BeatAPI · erickkkyt · Aug 30, 2026 · Aug 30, 2026
diff --git a/.env.example b/.env.example
diff --git a/.github/workflows/quality.yaml b/.github/workflows/quality.yaml
@@ -32,5 +32,4 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm test
       - run: pnpm i18n:check
-      - run: pnpm cf:build
       - run: pnpm audit --prod --audit-level high
diff --git a/.gitignore b/.gitignore
@@ -16,11 +16,6 @@
 src/routeTree.gen.ts
 src/paraglide/
 
-# cloudflare — wrangler.jsonc is your working copy (real D1 id, URLs);
-# the committed template is wrangler.example.jsonc
-/.wrangler/
-wrangler.jsonc
-
 # local agent state
 /.claude/
 /.agents/
@@ -31,9 +26,6 @@ wrangler.jsonc
 # production
 /build
 
-# deploy
-.vercel
-
 # editors
 .idea
 .vscode
@@ -49,10 +41,9 @@ yarn-debug.log*
 yarn-error.log*
 .pnpm-debug.log*
 
-# env — local files hold secrets, never commit (keep .env.example tracked)
+# local secret files
 .env
 .env.*
-!.env.example
 
 # typescript
 *.tsbuildinfo

diff --git a/AGENTS.md b/AGENTS.md
@@ -13,14 +13,14 @@ Do not add authentication, accounts, payments, subscriptions, credits, API-key i
 - TanStack Start, React 19, TypeScript
 - TanStack Query
 - Tailwind CSS 4 and Base UI/shadcn primitives
-- Drizzle ORM with SQLite locally and D1 optionally
+- Drizzle ORM with local SQLite
 - Paraglide for English and Chinese
 
 ## Rules
 
 - Browser components call typed local API helpers; they do not import the database.
 - Provider keys stay server-side.
-- Storage entitlement follows billing. BeatAPI managed R2/Files is allowed only with the official `https://api.beatapi.io` billing endpoint; any custom API host must use an operator-owned R2/S3-compatible bucket. File selection stays local and upload is allowed only after generation precheck. Never commit shared storage credentials.
+- BeatAPI Files is the default generation-input upload path. Users may configure their own public R2/S3-compatible bucket; credentials stay encrypted in local SQLite. File selection stays local and upload is allowed only after generation precheck. Never commit shared storage credentials.
 - The model catalog lives in `src/core/effects/effect-registry.ts`.
 - BeatAPI request mapping lives in `src/core/adapters/beatapi-adapter.ts`.
 - Studio, Canvas, and Assets share projects, tasks, and assets.

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
@@ -30,9 +30,9 @@ The shared product model is asset-first:
 
 The browser calls local `/api` routes. Server routes validate input and resolve a logical model through the active Generation Provider contract. BeatAPI is the built-in/default provider; forks can register another source-level provider without changing Canvas, Editor, MCP, or the asset-first request contract.
 
-Provider credentials are read from environment variables or the local `config` table. Browser components never receive the raw API key.
+Provider and optional R2/S3 credentials are encrypted in the local `config` table. Browser components never receive raw credentials.
 
-Upload storage is a separate adapter boundary. File selection remains browser-local. A successful generation precheck creates a short-lived, one-time SQLite intent that binds the project, model, exact upload count, uploaded URLs, and final generation submission. Required references are promoted only after that point and immediately before task submission; they become project assets only after BeatAPI accepts the task. The built-in provider is fixed to the official `https://api.beatapi.io` endpoint. Official `BEATAPI_MANAGED_R2_*` secrets and self-hosted `R2_*` credentials are deliberately separate and never fall through to each other.
+Upload storage is a separate adapter boundary. File selection remains browser-local. A successful generation precheck creates a short-lived, one-time SQLite intent that binds the project, model, exact upload count, uploaded URLs, and final generation submission. Required references are promoted only after that point and immediately before task submission; they become project assets only after the provider accepts the task. The default path uploads supported references to BeatAPI Files. Users may instead configure a public R2/S3-compatible bucket; those credentials remain local and are used only for confirmed generation inputs.
 
 ## Command boundary
 
@@ -56,7 +56,7 @@ Canvas layout persistence is the deliberate exception on the UI side: drag, resi
 
 ## Persistence
 
-The SQLite/D1 schema contains twelve tables:
+The local SQLite schema contains twelve tables:
 
 - `project`
 - `project_canvas_state`
@@ -79,6 +79,6 @@ No user, session, role, order, subscription, payment, credit, API-key, ticket, o
 
 `src/core/effects/effect-registry.ts` is the canonical user-facing logical catalog. `src/core/generation-providers/` maps those logical IDs to provider bindings and adapters. `src/core/adapters/beatapi-adapter.ts` contains BeatAPI request mapping. Do not leak upstream effect IDs or field names into MCP tools, and do not add a second database-backed model registry.
 
