create-efc-app 0.9.3 → 0.10.0

package/dist/index.js

@@ -46,18 +46,22 @@ function sendsMail(opts) {
 function usesTables(opts) {
   return opts.database === "postgresql" && opts.modelApi !== "defineModel";
 }
+function usesCollections(opts) {
+  return opts.database === "mongodb" && opts.modelApi !== "defineModel";
+}
 function orm(opts) {
   const t = usesTables(opts);
+  const c = usesCollections(opts);
   const where = (filter) => filter.replace(/\s/g, "") === "{}" ? "" : `{ where: ${filter} }`;
   const byId = (id) => id === "id" ? "{ id }" : `{ id: ${id} }`;
   return {
     findOne: (m, filter) => t ? `${m}.findFirst({ where: ${filter} })` : `${m}.findOne(${filter})`,
     findById: (m, id) => t ? `${m}.findUnique({ where: ${byId(id)} })` : `${m}.findById(${id})`,
     find: (m, filter) => t ? `${m}.findMany(${where(filter)})` : `${m}.find(${filter})`,
-    count: (m, filter) => t ? `${m}.count(${where(filter)})` : `${m}.count(${filter})`,
+    count: (m, filter) => t ? `${m}.count(${where(filter)})` : c ? `${m}.countDocuments(${filter})` : `${m}.count(${filter})`,
     create: (m, data) => t ? `${m}.create({ data: ${data} })` : `${m}.create(${data})`,
-    update: (m, id, data) => t ? `${m}.update({ where: ${byId(id)}, data: ${data} })` : `${m}.update(${id}, ${data})`,
-    delete: (m, id) => t ? `${m}.delete({ where: ${byId(id)} })` : `${m}.delete(${id})`
+    update: (m, id, data) => t ? `${m}.update({ where: ${byId(id)}, data: ${data} })` : c ? `${m}.findByIdAndUpdate(${id}, ${data}, { returnDocument: 'after' })` : `${m}.update(${id}, ${data})`,
+    delete: (m, id) => t ? `${m}.delete({ where: ${byId(id)} })` : c ? `${m}.findByIdAndDelete(${id})` : `${m}.delete(${id})`
   };
 }
 function generatedModels(opts) {
@@ -83,7 +87,7 @@ function generatedModels(opts) {
   return m;
 }
 function modelApi(opts) {
-  const name = usesTables(opts) ? "defineTable" : "defineModel";
+  const name = usesTables(opts) ? "defineTable" : usesCollections(opts) ? "defineCollection" : "defineModel";
   return { name, import: `import { ${name} } from 'express-file-cluster';` };
 }
 function refField(opts, r) {
@@ -153,7 +157,7 @@ async function scaffold(opts) {
 }
 async function writePackageJson(dest, opts) {
   const deps = {
-    "express-file-cluster": "^0.9.3"
+    "express-file-cluster": "^0.10.0"
   };
   if (opts.database === "mongodb") deps["mongoose"] = "^9.7.2";
   if (opts.database === "postgresql") {
@@ -238,6 +242,9 @@ ${declaration}
   jwtExpiresIn: process.env.JWT_EXPIRES_IN,
   cookieDomain: process.env.COOKIE_DOMAIN,
   cors: corsOrigins ? { origin: corsOrigins } : true,
+  // Behind a proxy / load balancer (Render, Fly, Heroku, nginx): the number of hops, e.g. 1,
+  // so req.ip is the client and rate limits count per client.
+  trustProxy: process.env.TRUST_PROXY ? Number(process.env.TRUST_PROXY) : undefined,
   authStrategy: '${opts.authStrategy}',
   tasks: ${tasks},
   // Cache + session-revocation store (logout really invalidates tokens). Redis when
@@ -311,7 +318,8 @@ Optional \u2014 the same docs over MCP, with search and scaffolding tools:
 ${usesTables(opts) ? `- \`src/model/*.${ext}\` \u2014 \`defineTable\` models (PostgreSQL-native, Prisma-style queries:
   \`findMany({ where, include })\`, \`create({ data })\`, \`update({ where, data })\`). A \`ref\` is a
   foreign key; ${opts.registry ? "add back-relations to a model's `relations` when you need `include`" : "back-relations are in each model's `relations`"}. \`src/model/index.${ext}\` imports
-  them all${opts.language === "typescript" ? " and declares `Tables` (typed `include`)" : ""} \u2014 add new models there.` : `- \`src/model/*.${ext}\` \u2014 \`defineModel\` models.`}
+  them all${opts.language === "typescript" ? " and declares `Tables` (typed `include`)" : ""} \u2014 add new models there.` : usesCollections(opts) ? `- \`src/model/*.${ext}\` \u2014 \`defineCollection\` models (MongoDB-native, mongoose-style queries:
+  \`find(filter, { projection, sort })\`, \`findByIdAndUpdate\`, typed \`pipeline()\`, \`lookup()\`).` : `- \`src/model/*.${ext}\` \u2014 \`defineModel\` models.`}
 - \`src/index.${ext}\` is the entry point; it imports \`efc.config.${ext}\` and passes it to \`ignite()\`.
 - Only three import paths exist: \`express-file-cluster\`, \`express-file-cluster/auth\`,
   \`express-file-cluster/tasks\`.
@@ -397,7 +405,9 @@ CORS_ORIGINS=http://localhost:3000${smtpVars}${oauthEnv}`;
 NODE_ENV=development
 DATABASE_URL=${dbExampleUrl}
 JWT_SECRET=<generate with: openssl rand -hex 64>${redis}
-CORS_ORIGINS=http://localhost:3000,https://yourapp.com${smtpExample}${oauthExample}`;
+CORS_ORIGINS=http://localhost:3000,https://yourapp.com
+# Behind a proxy / load balancer: how many hops to trust, so rate limits see client IPs
+# TRUST_PROXY=1${smtpExample}${oauthExample}`;
   await fs.outputFile(path.join(dest, ".env"), dotenv);
   await fs.outputFile(path.join(dest, ".env.example"), example);
 }
@@ -592,9 +602,9 @@ ${hasUser ? `import { User } from '../../model/User.js';
     const match = await verifyPassword(password, admin.password);
     if (!match) return res.status(401).json({ error: 'Invalid credentials' });
     if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
-    await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
-    await issueRefreshToken(res, Admin, admin.id);
-    return res.json({ message: 'Logged in as admin' });
+    const token = await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
+    const refreshToken = await issueRefreshToken(res, Admin, admin.id);
+    return res.json({ message: 'Logged in as admin', ...(token ? { token, refreshToken } : {}) });
   }
 
