
-                    println!("✓ App 启动成功！");
-
-                    // 创建主窗口
-                    let url = format!("http://localhost:{}", port);
-                    tauri::WebviewWindowBuilder::new(
-                        &app_handle,
-                        "main",
-                        tauri::WebviewUrl::External(url.parse().unwrap()),
-                    )
-                    .title(WINDOW_TITLE)
-                    .inner_size(DEFAULT_WINDOW_WIDTH, DEFAULT_WINDOW_HEIGHT)
-                    .center()
-                    .build()
-                    .expect("创建窗口失败");
-
-                    break;
-                }
-            }
-
-            // 超时检查
-            if start_time.elapsed() > timeout {
-                eprintln!("✗ 启动超时: App 未能在 {} 秒内启动", STARTUP_TIMEOUT_SECS);
-                break;
-            }
-        }
-
-        if !app_ready {
-            eprintln!("✗ App 启动失败");
-            std::process::exit(1);
-        }
-    });
-}
-
-/// 清理 Sidecar 进程 (在应用退出时调用)
-pub fn cleanup_sidecar_process(app_handle: &tauri::AppHandle) {
-    let is_dev = cfg!(debug_assertions);
-
-    if is_dev {
-        // 开发模式：退出时发送异常信号（exit 1），让 Turbo 停止 Vite 服务器
-        println!("🔧 开发模式退出，终止所有依赖任务...");
-        std::process::exit(1);
-    }
-
-    // 生产模式：正常清理 sidecar 进程
-    println!("应用退出，正在清理 Sidecar 进程...");
-    if let Some(state) = app_handle.try_state::<SidecarProcess>() {
-        if let Ok(mut process) = state.0.lock() {
-            if let Some(child) = process.take() {
-                let _ = child.kill();
-                println!("✓ Sidecar 进程已终止");
-            }
-        }
-    }
-}

apps/desktop/src-tauri/tauri.conf.json

@@ -1,25 +0,0 @@
-{
-  "$schema": "https://schema.tauri.app/config/2",
-  "productName": "server-desktop",
-  "version": "0.1.0",
-  "identifier": "com.imbytecat.server-desktop",
-  "app": {
-    "withGlobalTauri": true,
-    "windows": [],
-    "security": {
-      "csp": null
-    }
-  },
-  "bundle": {
-    "active": true,
-    "targets": "all",
-    "icon": [
-      "icons/32x32.png",
-      "icons/128x128.png",
-      "icons/128x128@2x.png",
-      "icons/icon.icns",
-      "icons/icon.ico"
-    ],
-    "externalBin": ["binaries/server"]
-  }
-}

apps/desktop/src/main/index.ts

@@ -0,0 +1,198 @@
+import { join } from 'node:path'
+import { app, BrowserWindow, dialog, session, shell } from 'electron'
+import { createSidecarRuntime } from './sidecar'
+
+const DEV_SERVER_URL = 'http://localhost:3000'
+const SAFE_EXTERNAL_PROTOCOLS = new Set(['https:', 'http:', 'mailto:'])
+
+let mainWindow: BrowserWindow | null = null
+let windowCreationPromise: Promise<void> | null = null
+let isQuitting = false
+
+const showErrorAndQuit = (title: string, detail: string) => {
+  if (isQuitting) {
+    return
+  }
+
+  dialog.showErrorBox(title, detail)
+  app.quit()
+}
+
+const sidecar = createSidecarRuntime({
+  devServerUrl: DEV_SERVER_URL,
+  isPackaged: app.isPackaged,
+  resourcesPath: process.resourcesPath,
+  isQuitting: () => isQuitting,
+  onUnexpectedStop: (detail) => {
+    showErrorAndQuit('Service Stopped', detail)
+  },
+})
+
+const toErrorMessage = (error: unknown): string => (error instanceof Error ? error.message : String(error))
+
+const canOpenExternally = (url: string): boolean => {
+  try {
+    const parsed = new URL(url)
+    return SAFE_EXTERNAL_PROTOCOLS.has(parsed.protocol)
+  } catch {
+    return false
+  }
+}
+
+const loadSplash = async (windowRef: BrowserWindow) => {
+  if (process.env.ELECTRON_RENDERER_URL) {
+    await windowRef.loadURL(process.env.ELECTRON_RENDERER_URL)
+    return
+  }
+
+  await windowRef.loadFile(join(__dirname, '../renderer/index.html'))
+}
+
+const createWindow = async () => {
+  if (mainWindow && !mainWindow.isDestroyed()) {
+    mainWindow.focus()
+    return
+  }
+
+  const windowRef = new BrowserWindow({
+    width: 1200,
+    height: 800,
+    show: false,
+    webPreferences: {
+      preload: join(__dirname, '../preload/index.js'),
+      sandbox: true,
+      contextIsolation: true,
+      nodeIntegration: false,
+    },
+  })
+  mainWindow = windowRef
+
+  windowRef.webContents.setWindowOpenHandler(({ url }) => {
+    if (!canOpenExternally(url)) {
+      if (!app.isPackaged) {
+        console.warn(`Blocked external URL: ${url}`)
+      }
+
+      return { action: 'deny' }
+    }
+
+    void shell.openExternal(url)
+    return { action: 'deny' }
+  })
+
+  windowRef.webContents.on('will-navigate', (event, url) => {
+    const allowed = [DEV_SERVER_URL, sidecar.lastResolvedUrl].filter((v): v is string => v != null)
+    const isAllowed = allowed.some((origin) => url.startsWith(origin))
+
+    if (!isAllowed) {
+      event.preventDefault()
+
+      if (canOpenExternally(url)) {
+        void shell.openExternal(url)
+      } else if (!app.isPackaged) {
+        console.warn(`Blocked navigation to: ${url}`)
+      }
+    }
+  })
+
+  windowRef.on('closed', () => {
+    if (mainWindow === windowRef) {
+      mainWindow = null
+    }
+  })
+
+  try {
+    await loadSplash(windowRef)
+  } catch (error) {
+    if (mainWindow === windowRef) {
+      mainWindow = null
+    }
+
+    if (!windowRef.isDestroyed()) {
+      windowRef.destroy()
+    }
+
+    throw error
+  }
+
+  if (!windowRef.isDestroyed()) {
+    windowRef.show()
+  }
+
+  const targetUrl = await sidecar.resolveUrl()
+  if (isQuitting || windowRef.isDestroyed()) {
+    return
+  }
+
+  try {
+    await windowRef.loadURL(targetUrl)
+  } catch (error) {
+    if (mainWindow === windowRef) {
+      mainWindow = null
+    }
+
+    if (!windowRef.isDestroyed()) {
+      windowRef.destroy()
+    }
+
+    throw error
+  }
+}
+
+const ensureWindow = async () => {
+  if (windowCreationPromise) {
+    return windowCreationPromise
+  }
+
+  windowCreationPromise = createWindow().finally(() => {
+    windowCreationPromise = null
+  })
+
+  return windowCreationPromise
+}
+
+const beginQuit = () => {
+  isQuitting = true
+  sidecar.stop()
+}
+
+const handleWindowCreationError = (error: unknown, context: string) => {
+  console.error(`${context}:`, error)
+  showErrorAndQuit(
+    "App Couldn't Start",
+    app.isPackaged
+      ? 'A required component failed to start. Please reinstall the app.'
+      : `${context}: ${toErrorMessage(error)}`,
+  )
+}
+
+app
+  .whenReady()
+  .then(() => {
+    session.defaultSession.setPermissionRequestHandler((_webContents, _permission, callback) => {
+      callback(false)
+    })
+
+    return ensureWindow()
+  })
+  .catch((error) => {
+    handleWindowCreationError(error, 'Failed to create window')
+  })
+
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') {
+    app.quit()
+  }
+})
+
+app.on('activate', () => {
+  if (isQuitting || BrowserWindow.getAllWindows().length > 0) {
+    return
+  }
+
+  ensureWindow().catch((error) => {
+    handleWindowCreationError(error, 'Failed to re-create window')
+  })
+})
+
+app.on('before-quit', beginQuit)

apps/desktop/src/main/sidecar.ts

@@ -0,0 +1,256 @@
+import { type ChildProcess, spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { createServer } from 'node:net'
+import { join } from 'node:path'
+import killProcessTree from 'tree-kill'
+
+const SERVER_HOST = '127.0.0.1'
+const SERVER_READY_TIMEOUT_MS = 10_000
+const SERVER_REQUEST_TIMEOUT_MS = 1_500
+const SERVER_POLL_INTERVAL_MS = 250
+const SERVER_PROBE_PATHS = ['/api/health', '/']
+
+type SidecarState = {
+  process: ChildProcess | null
+  startup: Promise<string> | null
+  url: string | null
+}
+
+type SidecarRuntimeOptions = {
+  devServerUrl: string
+  isPackaged: boolean
+  resourcesPath: string
+  isQuitting: () => boolean
+  onUnexpectedStop: (detail: string) => void
+}
+
+type SidecarRuntime = {
+  resolveUrl: () => Promise<string>
+  stop: () => void
+  lastResolvedUrl: string | null
+}
+
+const sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms))
+
+const isProcessAlive = (processToCheck: ChildProcess | null): processToCheck is ChildProcess => {
+  if (!processToCheck || !processToCheck.pid) {
+    return false
+  }
+
+  return processToCheck.exitCode === null && !processToCheck.killed
+}
+
+const getAvailablePort = (): Promise<number> =>
+  new Promise((resolve, reject) => {
+    const server = createServer()
+    server.listen(0, () => {
+      const addr = server.address()
+      if (!addr || typeof addr === 'string') {
+        server.close()
+        reject(new Error('Failed to resolve port'))
+        return
+      }
+
+      server.close(() => resolve(addr.port))
+    })
+    server.on('error', reject)
+  })
+
+const isServerReady = async (url: string): Promise<boolean> => {
+  for (const probePath of SERVER_PROBE_PATHS) {
+    try {
+      const probeUrl = new URL(probePath, `${url}/`)
+      const response = await fetch(probeUrl, {
+        method: 'GET',
+        cache: 'no-store',
+        signal: AbortSignal.timeout(SERVER_REQUEST_TIMEOUT_MS),
+      })
+
+      if (response.status < 500) {
+        if (probePath === '/api/health' && response.status === 404) {
+          continue
+        }
+
+        return true
+      }
+    } catch {
+      // Expected: probe request fails while server is still starting up
+    }
+  }
+
+  return false
+}
+
+const waitForServer = async (url: string, isQuitting: () => boolean, processRef?: ChildProcess): Promise<boolean> => {
+  const start = Date.now()
+  while (Date.now() - start < SERVER_READY_TIMEOUT_MS && !isQuitting()) {
+    if (processRef && processRef.exitCode !== null) {
+      return false
+    }
+
+    if (await isServerReady(url)) {
+      return true
+    }
+
+    await sleep(SERVER_POLL_INTERVAL_MS)
+  }
+
+  return false
+}
+
+const resolveBinaryPath = (resourcesPath: string): string => {
+  const binaryName = process.platform === 'win32' ? 'server.exe' : 'server'
+  return join(resourcesPath, binaryName)
+}
+
+const formatUnexpectedStopMessage = (
+  isPackaged: boolean,
+  code: number | null,
+  signal: NodeJS.Signals | null,
+): string => {
+  if (isPackaged) {
+    return 'The background service stopped unexpectedly. Please restart the app.'
+  }
+
+  return `Server process exited unexpectedly (code ${code ?? 'unknown'}, signal ${signal ?? 'none'}).`
+}
+
+export const createSidecarRuntime = (options: SidecarRuntimeOptions): SidecarRuntime => {
+  const state: SidecarState = {
+    process: null,
+    startup: null,
+    url: null,
+  }
+
+  const resetState = (processRef?: ChildProcess) => {
+    if (processRef && state.process !== processRef) {
+      return
+    }
+
+    state.process = null
+    state.url = null
+  }
+
+  const stop = () => {
+    const runningServer = state.process
+    resetState()
+
+    if (!runningServer?.pid || runningServer.exitCode !== null) {
+      return
+    }
+
+    killProcessTree(runningServer.pid, 'SIGTERM', (error?: Error) => {
+      if (error) {
+        console.error('Failed to stop server process:', error)
+      }
+    })
+  }
+
+  const attachLifecycleHandlers = (processRef: ChildProcess) => {
+    processRef.on('error', (error) => {
+      if (state.process !== processRef) {
+        return
+      }
+
+      const hadReadyServer = state.url !== null
+      resetState(processRef)
+
+      if (!options.isQuitting() && hadReadyServer) {
+        options.onUnexpectedStop('The background service crashed unexpectedly. Please restart the app.')
+        return
+      }
+
+      console.error('Failed to start server process:', error)
+    })
+
+    processRef.on('exit', (code, signal) => {
+      if (state.process !== processRef) {
+        return
+      }
+
+      const hadReadyServer = state.url !== null
+      resetState(processRef)
+
+      if (!options.isQuitting() && hadReadyServer) {
+        options.onUnexpectedStop(formatUnexpectedStopMessage(options.isPackaged, code, signal))
+      }
+    })
+  }
+
+  const startPackagedServer = async (): Promise<string> => {
+    if (state.url && isProcessAlive(state.process)) {
+      return state.url
+    }
+
+    if (state.startup) {
+      return state.startup
+    }
+
+    state.startup = (async () => {
+      const binaryPath = resolveBinaryPath(options.resourcesPath)
+      if (!existsSync(binaryPath)) {
+        throw new Error(`Sidecar server binary is missing: ${binaryPath}`)
+      }
+
+      if (options.isQuitting()) {
+        throw new Error('Application is shutting down.')
+      }
+
+      const port = await getAvailablePort()
+      const nextServerUrl = `http://${SERVER_HOST}:${port}`
+      const processRef = spawn(binaryPath, [], {
+        env: {
+          ...process.env,
+          HOST: SERVER_HOST,
+          PORT: String(port),
+        },
+        stdio: 'ignore',
+        windowsHide: true,
+      })
+
+      processRef.unref()
+      state.process = processRef
+      attachLifecycleHandlers(processRef)
+
+      const ready = await waitForServer(nextServerUrl, options.isQuitting, processRef)
+      if (ready && isProcessAlive(processRef)) {
+        state.url = nextServerUrl
+        return nextServerUrl
+      }
+
+      const failureReason =
+        processRef.exitCode !== null
+          ? `The service exited early (code ${processRef.exitCode}).`
+          : `The service did not respond at ${nextServerUrl} within 10 seconds.`
+
+      stop()
+      throw new Error(failureReason)
+    })().finally(() => {
+      state.startup = null
+    })
+
+    return state.startup
+  }
+
+  const resolveUrl = async (): Promise<string> => {
+    if (options.isPackaged) {
+      return startPackagedServer()
+    }
+
+    const ready = await waitForServer(options.devServerUrl, options.isQuitting)
+    if (!ready) {
+      throw new Error('Dev server not responding. Run `bun dev` in apps/server first.')
+    }
+
+    state.url = options.devServerUrl
+    return options.devServerUrl
+  }
+
+  return {
+    resolveUrl,
+    stop,
+    get lastResolvedUrl() {
+      return state.url
+    },
+  }
+}

