@beignet/cli 0.0.1 → 0.0.3

package/src/templates.ts

@@ -1,7 +1,22 @@
+/**
+ * Package managers supported by the app template generator.
+ */
 export type PackageManager = "bun" | "npm" | "pnpm" | "yarn";
+/**
+ * Starter presets supported by the app template generator.
+ */
 export type PresetName = "minimal" | "standard";
+/**
+ * Application templates supported by the app template generator.
+ */
 export type TemplateName = "next";
+/**
+ * Optional first-party features that can be scaffolded into a new app.
+ */
 export type FeatureName = "client" | "react-query" | "forms" | "openapi";
+/**
+ * Optional provider integrations that can be scaffolded into a new app.
+ */
 export type IntegrationName =
   | "better-auth"
   | "drizzle-turso"
@@ -10,11 +25,17 @@ export type IntegrationName =
   | "resend"
   | "upstash-rate-limit";
 
+/**
+ * One generated file emitted by the template generator.
+ */
 export type TemplateFile = {
   path: string;
   content: string;
 };
 
+/**
+ * Inputs used to render app template files.
+ */
 export type TemplateContext = {
   name: string;
   packageManager: PackageManager;
@@ -69,6 +90,9 @@ function packageRunner(ctx: TemplateContext): string {
   }
 }
 
+/**
+ * Supported scaffold feature choices.
+ */
 export const featureChoices = [
   "client",
   "react-query",
@@ -76,11 +100,17 @@ export const featureChoices = [
   "openapi",
 ] as const satisfies readonly FeatureName[];
 
+/**
+ * Supported scaffold preset choices.
+ */
 export const presetChoices = [
   "minimal",
   "standard",
 ] as const satisfies readonly PresetName[];
 
+/**
+ * Supported scaffold integration choices.
+ */
 export const integrationChoices = [
   "better-auth",
   "drizzle-turso",
@@ -184,6 +214,7 @@ function packageJson(ctx: TemplateContext): string {
 
   if (isStandardPreset(ctx)) {
     dependencies["@beignet/devtools"] = ctx.beignetVersion;
+    dependencies["@beignet/provider-event-bus-memory"] = ctx.beignetVersion;
     dependencies["@beignet/provider-storage-local"] = ctx.beignetVersion;
   }
 
@@ -228,6 +259,8 @@ function packageJson(ctx: TemplateContext): string {
   if (hasDrizzleTurso(ctx)) {
     scripts["db:generate"] = "drizzle-kit generate";
     scripts["db:migrate"] = "drizzle-kit migrate";
+    scripts["db:seed"] = "bun infra/db/seed.ts";
+    scripts["db:reset"] = "bun infra/db/reset.ts";
   }
 
   return json({
@@ -311,7 +344,8 @@ function standardReadme(ctx: TemplateContext): string {
   const beforeDeploy = hasDrizzleTurso(ctx)
     ? [
         "- Create a Turso database or keep `TURSO_DB_URL=file:local.db` for local libSQL development.",
-        `- Run \`${ctx.packageManager} run db:generate\` and \`${ctx.packageManager} run db:migrate\` after changing the Drizzle schema.`,
+        `- Run \`${cli} db generate\` and \`${cli} db migrate\` after changing the Drizzle schema.`,
+        `- Run \`${cli} db seed\` to load starter data or \`${cli} db reset\` to rebuild a local SQLite database.`,
       ].join("\n")
     : "- Replace the in-memory todo repository with a durable adapter.";
 
@@ -349,10 +383,14 @@ ${typecheck}
 - \`infra/\` implements ports for the selected runtime.
 - \`server/routes.ts\` keeps the central route registry and OpenAPI contract list.
 - \`server/\` wires context, providers, routes, hooks, and error handling.
+- \`server/outbox.ts\` registers durable events and jobs for the outbox drain route.
 - \`features/shared/errors.ts\` keeps application errors and route-owned error schemas together.
+- \`features/todos/domain/events/\`, \`jobs/\`, \`listeners/\`, \`notifications/\`, \`schedules/\`, and \`uploads/\` show the feature-owned background workflow shape.
 - \`app/storage/[...key]/route.ts\` serves public local storage objects.
+- \`app/api/cron/outbox/drain/route.ts\` is the bounded serverless entrypoint for durable event/job delivery.
 - \`lib/env.ts\` validates deployment configuration at startup.
 - \`lib/auth.ts\` exposes \`requireUser(ctx)\` for protected use cases.
+- \`lib/better-auth.ts\` owns Better Auth setup and keeps provider-specific auth details outside use cases.
 - \`features/todos/policy.ts\` defines authorization rules registered with \`createGate(...)\`.
 ${hasDrizzleTurso(ctx) ? "- `infra/db/schema/` contains the Drizzle schema, `infra/db/repositories.ts` creates app repositories, and `infra/todos/` contains the durable todo repository adapter.\n" : ""}
 
@@ -360,8 +398,9 @@ ${hasDrizzleTurso(ctx) ? "- `infra/db/schema/` contains the Drizzle schema, `inf
 
 ${beforeDeploy}
 - Keep \`/api/devtools\` development-only unless you add authentication and stricter redaction.
-- Set \`APP_URL\`, \`LOG_LEVEL\`, and service-specific integration variables in your hosting environment.
-- Replace anonymous auth and add use-case authorization before exposing user-owned data.
+- Set \`APP_URL\`, \`BETTER_AUTH_SECRET\`, \`CRON_SECRET\`, \`LOG_LEVEL\`, and service-specific integration variables in your hosting environment.
+- Configure a scheduled request to \`/api/cron/outbox/drain\` with \`Authorization: Bearer <CRON_SECRET>\`.
+- Review the starter authorization policy before exposing user-owned data.
 ${ctx.integrations.length > 0 ? "\nSee `docs/integrations.md` for setup notes.\n" : ""}
 `;
 }
@@ -381,10 +420,10 @@ function integrationsDoc(ctx: TemplateContext): string {
         "",
         "- Package: `@beignet/provider-auth-better-auth`",
         "- Peer dependency: `better-auth`",
-        "- The starter uses an anonymous auth adapter. Replace `createAnonymousAuth()` in `infra/app-ports.ts` with an adapter backed by your Better Auth session lookup.",
+        "- The standard starter wires `lib/better-auth.ts`, `app/api/auth/[...all]/route.ts`, and `createAuthBetterAuthProvider(...)`.",
         "- Keep auth behind the shared `AuthPort`, then call `requireUser(ctx)` in use cases that need a signed-in user.",
         "- Put repeated ownership or role rules in policies registered with `createGate(...)`.",
-        "- Add the Better Auth provider only after your app has a database adapter and session setup.",
+        "- The generated SQLite schema includes the Better Auth `user`, `session`, `account`, and `verification` tables for local development.",
         "",
       );
     }
@@ -398,7 +437,8 @@ function integrationsDoc(ctx: TemplateContext): string {
         "- Dev dependency: `drizzle-kit`",
         "- Set `TURSO_DB_URL` and optional `TURSO_DB_AUTH_TOKEN`.",
         "- The scaffold wires a typed Drizzle repository behind the `TodoRepository` port and a transaction-backed Unit of Work.",
-        `- Run \`${ctx.packageManager} run db:generate\` and \`${ctx.packageManager} run db:migrate\` after changing \`infra/db/schema.ts\`.`,
+        `- Run \`${packageRunner(ctx)} db generate\` and \`${packageRunner(ctx)} db migrate\` after changing \`infra/db/schema/index.ts\`.`,
+        `- Run \`${packageRunner(ctx)} db seed\` for idempotent starter data and \`${packageRunner(ctx)} db reset\` for destructive local resets.`,
         "",
       );
     }
@@ -511,9 +551,9 @@ function envExample(ctx: TemplateContext): string {
 
   if (hasIntegration(ctx, "better-auth")) {
     lines.push(
-      "# Better Auth needs an app-owned database adapter and a shared AuthPort adapter before it can be wired.",
-      "BETTER_AUTH_SECRET=",
+      "BETTER_AUTH_SECRET=local-dev-better-auth-secret-change-me",
       "BETTER_AUTH_URL=http://localhost:3000",
+      "# BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000",
       "",
     );
   }
@@ -771,14 +811,14 @@ export function TodoApp() {
 			<div className="todos-panel">
 				<div className="panel-heading">
 					<h2>Todos</h2>
-					<span>{todosQuery.data?.total ?? 0} total</span>
+					<span>{todosQuery.data?.page.total ?? 0} total</span>
 				</div>
 				{todosQuery.isLoading ? <p className="muted">Loading todos...</p> : null}
 				{todosQuery.isError ? (
 					<p className="error">Could not load todos.</p>
 				) : null}
 				<ul className="todo-list">
-					{todosQuery.data?.todos.map((todo) => (
+					{todosQuery.data?.items.map((todo) => (
 						<li key={todo.id}>
 							<span>{todo.title}</span>
 							<small>{todo.completed ? "Done" : "Open"}</small>
@@ -840,10 +880,10 @@ export function TodoApp() {
 			<div className="todos-panel">
 				<div className="panel-heading">
 					<h2>Todos</h2>
-					<span>{todosQuery.data?.total ?? 0} total</span>
+					<span>{todosQuery.data?.page.total ?? 0} total</span>
 				</div>
 				<ul className="todo-list">
-					{todosQuery.data?.todos.map((todo) => (
+					{todosQuery.data?.items.map((todo) => (
 						<li key={todo.id}>
 							<span>{todo.title}</span>
 							<small>{todo.completed ? "Done" : "Open"}</small>
@@ -1123,8 +1163,14 @@ export const CreateTodoSchema = z.object({
 
 export const listTodos = todos.get("/api/todos").responses({
 	200: z.object({
-		todos: z.array(TodoSchema),
-		total: z.number(),
+		items: z.array(TodoSchema),
+		page: z.object({
+			kind: z.literal("offset"),
+			limit: z.number(),
+			offset: z.number(),
+			total: z.number(),
+			hasMore: z.boolean(),
+		}),
 	}),
 });
 