   const user = await ${db.findOne("User", `{ email }`)};
@@ -602,32 +612,47 @@ ${hasUser ? `import { User } from '../../model/User.js';
   const match = await verifyPassword(password, user.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
-  await issueToken(res, { id: user.id, role: user.role, email: user.email });
-  await issueRefreshToken(res, User, user.id);
-  res.json({ message: 'Logged in' });` : hasAdmin ? `  const admin = await ${db.findOne("Admin", `{ email }`)};
+  const token = await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  const refreshToken = await issueRefreshToken(res, User, user.id);
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({ message: 'Logged in', ...(token ? { token, refreshToken } : {}) });` : hasAdmin ? `  const admin = await ${db.findOne("Admin", `{ email }`)};
   if (!admin) return res.status(401).json({ error: 'Invalid credentials' });
   const match = await verifyPassword(password, admin.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
-  await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
-  await issueRefreshToken(res, Admin, admin.id);
-  res.json({ message: 'Logged in as admin' });` : `  const user = await ${db.findOne("User", `{ email }`)};
+  const token = await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
+  const refreshToken = await issueRefreshToken(res, Admin, admin.id);
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({ message: 'Logged in as admin', ...(token ? { token, refreshToken } : {}) });` : `  const user = await ${db.findOne("User", `{ email }`)};
   if (!user) return res.status(401).json({ error: 'Invalid credentials' });
   const match = await verifyPassword(password, user.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
-  await issueToken(res, { id: user.id, role: user.role, email: user.email });
-  await issueRefreshToken(res, User, user.id);
-  res.json({ message: 'Logged in' });`;
+  const token = await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  const refreshToken = await issueRefreshToken(res, User, user.id);
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({ message: 'Logged in', ...(token ? { token, refreshToken } : {}) });`;
   const loginContent = hasModels ? ts ? `import { issueToken, verifyPassword } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
-${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+import { rateLimit } from 'express-file-cluster';
+${loginDbImports}${loginMeta}// 10 attempts per 15 minutes per address and account. Keyed on the email too, so behind a
+// proxy without TRUST_PROXY (every client then has the proxy's IP) it still limits one
+// account at a time, never everyone.
+export const middlewares = [
+  rateLimit({
+    window: '15m',
+    max: 10,
+    key: (req) => \`\${req.ip}:\${String(req.body?.email ?? '').toLowerCase()}\`,
+  }),
+];
+
+const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
 async function issueRefreshToken(
   res: Response,
-  model: ${usesTables(opts) ? "{ update: (args: { where: { id: string }; data: Record<string, unknown> }) => Promise<unknown> }" : "{ update: (id: string, data: Record<string, unknown>) => Promise<unknown> }"},
+  model: ${usesTables(opts) ? "{ update: (args: { where: { id: string }; data: Record<string, unknown> }) => Promise<unknown> }" : usesCollections(opts) ? "{ findByIdAndUpdate: (id: string, data: Record<string, unknown>, options: { returnDocument: 'after' }) => Promise<unknown> }" : "{ update: (id: string, data: Record<string, unknown>) => Promise<unknown> }"},
   id: string,
-): Promise<void> {
+): Promise<string> {
   const refreshToken = crypto.randomBytes(40).toString('hex');
   await ${db.update("model", "id", "{ refreshToken, refreshTokenExpiry: new Date(Date.now() + REFRESH_TOKEN_TTL_MS) }")};
   res.cookie('efc_refresh_token', refreshToken, {
@@ -636,16 +661,32 @@ async function issueRefreshToken(
     sameSite: 'strict',
     maxAge: REFRESH_TOKEN_TTL_MS,
   });
+  return refreshToken;
 }
 
 export const POST = async (req: Request, res: Response) => {
   const { email, password } = req.body;
-  if (!email || !password) return res.status(400).json({ error: 'email and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || typeof password !== 'string' || !email || !password) {
+    return res.status(400).json({ error: 'email and password are required' });
+  }
 
