@getstrata/starter 1.0.9 → 1.1.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 // @bun
 
 // src/generate.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, rmSync as rmSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, rmSync as rmSync2 } from "fs";
 import { basename, join as join2, resolve } from "path";
 
 // src/copy.ts
@@ -186,11 +186,7 @@ function dockerLayerForNeeded(layers, enabled) {
   if (!enabled || needed.length === 0) {
     return { enabled: false, services: emptyDockerServices() };
   }
-  const names = [...needed];
-  if (dockerDatabaseService(layers.database)) {
-    names.push("adminer");
-  }
-  return { enabled: true, services: enableDockerServices(names) };
+  return { enabled: true, services: enableDockerServices(needed) };
 }
 
 // src/presets.ts
@@ -1121,18 +1117,6 @@ async function resolveStarterPlan(flags, injected) {
 }
 
 // src/renderAuthFlows.ts
-function ph(layers, count, start = 1) {
-  if (layers.database === "postgres") {
-    return Array.from({ length: count }, (_, index) => `$${start + index}`).join(", ");
-  }
-  return Array.from({ length: count }, () => "?").join(", ");
-}
-function sqlFalse(layers) {
-  return layers.database === "postgres" ? "false" : "0";
-}
-function sqlTrue(layers) {
-  return layers.database === "postgres" ? "true" : "1";
-}
 function renderPendingMfaTs() {
   return `import { createHmac, timingSafeEqual } from "node:crypto";
 import { sessionSecret } from "./config.ts";
@@ -1147,11 +1131,13 @@ function sign(userId: number, issuedAt: number): string {
 
 export function pendingMfaSetCookie(userId: number): string {
   const issuedAt = Date.now();
-  return \`\${COOKIE}=\${sign(userId, issuedAt)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600\`;
+  const secure = process.env.APP_ENV === "production" || process.env.APP_ENV === "staging" ? "; Secure" : "";
+  return \`\${COOKIE}=\${sign(userId, issuedAt)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600\${secure}\`;
 }
 
 export function pendingMfaClearCookie(): string {
-  return \`\${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\`;
+  const secure = process.env.APP_ENV === "production" || process.env.APP_ENV === "staging" ? "; Secure" : "";
+  return \`\${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\${secure}\`;
 }
 
