@getstrata/starter 0.1.9 → 0.1.10

package/dist/cli.js

@@ -80,7 +80,7 @@ var AUTH_STACKS = [
   "cookie-token",
   "cookie-token-jwt"
 ];
-var TENANCY_DRIVERS = ["none", "rls"];
+var TENANCY_DRIVERS = ["none", "column", "rls"];
 var CACHE_DRIVERS = ["array", "redis"];
 var QUEUE_DRIVERS = ["sync", "redis"];
 var MAIL_DRIVERS = ["log", "smtp"];
@@ -103,6 +103,12 @@ function authUsesJwt(auth) {
 function authNeedsUsers(auth) {
   return auth !== "headers";
 }
+function usesTenantTable(tenancy) {
+  return tenancy === "rls" || tenancy === "column";
+}
+function htmlAuthKit(auth) {
+  return authUsesCookie(auth);
+}
 function needsRedis(layers) {
   return layers.cache === "redis" || layers.queue === "redis";
 }
@@ -225,7 +231,7 @@ Options:
   --frontend          api | server-htmx | spa-react | hybrid
   --database          sqlite | postgres | mysql (one database; not mixed)
   --auth              headers | cookie | token | jwt | cookie-token | cookie-token-jwt
-  --tenancy           none | rls
+  --tenancy           none | column | rls (rls is Postgres SET LOCAL; sqlite/mysql coerce rls to column)
   --cache             array | redis
   --queue             sync | redis
   --mail              log | smtp
@@ -461,8 +467,8 @@ function applyFlagOverrides(base, flags) {
     spaPrefix: flags.spaPrefix ?? base.spaPrefix,
     extras: { ...base.extras, ...flags.extras }
   };
-  if (next.database !== "postgres") {
-    next.tenancy = "none";
+  if (next.database !== "postgres" && next.tenancy === "rls") {
+    next.tenancy = "column";
   }
   return reconcileDocker(applyDockerFlags(next, flags));
 }
@@ -540,14 +546,20 @@ async function promptLayers(flags, prompter) {
     { value: "cookie-token", label: "cookie-token: HTML cookies + API tokens" },
     { value: "cookie-token-jwt", label: "cookie-token-jwt: cookies, tokens, and JWT" }
   ], layers.auth);
-  if (layers.database === "postgres") {
-    layers.tenancy = await prompter.select("Tenancy", [
-      { value: "none", label: "none: no tenant table" },
-      { value: "rls", label: "rls: Postgres row-level security plus a tenant table" }
-    ], layers.tenancy);
-  } else {
-    layers.tenancy = "none";
-  }
+  layers.tenancy = await prompter.select("Tenancy", layers.database === "postgres" ? [
+    { value: "none", label: "none: no tenant table" },
+    {
+      value: "column",
+      label: "column: tenant table + users.tenant_id (no Postgres SET LOCAL)"
+    },
+    { value: "rls", label: "rls: Postgres row-level security plus a tenant table" }
+  ] : [
+    { value: "none", label: "none: no tenant table" },
+    {
+      value: "column",
+      label: "column: tenant table + users.tenant_id (SQLite/MySQL cannot run Postgres RLS)"
+    }
+  ], layers.database === "postgres" ? layers.tenancy : layers.tenancy === "rls" ? "column" : layers.tenancy);
   layers.cache = await prompter.select("Cache", [
     { value: "array", label: "array: in-process" },
     { value: "redis", label: "redis" }
@@ -565,9 +577,9 @@ async function promptLayers(flags, prompter) {
   }
   const askExtras = flags.extrasPrompt || await prompter.confirm("Configure extras (MFA, SCIM, metrics)?", false);
   if (askExtras) {
-    layers.extras.mfa = await prompter.confirm("Staff MFA env flag?", layers.extras.mfa);
-    layers.extras.emailVerification = await prompter.confirm("Email verification env flag?", layers.extras.emailVerification);
-    layers.extras.scim = await prompter.confirm("SCIM env stubs?", layers.extras.scim);
+    layers.extras.mfa = await prompter.confirm("Authenticator MFA (cookie challenge + setup pages)?", layers.extras.mfa);
+    layers.extras.emailVerification = await prompter.confirm("Email verification (signed links + /email/verify)?", layers.extras.emailVerification);
+    layers.extras.scim = await prompter.confirm("SCIM /Users adapter?", layers.extras.scim);
     layers.extras.metrics = await prompter.confirm("Metrics token?", layers.extras.metrics);
   }
   if (!dockerFlagsProvided(flags)) {
@@ -621,300 +633,159 @@ async function resolveStarterPlan(flags, injected) {
   }
 }
 
-// src/renderAuth.ts
-function renderAuthDirectory(layers) {
-  if (!authNeedsUsers(layers.auth)) {
-    return null;
+// src/renderAuthFlows.ts
+function ph(layers, count, start = 1) {
+  if (layers.database === "postgres") {
+    return Array.from({ length: count }, (_, index) => `$${start + index}`).join(", ");
   }
-  const tokenLookup = authUsesToken(layers.auth) ? `
-  async resolveUserFromToken(token: string) {
-    if (!token || token.split(".").length === 3) {
-      return null;
-    }
-    const hashed = hashApiToken(token);
-    const rows = await getSql().unsafe<
-      Array<{
-        id: number;
-        user_id: number;
-        abilities: string;
-        expires_at: Date | string | null;
-        role?: string;
-        is_admin?: number | boolean;
-        email_verified_at?: Date | string | null;
-      }>
-    >(
-      \`SELECT t.id, t.user_id, t.abilities, t.expires_at, u.is_admin, u.email_verified_at
-       FROM api_tokens t INNER JOIN users u ON u.id = t.user_id
-       WHERE t.token_hash = ?\`,
-      [hashed],
-    );
-    const row = rows[0];
-    if (!row) {
-      return null;
-    }
-    if (row.expires_at && new Date(row.expires_at).getTime() <= Date.now()) {
-      return null;
-    }
-    let abilities: string[] = [];
-    try {
-      abilities = JSON.parse(String(row.abilities ?? "[]")) as string[];
-    } catch {
-      abilities = ["profile:read"];
-    }
-    return {
-      id: Number(row.user_id),
-      role: row.is_admin ? "admin" : "member",
-      abilities,
-      tokenId: Number(row.id),
-      emailVerifiedAt: row.email_verified_at ?? null,
-    };
-  },` : `
-  async resolveUserFromToken() {
-    return null;
-  },`;
-  const placeholder = layers.database === "postgres" ? "$1" : "?";
-  const hashImport = authUsesToken(layers.auth) ? `import { hashApiToken } from "@getstrata/core/auth/tokenHash";
-` : "";
-  return `import type { AuthUser } from "@getstrata/core/auth/authContext";
-import { verifyPassword } from "@getstrata/core/auth/password";
-${hashImport}import type { AuthUserDirectory } from "@getstrata/core/contracts/authUserDirectory";
-import { getSql } from "./database.ts";
+  return Array.from({ length: count }, () => "?").join(", ");
+}
+function sqlFalse(layers) {
+  return layers.database === "postgres" ? "false" : "0";
+}
+function sqlTrue(layers) {
+  return layers.database === "postgres" ? "true" : "1";
+}
+function renderPendingMfaTs() {
+  return `import { createHmac, timingSafeEqual } from "node:crypto";
 
-function mapRole(isAdmin: unknown): string {
-  return isAdmin === true || isAdmin === 1 || isAdmin === "1" ? "admin" : "member";
+const COOKIE = "strata_mfa_pending";
+
+function secret(): string {
+  return process.env.SESSION_SECRET?.trim() || "dev-session-secret-change-me-please-32ch";
 }
 
-export const starterAuthDirectory: AuthUserDirectory = {
-${tokenLookup.replace("WHERE t.token_hash = ?", `WHERE t.token_hash = ${placeholder}`)}
+function sign(userId: number, issuedAt: number): string {
+  const payload = \`\${userId}.\${issuedAt}\`;
+  const signature = createHmac("sha256", secret()).update(payload).digest("hex");
+  return \`\${payload}.\${signature}\`;
+}
 
-  async findByIdOrThrow(id: number) {
-    const rows = await getSql().unsafe<
-      Array<{
-        id: number;
-        email: string;
-        is_admin: number | boolean;
-        email_verified_at: Date | string | null;
-        password: string;
-      }>
-    >(\`SELECT id, email, is_admin, email_verified_at, password FROM users WHERE id = ${placeholder}\`, [id]);
-    const row = rows[0];
-    if (!row) {
-      throw new Error(\`User \${id} not found.\`);
-    }
-    return {
-      id: Number(row.id),
-      email: row.email,
-      role: mapRole(row.is_admin),
-      email_verified_at: row.email_verified_at ?? null,
-      password: row.password,
-    };
-  },
+export function pendingMfaSetCookie(userId: number): string {
+  const issuedAt = Date.now();
+  return \`\${COOKIE}=\${sign(userId, issuedAt)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600\`;
+}
 
-  async findByEmail(email: string) {
-    const rows = await getSql().unsafe<
-      Array<{
-        id: number;
-        email: string;
-        is_admin: number | boolean;
-        email_verified_at: Date | string | null;
-        password: string;
-      }>
-    >(
-      \`SELECT id, email, is_admin, email_verified_at, password FROM users WHERE email = ${placeholder}\`,
-      [email.trim().toLowerCase()],
-    );
-    const row = rows[0];
-    if (!row) {
-      return null;
-    }
-    return {
-      id: Number(row.id),
-      email: row.email,
-      role: mapRole(row.is_admin),
-      email_verified_at: row.email_verified_at ?? null,
-      password: row.password,
-    };
-  },
+export function pendingMfaClearCookie(): string {
+  return \`\${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\`;
+}
 