apps/desktop/src/preload/index.ts

@@ -0,0 +1 @@
+export {}

apps/desktop/src/renderer/components/SplashApp.tsx

@@ -0,0 +1,33 @@
+import { motion } from 'motion/react'
+import logoImage from '../assets/logo.png'
+
+export const SplashApp = () => {
+  return (
+    <main className="m-0 flex h-screen w-screen cursor-default select-none items-center justify-center overflow-hidden bg-white font-sans antialiased">
+      <motion.section
+        animate={{ opacity: 1, y: 0 }}
+        className="flex flex-col items-center gap-8"
+        initial={{ opacity: 0, y: 4 }}
+        transition={{
+          duration: 1,
+          ease: [0.16, 1, 0.3, 1],
+        }}
+      >
+        <img alt="Logo" className="h-20 w-auto object-contain" draggable={false} src={logoImage} />
+
+        <div className="relative h-[4px] w-36 overflow-hidden rounded-full bg-zinc-100">
+          <motion.div
+            animate={{ x: '100%' }}
+            className="h-full w-full bg-zinc-800"
+            initial={{ x: '-100%' }}
+            transition={{
+              duration: 2,
+              ease: [0.4, 0, 0.2, 1],
+              repeat: Infinity,
+            }}
+          />
+        </div>
+      </motion.section>
+    </main>
+  )
+}

apps/desktop/src/renderer/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Furtherverse</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="./main.tsx"></script>
+  </body>
+</html>

apps/desktop/src/renderer/main.tsx

@@ -0,0 +1,11 @@
+import { StrictMode } from 'react'
+import { createRoot } from 'react-dom/client'
+import { SplashApp } from './components/SplashApp'
+import './styles.css'
+
+// biome-ignore lint/style/noNonNullAssertion: 一定存在
+createRoot(document.getElementById('root')!).render(
+  <StrictMode>
+    <SplashApp />
+  </StrictMode>,
+)

apps/desktop/src/renderer/styles.css

@@ -0,0 +1 @@
+@import "tailwindcss";

apps/desktop/tsconfig.app.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@furtherverse/tsconfig/react.json",
+  "compilerOptions": {
+    "composite": true,
+    "types": ["vite/client"]
+  },
+  "include": ["src/renderer/**/*"]
+}

apps/desktop/tsconfig.json

@@ -1,4 +1,11 @@
 {
-  "extends": "@furtherverse/tsconfig/bun.json",
-  "exclude": ["node_modules", "src-tauri"]
+  "files": [],
+  "references": [
+    {
+      "path": "./tsconfig.app.json"
+    },
+    {
+      "path": "./tsconfig.node.json"
+    }
+  ]
 }

apps/desktop/tsconfig.node.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@furtherverse/tsconfig/base.json",
+  "compilerOptions": {
+    "composite": true,
+    "types": ["node"]
+  },
+  "include": ["src/main/**/*", "src/preload/**/*", "electron.vite.config.ts"]
+}

apps/desktop/turbo.json

@@ -3,12 +3,39 @@
   "extends": ["//"],
   "tasks": {
     "build": {
-      "dependsOn": ["@furtherverse/server#compile"],
-      "outputs": ["src-tauri/target/release/**"]
+      "outputs": ["out/**"]
     },
-    "dev": {
-      "dependsOn": ["@furtherverse/server#compile"],
-      "with": ["@furtherverse/server#dev"]
+    "dist": {
+      "dependsOn": ["build", "@furtherverse/server#compile"],
+      "outputs": ["dist/**"]
+    },
+    "dist:linux": {
+      "dependsOn": ["build", "@furtherverse/server#compile:linux:arm64", "@furtherverse/server#compile:linux:x64"],
+      "outputs": ["dist/**"]
+    },
+    "dist:linux:arm64": {
+      "dependsOn": ["build", "@furtherverse/server#compile:linux:arm64"],
+      "outputs": ["dist/**"]
+    },
+    "dist:linux:x64": {
+      "dependsOn": ["build", "@furtherverse/server#compile:linux:x64"],
+      "outputs": ["dist/**"]
+    },
+    "dist:mac": {
+      "dependsOn": ["build", "@furtherverse/server#compile:darwin:arm64", "@furtherverse/server#compile:darwin:x64"],
+      "outputs": ["dist/**"]
+    },
+    "dist:mac:arm64": {
+      "dependsOn": ["build", "@furtherverse/server#compile:darwin:arm64"],
+      "outputs": ["dist/**"]
+    },
+    "dist:mac:x64": {
+      "dependsOn": ["build", "@furtherverse/server#compile:darwin:x64"],
+      "outputs": ["dist/**"]
+    },
+    "dist:win": {
+      "dependsOn": ["build", "@furtherverse/server#compile:windows:x64"],
+      "outputs": ["dist/**"]
     }
   }
 }

apps/server/.env.example

@@ -1 +1 @@
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/postgres
+DATABASE_PATH=data.db

apps/server/AGENTS.md

@@ -1,155 +1,144 @@
-# AGENTS.md - AI Coding Agent Guidelines
+# AGENTS.md - Server App Guidelines
 
-本文档为 AI 编程助手提供此 TanStack Start 全栈项目的开发规范和指南。
+TanStack Start fullstack web app with ORPC (contract-first RPC).
 
-## 项目概览
+## Tech Stack
 
-- **框架**: TanStack Start (React SSR 框架，文件路由)
-- **运行时**: Bun
-- **语言**: TypeScript (strict mode, ESNext)
-- **样式**: Tailwind CSS v4
-- **数据库**: PostgreSQL + Drizzle ORM
-- **状态管理**: TanStack Query
-- **路由**: TanStack Router (文件路由)
-- **RPC**: ORPC (类型安全 RPC，契约优先)
-- **构建工具**: Vite + Turbo
-- **代码质量**: Biome (格式化 + Lint)
-- **桌面壳** (可选): Tauri v2 (详见 `src-tauri/AGENTS.md`)
+> **⚠️ This project uses Bun — NOT Node.js / npm. All commands use `bun`. Always use `bun run <script>` (not `bun <script>`) to avoid conflicts with Bun built-in subcommands. Never use `npm`, `npx`, or `node`.**
 
-## 构建、Lint 和测试命令
+- **Framework**: TanStack Start (React 19 SSR, file-based routing)
+- **Runtime**: Bun — **NOT Node.js**
+- **Package Manager**: Bun — **NOT npm / yarn / pnpm**
+- **Language**: TypeScript (strict mode)
+- **Styling**: Tailwind CSS v4
+- **Database**: PostgreSQL + Drizzle ORM v1 beta (`drizzle-orm/postgres-js`, RQBv2)
+- **State**: TanStack Query v5
+- **RPC**: ORPC (contract-first, type-safe)
+- **Build**: Vite + Nitro
+
+## Commands
 
-### 开发
 ```bash
-bun dev                    # 使用 Turbo 并行启动 Tauri + Vite 开发服务器
-bun dev:vite               # 仅启动 Vite 开发服务器 (localhost:3000)
-bun dev:tauri              # 启动 Tauri 桌面应用
-bun db:studio              # 打开 Drizzle Studio 数据库管理界面
+# Development
+bun run dev                    # Vite dev server (localhost:3000)
+bun run db:studio              # Drizzle Studio GUI
+
+# Build
+bun run build                  # Production build → .output/
+bun run compile                # Compile to standalone binary (current platform, depends on build)
+bun run compile:darwin         # Compile for macOS (arm64 + x64)
+bun run compile:darwin:arm64   # Compile for macOS arm64
+bun run compile:darwin:x64     # Compile for macOS x64
+bun run compile:linux          # Compile for Linux (x64 + arm64)
+bun run compile:linux:arm64    # Compile for Linux arm64
+bun run compile:linux:x64      # Compile for Linux x64
+bun run compile:windows        # Compile for Windows (default: x64)
+bun run compile:windows:x64    # Compile for Windows x64
+
+# Code Quality
+bun run fix                    # Biome auto-fix
+bun run typecheck              # TypeScript check
+
+# Database
+bun run db:generate            # Generate migrations from schema
+bun run db:migrate             # Run migrations
+bun run db:push                # Push schema directly (dev only)
+
+# Testing (not yet configured)
+bun test path/to/test.ts       # Run single test
+bun test -t "pattern"          # Run tests matching pattern
 ```
 
-### 构建
-```bash
-bun build                  # 完整构建 (Vite → 编译 → Tauri 打包)
-bun build:vite             # 仅构建 Vite (输出到 .output/)
-bun build:compile          # 编译为独立可执行文件 (使用 build.ts)
-bun build:tauri            # 构建 Tauri 桌面安装包
+## Directory Structure
+
+```
+src/
+├── client/                # Client-side code
+│   └── orpc.ts            # ORPC client + TanStack Query utils (single entry point)
+├── components/            # React components
+├── routes/                # TanStack Router file routes
+│   ├── __root.tsx         # Root layout
+│   ├── index.tsx          # Home page
+│   └── api/
+│       ├── $.ts           # OpenAPI handler + Scalar docs
+│       ├── health.ts      # Health check endpoint
+│       └── rpc.$.ts       # ORPC RPC handler
+├── server/                # Server-side code
+│   ├── api/               # ORPC layer
+│   │   ├── contracts/     # Input/output schemas (Zod)
+│   │   ├── middlewares/   # Middleware (db provider, auth)
+│   │   ├── routers/       # Handler implementations
+│   │   ├── interceptors.ts # Shared error interceptors
+│   │   ├── context.ts     # Request context
+│   │   ├── server.ts      # ORPC server instance
+│   │   └── types.ts       # Type exports
+│   └── db/
+│       ├── schema/        # Drizzle table definitions
+│       ├── fields.ts      # Shared field builders (id, createdAt, updatedAt)
+│       ├── relations.ts   # Drizzle relations (defineRelations, RQBv2)
+│       └── index.ts       # Database instance (postgres-js driver)
+├── env.ts                 # Environment variable validation
+├── router.tsx             # Router configuration
+├── routeTree.gen.ts       # Auto-generated (DO NOT EDIT)
+└── styles.css             # Tailwind entry
 ```
 
-### 代码质量
-```bash
-bun typecheck              # 运行 TypeScript 编译器检查 (tsc -b)
-bun fix                    # 运行 Biome 自动修复格式和 Lint 问题
-biome check .              # 检查但不自动修复
-biome format --write .     # 仅格式化代码
-```
+## ORPC Pattern
 
-### 数据库
-```bash
-bun db:generate            # 从 schema 生成迁移文件
-bun db:migrate             # 执行数据库迁移
-bun db:push                # 直接推送 schema 变更 (仅开发环境)
-```
-
-### 测试
-**注意**: 当前未配置测试框架。添加测试时:
-- 使用 Vitest 或 Bun 内置测试运行器
-- 运行单个测试文件: `bun test path/to/test.ts`
-- 运行特定测试: `bun test -t "测试名称模式"`
-
-## 代码风格指南
-
-### 格式化 (Biome)
-
-**缩进**: 2 空格 (不使用 tab)
-**换行符**: LF (Unix 风格)
-**引号**: 单引号 `'string'`
-**分号**: 按需 (ASI - 自动分号插入)
-**箭头函数括号**: 始终使用 `(x) => x`
-
-示例:
+### 1. Define Contract (`src/server/api/contracts/feature.contract.ts`)
 ```typescript
-const myFunc = (value: string) => {
-  return value.toUpperCase()
-}
-```
-
-### 导入组织
-
-Biome 自动组织导入。顺序:
-1. 外部依赖
-2. 内部导入 (使用 `@/*` 别名)
-3. 类型导入 (仅导入类型时使用 `type` 关键字)
-
-示例:
-```typescript
-import { createFileRoute } from '@tanstack/react-router'
 import { oc } from '@orpc/contract'
+import { createSelectSchema } from 'drizzle-orm/zod'
 import { z } from 'zod'
-import { db } from '@/db'
-import { todoTable } from '@/db/schema'
-import type { ReactNode } from 'react'
+import { featureTable } from '@/server/db/schema'
+
+const selectSchema = createSelectSchema(featureTable)
+
+export const list = oc.input(z.void()).output(z.array(selectSchema))
+export const create = oc.input(insertSchema).output(selectSchema)
 ```
 
-### TypeScript
-
-**严格模式**: 启用了额外的严格检查
-- `strict: true`
-- `noUncheckedIndexedAccess: true` - 数组/对象索引返回 `T | undefined`
-- `noImplicitOverride: true`
-- `noFallthroughCasesInSwitch: true`
-
-**模块解析**: `bundler` 模式 + `verbatimModuleSyntax`
-- 导入时始终使用 `.ts`/`.tsx` 扩展名
-- 使用 `@/*` 路径别名指向 `src/*`
-
-**类型注解**:
-- 公共 API 的函数参数和返回类型必须注解
-- 优先使用显式类型而非 `any`
-- 对象形状用 `type`，可扩展契约用 `interface`
-- 不可变 props 使用 `Readonly<T>`
-
-### 命名规范
-
-- **文件**: 工具函数用 kebab-case，组件用 PascalCase
-  - `utils.ts`, `todo.tsx`, `NotFound.tsx`
-- **路由**: 遵循 TanStack Router 约定
-  - `routes/index.tsx` → `/`
-  - `routes/__root.tsx` → 根布局
-- **组件**: PascalCase 箭头函数 (Biome 规则 `useArrowFunction` 强制)
-- **函数**: camelCase
-- **常量**: 真常量用 UPPER_SNAKE_CASE，配置对象用 camelCase
-- **类型/接口**: PascalCase
-
-### React 模式
-
-**组件**: 使用箭头函数
+### 2. Implement Router (`src/server/api/routers/feature.router.ts`)
 ```typescript
-const MyComponent = ({ title }: { title: string }) => {
-  return <div>{title}</div>
-}
-```
+import { ORPCError } from '@orpc/server'
+import { db } from '../middlewares'
+import { os } from '../server'
 
