@h-ai/cli 1.0.0-beta.2 → 1.0.0-beta.21

package/templates/apps/fullstack/packages/{{projectName}}-shared/vitest.config.ts.hbs

@@ -2,6 +2,11 @@ import { svelte } from '@sveltejs/vite-plugin-svelte'
 import { defineConfig } from 'vitest/config'
 
 export default defineConfig({
-  plugins: [svelte()],
-  test: { environment: 'node', include: ['tests/**/*.test.ts'] },
+  plugins: [
+    svelte(),
+  ],
+  test: {
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+  },
 })

package/templates/apps/fullstack/playwright.config.ts.hbs

@@ -2,6 +2,9 @@ import process from 'node:process'
 import { defineConfig } from '@playwright/test'
 import { createE2eNotificationEnv, createE2eServerEnv, createE2eTransportRing } from './scripts/e2e-env.js'
 
+{{#if fullstack.e2eFrontend}}
+const sessionClose = process.env.HAI_E2E_GROUP === 'session-close'
+{{/if}}
 const defaultBaseURL = '{{#if fullstack.e2eFrontend}}http://127.0.0.1:{{fullstack.e2eFrontend.port}}{{else}}http://127.0.0.1:3000{{/if}}'
 const defaultServiceBaseURL = 'http://127.0.0.1:3000'
 const baseURL = process.env.BASE_URL || defaultBaseURL
@@ -41,7 +44,9 @@ function resolvePortFromBaseUrl(urlString: string, fallbackPort: string): string
       return url.port
     }
 
-    return url.protocol === 'https:' ? '443' : '80'
+    return url.protocol === 'https:'
+      ? '443'
+      : '80'
   }
   catch {
     return fallbackPort
@@ -50,7 +55,11 @@ function resolvePortFromBaseUrl(urlString: string, fallbackPort: string): string
 
 export default defineConfig({
   testDir: './e2e',
-  testIgnore: '**/session-close.spec.ts',
+{{#if fullstack.e2eFrontend}}
+  ...(sessionClose
+    ? { testMatch: '**/session-close.spec.ts' }
+    : { testIgnore: '**/session-close.spec.ts' }),
+{{/if}}
   // 多个界面验收共用管理员资料与引导状态，保留串行以免互相覆盖。
   fullyParallel: false,
   forbidOnly: !!process.env.CI,
@@ -87,6 +96,17 @@ export default defineConfig({
         HAI_IAM_CAPTCHA_COST: '100',
         HAI_IAM_CAPTCHA_MAXCOUNTER: '2',
         HAI_IAM_INITIALCREDENTIALS_ENABLED: 'true',
+{{#if fullstack.e2eFrontend}}
+        // 会话回归单独启动服务，短超时和首次改密仅应用于这一轮。
+        ...(sessionClose
+          ? {
+              HAI_IAM_SESSION_ENDONPAGEHIDE: 'true',
+              HAI_IAM_SESSION_IDLETIMEOUT: '5',
+              HAI_IAM_SESSION_ABSOLUTETIMEOUT: '60',
+              HAI_IAM_PASSWORD_REQUIREINITIALCHANGE: 'true',
+            }
+          : {}),
+{{/if}}
         HAI_IAM_REAUTHENTICATION_ENABLED: 'true',
         HAI_IAM_REAUTHENTICATION_OPERATIONS: JSON.stringify(['iam.users.invite', 'audit.backup']),
         HAI_AUDIT_BACKUP_ENABLED: 'true',
@@ -100,7 +120,9 @@ export default defineConfig({
       timeout: 120_000,
     },
     ...frontends.map((frontend) => {
-      const url = frontend.target === primaryFrontend ? baseURL : frontend.url
+      const url = frontend.target === primaryFrontend
+        ? baseURL
+        : frontend.url
       return {
         name: frontend.name,
         command: `pnpm --filter ${frontend.name} exec vite preview --host ${resolveHostFromBaseUrl(url, '127.0.0.1')} --port ${resolvePortFromBaseUrl(url, '3000')} --strictPort`,

package/templates/apps/fullstack/pnpm-workspace.yaml.hbs

@@ -1,5 +1,5 @@
 {{! @skipIfEmpty }}
-shellEmulator: true
+minimumReleaseAgeExcludePrune: true
 
 trustPolicy: no-downgrade
 # 上游构建工具仍要求 4.x；4.0.3 tarball 已核对原 lockfile 的 SHA-512。
@@ -8,31 +8,47 @@ trustPolicyExclude:
 