-## Deployment boundary
+## Runtime boundary
 
-Local SQLite is the default. Cloudflare D1 is supported for hosted deployments. A hosted deployment is still logically single-user; put access control at the network/platform layer if the workspace must be private.
+BeatDesign is a localhost application backed by one SQLite database and project-owned files under `data/`. Cloud database and hosted deployment adapters are intentionally outside this repository.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,18 @@
 
 All notable changes to BeatDesign are documented in this file.
 
+## [0.2.1] - 2026-08-30
+
+### Changed
+
+- Fixed the open-source runtime to one local SQLite database and removed environment-file configuration from application startup.
+- Made BeatAPI Files the default confirmed-generation upload path while retaining optional, locally encrypted public R2/S3-compatible storage.
+- Kept provider selection as a source-level extension point with BeatAPI as the upstream default.
+
+### Removed
+
+- Cloudflare D1, Wrangler, Vercel, hosted deployment scripts, and obsolete SaaS-era assets that were not part of the local workbench.
+
 ## [0.2.0] - 2026-08-30
 
 ### Added
@@ -29,4 +41,5 @@ All notable changes to BeatDesign are documented in this file.
 - MP4 export remains browser-driven and is not yet available as a headless MCP tool.
 - Captions, transitions, speed controls, multiple named timelines, and native desktop packaging remain follow-up work.
 
+[0.2.1]: https://github.com/BeatAPI/BeatDesign/releases/tag/v0.2.1
 [0.2.0]: https://github.com/BeatAPI/BeatDesign/releases/tag/v0.2.0
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -14,15 +14,14 @@ Use Node.js 22+ and pnpm 10+.
 
 ```bash
 pnpm install
-cp .env.example .env.development
 pnpm db:push
 pnpm typecheck
 pnpm test
 pnpm i18n:check
 pnpm build
 ```
 
-Add or update tests for behavior changes. Add user-facing copy to both `messages/en.json` and `messages/zh.json`. Never include API keys, local databases, generated uploads, or deployment credentials.
+Add or update tests for behavior changes. Add user-facing copy to both `messages/en.json` and `messages/zh.json`. Never include API keys, local databases, generated uploads, or storage credentials.
 
 ## Pull requests
 

diff --git a/PROVIDERS.md b/PROVIDERS.md
@@ -2,12 +2,7 @@
 
 BeatAPI is the built-in and default generation/analysis provider. The official BeatAPI adapter keeps its upstream URL fixed to `https://api.beatapi.io`; users only provide their own BeatAPI API key.
 
-Configure it in either place:
-
-1. Set `BEATAPI_API_KEY` in the server environment.
-2. Use the Provider dialog in the workspace header. The key is saved in the local `config` table and takes precedence over the environment fallback.
-
-Set `CONFIG_ENCRYPTION_KEY` to encrypt saved API keys at rest. Keep that key stable: changing it makes previously encrypted values unreadable.
+Configure it in the Provider dialog in the workspace header. The key is encrypted in the local `config` table with a per-install key stored under `data/`.
 
 The adapter uses:
 
@@ -23,17 +18,16 @@ Kling 2.6 and Kling 3.0 Motion Control are exposed as BeatAPI models. Each run r
 
 Video Analysis is exposed as a stable BeatAPI workflow with Standard and Deep depth controls. The Workspace uploads one MP4/MOV input, submits the analysis task, polls `GET /v1/tasks/:id`, and stores the returned report text and usage in the local project history. Provider-specific Gemini routing remains private to BeatAPI.
 
-An API with a different request or polling contract needs its own adapter. Forks can register one in `src/config/generation-providers.ts`, bind only the logical models they support, and set server-side `GENERATION_PROVIDER=<id>`. BeatAPI is the default only when no custom provider is selected; an unknown configured id fails explicitly so it cannot accidentally submit a task to another provider. This repository does not ship placeholder KIE, Vidu, Evolink, Gemini, Fal, Replicate, or payment-provider integrations.
+An API with a different request or polling contract needs its own adapter. Forks can register one in `src/config/generation-providers.ts`, bind only the logical models they support, and change `ACTIVE_GENERATION_PROVIDER_ID` in the same file. BeatAPI remains the upstream default; an unknown configured id fails explicitly so it cannot accidentally submit a task to another provider. This repository does not ship placeholder KIE, Vidu, Evolink, Gemini, Fal, Replicate, or payment-provider integrations.
 
