@getstrata/starter 0.1.9 → 0.1.11

package/dist/cli.js

@@ -80,7 +80,7 @@ var AUTH_STACKS = [
   "cookie-token",
   "cookie-token-jwt"
 ];
-var TENANCY_DRIVERS = ["none", "rls"];
+var TENANCY_DRIVERS = ["none", "column", "rls"];
 var CACHE_DRIVERS = ["array", "redis"];
 var QUEUE_DRIVERS = ["sync", "redis"];
 var MAIL_DRIVERS = ["log", "smtp"];
@@ -103,6 +103,21 @@ function authUsesJwt(auth) {
 function authNeedsUsers(auth) {
   return auth !== "headers";
 }
+function usesTenantTable(tenancy) {
+  return tenancy === "rls" || tenancy === "column";
+}
+function htmlAuthKit(auth) {
+  return authUsesCookie(auth);
+}
+function extraApplies(extra, auth) {
+  if (extra === "metrics") {
+    return true;
+  }
+  if (extra === "mfa") {
+    return htmlAuthKit(auth);
+  }
+  return authNeedsUsers(auth);
+}
 function needsRedis(layers) {
   return layers.cache === "redis" || layers.queue === "redis";
 }
@@ -225,7 +240,7 @@ Options:
   --frontend          api | server-htmx | spa-react | hybrid
   --database          sqlite | postgres | mysql (one database; not mixed)
   --auth              headers | cookie | token | jwt | cookie-token | cookie-token-jwt
-  --tenancy           none | rls
+  --tenancy           none | column | rls (rls is Postgres SET LOCAL; sqlite/mysql coerce rls to column)
   --cache             array | redis
   --queue             sync | redis
   --mail              log | smtp
@@ -234,7 +249,7 @@ Options:
   --email-verification / --no-email-verification
   --scim / --no-scim
   --metrics / --no-metrics
-  --extras            Prompt (or enable) MFA, email verification, SCIM, metrics
+  --extras            Interactive extras list (MFA, email verification, SCIM, metrics)
   --docker            Write Docker Compose for every selected tool that needs a service
   --no-docker         Skip docker-compose.yml; use installs already on this machine
   --docker-services   Subset: postgres, mysql, redis, mailpit (comma-separated)
@@ -461,8 +476,8 @@ function applyFlagOverrides(base, flags) {
     spaPrefix: flags.spaPrefix ?? base.spaPrefix,
     extras: { ...base.extras, ...flags.extras }
   };
-  if (next.database !== "postgres") {
-    next.tenancy = "none";
+  if (next.database !== "postgres" && next.tenancy === "rls") {
+    next.tenancy = "column";
   }
   return reconcileDocker(applyDockerFlags(next, flags));
 }
@@ -473,14 +488,355 @@ function layersFromFlags(flags) {
 // src/prompt.ts
 import { stdin as input, stdout as output } from "process";
 import { createInterface } from "readline/promises";
+
+// src/selectPrompt.ts
+class PromptCancelledError extends Error {
+  constructor() {
+    super("Cancelled");
+    this.name = "PromptCancelledError";
+  }
+}
+function consumeSelectKeys(buffer) {
+  const events = [];
+  let rest = buffer;
+  while (rest.length > 0) {
+    if (rest[0] === "\x1B") {
+      if (rest.length === 1) {
+        break;
+      }
+      if (rest.startsWith("\x1B[")) {
+        const end = rest.search(/[A-Za-z]/);
+        if (end < 2) {
+          break;
+        }
+        const command = rest[end];
+        rest = rest.slice(end + 1);
+        if (command === "A") {
+          events.push({ type: "up" });
+        } else if (command === "B") {
+          events.push({ type: "down" });
+        } else if (command === "C") {
+          events.push({ type: "right" });
+        } else if (command === "D") {
+          events.push({ type: "left" });
+        }
+        continue;
+      }
+      if (rest.startsWith("\x1BO")) {
+        if (rest.length < 3) {
+          break;
+        }
+        const command = rest[2];
+        rest = rest.slice(3);
+        if (command === "A") {
+          events.push({ type: "up" });
+        } else if (command === "B") {
+          events.push({ type: "down" });
+        } else if (command === "C") {
+          events.push({ type: "right" });
+        } else if (command === "D") {
+          events.push({ type: "left" });
+        }
+        continue;
+      }
+      rest = rest.slice(1);
+      events.push({ type: "abort" });
+      continue;
+    }
+    const next = rest[0] ?? "";
+    rest = rest.slice(1);
+    if (next === "\x03") {
+      events.push({ type: "abort" });
+      continue;
+    }
+    if (next === "\r" || next === `
+`) {
+      events.push({ type: "submit" });
+      continue;
+    }
+    if (next === " ") {
+      events.push({ type: "toggle" });
+      continue;
+    }
+    if (next === "y" || next === "Y") {
+      events.push({ type: "yes" });
+      continue;
+    }
+    if (next === "n" || next === "N") {
+      events.push({ type: "no" });
+      continue;
+    }
+    if (next >= "1" && next <= "9") {
+      events.push({ type: "digit", value: Number(next) });
+    }
+  }
+  return { events, rest };
+}
+function moveSelectIndex(index, delta, length) {
+  if (length <= 0) {
+    return 0;
+  }
+  return (index + delta + length) % length;
+}
+function highlight(line, on) {
+  return on ? `\x1B[7m${line}\x1B[0m` : line;
+}
+function renderSelectLines(message, choices, index) {
+  return [
+    message,
+    ...choices.map((choice, choiceIndex) => {
+      const selected = choiceIndex === index;
+      const marker = selected ? ">" : " ";
+      return highlight(`  ${marker} ${choiceIndex + 1}) ${choice.label}`, selected);
+    }),
+    `  \u2191/\u2193 and Enter, or 1-${choices.length}`
+  ];
+}
+function renderConfirmLines(message, yes) {
+  return [
+    message,
+    highlight(`  ${yes ? ">" : " "} yes`, yes),
+    highlight(`  ${yes ? " " : ">"} no`, !yes),
+    "  \u2191/\u2193 and Enter, or y / n"
+  ];
+}
+function renderMultiSelectLines(message, choices, index) {
+  return [
+    message,
+    ...choices.map((choice, choiceIndex) => {
+      const focused = choiceIndex === index;
+      const box = choice.enabled ? "[x]" : "[ ]";
+      const marker = focused ? ">" : " ";
+      return highlight(`  ${marker} ${box} ${choiceIndex + 1}) ${choice.label}`, focused);
+    }),
+    "  \u2191/\u2193 move, Space or 1-9 toggle, Enter to continue"
+  ];
+}
+function writeLines(output, lines) {
+  for (const line of lines) {
+    output.write(`\x1B[2K${line}
+`);
+  }
+}
+function clearDrawnLines(output, lineCount) {
+  if (lineCount <= 0) {
+    return;
+  }
+  output.write(`\x1B[${lineCount}F`);
+  for (let i = 0;i < lineCount; i += 1) {
+    output.write(`\x1B[2K
+`);
+  }
+  output.write(`\x1B[${lineCount}F`);
+}
+function runRawPrompt(io, render, onEvent, summary) {
+  const { input, output } = io;
+  const wasRaw = Boolean(input.isTTY && typeof input.setRawMode === "function");
+  let buffer = "";
+  let lineCount = 0;
+  let settled = false;
+  const restore = () => {
+    output.write("\x1B[?25h");
+    if (wasRaw) {
+      input.setRawMode?.(false);
+    }
+  };
+  const paint = () => {
+    const lines = render();
+    if (lineCount > 0) {
+      output.write(`\x1B[${lineCount}F`);
+    }
+    writeLines(output, lines);
+    lineCount = lines.length;
+  };
+  input.setEncoding("utf8");
+  if (wasRaw) {
+    input.setRawMode?.(true);
+  }
+  if (typeof input.resume === "function") {
+    input.resume();
+  }
+  output.write("\x1B[?25l");
+  paint();
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      input.off("data", onData);
+      restore();
+    };
+    const succeed = (result) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      clearDrawnLines(output, lineCount);
+      output.write(`${summary(result)}
+`);
+      resolve(result);
+    };
+    const fail = (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      clearDrawnLines(output, lineCount);
+      reject(error);
+    };
+    function onData(chunk) {
+      buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      const consumed = consumeSelectKeys(buffer);
+      buffer = consumed.rest;
+      for (const event of consumed.events) {
+        const outcome = onEvent(event);
+        if (outcome === "abort") {
+          fail(new PromptCancelledError);
+          return;
+        }
+        if (outcome === "continue") {
+          paint();
+          continue;
+        }
+        succeed(outcome.done);
+        return;
+      }
+    }
+    input.on("data", onData);
+  });
+}
+async function promptSelect(message, choices, defaultValue, io) {
+  if (choices.length === 0) {
+    throw new Error(`No choices for "${message}".`);
+  }
+  const found = choices.findIndex((choice) => choice.value === defaultValue);
+  let index = found >= 0 ? found : 0;
+  return runRawPrompt(io, () => renderSelectLines(message, choices, index), (event) => {
+    if (event.type === "abort") {
+      return "abort";
+    }
+    if (event.type === "up") {
+      index = moveSelectIndex(index, -1, choices.length);
+      return "continue";
+    }
+    if (event.type === "down") {
+      index = moveSelectIndex(index, 1, choices.length);
+      return "continue";
+    }
+    if (event.type === "digit") {
+      if (event.value >= 1 && event.value <= choices.length) {
+        const choice = choices[event.value - 1];
+        if (choice) {
+          return { done: choice.value };
+        }
+      }
+      return "continue";
+    }
+    if (event.type === "submit") {
+      const choice = choices[index];
+      if (choice) {
+        return { done: choice.value };
+      }
+    }
+    return "continue";
+  }, (value) => `${message}  ${choices.find((choice) => choice.value === value)?.label ?? value}`);
+}
+async function promptConfirm(message, defaultValue, io) {
+  let yes = defaultValue;
+  return runRawPrompt(io, () => renderConfirmLines(message, yes), (event) => {
+    if (event.type === "abort") {
+      return "abort";
+    }
+    if (event.type === "up" || event.type === "right" || event.type === "yes") {
+      if (event.type === "yes") {
+        return { done: true };
+      }
+      yes = true;
+      return "continue";
+    }
+    if (event.type === "down" || event.type === "left" || event.type === "no") {
+      if (event.type === "no") {
+        return { done: false };
+      }
+      yes = false;
+      return "continue";
+    }
+    if (event.type === "digit") {
+      if (event.value === 1) {
+        return { done: true };
+      }
+      if (event.value === 2) {
+        return { done: false };
+      }
+    }
+    if (event.type === "submit") {
+      return { done: yes };
+    }
+    return "continue";
+  }, (value) => `${message}  ${value ? "yes" : "no"}`);
+}
+async function promptMultiSelect(message, choices, io) {
+  if (choices.length === 0) {
+    return [];
+  }
+  const selected = choices.map((choice) => choice.enabled);
+  let index = 0;
+  const enabledValues = () => choices.filter((_, choiceIndex) => selected[choiceIndex]).map((choice) => choice.value);
+  return runRawPrompt(io, () => renderMultiSelectLines(message, choices.map((choice, choiceIndex) => ({
+    ...choice,
+    enabled: Boolean(selected[choiceIndex])
+  })), index), (event) => {
+    if (event.type === "abort") {
+      return "abort";
+    }
+    if (event.type === "up") {
+      index = moveSelectIndex(index, -1, choices.length);
+      return "continue";
+    }
+    if (event.type === "down") {
+      index = moveSelectIndex(index, 1, choices.length);
+      return "continue";
+    }
+    if (event.type === "toggle") {
+      selected[index] = !selected[index];
+      return "continue";
+    }
+    if (event.type === "digit") {
+      if (event.value >= 1 && event.value <= choices.length) {
+        const target = event.value - 1;
+        selected[target] = !selected[target];
+        index = target;
+      }
+      return "continue";
+    }
+    if (event.type === "submit") {
+      return { done: enabledValues() };
+    }
+    return "continue";
+  }, (values) => {
+    const labels = choices.filter((choice) => values.includes(choice.value)).map((choice) => choice.value);
+    return `${message}  ${labels.length > 0 ? labels.join(", ") : "none"}`;
+  });
+}
+
+// src/prompt.ts
+var EXTRA_CHOICES = [
+  { value: "mfa", label: "mfa: authenticator challenge + setup pages" },
+  { value: "emailVerification", label: "email-verification: signed links + /email/verify" },
+  { value: "scim", label: "scim: /Users adapter" },
+  { value: "metrics", label: "metrics: Prometheus token" }
+];
 function isInteractive(flags) {
   if (flags.yes || flags.noInteractive) {
     return false;
   }
   return Boolean(input.isTTY && output.isTTY);
 }
+function canUseRawKeys() {
+  return Boolean(input.isTTY && typeof input.setRawMode === "function");
+}
 function createReadlinePrompter() {
   const rl = createInterface({ input, output });
+  const io = { input, output };
   return {
     async question(message, defaultValue) {
       const suffix = defaultValue ? ` [${defaultValue}]` : "";
@@ -488,6 +844,15 @@ function createReadlinePrompter() {
       return answer || defaultValue || "";
     },
     async confirm(message, defaultValue = false) {
+      if (canUseRawKeys()) {
+        rl.pause();
+        try {
+          return await promptConfirm(message, defaultValue, io);
+        } finally {
+          input.setRawMode?.(false);
+          rl.resume();
+        }
+      }
       const hint = defaultValue ? "Y/n" : "y/N";
       const answer = (await rl.question(`${message} (${hint}): `)).trim().toLowerCase();
       if (!answer) {
@@ -496,6 +861,15 @@ function createReadlinePrompter() {
       return answer === "y" || answer === "yes";
     },
     async select(message, choices, defaultValue) {
+      if (canUseRawKeys()) {
+        rl.pause();
+        try {
+          return await promptSelect(message, choices, defaultValue, io);
+        } finally {
+          input.setRawMode?.(false);
+          rl.resume();
+        }
+      }
       console.log(message);
       for (const [index, choice] of choices.entries()) {
         const marker = choice.value === defaultValue ? "*" : " ";
@@ -514,11 +888,66 @@ function createReadlinePrompter() {
       const match = choices.find((choice) => choice.value === answer || choice.label === answer);
       return match?.value ?? defaultValue;
     },
+    async multiSelect(message, choices) {
+      if (canUseRawKeys()) {
+        rl.pause();
+        try {
+          return await promptMultiSelect(message, choices, io);
+        } finally {
+          input.setRawMode?.(false);
+          rl.resume();
+        }
+      }
+      const enabled = new Set(choices.filter((choice) => choice.enabled).map((choice) => choice.value));
+      console.log(`${message} (yes/no each)`);
+      for (const choice of choices) {
+        const hint = enabled.has(choice.value) ? "Y/n" : "y/N";
+        const answer = (await rl.question(`  ${choice.label} (${hint}): `)).trim().toLowerCase();
+        if (!answer) {
+          continue;
+        }
+        if (answer === "y" || answer === "yes") {
+          enabled.add(choice.value);
+        } else if (answer === "n" || answer === "no") {
+          enabled.delete(choice.value);
+        }
+      }
+      return [...enabled];
+    },
     close() {
       rl.close();
     }
   };
 }
+function extrasStillToAsk(layers, flags) {
+  return EXTRA_CHOICES.filter((choice) => {
+    if (flags.extras[choice.value] !== undefined) {
+      return false;
+    }
+    return extraApplies(choice.value, layers.auth);
+  });
+}
+async function promptExtras(prompter, extras, layers, flags) {
+  const choices = extrasStillToAsk(layers, flags);
+  if (choices.length === 0) {
+    return extras;
+  }
+  const picked = new Set(await prompter.multiSelect("Extras", choices.map((choice) => ({
+    value: choice.value,
+    label: choice.label,
+    enabled: extras[choice.value]
+  }))));
+  const next = { ...extras };
+  for (const choice of choices) {
+    next[choice.value] = picked.has(choice.value);
+  }
+  for (const choice of EXTRA_CHOICES) {
+    if (!extraApplies(choice.value, layers.auth) && flags.extras[choice.value] === undefined) {
+      next[choice.value] = false;
+    }
+  }
+  return next;
+}
 async function promptLayers(flags, prompter) {
   const layers = applyFlagOverrides(defaultLayers(), flags);
   layers.frontend = await prompter.select("Frontend", [
@@ -540,14 +969,20 @@ async function promptLayers(flags, prompter) {
     { value: "cookie-token", label: "cookie-token: HTML cookies + API tokens" },
     { value: "cookie-token-jwt", label: "cookie-token-jwt: cookies, tokens, and JWT" }
   ], layers.auth);
-  if (layers.database === "postgres") {
-    layers.tenancy = await prompter.select("Tenancy", [
-      { value: "none", label: "none: no tenant table" },
-      { value: "rls", label: "rls: Postgres row-level security plus a tenant table" }
-    ], layers.tenancy);
-  } else {
-    layers.tenancy = "none";
-  }
+  layers.tenancy = await prompter.select("Tenancy", layers.database === "postgres" ? [
+    { value: "none", label: "none: no tenant table" },
+    {
+      value: "column",
+      label: "column: tenant table + users.tenant_id (no Postgres SET LOCAL)"
+    },
+    { value: "rls", label: "rls: Postgres row-level security plus a tenant table" }
+  ] : [
+    { value: "none", label: "none: no tenant table" },
+    {
+      value: "column",
+      label: "column: tenant table + users.tenant_id (SQLite/MySQL cannot run Postgres RLS)"
+    }
+  ], layers.database === "postgres" ? layers.tenancy : layers.tenancy === "rls" ? "column" : layers.tenancy);
   layers.cache = await prompter.select("Cache", [
     { value: "array", label: "array: in-process" },
     { value: "redis", label: "redis" }
@@ -560,16 +995,10 @@ async function promptLayers(flags, prompter) {
     { value: "log", label: "log: print messages" },
     { value: "smtp", label: "smtp" }
   ], layers.mail);
-  if (layers.frontend === "spa-react" || layers.frontend === "hybrid") {
+  if (flags.spaPrefix === undefined && (layers.frontend === "spa-react" || layers.frontend === "hybrid")) {
     layers.spaPrefix = await prompter.question("SPA prefix", layers.spaPrefix);
   }
-  const askExtras = flags.extrasPrompt || await prompter.confirm("Configure extras (MFA, SCIM, metrics)?", false);
-  if (askExtras) {
-    layers.extras.mfa = await prompter.confirm("Staff MFA env flag?", layers.extras.mfa);
-    layers.extras.emailVerification = await prompter.confirm("Email verification env flag?", layers.extras.emailVerification);
-    layers.extras.scim = await prompter.confirm("SCIM env stubs?", layers.extras.scim);
-    layers.extras.metrics = await prompter.confirm("Metrics token?", layers.extras.metrics);
-  }
+  layers.extras = await promptExtras(prompter, layers.extras, layers, flags);
   if (!dockerFlagsProvided(flags)) {
     layers.docker = await promptDockerLayer(prompter, layers);
   }
@@ -621,300 +1050,159 @@ async function resolveStarterPlan(flags, injected) {
   }
 }
 