 export function readPendingMfaUserId(request: Request): number | null {
@@ -1193,17 +1179,12 @@ function renderAuthModule(layers) {
   const verify = Boolean(layers.extras.emailVerification);
   const jsonApi = authUsesToken(layers.auth) || authUsesJwt(layers.auth);
   const tenantInsert = usesTenantTable(layers.tenancy);
-  const insertCols = tenantInsert ? "name, email, password, is_admin, tenant_id" : "name, email, password, is_admin";
-  const insertPh = tenantInsert ? ph(layers, 5) : ph(layers, 4);
-  const insertTail = tenantInsert ? `, ${sqlFalse(layers)}, 1` : `, ${sqlFalse(layers)}`;
-  const passwordPh = `${ph(layers, 1)}`;
-  const emailPh = `${ph(layers, 1, 2)}`;
-  const idPh = `${ph(layers, 1, 2)}`;
-  const verifiedPh = `${ph(layers, 1)}`;
-  const mfaUpdatePh = `${ph(layers, 1)}, ${ph(layers, 1, 2)}, ${ph(layers, 1, 3)}`;
-  const mfaIdPh = `${ph(layers, 1, 4)}`;
+  const tenantCreateField = tenantInsert ? `
+                tenant_id: currentTenantId(),` : "";
+  const samlTenantCreateField = tenantInsert ? `
+                  tenant_id: currentTenantId(),` : "";
   const imports = [];
-  if (authUsesToken(layers.auth)) {
+  if (authUsesToken(layers.auth) || cookie) {
     imports.push(`import { randomBytes } from "node:crypto";`);
   }
   imports.push(`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`);
@@ -1212,6 +1193,7 @@ function renderAuthModule(layers) {
     imports.push(`import { parseFormBody } from "@getstrata/bootstrap/web/forms";`);
     imports.push(`import { wrapWebLogin, wrapWebRegister } from "@getstrata/bootstrap/web/routing";`);
     imports.push(`import type { CookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+    imports.push(`import { createSamlServiceProvider } from "@getstrata/core/auth/saml/samlServiceProvider";`);
   }
   if (jsonApi) {
     imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
@@ -1220,28 +1202,49 @@ function renderAuthModule(layers) {
     imports.push(`import { jwtTtlSeconds, signJwt } from "@getstrata/core/auth/jwt";`);
   }
   imports.push(`import { hashPassword, verifyPassword } from "@getstrata/core/auth/password";`);
+  imports.push(`import { AUTH_ONE_TIME_PURPOSES, consumeOneTimeToken, generateOneTimeToken, hashOneTimeToken, revokeUserSessions as revokeStoredUserSessions } from "@getstrata/core/auth/oneTimeToken";`);
+  imports.push(`import { completePasswordLogin, persistConsumedRecoveryHash } from "@getstrata/core/auth/passwordLogin";`);
+  if (mfa) {
+    imports.push(`import { createPasswordConfirmCookie } from "@getstrata/core/auth/passwordConfirmCookie";`);
+  }
+  imports.push(`import { emailRule, minLength, required, stringRule, validateObject } from "@getstrata/core/validation/rules";`);
+  imports.push(`import { parseJsonBody } from "@getstrata/core/http/validation";`);
   if (authUsesToken(layers.auth)) {
     imports.push(`import { hashApiToken } from "@getstrata/core/auth/tokenHash";`);
     imports.push(`import { sqlTimestamp } from "@getstrata/core/database/dialect";`);
     imports.push(`import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";`);
   }
   if (mfa) {
-    imports.push(`import { protectMfaSecret, revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";`);
+    imports.push(`import { protectMfaSecret } from "@getstrata/core/crypto/mfaSecret";`);
   }
   if (cookie) {
     imports.push(`import { flashResponse } from "@getstrata/core/http/flashSession";`);
+    if (mfa) {
+      imports.push(`import { sanitizeInternalPath } from "@getstrata/core/http/safeInternalPath";`);
+    }
+    imports.push(`import { createOAuthState, verifyOAuthState } from "@getstrata/core/security/oauthState";`);
   }
-  if (jsonApi) {
+  if (jsonApi || cookie) {
     imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
+    imports.push(`import { resolveCsrfTokenForRequest } from "@getstrata/core/http/csrfToken";`);
   }
-  imports.push(`import { absoluteTemporarySignedUrl, assertValidSignature } from "@getstrata/core/http/signedUrl";`);
+  imports.push(cookie && verify ? `import { absoluteTemporarySignedUrl, assertValidSignature } from "@getstrata/core/http/signedUrl";` : `import { absoluteTemporarySignedUrl } from "@getstrata/core/http/signedUrl";`);
   imports.push(`import { mailer } from "@getstrata/core/mail/mailer";`);
   if (mfa) {
-    imports.push(`import { generateRecoveryCodes, hashRecoveryCode, recoveryCodeMatches } from "@getstrata/core/security/recoveryCodes";`);
+    imports.push(`import { generateRecoveryCodes, hashRecoveryCode } from "@getstrata/core/security/recoveryCodes";`);
     imports.push(`import { buildOtpauthUrl, generateTotpSecret, verifyTotp } from "@getstrata/core/security/totp";`);
   }
+  if (tenantInsert) {
+    imports.push(`import { currentTenantId } from "@getstrata/core/tenant/tenantContext";`);
+  }
+  imports.push(`import { runWithMigrationBypassForIdentifier } from "@getstrata/core/tenant/databaseTenantContext";`);
   imports.push(`import { starterAuthDirectory } from "../../bootstrap/authDirectory.ts";`);
   imports.push(`import { getSql } from "../../bootstrap/database.ts";`);
+  imports.push(`import { User } from "../../models/User.ts";`);
+  imports.push(`import { AuthOneTimeToken } from "../../models/AuthOneTimeToken.ts";`);
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { ApiToken } from "../../models/ApiToken.ts";`);
+  }
   if (cookie) {
     imports.push(`import { renderPage } from "../../lib/view.ts";`);
   }
@@ -1249,14 +1252,85 @@ function renderAuthModule(layers) {
     imports.push(`import { pendingMfaClearCookie, pendingMfaSetCookie, readPendingMfaUserId } from "../../bootstrap/pendingMfa.ts";`);
   }
   const helpers = `
-async function sendSignedMail(to: string, subject: string, path: string, query: Record<string, string>) {
-  const link = absoluteTemporarySignedUrl(path, 3600, query);
+function parseLoginCredentials(payload: unknown) {
+  const body = validateObject(payload, {
+    email: [required(), stringRule(), emailRule()],
+    password: [required(), stringRule()],
+    mfa_code: [stringRule()],
+  });
+  return {
+    email: String(body.email).toLowerCase(),
+    password: String(body.password ?? ""),
+    mfa_code: typeof body.mfa_code === "string" ? body.mfa_code : undefined,
+  };
+}
+
+function parseRegisterCredentials(payload: unknown) {
+  const body = validateObject(payload, {
+    name: [required(), stringRule()],
+    email: [required(), stringRule(), emailRule()],
+    password: [required(), stringRule(), minLength(8)],
+  });
+  return {
+    name: String(body.name ?? ""),
+    email: String(body.email).toLowerCase(),
+    password: String(body.password ?? ""),
+  };
+}
+
+function parseForgotPasswordEmail(payload: unknown) {
+  const body = validateObject(payload, {
+    email: [required(), stringRule(), emailRule()],
+  });
+  return String(body.email).toLowerCase();
+}
+
+async function runAuthWrite<T>(identifier: string | number, callback: () => Promise<T>): Promise<T> {
+  return await runWithMigrationBypassForIdentifier(identifier, callback);
+}
+
+async function issueSignedAuthMail(to: string, subject: string, path: string, purpose: string, userId: number, extra: Record<string, string> = {}) {
+  const issued = generateOneTimeToken();
+  const expiresAt = new Date(Date.now() + 60 * 60 * 1000);
+  await runAuthWrite(userId, async () => {
+    await AuthOneTimeToken.create({
+      purpose,
+      user_id: userId,
+      token_hash: issued.hash,
+      expires_at: expiresAt.toISOString(),
+    });
+  });
+  const link = absoluteTemporarySignedUrl(path, 3600, { ...extra, token: issued.plain });
   await mailer().send({
     to,
     subject,
     body: \`\${subject}\\n\\n\${link}\\n\`,
   });
 }
+
+async function consumeSignedAuthToken(request: Request, purpose: string): Promise<number | null> {
+  const token = new URL(request.url).searchParams.get("token") ?? "";
+  if (!token) {
+    return null;
+  }
+  return await runAuthWrite(hashOneTimeToken(token), async () => consumeOneTimeToken(getSql(), purpose, token));
+}
+
+async function revokeUserSessions(userId: number) {
+  await runAuthWrite(userId, async () => {
+    await revokeStoredUserSessions(getSql(), userId);
+  });
+}
+
+async function persistAuthRecovery(
+  userId: number,
+  currentRaw: string | null | undefined,
+  consumedHash: string | undefined,
+) {
+  await runAuthWrite(userId, async () => {
+    await persistConsumedRecoveryHash(getSql(), userId, currentRaw, consumedHash);
+  });
+}
 ${cookie ? `
 function redirectTo(path: string, status = 302): Response {
   return new Response(null, { status, headers: { location: path } });
@@ -1273,32 +1347,39 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
 ` : ""}`;
   const tokenLogin = authUsesToken(layers.auth) ? `
         "/api/v1/auth/login": {
-          POST: kernel.wrap("api", withErrorHandling(async (request) => {
-            const body = (await request.json()) as { email?: string; password?: string };
-            const email = (body.email ?? "").trim().toLowerCase();
-            const password = body.password ?? "";
-            const user = await starterAuthDirectory.verifyCredentials?.(email, password);
-            if (!user) {
+          POST: kernel.wrap("api", kernel.wrapLogin(withErrorHandling(async (request) => {
+            const { email, password, mfa_code } = await parseJsonBody(request, parseLoginCredentials);
+            const record = await starterAuthDirectory.findByEmail?.(email);
+            if (!record?.password || !(await verifyPassword(password, record.password))) {
               return jsonResponse({ error: "Invalid credentials" }, { status: 422 });
             }
+            const mfaResult = completePasswordLogin(record, { mfaCode: mfa_code });
+            if (!mfaResult.ok) {
+              return jsonResponse({ error: mfaResult.error }, { status: mfaResult.error === "mfa_required" ? 401 : 422 });
+            }
+            await persistAuthRecovery(record.id, record.mfa_recovery_codes, mfaResult.consumedRecoveryHash);
+            const user = { id: record.id, role: record.role };
             const plain = \`strp_\${randomBytes(24).toString("hex")}\`;
             // API_TOKEN_DEFAULT_EXPIRY_DAYS bounds every minted token; unset means no expiry.
             const expiryDays = resolveDefaultTokenExpiryDays();
             const expiresAt = expiryDays
               ? new Date(Date.now() + expiryDays * 24 * 60 * 60 * 1000)
               : null;
-            await getSql().unsafe(
-              "INSERT INTO api_tokens (user_id, name, token_hash, abilities, expires_at) VALUES (${ph(layers, 5)})",
-              [
-                user.id,
-                "spa",
-                hashApiToken(plain),
-                JSON.stringify(["profile:read"]),
-                expiresAt ? sqlTimestamp(expiresAt) : null,
-              ],
-            );
-            return jsonResponse({ token: plain, expires_at: expiresAt?.toISOString() ?? null });
-          })),
+            await runAuthWrite(user.id, async () => {
+              await ApiToken.create({
+                user_id: user.id,
+                name: "spa",
+                token_hash: hashApiToken(plain),
+                abilities: JSON.stringify([]),
+                expires_at: expiresAt ? sqlTimestamp(expiresAt) : null,
+              });
+            });
+            const payload = jsonResponse({ token: plain, expires_at: expiresAt?.toISOString() ?? null });
+            ${cookie ? `const sessionAuth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+            const { setCookie } = await sessionAuth.signIn(sessionUser(record));
+            payload.headers.append("set-cookie", setCookie);
+            ` : ""}return payload;
+          }))),
         },
         "/api/v1/auth/me": {
           GET: kernel.wrapApi(async (request) => {
@@ -1314,43 +1395,50 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
         },` : "";
   const jsonRegister = jsonApi ? `
         "/api/v1/auth/register": {
-          POST: kernel.wrap("api", withErrorHandling(async (request) => {
-            const body = (await request.json()) as { name?: string; email?: string; password?: string };
-            const name = (body.name ?? "").trim();
-            const email = (body.email ?? "").trim().toLowerCase();
-            const password = body.password ?? "";
-            if (!name || !email || password.length < 8) {
-              return jsonResponse({ error: "Name, email, and a password of 8+ characters are required." }, { status: 422 });
+          POST: kernel.wrap("api", kernel.wrapRegister(withErrorHandling(async (request) => {
+            if ((process.env.FEATURE_REGISTRATION ?? "true") === "false") {
+              return jsonResponse({ error: "Not found" }, { status: 404 });
             }
-            if (await starterAuthDirectory.findByEmail?.(email)) {
-              return jsonResponse({ error: "Email is already registered." }, { status: 422 });
+            const { name, email, password } = await parseJsonBody(request, parseRegisterCredentials);
+            const existing = await starterAuthDirectory.findByEmail?.(email);
+            await hashPassword(password);
+            if (existing) {
+              return jsonResponse({ ok: true }, { status: 201 });
             }
             const hashed = await hashPassword(password);
-            await getSql().unsafe(
-              "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
-              [name, email, hashed${insertTail}],
-            );
+            await runAuthWrite(email, async () => {
+              await User.create({
+                name,
+                email,
+                password: hashed,
+                is_admin: false,${tenantCreateField}
+              });
+            });
             const created = await starterAuthDirectory.findByEmail?.(email);
             ${verify ? `if (created) {
-              await sendSignedMail(email, "Verify your email", "/api/v1/auth/verify-email", { id: String(created.id) });
+              await issueSignedAuthMail(email, "Verify your email", "/api/v1/auth/verify-email", AUTH_ONE_TIME_PURPOSES.emailVerify, created.id, { id: String(created.id) });
             }` : ""}
             return jsonResponse({ ok: true }, { status: 201 });
-          })),
+          }))),
         },` : "";
   const jwtLogin = authUsesJwt(layers.auth) ? `
         "/api/auth/token": {
-          POST: kernel.wrap("api", withErrorHandling(async (request) => {
-            const body = (await request.json()) as { email?: string; password?: string };
-            const email = (body.email ?? "").trim().toLowerCase();
-            const password = body.password ?? "";
-            const user = await starterAuthDirectory.verifyCredentials?.(email, password);
-            if (!user) {
+          POST: kernel.wrap("api", kernel.wrapLogin(withErrorHandling(async (request) => {
+            const { email, password, mfa_code } = await parseJsonBody(request, parseLoginCredentials);
+            const record = await starterAuthDirectory.findByEmail?.(email);
+            if (!record?.password || !(await verifyPassword(password, record.password))) {
               return jsonResponse({ error: "Invalid credentials" }, { status: 422 });
             }
+            const mfaResult = completePasswordLogin(record, { mfaCode: mfa_code });
+            if (!mfaResult.ok) {
+              return jsonResponse({ error: mfaResult.error }, { status: mfaResult.error === "mfa_required" ? 401 : 422 });
+            }
+            await persistAuthRecovery(record.id, record.mfa_recovery_codes, mfaResult.consumedRecoveryHash);
+            const user = { id: record.id, role: record.role, emailVerifiedAt: record.email_verified_at ?? null };
             const token = signJwt({
               sub: user.id,
               role: user.role,
-              abilities: user.role === "admin" ? ["profile:read", "reports:export"] : ["profile:read"],${verify ? `
+              abilities: [],${verify ? `
               emailVerifiedAt: user.emailVerifiedAt ?? null,` : ""}
             });
             return jsonResponse({
@@ -1358,7 +1446,7 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
               token_type: "bearer",
               expires_in: jwtTtlSeconds(),
             });
-          })),
+          }))),
         },` : "";
   const apiUser = jsonApi ? `
         "/api/user": {
@@ -1366,64 +1454,195 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
             const user = await dependencies.container.resolve<AuthManager>(CORE_AUTH_TOKEN).requireUser(request);
             return jsonResponse({ id: user.id, role: user.role ?? "member" });
           }),
+        },
+        "/api/v1/auth/logout": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const payload = jsonResponse({ ok: true });
+            ${cookie ? `const sessionAuth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+            const { setCookie } = await sessionAuth.signOut(request);
+            payload.headers.append("set-cookie", setCookie);
+            ` : ""}return payload;
+          })),
         },` : "";
   const jsonPassword = jsonApi ? `
         "/api/v1/auth/forgot-password": {
           POST: kernel.wrap("api", withErrorHandling(async (request) => {
-            const body = (await request.json()) as { email?: string };
-            const email = (body.email ?? "").trim().toLowerCase();
+            const email = await parseJsonBody(request, parseForgotPasswordEmail);
             const user = await starterAuthDirectory.findByEmail?.(email);
             if (user) {
-              await sendSignedMail(email, "Reset your password", "/api/v1/auth/reset-password", { email });
+              await issueSignedAuthMail(email, "Reset your password", "/api/v1/auth/reset-password", AUTH_ONE_TIME_PURPOSES.passwordReset, user.id, { email });
             }
             return jsonResponse({ ok: true });
           })),
         },
         "/api/v1/auth/reset-password": {
-          POST: kernel.wrap("api", withErrorHandling(async (request) => {
-            assertValidSignature(request);
+          POST: kernel.wrap("api", kernel.wrapSigned(withErrorHandling(async (request) => {
+            const userId = await consumeSignedAuthToken(request, AUTH_ONE_TIME_PURPOSES.passwordReset);
             const body = (await request.json()) as { password?: string };
-            const email = new URL(request.url).searchParams.get("email") ?? "";
-            if (!email || !(body.password && body.password.length >= 8)) {
-              return jsonResponse({ error: "Invalid reset payload." }, { status: 422 });
+            const nextPassword = body.password ?? "";
+            if (!userId || nextPassword.length < 8) {
+              return jsonResponse({ error: "Invalid or expired reset link." }, { status: 403 });
             }
-            await getSql().unsafe(
-              "UPDATE users SET password = ${passwordPh} WHERE email = ${emailPh}",
-              [await hashPassword(body.password), email],
-            );
+            await runAuthWrite(userId, async () => {
+              const user = await User.find(userId);
+              await user?.update({ password: await hashPassword(nextPassword) });
+            });
+            await revokeUserSessions(userId);
             return jsonResponse({ ok: true });
-          })),
+          }))),
         },` : "";
   const jsonVerify = jsonApi && verify ? `
         "/api/v1/auth/verify-email": {
-          POST: kernel.wrap("api", withErrorHandling(async (request) => {
-            assertValidSignature(request);
-            const id = Number.parseInt(new URL(request.url).searchParams.get("id") ?? "", 10);
-            if (!Number.isInteger(id) || id <= 0) {
-              return jsonResponse({ error: "Invalid verification link." }, { status: 422 });
+          POST: kernel.wrap("api", kernel.wrapSigned(withErrorHandling(async (request) => {
+            const id = await consumeSignedAuthToken(request, AUTH_ONE_TIME_PURPOSES.emailVerify);
+            if (!id) {
+              return jsonResponse({ error: "Invalid or expired verification link." }, { status: 403 });
             }
-            await getSql().unsafe(
-              "UPDATE users SET email_verified_at = ${verifiedPh} WHERE id = ${idPh}",
-              [${nowTimestampLiteral(layers.database)}, id],
-            );
+            await runAuthWrite(id, async () => {
+              const user = await User.find(id);
+              await user?.update({ email_verified_at: ${nowTimestampLiteral(layers.database)} });
+            });
             return jsonResponse({ ok: true });
+          }))),
+        },` : "";
+  const csrfRoute = `
+        "/api/v1/auth/csrf": {
+          GET: kernel.wrap("api", withErrorHandling(async (request) => {
+            return jsonResponse({ token: resolveCsrfTokenForRequest(request) });
+          })),
+        },`;
+  const cookieJsonAuth = cookie && !jsonApi ? `
+        "/api/v1/auth/login": {
+          POST: kernel.wrap("api", kernel.wrapLogin(withErrorHandling(async (request) => {
+            const { email, password, mfa_code } = await parseJsonBody(request, parseLoginCredentials);
+            const record = await starterAuthDirectory.findByEmail?.(email);
+            if (!record?.password || !(await verifyPassword(password, record.password))) {
+              return jsonResponse({ error: "Invalid credentials" }, { status: 422 });
+            }
+            const mfaResult = completePasswordLogin(record, { mfaCode: mfa_code });
+            if (!mfaResult.ok) {
+              return jsonResponse({ error: mfaResult.error }, { status: mfaResult.error === "mfa_required" ? 401 : 422 });
+            }
+            await persistAuthRecovery(record.id, record.mfa_recovery_codes, mfaResult.consumedRecoveryHash);
+            const sessionAuth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+            const { setCookie } = await sessionAuth.signIn(sessionUser(record));
+            const payload = jsonResponse({ ok: true });
+            payload.headers.append("set-cookie", setCookie);
+            return payload;
+          }))),
+        },
+        "/api/v1/auth/me": {
+          GET: kernel.wrapApi(async (request) => {
+            const user = await dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN).requireUser(request);
+            const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
+            return jsonResponse({
+              id: record.id,
+              name: record.name ?? record.email,
+              email: record.email,
+              role: record.role,
+            });
+          }),
+        },
+        "/api/v1/auth/logout": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const sessionAuth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+            const { setCookie } = await sessionAuth.signOut(request);
+            const payload = jsonResponse({ ok: true });
+            payload.headers.append("set-cookie", setCookie);
+            return payload;
           })),
         },` : "";
-  const apiRoutes = jsonApi ? `
+  const samlRoutes = cookie ? `
+        "/auth/saml": {
+          GET: kernel.wrap("api", withErrorHandling(async () => {
+            if (process.env.FEATURE_SAML !== "true") {
+              return new Response("Not found", { status: 404 });
+            }
+            const issued = createOAuthState();
+            const url = await createSamlServiceProvider().authorizationUrl(issued.state);
+            return new Response(null, { status: 302, headers: { location: url } });
+          })),
+        },
+        "/auth/saml/acs": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            if (process.env.FEATURE_SAML !== "true") {
+              return new Response("Not found", { status: 404 });
+            }
+            const form = await request.formData();
+            const samlResponse = String(form.get("SAMLResponse") ?? "");
+            const relayState = String(form.get("RelayState") ?? "");
+            if (!verifyOAuthState(request, relayState)) {
+              return jsonResponse({ error: "Invalid SAML state." }, { status: 403 });
+            }
+            const profile = await createSamlServiceProvider()
+              .consumePost(samlResponse, relayState)
+              .catch(() => null);
+            if (!profile) {
+              return jsonResponse({ error: "Invalid SAML response." }, { status: 400 });
+            }
+            let record = await starterAuthDirectory.findByEmail?.(profile.email);
+            if (!record) {
+              if ((process.env.FEATURE_REGISTRATION ?? "true") === "false") {
+                return jsonResponse({ error: "SAML user is not provisioned." }, { status: 403 });
+              }
+              const hashed = await hashPassword(randomBytes(18).toString("hex"));
+              try {
+                await runAuthWrite(profile.email, async () => {
+                  await User.create({
+                    name: profile.name,
+                    email: profile.email,
+                    password: hashed,
+                    is_admin: false,${samlTenantCreateField}
+                  });
+                });
+              } catch {
+                // Unique email: another request already provisioned this user.
+              }
+              record = await starterAuthDirectory.findByEmail?.(profile.email);
+            }
+            if (!record) {
+              return jsonResponse({ error: "Could not complete SAML login." }, { status: 500 });
+            }
+            ${mfa ? `if (record.mfa_enabled) {
+              const pending = redirectTo("/login/mfa");
+              pending.headers.append("set-cookie", pendingMfaSetCookie(record.id));
+              return pending;
+            }
+            ` : ""}const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+            return auth.signInRedirect(sessionUser(record), "/");
+          })),
+        },` : "";
+  const apiRoutes = jsonApi || cookie ? `
     routes({ kernel, dependencies }) {
-      return {${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
+      return {${csrfRoute}${samlRoutes}${cookieJsonAuth}${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
       };
     },` : "";
-  const mfaLoginBranch = mfa ? `if (user.mfa_enabled) {
-                const pending = redirectTo("/login/mfa");
-                pending.headers.append("set-cookie", pendingMfaSetCookie(user.id));
-                return pending;
-              }` : "";
-  const verifyRegisterBranch = verify ? `await sendSignedMail(email, "Verify your email", "/email/verify", { id: String(insertedId) });
+  const mfaLoginBranch = `const mfaResult = completePasswordLogin(user, { mfaCode: mfa_code });
+              if (!mfaResult.ok) {
+                ${mfa ? `if (mfaResult.error === "mfa_required") {
+                  const pending = redirectTo("/login/mfa");
+                  pending.headers.append("set-cookie", pendingMfaSetCookie(user.id));
+                  return pending;
+                }` : ""}
+                return renderPage(
+                  "auth/login.eta",
+                  { layout: { title: "Sign in" }, errors: { email: "These credentials do not match our records." }, email, password: "" },
+                  request,
+                );
+              }
+              await persistAuthRecovery(user.id, user.mfa_recovery_codes, mfaResult.consumedRecoveryHash);`;
+  const registerSuccessExisting = `return flashResponse(
+                redirectTo("/login"),
+                { level: "success", message: "If that email is available, continue from the sign-in page." },
+              );`;
+  const verifyRegisterBranch = verify ? `await issueSignedAuthMail(email, "Verify your email", "/email/verify", AUTH_ONE_TIME_PURPOSES.emailVerify, insertedId, { id: String(insertedId) });
               return flashResponse(
-                await auth.signInRedirect(sessionUser({ id: insertedId, name, email, role: "member" }), "/email/verify"),
-                { level: "info", message: "Check your email for a verification link." },
-              );` : `return auth.signInRedirect(sessionUser({ id: insertedId, name, email, role: "member" }), "/");`;
+                redirectTo("/login"),
+                { level: "success", message: "If that email is available, continue from the sign-in page." },
+              );` : `return flashResponse(
+                redirectTo("/login"),
+                { level: "success", message: "If that email is available, continue from the sign-in page." },
+              );`;
   const cookieRoutes = cookie ? `
     webRoutes({ kernel, dependencies }) {
       const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
@@ -1436,8 +1655,7 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
             kernel,
             async (request) => {
               const { fields } = await parseFormBody(request);
-              const email = (fields.email ?? "").trim().toLowerCase();
-              const password = fields.password ?? "";
+              const { email, password, mfa_code } = parseLoginCredentials(fields);
               const user = await starterAuthDirectory.findByEmail?.(email);
               if (!user?.password || !(await verifyPassword(password, user.password))) {
                 return renderPage(
@@ -1459,44 +1677,37 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
           ),
         },
         "/register": {
-          GET: kernel.wrapWebGuest(async (request) =>
-            renderPage("auth/register.eta", { layout: { title: "Create account" }, errors: {}, name: "", email: "", password: "" }, request),
-          ),
+          GET: kernel.wrapWebGuest(async (request) => {
+            if ((process.env.FEATURE_REGISTRATION ?? "true") === "false") {
+              return new Response("Not found", { status: 404 });
+            }
+            return renderPage("auth/register.eta", { layout: { title: "Create account" }, errors: {}, name: "", email: "", password: "" }, request);
+          }),
           POST: wrapWebRegister(
             kernel,
             async (request) => {
-              const { fields } = await parseFormBody(request);
-              const name = (fields.name ?? "").trim();
-              const email = (fields.email ?? "").trim().toLowerCase();
-              const password = fields.password ?? "";
-              const errors: Record<string, string> = {};
-              if (!name) {
-                errors.name = "Name is required.";
-              }
-              if (!email) {
-                errors.email = "Email is required.";
-              }
-              if (password.length < 8) {
-                errors.password = "Use at least 8 characters.";
-              }
-              if (email && (await starterAuthDirectory.findByEmail?.(email))) {
-                errors.email = "Email is already registered.";
+              if ((process.env.FEATURE_REGISTRATION ?? "true") === "false") {
+                return new Response("Not found", { status: 404 });
               }
-              if (Object.keys(errors).length > 0) {
-                return renderPage(
-                  "auth/register.eta",
-                  { layout: { title: "Create account" }, errors, name, email, password: "" },
-                  request,
-                );
+              const { fields } = await parseFormBody(request);
+              const { name, email, password } = parseRegisterCredentials(fields);
+              const existing = await starterAuthDirectory.findByEmail?.(email);
+              await hashPassword(password);
+              if (existing) {
+                ${registerSuccessExisting}
               }
               const hashed = await hashPassword(password);
-              await getSql().unsafe(
-                "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
-                [name, email, hashed${insertTail}],
-              );
-              const created = await starterAuthDirectory.findByEmail?.(email);
+              await runAuthWrite(email, async () => {
+                await User.create({
+                  name,
+                  email,
+                  password: hashed,
+                  is_admin: false,${tenantCreateField}
+                });
+              });
+              ${verify ? `const created = await starterAuthDirectory.findByEmail?.(email);
               const insertedId = created?.id ?? 0;
-              ${verifyRegisterBranch}
+              ${verifyRegisterBranch}` : verifyRegisterBranch}
             },
             async (request) =>
               renderPage(
@@ -1513,10 +1724,10 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
           ),
           POST: kernel.wrapWeb(async (request) => {
             const { fields } = await parseFormBody(request);
-            const email = (fields.email ?? "").trim().toLowerCase();
+            const email = parseForgotPasswordEmail(fields);
             const user = await starterAuthDirectory.findByEmail?.(email);
             if (user) {
-              await sendSignedMail(email, "Reset your password", "/reset-password", { email });
+              await issueSignedAuthMail(email, "Reset your password", "/reset-password", AUTH_ONE_TIME_PURPOSES.passwordReset, user.id, { email });
             }
             return flashResponse(redirectTo("/forgot-password"), {
               level: "success",
@@ -1525,33 +1736,33 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
           }),
         },
         "/reset-password": {
-          GET: kernel.wrapWebGuest(async (request) => {
-            assertValidSignature(request);
+          GET: kernel.wrapWeb(kernel.wrapSigned(async (request) => {
             const email = new URL(request.url).searchParams.get("email") ?? "";
             return renderPage(
               "auth/reset-password.eta",
               { layout: { title: "Reset password" }, errors: {}, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
               request,
             );
-          }),
-          POST: kernel.wrapWeb(async (request) => {
-            assertValidSignature(request);
+          })),
+          POST: kernel.wrapWeb(kernel.wrapSigned(async (request) => {
+            const userId = await consumeSignedAuthToken(request, AUTH_ONE_TIME_PURPOSES.passwordReset);
             const { fields } = await parseFormBody(request);
             const email = new URL(request.url).searchParams.get("email") ?? fields.email ?? "";
             const password = fields.password ?? "";
-            if (!email || password.length < 8) {
+            if (!userId || !email || password.length < 8) {
               return renderPage(
                 "auth/reset-password.eta",
-                { layout: { title: "Reset password" }, errors: { password: "Use at least 8 characters." }, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
+                { layout: { title: "Reset password" }, errors: { password: "Invalid or expired reset link." }, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
                 request,
               );
             }
-            await getSql().unsafe(
-              "UPDATE users SET password = ${passwordPh} WHERE email = ${emailPh}",
-              [await hashPassword(password), email],
-            );
+            await runAuthWrite(userId, async () => {
+              const user = await User.find(userId);
+              await user?.update({ password: await hashPassword(password) });
+            });
+            await revokeUserSessions(userId);
             return flashResponse(redirectTo("/login"), { level: "success", message: "Password updated. Sign in." });
-          }),
+          })),
         },
         "/logout": {
           POST: kernel.wrapWebAuthenticatedAllowUnverified((request) => auth.signOutRedirect(request, "/")),
@@ -1561,18 +1772,21 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
             const url = new URL(request.url);
             if (url.searchParams.get("signature")) {
               assertValidSignature(request);
-              const id = Number.parseInt(url.searchParams.get("id") ?? "", 10);
-              if (Number.isInteger(id) && id > 0) {
-                await getSql().unsafe(
-                  "UPDATE users SET email_verified_at = ${verifiedPh} WHERE id = ${idPh}",
-                  [${nowTimestampLiteral(layers.database)}, id],
-                );
-                const record = await starterAuthDirectory.findByIdOrThrow(id);
+              const id = await consumeSignedAuthToken(request, AUTH_ONE_TIME_PURPOSES.emailVerify);
+              if (id) {
+                await runAuthWrite(id, async () => {
+                  const user = await User.find(id);
+                  await user?.update({ email_verified_at: ${nowTimestampLiteral(layers.database)} });
+                });
                 return flashResponse(
-                  await auth.signInRedirect(sessionUser(record), "/"),
-                  { level: "success", message: "Email verified." },
+                  redirectTo("/login"),
+                  { level: "success", message: "Email verified. Sign in." },
                 );
               }
+              return flashResponse(
+                redirectTo("/login"),
+                { level: "error", message: "Invalid or expired verification link." },
+              );
             }
             return renderPage("auth/verify-email.eta", { layout: { title: "Verify email" } }, request);
           }),
@@ -1582,7 +1796,7 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
             const user = await auth.user(request);
             if (user) {
               const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
-              await sendSignedMail(record.email ?? "", "Verify your email", "/email/verify", { id: String(record.id) });
+              await issueSignedAuthMail(record.email ?? "", "Verify your email", "/email/verify", AUTH_ONE_TIME_PURPOSES.emailVerify, Number(record.id), { id: String(record.id) });
             }
             return flashResponse(redirectTo("/email/verify"), { level: "info", message: "Verification link sent." });
           }),
@@ -1594,7 +1808,9 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
             }
             return renderPage("auth/mfa-challenge.eta", { layout: { title: "MFA" }, errors: {}, code: "" }, request);
           }),
-          POST: kernel.wrapWeb(async (request) => {
+          POST: wrapWebLogin(
+            kernel,
+            async (request) => {
             const pendingId = readPendingMfaUserId(request);
             if (!pendingId) {
               return redirectTo("/login");
@@ -1602,29 +1818,51 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
             const { fields } = await parseFormBody(request);
             const submitted = (fields.code ?? "").trim();
             const record = await starterAuthDirectory.findByIdOrThrow(pendingId);
-            const secret = revealMfaSecret(record.mfa_secret ?? null);
-            const hashedCodes: string[] = record.mfa_recovery_codes
-              ? (JSON.parse(record.mfa_recovery_codes) as string[])
-              : [];
-            const totpOk = secret ? verifyTotp(secret, submitted) : false;
-            const recoveryOk = hashedCodes.some((hash) => recoveryCodeMatches(submitted, hash));
-            if (!totpOk && !recoveryOk) {
+            const mfaResult = completePasswordLogin(record, { mfaCode: submitted });
+            if (!mfaResult.ok) {
               return renderPage(
                 "auth/mfa-challenge.eta",
                 { layout: { title: "MFA" }, errors: { code: "That code is not valid." }, code: "" },
                 request,
               );
             }
-            if (recoveryOk) {
-              const remaining = hashedCodes.filter((hash) => !recoveryCodeMatches(submitted, hash));
-              await getSql().unsafe(
-                "UPDATE users SET mfa_recovery_codes = ${passwordPh} WHERE id = ${idPh}",
-                [JSON.stringify(remaining), pendingId],
-              );
-            }
+            await persistAuthRecovery(pendingId, record.mfa_recovery_codes, mfaResult.consumedRecoveryHash);
             const signed = await auth.signInRedirect(sessionUser(record), "/");
             signed.headers.append("set-cookie", pendingMfaClearCookie());
             return signed;
+          },
+            async (request) =>
+              renderPage(
+                "auth/mfa-challenge.eta",
+                { layout: { title: "MFA" }, errors: { code: "Too many login attempts. Try again shortly." }, code: "" },
+                request,
+                429,
+              ),
+          ),
+        },
+        "/confirm-password": {
+          GET: kernel.wrapWebAuthenticated(async (request) =>
+            renderPage("auth/confirm-password.eta", { layout: { title: "Confirm password" }, errors: {}, password: "" }, request),
+          ),
+          POST: kernel.wrapWebAuthenticated(async (request) => {
+            const user = await auth.user(request);
+            if (!user) {
+              return redirectTo("/login");
+            }
+            const { fields } = await parseFormBody(request);
+            const password = fields.password ?? "";
+            const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
+            if (!record.password || !(await verifyPassword(password, record.password))) {
+              return renderPage(
+                "auth/confirm-password.eta",
+                { layout: { title: "Confirm password" }, errors: { password: "That password is not correct." }, password: "" },
+                request,
+              );
+            }
+            const next = sanitizeInternalPath(new URL(request.url).searchParams.get("redirect") ?? "/account/mfa");
+            const confirmed = redirectTo(next);
+            confirmed.headers.append("set-cookie", createPasswordConfirmCookie(Number(user.id)));
+            return confirmed;
           }),
         },
         "/account/mfa": {
@@ -1643,7 +1881,7 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
               request,
             );
           }),
-          POST: kernel.wrapWebAuthenticated(async (request) => {
+          POST: kernel.wrapWebPasswordConfirm(async (request) => {
             const user = await auth.user(request);
             if (!user) {
               return redirectTo("/login");
@@ -1666,10 +1904,15 @@ function sessionUser(user: { id: number; name?: string | null; email?: string |
             }
             const recoveryCodes = generateRecoveryCodes();
             const stored = protectMfaSecret(secret);
-            await getSql().unsafe(
-              "UPDATE users SET mfa_secret = ${mfaUpdatePh.split(", ")[0]}, mfa_enabled = ${mfaUpdatePh.split(", ")[1]}, mfa_recovery_codes = ${mfaUpdatePh.split(", ")[2]} WHERE id = ${mfaIdPh}",
-              [stored, ${sqlTrue(layers)}, JSON.stringify(recoveryCodes.map((item) => hashRecoveryCode(item))), Number(user.id)],
-            );
+            await runAuthWrite(Number(user.id), async () => {
+              const record = await User.find(Number(user.id));
+              await record?.update({
+                mfa_secret: stored,
+                mfa_enabled: true,
+                mfa_recovery_codes: JSON.stringify(recoveryCodes.map((item) => hashRecoveryCode(item))),
+              });
+            });
+            await revokeUserSessions(Number(user.id));
             return renderPage(
               "auth/mfa-setup.eta",
               {
@@ -1700,15 +1943,13 @@ export default authModule;
 function renderSiteModule(_layers) {
   return `import type { AppModule } from "@getstrata/bootstrap/contracts";
 import { withErrorHandling } from "@getstrata/core/http/response";
-import { getSql, pingDatabase } from "../../bootstrap/database.ts";
-import { plainText, renderPage } from "../../lib/view.ts";
+import { pingDatabase } from "../../bootstrap/database.ts";
 import { Note } from "../../models/Note.ts";
+import { plainText, renderPage } from "../../lib/view.ts";
 