 A custom provider definition owns adapter construction, readiness checks, parameter validation, model bindings, upstream model names, and upload paths. Provider credentials must stay server-side. Switching providers does not change Canvas nodes, Editor clips, Asset IDs, or MCP requests; each submitted task also records its provider/model identity so polling does not silently follow a later default-provider change.
 
 ## Storage
 
 Storage is independently configurable from generation:
 
-- `beatapi` uses the official `https://api.beatapi.io` endpoint with the user's BeatAPI API key. File selection stays local; after generation precheck, supported references go to `POST /v1/files` or the official deployment's managed R2 immediately before task submission.
+- `beatapi` uses the official `https://api.beatapi.io` endpoint with the user's BeatAPI API key. File selection stays local; after generation precheck, supported references go to `POST /v1/files` immediately before task submission.
 - Precheck creates a one-time SQLite generation intent that binds project, model, upload count, uploaded URLs, and final task submission. Selecting a file alone never uploads it, and uploaded inputs are not indexed as project assets until BeatAPI accepts the task.
-- Self-hosters may select `s3` to send generation references to their own Cloudflare R2 or S3-compatible bucket under the same intent rules.
-- The official hosted Workspace may inject `BEATAPI_MANAGED_R2_*` deployment secrets, giving users managed video-input uploads without exposing shared credentials. User-owned storage uses only `R2_*`; the two credential sets are isolated.
+- Users may select `s3` to send generation references to their own public R2/S3-compatible bucket under the same intent rules. Credentials are encrypted in local SQLite rather than read from environment files.
 
-Remote generation providers require public HTTPS media URLs. A custom bucket therefore needs `R2_PUBLIC_URL`, normally an R2 custom domain or public bucket domain.
+Remote generation providers require public HTTPS media URLs. A custom bucket therefore needs a public base URL, normally an R2 custom domain or public bucket domain.
diff --git a/README.md b/README.md
@@ -60,7 +60,6 @@ Requirements: Node.js 22+, pnpm 10+, and current Chrome on macOS or Windows.
 
 ```bash
 pnpm install
-cp .env.example .env.development
 pnpm db:push
 pnpm dev
 ```
@@ -117,7 +116,6 @@ See [MCP setup and tool boundaries](./docs/MCP.md).
 - Project-owned media under `data/project-assets/<project-id>/`.
 - Revision-aware Canvas and Editor saving.
 - English and Chinese UI.
-- Optional Cloudflare D1 deployment target.
 
 ## Data and provider boundary
 
@@ -133,9 +131,9 @@ Generation adapter (BeatAPI by default)
 Output copied back into the local Asset library
 ```
 
-API keys and storage credentials remain server-side. Selecting or dragging a local file does not send it to a provider. BeatDesign persists the file locally first and uploads only the durable project Asset required by a confirmed generation request.
+API keys and optional R2/S3 credentials are encrypted in the local SQLite workspace. Selecting or dragging a local file does not send it to a provider. BeatDesign persists the file locally first and uploads only the durable project Asset required by a confirmed generation request. BeatAPI Files is the default upload path; users can select their own public R2/S3-compatible bucket in Connections.
 
-BeatDesign does not reproduce provider billing, balance, or rate-limit logic. It returns the provider's result or error to the UI/MCP caller. The upstream repository ships the official BeatAPI adapter; a fork can implement `BaseAdapter` and register it in `src/config/generation-providers.ts`.
+BeatDesign does not reproduce provider billing, balance, or rate-limit logic. It returns the provider's result or error to the UI/MCP caller. The upstream repository ships the official BeatAPI adapter; a fork can implement `BaseAdapter`, register it, and select it in `src/config/generation-providers.ts`.
 
 Read [provider architecture](./PROVIDERS.md) and [system architecture](./ARCHITECTURE.md) for the full contract.
 
@@ -173,7 +171,7 @@ Start with [CONTRIBUTING.md](./CONTRIBUTING.md), then use:
 - [WORKSPACE_MODES.md](./WORKSPACE_MODES.md) for product surfaces.
 - [docs/MCP.md](./docs/MCP.md) for Agent integration.
 - [DESIGN.md](./DESIGN.md) for the BeatDesign visual language.
-- [SECURITY.md](./SECURITY.md) for local and deployment safety.
+- [SECURITY.md](./SECURITY.md) for local-workspace safety.
 
 ## License
 

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -60,7 +60,6 @@ Editor ────────── 裁剪、切分、移动、混音、AI 重
 
