@korajs/cli 1.0.0-beta.5 → 1.0.0-beta.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@korajs/cli",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.7",
   "description": "Kora.js CLI tooling and project scaffolding",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -37,7 +37,7 @@
     "conf": "^15.1.0",
     "esbuild": "^0.28.0",
     "validate-npm-package-name": "^7.0.2",
-    "@korajs/core": "1.0.0-beta.5"
+    "@korajs/core": "1.0.0-beta.7"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
@@ -47,12 +47,12 @@
     "tsup": "^8.3.6",
     "typescript": "^5.7.3",
     "vitest": "^3.0.4",
-    "@korajs/server": "1.0.0-beta.5",
-    "@korajs/sync": "1.0.0-beta.5",
-    "@korajs/store": "1.0.0-beta.5",
-    "@korajs/merge": "1.0.0-beta.5",
-    "@korajs/test": "1.0.0-beta.5",
-    "korajs": "1.0.0-beta.5"
+    "@korajs/server": "1.0.0-beta.7",
+    "@korajs/merge": "1.0.0-beta.7",
+    "@korajs/store": "1.0.0-beta.8",
+    "@korajs/sync": "1.0.0-beta.7",
+    "korajs": "1.0.0-beta.8",
+    "@korajs/test": "1.0.0-beta.8"
   },
   "license": "MIT",
   "scripts": {

package/templates/react-basic/README.md.hbs

@@ -47,7 +47,7 @@ To enable real-time sync across devices, update `src/main.tsx`:
 const app = createApp({
   schema,
   sync: {
-    url: import.meta.env.VITE_SYNC_URL || 'ws://localhost:3001',
+    url: import.meta.env.VITE_SYNC_URL || 'ws://localhost:3001/kora-sync',
   },
   // ...
 })

package/templates/react-basic/vite.config.ts

@@ -6,23 +6,26 @@ import { defineConfig } from 'vite'
 
 /**
  * Adds Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers
- * required for SharedArrayBuffer. Without these headers, OPFS SAH Pool VFS
- * cannot be used and SQLite WASM falls back to in-memory storage (no persistence).
+ * enabling SharedArrayBuffer where browsers support it while keeping common
+ * third-party embeds such as YouTube and Vimeo usable. Kora falls back to
+ * durable IndexedDB storage when SharedArrayBuffer is unavailable.
  */
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/react-sync/README.md.hbs

@@ -11,7 +11,7 @@ npm run dev
 This starts both the Vite dev server and the Kora sync server.
 
 - **App**: http://localhost:5173
-- **Sync server**: ws://localhost:3001
+- **Sync server**: ws://localhost:3001/kora-sync
 
 ## Project Structure
 
@@ -40,11 +40,12 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
+| `VITE_SYNC_URL` | `ws://localhost:3001/kora-sync` | WebSocket URL for the sync endpoint |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |
@@ -94,7 +95,7 @@ The client and sync server must be deployed separately:
 Set `VITE_SYNC_URL` to your deployed sync server URL when building:
 
 ```bash
-VITE_SYNC_URL=wss://your-server.example.com npm run build
+VITE_SYNC_URL=wss://your-server.example.com/kora-sync npm run build
 ```
 
 ## Learn More

package/templates/react-sync/server.ts

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from 'node:fs'
 import {
 	type CreateKoraAuthServerOptions,
 	createKoraAuthServer,
@@ -12,6 +13,45 @@ import {
 } from '@korajs/server'
 import schema from './src/schema'
 