-// Proves the database answers and the schema is migrated. Point it at a table your app owns.
 async function schemaReady(): Promise<boolean> {
   try {
-    getSql();
-    await Note.query().value("id");
+    await Note.query().limit(1).get();
     return true;
   } catch {
     return false;
@@ -1913,6 +2154,7 @@ function renderLayout(layers, projectName) {
     <meta name="description" content="<%= it.layout.description %>" />
     <% } %>
     <link rel="stylesheet" href="/assets/site.css" />
+    <script src="/assets/htmx.min.js"></script>
   </head>
   <body>
     <header class="site-header">
@@ -1941,7 +2183,7 @@ function renderHomeView(projectName, layers) {
     <a class="button" href="/register">Create account</a>
     <a class="button button-secondary" href="/login">Sign in</a>
   </div>
-  <p class="muted">Seeded demo: <code>demo@example.com</code> / <code>password</code>.</p>
+  <p class="muted">Seeded demo: <code>demo@example.com</code> / <code>StrataDemo!ChangeMe</code>.</p>
 <% } else { %>
   <p class="lede">You are signed in as <strong><%= it.currentUser.email %></strong>.</p>
   <p>Add routes in <code>src/modules</code>. This homepage is yours to restyle.</p>
@@ -2017,6 +2259,9 @@ function renderVerifyEmailView() {
 function renderMfaChallengeView() {
   return renderFormView("Two-factor code", `${textField("code", "Authenticator or recovery code", "text", 'required autocomplete="one-time-code"')}`, "Continue", `<a href="/login">Cancel</a>`).replace('action="<%= it.action || "" %>"', 'action="/login/mfa"');
 }
+function renderConfirmPasswordView() {
+  return renderFormView("Confirm your password", textField("password", "Current password", "password", 'required autocomplete="current-password"'), "Confirm", `<a href="/">Cancel</a>`).replace('action="<%= it.action || "" %>"', 'action=""');
+}
 function renderMfaSetupView() {
   return `<section class="auth-card">
   <h1>Authenticator app</h1>
@@ -2052,111 +2297,105 @@ function renderAuthDirectory(layers) {
       return null;
     }
     const hashed = hashApiToken(token);
-    const rows = await getSql().unsafe<
-      {
-        id: number;
-        user_id: number;
-        abilities: string;
-        expires_at: Date | string | null;
-        role?: string;
-        is_admin?: number | boolean;
-        email_verified_at?: Date | string | null;
-      }
-    >(
-      \`SELECT t.id, t.user_id, t.abilities, t.expires_at, u.is_admin, u.email_verified_at
-       FROM api_tokens t INNER JOIN users u ON u.id = t.user_id
-       WHERE t.token_hash = ?\`,
-      [hashed],
-    );
-    const row = rows[0];
-    if (!row) {
+    const tokenRow = await runWithMigrationBypassForIdentifier(hashed, async () => {
+      return await ApiToken.where({ token_hash: hashed }).first();
+    });
+    if (!tokenRow) {
       return null;
     }
-    if (row.expires_at && new Date(row.expires_at).getTime() <= Date.now()) {
+    const expiresAt = tokenRow.get("expires_at");
+    if (expiresAt && new Date(String(expiresAt)).getTime() <= Date.now()) {
+      return null;
+    }
+    const user_id = Number(tokenRow.get("user_id"));
+    const user = await runWithMigrationBypassForIdentifier(user_id, async () => {
+      return await User.find(user_id);
+    });
+    if (!user) {
       return null;
     }
     let abilities: string[] = [];
     try {
-      abilities = JSON.parse(String(row.abilities ?? "[]")) as string[];
+      abilities = JSON.parse(String(tokenRow.get("abilities") ?? "[]")) as string[];
     } catch {
-      abilities = ["profile:read"];
+      abilities = [];
     }
     return {
-      id: Number(row.user_id),
-      role: row.is_admin ? "admin" : "member",
+      id: user_id,
+      role: mapRole(user.get("is_admin")),
       abilities,
-      tokenId: Number(row.id),
-      emailVerifiedAt: row.email_verified_at ?? null,
+      tokenId: Number(tokenRow.get("id")),
+      emailVerifiedAt: asTimestamp(user.get("email_verified_at")),
     };
   },` : `
   async resolveUserFromToken() {
     return null;
   },`;
-  const placeholder = layers.database === "postgres" ? "$1" : "?";
   const hashImport = authUsesToken(layers.auth) ? `import { hashApiToken } from "@getstrata/core/auth/tokenHash";
 ` : "";
-  const mfaSelect = layers.extras.mfa ? ", mfa_enabled, mfa_secret, mfa_recovery_codes" : "";
-  const mfaColumns = layers.extras.mfa ? `
-  mfa_enabled?: number | boolean;
-  mfa_secret?: string | null;
-  mfa_recovery_codes?: string | null;` : "";
+  const apiTokenImport = authUsesToken(layers.auth) ? `import { ApiToken } from "../models/ApiToken.ts";
+` : "";
   const mfaReturn = layers.extras.mfa ? `
-    mfa_enabled: row.mfa_enabled === true || row.mfa_enabled === 1,
-    mfa_secret: row.mfa_secret ?? null,
-    mfa_recovery_codes: row.mfa_recovery_codes ?? null,` : "";
-  const userColumns = `id, name, email, is_admin, email_verified_at, password${mfaSelect}`;
+    mfa_enabled: user.get("mfa_enabled") === true || user.get("mfa_enabled") === 1,
+    mfa_secret: asNullableString(user.get("mfa_secret")),
+    mfa_recovery_codes: asNullableString(user.get("mfa_recovery_codes")),` : "";
+  const sessionReturn = `
+    session_valid_after: asTimestamp(user.get("session_valid_after")),`;
+  const nullableStringHelper = layers.extras.mfa ? `
+function asNullableString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+` : "";
+  const mfaKeys = layers.extras.mfa ? ` | "mfa_enabled" | "mfa_secret" | "mfa_recovery_codes"` : "";
   return `import type { AuthUser } from "@getstrata/core/auth/authContext";
 import { verifyPassword } from "@getstrata/core/auth/password";
-${hashImport}import type { AuthUserDirectory } from "@getstrata/core/contracts/authUserDirectory";
-import { getSql } from "./database.ts";
+${hashImport}import type { AuthUserDirectory, AuthUserRecord } from "@getstrata/core/contracts/authUserDirectory";
+import { runWithMigrationBypassForIdentifier } from "@getstrata/core/tenant/databaseTenantContext";
+${apiTokenImport}import { User } from "../models/User.ts";
 