 # pnpm 12 配置；原生依赖仅运行明确列出的安装脚本。
 nodeLinker: hoisted
-allowBuilds:
-  protobufjs: true
-  vue-demi: true
-  better-sqlite3: true
-  esbuild: true
-  core-js: false
+shellEmulator: true
+
+packages:
+  - packages/*
+  - apps/*
 
+# 构建与浏览器依赖的安全修复；版本与框架工作区同步维护。
 overrides:
-  "@ai-sdk/provider-utils@>=4.0.0 <4.0.33": 4.0.57
+  '@ai-sdk/provider-utils@>=4.0.0 <4.0.33': 4.0.57
+  '@types/node': {{versions.nodeTypes}}
+  body-parser@>=2 <2.4.0: 2.4.0
   cookie@<0.7.0: 0.7.2
+  dompurify@>=3 <3.4.17: 3.4.17
   esbuild@<0.28.1: 0.28.2
+  fast-uri@>=3 <3.1.9: 3.1.9
+  follow-redirects@>=1.16.0 <1.16.2: 1.16.2
+  glob@>=9 <=14.0.1: 14.0.4
+  ip-address@<=10.7.3: 10.7.6
   katex@<0.18.2: 0.18.10
+  minimatch@>=7 <11.0.1: 11.0.5
+  parse5@>=8 <8.1.0: 8.1.0
+  qs@>=6.7 <6.16.1: 6.17.1
+  runed@<0.38.0: 0.38.0
   sharp@<0.35.5: 0.35.5
   tinypool@<2.1.2: 2.2.0
-  '@qdrant/js-client-rest>undici': 7.30.0
   xcode>uuid: 11.1.1
-  "@types/node": "{{versions.nodeTypes}}"
 
-packages:
-  - packages/*
-  - apps/*
+patchedDependencies:
+  daisyui@5.7.50: patches/daisyui-5.7.50.patch
+  deepmerge@4.3.1: patches/deepmerge-4.3.1.patch
+
+allowBuilds:
+  core-js: false
+  esbuild: true
+  onnxruntime-node: true
+  protobufjs: true
+  vue-demi: true
 
 {{#if useCatalogProtocol}}
 catalog:
 {{#each haiCatalogPackages}}
-  '{{@key}}': {{this}}
+  {{{yaml @key this}}}
 {{/each}}
 {{/if}}

package/templates/apps/h5/src/routes/+layout.svelte.hbs

@@ -5,20 +5,10 @@
    */
   import type { BottomNavItem } from '@h-ai/ui'
   import type { Snippet } from 'svelte'
-{{#if hasI18n}}
-  import { browser } from '$app/environment'
-{{else}}
-{{#if features.crypto}}
-  import { browser } from '$app/environment'
-{{/if}}
-{{/if}}
+  import { browser } from '$app/env'
   import { goto } from '$app/navigation'
-  import { base, resolve } from '$app/paths'
+  import { resolve } from '$app/paths'
   import { page } from '$app/state'
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-  import { getLocale, setLocale } from '$lib/paraglide/runtime.js'
-{{/if}}
 {{#if features.crypto}}
   import { crypto } from '@h-ai/crypto'
   import { kit } from '@h-ai/kit'
@@ -28,12 +18,17 @@
 {{/if}}
 {{/if}}
 {{#if hasI18n}}
-  import { AppBar, BottomNav, LanguageSwitch, setGlobalLocale } from '@h-ai/ui'
+  import { AppBar, BottomNav, LanguageSwitch, setGlobalLocale, ThemeSelector } from '@h-ai/ui'
 {{else}}
-  import { AppBar, BottomNav } from '@h-ai/ui'
+  import { AppBar, BottomNav, ThemeSelector } from '@h-ai/ui'
 {{/if}}
+  import { applyTheme, getSavedTheme } from '@h-ai/ui/theme'
 {{#if features.crypto}}
   import { untrack } from 'svelte'
+{{/if}}
+{{#if hasI18n}}
+  import * as m from '#lib/paraglide/messages.js'
+  import { getLocale, setLocale } from '#lib/paraglide/runtime.js'
 {{/if}}
   import '../app.css'
 