-**路由**: 使用 `createFileRoute` 定义路由
-```typescript
-export const Route = createFileRoute('/')({
-  component: Home,
+export const list = os.feature.list.use(db).handler(async ({ context }) => {
+  return await context.db.query.featureTable.findMany({
+    orderBy: { createdAt: 'desc' },
+  })
 })
 ```
 
-**数据获取**: 使用 TanStack Query hooks
-- `useSuspenseQuery` - 保证有数据
-- `useQuery` - 数据可能为空
+### 3. Register in Index Files
+```typescript
+// src/server/api/contracts/index.ts
+import * as feature from './feature.contract'
+export const contract = { feature }
 
-**Props**: 禁止直接修改 props (Biome 规则 `noReactPropAssignments`)
+// src/server/api/routers/index.ts
+import * as feature from './feature.router'
+export const router = os.router({ feature })
+```
 
-### 数据库 Schema (Drizzle)
+### 4. Use in Components
+```typescript
+import { useSuspenseQuery, useMutation } from '@tanstack/react-query'
+import { orpc } from '@/client/orpc'
 
-- 在 `src/db/schema/*.ts` 定义 schema
-- 从 `src/db/schema/index.ts` 导出
-- 使用 `drizzle-orm/pg-core` 的 PostgreSQL 类型
-- 主键使用 `uuidv7()` (需要 PostgreSQL 扩展)
-- 始终包含 `createdAt` 和 `updatedAt` 时间戳
+const { data } = useSuspenseQuery(orpc.feature.list.queryOptions())
+const mutation = useMutation(orpc.feature.create.mutationOptions())
+```
 
-示例:
+## Database (Drizzle ORM v1 beta)
+
+- **Driver**: `drizzle-orm/postgres-js` (NOT `bun-sql`)
+- **Validation**: `drizzle-orm/zod` (built-in, NOT separate `drizzle-zod` package)
+- **Relations**: Defined via `defineRelations()` in `src/server/db/relations.ts`
+- **Query**: RQBv2 — use `db.query.tableName.findMany()` with object-style `orderBy` and `where`
+
+### Schema Definition
 ```typescript
 import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core'
 import { sql } from 'drizzle-orm'
@@ -162,116 +151,129 @@ export const myTable = pgTable('my_table', {
 })
 ```
 
-### 环境变量
-
-- 使用 `@t3-oss/env-core` 进行类型安全的环境变量验证
-- 在 `src/env.ts` 定义 schema
-- 服务端变量: 无前缀
-- 客户端变量: 必须有 `VITE_` 前缀
-- 使用 Zod schema 验证
-
-### 错误处理
-
-- 异步操作使用 try-catch
-- 抛出带有描述性消息的错误
-- 用户界面错误优先使用 Result 类型或错误边界
-- 适当记录错误 (避免记录敏感数据)
-
-### 样式 (Tailwind CSS)
-
-- 使用 Tailwind v4 工具类
-- 通过 `@/styles.css?url` 导入样式
-- 优先使用组合而非自定义 CSS
-- 响应式修饰符: `sm:`, `md:`, `lg:`
-- UI 文本适当使用中文
-
-## 目录结构
-
-```
-src/
-├── components/            # 可复用 React 组件
-├── db/
-│   ├── schema/           # Drizzle schema 定义
-│   └── index.ts          # 数据库实例
-├── integrations/         # 第三方集成 (TanStack Query/Router)
-├── lib/                  # 工具函数
-├── orpc/                 # ORPC (RPC 层)
-│   ├── contracts/        # 契约定义 (input/output schemas)
-│   ├── handlers/         # 服务端过程实现
-│   ├── middlewares/      # 中间件 (如 DB provider)
-│   ├── contract.ts       # 契约聚合
-│   ├── router.ts         # 路由组合
-│   ├── server.ts         # 服务端实例
-│   └── client.ts         # 同构客户端
-├── routes/               # TanStack Router 文件路由
-│   ├── __root.tsx        # 根布局
-│   ├── index.tsx         # 首页
-│   └── api/rpc.$.ts      # ORPC HTTP 端点
-├── env.ts                # 环境变量验证
-└── router.tsx            # 路由配置
-```
-
-## 重要提示
-
-- **禁止** 编辑 `src/routeTree.gen.ts` - 自动生成
-- **禁止** 提交 `.env` 文件 - 使用 `.env.example` 作为模板
-- **必须** 在提交前运行 `bun fix`
-- **必须** 使用 `@/*` 路径别名而非相对导入
-- **必须** 利用 React Compiler (babel-plugin-react-compiler) - 避免手动 memoization
-
-## Git 工作流
-
-1. 按照上述风格指南进行修改
-2. 运行 `bun fix` 自动格式化和 lint
-3. 运行 `bun typecheck` 确保类型安全
-4. 使用 `bun dev` 本地测试变更
-5. 使用清晰的描述性消息提交
-
-## 常见模式
-
-### 创建 ORPC 过程
-
-**步骤 1: 定义契约** (`src/orpc/contracts/my-feature.ts`)
+### Relations (RQBv2)
 ```typescript
-import { oc } from '@orpc/contract'
+// src/server/db/relations.ts
+import { defineRelations } from 'drizzle-orm'
+import * as schema from './schema'
+
+export const relations = defineRelations(schema, (r) => ({
+  // Define relations here using r.one / r.many / r.through
+}))
+```
+
+### DB Instance
+```typescript
+// src/server/db/index.ts
+import { drizzle } from 'drizzle-orm/postgres-js'
+import { relations } from '@/server/db/relations'
+// In RQBv2, relations already contain schema info — no separate schema import needed
+
+const db = drizzle({
+  connection: env.DATABASE_URL,
+  relations,
+})
+```
+
+### RQBv2 Query Examples
+```typescript
+// Object-style orderBy (NOT callback style)
+const todos = await db.query.todoTable.findMany({
+  orderBy: { createdAt: 'desc' },
+})
+
+// Object-style where
+const todo = await db.query.todoTable.findFirst({
+  where: { id: someId },
+})
+```
+
+## Code Style
+
+### Formatting (Biome)
+- **Indent**: 2 spaces
+- **Quotes**: Single `'`
+- **Semicolons**: Omit (ASI)
+- **Arrow parens**: Always `(x) => x`
+
+### Imports
+Biome auto-organizes:
+1. External packages
+2. Internal `@/*` aliases
+3. Type imports (`import type { ... }`)
+
+```typescript
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { db } from '@/server/db'
+import type { ReactNode } from 'react'
+```
+
+### TypeScript
+- `strict: true`
+- `noUncheckedIndexedAccess: true` - array access returns `T | undefined`
+- Use `@/*` path aliases (maps to `src/*`)
+
+### Naming
+| Type | Convention | Example |
+|------|------------|---------|
+| Files (utils) | kebab-case | `auth-utils.ts` |
+| Files (components) | PascalCase | `UserProfile.tsx` |
+| Components | PascalCase arrow | `const Button = () => {}` |
+| Functions | camelCase | `getUserById` |
+| Types | PascalCase | `UserProfile` |
+
+### React
+- Use arrow functions for components (Biome enforced)
+- Use `useSuspenseQuery` for guaranteed data
+- Let React Compiler handle memoization (no manual `useMemo`/`useCallback`)
+
+## Environment Variables
+
+```typescript
+// src/env.ts - using @t3-oss/env-core
+import { createEnv } from '@t3-oss/env-core'
 import { z } from 'zod'
 