-  async verifyCredentials(email: string, password: string): Promise<AuthUser | null> {
-    const user = await this.findByEmail(email);
-    if (!user?.password || !(await verifyPassword(password, user.password))) {
+export function readPendingMfaUserId(request: Request): number | null {
+  const header = request.headers.get("cookie") ?? "";
+  for (const part of header.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name !== COOKIE) {
+      continue;
+    }
+    const value = rest.join("=");
+    const pieces = value.split(".");
+    if (pieces.length !== 3) {
       return null;
     }
-    return {
-      id: user.id,
-      role: user.role,
-      emailVerifiedAt: user.email_verified_at ?? null,
-    };
-  },
-};
-`;
-}
-function renderAuthProvider(layers) {
-  if (layers.auth === "headers") {
-    return `import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";
-import type { AuthUser } from "@getstrata/core/auth/authContext";
-import { currentAuthUser } from "@getstrata/core/auth/authContext";
-import type { ServiceProvider } from "@getstrata/core/contracts/di";
-
-class StarterAuthManager {
-  async resolve(request?: Request): Promise<AuthUser | null> {
-    if (process.env.AUTH_DEV_HEADERS === "false") {
-      return request ? null : currentAuthUser();
+    const userId = Number.parseInt(pieces[0] ?? "", 10);
+    const issuedAt = Number.parseInt(pieces[1] ?? "", 10);
+    const signature = pieces[2] ?? "";
+    if (!Number.isInteger(userId) || userId <= 0 || Date.now() - issuedAt > 10 * 60 * 1000) {
+      return null;
     }
-    if (request) {
-      const userId = request.headers.get("x-authenticated-user-id");
-      if (!userId) {
-        return null;
-      }
-      const role = request.headers.get("x-authenticated-user-role");
-      return {
-        id: userId,
-        ...(role ? { role } : {}),
-      };
+    const expected = sign(userId, issuedAt).split(".").pop() ?? "";
+    const left = Buffer.from(signature);
+    const right = Buffer.from(expected);
+    if (left.length !== right.length || !timingSafeEqual(left, right)) {
+      return null;
     }
-    return currentAuthUser();
-  }
-
-  user(request?: Request) {
-    return this.resolve(request);
-  }
-
-  async check(request: Request) {
-    return (await this.user(request)) !== null;
+    return userId;
   }
+  return null;
 }
-
-const authProvider: ServiceProvider = {
-  name: "starter.auth",
-  register({ container }) {
-    container.set(CORE_AUTH_TOKEN, new StarterAuthManager());
-  },
-};
-
-export default authProvider;
 `;
+}
+function renderAuthModule(layers) {
+  if (!authNeedsUsers(layers.auth)) {
+    return null;
   }
-  const cookieBlock = authUsesCookie(layers.auth) ? `    const auth = createCookieSessionAuthManager({
-      secret: process.env.SESSION_SECRET?.trim() || "dev-session-secret-change-me-please-32ch",
-      cookieName: "strata_session",
-      mapUser: (user) => ({
-        id: user.id,
-        role: user.is_admin ? "admin" : "member",
-      }),
-    });` : `    const fallback = ${authUsesToken(layers.auth) ? "new DatabaseTokenGuard(container)" : "new JwtGuard()"};
-    const auth = new AuthManager(fallback);`;
-  const tokenRegs = authUsesToken(layers.auth) ? `    const apiGuard = new DatabaseTokenGuard(container);
-    auth.registerGuard("api", apiGuard);
-    auth.registerGuard("access_token", apiGuard);
-    auth.registerGuard("token", apiGuard);` : "";
-  const jwtReg = authUsesJwt(layers.auth) ? `    auth.registerGuard("jwt", new JwtGuard());` : "";
-  const basicReg = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `    auth.registerGuard("basic", new BasicAuthGuard(container));` : "";
-  const ability = authUsesToken(layers.auth) ? `    container.set(CORE_ABILITY_CHECKER_TOKEN, createTokenAbilityChecker());` : "";
-  const imports = [`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`];
-  if (authUsesCookie(layers.auth)) {
-    imports.push(`import { createCookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+  const cookie = htmlAuthKit(layers.auth);
+  const mfa = Boolean(layers.extras.mfa && cookie);
+  const verify = Boolean(layers.extras.emailVerification);
+  const jsonApi = authUsesToken(layers.auth) || authUsesJwt(layers.auth);
+  const tenantInsert = usesTenantTable(layers.tenancy);
+  const insertCols = tenantInsert ? "name, email, password, is_admin, tenant_id" : "name, email, password, is_admin";
+  const insertPh = tenantInsert ? ph(layers, 5) : ph(layers, 4);
+  const insertTail = tenantInsert ? `, ${sqlFalse(layers)}, 1` : `, ${sqlFalse(layers)}`;
+  const passwordPh = `${ph(layers, 1)}`;
+  const emailPh = `${ph(layers, 1, 2)}`;
+  const idPh = `${ph(layers, 1, 2)}`;
+  const verifiedPh = `${ph(layers, 1)}`;
+  const mfaUpdatePh = `${ph(layers, 1)}, ${ph(layers, 1, 2)}, ${ph(layers, 1, 3)}`;
+  const mfaIdPh = `${ph(layers, 1, 4)}`;
+  const imports = [];
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { randomBytes } from "node:crypto";`);
   }
-  if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
-    imports.push(`import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";`);
+  imports.push(`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`);
+  imports.push(`import type { AppModule } from "@getstrata/bootstrap/contracts";`);
+  if (cookie) {
+    imports.push(`import { parseFormBody } from "@getstrata/bootstrap/web/forms";`);
+    imports.push(`import { wrapWebLogin, wrapWebRegister } from "@getstrata/bootstrap/web/routing";`);
+    imports.push(`import type { CookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
   }
-  if (!authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
-    imports.push(`import { AuthManager, DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
-  } else if (!authUsesCookie(layers.auth) && authUsesJwt(layers.auth)) {
+  if (jsonApi) {
     imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
-  } else if (authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
-    imports.push(`import { DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
   }
   if (authUsesJwt(layers.auth)) {
-    imports.push(`import { JwtGuard } from "@getstrata/core/auth/jwtGuard";`);
+    imports.push(`import { jwtTtlSeconds, signJwt } from "@getstrata/core/auth/jwt";`);
   }
+  imports.push(`import { hashPassword, verifyPassword } from "@getstrata/core/auth/password";`);
   if (authUsesToken(layers.auth)) {
-    imports.push(`import { createTokenAbilityChecker } from "@getstrata/core/auth/tokenAbilityChecker";`);
+    imports.push(`import { hashApiToken } from "@getstrata/core/auth/tokenHash";`);
   }
-  imports.push(`import type { ServiceProvider } from "@getstrata/core/contracts/di";`);
-  const tokenImports = ["CORE_AUTH_USER_DIRECTORY_TOKEN"];
-  if (authUsesToken(layers.auth)) {
-    tokenImports.unshift("CORE_ABILITY_CHECKER_TOKEN");
+  if (mfa) {
+    imports.push(`import { protectMfaSecret, revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";`);
   }
-  imports.push(`import {
-  ${tokenImports.join(`,
-  `)},
-} from "@getstrata/core/contracts/serviceTokens";`);
-  imports.push(`import { starterAuthDirectory } from "../authDirectory.ts";`);
-  return `${imports.join(`
-`)}
-
-const authProvider: ServiceProvider = {
-  name: "starter.auth",
-  register({ container }) {
-    container.set(CORE_AUTH_USER_DIRECTORY_TOKEN, starterAuthDirectory);
-${cookieBlock}
-${tokenRegs}
-${jwtReg}
-${basicReg}
-${ability}
-    container.set(CORE_AUTH_TOKEN, auth);
-  },
-};
+  if (cookie) {
+    imports.push(`import { flashResponse } from "@getstrata/core/http/flashSession";`);
+  }
+  if (jsonApi) {
+    imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
+  }
+  imports.push(`import { absoluteTemporarySignedUrl, assertValidSignature } from "@getstrata/core/http/signedUrl";`);
+  imports.push(`import { mailer } from "@getstrata/core/mail/mailer";`);
+  if (mfa) {
+    imports.push(`import { generateRecoveryCodes, hashRecoveryCode, recoveryCodeMatches } from "@getstrata/core/security/recoveryCodes";`);
+    imports.push(`import { buildOtpauthUrl, generateTotpSecret, verifyTotp } from "@getstrata/core/security/totp";`);
+  }
+  imports.push(`import { starterAuthDirectory } from "../../bootstrap/authDirectory.ts";`);
+  imports.push(`import { getSql } from "../../bootstrap/database.ts";`);
+  if (cookie) {
+    imports.push(`import { renderPage } from "../../lib/view.ts";`);
+  }
+  if (mfa) {
+    imports.push(`import { pendingMfaClearCookie, pendingMfaSetCookie, readPendingMfaUserId } from "../../bootstrap/pendingMfa.ts";`);
+  }
+  const helpers = `
+async function sendSignedMail(to: string, subject: string, path: string, query: Record<string, string>) {
+  const link = absoluteTemporarySignedUrl(path, 3600, query);
+  await mailer().send({
+    to,
+    subject,
+    body: \`\${subject}\\n\\n\${link}\\n\`,
+  });
+}
+${cookie ? `
+function redirectTo(path: string, status = 302): Response {
+  return new Response(null, { status, headers: { location: path } });
+}
 