-type UserRow = {
-  id: number;
-  name: string;
-  email: string;
-  is_admin: number | boolean;
-  email_verified_at: Date | string | null;
-  password: string;${mfaColumns}
+type LoadedUser = {
+  get(key: "id" | "name" | "email" | "is_admin" | "email_verified_at" | "password" | "session_valid_after"${mfaKeys}): unknown;
 };
 
 function mapRole(isAdmin: unknown): string {
   return isAdmin === true || isAdmin === 1 || isAdmin === "1" ? "admin" : "member";
 }
 
-function mapUserRow(row: UserRow) {
+function asTimestamp(value: unknown): Date | string | null {
+  return value instanceof Date || typeof value === "string" ? value : null;
+}
+${nullableStringHelper}
+function mapUserRow(user: LoadedUser): AuthUserRecord {
   return {
-    id: Number(row.id),
-    name: row.name,
-    email: row.email,
-    role: mapRole(row.is_admin),
-    email_verified_at: row.email_verified_at ?? null,
-    password: row.password,${mfaReturn}
+    id: Number(user.get("id")),
+    name: String(user.get("name") ?? ""),
+    email: String(user.get("email") ?? ""),
+    role: mapRole(user.get("is_admin")),
+    email_verified_at: asTimestamp(user.get("email_verified_at")),
+    password: String(user.get("password") ?? ""),${mfaReturn}${sessionReturn}
   };
 }
 
 async function findUserById(id: number) {
-  const rows = await getSql().unsafe<UserRow>(
-    "SELECT ${userColumns} FROM users WHERE id = ${placeholder}",
-    [id],
-  );
-  const row = rows[0];
-  if (!row) {
-    throw new Error(\`User \${id} not found.\`);
-  }
-  return mapUserRow(row);
+  return await runWithMigrationBypassForIdentifier(id, async () => {
+    const user = await User.find(id);
+    if (!user) {
+      throw new Error(\`User \${id} not found.\`);
+    }
+    return mapUserRow(user);
+  });
 }
 
 async function findUserByEmail(email: string) {
-  const rows = await getSql().unsafe<UserRow>(
-    "SELECT ${userColumns} FROM users WHERE email = ${placeholder}",
-    [email.trim().toLowerCase()],
-  );
-  const row = rows[0];
-  return row ? mapUserRow(row) : null;
+  email = email.trim().toLowerCase();
+  return await runWithMigrationBypassForIdentifier(email, async () => {
+    const user = await User.where({ email }).first();
+    return user ? mapUserRow(user) : null;
+  });
 }
 
 export const starterAuthDirectory: AuthUserDirectory = {
-${tokenLookup.replace("WHERE t.token_hash = ?", `WHERE t.token_hash = ${placeholder}`)}
+${tokenLookup}
 
   findByIdOrThrow: findUserById,
 
@@ -2167,6 +2406,9 @@ ${tokenLookup.replace("WHERE t.token_hash = ?", `WHERE t.token_hash = ${placehol
     if (!user?.password || !(await verifyPassword(password, user.password))) {
       return null;
     }
+    if ("mfa_enabled" in user && user.mfa_enabled) {
+      return null;
+    }
     return {
       id: user.id,
       role: user.role,
@@ -2185,6 +2427,11 @@ import type { ServiceProvider } from "@getstrata/core/contracts/di";
 import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 
 class StarterAuthManager {
+  async resolveWithSource(request?: Request) {
+    const user = await this.resolve(request);
+    return { user, credentialSource: user ? "guest" as const : null };
+  }
+
   async resolve(request?: Request): Promise<AuthUser | null> {
     if (!envFlagEnabled(process.env.AUTH_DEV_HEADERS)) {
       return request ? null : currentAuthUser();
@@ -2230,13 +2477,13 @@ export default authProvider;
         role: user.is_admin ? "admin" : "member",
         ...(user.email_verified_at !== undefined ? { emailVerifiedAt: user.email_verified_at } : {}),
       }),
-    });` : `    const fallback = ${authUsesToken(layers.auth) ? "new DatabaseTokenGuard(container)" : "new JwtGuard()"};
+    });` : `    const fallback = ${authUsesToken(layers.auth) ? "new DatabaseTokenGuard(container)" : "new JwtGuard(container)"};
     const auth = new AuthManager(fallback);`;
   const tokenRegs = authUsesToken(layers.auth) ? `    const apiGuard = new DatabaseTokenGuard(container);
     auth.registerGuard("api", apiGuard);
     auth.registerGuard("access_token", apiGuard);
     auth.registerGuard("token", apiGuard);` : "";
-  const jwtReg = authUsesJwt(layers.auth) ? `    auth.registerGuard("jwt", new JwtGuard());` : "";
+  const jwtReg = authUsesJwt(layers.auth) ? `    auth.registerGuard("jwt", new JwtGuard(container));` : "";
   const basicReg = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `    auth.registerGuard("basic", new BasicAuthGuard(container));` : "";
   const ability = authUsesToken(layers.auth) ? `    container.set(CORE_ABILITY_CHECKER_TOKEN, createTokenAbilityChecker());` : "";
   const imports = [`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`];
@@ -2296,18 +2543,75 @@ export default authProvider;
 function envFlag(value) {
   return value ? "true" : "false";
 }
+var GENERATED_POSTGRES_APP_ROLE = "strata_app";
+var GENERATED_POSTGRES_APP_PASSWORD = "dev-strata-app-change-me";
+var GENERATED_POSTGRES_SUPERUSER_PASSWORD = "dev-postgres-change-me";
+var GENERATED_MYSQL_ROOT_PASSWORD = "dev-mysql-change-me";
 function appDatabaseName(projectName) {
   return projectName.replace(/[^A-Za-z0-9_]/g, "_");
 }
+function usesComposePostgres(layers) {
+  return selectedDockerServices(layers).includes("postgres");
+}
 function defaultDatabaseUrl(layers, projectName) {
   if (layers.database === "sqlite") {
     return "sqlite:./storage/app.sqlite";
   }
   const database = appDatabaseName(projectName);
   if (layers.database === "mysql") {
-    return `mysql://root:root@localhost:3306/${database}`;
+    return `mysql://root:${GENERATED_MYSQL_ROOT_PASSWORD}@localhost:3306/${database}`;
   }
-  return `postgresql://postgres:postgres@localhost:5432/${database}`;
+  return `postgresql://${GENERATED_POSTGRES_APP_ROLE}:${GENERATED_POSTGRES_APP_PASSWORD}@localhost:5432/${database}`;
+}
+function defaultMigrationDatabaseUrl(layers, projectName) {
+  if (layers.database !== "postgres") {
+    return null;
+  }
+  const database = appDatabaseName(projectName);
+  return `postgresql://postgres:${GENERATED_POSTGRES_SUPERUSER_PASSWORD}@localhost:5432/${database}`;
+}
+function postgresAppRoleEnvNotes(layers) {
+  if (layers.database !== "postgres") {
+    return [];
+  }
+  return [
+    `# Runtime DATABASE_URL is ${GENERATED_POSTGRES_APP_ROLE} (NOSUPERUSER NOBYPASSRLS).`,
+    "# MIGRATION_DATABASE_URL is the postgres superuser for CREATE ROLE / CREATE DATABASE / GRANT / migrate.",
+    "# db/ensure-postgres-app-role.sql is repeatable on an existing volume, not only docker-entrypoint-initdb.d.",
+    layers.tenancy === "rls" ? "# Production TENANCY_DRIVER=rls inspects pg_roles (rolsuper / rolbypassrls), not only the URL username." : "# This app is not TENANCY_DRIVER=rls; still do not point runtime traffic at the postgres superuser."
+  ];
+}
+function renderPostgresAppRoleInitSql(projectName, layers) {
+  if (layers.database !== "postgres") {
+    return null;
+  }
+  const database = appDatabaseName(projectName);
+  const role = GENERATED_POSTGRES_APP_ROLE;
+  const password = GENERATED_POSTGRES_APP_PASSWORD;
+  return `-- Application login role. FORCE RLS applies because this role is NOSUPERUSER and NOBYPASSRLS.
+-- Superuser remains for CREATE ROLE / CREATE DATABASE / GRANT / migrate.
+-- This script is repeatable on an already-existing volume (not only docker-entrypoint-initdb.d).
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN
+    CREATE ROLE ${role} LOGIN PASSWORD '${password}'
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  ELSE
+    ALTER ROLE ${role} WITH LOGIN PASSWORD '${password}'
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  END IF;
+END
+$$;
+
+GRANT CONNECT ON DATABASE ${database} TO ${role};
+GRANT USAGE, CREATE ON SCHEMA public TO ${role};
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role};
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role};
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role};
+`;
 }
 function renderEnvExample(projectName, layers) {
   const lines = [
@@ -2317,8 +2621,10 @@ function renderEnvExample(projectName, layers) {
     "PORT=3000",
     "APP_URL=http://localhost:3000",
     `DATABASE_URL=${defaultDatabaseUrl(layers, projectName)}`,
+    ...postgresAppRoleEnvNotes(layers),
+    ...layers.database === "postgres" ? [`MIGRATION_DATABASE_URL=${defaultMigrationDatabaseUrl(layers, projectName)}`] : [],
     ...layers.database === "sqlite" ? [] : [
-      "# Optional. Migrate and boot against a different database than DATABASE_URL.",
+      "# Optional. Point runtime at a different database than DATABASE_URL.",
       "# APP_DATABASE_URL="
     ],
     `DB_CONNECTION=${layers.database === "postgres" ? "pgsql" : layers.database}`,
@@ -2330,14 +2636,23 @@ function renderEnvExample(projectName, layers) {
     `MAIL_DRIVER=${layers.mail}`,
     `AUTH_DEV_HEADERS=${envFlag(layers.auth === "headers")}`
   ];
-  if (layers.frontend === "api") {
-    lines.push("FEATURE_PUBLIC_READS=false");
-  } else {
-    lines.push("# Local convenience so the welcome page reads without a login.", "# Production boot is blocked unless this is false.", "FEATURE_PUBLIC_READS=true");
-  }
+  lines.push("APP_DEBUG=false");
+  lines.push("FEATURE_PUBLIC_READS=false");
+  lines.push("FEATURE_SIEM_EXPORT=false");
+  lines.push("FEATURE_REGISTRATION=true");
+  lines.push("FEATURE_SAML=false");
+  lines.push("# SAML_IDP_SSO_URL=");
+  lines.push("# SAML_IDP_CERT=");
+  lines.push("# SAML_SP_ENTITY_ID=");
+  lines.push("# SAML_ACS_URL=");
+  lines.push("# SAML_IDP_ISSUER=");
+  lines.push("# SAML_WANT_RESPONSE_SIGNED=");
+  lines.push("# SAML_DISABLE_REQUESTED_AUTHN_CONTEXT=");
   if (needsRedis(layers)) {
-    lines.push("REDIS_URL=redis://127.0.0.1:6379");
+    lines.push("REDIS_PASSWORD=dev-redis-change-me");
+    lines.push("REDIS_URL=redis://:dev-redis-change-me@127.0.0.1:6379");
   } else {
+    lines.push("# REDIS_PASSWORD=");
     lines.push("# REDIS_URL=redis://127.0.0.1:6379");
   }
   if (authUsesCookie(layers.auth) || layers.frontend === "server-htmx" || layers.frontend === "hybrid") {
@@ -2359,6 +2674,11 @@ function renderEnvExample(projectName, layers) {
     lines.push("# FEATURE_API_TOKENS=false");
   }
   lines.push(`FEATURE_MFA=${envFlag(layers.extras.mfa)}`);
+  if (layers.extras.mfa) {
+    lines.push("KMS_ENCRYPTION_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef");
+  } else {
+    lines.push("# KMS_ENCRYPTION_KEY=");
+  }
   lines.push(`FEATURE_EMAIL_VERIFICATION=${envFlag(layers.extras.emailVerification)}`);
   if (layers.extras.metrics) {
     lines.push("METRICS_TOKEN=dev-metrics-token-change-me");
@@ -2404,22 +2724,24 @@ function renderDockerCompose(projectName, layers) {
     image: postgres:16-alpine
     environment:
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
+      POSTGRES_PASSWORD: ${GENERATED_POSTGRES_SUPERUSER_PASSWORD}
       POSTGRES_DB: ${database}
     ports:
-      - "5432:5432"
+      # Localhost only. Do not publish this port on a production host.
+      - "127.0.0.1:5432:5432"
     volumes:
-      - pgdata:/var/lib/postgresql/data`);
+      - pgdata:/var/lib/postgresql/data
+      - ./docker/postgres-init:/docker-entrypoint-initdb.d:ro`);
   }
   if (selectedSet.has("mysql")) {
     const database = appDatabaseName(projectName);
     services.push(`  mysql:
     image: mysql:8.4
     environment:
-      MYSQL_ROOT_PASSWORD: root
+      MYSQL_ROOT_PASSWORD: ${GENERATED_MYSQL_ROOT_PASSWORD}
       MYSQL_DATABASE: ${database}
     ports:
-      - "3306:3306"
+      - "127.0.0.1:3306:3306"
     volumes:
       - mysqldata:/var/lib/mysql`);
   }
@@ -2427,25 +2749,28 @@ function renderDockerCompose(projectName, layers) {
     const server = selectedSet.has("mysql") ? "mysql" : "postgres";
     services.push(`  adminer:
     image: adminer:5.4.2
+    profiles:
+      - debug
     environment:
       ADMINER_DEFAULT_SERVER: ${server}
     depends_on:
       - ${server}
     ports:
-      - "8080:8080"`);
+      - "127.0.0.1:8080:8080"`);
   }
   if (selectedSet.has("redis")) {
     services.push(`  redis:
     image: redis:7-alpine
+    command: ["redis-server", "--requirepass", "\${REDIS_PASSWORD:-dev-redis-change-me}"]
     ports:
-      - "6379:6379"`);
+      - "127.0.0.1:6379:6379"`);
   }
   if (selectedSet.has("mailpit")) {
     services.push(`  mailpit:
     image: axllent/mailpit:latest
     ports:
-      - "1025:1025"
-      - "8025:8025"`);
+      - "127.0.0.1:1025:1025"
+      - "127.0.0.1:8025:8025"`);
   }
   const volumes = [];
   if (selectedSet.has("postgres")) {
@@ -2531,9 +2856,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^1.0.9",
-    "@getstrata/cli": "^1.0.9",
-    "@getstrata/core": "^1.0.9"
+    "@getstrata/bootstrap": "^1.1.0",
+    "@getstrata/cli": "^1.1.0",
+    "@getstrata/core": "^1.1.0"
   };
   coreDeps.eta = "^4.6.0";
   if (options.layers?.database === "mysql") {
@@ -2615,8 +2940,11 @@ function renderSupportingToolsReadme(layers) {
       const system = mysql ? "MySQL" : "PostgreSQL";
       const server = mysql ? "mysql" : "postgres";
       const username = mysql ? "root" : "postgres";
-      const password = mysql ? "root" : "postgres";
+      const password = mysql ? GENERATED_MYSQL_ROOT_PASSWORD : GENERATED_POSTGRES_SUPERUSER_PASSWORD;
       lines.push(`Adminer: http://localhost:8080 (${system}, server \`${server}\`, username \`${username}\`, password \`${password}\`).`, "");
+      if (!mysql) {
+        lines.push("Adminer uses the Compose `postgres` superuser, which skips FORCE RLS. Application traffic should use `strata_app`.", "");
+      }
     }
   }
   if (localOn.length > 0) {
@@ -2630,13 +2958,13 @@ function renderSupportingToolsReadme(layers) {
 }
 function renderApiDocs(projectName, layers) {
   const rows = ["| Method | Path | Notes |", "| --- | --- | --- |"];
-  rows.push("| `GET` | `/health` | Plain text `ok` (200), or `degraded` (503) until the database ping succeeds and the migrated `notes` table exists. Docker HEALTHCHECK uses this path. |", '| `GET` | `/ready` | JSON from the framework: `{"status":"ready","checks":{"database":"ok","redis":"skipped"}}` (200) or `not_ready` (503). `redis` is `ok` or `error` when `REDIS_URL` is set and `skipped` otherwise. It does not check the schema, so use `/health` as the deploy gate. |');
+  rows.push("| `GET` | `/health` | Plain text `ok` (200) when the database ping succeeds and `notes` is readable under the request tenant (zero rows is still 200). `degraded` (503) when the ping or that read fails. Docker HEALTHCHECK uses this path. |", '| `GET` | `/ready` | JSON from the framework: `{"status":"ready","checks":{"database":"ok","redis":"skipped"}}` (200) or `not_ready` (503). `redis` is `ok` or `error` when `REDIS_URL` is set and `skipped` otherwise. It does not check the schema, so use `/health` as the deploy gate. |');
   rows.push("| `GET` | `/` | Welcome page. Restyle or replace it. |");
   if (authUsesToken(layers.auth)) {
-    rows.push("| `POST` | `/api/v1/auth/login` | `{ email, password }` returns `{ token }`. |", "| `POST` | `/api/v1/auth/register` | Creates a user and returns a token. |", "| `GET` | `/api/v1/auth/me` | Requires `Authorization: Bearer <token>`. |");
+    rows.push("| `POST` | `/api/v1/auth/login` | `{ email, password }` returns `{ token }`. Requires `GET /api/v1/auth/csrf` then `X-CSRF-Token`. |", "| `POST` | `/api/v1/auth/register` | Creates a user and returns a token. |", "| `GET` | `/api/v1/auth/me` | Requires `Authorization: Bearer <token>`. |");
   }
   if (authUsesJwt(layers.auth)) {
-    rows.push("| `POST` | `/api/auth/token` | Mints a short-lived JWT. Not an HTML session. |");
+    rows.push("| `POST` | `/api/auth/token` | Mints a short-lived JWT. Not an HTML session. Requires CSRF like JSON login. |");
   }
   if (authNeedsUsers(layers.auth)) {
     rows.push("| `POST` | `/api/v1/auth/forgot-password` | Sends a signed reset link through the mail driver. |", "| `POST` | `/api/v1/auth/reset-password` | Consumes the signed link. |", "| `GET` | `/api/user` | Current user for the active guard. |");
@@ -2644,7 +2972,7 @@ function renderApiDocs(projectName, layers) {
   if (layers.extras.metrics) {
     rows.push("| `GET` | `/metrics` | Prometheus text. Production requires `Authorization: Bearer <METRICS_TOKEN>`. |");
   }
-  const authNote = layers.auth === "headers" ? `Auth is \`headers\`. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`) for local work and tests. There are no login endpoints and no \`users\` table. Production must set \`AUTH_DEV_HEADERS=false\`, which turns those headers off and leaves you without a guard, so pick another auth layer before you ship.` : authUsesToken(layers.auth) ? `Sign in with \`POST /api/v1/auth/login\`, then send \`Authorization: Bearer <token>\` on every request. Tokens are stored hashed in \`api_tokens\` and expire after \`API_TOKEN_DEFAULT_EXPIRY_DAYS\` (30 in \`.env.example\`). The response includes \`expires_at\`.` : `Mint a JWT with \`POST /api/auth/token\`, then send \`Authorization: Bearer <jwt>\`. JWTs expire; re-mint rather than refreshing in place.`;
+  const authNote = layers.auth === "headers" ? `Auth is \`headers\`. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`) for local work and tests. There are no login endpoints and no \`users\` table. Production must set \`AUTH_DEV_HEADERS=false\`, which turns those headers off and leaves you without a guard, so pick another auth layer before you ship.` : authUsesToken(layers.auth) ? `Sign in with \`GET /api/v1/auth/csrf\` then \`POST /api/v1/auth/login\` (send \`X-CSRF-Token\`), then send \`Authorization: Bearer <token>\` on every request. Tokens are stored hashed in \`api_tokens\` and expire after \`API_TOKEN_DEFAULT_EXPIRY_DAYS\` (30 in \`.env.example\`). The response includes \`expires_at\`.` : `Mint a JWT with \`POST /api/auth/token\`, then send \`Authorization: Bearer <jwt>\`. JWTs expire; re-mint rather than refreshing in place.`;
   return `# ${projectName} API
 
