@korajs/cli 0.0.0-canary-20261008174129

package/templates/svelte-tailwind-sync/AGENTS.md

@@ -0,0 +1,76 @@
+# AGENTS.md
+
+Guidance for AI coding agents working in this project. Humans: this is useful for you too.
+
+## What this project is
+
+This is a **Kora.js** application: an offline-first app where all data lives in a local SQLite database (WASM + OPFS in the browser) and optionally syncs across devices through a Kora sync server. Offline is the normal state, not an error state. Full docs: https://korajs.dev and machine-readable index at https://korajs.dev/llms.txt (complete docs in one file: https://korajs.dev/llms-full.txt).
+
+## Golden rules
+
+1. **The schema is the source of truth.** All collections are defined in `src/schema.ts` with `defineSchema` and the `t.*` field builders. To add or change data shapes, edit the schema first; types flow from it automatically. Never hand-write types for records.
+2. **Never fetch application data over HTTP.** Do not add REST or GraphQL calls for app data, and do not talk to the sync server directly. Read and write through Kora collections only; sync happens automatically in the background.
+3. **Await readiness before direct collection access.** Outside the UI bindings, `await app.ready` before calling `app.<collection>` methods. The bindings handle this for you inside components.
+4. **Offline must keep working.** Any feature you add must function with the network off. Never gate a write or a read on connectivity. If you find yourself checking `navigator.onLine` before a data operation, you are doing it wrong.
+5. **Surface mutation errors.** Fire-and-forget mutate calls put errors into the mutation state. Always render the mutation's `error` in the UI or handle the promise from the async variant. Silent failure is the worst failure.
+6. **Do not touch `src/kora-worker.ts`.** It wires the SQLite WASM binary URL for both dev and production builds. Changing it breaks production builds in ways that only show up after deploy.
+7. **Do not add a state management library for server or app data.** Kora's reactive queries are the store. Local UI state (form inputs, toggles) can use the framework's normal state tools.
+
+## Data API cheat sheet
+
+```ts
+await app.ready
+const rec = await app.todos.insert({ title: 'x' })   // defaults and .auto() fields applied
+await app.todos.update(rec.id, { completed: true })  // partial update, changed fields only
+await app.todos.delete(rec.id)
+const one = await app.todos.findById(rec.id)
+const unsubscribe = app.todos
+  .where({ completed: false })
+  .orderBy('createdAt', 'desc')
+  .subscribe((rows) => {/* fires immediately, then on every change */})
+```
+
+Schema example (`src/schema.ts`):
+
+```ts
+import { defineSchema, t } from 'korajs'
+
+export default defineSchema({
+  version: 1,
+  collections: {
+    todos: {
+      fields: {
+        title: t.string(),
+        completed: t.boolean().default(false),
+        tags: t.array(t.string()).default([]),
+        priority: t.enum(['low', 'medium', 'high']).default('medium'),
+        createdAt: t.timestamp().auto(), // set automatically; never pass it on insert
+      },
+      indexes: ['completed', 'createdAt'],
+    },
+  },
+})
+```
+
+If you change a collection's shape, increment `version` and add a `migrations` entry for it (`migrate().addField(...)`): each device migrates its local database on its next open. `npx kora migrate` generates the matching migration for server databases and a transform stub for clients still on the older version.
+
+## Project conventions
+
+- Feature code lives in `src/modules/<feature>/` with the pattern: `<feature>.schema.ts` (collection definition, imported into `src/schema.ts`), `<feature>.queries.ts` (query builders), `<feature>.mutations.ts` (mutation functions taking a collection accessor).
+- Conflict handling is declarative. Concurrent edits merge automatically (last-write-wins per field, arrays as multisets that keep every device's additions and removals, objects per top-level key). If a field needs domain-specific merging (counters, quantities), add a `resolve` function in the schema rather than writing sync logic.
+- `kora.config.ts` controls the dev environment (ports, sync server, schema watcher).
+
+## Commands
+
+- `npm run dev` starts everything: Vite dev server (port 5173), local sync server (port 3001), and the schema watcher.
+- `npm run build` type-checks and builds for production.
+- `npx kora doctor` diagnoses a broken setup.
+- DevTools overlay: press Ctrl+Shift+K (Cmd+Shift+K on macOS) in the running app to inspect operations, merges, and sync status.
+
+## Sync and auth
+
+Sync is configured in `src/main.*` via `createApp({ sync: { url, authClient } })`. In dev, the sync URL is derived from the page host and proxied by Vite; in production set `VITE_SYNC_URL`. Auth (if present in this template) uses `@korajs/auth`; the client is created in `src/auth.ts`. Local writes work without sign-in; sync requires the server to accept the connection.
+
+## Svelte bindings
+
+Kora's Svelte package exposes store-based bindings from `@korajs/svelte`, wired through the provider set up in the app entry. Queries are reactive stores over the local database (no network, no spinner; `[]` until the first local result); mutations expose error state that must be surfaced in the UI.