-// src/renderAuth.ts
-function renderAuthDirectory(layers) {
-  if (!authNeedsUsers(layers.auth)) {
-    return null;
+// src/renderAuthFlows.ts
+function ph(layers, count, start = 1) {
+  if (layers.database === "postgres") {
+    return Array.from({ length: count }, (_, index) => `$${start + index}`).join(", ");
   }
-  const tokenLookup = authUsesToken(layers.auth) ? `
-  async resolveUserFromToken(token: string) {
-    if (!token || token.split(".").length === 3) {
-      return null;
-    }
-    const hashed = hashApiToken(token);
-    const rows = await getSql().unsafe<
-      Array<{
-        id: number;
-        user_id: number;
-        abilities: string;
-        expires_at: Date | string | null;
-        role?: string;
-        is_admin?: number | boolean;
-        email_verified_at?: Date | string | null;
-      }>
-    >(
-      \`SELECT t.id, t.user_id, t.abilities, t.expires_at, u.is_admin, u.email_verified_at
-       FROM api_tokens t INNER JOIN users u ON u.id = t.user_id
-       WHERE t.token_hash = ?\`,
-      [hashed],
-    );
-    const row = rows[0];
-    if (!row) {
-      return null;
-    }
-    if (row.expires_at && new Date(row.expires_at).getTime() <= Date.now()) {
-      return null;
-    }
-    let abilities: string[] = [];
-    try {
-      abilities = JSON.parse(String(row.abilities ?? "[]")) as string[];
-    } catch {
-      abilities = ["profile:read"];
-    }
-    return {
-      id: Number(row.user_id),
-      role: row.is_admin ? "admin" : "member",
-      abilities,
-      tokenId: Number(row.id),
-      emailVerifiedAt: row.email_verified_at ?? null,
-    };
-  },` : `
-  async resolveUserFromToken() {
-    return null;
-  },`;
-  const placeholder = layers.database === "postgres" ? "$1" : "?";
-  const hashImport = authUsesToken(layers.auth) ? `import { hashApiToken } from "@getstrata/core/auth/tokenHash";
-` : "";
-  return `import type { AuthUser } from "@getstrata/core/auth/authContext";
-import { verifyPassword } from "@getstrata/core/auth/password";
-${hashImport}import type { AuthUserDirectory } from "@getstrata/core/contracts/authUserDirectory";
-import { getSql } from "./database.ts";
+  return Array.from({ length: count }, () => "?").join(", ");
+}
+function sqlFalse(layers) {
+  return layers.database === "postgres" ? "false" : "0";
+}
+function sqlTrue(layers) {
+  return layers.database === "postgres" ? "true" : "1";
+}
+function renderPendingMfaTs() {
+  return `import { createHmac, timingSafeEqual } from "node:crypto";
 
-function mapRole(isAdmin: unknown): string {
-  return isAdmin === true || isAdmin === 1 || isAdmin === "1" ? "admin" : "member";
+const COOKIE = "strata_mfa_pending";
+
+function secret(): string {
+  return process.env.SESSION_SECRET?.trim() || "dev-session-secret-change-me-please-32ch";
 }
 
-export const starterAuthDirectory: AuthUserDirectory = {
-${tokenLookup.replace("WHERE t.token_hash = ?", `WHERE t.token_hash = ${placeholder}`)}
+function sign(userId: number, issuedAt: number): string {
+  const payload = \`\${userId}.\${issuedAt}\`;
+  const signature = createHmac("sha256", secret()).update(payload).digest("hex");
+  return \`\${payload}.\${signature}\`;
+}
 
-  async findByIdOrThrow(id: number) {
-    const rows = await getSql().unsafe<
-      Array<{
-        id: number;
-        email: string;
-        is_admin: number | boolean;
-        email_verified_at: Date | string | null;
-        password: string;
-      }>
-    >(\`SELECT id, email, is_admin, email_verified_at, password FROM users WHERE id = ${placeholder}\`, [id]);
-    const row = rows[0];
-    if (!row) {
-      throw new Error(\`User \${id} not found.\`);
-    }
-    return {
-      id: Number(row.id),
-      email: row.email,
-      role: mapRole(row.is_admin),
-      email_verified_at: row.email_verified_at ?? null,
-      password: row.password,
-    };
-  },
+export function pendingMfaSetCookie(userId: number): string {
+  const issuedAt = Date.now();
+  return \`\${COOKIE}=\${sign(userId, issuedAt)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600\`;
+}
 
