create-lacspace-app 2.3.0 → 2.5.0

package/dist/lib.js

@@ -37,7 +37,8 @@ function resolveContext(options = {}) {
   const seg = raw.split(/[\\/]/).filter(Boolean).pop() ?? "my-app";
   const name = seg.toLowerCase().replace(/[^a-z0-9-_]/g, "-").replace(/^-+|-+$/g, "") || "my-app";
   const features = normalizeFeatures(options.features);
-  return { name, template, features };
+  const mode = options.mode === "dynamic" ? "dynamic" : "static";
+  return { name, template, features, mode };
 }
 function normalizeFeatures(requested) {
   if (!requested || requested.length === 0) return [];
@@ -1910,6 +1911,10 @@ Because posts are just Markdown files, you can:
 Check the [first post](/blog/welcome) for the full Markdown reference.
 `;
 function buildFiles(ctx) {
+  if (ctx.mode === "dynamic") return buildFullStack(ctx);
+  return buildApp(ctx);
+}
+function buildApp(ctx) {
   const isBlog = ctx.template.key === "blog";
   const isDocs = ctx.template.key === "docs";
   const files = {
@@ -2113,6 +2118,51 @@ var FEATURES = [
       "Run `npm run dev` and open http://localhost:3000/ask."
     ],
     learn: "https://developer.lacspace.com/packages/rag"
+  },
+  {
+    key: "content",
+    label: "Content / blog",
+    description: "A markdown content section (/updates) for any template \u2014 plus an RSS feed and an llms.txt. Drop in .md files, get pages.",
+    deps: {
+      "@lacspace/markdown": "^1.1.0",
+      "@lacspace/rss": "^1.4.0",
+      "@lacspace/llms-txt": "^1.4.0"
+    },
+    files: (ctx) => ({
+      "content/updates/welcome.md": contentSampleWelcome(ctx),
+      "content/updates/building-in-public.md": contentSampleSecond(),
+      "lib/content.ts": contentLib(),
+      "app/updates/page.tsx": updatesListPage(),
+      "app/updates/[slug]/page.tsx": updatePostPage(),
+      "app/feed.xml/route.ts": feedRoute(),
+      "app/llms.txt/route.ts": llmsRoute()
+    }),
+    nextSteps: [
+      "Add markdown files to content/updates/ \u2014 each becomes a page at /updates/<name>.",
+      "Run `npm run dev` and open http://localhost:3000/updates, /feed.xml and /llms.txt.",
+      "Set NEXT_PUBLIC_SITE_URL in .env so the feed and llms.txt links are absolute."
+    ],
+    learn: "https://developer.lacspace.com/packages/markdown"
+  },
+  {
+    key: "search",
+    label: "Search",
+    description: "Instant, keyless full-text search (BM25) over your markdown content \u2014 a search box + /search page + API route. No key, no service.",
+    deps: {
+      "@lacspace/rerank": "^1.0.0",
+      "@lacspace/markdown": "^1.1.0"
+    },
+    files: () => ({
+      "app/api/search/route.ts": searchRoute(),
+      "components/search.tsx": searchBox(),
+      "app/search/page.tsx": searchPage()
+    }),
+    nextSteps: [
+      "Add markdown to content/ (e.g. the `content` add-on's content/updates/) \u2014 search indexes it automatically.",
+      "Run `npm run dev` and open http://localhost:3000/search, or drop <Search /> into your header.",
+      "Want semantic search? Upgrade to @lacspace/embeddings + @lacspace/vector (keyless-local via Ollama)."
+    ],
+    learn: "https://developer.lacspace.com/packages/rerank"
   }
 ];
 var aiChatRoute = (_ctx) => `import { resolveConfig } from "@lacspace/providers";
@@ -5091,6 +5141,1190 @@ var faqSection = (ctx) => {
         </div>
       </section>`;
 };
+var contentLib = () => `import fs from "node:fs";
+import path from "node:path";
+import { parseFrontmatter, markdownToHtml, excerpt } from "@lacspace/markdown";
+
+// how this works: every .md file in content/updates/ becomes a post. Frontmatter
+// (title/date/description) is read with @lacspace/markdown; the body is rendered to
+// safe HTML (raw HTML in the source is escaped, so this is XSS-safe by construction).
+const DIR = path.join(process.cwd(), "content/updates");
+
+export interface PostMeta { slug: string; title: string; date: string; description: string; }
+export interface Post extends PostMeta { html: string; }
+
+function read(slug: string): Post | null {
+  const file = path.join(DIR, slug + ".md");
+  if (!fs.existsSync(file)) return null;
+  const { data, content } = parseFrontmatter(fs.readFileSync(file, "utf8"));
+  return {
+    slug,
+    title: String(data.title ?? slug),
+    date: String(data.date ?? ""),
+    description: String(data.description ?? excerpt(content, { length: 160 })),
+    html: markdownToHtml(content, { headingIds: true, openLinksInNewTab: true }),
+  };
+}
+
+export function getAllPosts(): PostMeta[] {
+  if (!fs.existsSync(DIR)) return [];
+  return fs.readdirSync(DIR)
+    .filter((f) => f.endsWith(".md"))
+    .map((f) => read(f.replace(/\\.md$/, ""))!)