package/templates/svelte-tailwind-sync/README.md.hbs

@@ -0,0 +1,106 @@
+# {{projectName}}
+
+An offline-first application built with [Kora.js](https://ehoneahobed.github.io/kora/).
+
+## Getting Started
+
+```bash
+npm run dev
+```
+
+This starts both the Vite dev server and the Kora sync server.
+
+- **App**: http://localhost:5173
+- **Sync server**: ws://localhost:3001/kora-sync
+
+## Project Structure
+
+```
+src/
+  schema.ts        # Schema entry point
+  auth.ts          # Auth client and OAuth callback handling
+  main.tsx         # App initialization and Kora setup
+  App.tsx          # Main application component
+  modules/
+    todos/
+      todo.schema.ts     # Todo collection definition
+      todo.queries.ts    # Reusable todo query builders
+      todo.mutations.ts  # Todo mutation helpers
+      useTodos.ts        # React hook connecting todos to the UI
+  kora-worker.ts   # SQLite WASM web worker
+  index.css        # Styles
+server.ts          # Kora sync server
+kora.config.ts     # Kora configuration
+```
+
+In a feature module, `schema` defines data shape, `queries` contain reads only, `mutations` contain
+writes, and `useTodos.ts` is the React binding that exposes todo data and actions to components.
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `VITE_SYNC_URL` | `ws://localhost:3001/kora-sync` | WebSocket URL for the sync endpoint |
+| `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
+| `PORT` | `3001` | Sync server port |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
+| `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
+| `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
+| `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |
+| `KORA_GOOGLE_CLIENT_ID` | (none) | Enables Google OAuth when set with `KORA_GOOGLE_REDIRECT_URI` |
+| `KORA_GOOGLE_CLIENT_SECRET` | (none) | Google OAuth client secret for confidential web clients |
+| `KORA_GOOGLE_REDIRECT_URI` | (none) | OAuth callback URL, usually your app URL that handles `code` and `state` |
+| `KORA_OAUTH_PKCE` | `true` when no client secret | Enables PKCE for public desktop/mobile OAuth clients |
+| `KORA_ADMIN_TOKEN` | (none) | Protects `/__kora`, `/__kora/status`, and `/__kora/events` |
+| `KORA_METRICS_TOKEN` | (none) | Protects `/__kora/metrics` |
+| `KORA_BACKUP_TOKEN` | (none) | Protects server backup and restore endpoints |
+
+## Authentication
+
+Set `KORA_AUTH_SECRET` to enable built-in auth on the sync server. Generate a secret with:
+
+```bash
+node -e "console.log(require('node:crypto').randomBytes(32).toString('hex'))"
+```
+
+The template already creates `src/auth.ts`, wraps the app in `AuthProvider`, and wires sync with `createKoraAuthSync({ authClient, schema })`. To enable Google OAuth, set:
+
+```bash
+KORA_AUTH_SECRET=...
+KORA_GOOGLE_CLIENT_ID=...
+KORA_GOOGLE_CLIENT_SECRET=...
+KORA_GOOGLE_REDIRECT_URI=http://localhost:5173
+```
+
+Use `authClient.signInWithOAuth('google')` for web redirect sign-in, or `authClient.getOAuthAuthorizationUrl('google')` plus `authClient.completeOAuthSignIn('google', { code, state })` for custom handoff flows. See the [Authentication Guide](https://ehoneahobed.github.io/kora/guide/authentication).
+
+## Scripts
+
+| Script | Description |
+|--------|-------------|
+| `npm run dev` | Start dev server + sync server |
+| `npm run dev:server` | Start sync server only |
+| `npm run build` | Build for production |
+| `npm run preview` | Preview production build |
+
+## Deployment
+
+The client and sync server must be deployed separately:
+
+- **Client**: Any static host (Vercel, Netlify, Cloudflare Pages)
+- **Sync server**: Any Node.js host with WebSocket support (Railway, Render, Fly.io)
+
+Set `VITE_SYNC_URL` to your deployed sync server URL when building:
+
+```bash
+VITE_SYNC_URL=wss://your-server.example.com/kora-sync npm run build
+```
+
+## Learn More
+
+- [Documentation](https://ehoneahobed.github.io/kora/)
+- [Storage Configuration](https://ehoneahobed.github.io/kora/guide/storage-configuration)
+- [Sync Configuration](https://ehoneahobed.github.io/kora/guide/sync-configuration)
+- [Deployment Guide](https://ehoneahobed.github.io/kora/guide/deployment)