@@ -42,36 +37,82 @@
   }
 
   const { children }: Props = $props()
-{{#if features.crypto}}
+  const initialTheme = browser
+    ? getSavedTheme()
+    : 'light'
+  let currentTheme = $state(initialTheme)
   if (browser)
-    kit.client.installBrowserTransport(untrack(() => page.data.kitConfig), { crypto, basePath: base })
+    applyTheme(initialTheme, false)
+
+  function handleThemeChange(theme: string) {
+    currentTheme = theme
+    applyTheme(theme)
+  }
+{{#if features.crypto}}
+  if (browser) {
+    kit.client.installBrowserTransport(untrack(() => page.data.kitConfig), {
+      crypto,
+      basePath: resolve('/').replace(/\/$/, ''),
+    })
+  }
 {{/if}}
 {{#if features.iam}}
-  const authActions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+  const authActions = kit.client.createAuthActions({ basePath: `${resolve('/').replace(/\/$/, '')}/api/auth` })
   $effect(() => authActions.bindPageExit({ enabled: page.data.iamPublicConfig?.session.endOnPageHide }))
 {{/if}}
 
-  const navItems: (BottomNavItem & { path: '/' | '/discover' | '/profile' })[] = [
+  const navItems: (BottomNavItem & { path: ReturnType<typeof resolve> })[] = [
 {{#if hasI18n}}
-    { id: 'home', path: '/', label: m.nav_home(), iconClass: 'icon-[tabler--home]' },
-    { id: 'discover', path: '/discover', label: m.nav_discover(), iconClass: 'icon-[tabler--compass]' },
-    { id: 'profile', path: '/profile', label: m.nav_profile(), iconClass: 'icon-[tabler--user]' },
+    {
+      id: 'home',
+      path: resolve('/'),
+      label: m.nav_home(),
+      iconClass: 'icon-[tabler--home]',
+    },
+    {
+      id: 'discover',
+      path: resolve('discover'),
+      label: m.nav_discover(),
+      iconClass: 'icon-[tabler--compass]',
+    },
+    {
+      id: 'profile',
+      path: resolve('profile'),
+      label: m.nav_profile(),
+      iconClass: 'icon-[tabler--user]',
+    },
 {{else}}
-    { id: 'home', path: '/', label: '首页', iconClass: 'icon-[tabler--home]' },
-    { id: 'discover', path: '/discover', label: '发现', iconClass: 'icon-[tabler--compass]' },
-    { id: 'profile', path: '/profile', label: '我的', iconClass: 'icon-[tabler--user]' },
+    {
+      id: 'home',
+      path: resolve('/'),
+      label: '首页',
+      iconClass: 'icon-[tabler--home]',
+    },
+    {
+      id: 'discover',
+      path: resolve('discover'),
+      label: '发现',
+      iconClass: 'icon-[tabler--compass]',
+    },
+    {
+      id: 'profile',
+      path: resolve('profile'),
+      label: '我的',
+      iconClass: 'icon-[tabler--user]',
+    },
 {{/if}}
   ]
 
-  const localPath = $derived(page.url.pathname.slice(base.length) || '/')
-  const activeNav = $derived(navItems.find(item => item.path === localPath)?.id)
+  const localPath = $derived(page.url.pathname.slice(resolve('/').replace(/\/$/, '').length) || '/')
+  const activeNav = $derived(navItems.find(item => item.path === page.url.pathname)?.id)
   // 所有页面共用页头页脚；仅业务页面显示底部导航。
   const isAuthPage = $derived(localPath.startsWith('/auth'))
 
   function handleNavigation(id: string) {
     const item = navItems.find(item => item.id === id)
     if (item)
-      void goto(resolve(item.path, {}))
+      // eslint-disable-next-line svelte/no-navigation-without-resolve -- path 仅来自上方 resolve 构造的导航表，不能二次添加挂载前缀。
+      void goto(item.path)
   }
 {{#if hasI18n}}
 