+    .filter(Boolean)
+    .sort((a, b) => (a.date < b.date ? 1 : -1));
+}
+
+export function getPost(slug: string): Post | null {
+  return read(slug);
+}
+`;
+var updatesListPage = () => `import Link from "next/link";
+import { site } from "@/lib/site";
+import { getAllPosts } from "@/lib/content";
+
+export const metadata = site.meta({ title: "Updates", path: "/updates" });
+
+export default function UpdatesPage() {
+  const posts = getAllPosts();
+  return (
+    <main className="mx-auto max-w-3xl px-6 py-16">
+      <h1 className="text-3xl font-bold">Updates</h1>
+      <p className="mt-2 text-muted">News, notes and posts. <a href="/feed.xml" className="underline">RSS</a></p>
+      {posts.length === 0 && (
+        <p className="mt-8 text-muted">No posts yet \u2014 add a markdown file in <code>content/updates/</code>.</p>
+      )}
+      <ul className="mt-8 space-y-6">
+        {posts.map((p) => (
+          <li key={p.slug} className="border-b border-hairline pb-6">
+            <Link href={\`/updates/\${p.slug}\`} className="text-xl font-semibold hover:underline">{p.title}</Link>
+            {p.date && <p className="mt-1 text-sm text-muted">{p.date}</p>}
+            <p className="mt-2 text-muted">{p.description}</p>
+          </li>
+        ))}
+      </ul>
+    </main>
+  );
+}
+`;
+var updatePostPage = () => `import Link from "next/link";
+import { notFound } from "next/navigation";
+import { site } from "@/lib/site";
+import { getAllPosts, getPost } from "@/lib/content";
+
+export function generateStaticParams() {
+  return getAllPosts().map((p) => ({ slug: p.slug }));
+}
+
+export async function generateMetadata({ params }: { params: Promise<{ slug: string }> }) {
+  const { slug } = await params;
+  const post = getPost(slug);
+  return site.meta({ title: post?.title ?? "Updates", path: \`/updates/\${slug}\` });
+}
+
+export default async function PostPage({ params }: { params: Promise<{ slug: string }> }) {
+  const { slug } = await params;
+  const post = getPost(slug);
+  if (!post) notFound();
+  return (
+    <main className="mx-auto max-w-2xl px-6 py-16">
+      <Link href="/updates" className="text-sm text-muted hover:underline">\u2190 Updates</Link>
+      <h1 className="mt-4 text-3xl font-bold">{post.title}</h1>
+      {post.date && <p className="mt-1 text-sm text-muted">{post.date}</p>}
+      <article
+        className="mt-8 leading-7 [&_h2]:mt-8 [&_h2]:text-2xl [&_h2]:font-bold [&_h3]:mt-6 [&_h3]:text-xl [&_h3]:font-semibold [&_p]:mt-4 [&_p]:text-muted [&_a]:underline [&_ul]:mt-4 [&_ul]:list-disc [&_ul]:pl-6 [&_li]:mt-1 [&_pre]:mt-4 [&_pre]:overflow-x-auto [&_pre]:rounded-xl [&_pre]:bg-surface [&_pre]:p-4 [&_pre]:text-sm [&_code]:text-sm"
+        dangerouslySetInnerHTML={{ __html: post.html }}
+      />
+    </main>
+  );
+}
+`;
+var feedRoute = () => `import { rssResponse } from "@lacspace/rss";
+import { getAllPosts } from "@/lib/content";
+
+export const dynamic = "force-static";
+
+export function GET() {
+  const base = process.env.NEXT_PUBLIC_SITE_URL ?? "http://localhost:3000";
+  const items = getAllPosts().map((p) => ({
+    title: p.title,
+    link: base + "/updates/" + p.slug,
+    description: p.description,
+    // Only pass a date the feed can parse (rfc822Date throws on bad input).
+    date: p.date && !Number.isNaN(Date.parse(p.date)) ? p.date : undefined,
+  }));
+  return rssResponse(
+    { title: "Updates", link: base, description: "The latest posts and updates.", feedUrl: base + "/feed.xml" },
+    items,
+  );
+}
+`;
+var llmsRoute = () => `import { llmsTxtFromPages } from "@lacspace/llms-txt";
+import { getAllPosts } from "@/lib/content";
+
+export const dynamic = "force-static";
+
+export function GET() {
+  const base = process.env.NEXT_PUBLIC_SITE_URL ?? "http://localhost:3000";
+  const txt = llmsTxtFromPages(
+    getAllPosts().map((p) => ({ title: p.title, url: base + "/updates/" + p.slug, content: p.description, section: "Updates" })),
+    { title: "Updates", summary: "A content index for large language models." },
+  );
+  return new Response(txt, { headers: { "content-type": "text/plain; charset=utf-8" } });
+}
+`;
+var contentSampleWelcome = (ctx) => `---
+title: Welcome to ${ctx.template.siteName}'s content section
+date: 2026-01-15
+description: This markdown file became a page automatically \u2014 here's how it works.
+---
+
+## It just works
+
+Drop any \\\`.md\\\` file into \\\`content/updates/\\\` and it becomes a page at \\\`/updates/<filename>\\\`, listed on \\\`/updates\\\`, and included in \\\`/feed.xml\\\` and \\\`/llms.txt\\\`.
+
+- Frontmatter \\\`title\\\`, \\\`date\\\` and \\\`description\\\` are read automatically.
+- The body is rendered safely with \\\`@lacspace/markdown\\\` \u2014 raw HTML is escaped, so it's XSS-safe.
+- Delete this file when you're ready to write your own.
+`;
+var contentSampleSecond = () => `---
+title: Building in public
+date: 2026-01-10
+description: A second example post so the list and feed have something to show.
+---
+
+## Why a content section?
+
+Every product needs a place for changelog posts, announcements and notes. This one is
+Markdown-powered, needs no database, and ships an RSS feed and an \\\`llms.txt\\\` for free.
+
+### Add your own
+
+1. Create \\\`content/updates/my-post.md\\\`.
+2. Add frontmatter (\\\`title\\\`, \\\`date\\\`, \\\`description\\\`).
+3. Write. That's it \u2014 it appears at \\\`/updates/my-post\\\`.
+`;
+var searchRoute = () => `import fs from "node:fs";
+import path from "node:path";
+import { parseFrontmatter, toPlainText, excerpt } from "@lacspace/markdown";
+import { rerank } from "@lacspace/rerank";
+
+// how this works: full-text search with BM25 ranking \u2014 no external service, no API
+// key, no Ollama. It scans your markdown at request time and ranks matches. (For a
+// big site, precompute the corpus at build time and cache it instead.)
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const ROOT = path.join(process.cwd(), "content");
+// Map a content/<dir>/ to the route it renders under.