-export default authProvider;
-`;
+function sessionUser(user: { id: number; name?: string | null; email?: string | null; role: string }) {
+  return {
+    id: user.id,
+    name: user.name ?? user.email ?? "",
+    email: user.email ?? "",
+    is_admin: user.role === "admin",
+  };
 }
-function renderAuthModule(layers) {
-  if (!authNeedsUsers(layers.auth)) {
-    return null;
-  }
-  const cookieRoutes = authUsesCookie(layers.auth) ? `
-    webRoutes({ kernel, dependencies }) {
-      const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
-      return {
-        "/login": {
-          GET: kernel.wrapWebGuest(async (request) =>
-            renderPage(
-              "auth/login.eta",
-              { layout: { title: "Sign in" }, errors: {}, email: "" },
-              request,
-            ),
-          ),
-          POST: wrapWebLogin(
-            kernel,
-            async (request) => {
-              const { fields } = await parseFormBody(request);
-              const email = (fields.email ?? "").trim().toLowerCase();
-              const password = fields.password ?? "";
-              const user = await starterAuthDirectory.findByEmail?.(email);
-              if (!user?.password || !(await verifyPassword(password, user.password))) {
-                return renderPage(
-                  "auth/login.eta",
-                  {
-                    layout: { title: "Sign in" },
-                    errors: { email: "These credentials do not match our records." },
-                    email,
-                  },
-                  request,
-                );
-              }
-              return auth.signInRedirect(
-                {
-                  id: user.id,
-                  name: user.email ?? "",
-                  email: user.email ?? "",
-                  is_admin: user.role === "admin",
-                },
-                "/",
-              );
-            },
-            async () => new Response("Too many login attempts", { status: 429 }),
-          ),
-        },
-        "/logout": {
-          POST: kernel.wrapWebAuthenticatedAllowUnverified((request) =>
-            auth.signOutRedirect(request, "/login"),
-          ),
-        },
-      };
-    },` : "";
-  const apiLogin = authUsesToken(layers.auth) ? `
+` : ""}`;
+  const tokenLogin = authUsesToken(layers.auth) ? `
         "/api/v1/auth/login": {
           POST: kernel.wrap("api", withErrorHandling(async (request) => {
             const body = (await request.json()) as { email?: string; password?: string };
@@ -926,7 +797,7 @@ function renderAuthModule(layers) {
             }
             const plain = \`strp_\${randomBytes(24).toString("hex")}\`;
             await getSql().unsafe(
-              "INSERT INTO api_tokens (user_id, name, token_hash, abilities) VALUES (${layers.database === "postgres" ? "$1, $2, $3, $4" : "?, ?, ?, ?"})",
+              "INSERT INTO api_tokens (user_id, name, token_hash, abilities) VALUES (${ph(layers, 4)})",
               [user.id, "spa", hashApiToken(plain), JSON.stringify(["profile:read"])],
             );
             return jsonResponse({ token: plain });
@@ -938,12 +809,37 @@ function renderAuthModule(layers) {
             const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
             return jsonResponse({
               id: record.id,
-              name: record.email,
+              name: record.name ?? record.email,
               email: record.email,
               role: record.role,
             });
           }),
         },` : "";
+  const jsonRegister = jsonApi ? `
+        "/api/v1/auth/register": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { name?: string; email?: string; password?: string };
+            const name = (body.name ?? "").trim();
+            const email = (body.email ?? "").trim().toLowerCase();
+            const password = body.password ?? "";
+            if (!name || !email || password.length < 8) {
+              return jsonResponse({ error: "Name, email, and a password of 8+ characters are required." }, { status: 422 });
+            }
+            if (await starterAuthDirectory.findByEmail?.(email)) {
+              return jsonResponse({ error: "Email is already registered." }, { status: 422 });
+            }
+            const hashed = await hashPassword(password);
+            await getSql().unsafe(
+              "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+              [name, email, hashed${insertTail}],
+            );
+            const created = await starterAuthDirectory.findByEmail?.(email);
+            ${verify ? `if (created) {
+              await sendSignedMail(email, "Verify your email", "/api/v1/auth/verify-email", { id: String(created.id) });
+            }` : ""}
+            return jsonResponse({ ok: true }, { status: 201 });
+          })),
+        },` : "";
   const jwtLogin = authUsesJwt(layers.auth) ? `
         "/api/auth/token": {
           POST: kernel.wrap("api", withErrorHandling(async (request) => {
@@ -957,7 +853,8 @@ function renderAuthModule(layers) {
             const token = signJwt({
               sub: user.id,
               role: user.role,
-              abilities: user.role === "admin" ? ["profile:read", "reports:export"] : ["profile:read"],
+              abilities: user.role === "admin" ? ["profile:read", "reports:export"] : ["profile:read"],${verify ? `
+              emailVerifiedAt: user.emailVerifiedAt ?? null,` : ""}
             });
             return jsonResponse({
               token,
@@ -966,156 +863,928 @@ function renderAuthModule(layers) {
             });
           })),
         },` : "";
-  const apiUser = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `
+  const apiUser = jsonApi ? `
         "/api/user": {
           GET: kernel.wrapApi(async (request) => {
             const user = await dependencies.container.resolve<AuthManager>(CORE_AUTH_TOKEN).requireUser(request);
             return jsonResponse({ id: user.id, role: user.role ?? "member" });
           }),
         },` : "";
-  const routesBlock = apiLogin || jwtLogin || apiUser ? `
+  const jsonPassword = jsonApi ? `
+        "/api/v1/auth/forgot-password": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { email?: string };
+            const email = (body.email ?? "").trim().toLowerCase();
+            const user = await starterAuthDirectory.findByEmail?.(email);
+            if (user) {
+              await sendSignedMail(email, "Reset your password", "/api/v1/auth/reset-password", { email });
+            }
+            return jsonResponse({ ok: true });
+          })),
+        },
+        "/api/v1/auth/reset-password": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            assertValidSignature(request);
+            const body = (await request.json()) as { password?: string };
+            const email = new URL(request.url).searchParams.get("email") ?? "";
+            if (!email || !(body.password && body.password.length >= 8)) {
+              return jsonResponse({ error: "Invalid reset payload." }, { status: 422 });
+            }
+            await getSql().unsafe(
+              "UPDATE users SET password = ${passwordPh} WHERE email = ${emailPh}",
+              [await hashPassword(body.password), email],
+            );
+            return jsonResponse({ ok: true });
+          })),
+        },` : "";
+  const jsonVerify = jsonApi && verify ? `
+        "/api/v1/auth/verify-email": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            assertValidSignature(request);
+            const id = Number.parseInt(new URL(request.url).searchParams.get("id") ?? "", 10);
+            if (!Number.isInteger(id) || id <= 0) {
+              return jsonResponse({ error: "Invalid verification link." }, { status: 422 });
+            }
+            await getSql().unsafe(
+              "UPDATE users SET email_verified_at = ${verifiedPh} WHERE id = ${idPh}",
+              [new Date().toISOString(), id],
+            );
+            return jsonResponse({ ok: true });
+          })),
+        },` : "";
+  const apiRoutes = jsonApi ? `
     routes({ kernel, dependencies }) {
-      return {${apiLogin}${jwtLogin}${apiUser}
+      return {${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
       };
     },` : "";
-  const imports = [];
-  if (authUsesToken(layers.auth)) {
-    imports.push(`import { randomBytes } from "node:crypto";`);
+  const mfaLoginBranch = mfa ? `if (user.mfa_enabled) {
+                const pending = redirectTo("/login/mfa");
+                pending.headers.append("set-cookie", pendingMfaSetCookie(user.id));
+                return pending;
+              }` : "";
+  const verifyRegisterBranch = verify ? `await sendSignedMail(email, "Verify your email", "/email/verify", { id: String(insertedId) });
+              return flashResponse(
+                await auth.signInRedirect(sessionUser({ id: insertedId, name, email, role: "member" }), "/email/verify"),
+                { level: "info", message: "Check your email for a verification link." },
+              );` : `return auth.signInRedirect(sessionUser({ id: insertedId, name, email, role: "member" }), "/");`;
+  const cookieRoutes = cookie ? `
+    webRoutes({ kernel, dependencies }) {
+      const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+      return {
+        "/login": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/login.eta", { layout: { title: "Sign in" }, errors: {}, email: "", password: "" }, request),
+          ),
+          POST: wrapWebLogin(
+            kernel,
+            async (request) => {
+              const { fields } = await parseFormBody(request);
+              const email = (fields.email ?? "").trim().toLowerCase();
+              const password = fields.password ?? "";
+              const user = await starterAuthDirectory.findByEmail?.(email);
+              if (!user?.password || !(await verifyPassword(password, user.password))) {
+                return renderPage(
+                  "auth/login.eta",
+                  { layout: { title: "Sign in" }, errors: { email: "These credentials do not match our records." }, email, password: "" },
+                  request,
+                );
+              }
+              ${mfaLoginBranch}
+              return auth.signInRedirect(sessionUser(user), "/");
+            },
+            async (request) =>
+              renderPage(
+                "auth/login.eta",
+                { layout: { title: "Sign in" }, errors: { email: "Too many login attempts. Try again shortly." }, email: "", password: "" },
+                request,
+                429,
+              ),
+          ),
+        },
+        "/register": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/register.eta", { layout: { title: "Create account" }, errors: {}, name: "", email: "", password: "" }, request),
+          ),
+          POST: wrapWebRegister(
+            kernel,
+            async (request) => {
+              const { fields } = await parseFormBody(request);
+              const name = (fields.name ?? "").trim();
+              const email = (fields.email ?? "").trim().toLowerCase();
+              const password = fields.password ?? "";
+              const errors: Record<string, string> = {};
+              if (!name) {
+                errors.name = "Name is required.";
+              }
+              if (!email) {
+                errors.email = "Email is required.";
+              }
+              if (password.length < 8) {
+                errors.password = "Use at least 8 characters.";
+              }
+              if (email && (await starterAuthDirectory.findByEmail?.(email))) {
+                errors.email = "Email is already registered.";
+              }
+              if (Object.keys(errors).length > 0) {
+                return renderPage(
+                  "auth/register.eta",
+                  { layout: { title: "Create account" }, errors, name, email, password: "" },
+                  request,
+                );
+              }
+              const hashed = await hashPassword(password);
+              await getSql().unsafe(
+                "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+                [name, email, hashed${insertTail}],
+              );
+              const created = await starterAuthDirectory.findByEmail?.(email);
+              const insertedId = created?.id ?? 0;
+              ${verifyRegisterBranch}
+            },
+            async (request) =>
+              renderPage(
+                "auth/register.eta",
+                { layout: { title: "Create account" }, errors: { form: "Too many registration attempts. Try again shortly." }, name: "", email: "", password: "" },
+                request,
+                429,
+              ),
+          ),
+        },
+        "/forgot-password": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/forgot-password.eta", { layout: { title: "Forgot password" }, errors: {}, email: "" }, request),
+          ),
+          POST: kernel.wrapWeb(async (request) => {
+            const { fields } = await parseFormBody(request);
+            const email = (fields.email ?? "").trim().toLowerCase();
+            const user = await starterAuthDirectory.findByEmail?.(email);
+            if (user) {
+              await sendSignedMail(email, "Reset your password", "/reset-password", { email });
+            }
+            return flashResponse(redirectTo("/forgot-password"), {
+              level: "success",
+              message: "If that account exists, a reset link is on its way.",
+            });
+          }),
+        },
+        "/reset-password": {
+          GET: kernel.wrapWebGuest(async (request) => {
+            assertValidSignature(request);
+            const email = new URL(request.url).searchParams.get("email") ?? "";
+            return renderPage(
+              "auth/reset-password.eta",
+              { layout: { title: "Reset password" }, errors: {}, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
+              request,
+            );
+          }),
+          POST: kernel.wrapWeb(async (request) => {
+            assertValidSignature(request);
+            const { fields } = await parseFormBody(request);
+            const email = new URL(request.url).searchParams.get("email") ?? fields.email ?? "";
+            const password = fields.password ?? "";
+            if (!email || password.length < 8) {
+              return renderPage(
+                "auth/reset-password.eta",
+                { layout: { title: "Reset password" }, errors: { password: "Use at least 8 characters." }, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
+                request,
+              );
+            }
+            await getSql().unsafe(
+              "UPDATE users SET password = ${passwordPh} WHERE email = ${emailPh}",
+              [await hashPassword(password), email],
+            );
+            return flashResponse(redirectTo("/login"), { level: "success", message: "Password updated. Sign in." });
+          }),
+        },
+        "/logout": {
+          POST: kernel.wrapWebAuthenticatedAllowUnverified((request) => auth.signOutRedirect(request, "/")),
+        },${verify ? `
+        "/email/verify": {
+          GET: kernel.wrapWeb(async (request) => {
+            const url = new URL(request.url);
+            if (url.searchParams.get("signature")) {
+              assertValidSignature(request);
+              const id = Number.parseInt(url.searchParams.get("id") ?? "", 10);
+              if (Number.isInteger(id) && id > 0) {
+                await getSql().unsafe(
+                  "UPDATE users SET email_verified_at = ${verifiedPh} WHERE id = ${idPh}",
+                  [new Date().toISOString(), id],
+                );
+                const record = await starterAuthDirectory.findByIdOrThrow(id);
+                return flashResponse(
+                  await auth.signInRedirect(sessionUser(record), "/"),
+                  { level: "success", message: "Email verified." },
+                );
+              }
+            }
+            return renderPage("auth/verify-email.eta", { layout: { title: "Verify email" } }, request);
+          }),
+        },
+        "/email/verification-notification": {
+          POST: kernel.wrapWebAuthenticatedAllowUnverified(async (request) => {
+            const user = await auth.user(request);
+            if (user) {
+              const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
+              await sendSignedMail(record.email ?? "", "Verify your email", "/email/verify", { id: String(record.id) });
+            }
+            return flashResponse(redirectTo("/email/verify"), { level: "info", message: "Verification link sent." });
+          }),
+        },` : ""}${mfa ? `
+        "/login/mfa": {
+          GET: kernel.wrapWebGuest(async (request) => {
+            if (!readPendingMfaUserId(request)) {
+              return redirectTo("/login");
+            }
+            return renderPage("auth/mfa-challenge.eta", { layout: { title: "MFA" }, errors: {}, code: "" }, request);
+          }),
+          POST: kernel.wrapWeb(async (request) => {
+            const pendingId = readPendingMfaUserId(request);
+            if (!pendingId) {
+              return redirectTo("/login");
+            }
+            const { fields } = await parseFormBody(request);
+            const submitted = (fields.code ?? "").trim();
+            const record = await starterAuthDirectory.findByIdOrThrow(pendingId);
+            const secret = revealMfaSecret(record.mfa_secret ?? null);
+            const hashedCodes: string[] = record.mfa_recovery_codes
+              ? (JSON.parse(record.mfa_recovery_codes) as string[])
+              : [];
+            const totpOk = secret ? verifyTotp(secret, submitted) : false;
+            const recoveryOk = hashedCodes.some((hash) => recoveryCodeMatches(submitted, hash));
+            if (!totpOk && !recoveryOk) {
+              return renderPage(
+                "auth/mfa-challenge.eta",
+                { layout: { title: "MFA" }, errors: { code: "That code is not valid." }, code: "" },
+                request,
+              );
+            }
+            if (recoveryOk) {
+              const remaining = hashedCodes.filter((hash) => !recoveryCodeMatches(submitted, hash));
+              await getSql().unsafe(
+                "UPDATE users SET mfa_recovery_codes = ${passwordPh} WHERE id = ${idPh}",
+                [JSON.stringify(remaining), pendingId],
+              );
+            }
+            const signed = await auth.signInRedirect(sessionUser(record), "/");
+            signed.headers.append("set-cookie", pendingMfaClearCookie());
+            return signed;
+          }),
+        },
+        "/account/mfa": {
+          GET: kernel.wrapWebAuthenticated(async (request) => {
+            const secret = generateTotpSecret();
+            const user = await auth.user(request);
+            const record = user ? await starterAuthDirectory.findByIdOrThrow(Number(user.id)) : null;
+            const otpauth = buildOtpauthUrl({
+              secret,
+              account: record?.email ?? "user",
+              issuer: process.env.APP_NAME ?? "Strata",
+            });
+            return renderPage(
+              "auth/mfa-setup.eta",
+              { layout: { title: "MFA" }, errors: {}, code: "", secret, otpauth },
+              request,
+            );
+          }),
+          POST: kernel.wrapWebAuthenticated(async (request) => {
+            const user = await auth.user(request);
+            if (!user) {
+              return redirectTo("/login");
+            }
+            const { fields } = await parseFormBody(request);
+            const secret = (fields.secret ?? "").trim();
+            const submitted = (fields.code ?? "").trim();
+            if (!secret || !verifyTotp(secret, submitted)) {
+              return renderPage(
+                "auth/mfa-setup.eta",
+                {
+                  layout: { title: "MFA" },
+                  errors: { code: "Could not confirm that code." },
+                  code: "",
+                  secret,
+                  otpauth: buildOtpauthUrl({ secret, account: "user", issuer: process.env.APP_NAME ?? "Strata" }),
+                },
+                request,
+              );
+            }
+            const recoveryCodes = generateRecoveryCodes();
+            const stored = protectMfaSecret(secret);
+            await getSql().unsafe(
+              "UPDATE users SET mfa_secret = ${mfaUpdatePh.split(", ")[0]}, mfa_enabled = ${mfaUpdatePh.split(", ")[1]}, mfa_recovery_codes = ${mfaUpdatePh.split(", ")[2]} WHERE id = ${mfaIdPh}",
+              [stored, ${sqlTrue(layers)}, JSON.stringify(recoveryCodes.map((item) => hashRecoveryCode(item))), Number(user.id)],
+            );
+            return renderPage(
+              "auth/mfa-setup.eta",
+              {
+                layout: { title: "MFA" },
+                errors: {},
+                code: "",
+                secret,
+                otpauth: buildOtpauthUrl({ secret, account: "user", issuer: process.env.APP_NAME ?? "Strata" }),
+                recoveryCodes,
+              },
+              request,
+            );
+          }),
+        },` : ""}
+      };
+    },` : "";
+  return `${imports.join(`
+`)}
+${helpers}
+const authModule: AppModule = {
+  name: "auth",
+  order: 2,${apiRoutes}${cookieRoutes}
+};
+
+export default authModule;
+`;
+}
+function renderSiteModule(_layers) {
+  return `import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { withErrorHandling } from "@getstrata/core/http/response";
+import { pingDatabase } from "../../bootstrap/database.ts";
+import { plainText, renderPage } from "../../lib/view.ts";
+
+const siteModule: AppModule = {
+  name: "site",
+  order: 1,
+  routes({ kernel }) {
+    return {
+      "/health": kernel.wrap("api", withErrorHandling(async () => {
+        const dbOk = await pingDatabase();
+        return plainText(dbOk ? "ok" : "degraded");
+      })),
+    };
+  },
+  webRoutes({ kernel }) {
+    return {
+      "/": kernel.wrapWeb(async (request) =>
+        renderPage(
+          "home.eta",
+          {
+            layout: {
+              title: "Welcome",
+              description: "Welcome to your Strata app. Restyle views/home.eta and public/assets/site.css.",
+            },
+          },
+          request,
+        ),
+      ),
+    };
+  },
+};
+
+export default siteModule;
+`;
+}
+// src/renderAuthViews.ts
+function renderSiteCss() {
+  return `:root {
+  color-scheme: light;
+  --bg: #f4f1ea;
+  --ink: #1c1917;
+  --muted: #57534e;
+  --card: #fffdf8;
+  --line: #e7e0d4;
+  --accent: #1d4e4f;
+  --accent-ink: #f8faf8;
+  --danger: #9f1239;
+  --ok: #166534;
+  font-family: "Iowan Old Style", "Palatino Linotype", Palatino, serif;
+  line-height: 1.5;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  min-height: 100vh;
+  background: var(--bg);
+  color: var(--ink);
+}
+
+.site-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  padding: 1rem 1.5rem;
+  border-bottom: 1px solid var(--line);
+  background: var(--card);
+}
+
+.brand {
+  font-weight: 700;
+  text-decoration: none;
+  color: inherit;
+  letter-spacing: 0.02em;
+}
+
+.site-header nav {
+  display: flex;
+  gap: 0.75rem;
+  align-items: center;
+  font-size: 0.95rem;
+}
+
+.site-header a { color: inherit; }
+
+.site-header form { display: inline; }
+
+main {
+  padding: 2rem 1.5rem 3rem;
+}
+
+.section, .auth-card {
+  max-width: 36rem;
+  margin: 0 auto;
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: 1rem;
+  padding: 1.5rem 1.5rem 1.75rem;
+}
+
+.hero {
+  max-width: 40rem;
+}
+
+.section h1, .auth-card h1, .hero h1 {
+  margin: 0 0 0.5rem;
+  font-size: 1.8rem;
+}
+
+.lede, .muted { color: var(--muted); }
+
+.actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem;
+  margin-top: 1.25rem;
+}
+
+label {
+  display: block;
+  margin: 0.85rem 0;
+  font-size: 0.95rem;
+}
+
+input[type="email"],
+input[type="password"],
+input[type="text"] {
+  display: block;
+  width: 100%;
+  margin-top: 0.35rem;
+  padding: 0.55rem 0.7rem;
+  border: 1px solid var(--line);
+  border-radius: 0.5rem;
+  background: #fff;
+  font: inherit;
+}
+
+button, .button {
+  display: inline-block;
+  border: 0;
+  border-radius: 999px;
+  padding: 0.55rem 1rem;
+  background: var(--accent);
+  color: var(--accent-ink);
+  font: inherit;
+  text-decoration: none;
+  cursor: pointer;
+}
+
+.button-secondary {
+  background: transparent;
+  color: var(--ink);
+  border: 1px solid var(--line);
+}
+
+.error { color: var(--danger); }
+.ok, .flash-success { color: var(--ok); }
+.flash-error { color: var(--danger); }
+.flash {
+  margin: 0 0 1rem;
+  padding: 0.6rem 0.8rem;
+  border-radius: 0.5rem;
+  border: 1px solid var(--line);
+}
+
+.auth-links {
+  margin-top: 1rem;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem 1rem;
+}
+
+code { font-size: 0.9em; }
+`;
+}
+function renderLayout(layers, projectName) {
+  const kit = htmlAuthKit(layers.auth);
+  const guestNav = kit ? `<a href="/login">Sign in</a>
+        <a href="/register">Create account</a>` : "";
+  const userNav = kit ? `<% if (it.currentUser) { %>
+        <span class="muted"><%= it.currentUser.email %></span>
+        ${layers.extras.mfa ? '<a href="/account/mfa">MFA</a>' : ""}
+        <form method="post" action="/logout">
+          <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+          <button class="button-secondary" type="submit">Sign out</button>
+        </form>
+      <% } else { %>
+        ${guestNav}
+      <% } %>` : "";
+  return `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title><%= it.layout.title %> \xB7 ${projectName}</title>
+    <% if (it.layout.description) { %>
+    <meta name="description" content="<%= it.layout.description %>" />
+    <% } %>
+    <link rel="stylesheet" href="/assets/site.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">${projectName}</a>
+      <nav>
+        ${userNav}
+      </nav>
+    </header>
+    <main>
+      <% if (it.flash && it.flash.message) { %>
+      <p class="flash flash-<%= it.flash.level %>"><%= it.flash.message %></p>
+      <% } %>
+      <%~ it.body %>
+    </main>
+  </body>
+</html>
+`;
+}
+function renderHomeView(projectName, layers) {
+  const kit = htmlAuthKit(layers.auth);
+  const tokenHint = authUsesToken(layers.auth) ? '<p class="muted">API token: <code>POST /api/v1/auth/login</code> with email and password.</p>' : "";
+  const jwtHint = authUsesJwt(layers.auth) ? '<p class="muted">JWT: <code>POST /api/auth/token</code> with email and password.</p>' : "";
+  const guest = kit ? `<% if (!it.currentUser) { %>
+  <p class="lede">Sign in or create an account. Edit <code>views/home.eta</code> and <code>public/assets/site.css</code> to restyle this page.</p>
+  <div class="actions">
+    <a class="button" href="/register">Create account</a>
+    <a class="button button-secondary" href="/login">Sign in</a>
+  </div>
+  <p class="muted">Seeded demo: <code>demo@example.com</code> / <code>password</code>.</p>
+<% } else { %>
+  <p class="lede">You are signed in as <strong><%= it.currentUser.email %></strong>.</p>
+  <p>Add routes in <code>src/modules</code>. This homepage is yours to restyle.</p>
+<% } %>` : `<p class="lede">Edit <code>views/home.eta</code> and <code>public/assets/site.css</code> to restyle this page.</p>
+  <p class="muted">Auth stack: <code>${layers.auth}</code>.</p>`;
+  const extras = [tokenHint, jwtHint].filter(Boolean).join(`
+  `);
+  return `<section class="section hero">
+  <h1>Welcome to ${projectName}</h1>
+  ${guest}
+  <p>Health check: <a href="/health"><code>/health</code></a>.</p>${extras ? `
+  ${extras}` : ""}
+</section>
+`;
+}
+function renderFormView(title, fields, submit, links) {
+  return `<section class="auth-card">
+  <h1>${title}</h1>
+  <% if (it.status) { %>
+  <p class="ok"><%= it.status %></p>
+  <% } %>
+  <% if (it.errors && it.errors.form) { %>
+  <p class="error"><%= it.errors.form %></p>
+  <% } %>
+  <form method="post" action="<%= it.action || "" %>">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    ${fields}
+    <div class="actions">
+      <button type="submit">${submit}</button>
+    </div>
+  </form>
+  <div class="auth-links">
+    ${links}
+  </div>
+</section>
+`;
+}
+function textField(name, label, type, extra = "") {
+  return `<label>
+      ${label}
+      <% if (it.errors && it.errors.${name}) { %><span class="error"><%= it.errors.${name} %></span><% } %>
+      <input type="${type}" name="${name}" value="<%= it.${name} || "" %>" ${extra} />
+    </label>`;
+}
+function renderLoginView() {
+  return renderFormView("Sign in", `${textField("email", "Email", "email", 'required autocomplete="username"')}
+    ${textField("password", "Password", "password", 'required autocomplete="current-password"')}`, "Sign in", `<a href="/register">Create account</a>
+    <a href="/forgot-password">Forgot password</a>`).replace('action="<%= it.action || "" %>"', 'action="/login"');
+}
+function renderRegisterView() {
+  return renderFormView("Create account", `${textField("name", "Name", "text", "required")}
+    ${textField("email", "Email", "email", 'required autocomplete="email"')}
+    ${textField("password", "Password", "password", 'required minlength="8" autocomplete="new-password"')}`, "Create account", `<a href="/login">Already have an account</a>`).replace('action="<%= it.action || "" %>"', 'action="/register"');
+}
+function renderForgotPasswordView() {
+  return renderFormView("Forgot password", textField("email", "Email", "email", "required"), "Send reset link", `<a href="/login">Back to sign in</a>`).replace('action="<%= it.action || "" %>"', 'action="/forgot-password"');
+}
+function renderResetPasswordView() {
+  return renderFormView("Set a new password", `${textField("password", "New password", "password", 'required minlength="8" autocomplete="new-password"')}
+    <input type="hidden" name="email" value="<%= it.email || "" %>" />`, "Update password", `<a href="/login">Back to sign in</a>`).replace('action="<%= it.action || "" %>"', 'action="<%= it.action %>"');
+}
+function renderVerifyEmailView() {
+  return `<section class="auth-card">
+  <h1>Verify your email</h1>
+  <p>We sent a signed link to your inbox (or the mail log when <code>MAIL_DRIVER=log</code>).</p>
+  <form method="post" action="/email/verification-notification">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    <button type="submit">Resend link</button>
+  </form>
+</section>
+`;
+}
+function renderMfaChallengeView() {
+  return renderFormView("Two-factor code", `${textField("code", "Authenticator or recovery code", "text", 'required autocomplete="one-time-code"')}`, "Continue", `<a href="/login">Cancel</a>`).replace('action="<%= it.action || "" %>"', 'action="/login/mfa"');
+}
+function renderMfaSetupView() {
+  return `<section class="auth-card">
+  <h1>Authenticator app</h1>
+  <p class="muted">Scan this otpauth URL in your authenticator, then confirm a code. Restyle this page in <code>views/auth/mfa-setup.eta</code>.</p>
+  <p><code><%= it.otpauth %></code></p>
+  <form method="post" action="/account/mfa">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    <input type="hidden" name="secret" value="<%= it.secret %>" />
+    ${textField("code", "Confirmation code", "text", "required")}
+    <div class="actions"><button type="submit">Enable MFA</button></div>
+  </form>
+  <% if (it.recoveryCodes) { %>
+  <h2>Recovery codes</h2>
+  <p>Store these once. They will not be shown again.</p>
+  <ul>
+    <% for (const code of it.recoveryCodes) { %>
+    <li><code><%= code %></code></li>
+    <% } %>
+  </ul>
+  <% } %>
+</section>
+`;
+}
+
+// src/renderAuth.ts
+function renderAuthDirectory(layers) {
+  if (!authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const tokenLookup = authUsesToken(layers.auth) ? `
+  async resolveUserFromToken(token: string) {
+    if (!token || token.split(".").length === 3) {
+      return null;
+    }
+    const hashed = hashApiToken(token);
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        user_id: number;
+        abilities: string;
+        expires_at: Date | string | null;
+        role?: string;
+        is_admin?: number | boolean;
+        email_verified_at?: Date | string | null;
+      }>
+    >(
+      \`SELECT t.id, t.user_id, t.abilities, t.expires_at, u.is_admin, u.email_verified_at
+       FROM api_tokens t INNER JOIN users u ON u.id = t.user_id
+       WHERE t.token_hash = ?\`,
+      [hashed],
+    );
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    if (row.expires_at && new Date(row.expires_at).getTime() <= Date.now()) {
+      return null;
+    }
+    let abilities: string[] = [];
+    try {
+      abilities = JSON.parse(String(row.abilities ?? "[]")) as string[];
+    } catch {
+      abilities = ["profile:read"];
+    }
+    return {
+      id: Number(row.user_id),
+      role: row.is_admin ? "admin" : "member",
+      abilities,
+      tokenId: Number(row.id),
+      emailVerifiedAt: row.email_verified_at ?? null,
+    };
+  },` : `
+  async resolveUserFromToken() {
+    return null;
+  },`;
+  const placeholder = layers.database === "postgres" ? "$1" : "?";
+  const hashImport = authUsesToken(layers.auth) ? `import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+` : "";
+  const mfaSelect = layers.extras.mfa ? ", mfa_enabled, mfa_secret, mfa_recovery_codes" : "";
+  const mfaReturn = layers.extras.mfa ? `
+      mfa_enabled: row.mfa_enabled === true || row.mfa_enabled === 1,
+      mfa_secret: row.mfa_secret ?? null,
+      mfa_recovery_codes: row.mfa_recovery_codes ?? null,` : "";
+  return `import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { verifyPassword } from "@getstrata/core/auth/password";
+${hashImport}import type { AuthUserDirectory } from "@getstrata/core/contracts/authUserDirectory";
+import { getSql } from "./database.ts";
+
+function mapRole(isAdmin: unknown): string {
+  return isAdmin === true || isAdmin === 1 || isAdmin === "1" ? "admin" : "member";
+}
+
+export const starterAuthDirectory: AuthUserDirectory = {
+${tokenLookup.replace("WHERE t.token_hash = ?", `WHERE t.token_hash = ${placeholder}`)}
+
+  async findByIdOrThrow(id: number) {
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        name: string;
+        email: string;
+        is_admin: number | boolean;
+        email_verified_at: Date | string | null;
+        password: string;
+        mfa_enabled?: number | boolean;
+        mfa_secret?: string | null;
+        mfa_recovery_codes?: string | null;
+      }>
+    >(\`SELECT id, name, email, is_admin, email_verified_at, password${mfaSelect} FROM users WHERE id = ${placeholder}\`, [id]);
+    const row = rows[0];
+    if (!row) {
+      throw new Error(\`User \${id} not found.\`);
+    }
+    return {
+      id: Number(row.id),
+      name: row.name,
+      email: row.email,
+      role: mapRole(row.is_admin),
+      email_verified_at: row.email_verified_at ?? null,
+      password: row.password,${mfaReturn}
+    };
+  },
+
+  async findByEmail(email: string) {
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        name: string;
+        email: string;
+        is_admin: number | boolean;
+        email_verified_at: Date | string | null;
+        password: string;
+        mfa_enabled?: number | boolean;
+        mfa_secret?: string | null;
+        mfa_recovery_codes?: string | null;
+      }>
+    >(
+      \`SELECT id, name, email, is_admin, email_verified_at, password${mfaSelect} FROM users WHERE email = ${placeholder}\`,
+      [email.trim().toLowerCase()],
+    );
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    return {
+      id: Number(row.id),
+      name: row.name,
+      email: row.email,
+      role: mapRole(row.is_admin),
+      email_verified_at: row.email_verified_at ?? null,
+      password: row.password,${mfaReturn}
+    };
+  },
+
+  async verifyCredentials(email: string, password: string): Promise<AuthUser | null> {
+    const user = await this.findByEmail(email);
+    if (!user?.password || !(await verifyPassword(password, user.password))) {
+      return null;
+    }
+    return {
+      id: user.id,
+      role: user.role,
+      emailVerifiedAt: user.email_verified_at ?? null,
+    };
+  },
+};
+`;
+}
+function renderAuthProvider(layers) {
+  if (layers.auth === "headers") {
+    return `import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";
+import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { currentAuthUser } from "@getstrata/core/auth/authContext";
+import type { ServiceProvider } from "@getstrata/core/contracts/di";
+
+class StarterAuthManager {
+  async resolve(request?: Request): Promise<AuthUser | null> {
+    if (process.env.AUTH_DEV_HEADERS === "false") {
+      return request ? null : currentAuthUser();
+    }
+    if (request) {
+      const userId = request.headers.get("x-authenticated-user-id");
+      if (!userId) {
+        return null;
+      }
+      const role = request.headers.get("x-authenticated-user-role");
+      return {
+        id: userId,
+        ...(role ? { role } : {}),
+      };
+    }
+    return currentAuthUser();
+  }
+
+  user(request?: Request) {
+    return this.resolve(request);
+  }
+
+  async check(request: Request) {
+    return (await this.user(request)) !== null;
+  }
+}
+
+const authProvider: ServiceProvider = {
+  name: "starter.auth",
+  register({ container }) {
+    container.set(CORE_AUTH_TOKEN, new StarterAuthManager());
+  },
+};
+
+export default authProvider;
+`;
   }
-  imports.push(`import type { AppModule } from "@getstrata/bootstrap/contracts";`);
-  imports.push(`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`);
+  const cookieBlock = authUsesCookie(layers.auth) ? `    const auth = createCookieSessionAuthManager({
+      secret: process.env.SESSION_SECRET?.trim() || "dev-session-secret-change-me-please-32ch",
+      cookieName: "strata_session",
+      mapUser: (user) => ({
+        id: user.id,
+        role: user.is_admin ? "admin" : "member",
+        ...(user.email_verified_at !== undefined ? { emailVerifiedAt: user.email_verified_at } : {}),
+      }),
+    });` : `    const fallback = ${authUsesToken(layers.auth) ? "new DatabaseTokenGuard(container)" : "new JwtGuard()"};
+    const auth = new AuthManager(fallback);`;
+  const tokenRegs = authUsesToken(layers.auth) ? `    const apiGuard = new DatabaseTokenGuard(container);
+    auth.registerGuard("api", apiGuard);
+    auth.registerGuard("access_token", apiGuard);
+    auth.registerGuard("token", apiGuard);` : "";
+  const jwtReg = authUsesJwt(layers.auth) ? `    auth.registerGuard("jwt", new JwtGuard());` : "";
+  const basicReg = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `    auth.registerGuard("basic", new BasicAuthGuard(container));` : "";
+  const ability = authUsesToken(layers.auth) ? `    container.set(CORE_ABILITY_CHECKER_TOKEN, createTokenAbilityChecker());` : "";
+  const imports = [`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`];
   if (authUsesCookie(layers.auth)) {
-    imports.push(`import { parseFormBody } from "@getstrata/bootstrap/web/forms";`);
-    imports.push(`import { wrapWebLogin } from "@getstrata/bootstrap/web/routing";`);
-    imports.push(`import type { CookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+    imports.push(`import { createCookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
   }
   if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
+    imports.push(`import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";`);
+  }
+  if (!authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
+    imports.push(`import { AuthManager, DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
+  } else if (!authUsesCookie(layers.auth) && authUsesJwt(layers.auth)) {
     imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
+  } else if (authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
+    imports.push(`import { DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
   }
   if (authUsesJwt(layers.auth)) {
-    imports.push(`import { jwtTtlSeconds, signJwt } from "@getstrata/core/auth/jwt";`);
-  }
-  if (authUsesCookie(layers.auth)) {
-    imports.push(`import { verifyPassword } from "@getstrata/core/auth/password";`);
+    imports.push(`import { JwtGuard } from "@getstrata/core/auth/jwtGuard";`);
   }
   if (authUsesToken(layers.auth)) {
-    imports.push(`import { hashApiToken } from "@getstrata/core/auth/tokenHash";`);
-  }
-  if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
-    imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
+    imports.push(`import { createTokenAbilityChecker } from "@getstrata/core/auth/tokenAbilityChecker";`);
   }
-  imports.push(`import { starterAuthDirectory } from "../../bootstrap/authDirectory.ts";`);
+  imports.push(`import type { ServiceProvider } from "@getstrata/core/contracts/di";`);
+  const tokenImports = ["CORE_AUTH_USER_DIRECTORY_TOKEN"];
   if (authUsesToken(layers.auth)) {
-    imports.push(`import { getSql } from "../../bootstrap/database.ts";`);
-  }
-  if (authUsesCookie(layers.auth)) {
-    imports.push(`import { renderPage } from "../../lib/view.ts";`);
+    tokenImports.unshift("CORE_ABILITY_CHECKER_TOKEN");
   }
+  imports.push(`import {
+  ${tokenImports.join(`,
+  `)},
+} from "@getstrata/core/contracts/serviceTokens";`);
+  imports.push(`import { starterAuthDirectory } from "../authDirectory.ts";`);
   return `${imports.join(`
 `)}
 