 ${loginBody}
 };
 ` : `import { issueToken, verifyPassword } from 'express-file-cluster/auth';
-${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+import { rateLimit } from 'express-file-cluster';
+${loginDbImports}${loginMeta}// 10 attempts per 15 minutes per address and account. Keyed on the email too, so behind a
+// proxy without TRUST_PROXY (every client then has the proxy's IP) it still limits one
+// account at a time, never everyone.
+export const middlewares = [
+  rateLimit({
+    window: '15m',
+    max: 10,
+    key: (req) => \`\${req.ip}:\${String(req.body?.email ?? '').toLowerCase()}\`,
+  }),
+];
+
+const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
 async function issueRefreshToken(res, model, id) {
   const refreshToken = crypto.randomBytes(40).toString('hex');
@@ -656,11 +697,15 @@ async function issueRefreshToken(res, model, id) {
     sameSite: 'strict',
     maxAge: REFRESH_TOKEN_TTL_MS,
   });
+  return refreshToken;
 }
 
 export const POST = async (req, res) => {
   const { email, password } = req.body;
-  if (!email || !password) return res.status(400).json({ error: 'email and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || typeof password !== 'string' || !email || !password) {
+    return res.status(400).json({ error: 'email and password are required' });
+  }
 
 ${loginBody}
 };
@@ -750,7 +795,8 @@ ${sendsMail(opts) ? "import { enqueue } from 'express-file-cluster/tasks';\n" :
   const registerContent = ts ? `import type { Request, Response } from 'express';
 ${registerDbImports}${registerMeta}export const POST = async (req: Request, res: Response) => {
   const { name, email, password } = req.body;
-  if (!name || !email || !password) {
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof name !== 'string' || typeof email !== 'string' || typeof password !== 'string' || !name || !email || !password) {
     return res.status(400).json({ error: 'name, email and password are required' });
   }
   const existing = await ${db.findOne("User", `{ email }`)};
@@ -759,12 +805,13 @@ ${registerDbImports}${registerMeta}export const POST = async (req: Request, res:
   const verifyToken = crypto.randomBytes(32).toString('hex');
   const user = await ${db.create("User", `{ name, email, password: hashed, verifyToken }`)};
 ${sendVerifyEmail}
-  const { password: _, verifyToken: __, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.status(201).json({ message: 'Account created successfully', user: safe });
 };
 ` : `${registerDbImports}${registerMeta}export const POST = async (req, res) => {
   const { name, email, password } = req.body;
-  if (!name || !email || !password) {
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof name !== 'string' || typeof email !== 'string' || typeof password !== 'string' || !name || !email || !password) {
     return res.status(400).json({ error: 'name, email and password are required' });
   }
   const existing = await ${db.findOne("User", `{ email }`)};
@@ -773,7 +820,7 @@ ${sendVerifyEmail}
   const verifyToken = crypto.randomBytes(32).toString('hex');
   const user = await ${db.create("User", `{ name, email, password: hashed, verifyToken }`)};
 ${sendVerifyEmail}
-  const { password: _, verifyToken: __, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.status(201).json({ message: 'Account created successfully', user: safe });
 };
 `;
@@ -925,18 +972,21 @@ export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
   const limit = Math.min(100, Number(req.query.limit) || 20);
   const [all, total] = await Promise.all([${db.find("User", `{}`)}, ${db.count("User", `{}`)}]);
-  const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, ...u }) => u);
+  const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...u }) => u);
   res.json({ users, total, page, limit });
 };
 
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { name, email, password, role } = req.body;
-  if (!name || !email || !password) return res.status(400).json({ error: 'name, email and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof name !== 'string' || typeof email !== 'string' || typeof password !== 'string' || !name || !email || !password) {
+    return res.status(400).json({ error: 'name, email and password are required' });
+  }
   const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await hashPassword(password);
   const user = await ${db.create("User", `{ name, email, password: hashed, role: role ?? 'user' }`)};
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.status(201).json({ message: 'User created', user: safe });
 };
 ` : `import { hashPassword, requireAuth } from 'express-file-cluster/auth';
@@ -945,18 +995,21 @@ export const GET = async (req, res) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
   const limit = Math.min(100, Number(req.query.limit) || 20);
   const [all, total] = await Promise.all([${db.find("User", `{}`)}, ${db.count("User", `{}`)}]);
-  const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, ...u }) => u);
+  const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...u }) => u);
   res.json({ users, total, page, limit });
 };
 
 export const POST = async (req, res) => {
 ${roleGuard}  const { name, email, password, role } = req.body;
-  if (!name || !email || !password) return res.status(400).json({ error: 'name, email and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof name !== 'string' || typeof email !== 'string' || typeof password !== 'string' || !name || !email || !password) {
+    return res.status(400).json({ error: 'name, email and password are required' });
+  }
   const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await hashPassword(password);
   const user = await ${db.create("User", `{ name, email, password: hashed, role: role ?? 'user' }`)};
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.status(201).json({ message: 'User created', user: safe });
 };
 `;
@@ -1005,14 +1058,14 @@ export const meta: RouteMeta = {
 ` : "";
   const adminUserByIdDbImport = `import { User } from '../../../model/User.js';
 `;
-  const userByIdContent = ts ? `import { requireAuth } from 'express-file-cluster/auth';
+  const userByIdContent = ts ? `import { requireAuth, revokeAllSessions } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 ${adminUserByIdDbImport}${userByIdMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.json({ user: safe });
 };
 