+loadLocalEnv()
+
+function loadLocalEnv(mode = process.env.NODE_ENV || 'development') {
+	const existingKeys = new Set(Object.keys(process.env))
+	for (const file of ['.env', '.env.local', `.env.${mode}`, `.env.${mode}.local`]) {
+		if (!existsSync(file)) continue
+		for (const [key, value] of Object.entries(parseEnvFile(readFileSync(file, 'utf8')))) {
+			if (!existingKeys.has(key)) {
+				process.env[key] = value
+			}
+		}
+	}
+}
+
+function parseEnvFile(contents: string): Record<string, string> {
+	const env: Record<string, string> = {}
+	for (const rawLine of contents.split(/\r?\n/)) {
+		const line = rawLine.trim()
+		if (!line || line.startsWith('#')) continue
+		const normalized = line.startsWith('export ') ? line.slice('export '.length).trim() : line
+		const equalsIndex = normalized.indexOf('=')
+		if (equalsIndex <= 0) continue
+		const key = normalized.slice(0, equalsIndex).trim()
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue
+		env[key] = parseEnvValue(normalized.slice(equalsIndex + 1).trim())
+	}
+	return env
+}
+
+function parseEnvValue(value: string): string {
+	const quote = value[0]
+	if ((quote === '"' || quote === "'") && value[value.length - 1] === quote) {
+		const inner = value.slice(1, -1)
+		return quote === '"' ? inner.replace(/\\n/g, '\n').replace(/\\r/g, '\r') : inner
+	}
+	const commentIndex = value.search(/\s#/)
+	return (commentIndex >= 0 ? value.slice(0, commentIndex) : value).trim()
+}
+
 async function createStore() {
 	if (process.env.DATABASE_URL) {
 		return createPostgresServerStore({
@@ -20,7 +60,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +112,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/react-sync/vite.config.ts

@@ -6,23 +6,26 @@ import { defineConfig } from 'vite'
 
 /**
  * Adds Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers
- * required for SharedArrayBuffer. Without these headers, OPFS SAH Pool VFS
- * cannot be used and SQLite WASM falls back to in-memory storage (no persistence).
+ * enabling SharedArrayBuffer where browsers support it while keeping common
+ * third-party embeds such as YouTube and Vimeo usable. Kora falls back to
+ * durable IndexedDB storage when SharedArrayBuffer is unavailable.
  */
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -81,12 +84,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })

package/templates/react-tailwind/README.md.hbs

@@ -47,7 +47,7 @@ To enable real-time sync across devices, update `src/main.tsx`:
 const app = createApp({
   schema,
   sync: {
-    url: import.meta.env.VITE_SYNC_URL || 'ws://localhost:3001',
+    url: import.meta.env.VITE_SYNC_URL || 'ws://localhost:3001/kora-sync',
   },
   // ...
 })

package/templates/react-tailwind/vite.config.ts

@@ -7,23 +7,26 @@ import { defineConfig } from 'vite'
 
 /**
  * Adds Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers
- * required for SharedArrayBuffer. Without these headers, OPFS SAH Pool VFS
- * cannot be used and SQLite WASM falls back to in-memory storage (no persistence).
+ * enabling SharedArrayBuffer where browsers support it while keeping common
+ * third-party embeds such as YouTube and Vimeo usable. Kora falls back to
+ * durable IndexedDB storage when SharedArrayBuffer is unavailable.
  */
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/react-tailwind-sync/README.md.hbs

@@ -11,7 +11,7 @@ npm run dev
 This starts both the Vite dev server and the Kora sync server.
 
 - **App**: http://localhost:5173
-- **Sync server**: ws://localhost:3001
+- **Sync server**: ws://localhost:3001/kora-sync
 
 ## Project Structure
 
@@ -40,11 +40,12 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
+| `VITE_SYNC_URL` | `ws://localhost:3001/kora-sync` | WebSocket URL for the sync endpoint |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |
@@ -94,7 +95,7 @@ The client and sync server must be deployed separately:
 Set `VITE_SYNC_URL` to your deployed sync server URL when building:
 
 ```bash
-VITE_SYNC_URL=wss://your-server.example.com npm run build
+VITE_SYNC_URL=wss://your-server.example.com/kora-sync npm run build
 ```
 
 ## Learn More

package/templates/react-tailwind-sync/server.ts

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from 'node:fs'
 import {
 	type CreateKoraAuthServerOptions,
 	createKoraAuthServer,
@@ -12,6 +13,45 @@ import {
 } from '@korajs/server'
 import schema from './src/schema'
 
