@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/apps/fullstack/apps/{{projectName}}-desktop/src-tauri/src/lib.rs.hbs

@@ -0,0 +1,91 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.desktop}}
+use std::collections::HashMap;
+use tauri::utils::config::{Csp, CspDirectiveSources};
+
+/// 校验运行期 API 地址；例如 `https://api.example.test/api/v1`，不接收认证信息或查询参数。
+fn parse_runtime_api(value: &str) -> Result<tauri::Url, &'static str> {
+    let url = tauri::Url::parse(value).map_err(|_| "Invalid PUBLIC_API_BASE")?;
+    if !["http", "https"].contains(&url.scheme())
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.query().is_some()
+        || url.fragment().is_some()
+    {
+        return Err(
+            "PUBLIC_API_BASE must be an HTTP(S) URL without credentials, query or fragment",
+        );
+    }
+    Ok(url)
+}
+
+/// 仅将当前运行期 API 的 origin 加入 CSP；不放宽到所有 HTTP/HTTPS 站点。
+fn runtime_csp(policy: Csp, origin: &str) -> Csp {
+    let mut directives: HashMap<String, CspDirectiveSources> = policy.into();
+    for name in ["connect-src", "img-src"] {
+        directives.entry(name.to_string()).or_default().push(origin);
+    }
+    directives.into()
+}
+
+#[tauri::command]
+fn greet(name: &str) -> String {
+    format!("Hello, {}! Welcome to Desktop.", name)
+}
+
+#[cfg_attr(mobile, tauri::mobile_entry_point)]
+pub fn run() {
+    // 构建不读取部署环境；启动时从进程 PUBLIC_API_BASE 获取公开地址。
+    let api = parse_runtime_api(
+        &std::env::var("PUBLIC_API_BASE")
+            .unwrap_or_else(|_| "http://localhost:3000/api/v1".to_string()),
+    )
+    .expect("Invalid runtime API configuration");
+    let mut context = tauri::generate_context!();
+    if let Some(policy) = context.config_mut().app.security.csp.take() {
+        context.config_mut().app.security.csp =
+            Some(runtime_csp(policy, &api.origin().ascii_serialization()));
+    }
+    let script = format!(
+        "globalThis.__HAI_PUBLIC_CONFIG__={};",
+        serde_json::json!({ "apiBase": api.as_str() })
+    );
+    tauri::Builder::default()
+{{#if features.feedback}}
+        .plugin(tauri_plugin_dialog::init())
+        .plugin(tauri_plugin_fs::init())
+{{/if}}
+        .plugin(tauri_plugin_shell::init())
+        .append_invoke_initialization_script(script)
+        .invoke_handler(tauri::generate_handler![greet])
+        .run(context)
+        .expect("error while running tauri application");
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn validates_runtime_address_and_scopes_csp() {
+        let api = parse_runtime_api("https://api.example.test:8443/custom/v2").unwrap();
+        let policy = runtime_csp(
+            Csp::Policy("default-src 'self'; connect-src 'self'".into()),
+            &api.origin().ascii_serialization(),
+        );
+        let directives: HashMap<String, CspDirectiveSources> = policy.into();
+        let sources: Vec<String> = directives["connect-src"].clone().into();
+        assert!(sources.contains(&"https://api.example.test:8443".to_string()));
+        assert!(!sources.contains(&"https:".to_string()));
+        for value in [
+            "file:///tmp/config",
+            "https://user:secret@host",
+            "https://host/?token=secret",
+            "relative",
+        ] {
+            assert!(parse_runtime_api(value).is_err());
+        }
+    }
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-desktop/src-tauri/src/main.rs.hbs

@@ -0,0 +1,8 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.desktop}}
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+fn main() {
+    {{fullstack.nativeAppIdSegment}}_desktop_lib::run()
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-desktop/src-tauri/tauri.conf.json.hbs