@@ -1021,7 +1074,10 @@ ${roleGuard}  const { id } = req.params;
   const { name, email, role, isActive } = req.body;
   const updated = await ${db.update("User", `id`, `{ name, email, role, isActive }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = updated;
+  // The role lives in the user's JWTs: end them, or a demoted/suspended user keeps access
+  // until they expire. (/auth/refresh also refuses inactive accounts.)
+  if (role !== undefined || isActive === false) await revokeAllSessions(id);
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = updated;
   res.json({ message: 'User updated', user: safe });
 };
 
@@ -1030,15 +1086,16 @@ ${roleGuard}  const { id } = req.params;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
   await ${db.delete("User", `id`)};
+  await revokeAllSessions(id);
   res.json({ message: \`User \${id} deleted\` });
 };
-` : `import { requireAuth } from 'express-file-cluster/auth';
+` : `import { requireAuth, revokeAllSessions } from 'express-file-cluster/auth';
 ${adminUserByIdDbImport}${userByIdMeta}${middlewares}
 export const GET = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.json({ user: safe });
 };
 
@@ -1047,7 +1104,10 @@ ${roleGuard}  const { id } = req.params;
   const { name, email, role, isActive } = req.body;
   const updated = await ${db.update("User", `id`, `{ name, email, role, isActive }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = updated;
+  // The role lives in the user's JWTs: end them, or a demoted/suspended user keeps access
+  // until they expire. (/auth/refresh also refuses inactive accounts.)
+  if (role !== undefined || isActive === false) await revokeAllSessions(id);
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = updated;
   res.json({ message: 'User updated', user: safe });
 };
 
@@ -1056,6 +1116,7 @@ ${roleGuard}  const { id } = req.params;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
   await ${db.delete("User", `id`)};
+  await revokeAllSessions(id);
   res.json({ message: \`User \${id} deleted\` });
 };
 `;
@@ -1107,7 +1168,7 @@ export const GET = async (req: Request, res: Response) => {
   const { id } = (req as any).user;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.json({ user: safe });
 };
 
@@ -1116,7 +1177,7 @@ export const PUT = async (req: Request, res: Response) => {
   const { name, email } = req.body;
   const updated = await ${db.update("User", `id`, `{ name, email }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = updated;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = updated;
   res.json({ message: 'Profile updated', user: safe });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
@@ -1125,7 +1186,7 @@ export const GET = async (req, res) => {
   const { id } = req.user;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.json({ user: safe });
 };
 
@@ -1134,7 +1195,7 @@ export const PUT = async (req, res) => {
   const { name, email } = req.body;
   const updated = await ${db.update("User", `id`, `{ name, email }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = updated;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = updated;
   res.json({ message: 'Profile updated', user: safe });
 };
 `;
@@ -1432,12 +1493,15 @@ ${refreshModelImports}${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60
 export const POST = async (req: Request, res: Response) => {
   const token = req.cookies?.['efc_refresh_token'] || req.body?.refreshToken;
   if (!token) return res.status(401).json({ error: 'Refresh token required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof token !== 'string') return res.status(400).json({ error: 'Invalid refresh token' });
 
 ${refreshLookup}
 
   if (!account || !account.refreshTokenExpiry || new Date(account.refreshTokenExpiry) < new Date()) {
     return res.status(401).json({ error: 'Invalid or expired refresh token' });
   }
+  if (account.isActive === false) return res.status(403).json({ error: 'Account suspended' });
 
   const newRefreshToken = crypto.randomBytes(40).toString('hex');
   const refreshTokenExpiry = new Date(Date.now() + REFRESH_TOKEN_TTL_MS);
@@ -1450,8 +1514,12 @@ ${refreshPersist}
     maxAge: REFRESH_TOKEN_TTL_MS,
   });
 
-  await issueToken(res, { id: account.id, role: account.role, email: account.email });
-  res.json({ message: 'Token refreshed' });
+  const accessToken = await issueToken(res, { id: account.id, role: account.role, email: account.email });
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({
+    message: 'Token refreshed',
+    ...(accessToken ? { token: accessToken, refreshToken: newRefreshToken } : {}),
+  });
 };
 ` : `import { issueToken } from 'express-file-cluster/auth';
 import crypto from 'node:crypto';
@@ -1460,12 +1528,15 @@ ${refreshModelImports}${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60
 export const POST = async (req, res) => {
   const token = req.cookies?.efc_refresh_token || req.body?.refreshToken;
   if (!token) return res.status(401).json({ error: 'Refresh token required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof token !== 'string') return res.status(400).json({ error: 'Invalid refresh token' });
 
 ${refreshLookup}
 
   if (!account || !account.refreshTokenExpiry || new Date(account.refreshTokenExpiry) < new Date()) {
     return res.status(401).json({ error: 'Invalid or expired refresh token' });
   }
+  if (account.isActive === false) return res.status(403).json({ error: 'Account suspended' });
 
   const newRefreshToken = crypto.randomBytes(40).toString('hex');
   const refreshTokenExpiry = new Date(Date.now() + REFRESH_TOKEN_TTL_MS);
@@ -1478,8 +1549,12 @@ ${refreshPersist}
     maxAge: REFRESH_TOKEN_TTL_MS,
   });
 
