Tauri v2 + SvelteKit

Tauri is a framework for building tiny, fast desktop and mobile apps. It combines a Rust backend (Core Process) with a frontend rendered in the OS's native webview — no bundled browser engine. Apps start under 600KB. We always use SvelteKit with adapter-static (SPA mode, ssr = false).

Architecture Overview

SvelteKit Frontend (WebView)
      │  invoke() / events / channels
      ▼
┌─────────────────────────┐
│  Tauri Core Process     │  Rust — owns OS access, state, IPC routing
│  (tauri::Builder)       │
└─────────────────────────┘
      │
      ├── WRY: cross-platform webview rendering
      └── TAO: window creation & management

Core Process (Rust): entry point, OS access, state, IPC hub, security enforcement
WebView Process: renders SvelteKit app using system webview (WKWebView/Edge WebView2/webkitgtk)
IPC: message-passing via commands (invoke) and events — all routed through Core

Project Structure

├── package.json
├── svelte.config.js          # adapter-static, fallback: 'index.html'
├── src/
│   ├── routes/
│   │   └── +layout.ts        # export const ssr = false
│   └── ...
└── src-tauri/
    ├── Cargo.toml
    ├── tauri.conf.json        # devUrl, frontendDist, app config
    ├── build.rs               # must call tauri_build::build()
    ├── src/
    │   ├── lib.rs             # Builder, commands, state
    │   └── main.rs            # desktop entry point
    ├── capabilities/
    │   └── default.json       # permission bindings per window
    ├── permissions/            # custom TOML permission definitions
    └── icons/

Quick Command Reference

Rust API	Purpose
`#[tauri::command]`	Define a command callable from frontend
`tauri::generate_handler![cmd1, cmd2]`	Register commands with Builder
`tauri::Builder::default().manage(state)`	Register managed state
`State<'_, T>`	Access managed state in commands
`AppHandle`	Access app handle in commands
`WebviewWindow`	Access calling window in commands
`tauri::ipc::Channel<T>`	Stream data to frontend
`tauri::ipc::Response`	Return raw bytes efficiently
`app.emit("event", payload)`	Emit global event to frontend
`app.emit_to("label", "event", payload)`	Emit to specific window

JS/TS API (`@tauri-apps/api`)	Purpose
`invoke('cmd', { args })`	Call a Rust command
`listen('event', handler)`	Listen for backend events
`emit('event', payload)`	Emit event to backend
`Channel<T>`	Receive streamed data from Rust

SvelteKit Setup Essentials

// svelte.config.js
import adapter from '@sveltejs/adapter-static';
export default { kit: { adapter: adapter({ fallback: 'index.html' }) } };

// src/routes/+layout.ts
export const ssr = false;

// tauri.conf.json
{
  "build": {
    "beforeDevCommand": "npm run dev",
    "beforeBuildCommand": "npm run build",
    "devUrl": "http://localhost:5173",
    "frontendDist": "../build"
  }
}

Security Model (Capability-Based)

Permissions (TOML) → Capabilities (JSON/TOML) → Runtime Authority
     what ops            bind to windows         enforce at runtime

Frontend is untrusted by default — all backend access requires explicit capability grants
Commands must be listed in capability files to be callable from JS
Scopes (allow/deny) provide fine-grained resource boundaries
Isolation pattern adds AES-GCM encrypted IPC for high-security apps

Release Build Optimization

# src-tauri/Cargo.toml
[profile.release]
codegen-units = 1
lto = true
opt-level = "s"
panic = "abort"
strip = true

References

Getting Started & SvelteKit — project creation, SvelteKit adapter-static setup, project structure
Architecture & Process Model — multi-process design, WRY/TAO, crate ecosystem, size optimization
Inter-Process Communication — commands, events, channels, brownfield vs isolation patterns
Security & Permissions — capabilities, permissions, scopes, CSP, security lifecycle
Commands & Events — calling Rust from frontend, calling frontend from Rust, streaming
Development & Configuration — config files, resources, state management, icons, dev workflow
Testing — IPC mocking, event mocking, window mocking, WebDriver, tauri-driver