 \`FRONTEND_MODE=${layers.frontend}\`. ${layers.frontend === "api" ? "No server-rendered views beyond the welcome page and no SPA assets." : `HTML is served alongside this API. The SPA is mounted at \`${layers.spaPrefix}\`.`}
@@ -2756,7 +3084,7 @@ ${next.join(`
 Open http://localhost:3000. Health check: \`GET /health\`.
 
 ${renderSupportingToolsReadme(layers)}${layers.auth !== "headers" ? `
-Seeded login (password \`password\`):
+Seeded login (password \`StrataDemo!ChangeMe\`):
 
 - \`demo@example.com\` (member)
 - \`admin@example.test\` (admin)
@@ -2792,7 +3120,7 @@ Until \`frontend/dist\` exists, \`${layers.spaPrefix}\` answers 503. Use \`bun r
 ` : ""}${layers.database === "sqlite" ? "" : `
 ## Database
 
-The app uses the database named in \`DATABASE_URL\` and creates it on first migrate when the connection user may. Set \`APP_DATABASE_URL\` only when migrations and the app should target a different database than \`DATABASE_URL\`.
+The app uses the database named in \`DATABASE_URL\` and creates it on first migrate when the connection user may. Set \`APP_DATABASE_URL\` only when migrations and the app should target a different database than \`DATABASE_URL\`.${usesComposePostgres(layers) ? ` \`.env.example\` points \`DATABASE_URL\` at \`${GENERATED_POSTGRES_APP_ROLE}\` (\`NOSUPERUSER\` \`NOBYPASSRLS\`), including \`--no-docker\`. \`db/ensure-postgres-app-role.sql\` is repeatable on an existing volume; Compose init still runs on first empty volume. The \`postgres\` superuser is for CREATE ROLE / GRANT / migrate and Adminer.` : ""}
 `}
 ## Deploy
 
@@ -2816,9 +3144,110 @@ The image sets \`APP_ENV=production\` and \`AUTH_DEV_HEADERS=false\`; everything
 - Set \`FEATURE_PUBLIC_READS=false\`. ${layers.frontend === "api" ? "This app already ships `false`." : "This app ships `true` so the local welcome page reads without a login. Production requires `false`."}
 - Cross-origin browser calls are off in production until you set \`CORS_ALLOWED_ORIGINS\` to explicit origins. A \`*\` entry is rejected. Non-browser clients are unaffected.
 - Behind a reverse proxy or load balancer, set \`TRUST_FORWARDED_FOR=true\` so throttles and session records see the client address instead of the proxy. Only the rightmost public hop of \`X-Forwarded-For\` is trusted.
-${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}
-\`strata start\` does not migrate when \`APP_ENV=production\`. Run \`bun run db:migrate\` as a deploy step. \`GET /health\` answers 503 until the schema exists, so a fresh deploy stays out of rotation until it is migrated.
+${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}${layers.tenancy === "rls" ? `- \`DATABASE_URL\` must be a \`NOBYPASSRLS\` role, not the \`postgres\` superuser. Generated apps create \`${GENERATED_POSTGRES_APP_ROLE}\` via \`db/ensure-postgres-app-role.sql\` (and Compose init on first empty volume). \`MIGRATION_DATABASE_URL\` may stay the superuser for CREATE ROLE / GRANT / migrate. Production boot rejects username \`postgres\` or \`root\`, then inspects \`pg_roles\` for \`rolsuper\` / \`rolbypassrls\`.
+` : ""}
+\`strata start\` does not migrate when \`APP_ENV=production\`. Run \`bun run db:migrate\` as a deploy step. \`GET /health\` is 200 when \`notes\` is readable (including zero rows) and 503 when that read fails.
+`;
+}
+
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+
+// ../../src/core/tenant/enableTenantRls.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+var RLS_HELPER_SQL = `
+CREATE OR REPLACE FUNCTION app_bypass_rls()
+RETURNS BOOLEAN AS $$
+BEGIN
+  RETURN COALESCE(current_setting('app.bypass_rls', true), 'false') = 'true';
+EXCEPTION
+  WHEN others THEN
+    RETURN FALSE;
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+CREATE OR REPLACE FUNCTION app_bypass_identifier()
+RETURNS TEXT AS $$
+BEGIN
+  RETURN NULLIF(current_setting('app.bypass_identifier', true), '');
+EXCEPTION
+  WHEN others THEN
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+CREATE OR REPLACE FUNCTION app_current_tenant_id()
+RETURNS INTEGER AS $$
+BEGIN
+  RETURN NULLIF(current_setting('app.tenant_id', true), '')::INTEGER;
+EXCEPTION
+  WHEN others THEN
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql STABLE;
 `;
+function tenantIsolationPolicy(table, predicate) {
+  return `
+ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ${table} FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON ${table};
+CREATE POLICY tenant_isolation ON ${table}
+USING (
+  app_bypass_rls()
+  OR ${predicate}
+)
+WITH CHECK (
+  app_bypass_rls()
+  OR ${predicate}
+);
+`;
+}
+function enableTenantRlsSql(tableName) {
+  const table = assertSafeIdentifier(tableName);
+  return tenantIsolationPolicy(table, `tenant_id = app_current_tenant_id()`);
+}
+function enableUsersRlsSql() {
+  return tenantIsolationPolicy("users", `tenant_id = app_current_tenant_id()
+  OR (
+    app_bypass_identifier() IS NOT NULL
+    AND (
+      id::text = app_bypass_identifier()
+      OR email = app_bypass_identifier()
+    )
+  )`);
+}
+function userOwnedIdentifierPredicate(table, userIdColumn) {
+  const userIdMatch = `${table}.${userIdColumn}::text = app_bypass_identifier()`;
+  if (table === "sessions") {
+    return `(app_bypass_identifier() IS NOT NULL AND (${table}.id::text = app_bypass_identifier() OR ${userIdMatch}))`;
+  }
+  if (table === "api_tokens" || table === "auth_one_time_tokens") {
+    return `(app_bypass_identifier() IS NOT NULL AND (${table}.token_hash = app_bypass_identifier() OR ${userIdMatch}))`;
+  }
+  return `(app_bypass_identifier() IS NOT NULL AND ${userIdMatch})`;
+}
+function enableUserOwnedRlsSql(tableName, userIdColumn = "user_id") {
+  const table = assertSafeIdentifier(tableName);
+  const column = assertSafeIdentifier(userIdColumn);
+  return tenantIsolationPolicy(table, `EXISTS (
+    SELECT 1 FROM users u
+    WHERE u.id = ${table}.${column}
+      AND u.tenant_id = app_current_tenant_id()
+  )
+  OR ${userOwnedIdentifierPredicate(table, column)}`);
+}
+function generatedRlsBootstrapSql(tables, userOwnedTables = []) {
+  return [
+    RLS_HELPER_SQL,
+    ...tables.map((table) => table === "users" ? enableUsersRlsSql() : enableTenantRlsSql(table)),
+    ...userOwnedTables.map((table) => enableUserOwnedRlsSql(table))
+  ].join(`
+`);
 }
 