+const SECTION: Record<string, string> = { updates: "/updates", posts: "/blog", docs: "/docs" };
+
+interface Entry { id: string; title: string; url: string; text: string; }
+
+function corpus(): Entry[] {
+  if (!fs.existsSync(ROOT)) return [];
+  const out: Entry[] = [];
+  for (const dir of fs.readdirSync(ROOT)) {
+    const full = path.join(ROOT, dir);
+    if (!fs.statSync(full).isDirectory()) continue;
+    const base = SECTION[dir] ?? "/" + dir;
+    for (const file of fs.readdirSync(full)) {
+      if (!file.endsWith(".md")) continue;
+      const slug = file.replace(/\\.md$/, "");
+      const { data, content } = parseFrontmatter(fs.readFileSync(path.join(full, file), "utf8"));
+      out.push({ id: dir + "/" + slug, title: String(data.title ?? slug), url: base + "/" + slug, text: toPlainText(content) });
+    }
+  }
+  return out;
+}
+
+export async function GET(req: Request) {
+  const q = new URL(req.url).searchParams.get("q")?.trim() ?? "";
+  if (!q) return Response.json([]);
+  const docs = corpus().map((e) => ({ id: e.id, text: e.title + "\\n" + e.text, metadata: { title: e.title, url: e.url } }));
+  const hits = await rerank(q, docs, { method: "bm25", k: 8 });
+  return Response.json(hits.map((h) => ({
+    title: String(h.metadata?.title ?? ""),
+    url: String(h.metadata?.url ?? "#"),
+    snippet: excerpt(h.text.split("\\n").slice(1).join(" "), { length: 140 }),
+  })));
+}
+`;
+var searchBox = () => `"use client";
+import { useState, useEffect, useRef } from "react";
+
+interface Result { title: string; url: string; snippet: string; }
+
+export function Search() {
+  const [q, setQ] = useState("");
+  const [results, setResults] = useState<Result[]>([]);
+  const [open, setOpen] = useState(false);
+  const timer = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  useEffect(() => {
+    if (timer.current) clearTimeout(timer.current);
+    if (!q.trim()) { setResults([]); return; }
+    timer.current = setTimeout(async () => {
+      const res = await fetch("/api/search?q=" + encodeURIComponent(q));
+      setResults(await res.json());
+      setOpen(true);
+    }, 200);
+    return () => { if (timer.current) clearTimeout(timer.current); };
+  }, [q]);
+
+  return (
+    <div className="relative w-full max-w-md">
+      <input
+        value={q}
+        onChange={(e) => setQ(e.target.value)}
+        onFocus={() => { if (results.length) setOpen(true); }}
+        onBlur={() => setTimeout(() => setOpen(false), 150)}
+        placeholder="Search\u2026"
+        className="w-full rounded-xl border border-hairline bg-surface px-4 py-2 outline-none"
+      />
+      {open && results.length > 0 && (
+        <ul className="absolute z-20 mt-2 w-full overflow-hidden rounded-xl border border-hairline bg-app shadow-lg">
+          {results.map((r) => (
+            <li key={r.url}>
+              <a href={r.url} className="block px-4 py-3 transition hover:bg-surface">
+                <p className="font-medium">{r.title}</p>
+                <p className="mt-0.5 text-sm text-muted">{r.snippet}</p>
+              </a>
+            </li>
+          ))}
+        </ul>
+      )}
+    </div>
+  );
+}
+`;
+var searchPage = () => `import { site } from "@/lib/site";
+import { Search } from "@/components/search";
+
+export const metadata = site.meta({ title: "Search", path: "/search" });
+
+export default function SearchPage() {
+  return (
+    <main className="mx-auto max-w-2xl px-6 py-16">
+      <h1 className="text-3xl font-bold">Search</h1>
+      <p className="mt-2 text-muted">Instant, keyless full-text search over your content.</p>
+      <div className="mt-8"><Search /></div>
+    </main>
+  );
+}
+`;
+var scope = (ctx) => `@${ctx.name}`;
+var typesPkgJson = (ctx) => JSON.stringify({
+  name: `${scope(ctx)}/types`,
+  version: "0.1.0",
+  private: true,
+  // Type-only package: it ships a single .d.ts (no runtime code, nothing to build).
+  types: "./index.d.ts",
+  exports: { ".": { types: "./index.d.ts" } }
+}, null, 2) + "\n";
+var sharedTypes = () => `// Shared API contract \u2014 imported by BOTH the frontend and the backend, so the two
+// can never drift. These are TYPE-ONLY (no runtime code), so importing them adds
+// nothing to either bundle. Edit here once; both sides update. Use \`import type\`.
+
+/** A user, as returned by the API (no password; dates are ISO strings). */
+export interface User {
+  id: string;
+  email: string;
+  name: string;
+  createdAt: string;
+}
+
+/** The response from POST /auth/register and POST /auth/login. */
+export interface AuthResponse {
+  token: string;
+  user: User;
+}
+
+/** The shape of an error response from the API. */
+export interface ApiError {
+  error: string;
+  fields?: Record<string, string>;
+}
+
+/** The example CRUD resource. Rename "Note" to your real domain object. */
+export interface Note {
+  id: string;
+  title: string;
+  body: string;
+  userId: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface CreateNoteInput {
+  title: string;
+  body?: string;
+}
+
+export interface UpdateNoteInput {
+  title?: string;
+  body?: string;
+}
+`;
+var rootPkgJson = (ctx) => JSON.stringify({
+  name: ctx.name,
+  version: "0.1.0",
+  private: true,
+  workspaces: ["types", "backend", "frontend"],
+  scripts: {
+    // Run the API and the frontend together (concurrently), colourised + kill-all.
