@beignet/cli 0.0.1 → 0.0.4

package/src/templates.ts

@@ -1,20 +1,34 @@
-export type PackageManager = "bun" | "npm" | "pnpm" | "yarn";
-export type PresetName = "minimal" | "standard";
-export type TemplateName = "next";
-export type FeatureName = "client" | "react-query" | "forms" | "openapi";
-export type IntegrationName =
-  | "better-auth"
-  | "drizzle-turso"
-  | "inngest"
-  | "pino"
-  | "resend"
-  | "upstash-rate-limit";
-
+import type {
+  FeatureName,
+  IntegrationName,
+  PackageManager,
+  PresetName,
+} from "./choices.js";
+
+export type {
+  FeatureName,
+  IntegrationName,
+  PackageManager,
+  PresetName,
+  TemplateName,
+} from "./choices.js";
+export {
+  featureChoices,
+  integrationChoices,
+  presetChoices,
+} from "./choices.js";
+
+/**
+ * One generated file emitted by the template generator.
+ */
 export type TemplateFile = {
   path: string;
   content: string;
 };
 
+/**
+ * Inputs used to render app template files.
+ */
 export type TemplateContext = {
   name: string;
   packageManager: PackageManager;
@@ -37,9 +51,9 @@ const externalVersions = {
   tanstackReactQuery: "^5.100.7",
   hookformResolvers: "^5.0.0",
   reactHookForm: "^7.74.0",
-  betterAuth: "^1.3.26",
-  drizzleKit: "^0.30.0",
-  drizzleOrm: "^0.38.0",
+  betterAuth: "1.6.11",
+  drizzleKit: "^0.31.10",
+  drizzleOrm: "^0.45.2",
   inngest: "^3.0.0",
   libsqlClient: "^0.14.0",
   pino: "^9.7.0",
@@ -59,37 +73,16 @@ function hasDrizzleTurso(ctx: TemplateContext): boolean {
 function packageRunner(ctx: TemplateContext): string {
   switch (ctx.packageManager) {
     case "npm":
-      return "npx -p @beignet/cli beignet";
+      return "npm run beignet --";
     case "pnpm":
-      return "pnpm dlx @beignet/cli beignet";
+      return "pnpm beignet";
     case "yarn":
-      return "yarn dlx @beignet/cli beignet";
+      return "yarn beignet";
     default:
-      return "bunx -p @beignet/cli beignet";
+      return "bun beignet";
   }
 }
 
-export const featureChoices = [
-  "client",
-  "react-query",
-  "forms",
-  "openapi",
-] as const satisfies readonly FeatureName[];
-
-export const presetChoices = [
-  "minimal",
-  "standard",
-] as const satisfies readonly PresetName[];
-
-export const integrationChoices = [
-  "better-auth",
-  "drizzle-turso",
-  "inngest",
-  "pino",
-  "resend",
-  "upstash-rate-limit",
-] as const satisfies readonly IntegrationName[];
-
 const integrationDeps: Record<IntegrationName, Record<string, string>> = {
   "better-auth": {
     "@beignet/provider-auth-better-auth": "",
@@ -184,6 +177,7 @@ function packageJson(ctx: TemplateContext): string {
 
   if (isStandardPreset(ctx)) {
     dependencies["@beignet/devtools"] = ctx.beignetVersion;
+    dependencies["@beignet/provider-event-bus-memory"] = ctx.beignetVersion;
     dependencies["@beignet/provider-storage-local"] = ctx.beignetVersion;
   }
 
@@ -202,6 +196,7 @@ function packageJson(ctx: TemplateContext): string {
   }
 
   const devDependencies: Record<string, string> = {
+    "@beignet/cli": ctx.beignetVersion,
     "@types/bun": externalVersions.typesBun,
     "@types/node": externalVersions.typesNode,
     "@types/react": externalVersions.typesReact,
@@ -218,6 +213,7 @@ function packageJson(ctx: TemplateContext): string {
   }
 
   const scripts: Record<string, string> = {
+    beignet: "beignet",
     dev: "next dev",
     build: "next build",
     start: "next start",
@@ -228,6 +224,13 @@ function packageJson(ctx: TemplateContext): string {
   if (hasDrizzleTurso(ctx)) {
     scripts["db:generate"] = "drizzle-kit generate";
     scripts["db:migrate"] = "drizzle-kit migrate";
+
+    // The minimal preset does not scaffold infra/db/seed.ts or
+    // infra/db/reset.ts, so only the standard preset gets their scripts.
+    if (isStandardPreset(ctx)) {
+      scripts["db:seed"] = "bun infra/db/seed.ts";
+      scripts["db:reset"] = "bun infra/db/reset.ts";
+    }
   }
 
   return json({
@@ -251,6 +254,9 @@ function readme(ctx: TemplateContext): string {
     ctx.packageManager === "npm"
       ? "npm run dev"
       : `${ctx.packageManager} run dev`;
+  const cli = packageRunner(ctx);
+  const envSetup =
+    ctx.integrations.length > 0 ? "cp .env.example .env.local\n" : "";
   const featureList =
     ctx.features.length > 0
       ? ctx.features.map((feature) => `- \`${feature}\``).join("\n")
@@ -259,6 +265,20 @@ function readme(ctx: TemplateContext): string {
     ctx.integrations.length > 0
       ? ctx.integrations.map((integration) => `- \`${integration}\``).join("\n")
       : "- None";
+  const databaseSection = hasDrizzleTurso(ctx)
+    ? `
+## Database
+
+The drizzle-turso integration persists todos with Drizzle on libSQL/Turso. The server creates and seeds the starter \`todos\` table at startup using \`TURSO_DB_URL\` (defaults to \`file:local.db\`).
+
+Regenerate and apply migrations after changing \`infra/db/schema/index.ts\`:
+
+\`\`\`bash
+${cli} db generate
+${cli} db migrate
+\`\`\`
+`
+    : "";
 
   return `# ${ctx.name}
 
@@ -268,19 +288,21 @@ Beignet app scaffolded with \`@beignet/cli\`.
 
 \`\`\`bash
 ${install}
-${run}
+${envSetup}${run}
 \`\`\`
 
-Open http://localhost:3000 and start from the todos workflow.
-
+Open http://localhost:3000 and start from the todos workflow. The homepage links to the health check, OpenAPI document, and Beignet docs.
+${databaseSection}
 ## Files to know
 
 - \`features/todos/contracts.ts\` defines the API contract.
-- \`features/todos/use-cases.ts\` contains application logic with input and output validation.
+- \`features/todos/use-cases/\` contains application logic with input and output validation.
 - \`ports/index.ts\` defines the app's external dependencies.
-- \`server/index.ts\` wires contracts to handlers.
+- \`features/todos/routes.ts\` binds contracts to use cases.
+- \`server/context.ts\` declares the context blueprint shared by the server and tests.
+- \`server/index.ts\` composes the server from ports, context, and routes.
 - \`app/api/[[...path]]/route.ts\` exposes contract-backed API routes to Next.js.
-${hasFeature(ctx, "react-query") ? "- `features/todos/components/todo-app.tsx` contains the starter UI.\n" : ""}
+${hasDrizzleTurso(ctx) ? "- `infra/db/schema/index.ts` owns the Drizzle schema and `infra/db/provider.ts` wires the Drizzle todo repository into the `todos` port.\n" : ""}${hasIntegration(ctx, "better-auth") ? "- `lib/better-auth.ts` owns the Better Auth instance served at `/api/auth/*`.\n" : ""}${hasFeature(ctx, "react-query") ? "- `features/todos/components/todo-app.tsx` contains the starter UI.\n" : ""}
 
 ## Selected preset
 
@@ -303,6 +325,10 @@ function standardReadme(ctx: TemplateContext): string {
     ctx.packageManager === "npm"
       ? "npm run dev"
       : `${ctx.packageManager} run dev`;
+  const test =
+    ctx.packageManager === "npm"
+      ? "npm run test"
+      : `${ctx.packageManager} run test`;
   const typecheck =
     ctx.packageManager === "npm"
       ? "npm run typecheck"
@@ -311,7 +337,8 @@ function standardReadme(ctx: TemplateContext): string {
   const beforeDeploy = hasDrizzleTurso(ctx)
     ? [
         "- Create a Turso database or keep `TURSO_DB_URL=file:local.db` for local libSQL development.",
-        `- Run \`${ctx.packageManager} run db:generate\` and \`${ctx.packageManager} run db:migrate\` after changing the Drizzle schema.`,
+        `- Run \`${cli} db generate\` and \`${cli} db migrate\` after changing the Drizzle schema.`,
+        `- Run \`${cli} db seed\` to load starter data or \`${cli} db reset\` to rebuild a local SQLite database.`,
       ].join("\n")
     : "- Replace the in-memory todo repository with a durable adapter.";
 
@@ -324,10 +351,24 @@ Beignet app scaffolded with \`@beignet/cli\`.
 \`\`\`bash
 ${install}
 cp .env.example .env.local
+\`\`\`
+
+## Prepare the database
+
+\`\`\`bash
+${cli} db generate
+${cli} db migrate
+\`\`\`
+
+\`db generate\` creates Drizzle migrations from \`infra/db/schema/\`. \`db migrate\` applies them to the local SQLite database configured in \`.env.local\`.
+
+## Start the app
+
+\`\`\`bash
 ${run}
 \`\`\`
 
-Open http://localhost:3000 for the todo workflow, http://localhost:3000/api/health for health checks, and http://localhost:3000/api/devtools while developing.
+Open http://localhost:3000 for the todo workflow. The homepage links to the health check, OpenAPI document, devtools, and Beignet docs.
 
 ## First checks
 
@@ -341,18 +382,39 @@ ${typecheck}
 
 \`routes\` shows the contracts Beignet can inspect. \`lint\` checks dependency direction. \`doctor\` catches route, OpenAPI, and resource drift.
 
+## Generate a feature
+
+\`\`\`bash
+${cli} make feature projects
+${cli} db generate
+${cli} db migrate
+${test}
+${typecheck}
+${cli} lint
+${cli} doctor
+\`\`\`
+
+\`make feature\` creates a contract-to-test vertical slice. In the standard starter it also adds Drizzle schema and repository files, so regenerate and migrate the database before running the app against the new feature.
+
 ## App map
 
-- \`features/todos/contracts.ts\` owns the HTTP contract and reuses use case schemas.
+- \`features/todos/contracts.ts\` owns the HTTP contract and reuses shared feature schemas.
+- \`features/todos/schemas.ts\` owns shared DTO and validation schemas used by contracts, use cases, ports, tests, and clients.
 - \`features/todos/use-cases/\` owns application behavior and validation.
 - \`ports/\` defines app-owned dependencies.
 - \`infra/\` implements ports for the selected runtime.
 - \`server/routes.ts\` keeps the central route registry and OpenAPI contract list.
+- \`server/context.ts\` declares the context blueprint shared by the server and route tests.
 - \`server/\` wires context, providers, routes, hooks, and error handling.
+- \`server/outbox.ts\` registers durable events and jobs for the outbox drain route and CLI drain runner.
+- \`server/schedules.ts\` registers schedules for cron routes and the CLI schedule runner.
 - \`features/shared/errors.ts\` keeps application errors and route-owned error schemas together.
+- \`features/todos/domain/events/\`, \`jobs/\`, \`listeners/\`, \`notifications/\`, \`schedules/\`, and \`uploads/\` show the feature-owned background workflow shape.
 - \`app/storage/[...key]/route.ts\` serves public local storage objects.
+- \`app/api/cron/outbox/drain/route.ts\` is the bounded serverless entrypoint for durable event/job delivery.
 - \`lib/env.ts\` validates deployment configuration at startup.
 - \`lib/auth.ts\` exposes \`requireUser(ctx)\` for protected use cases.
+- \`lib/better-auth.ts\` owns Better Auth setup and keeps provider-specific auth details outside use cases.
 - \`features/todos/policy.ts\` defines authorization rules registered with \`createGate(...)\`.
 ${hasDrizzleTurso(ctx) ? "- `infra/db/schema/` contains the Drizzle schema, `infra/db/repositories.ts` creates app repositories, and `infra/todos/` contains the durable todo repository adapter.\n" : ""}
 
@@ -360,8 +422,11 @@ ${hasDrizzleTurso(ctx) ? "- `infra/db/schema/` contains the Drizzle schema, `inf
 
 ${beforeDeploy}
 - Keep \`/api/devtools\` development-only unless you add authentication and stricter redaction.
-- Set \`APP_URL\`, \`LOG_LEVEL\`, and service-specific integration variables in your hosting environment.
-- Replace anonymous auth and add use-case authorization before exposing user-owned data.
+- Set \`APP_URL\`, \`BETTER_AUTH_SECRET\`, \`CRON_SECRET\`, \`LOG_LEVEL\`, and service-specific integration variables in your hosting environment.
+- Configure a scheduled request to \`/api/cron/outbox/drain\` with \`Authorization: Bearer <CRON_SECRET>\`.
+- Use \`${cli} outbox drain\` for bounded local, CI, or worker-hosted drain runs.
+- Use \`${cli} schedule run todos.log-daily-summary\` for bounded local, CI, or worker-hosted schedule runs.
+- Review the starter authorization policy before exposing user-owned data.
 ${ctx.integrations.length > 0 ? "\nSee `docs/integrations.md` for setup notes.\n" : ""}
 `;
 }
@@ -381,10 +446,17 @@ function integrationsDoc(ctx: TemplateContext): string {
         "",
         "- Package: `@beignet/provider-auth-better-auth`",
         "- Peer dependency: `better-auth`",
-        "- The starter uses an anonymous auth adapter. Replace `createAnonymousAuth()` in `infra/app-ports.ts` with an adapter backed by your Better Auth session lookup.",
-        "- Keep auth behind the shared `AuthPort`, then call `requireUser(ctx)` in use cases that need a signed-in user.",
-        "- Put repeated ownership or role rules in policies registered with `createGate(...)`.",
-        "- Add the Better Auth provider only after your app has a database adapter and session setup.",
+        "- The starter wires `lib/better-auth.ts`, `app/api/auth/[...all]/route.ts`, and `createAuthBetterAuthProvider(...)`.",
+        ...(isStandardPreset(ctx)
+          ? [
+              "- Keep auth behind the shared `AuthPort`, then call `requireUser(ctx)` in use cases that need a signed-in user.",
+              "- Put repeated ownership or role rules in policies registered with `createGate(...)`.",
+              "- The generated SQLite schema includes the Better Auth `user`, `session`, `account`, and `verification` tables for local development.",
+            ]
+          : [
+              "- Keep auth behind the shared `AuthPort`, then read `ctx.auth` in use cases that need a signed-in user.",
+              "- The minimal starter uses Better Auth's in-memory adapter, so users and sessions reset on restart. Switch to a database adapter such as `better-auth/adapters/drizzle` before production.",
+            ]),
         "",
       );
     }
@@ -397,8 +469,19 @@ function integrationsDoc(ctx: TemplateContext): string {
         "- Peer dependencies: `@libsql/client` and `drizzle-orm`",
         "- Dev dependency: `drizzle-kit`",
         "- Set `TURSO_DB_URL` and optional `TURSO_DB_AUTH_TOKEN`.",
-        "- The scaffold wires a typed Drizzle repository behind the `TodoRepository` port and a transaction-backed Unit of Work.",
-        `- Run \`${ctx.packageManager} run db:generate\` and \`${ctx.packageManager} run db:migrate\` after changing \`infra/db/schema.ts\`.`,
+        ...(isStandardPreset(ctx)
+          ? [
+              "- The scaffold wires a typed Drizzle repository behind the `TodoRepository` port and a transaction-backed Unit of Work.",
+            ]
+          : [
+              "- The scaffold wires a typed Drizzle repository behind the `todos` port through `infra/db/provider.ts`, which also creates and seeds the starter table at startup.",
+            ]),
+        `- Run \`${packageRunner(ctx)} db generate\` and \`${packageRunner(ctx)} db migrate\` after changing \`infra/db/schema/index.ts\`.`,
+        ...(isStandardPreset(ctx)
+          ? [
+              `- Run \`${packageRunner(ctx)} db seed\` for idempotent starter data and \`${packageRunner(ctx)} db reset\` for destructive local resets.`,
+            ]
+          : []),
         "",
       );
     }
@@ -411,7 +494,7 @@ function integrationsDoc(ctx: TemplateContext): string {
         "- Package: `@beignet/provider-inngest`",
         "- Peer dependency: `inngest`",
         "- The standard preset wires `inngestProvider` in `server/providers.ts` and adds `jobs: JobDispatcherPort` to `AppPorts`.",
-        "- Define jobs with `createJobHandlers(...).defineJob(...)` and dispatch them through `ctx.ports.jobs.dispatch(...)`.",
+        "- Define jobs with `defineJob(...)` from `lib/jobs.ts` and dispatch them through `ctx.ports.jobs.dispatch(...)`.",
         "- Keep direct Inngest client usage inside infrastructure code unless you intentionally add an app-owned escape-hatch port.",
         "",
       );
@@ -504,16 +587,16 @@ function envExample(ctx: TemplateContext): string {
     lines.push(
       "UPSTASH_REDIS_REST_URL=",
       "UPSTASH_REDIS_REST_TOKEN=",
-      "UPSTASH_PREFIX=ck:ratelimit",
+      "UPSTASH_PREFIX=beignet:ratelimit",
       "",
     );
   }
 
   if (hasIntegration(ctx, "better-auth")) {
     lines.push(
-      "# Better Auth needs an app-owned database adapter and a shared AuthPort adapter before it can be wired.",
-      "BETTER_AUTH_SECRET=",
+      "BETTER_AUTH_SECRET=local-dev-better-auth-secret-change-me",
       "BETTER_AUTH_URL=http://localhost:3000",
+      "# BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000",
       "",
     );
   }
@@ -581,6 +664,11 @@ function page(ctx: TemplateContext): string {
 					<p>
 						<a href="/api/todos">Open todos API</a>
 					</p>
+					<nav className="starter-links" aria-label="Starter links">
+						<a href="/api/health">Health</a>
+						<a href="/api/openapi">OpenAPI</a>
+						<a href="https://beignetjs.com">Docs</a>
+					</nav>
 				</section>
 			</div>
 		</main>
@@ -605,6 +693,14 @@ export default function HomePage() {
 					</p>
 				</header>
 
+				<nav className="starter-links" aria-label="Starter links">
+					<a href="#todos">Todo feature</a>
+					<a href="/api/health">Health</a>
+					<a href="/api/openapi">OpenAPI</a>
+					<a href="/api/devtools">Devtools</a>
+					<a href="https://beignetjs.com">Docs</a>
+				</nav>
+
 				<TodoApp />
 			</div>
 		</main>
@@ -614,64 +710,126 @@ export default function HomePage() {
 }
 
 function serverProviders(ctx: TemplateContext): string {
-  const imports: string[] = [];
+  const packageImports: string[] = [];
+  const appImports: string[] = [];
+  const declarations: string[] = [];
   const entries: string[] = [];
 
+  if (hasIntegration(ctx, "better-auth")) {
+    packageImports.push(
+      'import { createAuthBetterAuthProvider } from "@beignet/provider-auth-better-auth";',
+    );
+    appImports.push(
+      'import { auth } from "@/lib/better-auth";',
+      'import type { AuthSessionMetadata, AuthUser } from "@/ports";',
+    );
+    entries.push(
+      "createAuthBetterAuthProvider<AuthUser, AuthSessionMetadata>(auth)",
+    );
+  }
+
   if (hasIntegration(ctx, "pino")) {
-    imports.push(
+    packageImports.push(
       'import { loggerPinoProvider } from "@beignet/provider-logger-pino";',
     );
     entries.push("loggerPinoProvider");
   }
 
+  if (hasDrizzleTurso(ctx)) {
+    packageImports.push(
+      'import { createDrizzleTursoProvider } from "@beignet/provider-drizzle-turso";',
+    );
+    appImports.unshift(
+      'import { starterDatabaseProvider } from "@/infra/db/provider";',
+      'import * as schema from "@/infra/db/schema";',
+    );
+    declarations.push(
+      "const drizzleTursoProvider = createDrizzleTursoProvider({ schema });",
+    );
+    entries.push("drizzleTursoProvider", "starterDatabaseProvider");
+  }
+
   if (hasIntegration(ctx, "inngest")) {
-    imports.push(
+    packageImports.push(
       'import { inngestProvider } from "@beignet/provider-inngest";',
     );
     entries.push("inngestProvider");
   }
 
   if (hasIntegration(ctx, "resend")) {
-    imports.push(
+    packageImports.push(
       'import { mailResendProvider } from "@beignet/provider-mail-resend";',
     );
     entries.push("mailResendProvider");
   }
 
   if (hasIntegration(ctx, "upstash-rate-limit")) {
-    imports.push(
+    packageImports.push(
       'import { upstashRateLimitProvider } from "@beignet/provider-rate-limit-upstash";',
     );
     entries.push("upstashRateLimitProvider");
   }
 
-  return `${imports.join("\n")}
+  const importBlock = [...packageImports.sort(), ...appImports].join("\n");
+  const declarationBlock =
+    declarations.length > 0 ? `\n${declarations.join("\n")}\n` : "";
+
+  return `${importBlock}
+${declarationBlock}
 export const providers = [
 	${entries.join(",\n\t")},
 ];
 `;
 }
 
+function serverContext(ctx: TemplateContext): string {
+  const blueprint = hasIntegration(ctx, "better-auth")
+    ? `	async ({ req, ports }) => ({
+		requestId: crypto.randomUUID(),
+		auth: await ports.auth.getSession(req),
+		ports,
+	}),`
+    : `	async ({ ports }) => ({
+		requestId: crypto.randomUUID(),
+		ports,
+	}),`;
+
+  return `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { defineServerContext } from "@beignet/core/server";
+import type { AppContext } from "@/app-context";
+import type { AppPorts } from "@/ports";
+
+/**
+ * Context blueprint shared by the runtime server and route tests.
+ */
+export const appContext = defineServerContext<AppContext, AppPorts>()(
+${blueprint}
+);
+`;
+}
+
 function server(ctx: TemplateContext): string {
-  const hasProviders = ctx.integrations.some((integration) =>
-    ["pino", "inngest", "resend", "upstash-rate-limit"].includes(integration),
-  );
+  const hasProviders = ctx.integrations.length > 0;
+  const providerConfigBlock = hasDrizzleTurso(ctx)
+    ? `	providerConfig: {
+		"drizzle-turso": {
+			DB_URL: process.env.TURSO_DB_URL ?? "file:local.db",
+			DB_AUTH_TOKEN: process.env.TURSO_DB_AUTH_TOKEN,
+		},
+	},
+`
+    : "";
 
-  return `import { createNextServer } from "@beignet/next";
+  return `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { createNextServer } from "@beignet/next";
+import { appContext } from "./context";
 ${hasProviders ? 'import { providers } from "./providers";\n' : ""}import { routes } from "./routes";
+import type { AppContext } from "@/app-context";
 import { appPorts, type AppPorts } from "@/ports";
 
-export type AppContext = {
-	requestId: string;
-	ports: AppPorts;
-};
-
 export const server = await createNextServer<AppContext, AppPorts>({
 	ports: appPorts,
-${hasProviders ? "\tproviders,\n" : ""}	createContext: async ({ ports }) => ({
-		requestId: crypto.randomUUID(),
-		ports,
-	}),
+${hasProviders ? "\tproviders,\n" : ""}${providerConfigBlock}	context: appContext,
 	routes,
 	mapUnhandledError: ({ err, ctx }) => {
 		const ports = ctx?.ports as
@@ -713,6 +871,127 @@ ${hasProviders ? "\tproviders,\n" : ""}	createContext: async ({ ports }) => ({
 `;
 }
 
+function minimalPorts(ctx: TemplateContext): string {
+  const usesDrizzleTurso = hasDrizzleTurso(ctx);
+  const usesBetterAuth = hasIntegration(ctx, "better-auth");
+
+  if (!usesDrizzleTurso && !usesBetterAuth) {
+    return files.ports;
+  }
+
+  const imports = [
+    'import { definePorts } from "@beignet/core/ports";',
+    ...(usesBetterAuth
+      ? [
+          `import type {
+	AuthPort as BeignetAuthPort,
+	AuthSession as BeignetAuthSession,
+} from "@beignet/core/ports";`,
+        ]
+      : []),
+    'import type { z } from "zod";',
+    'import type { CreateTodoSchema, TodoSchema } from "@/features/todos/contracts";',
+  ].join("\n");
+
+  const authTypes = usesBetterAuth
+    ? `
+
+export type AuthUser = {
+	id: string;
+	email?: string;
+	name?: string;
+};
+
+export type AuthSessionMetadata = {
+	id?: string;
+};
+
+export type AuthSession = BeignetAuthSession<AuthUser, AuthSessionMetadata>;
+
+export type AuthPort = BeignetAuthPort<AuthUser, AuthSessionMetadata>;`
+    : "";
+
+  const appPortsType = [
+    "export type AppPorts = {",
+    ...(usesBetterAuth ? ["\tauth: AuthPort;"] : []),
+    "\ttodos: TodoRepository;",
+    "};",
+  ].join("\n");
+
+  const inMemoryTodos = usesDrizzleTurso
+    ? ""
+    : `
+
+const todos = new Map<string, Todo>();
+
+function createTodo(input: CreateTodoInput): Todo {
+	const todo = {
+		id: crypto.randomUUID(),
+		title: input.title,
+		completed: false,
+		createdAt: new Date().toISOString(),
+	};
+	todos.set(todo.id, todo);
+	return todo;
+}
+
+createTodo({ title: "Read the generated contract" });
+createTodo({ title: "Add your first use case" });`;
+
+  const bound = usesDrizzleTurso
+    ? "\tbound: {},"
+    : `	bound: {
+		todos: {
+			list: async () => Array.from(todos.values()),
+			create: async (input: CreateTodoInput) => createTodo(input),
+		},
+	},`;
+  const deferred = [
+    ...(usesBetterAuth ? ['"auth"'] : []),
+    ...(usesDrizzleTurso ? ['"todos"'] : []),
+  ].join(", ");
+
+  return `${imports}
+
+export type Todo = z.infer<typeof TodoSchema>;
+export type CreateTodoInput = z.infer<typeof CreateTodoSchema>;
+
+export interface TodoRepository {
+	list(): Promise<Todo[]>;
+	create(input: CreateTodoInput): Promise<Todo>;
+}${authTypes}
+
+${appPortsType}${inMemoryTodos}
+
+/**
+ * App ports the server boots with.
+ *
+ * Bound ports are app-owned. Every deferred key is contributed by a provider
+ * in server/providers.ts during startup; createNextServer(...) fails boot if
+ * any of them is still unbound after providers have started.
+ */
+export const appPorts = definePorts<AppPorts>()({
+${bound}
+	deferred: [${deferred}],
+});
+`;
+}
+
+function minimalAppContext(ctx: TemplateContext): string {
+  if (!hasIntegration(ctx, "better-auth")) {
+    return files.appContext;
+  }
+
+  return `import type { AppPorts, AuthSession } from "@/ports";
+
+export type AppContext = {
+	requestId: string;
+	auth: AuthSession | null;
+	ports: AppPorts;
+};
+`;
+}
+
 function todoApp(ctx: TemplateContext): string {
   const listTodosQueryOptions =
     ctx.preset === "standard" ? "{ query: {} }" : "";
@@ -720,12 +999,12 @@ function todoApp(ctx: TemplateContext): string {
   if (hasFeature(ctx, "forms")) {
     return `"use client";
 
-import { createReactHookForm } from "@beignet/react-hook-form";
+import { rootFormError } from "@beignet/react-hook-form";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { rq } from "@/client";
+import { rhf } from "@/client/forms";
 import { createTodo, listTodos } from "@/features/todos/contracts";
-import { rq } from "@/client/rq";
 
-const rhf = createReactHookForm();
 const createTodoForm = rhf(createTodo);
 
 export function TodoApp() {
@@ -738,19 +1017,21 @@ export function TodoApp() {
 		rq(createTodo).mutationOptions({
 			onSuccess: async () => {
 				form.reset();
-				await queryClient.invalidateQueries({
-					queryKey: rq(listTodos).key(),
-				});
+				await rq(listTodos).invalidate(queryClient);
+			},
+			onError: (error) => {
+				form.setError("root", rootFormError(error, "Could not create the todo."));
 			},
 		}),
 	);
 
 	const onSubmit = form.handleSubmit((body) => {
+		form.clearErrors("root");
 		createTodoMutation.mutate({ body });
 	});
 
 	return (
-		<section className="workspace">
+		<section id="todos" className="workspace">
 			<form className="composer" onSubmit={onSubmit}>
 				<label htmlFor="todo-title">New todo</label>
 				<div className="composer-row">
@@ -766,19 +1047,22 @@ export function TodoApp() {
 				{form.formState.errors.title ? (
 					<p className="error">{form.formState.errors.title.message}</p>
 				) : null}
+				{form.formState.errors.root ? (
+					<p className="error">{form.formState.errors.root.message}</p>
+				) : null}
 			</form>
 
 			<div className="todos-panel">
 				<div className="panel-heading">
 					<h2>Todos</h2>
-					<span>{todosQuery.data?.total ?? 0} total</span>
+					<span>{todosQuery.data?.page.total ?? 0} total</span>
 				</div>
 				{todosQuery.isLoading ? <p className="muted">Loading todos...</p> : null}
 				{todosQuery.isError ? (
 					<p className="error">Could not load todos.</p>
 				) : null}
 				<ul className="todo-list">
-					{todosQuery.data?.todos.map((todo) => (
+					{todosQuery.data?.items.map((todo) => (
 						<li key={todo.id}>
 							<span>{todo.title}</span>
 							<small>{todo.completed ? "Done" : "Open"}</small>
@@ -796,8 +1080,8 @@ export function TodoApp() {
 
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { useState } from "react";
+import { rq } from "@/client";
 import { createTodo, listTodos } from "@/features/todos/contracts";
-import { rq } from "@/client/rq";
 
 export function TodoApp() {
 	const [title, setTitle] = useState("");
@@ -807,15 +1091,13 @@ export function TodoApp() {
 		rq(createTodo).mutationOptions({
 			onSuccess: async () => {
 				setTitle("");
-				await queryClient.invalidateQueries({
-					queryKey: rq(listTodos).key(),
-				});
+				await rq(listTodos).invalidate(queryClient);
 			},
 		}),
 	);
 
 	return (
-		<section className="workspace">
+		<section id="todos" className="workspace">
 			<form
 				className="composer"
 				onSubmit={(event) => {
@@ -840,10 +1122,10 @@ export function TodoApp() {
 			<div className="todos-panel">
 				<div className="panel-heading">
 					<h2>Todos</h2>
-					<span>{todosQuery.data?.total ?? 0} total</span>
+					<span>{todosQuery.data?.page.total ?? 0} total</span>
 				</div>
 				<ul className="todo-list">
-					{todosQuery.data?.todos.map((todo) => (
+					{todosQuery.data?.items.map((todo) => (
 						<li key={todo.id}>
 							<span>{todo.title}</span>
 							<small>{todo.completed ? "Done" : "Open"}</small>
@@ -857,6 +1139,58 @@ export function TodoApp() {
 `;
 }
 
+function clientIndex(ctx: TemplateContext): string {
+  const imports = [
+    'import { createClient } from "@beignet/core/client";',
+    ...(hasFeature(ctx, "react-query")
+      ? [
+          'import { createReactQuery } from "@beignet/react-query";',
+          'import { QueryClient } from "@tanstack/react-query";',
+        ]
+      : []),
+    ...(isStandardPreset(ctx)
+      ? [
+          'import { createUploadClient } from "@beignet/core/uploads/client";',
+          'import type { todoUploads } from "@/features/todos/uploads";',
+        ]
+      : []),
+  ].join("\n");
+
+  const exports = [
+    `export const apiClient = createClient({
+\tvalidateInput: true,
+});`,
+    ...(hasFeature(ctx, "react-query")
+      ? ["export const rq = createReactQuery(apiClient);"]
+      : []),
+    ...(isStandardPreset(ctx)
+      ? [
+          `export const uploads = createUploadClient<typeof todoUploads>({
+\tbaseUrl: "/api/uploads",
+});`,
+        ]
+      : []),
+    ...(hasFeature(ctx, "react-query")
+      ? [
+          `export function makeQueryClient() {
+\treturn new QueryClient({
+\t\tdefaultOptions: {
+\t\t\tqueries: {
+\t\t\t\tstaleTime: 60 * 1000,
+\t\t\t},
+\t\t},
+\t});
+}`,
+        ]
+      : []),
+  ].join("\n\n");
+
+  return `${imports}
+
+${exports}
+`;
+}
+
 const files = {
   gitignore: `.next
 node_modules
@@ -957,6 +1291,29 @@ input {
 	color: #475569;
 }
 
+.starter-links {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 10px;
+	margin: 22px 0;
+}
+
+.starter-links a {
+	border: 1px solid #cbd5e1;
+	border-radius: 8px;
+	padding: 8px 10px;
+	background: #ffffff;
+	color: #172033;
+	font-size: 14px;
+	font-weight: 700;
+	text-decoration: none;
+}
+
+.starter-links a:hover {
+	border-color: #4f46e5;
+	color: #4f46e5;
+}
+
 .panel {
 	margin-top: 24px;
 	padding: 20px;
@@ -1083,32 +1440,26 @@ input {
 `,
   appProviders: `"use client";
 
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { QueryClientProvider } from "@tanstack/react-query";
 import { type ReactNode, useState } from "react";
+import { makeQueryClient } from "@/client";
 
 export function Providers({ children }: { children: ReactNode }) {
-	const [queryClient] = useState(() => new QueryClient());
+	const [queryClient] = useState(() => makeQueryClient());
 
 	return (
 		<QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
 	);
 }
 `,
-  apiClient: `import { createNextClient } from "@beignet/next";
-
-export const apiClient = createNextClient({
-	validate: true,
-});
-`,
-  rq: `import { createReactQuery } from "@beignet/react-query";
-import { apiClient } from "./api-client";
+  formsClient: `import { createReactHookForm } from "@beignet/react-hook-form";
 
-export const rq = createReactQuery(apiClient);
+export const rhf = createReactHookForm();
 `,
-  contractsTodos: `import { createContractGroup } from "@beignet/core/contracts";
+  contractsTodos: `import { defineContractGroup } from "@beignet/core/contracts";
 import { z } from "zod";
 
-const todos = createContractGroup().namespace("todos");
+const todos = defineContractGroup().namespace("todos");
 
 export const TodoSchema = z.object({
 	id: z.string(),
@@ -1123,8 +1474,14 @@ export const CreateTodoSchema = z.object({
 
 export const listTodos = todos.get("/api/todos").responses({
 	200: z.object({
-		todos: z.array(TodoSchema),
-		total: z.number(),
+		items: z.array(TodoSchema),
+		page: z.object({
+			kind: z.literal("offset"),
+			limit: z.number(),
+			offset: z.number(),
+			total: z.number(),
+			hasMore: z.boolean(),
+		}),
 	}),
 });
 
@@ -1167,30 +1524,175 @@ export const appPorts = definePorts({
 
 export type AppPorts = typeof appPorts;
 `,
-  useCasesTodos: `import { createUseCase } from "@beignet/core/application";
-import { z } from "zod";
-import { CreateTodoSchema, TodoSchema } from "@/features/todos/contracts";
-import type { AppPorts } from "@/ports";
+  appContext: `import type { AppPorts } from "@/ports";
 
-type AppContext = {
+export type AppContext = {
 	requestId: string;
 	ports: AppPorts;
 };
+`,
+  minimalBetterAuth: `import { betterAuth } from "better-auth";
+import { memoryAdapter, type MemoryDB } from "better-auth/adapters/memory";
+
+// The minimal starter keeps auth storage in memory, matching its in-memory
+// ports. Users and sessions reset on restart; switch to a database adapter
+// such as better-auth/adapters/drizzle before production.
+const database: MemoryDB = {
+	account: [],
+	session: [],
+	user: [],
+	verification: [],
+};
+
+export const auth = betterAuth({
+	baseURL: process.env.BETTER_AUTH_URL ?? "http://localhost:3000",
+	secret:
+		process.env.BETTER_AUTH_SECRET ?? "local-dev-better-auth-secret-change-me",
+	database: memoryAdapter(database),
+	emailAndPassword: {
+		enabled: true,
+	},
+});
+`,
+  minimalDbSchema: `import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+export const todos = sqliteTable("todos", {
+	id: text("id").primaryKey(),
+	title: text("title").notNull(),
+	completed: integer("completed", { mode: "boolean" }).notNull().default(false),
+	createdAt: text("created_at").notNull(),
+});
+`,
+  minimalDrizzleTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import type { DrizzleTursoDatabase } from "@beignet/provider-drizzle-turso";
+import { asc } from "drizzle-orm";
+import * as schema from "@/infra/db/schema";
+import type { CreateTodoInput, TodoRepository } from "@/ports";
+
+export function createDrizzleTodoRepository(
+	db: DrizzleTursoDatabase<typeof schema>,
+): TodoRepository {
+	return {
+		async list() {
+			return db
+				.select()
+				.from(schema.todos)
+				.orderBy(asc(schema.todos.createdAt));
+		},
+		async create(input: CreateTodoInput) {
+			const todo = {
+				id: crypto.randomUUID(),
+				title: input.title,
+				completed: false,
+				createdAt: new Date().toISOString(),
+			};
+			const [row] = await db.insert(schema.todos).values(todo).returning();
+
+			if (!row) {
+				throw new Error("Failed to create todo");
+			}
+
+			return row;
+		},
+	};
+}
+`,
+  minimalDbProvider: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { createProvider } from "@beignet/core/providers";
+import type { DbPort } from "@beignet/provider-drizzle-turso";
+import { createDrizzleTodoRepository } from "@/infra/todos/drizzle-todo-repository";
+import type { AppPorts } from "@/ports";
+import * as schema from "./schema";
+
+const setupStatements = [
+	\`CREATE TABLE IF NOT EXISTS todos (
+		id text PRIMARY KEY NOT NULL,
+		title text NOT NULL,
+		completed integer DEFAULT false NOT NULL,
+		created_at text NOT NULL
+	)\`,
+];
+
+const seedTitles = [
+	"Read the generated contract",
+	"Add your first use case",
+] as const;
+
+export const starterDatabaseProvider = createProvider<{
+	db: DbPort<typeof schema>;
+}>()({
+	name: "starter-database",
+
+	async setup({ ports }) {
+		const dbPort = ports.db;
+		if (!dbPort) {
+			throw new Error(
+				"starterDatabaseProvider requires a db port. Register createDrizzleTursoProvider({ schema }) before it.",
+			);
+		}
+
+		const providedPorts: Pick<AppPorts, "todos"> = {
+			todos: createDrizzleTodoRepository(dbPort.db),
+		};
+
+		return {
+			ports: providedPorts,
+			async start() {
+				for (const statement of setupStatements) {
+					await dbPort.client.execute(statement);
+				}
+
+				const result = await dbPort.client.execute(
+					"SELECT count(*) as total FROM todos",
+				);
+				const total = Number(result.rows[0]?.total ?? 0);
+				if (total > 0) return;
+
+				for (const title of seedTitles) {
+					await dbPort.client.execute({
+						sql: "INSERT INTO todos (id, title, completed, created_at) VALUES (?, ?, ?, ?)",
+						args: [crypto.randomUUID(), title, 0, new Date().toISOString()],
+					});
+				}
+			},
+		};
+	},
+});
+`,
+  useCasesTodos: `import { createUseCase } from "@beignet/core/application";
+import { z } from "zod";
+import { CreateTodoSchema, TodoSchema } from "@/features/todos/contracts";
+import type { AppContext } from "@/app-context";
 
 const useCase = createUseCase<AppContext>();
 
 export const ListTodosOutputSchema = z.object({
-	todos: z.array(TodoSchema),
-	total: z.number(),
+	items: z.array(TodoSchema),
+	page: z.object({
+		kind: z.literal("offset"),
+		limit: z.number(),
+		offset: z.number(),
+		total: z.number(),
+		hasMore: z.boolean(),
+	}),
 });
 
 export const listTodos = useCase
 	.query("listTodos")
-	.input(z.void())
+	.input(z.object({}))
 	.output(ListTodosOutputSchema)
 	.run(async ({ ctx }) => {
 		const todos = await ctx.ports.todos.list();
-		return { todos, total: todos.length };
+		return {
+			items: todos,
+			page: {
+				kind: "offset" as const,
+				limit: todos.length,
+				offset: 0,
+				total: todos.length,
+				hasMore: false,
+			},
+		};
 	});
 
 export const createTodo = useCase
@@ -1199,33 +1701,23 @@ export const createTodo = useCase
 	.output(TodoSchema)
 	.run(async ({ ctx, input }) => ctx.ports.todos.create(input));
 `,
-  todoRoutes: `import { defineRouteGroup } from "@beignet/next";
-import type { AppContext } from "@/server";
+  todoRoutes: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { defineRouteGroup } from "@beignet/next";
+import type { AppContext } from "@/app-context";
 import { createTodo, listTodos } from "@/features/todos/use-cases";
 import * as contracts from "@/features/todos/contracts";
 
 export const todoRoutes = defineRouteGroup<AppContext>({
 	name: "todos",
 	routes: [
-		{
-			contract: contracts.listTodos,
-			handle: async ({ ctx }) => ({
-				status: 200,
-				body: await listTodos.run({ ctx, input: undefined }),
-			}),
-		},
-		{
-			contract: contracts.createTodo,
-			handle: async ({ ctx, body }) => ({
-				status: 201,
-				body: await createTodo.run({ ctx, input: body }),
-			}),
-		},
+		{ contract: contracts.listTodos, useCase: listTodos },
+		{ contract: contracts.createTodo, useCase: createTodo },
 	],
 });
 `,
-  serverRoutes: `import { contractsFromRoutes, defineRoutes } from "@beignet/next";
-import type { AppContext } from "@/server";
+  serverRoutes: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { contractsFromRoutes, defineRoutes } from "@beignet/next";
+import type { AppContext } from "@/app-context";
 import { todoRoutes } from "@/features/todos/routes";
 
 export const routes = defineRoutes<AppContext>([
@@ -1264,6 +1756,14 @@ export const env = createEnv({
 		APP_URL: z.string().url().default("http://localhost:3000"),
 		CRON_SECRET: z.string().min(1).optional(),
 		DEVTOOLS_ENABLED: BooleanEnv.optional(),
+		BETTER_AUTH_SECRET: z
+			.string()
+			.min(32)
+			.default("local-dev-better-auth-secret-change-me"),
+		BETTER_AUTH_URL: z.string().url().default("http://localhost:3000"),
+		BETTER_AUTH_TRUSTED_ORIGINS: z.string().optional(),
+		TURSO_DB_URL: z.string().default("file:local.db"),
+		TURSO_DB_AUTH_TOKEN: z.string().optional(),
 		LOG_LEVEL: z
 			.enum(["trace", "debug", "info", "warn", "error", "fatal"])
 			.default("info"),
@@ -1275,24 +1775,28 @@ export const env = createEnv({
 
 export const isProduction = env.NODE_ENV === "production";
 `,
-  productionAppContext: `import type { DevtoolsPort, DevtoolsTraceContext } from "@beignet/devtools";
-import type { ActivityActor, ActivityTenant, StoragePort } from "@beignet/core/ports";
+  productionAppContext: `import type { ActivityActor, ActivityTenant } from "@beignet/core/ports";
+import type { InferProviderPorts } from "@beignet/core/providers";
+import type { TraceContext } from "@beignet/core/tracing";
 import type { AppGate, AppPorts } from "@/ports";
 import type { AuthSession } from "@/ports/auth";
+import type { providers } from "@/server/providers";
+
+/**
+ * App ports plus the ports contributed by the server's providers at startup.
+ */
+export type AppRuntimePorts = AppPorts & InferProviderPorts<typeof providers>;
 
 export type AppContext = {
 	requestId: string;
 	actor: ActivityActor;
 	auth: AuthSession | null;
 	gate: AppGate;
-	ports: AppPorts & {
-		devtools: DevtoolsPort;
-		storage: StoragePort;
-	};
+	ports: AppRuntimePorts;
 	tenant?: ActivityTenant;
-} & Partial<DevtoolsTraceContext>;
+} & Partial<TraceContext>;
 `,
-  productimapUnhandledErrors: `import { createAppError, defineErrors } from "@beignet/core/errors";
+  productionSharedErrors: `import { createAppError, defineErrors } from "@beignet/core/errors";
 
 export const errors = defineErrors({
 	Unauthorized: {
@@ -1329,10 +1833,14 @@ export const ListTodosInputSchema = z.object({
 });
 
 export const ListTodosOutputSchema = z.object({
-	todos: z.array(TodoSchema),
-	total: z.number().int().min(0),
-	limit: z.number().int().min(1),
-	offset: z.number().int().min(0),
+	items: z.array(TodoSchema),
+	page: z.object({
+		kind: z.literal("offset"),
+		limit: z.number().int().min(1),
+		offset: z.number().int().min(0),
+		total: z.number().int().min(0),
+		hasMore: z.boolean(),
+	}),
 });
 
 export const GetTodoInputSchema = z.object({
@@ -1347,20 +1855,43 @@ export type Todo = z.infer<typeof TodoSchema>;
 export type CreateTodoInput = z.infer<typeof CreateTodoInputSchema>;
 export type ListTodosInput = z.infer<typeof ListTodosInputSchema>;
 `,
-  productionUseCaseBuilder: `import { createUseCase } from "@beignet/core/application";
-import { createDevtoolsUseCaseObserver } from "@beignet/devtools";
+  productionUseCaseBuilder: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { createUseCase } from "@beignet/core/application";
 import type { AppContext } from "@/app-context";
 
-export const useCase = createUseCase<AppContext>({
-	onRun: createDevtoolsUseCaseObserver<AppContext>(),
-});
+export const useCase = createUseCase<AppContext>();
 `,
-  productionAuthHelpers: `import type { AppContext } from "@/app-context";
-import type { AuthSession, AuthUser } from "@/ports/auth";
-import { appError } from "@/features/shared/errors";
+  productionListenersBuilder: `import { createListeners } from "@beignet/core/events";
+import type { AppContext } from "@/app-context";
 
-export function requireSession(ctx: AppContext): AuthSession {
-	if (!ctx.auth) {
+export const { defineListener } = createListeners<AppContext>();
+`,
+  productionJobsBuilder: `import { createJobs } from "@beignet/core/jobs";
+import type { AppContext } from "@/app-context";
+
+export const { defineJob } = createJobs<AppContext>();
+`,
+  productionSchedulesBuilder: `import { createSchedules } from "@beignet/core/schedules";
+import type { AppContext } from "@/app-context";
+
+export const { defineSchedule } = createSchedules<AppContext>();
+`,
+  productionNotificationsBuilder: `import { createNotifications } from "@beignet/core/notifications";
+import type { AppContext } from "@/app-context";
+
+export const { defineNotification } = createNotifications<AppContext>();
+`,
+  productionTasksBuilder: `import { createTasks } from "@beignet/core/tasks";
+import type { AppContext } from "@/app-context";
+
+export const { defineTask } = createTasks<AppContext>();
+`,
+  productionAuthHelpers: `import type { AppContext } from "@/app-context";
+import type { AuthSession, AuthUser } from "@/ports/auth";
+import { appError } from "@/features/shared/errors";
+
+export function requireSession(ctx: AppContext): AuthSession {
+	if (!ctx.auth) {
 		throw appError("Unauthorized");
 	}
 
@@ -1371,26 +1902,28 @@ export function requireUser(ctx: AppContext): AuthUser {
 	return requireSession(ctx).user;
 }
 `,
-  productionListTodosUseCase: `import { useCase } from "@/lib/use-case";
-import { ListTodosInputSchema, ListTodosOutputSchema } from "./schemas";
+  productionListTodosUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { normalizeOffsetPage } from "@beignet/core/pagination";
+import { useCase } from "@/lib/use-case";
+import { ListTodosInputSchema, ListTodosOutputSchema } from "../schemas";
 
 export const listTodosUseCase = useCase
 	.query("todos.list")
 	.input(ListTodosInputSchema)
 	.output(ListTodosOutputSchema)
 	.run(async ({ ctx, input }) => {
-		const result = await ctx.ports.todos.list(input);
-		return {
-			todos: result.todos,
-			total: result.total,
-			limit: input.limit,
-			offset: input.offset,
-		};
+		const page = normalizeOffsetPage(input, {
+			defaultLimit: 20,
+			maxLimit: 100,
+		});
+
+		return ctx.ports.todos.list(page);
 	});
 `,
-  productionGetTodoUseCase: `import { appError } from "@/features/shared/errors";
+  productionGetTodoUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { appError } from "@/features/shared/errors";
 import { useCase } from "@/lib/use-case";
-import { GetTodoInputSchema, TodoSchema } from "./schemas";
+import { GetTodoInputSchema, TodoSchema } from "../schemas";
 
 export const getTodoUseCase = useCase
 	.query("todos.get")
@@ -1405,16 +1938,36 @@ export const getTodoUseCase = useCase
 		return todo;
 	});
 `,
-  productionCreateTodoUseCase: `import { useCase } from "@/lib/use-case";
-import { CreateTodoInputSchema, TodoSchema } from "./schemas";
+  productionCreateTodoUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { TodoCreated } from "@/features/todos/domain/events";
+import { auditEntry } from "@/lib/audit";
+import { useCase } from "@/lib/use-case";
+import { CreateTodoInputSchema, TodoSchema } from "../schemas";
 
 export const createTodoUseCase = useCase
 	.command("todos.create")
 	.input(CreateTodoInputSchema)
 	.output(TodoSchema)
-	.run(async ({ ctx, input }) => {
+	.emits([TodoCreated])
+	.run(async ({ ctx, input, events }) => {
 		await ctx.gate.authorize("todos.create");
-		return ctx.ports.uow.transaction((tx) => tx.todos.create(input));
+		const todo = await ctx.ports.uow.transaction(async (tx) => {
+			const created = await tx.todos.create(input);
+			await events.record(tx.events, TodoCreated, {
+				todoId: created.id,
+				title: created.title,
+			});
+			await tx.audit.record(
+				auditEntry(ctx, {
+					action: "todos.create",
+					resource: { type: "todo", id: created.id, name: created.title },
+					metadata: { completed: created.completed },
+				}),
+			);
+			return created;
+		});
+
+		return todo;
 	});
 `,
   productionUseCasesIndex: `export { createTodoUseCase } from "./create-todo";
@@ -1429,24 +1982,40 @@ export {
 	type CreateTodoInput,
 	type ListTodosInput,
 	type Todo,
-} from "./schemas";
+} from "../schemas";
 `,
   productionTodoRepositoryPort: `import type {
+	OffsetPage,
+	OffsetPageInfo,
+	PageResult,
+} from "@beignet/core/pagination";
+import type {
 	CreateTodoInput,
-	ListTodosInput,
 	Todo,
-} from "@/features/todos/use-cases/schemas";
+} from "@/features/todos/schemas";
+
+export type ListTodosResult = PageResult<Todo, OffsetPageInfo>;
 
-export type ListTodosResult = {
-	todos: Todo[];
-	total: number;
+export type TodoAttachment = {
+	id: string;
+	todoId: string;
+	key: string;
+	fileName: string;
+	contentType: string;
+	size: number;
+	createdAt: string;
 };
 
 export interface TodoRepository {
-	list(input: ListTodosInput): Promise<ListTodosResult>;
+	list(page: OffsetPage): Promise<ListTodosResult>;
 	findById(id: string): Promise<Todo | null>;
 	create(input: CreateTodoInput): Promise<Todo>;
 }
+
+export interface TodoAttachmentRepository {
+	create(input: Omit<TodoAttachment, "createdAt">): Promise<TodoAttachment>;
+	findMany(todoId: string): Promise<TodoAttachment[]>;
+}
 `,
   productionAuthPort: `import type {
 	AuthPort as BeignetAuthPort,
@@ -1516,12 +2085,16 @@ export const todoPolicy = definePolicy({
 	},
 });
 `,
-  productionInMemoryTodoRepository: `import type {
+  productionInMemoryTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { offsetPageResult } from "@beignet/core/pagination";
+import type {
 	CreateTodoInput,
-	ListTodosInput,
 	Todo,
-} from "@/features/todos/use-cases/schemas";
-import type { TodoRepository } from "@/features/todos/ports";
+} from "@/features/todos/schemas";
+import type {
+	TodoAttachmentRepository,
+	TodoRepository,
+} from "@/features/todos/ports";
 
 export function createInMemoryTodoRepository(
 	seed: Todo[] = [],
@@ -1529,15 +2102,16 @@ export function createInMemoryTodoRepository(
 	const todos = new Map(seed.map((todo) => [todo.id, todo]));
 
 	return {
-		async list(input: ListTodosInput) {
+		async list(page) {
 			const allTodos = Array.from(todos.values()).sort((left, right) =>
 				left.createdAt.localeCompare(right.createdAt),
 			);
 
-			return {
-				todos: allTodos.slice(input.offset, input.offset + input.limit),
-				total: allTodos.length,
-			};
+			return offsetPageResult(
+				allTodos.slice(page.offset, page.offset + page.limit),
+				page,
+				allTodos.length,
+			);
 		},
 		async findById(id: string) {
 			return todos.get(id) ?? null;
@@ -1600,28 +2174,6 @@ export const appPorts = definePorts({
 		todos,
 	})),
 });
-`,
-  productionInfrastructurePortsWithDrizzleTurso: `import { createGate, definePorts } from "@beignet/core/ports";
-import { todoPolicy } from "@/features/todos/policy";
-import { appError } from "@/features/shared/errors";
-import { createAnonymousAuth } from "./auth/anonymous-auth";
-import { fallbackLogger } from "./logger";
-
-const gate = createGate({
-	policies: [todoPolicy],
-	onDeny(decision) {
-		return appError("Forbidden", {
-			message: decision.reason ?? "Forbidden",
-			details: decision.details,
-		});
-	},
-});
-
-export const appPorts = definePorts({
-	auth: createAnonymousAuth(),
-	gate,
-	logger: fallbackLogger,
-});
 `,
   productionDrizzleConfig: `export default {
 	schema: "./infra/db/schema/index.ts",
@@ -1633,7 +2185,63 @@ export const appPorts = definePorts({
 	},
 };
 `,
-  productionDbSchema: `import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+  productionDbSchema: `import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+export const user = sqliteTable("user", {
+	id: text("id").primaryKey(),
+	name: text("name").notNull(),
+	email: text("email").notNull().unique(),
+	emailVerified: integer("email_verified", { mode: "boolean" })
+		.notNull()
+		.default(false),
+	image: text("image"),
+	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+});
+
+export const session = sqliteTable("session", {
+	id: text("id").primaryKey(),
+	expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+	token: text("token").notNull().unique(),
+	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+	ipAddress: text("ip_address"),
+	userAgent: text("user_agent"),
+	userId: text("user_id")
+		.notNull()
+		.references(() => user.id, { onDelete: "cascade" }),
+});
+
+export const account = sqliteTable("account", {
+	id: text("id").primaryKey(),
+	accountId: text("account_id").notNull(),
+	providerId: text("provider_id").notNull(),
+	userId: text("user_id")
+		.notNull()
+		.references(() => user.id, { onDelete: "cascade" }),
+	accessToken: text("access_token"),
+	refreshToken: text("refresh_token"),
+	idToken: text("id_token"),
+	accessTokenExpiresAt: integer("access_token_expires_at", {
+		mode: "timestamp",
+	}),
+	refreshTokenExpiresAt: integer("refresh_token_expires_at", {
+		mode: "timestamp",
+	}),
+	scope: text("scope"),
+	password: text("password"),
+	createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull(),
+});
+
+export const verification = sqliteTable("verification", {
+	id: text("id").primaryKey(),
+	identifier: text("identifier").notNull(),
+	value: text("value").notNull(),
+	expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+	createdAt: integer("created_at", { mode: "timestamp" }),
+	updatedAt: integer("updated_at", { mode: "timestamp" }),
+});
 
 export const todos = sqliteTable("todos", {
 	id: text("id").primaryKey(),
@@ -1641,15 +2249,139 @@ export const todos = sqliteTable("todos", {
 	completed: integer("completed", { mode: "boolean" }).notNull().default(false),
 	createdAt: text("created_at").notNull(),
 });
+
+export const todoAttachments = sqliteTable(
+	"todo_attachments",
+	{
+		id: text("id").primaryKey(),
+		todoId: text("todo_id")
+			.notNull()
+			.references(() => todos.id, { onDelete: "cascade" }),
+		key: text("key").notNull(),
+		fileName: text("file_name").notNull(),
+		contentType: text("content_type").notNull(),
+		size: integer("size").notNull(),
+		createdAt: text("created_at").notNull(),
+	},
+	(table) => ({
+		todoIdx: index("todo_attachments_todo_idx").on(
+			table.todoId,
+			table.createdAt,
+		),
+		keyIdx: index("todo_attachments_key_idx").on(table.key),
+	}),
+);
+
+export const auditLog = sqliteTable(
+	"audit_log",
+	{
+		id: text("id").primaryKey(),
+		action: text("action").notNull(),
+		actorType: text("actor_type", {
+			enum: ["anonymous", "service", "system", "user"],
+		}).notNull(),
+		actorId: text("actor_id"),
+		actorDisplayName: text("actor_display_name"),
+		tenantId: text("tenant_id"),
+		tenantSlug: text("tenant_slug"),
+		resourceType: text("resource_type"),
+		resourceId: text("resource_id"),
+		resourceName: text("resource_name"),
+		outcome: text("outcome", { enum: ["success", "failure"] })
+			.notNull()
+			.default("success"),
+		requestId: text("request_id"),
+		traceId: text("trace_id"),
+		message: text("message"),
+		metadata: text("metadata"),
+		actorMetadata: text("actor_metadata"),
+		tenantMetadata: text("tenant_metadata"),
+		resourceMetadata: text("resource_metadata"),
+		occurredAt: text("occurred_at").notNull(),
+	},
+	(table) => ({
+		actionIdx: index("audit_log_action_idx").on(table.action),
+		actorIdx: index("audit_log_actor_idx").on(table.actorType, table.actorId),
+		occurredAtIdx: index("audit_log_occurred_at_idx").on(table.occurredAt),
+		requestIdx: index("audit_log_request_idx").on(table.requestId),
+		resourceIdx: index("audit_log_resource_idx").on(
+			table.resourceType,
+			table.resourceId,
+		),
+		tenantIdx: index("audit_log_tenant_idx").on(table.tenantId),
+	}),
+);
+
+export const outboxMessages = sqliteTable(
+	"outbox_messages",
+	{
+		id: text("id").primaryKey(),
+		kind: text("kind", { enum: ["event", "job"] }).notNull(),
+		name: text("name").notNull(),
+		payloadJson: text("payload_json").notNull(),
+		status: text("status", {
+			enum: ["pending", "claimed", "delivered", "deadLettered"],
+		}).notNull(),
+		attempts: integer("attempts").notNull().default(0),
+		maxAttempts: integer("max_attempts").notNull().default(3),
+		availableAt: text("available_at").notNull(),
+		claimedAt: text("claimed_at"),
+		lockedUntil: text("locked_until"),
+		claimToken: text("claim_token"),
+		deliveredAt: text("delivered_at"),
+		lastErrorJson: text("last_error_json"),
+		createdAt: text("created_at").notNull(),
+		updatedAt: text("updated_at").notNull(),
+	},
+	(table) => ({
+		availableIdx: index("outbox_messages_available_idx").on(
+			table.status,
+			table.availableAt,
+		),
+		lockedIdx: index("outbox_messages_locked_idx").on(
+			table.status,
+			table.lockedUntil,
+		),
+	}),
+);
+
+export const idempotencyRecords = sqliteTable(
+	"idempotency_records",
+	{
+		storageKey: text("storage_key").primaryKey(),
+		namespace: text("namespace").notNull(),
+		idempotencyKey: text("idempotency_key").notNull(),
+		scopeKey: text("scope_key").notNull(),
+		fingerprint: text("fingerprint").notNull(),
+		status: text("status", { enum: ["in-progress", "completed"] }).notNull(),
+		resultJson: text("result_json"),
+		reservedAt: text("reserved_at").notNull(),
+		completedAt: text("completed_at"),
+		expiresAt: text("expires_at"),
+		updatedAt: text("updated_at").notNull(),
+	},
+	(table) => ({
+		lookupIdx: index("idempotency_records_lookup_idx").on(
+			table.namespace,
+			table.scopeKey,
+			table.idempotencyKey,
+		),
+		expiresIdx: index("idempotency_records_expires_idx").on(table.expiresAt),
+	}),
+);
 `,
-  productionDrizzleTodoRepository: `import { count, desc, eq } from "drizzle-orm";
+  productionDrizzleTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { offsetPageResult } from "@beignet/core/pagination";
+import { count, desc, eq } from "drizzle-orm";
 import type { DrizzleTursoDatabase } from "@beignet/provider-drizzle-turso";
-import type { TodoRepository } from "@/features/todos/ports";
+import type {
+	TodoAttachmentRepository,
+	TodoRepository,
+} from "@/features/todos/ports";
 import type {
 	CreateTodoInput,
-	ListTodosInput,
 	Todo,
-} from "@/features/todos/use-cases/schemas";
+} from "@/features/todos/schemas";
 import * as schema from "@/infra/db/schema";
 
 type TodoRow = typeof schema.todos.$inferSelect;
@@ -1667,19 +2399,16 @@ export function createDrizzleTodoRepository(
 	db: DrizzleTursoDatabase<typeof schema>,
 ): TodoRepository {
 	return {
-		async list(input: ListTodosInput) {
+		async list(page) {
 			const rows = await db
 				.select()
 				.from(schema.todos)
 				.orderBy(desc(schema.todos.createdAt))
-				.limit(input.limit)
-				.offset(input.offset);
+				.limit(page.limit)
+				.offset(page.offset);
 			const [{ total }] = await db.select({ total: count() }).from(schema.todos);
 
-			return {
-				todos: rows.map(toTodo),
-				total,
-			};
+			return offsetPageResult(rows.map(toTodo), page, total);
 		},
 		async findById(id: string) {
 			const [row] = await db
@@ -1707,28 +2436,445 @@ export function createDrizzleTodoRepository(
 		},
 	};
 }
+
+export function createDrizzleTodoAttachmentRepository(
+	db: DrizzleTursoDatabase<typeof schema>,
+): TodoAttachmentRepository {
+	return {
+		async create(input) {
+			const attachment = {
+				...input,
+				createdAt: new Date().toISOString(),
+			};
+			const [row] = await db
+				.insert(schema.todoAttachments)
+				.values(attachment)
+				.returning();
+
+			if (!row) {
+				throw new Error("Failed to create todo attachment");
+			}
+
+			return {
+				id: row.id,
+				todoId: row.todoId,
+				key: row.key,
+				fileName: row.fileName,
+				contentType: row.contentType,
+				size: row.size,
+				createdAt: row.createdAt,
+			};
+		},
+		async findMany(todoId) {
+			const rows = await db
+				.select()
+				.from(schema.todoAttachments)
+				.where(eq(schema.todoAttachments.todoId, todoId))
+				.orderBy(desc(schema.todoAttachments.createdAt));
+
+			return rows.map((row) => ({
+				id: row.id,
+				todoId: row.todoId,
+				key: row.key,
+				fileName: row.fileName,
+				contentType: row.contentType,
+				size: row.size,
+				createdAt: row.createdAt,
+			}));
+		},
+	};
+}
 `,
   productionDbRepositories: `import type { DrizzleTursoDatabase } from "@beignet/provider-drizzle-turso";
-import { createDrizzleTodoRepository } from "@/infra/todos/drizzle-todo-repository";
+import {
+	createDrizzleTodoAttachmentRepository,
+	createDrizzleTodoRepository,
+} from "@/infra/todos/drizzle-todo-repository";
 import type { AppTransactionPorts } from "@/ports";
 import * as schema from "./schema";
 
 export function createRepositories(
 	db: DrizzleTursoDatabase<typeof schema>,
-): Omit<AppTransactionPorts, "events"> {
+): Omit<
+	AppTransactionPorts,
+	"audit" | "events" | "idempotency" | "jobs" | "outbox"
+> {
 	return {
+		todoAttachments: createDrizzleTodoAttachmentRepository(db),
 		todos: createDrizzleTodoRepository(db),
 	};
 }
 `,
-  productionContractsTodos: `import { createContractGroup } from "@beignet/core/contracts";
+  productionDrizzleAuditLog: `import type { AuditLogEntry, AuditLogPort } from "@beignet/core/ports";
+import {
+	normalizeAuditLogEntry,
+	redactAuditLogEntry,
+} from "@beignet/core/ports";
+import type { DrizzleTursoDatabase } from "@beignet/provider-drizzle-turso";
+import * as schema from "@/infra/db/schema";
+
+function serialize(value: unknown): string | null {
+	return value === undefined ? null : JSON.stringify(value);
+}
+
+export function createDrizzleAuditLog(
+	db: DrizzleTursoDatabase<typeof schema>,
+): AuditLogPort {
+	return {
+		async record(input) {
+			const entry: AuditLogEntry = redactAuditLogEntry(
+				normalizeAuditLogEntry(input),
+			);
+
+			await db.insert(schema.auditLog).values({
+				id: crypto.randomUUID(),
+				action: entry.action,
+				actorType: entry.actor.type,
+				actorId: entry.actor.id ?? null,
+				actorDisplayName: entry.actor.displayName ?? null,
+				tenantId: entry.tenant?.id ?? null,
+				tenantSlug: entry.tenant?.slug ?? null,
+				resourceType: entry.resource?.type ?? null,
+				resourceId: entry.resource?.id ?? null,
+				resourceName: entry.resource?.name ?? null,
+				outcome: entry.outcome,
+				requestId: entry.requestId ?? null,
+				traceId: entry.traceId ?? null,
+				message: entry.message ?? null,
+				metadata: serialize(entry.metadata),
+				actorMetadata: serialize(entry.actor.metadata),
+				tenantMetadata: serialize(entry.tenant?.metadata),
+				resourceMetadata: serialize(entry.resource?.metadata),
+				occurredAt: entry.occurredAt.toISOString(),
+			});
+		},
+	};
+}
+`,
+  productionDbBootstrap: `import { createDrizzleTursoIdempotencySetupStatements, createDrizzleTursoOutboxSetupStatements } from "@beignet/provider-drizzle-turso";
+import type { Client } from "@libsql/client";
+
+type BootstrapOptions = {
+	seed?: boolean;
+};
+
+const setupStatements = [
+	\`CREATE TABLE IF NOT EXISTS user (
+		id text PRIMARY KEY NOT NULL,
+		name text NOT NULL,
+		email text NOT NULL UNIQUE,
+		email_verified integer DEFAULT false NOT NULL,
+		image text,
+		created_at integer NOT NULL,
+		updated_at integer NOT NULL
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS session (
+		id text PRIMARY KEY NOT NULL,
+		expires_at integer NOT NULL,
+		token text NOT NULL UNIQUE,
+		created_at integer NOT NULL,
+		updated_at integer NOT NULL,
+		ip_address text,
+		user_agent text,
+		user_id text NOT NULL REFERENCES user(id) ON DELETE cascade
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS account (
+		id text PRIMARY KEY NOT NULL,
+		account_id text NOT NULL,
+		provider_id text NOT NULL,
+		user_id text NOT NULL REFERENCES user(id) ON DELETE cascade,
+		access_token text,
+		refresh_token text,
+		id_token text,
+		access_token_expires_at integer,
+		refresh_token_expires_at integer,
+		scope text,
+		password text,
+		created_at integer NOT NULL,
+		updated_at integer NOT NULL
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS verification (
+		id text PRIMARY KEY NOT NULL,
+		identifier text NOT NULL,
+		value text NOT NULL,
+		expires_at integer NOT NULL,
+		created_at integer,
+		updated_at integer
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS todos (
+		id text PRIMARY KEY NOT NULL,
+		title text NOT NULL,
+		completed integer DEFAULT false NOT NULL,
+		created_at text NOT NULL
+	)\`,
+	\`CREATE TABLE IF NOT EXISTS todo_attachments (
+		id text PRIMARY KEY NOT NULL,
+		todo_id text NOT NULL REFERENCES todos(id) ON DELETE cascade,
+		key text NOT NULL,
+		file_name text NOT NULL,
+		content_type text NOT NULL,
+		size integer NOT NULL,
+		created_at text NOT NULL
+	)\`,
+	"CREATE INDEX IF NOT EXISTS todo_attachments_todo_idx ON todo_attachments (todo_id, created_at)",
+	"CREATE INDEX IF NOT EXISTS todo_attachments_key_idx ON todo_attachments (key)",
+	\`CREATE TABLE IF NOT EXISTS audit_log (
+		id text PRIMARY KEY NOT NULL,
+		action text NOT NULL,
+		actor_type text NOT NULL,
+		actor_id text,
+		actor_display_name text,
+		tenant_id text,
+		tenant_slug text,
+		resource_type text,
+		resource_id text,
+		resource_name text,
+		outcome text DEFAULT 'success' NOT NULL,
+		request_id text,
+		trace_id text,
+		message text,
+		metadata text,
+		actor_metadata text,
+		tenant_metadata text,
+		resource_metadata text,
+		occurred_at text NOT NULL
+	)\`,
+	"CREATE INDEX IF NOT EXISTS audit_log_action_idx ON audit_log (action)",
+	"CREATE INDEX IF NOT EXISTS audit_log_actor_idx ON audit_log (actor_type, actor_id)",
+	"CREATE INDEX IF NOT EXISTS audit_log_occurred_at_idx ON audit_log (occurred_at)",
+	"CREATE INDEX IF NOT EXISTS audit_log_request_idx ON audit_log (request_id)",
+	"CREATE INDEX IF NOT EXISTS audit_log_resource_idx ON audit_log (resource_type, resource_id)",
+	"CREATE INDEX IF NOT EXISTS audit_log_tenant_idx ON audit_log (tenant_id)",
+	...createDrizzleTursoIdempotencySetupStatements(),
+	...createDrizzleTursoOutboxSetupStatements(),
+];
+
+const seedTodos = [
+	{
+		id: "00000000-0000-4000-8000-000000000001",
+		title: "Review the starter boundaries",
+		completed: 0,
+		createdAt: "2026-01-01T00:00:00.000Z",
+	},
+	{
+		id: "00000000-0000-4000-8000-000000000002",
+		title: "Create your first feature",
+		completed: 0,
+		createdAt: "2026-01-01T00:05:00.000Z",
+	},
+] as const;
+
+const resetTables = [
+	"verification",
+	"account",
+	"session",
+	"user",
+	"todo_attachments",
+	"todos",
+	"audit_log",
+	"idempotency_records",
+	"outbox_messages",
+] as const;
+
+export async function ensureStarterDatabase(
+	client: Client,
+	options: BootstrapOptions = {},
+): Promise<void> {
+	for (const statement of setupStatements) {
+		await client.execute(statement);
+	}
+
+	if (options.seed === false) return;
+
+	const result = await client.execute("SELECT count(*) as total FROM todos");
+	const total = Number(result.rows[0]?.total ?? 0);
+	if (total > 0) return;
+
+	for (const todo of seedTodos) {
+		await client.execute({
+			sql: "INSERT INTO todos (id, title, completed, created_at) VALUES (?, ?, ?, ?)",
+			args: [todo.id, todo.title, todo.completed, todo.createdAt],
+		});
+	}
+}
+
+export async function resetStarterDatabase(client: Client): Promise<void> {
+	await client.execute("PRAGMA foreign_keys = OFF");
+	try {
+		for (const table of resetTables) {
+			await client.execute(\`DROP TABLE IF EXISTS \${table}\`);
+		}
+	} finally {
+		await client.execute("PRAGMA foreign_keys = ON");
+	}
+	await ensureStarterDatabase(client, { seed: false });
+}
+`,
+  productionDbProvider: `import { registerListeners } from "@beignet/core/events";
+import { createInlineJobDispatcher } from "@beignet/core/jobs";
+import { createMemoryMailer } from "@beignet/core/mail";
+import { createInlineNotificationDispatcher } from "@beignet/core/notifications";
+import {
+	createOutboxEventRecorder,
+	createOutboxJobDispatcher,
+} from "@beignet/core/outbox";
+import {
+	createInstrumentedAuditLog,
+	createSystemActor,
+} from "@beignet/core/ports";
+import {
+	createProvider,
+	createProviderInstrumentation,
+} from "@beignet/core/providers";
+import {
+	createDrizzleTursoIdempotencyPort,
+	createDrizzleTursoOutboxPort,
+	createDrizzleTursoUnitOfWork,
+	type DbPort,
+} from "@beignet/provider-drizzle-turso";
+import { createInMemoryEventBus } from "@beignet/provider-event-bus-memory";
+import type { AppContext } from "@/app-context";
+import { todoListeners } from "@/features/todos/listeners";
+import { createDrizzleAuditLog } from "@/infra/audit/drizzle-audit-log";
+import type { AppPorts } from "@/ports";
+import type { AppServiceContextInput } from "@/server/context";
+import { ensureStarterDatabase } from "./bootstrap";
+import { createRepositories } from "./repositories";
+import type * as schema from "./schema";
+
+export const starterDatabaseProvider = createProvider<
+	{ db: DbPort<typeof schema> },
+	AppContext,
+	AppServiceContextInput
+>()({
+	name: "starter-database",
+
+	async setup({ ports, createServiceContext }) {
+		const dbPort = ports.db;
+		if (!dbPort) {
+			throw new Error(
+				"starterDatabaseProvider requires a db port. Register createDrizzleTursoProvider({ schema }) before it.",
+			);
+		}
+
+		const createBackgroundContext = () =>
+			createServiceContext({
+				actor: createSystemActor("starter-background"),
+			});
+
+		const mailInstrumentation = createProviderInstrumentation(ports, {
+			providerName: "memory-mailer",
+			watcher: "mail",
+		});
+		const eventBus = createInMemoryEventBus({
+			instrumentation: ports,
+			onHandlerError(error: unknown, eventName: string) {
+				console.error("Event handler failed", { error, eventName });
+			},
+		});
+		const jobs = createInlineJobDispatcher<AppContext>({
+			ctx: createBackgroundContext,
+		});
+		const notifications = createInlineNotificationDispatcher<AppContext>({
+			ctx: createBackgroundContext,
+			instrumentation: ports,
+		});
+		const mailer = createMemoryMailer({
+			defaultFrom: "Beignet Starter <noreply@example.local>",
+			onSend(delivery) {
+				mailInstrumentation.custom({
+					name: "mail.sent",
+					label: "Mail sent",
+					summary: delivery.message.subject,
+					details: {
+						to: delivery.message.to,
+						subject: delivery.message.subject,
+						id: delivery.id,
+					},
+				});
+			},
+		});
+		const audit = createInstrumentedAuditLog({
+			audit: createDrizzleAuditLog(dbPort.db),
+			instrumentation: ports,
+		});
+		const repositories = createRepositories(dbPort.db);
+		const idempotency = createDrizzleTursoIdempotencyPort(dbPort.db);
+		const outbox = createDrizzleTursoOutboxPort(dbPort.db);
+		const unregisterListeners = registerListeners(eventBus, todoListeners, {
+			ctx: createBackgroundContext,
+			onError(error, listener) {
+				console.error("Event listener failed", {
+					error,
+					listenerName: listener.name,
+				});
+			},
+		});
+
+		const providedPorts: Pick<
+			AppPorts,
+			| "audit"
+			| "eventBus"
+			| "idempotency"
+			| "jobs"
+			| "mailer"
+			| "notifications"
+			| "outbox"
+			| "todoAttachments"
+			| "todos"
+			| "uow"
+		> = {
+			audit,
+			...repositories,
+			eventBus,
+			idempotency,
+			jobs,
+			mailer,
+			notifications,
+			outbox,
+			uow: createDrizzleTursoUnitOfWork({
+				db: dbPort.db,
+				createTransactionPorts: (tx) => {
+					const txIdempotency = createDrizzleTursoIdempotencyPort(tx);
+					const txOutbox = createDrizzleTursoOutboxPort(tx);
+
+					return {
+						audit: createInstrumentedAuditLog({
+							audit: createDrizzleAuditLog(tx),
+							instrumentation: ports,
+						}),
+						...createRepositories(tx),
+						events: createOutboxEventRecorder(txOutbox),
+						idempotency: txIdempotency,
+						jobs: createOutboxJobDispatcher(txOutbox),
+						outbox: txOutbox,
+					};
+				},
+			}),
+		};
+
+		return {
+			ports: providedPorts,
+			async start() {
+				await ensureStarterDatabase(dbPort.client);
+			},
+			stop() {
+				unregisterListeners();
+			},
+		};
+	},
+});
+`,
+  productionContractsTodos: `import { defineContractGroup } from "@beignet/core/contracts";
 import { z } from "zod";
 import { errors } from "@/features/shared/errors";
 import {
-	createTodoUseCase,
-	getTodoUseCase,
-	listTodosUseCase,
-} from "@/features/todos/use-cases";
+	CreateTodoInputSchema,
+	GetTodoInputSchema,
+	ListTodosInputSchema,
+	ListTodosOutputSchema,
+	TodoSchema,
+} from "@/features/todos/schemas";
 
 const ErrorResponseSchema = z.object({
 	code: z.string(),
@@ -1736,7 +2882,7 @@ const ErrorResponseSchema = z.object({
 	requestId: z.string().optional(),
 });
 
-const todos = createContractGroup()
+const todos = defineContractGroup()
 	.namespace("todos")
 	.errors({ Unauthorized: errors.Unauthorized })
 	.responses({
@@ -1745,28 +2891,29 @@ const todos = createContractGroup()
 
 export const listTodos = todos
 	.get("/api/todos")
-	.query(listTodosUseCase.inputSchema)
+	.query(ListTodosInputSchema)
 	.responses({
-		200: listTodosUseCase.outputSchema,
+		200: ListTodosOutputSchema,
 	});
 
 export const createTodo = todos
 	.post("/api/todos")
-	.body(createTodoUseCase.inputSchema)
+	.body(CreateTodoInputSchema)
 	.errors({ Forbidden: errors.Forbidden })
 	.responses({
-		201: createTodoUseCase.outputSchema,
+		201: TodoSchema,
 	});
 
 export const getTodo = todos
 	.get("/api/todos/:id")
-	.pathParams(getTodoUseCase.inputSchema)
+	.pathParams(GetTodoInputSchema)
 	.errors({ TodoNotFound: errors.TodoNotFound })
 	.responses({
-		200: getTodoUseCase.outputSchema,
+		200: TodoSchema,
 	});
 `,
-  productionTodoRoutes: `import { defineRouteGroup } from "@beignet/next";
+  productionTodoRoutes: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { defineRouteGroup } from "@beignet/next";
 import type { AppContext } from "@/app-context";
 import { createTodo, getTodo, listTodos } from "@/features/todos/contracts";
 import {
@@ -1778,31 +2925,14 @@ import {
 export const todoRoutes = defineRouteGroup<AppContext>({
 	name: "todos",
 	routes: [
-		{
-			contract: listTodos,
-			handle: async ({ ctx, query }) => ({
-				status: 200,
-				body: await listTodosUseCase.run({ ctx, input: query }),
-			}),
-		},
-		{
-			contract: createTodo,
-			handle: async ({ ctx, body }) => ({
-				status: 201,
-				body: await createTodoUseCase.run({ ctx, input: body }),
-			}),
-		},
-		{
-			contract: getTodo,
-			handle: async ({ ctx, path }) => ({
-				status: 200,
-				body: await getTodoUseCase.run({ ctx, input: path }),
-			}),
-		},
+		{ contract: listTodos, useCase: listTodosUseCase },
+		{ contract: createTodo, useCase: createTodoUseCase },
+		{ contract: getTodo, useCase: getTodoUseCase },
 	],
 });
 `,
-  productionServerRoutes: `import { contractsFromRoutes, defineRoutes } from "@beignet/next";
+  productionServerRoutes: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { contractsFromRoutes, defineRoutes } from "@beignet/next";
 import type { AppContext } from "@/app-context";
 import { todoRoutes } from "@/features/todos/routes";
 
@@ -1811,45 +2941,126 @@ export const routes = defineRoutes<AppContext>([
 ]);
 export const contracts = contractsFromRoutes(routes);
 `,
-  productionServer: `import { createDevtoolsHooks } from "@beignet/devtools";
-import { createNextServer } from "@beignet/next";
+  productionServerContext: `import type { beignetServerOnly } from "@beignet/core/server-only";
 import {
+	type ActivityActor,
 	createAnonymousActor,
+	createServiceActor,
 	createTenant,
 	createUserActor,
 } from "@beignet/core/ports";
-import type { AppContext } from "@/app-context";
-import { appPorts } from "@/infra/app-ports";
-import { env } from "@/lib/env";
-import { providers } from "./providers";
-import { routes } from "./routes";
-
-export const server = await createNextServer({
-	ports: appPorts,
-	providers,
-	hooks: [
-		createDevtoolsHooks<AppContext>({
-			requestIdHeader: "x-request-id",
-		}),
-	],
-	createContext: async ({ req, ports }) => {
+import { defineServerContext } from "@beignet/core/server";
+import type { TraceContext } from "@beignet/core/tracing";
+import type { AppContext, AppRuntimePorts } from "@/app-context";
+
+export type AppServiceContextInput =
+	| {
+			actor?: ActivityActor;
+			tenantId?: string;
+	  }
+	| undefined;
+
+/**
+ * Context blueprint shared by the runtime server and route tests.
+ */
+export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
+	gate: (ports) => ports.gate,
+	request: async ({ req, ports, requestId, trace }) => {
 		const auth = await ports.auth.getSession(req);
 		const tenantId = req.headers.get("x-tenant-id") || undefined;
-		const context = {
-			requestId: req.headers.get("x-request-id") ?? crypto.randomUUID(),
+
+		return {
+			requestId,
 			actor: auth
 				? createUserActor(auth.user.id, { displayName: auth.user.name })
 				: createAnonymousActor(),
 			auth,
+			...trace,
 			ports,
 			tenant: tenantId ? createTenant(tenantId) : undefined,
 		};
+	},
+	service: ({
+		ports,
+		input,
+		requestId,
+		trace,
+	}: {
+		ports: AppRuntimePorts;
+		input: AppServiceContextInput;
+		requestId: string;
+		trace: TraceContext;
+	}) => ({
+		requestId,
+		actor: input?.actor ?? createServiceActor("beignet-service"),
+		auth: null,
+		...trace,
+		ports,
+		tenant: createTenant(input?.tenantId ?? "tenant_default"),
+	}),
+});
+`,
+  productionServer: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { createNextServer } from "@beignet/next";
+import { createIdempotencyHooks } from "@beignet/core/server";
+import type { AppContext } from "@/app-context";
+import { appPorts } from "@/infra/app-ports";
+import { env } from "@/lib/env";
+import { appContext } from "./context";
+import { providers } from "./providers";
+import { routes } from "./routes";
+
+export const server = await createNextServer({
+	ports: appPorts,
+	providers,
+	providerConfig: {
+		"drizzle-turso": {
+			DB_URL: env.TURSO_DB_URL,
+			DB_AUTH_TOKEN: env.TURSO_DB_AUTH_TOKEN,
+		},
+	},
+	hooks: [createIdempotencyHooks<AppContext>()],
+	context: appContext,
+	routes,
+	mapUnhandledError: ({ err, ctx }) => {
+		ctx?.ports.logger.error("Unhandled API error", {
+			error: err,
+			requestId: ctx?.requestId,
+			environment: env.NODE_ENV,
+		});
 
 		return {
-			...context,
-			gate: ports.gate.bind(context),
+			status: 500,
+			body: {
+				code: "INTERNAL_SERVER_ERROR",
+				message: "Internal server error",
+				requestId: ctx?.requestId,
+			},
 		};
 	},
+});
+`,
+  productionServerWithDrizzleTurso: `import type { beignetServerOnly } from "@beignet/core/server-only";
+import { createNextServer } from "@beignet/next";
+import { createIdempotencyHooks } from "@beignet/core/server";
+import type { AppContext } from "@/app-context";
+import { appPorts } from "@/infra/app-ports";
+import { env } from "@/lib/env";
+import { appContext } from "./context";
+import { providers } from "./providers";
+import { routes } from "./routes";
+
+export const server = await createNextServer({
+	ports: appPorts,
+	providers,
+	providerConfig: {
+		"drizzle-turso": {
+			DB_URL: env.TURSO_DB_URL,
+			DB_AUTH_TOKEN: env.TURSO_DB_AUTH_TOKEN,
+		},
+	},
+	hooks: [createIdempotencyHooks<AppContext>()],
+	context: appContext,
 	routes,
 	mapUnhandledError: ({ err, ctx }) => {
 		ctx?.ports.logger.error("Unhandled API error", {
@@ -1869,133 +3080,511 @@ export const server = await createNextServer({
 	},
 });
 `,
-  productionServerWithDrizzleTurso: `import { createDevtoolsHooks } from "@beignet/devtools";
-import { createNextServer } from "@beignet/next";
-import {
-	createAnonymousActor,
-	createTenant,
-	createUserActor,
-} from "@beignet/core/ports";
-import { createDrizzleTursoUnitOfWork } from "@beignet/provider-drizzle-turso";
-import type { AppContext } from "@/app-context";
-import { appPorts } from "@/infra/app-ports";
-import * as schema from "@/infra/db/schema";
-import { createRepositories } from "@/infra/db/repositories";
-import { env } from "@/lib/env";
-import type { AppTransactionPorts } from "@/ports";
-import { providers } from "./providers";
-import { routes } from "./routes";
+  productionApiCatchAllRoute: `import { server } from "@/server";
+
+export const GET = server.api;
+export const HEAD = server.api;
+export const OPTIONS = server.api;
+export const PATCH = server.api;
+export const POST = server.api;
+export const PUT = server.api;
+export const DELETE = server.api;
+`,
+  productionHealthRoute: `import { env } from "@/lib/env";
+
+export function GET() {
+	return Response.json(
+		{
+			status: "ok",
+			environment: env.NODE_ENV,
+			timestamp: new Date().toISOString(),
+		},
+		{
+			headers: {
+				"cache-control": "no-store",
+			},
+		},
+	);
+}
+`,
+  productionDevtoolsRoute: `import { createDevtoolsRoute } from "@beignet/devtools";
+import { server } from "@/server";
+
+export const { GET, POST } = createDevtoolsRoute(server.ports.devtools, {
+	basePath: "/api/devtools",
+});
+`,
+  productionStorageRoute: `import { createStorageRoute } from "@beignet/next";
+import { server } from "@/server";
+
+export const { GET, HEAD } = createStorageRoute(server.ports.storage, {
+	basePath: "/storage",
+});
+`,
+  productionOpenApiRoute: `import { createOpenAPIHandler } from "@beignet/next";
+import { server } from "@/server";
+
+export const GET = createOpenAPIHandler(server.contracts, {
+	title: "Beignet starter API",
+	version: "0.1.0",
+});
+`,
+  productionAuthRoute: `import { toNextJsHandler } from "better-auth/next-js";
+import { auth } from "@/lib/better-auth";
+
+export const { GET, POST } = toNextJsHandler(auth);
+`,
+  productionBetterAuth: `import { createClient } from "@libsql/client";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { drizzle } from "drizzle-orm/libsql";
+import * as schema from "@/infra/db/schema";
+import { ensureStarterDatabase } from "@/infra/db/bootstrap";
+import { env } from "@/lib/env";
+
+const client = createClient({
+	url: env.TURSO_DB_URL,
+	authToken: env.TURSO_DB_AUTH_TOKEN,
+});
+
+await ensureStarterDatabase(client);
+
+const db = drizzle(client, { schema });
+
+const trustedOrigins = [
+	env.APP_URL,
+	env.BETTER_AUTH_URL,
+	...(env.BETTER_AUTH_TRUSTED_ORIGINS?.split(",")
+		.map((origin) => origin.trim())
+		.filter(Boolean) ?? []),
+];
+
+export const auth = betterAuth({
+	baseURL: env.BETTER_AUTH_URL,
+	secret: env.BETTER_AUTH_SECRET,
+	trustedOrigins: [...new Set(trustedOrigins)],
+	database: drizzleAdapter(db, {
+		provider: "sqlite",
+		schema,
+	}),
+	emailAndPassword: {
+		enabled: true,
+	},
+});
+`,
+  productionDbSeed: `import { createClient } from "@libsql/client";
+import { ensureStarterDatabase } from "@/infra/db/bootstrap";
+import { env } from "@/lib/env";
+
+const client = createClient({
+	url: env.TURSO_DB_URL,
+	authToken: env.TURSO_DB_AUTH_TOKEN,
+});
+
+try {
+	await ensureStarterDatabase(client, { seed: true });
+	console.log("Database seeded.");
+} finally {
+	client.close();
+}
+`,
+  productionDbReset: `import { createClient } from "@libsql/client";
+import { resetStarterDatabase } from "@/infra/db/bootstrap";
+import { env } from "@/lib/env";
+
+if (!env.TURSO_DB_URL.startsWith("file:") && process.env.BEIGNET_ALLOW_DATABASE_RESET !== "true") {
+	throw new Error(
+		"Refusing to reset a non-local database. Set BEIGNET_ALLOW_DATABASE_RESET=true if this is intentional.",
+	);
+}
+
+const client = createClient({
+	url: env.TURSO_DB_URL,
+	authToken: env.TURSO_DB_AUTH_TOKEN,
+});
+
+try {
+	await resetStarterDatabase(client);
+	console.log("Database reset.");
+} finally {
+	client.close();
+}
+`,
+  productionDbTestDatabase: `import { existsSync, unlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { OutboxPort } from "@beignet/core/outbox";
+import { createDrizzleTursoOutboxPort } from "@beignet/provider-drizzle-turso";
+import { type Client, createClient } from "@libsql/client";
+import { drizzle, type LibSQLDatabase } from "drizzle-orm/libsql";
+import { createDrizzleAuditLog } from "@/infra/audit/drizzle-audit-log";
+import { ensureStarterDatabase, resetStarterDatabase } from "./bootstrap";
+import { createRepositories } from "./repositories";
+import * as schema from "./schema";
+
+export type TestDatabase = {
+\tclient: Client;
+\tdb: LibSQLDatabase<typeof schema>;
+\taudit: ReturnType<typeof createDrizzleAuditLog>;
+\toutbox: OutboxPort;
+\trepositories: ReturnType<typeof createRepositories>;
+\tpath: string;
+\treset(): Promise<void>;
+\tclose(): Promise<void>;
+};
+
+export async function createTestDatabase(): Promise<TestDatabase> {
+\tconst path = join(tmpdir(), "beignet-test-" + crypto.randomUUID() + ".db");
+\tconst client = createClient({ url: "file:" + path });
+\tawait ensureStarterDatabase(client, { seed: false });
+
+\tconst db = drizzle(client, { schema });
+
+\treturn {
+\t\tclient,
+\t\tdb,
+\t\taudit: createDrizzleAuditLog(db),
+\t\toutbox: createDrizzleTursoOutboxPort(db),
+\t\trepositories: createRepositories(db),
+\t\tpath,
+\t\treset: async () => {
+\t\t\tawait resetStarterDatabase(client);
+\t\t},
+\t\tclose: async () => {
+\t\t\tclient.close();
+\t\t\tif (existsSync(path)) {
+\t\t\t\tunlinkSync(path);
+\t\t\t}
+\t\t},
+\t};
+}
+`,
+  productionAuditHelper: `import type { AuditLogEntryInput } from "@beignet/core/ports";
+import type { AppContext } from "@/app-context";
+
+export function auditEntry(
+	ctx: AppContext,
+	entry: Omit<
+		AuditLogEntryInput,
+		"actor" | "tenant" | "requestId" | "traceId"
+	>,
+): AuditLogEntryInput {
+	return {
+		...entry,
+		actor: ctx.actor,
+		tenant: ctx.tenant,
+		requestId: ctx.requestId,
+		traceId: ctx.traceId,
+	};
+}
+`,
+  productionTodoEvents: `import { defineEvent } from "@beignet/core/events";
+import { z } from "zod";
+
+export const TodoCreated = defineEvent("todos.created", {
+	payload: z.object({
+		todoId: z.string().uuid(),
+		title: z.string(),
+	}),
+});
+
+export const todoEvents = [TodoCreated] as const;
+`,
+  productionTodoJobs: `import { retry } from "@beignet/core/jobs";
+import { z } from "zod";
+import { auditEntry } from "@/lib/audit";
+import { defineJob } from "@/lib/jobs";
+
+export const LogTodoCreatedJob = defineJob("todos.log-created", {
+	payload: z.object({
+		todoId: z.string().uuid(),
+		title: z.string(),
+	}),
+	retry: retry.exponential({
+		attempts: 3,
+		initialDelay: "1s",
+		maxDelay: "1m",
+	}),
+	async handle({ ctx, payload }) {
+		ctx.ports.logger.info("Todo created job handled", {
+			todoId: payload.todoId,
+		});
+		await ctx.ports.audit.record(
+			auditEntry(ctx, {
+				action: "jobs.todos.log-created",
+				resource: { type: "todo", id: payload.todoId, name: payload.title },
+				metadata: { jobName: "todos.log-created" },
+			}),
+		);
+	},
+});
+
+export const todoJobs = [LogTodoCreatedJob] as const;
+`,
+  productionTodoNotifications: `import { defineMailNotificationChannel } from "@beignet/core/notifications";
+import { z } from "zod";
+import { defineNotification } from "@/lib/notifications";
 
-export const server = await createNextServer({
-	ports: appPorts,
-	providers,
-	hooks: [
-		createDevtoolsHooks<AppContext>({
-			requestIdHeader: "x-request-id",
+export const TodoCreatedNotification = defineNotification(
+	"todos.created",
+	{
+		payload: z.object({
+			todoId: z.string().uuid(),
+			title: z.string(),
 		}),
-	],
-	createContext: async ({ req, ports }) => {
-		const auth = await ports.auth.getSession(req);
-		const tenantId = req.headers.get("x-tenant-id") || undefined;
-		const repositories = createRepositories(ports.db.db);
+		channels: {
+			email: defineMailNotificationChannel(({ payload }) => ({
+				to: "ops@example.local",
+				subject: \`Todo created: \${payload.title}\`,
+				text: \`Todo \${payload.todoId} was created.\`,
+			})),
+		},
+	},
+);
+`,
+  productionTodoListeners: `import { TodoCreated } from "@/features/todos/domain/events";
+import { LogTodoCreatedJob } from "@/features/todos/jobs";
+import { TodoCreatedNotification } from "@/features/todos/notifications";
+import { auditEntry } from "@/lib/audit";
+import { defineListener } from "@/lib/listeners";
+
+export const enqueueTodoCreatedWork = defineListener(TodoCreated, {
+	name: "todos.enqueue-created-work",
+	async handle({ ctx, payload }) {
+		await ctx.ports.jobs.dispatch(LogTodoCreatedJob, payload);
+		await ctx.ports.notifications.send(TodoCreatedNotification, payload);
+		await ctx.ports.audit.record(
+			auditEntry(ctx, {
+				action: "listeners.todos.enqueue-created-work",
+				resource: { type: "todo", id: payload.todoId, name: payload.title },
+				metadata: {
+					eventName: TodoCreated.name,
+					jobName: LogTodoCreatedJob.name,
+					notificationName: TodoCreatedNotification.name,
+				},
+			}),
+		);
+	},
+});
 
-		const context = {
-			requestId: req.headers.get("x-request-id") ?? crypto.randomUUID(),
-			actor: auth
-				? createUserActor(auth.user.id, { displayName: auth.user.name })
-				: createAnonymousActor(),
-			auth,
-			ports: {
-				...ports,
-				...repositories,
-				uow: createDrizzleTursoUnitOfWork<typeof schema, AppTransactionPorts>({
-					db: ports.db.db,
-					createTransactionPorts: (tx) => ({
-						...createRepositories(tx),
-					}),
+export const todoListeners = [enqueueTodoCreatedWork] as const;
+`,
+  productionTodoSchedules: `import { normalizeOffsetPage } from "@beignet/core/pagination";
+import { z } from "zod";
+import { auditEntry } from "@/lib/audit";
+import { defineSchedule } from "@/lib/schedules";
+
+export const LogDailyTodoSummarySchedule = defineSchedule(
+	"todos.log-daily-summary",
+	{
+		cron: "0 9 * * *",
+		timezone: "America/Chicago",
+		payload: z.object({
+			date: z.string(),
+		}),
+		createPayload({ run }) {
+			const date = run.scheduledAt ?? run.triggeredAt;
+			return { date: date.toISOString().slice(0, 10) };
+		},
+		async handle({ ctx, payload, run }) {
+			const { page } = await ctx.ports.todos.list(
+				normalizeOffsetPage(
+					{ limit: 1, offset: 0 },
+					{ defaultLimit: 1, maxLimit: 1 },
+				),
+			);
+			ctx.ports.logger.info("Daily todo summary schedule handled", {
+				date: payload.date,
+				todoCount: page.total,
+			});
+			await ctx.ports.audit.record(
+				auditEntry(ctx, {
+					action: "schedules.todos.daily-summary",
+					resource: {
+						type: "schedule",
+						id: "todos.log-daily-summary",
+						name: "Daily todo summary",
+					},
+					metadata: {
+						date: payload.date,
+						todoCount: page.total,
+						source: run.source ?? "inline",
+						triggeredAt: run.triggeredAt.toISOString(),
+					},
 				}),
-			},
-			tenant: tenantId ? createTenant(tenantId) : undefined,
-		};
+			);
+		},
+	},
+);
+
+export const todoSchedules = [LogDailyTodoSummarySchedule] as const;
+`,
+  productionSchedules: `import { createServiceActor } from "@beignet/core/ports";
+import type { AppContext } from "@/app-context";
+import { todoSchedules } from "@/features/todos/schedules";
+import { server } from "./index.js";
+
+export const schedules = [...todoSchedules] as const;
+
+export async function createScheduleContext(): Promise<AppContext> {
+	return server.createServiceContext({
+		actor: createServiceActor("beignet-schedule"),
+	});
+}
+
+export async function stopScheduleContext(): Promise<void> {
+	await server.stop();
+}
+`,
+  productionTodoUploads: `import { defineUpload, defineUploads } from "@beignet/core/uploads";
+import { z } from "zod";
+import type { AppContext } from "@/app-context";
+import { auditEntry } from "@/lib/audit";
+
+const todoAttachmentMetadataSchema = z.object({
+	todoId: z.string().uuid(),
+});
 
+export const TodoAttachmentUpload = defineUpload<
+	"todos.attachment",
+	typeof todoAttachmentMetadataSchema,
+	AppContext,
+	{ attachmentIds: string[] }
+>("todos.attachment", {
+	metadata: todoAttachmentMetadataSchema,
+	file: {
+		contentTypes: ["application/pdf", "text/plain", "text/plain;charset=utf-8"],
+		maxSizeBytes: 5 * 1024 * 1024,
+		maxFiles: 3,
+		visibility: "private",
+		cacheControl: "private, max-age=0",
+	},
+	authorize({ ctx }) {
+		return ctx.actor.type === "user"
+			? true
+			: {
+					allowed: false,
+					reason: "You must be signed in to upload todo attachments.",
+				};
+	},
+	key({ ctx, metadata, file, uploadId }) {
+		const tenantId = ctx.tenant?.id ?? "tenant_default";
+		const extension = file.name.includes(".")
+			? file.name.split(".").pop()
+			: undefined;
+		const suffix = extension ? \`.\${extension}\` : "";
+		return \`todos/\${tenantId}/\${metadata.todoId}/attachments/\${uploadId}\${suffix}\`;
+	},
+	storageMetadata({ ctx, metadata }) {
 		return {
-			...context,
-			gate: ports.gate.bind(context),
+			tenantId: ctx.tenant?.id ?? "tenant_default",
+			todoId: metadata.todoId,
 		};
 	},
-	routes,
-	mapUnhandledError: ({ err, ctx }) => {
-		ctx?.ports.logger.error("Unhandled API error", {
-			error: err,
-			requestId: ctx?.requestId,
-			environment: env.NODE_ENV,
-		});
+	async onComplete({ ctx, metadata, files }) {
+		const attachments = await Promise.all(
+			files.map((file) =>
+				ctx.ports.todoAttachments.create({
+					id: file.uploadId,
+					todoId: metadata.todoId,
+					key: file.key,
+					fileName: file.name,
+					contentType: file.contentType,
+					size: file.object.size,
+				}),
+			),
+		);
+		await ctx.ports.audit.record(
+			auditEntry(ctx, {
+				action: "todos.attachment.upload",
+				resource: { type: "todo", id: metadata.todoId },
+				metadata: {
+					attachmentCount: attachments.length,
+					keys: attachments.map((attachment) => attachment.key),
+				},
+			}),
+		);
 
 		return {
-			status: 500,
-			body: {
-				code: "INTERNAL_SERVER_ERROR",
-				message: "Internal server error",
-				requestId: ctx?.requestId,
-			},
+			attachmentIds: attachments.map((attachment) => attachment.id),
 		};
 	},
 });
-`,
-  productionApiCatchAllRoute: `import { server } from "@/server";
 
-export const GET = server.api;
-export const HEAD = server.api;
-export const OPTIONS = server.api;
-export const PATCH = server.api;
-export const POST = server.api;
-export const PUT = server.api;
-export const DELETE = server.api;
+export const todoUploads = defineUploads({
+	todoAttachment: TodoAttachmentUpload,
+});
 `,
-  productionHealthRoute: `import { env } from "@/lib/env";
+  productionOutbox: `import { defineOutboxRegistry } from "@beignet/core/outbox";
+import { createServiceActor } from "@beignet/core/ports";
+import type { AppContext } from "@/app-context";
+import { todoEvents } from "@/features/todos/domain/events";
+import { todoJobs } from "@/features/todos/jobs";
+import { server } from "./index.js";
 
-export function GET() {
-	return Response.json(
-		{
-			status: "ok",
-			environment: env.NODE_ENV,
-			timestamp: new Date().toISOString(),
-		},
-		{
-			headers: {
-				"cache-control": "no-store",
-			},
-		},
-	);
+export const outboxRegistry = defineOutboxRegistry({
+	events: todoEvents,
+	jobs: todoJobs,
+});
+
+export async function createOutboxDrainContext(): Promise<AppContext> {
+	return server.createServiceContext({
+		actor: createServiceActor("beignet-outbox"),
+	});
+}
+
+export async function stopOutboxDrainContext(): Promise<void> {
+	await server.stop();
 }
 `,
-  productionDevtoolsRoute: `import { createDevtoolsRoute } from "@beignet/devtools";
+  productionOutboxDrainRoute: `import { createOutboxDrainRoute } from "@beignet/next";
+import { env } from "@/lib/env";
 import { server } from "@/server";
+import { outboxRegistry } from "@/server/outbox";
 
-export const { GET, POST } = createDevtoolsRoute(server.ports.devtools, {
-	basePath: "/api/devtools",
+export const runtime = "nodejs";
+
+export const { GET, POST } = createOutboxDrainRoute({
+	server,
+	registry: outboxRegistry,
+	secret: env.CRON_SECRET,
 });
 `,
-  productionStorageRoute: `import { createStorageRoute } from "@beignet/next";
+  productionScheduleRoute: `import { createScheduleRoute } from "@beignet/next";
+import { env } from "@/lib/env";
 import { server } from "@/server";
+import { schedules } from "@/server/schedules";
 
-export const { GET, HEAD } = createStorageRoute(server.ports.storage, {
-	basePath: "/storage",
+export const runtime = "nodejs";
+
+export const { GET, POST } = createScheduleRoute({
+	server,
+	schedules,
+	schedule: "todos.log-daily-summary",
+	secret: env.CRON_SECRET,
+	source: "starter-cron-route",
 });
 `,
-  productionOpenApiRoute: `import { createOpenAPIHandler } from "@beignet/next";
+  productionUploadsRoute: `import { resolveProviderInstrumentationPort } from "@beignet/core/providers";
+import { createUploadRouter, uploadsFromRegistry } from "@beignet/core/uploads";
+import { createUploadRoute } from "@beignet/next";
+import type { AppContext } from "@/app-context";
+import { todoUploads } from "@/features/todos/uploads";
 import { server } from "@/server";
 
-export const GET = createOpenAPIHandler(server.contracts, {
-	title: "Beignet starter API",
-	version: "0.1.0",
+const uploadRouter = createUploadRouter<AppContext>({
+	uploads: uploadsFromRegistry(todoUploads),
+	ctx: () => server.createContextFromNext(),
+	storage: server.ports.storage,
+	instrumentation: resolveProviderInstrumentationPort(server.ports),
 });
+
+export const { POST } = createUploadRoute(uploadRouter);
 `,
 };
 
 function productionProviderPortImports(ctx: TemplateContext): string[] {
   const imports: string[] = [];
-  if (hasIntegration(ctx, "inngest")) imports.push("\tJobDispatcherPort,");
   if (hasIntegration(ctx, "upstash-rate-limit")) {
     imports.push("\tRateLimitPort,");
   }
@@ -2004,43 +3593,128 @@ function productionProviderPortImports(ctx: TemplateContext): string[] {
 
 function productionProviderPortFields(ctx: TemplateContext): string[] {
   const fields: string[] = [];
-  if (hasIntegration(ctx, "inngest")) fields.push("\tjobs: JobDispatcherPort;");
-  if (hasIntegration(ctx, "resend")) fields.push("\tmailer: MailerPort;");
   if (hasIntegration(ctx, "upstash-rate-limit")) {
     fields.push("\trateLimit: RateLimitPort;");
   }
   return fields;
 }
 
+function productionInfrastructurePortsWithDrizzleTurso(
+  ctx: TemplateContext,
+): string {
+  const deferred = [
+    '\t\t"audit",',
+    hasIntegration(ctx, "better-auth") ? '\t\t"auth",' : undefined,
+    '\t\t"eventBus",',
+    '\t\t"idempotency",',
+    '\t\t"jobs",',
+    '\t\t"logger",',
+    '\t\t"mailer",',
+    '\t\t"notifications",',
+    '\t\t"outbox",',
+    hasIntegration(ctx, "upstash-rate-limit") ? '\t\t"rateLimit",' : undefined,
+    '\t\t"storage",',
+    '\t\t"todoAttachments",',
+    '\t\t"todos",',
+    '\t\t"uow",',
+  ]
+    .filter((entry): entry is string => Boolean(entry))
+    .sort();
+  const bound = [
+    hasIntegration(ctx, "better-auth")
+      ? undefined
+      : "\t\tauth: createAnonymousAuth(),",
+    "\t\tgate,",
+  ].filter((entry): entry is string => Boolean(entry));
+  const imports = [
+    'import { createGate, definePorts } from "@beignet/core/ports";',
+    'import { todoPolicy } from "@/features/todos/policy";',
+    'import { appError } from "@/features/shared/errors";',
+    'import type { AppPorts } from "@/ports";',
+    hasIntegration(ctx, "better-auth")
+      ? undefined
+      : 'import { createAnonymousAuth } from "./auth/anonymous-auth";',
+  ].filter((entry): entry is string => Boolean(entry));
+
+  return `${imports.join("\n")}
+
+const gate = createGate({
+	policies: [todoPolicy],
+	onDeny(decision) {
+		return appError("Forbidden", {
+			message: decision.reason ?? "Forbidden",
+			details: decision.details,
+		});
+	},
+});
+
+/**
+ * App ports the server boots with.
+ *
+ * Bound ports are app-owned. Every deferred key is contributed by a provider
+ * in server/providers.ts during startup; createServer(...) fails boot if any
+ * of them is still unbound after providers have started.
+ */
+export const appPorts = definePorts<AppPorts>()({
+	bound: {
+${bound.join("\n")}
+	},
+	deferred: [
+${deferred.join("\n")}
+	],
+});
+`;
+}
+
 function productionPorts(ctx: TemplateContext): string {
-  const mailImport = hasIntegration(ctx, "resend")
-    ? 'import type { MailerPort } from "@beignet/core/mail";\n'
-    : "";
+  const mailImport = 'import type { MailerPort } from "@beignet/core/mail";\n';
   const imports = [
+    "\tAuditLogPort,",
     "\tBoundGate,",
+    "\tEventBusPort,",
     "\tGatePort,",
+    "\tJobDispatcherPort,",
     "\tLoggerPort,",
     ...productionProviderPortImports(ctx),
+    "\tStoragePort,",
     "\tUnitOfWorkPort,",
   ];
   const providerFields = productionProviderPortFields(ctx);
 
-  return `import type {
+  return `import type { IdempotencyPort } from "@beignet/core/idempotency";
+${mailImport}import type { NotificationPort } from "@beignet/core/notifications";
+import type { OutboxPort } from "@beignet/core/outbox";
+import type {
 ${imports.join("\n")}
 } from "@beignet/core/ports";
-${mailImport}import type { AuthorizationContext, todoPolicy } from "@/features/todos/policy";
+import type { AuthorizationContext, todoPolicy } from "@/features/todos/policy";
 import type { AuthPort } from "./auth";
-import type { TodoRepository } from "@/features/todos/ports";
+import type { TodoAttachmentRepository, TodoRepository } from "@/features/todos/ports";
 
 export type AppTransactionPorts = {
+	audit: AuditLogPort;
+	events: import("@beignet/core/ports").BufferedDomainEventRecorder;
+	idempotency: IdempotencyPort;
+	jobs: JobDispatcherPort;
+	outbox: OutboxPort;
+	todoAttachments: TodoAttachmentRepository;
 	todos: TodoRepository;
 };
 
 export type AppGate = BoundGate<[typeof todoPolicy]>;
 
 export type AppPorts = {
+	audit: AuditLogPort;
 	auth: AuthPort;
+	eventBus: EventBusPort;
 	gate: GatePort<AuthorizationContext, [typeof todoPolicy]>;
+	idempotency: IdempotencyPort;
+	jobs: JobDispatcherPort;
+	mailer: MailerPort;
+	notifications: NotificationPort;
+	outbox: OutboxPort;
+	storage: StoragePort;
+	todoAttachments: TodoAttachmentRepository;
 	todos: TodoRepository;
 	logger: LoggerPort;
 ${providerFields.length > 0 ? `${providerFields.join("\n")}\n` : ""}	uow: UnitOfWorkPort<AppTransactionPorts>;
@@ -2049,37 +3723,54 @@ ${providerFields.length > 0 ? `${providerFields.join("\n")}\n` : ""}	uow: UnitOf
 }
 
 function productionPortsWithDrizzleTurso(ctx: TemplateContext): string {
-  const mailImport = hasIntegration(ctx, "resend")
-    ? 'import type { MailerPort } from "@beignet/core/mail";\n'
-    : "";
+  const mailImport = 'import type { MailerPort } from "@beignet/core/mail";\n';
   const imports = [
+    "\tAuditLogPort,",
     "\tBoundGate,",
+    "\tEventBusPort,",
     "\tGatePort,",
+    "\tJobDispatcherPort,",
     "\tLoggerPort,",
     ...productionProviderPortImports(ctx),
+    "\tStoragePort,",
     "\tUnitOfWorkPort,",
   ];
   const providerFields = productionProviderPortFields(ctx);
 