@@ -94,11 +135,14 @@
 <div class='hai-mobile-viewport'>
   <div class='hai-mobile-shell min-w-0'>
     <AppBar title={page.data.appConfig.name} safeArea fixed={false}>
-{{#if hasI18n}}
       {#snippet trailing()}
-        <LanguageSwitch currentLanguage={getLocale()} onchange={handleLanguageChange} compact />
-      {/snippet}
+        <div class='flex items-center gap-1'>
+{{#if hasI18n}}
+          <LanguageSwitch currentLanguage={getLocale()} onchange={handleLanguageChange} compact />
 {{/if}}
+          <ThemeSelector {currentTheme} onchange={handleThemeChange} compact grouped={false} />
+        </div>
+      {/snippet}
     </AppBar>
     <main class='hai-mobile-main'>{@render children()}</main>
     <footer class='border-t border-base-300 bg-base-100 p-2 text-center text-xs text-base-content/60'>

package/templates/apps/h5/src/routes/+page.svelte.hbs

@@ -4,10 +4,10 @@
   /**
    * H5 首页
    */
+  import { Card } from '@h-ai/ui'
 {{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
+  import * as m from '#lib/paraglide/messages.js'
 {{/if}}
-  import { Card } from '@h-ai/ui'
 </script>
 
 <svelte:head>

package/templates/apps/h5/src/routes/discover/+page.svelte.hbs

@@ -3,10 +3,10 @@
   /**
    * 发现页面
    */
+  import { Card } from '@h-ai/ui'
 {{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
+  import * as m from '#lib/paraglide/messages.js'
 {{/if}}
-  import { Card } from '@h-ai/ui'
 </script>
 
 <svelte:head>

package/templates/apps/h5/src/routes/profile/+page.svelte.hbs

@@ -3,10 +3,10 @@
   /**
    * 个人中心页面
    */
+  import { Card } from '@h-ai/ui'
 {{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
+  import * as m from '#lib/paraglide/messages.js'
 {{/if}}
-  import { Card } from '@h-ai/ui'
 </script>
 
 <svelte:head>

package/templates/apps/mobile-app/capacitor.config.ts.hbs

@@ -1,12 +1,15 @@
 import type { CapacitorConfig } from '@capacitor/cli'
+import { resolve } from 'node:path'
+import process from 'node:process'
+import { resolveNativeName } from './scripts/native-name.mjs'
 
 const config: CapacitorConfig = {
   appId: 'com.hai.{{projectName}}',
-  appName: '{{projectName}}',
+  appName: resolveNativeName(process.cwd(), resolve('config/_core.yml')),
   webDir: 'dist',
   server: {
     androidScheme: 'https',
   },
 }
 
-export default config
+export default config

package/templates/apps/mobile-app/messages/en-US.json

@@ -24,13 +24,13 @@
   "status_runtime_web": "Browser preview",
   "status_token_label": "Token storage",
   "status_token_native": "Secure storage",
-  "status_token_memory": "Memory storage",
+  "status_token_memory": "Memory access token + httpOnly cookie",
   "tasks_title": "Today's tasks",
   "tasks_sync": "Wire backend APIs",
   "tasks_polish": "Polish mobile UX",
   "tasks_release": "Prepare native packaging",
   "profile_title": "App settings",
   "profile_language": "Locale follows Paraglide",
-  "profile_theme": "Theme follows @h-ai/ui",
+  "profile_theme": "Theme",
   "profile_secure": "Sensitive tokens avoid localStorage"
 }

package/templates/apps/mobile-app/messages/ja-JP.json

@@ -24,13 +24,13 @@
   "status_runtime_web": "ブラウザープレビュー",
   "status_token_label": "トークン保存",
   "status_token_native": "安全なストレージ",
-  "status_token_memory": "メモリー内保存",
+  "status_token_memory": "メモリー内access token + httpOnly Cookie",
   "tasks_title": "本日のタスク",
   "tasks_sync": "バックエンドAPIを接続",
   "tasks_polish": "モバイルUXを改善",
   "tasks_release": "ネイティブのパッケージ化を準備",
   "profile_title": "アプリ設定",
   "profile_language": "言語はParaglideに従います",
-  "profile_theme": "テーマは@h-ai/uiに従います",
+  "profile_theme": "テーマ",
   "profile_secure": "機密トークンはlocalStorageに保存しません"
 }

package/templates/apps/mobile-app/messages/zh-CN.json

@@ -24,13 +24,13 @@
   "status_runtime_web": "浏览器预览",
   "status_token_label": "Token 存储",
   "status_token_native": "安全存储",
-  "status_token_memory": "内存存储",
+  "status_token_memory": "内存 access token + httpOnly Cookie",
   "tasks_title": "今日任务",
   "tasks_sync": "同步后端接口",
   "tasks_polish": "打磨移动端体验",
   "tasks_release": "准备原生打包",
   "profile_title": "应用设置",
   "profile_language": "语言跟随 Paraglide",
-  "profile_theme": "主题跟随 @h-ai/ui",
+  "profile_theme": "主题",
   "profile_secure": "敏感 Token 不落 localStorage"
 }