@@ -1180,8 +1226,14 @@ type AppContext = {
 const useCase = createUseCase<AppContext>();
 
 export const ListTodosOutputSchema = z.object({
-	todos: z.array(TodoSchema),
-	total: z.number(),
+	items: z.array(TodoSchema),
+	page: z.object({
+		kind: z.literal("offset"),
+		limit: z.number(),
+		offset: z.number(),
+		total: z.number(),
+		hasMore: z.boolean(),
+	}),
 });
 
 export const listTodos = useCase
@@ -1190,7 +1242,16 @@ export const listTodos = useCase
 	.output(ListTodosOutputSchema)
 	.run(async ({ ctx }) => {
 		const todos = await ctx.ports.todos.list();
-		return { todos, total: todos.length };
+		return {
+			items: todos,
+			page: {
+				kind: "offset" as const,
+				limit: todos.length,
+				offset: 0,
+				total: todos.length,
+				hasMore: false,
+			},
+		};
 	});
 
 export const createTodo = useCase
@@ -1264,6 +1325,14 @@ export const env = createEnv({
 		APP_URL: z.string().url().default("http://localhost:3000"),
 		CRON_SECRET: z.string().min(1).optional(),
 		DEVTOOLS_ENABLED: BooleanEnv.optional(),
+		BETTER_AUTH_SECRET: z
+			.string()
+			.min(32)
+			.default("local-dev-better-auth-secret-change-me"),
+		BETTER_AUTH_URL: z.string().url().default("http://localhost:3000"),
+		BETTER_AUTH_TRUSTED_ORIGINS: z.string().optional(),
+		TURSO_DB_URL: z.string().default("file:local.db"),
+		TURSO_DB_AUTH_TOKEN: z.string().optional(),
 		LOG_LEVEL: z
 			.enum(["trace", "debug", "info", "warn", "error", "fatal"])
 			.default("info"),
@@ -1329,10 +1398,14 @@ export const ListTodosInputSchema = z.object({
 });
 
 export const ListTodosOutputSchema = z.object({
-	todos: z.array(TodoSchema),
-	total: z.number().int().min(0),
-	limit: z.number().int().min(1),
-	offset: z.number().int().min(0),
+	items: z.array(TodoSchema),
+	page: z.object({
+		kind: z.literal("offset"),
+		limit: z.number().int().min(1),
+		offset: z.number().int().min(0),
+		total: z.number().int().min(0),
+		hasMore: z.boolean(),
+	}),
 });
 
 export const GetTodoInputSchema = z.object({
@@ -1371,7 +1444,8 @@ export function requireUser(ctx: AppContext): AuthUser {
 	return requireSession(ctx).user;
 }
 `,
-  productionListTodosUseCase: `import { useCase } from "@/lib/use-case";
+  productionListTodosUseCase: `import { normalizeOffsetPage } from "@beignet/core/pagination";
+import { useCase } from "@/lib/use-case";
 import { ListTodosInputSchema, ListTodosOutputSchema } from "./schemas";
 
 export const listTodosUseCase = useCase
@@ -1379,13 +1453,12 @@ export const listTodosUseCase = useCase
 	.input(ListTodosInputSchema)
 	.output(ListTodosOutputSchema)
 	.run(async ({ ctx, input }) => {
-		const result = await ctx.ports.todos.list(input);
-		return {
-			todos: result.todos,
-			total: result.total,
-			limit: input.limit,
-			offset: input.offset,
-		};
+		const page = normalizeOffsetPage(input, {
+			defaultLimit: 20,
+			maxLimit: 100,
+		});
+
+		return ctx.ports.todos.list(page);
 	});
 `,
   productionGetTodoUseCase: `import { appError } from "@/features/shared/errors";
@@ -1405,16 +1478,35 @@ export const getTodoUseCase = useCase
 		return todo;
 	});
 `,
-  productionCreateTodoUseCase: `import { useCase } from "@/lib/use-case";
+  productionCreateTodoUseCase: `import { TodoCreated } from "@/features/todos/domain/events";
+import { auditEntry } from "@/lib/audit";
+import { useCase } from "@/lib/use-case";
 import { CreateTodoInputSchema, TodoSchema } from "./schemas";
 
 export const createTodoUseCase = useCase
 	.command("todos.create")
 	.input(CreateTodoInputSchema)
 	.output(TodoSchema)
-	.run(async ({ ctx, input }) => {
+	.emits([TodoCreated])
+	.run(async ({ ctx, input, events }) => {
 		await ctx.gate.authorize("todos.create");
-		return ctx.ports.uow.transaction((tx) => tx.todos.create(input));
+		const todo = await ctx.ports.uow.transaction(async (tx) => {
+			const created = await tx.todos.create(input);
+			await events.record(tx.events, TodoCreated, {
+				todoId: created.id,
+				title: created.title,
+			});
+			await tx.audit.record(
+				auditEntry(ctx, {
+					action: "todos.create",
+					resource: { type: "todo", id: created.id, name: created.title },
+					metadata: { completed: created.completed },
+				}),
+			);
+			return created;
+		});
+
+		return todo;
 	});
 `,
   productionUseCasesIndex: `export { createTodoUseCase } from "./create-todo";
@@ -1432,21 +1524,37 @@ export {
 } from "./schemas";
 `,
   productionTodoRepositoryPort: `import type {
+	OffsetPage,
+	OffsetPageInfo,
+	PageResult,
+} from "@beignet/core/pagination";
+import type {
 	CreateTodoInput,
-	ListTodosInput,
 	Todo,
 } from "@/features/todos/use-cases/schemas";
 
-export type ListTodosResult = {
-	todos: Todo[];
-	total: number;
+export type ListTodosResult = PageResult<Todo, OffsetPageInfo>;
+
+export type TodoAttachment = {
+	id: string;
+	todoId: string;
+	key: string;
+	fileName: string;
+	contentType: string;
+	size: number;
+	createdAt: string;
 };
 
 export interface TodoRepository {
-	list(input: ListTodosInput): Promise<ListTodosResult>;
+	list(page: OffsetPage): Promise<ListTodosResult>;
 	findById(id: string): Promise<Todo | null>;
 	create(input: CreateTodoInput): Promise<Todo>;
 }
+
+export interface TodoAttachmentRepository {
+	create(input: Omit<TodoAttachment, "createdAt">): Promise<TodoAttachment>;
+	findMany(todoId: string): Promise<TodoAttachment[]>;
+}
 `,
   productionAuthPort: `import type {
 	AuthPort as BeignetAuthPort,
@@ -1516,12 +1624,15 @@ export const todoPolicy = definePolicy({
 	},
 });
 `,
-  productionInMemoryTodoRepository: `import type {
+  productionInMemoryTodoRepository: `import { offsetPageResult } from "@beignet/core/pagination";
+import type {
 	CreateTodoInput,
-	ListTodosInput,
 	Todo,
 } from "@/features/todos/use-cases/schemas";
-import type { TodoRepository } from "@/features/todos/ports";
+import type {
+	TodoAttachmentRepository,
+	TodoRepository,
+} from "@/features/todos/ports";
 
 export function createInMemoryTodoRepository(
 	seed: Todo[] = [],
@@ -1529,15 +1640,16 @@ export function createInMemoryTodoRepository(
 	const todos = new Map(seed.map((todo) => [todo.id, todo]));
 
 	return {
-		async list(input: ListTodosInput) {
+		async list(page) {
 			const allTodos = Array.from(todos.values()).sort((left, right) =>
 				left.createdAt.localeCompare(right.createdAt),
 			);
 
-			return {
-				todos: allTodos.slice(input.offset, input.offset + input.limit),
-				total: allTodos.length,
-			};
+			return offsetPageResult(
+				allTodos.slice(page.offset, page.offset + page.limit),
+				page,
+				allTodos.length,
+			);
 		},
 		async findById(id: string) {
 			return todos.get(id) ?? null;
@@ -1604,7 +1716,6 @@ export const appPorts = definePorts({
   productionInfrastructurePortsWithDrizzleTurso: `import { createGate, definePorts } from "@beignet/core/ports";
 import { todoPolicy } from "@/features/todos/policy";
 import { appError } from "@/features/shared/errors";
-import { createAnonymousAuth } from "./auth/anonymous-auth";
 import { fallbackLogger } from "./logger";
 
 const gate = createGate({
@@ -1618,7 +1729,6 @@ const gate = createGate({
 });
 
