@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/stores/management-store.svelte.ts.hbs

@@ -0,0 +1,614 @@
+import type { IamListUsersInput, IamPublicConfig } from '@h-ai/api-contract'
+import type { HaiResult } from '@h-ai/core'
+import type { ChangePasswordFormData, UserProfileSubmitData } from '@h-ai/ui'
+import type { AdminAuditLog, AdminCreateUser, AdminInviteUser, AdminPermissionPolicy, AdminRole, AdminUpdateUser, AdminUser, AuditBackupReceipt, AvatarUpload, ProfileUpdate } from '{{fullstack.contractPackageName}}'
+import type { AppInfo, ManagementApiOptions } from '../api/api-client.js'
+import type { HashRouter } from '../navigation/hash-router.svelte.js'
+import { HaiApiClientError } from '@h-ai/api-client'
+import { IamSessionErrorCodeSchema } from '@h-ai/api-contract'
+import { core, err, HaiCommonError, ok } from '@h-ai/core'
+import { authErrorMessage, matchPermission } from '@h-ai/ui/components/scenes/iam/index'
+import { setGlobalLocale } from '@h-ai/ui/i18n'
+import { toast } from '@h-ai/ui/toast'
+import { SvelteDate } from 'svelte/reactivity'
+import { initializeManagementApi, managementApi, resolveAvatarUrl } from '../api/api-client.js'
+import { requestSensitive } from '../api/sensitive-actions.svelte.js'
+import * as m from '../paraglide/messages.js'
+import { getLocale, locales, setLocale } from '../paraglide/runtime.js'
+import { AVAILABLE_THEMES, DEFAULT_THEME, themeStore } from './theme-store.svelte.js'
+
+type ResultData<T> = T extends { success: true, data: infer D } ? D : never
+export type CurrentUser = ResultData<Awaited<ReturnType<typeof managementApi.iam.auth.currentUser>>>
+/** 页面目录对应的相对路径；例如 `reports/weekly`，新增页面无需修改类型或路由表。 */
+export type ManagementPage = string
+
+/** 页面状态和业务操作在共享 store 中收敛，宿主端仅装配平台能力。 */
+export class ManagementStore {
+  /**
+   * 绑定当前工作区的页面路由；服务端继续验证各 API 的权限。
+   * @example new ManagementStore(new HashRouter(Object.keys(pages), '/users'))
+   */
+  constructor(router: HashRouter) {
+    this.router = router
+  }
+
+  private readonly router: HashRouter
+  info = $state<AppInfo | null>(null)
+  authConfig = $state<IamPublicConfig | null>(null)
+  user = $state<CurrentUser | null>(null)
+  page = $state<ManagementPage>('settings')
+  locale = $state(getLocale())
+  initializing = $state(true)
+  loading = $state(false)
+  saving = $state(false)
+  error = $state('')
+  users = $state<AdminUser[]>([])
+  usersTotal = $state(0)
+  usersPage = $state(1)
+  usersSearch = $state('')
+  usersStatus = $state<'all' | AdminUser['accountStatus']>('all')
+  usersSortBy = $state<NonNullable<IamListUsersInput['sortBy']>>('createdAt')
+  usersSortDirection = $state<'asc' | 'desc'>('desc')
+  private appliedUsersQuery: Partial<Pick<Parameters<typeof managementApi.admin.users.list>[0], 'search' | 'accountStatus'>> = {}
+  private appliedAuditQuery: Partial<Parameters<typeof managementApi.admin.audit.list>[0]> = {}
+  roles = $state<AdminRole[]>([])
+  permissionPolicies = $state<AdminPermissionPolicy[]>([])
+  permissionPolicyPage = $state(1)
+  permissionPolicyTotal = $state(0)
+  audit = $state<AdminAuditLog[]>([])
+  auditTotal = $state(0)
+  auditPage = $state(1)
+  businessNotice = $state('')
+  auditCategory = $state<'system' | 'business' | ''>('')
+  auditOutcome = $state<'success' | 'failure' | 'denied' | ''>('')
+  auditSeverity = $state<'info' | 'warning' | 'error' | 'critical' | ''>('')
+  auditSortBy = $state<'createdAt' | 'action' | 'resource' | 'category' | 'outcome' | 'severity'>('createdAt')
+  auditSortDirection = $state<'asc' | 'desc'>('desc')
+  auditStats = $state<{ action: string, count: number }[]>([])
+  auditBackupEnabled = $state(false)
+  auditBackupReceipt = $state<AuditBackupReceipt | null>(null)
+  private auditBackupId = ''
+  auditAction = $state('')
+  auditResource = $state('')
+  auditStartDate = $state('')
+  auditEndDate = $state('')
+  readonly pageSize = 20
+  private requestVersion = 0
+  private sessionEpoch = 0
+  private onLocaleChange?: (locale: string) => void
+
+  localDateTime(value: string): string {
+    const date = new SvelteDate(value)
+    date.setMinutes(date.getMinutes() - date.getTimezoneOffset())