-const authModule: AppModule = {
-  name: "auth",
-  order: 2,${routesBlock}${cookieRoutes}
-};
-
-export default authModule;
-`;
-}
-function renderSiteModule(layers) {
-  const loginHint = authUsesCookie(layers.auth) && (layers.frontend === "server-htmx" || layers.frontend === "hybrid") ? " Sign in at /login." : "";
-  return `import type { AppModule } from "@getstrata/bootstrap/contracts";
-import { withErrorHandling } from "@getstrata/core/http/response";
-import { pingDatabase } from "../../bootstrap/database.ts";
-import { plainText, renderPage } from "../../lib/view.ts";
-
-const siteModule: AppModule = {
-  name: "site",
-  order: 1,
-  routes({ kernel }) {
-    return {
-      "/health": kernel.wrap("api", withErrorHandling(async () => {
-        const dbOk = await pingDatabase();
-        return plainText(dbOk ? "ok" : "degraded");
-      })),
-    };
-  },
-  webRoutes({ kernel }) {
-    return {
-      "/": kernel.wrapWeb(async (request) =>
-        renderPage(
-          "home.eta",
-          {
-            layout: {
-              title: "Home",
-              description: "A new Strata application.${loginHint}",
-            },
-          },
-          request,
-        ),
-      ),
-    };
+const authProvider: ServiceProvider = {
+  name: "starter.auth",
+  register({ container }) {
+    container.set(CORE_AUTH_USER_DIRECTORY_TOKEN, starterAuthDirectory);
+${cookieBlock}
+${tokenRegs}
+${jwtReg}
+${basicReg}
+${ability}
+    container.set(CORE_AUTH_TOKEN, auth);
   },
 };
 