-  async findByEmail(email: string) {
-    const rows = await getSql().unsafe<
-      Array<{
-        id: number;
-        email: string;
-        is_admin: number | boolean;
-        email_verified_at: Date | string | null;
-        password: string;
-      }>
-    >(
-      \`SELECT id, email, is_admin, email_verified_at, password FROM users WHERE email = ${placeholder}\`,
-      [email.trim().toLowerCase()],
-    );
-    const row = rows[0];
-    if (!row) {
+export function pendingMfaClearCookie(): string {
+  return \`\${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\`;
+}
+
+export function readPendingMfaUserId(request: Request): number | null {
+  const header = request.headers.get("cookie") ?? "";
+  for (const part of header.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name !== COOKIE) {
+      continue;
+    }
+    const value = rest.join("=");
+    const pieces = value.split(".");
+    if (pieces.length !== 3) {
       return null;
     }
-    return {
-      id: Number(row.id),
-      email: row.email,
-      role: mapRole(row.is_admin),
-      email_verified_at: row.email_verified_at ?? null,
-      password: row.password,
-    };
-  },
-
-  async verifyCredentials(email: string, password: string): Promise<AuthUser | null> {
-    const user = await this.findByEmail(email);
-    if (!user?.password || !(await verifyPassword(password, user.password))) {
+    const userId = Number.parseInt(pieces[0] ?? "", 10);
+    const issuedAt = Number.parseInt(pieces[1] ?? "", 10);
+    const signature = pieces[2] ?? "";
+    if (!Number.isInteger(userId) || userId <= 0 || Date.now() - issuedAt > 10 * 60 * 1000) {
       return null;
     }
-    return {
-      id: user.id,
-      role: user.role,
-      emailVerifiedAt: user.email_verified_at ?? null,
-    };
-  },
-};
+    const expected = sign(userId, issuedAt).split(".").pop() ?? "";
+    const left = Buffer.from(signature);
+    const right = Buffer.from(expected);
+    if (left.length !== right.length || !timingSafeEqual(left, right)) {
+      return null;
+    }
+    return userId;
+  }
+  return null;
+}
 `;
 }
-function renderAuthProvider(layers) {
-  if (layers.auth === "headers") {
-    return `import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";
-import type { AuthUser } from "@getstrata/core/auth/authContext";
-import { currentAuthUser } from "@getstrata/core/auth/authContext";
-import type { ServiceProvider } from "@getstrata/core/contracts/di";
-
-class StarterAuthManager {
-  async resolve(request?: Request): Promise<AuthUser | null> {
-    if (process.env.AUTH_DEV_HEADERS === "false") {
-      return request ? null : currentAuthUser();
-    }
-    if (request) {
-      const userId = request.headers.get("x-authenticated-user-id");
-      if (!userId) {
-        return null;
-      }
-      const role = request.headers.get("x-authenticated-user-role");
-      return {
-        id: userId,
-        ...(role ? { role } : {}),
-      };
-    }
-    return currentAuthUser();
-  }
-
-  user(request?: Request) {
-    return this.resolve(request);
-  }
-
-  async check(request: Request) {
-    return (await this.user(request)) !== null;
-  }
-}
-
-const authProvider: ServiceProvider = {
-  name: "starter.auth",
-  register({ container }) {
-    container.set(CORE_AUTH_TOKEN, new StarterAuthManager());
-  },
-};
-
-export default authProvider;
-`;
+function renderAuthModule(layers) {
+  if (!authNeedsUsers(layers.auth)) {
+    return null;
   }
-  const cookieBlock = authUsesCookie(layers.auth) ? `    const auth = createCookieSessionAuthManager({
-      secret: process.env.SESSION_SECRET?.trim() || "dev-session-secret-change-me-please-32ch",
-      cookieName: "strata_session",
-      mapUser: (user) => ({
-        id: user.id,
-        role: user.is_admin ? "admin" : "member",
-      }),
-    });` : `    const fallback = ${authUsesToken(layers.auth) ? "new DatabaseTokenGuard(container)" : "new JwtGuard()"};
-    const auth = new AuthManager(fallback);`;
-  const tokenRegs = authUsesToken(layers.auth) ? `    const apiGuard = new DatabaseTokenGuard(container);
-    auth.registerGuard("api", apiGuard);
-    auth.registerGuard("access_token", apiGuard);
-    auth.registerGuard("token", apiGuard);` : "";
-  const jwtReg = authUsesJwt(layers.auth) ? `    auth.registerGuard("jwt", new JwtGuard());` : "";
-  const basicReg = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `    auth.registerGuard("basic", new BasicAuthGuard(container));` : "";
-  const ability = authUsesToken(layers.auth) ? `    container.set(CORE_ABILITY_CHECKER_TOKEN, createTokenAbilityChecker());` : "";
-  const imports = [`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`];
-  if (authUsesCookie(layers.auth)) {
-    imports.push(`import { createCookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+  const cookie = htmlAuthKit(layers.auth);
+  const mfa = Boolean(layers.extras.mfa && cookie);
+  const verify = Boolean(layers.extras.emailVerification);
+  const jsonApi = authUsesToken(layers.auth) || authUsesJwt(layers.auth);
+  const tenantInsert = usesTenantTable(layers.tenancy);
+  const insertCols = tenantInsert ? "name, email, password, is_admin, tenant_id" : "name, email, password, is_admin";
+  const insertPh = tenantInsert ? ph(layers, 5) : ph(layers, 4);
+  const insertTail = tenantInsert ? `, ${sqlFalse(layers)}, 1` : `, ${sqlFalse(layers)}`;
+  const passwordPh = `${ph(layers, 1)}`;
+  const emailPh = `${ph(layers, 1, 2)}`;
+  const idPh = `${ph(layers, 1, 2)}`;
+  const verifiedPh = `${ph(layers, 1)}`;
+  const mfaUpdatePh = `${ph(layers, 1)}, ${ph(layers, 1, 2)}, ${ph(layers, 1, 3)}`;
+  const mfaIdPh = `${ph(layers, 1, 4)}`;
+  const imports = [];
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { randomBytes } from "node:crypto";`);
   }
-  if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
-    imports.push(`import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";`);
+  imports.push(`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`);
+  imports.push(`import type { AppModule } from "@getstrata/bootstrap/contracts";`);
+  if (cookie) {
+    imports.push(`import { parseFormBody } from "@getstrata/bootstrap/web/forms";`);
+    imports.push(`import { wrapWebLogin, wrapWebRegister } from "@getstrata/bootstrap/web/routing";`);
+    imports.push(`import type { CookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
   }
-  if (!authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
-    imports.push(`import { AuthManager, DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
-  } else if (!authUsesCookie(layers.auth) && authUsesJwt(layers.auth)) {
+  if (jsonApi) {
     imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
-  } else if (authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
-    imports.push(`import { DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
   }
   if (authUsesJwt(layers.auth)) {
-    imports.push(`import { JwtGuard } from "@getstrata/core/auth/jwtGuard";`);
+    imports.push(`import { jwtTtlSeconds, signJwt } from "@getstrata/core/auth/jwt";`);
   }
+  imports.push(`import { hashPassword, verifyPassword } from "@getstrata/core/auth/password";`);
   if (authUsesToken(layers.auth)) {
-    imports.push(`import { createTokenAbilityChecker } from "@getstrata/core/auth/tokenAbilityChecker";`);
+    imports.push(`import { hashApiToken } from "@getstrata/core/auth/tokenHash";`);
   }
-  imports.push(`import type { ServiceProvider } from "@getstrata/core/contracts/di";`);
-  const tokenImports = ["CORE_AUTH_USER_DIRECTORY_TOKEN"];
-  if (authUsesToken(layers.auth)) {
-    tokenImports.unshift("CORE_ABILITY_CHECKER_TOKEN");
+  if (mfa) {
+    imports.push(`import { protectMfaSecret, revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";`);
   }
-  imports.push(`import {
-  ${tokenImports.join(`,
-  `)},
-} from "@getstrata/core/contracts/serviceTokens";`);
-  imports.push(`import { starterAuthDirectory } from "../authDirectory.ts";`);
-  return `${imports.join(`
-`)}
-
-const authProvider: ServiceProvider = {
-  name: "starter.auth",
-  register({ container }) {
-    container.set(CORE_AUTH_USER_DIRECTORY_TOKEN, starterAuthDirectory);
-${cookieBlock}
-${tokenRegs}
-${jwtReg}
-${basicReg}
-${ability}
-    container.set(CORE_AUTH_TOKEN, auth);
-  },
-};
+  if (cookie) {
+    imports.push(`import { flashResponse } from "@getstrata/core/http/flashSession";`);
+  }
+  if (jsonApi) {
+    imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
+  }
+  imports.push(`import { absoluteTemporarySignedUrl, assertValidSignature } from "@getstrata/core/http/signedUrl";`);
+  imports.push(`import { mailer } from "@getstrata/core/mail/mailer";`);
+  if (mfa) {
+    imports.push(`import { generateRecoveryCodes, hashRecoveryCode, recoveryCodeMatches } from "@getstrata/core/security/recoveryCodes";`);
+    imports.push(`import { buildOtpauthUrl, generateTotpSecret, verifyTotp } from "@getstrata/core/security/totp";`);
+  }
+  imports.push(`import { starterAuthDirectory } from "../../bootstrap/authDirectory.ts";`);
+  imports.push(`import { getSql } from "../../bootstrap/database.ts";`);
+  if (cookie) {
+    imports.push(`import { renderPage } from "../../lib/view.ts";`);
+  }
+  if (mfa) {
+    imports.push(`import { pendingMfaClearCookie, pendingMfaSetCookie, readPendingMfaUserId } from "../../bootstrap/pendingMfa.ts";`);
+  }
+  const helpers = `
+async function sendSignedMail(to: string, subject: string, path: string, query: Record<string, string>) {
+  const link = absoluteTemporarySignedUrl(path, 3600, query);
+  await mailer().send({
+    to,
+    subject,
+    body: \`\${subject}\\n\\n\${link}\\n\`,
+  });
+}
+${cookie ? `
+function redirectTo(path: string, status = 302): Response {
+  return new Response(null, { status, headers: { location: path } });
+}
 