-export const myContract = {
-  get: oc.input(z.object({ id: z.uuid() })).output(mySchema),
-  create: oc.input(createSchema).output(mySchema),
-}
+export const env = createEnv({
+  server: {
+    DATABASE_URL: z.string().url(),
+  },
+  clientPrefix: 'VITE_',
+  client: {
+    VITE_API_URL: z.string().optional(),
+  },
+})
 ```
 
-**步骤 2: 实现处理器** (`src/orpc/handlers/my-feature.ts`)
-```typescript
-import { os } from '@/orpc/server'
-import { dbProvider } from '@/orpc/middlewares'
+## Development Principles
 
-export const get = os.myFeature.get
-  .use(dbProvider)
-  .handler(async ({ context, input }) => {
-    return await context.db.query.myTable.findFirst(...)
-  })
-```
+> **These principles apply to ALL code changes. Agents MUST follow them on every task.**
 
-**步骤 3: 注册到契约和路由**
-```typescript
-// src/orpc/contract.ts
-export const contract = { myFeature: myContract }
+1. **No backward compatibility** — This project is in rapid iteration. Always use the latest API and patterns. Never keep deprecated code paths or old API fallbacks.
+2. **Always sync documentation** — When code changes, immediately update all related documentation (`AGENTS.md`, `README.md`, inline code examples). Code and docs must never drift apart.
+3. **Forward-only migration** — When upgrading dependencies, fully adopt the new API. Don't mix old and new patterns.
 
-// src/orpc/router.ts
-import * as myFeature from './handlers/my-feature'
-export const router = os.router({ myFeature })
-```
+## Critical Rules
 
-**步骤 4: 在组件中使用**
-```typescript
-import { orpc } from '@/orpc'
-const query = useSuspenseQuery(orpc.myFeature.get.queryOptions({ id }))
-const mutation = useMutation(orpc.myFeature.create.mutationOptions())
-```
+**DO:**
+- Run `bun run fix` before committing
+- Use `@/*` path aliases
+- Include `createdAt`/`updatedAt` on all tables
+- Use `ORPCError` with proper codes
+- Use `drizzle-orm/zod` (NOT `drizzle-zod`) for schema validation
+- Use RQBv2 object syntax for `orderBy` and `where`
+- Update `AGENTS.md` and other docs whenever code patterns change
 
----
-
-**最后更新**: 2026-01-18
-**项目版本**: 基于 package.json 依赖版本
+**DON'T:**
+- Use `npm`, `npx`, `node`, `yarn`, `pnpm` — always use `bun` / `bunx`
+- Edit `src/routeTree.gen.ts` (auto-generated)
+- Use `as any`, `@ts-ignore`, `@ts-expect-error`
+- Commit `.env` files
+- Use empty catch blocks
+- Import from `drizzle-zod` (use `drizzle-orm/zod` instead)
+- Use RQBv1 callback-style `orderBy` / old `relations()` API
+- Use `drizzle-orm/bun-sql` driver (use `drizzle-orm/postgres-js`)
+- Pass `schema` to `drizzle()` constructor (only `relations` is needed in RQBv2)
+- Import `os` from `@orpc/server` in middleware — use `@/server/api/server` (the local typed instance)
+- Leave docs out of sync with code changes

apps/server/biome.json

@@ -3,5 +3,10 @@
   "extends": "//",
   "files": {
     "includes": ["**", "!**/routeTree.gen.ts"]
+  },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    }
   }
 }

apps/server/build.ts

@@ -1,289 +0,0 @@
-import { Schema } from '@effect/schema'
-import { $ } from 'bun'
-import { Console, Context, Data, Effect, Layer } from 'effect'
-
-// ============================================================================
-// Domain Models & Schema
-// ============================================================================
-
-const BunTargetSchema = Schema.Literal(
-  'bun-windows-x64',
-  'bun-darwin-arm64',
-  'bun-darwin-x64',
-  'bun-linux-x64',
-  'bun-linux-arm64',
-)
-
-/**
- * 将 bun target 转换为文件后缀 (去掉 'bun-' 前缀)
- */
-const getTargetSuffix = (target: BunTarget): string => {
-  return target.replace('bun-', '')
-}
-
-type BunTarget = Schema.Schema.Type<typeof BunTargetSchema>
-
-const BuildConfigSchema = Schema.Struct({
-  entrypoint: Schema.String.pipe(Schema.nonEmptyString()),
-  outputDir: Schema.String.pipe(Schema.nonEmptyString()),
-  outfile: Schema.String.pipe(Schema.nonEmptyString()),
-  targets: Schema.Array(BunTargetSchema).pipe(Schema.minItems(1)),
-})
-
-type BuildConfig = Schema.Schema.Type<typeof BuildConfigSchema>
-
-const BuildResultSchema = Schema.Struct({
-  target: BunTargetSchema,
-  outputs: Schema.Array(Schema.String),
-})
-
-type BuildResult = Schema.Schema.Type<typeof BuildResultSchema>
-
-// ============================================================================
-// Error Models (使用 Data.TaggedError)
-// ============================================================================
-
-class CleanError extends Data.TaggedError('CleanError')<{
-  readonly dir: string
-  readonly cause: unknown
-}> {}
-
-class BuildError extends Data.TaggedError('BuildError')<{
-  readonly target: BunTarget
-  readonly cause: unknown
-}> {}
-
-class ConfigError extends Data.TaggedError('ConfigError')<{
-  readonly message: string
-  readonly cause: unknown
-}> {}
-
-// ============================================================================
-// Services
-// ============================================================================
-
-/**
- * 配置服务
- */
-class BuildConfigService extends Context.Tag('BuildConfigService')<
-  BuildConfigService,
-  BuildConfig
->() {
-  /**
-   * 从原始数据创建并验证配置
-   */
-  static fromRaw = (raw: unknown) =>
-    Effect.gen(function* () {
-      const decoded = yield* Schema.decodeUnknown(BuildConfigSchema)(raw)
-      return decoded
-    }).pipe(
-      Effect.catchAll((error) =>
-        Effect.fail(
-          new ConfigError({
-            message: '配置验证失败',
-            cause: error,
-          }),
-        ),
-      ),
-    )
-
-  /**
-   * 默认配置 Layer
-   */
-  static readonly Live = Layer.effect(
-    BuildConfigService,
-    BuildConfigService.fromRaw({
-      entrypoint: '.output/server/index.mjs',
-      outputDir: 'out',
-      outfile: 'server',
-      targets: ['bun-windows-x64', 'bun-darwin-arm64', 'bun-linux-x64'],
-    } satisfies BuildConfig),
-  )
-}
-
-/**
- * 文件系统服务
- */
-class FileSystemService extends Context.Tag('FileSystemService')<
-  FileSystemService,
-  {
-    readonly cleanDir: (dir: string) => Effect.Effect<void, CleanError>
-  }
->() {
-  static readonly Live = Layer.succeed(FileSystemService, {
-    cleanDir: (dir: string) =>
-      Effect.tryPromise({
-        try: async () => {
-          await $`rm -rf ${dir}`
-        },
-        catch: (cause: unknown) =>
-          new CleanError({
-            dir,
-            cause,
-          }),
-      }),
-  })
-}
-
-/**
- * 构建服务
- */
-class BuildService extends Context.Tag('BuildService')<
-  BuildService,
-  {
-    readonly buildForTarget: (
-      config: BuildConfig,
-      target: BunTarget,
-    ) => Effect.Effect<BuildResult, BuildError>
-    readonly buildAll: (
-      config: BuildConfig,
-    ) => Effect.Effect<ReadonlyArray<BuildResult>, BuildError>
-  }
->() {
-  static readonly Live = Layer.succeed(BuildService, {
-    buildForTarget: (config: BuildConfig, target: BunTarget) =>
-      Effect.gen(function* () {
-        yield* Console.log(`🔨 开始构建: ${target}`)
-
-        const output = yield* Effect.tryPromise({
-          try: () =>
-            Bun.build({
-              entrypoints: [config.entrypoint],
-              compile: {
-                outfile: `${config.outfile}-${getTargetSuffix(target)}`,
-                target: target,
-              },
-              outdir: config.outputDir,
-            }),
-          catch: (cause: unknown) =>
-            new BuildError({
-              target,
-              cause,
-            }),
-        })
-
-        const paths = output.outputs.map((item: { path: string }) => item.path)
-
-        return {
-          target,
-          outputs: paths,
-        } satisfies BuildResult
-      }),
-
-    buildAll: (config: BuildConfig) =>
-      Effect.gen(function* () {
-        const effects = config.targets.map((target) =>
-          Effect.gen(function* () {
-            yield* Console.log(`🔨 开始构建: ${target}`)
-
-            const output = yield* Effect.tryPromise({
-              try: () =>
-                Bun.build({
-                  entrypoints: [config.entrypoint],
-                  compile: {
-                    outfile: `${config.outfile}-${getTargetSuffix(target)}`,
-                    target: target,
-                  },
-                  outdir: config.outputDir,
-                }),
-              catch: (cause: unknown) =>
-                new BuildError({
-                  target,
-                  cause,
-                }),
-            })
-
-            const paths = output.outputs.map(
-              (item: { path: string }) => item.path,
-            )
-
-            return {
-              target,
-              outputs: paths,
-            } satisfies BuildResult
-          }),
-        )
-        return yield* Effect.all(effects, { concurrency: 'unbounded' })
-      }),
-  })
-}
-
-/**
- * 报告服务
- */
-class ReporterService extends Context.Tag('ReporterService')<
-  ReporterService,
-  {
-    readonly printSummary: (
-      results: ReadonlyArray<BuildResult>,
-    ) => Effect.Effect<void>
-  }
->() {
-  static readonly Live = Layer.succeed(ReporterService, {
-    printSummary: (results: ReadonlyArray<BuildResult>) =>
-      Effect.gen(function* () {
-        yield* Console.log('\n📦 构建完成:')
-        for (const result of results) {
-          yield* Console.log(`  ${result.target}:`)
-          for (const path of result.outputs) {
-            yield* Console.log(`    - ${path}`)
-          }
-        }
-      }),
-  })
-}
-
-// ============================================================================
-// Main Program
-// ============================================================================
-
-const program = Effect.gen(function* () {
-  const config = yield* BuildConfigService
-  const fs = yield* FileSystemService
-  const builder = yield* BuildService
-  const reporter = yield* ReporterService
-
-  // 1. 清理输出目录
-  yield* fs.cleanDir(config.outputDir)
-  yield* Console.log(`✓ 已清理输出目录: ${config.outputDir}`)
-
-  // 2. 并行构建所有目标
-  const results = yield* builder.buildAll(config)
-
-  // 3. 输出构建摘要
-  yield* reporter.printSummary(results)
-
-  return results
-})
-
-// ============================================================================
-// Layer Composition
-// ============================================================================
-
-const MainLayer = Layer.mergeAll(
-  BuildConfigService.Live,
-  FileSystemService.Live,
-  BuildService.Live,
-  ReporterService.Live,
-)
-
-// ============================================================================
-// Runner
-// ============================================================================
-
-const runnable = program.pipe(
-  Effect.provide(MainLayer),
-  Effect.catchTags({
-    CleanError: (error) =>
-      Console.error(`❌ 清理目录失败: ${error.dir}`, error.cause),
-    BuildError: (error) =>
-      Console.error(`❌ 构建失败 [${error.target}]:`, error.cause),
-    ConfigError: (error) =>
-      Console.error(`❌ 配置错误: ${error.message}`, error.cause),
-  }),
-  Effect.tapErrorCause((cause) => Console.error('❌ 未预期的错误:', cause)),
-)
-
-Effect.runPromise(runnable).catch(() => {
-  process.exit(1)
-})

apps/server/compile.ts

@@ -0,0 +1,64 @@
+import { mkdir, rm } from 'node:fs/promises'
+import { parseArgs } from 'node:util'
+
+const ENTRYPOINT = '.output/server/index.mjs'
+const OUTDIR = 'out'
+
+const SUPPORTED_TARGETS: readonly Bun.Build.CompileTarget[] = [
+  'bun-windows-x64',
+  'bun-darwin-arm64',
+  'bun-darwin-x64',
+  'bun-linux-x64',
+  'bun-linux-arm64',
+]
+
+const isSupportedTarget = (value: string): value is Bun.Build.CompileTarget =>
+  (SUPPORTED_TARGETS as readonly string[]).includes(value)
+
+const { values } = parseArgs({
+  options: { target: { type: 'string' } },
+  strict: true,
+  allowPositionals: false,
+})
+
+const resolveTarget = (): Bun.Build.CompileTarget => {
+  if (values.target !== undefined) {
+    if (!isSupportedTarget(values.target)) {
+      throw new Error(`Invalid target: ${values.target}\nAllowed: ${SUPPORTED_TARGETS.join(', ')}`)
+    }
+    return values.target
+  }
+
+  const os = process.platform === 'win32' ? 'windows' : process.platform
+  const candidate = `bun-${os}-${process.arch}`
+  if (!isSupportedTarget(candidate)) {
+    throw new Error(`Unsupported host: ${process.platform}-${process.arch}`)
+  }
+  return candidate
+}
+
+const main = async () => {
+  const target = resolveTarget()
+  const suffix = target.replace('bun-', '')
+  const outfile = `server-${suffix}`
+
+  await mkdir(OUTDIR, { recursive: true })
+  await Promise.all([rm(`${OUTDIR}/${outfile}`, { force: true }), rm(`${OUTDIR}/${outfile}.exe`, { force: true })])
+
+  const result = await Bun.build({
+    entrypoints: [ENTRYPOINT],
+    outdir: OUTDIR,
+    compile: { outfile, target },
+  })
+
+  if (!result.success) {
+    throw new Error(result.logs.map(String).join('\n'))
+  }
+
+  console.log(`✓ ${target} → ${OUTDIR}/${outfile}`)
+}
+
+main().catch((err) => {
+  console.error('❌', err instanceof Error ? err.message : err)
+  process.exit(1)
+})

apps/server/drizzle.config.ts

@@ -1,11 +1,12 @@
 import { defineConfig } from 'drizzle-kit'
-import { env } from '@/env'
+
+const databasePath = process.env.DATABASE_PATH ?? 'data.db'
 
 export default defineConfig({
   out: './drizzle',
   schema: './src/server/db/schema/index.ts',
-  dialect: 'postgresql',
+  dialect: 'sqlite',
   dbCredentials: {
-    url: env.DATABASE_URL,
+    url: databasePath,
   },
 })

apps/server/package.json

@@ -4,18 +4,26 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "build": "vite build",
-    "compile": "bun build.ts",
-    "db:generate": "drizzle-kit generate",
-    "db:migrate": "drizzle-kit migrate",
-    "db:push": "drizzle-kit push",
-    "db:studio": "drizzle-kit studio",
-    "dev": "vite dev",
+    "build": "bunx --bun vite build",
+    "compile": "bun compile.ts",
+    "compile:darwin": "bun run compile:darwin:arm64 && bun run compile:darwin:x64",
+    "compile:darwin:arm64": "bun compile.ts --target bun-darwin-arm64",
+    "compile:darwin:x64": "bun compile.ts --target bun-darwin-x64",
+    "compile:linux": "bun run compile:linux:x64 && bun run compile:linux:arm64",
+    "compile:linux:arm64": "bun compile.ts --target bun-linux-arm64",
+    "compile:linux:x64": "bun compile.ts --target bun-linux-x64",
+    "compile:windows": "bun run compile:windows:x64",
+    "compile:windows:x64": "bun compile.ts --target bun-windows-x64",
+    "db:generate": "bun --bun drizzle-kit generate",
+    "db:migrate": "bun --bun drizzle-kit migrate",
+    "db:push": "bun --bun drizzle-kit push",
+    "db:studio": "bun --bun drizzle-kit studio",
+    "dev": "bunx --bun vite dev",
     "fix": "biome check --write",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@furtherverse/utils": "workspace:*",
+    "@furtherverse/crypto": "workspace:*",
     "@orpc/client": "catalog:",
     "@orpc/contract": "catalog:",
     "@orpc/openapi": "catalog:",
@@ -27,18 +35,15 @@
     "@tanstack/react-router": "catalog:",
     "@tanstack/react-router-ssr-query": "catalog:",
     "@tanstack/react-start": "catalog:",
-    "@tauri-apps/api": "catalog:",
     "drizzle-orm": "catalog:",
-    "drizzle-zod": "catalog:",
-    "postgres": "catalog:",
+    "jszip": "catalog:",
     "react": "catalog:",
     "react-dom": "catalog:",
+    "systeminformation": "catalog:",
     "uuid": "catalog:",
     "zod": "catalog:"