-export default siteModule;
-`;
-}
-function renderLoginView() {
-  return `<section class="section">
-  <h1>Sign in</h1>
-  <p>Seeded accounts use password <code>password</code>.</p>
-  <% if (it.errors && it.errors.email) { %>
-  <p class="error"><%= it.errors.email %></p>
-  <% } %>
-  <form method="post" action="/login">
-    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
-    <label>
-      Email
-      <input type="email" name="email" value="<%= it.email || "demo@example.com" %>" required />
-    </label>
-    <label>
-      Password
-      <input type="password" name="password" value="password" required />
-    </label>
-    <button type="submit">Sign in</button>
-  </form>
-</section>
-`;
-}
-function renderLayout(layers, projectName) {
-  const cookie = authUsesCookie(layers.auth);
-  return `<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title><%= it.layout.title %> \xB7 ${projectName}</title>
-    <% if (it.layout.description) { %>
-    <meta name="description" content="<%= it.layout.description %>" />
-    <% } %>
-    <link rel="stylesheet" href="/assets/site.css" />
-  </head>
-  <body>
-    <header class="site-header">
-      <a class="brand" href="/">${projectName}</a>
-      <nav>
-        ${cookie ? '<a href="/login">Sign in</a>' : ""}
-      </nav>
-    </header>
-    <main><%~ it.body %></main>
-  </body>
-</html>
-`;
-}
-function renderHomeView(projectName, layers) {
-  const loginLine = authUsesCookie(layers.auth) ? '<p>HTML sign-in: <a href="/login">/login</a> (demo@example.com / password).</p>' : "";
-  return `<section class="section">
-  <h1>Welcome to ${projectName}</h1>
-  <p>Frontend <code>${layers.frontend}</code>, database <code>${layers.database}</code>, auth <code>${layers.auth}</code>.</p>
-  <p>Health check: <a href="/health"><code>/health</code></a>.</p>
-  ${loginLine}
-</section>
+export default authProvider;
 `;
 }
 