 export const appPorts = definePorts({
-	auth: createAnonymousAuth(),
 	gate,
 	logger: fallbackLogger,
 });
@@ -1633,7 +1743,63 @@ export const appPorts = definePorts({
 	},
 };
 `,
-  productionDbSchema: `import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+  productionDbSchema: `import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+export const user = sqliteTable("user", {
+	id: text("id").primaryKey(),
+	name: text("name").notNull(),
+	email: text("email").notNull().unique(),
+	emailVerified: integer("email_verified", { mode: "boolean" })
+		.notNull()
+		.default(false),
+	image: text("image"),
+	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+});
+
+export const session = sqliteTable("session", {
+	id: text("id").primaryKey(),
+	expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+	token: text("token").notNull().unique(),
+	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+	ipAddress: text("ip_address"),
+	userAgent: text("user_agent"),
+	userId: text("user_id")
+		.notNull()
+		.references(() => user.id, { onDelete: "cascade" }),
+});
+
+export const account = sqliteTable("account", {
+	id: text("id").primaryKey(),
+	accountId: text("account_id").notNull(),
+	providerId: text("provider_id").notNull(),
+	userId: text("user_id")
+		.notNull()
+		.references(() => user.id, { onDelete: "cascade" }),
+	accessToken: text("access_token"),
+	refreshToken: text("refresh_token"),
+	idToken: text("id_token"),
+	accessTokenExpiresAt: integer("access_token_expires_at", {
+		mode: "timestamp",
+	}),
+	refreshTokenExpiresAt: integer("refresh_token_expires_at", {
+		mode: "timestamp",
+	}),
+	scope: text("scope"),
+	password: text("password"),
+	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+});
+
+export const verification = sqliteTable("verification", {
+	id: text("id").primaryKey(),
+	identifier: text("identifier").notNull(),
+	value: text("value").notNull(),
+	expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+	createdAt: integer("created_at", { mode: "timestamp" }),
+	updatedAt: integer("updated_at", { mode: "timestamp" }),
+});
 
 export const todos = sqliteTable("todos", {
 	id: text("id").primaryKey(),
@@ -1641,13 +1807,111 @@ export const todos = sqliteTable("todos", {
 	completed: integer("completed", { mode: "boolean" }).notNull().default(false),
 	createdAt: text("created_at").notNull(),
 });
+
+export const todoAttachments = sqliteTable(
+	"todo_attachments",
+	{
+		id: text("id").primaryKey(),
+		todoId: text("todo_id")
+			.notNull()
+			.references(() => todos.id, { onDelete: "cascade" }),
+		key: text("key").notNull(),
+		fileName: text("file_name").notNull(),
+		contentType: text("content_type").notNull(),
+		size: integer("size").notNull(),
+		createdAt: text("created_at").notNull(),
+	},
+	(table) => ({
+		todoIdx: index("todo_attachments_todo_idx").on(
+			table.todoId,
+			table.createdAt,
+		),
+		keyIdx: index("todo_attachments_key_idx").on(table.key),
+	}),
+);
+
+export const auditLog = sqliteTable(
+	"audit_log",
+	{
+		id: text("id").primaryKey(),
+		action: text("action").notNull(),
+		actorType: text("actor_type", {
+			enum: ["anonymous", "service", "system", "user"],
+		}).notNull(),
+		actorId: text("actor_id"),
+		actorDisplayName: text("actor_display_name"),
+		tenantId: text("tenant_id"),
+		tenantSlug: text("tenant_slug"),
+		resourceType: text("resource_type"),
+		resourceId: text("resource_id"),
+		resourceName: text("resource_name"),
+		outcome: text("outcome", { enum: ["success", "failure"] })
+			.notNull()
+			.default("success"),
+		requestId: text("request_id"),
+		traceId: text("trace_id"),
+		message: text("message"),
+		metadata: text("metadata"),
+		actorMetadata: text("actor_metadata"),
+		tenantMetadata: text("tenant_metadata"),
+		resourceMetadata: text("resource_metadata"),
+		occurredAt: text("occurred_at").notNull(),
+	},
+	(table) => ({
+		actionIdx: index("audit_log_action_idx").on(table.action),
+		actorIdx: index("audit_log_actor_idx").on(table.actorType, table.actorId),
+		occurredAtIdx: index("audit_log_occurred_at_idx").on(table.occurredAt),
+		requestIdx: index("audit_log_request_idx").on(table.requestId),
+		resourceIdx: index("audit_log_resource_idx").on(
+			table.resourceType,
+			table.resourceId,
+		),
+		tenantIdx: index("audit_log_tenant_idx").on(table.tenantId),
+	}),
+);
+
+export const outboxMessages = sqliteTable(
+	"outbox_messages",
+	{
+		id: text("id").primaryKey(),
+		kind: text("kind", { enum: ["event", "job"] }).notNull(),
+		name: text("name").notNull(),
+		payloadJson: text("payload_json").notNull(),
+		status: text("status", {
+			enum: ["pending", "claimed", "delivered", "deadLettered"],
+		}).notNull(),
+		attempts: integer("attempts").notNull().default(0),
+		maxAttempts: integer("max_attempts").notNull().default(3),
+		availableAt: text("available_at").notNull(),
+		claimedAt: text("claimed_at"),
+		lockedUntil: text("locked_until"),
+		claimToken: text("claim_token"),
+		deliveredAt: text("delivered_at"),
+		lastErrorJson: text("last_error_json"),
+		createdAt: text("created_at").notNull(),
+		updatedAt: text("updated_at").notNull(),
+	},
+	(table) => ({
+		availableIdx: index("outbox_messages_available_idx").on(
+			table.status,
+			table.availableAt,
+		),
+		lockedIdx: index("outbox_messages_locked_idx").on(
+			table.status,
+			table.lockedUntil,
+		),
+	}),
+);
 `,
-  productionDrizzleTodoRepository: `import { count, desc, eq } from "drizzle-orm";
+  productionDrizzleTodoRepository: `import { offsetPageResult } from "@beignet/core/pagination";
+import { count, desc, eq } from "drizzle-orm";
 import type { DrizzleTursoDatabase } from "@beignet/provider-drizzle-turso";
-import type { TodoRepository } from "@/features/todos/ports";
+import type {
+	TodoAttachmentRepository,
+	TodoRepository,
+} from "@/features/todos/ports";
 import type {
 	CreateTodoInput,
-	ListTodosInput,
 	Todo,
 } from "@/features/todos/use-cases/schemas";
 import * as schema from "@/infra/db/schema";
@@ -1667,19 +1931,16 @@ export function createDrizzleTodoRepository(
 	db: DrizzleTursoDatabase<typeof schema>,
 ): TodoRepository {
 	return {
-		async list(input: ListTodosInput) {
+		async list(page) {
 			const rows = await db
 				.select()
 				.from(schema.todos)
 				.orderBy(desc(schema.todos.createdAt))
-				.limit(input.limit)
-				.offset(input.offset);
+				.limit(page.limit)
+				.offset(page.offset);
 			const [{ total }] = await db.select({ total: count() }).from(schema.todos);
 
-			return {
-				todos: rows.map(toTodo),
-				total,
-			};
+			return offsetPageResult(rows.map(toTodo), page, total);
 		},
 		async findById(id: string) {
 			const [row] = await db
@@ -1707,19 +1968,428 @@ export function createDrizzleTodoRepository(
 		},
 	};
 }
+
+export function createDrizzleTodoAttachmentRepository(
+	db: DrizzleTursoDatabase<typeof schema>,
+): TodoAttachmentRepository {
+	return {
+		async create(input) {
+			const attachment = {
+				...input,
+				createdAt: new Date().toISOString(),
+			};
+			const [row] = await db
+				.insert(schema.todoAttachments)
+				.values(attachment)
+				.returning();
+
+			if (!row) {
+				throw new Error("Failed to create todo attachment");
+			}
+
+			return {
+				id: row.id,
+				todoId: row.todoId,
+				key: row.key,
+				fileName: row.fileName,
+				contentType: row.contentType,
+				size: row.size,
+				createdAt: row.createdAt,
+			};
+		},
+		async findMany(todoId) {
+			const rows = await db
+				.select()
+				.from(schema.todoAttachments)
+				.where(eq(schema.todoAttachments.todoId, todoId))
+				.orderBy(desc(schema.todoAttachments.createdAt));
+
+			return rows.map((row) => ({
+				id: row.id,
+				todoId: row.todoId,
+				key: row.key,
+				fileName: row.fileName,
+				contentType: row.contentType,
+				size: row.size,
+				createdAt: row.createdAt,
+			}));
+		},
+	};
+}
 `,
   productionDbRepositories: `import type { DrizzleTursoDatabase } from "@beignet/provider-drizzle-turso";
-import { createDrizzleTodoRepository } from "@/infra/todos/drizzle-todo-repository";
+import {
+	createDrizzleTodoAttachmentRepository,
+	createDrizzleTodoRepository,
+} from "@/infra/todos/drizzle-todo-repository";
 import type { AppTransactionPorts } from "@/ports";
 import * as schema from "./schema";
 