-  await issueToken(res, { id: account.id, role: account.role, email: account.email });
-  res.json({ message: 'Token refreshed' });
+  const accessToken = await issueToken(res, { id: account.id, role: account.role, email: account.email });
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({
+    message: 'Token refreshed',
+    ...(accessToken ? { token: accessToken, refreshToken: newRefreshToken } : {}),
+  });
 };
 `;
     await fs.outputFile(path.join(dest, "src", "api", "auth", `refresh.${ext}`), refreshContent);
@@ -1513,7 +1588,8 @@ ${veMeta}export const GET = async (req: Request, res: Response) => {
 
 export const POST = async (req: Request, res: Response) => {
   const { email } = req.body;
-  if (!email) return res.status(400).json({ error: 'email is required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || !email) return res.status(400).json({ error: 'email is required' });
 
   const user = await ${db.findOne("User", `{ email }`)};
   if (user && !user.isVerified) {
@@ -1538,7 +1614,8 @@ ${veMeta}export const GET = async (req, res) => {
 
 export const POST = async (req, res) => {
   const { email } = req.body;
-  if (!email) return res.status(400).json({ error: 'email is required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || !email) return res.status(400).json({ error: 'email is required' });
 
   const user = await ${db.findOne("User", `{ email }`)};
   if (user && !user.isVerified) {
@@ -1569,11 +1646,18 @@ ${hasAdmin ? `import { Admin } from '../../model/Admin.js';
     else if (admin) await ${db.update("Admin", `admin.id`, `{ resetToken, resetTokenExpiry }`)};` : `    await ${db.update("User", `user.id`, `{ resetToken, resetTokenExpiry }`)};`;
     const fpContent = ts ? `import type { Request, Response } from 'express';
 import crypto from 'node:crypto';
-${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
+import { rateLimit } from 'express-file-cluster';
+${mailerTaskImport}${fpModelImports}${fpMeta}// 5 reset emails per hour per address \u2014 keeps the endpoint from mail-bombing someone.
+export const middlewares = [
+  rateLimit({ window: '1h', max: 5, key: (req) => String(req.body?.email ?? '').toLowerCase() }),
+];
+
+const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
 
 export const POST = async (req: Request, res: Response) => {
   const { email } = req.body;
-  if (!email) return res.status(400).json({ error: 'email is required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || !email) return res.status(400).json({ error: 'email is required' });
 
 ${fpLookup}
 
@@ -1588,11 +1672,18 @@ ${sendResetEmail}  }
   res.json({ message: 'Reset email sent' });
 };
 ` : `import crypto from 'node:crypto';
-${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
+import { rateLimit } from 'express-file-cluster';
+${mailerTaskImport}${fpModelImports}${fpMeta}// 5 reset emails per hour per address \u2014 keeps the endpoint from mail-bombing someone.
+export const middlewares = [
+  rateLimit({ window: '1h', max: 5, key: (req) => String(req.body?.email ?? '').toLowerCase() }),
+];
+
+const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
 
 export const POST = async (req, res) => {
   const { email } = req.body;
-  if (!email) return res.status(400).json({ error: 'email is required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || !email) return res.status(400).json({ error: 'email is required' });
 
 ${fpLookup}
 
@@ -1628,7 +1719,10 @@ ${hasAdmin ? `import { Admin } from '../../model/Admin.js';
 import { hashPassword, revokeAllSessions } from 'express-file-cluster/auth';
 ${rpModelImports}${rpMeta}export const POST = async (req: Request, res: Response) => {
   const { token, password } = req.body;
-  if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof token !== 'string' || typeof password !== 'string' || !token || !password) {
+    return res.status(400).json({ error: 'token and password are required' });
+  }
 
 ${rpLookup}
 
@@ -1646,7 +1740,10 @@ ${rpPersist}
 ` : `import { hashPassword, revokeAllSessions } from 'express-file-cluster/auth';
 ${rpModelImports}${rpMeta}export const POST = async (req, res) => {
   const { token, password } = req.body;
-  if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof token !== 'string' || typeof password !== 'string' || !token || !password) {
+    return res.status(400).json({ error: 'token and password are required' });
+  }
 
 ${rpLookup}
 
@@ -2821,14 +2918,14 @@ ${suspendMeta}${mwAdmin4}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
   const { reason } = req.body;
-  // TODO: set user.isActive = false, log audit event
+  // TODO: set user.isActive = false (then revokeAllSessions(id) so open sessions end), log audit event
   res.json({ message: \`User \${id} suspended\`, reason });
 };
 ` : `${RA}${suspendMeta}${mwAdmin4}
 export const POST = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   const { reason } = req.body;
-  // TODO: set user.isActive = false, log audit event
+  // TODO: set user.isActive = false (then revokeAllSessions(id) so open sessions end), log audit event
   res.json({ message: \`User \${id} suspended\`, reason });
 };
 `;
@@ -3664,7 +3761,7 @@ async function writeOAuth(dest, opts) {
   const T = (s) => ts ? s : "";
   const userField = usesTables(opts) && generatedModels(opts).has("User") ? "user" : "userId";
   const lib = `import crypto from 'node:crypto';
-import { HttpError } from 'express-file-cluster';
+import { HttpError, cache } from 'express-file-cluster';
 import { hashPassword, issueToken } from 'express-file-cluster/auth';
 ${T("import type { Request, Response } from 'express';\n")}import { User } from '../model/User.js';
 import { OAuthAccount } from '../model/OAuthAccount.js';
@@ -3672,11 +3769,14 @@ import { OAuthAccount } from '../model/OAuthAccount.js';
 // Shared by the OAuth sign-in routes (src/api/auth/<provider>/).
 