@@ -1187,6 +1856,7 @@ function renderEnvExample(projectName, layers) {
   if (layers.extras.scim) {
     lines.push("FEATURE_SCIM=true");
     lines.push("SCIM_BEARER_TOKEN=dev-scim-token-change-me");
+    lines.push("# SCIM_TENANT_TOKENS=1:token-a");
   } else {
     lines.push("# FEATURE_SCIM=false");
     lines.push("# SCIM_BEARER_TOKEN=");
@@ -1288,9 +1958,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^0.4.2",
+    "@getstrata/bootstrap": "^0.4.3",
     "@getstrata/cli": "^0.2.0",
-    "@getstrata/core": "^0.7.4"
+    "@getstrata/core": "^0.7.5"
   };
   if (options.layers?.database === "mysql") {
     coreDeps.mysql2 = "^3.24.3";
@@ -1419,9 +2089,17 @@ Seeded login (password \`password\`):
 ` : `
 Header auth is on for local use. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`). Production must set \`AUTH_DEV_HEADERS=false\`.
 `}${authUsesCookie(layers.auth) ? `
-HTML sign-in lives at \`/login\` (cookie session + CSRF when \`FRONTEND_MODE\` is \`server-htmx\` or \`hybrid\`).
+HTML auth kit (restyle \`views/\` and \`public/assets/site.css\`):
+
+- Welcome: \`/\`
+- Sign in: \`/login\`
+- Register: \`/register\`
+- Forgot password: \`/forgot-password\`
+- Reset password: signed \`/reset-password\` (mail log when \`MAIL_DRIVER=log\`)
+${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}
+Cookie name is \`strata_session\`. Forms send CSRF as \`_token\`.
 ` : ""}${authUsesToken(layers.auth) ? `
-Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Send \`Authorization: Bearer\`.
+Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Register: \`POST /api/v1/auth/register\`. Forgot/reset: \`POST /api/v1/auth/forgot-password\` and signed \`POST /api/v1/auth/reset-password\`. Send \`Authorization: Bearer\` after login.
 ` : ""}${authUsesJwt(layers.auth) ? `
 JWT mint: \`POST /api/auth/token\` with email and password. Short-lived. Not a portal session.
 ` : ""}
@@ -1651,7 +2329,9 @@ export async function closeDatabase() {
 function renderMigrateTs(layers) {
   const d = dialectFragments(layers.database);
   const statements = [];
-  if (layers.tenancy === "rls") {
+  const tenancyOn = usesTenantTable(layers.tenancy);
+  const mfaOn = layers.extras.mfa && authNeedsUsers(layers.auth);
+  if (tenancyOn) {
     statements.push(`CREATE TABLE IF NOT EXISTS tenant (
     id ${d.id},
     slug ${d.text} NOT NULL UNIQUE,
@@ -1665,14 +2345,18 @@ function renderMigrateTs(layers) {
     created_at ${d.timestamp}
   )`);
   if (authNeedsUsers(layers.auth)) {
-    const tenantColumn = layers.tenancy === "rls" ? `
+    const tenantColumn = tenancyOn ? `
     tenant_id INTEGER NOT NULL DEFAULT 1,` : "";
+    const mfaColumns = mfaOn ? `
+    mfa_secret ${d.text},
+    mfa_enabled ${d.bool},
+    mfa_recovery_codes ${d.text},` : "";
     statements.push(`CREATE TABLE IF NOT EXISTS users (
     id ${d.id},
     name ${d.text} NOT NULL,
     email ${d.text} NOT NULL UNIQUE,
     password ${d.text} NOT NULL,
-    is_admin ${d.bool},${tenantColumn}
+    is_admin ${d.bool},${tenantColumn}${mfaColumns}
     email_verified_at ${d.timestampNull},
     created_at ${d.timestamp}
   )`);
@@ -1701,18 +2385,22 @@ function renderMigrateTs(layers) {
   }
   const list = statements.map((sql) => `  \`${sql}\`,`).join(`
 `);
-  const ph = layers.database === "postgres";
-  const notePlaceholder = ph ? "$1" : "?";
-  const userPlaceholders = ph ? "$1, $2, $3, $4), ($5, $6, $7, $8" : "?, ?, ?, ?), (?, ?, ?, ?";
-  const adminFlag = ph ? "false, " : "0, ";
-  const adminTrue = ph ? "true" : "1";
-  const seedTenant = layers.tenancy === "rls" ? `
+  const ph2 = layers.database === "postgres";
+  const notePlaceholder = ph2 ? "$1" : "?";
+  const verifyOn = layers.extras.emailVerification && authNeedsUsers(layers.auth);
+  const userColumns = verifyOn ? "name, email, password, is_admin, email_verified_at" : "name, email, password, is_admin";
+  const userPlaceholders = verifyOn ? ph2 ? "$1, $2, $3, $4, $5), ($6, $7, $8, $9, $10" : "?, ?, ?, ?, ?), (?, ?, ?, ?, ?" : ph2 ? "$1, $2, $3, $4), ($5, $6, $7, $8" : "?, ?, ?, ?), (?, ?, ?, ?";
+  const adminFlag = ph2 ? "false" : "0";
+  const adminTrue = ph2 ? "true" : "1";
+  const verifiedNow = "new Date().toISOString()";
+  const userValues = verifyOn ? `["Demo User", "demo@example.com", password, ${adminFlag}, ${verifiedNow}, "Admin User", "admin@example.test", password, ${adminTrue}, ${verifiedNow}]` : `["Demo User", "demo@example.com", password, ${adminFlag}, "Admin User", "admin@example.test", password, ${adminTrue}]`;
+  const seedTenant = tenancyOn ? `
   const [{ count: tenantCount }] = await sql.unsafe<Array<{ count: string | number }>>(
     "SELECT COUNT(*) AS count FROM tenant",
   );
   if (Number(tenantCount) === 0) {
     await sql.unsafe(
-      "INSERT INTO tenant (slug, plan, region) VALUES (${ph ? "$1, $2, $3" : "?, ?, ?"})",
+      "INSERT INTO tenant (slug, plan, region) VALUES (${ph2 ? "$1, $2, $3" : "?, ?, ?"})",
       ["default", "enterprise", "eu"],
     );
   }` : "";
@@ -1723,8 +2411,8 @@ function renderMigrateTs(layers) {
   if (Number(userCount) === 0) {
     const password = await hashPassword("password");
     await sql.unsafe(
-      "INSERT INTO users (name, email, password, is_admin) VALUES (${userPlaceholders})",
-      ["Demo User", "demo@example.com", password, ${adminFlag}"Admin User", "admin@example.test", password, ${adminTrue}],
+      "INSERT INTO users (${userColumns}) VALUES (${userPlaceholders})",
+      ${userValues},
     );
   }` : "";
   const hashImport = authNeedsUsers(layers.auth) ? `import { hashPassword } from "@getstrata/core/auth/password";
@@ -1736,13 +2424,6 @@ const migrations = [
 ${list}
 ];
 