+    return date.toISOString().slice(0, 16)
+  }
+
+  hasPermission(permission: string): boolean {
+    return matchPermission(permission, this.user?.permissions ?? [])
+  }
+
+  canOpenPage(page: string): boolean {
+    const permissions: Record<string, string> = { users: 'app.users.manage', roles: 'app.roles.manage', audit: 'audit:read', configuration: 'app.config.manage', feedback: 'feedback:read' }
+    return !permissions[page] || this.hasPermission(permissions[page])
+  }
+
+  async initialize(options: ManagementApiOptions, onLocaleChange?: (locale: string) => void): Promise<void> {
+    this.onLocaleChange = onLocaleChange
+    this.initializing = true
+    this.error = ''
+    try {
+      const init = await initializeManagementApi({ ...options, onSessionExpired: () => this.expireSession() })
+      if (!init.success) {
+        this.error = init.error.code === HaiApiClientError.CONFIG_ERROR.code ? m.api_not_configured() : m.home_error()
+        return
+      }
+      const info = await managementApi.app.info()
+      if (!info.success) {
+        this.error = info.error.httpStatus === 400 ? info.error.message : m.home_error()
+        return
+      }
+      this.info = info.data
+      const authConfig = await managementApi.iam.auth.publicConfig()
+      if (!authConfig.success) {
+        this.error = authConfig.error.message
+        return
+      }
+      this.authConfig = authConfig.data
+      this.applyLocale(info.data.defaultLocale)
+      // 默认 Cookie 存储通过 api-client 的加密刷新链路恢复会话。
+      const me = await managementApi.iam.auth.currentUser()
+      if (me.success) {
+        this.setUser(me.data)
+        await this.navigate(this.router.path.slice(1))
+      }
+      else if (me.error.httpStatus !== 401) {
+        this.error = me.error.httpStatus === 400 ? me.error.message : m.operation_failed()
+      }
+    }
+    catch {
+      this.error = m.home_error()
+    }
+    finally {
+      this.initializing = false
+    }
+  }
+
+  async close(): Promise<void> {
+    this.requestVersion++
+    this.sessionEpoch++
+    this.loading = false
+    await managementApi.close()
+  }
+
+  async authenticated(): Promise<void> {
+    const me = await this.request(() => managementApi.iam.auth.currentUser())
+    if (!me?.success)
+      return
+    this.setUser(me.data)
+    await this.navigate(this.router.path.slice(1))
+  }
+
+  async logout(): Promise<void> {
+    await this.mutate(async () => {
+      const result = await this.request(() => managementApi.iam.auth.logout({}))
+      if (!result?.success)
+        return
+      await managementApi.auth.clear()
+      this.clearSession()
+    })
+  }
+
+  async navigate(page: ManagementPage): Promise<void> {
+    if (!this.user)
+      return
+    this.requestVersion++
+    this.loading = false
+    this.page = this.canOpenPage(page) ? page : 'settings'
+    if (this.router.path !== `/${this.page}`)
+      this.router.navigate(`/${this.page}`)
+    this.page = this.router.path.slice(1)
+    this.error = ''
+    if (this.page === 'users')
+      await this.loadUsers()
+    else if (this.page === 'roles')
+      await this.loadRoles()
+    else if (this.page === 'audit')
+      await this.loadAudit()
+    else if (this.page === 'configuration')
+      await this.loadConfiguration()
+  }
+
+  async loadConfiguration(): Promise<void> {
+    await this.load(async (version) => {
+      const result = await this.request(() => managementApi.admin.configuration.get(), version)
+      if (result?.success && version === this.requestVersion)
+        this.businessNotice = result.data.notice
+    })
+  }
+
+  async saveConfiguration(): Promise<void> {
+    await this.mutate(async () => {
+      const result = await this.request(() => requestSensitive('business.settings.update', options => managementApi.admin.configuration.update({ notice: this.businessNotice }, options)))
+      if (result?.success && this.info) {
+        this.info = { ...this.info, notice: result.data.notice }
+        toast.add({ 'message': m.saved(), 'variant': 'success', 'data-testid': 'notice' })
+      }
+    })
+  }
+
+  async queryUsers(): Promise<void> {