-export default authProvider;
-`;
+function sessionUser(user: { id: number; name?: string | null; email?: string | null; role: string }) {
+  return {
+    id: user.id,
+    name: user.name ?? user.email ?? "",
+    email: user.email ?? "",
+    is_admin: user.role === "admin",
+  };
 }
-function renderAuthModule(layers) {
-  if (!authNeedsUsers(layers.auth)) {
-    return null;
-  }
-  const cookieRoutes = authUsesCookie(layers.auth) ? `
-    webRoutes({ kernel, dependencies }) {
-      const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
-      return {
-        "/login": {
-          GET: kernel.wrapWebGuest(async (request) =>
-            renderPage(
-              "auth/login.eta",
-              { layout: { title: "Sign in" }, errors: {}, email: "" },
-              request,
-            ),
-          ),
-          POST: wrapWebLogin(
-            kernel,
-            async (request) => {
-              const { fields } = await parseFormBody(request);
-              const email = (fields.email ?? "").trim().toLowerCase();
-              const password = fields.password ?? "";
-              const user = await starterAuthDirectory.findByEmail?.(email);
-              if (!user?.password || !(await verifyPassword(password, user.password))) {
-                return renderPage(
-                  "auth/login.eta",
-                  {
-                    layout: { title: "Sign in" },
-                    errors: { email: "These credentials do not match our records." },
-                    email,
-                  },
-                  request,
-                );
-              }
-              return auth.signInRedirect(
-                {
-                  id: user.id,
-                  name: user.email ?? "",
-                  email: user.email ?? "",
-                  is_admin: user.role === "admin",
-                },
-                "/",
-              );
-            },
-            async () => new Response("Too many login attempts", { status: 429 }),
-          ),
-        },
-        "/logout": {
-          POST: kernel.wrapWebAuthenticatedAllowUnverified((request) =>
-            auth.signOutRedirect(request, "/login"),
-          ),
-        },
-      };
-    },` : "";
-  const apiLogin = authUsesToken(layers.auth) ? `
+` : ""}`;
+  const tokenLogin = authUsesToken(layers.auth) ? `
         "/api/v1/auth/login": {
           POST: kernel.wrap("api", withErrorHandling(async (request) => {
             const body = (await request.json()) as { email?: string; password?: string };
@@ -926,7 +1214,7 @@ function renderAuthModule(layers) {
             }
             const plain = \`strp_\${randomBytes(24).toString("hex")}\`;
             await getSql().unsafe(
-              "INSERT INTO api_tokens (user_id, name, token_hash, abilities) VALUES (${layers.database === "postgres" ? "$1, $2, $3, $4" : "?, ?, ?, ?"})",
+              "INSERT INTO api_tokens (user_id, name, token_hash, abilities) VALUES (${ph(layers, 4)})",
               [user.id, "spa", hashApiToken(plain), JSON.stringify(["profile:read"])],
             );
             return jsonResponse({ token: plain });
@@ -938,12 +1226,37 @@ function renderAuthModule(layers) {
             const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
             return jsonResponse({
               id: record.id,
-              name: record.email,
+              name: record.name ?? record.email,
               email: record.email,
               role: record.role,
             });
           }),
         },` : "";
+  const jsonRegister = jsonApi ? `
+        "/api/v1/auth/register": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { name?: string; email?: string; password?: string };
+            const name = (body.name ?? "").trim();
+            const email = (body.email ?? "").trim().toLowerCase();
+            const password = body.password ?? "";
+            if (!name || !email || password.length < 8) {
+              return jsonResponse({ error: "Name, email, and a password of 8+ characters are required." }, { status: 422 });
+            }
+            if (await starterAuthDirectory.findByEmail?.(email)) {
+              return jsonResponse({ error: "Email is already registered." }, { status: 422 });
+            }
+            const hashed = await hashPassword(password);
+            await getSql().unsafe(
+              "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+              [name, email, hashed${insertTail}],
+            );
+            const created = await starterAuthDirectory.findByEmail?.(email);
+            ${verify ? `if (created) {
+              await sendSignedMail(email, "Verify your email", "/api/v1/auth/verify-email", { id: String(created.id) });
+            }` : ""}
+            return jsonResponse({ ok: true }, { status: 201 });
+          })),
+        },` : "";
   const jwtLogin = authUsesJwt(layers.auth) ? `
         "/api/auth/token": {
           POST: kernel.wrap("api", withErrorHandling(async (request) => {
@@ -957,7 +1270,8 @@ function renderAuthModule(layers) {
             const token = signJwt({
               sub: user.id,
               role: user.role,
-              abilities: user.role === "admin" ? ["profile:read", "reports:export"] : ["profile:read"],
+              abilities: user.role === "admin" ? ["profile:read", "reports:export"] : ["profile:read"],${verify ? `
+              emailVerifiedAt: user.emailVerifiedAt ?? null,` : ""}
             });
             return jsonResponse({
               token,
@@ -966,156 +1280,928 @@ function renderAuthModule(layers) {
             });
           })),
         },` : "";
-  const apiUser = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `
+  const apiUser = jsonApi ? `
         "/api/user": {
           GET: kernel.wrapApi(async (request) => {
             const user = await dependencies.container.resolve<AuthManager>(CORE_AUTH_TOKEN).requireUser(request);
             return jsonResponse({ id: user.id, role: user.role ?? "member" });
           }),
         },` : "";
-  const routesBlock = apiLogin || jwtLogin || apiUser ? `
+  const jsonPassword = jsonApi ? `
+        "/api/v1/auth/forgot-password": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { email?: string };
+            const email = (body.email ?? "").trim().toLowerCase();
+            const user = await starterAuthDirectory.findByEmail?.(email);
+            if (user) {
+              await sendSignedMail(email, "Reset your password", "/api/v1/auth/reset-password", { email });
+            }
+            return jsonResponse({ ok: true });
+          })),
+        },
+        "/api/v1/auth/reset-password": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            assertValidSignature(request);
+            const body = (await request.json()) as { password?: string };
+            const email = new URL(request.url).searchParams.get("email") ?? "";
+            if (!email || !(body.password && body.password.length >= 8)) {
+              return jsonResponse({ error: "Invalid reset payload." }, { status: 422 });
+            }
+            await getSql().unsafe(
+              "UPDATE users SET password = ${passwordPh} WHERE email = ${emailPh}",
+              [await hashPassword(body.password), email],
+            );
+            return jsonResponse({ ok: true });
+          })),
+        },` : "";
+  const jsonVerify = jsonApi && verify ? `
+        "/api/v1/auth/verify-email": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            assertValidSignature(request);
+            const id = Number.parseInt(new URL(request.url).searchParams.get("id") ?? "", 10);
+            if (!Number.isInteger(id) || id <= 0) {
+              return jsonResponse({ error: "Invalid verification link." }, { status: 422 });
+            }
+            await getSql().unsafe(
+              "UPDATE users SET email_verified_at = ${verifiedPh} WHERE id = ${idPh}",
+              [new Date().toISOString(), id],
+            );
+            return jsonResponse({ ok: true });
+          })),
+        },` : "";
+  const apiRoutes = jsonApi ? `
     routes({ kernel, dependencies }) {
-      return {${apiLogin}${jwtLogin}${apiUser}
+      return {${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
       };
     },` : "";
-  const imports = [];
-  if (authUsesToken(layers.auth)) {
-    imports.push(`import { randomBytes } from "node:crypto";`);
+  const mfaLoginBranch = mfa ? `if (user.mfa_enabled) {
+                const pending = redirectTo("/login/mfa");
+                pending.headers.append("set-cookie", pendingMfaSetCookie(user.id));
+                return pending;
+              }` : "";
+  const verifyRegisterBranch = verify ? `await sendSignedMail(email, "Verify your email", "/email/verify", { id: String(insertedId) });
+              return flashResponse(
+                await auth.signInRedirect(sessionUser({ id: insertedId, name, email, role: "member" }), "/email/verify"),
+                { level: "info", message: "Check your email for a verification link." },
+              );` : `return auth.signInRedirect(sessionUser({ id: insertedId, name, email, role: "member" }), "/");`;
+  const cookieRoutes = cookie ? `
+    webRoutes({ kernel, dependencies }) {
+      const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+      return {
+        "/login": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/login.eta", { layout: { title: "Sign in" }, errors: {}, email: "", password: "" }, request),
+          ),
+          POST: wrapWebLogin(
+            kernel,
+            async (request) => {
+              const { fields } = await parseFormBody(request);
+              const email = (fields.email ?? "").trim().toLowerCase();
+              const password = fields.password ?? "";
+              const user = await starterAuthDirectory.findByEmail?.(email);
+              if (!user?.password || !(await verifyPassword(password, user.password))) {
+                return renderPage(
+                  "auth/login.eta",
+                  { layout: { title: "Sign in" }, errors: { email: "These credentials do not match our records." }, email, password: "" },
+                  request,
+                );
+              }
+              ${mfaLoginBranch}
+              return auth.signInRedirect(sessionUser(user), "/");
+            },
+            async (request) =>
+              renderPage(
+                "auth/login.eta",
+                { layout: { title: "Sign in" }, errors: { email: "Too many login attempts. Try again shortly." }, email: "", password: "" },
+                request,
+                429,
+              ),
+          ),
+        },
+        "/register": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/register.eta", { layout: { title: "Create account" }, errors: {}, name: "", email: "", password: "" }, request),
+          ),
+          POST: wrapWebRegister(
+            kernel,
+            async (request) => {
+              const { fields } = await parseFormBody(request);
+              const name = (fields.name ?? "").trim();
+              const email = (fields.email ?? "").trim().toLowerCase();
+              const password = fields.password ?? "";
+              const errors: Record<string, string> = {};
+              if (!name) {
+                errors.name = "Name is required.";
+              }
+              if (!email) {
+                errors.email = "Email is required.";
+              }
+              if (password.length < 8) {
+                errors.password = "Use at least 8 characters.";
+              }
+              if (email && (await starterAuthDirectory.findByEmail?.(email))) {
+                errors.email = "Email is already registered.";
+              }
+              if (Object.keys(errors).length > 0) {
+                return renderPage(
+                  "auth/register.eta",
+                  { layout: { title: "Create account" }, errors, name, email, password: "" },
+                  request,
+                );
+              }
+              const hashed = await hashPassword(password);
+              await getSql().unsafe(
+                "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+                [name, email, hashed${insertTail}],
+              );
+              const created = await starterAuthDirectory.findByEmail?.(email);
+              const insertedId = created?.id ?? 0;
+              ${verifyRegisterBranch}
+            },
+            async (request) =>
+              renderPage(
+                "auth/register.eta",
+                { layout: { title: "Create account" }, errors: { form: "Too many registration attempts. Try again shortly." }, name: "", email: "", password: "" },
+                request,
+                429,
+              ),
+          ),
+        },
+        "/forgot-password": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/forgot-password.eta", { layout: { title: "Forgot password" }, errors: {}, email: "" }, request),
+          ),
+          POST: kernel.wrapWeb(async (request) => {
+            const { fields } = await parseFormBody(request);
+            const email = (fields.email ?? "").trim().toLowerCase();
+            const user = await starterAuthDirectory.findByEmail?.(email);
+            if (user) {
+              await sendSignedMail(email, "Reset your password", "/reset-password", { email });
+            }
+            return flashResponse(redirectTo("/forgot-password"), {
+              level: "success",
+              message: "If that account exists, a reset link is on its way.",
+            });
+          }),
+        },
+        "/reset-password": {
+          GET: kernel.wrapWebGuest(async (request) => {
+            assertValidSignature(request);
+            const email = new URL(request.url).searchParams.get("email") ?? "";
+            return renderPage(
+              "auth/reset-password.eta",
+              { layout: { title: "Reset password" }, errors: {}, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
+              request,
+            );
+          }),
+          POST: kernel.wrapWeb(async (request) => {
+            assertValidSignature(request);
+            const { fields } = await parseFormBody(request);
+            const email = new URL(request.url).searchParams.get("email") ?? fields.email ?? "";
+            const password = fields.password ?? "";
+            if (!email || password.length < 8) {
+              return renderPage(
+                "auth/reset-password.eta",
+                { layout: { title: "Reset password" }, errors: { password: "Use at least 8 characters." }, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
+                request,
+              );
+            }
+            await getSql().unsafe(
+              "UPDATE users SET password = ${passwordPh} WHERE email = ${emailPh}",
+              [await hashPassword(password), email],
+            );
+            return flashResponse(redirectTo("/login"), { level: "success", message: "Password updated. Sign in." });
+          }),
+        },
+        "/logout": {
+          POST: kernel.wrapWebAuthenticatedAllowUnverified((request) => auth.signOutRedirect(request, "/")),
+        },${verify ? `
+        "/email/verify": {
+          GET: kernel.wrapWeb(async (request) => {
+            const url = new URL(request.url);
+            if (url.searchParams.get("signature")) {
+              assertValidSignature(request);
+              const id = Number.parseInt(url.searchParams.get("id") ?? "", 10);
+              if (Number.isInteger(id) && id > 0) {
+                await getSql().unsafe(
+                  "UPDATE users SET email_verified_at = ${verifiedPh} WHERE id = ${idPh}",
+                  [new Date().toISOString(), id],
+                );
+                const record = await starterAuthDirectory.findByIdOrThrow(id);
+                return flashResponse(
+                  await auth.signInRedirect(sessionUser(record), "/"),
+                  { level: "success", message: "Email verified." },
+                );
+              }
+            }
+            return renderPage("auth/verify-email.eta", { layout: { title: "Verify email" } }, request);
+          }),
+        },
+        "/email/verification-notification": {
+          POST: kernel.wrapWebAuthenticatedAllowUnverified(async (request) => {
+            const user = await auth.user(request);
+            if (user) {
+              const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
+              await sendSignedMail(record.email ?? "", "Verify your email", "/email/verify", { id: String(record.id) });
+            }
+            return flashResponse(redirectTo("/email/verify"), { level: "info", message: "Verification link sent." });
+          }),
+        },` : ""}${mfa ? `
+        "/login/mfa": {
+          GET: kernel.wrapWebGuest(async (request) => {
+            if (!readPendingMfaUserId(request)) {
+              return redirectTo("/login");
+            }
+            return renderPage("auth/mfa-challenge.eta", { layout: { title: "MFA" }, errors: {}, code: "" }, request);
+          }),
+          POST: kernel.wrapWeb(async (request) => {
+            const pendingId = readPendingMfaUserId(request);
+            if (!pendingId) {
+              return redirectTo("/login");
+            }
+            const { fields } = await parseFormBody(request);
+            const submitted = (fields.code ?? "").trim();
+            const record = await starterAuthDirectory.findByIdOrThrow(pendingId);
+            const secret = revealMfaSecret(record.mfa_secret ?? null);
+            const hashedCodes: string[] = record.mfa_recovery_codes
+              ? (JSON.parse(record.mfa_recovery_codes) as string[])
+              : [];
+            const totpOk = secret ? verifyTotp(secret, submitted) : false;
+            const recoveryOk = hashedCodes.some((hash) => recoveryCodeMatches(submitted, hash));
+            if (!totpOk && !recoveryOk) {
+              return renderPage(
+                "auth/mfa-challenge.eta",
+                { layout: { title: "MFA" }, errors: { code: "That code is not valid." }, code: "" },
+                request,
+              );
+            }
+            if (recoveryOk) {
+              const remaining = hashedCodes.filter((hash) => !recoveryCodeMatches(submitted, hash));
+              await getSql().unsafe(
+                "UPDATE users SET mfa_recovery_codes = ${passwordPh} WHERE id = ${idPh}",
+                [JSON.stringify(remaining), pendingId],
+              );
+            }
+            const signed = await auth.signInRedirect(sessionUser(record), "/");
+            signed.headers.append("set-cookie", pendingMfaClearCookie());
+            return signed;
+          }),
+        },
+        "/account/mfa": {
+          GET: kernel.wrapWebAuthenticated(async (request) => {
+            const secret = generateTotpSecret();
+            const user = await auth.user(request);
+            const record = user ? await starterAuthDirectory.findByIdOrThrow(Number(user.id)) : null;
+            const otpauth = buildOtpauthUrl({
+              secret,
+              account: record?.email ?? "user",
+              issuer: process.env.APP_NAME ?? "Strata",
+            });
+            return renderPage(
+              "auth/mfa-setup.eta",
+              { layout: { title: "MFA" }, errors: {}, code: "", secret, otpauth },
+              request,
+            );
+          }),
+          POST: kernel.wrapWebAuthenticated(async (request) => {
+            const user = await auth.user(request);
+            if (!user) {
+              return redirectTo("/login");
+            }
+            const { fields } = await parseFormBody(request);
+            const secret = (fields.secret ?? "").trim();
+            const submitted = (fields.code ?? "").trim();
+            if (!secret || !verifyTotp(secret, submitted)) {
+              return renderPage(
+                "auth/mfa-setup.eta",
+                {
+                  layout: { title: "MFA" },
+                  errors: { code: "Could not confirm that code." },
+                  code: "",
+                  secret,
+                  otpauth: buildOtpauthUrl({ secret, account: "user", issuer: process.env.APP_NAME ?? "Strata" }),
+                },
+                request,
+              );
+            }
+            const recoveryCodes = generateRecoveryCodes();
+            const stored = protectMfaSecret(secret);
+            await getSql().unsafe(
+              "UPDATE users SET mfa_secret = ${mfaUpdatePh.split(", ")[0]}, mfa_enabled = ${mfaUpdatePh.split(", ")[1]}, mfa_recovery_codes = ${mfaUpdatePh.split(", ")[2]} WHERE id = ${mfaIdPh}",
+              [stored, ${sqlTrue(layers)}, JSON.stringify(recoveryCodes.map((item) => hashRecoveryCode(item))), Number(user.id)],
+            );
+            return renderPage(
+              "auth/mfa-setup.eta",
+              {
+                layout: { title: "MFA" },
+                errors: {},
+                code: "",
+                secret,
+                otpauth: buildOtpauthUrl({ secret, account: "user", issuer: process.env.APP_NAME ?? "Strata" }),
+                recoveryCodes,
+              },
+              request,
+            );
+          }),
+        },` : ""}
+      };
+    },` : "";
+  return `${imports.join(`
+`)}
+${helpers}
+const authModule: AppModule = {
+  name: "auth",
+  order: 2,${apiRoutes}${cookieRoutes}
+};
+
+export default authModule;
+`;
+}
+function renderSiteModule(_layers) {
+  return `import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { withErrorHandling } from "@getstrata/core/http/response";
+import { pingDatabase } from "../../bootstrap/database.ts";
+import { plainText, renderPage } from "../../lib/view.ts";
+
+const siteModule: AppModule = {
+  name: "site",
+  order: 1,
+  routes({ kernel }) {
+    return {
+      "/health": kernel.wrap("api", withErrorHandling(async () => {
+        const dbOk = await pingDatabase();
+        return plainText(dbOk ? "ok" : "degraded");
+      })),
+    };
+  },
+  webRoutes({ kernel }) {
+    return {
+      "/": kernel.wrapWeb(async (request) =>
+        renderPage(
+          "home.eta",
+          {
+            layout: {
+              title: "Welcome",
+              description: "Welcome to your Strata app. Restyle views/home.eta and public/assets/site.css.",
+            },
+          },
+          request,
+        ),
+      ),
+    };
+  },
+};
+
+export default siteModule;
+`;
+}
+// src/renderAuthViews.ts
+function renderSiteCss() {
+  return `:root {
+  color-scheme: light;
+  --bg: #f4f1ea;
+  --ink: #1c1917;
+  --muted: #57534e;
+  --card: #fffdf8;
+  --line: #e7e0d4;
+  --accent: #1d4e4f;
+  --accent-ink: #f8faf8;
+  --danger: #9f1239;
+  --ok: #166534;
+  font-family: "Iowan Old Style", "Palatino Linotype", Palatino, serif;
+  line-height: 1.5;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  min-height: 100vh;
+  background: var(--bg);
+  color: var(--ink);
+}
+
+.site-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  padding: 1rem 1.5rem;
+  border-bottom: 1px solid var(--line);
+  background: var(--card);
+}
+
+.brand {
+  font-weight: 700;
+  text-decoration: none;
+  color: inherit;
+  letter-spacing: 0.02em;
+}
+
+.site-header nav {
+  display: flex;
+  gap: 0.75rem;
+  align-items: center;
+  font-size: 0.95rem;
+}
+
+.site-header a { color: inherit; }
+
+.site-header form { display: inline; }
+
+main {
+  padding: 2rem 1.5rem 3rem;
+}
+
+.section, .auth-card {
+  max-width: 36rem;
+  margin: 0 auto;
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: 1rem;
+  padding: 1.5rem 1.5rem 1.75rem;
+}
+
+.hero {
+  max-width: 40rem;
+}
+
+.section h1, .auth-card h1, .hero h1 {
+  margin: 0 0 0.5rem;
+  font-size: 1.8rem;
+}
+
+.lede, .muted { color: var(--muted); }
+
+.actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem;
+  margin-top: 1.25rem;
+}
+
+label {
+  display: block;
+  margin: 0.85rem 0;
+  font-size: 0.95rem;
+}
+
+input[type="email"],
+input[type="password"],
+input[type="text"] {
+  display: block;
+  width: 100%;
+  margin-top: 0.35rem;
+  padding: 0.55rem 0.7rem;
+  border: 1px solid var(--line);
+  border-radius: 0.5rem;
+  background: #fff;
+  font: inherit;
+}
+
+button, .button {
+  display: inline-block;
+  border: 0;
+  border-radius: 999px;
+  padding: 0.55rem 1rem;
+  background: var(--accent);
+  color: var(--accent-ink);
+  font: inherit;
+  text-decoration: none;
+  cursor: pointer;
+}
+
+.button-secondary {
+  background: transparent;
+  color: var(--ink);
+  border: 1px solid var(--line);
+}
+
+.error { color: var(--danger); }
+.ok, .flash-success { color: var(--ok); }
+.flash-error { color: var(--danger); }
+.flash {
+  margin: 0 0 1rem;
+  padding: 0.6rem 0.8rem;
+  border-radius: 0.5rem;
+  border: 1px solid var(--line);
+}
+
+.auth-links {
+  margin-top: 1rem;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem 1rem;
+}
+
+code { font-size: 0.9em; }
+`;
+}
+function renderLayout(layers, projectName) {
+  const kit = htmlAuthKit(layers.auth);
+  const guestNav = kit ? `<a href="/login">Sign in</a>
+        <a href="/register">Create account</a>` : "";
+  const userNav = kit ? `<% if (it.currentUser) { %>
+        <span class="muted"><%= it.currentUser.email %></span>
+        ${layers.extras.mfa ? '<a href="/account/mfa">MFA</a>' : ""}
+        <form method="post" action="/logout">
+          <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+          <button class="button-secondary" type="submit">Sign out</button>
+        </form>
+      <% } else { %>
+        ${guestNav}
+      <% } %>` : "";
+  return `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title><%= it.layout.title %> \xB7 ${projectName}</title>
+    <% if (it.layout.description) { %>
+    <meta name="description" content="<%= it.layout.description %>" />
+    <% } %>
+    <link rel="stylesheet" href="/assets/site.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">${projectName}</a>
+      <nav>
+        ${userNav}
+      </nav>
+    </header>
+    <main>
+      <% if (it.flash && it.flash.message) { %>
+      <p class="flash flash-<%= it.flash.level %>"><%= it.flash.message %></p>
+      <% } %>
+      <%~ it.body %>
+    </main>
+  </body>
+</html>
+`;
+}
+function renderHomeView(projectName, layers) {
+  const kit = htmlAuthKit(layers.auth);
+  const tokenHint = authUsesToken(layers.auth) ? '<p class="muted">API token: <code>POST /api/v1/auth/login</code> with email and password.</p>' : "";
+  const jwtHint = authUsesJwt(layers.auth) ? '<p class="muted">JWT: <code>POST /api/auth/token</code> with email and password.</p>' : "";
+  const guest = kit ? `<% if (!it.currentUser) { %>
+  <p class="lede">Sign in or create an account. Edit <code>views/home.eta</code> and <code>public/assets/site.css</code> to restyle this page.</p>
+  <div class="actions">
+    <a class="button" href="/register">Create account</a>
+    <a class="button button-secondary" href="/login">Sign in</a>
+  </div>
+  <p class="muted">Seeded demo: <code>demo@example.com</code> / <code>password</code>.</p>
+<% } else { %>
+  <p class="lede">You are signed in as <strong><%= it.currentUser.email %></strong>.</p>
+  <p>Add routes in <code>src/modules</code>. This homepage is yours to restyle.</p>
+<% } %>` : `<p class="lede">Edit <code>views/home.eta</code> and <code>public/assets/site.css</code> to restyle this page.</p>
+  <p class="muted">Auth stack: <code>${layers.auth}</code>.</p>`;
+  const extras = [tokenHint, jwtHint].filter(Boolean).join(`
+  `);
+  return `<section class="section hero">
+  <h1>Welcome to ${projectName}</h1>
+  ${guest}
+  <p>Health check: <a href="/health"><code>/health</code></a>.</p>${extras ? `
+  ${extras}` : ""}
+</section>
+`;
+}
+function renderFormView(title, fields, submit, links) {
+  return `<section class="auth-card">
+  <h1>${title}</h1>
+  <% if (it.status) { %>
+  <p class="ok"><%= it.status %></p>
+  <% } %>
+  <% if (it.errors && it.errors.form) { %>
+  <p class="error"><%= it.errors.form %></p>
+  <% } %>
+  <form method="post" action="<%= it.action || "" %>">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    ${fields}
+    <div class="actions">
+      <button type="submit">${submit}</button>
+    </div>
+  </form>
+  <div class="auth-links">
+    ${links}
+  </div>
+</section>
+`;
+}
+function textField(name, label, type, extra = "") {
+  return `<label>
+      ${label}
+      <% if (it.errors && it.errors.${name}) { %><span class="error"><%= it.errors.${name} %></span><% } %>
+      <input type="${type}" name="${name}" value="<%= it.${name} || "" %>" ${extra} />
+    </label>`;
+}
+function renderLoginView() {
+  return renderFormView("Sign in", `${textField("email", "Email", "email", 'required autocomplete="username"')}
+    ${textField("password", "Password", "password", 'required autocomplete="current-password"')}`, "Sign in", `<a href="/register">Create account</a>
+    <a href="/forgot-password">Forgot password</a>`).replace('action="<%= it.action || "" %>"', 'action="/login"');
+}
+function renderRegisterView() {
+  return renderFormView("Create account", `${textField("name", "Name", "text", "required")}
+    ${textField("email", "Email", "email", 'required autocomplete="email"')}
+    ${textField("password", "Password", "password", 'required minlength="8" autocomplete="new-password"')}`, "Create account", `<a href="/login">Already have an account</a>`).replace('action="<%= it.action || "" %>"', 'action="/register"');
+}
+function renderForgotPasswordView() {
+  return renderFormView("Forgot password", textField("email", "Email", "email", "required"), "Send reset link", `<a href="/login">Back to sign in</a>`).replace('action="<%= it.action || "" %>"', 'action="/forgot-password"');
+}
+function renderResetPasswordView() {
+  return renderFormView("Set a new password", `${textField("password", "New password", "password", 'required minlength="8" autocomplete="new-password"')}
+    <input type="hidden" name="email" value="<%= it.email || "" %>" />`, "Update password", `<a href="/login">Back to sign in</a>`).replace('action="<%= it.action || "" %>"', 'action="<%= it.action %>"');
+}
+function renderVerifyEmailView() {
+  return `<section class="auth-card">
+  <h1>Verify your email</h1>
+  <p>We sent a signed link to your inbox (or the mail log when <code>MAIL_DRIVER=log</code>).</p>
+  <form method="post" action="/email/verification-notification">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    <button type="submit">Resend link</button>
+  </form>
+</section>
+`;
+}
+function renderMfaChallengeView() {
+  return renderFormView("Two-factor code", `${textField("code", "Authenticator or recovery code", "text", 'required autocomplete="one-time-code"')}`, "Continue", `<a href="/login">Cancel</a>`).replace('action="<%= it.action || "" %>"', 'action="/login/mfa"');
+}
+function renderMfaSetupView() {
+  return `<section class="auth-card">
+  <h1>Authenticator app</h1>
+  <p class="muted">Scan this otpauth URL in your authenticator, then confirm a code. Restyle this page in <code>views/auth/mfa-setup.eta</code>.</p>
+  <p><code><%= it.otpauth %></code></p>
+  <form method="post" action="/account/mfa">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    <input type="hidden" name="secret" value="<%= it.secret %>" />
+    ${textField("code", "Confirmation code", "text", "required")}
+    <div class="actions"><button type="submit">Enable MFA</button></div>
+  </form>
+  <% if (it.recoveryCodes) { %>
+  <h2>Recovery codes</h2>
+  <p>Store these once. They will not be shown again.</p>
+  <ul>
+    <% for (const code of it.recoveryCodes) { %>
+    <li><code><%= code %></code></li>
+    <% } %>
+  </ul>
+  <% } %>
+</section>
+`;
+}
+
+// src/renderAuth.ts
+function renderAuthDirectory(layers) {
+  if (!authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const tokenLookup = authUsesToken(layers.auth) ? `
+  async resolveUserFromToken(token: string) {
+    if (!token || token.split(".").length === 3) {
+      return null;
+    }
+    const hashed = hashApiToken(token);
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        user_id: number;
+        abilities: string;
+        expires_at: Date | string | null;
+        role?: string;
+        is_admin?: number | boolean;
+        email_verified_at?: Date | string | null;
+      }>
+    >(
+      \`SELECT t.id, t.user_id, t.abilities, t.expires_at, u.is_admin, u.email_verified_at
+       FROM api_tokens t INNER JOIN users u ON u.id = t.user_id
+       WHERE t.token_hash = ?\`,
+      [hashed],
+    );
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    if (row.expires_at && new Date(row.expires_at).getTime() <= Date.now()) {
+      return null;
+    }
+    let abilities: string[] = [];
+    try {
+      abilities = JSON.parse(String(row.abilities ?? "[]")) as string[];
+    } catch {
+      abilities = ["profile:read"];
+    }
+    return {
+      id: Number(row.user_id),
+      role: row.is_admin ? "admin" : "member",
+      abilities,
+      tokenId: Number(row.id),
+      emailVerifiedAt: row.email_verified_at ?? null,
+    };
+  },` : `
+  async resolveUserFromToken() {
+    return null;
+  },`;
+  const placeholder = layers.database === "postgres" ? "$1" : "?";
+  const hashImport = authUsesToken(layers.auth) ? `import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+` : "";
+  const mfaSelect = layers.extras.mfa ? ", mfa_enabled, mfa_secret, mfa_recovery_codes" : "";
+  const mfaReturn = layers.extras.mfa ? `
+      mfa_enabled: row.mfa_enabled === true || row.mfa_enabled === 1,
+      mfa_secret: row.mfa_secret ?? null,
+      mfa_recovery_codes: row.mfa_recovery_codes ?? null,` : "";
+  return `import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { verifyPassword } from "@getstrata/core/auth/password";
+${hashImport}import type { AuthUserDirectory } from "@getstrata/core/contracts/authUserDirectory";
+import { getSql } from "./database.ts";
+
+function mapRole(isAdmin: unknown): string {
+  return isAdmin === true || isAdmin === 1 || isAdmin === "1" ? "admin" : "member";
+}
+
+export const starterAuthDirectory: AuthUserDirectory = {
+${tokenLookup.replace("WHERE t.token_hash = ?", `WHERE t.token_hash = ${placeholder}`)}
+
+  async findByIdOrThrow(id: number) {
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        name: string;
+        email: string;
+        is_admin: number | boolean;
+        email_verified_at: Date | string | null;
+        password: string;
+        mfa_enabled?: number | boolean;
+        mfa_secret?: string | null;
+        mfa_recovery_codes?: string | null;
+      }>
+    >(\`SELECT id, name, email, is_admin, email_verified_at, password${mfaSelect} FROM users WHERE id = ${placeholder}\`, [id]);
+    const row = rows[0];
+    if (!row) {
+      throw new Error(\`User \${id} not found.\`);
+    }
+    return {
+      id: Number(row.id),
+      name: row.name,
+      email: row.email,
+      role: mapRole(row.is_admin),
+      email_verified_at: row.email_verified_at ?? null,
+      password: row.password,${mfaReturn}
+    };
+  },
+
+  async findByEmail(email: string) {
+    const rows = await getSql().unsafe<
+      Array<{
+        id: number;
+        name: string;
+        email: string;
+        is_admin: number | boolean;
+        email_verified_at: Date | string | null;
+        password: string;
+        mfa_enabled?: number | boolean;
+        mfa_secret?: string | null;
+        mfa_recovery_codes?: string | null;
+      }>
+    >(
+      \`SELECT id, name, email, is_admin, email_verified_at, password${mfaSelect} FROM users WHERE email = ${placeholder}\`,
+      [email.trim().toLowerCase()],
+    );
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    return {
+      id: Number(row.id),
+      name: row.name,
+      email: row.email,
+      role: mapRole(row.is_admin),
+      email_verified_at: row.email_verified_at ?? null,
+      password: row.password,${mfaReturn}
+    };
+  },
+
+  async verifyCredentials(email: string, password: string): Promise<AuthUser | null> {
+    const user = await this.findByEmail(email);
+    if (!user?.password || !(await verifyPassword(password, user.password))) {
+      return null;
+    }
+    return {
+      id: user.id,
+      role: user.role,
+      emailVerifiedAt: user.email_verified_at ?? null,
+    };
+  },
+};
+`;
+}
+function renderAuthProvider(layers) {
+  if (layers.auth === "headers") {
+    return `import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";
+import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { currentAuthUser } from "@getstrata/core/auth/authContext";
+import type { ServiceProvider } from "@getstrata/core/contracts/di";
+
+class StarterAuthManager {
+  async resolve(request?: Request): Promise<AuthUser | null> {
+    if (process.env.AUTH_DEV_HEADERS === "false") {
+      return request ? null : currentAuthUser();
+    }
+    if (request) {
+      const userId = request.headers.get("x-authenticated-user-id");
+      if (!userId) {
+        return null;
+      }
+      const role = request.headers.get("x-authenticated-user-role");
+      return {
+        id: userId,
+        ...(role ? { role } : {}),
+      };
+    }
+    return currentAuthUser();
+  }
+
+  user(request?: Request) {
+    return this.resolve(request);
+  }
+
+  async check(request: Request) {
+    return (await this.user(request)) !== null;
+  }
+}
+
+const authProvider: ServiceProvider = {
+  name: "starter.auth",
+  register({ container }) {
+    container.set(CORE_AUTH_TOKEN, new StarterAuthManager());
+  },
+};
+
+export default authProvider;
+`;
   }
-  imports.push(`import type { AppModule } from "@getstrata/bootstrap/contracts";`);
-  imports.push(`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`);
+  const cookieBlock = authUsesCookie(layers.auth) ? `    const auth = createCookieSessionAuthManager({
+      secret: process.env.SESSION_SECRET?.trim() || "dev-session-secret-change-me-please-32ch",
+      cookieName: "strata_session",
+      mapUser: (user) => ({
+        id: user.id,
+        role: user.is_admin ? "admin" : "member",
+        ...(user.email_verified_at !== undefined ? { emailVerifiedAt: user.email_verified_at } : {}),
+      }),
+    });` : `    const fallback = ${authUsesToken(layers.auth) ? "new DatabaseTokenGuard(container)" : "new JwtGuard()"};
+    const auth = new AuthManager(fallback);`;
+  const tokenRegs = authUsesToken(layers.auth) ? `    const apiGuard = new DatabaseTokenGuard(container);
+    auth.registerGuard("api", apiGuard);
+    auth.registerGuard("access_token", apiGuard);
+    auth.registerGuard("token", apiGuard);` : "";
+  const jwtReg = authUsesJwt(layers.auth) ? `    auth.registerGuard("jwt", new JwtGuard());` : "";
+  const basicReg = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `    auth.registerGuard("basic", new BasicAuthGuard(container));` : "";
+  const ability = authUsesToken(layers.auth) ? `    container.set(CORE_ABILITY_CHECKER_TOKEN, createTokenAbilityChecker());` : "";
+  const imports = [`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`];
   if (authUsesCookie(layers.auth)) {
-    imports.push(`import { parseFormBody } from "@getstrata/bootstrap/web/forms";`);
-    imports.push(`import { wrapWebLogin } from "@getstrata/bootstrap/web/routing";`);
-    imports.push(`import type { CookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+    imports.push(`import { createCookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
   }
   if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
+    imports.push(`import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";`);
+  }
+  if (!authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
+    imports.push(`import { AuthManager, DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
+  } else if (!authUsesCookie(layers.auth) && authUsesJwt(layers.auth)) {
     imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
+  } else if (authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
+    imports.push(`import { DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
   }
   if (authUsesJwt(layers.auth)) {
-    imports.push(`import { jwtTtlSeconds, signJwt } from "@getstrata/core/auth/jwt";`);
-  }
-  if (authUsesCookie(layers.auth)) {
-    imports.push(`import { verifyPassword } from "@getstrata/core/auth/password";`);
+    imports.push(`import { JwtGuard } from "@getstrata/core/auth/jwtGuard";`);
   }
   if (authUsesToken(layers.auth)) {
-    imports.push(`import { hashApiToken } from "@getstrata/core/auth/tokenHash";`);
-  }
-  if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
-    imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
+    imports.push(`import { createTokenAbilityChecker } from "@getstrata/core/auth/tokenAbilityChecker";`);
   }
-  imports.push(`import { starterAuthDirectory } from "../../bootstrap/authDirectory.ts";`);
+  imports.push(`import type { ServiceProvider } from "@getstrata/core/contracts/di";`);
+  const tokenImports = ["CORE_AUTH_USER_DIRECTORY_TOKEN"];
   if (authUsesToken(layers.auth)) {
-    imports.push(`import { getSql } from "../../bootstrap/database.ts";`);
-  }
-  if (authUsesCookie(layers.auth)) {
-    imports.push(`import { renderPage } from "../../lib/view.ts";`);
+    tokenImports.unshift("CORE_ABILITY_CHECKER_TOKEN");
   }
+  imports.push(`import {
+  ${tokenImports.join(`,
+  `)},
+} from "@getstrata/core/contracts/serviceTokens";`);
+  imports.push(`import { starterAuthDirectory } from "../authDirectory.ts";`);
   return `${imports.join(`
 `)}
 