   },
   "devDependencies": {
-    "@effect/platform": "catalog:",
-    "@effect/schema": "catalog:",
     "@furtherverse/tsconfig": "workspace:*",
     "@tailwindcss/vite": "catalog:",
     "@tanstack/devtools-vite": "catalog:",
@@ -49,10 +54,8 @@
     "@vitejs/plugin-react": "catalog:",
     "babel-plugin-react-compiler": "catalog:",
     "drizzle-kit": "catalog:",
-    "effect": "catalog:",
     "nitro": "catalog:",
     "tailwindcss": "catalog:",
-    "typescript": "catalog:",
     "vite": "catalog:",
     "vite-tsconfig-paths": "catalog:"
   }

apps/server/src/client/orpc.ts

@@ -1,6 +1,7 @@
 import { createORPCClient } from '@orpc/client'
 import { RPCLink } from '@orpc/client/fetch'
 import { createRouterClient } from '@orpc/server'
+import { createTanstackQueryUtils } from '@orpc/tanstack-query'
 import { createIsomorphicFn } from '@tanstack/react-start'
 import { getRequestHeaders } from '@tanstack/react-start/server'
 import { router } from '@/server/api/routers'
@@ -21,4 +22,6 @@ const getORPCClient = createIsomorphicFn()
     return createORPCClient<RouterClient>(link)
   })
 
-export const orpc: RouterClient = getORPCClient()
+const client: RouterClient = getORPCClient()
+
+export const orpc = createTanstackQueryUtils(client)

apps/server/src/client/query-client.ts

@@ -1,30 +0,0 @@
-import { createTanstackQueryUtils } from '@orpc/tanstack-query'
-import { orpc as orpcClient } from './orpc.client'
-
-export const orpc = createTanstackQueryUtils(orpcClient, {
-  experimental_defaults: {
-    todo: {
-      create: {
-        mutationOptions: {
-          onSuccess: (_, __, ___, ctx) => {
-            ctx.client.invalidateQueries({ queryKey: orpc.todo.list.key() })
-          },
-        },
-      },
-      update: {
-        mutationOptions: {
-          onSuccess: (_, __, ___, ctx) => {
-            ctx.client.invalidateQueries({ queryKey: orpc.todo.list.key() })
-          },
-        },
-      },
-      remove: {
-        mutationOptions: {
-          onSuccess: (_, __, ___, ctx) => {
-            ctx.client.invalidateQueries({ queryKey: orpc.todo.list.key() })
-          },
-        },
-      },
-    },
-  },
-})

apps/server/src/env.ts

@@ -3,7 +3,7 @@ import { z } from 'zod'
 
 export const env = createEnv({
   server: {
-    DATABASE_URL: z.url(),
+    DATABASE_PATH: z.string().min(1).default('data.db'),
   },
   clientPrefix: 'VITE_',
   client: {

apps/server/src/routeTree.gen.ts

@@ -10,6 +10,7 @@
 
 import { Route as rootRouteImport } from './routes/__root'
 import { Route as IndexRouteImport } from './routes/index'
+import { Route as ApiHealthRouteImport } from './routes/api/health'
 import { Route as ApiSplatRouteImport } from './routes/api/$'
 import { Route as ApiRpcSplatRouteImport } from './routes/api/rpc.$'
 
@@ -18,6 +19,11 @@ const IndexRoute = IndexRouteImport.update({
   path: '/',
   getParentRoute: () => rootRouteImport,
 } as any)
+const ApiHealthRoute = ApiHealthRouteImport.update({
+  id: '/api/health',
+  path: '/api/health',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const ApiSplatRoute = ApiSplatRouteImport.update({
   id: '/api/$',
   path: '/api/$',
@@ -32,30 +38,34 @@ const ApiRpcSplatRoute = ApiRpcSplatRouteImport.update({
 export interface FileRoutesByFullPath {
   '/': typeof IndexRoute
   '/api/$': typeof ApiSplatRoute
+  '/api/health': typeof ApiHealthRoute
   '/api/rpc/$': typeof ApiRpcSplatRoute
 }
 export interface FileRoutesByTo {
   '/': typeof IndexRoute
   '/api/$': typeof ApiSplatRoute
+  '/api/health': typeof ApiHealthRoute
   '/api/rpc/$': typeof ApiRpcSplatRoute
 }
 export interface FileRoutesById {
   __root__: typeof rootRouteImport
   '/': typeof IndexRoute
   '/api/$': typeof ApiSplatRoute
+  '/api/health': typeof ApiHealthRoute
   '/api/rpc/$': typeof ApiRpcSplatRoute
 }
 export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
-  fullPaths: '/' | '/api/$' | '/api/rpc/$'
+  fullPaths: '/' | '/api/$' | '/api/health' | '/api/rpc/$'
   fileRoutesByTo: FileRoutesByTo
-  to: '/' | '/api/$' | '/api/rpc/$'
-  id: '__root__' | '/' | '/api/$' | '/api/rpc/$'
+  to: '/' | '/api/$' | '/api/health' | '/api/rpc/$'
+  id: '__root__' | '/' | '/api/$' | '/api/health' | '/api/rpc/$'
   fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
   IndexRoute: typeof IndexRoute
   ApiSplatRoute: typeof ApiSplatRoute
+  ApiHealthRoute: typeof ApiHealthRoute
   ApiRpcSplatRoute: typeof ApiRpcSplatRoute
 }
 
@@ -68,6 +78,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof IndexRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/api/health': {
+      id: '/api/health'
+      path: '/api/health'
+      fullPath: '/api/health'
+      preLoaderRoute: typeof ApiHealthRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/api/$': {
       id: '/api/$'
       path: '/api/$'
@@ -88,6 +105,7 @@ declare module '@tanstack/react-router' {
 const rootRouteChildren: RootRouteChildren = {
   IndexRoute: IndexRoute,
   ApiSplatRoute: ApiSplatRoute,
+  ApiHealthRoute: ApiHealthRoute,
   ApiRpcSplatRoute: ApiRpcSplatRoute,
 }
 export const routeTree = rootRouteImport

apps/server/src/router.tsx

@@ -5,7 +5,14 @@ import type { RouterContext } from './routes/__root'
 import { routeTree } from './routeTree.gen'
 
 export const getRouter = () => {
-  const queryClient = new QueryClient()
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        staleTime: 30 * 1000,
+        retry: 1,
+      },
+    },
+  })
 
   const router = createRouter({
     routeTree,

apps/server/src/routes/__root.tsx

@@ -1,15 +1,11 @@
 import { TanStackDevtools } from '@tanstack/react-devtools'
 import type { QueryClient } from '@tanstack/react-query'
 import { ReactQueryDevtoolsPanel } from '@tanstack/react-query-devtools'
-import {
-  createRootRouteWithContext,
-  HeadContent,
-  Scripts,
-} from '@tanstack/react-router'
+import { createRootRouteWithContext, HeadContent, Scripts } from '@tanstack/react-router'
 import { TanStackRouterDevtoolsPanel } from '@tanstack/react-router-devtools'
 import type { ReactNode } from 'react'
 import { ErrorComponent } from '@/components/Error'
-import { NotFoundComponent } from '@/components/NotFount'
+import { NotFoundComponent } from '@/components/NotFound'
 import appCss from '@/styles.css?url'
 
 export interface RouterContext {
@@ -50,6 +46,7 @@ function RootDocument({ children }: Readonly<{ children: ReactNode }>) {
       </head>
       <body>
         {children}
+        {import.meta.env.DEV && (
           <TanStackDevtools
             config={{
               position: 'bottom-right',
@@ -65,6 +62,7 @@ function RootDocument({ children }: Readonly<{ children: ReactNode }>) {
               },
             ]}
           />
+        )}
         <Scripts />
       </body>
     </html>

apps/server/src/routes/api/$.ts

@@ -1,10 +1,10 @@
 import { OpenAPIHandler } from '@orpc/openapi/fetch'
 import { OpenAPIReferencePlugin } from '@orpc/openapi/plugins'
-import { ORPCError, onError, ValidationError } from '@orpc/server'
+import { onError } from '@orpc/server'
 import { ZodToJsonSchemaConverter } from '@orpc/zod/zod4'
 import { createFileRoute } from '@tanstack/react-router'
-import { z } from 'zod'
 import { name, version } from '@/../package.json'
+import { handleValidationError, logError } from '@/server/api/interceptors'
 import { router } from '@/server/api/routers'
 
 const handler = new OpenAPIHandler(router, {
@@ -16,56 +16,15 @@ const handler = new OpenAPIHandler(router, {
         info: {
           title: name,
           version,
+          description: 'UX 授权服务 OpenAPI 文档：设备授权、任务解密、摘要加密与报告签名打包接口。',
         },
-        // components: {
-        //   securitySchemes: {
-        //     bearerAuth: {
-        //       type: 'http',
-        //       scheme: 'bearer',
-        //     },
-        //   },
-        // },
       },
       docsPath: '/docs',
       specPath: '/spec.json',
     }),
   ],
-  interceptors: [
-    onError((error) => {
-      console.error(error)
-    }),
-  ],
-  clientInterceptors: [
-    onError((error) => {
-      if (
-        error instanceof ORPCError &&
-        error.code === 'BAD_REQUEST' &&
-        error.cause instanceof ValidationError
-      ) {
-        // If you only use Zod you can safely cast to ZodIssue[]
-        const zodError = new z.ZodError(
-          error.cause.issues as z.core.$ZodIssue[],
-        )
-
-        throw new ORPCError('INPUT_VALIDATION_FAILED', {
-          status: 422,
-          message: z.prettifyError(zodError),
-          data: z.flattenError(zodError),
-          cause: error.cause,
-        })
-      }
-
-      if (
-        error instanceof ORPCError &&
-        error.code === 'INTERNAL_SERVER_ERROR' &&
-        error.cause instanceof ValidationError
-      ) {
-        throw new ORPCError('OUTPUT_VALIDATION_FAILED', {
-          cause: error.cause,
-        })
-      }
-    }),
-  ],
+  interceptors: [onError(logError)],
+  clientInterceptors: [onError(handleValidationError)],
 })
 
 export const Route = createFileRoute('/api/$')({

apps/server/src/routes/api/health.ts

@@ -0,0 +1,27 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { name, version } from '@/../package.json'
+
+const createHealthResponse = (): Response =>
+  Response.json(
+    {
+      status: 'ok',
+      service: name,
+      version,
+      timestamp: new Date().toISOString(),
+    },
+    {
+      status: 200,
+      headers: {
+        'cache-control': 'no-store',
+      },
+    },
+  )
+
+export const Route = createFileRoute('/api/health')({
+  server: {
+    handlers: {
+      GET: async () => createHealthResponse(),
+      HEAD: async () => new Response(null, { status: 200 }),
+    },
+  },
+})

apps/server/src/routes/api/rpc.$.ts

@@ -1,46 +1,12 @@
-import { ORPCError, onError, ValidationError } from '@orpc/server'
+import { onError } from '@orpc/server'
 import { RPCHandler } from '@orpc/server/fetch'
 import { createFileRoute } from '@tanstack/react-router'
-import { z } from 'zod'
+import { handleValidationError, logError } from '@/server/api/interceptors'
 import { router } from '@/server/api/routers'
 
 const handler = new RPCHandler(router, {
-  interceptors: [
-    onError((error) => {
-      console.error(error)
-    }),
-  ],
-  clientInterceptors: [
-    onError((error) => {
-      if (
-        error instanceof ORPCError &&
-        error.code === 'BAD_REQUEST' &&
-        error.cause instanceof ValidationError
-      ) {
-        // If you only use Zod you can safely cast to ZodIssue[]
-        const zodError = new z.ZodError(
-          error.cause.issues as z.core.$ZodIssue[],
-        )
-
-        throw new ORPCError('INPUT_VALIDATION_FAILED', {
-          status: 422,
-          message: z.prettifyError(zodError),
-          data: z.flattenError(zodError),
-          cause: error.cause,
-        })
-      }
-
-      if (
-        error instanceof ORPCError &&
-        error.code === 'INTERNAL_SERVER_ERROR' &&
-        error.cause instanceof ValidationError
-      ) {
-        throw new ORPCError('OUTPUT_VALIDATION_FAILED', {
-          cause: error.cause,
-        })
-      }
-    }),
-  ],
+  interceptors: [onError(logError)],
+  clientInterceptors: [onError(handleValidationError)],
 })
 
 export const Route = createFileRoute('/api/rpc/$')({

apps/server/src/routes/index.tsx

@@ -1,215 +1,21 @@
-import { useMutation, useSuspenseQuery } from '@tanstack/react-query'
 import { createFileRoute } from '@tanstack/react-router'
-import { isTauri } from '@tauri-apps/api/core'
-import { getCurrentWindow } from '@tauri-apps/api/window'
-import type { ChangeEventHandler, FormEventHandler } from 'react'
-import { useEffect, useState } from 'react'
-import { orpc } from '@/client/query-client'
 
 export const Route = createFileRoute('/')({
-  component: Todos,
-  loader: async ({ context }) => {
-    await context.queryClient.ensureQueryData(orpc.todo.list.queryOptions())
-  },
+  component: Home,
 })
 
-function Todos() {
-  const [newTodoTitle, setNewTodoTitle] = useState('')
-
-  const listQuery = useSuspenseQuery(orpc.todo.list.queryOptions())
-  const createMutation = useMutation(orpc.todo.create.mutationOptions())
-  const updateMutation = useMutation(orpc.todo.update.mutationOptions())
-  const deleteMutation = useMutation(orpc.todo.remove.mutationOptions())
-
-  useEffect(() => {
-    if (!isTauri()) return
-    getCurrentWindow().setTitle('待办事项')
-  }, [])
-
-  const handleCreateTodo: FormEventHandler<HTMLFormElement> = (e) => {
-    e.preventDefault()
-    if (newTodoTitle.trim()) {
-      createMutation.mutate({ title: newTodoTitle.trim() })
-      setNewTodoTitle('')
-    }
-  }
-
-  const handleInputChange: ChangeEventHandler<HTMLInputElement> = (e) => {
-    setNewTodoTitle(e.target.value)
-  }
-
-  const handleToggleTodo = (id: string, currentCompleted: boolean) => {
-    updateMutation.mutate({
-      id,
-      data: { completed: !currentCompleted },
-    })
-  }
-
-  const handleDeleteTodo = (id: string) => {
-    deleteMutation.mutate({ id })
-  }
-
-  const todos = listQuery.data
-  const completedCount = todos.filter((todo) => todo.completed).length
-  const totalCount = todos.length
-  const progress = totalCount > 0 ? (completedCount / totalCount) * 100 : 0
-
+function Home() {
   return (
-    <div className="min-h-screen bg-slate-50 py-12 px-4 sm:px-6 font-sans">
-      <div className="max-w-2xl mx-auto space-y-8">
-        {/* Header */}
-        <div className="flex items-end justify-between">
-          <div>
-            <h1 className="text-3xl font-bold text-slate-900 tracking-tight">
-              我的待办
-            </h1>
-            <p className="text-slate-500 mt-1">保持专注，逐个击破</p>
-          </div>
-          <div className="text-right">
-            <div className="text-2xl font-semibold text-slate-900">
-              {completedCount}
-              <span className="text-slate-400 text-lg">/{totalCount}</span>
-            </div>
-            <div className="text-xs font-medium text-slate-400 uppercase tracking-wider">
-              已完成
-            </div>
-          </div>
-        </div>
-
-        {/* Add Todo Form */}
-        <form onSubmit={handleCreateTodo} className="relative group z-10">
-          <div className="relative transform transition-all duration-200 focus-within:-translate-y-1">
-            <input
-              type="text"
-              value={newTodoTitle}
-              onChange={handleInputChange}
-              placeholder="添加新任务..."
-              className="w-full pl-6 pr-32 py-5 bg-white rounded-2xl shadow-[0_8px_30px_rgb(0,0,0,0.04)] border-0 ring-1 ring-slate-100 focus:ring-2 focus:ring-indigo-500/50 outline-none transition-all placeholder:text-slate-400 text-lg text-slate-700"
-              disabled={createMutation.isPending}
-            />
-            <button
-              type="submit"
-              disabled={createMutation.isPending || !newTodoTitle.trim()}
-              className="absolute right-3 top-3 bottom-3 px-6 bg-indigo-600 hover:bg-indigo-700 text-white rounded-xl font-medium transition-all shadow-md shadow-indigo-200 disabled:opacity-50 disabled:shadow-none hover:shadow-lg hover:shadow-indigo-300 active:scale-95"
-            >
-              {createMutation.isPending ? '添加中' : '添加'}
-            </button>
-          </div>
-        </form>
-
-        {/* Progress Bar (Only visible when there are tasks) */}