 export function createRepositories(
 	db: DrizzleTursoDatabase<typeof schema>,
-): Omit<AppTransactionPorts, "events"> {
+): Omit<AppTransactionPorts, "audit" | "events" | "jobs" | "outbox"> {
 	return {
+		todoAttachments: createDrizzleTodoAttachmentRepository(db),
 		todos: createDrizzleTodoRepository(db),
 	};
 }
+`,
+  productionDrizzleAuditLog: `import type { AuditLogEntry, AuditLogPort } from "@beignet/core/ports";
+import {
+	normalizeAuditLogEntry,
+	redactAuditLogEntry,
+} from "@beignet/core/ports";
+import type { DrizzleTursoDatabase } from "@beignet/provider-drizzle-turso";
+import * as schema from "@/infra/db/schema";
+
+function serialize(value: unknown): string | null {
+	return value === undefined ? null : JSON.stringify(value);
+}
+
+export function createDrizzleAuditLog(
+	db: DrizzleTursoDatabase<typeof schema>,
+): AuditLogPort {
+	return {
+		async record(input) {
+			const entry: AuditLogEntry = redactAuditLogEntry(
+				normalizeAuditLogEntry(input),
+			);
+
+			await db.insert(schema.auditLog).values({
+				id: crypto.randomUUID(),
+				action: entry.action,
+				actorType: entry.actor.type,
+				actorId: entry.actor.id ?? null,
+				actorDisplayName: entry.actor.displayName ?? null,
+				tenantId: entry.tenant?.id ?? null,
+				tenantSlug: entry.tenant?.slug ?? null,
+				resourceType: entry.resource?.type ?? null,
+				resourceId: entry.resource?.id ?? null,
+				resourceName: entry.resource?.name ?? null,
+				outcome: entry.outcome,
+				requestId: entry.requestId ?? null,
+				traceId: entry.traceId ?? null,
+				message: entry.message ?? null,
+				metadata: serialize(entry.metadata),
+				actorMetadata: serialize(entry.actor.metadata),
+				tenantMetadata: serialize(entry.tenant?.metadata),
+				resourceMetadata: serialize(entry.resource?.metadata),
+				occurredAt: entry.occurredAt.toISOString(),
+			});
+		},
+	};
+}
+`,
+  productionDbBootstrap: `import { createDrizzleTursoOutboxSetupStatements } from "@beignet/provider-drizzle-turso";
+import type { Client } from "@libsql/client";
+
+type BootstrapOptions = {
+	seed?: boolean;
+};
+
+const setupStatements = [
+	\`CREATE TABLE IF NOT EXISTS user (
+		id text PRIMARY KEY NOT NULL,
+		name text NOT NULL,
+		email text NOT NULL UNIQUE,
+		email_verified integer DEFAULT false NOT NULL,
+		image text,
+		created_at integer NOT NULL,
+		updated_at integer NOT NULL
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS session (
+		id text PRIMARY KEY NOT NULL,
+		expires_at integer NOT NULL,
+		token text NOT NULL UNIQUE,
+		created_at integer NOT NULL,
+		updated_at integer NOT NULL,
+		ip_address text,
+		user_agent text,
+		user_id text NOT NULL REFERENCES user(id) ON DELETE cascade
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS account (
+		id text PRIMARY KEY NOT NULL,
+		account_id text NOT NULL,
+		provider_id text NOT NULL,
+		user_id text NOT NULL REFERENCES user(id) ON DELETE cascade,
+		access_token text,
+		refresh_token text,
+		id_token text,
+		access_token_expires_at integer,
+		refresh_token_expires_at integer,
+		scope text,
+		password text,
+		created_at integer NOT NULL,
+		updated_at integer NOT NULL
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS verification (
+		id text PRIMARY KEY NOT NULL,
+		identifier text NOT NULL,
+		value text NOT NULL,
+		expires_at integer NOT NULL,
+		created_at integer,
+		updated_at integer
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS todos (
+		id text PRIMARY KEY NOT NULL,
+		title text NOT NULL,
+		completed integer DEFAULT false NOT NULL,
+		created_at text NOT NULL
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS todo_attachments (
+		id text PRIMARY KEY NOT NULL,
+		todo_id text NOT NULL REFERENCES todos(id) ON DELETE cascade,
+		key text NOT NULL,
+		file_name text NOT NULL,
+		content_type text NOT NULL,
+		size integer NOT NULL,
+		created_at text NOT NULL
+	)\`,
+	"CREATE INDEX IF NOT EXISTS todo_attachments_todo_idx ON todo_attachments (todo_id, created_at)",
+	"CREATE INDEX IF NOT EXISTS todo_attachments_key_idx ON todo_attachments (key)",
+	\`CREATE TABLE IF NOT EXISTS audit_log (
+		id text PRIMARY KEY NOT NULL,
+		action text NOT NULL,
+		actor_type text NOT NULL,
+		actor_id text,
+		actor_display_name text,
+		tenant_id text,
+		tenant_slug text,
+		resource_type text,
+		resource_id text,
+		resource_name text,
+		outcome text DEFAULT 'success' NOT NULL,
+		request_id text,
+		trace_id text,
+		message text,
+		metadata text,
+		actor_metadata text,
+		tenant_metadata text,
+		resource_metadata text,
+		occurred_at text NOT NULL
+	)\`,
+	"CREATE INDEX IF NOT EXISTS audit_log_action_idx ON audit_log (action)",
+	"CREATE INDEX IF NOT EXISTS audit_log_actor_idx ON audit_log (actor_type, actor_id)",
+	"CREATE INDEX IF NOT EXISTS audit_log_occurred_at_idx ON audit_log (occurred_at)",
+	"CREATE INDEX IF NOT EXISTS audit_log_request_idx ON audit_log (request_id)",
+	"CREATE INDEX IF NOT EXISTS audit_log_resource_idx ON audit_log (resource_type, resource_id)",
+	"CREATE INDEX IF NOT EXISTS audit_log_tenant_idx ON audit_log (tenant_id)",
+	...createDrizzleTursoOutboxSetupStatements(),
+];
+
+const seedTodos = [
+	{
+		id: "00000000-0000-4000-8000-000000000001",
+		title: "Review the starter boundaries",
+		completed: 0,
+		createdAt: "2026-01-01T00:00:00.000Z",
+	},
+	{
+		id: "00000000-0000-4000-8000-000000000002",
+		title: "Create your first feature",
+		completed: 0,
+		createdAt: "2026-01-01T00:05:00.000Z",
+	},
+] as const;
+
+const resetTables = [
+	"verification",
+	"account",
+	"session",
+	"user",
+	"todo_attachments",
+	"todos",
+	"audit_log",
+	"outbox_messages",
+] as const;
+
+export async function ensureStarterDatabase(
+	client: Client,
+	options: BootstrapOptions = {},
+): Promise<void> {
+	for (const statement of setupStatements) {
+		await client.execute(statement);
+	}
+
+	if (options.seed === false) return;
+
+	const result = await client.execute("SELECT count(*) as total FROM todos");
+	const total = Number(result.rows[0]?.total ?? 0);
+	if (total > 0) return;
+
+	for (const todo of seedTodos) {
+		await client.execute({
+			sql: "INSERT INTO todos (id, title, completed, created_at) VALUES (?, ?, ?, ?)",
+			args: [todo.id, todo.title, todo.completed, todo.createdAt],
+		});
+	}
+}
+
+export async function resetStarterDatabase(client: Client): Promise<void> {
+	await client.execute("PRAGMA foreign_keys = OFF");
+	try {
+		for (const table of resetTables) {
+			await client.execute(\`DROP TABLE IF EXISTS \${table}\`);
+		}
+	} finally {
+		await client.execute("PRAGMA foreign_keys = ON");
+	}
+	await ensureStarterDatabase(client, { seed: false });
+}
+`,
+  productionDbProvider: `import { registerListeners } from "@beignet/core/events";
+import { createMemoryIdempotencyStore } from "@beignet/core/idempotency";
+import { createInlineJobDispatcher } from "@beignet/core/jobs";
+import { createMemoryMailer } from "@beignet/core/mail";
+import { createInlineNotificationDispatcher } from "@beignet/core/notifications";
+import {
+	createOutboxEventRecorder,
+	createOutboxJobDispatcher,
+} from "@beignet/core/outbox";
+import {
+	createSystemActor,
+	createTenant,
+} from "@beignet/core/ports";
+import {
+	createProvider,
+	createProviderInstrumentation,
+} from "@beignet/core/providers";
+import {
+	createDevtoolsAuditLog,
+	createDevtoolsTraceContext,
+	type DevtoolsPort,
+} from "@beignet/devtools";
+import {
+	createDrizzleTursoOutboxPort,
+	createDrizzleTursoUnitOfWork,
+	type DbPort,
+} from "@beignet/provider-drizzle-turso";
+import { createInMemoryEventBus } from "@beignet/provider-event-bus-memory";
+import type { AppContext } from "@/app-context";
+import { todoListeners } from "@/features/todos/listeners";
+import { createDrizzleAuditLog } from "@/infra/audit/drizzle-audit-log";
+import type { AppPorts } from "@/ports";
+import { ensureStarterDatabase } from "./bootstrap";
+import { createRepositories } from "./repositories";
+import type * as schema from "./schema";
+
+export const starterDatabaseProvider = createProvider({
+	name: "starter-database",
+
+	async setup({ ports }) {
+		const dbPort = (ports as { db: DbPort<typeof schema> }).db;
+		const devtools = (ports as { devtools?: DevtoolsPort }).devtools;
+		if (!dbPort) {
+			throw new Error(
+				"starterDatabaseProvider requires a db port. Register createDrizzleTursoProvider({ schema }) before it.",
+			);
+		}
+
+		let currentPorts: AppContext["ports"] | undefined;
+		const createBackgroundContext = (): AppContext => {
+			if (!currentPorts) {
+				throw new Error("Starter background context is not ready.");
+			}
+
+			const actor = createSystemActor("starter-background");
+			const tenant = createTenant("tenant_default");
+			const traceContext = createDevtoolsTraceContext();
+
+			return {
+				actor,
+				auth: null,
+				gate: currentPorts.gate.bind({ actor, auth: null }),
+				requestId: crypto.randomUUID(),
+				...traceContext,
+				ports: currentPorts,
+				tenant,
+			};
+		};
+
+		const mailInstrumentation = createProviderInstrumentation(ports, {
+			providerName: "memory-mailer",
+			watcher: "mail",
+		});
+		const eventBus = createInMemoryEventBus({
+			instrumentation: ports,
+			onHandlerError(error: unknown, eventName: string) {
+				console.error("Event handler failed", { error, eventName });
+			},
+		});
+		const jobs = createInlineJobDispatcher<AppContext>({
+			ctx: createBackgroundContext,
+		});
+		const notifications = createInlineNotificationDispatcher<AppContext>({
+			ctx: createBackgroundContext,
+			instrumentation: ports,
+		});
+		const mailer = createMemoryMailer({
+			defaultFrom: "Beignet Starter <noreply@example.local>",
+			onSend(delivery) {
+				mailInstrumentation.custom({
+					name: "mail.sent",
+					label: "Mail sent",
+					summary: delivery.message.subject,
+					details: {
+						to: delivery.message.to,
+						subject: delivery.message.subject,
+						id: delivery.id,
+					},
+				});
+			},
+		});
+		const audit = createDevtoolsAuditLog({
+			audit: createDrizzleAuditLog(dbPort.db),
+			devtools,
+		});
+		const repositories = createRepositories(dbPort.db);
+		const idempotency = createMemoryIdempotencyStore();
+		const outbox = createDrizzleTursoOutboxPort(dbPort.db);
+		const unregisterListeners = registerListeners(eventBus, todoListeners, {
+			ctx: createBackgroundContext,
+			onError(error, listener) {
+				console.error("Event listener failed", {
+					error,
+					listenerName: listener.name,
+				});
+			},
+		});
+
+		return {
+			ports: {
+				audit,
+				...repositories,
+				eventBus,
+				idempotency,
+				jobs,
+				mailer,
+				notifications,
+				outbox,
+				uow: createDrizzleTursoUnitOfWork({
+					db: dbPort.db,
+					createTransactionPorts: (tx) => {
+						const txOutbox = createDrizzleTursoOutboxPort(tx);
+
+						return {
+							audit: createDrizzleAuditLog(tx),
+							...createRepositories(tx),
+							events: createOutboxEventRecorder(txOutbox),
+							jobs: createOutboxJobDispatcher(txOutbox),
+							outbox: txOutbox,
+						};
+					},
+				}),
+			} satisfies Partial<AppPorts>,
+			async start(ctx) {
+				await ensureStarterDatabase(dbPort.client);
+				currentPorts = ctx.ports as AppContext["ports"];
+			},
+			stop() {
+				unregisterListeners();
+			},
+		};
+	},
+});
 `,
   productionContractsTodos: `import { createContractGroup } from "@beignet/core/contracts";
 import { z } from "zod";
@@ -1827,6 +2497,12 @@ import { routes } from "./routes";
 export const server = await createNextServer({
 	ports: appPorts,
 	providers,
+	providerConfig: {
+		"drizzle-turso": {
+			DB_URL: env.TURSO_DB_URL,
+			DB_AUTH_TOKEN: env.TURSO_DB_AUTH_TOKEN,
+		},
+	},
 	hooks: [
 		createDevtoolsHooks<AppContext>({
 			requestIdHeader: "x-request-id",
@@ -1876,19 +2552,21 @@ import {
 	createTenant,
 	createUserActor,
 } from "@beignet/core/ports";
-import { createDrizzleTursoUnitOfWork } from "@beignet/provider-drizzle-turso";
 import type { AppContext } from "@/app-context";
 import { appPorts } from "@/infra/app-ports";
-import * as schema from "@/infra/db/schema";
-import { createRepositories } from "@/infra/db/repositories";
 import { env } from "@/lib/env";
-import type { AppTransactionPorts } from "@/ports";
 import { providers } from "./providers";
 import { routes } from "./routes";
 