-const authModule: AppModule = {
-  name: "auth",
-  order: 2,${routesBlock}${cookieRoutes}
-};
-
-export default authModule;
-`;
-}
-function renderSiteModule(layers) {
-  const loginHint = authUsesCookie(layers.auth) && (layers.frontend === "server-htmx" || layers.frontend === "hybrid") ? " Sign in at /login." : "";
-  return `import type { AppModule } from "@getstrata/bootstrap/contracts";
-import { withErrorHandling } from "@getstrata/core/http/response";
-import { pingDatabase } from "../../bootstrap/database.ts";
-import { plainText, renderPage } from "../../lib/view.ts";
-
-const siteModule: AppModule = {
-  name: "site",
-  order: 1,
-  routes({ kernel }) {
-    return {
-      "/health": kernel.wrap("api", withErrorHandling(async () => {
-        const dbOk = await pingDatabase();
-        return plainText(dbOk ? "ok" : "degraded");
-      })),
-    };
-  },
-  webRoutes({ kernel }) {
-    return {
-      "/": kernel.wrapWeb(async (request) =>
-        renderPage(
-          "home.eta",
-          {
-            layout: {
-              title: "Home",
-              description: "A new Strata application.${loginHint}",
-            },
-          },
-          request,
-        ),
-      ),
-    };
+const authProvider: ServiceProvider = {
+  name: "starter.auth",
+  register({ container }) {
+    container.set(CORE_AUTH_USER_DIRECTORY_TOKEN, starterAuthDirectory);
+${cookieBlock}
+${tokenRegs}
+${jwtReg}
+${basicReg}
+${ability}
+    container.set(CORE_AUTH_TOKEN, auth);
   },
 };
 