package/templates/apps/mobile-app/src/App.svelte.hbs

@@ -48,9 +48,21 @@
   let nativeTokenStorage = $state(false)
 
   const navItems = $derived([
-    { id: 'home', label: m.nav_home(), iconClass: 'icon-[tabler--layout-dashboard]' },
-    { id: 'tasks', label: m.nav_tasks(), iconClass: 'icon-[tabler--checkbox]' },
-    { id: 'profile', label: m.nav_profile(), iconClass: 'icon-[tabler--user-circle]' },
+    {
+      id: 'home',
+      label: m.nav_home(),
+      iconClass: 'icon-[tabler--layout-dashboard]',
+    },
+    {
+      id: 'tasks',
+      label: m.nav_tasks(),
+      iconClass: 'icon-[tabler--checkbox]',
+    },
+    {
+      id: 'profile',
+      label: m.nav_profile(),
+      iconClass: 'icon-[tabler--user-circle]',
+    },
   ])
 
   async function bootstrap(): Promise<void> {
@@ -143,10 +155,10 @@
     </footer>
 {{#if features.iam}}
     {#if authenticated && !booting && !bootError}
-{{/if}}
       <BottomNav items={navItems} active={router.path.slice(1)} onchange={handleTabChange} safeArea centered maxWidth='none' />
-{{#if features.iam}}
     {/if}
+{{else}}
+    <BottomNav items={navItems} active={router.path.slice(1)} onchange={handleTabChange} safeArea centered maxWidth='none' />
 {{/if}}
   </div>
 </div>

package/templates/apps/mobile-app/src/lib/api.ts.hbs

@@ -1,6 +1,6 @@
 /**
  * {{projectName}} — API 客户端初始化。
- * Web 预览仅使用内存 TokenStore；原生端使用 Capacitor 安全存储。
+ * Web 预览使用内存 access token + httpOnly refresh Cookie；原生端使用 Capacitor 安全存储。
  * 原生存储失败会拒绝 Promise；登录/退出调用方须处理 auth.setTokens/clear 失败并释放界面 loading。
  */
 import { apiClient } from '@h-ai/api-client'
@@ -56,7 +56,7 @@ export function resolveApiBase(): string {
 }
 
 /**
- * 查询实际 Capacitor 平台，决定安全原生存储或 Web 内存存储。
+ * 查询实际 Capacitor 平台，决定安全原生存储或 Web Cookie 刷新通道。
  * @returns 是否处于 Capacitor 原生平台；浏览器预览返回 false。
  * @throws Error - 平台模块加载或检测失败时拒绝 Promise，不伪装为 Web 模式。
  * @example 模块内部上下文
@@ -74,7 +74,7 @@ export async function usesNativeTokenStorage(): Promise<boolean> {
 
 /**
  * 按真实平台创建 TokenStorage；绑定 client 后通过 client.auth 变更身份。
- * @returns 原生安全存储或 Web 内存存储；其方法的读写故障继续拒绝 Promise。
+ * @returns 原生安全存储或内存 access token + httpOnly refresh Cookie；其方法的读写故障继续拒绝 Promise。
  * @throws Error - 平台检测或存储工厂失败时拒绝，不改用较弱的持久化方式。
  * @example 模块内部上下文
  * ```ts
@@ -86,7 +86,7 @@ async function createTokenStorage() {
   if (await usesNativeTokenStorage())
     return createCapacitorTokenStorage()
 
-  return apiClient.tokenStorage.memory()
+  return apiClient.tokenStorage.httpOnlyCookie()
 }
 
 /**
@@ -137,6 +137,7 @@ export async function initApi(): Promise<void> {
  * ```
  */
 async function initialize(): Promise<void> {
+  const native = await usesNativeTokenStorage()
   const storage = await createTokenStorage()
 {{#if features.crypto}}
   const transport = resolveTransport()
@@ -149,8 +150,14 @@ async function initialize(): Promise<void> {
     }
     const result = await apiClient.init({
       baseUrl: resolveApiBase(),
+      clientName: 'hai-mobile-app',
+      headers: native
+        ? { 'x-hai-token-transport': 'body' }
+        : {},
       auth: { storage },
-      ...(transport ? { transport } : {}),
+      ...(transport
+        ? { transport }
+        : {}),
     })
     if (!result.success)
       throw new Error(result.error.message)
@@ -169,7 +176,14 @@ async function initialize(): Promise<void> {
     throw error
   }
 {{else}}
-  const result = await apiClient.init({ baseUrl: resolveApiBase(), auth: { storage } })
+  const result = await apiClient.init({
+    baseUrl: resolveApiBase(),
+    clientName: 'hai-mobile-app',
+    headers: native
+      ? { 'x-hai-token-transport': 'body' }
+      : {},
+    auth: { storage },
+  })
   if (!result.success)
     throw new Error(result.error.message)
   initialized = true