+    this.appliedUsersQuery = { search: this.usersSearch.trim() || undefined, accountStatus: this.usersStatus === 'all' ? undefined : this.usersStatus }
+    await this.loadUsers()
+  }
+
+  async sortUsers(key: string, direction: 'asc' | 'desc'): Promise<void> {
+    const field = (['username', 'email', 'accountStatus', 'createdAt'] as const).find(field => field === key)
+    if (!field)
+      return
+    this.usersSortBy = field
+    this.usersSortDirection = direction
+    await this.loadUsers()
+  }
+
+  async loadUsers(page = 1): Promise<void> {
+    await this.load(async (version) => {
+      const result = await this.request(() => managementApi.admin.users.list({
+        page,
+        pageSize: this.pageSize,
+        ...this.appliedUsersQuery,
+        sortBy: this.usersSortBy,
+        sortDirection: this.usersSortDirection,
+      }), version)
+      if (result?.success && version === this.requestVersion) {
+        this.users = result.data.items.map(user => ({ ...user, avatarUrl: resolveAvatarUrl(user.avatarUrl) }))
+        this.usersTotal = result.data.total
+        this.usersPage = result.data.page
+      }
+    })
+  }
+
+  async loadRoles(): Promise<void> {
+    await this.load(async (version) => {
+      const result = await this.request(() => managementApi.admin.roles.list(), version)
+      if (result?.success && version === this.requestVersion)
+        this.roles = result.data.items
+      if (this.authConfig?.reauthentication?.enabled)
+        await this.loadPermissionPolicies()
+    })
+  }
+
+  async loadPermissionPolicies(page = 1): Promise<void> {
+    const result = await this.request(() => managementApi.admin.permissions.list({ page, pageSize: this.pageSize }))
+    if (result?.success) {
+      this.permissionPolicies = result.data.items
+      this.permissionPolicyPage = page
+      this.permissionPolicyTotal = result.data.total
+    }
+  }
+
+  async savePermissionPolicy(id: string, operations: string[]): Promise<HaiResult<void>> {
+    if (this.saving)
+      return err(HaiCommonError.CONFLICT, m.operation_failed())
+    this.saving = true
+    this.error = ''
+    try {
+      // 表单持有本次保存失败；根布局只报告列表和配置刷新的独立失败，避免重复通知。
+      const result = await requestSensitive('iam.permissions.sensitiveOperations', options => managementApi.admin.permissions.update({ id, sensitiveOperations: operations }, options))
+      if (!result.success)
+        return result
+      await this.loadPermissionPolicies(this.permissionPolicyPage)
+      const config = await this.request(() => managementApi.iam.auth.publicConfig())
+      if (config?.success)
+        this.authConfig = config.data
+      return ok(undefined)
+    }
+    catch {
+      return err(HaiCommonError.SERVICE_UNAVAILABLE, m.network_error())
+    }
+    finally {
+      this.saving = false
+    }
+  }
+
+  async queryAudit(): Promise<void> {
+    if (this.auditStartDate && this.auditEndDate && this.auditStartDate > this.auditEndDate) {
+      this.error = m.audit_date_invalid()
+      return
+    }
+    this.appliedAuditQuery = {
+      category: this.auditCategory || undefined,
+      outcome: this.auditOutcome || undefined,
+      severity: this.auditSeverity || undefined,
+      action: this.auditAction.trim() || undefined,
+      resource: this.auditResource.trim() || undefined,
+      startDate: this.auditStartDate ? new SvelteDate(`${this.auditStartDate}T00:00:00`).toISOString() : undefined,
+      endDate: this.auditEndDate ? new SvelteDate(`${this.auditEndDate}T23:59:59.999`).toISOString() : undefined,
+    }
+    await this.loadAudit()
+  }
+
+  async sortAudit(key: string, direction: 'asc' | 'desc'): Promise<void> {
+    const field = (['createdAt', 'action', 'resource', 'category', 'outcome', 'severity'] as const).find(field => field === key)
+    if (!field)
+      return
+    this.auditSortBy = field
+    this.auditSortDirection = direction
+    await this.loadAudit()
+  }
+
+  async loadAudit(page = 1): Promise<void> {
+    await this.load(async (version) => {
+      const result = await this.request(() => managementApi.admin.audit.list({
+        ...this.appliedAuditQuery,
+        page,
+        pageSize: this.pageSize,
+        sortBy: this.auditSortBy,