 ```bash
 pnpm install
-cp .env.example .env.development
 pnpm db:push
 pnpm dev
 ```
@@ -117,7 +116,6 @@ MCP 不会模拟点击界面像素。Agent 读取 Project、提交稳定命令
 - 项目媒体保存在 `data/project-assets/<project-id>/`。
 - Canvas 与 Editor 使用 revision-aware 保存。
 - 中英文界面。
-- 可选 Cloudflare D1 部署目标。
 
 ## 数据与 Provider 边界
 
@@ -133,9 +131,9 @@ Generation adapter（默认 BeatAPI）
 输出复制回本地 Asset 素材库
 ```
 
-API Key 和存储凭据只留在服务端。选择或拖入本地文件不会把它发送给 Provider；BeatDesign 会先把它持久化为本地 Project Asset，只有用户确认生成后，才上传该次生成真正需要的素材。
+API Key 和可选的 R2/S3 凭据会加密保存在本地 SQLite。选择或拖入本地文件不会把它发送给 Provider；BeatDesign 会先把它持久化为本地 Project Asset，只有用户确认生成后，才上传该次生成真正需要的素材。默认使用 BeatAPI Files，用户也可以在“连接配置”中选择自己的公网 R2/S3 兼容存储桶。
 
-BeatDesign 不重复实现 Provider 的余额、计费或限流逻辑，只把 Provider 的结果或错误返回给 UI / MCP。上游仓库内置官方 BeatAPI 适配器；fork 可以实现 `BaseAdapter`，并在 `src/config/generation-providers.ts` 中注册。
+BeatDesign 不重复实现 Provider 的余额、计费或限流逻辑，只把 Provider 的结果或错误返回给 UI / MCP。上游仓库内置官方 BeatAPI 适配器；fork 可以实现 `BaseAdapter`，并在 `src/config/generation-providers.ts` 中注册和选择。
 
 完整约定见 [Provider 架构](./PROVIDERS.md) 与 [系统架构](./ARCHITECTURE.md)。
 
@@ -173,7 +171,7 @@ BeatDesign v0.2 聚焦本地 AI 短视频工作流：
 - [WORKSPACE_MODES.md](./WORKSPACE_MODES.md)：产品视图。
 - [docs/MCP.md](./docs/MCP.md)：Agent 接入。
 - [DESIGN.md](./DESIGN.md)：BeatDesign 视觉语言。
-- [SECURITY.md](./SECURITY.md)：本地与部署安全。
+- [SECURITY.md](./SECURITY.md)：本地工作区安全。
 
 ## License
 

diff --git a/RELEASE_SCOPE.md b/RELEASE_SCOPE.md
@@ -2,15 +2,15 @@
 
 This repository contains BeatDesign only. The separate BeatAPI SaaS Template is not part of this codebase.
 
-Included: homepage, projects, Studio, Canvas, provider configuration, supported model and video-analysis registry, generation/analysis lifecycle, uploads, assets, local history, i18n, SQLite/D1 persistence, tests, and deployment examples.
+Included: homepage, projects, Studio, Canvas, provider and upload-storage configuration, supported model and video-analysis registry, generation/analysis lifecycle, uploads, assets, local history, i18n, SQLite persistence, tests, and localhost runtime examples.
 
 Excluded: authentication, login, accounts, payments, subscriptions, credits, API-key issuing, invitations, RBAC, admin, support tickets, CMS, email delivery, and unrelated AI-provider adapters.
 
 Release verification requires a clean install, schema creation, production build (which generates Paraglide and route types), typecheck, test, i18n check, MCP stdio handshake, and local route smoke test. A real paid BeatAPI generation is a separate credentialed end-to-end check.
 
-## v0.2.0 release gate
+## v0.2.1 release gate
 
-- [x] Package, MCP server, and Codex plugin versions agree on `0.2.0`.
+- [x] Package, MCP server, and Codex plugin versions agree on `0.2.1`.
 - [x] Canvas, Editor, and MCP contracts have automated coverage.
 - [x] MCP exposes Project, Asset, Canvas, Generation, and Editor groups without full-document replacement tools.
 - [x] Local media import and image clips are documented as shipped capabilities.

diff --git a/SECURITY.md b/SECURITY.md
@@ -8,6 +8,6 @@ Include the affected route or component, reproduction steps, impact, and any sug
 
 ## Deployment responsibility
 
-BeatDesign is a single-user, local-first application and does not include authentication. The development server binds to localhost. Operators who expose it to a network must add access control in front of the application and provide provider and storage credentials through deployment secrets.
+BeatDesign is a single-user, local-first application and does not include authentication. The development server binds to localhost and is not designed to be exposed as a hosted multi-user service. Provider and optional storage credentials are encrypted in the local SQLite workspace.
 
 The maintainers support the latest released `0.2.x` version. Security fixes are published in the next patch release when possible.