-export default siteModule;
-`;
-}
-function renderLoginView() {
-  return `<section class="section">
-  <h1>Sign in</h1>
-  <p>Seeded accounts use password <code>password</code>.</p>
-  <% if (it.errors && it.errors.email) { %>
-  <p class="error"><%= it.errors.email %></p>
-  <% } %>
-  <form method="post" action="/login">
-    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
-    <label>
-      Email
-      <input type="email" name="email" value="<%= it.email || "demo@example.com" %>" required />
-    </label>
-    <label>
-      Password
-      <input type="password" name="password" value="password" required />
-    </label>
-    <button type="submit">Sign in</button>
-  </form>
-</section>
-`;
-}
-function renderLayout(layers, projectName) {
-  const cookie = authUsesCookie(layers.auth);
-  return `<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title><%= it.layout.title %> \xB7 ${projectName}</title>
-    <% if (it.layout.description) { %>
-    <meta name="description" content="<%= it.layout.description %>" />
-    <% } %>
-    <link rel="stylesheet" href="/assets/site.css" />
-  </head>
-  <body>
-    <header class="site-header">
-      <a class="brand" href="/">${projectName}</a>
-      <nav>
-        ${cookie ? '<a href="/login">Sign in</a>' : ""}
-      </nav>
-    </header>
-    <main><%~ it.body %></main>
-  </body>
-</html>
-`;
-}
-function renderHomeView(projectName, layers) {
-  const loginLine = authUsesCookie(layers.auth) ? '<p>HTML sign-in: <a href="/login">/login</a> (demo@example.com / password).</p>' : "";
-  return `<section class="section">
-  <h1>Welcome to ${projectName}</h1>
-  <p>Frontend <code>${layers.frontend}</code>, database <code>${layers.database}</code>, auth <code>${layers.auth}</code>.</p>
-  <p>Health check: <a href="/health"><code>/health</code></a>.</p>
-  ${loginLine}
-</section>
+export default authProvider;
 `;
 }
 