package/templates/svelte-tailwind-sync/index.html.hbs

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>{{projectName}}</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

package/templates/svelte-tailwind-sync/kora.config.ts

@@ -0,0 +1,17 @@
+import { defineConfig } from 'korajs/config'
+
+export default defineConfig({
+	schema: './src/schema.ts',
+	dev: {
+		port: 5173,
+		sync: {
+			enabled: true,
+			port: 3001,
+			store: 'sqlite',
+		},
+		watch: {
+			enabled: true,
+			debounceMs: 300,
+		},
+	},
+})

package/templates/svelte-tailwind-sync/package.json.hbs

@@ -0,0 +1,46 @@
+{
+  "name": "{{projectName}}",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "kora dev",
+    "dev:server": "tsx server.ts",
+    "build": "vite build",
+    "check": "svelte-check --tsconfig ./tsconfig.json",
+    "start": "node --import tsx server.ts",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "korajs": "{{koraVersion}}",
+    "@korajs/auth": "{{koraVersion}}",
+    "@korajs/svelte": "{{koraVersion}}",
+    "@korajs/store": "{{koraVersion}}",
+    "@lucide/svelte": "^0.479.0",
+    "@sqlite.org/sqlite-wasm": ">=3.51.0-build1",
+    "svelte": "^5.0.0",
+    "ws": "^8.18.0",
+    "yjs": "^13.6.30"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "esbuild",
+      "protobufjs"
+    ]
+  },
+  "devDependencies": {
+    "@korajs/cli": "{{koraVersion}}",
+    "@korajs/server": "{{koraVersion}}",
+    "@sveltejs/vite-plugin-svelte": "^5.0.0",
+    "@tailwindcss/vite": "^4.0.0",
+    "@types/ws": "^8.5.0",
+    "better-sqlite3": "^12.9.0",
+    "postgres": "^3.4.0",
+    "svelte-check": "^4.1.0",
+    "tailwindcss": "^4.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vite": "^6.0.0"
+  }
+}