@@ -0,0 +1,46 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.desktop}}
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": {{json fullstack.appName}},
+  "version": "../../../package.json",
+  "identifier": "com.hai.{{fullstack.nativeAppIdSegment}}.desktop",
+  "build": {
+    "beforeDevCommand": "pnpm dev",
+    "beforeBuildCommand": "pnpm compile",
+    "devUrl": "http://localhost:{{fullstack.ports.desktop}}",
+    "frontendDist": "../dist"
+  },
+  "app": {
+    "windows": [
+      {
+        "title": {{json fullstack.appName}},
+        "width": 1280,
+        "height": 800,
+        "resizable": true,
+        "fullscreen": false,
+        "center": true
+      }
+    ],
+    "security": {
+      "headers": {
+        "Cross-Origin-Opener-Policy": "same-origin",
+        "Cross-Origin-Embedder-Policy": "require-corp",
+        "Cross-Origin-Resource-Policy": "same-origin"
+      },
+      "csp": "default-src 'self'; img-src 'self' blob: data: https: http://localhost:3000 http://127.0.0.1:3000; media-src 'self' blob:; frame-src 'self' about: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self' http://localhost:3000 http://127.0.0.1:3000 ws://localhost:* ws://127.0.0.1:*; font-src 'self' data:"
+    }
+  },
+  "bundle": {
+    "active": true,
+    "targets": ["nsis"],
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.ico"
+    ]
+  }
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-desktop/svelte.config.js.hbs

@@ -0,0 +1,14 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.desktop}}
+import { autoImportHaiUi } from '@h-ai/ui/auto-import'
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte'
+
+/** @type {import('@sveltejs/vite-plugin-svelte').SvelteConfig} */
+export default {
+  preprocess: [autoImportHaiUi(), vitePreprocess()],
+  compilerOptions: {
+    // 使用 Svelte 5 Runes，和 @h-ai/ui 组件库保持一致。
+    runes: true,
+  },
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-desktop/tsconfig.json.hbs

@@ -0,0 +1,22 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.desktop}}
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "allowJs": true,
+    "checkJs": false,
+    "strict": true,
+    "noEmit": true,
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true,
+    "types": ["svelte", "vite/client", "node", "vitest/globals"]
+  },
+  "include": ["src/**/*.ts", "src/**/*.svelte", "tests/**/*.ts", "vite.config.ts", "svelte.config.js"],
+  "exclude": ["node_modules", "dist", "src-tauri/target"]
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-desktop/vite.config.ts.hbs

@@ -0,0 +1,89 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.desktop}}
+import type { Plugin } from 'vite'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { core } from '@h-ai/core'
+import { haiOptimizeExclude, haiPrebundledDeps } from '@h-ai/ui/vite'
+import { paraglideVitePlugin } from '@inlang/paraglide-js'
+import { svelte } from '@sveltejs/vite-plugin-svelte'
+import tailwindcss from '@tailwindcss/vite'
+import { defineConfig } from 'vitest/config'
+import { resolveBuildMetadata } from '../../scripts/build-metadata.js'
+
+const host = process.env.TAURI_DEV_HOST
+const envDir = fileURLToPath(new URL('../../', import.meta.url))
+
+export default defineConfig(({ mode, command }) => {
+  const envResult = command === 'build' || process.env.HAI_E2E === '1' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
+  if (!envResult.success)
+    throw new Error(envResult.error.message)
+  const env = envResult.data
+  Object.assign(process.env, env)
+  const buildMetadata = resolveBuildMetadata(fileURLToPath(new URL('.', import.meta.url)))
+  const metadataAsset: Plugin = {
+    name: 'hai-build-metadata',
+    generateBundle() {
+      this.emitFile({ type: 'asset', fileName: 'build-metadata.json', source: JSON.stringify(buildMetadata) })
+    },
+  }
+  const target = (env.PUBLIC_API_BASE || process.env.SERVICE_BASE_URL || 'http://127.0.0.1:3000').replace(/\/api\/v1\/?$/, '')
+  const proxy = { '/api': { target, changeOrigin: true } }
+
+  return {
+    base: './',
+    envDir: false,
+    define: { __HAI_BUILD_METADATA__: JSON.stringify(buildMetadata) },
+    preview: { proxy },
+    build: {
+      rolldownOptions: {
+        output: {
+          codeSplitting: {
+            groups: [
+              { name: 'vendor-ui', test: /node_modules\/(?:@h-ai\/ui|bits-ui|svelte)\// },
+              { name: 'vendor-crypto', test: /node_modules\/(?:@h-ai\/(?:core|crypto)|sm-crypto(?:-v2)?)\// },
+              { name: 'vendor-api', test: /node_modules\/(?:@orpc\/|zod\/)/ },
+            ],
+          },
+        },
+      },
+    },
+    plugins: [
+      metadataAsset,
+      svelte(),
+      tailwindcss(),
+      paraglideVitePlugin({
+        project: './project.inlang',
+        outdir: './src/lib/paraglide',
+        strategy: ['cookie', 'baseLocale'],
+      }),
+    ],
+    clearScreen: false,
+    server: {
+      proxy,
+      port: {{fullstack.ports.desktop}},
+      strictPort: true,
+      host: host || false,
+      hmr: host
+        ? {
+            protocol: 'ws',
+            host,
+            port: {{fullstack.ports.desktop}} + 1,
+          }
+        : undefined,
+      watch: {
+        ignored: ['**/src-tauri/**'],
+      },
+    },
+    optimizeDeps: {
+      exclude: ['@h-ai/ui', ...haiOptimizeExclude],
+      include: [...haiPrebundledDeps],
+    },
+    envPrefix: ['VITE_', 'PUBLIC_'],
+    test: {
+      environment: 'node',
+      include: ['tests/**/*.test.ts'],
+    },
+  }
+})
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-miniapp/README.md.hbs