 // src/renderRuntime.ts
@@ -3053,17 +3482,19 @@ function renderMigrateTs(layers) {
     statements.push(`CREATE TABLE IF NOT EXISTS tenant (
     id ${d.id},
     slug ${d.keyText} NOT NULL UNIQUE,
-    plan ${d.defaultText} NOT NULL DEFAULT 'enterprise',
+    plan ${d.defaultText} NOT NULL DEFAULT 'free',
     region ${d.defaultText} NOT NULL DEFAULT 'eu'
   )`);
   }
+  const notesTenantColumn = tenancyOn ? `
+    tenant_id INTEGER NOT NULL DEFAULT 1,` : "";
   statements.push(`CREATE TABLE IF NOT EXISTS notes (
     id ${d.id},
-    body ${d.text} NOT NULL,
+    body ${d.text} NOT NULL,${notesTenantColumn}
     created_at ${d.timestamp}
   )`);
   if (authNeedsUsers(layers.auth)) {
-    const tenantColumn = tenancyOn ? `
+    const tenantColumn = tenancyOn || layers.extras.scim ? `
     tenant_id INTEGER NOT NULL DEFAULT 1,` : "";
     const mfaColumns = mfaOn ? `
     mfa_secret ${d.text},
@@ -3075,8 +3506,17 @@ function renderMigrateTs(layers) {
     email ${d.keyText} NOT NULL UNIQUE,
     password ${d.text} NOT NULL,
     is_admin ${d.bool},${tenantColumn}${mfaColumns}
+    session_valid_after ${d.timestampNull},
     email_verified_at ${d.timestampNull},
     created_at ${d.timestamp}
+  )`);
+    statements.push(`CREATE TABLE IF NOT EXISTS auth_one_time_tokens (
+    id ${d.id},
+    purpose ${d.keyText} NOT NULL,
+    user_id INTEGER NOT NULL,
+    token_hash ${d.keyText} NOT NULL UNIQUE,
+    expires_at ${d.timestamp},
+    consumed_at ${d.timestampNull}
   )`);
   }
   if (authUsesCookie(layers.auth)) {
@@ -3086,7 +3526,15 @@ function renderMigrateTs(layers) {
     expires_at ${d.timestamp},
     user_agent ${d.text},
     ip_address ${d.text},
-    last_active_at ${d.timestamp}
+    last_active_at ${d.timestamp},
+    created_at ${d.timestamp}
+  )`);
+    if (layers.database === "postgres") {
+      statements.push("ALTER TABLE sessions ADD COLUMN IF NOT EXISTS created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()");
+    }
+    statements.push(`CREATE TABLE IF NOT EXISTS auth_saml_assertions (
+    assertion_id ${d.keyText} PRIMARY KEY,
+    consumed_at ${d.timestamp}
   )`);
   }
   if (authUsesToken(layers.auth)) {
@@ -3101,16 +3549,26 @@ function renderMigrateTs(layers) {
     created_at ${d.timestamp}
   )`);
   }
-  const list = statements.map((sql) => `  \`${sql}\`,`).join(`
+  const rlsOn = layers.tenancy === "rls" && layers.database === "postgres";
+  if (rlsOn) {
+    const rlsTables = authNeedsUsers(layers.auth) ? ["notes", "users"] : ["notes"];
+    const userOwnedTables = [];
+    if (authNeedsUsers(layers.auth)) {
+      userOwnedTables.push("auth_one_time_tokens");
+    }
+    if (authUsesCookie(layers.auth)) {
+      userOwnedTables.push("sessions");
+    }
+    if (authUsesToken(layers.auth)) {
+      userOwnedTables.push("api_tokens");
+    }
+    statements.push(generatedRlsBootstrapSql(rlsTables, userOwnedTables).trim());
+  }
+  const list = statements.map((sql) => `  \`${sql.replace(/`/g, "\\`")}\`,`).join(`
 `);
   const ph = layers.database === "postgres";
   const verifyOn = layers.extras.emailVerification && authNeedsUsers(layers.auth);
-  const userColumns = verifyOn ? "name, email, password, is_admin, email_verified_at" : "name, email, password, is_admin";
-  const userPlaceholders = verifyOn ? ph ? "$1, $2, $3, $4, $5), ($6, $7, $8, $9, $10" : "?, ?, ?, ?, ?), (?, ?, ?, ?, ?" : ph ? "$1, $2, $3, $4), ($5, $6, $7, $8" : "?, ?, ?, ?), (?, ?, ?, ?";
-  const adminFlag = ph ? "false" : "0";
-  const adminTrue = ph ? "true" : "1";
   const verifiedNow = nowTimestampLiteral(layers.database);
-  const userValues = verifyOn ? `["Demo User", "demo@example.com", password, ${adminFlag}, ${verifiedNow}, "Admin User", "admin@example.test", password, ${adminTrue}, ${verifiedNow}]` : `["Demo User", "demo@example.com", password, ${adminFlag}, "Admin User", "admin@example.test", password, ${adminTrue}]`;
   const seedTenant = tenancyOn ? `
   const [{ count: tenantCount }] = await sql.unsafe<{ count: string | number }>(
     "SELECT COUNT(*) AS count FROM tenant",
@@ -3118,45 +3576,80 @@ function renderMigrateTs(layers) {
   if (Number(tenantCount) === 0) {
     await sql.unsafe(
       "INSERT INTO tenant (slug, plan, region) VALUES (${ph ? "$1, $2, $3" : "?, ?, ?"})",
-      ["default", "enterprise", "eu"],
+      ["default", "free", "eu"],
     );
   }` : "";
   const seedUsers = authNeedsUsers(layers.auth) ? `
-  const [{ count: userCount }] = await sql.unsafe<{ count: string | number }>(
-    "SELECT COUNT(*) AS count FROM users",
-  );
-  if (Number(userCount) === 0) {
-    const password = await hashPassword("password");
-    await sql.unsafe(
-      "INSERT INTO users (${userColumns}) VALUES (${userPlaceholders})",
-      ${userValues},
-    );
+  if ((await User.query().value("id")) === null) {
+    const password = await hashPassword("StrataDemo!ChangeMe");
+    await User.create({
+      name: "Demo User",
+      email: "demo@example.com",
+      password,
+      is_admin: false,${verifyOn ? `
+      email_verified_at: ${verifiedNow},` : ""}
+    });
+    await User.create({
+      name: "Admin User",
+      email: "admin@example.test",
+      password,
+      is_admin: true,${verifyOn ? `
+      email_verified_at: ${verifiedNow},` : ""}
+    });
   }` : "";
   const hashImport = authNeedsUsers(layers.auth) ? `import { hashPassword } from "@getstrata/core/auth/password";
 ` : "";
-  const seedBlock = `${seedTenant}${seedUsers}`;
-  const bindSql = seedBlock.length > 0 ? `  const sql = getSql();
-` : `  getSql();
+  const rlsBypassImport = layers.tenancy === "rls" && layers.database === "postgres" ? `import { runWithMigrationBypass } from "@getstrata/core/tenant/databaseTenantContext";
+` : "";
+  const postgresRoleImport = layers.database === "postgres" ? `import { grantPostgresAppRolePrivileges, openPostgresAdminConnection, postgresDatabaseNameFromUrl } from "@getstrata/core/tenant/enableTenantRls";
+` : "";
+  const bindSql = seedTenant || layers.tenancy === "rls" && layers.database === "postgres" ? `  const sql = getSql();
+` : "";
+  const seedOpen = layers.tenancy === "rls" && layers.database === "postgres" ? `  await runWithMigrationBypass(async () => {
+` : "";
+  const seedClose = layers.tenancy === "rls" && layers.database === "postgres" ? `
+  });` : "";
+  const noteCreate = tenancyOn ? `await Note.create({ body: "Welcome to Strata!", tenant_id: 1 });` : `await Note.create({ body: "Welcome to Strata!" });`;
+  const userImport = authNeedsUsers(layers.auth) ? `import { User } from "../models/User.ts";
+` : "";
+  const needsSqlClient = layers.database !== "postgres" || Boolean(seedTenant) || layers.tenancy === "rls" && layers.database === "postgres";
+  const databaseImport = needsSqlClient ? `import { closeDatabase, getSql } from "../bootstrap/database.ts";
+` : `import { closeDatabase } from "../bootstrap/database.ts";
 `;
-  return `${hashImport}${ensureImport(layers)}import { closeDatabase, getSql } from "../bootstrap/database.ts";
-import { Note } from "../models/Note.ts";
-
+  return `${hashImport}${rlsBypassImport}${postgresRoleImport}${ensureImport(layers)}${databaseImport}import { Note } from "../models/Note.ts";
+${userImport}
 const migrations = [
 ${list}
 ];
 
 export async function seed() {
-${ensureCall(layers)}${bindSql}  if ((await Note.query().value("id")) === null) {
-    await Note.create({ body: "Welcome to Strata!" });
-  }${seedBlock}
+${ensureCall(layers)}${bindSql}${seedOpen}${seedTenant}
+  if ((await Note.query().value("id")) === null) {
+    ${noteCreate}
+  }${seedUsers}${seedClose}
 }
 
 export async function migrate() {
-${ensureCall(layers)}  const sql = getSql();
+${ensureCall(layers)}${layers.database === "postgres" ? `  const runtimeUrl = process.env.DATABASE_URL ?? "";
+  const admin = await openPostgresAdminConnection({
+    runtimeUrl,
+    migrationUrl: process.env.MIGRATION_DATABASE_URL,
+  });
+  try {
+    for (const statement of migrations) {
+      await admin.unsafe(statement);
+    }
+    await grantPostgresAppRolePrivileges(admin, {
+      database: postgresDatabaseNameFromUrl(runtimeUrl),
+    });
+  } finally {
+    await admin.close?.();
+  }
+` : `  const sql = getSql();
   for (const statement of migrations) {
     await sql.unsafe(statement);
   }
-  await seed();
+`}  await seed();
 }
 
 /** The CLI calls this after migrate() so pooled drivers do not hold the process open. */
@@ -3172,21 +3665,26 @@ if (import.meta.main) {
 }
 `;
 }
-function renderNoteModel() {
+function renderNoteModel(layers) {
+  const tenancyOn = usesTenantTable(layers.tenancy);
+  const tenantField = tenancyOn ? `
+  tenant_id: number;` : "";
+  const tenantColumn = tenancyOn ? ', "tenant_id"' : "";
+  const fillable = tenancyOn ? '["body", "tenant_id"]' : '["body"]';
   return `import { BaseRepository } from "@getstrata/core/database/baseRepository";
 import { Model, registerModelRepository } from "@getstrata/core/database/model";
 import { defineTable } from "@getstrata/core/database/table";
 
 interface NoteRecord {
   id: number;
-  body: string;
+  body: string;${tenantField}
   created_at: Date | string;
 }
 
 const notesTable = defineTable<NoteRecord, "id">({
   name: "notes",
   primaryKey: "id",
-  columns: ["id", "body", "created_at"],
+  columns: ["id", "body"${tenantColumn}, "created_at"],
   defaultOrderBy: { column: "id", direction: "ASC" },
 });
 
@@ -3197,7 +3695,7 @@ class NoteRepository extends BaseRepository<NoteRecord, "id"> {
 }
 