+    dev: 'concurrently -k -n api,web -c blue,magenta "npm:dev:api" "npm:dev:web"',
+    "dev:api": `npm run dev --workspace ${scope(ctx)}/backend`,
+    "dev:web": `npm run dev --workspace ${scope(ctx)}/frontend`,
+    build: `npm run build --workspace ${scope(ctx)}/backend && npm run build --workspace ${scope(ctx)}/frontend`,
+    start: 'concurrently -k -n api,web -c blue,magenta "npm:start:api" "npm:start:web"',
+    "start:api": `npm run start --workspace ${scope(ctx)}/backend`,
+    "start:web": `npm run start --workspace ${scope(ctx)}/frontend`,
+    typecheck: `npm run typecheck --workspace ${scope(ctx)}/backend`
+  },
+  devDependencies: { concurrently: "^9.1.0" },
+  engines: { node: ">=18" }
+}, null, 2) + "\n";
+var dockerCompose = (ctx) => `# Local infrastructure for ${ctx.name}. Start it with:  docker compose up -d
+# Optional \u2014 the API also runs with NO Redis, and against any MongoDB (e.g. Atlas).
+services:
+  mongo:
+    image: mongo:7
+    restart: unless-stopped
+    ports:
+      - "27017:27017"
+    volumes:
+      - mongo-data:/data/db
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    ports:
+      - "6379:6379"
+
+volumes:
+  mongo-data:
+`;
+var rootGitignore = () => `node_modules
+.env
+.env.local
+*.log
+.DS_Store
+dist
+.next
+`;
+var rootEnvExample = (ctx) => `# ${ctx.name} \u2014 ONE .env for the whole monorepo.  Copy it:  cp .env.example .env
+# The defaults below let the app run locally with zero changes.
+
+# --- Backend ---
+NODE_ENV=development
+PORT=4000
+
+# MongoDB. With Docker (docker compose up -d) the default just works. Or paste a
+# free MongoDB Atlas connection string here.
+MONGODB_URI=mongodb://localhost:27017/${ctx.name}
+
+# Signs JWTs. In production generate a strong value:  openssl rand -hex 32
+JWT_SECRET=dev-secret-change-me
+
+# Redis is OPTIONAL \u2014 leave empty to use the in-memory cache fallback.
+# With Docker, set it to:  redis://localhost:6379
+REDIS_URL=
+
+# Who may call the API (the frontend origin). Comma-separate for multiple.
+CORS_ORIGIN=http://localhost:3000
+
+# --- Frontend ---
+# Where the browser calls the API. Unset = http://localhost:4000 (local default).
+# NEXT_PUBLIC_API_URL=http://localhost:4000
+`;
+var rootReadme = (ctx) => `# ${ctx.name}
+
+A full-stack app scaffolded with [create-lacspace-app](https://www.npmjs.com/package/create-lacspace-app) \u2014 a **${ctx.template.label}** frontend + a real backend, wired together.
+
+\`\`\`
+${ctx.name}/
+\u251C\u2500 frontend/   Next.js 15 app (your UI) \u2014 talks to the API
+\u251C\u2500 backend/    Node \xB7 Express \xB7 MongoDB \xB7 Redis \xB7 TypeScript API
+\u251C\u2500 types/      Shared API types \u2014 imported by BOTH sides, so they can't drift
+\u2514\u2500 docker-compose.yml   Mongo + Redis for local dev (optional)
+\`\`\`
+
+## Quick start
+
+\`\`\`bash
+cp .env.example .env         # one env file for everything (sensible defaults)
+docker compose up -d         # optional: starts MongoDB + Redis locally
+npm install                  # installs all three workspaces at once
+npm run dev                  # runs the API (:4000) and the frontend (:3000) together
+\`\`\`
+
+Then open **http://localhost:3000** \u2192 visit **/register**, create an account, and you'll land on **/account** \u2014 a protected page that reads/writes the example "notes" resource through the API.
+
+**No Docker?** Point \`MONGODB_URI\` at any MongoDB (a free [Atlas](https://www.mongodb.com/atlas) cluster works). Redis is optional \u2014 leave \`REDIS_URL\` empty and the API uses an in-memory cache instead.
+
+## What's already built
+
+- **Auth** \u2014 \`POST /auth/register\`, \`POST /auth/login\` (JWT), \`GET /auth/me\`. Passwords hashed with \`@lacspace/password\`, tokens signed/verified with \`@lacspace/jwt\`.
+- **Example CRUD** \u2014 \`/notes\` (list \xB7 create \xB7 read \xB7 update \xB7 delete), protected, per-user, with a per-user cache (Redis or in-memory) that busts on writes.
+- **Validation** \u2014 request bodies validated with \`@lacspace/validate\`; failures return a clean 400.
+- **Rate limiting** \u2014 auth endpoints throttled with \`@lacspace/rate-limit\`.
+- **Typed env** \u2014 \`@lacspace/env\` fails fast at boot if config is wrong.
+
+Everything on the backend is built from zero-dependency \`@lacspace/*\` packages \u2192 https://lacspace.com/packages
+
+## Make it yours
+
+Rename the \`Note\` resource (in \`types/index.d.ts\`, \`backend/src/models/note.ts\`, \`backend/src/routes/notes.ts\`) to your real domain object, then follow the same pattern for more resources. The shared \`types/\` package keeps the frontend and backend in lock-step.
+`;
+var frontendApiClient = (ctx) => `import type { AuthResponse, User, Note, CreateNoteInput, ApiError } from "${scope(ctx)}/types";
+
+// how this works: a tiny typed fetch wrapper around the backend API. The response
+// shapes come from the shared "${scope(ctx)}/types" package \u2014 the SAME types the
+// backend uses \u2014 so the client and server can never disagree about the contract.