package/templates/svelte-tailwind-sync/server.ts

@@ -0,0 +1,141 @@
+import { existsSync, readFileSync } from 'node:fs'
+import {
+	type CreateKoraAuthServerOptions,
+	createKoraAuthServer,
+	createPostgresOAuthStores,
+	createPostgresUserStore,
+	createSqliteOAuthStores,
+	createSqliteUserStore,
+	googleProvider,
+} from '@korajs/auth/server'
+import {
+	createPostgresServerStore,
+	createProductionServer,
+	createSqliteServerStore,
+} from '@korajs/server'
+import schema from './src/schema'
+
+loadLocalEnv()
+
+function loadLocalEnv(mode = process.env.NODE_ENV || 'development') {
+	const existingKeys = new Set(Object.keys(process.env))
+	for (const file of ['.env', '.env.local', `.env.${mode}`, `.env.${mode}.local`]) {
+		if (!existsSync(file)) continue
+		for (const [key, value] of Object.entries(parseEnvFile(readFileSync(file, 'utf8')))) {
+			if (!existingKeys.has(key)) {
+				process.env[key] = value
+			}
+		}
+	}
+}
+
+function parseEnvFile(contents: string): Record<string, string> {
+	const env: Record<string, string> = {}
+	for (const rawLine of contents.split(/\r?\n/)) {
+		const line = rawLine.trim()
+		if (!line || line.startsWith('#')) continue
+		const normalized = line.startsWith('export ') ? line.slice('export '.length).trim() : line
+		const equalsIndex = normalized.indexOf('=')
+		if (equalsIndex <= 0) continue
+		const key = normalized.slice(0, equalsIndex).trim()
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue
+		env[key] = parseEnvValue(normalized.slice(equalsIndex + 1).trim())
+	}
+	return env
+}
+
+function parseEnvValue(value: string): string {
+	const quote = value[0]
+	if ((quote === '"' || quote === "'") && value[value.length - 1] === quote) {
+		const inner = value.slice(1, -1)
+		return quote === '"' ? inner.replace(/\\n/g, '\n').replace(/\\r/g, '\r') : inner
+	}
+	const commentIndex = value.search(/\s#/)
+	return (commentIndex >= 0 ? value.slice(0, commentIndex) : value).trim()
+}
+
+async function createStore() {
+	if (process.env.DATABASE_URL) {
+		return createPostgresServerStore({
+			connectionString: process.env.DATABASE_URL,
+		})
+	}
+
+	return createSqliteServerStore({
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
+	})
+}
+
+async function start() {
+	const store = await createStore()
+	await store.setSchema(schema)
+
+	const syncPath = process.env.KORA_SYNC_PATH || '/kora-sync'
+	const auth = await createAuth()
+	const server = createProductionServer({
+		store,
+		port: Number(process.env.PORT) || 3001,
+		staticDir: './dist',
+		syncPath,
+		httpRoutes: auth ? [{ path: '/auth', handle: auth.handleRequest }] : undefined,
+		syncOptions: {
+			schemaVersion: schema.version,
+			...(auth ? { auth: auth.auth } : {}),
+		},
+		operationalAuth: {
+			adminToken: process.env.KORA_ADMIN_TOKEN,
+			metricsToken: process.env.KORA_METRICS_TOKEN,
+			backupToken: process.env.KORA_BACKUP_TOKEN,
+		},
+	})
+
+	const url = await server.start()
+	console.log(`Kora app running at ${url}`)
+	console.log(`  Sync endpoint: ${url.replace('http', 'ws')}${syncPath}`)
+	if (auth) console.log(`  Auth endpoint: ${url}/auth`)
+}
+
+void start()
+
+async function createAuth() {
+	if (!process.env.KORA_AUTH_SECRET) {
+		return null
+	}
+
+	const oauth = await createOAuthConfig()
+	// Users and token revocations persist in the same database (the user store's
+	// revocation store is used automatically), so sign-outs survive restarts.
+	const userStore = process.env.DATABASE_URL
+		? await createPostgresUserStore({ connectionString: process.env.DATABASE_URL })
+		: await createSqliteUserStore({ filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db' })
+	return createKoraAuthServer({
+		jwtSecret: process.env.KORA_AUTH_SECRET,
+		userStore,
+		...(oauth ? { oauth } : {}),
+	})
+}
+
+async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth'] | undefined> {
+	if (!process.env.KORA_GOOGLE_CLIENT_ID || !process.env.KORA_GOOGLE_REDIRECT_URI) {
+		return undefined
+	}
+
+	const oauthStores = process.env.DATABASE_URL
+		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
+		: await createSqliteOAuthStores({
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
+			})
+
+	return {
+		providers: [
+			googleProvider({
+				clientId: process.env.KORA_GOOGLE_CLIENT_ID,
+				clientSecret: process.env.KORA_GOOGLE_CLIENT_SECRET,
+				redirectUri: process.env.KORA_GOOGLE_REDIRECT_URI,
+				pkce: process.env.KORA_OAUTH_PKCE === 'true' || !process.env.KORA_GOOGLE_CLIENT_SECRET,
+			}),
+		],
+		stateStore: oauthStores.stateStore,
+		linkedIdentityStore: oauthStores.linkedIdentityStore,
+	}
+}