-        {totalCount > 0 && (
-          <div className="h-1.5 w-full bg-slate-200 rounded-full overflow-hidden">
-            <div
-              className="h-full bg-indigo-500 transition-all duration-500 ease-out rounded-full"
-              style={{ width: `${progress}%` }}
-            />
-          </div>
-        )}
-
-        {/* Todo List */}
-        <div className="space-y-3">
-          {todos.length === 0 ? (
-            <div className="py-20 text-center">
-              <div className="inline-flex items-center justify-center w-16 h-16 rounded-full bg-slate-100 mb-4">
-                <svg
-                  className="w-8 h-8 text-slate-400"
-                  fill="none"
-                  viewBox="0 0 24 24"
-                  stroke="currentColor"
-                  aria-hidden="true"
-                >
-                  <path
-                    strokeLinecap="round"
-                    strokeLinejoin="round"
-                    strokeWidth={1.5}
-                    d="M12 6v6m0 0v6m0-6h6m-6 0H6"
-                  />
-                </svg>
-              </div>
-              <p className="text-slate-500 text-lg font-medium">没有待办事项</p>
-              <p className="text-slate-400 text-sm mt-1">
-                输入上方内容添加您的第一个任务
+    <div className="min-h-screen bg-slate-50 flex items-center justify-center font-sans">
+      <div className="text-center space-y-4">
+        <h1 className="text-3xl font-bold text-slate-900 tracking-tight">UX Server</h1>
+        <p className="text-slate-500">
+          API:&nbsp;
+          <a href="/api" className="text-indigo-600 hover:text-indigo-700 underline">
+            /api
+          </a>
         </p>
       </div>
-          ) : (
-            todos.map((todo) => (
-              <div
-                key={todo.id}
-                className={`group relative flex items-center p-4 bg-white rounded-xl border border-slate-100 shadow-sm transition-all duration-200 hover:shadow-md hover:border-slate-200 ${
-                  todo.completed ? 'bg-slate-50/50' : ''
-                }`}
-              >
-                <button
-                  type="button"
-                  onClick={() => handleToggleTodo(todo.id, todo.completed)}
-                  className={`flex-shrink-0 w-6 h-6 rounded-full border-2 transition-all duration-200 flex items-center justify-center mr-4 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500 ${
-                    todo.completed
-                      ? 'bg-indigo-500 border-indigo-500'
-                      : 'border-slate-300 hover:border-indigo-500 bg-white'
-                  }`}
-                >
-                  {todo.completed && (
-                    <svg
-                      className="w-3.5 h-3.5 text-white"
-                      fill="none"
-                      viewBox="0 0 24 24"
-                      stroke="currentColor"
-                      strokeWidth={3}
-                      aria-hidden="true"
-                    >
-                      <path
-                        strokeLinecap="round"
-                        strokeLinejoin="round"
-                        d="M5 13l4 4L19 7"
-                      />
-                    </svg>
-                  )}
-                </button>
-
-                <div className="flex-1 min-w-0">
-                  <p
-                    className={`text-lg transition-all duration-200 truncate ${
-                      todo.completed
-                        ? 'text-slate-400 line-through decoration-slate-300 decoration-2'
-                        : 'text-slate-700'
-                    }`}
-                  >
-                    {todo.title}
-                  </p>
-                </div>
-
-                <div className="flex items-center opacity-0 group-hover:opacity-100 transition-opacity duration-200 absolute right-4 pl-4 bg-gradient-to-l from-white via-white to-transparent sm:static sm:bg-none">
-                  <span className="text-xs text-slate-400 mr-3 hidden sm:inline-block">
-                    {new Date(todo.createdAt).toLocaleDateString('zh-CN')}
-                  </span>
-                  <button
-                    type="button"
-                    onClick={() => handleDeleteTodo(todo.id)}
-                    className="p-2 text-slate-400 hover:text-red-500 hover:bg-red-50 rounded-lg transition-colors focus:outline-none"
-                    title="删除"
-                  >
-                    <svg
-                      className="w-5 h-5"
-                      fill="none"
-                      viewBox="0 0 24 24"
-                      stroke="currentColor"
-                      strokeWidth={1.5}
-                      aria-hidden="true"
-                    >
-                      <path
-                        strokeLinecap="round"
-                        strokeLinejoin="round"
-                        d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"
-                      />
-                    </svg>
-                  </button>
-                </div>
-              </div>
-            ))
-          )}
-        </div>
-      </div>
     </div>
   )
 }

apps/server/src/server/api/contracts/config.contract.ts

@@ -0,0 +1,82 @@
+import { oc } from '@orpc/contract'
+import { z } from 'zod'
+
+const configOutput = z
+  .object({
+    licence: z.string().nullable().describe('当前本地 licence，未设置时为 null'),
+    fingerprint: z.string().describe('UX 本机计算得到的设备特征码（SHA-256）'),
+    hasPgpPrivateKey: z.boolean().describe('是否已配置 OpenPGP 私钥'),
+  })
+  .meta({
+    examples: [
+      {
+        licence: 'LIC-8F2A-XXXX',
+        fingerprint: '9a3b7c1d2e4f5a6b8c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b',
+        hasPgpPrivateKey: true,
+      },
+      {
+        licence: null,
+        fingerprint: '9a3b7c1d2e4f5a6b8c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b',
+        hasPgpPrivateKey: false,
+      },
+    ],
+  })
+
+export const get = oc
+  .route({
+    method: 'POST',
+    path: '/config/get',
+    operationId: 'configGet',
+    summary: '读取本机身份配置',
+    description:
+      '返回 UX 本地持久化的 licence、本机设备特征码（fingerprint）以及 OpenPGP 私钥配置状态。工具箱端可据此判断是否已完成本地身份初始化。',
+    tags: ['Config'],
+  })
+  .input(z.object({}))
+  .output(configOutput)
+
+export const setLicence = oc
+  .route({
+    method: 'POST',
+    path: '/config/set-licence',
+    operationId: 'configSetLicence',
+    summary: '写入本地 licence',
+    description:
+      '写入或更新本机持久化的 licence。设备特征码（fingerprint）始终由 UX 本机自动计算，无需外部传入。此接口应在设备授权流程前调用。',
+    tags: ['Config'],
+  })
+  .input(
+    z
+      .object({
+        licence: z.string().min(1).describe('本地持久化的 licence'),
+      })
+      .meta({
+        examples: [{ licence: 'LIC-8F2A-XXXX' }],
+      }),
+  )
+  .output(configOutput)
+
+export const setPgpPrivateKey = oc
+  .route({
+    method: 'POST',
+    path: '/config/set-pgp-private-key',
+    operationId: 'configSetPgpPrivateKey',
+    summary: '写入本地 OpenPGP 私钥',
+    description:
+      '写入或更新本机持久化的 OpenPGP 私钥（ASCII armored 格式），用于报告签名。私钥与设备绑定，调用报告签名接口时 UX 自动读取，无需每次传入。',
+    tags: ['Config'],
+  })
+  .input(
+    z
+      .object({
+        pgpPrivateKey: z.string().min(1).describe('OpenPGP 私钥（ASCII armored 格式）'),
+      })
+      .meta({
+        examples: [
+          {
+            pgpPrivateKey: '-----BEGIN PGP PRIVATE KEY BLOCK-----\n\nxcMGBGd...\n-----END PGP PRIVATE KEY BLOCK-----',
+          },
+        ],
+      }),
+  )
+  .output(configOutput)

apps/server/src/server/api/contracts/crypto.contract.ts

@@ -0,0 +1,150 @@
+import { oc } from '@orpc/contract'
+import { z } from 'zod'
+
+export const encryptDeviceInfo = oc
+  .route({
+    method: 'POST',
+    path: '/crypto/encrypt-device-info',
+    operationId: 'encryptDeviceInfo',
+    summary: '生成设备授权二维码密文',
+    description:
+      '将本机 licence 与 fingerprint 组装为 JSON，使用平台 RSA 公钥（RSA-OAEP + SHA-256）加密后返回 Base64 密文，供工具箱生成设备授权二维码。参见《工具箱端 - 设备授权二维码生成指南》。',
+    tags: ['Crypto'],
+  })
+  .input(
+    z
+      .object({
+        platformPublicKey: z.string().min(1).describe('平台公钥（Base64，SPKI DER）'),
+      })
+      .meta({
+        examples: [
+          {
+            platformPublicKey:
+              'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzDlZvMDVaL+fjl05Hi182JOAUAaN4gh9rOF+1NhKfO4J6e0HLy8lBuylp3A4xoTiyUejNm22h0dqAgDSPnY/xZR76POFTD1soHr2LaFCN8JAbQ96P8gE7wC9qpoTssVvIVRH7QbVd260J6eD0Szwcx9cg591RSN69pMpe5IVRi8T99Hhql6/wnZHORPr18eESLOY93jRskLzc0q18r68RRoTJiQf+9YC8ub5iKp7rCjVnPi1UbIYmXmL08tk5mksYA0NqWQAa1ofKxx/9tQtB9uTjhTxuTu94XU9jlGU87qaHZs+kpqa8CAbYYJFbSP1xHwoZzpU2jpw2aF22HBYxwIDAQAB',
+          },
+        ],
+      }),
+  )
+  .output(
+    z
+      .object({
+        encrypted: z.string().describe('Base64 密文（用于设备授权二维码）'),
+      })
+      .meta({
+        examples: [
+          {
+            encrypted: 'dGhpcyBpcyBhIGJhc2U2NCBlbmNvZGVkIFJTQS1PQUVQIGVuY3J5cHRlZCBkZXZpY2UgaW5mby4uLg==',
+          },
+        ],
+      }),
+  )
+
+export const decryptTask = oc
+  .route({
+    method: 'POST',
+    path: '/crypto/decrypt-task',
+    operationId: 'decryptTask',
+    summary: '解密任务二维码数据',
+    description:
+      '使用本机 licence 与 fingerprint 派生 AES-256-GCM 密钥（SHA-256），解密 App 任务二维码中的 Base64 密文，返回任务信息明文。参见《工具箱端 - 任务二维码解密指南》。',
+    tags: ['Crypto'],
+  })
+  .input(
+    z
+      .object({
+        encryptedData: z.string().min(1).describe('Base64 编码的 AES-256-GCM 密文（来自任务二维码扫描结果）'),
+      })
+      .meta({
+        examples: [
+          {
+            encryptedData: 'uWUcAmp6UQd0w3G3crdsd4613QCxGLoEgslgXJ4G2hQhpQdjtghtQjCBUZwB/JO+NRgH1vSTr8dqBJRq7Qh4nug==',
+          },
+        ],
+      }),
+  )
+  .output(
+    z
+      .object({
+        decrypted: z.string().describe('解密后的任务信息 JSON 字符串'),
+      })
+      .meta({
+        examples: [
+          {
+            decrypted:
+              '{"taskId":"TASK-20260115-4875","enterpriseId":"1173040813421105152","orgName":"超艺科技有限公司","inspectionId":"702286470691215417","inspectionPerson":"警务通","issuedAt":1734571234567}',
+          },
+        ],
+      }),
+  )
+
+export const encryptSummary = oc
+  .route({
+    method: 'POST',
+    path: '/crypto/encrypt-summary',
+    operationId: 'encryptSummary',
+    summary: '加密摘要信息',
+    description:
+      '使用本机 licence 与 fingerprint 通过 HKDF-SHA256 派生密钥，以 AES-256-GCM 加密检查摘要明文并返回 Base64 密文，供工具箱生成摘要信息二维码。参见《工具箱端 - 摘要信息二维码生成指南》。',
+    tags: ['Crypto'],
+  })
+  .input(
+    z
+      .object({
+        salt: z.string().min(1).describe('HKDF salt（即 taskId，从任务二维码中获取）'),
+        plaintext: z.string().min(1).describe('待加密的摘要信息 JSON 明文'),
+      })
+      .meta({
+        examples: [
+          {
+            salt: 'TASK-20260115-4875',
+            plaintext:
+              '{"enterpriseId":"1173040813421105152","inspectionId":"702286470691215417","summary":"检查摘要信息：发现3个高危漏洞，5个中危漏洞","timestamp":1734571234567}',
+          },
+        ],
+      }),
+  )
+  .output(
+    z
+      .object({
+        encrypted: z.string().describe('Base64 密文（用于摘要信息二维码）'),
+      })
+      .meta({
+        examples: [
+          {
+            encrypted: 'uWUcAmp6UQd0w3G3crdsd4613QCxGLoEgslgXJ4G2hQhpQdjtghtQjCBUZwB/JO+NRgH1vSTr8dqBJRq7Qh4nug==',
+          },
+        ],
+      }),
+  )
+
+export const signAndPackReport = oc
+  .route({
+    method: 'POST',
+    path: '/crypto/sign-and-pack-report',
+    operationId: 'signAndPackReport',
+    summary: '签名并打包检查报告',
+    description:
+      '上传包含 summary.json 的原始报告 ZIP，UX 自动从 ZIP 中提取 summary.json，使用本地存储的 licence/fingerprint 计算设备签名（HKDF + HMAC-SHA256），并使用本地 OpenPGP 私钥生成分离式签名。返回包含 summary.json（含 deviceSignature）、META-INF/manifest.json、META-INF/signature.asc 的签名报告 ZIP。参见《工具箱端 - 报告加密与签名生成指南》。',
+    tags: ['Crypto', 'Report'],
+  })
+  .input(
+    z.object({
+      rawZip: z
+        .file()
+        .mime(['application/zip', 'application/x-zip-compressed'])
+        .describe(
+          '原始报告 ZIP 文件（必须包含 summary.json，以及 assets.json、vulnerabilities.json、weakPasswords.json、漏洞评估报告.html 等报告文件）',
+        ),
+      outputFileName: z
+        .string()
+        .min(1)
+        .optional()
+        .describe('返回 ZIP 文件名（可选，默认 signed-report.zip）')
+        .meta({ examples: ['signed-report.zip'] }),
+    }),
+  )
+  .output(
+    z
+      .file()
+      .describe('签名后报告 ZIP 文件（二进制响应，包含 summary.json、META-INF/manifest.json、META-INF/signature.asc）'),
+  )

apps/server/src/server/api/contracts/index.ts

@@ -1,7 +1,9 @@
-import * as todo from './todo.contract'
+import * as config from './config.contract'
+import * as crypto from './crypto.contract'
 
 export const contract = {
-  todo,
+  config,
+  crypto,
 }
 
 export type Contract = typeof contract

apps/server/src/server/api/contracts/todo.contract.ts

@@ -1,43 +0,0 @@
-import { oc } from '@orpc/contract'
-import {
-  createInsertSchema,
-  createSelectSchema,
-  createUpdateSchema,
-} from 'drizzle-zod'
-import { z } from 'zod'
-import { todoTable } from '@/server/db/schema'
-
-const selectSchema = createSelectSchema(todoTable)
-
-const insertSchema = createInsertSchema(todoTable).omit({
-  id: true,
-  createdAt: true,
-  updatedAt: true,
-})
-
-const updateSchema = createUpdateSchema(todoTable).omit({
-  id: true,
-  createdAt: true,
-  updatedAt: true,
-})
-
-export const list = oc.input(z.void()).output(z.array(selectSchema))
-
-export const create = oc.input(insertSchema).output(selectSchema)
-
-export const update = oc
-  .input(
-    z.object({
-      id: z.uuid(),
-      data: updateSchema,
-    }),
-  )
-  .output(selectSchema)
-
-export const remove = oc
-  .input(
-    z.object({
-      id: z.uuid(),
-    }),
-  )
-  .output(z.void())

apps/server/src/server/api/interceptors.ts

@@ -0,0 +1,26 @@
+import { ORPCError, ValidationError } from '@orpc/server'
+import { z } from 'zod'
+
+export const logError = (error: unknown) => {
+  console.error(error)
+}
+
+export const handleValidationError = (error: unknown) => {
+  if (error instanceof ORPCError && error.code === 'BAD_REQUEST' && error.cause instanceof ValidationError) {
+    // If you only use Zod you can safely cast to ZodIssue[] (per ORPC official docs)
+    const zodError = new z.ZodError(error.cause.issues as z.core.$ZodIssue[])
+
+    throw new ORPCError('INPUT_VALIDATION_FAILED', {
+      status: 422,
+      message: z.prettifyError(zodError),
+      data: z.flattenError(zodError),
+      cause: error.cause,
+    })
+  }
+
+  if (error instanceof ORPCError && error.code === 'INTERNAL_SERVER_ERROR' && error.cause instanceof ValidationError) {
+    throw new ORPCError('OUTPUT_VALIDATION_FAILED', {
+      cause: error.cause,
+    })
+  }
+}

apps/server/src/server/api/middlewares/db.middleware.ts

@@ -1,4 +1,4 @@
-import { os } from '@orpc/server'
+import { os } from '@/server/api/server'
 import { getDB } from '@/server/db'
 
 export const db = os.middleware(async ({ context, next }) => {

apps/server/src/server/api/routers/config.router.ts

@@ -0,0 +1,24 @@
+import { ensureUxConfig, setUxLicence, setUxPgpPrivateKey } from '@/server/ux-config'
+import { db } from '../middlewares'
+import { os } from '../server'
+
+const toConfigOutput = (config: { licence: string | null; fingerprint: string; pgpPrivateKey: string | null }) => ({
+  licence: config.licence,
+  fingerprint: config.fingerprint,
+  hasPgpPrivateKey: config.pgpPrivateKey != null,
+})
+
+export const get = os.config.get.use(db).handler(async ({ context }) => {