-export async function migrate() {
-${ensureCall(layers)}  const sql = getSql();
-  for (const statement of migrations) {
-    await sql.unsafe(statement);
-  }
-}
-
 export async function seed() {
 ${ensureCall(layers)}  const sql = getSql();
   const [{ count }] = await sql.unsafe<Array<{ count: string | number }>>(
@@ -1755,9 +2436,16 @@ ${ensureCall(layers)}  const sql = getSql();
   }${seedBlock}
 }
 
+export async function migrate() {
+${ensureCall(layers)}  const sql = getSql();
+  for (const statement of migrations) {
+    await sql.unsafe(statement);
+  }
+  await seed();
+}
+
 if (import.meta.main) {
   await migrate();
-  await seed();
   console.log("Database migrated and seeded.");
   process.exit(0);
 }
@@ -1775,7 +2463,7 @@ function dropTables(layers) {
     ordered.push("users");
   }
   ordered.push("notes");
-  if (layers.tenancy === "rls") {
+  if (usesTenantTable(layers.tenancy)) {
     ordered.push("tenant");
   }
   return ordered;
@@ -1784,7 +2472,7 @@ function renderFreshTs(layers) {
   const tables = dropTables(layers);
   const cascade = layers.database === "sqlite" ? "" : " CASCADE";
   return `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
-import { migrate, seed } from "./migrate.ts";
+import { migrate } from "./migrate.ts";
 
 const tables = ${JSON.stringify(tables)};
 
@@ -1794,7 +2482,6 @@ ${ensureCall(layers)}  const sql = getSql();
     await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
   }
   await migrate();
-  await seed();
 }
 
 if (import.meta.main) {
@@ -2232,11 +2919,28 @@ export function buildRoutes(dependencies: AppDependencies): AppRouteMap {
 }
 `;
 }
-function renderViewTs() {
-  return `import { join } from "node:path";
+function renderViewTs(layers) {
+  const authImport = authNeedsUsers(layers.auth) ? `import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { resolveCsrfTokenForRequest } from "@getstrata/core/http/csrfToken";
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 import { EtaViewEngine, htmlResponse } from "@getstrata/core/view";
-
+import { starterAuthDirectory } from "../bootstrap/authDirectory.ts";
+` : `import { resolveCsrfTokenForRequest } from "@getstrata/core/http/csrfToken";
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { EtaViewEngine, htmlResponse } from "@getstrata/core/view";
+`;
+  const userBlock = authNeedsUsers(layers.auth) ? `  let currentUser: { id: number; email: string; name: string | null } | null = null;
+  const authUser = currentAuthUser();
+  if (authUser) {
+    try {
+      const row = await starterAuthDirectory.findByIdOrThrow(Number(authUser.id));
+      currentUser = { id: row.id, email: row.email ?? "", name: row.name ?? null };
+    } catch {
+      currentUser = null;
+    }
+  }` : `  const currentUser = null;`;
+  return `import { join } from "node:path";
+${authImport}
 const engine = new EtaViewEngine(join(import.meta.dir, "../../views"));
 
 export interface LayoutData {
@@ -2248,10 +2952,17 @@ export async function renderPage(
   template: string,
   data: Record<string, unknown> & { layout: LayoutData },
   request?: Request,
+  status = 200,
 ): Promise<Response> {
   const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const html = await engine.render(template, { ...data, csrfToken });
-  return htmlResponse(html);
+  const flash = currentRequestMeta().flash ?? null;
+${userBlock}
+  const html = await engine.render(
+    template,
+    { ...data, csrfToken, flash, currentUser },
+    { request },
+  );
+  return htmlResponse(html, { status });
 }
 
 export function plainText(body: string): Response {
@@ -2260,6 +2971,315 @@ export function plainText(body: string): Response {
 `;
 }
 