package/templates/apps/mobile-app/src/lib/app-config.ts.hbs

@@ -7,7 +7,14 @@ declare const __APP_CORE_CONFIG__: Pick<CoreConfig, 'name' | 'version' | 'env' |
 
 /** 构建包含公开默认值；预览或容器启动时的公开配置覆盖默认值，不重建静态资源。 */
 const runtime = (globalThis as typeof globalThis & { __HAI_PUBLIC_CONFIG__?: { core?: Partial<typeof __APP_CORE_CONFIG__> } }).__HAI_PUBLIC_CONFIG__?.core
-export const appConfig = { ...__APP_CORE_CONFIG__, ...runtime, logging: { ...__APP_CORE_CONFIG__.logging, ...runtime?.logging } }
+export const appConfig = {
+  ...__APP_CORE_CONFIG__,
+  ...runtime,
+  logging: {
+    ...__APP_CORE_CONFIG__.logging,
+    ...runtime?.logging,
+  },
+}
 
 export function initClientCore(): void {
   core.init({ logging: appConfig.logging })

package/templates/apps/mobile-app/src/lib/pages/home.svelte.hbs

@@ -46,12 +46,16 @@
       <div>
         <p class='text-base-content/50'>{m.status_runtime_label()}</p>
         <Badge variant={nativeRuntime ? 'success' : 'warning'} size='sm'>
-          {nativeRuntime ? m.status_runtime_native() : m.status_runtime_web()}
+          {nativeRuntime
+            ? m.status_runtime_native()
+            : m.status_runtime_web()}
         </Badge>
       </div>
       <div class='col-span-2'>
         <p class='text-base-content/50'>{m.status_token_label()}</p>
-        <p class='font-medium'>{nativeTokenStorage ? m.status_token_native() : m.status_token_memory()}</p>
+        <p class='font-medium'>{nativeTokenStorage
+          ? m.status_token_native()
+          : m.status_token_memory()}</p>
       </div>
     </div>
   </Card>

package/templates/apps/mobile-app/src/lib/pages/profile.svelte.hbs

@@ -1,12 +1,24 @@
 <script lang='ts'>
+  import { ThemeSelector } from '@h-ai/ui'
+  import { applyTheme, getSavedTheme } from '@h-ai/ui/theme'
   import * as m from '../paraglide/messages.js'
+
+  let currentTheme = $state(getSavedTheme())
+
+  function handleThemeChange(theme: string) {
+    currentTheme = theme
+    applyTheme(theme)
+  }
 </script>
 
 <section class='space-y-4 p-4 pb-6'>
   <Card title={m.profile_title()} shadow='sm'>
     <div class='space-y-3 text-sm'>
       <div class='bg-base-200 rounded-xl p-3'>{m.profile_language()}</div>
-      <div class='bg-base-200 rounded-xl p-3'>{m.profile_theme()}</div>
+      <div class='flex flex-wrap items-center justify-between gap-3 bg-base-200 rounded-xl p-3' data-testid='profile-theme'>
+        <span>{m.profile_theme()}</span>
+        <ThemeSelector {currentTheme} onchange={handleThemeChange} compact grouped={false} />
+      </div>
       <div class='bg-base-200 rounded-xl p-3'>{m.profile_secure()}</div>
     </div>
   </Card>

package/templates/apps/mobile-app/src/lib/pages/tasks.svelte.hbs

@@ -5,7 +5,11 @@
 <section class='space-y-4 p-4 pb-6'>
   <Card title={m.tasks_title()} shadow='sm'>
     <div class='space-y-3'>
-      {#each [m.tasks_sync(), m.tasks_polish(), m.tasks_release()] as task (task)}
+      {#each [
+        m.tasks_sync(),
+        m.tasks_polish(),
+        m.tasks_release(),
+      ] as task (task)}
         <div class='bg-base-200 rounded-xl flex items-center gap-3 p-3'>
           <span class='icon-[tabler--circle-check] text-success text-xl'></span>
           <span class='text-sm font-medium'>{task}</span>