+  const config = await ensureUxConfig(context.db)
+  return toConfigOutput(config)
+})
+
+export const setLicence = os.config.setLicence.use(db).handler(async ({ context, input }) => {
+  const config = await setUxLicence(context.db, input.licence)
+  return toConfigOutput(config)
+})
+
+export const setPgpPrivateKey = os.config.setPgpPrivateKey.use(db).handler(async ({ context, input }) => {
+  const config = await setUxPgpPrivateKey(context.db, input.pgpPrivateKey)
+  return toConfigOutput(config)
+})

apps/server/src/server/api/routers/crypto.router.ts

@@ -0,0 +1,171 @@
+import {
+  aesGcmDecrypt,
+  aesGcmEncrypt,
+  hkdfSha256,
+  hmacSha256Base64,
+  pgpSignDetached,
+  rsaOaepEncrypt,
+  sha256,
+  sha256Hex,
+} from '@furtherverse/crypto'
+import { ORPCError } from '@orpc/server'
+import JSZip from 'jszip'
+import { z } from 'zod'
+import { extractSafeZipFiles, ZipValidationError } from '@/server/safe-zip'
+import { getUxConfig } from '@/server/ux-config'
+import { db } from '../middlewares'
+import { os } from '../server'
+
+const summaryPayloadSchema = z
+  .object({
+    taskId: z.string().min(1, 'summary.json must contain a non-empty taskId'),
+    checkId: z.string().optional(),
+    inspectionId: z.string().optional(),
+  })
+  .loose()
+
+const requireIdentity = async (dbInstance: Parameters<typeof getUxConfig>[0]) => {
+  const config = await getUxConfig(dbInstance)
+  if (!config || !config.licence) {
+    throw new ORPCError('PRECONDITION_FAILED', {
+      message: 'Local identity is not initialized. Call config.get and then config.setLicence first.',
+    })
+  }
+  return config as typeof config & { licence: string }
+}
+
+export const encryptDeviceInfo = os.crypto.encryptDeviceInfo.use(db).handler(async ({ context, input }) => {
+  const config = await requireIdentity(context.db)
+
+  const deviceInfoJson = JSON.stringify({
+    licence: config.licence,
+    fingerprint: config.fingerprint,
+  })
+
+  const encrypted = rsaOaepEncrypt(deviceInfoJson, input.platformPublicKey)
+  return { encrypted }
+})
+
+export const decryptTask = os.crypto.decryptTask.use(db).handler(async ({ context, input }) => {
+  const config = await requireIdentity(context.db)
+
+  const key = sha256(config.licence + config.fingerprint)
+  const decrypted = aesGcmDecrypt(input.encryptedData, key)
+  return { decrypted }
+})
+
+export const encryptSummary = os.crypto.encryptSummary.use(db).handler(async ({ context, input }) => {
+  const config = await requireIdentity(context.db)
+
+  const ikm = config.licence + config.fingerprint
+  const aesKey = hkdfSha256(ikm, input.salt, 'inspection_report_encryption')
+  const encrypted = aesGcmEncrypt(input.plaintext, aesKey)
+  return { encrypted }
+})
+
+export const signAndPackReport = os.crypto.signAndPackReport.use(db).handler(async ({ context, input }) => {
+  const config = await requireIdentity(context.db)
+
+  if (!config.pgpPrivateKey) {
+    throw new ORPCError('PRECONDITION_FAILED', {
+      message: 'PGP private key is not configured. Call config.setPgpPrivateKey first.',
+    })
+  }
+
+  const rawZipBytes = Buffer.from(await input.rawZip.arrayBuffer())
+
+  const zipFiles = await extractSafeZipFiles(rawZipBytes).catch((error) => {
+    if (error instanceof ZipValidationError) {
+      throw new ORPCError('BAD_REQUEST', { message: error.message })
+    }
+    throw error
+  })
+
+  // Extract and validate summary.json from the ZIP
+  const summaryFile = zipFiles.find((f) => f.name === 'summary.json')
+  if (!summaryFile) {
+    throw new ORPCError('BAD_REQUEST', {
+      message: 'rawZip must contain a summary.json file',
+    })
+  }
+
+  let rawJson: unknown
+  try {
+    rawJson = JSON.parse(Buffer.from(summaryFile.bytes).toString('utf-8'))
+  } catch {
+    throw new ORPCError('BAD_REQUEST', {
+      message: 'summary.json in the ZIP is not valid JSON',
+    })
+  }
+
+  const parsed = summaryPayloadSchema.safeParse(rawJson)
+  if (!parsed.success) {
+    throw new ORPCError('BAD_REQUEST', {
+      message: `Invalid summary.json: ${z.prettifyError(parsed.error)}`,
+    })
+  }
+
+  const summaryPayload = parsed.data
+  const checkId = summaryPayload.checkId ?? summaryPayload.inspectionId ?? ''
+  const signingContext = `${summaryPayload.taskId}${checkId}`
+
+  // Compute device signature
+  const ikm = config.licence + config.fingerprint
+  const signingKey = hkdfSha256(ikm, 'AUTH_V3_SALT', 'device_report_signature')
+
+  const fileHashEntries = zipFiles
+    .map((item) => ({
+      name: item.name,
+      hash: sha256Hex(Buffer.from(item.bytes)),
+    }))
+    .sort((a, b) => a.name.localeCompare(b.name, 'en'))
+
+  const hashPayload = fileHashEntries.map((item) => `${item.name}:${item.hash}`).join('|')
+  const signPayload = `${signingContext}|${hashPayload}`
+  const deviceSignature = hmacSha256Base64(signingKey, signPayload)
+
+  // Build final summary.json with device signature and identity
+  const finalSummary = {
+    deviceSignature,
+    signingContext,
+    licence: config.licence,
+    fingerprint: config.fingerprint,
+    payload: summaryPayload,
+    timestamp: Date.now(),
+  }
+  const summaryBytes = Buffer.from(JSON.stringify(finalSummary), 'utf-8')
+
+  // Build manifest.json
+  const manifestFiles: Record<string, string> = {
+    'summary.json': sha256Hex(summaryBytes),
+  }
+  for (const item of fileHashEntries) {
+    if (item.name !== 'summary.json') {
+      manifestFiles[item.name] = item.hash
+    }
+  }
+
+  const manifestBytes = Buffer.from(JSON.stringify({ files: manifestFiles }, null, 2), 'utf-8')
+  const signatureAsc = await pgpSignDetached(manifestBytes, config.pgpPrivateKey)
+
+  // Pack signed ZIP
+  const signedZip = new JSZip()
+  signedZip.file('summary.json', summaryBytes)
+  for (const item of zipFiles) {
+    if (item.name !== 'summary.json') {
+      signedZip.file(item.name, item.bytes)
+    }
+  }
+  signedZip.file('META-INF/manifest.json', manifestBytes)
+  signedZip.file('META-INF/signature.asc', signatureAsc)
+
+  const signedZipBytes = await signedZip.generateAsync({
+    type: 'uint8array',
+    compression: 'DEFLATE',
+    compressionOptions: { level: 9 },
+  })
+
+  return new File([Buffer.from(signedZipBytes)], input.outputFileName ?? 'signed-report.zip', {
+    type: 'application/zip',
+  })
+})

apps/server/src/server/api/routers/index.ts

@@ -1,6 +1,8 @@
 import { os } from '../server'
-import * as todo from './todo.router'
+import * as config from './config.router'
+import * as crypto from './crypto.router'
 
 export const router = os.router({
-  todo,
+  config,
+  crypto,
 })

apps/server/src/server/api/routers/todo.router.ts

@@ -1,49 +0,0 @@
-import { ORPCError } from '@orpc/server'
-import { eq } from 'drizzle-orm'
-import { todoTable } from '@/server/db/schema'
-import { db } from '../middlewares'
-import { os } from '../server'
-
-export const list = os.todo.list.use(db).handler(async ({ context }) => {
-  const todos = await context.db.query.todoTable.findMany({
-    orderBy: (todos, { desc }) => [desc(todos.createdAt)],
-  })
-  return todos
-})
-
-export const create = os.todo.create
-  .use(db)
-  .handler(async ({ context, input }) => {
-    const [newTodo] = await context.db
-      .insert(todoTable)
-      .values(input)
-      .returning()
-
-    if (!newTodo) {
-      throw new ORPCError('NOT_FOUND')
-    }
-
-    return newTodo
-  })
-
-export const update = os.todo.update
-  .use(db)
-  .handler(async ({ context, input }) => {
-    const [updatedTodo] = await context.db
-      .update(todoTable)
-      .set(input.data)
-      .where(eq(todoTable.id, input.id))
-      .returning()
-
-    if (!updatedTodo) {
-      throw new ORPCError('NOT_FOUND')
-    }
-
-    return updatedTodo
-  })
-
-export const remove = os.todo.remove
-  .use(db)
-  .handler(async ({ context, input }) => {
-    await context.db.delete(todoTable).where(eq(todoTable.id, input.id))
-  })

apps/server/src/server/api/types.ts

@@ -1,8 +1,4 @@
-import type {
-  ContractRouterClient,
-  InferContractRouterInputs,
-  InferContractRouterOutputs,
-} from '@orpc/contract'
+import type { ContractRouterClient, InferContractRouterInputs, InferContractRouterOutputs } from '@orpc/contract'
 import type { Contract } from './contracts'
 
 export type RouterClient = ContractRouterClient<Contract>

apps/server/src/server/db/fields.ts

@@ -0,0 +1,36 @@
+import { integer, text } from 'drizzle-orm/sqlite-core'
+import { v7 as uuidv7 } from 'uuid'
+
+export const pk = (name = 'id') =>
+  text(name)
+    .primaryKey()
+    .$defaultFn(() => uuidv7())
+
+export const createdAt = (name = 'created_at') =>
+  integer(name, { mode: 'timestamp_ms' })
+    .notNull()
+    .$defaultFn(() => new Date())
+
+export const updatedAt = (name = 'updated_at') =>
+  integer(name, { mode: 'timestamp_ms' })
+    .notNull()
+    .$defaultFn(() => new Date())
+    .$onUpdateFn(() => new Date())
+
+export const generatedFields = {
+  id: pk('id'),
+  createdAt: createdAt('created_at'),
+  updatedAt: updatedAt('updated_at'),
+}
+
+const createGeneratedFieldKeys = <T extends Record<string, unknown>>(fields: T): Record<keyof T, true> => {
+  return Object.keys(fields).reduce(
+    (acc, key) => {
+      acc[key as keyof T] = true
+      return acc
+    },
+    {} as Record<keyof T, true>,
+  )
+}
+
+export const generatedFieldKeys = createGeneratedFieldKeys(generatedFields)

apps/server/src/server/db/index.ts

@@ -1,15 +1,14 @@
-import { drizzle } from 'drizzle-orm/postgres-js'
+import { Database } from 'bun:sqlite'
+import { drizzle } from 'drizzle-orm/bun-sqlite'
 import { env } from '@/env'
-import * as schema from '@/server/db/schema'
+import { relations } from '@/server/db/relations'
 
-export const createDB = () =>
-  drizzle({
-    connection: {
-      url: env.DATABASE_URL,
-      prepare: true,
-    },
-    schema,
-  })
+export const createDB = () => {
+  const sqlite = new Database(env.DATABASE_PATH)
+  sqlite.exec('PRAGMA journal_mode = WAL')
+  sqlite.exec('PRAGMA foreign_keys = ON')
+  return drizzle({ client: sqlite, relations })
+}
 
 export type DB = ReturnType<typeof createDB>
 

apps/server/src/server/db/relations.ts

@@ -0,0 +1,4 @@
+import { defineRelations } from 'drizzle-orm'
+import * as schema from './schema'
+
+export const relations = defineRelations(schema, () => ({}))

apps/server/src/server/db/schema/index.ts

@@ -1 +1 @@
-export * from './todo'
+export * from './ux-config'

apps/server/src/server/db/schema/todo.ts

@@ -1,8 +0,0 @@
-import { boolean, pgTable, text } from 'drizzle-orm/pg-core'
-import { generatedFields } from './utils/field'
-
-export const todoTable = pgTable('todo', {
-  ...generatedFields,
-  title: text('title').notNull(),
-  completed: boolean('completed').notNull().default(false),
-})

apps/server/src/server/db/schema/utils/field.ts

@@ -1,58 +0,0 @@
-import { sql } from 'drizzle-orm'
-import { timestamp, uuid } from 'drizzle-orm/pg-core'
-import { v7 as uuidv7 } from 'uuid'
-
-// id
-
-export const id = (name: string) => uuid(name)
-export const pk = (name: string, strategy?: 'native' | 'extension') => {
-  switch (strategy) {
-    // PG 18+
-    case 'native':
-      return id(name).primaryKey().default(sql`uuidv7()`)
-
-    // PG 13+ with extension
-    case 'extension':
-      return id(name).primaryKey().default(sql`uuid_generate_v7()`)
-
-    // Any PG version
-    default:
-      return id(name)
-        .primaryKey()
-        .$defaultFn(() => uuidv7())
-  }
-}
-
-// timestamp
-
-export const createdAt = (name = 'created_at') =>
-  timestamp(name, { withTimezone: true }).notNull().defaultNow()
-
-export const updatedAt = (name = 'updated_at') =>
-  timestamp(name, { withTimezone: true })
-    .notNull()
-    .defaultNow()
-    .$onUpdateFn(() => new Date())
-
-// generated fields
-
-export const generatedFields = {
-  id: pk('id'),
-  createdAt: createdAt('created_at'),
-  updatedAt: updatedAt('updated_at'),
-}
-
-// Helper to create omit keys from generatedFields
-const createGeneratedFieldKeys = <T extends Record<string, unknown>>(
-  fields: T,
-): Record<keyof T, true> => {
-  return Object.keys(fields).reduce(
-    (acc, key) => {
-      acc[key as keyof T] = true
-      return acc
-    },
-    {} as Record<keyof T, true>,
-  )
-}
-
-export const generatedFieldKeys = createGeneratedFieldKeys(generatedFields)

apps/server/src/server/db/schema/ux-config.ts

@@ -0,0 +1,10 @@
+import { sqliteTable, text } from 'drizzle-orm/sqlite-core'
+import { generatedFields } from '../fields'
+
+export const uxConfigTable = sqliteTable('ux_config', {
+  ...generatedFields,
+  singletonKey: text('singleton_key').notNull().unique().default('default'),
+  licence: text('licence'),
+  fingerprint: text('fingerprint').notNull(),
+  pgpPrivateKey: text('pgp_private_key'),
+})

apps/server/src/server/device-fingerprint.ts

@@ -0,0 +1,10 @@
+import { sha256Hex } from '@furtherverse/crypto'
+import { system } from 'systeminformation'
+
+export const computeDeviceFingerprint = async (): Promise<string> => {
+  const { uuid, serial, model, manufacturer } = await system()
+  const source = [uuid, serial, model, manufacturer].join('|')
+  const hash = sha256Hex(source)
+
+  return hash
+}

apps/server/src/server/safe-zip.ts

@@ -0,0 +1,96 @@
+import type { JSZipObject } from 'jszip'
+import JSZip from 'jszip'
+
+export class ZipValidationError extends Error {
+  override name = 'ZipValidationError'
+}
+
+export interface ZipFileItem {
+  name: string
+  bytes: Uint8Array
+}
+
+export interface SafeZipOptions {
+  maxRawBytes?: number
+  maxEntries?: number
+  maxSingleFileBytes?: number
+  maxTotalUncompressedBytes?: number
+}
+
+const DEFAULTS = {
+  maxRawBytes: 50 * 1024 * 1024,
+  maxEntries: 64,
+  maxSingleFileBytes: 20 * 1024 * 1024,
+  maxTotalUncompressedBytes: 60 * 1024 * 1024,
+} satisfies Required<SafeZipOptions>
+
+const normalizePath = (name: string): string => name.replaceAll('\\', '/')
+
+const isUnsafePath = (name: string): boolean => {
+  const normalized = normalizePath(name)
+  const segments = normalized.split('/')
+
+  return (
+    normalized.startsWith('/') ||
+    normalized.includes('\0') ||
+    segments.some((segment) => segment === '..' || segment.trim().length === 0)
+  )
+}
+
+export const extractSafeZipFiles = async (
+  rawBytes: Uint8Array | Buffer,
+  options?: SafeZipOptions,
+): Promise<ZipFileItem[]> => {
+  const opts = { ...DEFAULTS, ...options }
+
+  if (rawBytes.byteLength === 0 || rawBytes.byteLength > opts.maxRawBytes) {
+    throw new ZipValidationError('ZIP is empty or exceeds max size limit')
+  }
+
+  const zip = await JSZip.loadAsync(rawBytes, { checkCRC32: true }).catch(() => {
+    throw new ZipValidationError('Not a valid ZIP file')
+  })
+
+  const entries = Object.values(zip.files) as JSZipObject[]
+  if (entries.length > opts.maxEntries) {
+    throw new ZipValidationError(`ZIP contains too many entries: ${entries.length}`)
+  }
+
+  let totalUncompressedBytes = 0
+  const files: ZipFileItem[] = []
+  const seen = new Set<string>()
+
+  for (const entry of entries) {
+    if (entry.dir) {
+      continue
+    }
+
+    if (isUnsafePath(entry.name)) {
+      throw new ZipValidationError(`ZIP contains unsafe entry path: ${entry.name}`)
+    }
+
+    const normalizedName = normalizePath(entry.name)
+    if (seen.has(normalizedName)) {