 const STATE_TTL_MS = 10 * 60 * 1000; // a sign-in attempt has 10 minutes to come back
+const CODE_TTL_S = 60; // a bearer app has a minute to exchange its sign-in code
 ${T(`
 export interface OAuthState {
   state: string;
   nonce: string;
   verifier?: string;
+  /** Bearer apps: the S256 challenge of a verifier only the app knows (app \u2194 this server). */
+  appChallenge?: string;
 }
 
 export interface OAuthProfile {
@@ -3743,7 +3843,7 @@ export function takeState(
  * user with the same (provider-verified) email, else a new user. New users get a random
  * password \u2014 they can set a real one with the forgot-password flow.
  */
-export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuthProfile")})${T(": Promise<void>")} {
+export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuthProfile")})${T(": Promise<string | undefined>")} {
   const key = \`\${profile.provider}:\${profile.providerId}\`;
   const account = await ${db.findOne("OAuthAccount", "{ key }")};
   let user = account ? await ${db.findById("User", `account.${userField}`)} : null;
@@ -3778,12 +3878,66 @@ export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuth
     }
   }
   if (!user.isActive) throw new HttpError(403, 'Account suspended');
-  await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  // http-only: sets the cookie, returns undefined. bearer: returns the token.
+  return issueToken(res, { id: user.id, role: user.role, email: user.email });
+}
+
+/**
+ * Bearer apps start sign-in with \`?code_challenge=<base64url SHA-256 of a random verifier>\`
+ * (PKCE, RFC 7636, between the app and this server). Only the app holding the verifier can
+ * redeem the sign-in code \u2014 another app catching the myapp:// redirect can't.
+ */
+export function appChallengeFrom(query${T(": Request['query']")})${T(": string | undefined")} {
+  const challenge = query.code_challenge;
+  if (challenge === undefined) return undefined;
+  if (typeof challenge !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(challenge)) {
+    throw new HttpError(400, 'code_challenge must be the base64url SHA-256 of your code_verifier');
+  }
+  return challenge;
 }
 
-/** Where the browser goes once signed in. */
-export function successRedirect()${T(": string")} {
-  return process.env.OAUTH_SUCCESS_REDIRECT || '/';
+/**
+ * Where the browser goes once signed in. With authStrategy 'bearer' the JWT never goes in the
+ * URL (history, screenshots, logs): it gets a one-time code, valid for a minute, which the app
+ * that started the sign-in trades for the token at POST /auth/oauth/exchange.
+ */
+export async function successRedirect(
+  token${T("?: string")},
+  appChallenge${T("?: string")},
+)${T(": Promise<string>")} {
+  const to = process.env.OAUTH_SUCCESS_REDIRECT || '/';
+  if (!token) return to;
+  if (!appChallenge) {
+    throw new HttpError(
+      400,
+      'Bearer sign-in needs a code_challenge \u2014 start at /auth/<provider>?code_challenge=\u2026',
+    );
+  }
+  const code = randomToken();
+  await cache.set(\`oauth:code:\${code}\`, { token, appChallenge }, { ttl: CODE_TTL_S });
+  return \`\${to}#code=\${code}\`;
+}
+
+/**
+ * The token for a one-time sign-in code, given the verifier behind the challenge the sign-in
+ * started with. Once: a second use (or after a minute) gets 400.
+ */
+export async function exchangeCode(code${T(": unknown")}, verifier${T(": unknown")})${T(": Promise<string>")} {
+  if (typeof code !== 'string' || !code) throw new HttpError(400, 'code is required');
+  if (typeof verifier !== 'string' || !/^[A-Za-z0-9._~-]{43,128}$/.test(verifier)) {
+    throw new HttpError(400, 'code_verifier is required (43-128 characters)');
+  }
+  const key = \`oauth:code:\${code}\`;
+  const saved = await cache.get${T("<{ token: string; appChallenge: string }>")}(key);
+  const expected = Buffer.from(saved?.appChallenge ?? '');
+  const actual = Buffer.from(pkceChallenge(verifier));
+  // A wrong verifier leaves the code alone, so it can't be used to burn someone's sign-in.
+  if (!saved || expected.length !== actual.length || !crypto.timingSafeEqual(expected, actual)) {
+    throw new HttpError(400, 'Invalid or expired sign-in code');
+  }
+  // del is atomic: of two requests racing with the same code, only one removes it.
+  if ((await cache.del(key)) !== 1) throw new HttpError(400, 'Invalid or expired sign-in code');
+  return saved.token;
 }
 `;
   const reqRes = (r) => ts ? `(${r}: Request, res: Response)` : `(${r}, res)`;
@@ -3793,14 +3947,16 @@ export function successRedirect()${T(": string")} {
 };
 
 `;
-  const googleStart = `${typeImport}import { pkceChallenge, randomToken, rememberState } from '../../../lib/oauth.js';
+  const googleStart = `${typeImport}import { appChallengeFrom, pkceChallenge, randomToken, rememberState } from '../../../lib/oauth.js';
 ${meta("GET", 'Start "Sign in with Google": redirects to Google.')}// Redirects to Google's consent screen; Google sends the browser back to the callback route
 // (GOOGLE_REDIRECT_URI \u2014 register that exact URL in the Google Cloud console).
-export const GET = async ${reqRes("_req")} => {
+// Bearer apps add ?code_challenge=\u2026 (see appChallengeFrom in src/lib/oauth).
+export const GET = async ${reqRes("req")} => {
+  const appChallenge = appChallengeFrom(req.query);
   const state = randomToken();
   const nonce = randomToken();
   const verifier = randomToken();
-  rememberState(res, 'google', { state, nonce, verifier });
+  rememberState(res, 'google', { state, nonce, verifier, ...(appChallenge ? { appChallenge } : {}) });
   const params = new URLSearchParams({
     client_id: process.env.GOOGLE_CLIENT_ID ?? '',
     redirect_uri: process.env.GOOGLE_REDIRECT_URI ?? '',
@@ -3849,23 +4005,25 @@ export const GET = async ${reqRes("req")} => {
   });
   if (payload.nonce !== saved.nonce) throw new HttpError(400, 'Invalid sign-in response');
 