package/templates/svelte-tailwind-sync/src/App.svelte

@@ -0,0 +1,193 @@
+<script lang="ts">
+import { createAuthStore } from '@korajs/auth/svelte'
+import { createSyncStatusStore } from '@korajs/svelte'
+import {
+	AlertCircle,
+	CheckCircle2,
+	Circle,
+	ClipboardList,
+	Loader2,
+	Plus,
+	Trash2,
+	Wifi,
+	WifiOff,
+} from '@lucide/svelte'
+import { createTodosStores } from './modules/todos/useTodos'
+
+type Filter = 'all' | 'active' | 'completed'
+
+const syncStatus = createSyncStatusStore()
+const auth = createAuthStore()
+const todos = createTodosStores()
+const { allTodos, activeTodos, completedTodos, addTodo, toggleTodo, deleteTodo } = todos
+
+// biome-ignore lint/style/useConst: reassigned in the markup, which Biome does not see
+let filter = $state<Filter>('all')
+let input = $state('')
+
+const filteredTodos = $derived(
+	filter === 'active' ? $activeTodos : filter === 'completed' ? $completedTodos : $allTodos,
+)
+
+const syncBadge = $derived.by(() => {
+	const s = $syncStatus.status
+	const pending = $syncStatus.pendingOperations ?? 0
+	const map: Record<string, { icon: typeof Wifi; color: string; label: string }> = {
+		connected: { icon: Wifi, color: 'text-emerald-400', label: 'Connected' },
+		syncing: { icon: Wifi, color: 'text-amber-400', label: 'Syncing' },
+		synced: { icon: Wifi, color: 'text-emerald-400', label: 'Synced' },
+		offline: { icon: WifiOff, color: 'text-gray-500', label: 'Offline' },
+		error: { icon: AlertCircle, color: 'text-red-400', label: 'Error' },
+	}
+	return { ...(map[s] ?? map.offline), pending }
+})
+
+function handleSubmit(event: SubmitEvent): void {
+	event.preventDefault()
+	const title = input.trim()
+	if (!title) return
+	addTodo.mutate({ title })
+	input = ''
+}
+
+function clearCompleted(): void {
+	for (const todo of $completedTodos) {
+		deleteTodo.mutate(todo.id)
+	}
+}
+
+function emptyMessage(f: Filter): string {
+	if (f === 'all') return 'No tasks yet. Add one above!'
+	if (f === 'active') return 'All caught up! No active tasks.'
+	return 'No completed tasks yet.'
+}
+</script>
+
+<div class="min-h-screen bg-gray-950 text-gray-100">
+	<div class="mx-auto max-w-2xl px-4 py-12">
+		<div class="mb-8 flex items-center justify-between">
+			<div class="flex items-center gap-3">
+				<ClipboardList class="h-8 w-8 text-indigo-400" />
+				<h1 class="text-2xl font-bold">My Tasks</h1>
+			</div>
+			<div class="flex items-center gap-2">
+				<div class="flex items-center gap-2 rounded-full bg-gray-800 px-3 py-1.5 text-sm">
+					<svelte:component this={syncBadge.icon} class="h-4 w-4 {syncBadge.color}" />
+					<span class={syncBadge.color}>{syncBadge.label}</span>
+					{#if syncBadge.pending > 0}
+						<span class="rounded-full bg-gray-700 px-2 py-0.5 text-xs text-gray-400">
+							{syncBadge.pending} pending
+						</span>
+					{/if}
+				</div>
+				{#if $auth.isAuthenticated}
+					<button
+						type="button"
+						class="max-w-44 truncate rounded-full border border-gray-700 bg-gray-900 px-3 py-1.5 text-sm text-gray-300"
+						onclick={() => $auth.signOut()}
+					>
+						{$auth.user?.email || 'Sign out'}
+					</button>
+				{:else}
+					<button
+						type="button"