+// src/renderScim.ts
+function ph2(layers, count, start = 1) {
+  if (layers.database === "postgres") {
+    return Array.from({ length: count }, (_, index) => `$${start + index}`).join(", ");
+  }
+  return Array.from({ length: count }, () => "?").join(", ");
+}
+function sqlFalse2(layers) {
+  return layers.database === "postgres" ? "false" : "0";
+}
+function renderScimModule(layers) {
+  if (!layers.extras.scim || !authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const tenantOn = usesTenantTable(layers.tenancy);
+  const insertCols = tenantOn ? "name, email, password, is_admin, tenant_id" : "name, email, password, is_admin";
+  const insertPh = tenantOn ? ph2(layers, 5) : ph2(layers, 4);
+  const insertTail = tenantOn ? `, ${sqlFalse2(layers)}, tenantId` : `, ${sqlFalse2(layers)}`;
+  const emailPh = ph2(layers, 1);
+  const idPh = ph2(layers, 1);
+  const updatePh = `${ph2(layers, 1)}, ${ph2(layers, 1, 2)}, ${ph2(layers, 1, 3)}`;
+  return `import { randomBytes } from "node:crypto";
+import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { routeParams } from "@getstrata/bootstrap/web/routing";
+import { createScimAuthMiddleware } from "@getstrata/core/auth/scimAuthMiddleware";
+import { hashPassword } from "@getstrata/core/auth/password";
+import { withErrorHandling } from "@getstrata/core/http/response";
+import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
+import { createScimThrottleMiddleware } from "@getstrata/core/http/scimThrottleMiddleware";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
+import { getSql } from "../../bootstrap/database.ts";
+
+const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+const CONFIG_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
+
+type UserRow = { id: number; name: string; email: string };
+
+function scimEnabled(): boolean {
+  return (process.env.FEATURE_SCIM ?? "false") === "true";
+}
+
+function scimJson(body: unknown, status = 200): Response {
+  return Response.json(body, {
+    status,
+    headers: { "content-type": "application/scim+json" },
+  });
+}
+
+function scimError(detail: string, status: number): Response {
+  return scimJson({ schemas: [ERROR_SCHEMA], detail, status: String(status) }, status);
+}
+
+function toScimUser(row: UserRow) {
+  return {
+    schemas: [USER_SCHEMA],
+    id: String(row.id),
+    userName: row.email,
+    name: { formatted: row.name },
+    emails: [{ value: row.email, primary: true }],
+    active: true,
+    meta: { resourceType: "User" },
+  };
+}
+
+function readUserName(body: Record<string, unknown>): string {
+  const emails = body.emails;
+  if (Array.isArray(emails) && emails[0] && typeof emails[0] === "object") {
+    const value = (emails[0] as { value?: unknown }).value;
+    if (typeof value === "string" && value.trim()) {
+      return value.trim().toLowerCase();
+    }
+  }
+  return typeof body.userName === "string" ? body.userName.trim().toLowerCase() : "";
+}
+
+function readName(body: Record<string, unknown>, fallback: string): string {
+  const name = body.name;
+  if (name && typeof name === "object") {
+    const formatted = (name as { formatted?: unknown; givenName?: unknown; familyName?: unknown }).formatted;
+    if (typeof formatted === "string" && formatted.trim()) {
+      return formatted.trim();
+    }
+    const given = (name as { givenName?: unknown }).givenName;
+    const family = (name as { familyName?: unknown }).familyName;
+    const combined = [given, family].filter((part) => typeof part === "string").join(" ").trim();
+    if (combined) {
+      return combined;
+    }
+  }
+  if (typeof body.displayName === "string" && body.displayName.trim()) {
+    return body.displayName.trim();
+  }
+  return fallback;
+}
+
+function wrapScim(handler: (request: Request) => Promise<Response>) {
+  const throttle = createScimThrottleMiddleware({
+    redisUrl: process.env.REDIS_URL,
+    maxAttempts: 120,
+    decaySeconds: 60,
+  });
+  return withMiddleware(throttle, createScimAuthMiddleware())(
+    withErrorHandling(async (request) => {
+      if (!scimEnabled()) {
+        return scimError("SCIM is off.", 404);
+      }
+      return handler(request);
+    }),
+  );
+}
+
+const scimModule: AppModule = {
+  name: "scim",
+  order: 8,
+  routes({ kernel }) {
+    return {
+      "/scim/v2/ServiceProviderConfig": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async () =>
+            scimJson({
+              schemas: [CONFIG_SCHEMA],
+              patch: { supported: true },
+              bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+              filter: { supported: true, maxResults: 200 },
+              changePassword: { supported: false },
+              sort: { supported: false },
+              etag: { supported: false },
+              authenticationSchemes: [
+                {
+                  type: "oauthbearertoken",
+                  name: "OAuth Bearer Token",
+                  description: "Bearer token in the Authorization header.",
+                  specUri: "https://www.rfc-editor.org/rfc/rfc6750",
+                  primary: true,
+                },
+              ],
+            }),
+          ),
+        ),
+      },
+      "/scim/v2/Users": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const url = new URL(request.url);
+            const filter = url.searchParams.get("filter") ?? "";
+            const match = /userName\\s+eq\\s+"([^"]+)"/i.exec(filter);
+            let rows: UserRow[];
+            if (match?.[1]) {
+              rows = await getSql().unsafe<UserRow[]>(
+                "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+                [match[1].trim().toLowerCase()],
+              );
+            } else {
+              rows = await getSql().unsafe<UserRow[]>("SELECT id, name, email FROM users");
+            }
+            const startIndex = Math.max(1, Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10) || 1);
+            const count = Math.min(200, Math.max(1, Number.parseInt(url.searchParams.get("count") ?? String(rows.length || 1), 10) || 200));
+            const slice = rows.slice(startIndex - 1, startIndex - 1 + count);
+            return scimJson({
+              schemas: [LIST_SCHEMA],
+              totalResults: rows.length,
+              startIndex,
+              itemsPerPage: slice.length,
+              Resources: slice.map(toScimUser),
+            });
+          }),
+        ),
+        POST: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const body = (await request.json()) as Record<string, unknown>;
+            const email = readUserName(body);
+            const name = readName(body, email.split("@")[0] ?? "User");
+            if (!email) {
+              return scimError("userName is required.", 400);
+            }
+            const existing = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+              [email],
+            );
+            if (existing[0]) {
+              return scimError("User already exists.", 409);
+            }
+            const hashed = await hashPassword(randomBytes(18).toString("hex"));
+            const tenantId = currentTenant()?.id ?? 1;
+            await getSql().unsafe(
+              "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+              [name, email, hashed${insertTail}],
+            );
+            const created = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+              [email],
+            );
+            const row = created[0];
+            if (!row) {
+              return scimError("Could not create user.", 500);
+            }
+            return scimJson(toScimUser(row), 201);
+          }),
+        ),
+      },
+      "/scim/v2/Users/:id": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const rows = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = rows[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            return scimJson(toScimUser(row));
+          }),
+        ),
+        PUT: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const body = (await request.json()) as Record<string, unknown>;
+            const email = readUserName(body);
+            const name = readName(body, email);
+            if (!email || !name) {
+              return scimError("userName and name are required.", 400);
+            }
+            await getSql().unsafe(
+              "UPDATE users SET name = ${updatePh.split(", ")[0]}, email = ${updatePh.split(", ")[1]} WHERE id = ${updatePh.split(", ")[2]}",
+              [name, email, id],
+            );
+            const rows = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = rows[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            return scimJson(toScimUser(row));
+          }),
+        ),
+        PATCH: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const existing = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = existing[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            const body = (await request.json()) as { schemas?: string[]; Operations?: Array<{ op?: string; path?: string; value?: unknown }> };
+            if (body.schemas && !body.schemas.includes(PATCH_SCHEMA)) {
+              return scimError("Unsupported patch schema.", 400);
+            }
+            let name = row.name;
+            let email = row.email;
+            for (const operation of body.Operations ?? []) {
+              const op = (operation.op ?? "replace").toLowerCase();
+              if (op !== "replace" && op !== "add") {
+                continue;
+              }
+              const path = (operation.path ?? "").toLowerCase();
+              if (path === "username" || path === "emails") {
+                email = String(operation.value ?? email).trim().toLowerCase();
+              } else if (path === "name.formatted" || path === "displayname" || path === "name") {
+                if (typeof operation.value === "string") {
+                  name = operation.value.trim() || name;
+                } else if (operation.value && typeof operation.value === "object") {
+                  name = readName({ name: operation.value as Record<string, unknown> }, name);
+                }
+              } else if (!path && operation.value && typeof operation.value === "object") {
+                const value = operation.value as Record<string, unknown>;
+                email = readUserName(value) || email;
+                name = readName(value, name);
+              }
+            }
+            await getSql().unsafe(
+              "UPDATE users SET name = ${updatePh.split(", ")[0]}, email = ${updatePh.split(", ")[1]} WHERE id = ${updatePh.split(", ")[2]}",
+              [name, email, id],
+            );
+            return scimJson(toScimUser({ id: row.id, name, email }));
+          }),
+        ),
+        DELETE: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            await getSql().unsafe("DELETE FROM users WHERE id = ${idPh}", [id]);
+            return new Response(null, { status: 204 });
+          }),
+        ),
+      },
+    };
+  },
+};
+
+export default scimModule;
+`;
+}
+
 // src/generate.ts
 var PROJECT_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]*$/i;
 function starterPackageRoot() {
@@ -2317,7 +3337,7 @@ function writeGeneratedFiles(options) {
     removeIfExists(join2(targetDir, "docker-compose.yml"));
   }
   writeText(join2(src, "routes.ts"), renderRoutesTs());
-  writeText(join2(src, "lib/view.ts"), renderViewTs());
+  writeText(join2(src, "lib/view.ts"), renderViewTs(layers));
   writeText(join2(src, "bootstrap/config.ts"), renderConfigTs());
   writeText(join2(src, "bootstrap/preload.ts"), renderPreloadTs(layers, projectName));
   writeText(join2(src, "bootstrap/database.ts"), renderDatabaseTs(layers));
@@ -2350,10 +3370,32 @@ function writeGeneratedFiles(options) {
   if (authModule) {
     writeText(join2(src, "modules/auth/index.ts"), authModule);
   }
+  const scimModule = renderScimModule(layers);
+  if (scimModule) {
+    writeText(join2(src, "modules/scim/index.ts"), scimModule);
+  } else {
+    removeIfExists(join2(src, "modules/scim/index.ts"));
+  }
+  if (layers.extras.mfa && htmlAuthKit(layers.auth)) {
+    writeText(join2(src, "bootstrap/pendingMfa.ts"), renderPendingMfaTs());
+  } else {
+    removeIfExists(join2(src, "bootstrap/pendingMfa.ts"));
+  }
+  writeText(join2(targetDir, "public/assets/site.css"), renderSiteCss());
   writeText(join2(targetDir, "views/home.eta"), renderHomeView(projectName, layers));
   writeText(join2(targetDir, "views/layouts/app.eta"), renderLayout(layers, projectName));
-  if (authUsesCookie(layers.auth)) {
+  if (htmlAuthKit(layers.auth)) {
     writeText(join2(targetDir, "views/auth/login.eta"), renderLoginView());
+    writeText(join2(targetDir, "views/auth/register.eta"), renderRegisterView());
+    writeText(join2(targetDir, "views/auth/forgot-password.eta"), renderForgotPasswordView());
+    writeText(join2(targetDir, "views/auth/reset-password.eta"), renderResetPasswordView());
+    if (layers.extras.emailVerification) {
+      writeText(join2(targetDir, "views/auth/verify-email.eta"), renderVerifyEmailView());
+    }
+    if (layers.extras.mfa) {
+      writeText(join2(targetDir, "views/auth/mfa-challenge.eta"), renderMfaChallengeView());
+      writeText(join2(targetDir, "views/auth/mfa-setup.eta"), renderMfaSetupView());
+    }
   }
   mkdirSync2(join2(targetDir, "storage"), { recursive: true });
   writeText(join2(targetDir, "storage/.gitkeep"), "");