-  await signInWithOAuth(res, {
+  const token = await signInWithOAuth(res, {
     provider: 'google',
     providerId: String(payload.sub),
     email: ${ts ? "payload.email as string | undefined" : "payload.email"},
     emailVerified: payload.email_verified === true,
     name: ${ts ? "payload.name as string | undefined" : "payload.name"},
   });
-  res.redirect(successRedirect());
+  res.redirect(await successRedirect(token, saved.appChallenge));
 };
 `;
-  const appleStart = `${typeImport}import { randomToken, rememberState } from '../../../lib/oauth.js';
+  const appleStart = `${typeImport}import { appChallengeFrom, randomToken, rememberState } from '../../../lib/oauth.js';
 ${meta("GET", 'Start "Sign in with Apple": redirects to Apple.')}// Redirects to Apple; Apple POSTs the result to the callback route (APPLE_REDIRECT_URI \u2014
 // register it on the Services ID; Apple only accepts https URLs on a verified domain).
-export const GET = async ${reqRes("_req")} => {
+// Bearer apps add ?code_challenge=\u2026 (see appChallengeFrom in src/lib/oauth).
+export const GET = async ${reqRes("req")} => {
+  const appChallenge = appChallengeFrom(req.query);
   const state = randomToken();
   const nonce = randomToken();
-  rememberState(res, 'apple', { state, nonce }, true);
+  rememberState(res, 'apple', { state, nonce, ...(appChallenge ? { appChallenge } : {}) }, true);
   const params = new URLSearchParams({
     client_id: process.env.APPLE_CLIENT_ID ?? '',
     redirect_uri: process.env.APPLE_REDIRECT_URI ?? '',
@@ -3934,18 +4092,24 @@ export const POST = async ${reqRes("req")} => {
     name = undefined;
   }
 