 class Note extends Model<NoteRecord, "id"> {
-  static $fillable = ["body"] as const;
+  static $fillable = ${fillable} as const;
   // created_at uses the table default. Sending a JS Date from $timestamps
   // is rejected by SQLite bindings.
   static $timestamps = false;
@@ -3209,6 +3707,160 @@ export type { NoteRecord };
 export { Note };
 `;
 }
+function renderUserModel(layers) {
+  const tenancyOn = usesTenantTable(layers.tenancy) || layers.extras.scim;
+  const mfaOn = Boolean(layers.extras.mfa);
+  const tenantField = tenancyOn ? `
+  tenant_id: number;` : "";
+  const mfaFields = mfaOn ? `
+  mfa_secret: string | null;
+  mfa_enabled: number | boolean;
+  mfa_recovery_codes: string | null;` : "";
+  const columns = ["id", "name", "email", "password", "is_admin"];
+  if (tenancyOn) {
+    columns.push("tenant_id");
+  }
+  if (mfaOn) {
+    columns.push("mfa_secret", "mfa_enabled", "mfa_recovery_codes");
+  }
+  columns.push("session_valid_after", "email_verified_at", "created_at");
+  const fillable = ["name", "email", "password", "is_admin"];
+  if (tenancyOn) {
+    fillable.push("tenant_id");
+  }
+  if (mfaOn) {
+    fillable.push("mfa_secret", "mfa_enabled", "mfa_recovery_codes");
+  }
+  fillable.push("session_valid_after", "email_verified_at");
+  const hidden = ["password"];
+  if (mfaOn) {
+    hidden.push("mfa_secret", "mfa_recovery_codes");
+  }
+  const fillableLiteral = `[${fillable.map((column) => `"${column}"`).join(", ")}]`;
+  const hiddenLiteral = `[${hidden.map((column) => `"${column}"`).join(", ")}]`;
+  const columnsLiteral = columns.map((column) => `"${column}"`).join(", ");
+  return `import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { Model, registerModelRepository } from "@getstrata/core/database/model";
+import { defineTable } from "@getstrata/core/database/table";
+
+interface UserRecord {
+  id: number;
+  name: string;
+  email: string;
+  password: string;
+  is_admin: number | boolean;${tenantField}${mfaFields}
+  session_valid_after: Date | string | null;
+  email_verified_at: Date | string | null;
+  created_at: Date | string;
+}
+
+const usersTable = defineTable<UserRecord, "id">({
+  name: "users",
+  primaryKey: "id",
+  columns: [${columnsLiteral}],
+  defaultOrderBy: { column: "id", direction: "ASC" },
+});
+
+class UserRepository extends BaseRepository<UserRecord, "id"> {
+  constructor() {
+    super(usersTable);
+  }
+}
+
+class User extends Model<UserRecord, "id"> {
+  static $fillable = ${fillableLiteral} as const;
+  static $hidden = ${hiddenLiteral} as const;
+  // created_at uses the table default. Sending a JS Date from $timestamps
+  // is rejected by SQLite bindings.
+  static $timestamps = false;
+}
+
+registerModelRepository(User, new UserRepository());
+
+export type { UserRecord };
+export { User };
+`;
+}
+function renderApiTokenModel() {
+  return `import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { Model, registerModelRepository } from "@getstrata/core/database/model";
+import { defineTable } from "@getstrata/core/database/table";
+
+interface ApiTokenRecord {
+  id: number;
+  user_id: number;
+  name: string;
+  token_hash: string;
+  abilities: string;
+  expires_at: Date | string | null;
+  last_used_at: Date | string | null;
+  created_at: Date | string;
+}
+
+const apiTokensTable = defineTable<ApiTokenRecord, "id">({
+  name: "api_tokens",
+  primaryKey: "id",
+  columns: ["id", "user_id", "name", "token_hash", "abilities", "expires_at", "last_used_at", "created_at"],
+  defaultOrderBy: { column: "id", direction: "ASC" },
+});
+
+class ApiTokenRepository extends BaseRepository<ApiTokenRecord, "id"> {
+  constructor() {
+    super(apiTokensTable);
+  }
+}
+
+class ApiToken extends Model<ApiTokenRecord, "id"> {
+  static $fillable = ["user_id", "name", "token_hash", "abilities", "expires_at", "last_used_at"] as const;
+  // created_at uses the table default. Sending a JS Date from $timestamps
+  // is rejected by SQLite bindings.
+  static $timestamps = false;
+}
+
+registerModelRepository(ApiToken, new ApiTokenRepository());
+
+export type { ApiTokenRecord };
+export { ApiToken };
+`;
+}
+function renderAuthOneTimeTokenModel() {
+  return `import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { Model, registerModelRepository } from "@getstrata/core/database/model";
+import { defineTable } from "@getstrata/core/database/table";
+
+interface AuthOneTimeTokenRecord {
+  id: number;
+  purpose: string;
+  user_id: number;
+  token_hash: string;
+  expires_at: Date | string;
+  consumed_at: Date | string | null;
+}
+
+const authOneTimeTokensTable = defineTable<AuthOneTimeTokenRecord, "id">({
+  name: "auth_one_time_tokens",
+  primaryKey: "id",
+  columns: ["id", "purpose", "user_id", "token_hash", "expires_at", "consumed_at"],
+  defaultOrderBy: { column: "id", direction: "ASC" },
+});
+
+class AuthOneTimeTokenRepository extends BaseRepository<AuthOneTimeTokenRecord, "id"> {
+  constructor() {
+    super(authOneTimeTokensTable);
+  }
+}
+
+class AuthOneTimeToken extends Model<AuthOneTimeTokenRecord, "id"> {
+  static $fillable = ["purpose", "user_id", "token_hash", "expires_at", "consumed_at"] as const;
+  static $timestamps = false;
+}
+
+registerModelRepository(AuthOneTimeToken, new AuthOneTimeTokenRepository());
+
+export type { AuthOneTimeTokenRecord };
+export { AuthOneTimeToken };
+`;
+}
 function dropTables(layers) {
   const ordered = [];
   if (authUsesToken(layers.auth)) {
@@ -3216,8 +3868,10 @@ function dropTables(layers) {
   }
   if (authUsesCookie(layers.auth)) {
     ordered.push("sessions");
+    ordered.push("auth_saml_assertions");
   }
   if (authNeedsUsers(layers.auth)) {
+    ordered.push("auth_one_time_tokens");
     ordered.push("users");
   }
   ordered.push("notes");
@@ -3226,20 +3880,31 @@ function dropTables(layers) {
   }
   return ordered;
 }
+function renderPostgresAdminDropCall() {
+  return `  await dropPostgresTablesAsAdmin(tables, {
+    runtimeUrl: process.env.DATABASE_URL ?? "",
+    migrationUrl: process.env.MIGRATION_DATABASE_URL,
+  });
+`;
+}
 function renderFreshTs(layers) {
   const tables = dropTables(layers);
   const cascade = layers.database === "sqlite" ? "" : " CASCADE";
-  return `${ensureImport(layers)}import { closeDatabase, getSql } from "../bootstrap/database.ts";
-import { migrate } from "./migrate.ts";
+  const imports = layers.database === "postgres" ? `import { dropPostgresTablesAsAdmin } from "@getstrata/core/tenant/enableTenantRls";
+${ensureImport(layers)}import { closeDatabase } from "../bootstrap/database.ts";
+import { migrate } from "./migrate.ts";` : `${ensureImport(layers)}import { closeDatabase, getSql } from "../bootstrap/database.ts";
+import { migrate } from "./migrate.ts";`;
+  const dropBody = layers.database === "postgres" ? `${renderPostgresAdminDropCall()}  await migrate();` : `  const sql = getSql();
+  for (const table of tables) {
+    await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
+  }
+  await migrate();`;
+  return `${imports}
 
 const tables = ${JSON.stringify(tables)};
 
 export async function fresh() {
-${ensureCall(layers)}  const sql = getSql();
-  for (const table of tables) {
-    await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
-  }
-  await migrate();
+${ensureCall(layers)}${dropBody}
 }
 
 /** The CLI calls this after fresh() so pooled drivers do not hold the process open. */
@@ -3297,16 +3962,21 @@ if (import.meta.main) {
 function renderRollbackTs(layers) {
   const tables = dropTables(layers);
   const cascade = layers.database === "sqlite" ? "" : " CASCADE";
-  return `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
+  const imports = layers.database === "postgres" ? `import { dropPostgresTablesAsAdmin } from "@getstrata/core/tenant/enableTenantRls";
+${ensureImport(layers)}` : `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";`;
+  const dropBody = layers.database === "postgres" ? `${renderPostgresAdminDropCall()}  for (const table of tables) {
+    console.log(\`dropped \${table}\`);
+  }` : `  const sql = getSql();
+  for (const table of tables) {
+    await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
+    console.log(\`dropped \${table}\`);
+  }`;
+  return `${imports}
 
 const tables = ${JSON.stringify(tables)};
 
 export async function rollback() {
-${ensureCall(layers)}  const sql = getSql();
-  for (const table of tables) {
-    await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
-    console.log(\`dropped \${table}\`);
-  }
+${ensureCall(layers)}${dropBody}
 }
 
 if (import.meta.main) {
@@ -3317,13 +3987,15 @@ if (import.meta.main) {
 `;
 }
 function renderPreloadTs(layers, projectName) {
-  const database = appDatabaseName(projectName);
-  const fallback = layers.database === "sqlite" ? "sqlite:./storage/app.sqlite" : layers.database === "mysql" ? `mysql://root:root@localhost:3306/${database}` : `postgresql://postgres:postgres@localhost:5432/${database}`;
+  const fallback = defaultDatabaseUrl(layers, projectName);
+  const migrationFallback = defaultMigrationDatabaseUrl(layers, projectName);
+  const migrationLine = migrationFallback ? `process.env.MIGRATION_DATABASE_URL ??= ${JSON.stringify(migrationFallback)};
+` : "";
   return `import { join } from "node:path";
 import { configureModulesDirectory } from "@getstrata/bootstrap/discoverModules";
 
 process.env.DATABASE_URL ??= ${JSON.stringify(fallback)};
-process.env.FRONTEND_MODE ??= ${JSON.stringify(layers.frontend)};
+${migrationLine}process.env.FRONTEND_MODE ??= ${JSON.stringify(layers.frontend)};
 process.env.SPA_PREFIX ??= ${JSON.stringify(layers.spaPrefix)};
 process.env.CACHE_DRIVER ??= ${JSON.stringify(layers.cache)};
 process.env.QUEUE_DRIVER ??= ${JSON.stringify(layers.queue)};
@@ -3420,11 +4092,10 @@ function renderEnsureDatabaseTs(layers, projectName) {
   if (layers.database === "sqlite") {
     return null;
   }
-  const database = appDatabaseName(projectName);
-  const fallback = layers.database === "mysql" ? `mysql://root:root@localhost:3306/${database}` : `postgresql://postgres:postgres@localhost:5432/${database}`;
+  const fallback = defaultDatabaseUrl(layers, projectName);
   const resolveUrl = `/**
- * The database name comes from DATABASE_URL. Set APP_DATABASE_URL to point
- * migrations and the app at a different database than DATABASE_URL.
+ * Runtime URL. Superuser CREATE ROLE / CREATE DATABASE / GRANT / migrate uses
+ * MIGRATION_DATABASE_URL when set.
  */
 function resolveAppDatabaseUrl(): string {
   const explicit = process.env.APP_DATABASE_URL?.trim();
@@ -3433,8 +4104,8 @@ function resolveAppDatabaseUrl(): string {
   }
   return process.env.DATABASE_URL?.trim() || DEFAULT_DATABASE_URL;
 }
-
-/** Reject anything we would have to quote before interpolating into DDL. */
+`;
+  const safeName = `/** Reject anything we would have to quote before interpolating into DDL. */
 function safeDatabaseName(url: string): string {
   let name = "";
   try {
@@ -3456,7 +4127,7 @@ function safeDatabaseName(url: string): string {
 
 const DEFAULT_DATABASE_URL = ${JSON.stringify(fallback)};
 
-${resolveUrl}
+${resolveUrl}${safeName}
 export async function ensureAppDatabase(): Promise<string> {
   const url = resolveAppDatabaseUrl();
   const name = safeDatabaseName(url);
@@ -3475,58 +4146,21 @@ export async function ensureAppDatabase(): Promise<string> {
 }
 `;
   }
-  return `const DEFAULT_DATABASE_URL = ${JSON.stringify(fallback)};
-
-${resolveUrl}
-function adminCandidateUrls(url: string): string[] {
-  const names = ["postgres", "template1"];
-  try {
-    const current = decodeURIComponent(new URL(url).pathname.replace(/^\\//, ""));
-    if (current && !names.includes(current)) {
-      names.push(current);
-    }
-  } catch {
-  }
-  return names.map((name) => {
-    const admin = new URL(url);
-    admin.pathname = \`/\${name}\`;
-    return admin.toString();
-  });
-}
+  return `import {
+  ensurePostgresDatabaseAndAppRole,
+  POSTGRES_APP_ROLE_PASSWORD,
+} from "@getstrata/core/tenant/enableTenantRls";
 
-async function openAdminConnection(url: string): Promise<Bun.SQL> {
-  let lastError: unknown;
-  for (const candidate of adminCandidateUrls(url)) {
-    const adminSql = new Bun.SQL(candidate);
-    try {
-      await adminSql\`SELECT 1\`;
-      return adminSql;
-    } catch (error) {
-      lastError = error;
-      await adminSql.close().catch(() => undefined);
-    }
-  }
-  throw lastError instanceof Error
-    ? lastError
-    : new Error("Could not open an admin connection to create the app database.");
-}
+const DEFAULT_DATABASE_URL = ${JSON.stringify(fallback)};
 
+${resolveUrl}
 export async function ensureAppDatabase(): Promise<string> {
   const url = resolveAppDatabaseUrl();
-  const name = safeDatabaseName(url);
-
-  const adminSql = await openAdminConnection(url);
-  try {
-    const rows = await adminSql\`
-      SELECT 1 AS ok FROM pg_database WHERE datname = \${name}
-    \`;
-    if (rows.length === 0) {
-      await adminSql.unsafe(\`CREATE DATABASE \${name}\`);
-    }
-  } finally {
-    await adminSql.close();
-  }
-
+  await ensurePostgresDatabaseAndAppRole({
+    runtimeUrl: url,
+    migrationUrl: process.env.MIGRATION_DATABASE_URL,
+    password: process.env.STRATA_APP_PASSWORD ?? POSTGRES_APP_ROLE_PASSWORD,
+  });
   process.env.DATABASE_URL = url;
   return url;
 }
@@ -3535,11 +4169,27 @@ export async function ensureAppDatabase(): Promise<string> {
 function renderSidecarsTs(_layers) {
   return null;
 }
+function renderPolicyProvider() {
+  return `import { CORE_POLICY_GATE_TOKEN } from "@getstrata/bootstrap/config";
+import { PolicyGate } from "@getstrata/core/auth/policy";
+import type { ServiceProvider } from "@getstrata/core/contracts/di";
+
+const policyProvider: ServiceProvider = {
+  name: "core.policy",
+  register({ container }) {
+    container.set(CORE_POLICY_GATE_TOKEN, new PolicyGate());
+  },
+};
+
+export default policyProvider;
+`;
+}
 function renderProvidersIndex() {
   return `import type { ServiceProvider } from "@getstrata/core/contracts/di";
 import authProvider from "./auth.ts";
 import cacheProvider from "./cache.ts";
 import configProvider from "./config.ts";
+import policyProvider from "./policy.ts";
 import queueProvider from "./queue.ts";
 import storageProvider from "./storage.ts";
 
@@ -3549,6 +4199,7 @@ const starterProviders: ServiceProvider[] = [
   storageProvider,
   queueProvider,
   authProvider,
+  policyProvider,
 ];
 
 export { starterProviders };
@@ -3580,10 +4231,11 @@ import {
   ensureModulesLoaded,
 } from "@getstrata/bootstrap/discoverModules";
 import { createHealthRoutes } from "@getstrata/bootstrap/health";
-${metricsImport}import { assertProductionSecrets } from "@getstrata/bootstrap/secretsGuard";
+${metricsImport}import { assertProductionSecrets, assertRlsLiveDatabaseRole } from "@getstrata/bootstrap/secretsGuard";
 import { createWebServer } from "@getstrata/bootstrap/web/server";
 import { setActiveApplicationContext } from "@getstrata/core/runtime/applicationRegistry";
 import { isProductionEnv } from "@getstrata/core/runtime/appEnv";
+import { isRlsTenancy } from "@getstrata/core/tenant/tenancyConfig";
 import { migrate } from "../db/migrate.ts";
 import { buildRoutes } from "../routes.ts";
 import { loadConfig } from "./config.ts";
@@ -3654,6 +4306,9 @@ export async function bootstrapApp(options: BootstrapOptions = {}): Promise<Boot
 ${needsEnsure(layers) ? `  await ensureAppDatabase();
 ` : ""}  const appConfig = loadConfig();
   getSql();
+  if (isRlsTenancy()) {
+    await assertRlsLiveDatabaseRole();
+  }
   configureModulesDirectory(join(import.meta.dir, "../modules"));
   await ensureModulesLoaded();
   const context = createAppContext();
@@ -3754,36 +4409,22 @@ export function plainText(body: string, status = 200): Response {
 }
 