@@ -0,0 +1,25 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.hasMiniapp}}
+# {{projectName}}-miniapp
+
+## 简介
+
+小程序预留目录，目前没有可运行的小程序应用。
+
+## 核心功能清单
+
+- 已提供 `project.inlang/settings.json` 与中、英、日三种语言的 `messages/`。
+- 可复用 `packages/{{fullstack.contractPackageName}}` 的接口类型。
+
+## 使用入门
+
+选定小程序框架后再实现页面、请求适配和认证。小程序文案放本目录 `messages/`，跨端通用内容放 `packages/{{fullstack.sharedPackageName}}`；消息格式插件使用工程根已安装的依赖。
+
+## 开发测试
+
+本目录不参与 workspace 构建、单元测试或 E2E。接入实际框架后增加对应命令，并在目标平台验证登录、请求、导航与发布包。
+
+## 许可证
+
+Apache-2.0
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-miniapp/messages/en-US.json.hbs

@@ -0,0 +1,12 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.hasMiniapp}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "mini_title": "{{projectName}} Mini App",
+  "mini_status": "Reserved placeholder",
+  "mini_description": "The mini app target does not generate a buildable package yet, but it includes standard inlang project.inlang and messages so a real mini app framework can adopt them later.",
+  "mini_shared_contract": "Reuse Schema and route constants from packages/{{fullstack.contractPackageName}}.",
+  "mini_own_messages": "Mini-app-only copy lives in apps/{{projectName}}-miniapp/messages.",
+  "mini_customize": "Keep locale lists aligned with shared so cross-platform locale switching remains consistent."
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-miniapp/messages/ja-JP.json.hbs

@@ -0,0 +1,12 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.hasMiniapp}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "mini_title": "{{projectName}} ミニアプリ",
+  "mini_status": "予約済みのプレースホルダー",
+  "mini_description": "ミニアプリの対象では、まだビルド可能なパッケージは生成しません。標準のinlang project.inlangとmessagesを用意しているため、後でミニアプリ用フレームワークに組み込めます。",
+  "mini_shared_contract": "packages/{{fullstack.contractPackageName}}のスキーマとルート定数を再利用してください。",
+  "mini_own_messages": "ミニアプリ固有の文案はapps/{{projectName}}-miniapp/messagesに配置します。",
+  "mini_customize": "端末間の言語切り替えを揃えるため、言語一覧をsharedと一致させてください。"
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-miniapp/messages/zh-CN.json.hbs