-  await signInWithOAuth(res, {
+  const token = await signInWithOAuth(res, {
     provider: 'apple',
     providerId: String(payload.sub),
     email: ${ts ? "payload.email as string | undefined" : "payload.email"},
     emailVerified: payload.email_verified === true || payload.email_verified === 'true',
     name,
   });
-  res.redirect(303, successRedirect());
+  res.redirect(303, await successRedirect(token, saved.appChallenge));
+};
+`;
+  const exchange = `${typeImport}import { exchangeCode } from '../../../lib/oauth.js';
+${meta("POST", "Bearer apps: trade the one-time code from the sign-in redirect (plus the PKCE code_verifier) for a token.")}export const POST = async ${reqRes("req")} => {
+  res.json({ token: await exchangeCode(req.body?.code, req.body?.code_verifier) });
 };
 `;
   const oauth = opts.oauth ?? {};
   await fs.outputFile(path.join(dest, "src", "lib", `oauth.${ext}`), lib);
+  await fs.outputFile(path.join(dest, "src", "api", "auth", "oauth", `exchange.${ext}`), exchange);
   if (oauth.google) {
     await fs.outputFile(
       path.join(dest, "src", "api", "auth", "google", `index.${ext}`),
@@ -3979,6 +4143,12 @@ var VARIANTS = ["typescript", "javascript"].flatMap((language) => {
       database: "mongodb",
       modelApi: "defineModel"
     },
+    {
+      key: `${lang}-mongo-collection`,
+      language,
+      database: "mongodb",
+      modelApi: "defineCollection"
+    },
     {
       key: `${lang}-pg-model`,
       language,
@@ -4001,6 +4171,18 @@ var admin = (flag) => (o) => {
   o.adminPortal = true;
   o.adminFeatures = { ...o.adminFeatures, [flag]: true };
 };
+var AUTH_STRATEGY_OPTIONS = [
+  {
+    value: "http-only",
+    label: "http-only cookie",
+    hint: "browsers \u2014 websites and SPAs (recommended)"
+  },
+  {
+    value: "bearer",
+    label: "Bearer token",
+    hint: "mobile/desktop apps, API clients \u2014 keep it in Keychain/Keystore, not localStorage"
+  }
+];
 var ITEMS = [
   {
     name: "auth",
@@ -4008,7 +4190,16 @@ var ITEMS = [
     description: "User & Admin models; register, login, logout and me routes",
     group: "auth",
     registryDependencies: [],
-    docs: "Tokens are issued per `authStrategy` in efc.config \u2014 'http-only' (cookie) or 'localStorage' (Bearer). Verification emails go through the SendEmail task; `efc add email-client` makes it send real mail.",
+    docs: "Tokens are issued per `authStrategy` in efc.config \u2014 'http-only' (cookie) or 'bearer' (login returns the token; send it as Authorization: Bearer). Verification emails go through the SendEmail task; `efc add email-client` makes it send real mail.",
+    prompts: [
+      {
+        name: "authStrategy",
+        config: "authStrategy",
+        type: "select",
+        message: "Authentication strategy:",
+        options: AUTH_STRATEGY_OPTIONS
+      }
+    ],
     enable: (o) => {
       o.userPortal = true;
     }
@@ -4373,7 +4564,7 @@ function registryOptions(v, items = [], extra = {}) {
     projectName: "efc-app",
     language: v.language,
     database: v.database,
-    ...v.database === "postgresql" && { modelApi: v.modelApi },
+    modelApi: v.modelApi,
     authStrategy: "http-only",
     cluster: true,
     tasks: true,
@@ -4416,7 +4607,7 @@ async function writeManifest(dest, opts, items) {
     registry: (pkg.dependencies["express-file-cluster"] ?? "").replace(/^[^\d]*/, ""),
     language: opts.language,
     database: opts.database,
-    modelApi: opts.database === "postgresql" ? opts.modelApi ?? "defineTable" : "defineModel",
+    modelApi: opts.database === "postgresql" ? opts.modelApi ?? "defineTable" : opts.modelApi === "defineModel" ? "defineModel" : "defineCollection",
     tasks: opts.tasks ? opts.taskBackend ?? "bullmq" : null,
     items: [...withDependencies(items)].sort(),
     files: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)))
@@ -4512,22 +4703,30 @@ async function main() {
     ]
   });
   if (p.isCancel(database)) cancel2();
-  let modelApi2;
-  if (database === "postgresql") {
-    const api = await p.select({
-      message: "Models:",
-      options: [
-        {
-          value: "defineTable",
-          label: "defineTable",
-          hint: "PostgreSQL-native \u2014 foreign keys, relations, include, Prisma-style queries"
-        },
-        { value: "defineModel", label: "defineModel", hint: "portable \u2014 the same API on MongoDB" }
-      ]
-    });
-    if (p.isCancel(api)) cancel2();
-    modelApi2 = api;
-  }
+  const api = await p.select({
+    message: "Models:",
+    options: database === "postgresql" ? [
+      {
+        value: "defineTable",
+        label: "defineTable",
+        hint: "PostgreSQL-native \u2014 foreign keys, relations, include, Prisma-style queries"
+      },
+      { value: "defineModel", label: "defineModel", hint: "portable \u2014 the same API on MongoDB" }
+    ] : [
+      {
+        value: "defineCollection",
+        label: "defineCollection",
+        hint: "MongoDB-native \u2014 mongoose-style queries, typed pipelines, BSON types"
+      },
+      {
+        value: "defineModel",
+        label: "defineModel",
+        hint: "portable \u2014 the same API on PostgreSQL"
+      }
+    ]
+  });
+  if (p.isCancel(api)) cancel2();
+  const modelApi2 = api;
   const taskBackend = await p.select({
     message: "Task queue backend:",
     options: database === "postgresql" ? [
@@ -4555,29 +4754,26 @@ async function main() {
       hint: item.description
     });
   }
+  const auth = await p.select({
+    message: "Authentication:",
+    options: [
+      ...AUTH_STRATEGY_OPTIONS,
+      { value: "none", label: "None", hint: "add it later with `efc add auth`" }
+    ]
+  });
+  if (p.isCancel(auth)) cancel2();
   const picked = await p.groupMultiselect({
     message: `Add features now? ${pc.dim("(space to toggle, enter to confirm \u2014 or add any later with `efc add <item>`)")}`,
     options: groups,
+    initialValues: auth === "none" ? [] : ["auth"],
     required: false
   });
   if (p.isCancel(picked)) cancel2();
   const items = withDependencies(picked);
-  let authStrategy = "http-only";
-  if (items.includes("auth")) {
-    const strategy = await p.select({
-      message: "Authentication strategy:",
-      options: [
-        { value: "http-only", label: "http-only", hint: "secure cookie \u2014 recommended for SSR" },
-        { value: "localStorage", label: "localStorage", hint: "bearer token \u2014 for SPAs" }
-      ]
-    });
-    if (p.isCancel(strategy)) cancel2();
-    authStrategy = strategy;
-  }
-  const answers = {};
+  const answers = auth === "none" ? {} : { authStrategy: auth };
   const prompts = itemPrompts(items);
   for (const q of prompts) {
-    if (!promptApplies(q, answers)) continue;
+    if (q.name in answers || !promptApplies(q, answers)) continue;
     if (q.note) p.note(q.note);
     if (q.type === "select") {
       const choice = await p.select({
@@ -4617,7 +4813,7 @@ async function main() {
     items,
     {
       projectName,
-      authStrategy,
+      authStrategy: answers["authStrategy"] ?? "http-only",
       cluster,
       taskBackend,
       ...answers["provider"] === "custom" && { smtpProvider: "custom" }
@@ -4652,6 +4848,17 @@ Rotate any of them immediately if it is ever exposed.`,
       "Credentials"
     );
   }
+  if (opts.database === "postgresql") {
+    const db = path3.basename(opts.projectName);
+    p.note(
+      `.env points DATABASE_URL at postgresql://localhost:5432/${db}, with no user or password.
+EFC creates the tables on first use, but not the database or the login:
+  \u2022 Local server: createdb ${db}  (add user:password@ to the URL if it asks for one)
+  \u2022 Neon, Supabase, RDS: create the database in the dashboard and paste its full
+    connection string into .env as DATABASE_URL`,
+      "PostgreSQL"
+    );
+  }
   p.outro(
     pc.green(`
 Your project is ready!