+						class="rounded-full border border-gray-700 bg-gray-900 px-3 py-1.5 text-sm text-gray-300"
+						onclick={() => $auth.signInWithOAuth('google')}
+					>
+						Sign in
+					</button>
+				{/if}
+			</div>
+		</div>
+
+		{#if $auth.error}
+			<div class="mb-4 rounded-lg border border-red-400/30 px-3 py-2 text-sm text-red-300">
+				{$auth.error}
+			</div>
+		{/if}
+
+		<div class="mb-8 grid grid-cols-3 gap-4">
+			<div class="rounded-lg border border-gray-800 bg-gray-900 p-4">
+				<p class="text-sm text-gray-500">Total</p>
+				<p class="text-2xl font-bold text-gray-300">{$allTodos.length}</p>
+			</div>
+			<div class="rounded-lg border border-gray-800 bg-gray-900 p-4">
+				<p class="text-sm text-gray-500">Remaining</p>
+				<p class="text-2xl font-bold text-amber-400">{$activeTodos.length}</p>
+			</div>
+			<div class="rounded-lg border border-gray-800 bg-gray-900 p-4">
+				<p class="text-sm text-gray-500">Done</p>
+				<p class="text-2xl font-bold text-emerald-400">{$completedTodos.length}</p>
+			</div>
+		</div>
+
+		<form class="mb-8 flex gap-3" onsubmit={handleSubmit}>
+			<input
+				bind:value={input}
+				type="text"
+				placeholder="What needs to be done?"
+				class="flex-1 rounded-lg border border-gray-700 bg-gray-900 px-4 py-3 text-gray-100 placeholder-gray-500 outline-none focus:border-indigo-500"
+			/>
+			<button
+				type="submit"
+				disabled={!input.trim()}
+				class="flex items-center gap-2 rounded-lg bg-indigo-600 px-5 py-3 font-medium text-white disabled:opacity-50"
+			>
+				<Plus class="h-4 w-4" />
+				Add
+			</button>
+		</form>
+
+		<div class="mb-6 flex gap-2">
+			{#each ['all', 'active', 'completed'] as const as f}
+				<button
+					type="button"
+					class="rounded-lg px-4 py-2 text-sm font-medium {filter === f
+						? 'bg-indigo-600 text-white'
+						: 'bg-gray-800 text-gray-400'}"
+					onclick={() => (filter = f)}
+				>
+					{f.charAt(0).toUpperCase() + f.slice(1)}
+				</button>
+			{/each}
+		</div>
+
+		<div class="space-y-2">
+			{#if filteredTodos.length === 0}
+				<div class="rounded-lg border border-dashed border-gray-800 py-12 text-center text-gray-600">
+					{emptyMessage(filter)}
+				</div>
+			{:else}
+				{#each filteredTodos as todo (todo.id)}
+					<div
+						class="group flex items-center gap-3 rounded-lg border border-gray-800 bg-gray-900 px-4 py-3"
+					>
+						<button
+							type="button"
+							class="text-gray-500 hover:text-indigo-400"
+							onclick={() => toggleTodo.mutate(todo.id, { completed: !todo.completed })}
+						>
+							{#if todo.completed}
+								<CheckCircle2 class="h-5 w-5 text-emerald-400" />
+							{:else}
+								<Circle class="h-5 w-5" />
+							{/if}
+						</button>
+						<span class="flex-1 {todo.completed ? 'line-through text-gray-500' : ''}">
+							{String(todo.title)}
+						</span>
+						<button
+							type="button"
+							class="text-gray-600 opacity-0 group-hover:opacity-100 hover:text-red-400"
+							onclick={() => deleteTodo.mutate(todo.id)}
+						>
+							<Trash2 class="h-4 w-4" />
+						</button>
+					</div>
+				{/each}
+			{/if}
+		</div>
+
+		<p class="mt-12 text-center text-xs text-gray-700">Powered by Kora — offline-first, real-time sync</p>
+	</div>
+</div>