+        sortDirection: this.auditSortDirection,
+      }), version)
+      if (result?.success && version === this.requestVersion) {
+        this.auditStats = result.data.stats
+        this.auditBackupEnabled = result.data.backupEnabled
+        this.audit = result.data.items
+        this.auditTotal = result.data.total
+        this.auditPage = result.data.page
+      }
+    })
+  }
+
+  async backupAudit(): Promise<void> {
+    await this.mutate(async () => {
+      this.auditBackupId ||= crypto.randomUUID()
+      const id = this.auditBackupId
+      const result = await this.request(() => requestSensitive('audit.backup', options => managementApi.admin.audit.backup({ id }, options)))
+      if (!result?.success) {
+        this.error = `${this.error} ${m.audit_backup_retry_hint()}`
+        return
+      }
+      this.auditBackupReceipt = result.data
+      this.auditBackupId = ''
+      toast.add({ 'message': m.audit_backup_private_hint(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+  }
+
+  async saveUser(data: AdminCreateUser | AdminUpdateUser): Promise<boolean> {
+    let saved = false
+    await this.mutate(async () => {
+      const result = 'id' in data
+        ? await this.request(() => requestSensitive('iam.users.update', options => managementApi.admin.users.update(data, options)))
+        : await this.request(() => requestSensitive('iam.users.create', options => managementApi.admin.users.create(data, options)))
+      if (!result?.success)
+        return
+      saved = true
+      await this.loadUsers(this.usersPage)
+      toast.add({ 'message': m.saved(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+    return saved
+  }
+
+  async inviteUser(data: AdminInviteUser): Promise<boolean> {
+    let invited = false
+    await this.mutate(async () => {
+      const result = await this.request(() => requestSensitive('iam.users.invite', options => managementApi.admin.users.invite(data, options)))
+      const failure = this.error
+      await this.loadUsers()
+      if (!result?.success) {
+        this.error = `${failure} ${m.invitation_check_existing()}`
+        return
+      }
+      invited = true
+      toast.add({ 'message': m.saved(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+    return invited
+  }
+
+  async deleteUser(user: AdminUser): Promise<boolean> {
+    let deleted = false
+    await this.mutate(async () => {
+      const result = await this.request(() => requestSensitive('iam.users.delete', options => managementApi.admin.users.delete({ id: user.id }, options)))
+      if (!result?.success)
+        return
+      deleted = true
+      const page = this.users.length === 1 ? Math.max(1, this.usersPage - 1) : this.usersPage
+      await this.loadUsers(page)
+      toast.add({ 'message': m.user_deleted(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+    return deleted
+  }
+
+  async resetUserPassword(user: AdminUser, newPassword: string): Promise<boolean> {
+    let reset = false
+    await this.mutate(async () => {
+      const result = await this.request(() => requestSensitive('iam.users.resetPassword', options => managementApi.admin.users.resetPassword({ id: user.id, newPassword }, options)))
+      if (!result?.success)
+        return
+      reset = true
+      if (user.id === this.user?.id) {
+        await managementApi.auth.clear()
+        this.clearSession()
+      }
+      toast.add({ 'message': m.user_password_reset_done(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+    return reset
+  }
+
+  async saveRole(id: string, description: string): Promise<boolean> {
+    let saved = false
+    await this.mutate(async () => {
+      const result = await this.request(() => requestSensitive('iam.roles.update', options => managementApi.admin.roles.update({ id, description }, options)))
+      if (!result?.success)
+        return
+      saved = true
+      await this.loadRoles()
+      toast.add({ 'message': m.saved(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+    return saved
+  }
+
+  async saveProfile(data: UserProfileSubmitData): Promise<void> {
+    await this.savePreferences({ displayName: data.displayName?.trim() ?? '', email: data.email?.trim() ?? '' })