+const BASE = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:4000";
+const TOKEN_KEY = "${ctx.name}_token";
+
+export function getToken(): string | null {
+  if (typeof window === "undefined") return null;
+  try { return localStorage.getItem(TOKEN_KEY); } catch { return null; }
+}
+export function setToken(token: string | null): void {
+  if (typeof window === "undefined") return;
+  try { token ? localStorage.setItem(TOKEN_KEY, token) : localStorage.removeItem(TOKEN_KEY); } catch {}
+}
+
+async function request<T>(path: string, init?: RequestInit): Promise<T> {
+  const token = getToken();
+  const res = await fetch(\`\${BASE}\${path}\`, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      ...(token ? { Authorization: \`Bearer \${token}\` } : {}),
+      ...(init?.headers ?? {}),
+    },
+  });
+  if (!res.ok) {
+    let message = "Request failed";
+    try { message = ((await res.json()) as ApiError).error ?? message; } catch {}
+    throw new Error(message);
+  }
+  if (res.status === 204) return undefined as T;
+  return (await res.json()) as T;
+}
+
+export const api = {
+  register: (input: { name: string; email: string; password: string }) =>
+    request<AuthResponse>("/auth/register", { method: "POST", body: JSON.stringify(input) }),
+  login: (input: { email: string; password: string }) =>
+    request<AuthResponse>("/auth/login", { method: "POST", body: JSON.stringify(input) }),
+  me: () => request<User>("/auth/me"),
+  listNotes: () => request<Note[]>("/notes"),
+  createNote: (input: CreateNoteInput) =>
+    request<Note>("/notes", { method: "POST", body: JSON.stringify(input) }),
+  deleteNote: (id: string) => request<void>(\`/notes/\${id}\`, { method: "DELETE" }),
+};
+`;
+var frontendLoginPage = () => `"use client";
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, setToken } from "@/lib/api";
+
+// how this works: posts to the backend /auth/login, stores the returned JWT, then
+// redirects to /account. Every request after this sends the token automatically.
+export default function LoginPage() {
+  const router = useRouter();
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  async function onSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setBusy(true); setError(null);
+    try {
+      const { token } = await api.login({ email, password });
+      setToken(token);
+      router.push("/account");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Something went wrong");
+    } finally { setBusy(false); }
+  }
+
+  return (
+    <main className="mx-auto flex min-h-[70vh] max-w-sm flex-col justify-center px-6">
+      <h1 className="text-2xl font-bold">Welcome back</h1>
+      <p className="mt-1 text-muted">Sign in to your account.</p>
+      <form onSubmit={onSubmit} className="mt-6 space-y-4">
+        <input value={email} onChange={(e) => setEmail(e.target.value)} type="email" required placeholder="you@example.com" className="w-full rounded-xl border border-hairline bg-surface px-4 py-3 outline-none" />
+        <input value={password} onChange={(e) => setPassword(e.target.value)} type="password" required placeholder="Password" className="w-full rounded-xl border border-hairline bg-surface px-4 py-3 outline-none" />
+        {error && <p className="text-sm text-red-400">{error}</p>}
+        <button disabled={busy} className="w-full rounded-full gradient-bg px-4 py-3 font-semibold on-accent transition hover:opacity-90 disabled:opacity-60">{busy ? "Signing in\u2026" : "Sign in"}</button>
+      </form>
+      <p className="mt-4 text-sm text-muted">No account? <Link href="/register" className="underline">Create one</Link></p>
+    </main>
+  );
+}
+`;
+var frontendRegisterPage = () => `"use client";
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, setToken } from "@/lib/api";
+
+// how this works: posts to /auth/register, stores the JWT, redirects to /account.
+export default function RegisterPage() {
+  const router = useRouter();
+  const [name, setName] = useState("");
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  async function onSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setBusy(true); setError(null);
+    try {
+      const { token } = await api.register({ name, email, password });
+      setToken(token);
+      router.push("/account");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Something went wrong");
+    } finally { setBusy(false); }
+  }
+
+  return (
+    <main className="mx-auto flex min-h-[70vh] max-w-sm flex-col justify-center px-6">
+      <h1 className="text-2xl font-bold">Create your account</h1>
+      <p className="mt-1 text-muted">It takes a few seconds.</p>
+      <form onSubmit={onSubmit} className="mt-6 space-y-4">
+        <input value={name} onChange={(e) => setName(e.target.value)} required placeholder="Your name" className="w-full rounded-xl border border-hairline bg-surface px-4 py-3 outline-none" />
+        <input value={email} onChange={(e) => setEmail(e.target.value)} type="email" required placeholder="you@example.com" className="w-full rounded-xl border border-hairline bg-surface px-4 py-3 outline-none" />
+        <input value={password} onChange={(e) => setPassword(e.target.value)} type="password" required minLength={8} placeholder="Password (min 8 chars)" className="w-full rounded-xl border border-hairline bg-surface px-4 py-3 outline-none" />
+        {error && <p className="text-sm text-red-400">{error}</p>}
+        <button disabled={busy} className="w-full rounded-full gradient-bg px-4 py-3 font-semibold on-accent transition hover:opacity-90 disabled:opacity-60">{busy ? "Creating\u2026" : "Create account"}</button>
+      </form>
+      <p className="mt-4 text-sm text-muted">Already have one? <Link href="/login" className="underline">Sign in</Link></p>
+    </main>
+  );
+}
+`;
+var frontendAccountPage = (ctx) => `"use client";
+import { useEffect, useState } from "react";
+import { useRouter } from "next/navigation";
+import { api, getToken, setToken } from "@/lib/api";
+import type { User, Note } from "${scope(ctx)}/types";
+
+// how this works: a PROTECTED page. On mount it calls /auth/me with the stored
+// token; if that fails it bounces to /login. Notes are the example CRUD resource.