@@ -0,0 +1,12 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.hasMiniapp}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "mini_title": "{{projectName}} 小程序端",
+  "mini_status": "预留占位",
+  "mini_description": "小程序端暂不生成可构建 package，但已经按 inlang 标准预置 project.inlang 与 messages，后续接入真实小程序框架时可直接迁移。",
+  "mini_shared_contract": "复用 packages/{{fullstack.contractPackageName}} 的 Schema 与路径常量。",
+  "mini_own_messages": "小程序独有文案放在 apps/{{projectName}}-miniapp/messages。",
+  "mini_customize": "保持 locale 列表与 shared 一致，跨端语言切换才能保持同步。"
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-miniapp/project.inlang/settings.json.hbs

@@ -0,0 +1,17 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.hasMiniapp}}
+{
+  "$schema": "https://inlang.com/schema/project-settings",
+  "baseLocale": "{{fullstack.i18n.baseLocale}}",
+  "locales": [
+    {{#each fullstack.i18n.locales}}"{{this}}"{{#unless @last}},{{/unless}}
+    {{/each}}
+  ],
+  "modules": [
+    "../../node_modules/@inlang/plugin-message-format/dist/index.js"
+  ],
+  "plugin.inlang.messageFormat": {
+    "pathPattern": "./messages/{locale}.json"
+  }
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/README.md.hbs

@@ -0,0 +1,54 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+# {{projectName}}-web
+
+## 简介
+
+响应式 mini 后台 Web 前端，通过 `packages/{{fullstack.sharedPackageName}}` 调用后端 API，并通过 `@h-ai/ui` 组件搭建页面。
+
+## 核心功能清单
+
+- 浏览器访问共享管理界面与个人设置。
+- 与 API 共用接口类型、登录状态、主题和语言。
+- 可单独构建 Web 镜像并增量更新。
+
+## 使用入门
+
+### i18n 与 shared 协同
+
+- 本端页面文案：`messages/{locale}.json` + `project.inlang/settings.json`
+- 共享 Shell/主题/语言/API：`packages/{{fullstack.sharedPackageName}}`
+- 个人设置保存语言与风格偏好到 IAM 元数据，并同步 shared 和本端 Paraglide runtime
+
+自定义建议：Web 独有文案放在本目录 `messages/`；跨端通用文案或组件放到 shared。
+
+### 编译、打包与部署
+
+```bash
+# 开发预览，默认端口 {{fullstack.ports.web}}
+pnpm --filter {{projectName}}-web dev
+
+# 编译 Web 前端
+pnpm --filter {{projectName}}-web build
+```
+
+从工程根运行 `pnpm build --target docker` 导出镜像。默认带部署工具，可运行 `pnpm run deploy --env test --build` 一次完成构建发布，或 `pnpm run deploy --env prod --bundle-only` 交付已有镜像及跨平台脚本。完整包包含自建中间件，人工部署与按服务更新见工程根 README。
+
+### IAM 认证配置
+
+服务端 `config/_iam.yml` 统一控制登录、注册、重置、协议与 `ui` 品牌。邮件/短信可用 `_reach.yml` 中的 Provider/标准模板或自定义发送回调。`AuthPanel` 使用安全公开配置及框架认证动作；无需在页面适配 Token、验证码倒计时和错误提示。Memory 仅用于本地开发和显式测试；生产环境即使只有一个实例，也须使用框架支持的共享数据库与 Redis，并按工程根 README 配置写入路由和传输会话。
+
+LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise；回调第三参数 context 提供 expiresAt/idempotencyKey，发送服务按稳定键持久化去重，异常/超时为结果未知且不自动重发。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
+
+协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
+
+完整契约见生成应用的 `.agents/skills/hai-iam/reference.md`。
+
+## 开发测试
+
+从工程根执行 `pnpm typecheck`、`pnpm lint`、`pnpm build`、`pnpm test` 和 `pnpm test:e2e`。浏览器预览通过后，原生壳仍需在对应系统或设备单独验收。
+
+## 许可证
+
+Apache-2.0
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/eslint.config.js.hbs