+  }
+
+  async savePreferences(data: ProfileUpdate): Promise<void> {
+    await this.mutate(async () => {
+      const result = await this.request(() => requestSensitive('iam.profile.update', options => managementApi.profile.update(data, options)))
+      if (!result?.success)
+        return
+      const me = await this.request(() => managementApi.iam.auth.currentUser())
+      if (me?.success)
+        this.setUser(me.data)
+      toast.add({ 'message': m.saved(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+  }
+
+  async changePassword(data: ChangePasswordFormData): Promise<void> {
+    await this.mutate(async () => {
+      if (!data.oldPassword) {
+        this.error = m.password_current_required()
+        return
+      }
+      if (!data.newPassword || data.newPassword !== data.confirmPassword) {
+        this.error = m.password_confirmation_mismatch()
+        return
+      }
+      const oldPassword = data.oldPassword
+      const result = await this.request(() => managementApi.iam.auth.changePassword({ oldPassword, newPassword: data.newPassword }))
+      if (!result?.success) {
+        if (result)
+          this.error = authErrorMessage(result.error)
+        return
+      }
+      await managementApi.auth.clear()
+      this.clearSession()
+      toast.add({ 'message': m.password_changed(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+  }
+
+  async uploadAvatar(file: File, userId?: string): Promise<void> {
+    await this.mutate(async () => {
+      const payload = await this.readAvatar(file)
+      if (!payload)
+        return
+      const result = userId
+        ? await this.request(() => requestSensitive('iam.users.avatar', options => managementApi.admin.users.avatar({ id: userId, ...payload }, options)))
+        : await this.request(() => requestSensitive('iam.profile.avatar', options => managementApi.profile.avatar(payload, options)))
+      if (!result?.success)
+        return
+      if (!userId || userId === this.user?.id) {
+        const me = await this.request(() => managementApi.iam.auth.currentUser())
+        if (me?.success)
+          this.setUser(me.data)
+      }
+      if (userId)
+        await this.loadUsers(this.usersPage)
+      toast.add({ 'message': m.avatar_saved(), 'variant': 'success', 'data-testid': 'notice' })
+    })
+  }
+
+  formatDate(value: string): string {
+    return new Intl.DateTimeFormat(this.locale, { dateStyle: 'medium', timeStyle: 'short' }).format(new SvelteDate(value))
+  }
+
+  private async readAvatar(file: File): Promise<AvatarUpload | undefined> {
+    if (file.size > 512 * 1024 || !['image/png', 'image/jpeg', 'image/webp'].includes(file.type)) {
+      this.error = m.avatar_invalid()
+      return undefined
+    }
+    const bytes = new Uint8Array(await file.arrayBuffer())
+    let binary = ''
+    for (const byte of bytes)
+      binary += String.fromCharCode(byte)
+    return { contentType: file.type as AvatarUpload['contentType'], base64: btoa(binary) }
+  }
+
+  private setUser(user: CurrentUser): void {
+    if (this.user?.id !== user.id)
+      this.sessionEpoch++
+    this.user = { ...user, avatarUrl: resolveAvatarUrl(user.avatarUrl) }
+    if (!this.hasPermission('app.users.manage')) {
+      this.users = []
+      this.usersTotal = 0
+      this.usersPage = 1
+      this.appliedUsersQuery = {}
+    }
+    if (!this.hasPermission('app.roles.manage'))
+      this.roles = []
+    if (!this.hasPermission('audit:read')) {
+      this.audit = []
+      this.auditTotal = 0
+      this.auditPage = 1
+      this.appliedAuditQuery = {}
+      this.auditStats = []
+      this.auditBackupEnabled = false
+    }
+    if (!this.hasPermission('audit:backup')) {
+      this.auditBackupReceipt = null
+      this.auditBackupId = ''
+    }
+    this.applyLocale(typeof user.metadata?.locale === 'string' ? user.metadata.locale : this.info?.defaultLocale ?? getLocale())
+    if (typeof user.metadata?.theme === 'string' && AVAILABLE_THEMES.includes(user.metadata.theme))
+      themeStore.set(user.metadata.theme)
+    else
+      themeStore.set(DEFAULT_THEME)
+  }
+
+  private applyLocale(value: string): void {