 export const server = await createNextServer({
 	ports: appPorts,
 	providers,
+	providerConfig: {
+		"drizzle-turso": {
+			DB_URL: env.TURSO_DB_URL,
+			DB_AUTH_TOKEN: env.TURSO_DB_AUTH_TOKEN,
+		},
+	},
 	hooks: [
 		createDevtoolsHooks<AppContext>({
 			requestIdHeader: "x-request-id",
@@ -1897,7 +2575,6 @@ export const server = await createNextServer({
 	createContext: async ({ req, ports }) => {
 		const auth = await ports.auth.getSession(req);
 		const tenantId = req.headers.get("x-tenant-id") || undefined;
-		const repositories = createRepositories(ports.db.db);
 
 		const context = {
 			requestId: req.headers.get("x-request-id") ?? crypto.randomUUID(),
@@ -1905,16 +2582,7 @@ export const server = await createNextServer({
 				? createUserActor(auth.user.id, { displayName: auth.user.name })
 				: createAnonymousActor(),
 			auth,
-			ports: {
-				...ports,
-				...repositories,
-				uow: createDrizzleTursoUnitOfWork<typeof schema, AppTransactionPorts>({
-					db: ports.db.db,
-					createTransactionPorts: (tx) => ({
-						...createRepositories(tx),
-					}),
-				}),
-			},
+			ports,
 			tenant: tenantId ? createTenant(tenantId) : undefined,
 		};
 
