@korajs/cli 1.0.0-beta.5 → 1.0.0-beta.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@korajs/cli",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.6",
   "description": "Kora.js CLI tooling and project scaffolding",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -37,7 +37,7 @@
     "conf": "^15.1.0",
     "esbuild": "^0.28.0",
     "validate-npm-package-name": "^7.0.2",
-    "@korajs/core": "1.0.0-beta.5"
+    "@korajs/core": "1.0.0-beta.6"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
@@ -47,12 +47,12 @@
     "tsup": "^8.3.6",
     "typescript": "^5.7.3",
     "vitest": "^3.0.4",
-    "@korajs/server": "1.0.0-beta.5",
-    "@korajs/sync": "1.0.0-beta.5",
-    "@korajs/store": "1.0.0-beta.5",
-    "@korajs/merge": "1.0.0-beta.5",
-    "@korajs/test": "1.0.0-beta.5",
-    "korajs": "1.0.0-beta.5"
+    "@korajs/server": "1.0.0-beta.6",
+    "@korajs/store": "1.0.0-beta.7",
+    "@korajs/merge": "1.0.0-beta.6",
+    "@korajs/sync": "1.0.0-beta.6",
+    "@korajs/test": "1.0.0-beta.7",
+    "korajs": "1.0.0-beta.7"
   },
   "license": "MIT",
   "scripts": {

package/templates/react-basic/vite.config.ts

@@ -6,23 +6,26 @@ import { defineConfig } from 'vite'
 
 /**
  * Adds Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers
- * required for SharedArrayBuffer. Without these headers, OPFS SAH Pool VFS
- * cannot be used and SQLite WASM falls back to in-memory storage (no persistence).
+ * enabling SharedArrayBuffer where browsers support it while keeping common
+ * third-party embeds such as YouTube and Vimeo usable. Kora falls back to
+ * durable IndexedDB storage when SharedArrayBuffer is unavailable.
  */
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/react-sync/README.md.hbs

@@ -43,8 +43,9 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 | `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |

package/templates/react-sync/server.ts

@@ -20,7 +20,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +72,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/react-sync/vite.config.ts

@@ -6,23 +6,26 @@ import { defineConfig } from 'vite'
 
 /**
  * Adds Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers
- * required for SharedArrayBuffer. Without these headers, OPFS SAH Pool VFS
- * cannot be used and SQLite WASM falls back to in-memory storage (no persistence).
+ * enabling SharedArrayBuffer where browsers support it while keeping common
+ * third-party embeds such as YouTube and Vimeo usable. Kora falls back to
+ * durable IndexedDB storage when SharedArrayBuffer is unavailable.
  */
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -81,12 +84,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })

package/templates/react-tailwind/vite.config.ts

@@ -7,23 +7,26 @@ import { defineConfig } from 'vite'
 
 /**
  * Adds Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers
- * required for SharedArrayBuffer. Without these headers, OPFS SAH Pool VFS
- * cannot be used and SQLite WASM falls back to in-memory storage (no persistence).
+ * enabling SharedArrayBuffer where browsers support it while keeping common
+ * third-party embeds such as YouTube and Vimeo usable. Kora falls back to
+ * durable IndexedDB storage when SharedArrayBuffer is unavailable.
  */
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/react-tailwind-sync/README.md.hbs

@@ -43,8 +43,9 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 | `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |

package/templates/react-tailwind-sync/server.ts

@@ -20,7 +20,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +72,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/react-tailwind-sync/vite.config.ts

@@ -7,23 +7,26 @@ import { defineConfig } from 'vite'
 
 /**
  * Adds Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers
- * required for SharedArrayBuffer. Without these headers, OPFS SAH Pool VFS
- * cannot be used and SQLite WASM falls back to in-memory storage (no persistence).
+ * enabling SharedArrayBuffer where browsers support it while keeping common
+ * third-party embeds such as YouTube and Vimeo usable. Kora falls back to
+ * durable IndexedDB storage when SharedArrayBuffer is unavailable.
  */
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -82,12 +85,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })

package/templates/svelte-basic/vite.config.ts

@@ -5,19 +5,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/svelte-sync/README.md.hbs

@@ -43,8 +43,9 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 | `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |

package/templates/svelte-sync/server.ts

@@ -20,7 +20,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +72,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/svelte-sync/vite.config.ts

@@ -5,19 +5,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -68,12 +70,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })

package/templates/svelte-tailwind/vite.config.ts

@@ -6,19 +6,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/svelte-tailwind-sync/README.md.hbs

@@ -43,8 +43,9 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 | `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |

package/templates/svelte-tailwind-sync/server.ts

@@ -20,7 +20,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +72,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/svelte-tailwind-sync/vite.config.ts

@@ -6,19 +6,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -69,12 +71,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })

package/templates/vue-basic/vite.config.ts

@@ -5,19 +5,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/vue-sync/README.md.hbs

@@ -43,8 +43,9 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 | `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |

package/templates/vue-sync/server.ts

@@ -20,7 +20,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +72,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/vue-sync/vite.config.ts

@@ -5,19 +5,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -68,12 +70,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })

package/templates/vue-tailwind/vite.config.ts

@@ -6,19 +6,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/vue-tailwind-sync/README.md.hbs

@@ -43,8 +43,9 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 | `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |

package/templates/vue-tailwind-sync/server.ts

@@ -20,7 +20,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +72,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/vue-tailwind-sync/vite.config.ts

@@ -6,19 +6,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -69,12 +71,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })