@getstrata/starter 0.1.4 → 0.1.9

package/dist/cli.js

@@ -1,77 +1,2430 @@
 #!/usr/bin/env bun
 // @bun
 
-// cli.ts
-import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "fs";
-import { join, resolve } from "path";
+// src/generate.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, rmSync as rmSync2 } from "fs";
+import { join as join2, resolve } from "path";
+
+// src/copy.ts
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { join } from "path";
 var PLACEHOLDER = /\{\{PROJECT_NAME\}\}/g;
+function copyTree(source, target, projectName, skipNames = new Set) {
+  mkdirSync(target, { recursive: true });
+  for (const entry of readdirSync(source)) {
+    if (skipNames.has(entry) || entry === ".DS_Store") {
+      continue;
+    }
+    const from = join(source, entry);
+    const to = join(target, entry.replace(PLACEHOLDER, projectName));
+    const info = statSync(from);
+    if (info.isDirectory()) {
+      copyTree(from, to, projectName, skipNames);
+      continue;
+    }
+    let contents = readFileSync(from, "utf8");
+    if (contents.includes("{{PROJECT_NAME}}")) {
+      contents = contents.replace(PLACEHOLDER, projectName);
+    }
+    writeFileSync(to, contents, { mode: info.mode & 511 });
+  }
+}
+function copyOverlayTree(sourceRoot, targetRoot) {
+  if (!existsSync(sourceRoot)) {
+    return;
+  }
+  for (const entry of readdirSync(sourceRoot, { withFileTypes: true })) {
+    const sourcePath = join(sourceRoot, entry.name);
+    const targetPath = join(targetRoot, entry.name);
+    if (entry.isDirectory()) {
+      mkdirSync(targetPath, { recursive: true });
+      copyOverlayTree(sourcePath, targetPath);
+      continue;
+    }
+    if (existsSync(targetPath)) {
+      continue;
+    }
+    mkdirSync(join(targetPath, ".."), { recursive: true });
+    const contents = readFileSync(sourcePath);
+    writeFileSync(targetPath, contents);
+  }
+}
+function writeText(target, contents) {
+  mkdirSync(join(target, ".."), { recursive: true });
+  writeFileSync(target, contents.endsWith(`
+`) ? contents : `${contents}
+`);
+}
+function removeIfExists(path) {
+  if (existsSync(path)) {
+    rmSync(path, { recursive: true, force: true });
+  }
+}
+
+// src/types.ts
+var FRONTENDS = ["api", "server-htmx", "spa-react", "hybrid"];
+var DATABASES = ["sqlite", "postgres", "mysql"];
+var AUTH_STACKS = [
+  "headers",
+  "cookie",
+  "token",
+  "jwt",
+  "cookie-token",
+  "cookie-token-jwt"
+];
+var TENANCY_DRIVERS = ["none", "rls"];
+var CACHE_DRIVERS = ["array", "redis"];
+var QUEUE_DRIVERS = ["sync", "redis"];
+var MAIL_DRIVERS = ["log", "smtp"];
+var DOCKER_SERVICE_NAMES = ["postgres", "mysql", "redis", "mailpit"];
+var DOCKER_SERVICE_LABELS = {
+  postgres: "Postgres",
+  mysql: "MySQL",
+  redis: "Redis",
+  mailpit: "SMTP (Mailpit)"
+};
+function authUsesCookie(auth) {
+  return auth === "cookie" || auth.startsWith("cookie-");
+}
+function authUsesToken(auth) {
+  return auth === "token" || auth.includes("token");
+}
+function authUsesJwt(auth) {
+  return auth === "jwt" || auth.endsWith("jwt");
+}
+function authNeedsUsers(auth) {
+  return auth !== "headers";
+}
+function needsRedis(layers) {
+  return layers.cache === "redis" || layers.queue === "redis";
+}
+function emptyDockerServices() {
+  return { postgres: false, mysql: false, redis: false, mailpit: false };
+}
+function enableDockerServices(names) {
+  const services = emptyDockerServices();
+  for (const name of names) {
+    services[name] = true;
+  }
+  return services;
+}
+function neededDockerServices(layers) {
+  const needed = [];
+  if (layers.database === "postgres") {
+    needed.push("postgres");
+  }
+  if (layers.database === "mysql") {
+    needed.push("mysql");
+  }
+  if (needsRedis(layers)) {
+    needed.push("redis");
+  }
+  if (layers.mail === "smtp") {
+    needed.push("mailpit");
+  }
+  return needed;
+}
+function selectedDockerServices(layers) {
+  if (!layers.docker.enabled) {
+    return [];
+  }
+  return neededDockerServices(layers).filter((name) => layers.docker.services[name]);
+}
+function reconcileDocker(layers) {
+  const selected = selectedDockerServices(layers);
+  return {
+    ...layers,
+    docker: {
+      enabled: selected.length > 0,
+      services: enableDockerServices(selected)
+    }
+  };
+}
+function dockerLayerForNeeded(layers, enabled) {
+  const needed = neededDockerServices(layers);
+  if (!enabled || needed.length === 0) {
+    return { enabled: false, services: emptyDockerServices() };
+  }
+  return { enabled: true, services: enableDockerServices(needed) };
+}
+
+// src/presets.ts
+var noneExtras = {
+  mfa: false,
+  emailVerification: false,
+  scim: false,
+  metrics: false
+};
+var enterpriseExtras = {
+  mfa: true,
+  emailVerification: true,
+  scim: true,
+  metrics: true
+};
+function withDocker(layers, composeForNeededTools) {
+  return {
+    ...layers,
+    docker: dockerLayerForNeeded(layers, composeForNeededTools)
+  };
+}
+function defaultLayers() {
+  return withDocker({
+    frontend: "api",
+    database: "sqlite",
+    auth: "headers",
+    tenancy: "none",
+    cache: "array",
+    queue: "sync",
+    mail: "log",
+    spaPrefix: "/app",
+    extras: { ...noneExtras }
+  }, false);
+}
+var EXAMPLE_APPS = {
+  "hiroapp-hobby": defaultLayers(),
+  "hiroapp-team": withDocker({
+    frontend: "server-htmx",
+    database: "postgres",
+    auth: "cookie",
+    tenancy: "none",
+    cache: "redis",
+    queue: "redis",
+    mail: "log",
+    spaPrefix: "/app",
+    extras: { ...noneExtras, metrics: true }
+  }, true),
+  hiroapp: withDocker({
+    frontend: "server-htmx",
+    database: "postgres",
+    auth: "cookie-token-jwt",
+    tenancy: "rls",
+    cache: "redis",
+    queue: "redis",
+    mail: "smtp",
+    spaPrefix: "/app",
+    extras: { ...enterpriseExtras }
+  }, true)
+};
+
+// src/parseArgs.ts
 function usage() {
-  console.log(`Usage: create-strata [project-name]
+  return `Usage: create-strata [project-name] [options]
+
+Scaffold a runnable Strata app. The wizard always asks each layer. For CI, pass --yes
+and the layer flags you want (defaults are SQLite, JSON API, header auth).
 
-Scaffold a new Strata application with Bun, @getstrata/core, and @getstrata/bootstrap.
+Options:
+  --frontend          api | server-htmx | spa-react | hybrid
+  --database          sqlite | postgres | mysql (one database; not mixed)
+  --auth              headers | cookie | token | jwt | cookie-token | cookie-token-jwt
+  --tenancy           none | rls
+  --cache             array | redis
+  --queue             sync | redis
+  --mail              log | smtp
+  --spa-prefix        SPA URL prefix (default /app)
+  --mfa / --no-mfa
+  --email-verification / --no-email-verification
+  --scim / --no-scim
+  --metrics / --no-metrics
+  --extras            Prompt (or enable) MFA, email verification, SCIM, metrics
+  --docker            Write Docker Compose for every selected tool that needs a service
+  --no-docker         Skip docker-compose.yml; use installs already on this machine
+  --docker-services   Subset: postgres, mysql, redis, mailpit (comma-separated)
+  --force             Replace an existing directory
+  --yes, --no-interactive
+  -h, --help
 
 Examples:
-  bunx @getstrata/starter my-app
   bunx create-strata my-app
+  bunx create-strata my-app --yes
+  bunx create-strata html --frontend server-htmx --database postgres --auth cookie --cache redis --queue redis --docker --yes
+  bunx create-strata html --frontend server-htmx --database postgres --no-docker --yes
+`;
+}
+function takeValue(arg, prefix) {
+  if (arg.startsWith(`${prefix}=`)) {
+    return arg.slice(prefix.length + 1);
+  }
+  return;
+}
+function parseEnum(value, allowed, label) {
+  if (allowed.includes(value)) {
+    return value;
+  }
+  throw new Error(`Unknown ${label} "${value}". Expected ${allowed.join(", ")}.`);
+}
+function parseDockerServiceList(raw) {
+  const names = raw.split(",").map((part) => part.trim().toLowerCase()).filter((part) => part.length > 0);
+  const unknown = names.filter((name) => !DOCKER_SERVICE_NAMES.includes(name));
+  if (unknown.length > 0) {
+    throw new Error(`Unknown docker service "${unknown.join(", ")}". Expected ${DOCKER_SERVICE_NAMES.join(", ")}.`);
+  }
+  return names;
+}
+function dockerFlagsProvided(flags) {
+  return flags.docker !== undefined || flags.dockerServices !== undefined;
+}
+function parseCreateStrataArgs(argv) {
+  const flags = {
+    help: false,
+    yes: false,
+    noInteractive: false,
+    force: false,
+    extrasPrompt: false,
+    extras: {}
+  };
+  const positional = [];
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg) {
+      continue;
+    }
+    if (arg === "-h" || arg === "--help") {
+      flags.help = true;
+      continue;
+    }
+    if (arg === "--yes" || arg === "-y") {
+      flags.yes = true;
+      continue;
+    }
+    if (arg === "--no-interactive") {
+      flags.noInteractive = true;
+      continue;
+    }
+    if (arg === "--force") {
+      flags.force = true;
+      continue;
+    }
+    if (arg === "--extras" || arg === "--corporate") {
+      flags.extrasPrompt = true;
+      continue;
+    }
+    if (arg === "--docker") {
+      flags.docker = true;
+      flags.dockerServices = undefined;
+      continue;
+    }
+    if (arg === "--no-docker") {
+      flags.docker = false;
+      flags.dockerServices = undefined;
+      continue;
+    }
+    const dockerServicesInline = takeValue(arg, "--docker-services");
+    if (dockerServicesInline !== undefined) {
+      flags.docker = true;
+      flags.dockerServices = parseDockerServiceList(dockerServicesInline);
+      continue;
+    }
+    if (arg === "--docker-services") {
+      flags.docker = true;
+      flags.dockerServices = parseDockerServiceList(argv[index + 1] ?? "");
+      index += 1;
+      continue;
+    }
+    const boolFlags = [
+      ["--mfa", "mfa", true],
+      ["--no-mfa", "mfa", false],
+      ["--email-verification", "emailVerification", true],
+      ["--no-email-verification", "emailVerification", false],
+      ["--scim", "scim", true],
+      ["--no-scim", "scim", false],
+      ["--metrics", "metrics", true],
+      ["--no-metrics", "metrics", false]
+    ];
+    const boolMatch = boolFlags.find(([name]) => name === arg);
+    if (boolMatch) {
+      flags.extras[boolMatch[1]] = boolMatch[2];
+      continue;
+    }
+    const pairs = [
+      [
+        "--frontend",
+        (value) => {
+          flags.frontend = parseEnum(value, FRONTENDS, "frontend");
+        }
+      ],
+      [
+        "--database",
+        (value) => {
+          flags.database = parseEnum(value, DATABASES, "database");
+        }
+      ],
+      [
+        "--auth",
+        (value) => {
+          flags.auth = parseEnum(value, AUTH_STACKS, "auth");
+        }
+      ],
+      [
+        "--tenancy",
+        (value) => {
+          flags.tenancy = parseEnum(value, TENANCY_DRIVERS, "tenancy");
+        }
+      ],
+      [
+        "--cache",
+        (value) => {
+          flags.cache = parseEnum(value, CACHE_DRIVERS, "cache");
+        }
+      ],
+      [
+        "--queue",
+        (value) => {
+          flags.queue = parseEnum(value, QUEUE_DRIVERS, "queue");
+        }
+      ],
+      [
+        "--mail",
+        (value) => {
+          flags.mail = parseEnum(value, MAIL_DRIVERS, "mail");
+        }
+      ],
+      [
+        "--spa-prefix",
+        (value) => {
+          flags.spaPrefix = value.startsWith("/") ? value : `/${value}`;
+        }
+      ]
+    ];
+    let matched = false;
+    for (const [name, apply] of pairs) {
+      const inline = takeValue(arg, name);
+      if (inline !== undefined) {
+        apply(inline);
+        matched = true;
+        break;
+      }
+      if (arg === name) {
+        apply(argv[index + 1] ?? "");
+        index += 1;
+        matched = true;
+        break;
+      }
+    }
+    if (matched) {
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      throw new Error(`Unknown option ${arg}. Pass --help to list flags.`);
+    }
+    positional.push(arg);
+  }
+  if (positional[0]) {
+    flags.projectName = positional[0];
+  }
+  return flags;
+}
+function applyDockerFlags(layers, flags) {
+  const needed = neededDockerServices(layers);
+  if (flags.docker === false) {
+    return {
+      ...layers,
+      docker: dockerLayerForNeeded(layers, false)
+    };
+  }
+  if (flags.dockerServices) {
+    const selected = flags.dockerServices.filter((name) => needed.includes(name));
+    return {
+      ...layers,
+      docker: {
+        enabled: selected.length > 0,
+        services: enableDockerServices(selected)
+      }
+    };
+  }
+  if (flags.docker === true) {
+    return {
+      ...layers,
+      docker: dockerLayerForNeeded(layers, true)
+    };
+  }
+  return layers;
+}
+function applyFlagOverrides(base, flags) {
+  const next = {
+    ...base,
+    frontend: flags.frontend ?? base.frontend,
+    database: flags.database ?? base.database,
+    auth: flags.auth ?? base.auth,
+    tenancy: flags.tenancy ?? base.tenancy,
+    cache: flags.cache ?? base.cache,
+    queue: flags.queue ?? base.queue,
+    mail: flags.mail ?? base.mail,
+    spaPrefix: flags.spaPrefix ?? base.spaPrefix,
+    extras: { ...base.extras, ...flags.extras }
+  };
+  if (next.database !== "postgres") {
+    next.tenancy = "none";
+  }
+  return reconcileDocker(applyDockerFlags(next, flags));
+}
+function layersFromFlags(flags) {
+  return applyFlagOverrides(defaultLayers(), flags);
+}
+
+// src/prompt.ts
+import { stdin as input, stdout as output } from "process";
+import { createInterface } from "readline/promises";
+function isInteractive(flags) {
+  if (flags.yes || flags.noInteractive) {
+    return false;
+  }
+  return Boolean(input.isTTY && output.isTTY);
+}
+function createReadlinePrompter() {
+  const rl = createInterface({ input, output });
+  return {
+    async question(message, defaultValue) {
+      const suffix = defaultValue ? ` [${defaultValue}]` : "";
+      const answer = (await rl.question(`${message}${suffix}: `)).trim();
+      return answer || defaultValue || "";
+    },
+    async confirm(message, defaultValue = false) {
+      const hint = defaultValue ? "Y/n" : "y/N";
+      const answer = (await rl.question(`${message} (${hint}): `)).trim().toLowerCase();
+      if (!answer) {
+        return defaultValue;
+      }
+      return answer === "y" || answer === "yes";
+    },
+    async select(message, choices, defaultValue) {
+      console.log(message);
+      for (const [index, choice] of choices.entries()) {
+        const marker = choice.value === defaultValue ? "*" : " ";
+        console.log(`  ${index + 1}) ${marker} ${choice.label}`);
+      }
+      const defaultIndex = choices.findIndex((choice) => choice.value === defaultValue) + 1;
+      const answer = (await rl.question(`Choose [${defaultIndex}]: `)).trim();
+      if (!answer) {
+        return defaultValue;
+      }
+      const asNumber = Number.parseInt(answer, 10);
+      if (Number.isInteger(asNumber) && asNumber >= 1 && asNumber <= choices.length) {
+        const selected = choices[asNumber - 1];
+        return selected?.value ?? defaultValue;
+      }
+      const match = choices.find((choice) => choice.value === answer || choice.label === answer);
+      return match?.value ?? defaultValue;
+    },
+    close() {
+      rl.close();
+    }
+  };
+}
+async function promptLayers(flags, prompter) {
+  const layers = applyFlagOverrides(defaultLayers(), flags);
+  layers.frontend = await prompter.select("Frontend", [
+    { value: "api", label: "api: JSON only" },
+    { value: "server-htmx", label: "server-htmx: Eta HTML + HTMX" },
+    { value: "spa-react", label: "spa-react: JSON + React under SPA_PREFIX" },
+    { value: "hybrid", label: "hybrid: HTML at / plus SPA prefix" }
+  ], layers.frontend);
+  layers.database = await prompter.select("Database (one engine)", [
+    { value: "sqlite", label: "sqlite: file database" },
+    { value: "postgres", label: "postgres" },
+    { value: "mysql", label: "mysql" }
+  ], layers.database);
+  layers.auth = await prompter.select("Auth", [
+    { value: "headers", label: "headers: x-authenticated-user-id (local/tests)" },
+    { value: "cookie", label: "cookie: sessions table + CSRF" },
+    { value: "token", label: "token: opaque hashed Bearer" },
+    { value: "jwt", label: "jwt: short-lived HS256" },
+    { value: "cookie-token", label: "cookie-token: HTML cookies + API tokens" },
+    { value: "cookie-token-jwt", label: "cookie-token-jwt: cookies, tokens, and JWT" }
+  ], layers.auth);
+  if (layers.database === "postgres") {
+    layers.tenancy = await prompter.select("Tenancy", [
+      { value: "none", label: "none: no tenant table" },
+      { value: "rls", label: "rls: Postgres row-level security plus a tenant table" }
+    ], layers.tenancy);
+  } else {
+    layers.tenancy = "none";
+  }
+  layers.cache = await prompter.select("Cache", [
+    { value: "array", label: "array: in-process" },
+    { value: "redis", label: "redis" }
+  ], layers.cache);
+  layers.queue = await prompter.select("Queue", [
+    { value: "sync", label: "sync: run jobs inline" },
+    { value: "redis", label: "redis: background worker" }
+  ], layers.queue);
+  layers.mail = await prompter.select("Mail", [
+    { value: "log", label: "log: print messages" },
+    { value: "smtp", label: "smtp" }
+  ], layers.mail);
+  if (layers.frontend === "spa-react" || layers.frontend === "hybrid") {
+    layers.spaPrefix = await prompter.question("SPA prefix", layers.spaPrefix);
+  }
+  const askExtras = flags.extrasPrompt || await prompter.confirm("Configure extras (MFA, SCIM, metrics)?", false);
+  if (askExtras) {
+    layers.extras.mfa = await prompter.confirm("Staff MFA env flag?", layers.extras.mfa);
+    layers.extras.emailVerification = await prompter.confirm("Email verification env flag?", layers.extras.emailVerification);
+    layers.extras.scim = await prompter.confirm("SCIM env stubs?", layers.extras.scim);
+    layers.extras.metrics = await prompter.confirm("Metrics token?", layers.extras.metrics);
+  }
+  if (!dockerFlagsProvided(flags)) {
+    layers.docker = await promptDockerLayer(prompter, layers);
+  }
+  return applyFlagOverrides(layers, flags);
+}
+async function promptDockerLayer(prompter, layers) {
+  const needed = neededDockerServices(layers);
+  if (needed.length === 0) {
+    return dockerLayerForNeeded(layers, false);
+  }
+  const labels = needed.map((name) => DOCKER_SERVICE_LABELS[name]).join(", ");
+  const mode = await prompter.select(`How should supporting tools run (${labels})?`, [
+    { value: "local", label: "local: installs already on this machine" },
+    { value: "docker", label: "docker: Compose for all of them" },
+    { value: "mix", label: "mix: pick Docker Compose vs local per tool" }
+  ], "docker");
+  if (mode === "local") {
+    return dockerLayerForNeeded(layers, false);
+  }
+  if (mode === "docker") {
+    return dockerLayerForNeeded(layers, true);
+  }
+  const services = emptyDockerServices();
+  for (const name of needed) {
+    services[name] = await prompter.confirm(`Docker Compose for ${DOCKER_SERVICE_LABELS[name]}?`, true);
+  }
+  const selected = needed.filter((name) => services[name]);
+  return {
+    enabled: selected.length > 0,
+    services
+  };
+}
+async function resolveStarterPlan(flags, injected) {
+  if (!isInteractive(flags)) {
+    return {
+      projectName: flags.projectName ?? "strata-app",
+      layers: layersFromFlags(flags)
+    };
+  }
+  const prompter = injected ?? createReadlinePrompter();
+  try {
+    const projectName = flags.projectName || await prompter.question("Project name", "strata-app") || "strata-app";
+    const layers = await promptLayers({ ...flags, projectName }, prompter);
+    return { projectName, layers };
+  } finally {
+    if (!injected) {
+      prompter.close();
+    }
+  }
+}
+
+// src/renderAuth.ts
+function renderAuthDirectory(layers) {
+  if (!authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const tokenLookup = authUsesToken(layers.auth) ? `
+  async resolveUserFromToken(token: string) {
+    if (!token || token.split(".").length === 3) {
+      return null;
+    }
+    const hashed = hashApiToken(token);
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        user_id: number;
+        abilities: string;
+        expires_at: Date | string | null;
+        role?: string;
+        is_admin?: number | boolean;
+        email_verified_at?: Date | string | null;
+      }>
+    >(
+      \`SELECT t.id, t.user_id, t.abilities, t.expires_at, u.is_admin, u.email_verified_at
+       FROM api_tokens t INNER JOIN users u ON u.id = t.user_id
+       WHERE t.token_hash = ?\`,
+      [hashed],
+    );
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    if (row.expires_at && new Date(row.expires_at).getTime() <= Date.now()) {
+      return null;
+    }
+    let abilities: string[] = [];
+    try {
+      abilities = JSON.parse(String(row.abilities ?? "[]")) as string[];
+    } catch {
+      abilities = ["profile:read"];
+    }
+    return {
+      id: Number(row.user_id),
+      role: row.is_admin ? "admin" : "member",
+      abilities,
+      tokenId: Number(row.id),
+      emailVerifiedAt: row.email_verified_at ?? null,
+    };
+  },` : `
+  async resolveUserFromToken() {
+    return null;
+  },`;
+  const placeholder = layers.database === "postgres" ? "$1" : "?";
+  const hashImport = authUsesToken(layers.auth) ? `import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+` : "";
+  return `import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { verifyPassword } from "@getstrata/core/auth/password";
+${hashImport}import type { AuthUserDirectory } from "@getstrata/core/contracts/authUserDirectory";
+import { getSql } from "./database.ts";
+
+function mapRole(isAdmin: unknown): string {
+  return isAdmin === true || isAdmin === 1 || isAdmin === "1" ? "admin" : "member";
+}
+
+export const starterAuthDirectory: AuthUserDirectory = {
+${tokenLookup.replace("WHERE t.token_hash = ?", `WHERE t.token_hash = ${placeholder}`)}
+
+  async findByIdOrThrow(id: number) {
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        email: string;
+        is_admin: number | boolean;
+        email_verified_at: Date | string | null;
+        password: string;
+      }>
+    >(\`SELECT id, email, is_admin, email_verified_at, password FROM users WHERE id = ${placeholder}\`, [id]);
+    const row = rows[0];
+    if (!row) {
+      throw new Error(\`User \${id} not found.\`);
+    }
+    return {
+      id: Number(row.id),
+      email: row.email,
+      role: mapRole(row.is_admin),
+      email_verified_at: row.email_verified_at ?? null,
+      password: row.password,
+    };
+  },
+
+  async findByEmail(email: string) {
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        email: string;
+        is_admin: number | boolean;
+        email_verified_at: Date | string | null;
+        password: string;
+      }>
+    >(
+      \`SELECT id, email, is_admin, email_verified_at, password FROM users WHERE email = ${placeholder}\`,
+      [email.trim().toLowerCase()],
+    );
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    return {
+      id: Number(row.id),
+      email: row.email,
+      role: mapRole(row.is_admin),
+      email_verified_at: row.email_verified_at ?? null,
+      password: row.password,
+    };
+  },
+
+  async verifyCredentials(email: string, password: string): Promise<AuthUser | null> {
+    const user = await this.findByEmail(email);
+    if (!user?.password || !(await verifyPassword(password, user.password))) {
+      return null;
+    }
+    return {
+      id: user.id,
+      role: user.role,
+      emailVerifiedAt: user.email_verified_at ?? null,
+    };
+  },
+};
+`;
+}
+function renderAuthProvider(layers) {
+  if (layers.auth === "headers") {
+    return `import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";
+import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { currentAuthUser } from "@getstrata/core/auth/authContext";
+import type { ServiceProvider } from "@getstrata/core/contracts/di";
+
+class StarterAuthManager {
+  async resolve(request?: Request): Promise<AuthUser | null> {
+    if (process.env.AUTH_DEV_HEADERS === "false") {
+      return request ? null : currentAuthUser();
+    }
+    if (request) {
+      const userId = request.headers.get("x-authenticated-user-id");
+      if (!userId) {
+        return null;
+      }
+      const role = request.headers.get("x-authenticated-user-role");
+      return {
+        id: userId,
+        ...(role ? { role } : {}),
+      };
+    }
+    return currentAuthUser();
+  }
+
+  user(request?: Request) {
+    return this.resolve(request);
+  }
+
+  async check(request: Request) {
+    return (await this.user(request)) !== null;
+  }
+}
+
+const authProvider: ServiceProvider = {
+  name: "starter.auth",
+  register({ container }) {
+    container.set(CORE_AUTH_TOKEN, new StarterAuthManager());
+  },
+};
+
+export default authProvider;
+`;
+  }
+  const cookieBlock = authUsesCookie(layers.auth) ? `    const auth = createCookieSessionAuthManager({
+      secret: process.env.SESSION_SECRET?.trim() || "dev-session-secret-change-me-please-32ch",
+      cookieName: "strata_session",
+      mapUser: (user) => ({
+        id: user.id,
+        role: user.is_admin ? "admin" : "member",
+      }),
+    });` : `    const fallback = ${authUsesToken(layers.auth) ? "new DatabaseTokenGuard(container)" : "new JwtGuard()"};
+    const auth = new AuthManager(fallback);`;
+  const tokenRegs = authUsesToken(layers.auth) ? `    const apiGuard = new DatabaseTokenGuard(container);
+    auth.registerGuard("api", apiGuard);
+    auth.registerGuard("access_token", apiGuard);
+    auth.registerGuard("token", apiGuard);` : "";
+  const jwtReg = authUsesJwt(layers.auth) ? `    auth.registerGuard("jwt", new JwtGuard());` : "";
+  const basicReg = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `    auth.registerGuard("basic", new BasicAuthGuard(container));` : "";
+  const ability = authUsesToken(layers.auth) ? `    container.set(CORE_ABILITY_CHECKER_TOKEN, createTokenAbilityChecker());` : "";
+  const imports = [`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`];
+  if (authUsesCookie(layers.auth)) {
+    imports.push(`import { createCookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+  }
+  if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
+    imports.push(`import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";`);
+  }
+  if (!authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
+    imports.push(`import { AuthManager, DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
+  } else if (!authUsesCookie(layers.auth) && authUsesJwt(layers.auth)) {
+    imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
+  } else if (authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
+    imports.push(`import { DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
+  }
+  if (authUsesJwt(layers.auth)) {
+    imports.push(`import { JwtGuard } from "@getstrata/core/auth/jwtGuard";`);
+  }
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { createTokenAbilityChecker } from "@getstrata/core/auth/tokenAbilityChecker";`);
+  }
+  imports.push(`import type { ServiceProvider } from "@getstrata/core/contracts/di";`);
+  const tokenImports = ["CORE_AUTH_USER_DIRECTORY_TOKEN"];
+  if (authUsesToken(layers.auth)) {
+    tokenImports.unshift("CORE_ABILITY_CHECKER_TOKEN");
+  }
+  imports.push(`import {
+  ${tokenImports.join(`,
+  `)},
+} from "@getstrata/core/contracts/serviceTokens";`);
+  imports.push(`import { starterAuthDirectory } from "../authDirectory.ts";`);
+  return `${imports.join(`
+`)}
+
+const authProvider: ServiceProvider = {
+  name: "starter.auth",
+  register({ container }) {
+    container.set(CORE_AUTH_USER_DIRECTORY_TOKEN, starterAuthDirectory);
+${cookieBlock}
+${tokenRegs}
+${jwtReg}
+${basicReg}
+${ability}
+    container.set(CORE_AUTH_TOKEN, auth);
+  },
+};
+
+export default authProvider;
+`;
+}
+function renderAuthModule(layers) {
+  if (!authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const cookieRoutes = authUsesCookie(layers.auth) ? `
+    webRoutes({ kernel, dependencies }) {
+      const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+      return {
+        "/login": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage(
+              "auth/login.eta",
+              { layout: { title: "Sign in" }, errors: {}, email: "" },
+              request,
+            ),
+          ),
+          POST: wrapWebLogin(
+            kernel,
+            async (request) => {
+              const { fields } = await parseFormBody(request);
+              const email = (fields.email ?? "").trim().toLowerCase();
+              const password = fields.password ?? "";
+              const user = await starterAuthDirectory.findByEmail?.(email);
+              if (!user?.password || !(await verifyPassword(password, user.password))) {
+                return renderPage(
+                  "auth/login.eta",
+                  {
+                    layout: { title: "Sign in" },
+                    errors: { email: "These credentials do not match our records." },
+                    email,
+                  },
+                  request,
+                );
+              }
+              return auth.signInRedirect(
+                {
+                  id: user.id,
+                  name: user.email ?? "",
+                  email: user.email ?? "",
+                  is_admin: user.role === "admin",
+                },
+                "/",
+              );
+            },
+            async () => new Response("Too many login attempts", { status: 429 }),
+          ),
+        },
+        "/logout": {
+          POST: kernel.wrapWebAuthenticatedAllowUnverified((request) =>
+            auth.signOutRedirect(request, "/login"),
+          ),
+        },
+      };
+    },` : "";
+  const apiLogin = authUsesToken(layers.auth) ? `
+        "/api/v1/auth/login": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { email?: string; password?: string };
+            const email = (body.email ?? "").trim().toLowerCase();
+            const password = body.password ?? "";
+            const user = await starterAuthDirectory.verifyCredentials?.(email, password);
+            if (!user) {
+              return jsonResponse({ error: "Invalid credentials" }, { status: 422 });
+            }
+            const plain = \`strp_\${randomBytes(24).toString("hex")}\`;
+            await getSql().unsafe(
+              "INSERT INTO api_tokens (user_id, name, token_hash, abilities) VALUES (${layers.database === "postgres" ? "$1, $2, $3, $4" : "?, ?, ?, ?"})",
+              [user.id, "spa", hashApiToken(plain), JSON.stringify(["profile:read"])],
+            );
+            return jsonResponse({ token: plain });
+          })),
+        },
+        "/api/v1/auth/me": {
+          GET: kernel.wrapApi(async (request) => {
+            const user = await dependencies.container.resolve<AuthManager>(CORE_AUTH_TOKEN).requireUser(request);
+            const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
+            return jsonResponse({
+              id: record.id,
+              name: record.email,
+              email: record.email,
+              role: record.role,
+            });
+          }),
+        },` : "";
+  const jwtLogin = authUsesJwt(layers.auth) ? `
+        "/api/auth/token": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { email?: string; password?: string };
+            const email = (body.email ?? "").trim().toLowerCase();
+            const password = body.password ?? "";
+            const user = await starterAuthDirectory.verifyCredentials?.(email, password);
+            if (!user) {
+              return jsonResponse({ error: "Invalid credentials" }, { status: 422 });
+            }
+            const token = signJwt({
+              sub: user.id,
+              role: user.role,
+              abilities: user.role === "admin" ? ["profile:read", "reports:export"] : ["profile:read"],
+            });
+            return jsonResponse({
+              token,
+              token_type: "bearer",
+              expires_in: jwtTtlSeconds(),
+            });
+          })),
+        },` : "";
+  const apiUser = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `
+        "/api/user": {
+          GET: kernel.wrapApi(async (request) => {
+            const user = await dependencies.container.resolve<AuthManager>(CORE_AUTH_TOKEN).requireUser(request);
+            return jsonResponse({ id: user.id, role: user.role ?? "member" });
+          }),
+        },` : "";
+  const routesBlock = apiLogin || jwtLogin || apiUser ? `
+    routes({ kernel, dependencies }) {
+      return {${apiLogin}${jwtLogin}${apiUser}
+      };
+    },` : "";
+  const imports = [];
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { randomBytes } from "node:crypto";`);
+  }
+  imports.push(`import type { AppModule } from "@getstrata/bootstrap/contracts";`);
+  imports.push(`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`);
+  if (authUsesCookie(layers.auth)) {
+    imports.push(`import { parseFormBody } from "@getstrata/bootstrap/web/forms";`);
+    imports.push(`import { wrapWebLogin } from "@getstrata/bootstrap/web/routing";`);
+    imports.push(`import type { CookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+  }
+  if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
+    imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
+  }
+  if (authUsesJwt(layers.auth)) {
+    imports.push(`import { jwtTtlSeconds, signJwt } from "@getstrata/core/auth/jwt";`);
+  }
+  if (authUsesCookie(layers.auth)) {
+    imports.push(`import { verifyPassword } from "@getstrata/core/auth/password";`);
+  }
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { hashApiToken } from "@getstrata/core/auth/tokenHash";`);
+  }
+  if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
+    imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
+  }
+  imports.push(`import { starterAuthDirectory } from "../../bootstrap/authDirectory.ts";`);
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { getSql } from "../../bootstrap/database.ts";`);
+  }
+  if (authUsesCookie(layers.auth)) {
+    imports.push(`import { renderPage } from "../../lib/view.ts";`);
+  }
+  return `${imports.join(`
+`)}
+
+const authModule: AppModule = {
+  name: "auth",
+  order: 2,${routesBlock}${cookieRoutes}
+};
+
+export default authModule;
+`;
+}
+function renderSiteModule(layers) {
+  const loginHint = authUsesCookie(layers.auth) && (layers.frontend === "server-htmx" || layers.frontend === "hybrid") ? " Sign in at /login." : "";
+  return `import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { withErrorHandling } from "@getstrata/core/http/response";
+import { pingDatabase } from "../../bootstrap/database.ts";
+import { plainText, renderPage } from "../../lib/view.ts";
+
+const siteModule: AppModule = {
+  name: "site",
+  order: 1,
+  routes({ kernel }) {
+    return {
+      "/health": kernel.wrap("api", withErrorHandling(async () => {
+        const dbOk = await pingDatabase();
+        return plainText(dbOk ? "ok" : "degraded");
+      })),
+    };
+  },
+  webRoutes({ kernel }) {
+    return {
+      "/": kernel.wrapWeb(async (request) =>
+        renderPage(
+          "home.eta",
+          {
+            layout: {
+              title: "Home",
+              description: "A new Strata application.${loginHint}",
+            },
+          },
+          request,
+        ),
+      ),
+    };
+  },
+};
+
+export default siteModule;
+`;
+}
+function renderLoginView() {
+  return `<section class="section">
+  <h1>Sign in</h1>
+  <p>Seeded accounts use password <code>password</code>.</p>
+  <% if (it.errors && it.errors.email) { %>
+  <p class="error"><%= it.errors.email %></p>
+  <% } %>
+  <form method="post" action="/login">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    <label>
+      Email
+      <input type="email" name="email" value="<%= it.email || "demo@example.com" %>" required />
+    </label>
+    <label>
+      Password
+      <input type="password" name="password" value="password" required />
+    </label>
+    <button type="submit">Sign in</button>
+  </form>
+</section>
+`;
+}
+function renderLayout(layers, projectName) {
+  const cookie = authUsesCookie(layers.auth);
+  return `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title><%= it.layout.title %> \xB7 ${projectName}</title>
+    <% if (it.layout.description) { %>
+    <meta name="description" content="<%= it.layout.description %>" />
+    <% } %>
+    <link rel="stylesheet" href="/assets/site.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">${projectName}</a>
+      <nav>
+        ${cookie ? '<a href="/login">Sign in</a>' : ""}
+      </nav>
+    </header>
+    <main><%~ it.body %></main>
+  </body>
+</html>
+`;
+}
+function renderHomeView(projectName, layers) {
+  const loginLine = authUsesCookie(layers.auth) ? '<p>HTML sign-in: <a href="/login">/login</a> (demo@example.com / password).</p>' : "";
+  return `<section class="section">
+  <h1>Welcome to ${projectName}</h1>
+  <p>Frontend <code>${layers.frontend}</code>, database <code>${layers.database}</code>, auth <code>${layers.auth}</code>.</p>
+  <p>Health check: <a href="/health"><code>/health</code></a>.</p>
+  ${loginLine}
+</section>
+`;
+}
+
+// src/renderEnv.ts
+function envFlag(value) {
+  return value ? "true" : "false";
+}
+function appDatabaseName(projectName) {
+  return `${projectName.replace(/[^A-Za-z0-9_]/g, "_")}_test`;
+}
+function defaultDatabaseUrl(layers, projectName) {
+  if (layers.database === "sqlite") {
+    return "sqlite:./storage/app.sqlite";
+  }
+  const database = appDatabaseName(projectName);
+  if (layers.database === "mysql") {
+    return `mysql://root:root@localhost:3306/${database}`;
+  }
+  return `postgresql://postgres:postgres@localhost:5432/${database}`;
+}
+function renderEnvExample(projectName, layers) {
+  const lines = [
+    `APP_NAME=${projectName}`,
+    `APP_KEY_PREFIX=${projectName}`,
+    "APP_ENV=local",
+    "PORT=3000",
+    "APP_URL=http://localhost:3000",
+    `DATABASE_URL=${defaultDatabaseUrl(layers, projectName)}`,
+    `DB_CONNECTION=${layers.database === "postgres" ? "pgsql" : layers.database}`,
+    `FRONTEND_MODE=${layers.frontend}`,
+    `SPA_PREFIX=${layers.spaPrefix}`,
+    `TENANCY_DRIVER=${layers.tenancy}`,
+    `CACHE_DRIVER=${layers.cache}`,
+    `QUEUE_DRIVER=${layers.queue}`,
+    `MAIL_DRIVER=${layers.mail}`,
+    `AUTH_DEV_HEADERS=${envFlag(layers.auth === "headers")}`,
+    `FEATURE_PUBLIC_READS=${envFlag(layers.frontend !== "api")}`
+  ];
+  if (needsRedis(layers)) {
+    lines.push("REDIS_URL=redis://127.0.0.1:6379");
+  } else {
+    lines.push("# REDIS_URL=redis://127.0.0.1:6379");
+  }
+  if (authUsesCookie(layers.auth) || layers.frontend === "server-htmx" || layers.frontend === "hybrid") {
+    lines.push("SESSION_SECRET=dev-session-secret-change-me-please-32ch");
+  } else {
+    lines.push("# SESSION_SECRET=");
+  }
+  if (authUsesJwt(layers.auth)) {
+    lines.push("JWT_SECRET=dev-jwt-secret-change-me-please-32chars");
+    lines.push("JWT_TTL_SECONDS=3600");
+  } else {
+    lines.push("# JWT_SECRET=");
+  }
+  if (authUsesToken(layers.auth)) {
+    lines.push("FEATURE_API_TOKENS=true");
+    lines.push("TOKEN_HASH_PEPPER=dev-token-pepper-change-me");
+    lines.push("API_TOKEN_DEFAULT_EXPIRY_DAYS=30");
+  } else {
+    lines.push("# FEATURE_API_TOKENS=false");
+  }
+  lines.push(`FEATURE_MFA=${envFlag(layers.extras.mfa)}`);
+  lines.push(`FEATURE_EMAIL_VERIFICATION=${envFlag(layers.extras.emailVerification)}`);
+  if (layers.extras.metrics) {
+    lines.push("METRICS_TOKEN=dev-metrics-token-change-me");
+  } else {
+    lines.push("# METRICS_TOKEN=");
+  }
+  if (layers.extras.scim) {
+    lines.push("FEATURE_SCIM=true");
+    lines.push("SCIM_BEARER_TOKEN=dev-scim-token-change-me");
+  } else {
+    lines.push("# FEATURE_SCIM=false");
+    lines.push("# SCIM_BEARER_TOKEN=");
+  }
+  if (layers.database === "mysql") {
+    lines.push(`MYSQL_URL=${defaultDatabaseUrl(layers, projectName)}`);
+  }
+  if (layers.mail === "smtp") {
+    lines.push("MAIL_HOST=localhost");
+    lines.push("MAIL_PORT=1025");
+    lines.push(`MAIL_FROM=noreply@${projectName}.local`);
+    lines.push("MAIL_SECURE=false");
+  } else {
+    lines.push("# MAIL_HOST=");
+    lines.push("# MAIL_FROM=");
+  }
+  lines.push("# TRUST_FORWARDED_FOR=true");
+  return `${lines.join(`
+`)}
+`;
+}
+function renderDockerCompose(projectName, layers) {
+  const selected = selectedDockerServices(layers);
+  if (selected.length === 0) {
+    return null;
+  }
+  const selectedSet = new Set(selected);
+  const services = [];
+  if (selectedSet.has("postgres")) {
+    const database = appDatabaseName(projectName);
+    services.push(`  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: ${database}
+    ports:
+      - "5432:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data`);
+  }
+  if (selectedSet.has("mysql")) {
+    const database = appDatabaseName(projectName);
+    services.push(`  mysql:
+    image: mysql:8.4
+    environment:
+      MYSQL_ROOT_PASSWORD: root
+      MYSQL_DATABASE: ${database}
+    ports:
+      - "3306:3306"
+    volumes:
+      - mysqldata:/var/lib/mysql`);
+  }
+  if (selectedSet.has("redis")) {
+    services.push(`  redis:
+    image: redis:7-alpine
+    ports:
+      - "6379:6379"`);
+  }
+  if (selectedSet.has("mailpit")) {
+    services.push(`  mailpit:
+    image: axllent/mailpit:latest
+    ports:
+      - "1025:1025"
+      - "8025:8025"`);
+  }
+  const volumes = [];
+  if (selectedSet.has("postgres")) {
+    volumes.push("  pgdata:");
+  }
+  if (selectedSet.has("mysql")) {
+    volumes.push("  mysqldata:");
+  }
+  return `services:
+${services.join(`
+
+`)}
+${volumes.length > 0 ? `
+volumes:
+${volumes.join(`
+`)}
+` : ""}`;
+}
+function renderGitignore() {
+  return `node_modules
+.env
+.env.local
+dist
+frontend/dist
+storage/*.sqlite
+storage/*.sqlite-journal
+coverage
+*.tsbuildinfo
+`;
+}
+function renderPackageJson(projectName, options = {}) {
+  const coreDeps = options.workspaceDependencies ? {
+    "@getstrata/bootstrap": "workspace:*",
+    "@getstrata/cli": "workspace:*",
+    "@getstrata/core": "workspace:*"
+  } : {
+    "@getstrata/bootstrap": "^0.4.2",
+    "@getstrata/cli": "^0.2.0",
+    "@getstrata/core": "^0.7.4"
+  };
+  if (options.layers?.database === "mysql") {
+    coreDeps.mysql2 = "^3.24.3";
+  }
+  return `${JSON.stringify({
+    name: projectName,
+    version: "0.1.0",
+    private: true,
+    type: "module",
+    scripts: {
+      dev: "strata dev",
+      start: "strata start",
+      "db:migrate": "strata migrate",
+      "db:fresh": "strata migrate:fresh",
+      check: "tsc --noEmit"
+    },
+    dependencies: coreDeps,
+    devDependencies: {
+      "@types/bun": "^1.4.0",
+      typescript: "^5.9.2"
+    }
+  }, null, 2)}
+`;
+}
+function renderLayersManifest(projectName, layers) {
+  return `${JSON.stringify({
+    name: projectName,
+    generatedBy: "create-strata",
+    layers: {
+      frontend: layers.frontend,
+      database: layers.database,
+      auth: layers.auth,
+      tenancy: layers.tenancy,
+      cache: layers.cache,
+      queue: layers.queue,
+      mail: layers.mail,
+      spaPrefix: layers.spaPrefix,
+      extras: layers.extras,
+      docker: layers.docker
+    },
+    notes: "Generated by create-strata. Change layers later with flags or by editing env and bootstrap files."
+  }, null, 2)}
+`;
+}
+function localEnvVars(services) {
+  const vars = [];
+  for (const name of services) {
+    if (name === "postgres" || name === "mysql") {
+      vars.push("DATABASE_URL");
+    } else if (name === "redis") {
+      vars.push("REDIS_URL");
+    } else if (name === "mailpit") {
+      vars.push("MAIL_HOST");
+    }
+  }
+  return [...new Set(vars)];
+}
+function renderSupportingToolsReadme(layers) {
+  const needed = neededDockerServices(layers);
+  if (needed.length === 0) {
+    return "";
+  }
+  const dockerOn = selectedDockerServices(layers);
+  const dockerSet = new Set(dockerOn);
+  const localOn = needed.filter((name) => !dockerSet.has(name));
+  const lines = ["## Supporting tools", ""];
+  if (dockerOn.length > 0) {
+    const names = dockerOn.map((name) => DOCKER_SERVICE_LABELS[name]).join(", ");
+    lines.push(`Docker Compose includes ${names}.`, "", "```bash", "docker compose up -d", "```", "");
+  }
+  if (localOn.length > 0) {
+    const names = localOn.map((name) => DOCKER_SERVICE_LABELS[name]).join(", ");
+    const envVars = localEnvVars(localOn).map((name) => `\`${name}\``).join(", ");
+    lines.push(`Use local installs for ${names}. Point ${envVars} in \`.env\` at services on this machine.`, "");
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function renderReadme(projectName, layers) {
+  const docker = renderDockerCompose(projectName, layers);
+  const next = [`cd ${projectName}`, "cp .env.example .env"];
+  if (docker) {
+    next.push("docker compose up -d");
+  }
+  next.push("bun install", "strata migrate", "strata dev");
+  const extras = Object.entries(layers.extras).filter(([, on]) => on).map(([key]) => key);
+  const dockerServices = selectedDockerServices(layers);
+  const neededTools = neededDockerServices(layers);
+  const dockerLabel = neededTools.length === 0 ? "not needed" : dockerServices.length > 0 ? dockerServices.join(", ") : "off (local installs)";
+  return `# ${projectName}
+
+Strata app generated by \`create-strata\`.
+
+## Layers
+
+| Layer | Choice |
+|-------|--------|
+| Frontend | \`${layers.frontend}\` |
+| Database | \`${layers.database}\` |
+| Auth | \`${layers.auth}\` |
+| Tenancy | \`${layers.tenancy}\` |
+| Cache | \`${layers.cache}\` |
+| Queue | \`${layers.queue}\` |
+| Mail | \`${layers.mail}\` |
+| SPA prefix | \`${layers.spaPrefix}\` |
+| Docker Compose | ${dockerLabel} |
+${extras.length > 0 ? `| Extras | ${extras.join(", ")} |
+` : ""}
+This file is the map for this app. Framework guides: [Building apps](https://github.com/EyK-26/strata/blob/main/docs/BUILDING-APPS.md), [Auth](https://github.com/EyK-26/strata/blob/main/docs/AUTH.md), [Starter](https://github.com/EyK-26/strata/blob/main/docs/STARTER.md).
+
+## Run it
+
+\`\`\`bash
+${next.join(`
+`)}
+\`\`\`
+
+Open http://localhost:3000. Health check: \`GET /health\`.
+
+${renderSupportingToolsReadme(layers)}${layers.auth !== "headers" ? `
+Seeded login (password \`password\`):
+
+- \`demo@example.com\` (member)
+- \`admin@example.test\` (admin)
+` : `
+Header auth is on for local use. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`). Production must set \`AUTH_DEV_HEADERS=false\`.
+`}${authUsesCookie(layers.auth) ? `
+HTML sign-in lives at \`/login\` (cookie session + CSRF when \`FRONTEND_MODE\` is \`server-htmx\` or \`hybrid\`).
+` : ""}${authUsesToken(layers.auth) ? `
+Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Send \`Authorization: Bearer\`.
+` : ""}${authUsesJwt(layers.auth) ? `
+JWT mint: \`POST /api/auth/token\` with email and password. Short-lived. Not a portal session.
+` : ""}
+## Production
+
+\`createApp\` calls \`assertProductionSecrets()\` when \`APP_ENV=production\`. Set real secrets before you ship. Cookie HTML apps need \`SESSION_SECRET\` (32+ characters). Token apps need \`TOKEN_HASH_PEPPER\`. Set \`AUTH_DEV_HEADERS=false\`.
+`;
+}
+
+// src/renderRuntime.ts
+function needsEnsure(layers) {
+  return layers.database !== "sqlite";
+}
+function ensureImport(layers) {
+  return needsEnsure(layers) ? `import { ensureAppDatabase } from "../bootstrap/ensureDatabase.ts";
+` : "";
+}
+function ensureCall(layers) {
+  return needsEnsure(layers) ? `  await ensureAppDatabase();
+` : "";
+}
+function dialectFragments(database) {
+  if (database === "sqlite") {
+    return {
+      id: "INTEGER PRIMARY KEY AUTOINCREMENT",
+      text: "TEXT",
+      timestamp: "TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP",
+      timestampNull: "TEXT",
+      bool: "INTEGER NOT NULL DEFAULT 0"
+    };
+  }
+  if (database === "mysql") {
+    return {
+      id: "INT AUTO_INCREMENT PRIMARY KEY",
+      text: "TEXT",
+      timestamp: "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP",
+      timestampNull: "DATETIME NULL",
+      bool: "TINYINT(1) NOT NULL DEFAULT 0"
+    };
+  }
+  return {
+    id: "SERIAL PRIMARY KEY",
+    text: "TEXT",
+    timestamp: "TIMESTAMPTZ NOT NULL DEFAULT NOW()",
+    timestampNull: "TIMESTAMPTZ",
+    bool: "BOOLEAN NOT NULL DEFAULT FALSE"
+  };
+}
+function driverName(database) {
+  return database === "postgres" ? "pgsql" : database;
+}
+function renderDatabaseTs(layers) {
+  const driver = driverName(layers.database);
+  if (layers.database === "sqlite") {
+    return `import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import type { SqlDatabaseConnection } from "@getstrata/core/database/baseRepository";
+import { bindDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import { registerDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { createSqliteConnection } from "@getstrata/core/database/sqliteConnection";
+import { useSqlDialect } from "@getstrata/core/database/dialect";
+
+export type SqlClient = {
+  unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
+  close?: () => Promise<void> | void;
+};
+
+let sql: SqlClient | null = null;
+
+function sqliteFilename(url: string): string {
+  const trimmed = url.trim();
+  if (trimmed === ":memory:" || trimmed === "sqlite::memory:") {
+    return ":memory:";
+  }
+  if (trimmed.startsWith("sqlite:")) {
+    return trimmed.slice("sqlite:".length).replace(/^\\/\\//, "") || "./storage/app.sqlite";
+  }
+  return trimmed || "./storage/app.sqlite";
+}
+
+function asSqlPool(client: SqlClient): SqlDatabaseConnection {
+  const tagged = async () => {
+    throw new Error(
+      "SQLite starter connections do not run tagged SQL. Keep TENANCY_DRIVER=none or use Postgres.",
+    );
+  };
+  return Object.assign(tagged, client) as SqlDatabaseConnection;
+}
+
+export function getSql(): SqlClient {
+  if (sql) {
+    return sql;
+  }
+
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL is required");
+  }
+
+  useSqlDialect("${driver}");
+  const filename = sqliteFilename(url);
+  if (filename !== ":memory:") {
+    mkdirSync(dirname(filename), { recursive: true });
+  }
+  sql = createSqliteConnection(filename);
+  bindDatabaseConnection(sql);
+  registerDefaultDatabasePool(asSqlPool(sql));
+  return sql;
+}
+
+export async function pingDatabase(): Promise<boolean> {
+  try {
+    await getSql().unsafe("SELECT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function closeDatabase() {
+  if (sql?.close) {
+    await sql.close();
+  }
+  sql = null;
+}
+`;
+  }
+  if (layers.database === "mysql") {
+    return `import { bindDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import type { SqlDatabaseConnection } from "@getstrata/core/database/baseRepository";
+import { registerDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { createMysqlConnection } from "@getstrata/core/database/mysqlConnection";
+import { useSqlDialect } from "@getstrata/core/database/dialect";
+
+export type SqlClient = {
+  unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
+  close?: () => Promise<void> | void;
+};
+
+let sql: SqlClient | null = null;
+
+export function getSql(): SqlClient {
+  if (sql) {
+    return sql;
+  }
+
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL is required");
+  }
+
+  useSqlDialect("${driver}");
+  sql = createMysqlConnection(url);
+  bindDatabaseConnection(sql);
+  registerDefaultDatabasePool(sql as SqlDatabaseConnection);
+  return sql;
+}
+
+export async function pingDatabase(): Promise<boolean> {
+  try {
+    await getSql().unsafe("SELECT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function closeDatabase() {
+  if (sql?.close) {
+    await sql.close();
+  }
+  sql = null;
+}
+`;
+  }
+  return `import { createBunSqlPool } from "@getstrata/core/database/bunSql";
+import type { SqlDatabaseConnection } from "@getstrata/core/database/baseRepository";
+import { bindDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import {
+  getDefaultDatabaseQuery,
+  registerDefaultDatabasePool,
+} from "@getstrata/core/database/defaultConnection";
+import { useSqlDialect } from "@getstrata/core/database/dialect";
+
+export type SqlClient = {
+  unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
+  close?: () => Promise<void> | void;
+};
+
+let sql: SqlClient | null = null;
+
+export function getSql(): SqlClient {
+  if (sql) {
+    return sql;
+  }
+
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL is required");
+  }
+
+  useSqlDialect("${driver}");
+  const pool = createBunSqlPool({ url, max: 5 }) as SqlDatabaseConnection;
+  registerDefaultDatabasePool(pool);
+  bindDatabaseConnection(getDefaultDatabaseQuery());
+  sql = getDefaultDatabaseQuery() as SqlClient;
+  return sql;
+}
+
+export async function pingDatabase(): Promise<boolean> {
+  try {
+    await getSql().unsafe("SELECT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function closeDatabase() {
+  if (sql?.close) {
+    await sql.close();
+  }
+  sql = null;
+}
+`;
+}
+function renderMigrateTs(layers) {
+  const d = dialectFragments(layers.database);
+  const statements = [];
+  if (layers.tenancy === "rls") {
+    statements.push(`CREATE TABLE IF NOT EXISTS tenant (
+    id ${d.id},
+    slug ${d.text} NOT NULL UNIQUE,
+    plan ${d.text} NOT NULL DEFAULT 'enterprise',
+    region ${d.text} NOT NULL DEFAULT 'eu'
+  )`);
+  }
+  statements.push(`CREATE TABLE IF NOT EXISTS notes (
+    id ${d.id},
+    body ${d.text} NOT NULL,
+    created_at ${d.timestamp}
+  )`);
+  if (authNeedsUsers(layers.auth)) {
+    const tenantColumn = layers.tenancy === "rls" ? `
+    tenant_id INTEGER NOT NULL DEFAULT 1,` : "";
+    statements.push(`CREATE TABLE IF NOT EXISTS users (
+    id ${d.id},
+    name ${d.text} NOT NULL,
+    email ${d.text} NOT NULL UNIQUE,
+    password ${d.text} NOT NULL,
+    is_admin ${d.bool},${tenantColumn}
+    email_verified_at ${d.timestampNull},
+    created_at ${d.timestamp}
+  )`);
+  }
+  if (authUsesCookie(layers.auth)) {
+    statements.push(`CREATE TABLE IF NOT EXISTS sessions (
+    id ${d.text} PRIMARY KEY,
+    user_id INTEGER NOT NULL,
+    expires_at ${d.timestamp},
+    user_agent ${d.text},
+    ip_address ${d.text},
+    last_active_at ${d.timestamp}
+  )`);
+  }
+  if (authUsesToken(layers.auth)) {
+    statements.push(`CREATE TABLE IF NOT EXISTS api_tokens (
+    id ${d.id},
+    user_id INTEGER NOT NULL,
+    name ${d.text} NOT NULL,
+    token_hash ${d.text} NOT NULL UNIQUE,
+    abilities ${d.text} NOT NULL DEFAULT '[]',
+    expires_at ${d.timestampNull},
+    last_used_at ${d.timestampNull},
+    created_at ${d.timestamp}
+  )`);
+  }
+  const list = statements.map((sql) => `  \`${sql}\`,`).join(`
 `);
+  const ph = layers.database === "postgres";
+  const notePlaceholder = ph ? "$1" : "?";
+  const userPlaceholders = ph ? "$1, $2, $3, $4), ($5, $6, $7, $8" : "?, ?, ?, ?), (?, ?, ?, ?";
+  const adminFlag = ph ? "false, " : "0, ";
+  const adminTrue = ph ? "true" : "1";
+  const seedTenant = layers.tenancy === "rls" ? `
+  const [{ count: tenantCount }] = await sql.unsafe<Array<{ count: string | number }>>(
+    "SELECT COUNT(*) AS count FROM tenant",
+  );
+  if (Number(tenantCount) === 0) {
+    await sql.unsafe(
+      "INSERT INTO tenant (slug, plan, region) VALUES (${ph ? "$1, $2, $3" : "?, ?, ?"})",
+      ["default", "enterprise", "eu"],
+    );
+  }` : "";
+  const seedUsers = authNeedsUsers(layers.auth) ? `
+  const [{ count: userCount }] = await sql.unsafe<Array<{ count: string | number }>>(
+    "SELECT COUNT(*) AS count FROM users",
+  );
+  if (Number(userCount) === 0) {
+    const password = await hashPassword("password");
+    await sql.unsafe(
+      "INSERT INTO users (name, email, password, is_admin) VALUES (${userPlaceholders})",
+      ["Demo User", "demo@example.com", password, ${adminFlag}"Admin User", "admin@example.test", password, ${adminTrue}],
+    );
+  }` : "";
+  const hashImport = authNeedsUsers(layers.auth) ? `import { hashPassword } from "@getstrata/core/auth/password";
+` : "";
+  const seedBlock = `${seedTenant}${seedUsers}`;
+  return `${hashImport}${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
+
+const migrations = [
+${list}
+];
+
+export async function migrate() {
+${ensureCall(layers)}  const sql = getSql();
+  for (const statement of migrations) {
+    await sql.unsafe(statement);
+  }
+}
+
+export async function seed() {
+${ensureCall(layers)}  const sql = getSql();
+  const [{ count }] = await sql.unsafe<Array<{ count: string | number }>>(
+    "SELECT COUNT(*) AS count FROM notes",
+  );
+  if (Number(count) === 0) {
+    await sql.unsafe("INSERT INTO notes (body) VALUES (${notePlaceholder})", [
+      "Welcome to Strata!",
+    ]);
+  }${seedBlock}
+}
+
+if (import.meta.main) {
+  await migrate();
+  await seed();
+  console.log("Database migrated and seeded.");
+  process.exit(0);
+}
+`;
+}
+function dropTables(layers) {
+  const ordered = [];
+  if (authUsesToken(layers.auth)) {
+    ordered.push("api_tokens");
+  }
+  if (authUsesCookie(layers.auth)) {
+    ordered.push("sessions");
+  }
+  if (authNeedsUsers(layers.auth)) {
+    ordered.push("users");
+  }
+  ordered.push("notes");
+  if (layers.tenancy === "rls") {
+    ordered.push("tenant");
+  }
+  return ordered;
 }
-function parseArgs(argv) {
-  const positional = argv.filter((arg) => !arg.startsWith("-"));
-  if (argv.includes("-h") || argv.includes("--help")) {
-    usage();
-    process.exit(0);
+function renderFreshTs(layers) {
+  const tables = dropTables(layers);
+  const cascade = layers.database === "sqlite" ? "" : " CASCADE";
+  return `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
+import { migrate, seed } from "./migrate.ts";
+
+const tables = ${JSON.stringify(tables)};
+
+export async function fresh() {
+${ensureCall(layers)}  const sql = getSql();
+  for (const table of tables) {
+    await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
   }
-  const projectName = positional[0] ?? "strata-app";
-  if (!/^[a-z0-9][a-z0-9-_]*$/i.test(projectName)) {
-    console.error("Project name must contain only letters, numbers, hyphens, and underscores.");
-    process.exit(1);
+  await migrate();
+  await seed();
+}
+
+if (import.meta.main) {
+  await fresh();
+  console.log("Database reset, migrated, and seeded.");
+  process.exit(0);
+}
+`;
+}
+function renderSeedTs() {
+  return `import { seed } from "./migrate.ts";
+
+export { seed };
+
+if (import.meta.main) {
+  await seed();
+  console.log("Database seeded.");
+  process.exit(0);
+}
+`;
+}
+function renderStatusTs(layers) {
+  const tables = dropTables(layers);
+  return `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
+
+const tables = ${JSON.stringify(tables)};
+
+export async function status() {
+${ensureCall(layers)}  const sql = getSql();
+  console.log("Starter schema (inline SQL, not a migration runner):");
+  for (const table of tables) {
+    try {
+      const rows = await sql.unsafe<Array<{ count: string | number }>>(
+        \`SELECT COUNT(*) AS count FROM \${table}\`,
+      );
+      console.log(\`- [present] \${table} (rows: \${rows[0]?.count ?? 0})\`);
+    } catch {
+      console.log(\`- [missing] \${table}\`);
+    }
   }
+}
+
+if (import.meta.main) {
+  await status();
+  process.exit(0);
+}
+`;
+}
+function renderRollbackTs(layers) {
+  const tables = dropTables(layers);
+  const cascade = layers.database === "sqlite" ? "" : " CASCADE";
+  return `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
+
+const tables = ${JSON.stringify(tables)};
+
+export async function rollback() {
+${ensureCall(layers)}  const sql = getSql();
+  for (const table of tables) {
+    await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
+    console.log(\`dropped \${table}\`);
+  }
+}
+
+if (import.meta.main) {
+  await rollback();
+  console.log("Rolled back starter tables.");
+  process.exit(0);
+}
+`;
+}
+function renderPreloadTs(layers, projectName) {
+  const database = appDatabaseName(projectName);
+  const fallback = layers.database === "sqlite" ? "sqlite:./storage/app.sqlite" : layers.database === "mysql" ? `mysql://root:root@localhost:3306/${database}` : `postgresql://postgres:postgres@localhost:5432/${database}`;
+  return `import { join } from "node:path";
+import { configureModulesDirectory } from "@getstrata/bootstrap/discoverModules";
+
+process.env.DATABASE_URL ??= ${JSON.stringify(fallback)};
+process.env.FRONTEND_MODE ??= ${JSON.stringify(layers.frontend)};
+process.env.SPA_PREFIX ??= ${JSON.stringify(layers.spaPrefix)};
+process.env.CACHE_DRIVER ??= ${JSON.stringify(layers.cache)};
+process.env.QUEUE_DRIVER ??= ${JSON.stringify(layers.queue)};
+process.env.MAIL_DRIVER ??= ${JSON.stringify(layers.mail)};
+process.env.TENANCY_DRIVER ??= ${JSON.stringify(layers.tenancy)};
+configureModulesDirectory(join(import.meta.dir, "../modules"));
+`;
+}
+function renderConfigTs() {
+  return `export interface AppConfig {
+  port: number;
+  appUrl: string;
+  databaseUrl: string;
+}
+
+export function loadConfig(): AppConfig {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is required");
+  }
+
   return {
-    projectName,
-    targetDir: resolve(process.cwd(), projectName)
+    port: Number(process.env.PORT ?? 3000),
+    appUrl: process.env.APP_URL ?? "http://localhost:3000",
+    databaseUrl,
   };
 }
-function copyTemplate(source, target, projectName) {
-  mkdirSync(target, { recursive: true });
-  for (const entry of readdirSync(source)) {
-    const from = join(source, entry);
-    const to = join(target, entry.replace(PLACEHOLDER, projectName));
-    const info = statSync(from);
-    if (info.isDirectory()) {
-      copyTemplate(from, to, projectName);
-      continue;
+`;
+}
+function renderConfigProvider(layers) {
+  return `import {
+  APP_PORT_CONFIG_KEY,
+  CORE_CONFIG_TOKEN,
+  DATABASE_URL_CONFIG_KEY,
+  REDIS_URL_CONFIG_KEY,
+} from "@getstrata/bootstrap/config";
+import type { ServiceProvider } from "@getstrata/core/contracts/di";
+import { loadConfig } from "../config.ts";
+
+const configProvider: ServiceProvider = {
+  name: "starter.config",
+  register({ container, config }) {
+    const appConfig = loadConfig();
+
+    container.set(CORE_CONFIG_TOKEN, config);
+    config.set(DATABASE_URL_CONFIG_KEY, appConfig.databaseUrl);
+    config.set(APP_PORT_CONFIG_KEY, appConfig.port);
+    config.set(REDIS_URL_CONFIG_KEY, process.env.REDIS_URL ?? "");
+    config.set("app.url", appConfig.appUrl);
+    config.set("cache.driver", process.env.CACHE_DRIVER ?? "${layers.cache}");
+    config.set("cache.ttlMs", 3_600_000);
+    config.set("cache.maxEntries", 100);
+    config.set("queue.driver", process.env.QUEUE_DRIVER ?? "${layers.queue}");
+  },
+};
+
+export default configProvider;
+`;
+}
+function renderQueueProvider() {
+  return `import type { ServiceProvider } from "@getstrata/core/contracts/di";
+import { CORE_QUEUE_TOKEN } from "@getstrata/core/contracts/serviceTokens";
+import {
+  createAppQueue,
+  createFailedJobService,
+  FAILED_JOB_SERVICE_TOKEN,
+} from "@getstrata/core/queue/createAppQueue";
+
+const queueProvider: ServiceProvider = {
+  name: "starter.queue",
+  register({ container }) {
+    const driver = (process.env.QUEUE_DRIVER ?? "sync") as "sync" | "async" | "redis";
+    const failedJobs = createFailedJobService();
+    container.set(FAILED_JOB_SERVICE_TOKEN, failedJobs);
+    container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, process.env.REDIS_URL, failedJobs));
+  },
+};
+
+export default queueProvider;
+`;
+}
+function renderEnsureDatabaseTs(layers, projectName) {
+  if (layers.database === "sqlite") {
+    return null;
+  }
+  const database = appDatabaseName(projectName);
+  const fallback = layers.database === "mysql" ? `mysql://root:root@localhost:3306/${database}` : `postgresql://postgres:postgres@localhost:5432/${database}`;
+  if (layers.database === "mysql") {
+    return `const APP_DATABASE = ${JSON.stringify(database)};
+
+function resolveAppDatabaseUrl(): string {
+  const explicit = process.env.APP_DATABASE_URL?.trim();
+  if (explicit) {
+    return explicit;
+  }
+
+  const base = process.env.DATABASE_URL?.trim() || ${JSON.stringify(fallback)};
+  try {
+    const url = new URL(base);
+    url.pathname = \`/\${APP_DATABASE}\`;
+    return url.toString();
+  } catch {
+    return base;
+  }
+}
+
+export async function ensureAppDatabase(): Promise<string> {
+  const url = resolveAppDatabaseUrl();
+  process.env.DATABASE_URL = url;
+  return url;
+}
+`;
+  }
+  return `const APP_DATABASE = ${JSON.stringify(database)};
+
+function resolveAppDatabaseUrl(): string {
+  const explicit = process.env.APP_DATABASE_URL?.trim();
+  if (explicit) {
+    return explicit;
+  }
+
+  const base = process.env.DATABASE_URL?.trim() || ${JSON.stringify(fallback)};
+  try {
+    const url = new URL(base);
+    url.pathname = \`/\${APP_DATABASE}\`;
+    return url.toString();
+  } catch {
+    return base;
+  }
+}
+
+function adminCandidateUrls(url: string): string[] {
+  const names = ["postgres", "template1"];
+  try {
+    const current = decodeURIComponent(new URL(url).pathname.replace(/^\\//, ""));
+    if (current && !names.includes(current)) {
+      names.push(current);
     }
-    let contents = readFileSync(from, "utf8");
-    if (contents.includes("{{PROJECT_NAME}}")) {
-      contents = contents.replace(PLACEHOLDER, projectName);
+  } catch {
+    // keep the built-in admin databases
+  }
+  return names.map((name) => {
+    const admin = new URL(url);
+    admin.pathname = \`/\${name}\`;
+    return admin.toString();
+  });
+}
+
+async function openAdminConnection(url: string): Promise<Bun.SQL> {
+  let lastError: unknown;
+  for (const candidate of adminCandidateUrls(url)) {
+    const adminSql = new Bun.SQL(candidate);
+    try {
+      await adminSql\`SELECT 1\`;
+      return adminSql;
+    } catch (error) {
+      lastError = error;
+      await adminSql.close().catch(() => undefined);
     }
-    writeFileSync(to, contents, { mode: info.mode & 511 });
   }
+  throw lastError instanceof Error
+    ? lastError
+    : new Error("Could not open an admin connection to create the app database.");
 }
-function main() {
-  const options = parseArgs(process.argv.slice(2));
-  if (!options)
-    process.exit(1);
-  const templateDir = join(import.meta.dir, "templates");
-  if (!existsSync(templateDir)) {
-    console.error("Template directory missing. Reinstall create-strata.");
-    process.exit(1);
+
+export async function ensureAppDatabase(): Promise<string> {
+  const url = resolveAppDatabaseUrl();
+  const parsed = new URL(url);
+  const name = decodeURIComponent(parsed.pathname.replace(/^\\//, ""));
+  if (!name) {
+    throw new Error("DATABASE_URL is missing a database name.");
   }
-  if (existsSync(options.targetDir)) {
-    console.error(`Directory already exists: ${options.targetDir}`);
-    process.exit(1);
+
+  const identifier = name.replace(/[^A-Za-z0-9_]/g, "");
+  if (identifier !== name) {
+    throw new Error(\`Refusing to create a database with an unsafe name: \${name}\`);
+  }
+
+  const adminSql = await openAdminConnection(url);
+  try {
+    const rows = await adminSql\`
+      SELECT 1 AS ok FROM pg_database WHERE datname = \${name}
+    \`;
+    if (rows.length === 0) {
+      await adminSql.unsafe(\`CREATE DATABASE \${identifier}\`);
+    }
+  } finally {
+    await adminSql.close();
   }
-  copyTemplate(templateDir, options.targetDir, options.projectName);
+
+  process.env.DATABASE_URL = url;
+  process.env.APP_DATABASE_URL = url;
+  return url;
+}
+`;
+}
+function renderSidecarsTs(_layers) {
+  return null;
+}
+function renderProvidersIndex() {
+  return `import type { ServiceProvider } from "@getstrata/core/contracts/di";
+import authProvider from "./auth.ts";
+import cacheProvider from "./cache.ts";
+import configProvider from "./config.ts";
+import queueProvider from "./queue.ts";
+import storageProvider from "./storage.ts";
+
+const starterProviders: ServiceProvider[] = [
+  configProvider,
+  cacheProvider,
+  storageProvider,
+  queueProvider,
+  authProvider,
+];
+
+export { starterProviders };
+`;
+}
+function renderCreateAppTs(layers) {
+  const ensureLine = needsEnsure(layers) ? `import { ensureAppDatabase } from "./ensureDatabase.ts";
+` : "";
+  return `import { join } from "node:path";
+import "./preload.ts";
+import { runProviderPhase } from "@getstrata/bootstrap/context";
+import {
+  type AppContext,
+  type AppDependencies,
+  type AppRouteMap,
+  assertAppDependenciesComplete,
+  type ConfigStore,
+  type MutableAppDependencies,
+  type ProviderContext,
+  ServiceContainer,
+} from "@getstrata/bootstrap/contracts";
+import { mergeSpaRoutes } from "@getstrata/bootstrap/createSpaRoutes";
+import {
+  configureModulesDirectory,
+  ensureModulesLoaded,
+} from "@getstrata/bootstrap/discoverModules";
+import { createHealthRoutes } from "@getstrata/bootstrap/health";
+import { createMetricsRoutes } from "@getstrata/bootstrap/metricsRoutes";
+import { assertProductionSecrets } from "@getstrata/bootstrap/secretsGuard";
+import { createWebServer } from "@getstrata/bootstrap/web/server";
+import { setActiveApplicationContext } from "@getstrata/core/runtime/applicationRegistry";
+import { migrate } from "../db/migrate.ts";
+import { buildRoutes } from "../routes.ts";
+import { loadConfig } from "./config.ts";
+import { getSql } from "./database.ts";
+${ensureLine}import { starterProviders } from "./providers/index.ts";
+
+export interface BootstrapOptions {
+  migrate?: boolean;
+}
+
+export interface BootstrappedApp {
+  context: AppContext;
+  routes: AppRouteMap;
+  config: ReturnType<typeof loadConfig>;
+}
+
+class AppConfigStore {
+  private readonly values = new Map<string, unknown>();
+
+  set<T>(key: string, value: T): T {
+    this.values.set(key, value);
+    return value;
+  }
+
+  get<T>(key: string): T | undefined {
+    return this.values.get(key) as T | undefined;
+  }
+
+  require<T>(key: string): T {
+    const value = this.get<T>(key);
+    if (value === undefined) {
+      throw new Error(\`Missing required config value "\${key}".\`);
+    }
+    return value;
+  }
+
+  has(key: string): boolean {
+    return this.values.has(key);
+  }
+}
+
+function createAppContext(): AppContext {
+  const container = new ServiceContainer();
+  const config = new AppConfigStore() as unknown as ConfigStore;
+  const dependencies: MutableAppDependencies = { container };
+  const context: ProviderContext = { container, config, dependencies };
+
+  runProviderPhase(starterProviders, "register", context);
+  runProviderPhase(starterProviders, "boot", context);
+
+  assertAppDependenciesComplete(dependencies);
+
+  const appContext = { container, config, dependencies: dependencies as AppDependencies };
+  setActiveApplicationContext(appContext as never);
+  return appContext;
+}
+
+export async function bootstrapApp(options: BootstrapOptions = {}): Promise<BootstrappedApp> {
+  const { migrate: runMigrate = true } = options;
+
+  if (process.env.APP_ENV === "production") {
+    assertProductionSecrets();
+  }
+
+${needsEnsure(layers) ? `  await ensureAppDatabase();
+` : ""}  const appConfig = loadConfig();
+  getSql();
+  configureModulesDirectory(join(import.meta.dir, "../modules"));
+  await ensureModulesLoaded();
+  const context = createAppContext();
+
+  if (runMigrate) {
+    await migrate();
+  }
+
+  const routes = mergeSpaRoutes(context.dependencies, {
+    ...createHealthRoutes(context.dependencies),
+    ...buildRoutes(context.dependencies),
+    ...createMetricsRoutes(),
+  }, {
+    distDirectory: join(import.meta.dir, "../../frontend/dist"),
+  });
+
+  return { context, routes, config: appConfig };
+}
+
+export async function createApp(options: BootstrapOptions = {}) {
+  return bootstrapApp({ migrate: false, ...options });
+}
+
+export function createAppServer(routes: AppRouteMap, port = 0) {
+  return createWebServer({
+    port,
+    publicDir: "./public",
+    routes,
+  });
+}
+
+export { createAppContext };
+`;
+}
+function renderRoutesTs() {
+  return `import { buildModuleRoutes } from "@getstrata/bootstrap/buildModuleRoutes";
+import { buildWebModuleRoutes } from "@getstrata/bootstrap/buildWebModuleRoutes";
+import type { AppDependencies, AppRouteMap } from "@getstrata/bootstrap/contracts";
+
+export function buildRoutes(dependencies: AppDependencies): AppRouteMap {
+  const api = buildModuleRoutes(dependencies);
+  return {
+    ...api,
+    ...buildWebModuleRoutes(dependencies, { clearRegistry: false }),
+  };
+}
+`;
+}
+function renderViewTs() {
+  return `import { join } from "node:path";
+import { resolveCsrfTokenForRequest } from "@getstrata/core/http/csrfToken";
+import { EtaViewEngine, htmlResponse } from "@getstrata/core/view";
+
+const engine = new EtaViewEngine(join(import.meta.dir, "../../views"));
+
+export interface LayoutData {
+  title: string;
+  description?: string;
+}
+
+export async function renderPage(
+  template: string,
+  data: Record<string, unknown> & { layout: LayoutData },
+  request?: Request,
+): Promise<Response> {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const html = await engine.render(template, { ...data, csrfToken });
+  return htmlResponse(html);
+}
+
+export function plainText(body: string): Response {
+  return new Response(body, { headers: { "content-type": "text/plain; charset=utf-8" } });
+}
+`;
+}
+
+// src/generate.ts
+var PROJECT_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]*$/i;
+function starterPackageRoot() {
+  return join2(import.meta.dir, "..");
+}
+function resolveTemplateRoot(root = starterPackageRoot()) {
+  const fromDist = join2(root, "templates");
+  if (existsSync2(join2(fromDist, "src"))) {
+    return fromDist;
+  }
+  const nested = join2(root, "dist/templates");
+  if (existsSync2(join2(nested, "src"))) {
+    return nested;
+  }
+  return fromDist;
+}
+function resolveOverlayRoot(root = starterPackageRoot()) {
+  const candidates = [
+    join2(root, "templates/overlays"),
+    join2(root, "dist/templates/overlays"),
+    join2(root, "../../templates/scaffold")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync2(join2(candidate, "server-htmx")) || existsSync2(join2(candidate, "spa-react")) || existsSync2(join2(candidate, "api"))) {
+      return candidate;
+    }
+  }
+  return candidates[0] ?? join2(root, "templates/overlays");
+}
+function assertProjectName(projectName) {
+  if (!PROJECT_NAME_PATTERN.test(projectName)) {
+    throw new Error("Project name must contain only letters, numbers, hyphens, and underscores.");
+  }
+}
+function applyFrontendOverlays(overlayRoot, targetDir, layers) {
+  if (layers.frontend === "hybrid" || layers.frontend === "spa-react") {
+    copyOverlayTree(join2(overlayRoot, "spa-react"), targetDir);
+  }
+  if (layers.frontend === "api") {
+    copyOverlayTree(join2(overlayRoot, "api"), targetDir);
+  }
+}
+function writeGeneratedFiles(options) {
+  const { targetDir, projectName, layers } = options;
+  const src = join2(targetDir, "src");
+  writeText(join2(targetDir, ".env.example"), renderEnvExample(projectName, layers));
+  writeText(join2(targetDir, ".gitignore"), renderGitignore());
+  writeText(join2(targetDir, "package.json"), renderPackageJson(projectName, { ...options, layers }));
+  writeText(join2(targetDir, "README.md"), renderReadme(projectName, layers));
+  writeText(join2(targetDir, "strata.layers.json"), renderLayersManifest(projectName, layers));
+  const compose = renderDockerCompose(projectName, layers);
+  if (compose) {
+    writeText(join2(targetDir, "docker-compose.yml"), compose);
+  } else {
+    removeIfExists(join2(targetDir, "docker-compose.yml"));
+  }
+  writeText(join2(src, "routes.ts"), renderRoutesTs());
+  writeText(join2(src, "lib/view.ts"), renderViewTs());
+  writeText(join2(src, "bootstrap/config.ts"), renderConfigTs());
+  writeText(join2(src, "bootstrap/preload.ts"), renderPreloadTs(layers, projectName));
+  writeText(join2(src, "bootstrap/database.ts"), renderDatabaseTs(layers));
+  const ensureDatabase = renderEnsureDatabaseTs(layers, projectName);
+  if (ensureDatabase) {
+    writeText(join2(src, "bootstrap/ensureDatabase.ts"), ensureDatabase);
+  } else {
+    removeIfExists(join2(src, "bootstrap/ensureDatabase.ts"));
+  }
+  writeText(join2(src, "bootstrap/createApp.ts"), renderCreateAppTs(layers));
+  writeText(join2(src, "bootstrap/providers/config.ts"), renderConfigProvider(layers));
+  writeText(join2(src, "bootstrap/providers/queue.ts"), renderQueueProvider());
+  writeText(join2(src, "bootstrap/providers/index.ts"), renderProvidersIndex());
+  writeText(join2(src, "bootstrap/providers/auth.ts"), renderAuthProvider(layers));
+  writeText(join2(src, "db/migrate.ts"), renderMigrateTs(layers));
+  writeText(join2(src, "db/fresh.ts"), renderFreshTs(layers));
+  writeText(join2(src, "db/seed.ts"), renderSeedTs());
+  writeText(join2(src, "db/status.ts"), renderStatusTs(layers));
+  writeText(join2(src, "db/rollback.ts"), renderRollbackTs(layers));
+  writeText(join2(src, "modules/site/index.ts"), renderSiteModule(layers));
+  const directory = renderAuthDirectory(layers);
+  if (directory) {
+    writeText(join2(src, "bootstrap/authDirectory.ts"), directory);
+  }
+  const sidecars = renderSidecarsTs(layers);
+  if (sidecars) {
+    writeText(join2(src, "bootstrap/sidecars.ts"), sidecars);
+  }
+  const authModule = renderAuthModule(layers);
+  if (authModule) {
+    writeText(join2(src, "modules/auth/index.ts"), authModule);
+  }
+  writeText(join2(targetDir, "views/home.eta"), renderHomeView(projectName, layers));
+  writeText(join2(targetDir, "views/layouts/app.eta"), renderLayout(layers, projectName));
+  if (authUsesCookie(layers.auth)) {
+    writeText(join2(targetDir, "views/auth/login.eta"), renderLoginView());
+  }
+  mkdirSync2(join2(targetDir, "storage"), { recursive: true });
+  writeText(join2(targetDir, "storage/.gitkeep"), "");
+}
+function printNextSteps(projectName, layers, compose) {
+  const dockerOn = selectedDockerServices(layers);
+  const neededTools = neededDockerServices(layers);
+  const localOn = neededTools.filter((name) => !dockerOn.includes(name));
+  const dockerSummary = neededTools.length === 0 ? "none" : dockerOn.length > 0 ? dockerOn.join("+") : "local";
   console.log(`
-Created Strata app in ${options.projectName}/
+Created Strata app in ${projectName}/
 `);
-  console.log("Next steps:");
-  console.log(`  cd ${options.projectName}`);
+  console.log(`frontend=${layers.frontend}  db=${layers.database}  auth=${layers.auth}  docker=${dockerSummary}`);
+  console.log(`
+Next steps:`);
+  console.log(`  cd ${projectName}`);
   console.log("  cp .env.example .env");
-  console.log("  docker compose up -d");
+  if (compose) {
+    console.log("  docker compose up -d");
+  }
+  if (localOn.length > 0) {
+    console.log(`  Point env at local ${localOn.join(", ")} (see README).`);
+  }
   console.log("  bun install");
   console.log("  strata migrate");
   console.log(`  strata dev
 `);
 }
-main();
+function generateProject(options) {
+  assertProjectName(options.projectName);
+  if (existsSync2(options.targetDir)) {
+    if (!options.force) {
+      throw new Error(`Directory already exists: ${options.targetDir}`);
+    }
+    rmSync2(options.targetDir, { recursive: true, force: true });
+  }
+  copyTree(options.templateRoot, options.targetDir, options.projectName, new Set(["overlays"]));
+  applyFrontendOverlays(options.overlayRoot, options.targetDir, options.layers);
+  writeGeneratedFiles(options);
+}
+async function runCreateStrata(argv, cwd = process.cwd()) {
+  let flags;
+  try {
+    flags = parseCreateStrataArgs(argv);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : error);
+    return 1;
+  }
+  if (flags.help) {
+    console.log(usage());
+    return 0;
+  }
+  try {
+    const plan = await resolveStarterPlan(flags);
+    const targetDir = resolve(cwd, plan.projectName);
+    generateProject({
+      projectName: plan.projectName,
+      targetDir,
+      layers: plan.layers,
+      templateRoot: resolveTemplateRoot(),
+      overlayRoot: resolveOverlayRoot(),
+      force: flags.force
+    });
+    printNextSteps(plan.projectName, plan.layers, renderDockerCompose(plan.projectName, plan.layers) !== null);
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : error);
+    return 1;
+  }
+}
+
+// cli.ts
+var code = await runCreateStrata(process.argv.slice(2));
+process.exit(code);