@@ -1990,12 +2658,492 @@ export const GET = createOpenAPIHandler(server.contracts, {
 	title: "Beignet starter API",
 	version: "0.1.0",
 });
+`,
+  productionAuthRoute: `import { toNextJsHandler } from "better-auth/next-js";
+import { auth } from "@/lib/better-auth";
+
+export const { GET, POST } = toNextJsHandler(auth);
+`,
+  productionBetterAuth: `import { createClient } from "@libsql/client";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { drizzle } from "drizzle-orm/libsql";
+import * as schema from "@/infra/db/schema";
+import { ensureStarterDatabase } from "@/infra/db/bootstrap";
+import { env } from "@/lib/env";
+
+const client = createClient({
+	url: env.TURSO_DB_URL,
+	authToken: env.TURSO_DB_AUTH_TOKEN,
+});
+
+await ensureStarterDatabase(client);
+
+const db = drizzle(client, { schema });
+
+const trustedOrigins = [
+	env.APP_URL,
+	env.BETTER_AUTH_URL,
+	...(env.BETTER_AUTH_TRUSTED_ORIGINS?.split(",")
+		.map((origin) => origin.trim())
+		.filter(Boolean) ?? []),
+];
+
+export const auth = betterAuth({
+	baseURL: env.BETTER_AUTH_URL,
+	secret: env.BETTER_AUTH_SECRET,
+	trustedOrigins: [...new Set(trustedOrigins)],
+	database: drizzleAdapter(db, {
+		provider: "sqlite",
+		schema,
+	}),
+	emailAndPassword: {
+		enabled: true,
+	},
+});
+`,
+  productionDbSeed: `import { createClient } from "@libsql/client";
+import { ensureStarterDatabase } from "@/infra/db/bootstrap";
+import { env } from "@/lib/env";
+
+const client = createClient({
+	url: env.TURSO_DB_URL,
+	authToken: env.TURSO_DB_AUTH_TOKEN,
+});
+
+try {
+	await ensureStarterDatabase(client, { seed: true });
+	console.log("Database seeded.");
+} finally {
+	client.close();
+}
+`,
+  productionDbReset: `import { createClient } from "@libsql/client";
+import { resetStarterDatabase } from "@/infra/db/bootstrap";
+import { env } from "@/lib/env";
+
+if (!env.TURSO_DB_URL.startsWith("file:") && process.env.BEIGNET_ALLOW_DATABASE_RESET !== "true") {
+	throw new Error(
+		"Refusing to reset a non-local database. Set BEIGNET_ALLOW_DATABASE_RESET=true if this is intentional.",
+	);
+}
+
+const client = createClient({
+	url: env.TURSO_DB_URL,
+	authToken: env.TURSO_DB_AUTH_TOKEN,
+});
+
+try {
+	await resetStarterDatabase(client);
+	console.log("Database reset.");
+} finally {
+	client.close();
+}
+`,
+  productionAuditHelper: `import type { AuditLogEntryInput } from "@beignet/core/ports";
+import type { AppContext } from "@/app-context";
+
+export function auditEntry(
+	ctx: AppContext,
+	entry: Omit<
+		AuditLogEntryInput,
+		"actor" | "tenant" | "requestId" | "traceId"
+	>,
+): AuditLogEntryInput {
+	return {
+		...entry,
+		actor: ctx.actor,
+		tenant: ctx.tenant,
+		requestId: ctx.requestId,
+		traceId: ctx.traceId,
+	};
+}
+`,
+  productionTodoEvents: `import { defineEvent } from "@beignet/core/events";
+import { z } from "zod";
+
+export const TodoCreated = defineEvent("todos.created", {
+	payload: z.object({
+		todoId: z.string().uuid(),
+		title: z.string(),
+	}),
+});
+
+export const todoEvents = [TodoCreated] as const;
+`,
+  productionTodoJobs: `import { createJobHandlers, retry } from "@beignet/core/jobs";
+import { z } from "zod";
+import type { AppContext } from "@/app-context";
+import { auditEntry } from "@/lib/audit";
+
+const jobs = createJobHandlers<AppContext>();
+
+export const LogTodoCreatedJob = jobs.defineJob("todos.log-created", {
+	payload: z.object({
+		todoId: z.string().uuid(),
+		title: z.string(),
+	}),
+	retry: retry.exponential({
+		attempts: 3,
+		initialDelay: "1s",
+		maxDelay: "1m",
+	}),
+	async handle({ ctx, payload }) {
+		ctx.ports.logger.info("Todo created job handled", {
+			todoId: payload.todoId,
+		});
+		await ctx.ports.audit.record(
+			auditEntry(ctx, {
+				action: "jobs.todos.log-created",
+				resource: { type: "todo", id: payload.todoId, name: payload.title },
+				metadata: { jobName: "todos.log-created" },
+			}),
+		);
+	},
+});
+
+export const todoJobs = [LogTodoCreatedJob] as const;
+`,
+  productionTodoNotifications: `import {
+	createNotificationHandlers,
+	defineMailNotificationChannel,
+} from "@beignet/core/notifications";
+import { z } from "zod";
+import type { AppContext } from "@/app-context";
+
+const notifications = createNotificationHandlers<AppContext>();
+
+export const TodoCreatedNotification = notifications.defineNotification(
+	"todos.created",
+	{
+		payload: z.object({
+			todoId: z.string().uuid(),
+			title: z.string(),
+		}),
+		channels: {
+			email: defineMailNotificationChannel(({ payload }) => ({
+				to: "ops@example.local",
+				subject: \`Todo created: \${payload.title}\`,
+				text: \`Todo \${payload.todoId} was created.\`,
+			})),
+		},
+	},
+);
+`,
+  productionTodoListeners: `import { createEventHandlers } from "@beignet/core/events";
+import type { AppContext } from "@/app-context";
+import { TodoCreated } from "@/features/todos/domain/events";
+import { LogTodoCreatedJob } from "@/features/todos/jobs";
+import { TodoCreatedNotification } from "@/features/todos/notifications";
+import { auditEntry } from "@/lib/audit";
+
+const listeners = createEventHandlers<AppContext>();
+
+export const enqueueTodoCreatedWork = listeners.defineListener(TodoCreated, {
+	name: "todos.enqueue-created-work",
+	async handle({ ctx, payload }) {
+		await ctx.ports.jobs.dispatch(LogTodoCreatedJob, payload);
+		await ctx.ports.notifications.send(TodoCreatedNotification, payload);
+		await ctx.ports.audit.record(
+			auditEntry(ctx, {
+				action: "listeners.todos.enqueue-created-work",
+				resource: { type: "todo", id: payload.todoId, name: payload.title },
+				metadata: {
+					eventName: TodoCreated.name,
+					jobName: LogTodoCreatedJob.name,
+					notificationName: TodoCreatedNotification.name,
+				},
+			}),
+		);
+	},
+});
+
+export const todoListeners = [enqueueTodoCreatedWork] as const;
+`,
+  productionTodoSchedules: `import { normalizeOffsetPage } from "@beignet/core/pagination";
+import { createScheduleHandlers } from "@beignet/core/schedules";
+import { z } from "zod";
+import type { AppContext } from "@/app-context";
+import { auditEntry } from "@/lib/audit";
+
+const schedules = createScheduleHandlers<AppContext>();
+
+export const LogDailyTodoSummarySchedule = schedules.defineSchedule(
+	"todos.log-daily-summary",
+	{
+		cron: "0 9 * * *",
+		timezone: "America/Chicago",
+		payload: z.object({
+			date: z.string(),
+		}),
+		createPayload({ run }) {
+			const date = run.scheduledAt ?? run.triggeredAt;
+			return { date: date.toISOString().slice(0, 10) };
+		},
+		async handle({ ctx, payload, run }) {
+			const { page } = await ctx.ports.todos.list(
+				normalizeOffsetPage(
+					{ limit: 1, offset: 0 },
+					{ defaultLimit: 1, maxLimit: 1 },
+				),
+			);
+			ctx.ports.logger.info("Daily todo summary schedule handled", {
+				date: payload.date,
+				todoCount: page.total,
+			});
+			await ctx.ports.audit.record(
+				auditEntry(ctx, {
+					action: "schedules.todos.daily-summary",
+					resource: {
+						type: "schedule",
+						id: "todos.log-daily-summary",
+						name: "Daily todo summary",
+					},
+					metadata: {
+						date: payload.date,
+						todoCount: page.total,
+						source: run.source ?? "inline",
+						triggeredAt: run.triggeredAt.toISOString(),
+					},
+				}),
+			);
+		},
+	},
+);
+
+export const todoSchedules = [LogDailyTodoSummarySchedule] as const;
+`,
+  productionTodoUploads: `import { defineUpload, defineUploads } from "@beignet/core/uploads";
+import { z } from "zod";
+import type { AppContext } from "@/app-context";
+import { auditEntry } from "@/lib/audit";
+
+const todoAttachmentMetadataSchema = z.object({
+	todoId: z.string().uuid(),
+});
+
+export const TodoAttachmentUpload = defineUpload<
+	"todos.attachment",
+	typeof todoAttachmentMetadataSchema,
+	AppContext,
+	{ attachmentIds: string[] }
+>("todos.attachment", {
+	metadata: todoAttachmentMetadataSchema,
+	file: {
+		contentTypes: ["application/pdf", "text/plain", "text/plain;charset=utf-8"],
+		maxSizeBytes: 5 * 1024 * 1024,
+		maxFiles: 3,
+		visibility: "private",
+		cacheControl: "private, max-age=0",
+	},
+	authorize({ ctx }) {
+		return ctx.actor.type === "user"
+			? true
+			: {
+					allowed: false,
+					reason: "You must be signed in to upload todo attachments.",
+				};
+	},
+	key({ ctx, metadata, file, uploadId }) {
+		const tenantId = ctx.tenant?.id ?? "tenant_default";
+		const extension = file.name.includes(".")
+			? file.name.split(".").pop()
+			: undefined;
+		const suffix = extension ? \`.\${extension}\` : "";
+		return \`todos/\${tenantId}/\${metadata.todoId}/attachments/\${uploadId}\${suffix}\`;
+	},
+	storageMetadata({ ctx, metadata }) {
+		return {
+			tenantId: ctx.tenant?.id ?? "tenant_default",
+			todoId: metadata.todoId,
+		};
+	},
+	async onComplete({ ctx, metadata, files }) {
+		const attachments = await Promise.all(
+			files.map((file) =>
+				ctx.ports.todoAttachments.create({
+					id: file.uploadId,
+					todoId: metadata.todoId,
+					key: file.key,
+					fileName: file.name,
+					contentType: file.contentType,
+					size: file.object.size,
+				}),
+			),
+		);
+		await ctx.ports.audit.record(
+			auditEntry(ctx, {
+				action: "todos.attachment.upload",
+				resource: { type: "todo", id: metadata.todoId },
+				metadata: {
+					attachmentCount: attachments.length,
+					keys: attachments.map((attachment) => attachment.key),
+				},
+			}),
+		);
+
+		return {
+			attachmentIds: attachments.map((attachment) => attachment.id),
+		};
+	},
+});
+
+export const todoUploads = defineUploads({
+	todoAttachment: TodoAttachmentUpload,
+});
+`,
+  productionOutbox: `import { defineOutboxRegistry } from "@beignet/core/outbox";
+import { todoEvents } from "@/features/todos/domain/events";
+import { todoJobs } from "@/features/todos/jobs";
+
+export const outboxRegistry = defineOutboxRegistry({
+	events: todoEvents,
+	jobs: todoJobs,
+});
+`,
+  productionOutboxDrainRoute: `import { createOutboxDrainRoute } from "@beignet/next";
+import { env } from "@/lib/env";
+import { server } from "@/server";
+import { outboxRegistry } from "@/server/outbox";
+
+export const runtime = "nodejs";
+
+export const { GET, POST } = createOutboxDrainRoute({
+	server,
+	registry: outboxRegistry,
+	secret: env.CRON_SECRET,
+});
+`,
+  productionScheduleRoute: `import { createInlineScheduleRunner } from "@beignet/core/schedules";
+import type { AppContext } from "@/app-context";
+import { LogDailyTodoSummarySchedule } from "@/features/todos/schedules";
+import { env } from "@/lib/env";
+import { server } from "@/server";
+
+async function runDailyTodoSummary(request: Request) {
+	if (!env.CRON_SECRET) {
+		return Response.json(
+			{
+				ok: false,
+				error: "CRON_SECRET is not configured.",
+				scheduleName: LogDailyTodoSummarySchedule.name,
+			},
+			{ status: 500 },
+		);
+	}
+
+	if (request.headers.get("authorization") !== \`Bearer \${env.CRON_SECRET}\`) {
+		return Response.json({ error: "Unauthorized" }, { status: 401 });
+	}
+
+	const ctx = await server.createContextFromNext();
+	const runner = createInlineScheduleRunner<AppContext>({
+		ctx,
+		onStart({ run, schedule }) {
+			ctx.ports.devtools.record({
+				type: "schedule",
+				watcher: "schedules",
+				requestId: ctx.requestId,
+				traceId: ctx.traceId,
+				scheduleName: schedule.name,
+				status: "started",
+				cron: schedule.cron,
+				timezone: schedule.timezone,
+				details: {
+					source: run.source,
+					scheduledAt: run.scheduledAt?.toISOString(),
+				},
+			});
+		},
+		onSuccess({ run, schedule }) {
+			ctx.ports.devtools.record({
+				type: "schedule",
+				watcher: "schedules",
+				requestId: ctx.requestId,
+				traceId: ctx.traceId,
+				scheduleName: schedule.name,
+				status: "completed",
+				cron: schedule.cron,
+				timezone: schedule.timezone,
+				details: {
+					source: run.source,
+					scheduledAt: run.scheduledAt?.toISOString(),
+				},
+			});
+		},
+		onError({ error, run, schedule }) {
+			ctx.ports.devtools.record({
+				type: "schedule",
+				watcher: "schedules",
+				requestId: ctx.requestId,
+				traceId: ctx.traceId,
+				scheduleName: schedule.name,
+				status: "failed",
+				cron: schedule.cron,
+				timezone: schedule.timezone,
+				details: {
+					error,
+					source: run.source,
+					scheduledAt: run.scheduledAt?.toISOString(),
+				},
+			});
+			ctx.ports.logger.error("Daily todo summary schedule failed", {
+				error,
+				scheduleName: schedule.name,
+			});
+		},
+	});
+
+	try {
+		await runner.run(LogDailyTodoSummarySchedule, {
+			source: "starter-cron-route",
+		});
+	} catch {
+		return Response.json(
+			{
+				ok: false,
+				error: "Schedule failed",
+				scheduleName: LogDailyTodoSummarySchedule.name,
+			},
+			{ status: 500 },
+		);
+	}
+
+	return Response.json({
+		ok: true,
+		scheduleName: LogDailyTodoSummarySchedule.name,
+	});
+}
+
+export const GET = runDailyTodoSummary;
+export const POST = runDailyTodoSummary;
+`,
+  productionUploadsRoute: `import { createUploadRouter, uploadsFromRegistry } from "@beignet/core/uploads";
+import { createUploadRoute } from "@beignet/next";
+import type { AppContext } from "@/app-context";
+import { todoUploads } from "@/features/todos/uploads";
+import { server } from "@/server";
+
+const uploadRouter = createUploadRouter<AppContext>({
+	uploads: uploadsFromRegistry(todoUploads),
+	ctx: () => server.createContextFromNext(),
+	storage: server.ports.storage,
+	instrumentation: server.ports.devtools,
+});
+
+export const { POST } = createUploadRoute(uploadRouter);
+`,
+  productionUploadClient: `import { createUploadClient } from "@beignet/core/uploads/client";
+import type { todoUploads } from "@/features/todos/uploads";
+
+export const uploads = createUploadClient<typeof todoUploads>({
+	baseUrl: "/api/uploads",
+});
 `,
 };
 