+    const locale = locales.find(locale => locale === value)
+    if (!locale)
+      return
+    this.locale = locale
+    setLocale(locale, { reload: false })
+    setGlobalLocale(locale)
+    if (typeof document !== 'undefined')
+      document.documentElement.lang = locale
+    this.onLocaleChange?.(locale)
+  }
+
+  private clearSession(): void {
+    this.requestVersion++
+    this.sessionEpoch++
+    this.loading = false
+    this.user = null
+    this.users = []
+    this.roles = []
+    this.audit = []
+    this.auditStats = []
+    this.auditBackupEnabled = false
+    this.auditBackupReceipt = null
+    this.auditBackupId = ''
+    this.page = 'settings'
+  }
+
+  private expireSession(): void {
+    if (!this.user)
+      return
+    // 原地登录取消时保留页面和输入；显式退出仍由logout清空会话与页面。
+    this.error = m.session_expired()
+  }
+
+  private async request<T>(task: () => Promise<HaiResult<T>>, version?: number): Promise<HaiResult<T> | undefined> {
+    const epoch = this.sessionEpoch
+    const isCurrent = () => epoch === this.sessionEpoch && (version === undefined || version === this.requestVersion)
+    try {
+      const result = await task()
+      if (!isCurrent())
+        return undefined
+      if (!result.success) {
+        if (result.error.code === HaiCommonError.REQUEST_ACCESS_DENIED.code) {
+          this.error = authErrorMessage(result.error)
+        }
+        else if (result.error.httpStatus === 401 && this.user && (typeof result.error.code !== 'string' || !result.error.code.startsWith('hai:iam:') || IamSessionErrorCodeSchema.safeParse(result.error.code).success)) {
+          this.expireSession()
+        }
+        else if (result.error.httpStatus === 403 && this.user) {
+          const current = await managementApi.iam.auth.currentUser()
+          if (!isCurrent())
+            return undefined
+          if (current.success) {
+            this.setUser(current.data)
+            if (!this.canOpenPage(this.page)) {
+              this.requestVersion++
+              this.loading = false
+              this.page = 'settings'
+            }
+          }
+          this.error = m.forbidden()
+        }
+        else {
+          this.error = result.error.httpStatus === 403 ? m.forbidden() : result.error.httpStatus === 409 ? m.conflict() : result.error.httpStatus === 400 || result.error.httpStatus === 422 ? result.error.message || m.validation_failed() : m.operation_failed()
+        }
+        this.error = core.error.formatMessage({ message: this.error, traceId: result.error.traceId })
+      }
+      return result
+    }
+    catch {
+      if (isCurrent())
+        this.error = m.network_error()
+      return undefined
+    }
+  }
+
+  private async load(task: (version: number) => Promise<void>): Promise<void> {
+    const version = ++this.requestVersion
+    this.loading = true
+    this.error = ''
+    await task(version)
+    if (version === this.requestVersion)
+      this.loading = false
+  }
+
+  private async mutate(task: () => Promise<void>): Promise<void> {
+    if (this.saving)
+      return
+    this.saving = true
+    this.error = ''
+    try {
+      await task()
+    }
+    catch {
+      this.error = m.network_error()
+    }
+    finally {
+      this.saving = false
+    }
+  }
+}

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/stores/theme-store.svelte.ts.hbs

@@ -0,0 +1,23 @@
+import { applyTheme, getSavedTheme } from '@h-ai/ui/theme'
+
+export const DEFAULT_THEME = '{{fullstack.theme.defaultTheme}}'
+export const AVAILABLE_THEMES: readonly string[] = [{{#each fullstack.theme.themes}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}]
+
+/** 只维护响应式状态和已编译主题白名单，DOM 与安全持久化复用 UI 公共工具。 */
+class ThemeState {
+  current = $state<string>(DEFAULT_THEME)
+
+  constructor() {
+    const saved = getSavedTheme(DEFAULT_THEME)
+    this.set(AVAILABLE_THEMES.includes(saved) ? saved : DEFAULT_THEME)
+  }
+
+  set(value: string): void {
+    if (!AVAILABLE_THEMES.includes(value))
+      return
+    this.current = value
+    applyTheme(value)
+  }
+}
+
+export const themeStore = new ThemeState()

package/templates/apps/fullstack/packages/{{projectName}}-shared/svelte.config.js.hbs

@@ -0,0 +1 @@
+export default {}