package/templates/svelte-tailwind-sync/src/Root.svelte

@@ -0,0 +1,26 @@
+<script lang="ts">
+import type { AuthClient } from '@korajs/auth'
+import AuthProvider from '@korajs/auth/svelte/AuthProvider.svelte'
+import type { KoraAppLike } from '@korajs/svelte'
+import KoraProvider from '@korajs/svelte/KoraProvider.svelte'
+import App from './App.svelte'
+
+const { kora, authClient }: { kora: KoraAppLike; authClient: AuthClient } = $props()
+</script>
+
+<AuthProvider client={authClient}>
+	{#snippet fallback()}
+		<div class="flex h-screen items-center justify-center bg-gray-950 text-gray-400">
+			Restoring session...
+		</div>
+	{/snippet}
+
+	<KoraProvider app={kora}>
+		{#snippet fallback()}
+			<div class="flex h-screen items-center justify-center bg-gray-950 text-gray-400">
+				Loading...
+			</div>
+		{/snippet}
+		<App />
+	</KoraProvider>
+</AuthProvider>

package/templates/svelte-tailwind-sync/src/auth.ts

@@ -0,0 +1,25 @@
+import { createKoraAuth } from '@korajs/auth'
+
+export const authServerUrl =
+	import.meta.env.VITE_AUTH_URL || `${window.location.protocol}//${window.location.host}`
+
+export const authClient = createKoraAuth({
+	serverUrl: authServerUrl,
+})
+
+export async function completeOAuthCallbackFromLocation(): Promise<void> {
+	const url = new URL(window.location.href)
+	const code = url.searchParams.get('code')
+	const state = url.searchParams.get('state')
+	const provider = url.searchParams.get('provider') || 'google'
+
+	if (!code || !state) {
+		return
+	}
+
+	await authClient.completeOAuthSignIn(provider, { code, state })
+	url.searchParams.delete('code')
+	url.searchParams.delete('state')
+	url.searchParams.delete('provider')
+	window.history.replaceState({}, document.title, `${url.pathname}${url.search}${url.hash}`)
+}

package/templates/svelte-tailwind-sync/src/index.css

@@ -0,0 +1,7 @@
+@import "tailwindcss";
+
+@layer base {
+	body {
+		@apply bg-gray-950 text-gray-100 antialiased;
+	}
+}

package/templates/svelte-tailwind-sync/src/kora-worker.ts

@@ -0,0 +1,9 @@
+// Web Worker entry point for SQLite WASM.
+// Loaded automatically by the Kora store to run SQLite in a background thread.
+
+// Import the WASM binary URL so Vite resolves it with the correct content hash.
+// Without this, production builds fail because sqlite3 looks for the unhashed filename.
+import sqliteWasmUrl from '@sqlite.org/sqlite-wasm/sqlite3.wasm?url'
+;(globalThis as Record<string, unknown>).__KORA_SQLITE_WASM_URL = sqliteWasmUrl
+
+import '@korajs/store/sqlite-wasm/worker'