 function productionProviderPortImports(ctx: TemplateContext): string[] {
   const imports: string[] = [];
-  if (hasIntegration(ctx, "inngest")) imports.push("\tJobDispatcherPort,");
   if (hasIntegration(ctx, "upstash-rate-limit")) {
     imports.push("\tRateLimitPort,");
   }
@@ -2004,8 +3152,6 @@ function productionProviderPortImports(ctx: TemplateContext): string[] {
 
 function productionProviderPortFields(ctx: TemplateContext): string[] {
   const fields: string[] = [];
-  if (hasIntegration(ctx, "inngest")) fields.push("\tjobs: JobDispatcherPort;");
-  if (hasIntegration(ctx, "resend")) fields.push("\tmailer: MailerPort;");
   if (hasIntegration(ctx, "upstash-rate-limit")) {
     fields.push("\trateLimit: RateLimitPort;");
   }
@@ -2013,34 +3159,53 @@ function productionProviderPortFields(ctx: TemplateContext): string[] {
 }
 
 function productionPorts(ctx: TemplateContext): string {
-  const mailImport = hasIntegration(ctx, "resend")
-    ? 'import type { MailerPort } from "@beignet/core/mail";\n'
-    : "";
+  const mailImport = 'import type { MailerPort } from "@beignet/core/mail";\n';
   const imports = [
+    "\tAuditLogPort,",
     "\tBoundGate,",
+    "\tEventBusPort,",
     "\tGatePort,",
+    "\tJobDispatcherPort,",
     "\tLoggerPort,",
     ...productionProviderPortImports(ctx),
+    "\tStoragePort,",
     "\tUnitOfWorkPort,",
   ];
   const providerFields = productionProviderPortFields(ctx);
 
-  return `import type {
+  return `import type { IdempotencyPort } from "@beignet/core/idempotency";
+${mailImport}import type { NotificationPort } from "@beignet/core/notifications";
+import type { OutboxPort } from "@beignet/core/outbox";
+import type {
 ${imports.join("\n")}
 } from "@beignet/core/ports";
-${mailImport}import type { AuthorizationContext, todoPolicy } from "@/features/todos/policy";
+import type { AuthorizationContext, todoPolicy } from "@/features/todos/policy";
 import type { AuthPort } from "./auth";
-import type { TodoRepository } from "@/features/todos/ports";
+import type { TodoAttachmentRepository, TodoRepository } from "@/features/todos/ports";
 
 export type AppTransactionPorts = {
+	audit: AuditLogPort;
+	events: import("@beignet/core/ports").BufferedDomainEventRecorder;
+	jobs: JobDispatcherPort;
+	outbox: OutboxPort;
+	todoAttachments: TodoAttachmentRepository;
 	todos: TodoRepository;
 };
 
 export type AppGate = BoundGate<[typeof todoPolicy]>;
 
 export type AppPorts = {
+	audit: AuditLogPort;
 	auth: AuthPort;
+	eventBus: EventBusPort;
 	gate: GatePort<AuthorizationContext, [typeof todoPolicy]>;
+	idempotency: IdempotencyPort;
+	jobs: JobDispatcherPort;
+	mailer: MailerPort;
+	notifications: NotificationPort;
+	outbox: OutboxPort;
+	storage: StoragePort;
+	todoAttachments: TodoAttachmentRepository;
 	todos: TodoRepository;
 	logger: LoggerPort;
 ${providerFields.length > 0 ? `${providerFields.join("\n")}\n` : ""}	uow: UnitOfWorkPort<AppTransactionPorts>;
@@ -2049,37 +3214,59 @@ ${providerFields.length > 0 ? `${providerFields.join("\n")}\n` : ""}	uow: UnitOf
 }
 
 function productionPortsWithDrizzleTurso(ctx: TemplateContext): string {
-  const mailImport = hasIntegration(ctx, "resend")
-    ? 'import type { MailerPort } from "@beignet/core/mail";\n'
-    : "";
+  const mailImport = 'import type { MailerPort } from "@beignet/core/mail";\n';
   const imports = [
+    "\tAuditLogPort,",
     "\tBoundGate,",
+    "\tEventBusPort,",
     "\tGatePort,",
+    "\tJobDispatcherPort,",
     "\tLoggerPort,",
     ...productionProviderPortImports(ctx),
+    "\tStoragePort,",
     "\tUnitOfWorkPort,",
   ];
   const providerFields = productionProviderPortFields(ctx);
 
-  return `import type {
+  return `import type { IdempotencyPort } from "@beignet/core/idempotency";
+${mailImport}import type { NotificationPort } from "@beignet/core/notifications";
+import type { OutboxPort } from "@beignet/core/outbox";
+import type {
 ${imports.join("\n")}
 } from "@beignet/core/ports";
-${mailImport}import type { DbPort } from "@beignet/provider-drizzle-turso";
-import * as schema from "@/infra/db/schema";
 import type { AuthorizationContext, todoPolicy } from "@/features/todos/policy";
 import type { AuthPort } from "./auth";
-import type { TodoRepository } from "@/features/todos/ports";
+import type { TodoAttachmentRepository, TodoRepository } from "@/features/todos/ports";
+
+export type AppDatabasePort = {
+	db: unknown;
+	client: unknown;
+};
 
 export type AppTransactionPorts = {
+	audit: AuditLogPort;
+	events: import("@beignet/core/ports").BufferedDomainEventRecorder;
+	jobs: JobDispatcherPort;
+	outbox: OutboxPort;
+	todoAttachments: TodoAttachmentRepository;
 	todos: TodoRepository;
 };
 
 export type AppGate = BoundGate<[typeof todoPolicy]>;
 
 export type AppPorts = {
+	audit: AuditLogPort;
 	auth: AuthPort;
-	db: DbPort<typeof schema>;
+	db: AppDatabasePort;
+	eventBus: EventBusPort;
 	gate: GatePort<AuthorizationContext, [typeof todoPolicy]>;
+	idempotency: IdempotencyPort;
+	jobs: JobDispatcherPort;
+	mailer: MailerPort;
+	notifications: NotificationPort;
+	outbox: OutboxPort;
+	storage: StoragePort;
+	todoAttachments: TodoAttachmentRepository;
 	todos: TodoRepository;
 	logger: LoggerPort;
 ${providerFields.length > 0 ? `${providerFields.join("\n")}\n` : ""}	uow: UnitOfWorkPort<AppTransactionPorts>;
@@ -2090,6 +3277,9 @@ ${providerFields.length > 0 ? `${providerFields.join("\n")}\n` : ""}	uow: UnitOf
 function productionServerProviders(ctx: TemplateContext): string {
   const imports = [
     'import { createDevtoolsProvider } from "@beignet/devtools";',
+    hasIntegration(ctx, "better-auth")
+      ? 'import { createAuthBetterAuthProvider } from "@beignet/provider-auth-better-auth";'
+      : undefined,
     hasDrizzleTurso(ctx)
       ? 'import { createDrizzleTursoProvider } from "@beignet/provider-drizzle-turso";'
       : undefined,
@@ -2107,6 +3297,13 @@ function productionServerProviders(ctx: TemplateContext): string {
     hasDrizzleTurso(ctx)
       ? 'import * as schema from "@/infra/db/schema";'
       : undefined,
+    hasIntegration(ctx, "better-auth")
+      ? 'import { auth } from "@/lib/better-auth";'
+      : undefined,
+    'import { starterDatabaseProvider } from "@/infra/db/provider";',
+    hasIntegration(ctx, "better-auth")
+      ? 'import type { AuthSessionMetadata, AuthUser } from "@/ports/auth";'
+      : undefined,
   ].filter((line): line is string => Boolean(line));
 