@@ -0,0 +1,20 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+import antfu, { GLOB_SRC } from '@antfu/eslint-config'
+import { haiQualityConfig } from '../../eslint-rules.js'
+
+export default antfu({
+  // unused-imports 使用 TS 规则，JS 同样使用 TS parser 以保持 scope 契约一致。
+  typescript: { files: [GLOB_SRC] },
+  formatters: true,
+  ignores: ['**/build/**', '**/dist/**', '**/*.d.ts', '**/project.inlang/**', '**/src/lib/paraglide/**'],
+  svelte: true,
+}, haiQualityConfig, {
+  files: ['**/*.svelte'],
+  rules: {
+    'svelte/html-quotes': 'off',
+    'svelte/indent': 'off',
+    'perfectionist/sort-imports': 'off',
+  },
+})
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/index.html.hbs

@@ -0,0 +1,21 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+<!doctype html>
+<html lang="{{fullstack.i18n.baseLocale}}">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{{html fullstack.appName}}</title>
+    <link
+      rel="icon"
+      type="image/svg+xml"
+      href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='8' fill='%234438df'/%3E%3Cpath d='M10 8v16M22 8v16M10 16h12' fill='none' stroke='white' stroke-width='3'/%3E%3C/svg%3E"
+    />
+    <script src="./runtime-config.js"></script>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="./src/main.ts"></script>
+  </body>
+</html>
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/messages/en-US.json.hbs

@@ -0,0 +1,7 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "page_title": "{name}"
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/messages/ja-JP.json.hbs

@@ -0,0 +1,7 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "page_title": "{name}"
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/messages/zh-CN.json.hbs

@@ -0,0 +1,7 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "page_title": "{name}"
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/package.json.hbs

@@ -0,0 +1,53 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+{
+  "name": "{{projectName}}-web",
+  "type": "module",
+  "version": "0.1.0",
+  "private": true,
+  "engines": { "node": "^22.23.4 || ^24.22.1 || ^26.12.1" },
+  "scripts": {
+    "paraglide:compile": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide",
+    "paraglide:watch": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide --watch",
+    "dev:test": "vite --mode test",
+    "dev:prod": "vite --mode prod",
+    "dev": "vite dev --host 127.0.0.1 --port {{fullstack.ports.web}}",
+    "build": "pnpm paraglide:compile && vite build",
+    "package": "pnpm build",
+    "preview": "vite preview --host 127.0.0.1 --port {{fullstack.ports.web}} --strictPort",
+    "check": "pnpm typecheck",
+    "typecheck": "pnpm paraglide:compile && svelte-check --tsconfig ./tsconfig.json",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "clean": "rimraf dist build .turbo src/lib/paraglide"
+  },
+  "dependencies": {
+    "@h-ai/ui": "{{haiPackageSpecifier}}",
+    "{{fullstack.sharedPackageName}}": "workspace:*"
+  },
+  "devDependencies": {
+    "@antfu/eslint-config": "{{fullstack.packageSpecifiers.antfuEslintConfig}}",
+    "@h-ai/core": "{{haiPackageSpecifier}}",
+    "@iconify-json/tabler": "{{fullstack.packageSpecifiers.iconifyJsonTabler}}",
+    "@iconify/tailwind4": "{{fullstack.packageSpecifiers.iconifyTailwind}}",
+    "@inlang/paraglide-js": "{{fullstack.packageSpecifiers.inlangParaglide}}",
+    "@inlang/plugin-message-format": "{{fullstack.packageSpecifiers.inlangMessageFormat}}",
+    "@sveltejs/vite-plugin-svelte": "{{fullstack.packageSpecifiers.sveltePlugin}}",
+    "@tailwindcss/vite": "{{fullstack.packageSpecifiers.tailwindcssVite}}",
+    "bits-ui": "{{fullstack.packageSpecifiers.bitsUi}}",
+    "daisyui": "{{fullstack.packageSpecifiers.daisyui}}",
+    "eslint": "{{fullstack.packageSpecifiers.eslint}}",
+    "eslint-plugin-format": "{{fullstack.packageSpecifiers.eslintPluginFormat}}",
+    "eslint-plugin-svelte": "{{fullstack.packageSpecifiers.eslintPluginSvelte}}",
+    "svelte": "{{fullstack.packageSpecifiers.svelte}}",
+    "svelte-check": "{{fullstack.packageSpecifiers.svelteCheck}}",
+    "svelte-eslint-parser": "{{fullstack.packageSpecifiers.svelteEslintParser}}",
+    "tailwindcss": "{{fullstack.packageSpecifiers.tailwindcss}}",
+    "typescript": "{{fullstack.packageSpecifiers.typescript}}",
+    "vite": "{{fullstack.packageSpecifiers.vite}}",
+    "vitest": "{{fullstack.packageSpecifiers.vitest}}"
+  }
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/project.inlang/settings.json.hbs