package/templates/apps/website/scripts/static-website.mjs.hbs

@@ -9,28 +9,41 @@ const message = core.i18n.createMessageGetter({
   'zh-CN': {
     flag: 'HAI_BUILD_STATIC仅支持0或1；省略或0保持SSR，1启用website静态构建。',
     base: 'PUBLIC_BASE_PATH须为空或以/开头的站内目录；不允许外部地址、末尾/、查询、片段或路径逃逸。',
-    modules: '静态website不能启用服务端业务模块。请使用--features none创建纯展示站点，或继续使用默认SSR。',
+    modules: '静态website不能启用服务端业务模块。请移除服务端模块及其初始化后再构建，或继续使用默认SSR。',
     routes: '静态website不能包含自定义API、表单actions或未预渲染页面；请移除动态入口或使用SSR。',
     assets: 'static是公开资产目录，不能放入.env私有环境文件或符号链接；请移动私有内容后重新构建。',
   },
   'en-US': {
     flag: 'HAI_BUILD_STATIC accepts only 0 or 1: omitted/0 keeps SSR, and 1 enables a static website build.',
     base: 'PUBLIC_BASE_PATH must be empty or a site-local directory beginning with /. External URLs, trailing /, queries, fragments and path traversal are not allowed.',
-    modules: 'A static website cannot enable server-side business modules. Create a presentation site with --features none, or keep the default SSR mode.',
+    modules: 'A static website cannot enable server-side business modules. Remove server modules and their initialization before building, or keep the default SSR mode.',
     routes: 'A static website cannot contain custom APIs, form actions or pages that were not prerendered. Remove dynamic routes or use SSR.',
     assets: 'static is a public asset directory and cannot contain private .env files or symbolic links. Move private content before building.',
   },
   'ja-JP': {
     flag: 'HAI_BUILD_STATICは0または1です。省略/0はSSR、1はwebsiteの静的構築を有効にします。',
     base: 'PUBLIC_BASE_PATHは空、または/で始まるサイト内ディレクトリーです。外部URL、末尾の/、クエリー、フラグメント、パス逸脱は使えません。',
-    modules: '静的websiteではサーバー業務モジュールを有効にできません。--features noneで表示専用サイトを作成するか、既定のSSRを使用してください。',
+    modules: '静的websiteではサーバー業務モジュールを有効にできません。サーバーモジュールと初期化処理を除去するか、既定のSSRを使用してください。',
     routes: '静的websiteに独自API、form actions、事前描画されないページを含められません。動的ルートを削除するかSSRを使用してください。',
     assets: 'staticは公開資産ディレクトリーです。非公開.envファイルやシンボリックリンクを置かず、非公開内容を移動してから構築してください。',
   },
 })
-const serverFeatures = [{{#each websiteServerFeatures}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}]
-const requestedLocale = [process.env.HAI_CORE_DEFAULTLOCALE, process.env.LC_ALL, process.env.LC_MESSAGES, process.env.LANG].find(value => value?.trim())?.split(/[_.-]/)[0]?.toLowerCase()
-const locale = requestedLocale === 'en' || requestedLocale === 'c' || requestedLocale === 'posix' ? 'en-US' : requestedLocale === 'ja' ? 'ja-JP' : 'zh-CN'
+const serverFeatures = [
+{{#each websiteServerFeatures}}
+  '{{this}}',
+{{/each}}
+]
+const requestedLocale = [
+  process.env.HAI_CORE_DEFAULTLOCALE,
+  process.env.LC_ALL,
+  process.env.LC_MESSAGES,
+  process.env.LANG,
+].find(value => value?.trim())?.split(/[_.-]/)[0]?.toLowerCase()
+const locale = requestedLocale === 'en' || requestedLocale === 'c' || requestedLocale === 'posix'
+  ? 'en-US'
+  : requestedLocale === 'ja'
+    ? 'ja-JP'
+    : 'zh-CN'
 
 /** 只读取显式构建值，不加载dotenv和服务端秘密。 */
 export function resolveStaticWebsite() {