+export default function AccountPage() {
+  const router = useRouter();
+  const [user, setUser] = useState<User | null>(null);
+  const [notes, setNotes] = useState<Note[]>([]);
+  const [title, setTitle] = useState("");
+  const [body, setBody] = useState("");
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!getToken()) { router.push("/login"); return; }
+    (async () => {
+      try {
+        setUser(await api.me());
+        setNotes(await api.listNotes());
+      } catch { setToken(null); router.push("/login"); }
+    })();
+  }, [router]);
+
+  async function addNote(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    try {
+      const note = await api.createNote({ title, body });
+      setNotes((prev) => [note, ...prev]);
+      setTitle(""); setBody("");
+    } catch (err) { setError(err instanceof Error ? err.message : "Failed to save"); }
+  }
+  async function remove(id: string) {
+    await api.deleteNote(id);
+    setNotes((prev) => prev.filter((n) => n.id !== id));
+  }
+  function signOut() { setToken(null); router.push("/login"); }
+
+  if (!user) return <main className="mx-auto max-w-2xl px-6 py-16 text-muted">Loading\u2026</main>;
+
+  return (
+    <main className="mx-auto max-w-2xl px-6 py-16">
+      <div className="flex items-center justify-between">
+        <div>
+          <h1 className="text-2xl font-bold">Hi, {user.name}</h1>
+          <p className="text-muted">{user.email}</p>
+        </div>
+        <button onClick={signOut} className="rounded-full border border-hairline px-4 py-2 text-sm transition hover:bg-surface">Sign out</button>
+      </div>
+
+      <form onSubmit={addNote} className="mt-8 space-y-3 rounded-2xl border border-hairline bg-surface p-5">
+        <h2 className="font-semibold">Add a note</h2>
+        <input value={title} onChange={(e) => setTitle(e.target.value)} required placeholder="Title" className="w-full rounded-xl border border-hairline bg-app px-4 py-2 outline-none" />
+        <textarea value={body} onChange={(e) => setBody(e.target.value)} placeholder="Write something\u2026" rows={3} className="w-full rounded-xl border border-hairline bg-app px-4 py-2 outline-none" />
+        {error && <p className="text-sm text-red-400">{error}</p>}
+        <button className="rounded-full gradient-bg px-4 py-2 text-sm font-semibold on-accent">Save note</button>
+      </form>
+
+      <ul className="mt-6 space-y-3">
+        {notes.length === 0 && <li className="text-muted">No notes yet \u2014 add your first above.</li>}
+        {notes.map((n) => (
+          <li key={n.id} className="flex items-start justify-between rounded-2xl border border-hairline p-4">
+            <div>
+              <p className="font-medium">{n.title}</p>
+              {n.body && <p className="mt-1 text-sm text-muted">{n.body}</p>}
+            </div>
+            <button onClick={() => remove(n.id)} className="shrink-0 text-sm text-muted transition hover:text-red-400">Delete</button>
+          </li>
+        ))}
+      </ul>
+    </main>
+  );
+}
+`;
+function buildFullStack(ctx) {
+  const out = {};
+  const s = scope(ctx);
+  const app = buildApp(ctx);
+  for (const [rel, content] of Object.entries(app)) out[`frontend/${rel}`] = content;
+  const fpkg = JSON.parse(out["frontend/package.json"]);
+  fpkg.name = `${s}/frontend`;
+  fpkg.dependencies[`${s}/types`] = "*";
+  out["frontend/package.json"] = JSON.stringify(fpkg, null, 2) + "\n";
+  const fts = JSON.parse(out["frontend/tsconfig.json"]);
+  fts.compilerOptions.paths[`${s}/types`] = ["../types/index.d.ts"];
+  out["frontend/tsconfig.json"] = JSON.stringify(fts, null, 2) + "\n";
+  const fenv = out["frontend/.env.example"] ?? "";
+  out["frontend/.env.example"] = (fenv.endsWith("\n") || fenv === "" ? fenv : fenv + "\n") + "\n# The backend API base URL. Unset = http://localhost:4000 (local default).\n# NEXT_PUBLIC_API_URL=http://localhost:4000\n";
+  out["frontend/lib/api.ts"] = frontendApiClient(ctx);
+  out["frontend/app/login/page.tsx"] = frontendLoginPage();
+  out["frontend/app/register/page.tsx"] = frontendRegisterPage();
+  out["frontend/app/account/page.tsx"] = frontendAccountPage(ctx);
+  Object.assign(out, backendFiles(ctx));
+  out["types/package.json"] = typesPkgJson(ctx);
+  out["types/index.d.ts"] = sharedTypes();
+  out["package.json"] = rootPkgJson(ctx);
+  out["docker-compose.yml"] = dockerCompose(ctx);
+  out[".gitignore"] = rootGitignore();
+  out[".env.example"] = rootEnvExample(ctx);
+  out["README.md"] = rootReadme(ctx);
+  return out;
+}
+var backendPkgJson = (ctx) => JSON.stringify({
+  name: `${scope(ctx)}/backend`,
+  version: "0.1.0",
+  private: true,
+  type: "module",
+  main: "dist/index.js",
+  scripts: {
+    dev: "tsx watch src/index.ts",
+    build: "tsc -p tsconfig.json",
+    start: "node dist/index.js",
+    typecheck: "tsc -p tsconfig.json --noEmit"
+  },
+  dependencies: {
+    express: "^4.21.2",
+    cors: "^2.8.5",
+    mongoose: "^8.9.0",
+    ioredis: "^5.4.2",
+    dotenv: "^16.4.7",
+    // ✨ Backend built on zero-dep @lacspace/* packages instead of the usual grab-bag.
+    "@lacspace/env": "^1.1.0",
+    "@lacspace/jwt": "^1.4.0",
+    "@lacspace/password": "^1.1.0",
+    "@lacspace/validate": "^1.1.0",
+    "@lacspace/id": "^1.1.0",
+    "@lacspace/rate-limit": "^1.2.0",
+    "@lacspace/cache": "^1.1.0",
+    [`${scope(ctx)}/types`]: "*"
+  },
+  devDependencies: {
+    typescript: "^5.7.0",
+    tsx: "^4.19.2",
+    "@types/node": "^22.10.0",
+    "@types/express": "^4.17.21",
+    "@types/cors": "^2.8.17"
+  }
+}, null, 2) + "\n";
+var backendTsconfig = (ctx) => JSON.stringify({
+  compilerOptions: {
+    target: "ES2022",
+    module: "NodeNext",
+    moduleResolution: "NodeNext",
+    lib: ["ES2022"],
+    esModuleInterop: true,
+    allowSyntheticDefaultImports: true,
+    strict: true,
+    skipLibCheck: true,
+    resolveJsonModule: true,
+    outDir: "dist",
+    rootDir: "src",
+    sourceMap: true,
+    types: ["node"],
+    baseUrl: ".",
+    paths: { [`${scope(ctx)}/types`]: ["../types/index.d.ts"] }
+  },
+  include: ["src/**/*"],
+  exclude: ["node_modules", "dist"]
+}, null, 2) + "\n";
+var backendGitignore = () => `node_modules
+dist
+.env
+*.log
+`;
+var backendReadme = (ctx) => `# ${ctx.name} \u2014 API
+
+Node \xB7 Express \xB7 MongoDB \xB7 Redis (optional) \xB7 TypeScript. Built on zero-dependency \`@lacspace/*\` packages.