@@ -1187,6 +2273,7 @@ function renderEnvExample(projectName, layers) {
   if (layers.extras.scim) {
     lines.push("FEATURE_SCIM=true");
     lines.push("SCIM_BEARER_TOKEN=dev-scim-token-change-me");
+    lines.push("# SCIM_TENANT_TOKENS=1:token-a");
   } else {
     lines.push("# FEATURE_SCIM=false");
     lines.push("# SCIM_BEARER_TOKEN=");
@@ -1288,9 +2375,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^0.4.2",
+    "@getstrata/bootstrap": "^0.4.3",
     "@getstrata/cli": "^0.2.0",
-    "@getstrata/core": "^0.7.4"
+    "@getstrata/core": "^0.7.5"
   };
   if (options.layers?.database === "mysql") {
     coreDeps.mysql2 = "^3.24.3";
@@ -1419,11 +2506,21 @@ Seeded login (password \`password\`):
 ` : `
 Header auth is on for local use. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`). Production must set \`AUTH_DEV_HEADERS=false\`.
 `}${authUsesCookie(layers.auth) ? `
-HTML sign-in lives at \`/login\` (cookie session + CSRF when \`FRONTEND_MODE\` is \`server-htmx\` or \`hybrid\`).
+HTML auth kit (restyle \`views/\` and \`public/assets/site.css\`):
+
+- Welcome: \`/\`
+- Sign in: \`/login\`
+- Register: \`/register\`
+- Forgot password: \`/forgot-password\`
+- Reset password: signed \`/reset-password\` (mail log when \`MAIL_DRIVER=log\`)
+${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}
+Cookie name is \`strata_session\`. Forms send CSRF as \`_token\`.
 ` : ""}${authUsesToken(layers.auth) ? `
-Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Send \`Authorization: Bearer\`.
+Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Register: \`POST /api/v1/auth/register\`. Forgot/reset: \`POST /api/v1/auth/forgot-password\` and signed \`POST /api/v1/auth/reset-password\`. Send \`Authorization: Bearer\` after login.
 ` : ""}${authUsesJwt(layers.auth) ? `
 JWT mint: \`POST /api/auth/token\` with email and password. Short-lived. Not a portal session.
+` : ""}${layers.extras.metrics ? `
+Prometheus scrape: \`GET /metrics\`. Production requires \`Authorization: Bearer <METRICS_TOKEN>\`.
 ` : ""}
 ## Production
 
@@ -1651,7 +2748,9 @@ export async function closeDatabase() {
 function renderMigrateTs(layers) {
   const d = dialectFragments(layers.database);
   const statements = [];
-  if (layers.tenancy === "rls") {
+  const tenancyOn = usesTenantTable(layers.tenancy);
+  const mfaOn = layers.extras.mfa && authNeedsUsers(layers.auth);
+  if (tenancyOn) {
     statements.push(`CREATE TABLE IF NOT EXISTS tenant (
     id ${d.id},
     slug ${d.text} NOT NULL UNIQUE,
@@ -1665,14 +2764,18 @@ function renderMigrateTs(layers) {
     created_at ${d.timestamp}
   )`);
   if (authNeedsUsers(layers.auth)) {
-    const tenantColumn = layers.tenancy === "rls" ? `
+    const tenantColumn = tenancyOn ? `
     tenant_id INTEGER NOT NULL DEFAULT 1,` : "";
+    const mfaColumns = mfaOn ? `
+    mfa_secret ${d.text},
+    mfa_enabled ${d.bool},
+    mfa_recovery_codes ${d.text},` : "";
     statements.push(`CREATE TABLE IF NOT EXISTS users (
     id ${d.id},
     name ${d.text} NOT NULL,
     email ${d.text} NOT NULL UNIQUE,
     password ${d.text} NOT NULL,
-    is_admin ${d.bool},${tenantColumn}
+    is_admin ${d.bool},${tenantColumn}${mfaColumns}
     email_verified_at ${d.timestampNull},
     created_at ${d.timestamp}
   )`);
@@ -1701,18 +2804,22 @@ function renderMigrateTs(layers) {
   }
   const list = statements.map((sql) => `  \`${sql}\`,`).join(`
 `);
-  const ph = layers.database === "postgres";
-  const notePlaceholder = ph ? "$1" : "?";
-  const userPlaceholders = ph ? "$1, $2, $3, $4), ($5, $6, $7, $8" : "?, ?, ?, ?), (?, ?, ?, ?";
-  const adminFlag = ph ? "false, " : "0, ";
-  const adminTrue = ph ? "true" : "1";
-  const seedTenant = layers.tenancy === "rls" ? `
+  const ph2 = layers.database === "postgres";
+  const notePlaceholder = ph2 ? "$1" : "?";
+  const verifyOn = layers.extras.emailVerification && authNeedsUsers(layers.auth);
+  const userColumns = verifyOn ? "name, email, password, is_admin, email_verified_at" : "name, email, password, is_admin";
+  const userPlaceholders = verifyOn ? ph2 ? "$1, $2, $3, $4, $5), ($6, $7, $8, $9, $10" : "?, ?, ?, ?, ?), (?, ?, ?, ?, ?" : ph2 ? "$1, $2, $3, $4), ($5, $6, $7, $8" : "?, ?, ?, ?), (?, ?, ?, ?";
+  const adminFlag = ph2 ? "false" : "0";
+  const adminTrue = ph2 ? "true" : "1";
+  const verifiedNow = "new Date().toISOString()";
+  const userValues = verifyOn ? `["Demo User", "demo@example.com", password, ${adminFlag}, ${verifiedNow}, "Admin User", "admin@example.test", password, ${adminTrue}, ${verifiedNow}]` : `["Demo User", "demo@example.com", password, ${adminFlag}, "Admin User", "admin@example.test", password, ${adminTrue}]`;
+  const seedTenant = tenancyOn ? `
   const [{ count: tenantCount }] = await sql.unsafe<Array<{ count: string | number }>>(
     "SELECT COUNT(*) AS count FROM tenant",
   );
   if (Number(tenantCount) === 0) {
     await sql.unsafe(
-      "INSERT INTO tenant (slug, plan, region) VALUES (${ph ? "$1, $2, $3" : "?, ?, ?"})",
+      "INSERT INTO tenant (slug, plan, region) VALUES (${ph2 ? "$1, $2, $3" : "?, ?, ?"})",
       ["default", "enterprise", "eu"],
     );
   }` : "";
@@ -1723,8 +2830,8 @@ function renderMigrateTs(layers) {
   if (Number(userCount) === 0) {
     const password = await hashPassword("password");
     await sql.unsafe(
-      "INSERT INTO users (name, email, password, is_admin) VALUES (${userPlaceholders})",
-      ["Demo User", "demo@example.com", password, ${adminFlag}"Admin User", "admin@example.test", password, ${adminTrue}],
+      "INSERT INTO users (${userColumns}) VALUES (${userPlaceholders})",
+      ${userValues},
     );
   }` : "";
   const hashImport = authNeedsUsers(layers.auth) ? `import { hashPassword } from "@getstrata/core/auth/password";
@@ -1736,13 +2843,6 @@ const migrations = [
 ${list}
 ];
 
-export async function migrate() {
-${ensureCall(layers)}  const sql = getSql();
-  for (const statement of migrations) {
-    await sql.unsafe(statement);
-  }
-}
-
 export async function seed() {
 ${ensureCall(layers)}  const sql = getSql();
   const [{ count }] = await sql.unsafe<Array<{ count: string | number }>>(
@@ -1755,9 +2855,16 @@ ${ensureCall(layers)}  const sql = getSql();
   }${seedBlock}
 }
 
+export async function migrate() {
+${ensureCall(layers)}  const sql = getSql();
+  for (const statement of migrations) {
+    await sql.unsafe(statement);
+  }
+  await seed();
+}
+
 if (import.meta.main) {
   await migrate();
-  await seed();
   console.log("Database migrated and seeded.");
   process.exit(0);
 }
@@ -1775,7 +2882,7 @@ function dropTables(layers) {
     ordered.push("users");
   }
   ordered.push("notes");
-  if (layers.tenancy === "rls") {
+  if (usesTenantTable(layers.tenancy)) {
     ordered.push("tenant");
   }
   return ordered;
@@ -1784,7 +2891,7 @@ function renderFreshTs(layers) {
   const tables = dropTables(layers);
   const cascade = layers.database === "sqlite" ? "" : " CASCADE";
   return `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
-import { migrate, seed } from "./migrate.ts";
+import { migrate } from "./migrate.ts";
 
 const tables = ${JSON.stringify(tables)};
 
@@ -1794,7 +2901,6 @@ ${ensureCall(layers)}  const sql = getSql();
     await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
   }
   await migrate();
-  await seed();
 }
 
 if (import.meta.main) {
@@ -2094,6 +3200,10 @@ export { starterProviders };
 function renderCreateAppTs(layers) {
   const ensureLine = needsEnsure(layers) ? `import { ensureAppDatabase } from "./ensureDatabase.ts";
 ` : "";
+  const metricsImport = layers.extras.metrics ? `import { createMetricsRoutes } from "@getstrata/bootstrap/metricsRoutes";
+` : "";
+  const metricsSpread = layers.extras.metrics ? `
+    ...createMetricsRoutes(),` : "";
   return `import { join } from "node:path";
 import "./preload.ts";
 import { runProviderPhase } from "@getstrata/bootstrap/context";
@@ -2113,8 +3223,7 @@ import {
   ensureModulesLoaded,
 } from "@getstrata/bootstrap/discoverModules";
 import { createHealthRoutes } from "@getstrata/bootstrap/health";
-import { createMetricsRoutes } from "@getstrata/bootstrap/metricsRoutes";
-import { assertProductionSecrets } from "@getstrata/bootstrap/secretsGuard";
+${metricsImport}import { assertProductionSecrets } from "@getstrata/bootstrap/secretsGuard";
 import { createWebServer } from "@getstrata/bootstrap/web/server";
 import { setActiveApplicationContext } from "@getstrata/core/runtime/applicationRegistry";
 import { migrate } from "../db/migrate.ts";
@@ -2194,8 +3303,7 @@ ${needsEnsure(layers) ? `  await ensureAppDatabase();
 
   const routes = mergeSpaRoutes(context.dependencies, {
     ...createHealthRoutes(context.dependencies),
-    ...buildRoutes(context.dependencies),
-    ...createMetricsRoutes(),
+    ...buildRoutes(context.dependencies),${metricsSpread}
   }, {
     distDirectory: join(import.meta.dir, "../../frontend/dist"),
   });
@@ -2232,11 +3340,28 @@ export function buildRoutes(dependencies: AppDependencies): AppRouteMap {
 }
 `;
 }
-function renderViewTs() {
-  return `import { join } from "node:path";
+function renderViewTs(layers) {
+  const authImport = authNeedsUsers(layers.auth) ? `import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { resolveCsrfTokenForRequest } from "@getstrata/core/http/csrfToken";
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 import { EtaViewEngine, htmlResponse } from "@getstrata/core/view";
-
+import { starterAuthDirectory } from "../bootstrap/authDirectory.ts";
+` : `import { resolveCsrfTokenForRequest } from "@getstrata/core/http/csrfToken";
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { EtaViewEngine, htmlResponse } from "@getstrata/core/view";
+`;
+  const userBlock = authNeedsUsers(layers.auth) ? `  let currentUser: { id: number; email: string; name: string | null } | null = null;
+  const authUser = currentAuthUser();
+  if (authUser) {
+    try {
+      const row = await starterAuthDirectory.findByIdOrThrow(Number(authUser.id));
+      currentUser = { id: row.id, email: row.email ?? "", name: row.name ?? null };
+    } catch {
+      currentUser = null;
+    }
+  }` : `  const currentUser = null;`;
+  return `import { join } from "node:path";
+${authImport}
 const engine = new EtaViewEngine(join(import.meta.dir, "../../views"));
 
 export interface LayoutData {
@@ -2248,10 +3373,17 @@ export async function renderPage(
   template: string,
   data: Record<string, unknown> & { layout: LayoutData },
   request?: Request,
+  status = 200,
 ): Promise<Response> {
   const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const html = await engine.render(template, { ...data, csrfToken });
-  return htmlResponse(html);
+  const flash = currentRequestMeta().flash ?? null;
+${userBlock}
+  const html = await engine.render(
+    template,
+    { ...data, csrfToken, flash, currentUser },
+    { request },
+  );
+  return htmlResponse(html, { status });
 }
 
 export function plainText(body: string): Response {
@@ -2260,6 +3392,315 @@ export function plainText(body: string): Response {
 `;
 }
 