 // src/renderScim.ts
-function ph2(layers, count, start = 1) {
-  if (layers.database === "postgres") {
-    return Array.from({ length: count }, (_, index) => `$${start + index}`).join(", ");
-  }
-  return Array.from({ length: count }, () => "?").join(", ");
-}
-function sqlFalse2(layers) {
-  return layers.database === "postgres" ? "false" : "0";
-}
 function renderScimModule(layers) {
   if (!layers.extras.scim || !authNeedsUsers(layers.auth)) {
     return null;
   }
-  const tenantOn = usesTenantTable(layers.tenancy);
-  const insertCols = tenantOn ? "name, email, password, is_admin, tenant_id" : "name, email, password, is_admin";
-  const insertPh = tenantOn ? ph2(layers, 5) : ph2(layers, 4);
-  const insertTail = tenantOn ? `, ${sqlFalse2(layers)}, tenantId` : `, ${sqlFalse2(layers)}`;
-  const emailPh = ph2(layers, 1);
-  const idPh = ph2(layers, 1);
-  const updatePh = `${ph2(layers, 1)}, ${ph2(layers, 1, 2)}, ${ph2(layers, 1, 3)}`;
   return `import { randomBytes } from "node:crypto";
 import type { AppModule } from "@getstrata/bootstrap/contracts";
 import { routeParams } from "@getstrata/bootstrap/web/routing";
 import { createScimAuthMiddleware } from "@getstrata/core/auth/scimAuthMiddleware";
 import { hashPassword } from "@getstrata/core/auth/password";
+import { BadRequestError } from "@getstrata/core/errors/http";
+import { parsePositiveIntParam } from "@getstrata/core/http/validation";
 import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createScimThrottleMiddleware } from "@getstrata/core/http/scimThrottleMiddleware";
 import { currentTenant } from "@getstrata/core/tenant/tenantContext";
-import { getSql } from "../../bootstrap/database.ts";
+import { User } from "../../models/User.ts";
 
 const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
 const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
@@ -3791,12 +4432,29 @@ const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
 const CONFIG_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
 
-type UserRow = { id: number; name: string; email: string };
-
 function scimEnabled(): boolean {
   return (process.env.FEATURE_SCIM ?? "false") === "true";
 }
 
+function tenantId(): number {
+  const tenant = currentTenant();
+  if (!tenant) {
+    throw new Error("SCIM requires a tenant context.");
+  }
+  return tenant.id;
+}
+
+function readScimUserId(request: Request): number | Response {
+  try {
+    return parsePositiveIntParam(routeParams(request).id ?? "", "id");
+  } catch (error) {
+    if (error instanceof BadRequestError) {
+      return scimError("Invalid id.", 400);
+    }
+    throw error;
+  }
+}
+
 function scimJson(body: unknown, status = 200): Response {
   return Response.json(body, {
     status,
@@ -3808,13 +4466,15 @@ function scimError(detail: string, status: number): Response {
   return scimJson({ schemas: [ERROR_SCHEMA], detail, status: String(status) }, status);
 }
 
-function toScimUser(row: UserRow) {
+function toScimUser(user: { get(key: "id" | "name" | "email"): unknown }) {
+  const email = String(user.get("email") ?? "");
+  const name = String(user.get("name") ?? "");
   return {
     schemas: [USER_SCHEMA],
-    id: String(row.id),
-    userName: row.email,
-    name: { formatted: row.name },
-    emails: [{ value: row.email, primary: true }],
+    id: String(user.get("id")),
+    userName: email,
+    name: { formatted: name },
+    emails: [{ value: email, primary: true }],
     active: true,
     meta: { resourceType: "User" },
   };
@@ -3904,24 +4564,29 @@ const scimModule: AppModule = {
             const url = new URL(request.url);
             const filter = url.searchParams.get("filter") ?? "";
             const match = /userName\\s+eq\\s+"([^"]+)"/i.exec(filter);
-            let rows: UserRow[];
+            const startIndex = Math.max(1, Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10) || 1);
+            const count = Math.min(200, Math.max(1, Number.parseInt(url.searchParams.get("count") ?? "200", 10) || 200));
             if (match?.[1]) {
-              rows = await getSql().unsafe<UserRow>(
-                "SELECT id, name, email FROM users WHERE email = ${emailPh}",
-                [match[1].trim().toLowerCase()],
-              );
-            } else {
-              rows = await getSql().unsafe<UserRow>("SELECT id, name, email FROM users");
+              const email = match[1].trim().toLowerCase();
+              const user = await User.where({ email, tenant_id: tenantId() }).first();
+              const users = user ? [user] : [];
+              const slice = users.slice(startIndex - 1, startIndex - 1 + count);
+              return scimJson({
+                schemas: [LIST_SCHEMA],
+                totalResults: users.length,
+                startIndex,
+                itemsPerPage: slice.length,
+                Resources: slice.map(toScimUser),
+              });
             }
-            const startIndex = Math.max(1, Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10) || 1);
-            const count = Math.min(200, Math.max(1, Number.parseInt(url.searchParams.get("count") ?? String(rows.length || 1), 10) || 200));
-            const slice = rows.slice(startIndex - 1, startIndex - 1 + count);
+            const totalResults = await User.where({ tenant_id: tenantId() }).count();
+            const page = await User.where({ tenant_id: tenantId() }).offset(startIndex - 1).limit(count).get();
             return scimJson({
               schemas: [LIST_SCHEMA],
-              totalResults: rows.length,
+              totalResults,
               startIndex,
-              itemsPerPage: slice.length,
-              Resources: slice.map(toScimUser),
+              itemsPerPage: page.length,
+              Resources: page.map(toScimUser),
             });
           }),
         ),
@@ -3934,28 +4599,16 @@ const scimModule: AppModule = {
             if (!email) {
               return scimError("userName is required.", 400);
             }
-            const existing = await getSql().unsafe<UserRow>(
-              "SELECT id, name, email FROM users WHERE email = ${emailPh}",
-              [email],
-            );
-            if (existing[0]) {
+            const existing = await User.where({ email, tenant_id: tenantId() }).first();
+            if (existing) {
               return scimError("User already exists.", 409);
             }
             const hashed = await hashPassword(randomBytes(18).toString("hex"));
-            const tenantId = currentTenant()?.id ?? 1;
-            await getSql().unsafe(
-              "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
-              [name, email, hashed${insertTail}],
-            );
-            const created = await getSql().unsafe<UserRow>(
-              "SELECT id, name, email FROM users WHERE email = ${emailPh}",
-              [email],
-            );
-            const row = created[0];
-            if (!row) {
+            const created = await User.create({ name, email, password: hashed, is_admin: false, tenant_id: tenantId() });
+            if (!created) {
               return scimError("Could not create user.", 500);
             }
-            return scimJson(toScimUser(row), 201);
+            return scimJson(toScimUser(created), 201);
           }),
         ),
       },
@@ -3963,61 +4616,55 @@ const scimModule: AppModule = {
         GET: kernel.wrap(
           "api",
           wrapScim(async (request) => {
-            const id = Number.parseInt(routeParams(request).id ?? "", 10);
-            const rows = await getSql().unsafe<UserRow>(
-              "SELECT id, name, email FROM users WHERE id = ${idPh}",
-              [id],
-            );
-            const row = rows[0];
-            if (!row) {
+            const id = readScimUserId(request);
+            if (id instanceof Response) {
+              return id;
+            }
+            const user = await User.where({ id, tenant_id: tenantId() }).first();
+            if (!user) {
               return scimError("User not found.", 404);
             }
-            return scimJson(toScimUser(row));
+            return scimJson(toScimUser(user));
           }),
         ),
         PUT: kernel.wrap(
           "api",
           wrapScim(async (request) => {
-            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const id = readScimUserId(request);
+            if (id instanceof Response) {
+              return id;
+            }
             const body = (await request.json()) as Record<string, unknown>;
             const email = readUserName(body);
             const name = readName(body, email);
             if (!email || !name) {
               return scimError("userName and name are required.", 400);
             }
-            await getSql().unsafe(
-              "UPDATE users SET name = ${updatePh.split(", ")[0]}, email = ${updatePh.split(", ")[1]} WHERE id = ${updatePh.split(", ")[2]}",
-              [name, email, id],
-            );
-            const rows = await getSql().unsafe<UserRow>(
-              "SELECT id, name, email FROM users WHERE id = ${idPh}",
-              [id],
-            );
-            const row = rows[0];
-            if (!row) {
+            const user = await User.where({ id, tenant_id: tenantId() }).first();
+            if (!user) {
               return scimError("User not found.", 404);
             }
-            return scimJson(toScimUser(row));
+            await user.update({ name, email });
+            return scimJson(toScimUser(user));
           }),
         ),
         PATCH: kernel.wrap(
           "api",
           wrapScim(async (request) => {
-            const id = Number.parseInt(routeParams(request).id ?? "", 10);
-            const existing = await getSql().unsafe<UserRow>(
-              "SELECT id, name, email FROM users WHERE id = ${idPh}",
-              [id],
-            );
-            const row = existing[0];
-            if (!row) {
+            const id = readScimUserId(request);
+            if (id instanceof Response) {
+              return id;
+            }
+            const user = await User.where({ id, tenant_id: tenantId() }).first();
+            if (!user) {
               return scimError("User not found.", 404);
             }
             const body = (await request.json()) as { schemas?: string[]; Operations?: Array<{ op?: string; path?: string; value?: unknown }> };
             if (body.schemas && !body.schemas.includes(PATCH_SCHEMA)) {
               return scimError("Unsupported patch schema.", 400);
             }
-            let name = row.name;
-            let email = row.email;
+            let name = String(user.get("name") ?? "");
+            let email = String(user.get("email") ?? "");
             for (const operation of body.Operations ?? []) {
               const op = (operation.op ?? "replace").toLowerCase();
               if (op !== "replace" && op !== "add") {
@@ -4038,18 +4685,21 @@ const scimModule: AppModule = {
                 name = readName(value, name);
               }
             }
-            await getSql().unsafe(
-              "UPDATE users SET name = ${updatePh.split(", ")[0]}, email = ${updatePh.split(", ")[1]} WHERE id = ${updatePh.split(", ")[2]}",
-              [name, email, id],
-            );
-            return scimJson(toScimUser({ id: row.id, name, email }));
+            await user.update({ name, email });
+            return scimJson(toScimUser(user));
           }),
         ),
         DELETE: kernel.wrap(
           "api",
           wrapScim(async (request) => {
-            const id = Number.parseInt(routeParams(request).id ?? "", 10);
-            await getSql().unsafe("DELETE FROM users WHERE id = ${idPh}", [id]);
+            const id = readScimUserId(request);
+            if (id instanceof Response) {
+              return id;
+            }
+            const user = await User.where({ id, tenant_id: tenantId() }).first();
+            if (user) {
+              await user.delete();
+            }
             return new Response(null, { status: 204 });
           }),
         ),
@@ -4131,6 +4781,18 @@ function writeGeneratedFiles(options) {
   } else {
     removeIfExists(join2(targetDir, "docker-compose.yml"));
   }
+  const postgresInit = renderPostgresAppRoleInitSql(projectName, layers);
+  if (postgresInit) {
+    writeText(join2(targetDir, "db/ensure-postgres-app-role.sql"), postgresInit);
+    if (usesComposePostgres(layers)) {
+      writeText(join2(targetDir, "docker/postgres-init/01-strata-app-role.sql"), postgresInit);
+    } else {
+      removeIfExists(join2(targetDir, "docker/postgres-init"));
+    }
+  } else {
+    removeIfExists(join2(targetDir, "db/ensure-postgres-app-role.sql"));
+    removeIfExists(join2(targetDir, "docker/postgres-init"));
+  }
   writeText(join2(src, "routes.ts"), renderRoutesTs());
   writeText(join2(src, "lib/view.ts"), renderViewTs(layers));
   writeText(join2(src, "bootstrap/config.ts"), renderConfigTs());
@@ -4145,9 +4807,22 @@ function writeGeneratedFiles(options) {
   writeText(join2(src, "bootstrap/createApp.ts"), renderCreateAppTs(layers));
   writeText(join2(src, "bootstrap/providers/config.ts"), renderConfigProvider(layers));
   writeText(join2(src, "bootstrap/providers/queue.ts"), renderQueueProvider());
+  writeText(join2(src, "bootstrap/providers/policy.ts"), renderPolicyProvider());
   writeText(join2(src, "bootstrap/providers/index.ts"), renderProvidersIndex());
   writeText(join2(src, "bootstrap/providers/auth.ts"), renderAuthProvider(layers));
-  writeText(join2(src, "models/Note.ts"), renderNoteModel());
+  writeText(join2(src, "models/Note.ts"), renderNoteModel(layers));
+  if (authNeedsUsers(layers.auth)) {
+    writeText(join2(src, "models/User.ts"), renderUserModel(layers));
+    writeText(join2(src, "models/AuthOneTimeToken.ts"), renderAuthOneTimeTokenModel());
+  } else {
+    removeIfExists(join2(src, "models/User.ts"));
+    removeIfExists(join2(src, "models/AuthOneTimeToken.ts"));
+  }
+  if (authUsesToken(layers.auth)) {
+    writeText(join2(src, "models/ApiToken.ts"), renderApiTokenModel());
+  } else {
+    removeIfExists(join2(src, "models/ApiToken.ts"));
+  }
   writeText(join2(src, "db/migrate.ts"), renderMigrateTs(layers));
   writeText(join2(src, "db/fresh.ts"), renderFreshTs(layers));
   writeText(join2(src, "db/seed.ts"), renderSeedTs());
@@ -4178,6 +4853,17 @@ function writeGeneratedFiles(options) {
     removeIfExists(join2(src, "bootstrap/pendingMfa.ts"));
   }
   writeText(join2(targetDir, "public/assets/site.css"), renderSiteCss());
+  const htmxSource = join2(options.templateRoot ?? starterPackageRoot(), "public/assets/htmx.min.js");
+  const htmxFallback = join2(starterPackageRoot(), "templates/public/assets/htmx.min.js");
+  const htmxPath = existsSync2(htmxSource) ? htmxSource : htmxFallback;
+  if (existsSync2(htmxPath)) {
+    mkdirSync2(join2(targetDir, "public/assets"), { recursive: true });
+    copyFileSync(htmxPath, join2(targetDir, "public/assets/htmx.min.js"));
+    const versionSidecar = `${htmxPath}.version`;
+    if (existsSync2(versionSidecar)) {
+      copyFileSync(versionSidecar, join2(targetDir, "public/assets/htmx.min.js.version"));
+    }
+  }
   writeText(join2(targetDir, "views/home.eta"), renderHomeView(projectName, layers));
   writeText(join2(targetDir, "views/layouts/app.eta"), renderLayout(layers, projectName));
   if (htmlAuthKit(layers.auth)) {
@@ -4191,6 +4877,7 @@ function writeGeneratedFiles(options) {
     if (layers.extras.mfa) {
       writeText(join2(targetDir, "views/auth/mfa-challenge.eta"), renderMfaChallengeView());
       writeText(join2(targetDir, "views/auth/mfa-setup.eta"), renderMfaSetupView());
+      writeText(join2(targetDir, "views/auth/confirm-password.eta"), renderConfirmPasswordView());
     }
   }
   mkdirSync2(join2(targetDir, "storage"), { recursive: true });