   const declarations = hasDrizzleTurso(ctx)
@@ -2114,9 +3311,13 @@ function productionServerProviders(ctx: TemplateContext): string {
     : "";
   const entries = [
     "\tcreateDevtoolsProvider(),",
+    hasIntegration(ctx, "better-auth")
+      ? "\tcreateAuthBetterAuthProvider<AuthUser, AuthSessionMetadata>(auth),"
+      : undefined,
     "\tlocalStorageProvider,",
     "\tloggerPinoProvider,",
     hasDrizzleTurso(ctx) ? "\tdrizzleTursoProvider," : undefined,
+    "\tstarterDatabaseProvider,",
     hasIntegration(ctx, "inngest") ? "\tinngestProvider," : undefined,
     hasIntegration(ctx, "resend") ? "\tmailResendProvider," : undefined,
     hasIntegration(ctx, "upstash-rate-limit")
@@ -2145,12 +3346,6 @@ function productionTodosTest(ctx: TemplateContext): string {
     hasDrizzleTurso(ctx)
       ? "\t\t\tdb: { db: undefined as never, client: undefined as never },"
       : undefined,
-    hasIntegration(ctx, "inngest")
-      ? "\t\t\tjobs: { dispatch: async () => undefined },"
-      : undefined,
-    hasIntegration(ctx, "resend")
-      ? '\t\t\tmailer: { send: async () => ({ provider: "test" }) },'
-      : undefined,
     hasIntegration(ctx, "upstash-rate-limit")
       ? "\t\t\trateLimit: createMemoryRateLimiter(),"
       : undefined,
@@ -2158,8 +3353,14 @@ function productionTodosTest(ctx: TemplateContext): string {
 
   return `import { describe, expect, it } from "bun:test";
 import { createUseCaseTester } from "@beignet/core/application";
+import { createMemoryIdempotencyStore } from "@beignet/core/idempotency";
+import { createMemoryMailer } from "@beignet/core/mail";
+import { createMemoryNotificationPort } from "@beignet/core/notifications";
+import { createMemoryOutbox } from "@beignet/core/outbox";
+import { offsetPageResult, type OffsetPage } from "@beignet/core/pagination";
 import { createInMemoryDevtools } from "@beignet/devtools";
-import { ${portImports.join(", ")} } from "@beignet/core/ports";
+import { createInMemoryEventBus } from "@beignet/provider-event-bus-memory";
+import { ${["createDomainEventRecorder", "createMemoryAuditLog", ...portImports].join(", ")} } from "@beignet/core/ports";
 import type { AppContext } from "@/app-context";
 import { appPorts } from "@/infra/app-ports";
 import {
@@ -2167,7 +3368,6 @@ import {
 	getTodoUseCase,
 	listTodosUseCase,
 	type CreateTodoInput,
-	type ListTodosInput,
 	type Todo,
 } from "../use-cases";
 
@@ -2175,15 +3375,16 @@ function createTestTodoRepository() {
 	const todos = new Map<string, Todo>();
 
 	return {
-		async list(input: ListTodosInput) {
+		async list(page: OffsetPage) {
 			const allTodos = Array.from(todos.values()).sort((left, right) =>
 				left.createdAt.localeCompare(right.createdAt),
 			);
 
-			return {
-				todos: allTodos.slice(input.offset, input.offset + input.limit),
-				total: allTodos.length,
-			};
+			return offsetPageResult(
+				allTodos.slice(page.offset, page.offset + page.limit),
+				page,
+				allTodos.length,
+			);
 		},
 		async findById(id: string) {
 			return todos.get(id) ?? null;
@@ -2201,9 +3402,39 @@ function createTestTodoRepository() {
 	};
 }
 
+function createTestTodoAttachmentRepository() {
+	return {
+		async create(input: {
+			id: string;
+			todoId: string;
+			key: string;
+			fileName: string;
+			contentType: string;
+			size: number;
+		}) {
+			return {
+				...input,
+				createdAt: new Date().toISOString(),
+			};
+		},
+		async findMany() {
+			return [];
+		},
+	};
+}
+
 describe("todos resource", () => {
 	it("creates, gets, and lists todos", async () => {
 		const todos = createTestTodoRepository();
+		const todoAttachments = createTestTodoAttachmentRepository();
+		const audit = createMemoryAuditLog();
+		const eventBus = createInMemoryEventBus();
+		const jobs = { dispatch: async () => undefined };
+		const mailer = createMemoryMailer({
+			defaultFrom: "Test <test@example.local>",
+		});
+		const notifications = createMemoryNotificationPort();
+		const outbox = createMemoryOutbox();
 		const auth = {
 			user: {
 				id: "user_test",
@@ -2217,11 +3448,26 @@ describe("todos resource", () => {
 		});
 		const testPorts = {
 			...appPorts,
+			audit,
+			eventBus,
+			idempotency: createMemoryIdempotencyStore(),
+			jobs,
+			mailer,
+			notifications,
+			outbox,
+			todoAttachments,
 			todos,
-${extraPorts.length > 0 ? `${extraPorts.join("\n")}\n` : ""}			uow: createNoopUnitOfWork(() => ({ todos })) as AppContext["ports"]["uow"],
+${extraPorts.length > 0 ? `${extraPorts.join("\n")}\n` : ""}			uow: createNoopUnitOfWork(() => ({
+				audit,
+				events: createDomainEventRecorder(),
+				jobs,
+				outbox,
+				todoAttachments,
+				todos,
+			})) as unknown as AppContext["ports"]["uow"],
 			devtools: createInMemoryDevtools(),
 			storage: createMemoryStorage(),
-		};
+		} as unknown as AppContext["ports"];
 		const tester = createUseCaseTester<AppContext>(() => ({
 			requestId: "test-request",
 			actor,
@@ -2245,8 +3491,8 @@ ${extraPorts.length > 0 ? `${extraPorts.join("\n")}\n` : ""}			uow: createNoopUn
 
 		expect(created.title).toBe("First todo");
 		expect(found.id).toBe(created.id);
-		expect(result.total).toBe(1);
-		expect(result.todos).toEqual([created]);
+		expect(result.page.total).toBe(1);
+		expect(result.items).toEqual([created]);
 	});
 });
 `;
@@ -2284,8 +3530,25 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
       path: "app/api/openapi/route.ts",
       content: files.productionOpenApiRoute,
     },
+    {
+      path: "app/api/auth/[...all]/route.ts",
+      content: files.productionAuthRoute,
+    },
+    {
+      path: "app/api/cron/outbox/drain/route.ts",
+      content: files.productionOutboxDrainRoute,
+    },
+    {
+      path: "app/api/cron/todos/daily-summary/route.ts",
+      content: files.productionScheduleRoute,
+    },
+    {
+      path: "app/api/uploads/[uploadName]/[action]/route.ts",
+      content: files.productionUploadsRoute,
+    },
     { path: "client/api-client.ts", content: files.apiClient },
     { path: "client/rq.ts", content: files.rq },
+    { path: "client/uploads.ts", content: files.productionUploadClient },
     {
       path: "features/todos/contracts.ts",
       content: files.productionContractsTodos,
@@ -2300,12 +3563,39 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
         : files.productionInfrastructurePorts,
     },
     { path: "lib/env.ts", content: files.productionEnv },
+    { path: "lib/audit.ts", content: files.productionAuditHelper },
     { path: "lib/auth.ts", content: files.productionAuthHelpers },
+    { path: "lib/better-auth.ts", content: files.productionBetterAuth },
     { path: "features/todos/policy.ts", content: files.productionTodoPolicy },
     {
-      path: "infra/auth/anonymous-auth.ts",
-      content: files.productionAnonymousAuth,
+      path: "features/todos/domain/events/index.ts",
+      content: files.productionTodoEvents,
+    },
+    { path: "features/todos/jobs/index.ts", content: files.productionTodoJobs },
+    {
+      path: "features/todos/listeners/index.ts",
+      content: files.productionTodoListeners,
+    },
+    {
+      path: "features/todos/notifications/index.ts",
+      content: files.productionTodoNotifications,
+    },
+    {
+      path: "features/todos/schedules/index.ts",
+      content: files.productionTodoSchedules,
     },
+    {
+      path: "features/todos/uploads/index.ts",
+      content: files.productionTodoUploads,
+    },
+    ...(!hasIntegration(ctx, "better-auth")
+      ? [
+          {
+            path: "infra/auth/anonymous-auth.ts",
+            content: files.productionAnonymousAuth,
+          },
+        ]
+      : []),
     { path: "ports/auth.ts", content: files.productionAuthPort },
     {
       path: "ports/index.ts",
@@ -2328,6 +3618,7 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
         : files.productionServer,
     },
     { path: "server/routes.ts", content: files.productionServerRoutes },
+    { path: "server/outbox.ts", content: files.productionOutbox },
     {
       path: "server/providers.ts",
       content: productionServerProviders(ctx),
@@ -2363,6 +3654,26 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
   if (usesDrizzleTurso) {
     templateFiles.push(
       { path: "drizzle.config.ts", content: files.productionDrizzleConfig },
+      {
+        path: "infra/audit/drizzle-audit-log.ts",
+        content: files.productionDrizzleAuditLog,
+      },
+      {
+        path: "infra/db/bootstrap.ts",
+        content: files.productionDbBootstrap,
+      },
+      {
+        path: "infra/db/seed.ts",
+        content: files.productionDbSeed,
+      },
+      {
+        path: "infra/db/reset.ts",
+        content: files.productionDbReset,
+      },
+      {
+        path: "infra/db/provider.ts",
+        content: files.productionDbProvider,
+      },
       {
         path: "infra/db/schema/index.ts",
         content: files.productionDbSchema,
@@ -2386,6 +3697,9 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
   return templateFiles;
 }
 
+/**
+ * Render all template files for a new Beignet app.
+ */
 export function getTemplateFiles(ctx: TemplateContext): TemplateFile[] {
   if (isStandardPreset(ctx)) {
     return getProductionTemplateFiles(ctx);