-  return `import type {
+  return `import type { IdempotencyPort } from "@beignet/core/idempotency";
+${mailImport}import type { NotificationPort } from "@beignet/core/notifications";
+import type { OutboxPort } from "@beignet/core/outbox";
+import type {
 ${imports.join("\n")}
 } from "@beignet/core/ports";
-${mailImport}import type { DbPort } from "@beignet/provider-drizzle-turso";
-import * as schema from "@/infra/db/schema";
 import type { AuthorizationContext, todoPolicy } from "@/features/todos/policy";
 import type { AuthPort } from "./auth";
-import type { TodoRepository } from "@/features/todos/ports";
+import type { TodoAttachmentRepository, TodoRepository } from "@/features/todos/ports";
 
 export type AppTransactionPorts = {
+	audit: AuditLogPort;
+	events: import("@beignet/core/ports").BufferedDomainEventRecorder;
+	idempotency: IdempotencyPort;
+	jobs: JobDispatcherPort;
+	outbox: OutboxPort;
+	todoAttachments: TodoAttachmentRepository;
 	todos: TodoRepository;
 };
 
 export type AppGate = BoundGate<[typeof todoPolicy]>;
 
 export type AppPorts = {
+	audit: AuditLogPort;
 	auth: AuthPort;
-	db: DbPort<typeof schema>;
+	eventBus: EventBusPort;
 	gate: GatePort<AuthorizationContext, [typeof todoPolicy]>;
+	idempotency: IdempotencyPort;
+	jobs: JobDispatcherPort;
+	mailer: MailerPort;
+	notifications: NotificationPort;
+	outbox: OutboxPort;
+	storage: StoragePort;
+	todoAttachments: TodoAttachmentRepository;
 	todos: TodoRepository;
 	logger: LoggerPort;
 ${providerFields.length > 0 ? `${providerFields.join("\n")}\n` : ""}	uow: UnitOfWorkPort<AppTransactionPorts>;
@@ -2089,7 +3780,11 @@ ${providerFields.length > 0 ? `${providerFields.join("\n")}\n` : ""}	uow: UnitOf
 
 function productionServerProviders(ctx: TemplateContext): string {
   const imports = [
+    'import type { beignetServerOnly } from "@beignet/core/server-only";',
     'import { createDevtoolsProvider } from "@beignet/devtools";',
+    hasIntegration(ctx, "better-auth")
+      ? 'import { createAuthBetterAuthProvider } from "@beignet/provider-auth-better-auth";'
+      : undefined,
     hasDrizzleTurso(ctx)
       ? 'import { createDrizzleTursoProvider } from "@beignet/provider-drizzle-turso";'
       : undefined,
@@ -2107,6 +3802,13 @@ function productionServerProviders(ctx: TemplateContext): string {
     hasDrizzleTurso(ctx)
       ? 'import * as schema from "@/infra/db/schema";'
       : undefined,
+    hasIntegration(ctx, "better-auth")
+      ? 'import { auth } from "@/lib/better-auth";'
+      : undefined,
+    'import { starterDatabaseProvider } from "@/infra/db/provider";',
+    hasIntegration(ctx, "better-auth")
+      ? 'import type { AuthSessionMetadata, AuthUser } from "@/ports/auth";'
+      : undefined,
   ].filter((line): line is string => Boolean(line));
 
   const declarations = hasDrizzleTurso(ctx)
@@ -2114,9 +3816,13 @@ function productionServerProviders(ctx: TemplateContext): string {
     : "";
   const entries = [
     "\tcreateDevtoolsProvider(),",
+    hasIntegration(ctx, "better-auth")
+      ? "\tcreateAuthBetterAuthProvider<AuthUser, AuthSessionMetadata>(auth),"
+      : undefined,
     "\tlocalStorageProvider,",
     "\tloggerPinoProvider,",
     hasDrizzleTurso(ctx) ? "\tdrizzleTursoProvider," : undefined,
+    "\tstarterDatabaseProvider,",
     hasIntegration(ctx, "inngest") ? "\tinngestProvider," : undefined,
     hasIntegration(ctx, "resend") ? "\tmailResendProvider," : undefined,
     hasIntegration(ctx, "upstash-rate-limit")
@@ -2128,46 +3834,26 @@ function productionServerProviders(ctx: TemplateContext): string {
 ${declarations}
 export const providers = [
 ${entries.join("\n")}
-];
+] as const;
 `;
 }
 
-function productionTodosTest(ctx: TemplateContext): string {
-  const portImports = [
-    hasIntegration(ctx, "upstash-rate-limit")
-      ? "createMemoryRateLimiter"
-      : undefined,
-    "createMemoryStorage",
-    "createNoopUnitOfWork",
-    "createUserActor",
-  ].filter((item): item is string => Boolean(item));
-  const extraPorts = [
-    hasDrizzleTurso(ctx)
-      ? "\t\t\tdb: { db: undefined as never, client: undefined as never },"
-      : undefined,
-    hasIntegration(ctx, "inngest")
-      ? "\t\t\tjobs: { dispatch: async () => undefined },"
-      : undefined,
-    hasIntegration(ctx, "resend")
-      ? '\t\t\tmailer: { send: async () => ({ provider: "test" }) },'
-      : undefined,
-    hasIntegration(ctx, "upstash-rate-limit")
-      ? "\t\t\trateLimit: createMemoryRateLimiter(),"
-      : undefined,
-  ].filter((entry): entry is string => Boolean(entry));
-
+function productionTodosTest(_ctx: TemplateContext): string {
   return `import { describe, expect, it } from "bun:test";
 import { createUseCaseTester } from "@beignet/core/application";
+import { offsetPageResult, type OffsetPage } from "@beignet/core/pagination";
 import { createInMemoryDevtools } from "@beignet/devtools";
-import { ${portImports.join(", ")} } from "@beignet/core/ports";
+import { createDomainEventRecorder } from "@beignet/core/ports";
+import { createTestContextFactory, createTestPorts } from "@beignet/core/testing";
+import { createTestUserActor } from "@beignet/core/ports/testing";
 import type { AppContext } from "@/app-context";
 import { appPorts } from "@/infra/app-ports";
+import type { AppTransactionPorts } from "@/ports";
 import {
 	createTodoUseCase,
 	getTodoUseCase,
 	listTodosUseCase,
 	type CreateTodoInput,
-	type ListTodosInput,
 	type Todo,
 } from "../use-cases";
 
@@ -2175,15 +3861,16 @@ function createTestTodoRepository() {
 	const todos = new Map<string, Todo>();
 
 	return {
-		async list(input: ListTodosInput) {
+		async list(page: OffsetPage) {
 			const allTodos = Array.from(todos.values()).sort((left, right) =>
 				left.createdAt.localeCompare(right.createdAt),
 			);
 
-			return {
-				todos: allTodos.slice(input.offset, input.offset + input.limit),
-				total: allTodos.length,
-			};
+			return offsetPageResult(
+				allTodos.slice(page.offset, page.offset + page.limit),
+				page,
+				allTodos.length,
+			);
 		},
 		async findById(id: string) {
 			return todos.get(id) ?? null;
@@ -2201,9 +3888,31 @@ function createTestTodoRepository() {
 	};
 }
 
+function createTestTodoAttachmentRepository() {
+	return {
+		async create(input: {
+			id: string;
+			todoId: string;
+			key: string;
+			fileName: string;
+			contentType: string;
+			size: number;
+		}) {
+			return {
+				...input,
+				createdAt: new Date().toISOString(),
+			};
+		},
+		async findMany() {
+			return [];
+		},
+	};
+}
+
 describe("todos resource", () => {
 	it("creates, gets, and lists todos", async () => {
 		const todos = createTestTodoRepository();
+		const todoAttachments = createTestTodoAttachmentRepository();
 		const auth = {
 			user: {
 				id: "user_test",
@@ -2212,23 +3921,31 @@ describe("todos resource", () => {
 			},
 			session: { id: "session_test" },
 		};
-		const actor = createUserActor(auth.user.id, {
-			displayName: auth.user.name,
+		const testFixture = createTestPorts<AppContext["ports"], AppTransactionPorts>({
+			base: appPorts,
+			overrides: {
+				gate: appPorts.gate,
+				todoAttachments,
+				todos,
+				devtools: createInMemoryDevtools(),
+			},
+			transaction: {
+				ports: (ports) => ({
+					...ports,
+					events: createDomainEventRecorder(),
+					todoAttachments,
+					todos,
+				}),
+			},
 		});
-		const testPorts = {
-			...appPorts,
-			todos,
-${extraPorts.length > 0 ? `${extraPorts.join("\n")}\n` : ""}			uow: createNoopUnitOfWork(() => ({ todos })) as AppContext["ports"]["uow"],
-			devtools: createInMemoryDevtools(),
-			storage: createMemoryStorage(),
-		};
-		const tester = createUseCaseTester<AppContext>(() => ({
-			requestId: "test-request",
-			actor,
+		const createTestContext = createTestContextFactory<AppContext, AppContext["ports"]>({
+			ports: testFixture.ports,
+			actor: createTestUserActor(auth.user.id, {
+				displayName: auth.user.name,
+			}),
 			auth,
-			gate: testPorts.gate.bind({ actor, auth }),
-			ports: testPorts,
-		}));
+		});
+		const tester = createUseCaseTester<AppContext>(createTestContext);
 
 		const ctx = await tester.ctx();
 		const created = await tester.run(
@@ -2245,8 +3962,8 @@ ${extraPorts.length > 0 ? `${extraPorts.join("\n")}\n` : ""}			uow: createNoopUn
 
 		expect(created.title).toBe("First todo");
 		expect(found.id).toBe(created.id);
-		expect(result.total).toBe(1);
-		expect(result.todos).toEqual([created]);
+		expect(result.page.total).toBe(1);
+		expect(result.items).toEqual([created]);
 	});
 });
 `;
@@ -2284,8 +4001,24 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
       path: "app/api/openapi/route.ts",
       content: files.productionOpenApiRoute,
     },
-    { path: "client/api-client.ts", content: files.apiClient },
-    { path: "client/rq.ts", content: files.rq },
+    {
+      path: "app/api/auth/[...all]/route.ts",
+      content: files.productionAuthRoute,
+    },
+    {
+      path: "app/api/cron/outbox/drain/route.ts",
+      content: files.productionOutboxDrainRoute,
+    },
+    {
+      path: "app/api/cron/todos/daily-summary/route.ts",
+      content: files.productionScheduleRoute,
+    },
+    {
+      path: "app/api/uploads/[uploadName]/[action]/route.ts",
+      content: files.productionUploadsRoute,
+    },
+    { path: "client/index.ts", content: clientIndex(ctx) },
+    { path: "client/forms.ts", content: files.formsClient },
     {
       path: "features/todos/contracts.ts",
       content: files.productionContractsTodos,
@@ -2296,16 +4029,43 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     {
       path: "infra/app-ports.ts",
       content: usesDrizzleTurso
-        ? files.productionInfrastructurePortsWithDrizzleTurso
+        ? productionInfrastructurePortsWithDrizzleTurso(ctx)
         : files.productionInfrastructurePorts,
     },
     { path: "lib/env.ts", content: files.productionEnv },
+    { path: "lib/audit.ts", content: files.productionAuditHelper },
     { path: "lib/auth.ts", content: files.productionAuthHelpers },
+    { path: "lib/better-auth.ts", content: files.productionBetterAuth },
     { path: "features/todos/policy.ts", content: files.productionTodoPolicy },
     {
-      path: "infra/auth/anonymous-auth.ts",
-      content: files.productionAnonymousAuth,
+      path: "features/todos/domain/events/index.ts",
+      content: files.productionTodoEvents,
+    },
+    { path: "features/todos/jobs/index.ts", content: files.productionTodoJobs },
+    {
+      path: "features/todos/listeners/index.ts",
+      content: files.productionTodoListeners,
+    },
+    {
+      path: "features/todos/notifications/index.ts",
+      content: files.productionTodoNotifications,
+    },
+    {
+      path: "features/todos/schedules/index.ts",
+      content: files.productionTodoSchedules,
     },
+    {
+      path: "features/todos/uploads/index.ts",
+      content: files.productionTodoUploads,
+    },
+    ...(!hasIntegration(ctx, "better-auth")
+      ? [
+          {
+            path: "infra/auth/anonymous-auth.ts",
+            content: files.productionAnonymousAuth,
+          },
+        ]
+      : []),
     { path: "ports/auth.ts", content: files.productionAuthPort },
     {
       path: "ports/index.ts",
@@ -2319,7 +4079,7 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     },
     {
       path: "features/shared/errors.ts",
-      content: files.productimapUnhandledErrors,
+      content: files.productionSharedErrors,
     },
     {
       path: "server/index.ts",
@@ -2327,12 +4087,22 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
         ? files.productionServerWithDrizzleTurso
         : files.productionServer,
     },
+    { path: "server/context.ts", content: files.productionServerContext },
     { path: "server/routes.ts", content: files.productionServerRoutes },
+    { path: "server/outbox.ts", content: files.productionOutbox },
+    { path: "server/schedules.ts", content: files.productionSchedules },
     {
       path: "server/providers.ts",
       content: productionServerProviders(ctx),
     },
     { path: "lib/use-case.ts", content: files.productionUseCaseBuilder },
+    { path: "lib/listeners.ts", content: files.productionListenersBuilder },
+    { path: "lib/jobs.ts", content: files.productionJobsBuilder },
+    { path: "lib/schedules.ts", content: files.productionSchedulesBuilder },
+    {
+      path: "lib/notifications.ts",
+      content: files.productionNotificationsBuilder,
+    },
     {
       path: "features/todos/use-cases/create-todo.ts",
       content: files.productionCreateTodoUseCase,
@@ -2350,7 +4120,7 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
       content: files.productionUseCasesIndex,
     },
     {
-      path: "features/todos/use-cases/schemas.ts",
+      path: "features/todos/schemas.ts",
       content: files.productionTodoSchemas,
     },
     {
@@ -2363,6 +4133,30 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
   if (usesDrizzleTurso) {
     templateFiles.push(
       { path: "drizzle.config.ts", content: files.productionDrizzleConfig },
+      {
+        path: "infra/audit/drizzle-audit-log.ts",
+        content: files.productionDrizzleAuditLog,
+      },
+      {
+        path: "infra/db/bootstrap.ts",
+        content: files.productionDbBootstrap,
+      },
+      {
+        path: "infra/db/seed.ts",
+        content: files.productionDbSeed,
+      },
+      {
+        path: "infra/db/reset.ts",
+        content: files.productionDbReset,
+      },
+      {
+        path: "infra/db/test-database.ts",
+        content: files.productionDbTestDatabase,
+      },
+      {
+        path: "infra/db/provider.ts",
+        content: files.productionDbProvider,
+      },
       {
         path: "infra/db/schema/index.ts",
         content: files.productionDbSchema,
@@ -2386,6 +4180,9 @@ function getProductionTemplateFiles(ctx: TemplateContext): TemplateFile[] {
   return templateFiles;
 }
 
+/**
+ * Render all template files for a new Beignet app.
+ */
 export function getTemplateFiles(ctx: TemplateContext): TemplateFile[] {
   if (isStandardPreset(ctx)) {
     return getProductionTemplateFiles(ctx);
@@ -2402,29 +4199,37 @@ export function getTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     { path: "app/layout.tsx", content: layout(ctx) },
     { path: "app/page.tsx", content: page(ctx) },
     { path: "app/api/[[...path]]/route.ts", content: files.apiCatchAllRoute },
+    { path: "app-context.ts", content: minimalAppContext(ctx) },
     { path: "features/todos/contracts.ts", content: files.contractsTodos },
     { path: "features/todos/routes.ts", content: files.todoRoutes },
-    { path: "ports/index.ts", content: files.ports },
+    { path: "ports/index.ts", content: minimalPorts(ctx) },
     { path: "server/index.ts", content: server(ctx) },
+    { path: "server/context.ts", content: serverContext(ctx) },
     { path: "server/routes.ts", content: files.serverRoutes },
-    { path: "features/todos/use-cases.ts", content: files.useCasesTodos },
+    { path: "features/todos/use-cases/index.ts", content: files.useCasesTodos },
   ];
 
   if (hasFeature(ctx, "client")) {
     templateFiles.push({
-      path: "client/api-client.ts",
-      content: files.apiClient,
+      path: "client/index.ts",
+      content: clientIndex(ctx),
     });
   }
 
   if (hasFeature(ctx, "react-query")) {
     templateFiles.push(
       { path: "app/providers.tsx", content: files.appProviders },
-      { path: "client/rq.ts", content: files.rq },
       { path: "features/todos/components/todo-app.tsx", content: todoApp(ctx) },
     );
   }
 
+  if (hasFeature(ctx, "forms")) {
+    templateFiles.push({
+      path: "client/forms.ts",
+      content: files.formsClient,
+    });
+  }
+
   if (hasFeature(ctx, "openapi")) {
     templateFiles.push({
       path: "app/api/openapi/route.ts",
@@ -2432,19 +4237,34 @@ export function getTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     });
   }
 
-  if (
-    ctx.integrations.some((integration) =>
-      ["pino", "inngest", "resend", "upstash-rate-limit"].includes(integration),
-    )
-  ) {
-    templateFiles.push({
-      path: "server/providers.ts",
-      content: serverProviders(ctx),
-    });
+  if (hasIntegration(ctx, "better-auth")) {
+    templateFiles.push(
+      { path: "lib/better-auth.ts", content: files.minimalBetterAuth },
+      {
+        path: "app/api/auth/[...all]/route.ts",
+        content: files.productionAuthRoute,
+      },
+    );
+  }
+
+  if (hasDrizzleTurso(ctx)) {
+    templateFiles.push(
+      { path: "drizzle.config.ts", content: files.productionDrizzleConfig },
+      { path: "infra/db/provider.ts", content: files.minimalDbProvider },
+      { path: "infra/db/schema/index.ts", content: files.minimalDbSchema },
+      {
+        path: "infra/todos/drizzle-todo-repository.ts",
+        content: files.minimalDrizzleTodoRepository,
+      },
+    );
   }
 
   if (ctx.integrations.length > 0) {
     templateFiles.push(
+      {
+        path: "server/providers.ts",
+        content: serverProviders(ctx),
+      },
       {
         path: ".env.example",
         content: envExample(ctx),