+loadLocalEnv()
+
+function loadLocalEnv(mode = process.env.NODE_ENV || 'development') {
+	const existingKeys = new Set(Object.keys(process.env))
+	for (const file of ['.env', '.env.local', `.env.${mode}`, `.env.${mode}.local`]) {
+		if (!existsSync(file)) continue
+		for (const [key, value] of Object.entries(parseEnvFile(readFileSync(file, 'utf8')))) {
+			if (!existingKeys.has(key)) {
+				process.env[key] = value
+			}
+		}
+	}
+}
+
+function parseEnvFile(contents: string): Record<string, string> {
+	const env: Record<string, string> = {}
+	for (const rawLine of contents.split(/\r?\n/)) {
+		const line = rawLine.trim()
+		if (!line || line.startsWith('#')) continue
+		const normalized = line.startsWith('export ') ? line.slice('export '.length).trim() : line
+		const equalsIndex = normalized.indexOf('=')
+		if (equalsIndex <= 0) continue
+		const key = normalized.slice(0, equalsIndex).trim()
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue
+		env[key] = parseEnvValue(normalized.slice(equalsIndex + 1).trim())
+	}
+	return env
+}
+
+function parseEnvValue(value: string): string {
+	const quote = value[0]
+	if ((quote === '"' || quote === "'") && value[value.length - 1] === quote) {
+		const inner = value.slice(1, -1)
+		return quote === '"' ? inner.replace(/\\n/g, '\n').replace(/\\r/g, '\r') : inner
+	}
+	const commentIndex = value.search(/\s#/)
+	return (commentIndex >= 0 ? value.slice(0, commentIndex) : value).trim()
+}
+
 async function createStore() {
 	if (process.env.DATABASE_URL) {
 		return createPostgresServerStore({
@@ -20,7 +60,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +112,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/react-tailwind-sync/vite.config.ts

@@ -7,23 +7,26 @@ import { defineConfig } from 'vite'
 
 /**
  * Adds Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers
- * required for SharedArrayBuffer. Without these headers, OPFS SAH Pool VFS
- * cannot be used and SQLite WASM falls back to in-memory storage (no persistence).
+ * enabling SharedArrayBuffer where browsers support it while keeping common
+ * third-party embeds such as YouTube and Vimeo usable. Kora falls back to
+ * durable IndexedDB storage when SharedArrayBuffer is unavailable.
  */
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -82,12 +85,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })

package/templates/svelte-basic/README.md.hbs

@@ -47,7 +47,7 @@ To enable real-time sync across devices, update `src/main.tsx`:
 const app = createApp({
   schema,
   sync: {
-    url: import.meta.env.VITE_SYNC_URL || 'ws://localhost:3001',
+    url: import.meta.env.VITE_SYNC_URL || 'ws://localhost:3001/kora-sync',
   },
   // ...
 })

package/templates/svelte-basic/vite.config.ts

@@ -5,19 +5,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},

package/templates/svelte-sync/README.md.hbs

@@ -11,7 +11,7 @@ npm run dev
 This starts both the Vite dev server and the Kora sync server.
 
 - **App**: http://localhost:5173
-- **Sync server**: ws://localhost:3001
+- **Sync server**: ws://localhost:3001/kora-sync
 
 ## Project Structure
 
@@ -40,11 +40,12 @@ writes, and `useTodos.ts` is the React binding that exposes todo data and action
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `VITE_SYNC_URL` | `ws://localhost:3001` | WebSocket URL for the sync server |
+| `VITE_SYNC_URL` | `ws://localhost:3001/kora-sync` | WebSocket URL for the sync endpoint |
 | `VITE_AUTH_URL` | current origin | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
-| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
-| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_SERVER_DB` | `./.kora/kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./.kora/kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `KORA_COEP_POLICY` | `credentialless` | Dev/preview Cross-Origin-Embedder-Policy. Use `require-corp` only when every embedded resource opts in. |
 | `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
 | `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
 | `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |
@@ -94,7 +95,7 @@ The client and sync server must be deployed separately:
 Set `VITE_SYNC_URL` to your deployed sync server URL when building:
 
 ```bash
-VITE_SYNC_URL=wss://your-server.example.com npm run build
+VITE_SYNC_URL=wss://your-server.example.com/kora-sync npm run build
 ```
 