+
+Run it from the repo root with \`npm run dev\` (starts this API + the frontend). Standalone: \`npm run dev\` inside this folder.
+
+## Endpoints
+
+| Method | Path             | Auth | Description                    |
+|--------|------------------|------|--------------------------------|
+| GET    | \`/health\`        | \u2014    | Liveness check                 |
+| POST   | \`/auth/register\` | \u2014    | Create an account \u2192 JWT + user |
+| POST   | \`/auth/login\`    | \u2014    | Log in \u2192 JWT + user            |
+| GET    | \`/auth/me\`       | \u2713    | The current user               |
+| GET    | \`/notes\`         | \u2713    | List your notes (cached)       |
+| POST   | \`/notes\`         | \u2713    | Create a note                  |
+| GET    | \`/notes/:id\`     | \u2713    | Read one note                  |
+| PATCH  | \`/notes/:id\`     | \u2713    | Update a note                  |
+| DELETE | \`/notes/:id\`     | \u2713    | Delete a note                  |
+
+Send \`Authorization: Bearer <token>\` for the \u2713 routes (you get the token from register/login).
+
+## Layout
+
+\`\`\`
+src/
+\u251C\u2500 index.ts        boot: load env \u2192 connect Mongo \u2192 listen
+\u251C\u2500 load-env.ts     loads the root .env (imported first)
+\u251C\u2500 env.ts          typed, validated env (@lacspace/env)
+\u251C\u2500 app.ts          the Express app (CORS, routes, error handler)
+\u251C\u2500 db.ts           Mongoose connection
+\u251C\u2500 cache.ts        Redis, or an in-memory fallback (@lacspace/cache)
+\u251C\u2500 http.ts         HttpError + asyncHandler
+\u251C\u2500 validation.ts   request schemas (@lacspace/validate)
+\u251C\u2500 middleware/     auth (@lacspace/jwt) + error handling
+\u251C\u2500 models/         Mongoose models (User, Note)
+\u2514\u2500 routes/         auth + notes (the example CRUD resource)
+\`\`\`
+`;
+var backendLoadEnv = () => `import { config } from "dotenv";
+import { resolve } from "node:path";
+
+// how this works: the whole monorepo shares ONE .env at the repo root. When this
+// API runs via \`npm run dev\` its working directory is backend/, so the root .env
+// is one level up. This module is imported FIRST (before env.ts) so the variables
+// exist by the time anything reads them.
+config({ path: resolve(process.cwd(), "../.env") });
+config(); // also load backend/.env if you keep one (root values already set win)
+`;
+var backendEnv = (ctx) => `import { createEnv, str, port, oneOf } from "@lacspace/env";
+
+// how this works: fail-fast, TYPED environment variables (@lacspace/env). Bad or
+// missing values throw at boot with a clear message. Sensible dev defaults mean it
+// runs with zero config against a local MongoDB; set real values in the root .env.
+export const env = createEnv({
+  NODE_ENV: oneOf(["development", "production", "test"], { default: "development" }),
+  PORT: port({ default: 4000 }),
+  MONGODB_URI: str({ default: "mongodb://localhost:27017/${ctx.name}" }),
+  JWT_SECRET: str({ default: "dev-secret-change-me" }),
+  REDIS_URL: str({ optional: true }),
+  CORS_ORIGIN: str({ default: "http://localhost:3000" }),
+});
+
+if (env.NODE_ENV === "production" && env.JWT_SECRET === "dev-secret-change-me") {
+  throw new Error("Set a strong JWT_SECRET in production (see .env.example).");
+}
+`;
+var backendIndex = (ctx) => `import "./load-env.js"; // MUST be first: fills process.env before anything reads it
+import { env } from "./env.js";
+import { connectDb } from "./db.js";
+import { createApp } from "./app.js";
+
+// how this works: connect to MongoDB, build the Express app, then listen.
+async function main(): Promise<void> {
+  await connectDb(env.MONGODB_URI);
+  const app = createApp();
+  app.listen(env.PORT, () => {
+    console.log(\`\u{1F680} ${ctx.name} API ready on http://localhost:\${env.PORT}\`);
+  });
+}
+
+main().catch((err) => {
+  console.error("Failed to start the API:", err);
+  process.exit(1);
+});
+`;
+var backendDb = () => `import mongoose from "mongoose";
+
+// how this works: opens the Mongoose connection. Call once at boot.
+export async function connectDb(uri: string): Promise<void> {
+  mongoose.set("strictQuery", true);
+  await mongoose.connect(uri);
+  console.log("\u2714 MongoDB connected");
+}
+`;
+var backendCache = () => `import { createCache } from "@lacspace/cache";
+import { Redis } from "ioredis";
+import { env } from "./env.js";
+
+// how this works: one cache interface, TWO backends. If REDIS_URL is set we use
+// Redis; otherwise we fall back to @lacspace/cache (zero-dep, in-memory) so the app
+// runs with NO Redis at all. The rest of the code doesn't care which is active.