+      throw new ZipValidationError(`ZIP contains duplicate entry: ${normalizedName}`)
+    }
+    seen.add(normalizedName)
+
+    const content = await entry.async('uint8array')
+    if (content.byteLength > opts.maxSingleFileBytes) {
+      throw new ZipValidationError(`ZIP entry too large: ${normalizedName}`)
+    }
+
+    totalUncompressedBytes += content.byteLength
+    if (totalUncompressedBytes > opts.maxTotalUncompressedBytes) {
+      throw new ZipValidationError('ZIP total uncompressed content exceeds max size limit')
+    }
+
+    files.push({ name: normalizedName, bytes: content })
+  }
+
+  if (files.length === 0) {
+    throw new ZipValidationError('ZIP has no file entries')
+  }
+
+  return files
+}

apps/server/src/server/ux-config.ts

@@ -0,0 +1,56 @@
+import { eq } from 'drizzle-orm'
+import type { DB } from '@/server/db'
+import { uxConfigTable } from '@/server/db/schema'
+import { computeDeviceFingerprint } from './device-fingerprint'
+
+const UX_CONFIG_KEY = 'default'
+
+export const getUxConfig = async (db: DB) => {
+  return await db.query.uxConfigTable.findFirst({
+    where: { singletonKey: UX_CONFIG_KEY },
+  })
+}
+
+export const ensureUxConfig = async (db: DB) => {
+  const fingerprint = await computeDeviceFingerprint()
+  const existing = await getUxConfig(db)
+
+  if (existing) {
+    if (existing.fingerprint !== fingerprint) {
+      const rows = await db
+        .update(uxConfigTable)
+        .set({ fingerprint })
+        .where(eq(uxConfigTable.id, existing.id))
+        .returning()
+      return rows[0] as (typeof rows)[number]
+    }
+    return existing
+  }
+
+  const rows = await db
+    .insert(uxConfigTable)
+    .values({
+      singletonKey: UX_CONFIG_KEY,
+      fingerprint,
+      licence: null,
+    })
+    .returning()
+
+  return rows[0] as (typeof rows)[number]
+}
+
+export const setUxLicence = async (db: DB, licence: string) => {
+  const config = await ensureUxConfig(db)
+
+  const rows = await db.update(uxConfigTable).set({ licence }).where(eq(uxConfigTable.id, config.id)).returning()
+
+  return rows[0] as (typeof rows)[number]
+}
+
+export const setUxPgpPrivateKey = async (db: DB, pgpPrivateKey: string) => {
+  const config = await ensureUxConfig(db)
+
+  const rows = await db.update(uxConfigTable).set({ pgpPrivateKey }).where(eq(uxConfigTable.id, config.id)).returning()
+
+  return rows[0] as (typeof rows)[number]
+}

apps/server/turbo.json

@@ -2,9 +2,46 @@
   "$schema": "../../node_modules/turbo/schema.json",
   "extends": ["//"],
   "tasks": {
+    "build": {
+      "env": ["NODE_ENV", "VITE_*"],
+      "inputs": ["src/**", "public/**", "package.json", "tsconfig.json", "vite.config.ts"],
+      "outputs": [".output/**"]
+    },
     "compile": {
       "dependsOn": ["build"],
       "outputs": ["out/**"]
+    },
+    "compile:darwin": {
+      "dependsOn": ["build"],
+      "outputs": ["out/**"]
+    },
+    "compile:darwin:arm64": {
+      "dependsOn": ["build"],
+      "outputs": ["out/**"]
+    },
+    "compile:darwin:x64": {
+      "dependsOn": ["build"],
+      "outputs": ["out/**"]
+    },
+    "compile:linux": {
+      "dependsOn": ["build"],
+      "outputs": ["out/**"]
+    },
+    "compile:linux:arm64": {
+      "dependsOn": ["build"],
+      "outputs": ["out/**"]
+    },
+    "compile:linux:x64": {
+      "dependsOn": ["build"],
+      "outputs": ["out/**"]
+    },
+    "compile:windows": {
+      "dependsOn": ["build"],
+      "outputs": ["out/**"]
+    },
+    "compile:windows:x64": {
+      "dependsOn": ["build"],
+      "outputs": ["out/**"]
     }
   }
 }

apps/server/vite.config.ts

@@ -10,24 +10,21 @@ export default defineConfig({
   clearScreen: false,
   plugins: [
     tanstackDevtools(),
-    nitro({
-      preset: 'bun',
-      serveStatic: 'inline',
-    }),
-    tsconfigPaths(),
     tailwindcss(),
+    tsconfigPaths(),
     tanstackStart(),
     react({
       babel: {
         plugins: ['babel-plugin-react-compiler'],
       },
     }),
+    nitro({
+      preset: 'bun',
+      serveStatic: 'inline',
+    }),
   ],
   server: {
     port: 3000,
     strictPort: true,
-    watch: {
-      ignored: ['**/src-tauri/**'],
-    },
   },
 })

biome.json

@@ -11,7 +11,8 @@
   "formatter": {
     "enabled": true,
     "indentStyle": "space",
-    "lineEnding": "lf"
+    "lineEnding": "lf",
+    "lineWidth": 120
   },
   "linter": {
     "enabled": true,

docs/工具箱端-授权对接指南/utils/AesGcmUtil.kt

@@ -0,0 +1,124 @@
+package top.tangyh.lamp.filing.utils
+
+import io.github.oshai.kotlinlogging.KotlinLogging
+import java.nio.charset.StandardCharsets
+import java.util.*
+import javax.crypto.Cipher
+import javax.crypto.spec.GCMParameterSpec
+import javax.crypto.spec.SecretKeySpec
+
+private val logger = KotlinLogging.logger {}
+
+/**
+ * AES-256-GCM 加密解密工具类
+ * 
+ * 安全设计说明：
+ * - 使用 AES-256-GCM 提供认证加密（AEAD）
+ * - GCM 模式自动提供认证标签（tag），防止数据被篡改
+ * - IV（初始化向量）长度为 12 字节（96位），符合 GCM 推荐
+ * - 认证标签长度为 16 字节（128位），提供强认证
+ * - 加密数据格式：IV (12字节) + Ciphertext (变长) + Tag (16字节)
+ * 
+ * 为什么第三方无法伪造：
+ * - 只有拥有正确 licence + fingerprint 的设备才能派生正确的 AES 密钥
+ * - GCM 模式会验证认证标签，任何篡改都会导致解密失败
+ * - 即使第三方获取了加密数据，也无法解密（缺少密钥）
+ */
+object AesGcmUtil {
+
+    private const val ALGORITHM = "AES"
+    private const val TRANSFORMATION = "AES/GCM/NoPadding"
+    private const val IV_LENGTH = 12 // 12 bytes = 96 bits (GCM 推荐)
+    private const val TAG_LENGTH = 16 // 16 bytes = 128 bits (GCM 认证标签长度)
+    private const val GCM_TAG_LENGTH_BITS = TAG_LENGTH * 8 // 128 bits
+
+    /**
+     * 解密 AES-256-GCM 加密的数据
+     * 
+     * @param encryptedData Base64 编码的加密数据（格式：iv + ciphertext + tag）
+     * @param key AES 密钥（32字节）
+     * @return 解密后的明文（UTF-8 字符串）
+     * @throws RuntimeException 如果解密失败（密钥错误、数据被篡改等）
+     */
+    fun decrypt(encryptedData: String, key: ByteArray): String {
+        return try {
+            // 1. Base64 解码
+            val encryptedBytes = Base64.getDecoder().decode(encryptedData)
+
+            // 2. 提取 IV、密文和认证标签
+            if (encryptedBytes.size < IV_LENGTH + TAG_LENGTH) {
+                throw IllegalArgumentException("加密数据长度不足，无法提取 IV 和 Tag")
+            }
+
+            val iv = encryptedBytes.copyOfRange(0, IV_LENGTH)
+            val tag = encryptedBytes.copyOfRange(encryptedBytes.size - TAG_LENGTH, encryptedBytes.size)
+            val ciphertext = encryptedBytes.copyOfRange(IV_LENGTH, encryptedBytes.size - TAG_LENGTH)
+
+            // 3. 创建 SecretKeySpec
+            val secretKey = SecretKeySpec(key, ALGORITHM)
+
+            // 4. 创建 GCMParameterSpec（包含 IV 和认证标签长度）
+            val gcmSpec = GCMParameterSpec(GCM_TAG_LENGTH_BITS, iv)
+
+            // 5. 初始化 Cipher 进行解密
+            val cipher = Cipher.getInstance(TRANSFORMATION)
+            cipher.init(Cipher.DECRYPT_MODE, secretKey, gcmSpec)
+
+            // 6. 执行解密（GCM 模式会自动验证认证标签）
+            // 如果认证标签验证失败，会抛出异常
+            val decryptedBytes = cipher.doFinal(ciphertext + tag)
+
+            // 7. 转换为 UTF-8 字符串
+            String(decryptedBytes, StandardCharsets.UTF_8)
+        } catch (e: javax.crypto.AEADBadTagException) {
+            logger.error(e) { "AES-GCM 认证标签验证失败，数据可能被篡改或密钥错误" }
+            throw RuntimeException("解密失败：认证标签验证失败，数据可能被篡改或密钥错误", e)
+        } catch (e: Exception) {
+            logger.error(e) { "AES-GCM 解密失败" }
+            throw RuntimeException("解密失败: ${e.message}", e)
+        }
+    }
+
+    /**
+     * 加密数据（用于测试或客户端实现参考）
+     * 
+     * @param plaintext 明文数据
+     * @param key AES 密钥（32字节）
+     * @return Base64 编码的加密数据（格式：iv + ciphertext + tag）
+     */
+    fun encrypt(plaintext: String, key: ByteArray): String {
+        return try {
+            // 1. 生成随机 IV
+            val iv = ByteArray(IV_LENGTH)
+            java.security.SecureRandom().nextBytes(iv)
+
+            // 2. 创建 SecretKeySpec
+            val secretKey = SecretKeySpec(key, ALGORITHM)
+
+            // 3. 创建 GCMParameterSpec
+            val gcmSpec = GCMParameterSpec(GCM_TAG_LENGTH_BITS, iv)
+
+            // 4. 初始化 Cipher 进行加密
+            val cipher = Cipher.getInstance(TRANSFORMATION)
+            cipher.init(Cipher.ENCRYPT_MODE, secretKey, gcmSpec)
+
+            // 5. 执行加密
+            val plaintextBytes = plaintext.toByteArray(StandardCharsets.UTF_8)
+            val encryptedBytes = cipher.doFinal(plaintextBytes)
+
+            // 6. 组装：IV + Ciphertext + Tag
+            // GCM 模式会将认证标签附加到密文末尾
+            val ciphertext = encryptedBytes.copyOfRange(0, encryptedBytes.size - TAG_LENGTH)
+            val tag = encryptedBytes.copyOfRange(encryptedBytes.size - TAG_LENGTH, encryptedBytes.size)
+
+            val result = iv + ciphertext + tag
+
+            // 7. Base64 编码返回
+            Base64.getEncoder().encodeToString(result)
+        } catch (e: Exception) {
+            logger.error(e) { "AES-GCM 加密失败" }
+            throw RuntimeException("加密失败: ${e.message}", e)
+        }
+    }
+}
+

docs/工具箱端-授权对接指南/utils/DateUtil.kt

@@ -0,0 +1,42 @@
+package top.tangyh.lamp.filing.utils
+
+import java.text.SimpleDateFormat
+import java.util.*
+
+class DateUtil {
+
+    companion object {
+        // 获取当前时间戳
+        fun getCurrentTimestamp(): Long {
+            return System.currentTimeMillis()
+        }
+
+        // 格式化日期
+        fun formatDate(date: Date, format: String = "yyyy-MM-dd HH:mm:ss"): String {
+            val sdf = SimpleDateFormat(format)
+            return sdf.format(date)
+        }
+
+        // 解析日期字符串
+        fun parseDate(dateString: String, format: String = "yyyy-MM-dd HH:mm:ss"): Date? {
+            val sdf = SimpleDateFormat(format)
+            return try {
+                sdf.parse(dateString)
+            } catch (e: Exception) {
+                null
+            }
+        }
+
+        // 计算两个日期之间的天数差
+        fun getDaysBetweenDates(date1: Date, date2: Date): Long {
+            val diff = Math.abs(date1.time - date2.time)
+            return diff / (24 * 60 * 60 * 1000)
+        }
+
+        // 获取当前时间并格式化为 yyyy-MM-dd_HH-mm-ss
+        fun getCurrentFormattedTime(format: String = "yyyy-MM-dd_HH-mm-ss"): String {
+            val sdf = SimpleDateFormat(format)
+            return sdf.format(Date())
+        }
+    }
+}

docs/工具箱端-授权对接指南/utils/DeviceSignatureUtil.kt

@@ -0,0 +1,129 @@
+package top.tangyh.lamp.filing.utils
+
+import io.github.oshai.kotlinlogging.KotlinLogging
+import java.nio.charset.StandardCharsets
+import java.security.MessageDigest
+import java.util.*
+import javax.crypto.Mac
+import javax.crypto.spec.SecretKeySpec
+
+private val logger = KotlinLogging.logger {}
+
+/**
+ * 设备签名工具类
+ * 用于生成和验证设备报告签名
+ * 
+ * 签名算法：HMAC-SHA256
+ * 签名数据（严格顺序）：
+ *   sign_payload = taskId + inspectionId + 
+ *                  SHA256(assets.json) + 
+ *                  SHA256(vulnerabilities.json) + 
+ *                  SHA256(weakPasswords.json) + 
+ *                  SHA256(漏洞评估报告.html)
+ * 
+ * 安全设计说明：
+ * - 使用 HMAC-SHA256 提供消息认证，防止伪造和篡改
+ * - 签名包含 taskId 和 inspectionId，确保签名与特定任务绑定
+ * - 包含多个报告文件的 SHA256，确保报告内容完整性
+ * - 只有拥有正确 licence + fingerprint 的设备才能生成有效签名
+ */
+object DeviceSignatureUtil {
+
+    private const val HMAC_ALGORITHM = "HmacSHA256"
+
+    /**
+     * 签名数据文件列表（严格顺序）
+     */
+    data class SignatureFileHashes(
+        val assetsJsonSha256: String,
+        val vulnerabilitiesJsonSha256: String,
+        val weakPasswordsJsonSha256: String,
+        val reportHtmlSha256: String
+    )
+
+    /**
+     * 生成设备签名
+     * 
+     * @param key 派生密钥（32字节）
+     * @param taskId 任务ID
+     * @param inspectionId 检查ID
+     * @param fileHashes 各个文件的 SHA256 哈希值（hex字符串）
+     * @return Base64 编码的签名
+     */
+    fun generateSignature(
+        key: ByteArray,
+        taskId: String,
+        inspectionId: Long,
+        fileHashes: SignatureFileHashes
+    ): String {
+        return try {
+            // 组装签名数据（严格顺序）：
+            // taskId + inspectionId + SHA256(assets.json) + SHA256(vulnerabilities.json) + 
+            // SHA256(weakPasswords.json) + SHA256(漏洞评估报告.html)
+            val signatureData = buildString {
+                append(taskId)
+                append(inspectionId)
+                append(fileHashes.assetsJsonSha256)
+                append(fileHashes.vulnerabilitiesJsonSha256)
+                append(fileHashes.weakPasswordsJsonSha256)
+                append(fileHashes.reportHtmlSha256)
+            }
+            val dataBytes = signatureData.toByteArray(StandardCharsets.UTF_8)
+
+            // 使用 HMAC-SHA256 计算签名
+            val mac = Mac.getInstance(HMAC_ALGORITHM)
+            val secretKey = SecretKeySpec(key, HMAC_ALGORITHM)
+            mac.init(secretKey)
+            val signatureBytes = mac.doFinal(dataBytes)
+
+            // Base64 编码返回
+            Base64.getEncoder().encodeToString(signatureBytes)
+        } catch (e: Exception) {
+            logger.error(e) { "生成设备签名失败: taskId=$taskId, inspectionId=$inspectionId" }
+            throw RuntimeException("生成设备签名失败: ${e.message}", e)
+        }
+    }
+
+    /**
+     * 验证设备签名
+     * 
+     * @param key 派生密钥（32字节）
+     * @param taskId 任务ID
+     * @param inspectionId 检查ID
+     * @param fileHashes 各个文件的 SHA256 哈希值（hex字符串）
+     * @param expectedSignature Base64 编码的期望签名
+     * @return true 如果签名匹配，false 否则
+     */
+    fun verifySignature(
+        key: ByteArray,
+        taskId: String,
+        inspectionId: Long,
+        fileHashes: SignatureFileHashes,
+        expectedSignature: String
+    ): Boolean {
+        return try {
+            val calculatedSignature = generateSignature(key, taskId, inspectionId, fileHashes)
+            // 使用时间安全的比较，防止时序攻击
+            MessageDigest.isEqual(
+                Base64.getDecoder().decode(expectedSignature),
+                Base64.getDecoder().decode(calculatedSignature)
+            )
+        } catch (e: Exception) {
+            logger.error(e) { "验证设备签名失败: taskId=$taskId, inspectionId=$inspectionId" }
+            false
+        }
+    }
+
+    /**
+     * 计算文件的 SHA256 哈希值（hex字符串）
+     * 
+     * @param fileContent 文件内容
+     * @return SHA256 哈希值的 hex 字符串
+     */
+    fun calculateSha256(fileContent: ByteArray): String {
+        val digest = MessageDigest.getInstance("SHA-256")
+        val hashBytes = digest.digest(fileContent)
+        return hashBytes.joinToString("") { "%02x".format(it) }
+    }
+}
+

docs/工具箱端-授权对接指南/utils/DistributedIdUtil.kt

@@ -0,0 +1,12 @@
+package top.tangyh.lamp.filing.utils
+
+object DistributedIdUtil {
+    fun generateId(platformId: Long, localId: Long): Long {
+        require(platformId in 0..0xFFFF) { "platformId must be 0-65535" }
+        val safeLocalId = localId and 0xFFFFFFFFFFFF
+        return (platformId shl 48) or safeLocalId
+    }
+
+    fun parsePlatform(id: Long): Long = id ushr 48
+    fun parseLocal(id: Long): Long = id and 0xFFFFFFFFFFFF
+}

docs/工具箱端-授权对接指南/utils/HashUtil.kt

@@ -0,0 +1,18 @@
+package top.tangyh.lamp.filing.utils
+
+import java.io.InputStream
+import java.security.MessageDigest
+
+object HashUtil {
+    fun calculateFileHash(inputStream: InputStream): String {
+        val digest = MessageDigest.getInstance("SHA-256")
+        val buffer = ByteArray(8192)
+        var bytesRead: Int
+
+        while (inputStream.read(buffer).also { bytesRead = it } != -1) {
+            digest.update(buffer, 0, bytesRead)
+        }
+
+        return digest.digest().joinToString("") { "%02x".format(it) }
+    }
+}