 ## Learn More

package/templates/svelte-sync/server.ts

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from 'node:fs'
 import {
 	type CreateKoraAuthServerOptions,
 	createKoraAuthServer,
@@ -12,6 +13,45 @@ import {
 } from '@korajs/server'
 import schema from './src/schema'
 
+loadLocalEnv()
+
+function loadLocalEnv(mode = process.env.NODE_ENV || 'development') {
+	const existingKeys = new Set(Object.keys(process.env))
+	for (const file of ['.env', '.env.local', `.env.${mode}`, `.env.${mode}.local`]) {
+		if (!existsSync(file)) continue
+		for (const [key, value] of Object.entries(parseEnvFile(readFileSync(file, 'utf8')))) {
+			if (!existingKeys.has(key)) {
+				process.env[key] = value
+			}
+		}
+	}
+}
+
+function parseEnvFile(contents: string): Record<string, string> {
+	const env: Record<string, string> = {}
+	for (const rawLine of contents.split(/\r?\n/)) {
+		const line = rawLine.trim()
+		if (!line || line.startsWith('#')) continue
+		const normalized = line.startsWith('export ') ? line.slice('export '.length).trim() : line
+		const equalsIndex = normalized.indexOf('=')
+		if (equalsIndex <= 0) continue
+		const key = normalized.slice(0, equalsIndex).trim()
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue
+		env[key] = parseEnvValue(normalized.slice(equalsIndex + 1).trim())
+	}
+	return env
+}
+
+function parseEnvValue(value: string): string {
+	const quote = value[0]
+	if ((quote === '"' || quote === "'") && value[value.length - 1] === quote) {
+		const inner = value.slice(1, -1)
+		return quote === '"' ? inner.replace(/\\n/g, '\n').replace(/\\r/g, '\r') : inner
+	}
+	const commentIndex = value.search(/\s#/)
+	return (commentIndex >= 0 ? value.slice(0, commentIndex) : value).trim()
+}
+
 async function createStore() {
 	if (process.env.DATABASE_URL) {
 		return createPostgresServerStore({
@@ -20,7 +60,7 @@ async function createStore() {
 	}
 
 	return createSqliteServerStore({
-		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+		filename: process.env.KORA_SERVER_DB || './.kora/kora-server.db',
 	})
 }
 
@@ -72,7 +112,7 @@ async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth']
 	const oauthStores = process.env.DATABASE_URL
 		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
 		: await createSqliteOAuthStores({
-				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+				filename: process.env.KORA_AUTH_DB || './.kora/kora-auth.db',
 			})
 
 	return {

package/templates/svelte-sync/vite.config.ts

@@ -5,19 +5,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
@@ -68,12 +70,19 @@ export default defineConfig({
 	},
 	server: {
 		allowedHosts: true,
+		watch: {
+			ignored: ['**/.kora/**', '**/*.db', '**/*.db-shm', '**/*.db-wal'],
+		},
 		proxy: {
 			'/kora-sync': {
 				target: 'ws://localhost:3001',
 				ws: true,
 				rewriteWsOrigin: true,
 			},
+			'/auth': {
+				target: 'http://localhost:3001',
+				changeOrigin: true,
+			},
 		},
 	},
 })

package/templates/svelte-tailwind/README.md.hbs

@@ -47,7 +47,7 @@ To enable real-time sync across devices, update `src/main.tsx`:
 const app = createApp({
   schema,
   sync: {
-    url: import.meta.env.VITE_SYNC_URL || 'ws://localhost:3001',
+    url: import.meta.env.VITE_SYNC_URL || 'ws://localhost:3001/kora-sync',
   },
   // ...
 })

package/templates/svelte-tailwind/vite.config.ts

@@ -6,19 +6,21 @@ import type { Plugin } from 'vite'
 import { defineConfig } from 'vite'
 
 function crossOriginIsolation(): Plugin {
+	const embedderPolicy = process.env.KORA_COEP_POLICY || 'credentialless'
+
 	return {
 		name: 'cross-origin-isolation',
 		configureServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},
 		configurePreviewServer(server) {
 			server.middlewares.use((_req, res, next) => {
 				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				res.setHeader('Cross-Origin-Embedder-Policy', embedderPolicy)
 				next()
 			})
 		},