+// src/renderScim.ts
+function ph2(layers, count, start = 1) {
+  if (layers.database === "postgres") {
+    return Array.from({ length: count }, (_, index) => `$${start + index}`).join(", ");
+  }
+  return Array.from({ length: count }, () => "?").join(", ");
+}
+function sqlFalse2(layers) {
+  return layers.database === "postgres" ? "false" : "0";
+}
+function renderScimModule(layers) {
+  if (!layers.extras.scim || !authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const tenantOn = usesTenantTable(layers.tenancy);
+  const insertCols = tenantOn ? "name, email, password, is_admin, tenant_id" : "name, email, password, is_admin";
+  const insertPh = tenantOn ? ph2(layers, 5) : ph2(layers, 4);
+  const insertTail = tenantOn ? `, ${sqlFalse2(layers)}, tenantId` : `, ${sqlFalse2(layers)}`;
+  const emailPh = ph2(layers, 1);
+  const idPh = ph2(layers, 1);
+  const updatePh = `${ph2(layers, 1)}, ${ph2(layers, 1, 2)}, ${ph2(layers, 1, 3)}`;
+  return `import { randomBytes } from "node:crypto";
+import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { routeParams } from "@getstrata/bootstrap/web/routing";
+import { createScimAuthMiddleware } from "@getstrata/core/auth/scimAuthMiddleware";
+import { hashPassword } from "@getstrata/core/auth/password";
+import { withErrorHandling } from "@getstrata/core/http/response";
+import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
+import { createScimThrottleMiddleware } from "@getstrata/core/http/scimThrottleMiddleware";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
+import { getSql } from "../../bootstrap/database.ts";
+
+const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+const CONFIG_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
+
+type UserRow = { id: number; name: string; email: string };
+
+function scimEnabled(): boolean {
+  return (process.env.FEATURE_SCIM ?? "false") === "true";
+}
+
+function scimJson(body: unknown, status = 200): Response {
+  return Response.json(body, {
+    status,
+    headers: { "content-type": "application/scim+json" },
+  });
+}
+
+function scimError(detail: string, status: number): Response {
+  return scimJson({ schemas: [ERROR_SCHEMA], detail, status: String(status) }, status);
+}
+
+function toScimUser(row: UserRow) {
+  return {
+    schemas: [USER_SCHEMA],
+    id: String(row.id),
+    userName: row.email,
+    name: { formatted: row.name },
+    emails: [{ value: row.email, primary: true }],
+    active: true,
+    meta: { resourceType: "User" },
+  };
+}
+
+function readUserName(body: Record<string, unknown>): string {
+  const emails = body.emails;
+  if (Array.isArray(emails) && emails[0] && typeof emails[0] === "object") {
+    const value = (emails[0] as { value?: unknown }).value;
+    if (typeof value === "string" && value.trim()) {
+      return value.trim().toLowerCase();
+    }
+  }
+  return typeof body.userName === "string" ? body.userName.trim().toLowerCase() : "";
+}
+
+function readName(body: Record<string, unknown>, fallback: string): string {
+  const name = body.name;
+  if (name && typeof name === "object") {
+    const formatted = (name as { formatted?: unknown; givenName?: unknown; familyName?: unknown }).formatted;
+    if (typeof formatted === "string" && formatted.trim()) {
+      return formatted.trim();
+    }
+    const given = (name as { givenName?: unknown }).givenName;
+    const family = (name as { familyName?: unknown }).familyName;
+    const combined = [given, family].filter((part) => typeof part === "string").join(" ").trim();
+    if (combined) {
+      return combined;
+    }
+  }
+  if (typeof body.displayName === "string" && body.displayName.trim()) {
+    return body.displayName.trim();
+  }
+  return fallback;
+}
+
+function wrapScim(handler: (request: Request) => Promise<Response>) {
+  const throttle = createScimThrottleMiddleware({
+    redisUrl: process.env.REDIS_URL,
+    maxAttempts: 120,
+    decaySeconds: 60,
+  });
+  return withMiddleware(throttle, createScimAuthMiddleware())(
+    withErrorHandling(async (request) => {
+      if (!scimEnabled()) {
+        return scimError("SCIM is off.", 404);
+      }
+      return handler(request);
+    }),
+  );
+}
+
+const scimModule: AppModule = {
+  name: "scim",
+  order: 8,
+  routes({ kernel }) {
+    return {
+      "/scim/v2/ServiceProviderConfig": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async () =>
+            scimJson({
+              schemas: [CONFIG_SCHEMA],
+              patch: { supported: true },
+              bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+              filter: { supported: true, maxResults: 200 },
+              changePassword: { supported: false },
+              sort: { supported: false },
+              etag: { supported: false },
+              authenticationSchemes: [
+                {
+                  type: "oauthbearertoken",
+                  name: "OAuth Bearer Token",
+                  description: "Bearer token in the Authorization header.",
+                  specUri: "https://www.rfc-editor.org/rfc/rfc6750",
+                  primary: true,
+                },
+              ],
+            }),
+          ),
+        ),
+      },
+      "/scim/v2/Users": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const url = new URL(request.url);
+            const filter = url.searchParams.get("filter") ?? "";
+            const match = /userName\\s+eq\\s+"([^"]+)"/i.exec(filter);
+            let rows: UserRow[];
+            if (match?.[1]) {
+              rows = await getSql().unsafe<UserRow[]>(
+                "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+                [match[1].trim().toLowerCase()],
+              );
+            } else {
+              rows = await getSql().unsafe<UserRow[]>("SELECT id, name, email FROM users");
+            }
+            const startIndex = Math.max(1, Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10) || 1);
+            const count = Math.min(200, Math.max(1, Number.parseInt(url.searchParams.get("count") ?? String(rows.length || 1), 10) || 200));
+            const slice = rows.slice(startIndex - 1, startIndex - 1 + count);
+            return scimJson({
+              schemas: [LIST_SCHEMA],
+              totalResults: rows.length,
+              startIndex,
+              itemsPerPage: slice.length,
+              Resources: slice.map(toScimUser),
+            });
+          }),
+        ),
+        POST: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const body = (await request.json()) as Record<string, unknown>;
+            const email = readUserName(body);
+            const name = readName(body, email.split("@")[0] ?? "User");
+            if (!email) {
+              return scimError("userName is required.", 400);
+            }
+            const existing = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+              [email],
+            );
+            if (existing[0]) {
+              return scimError("User already exists.", 409);
+            }
+            const hashed = await hashPassword(randomBytes(18).toString("hex"));
+            const tenantId = currentTenant()?.id ?? 1;
+            await getSql().unsafe(
+              "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+              [name, email, hashed${insertTail}],
+            );
+            const created = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+              [email],
+            );
+            const row = created[0];
+            if (!row) {
+              return scimError("Could not create user.", 500);
+            }
+            return scimJson(toScimUser(row), 201);
+          }),
+        ),
+      },
+      "/scim/v2/Users/:id": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const rows = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = rows[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            return scimJson(toScimUser(row));
+          }),
+        ),
+        PUT: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const body = (await request.json()) as Record<string, unknown>;
+            const email = readUserName(body);
+            const name = readName(body, email);
+            if (!email || !name) {
+              return scimError("userName and name are required.", 400);
+            }
+            await getSql().unsafe(
+              "UPDATE users SET name = ${updatePh.split(", ")[0]}, email = ${updatePh.split(", ")[1]} WHERE id = ${updatePh.split(", ")[2]}",
+              [name, email, id],
+            );
+            const rows = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = rows[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            return scimJson(toScimUser(row));
+          }),
+        ),
+        PATCH: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const existing = await getSql().unsafe<UserRow[]>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = existing[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            const body = (await request.json()) as { schemas?: string[]; Operations?: Array<{ op?: string; path?: string; value?: unknown }> };
+            if (body.schemas && !body.schemas.includes(PATCH_SCHEMA)) {
+              return scimError("Unsupported patch schema.", 400);
+            }
+            let name = row.name;
+            let email = row.email;
+            for (const operation of body.Operations ?? []) {
+              const op = (operation.op ?? "replace").toLowerCase();
+              if (op !== "replace" && op !== "add") {
+                continue;
+              }
+              const path = (operation.path ?? "").toLowerCase();
+              if (path === "username" || path === "emails") {
+                email = String(operation.value ?? email).trim().toLowerCase();
+              } else if (path === "name.formatted" || path === "displayname" || path === "name") {
+                if (typeof operation.value === "string") {
+                  name = operation.value.trim() || name;
+                } else if (operation.value && typeof operation.value === "object") {
+                  name = readName({ name: operation.value as Record<string, unknown> }, name);
+                }
+              } else if (!path && operation.value && typeof operation.value === "object") {
+                const value = operation.value as Record<string, unknown>;
+                email = readUserName(value) || email;
+                name = readName(value, name);
+              }
+            }
+            await getSql().unsafe(
+              "UPDATE users SET name = ${updatePh.split(", ")[0]}, email = ${updatePh.split(", ")[1]} WHERE id = ${updatePh.split(", ")[2]}",
+              [name, email, id],
+            );
+            return scimJson(toScimUser({ id: row.id, name, email }));
+          }),
+        ),
+        DELETE: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            await getSql().unsafe("DELETE FROM users WHERE id = ${idPh}", [id]);
+            return new Response(null, { status: 204 });
+          }),
+        ),
+      },
+    };
+  },
+};
+
+export default scimModule;
+`;
+}
+
 // src/generate.ts
 var PROJECT_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]*$/i;
 function starterPackageRoot() {
@@ -2317,7 +3758,7 @@ function writeGeneratedFiles(options) {
     removeIfExists(join2(targetDir, "docker-compose.yml"));
   }
   writeText(join2(src, "routes.ts"), renderRoutesTs());
-  writeText(join2(src, "lib/view.ts"), renderViewTs());
+  writeText(join2(src, "lib/view.ts"), renderViewTs(layers));
   writeText(join2(src, "bootstrap/config.ts"), renderConfigTs());
   writeText(join2(src, "bootstrap/preload.ts"), renderPreloadTs(layers, projectName));
   writeText(join2(src, "bootstrap/database.ts"), renderDatabaseTs(layers));
@@ -2350,10 +3791,32 @@ function writeGeneratedFiles(options) {
   if (authModule) {
     writeText(join2(src, "modules/auth/index.ts"), authModule);
   }
+  const scimModule = renderScimModule(layers);
+  if (scimModule) {
+    writeText(join2(src, "modules/scim/index.ts"), scimModule);
+  } else {
+    removeIfExists(join2(src, "modules/scim/index.ts"));
+  }
+  if (layers.extras.mfa && htmlAuthKit(layers.auth)) {
+    writeText(join2(src, "bootstrap/pendingMfa.ts"), renderPendingMfaTs());
+  } else {
+    removeIfExists(join2(src, "bootstrap/pendingMfa.ts"));
+  }
+  writeText(join2(targetDir, "public/assets/site.css"), renderSiteCss());
   writeText(join2(targetDir, "views/home.eta"), renderHomeView(projectName, layers));
   writeText(join2(targetDir, "views/layouts/app.eta"), renderLayout(layers, projectName));
-  if (authUsesCookie(layers.auth)) {
+  if (htmlAuthKit(layers.auth)) {
     writeText(join2(targetDir, "views/auth/login.eta"), renderLoginView());
+    writeText(join2(targetDir, "views/auth/register.eta"), renderRegisterView());
+    writeText(join2(targetDir, "views/auth/forgot-password.eta"), renderForgotPasswordView());
+    writeText(join2(targetDir, "views/auth/reset-password.eta"), renderResetPasswordView());
+    if (layers.extras.emailVerification) {
+      writeText(join2(targetDir, "views/auth/verify-email.eta"), renderVerifyEmailView());
+    }
+    if (layers.extras.mfa) {
+      writeText(join2(targetDir, "views/auth/mfa-challenge.eta"), renderMfaChallengeView());
+      writeText(join2(targetDir, "views/auth/mfa-setup.eta"), renderMfaSetupView());
+    }
   }
   mkdirSync2(join2(targetDir, "storage"), { recursive: true });
   writeText(join2(targetDir, "storage/.gitkeep"), "");