@@ -0,0 +1,17 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+{
+  "$schema": "https://inlang.com/schema/project-settings",
+  "baseLocale": "{{fullstack.i18n.baseLocale}}",
+  "locales": [
+    {{#each fullstack.i18n.locales}}"{{this}}"{{#unless @last}},{{/unless}}
+    {{/each}}
+  ],
+  "modules": [
+    "../../node_modules/@inlang/plugin-message-format/dist/index.js"
+  ],
+  "plugin.inlang.messageFormat": {
+    "pathPattern": "./messages/{locale}.json"
+  }
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/public/runtime-config.js.hbs

@@ -0,0 +1 @@
+globalThis.__HAI_PUBLIC_CONFIG__ = {}

package/templates/apps/fullstack/apps/{{projectName}}-web/src/App.svelte.hbs

@@ -0,0 +1,18 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+<script lang="ts">
+  import { AdminWorkspace } from '{{fullstack.sharedPackageName}}'
+{{#if features.feedback}}
+  import { buildMetadata } from './build-metadata.js'
+{{/if}}
+  import { setLocale } from './lib/paraglide/runtime.js'
+
+  const apiOptions = { clientName: '{{projectName}}-web' }
+
+  function syncLocale(locale: string) {
+    setLocale(locale as Parameters<typeof setLocale>[0], { reload: false })
+  }
+</script>
+
+<AdminWorkspace platform="web" {apiOptions}{{#if features.feedback}} {buildMetadata}{{/if}} onLocaleChange={syncLocale} />
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/src/app.css.hbs

@@ -0,0 +1,18 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+@import 'tailwindcss';
+@import '@h-ai/ui/styles/global.css';
+@import '@h-ai/ui/styles/theme.css';
+@source "../node_modules/@h-ai/ui/dist/**/*.{svelte,js,ts}";
+@source "../../../node_modules/@h-ai/ui/dist/**/*.{svelte,js,ts}";
+@source "../../../packages/{{fullstack.sharedPackageName}}/src/**/*.{svelte,js,ts}";
+
+@plugin "daisyui" {
+  themes:
+    {{#each fullstack.theme.themes}}{{this}}{{#if_eq this ../fullstack.theme.defaultTheme}} --default{{/if_eq}}{{#unless @last}},
+    {{/unless}}{{/each}};
+}
+@plugin "@iconify/tailwind4" {
+  prefixes: tabler;
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/src/app.d.ts.hbs

@@ -0,0 +1,8 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+/// <reference types="vite/client" />
+
+import '@h-ai/ui/auto-import'
+
+declare module '*.css'
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/src/build-metadata.ts.hbs

@@ -0,0 +1,9 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+{{#if features.feedback}}
+/** 当前应用编译时烘焙的产物身份；运行时配置不能覆盖。 */
+declare const __HAI_BUILD_METADATA__: { appVersion: string, buildId: string, commit: string }
+
+export const buildMetadata = __HAI_BUILD_METADATA__
+{{/if}}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/src/main.ts.hbs

@@ -0,0 +1,14 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+import { mount } from 'svelte'
+import App from './App.svelte'
+import './app.css'
+
+const target = document.getElementById('app')
+if (!target)
+  throw new Error('Root element #app not found')
+
+const app = mount(App, { target })
+
+export default app
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/svelte.config.js.hbs

@@ -0,0 +1,16 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+import { autoImportHaiUi } from '@h-ai/ui/auto-import'
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte'
+
+/** @type {import('@sveltejs/vite-plugin-svelte').SvelteConfig} */
+const config = {
+  preprocess: [autoImportHaiUi(), vitePreprocess()],
+  compilerOptions: {
+    // 使用 Svelte 5 Runes，和 @h-ai/ui 组件库保持一致。
+    runes: true,
+  },
+}
+
+export default config
+{{/if}}