+export interface Cache {
+  get(key: string): Promise<string | null>;
+  set(key: string, value: string, ttlSeconds?: number): Promise<void>;
+  del(key: string): Promise<void>;
+  readonly kind: "redis" | "memory";
+}
+
+function redisCache(url: string): Cache {
+  const client = new Redis(url, { maxRetriesPerRequest: 2 });
+  client.on("error", (e: Error) => console.warn("\u26A0 Redis error:", e.message));
+  return {
+    kind: "redis",
+    async get(key) { return client.get(key); },
+    async set(key, value, ttl) { if (ttl) await client.set(key, value, "EX", ttl); else await client.set(key, value); },
+    async del(key) { await client.del(key); },
+  };
+}
+
+function memoryCache(): Cache {
+  const mem = createCache<string>({ max: 5000 });
+  return {
+    kind: "memory",
+    async get(key) { return mem.get(key) ?? null; },
+    async set(key, value, ttl) { mem.set(key, value, ttl ? ttl * 1000 : undefined); },
+    async del(key) { mem.delete(key); },
+  };
+}
+
+export const cache: Cache = env.REDIS_URL ? redisCache(env.REDIS_URL) : memoryCache();
+console.log(\`\u2714 Cache: \${cache.kind}\${cache.kind === "memory" ? " (no REDIS_URL \u2014 in-memory fallback)" : ""}\`);
+`;
+var backendHttp = () => `import type { Request, Response, NextFunction, RequestHandler } from "express";
+
+/** A simple HTTP error with a status code \u2014 throw it from any handler. */
+export class HttpError extends Error {
+  status: number;
+  constructor(status: number, message: string) {
+    super(message);
+    this.status = status;
+    this.name = "HttpError";
+  }
+}
+
+// how this works: Express v4 doesn't catch rejected Promises from async handlers,
+// so wrap them \u2014 any thrown error is forwarded to the error middleware.
+export const asyncHandler =
+  (fn: (req: Request, res: Response, next: NextFunction) => Promise<unknown>): RequestHandler =>
+  (req, res, next) => { fn(req, res, next).catch(next); };
+`;
+var backendExpressTypes = () => `// Adds req.user (populated by requireAuth) to Express's Request type.
+import "express";
+
+declare global {
+  namespace Express {
+    interface Request {
+      user?: { sub: string; email: string; iat?: number; exp?: number; iss?: string };
+    }
+  }
+}
+
+export {};
+`;
+var backendErrorMw = () => `import type { Request, Response, NextFunction } from "express";
+import { ValidationError } from "@lacspace/validate";
+import { HttpError } from "../http.js";
+
+// how this works: ONE place that turns thrown errors into clean JSON responses.
+// Register it LAST (after all routes). Express identifies it by its 4 arguments.
+export function errorHandler(err: unknown, _req: Request, res: Response, _next: NextFunction): void {
+  if (err instanceof ValidationError) {
+    res.status(400).json({ error: "Validation failed", fields: err.flatten() });
+    return;
+  }
+  if (err instanceof HttpError) {
+    res.status(err.status).json({ error: err.message });
+    return;
+  }
+  console.error(err);
+  res.status(500).json({ error: "Internal server error" });
+}
+`;
+var backendAuthMw = (ctx) => `import type { RequestHandler } from "express";
+import { expressJwt } from "@lacspace/jwt";
+import { env } from "../env.js";
+
+// how this works: verifies the "Authorization: Bearer <token>" header with
+// @lacspace/jwt and attaches the decoded payload to req.user (see express.d.ts).
+// Missing/invalid token \u2192 it responds 401 automatically. Put it on any route you
+// want protected:  router.get("/secret", requireAuth, handler)
+// (@lacspace/jwt's middleware is framework-agnostic, so we cast it to Express's
+//  RequestHandler \u2014 it's a standard (req, res, next) function underneath.)
+export const requireAuth = expressJwt(env.JWT_SECRET, { issuer: "${ctx.name}-api" }) as unknown as RequestHandler;
+`;
+var backendUserModel = () => `import mongoose from "mongoose";
+import { uuidv7 } from "@lacspace/id";
+
+// how this works: the User fields. _id is a time-sortable UUID (@lacspace/id)
+// instead of an ObjectId, so ids are readable and orderable. We store only a
+// password HASH, never the raw password. (We DON'T extend mongoose.Document \u2014 that
+// would force _id to be an ObjectId; a plain interface lets _id be our string.)
+export interface UserDoc {
+  _id: string;
+  email: string;
+  name: string;
+  passwordHash: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+const userSchema = new mongoose.Schema<UserDoc>(
+  {
+    _id: { type: String, default: () => uuidv7() },
+    email: { type: String, required: true, unique: true, lowercase: true, trim: true },
+    name: { type: String, required: true, trim: true },
+    passwordHash: { type: String, required: true },
+  },
+  { timestamps: true },
+);
+
+export const User =
+  (mongoose.models.User as mongoose.Model<UserDoc>) ?? mongoose.model<UserDoc>("User", userSchema);
+`;
+var backendNoteModel = () => `import mongoose from "mongoose";
+import { uuidv7 } from "@lacspace/id";
+
+// how this works: the example CRUD resource. Rename "Note" to your real domain
+// object (Task, Post, Product\u2026) and add fields \u2014 the routes follow the same shape.
+// (Plain interface, not mongoose.Document, so _id can be our string UUID.)
+export interface NoteDoc {
+  _id: string;
+  title: string;
+  body: string;
+  userId: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+const noteSchema = new mongoose.Schema<NoteDoc>(
+  {
+    _id: { type: String, default: () => uuidv7() },
+    title: { type: String, required: true, trim: true },
+    body: { type: String, default: "" },
+    userId: { type: String, required: true, index: true },
+  },
+  { timestamps: true },
+);
+
+export const Note =
+  (mongoose.models.Note as mongoose.Model<NoteDoc>) ?? mongoose.model<NoteDoc>("Note", noteSchema);
+`;
+var backendValidation = () => `import { v, type Infer } from "@lacspace/validate";
+
+// how this works: Zod-like schemas (@lacspace/validate). .parse(body) throws a
+// ValidationError on bad input, which the error middleware turns into a clean 400
+// with per-field messages.
+export const RegisterInput = v.object({
+  name: v.string().min(2).max(80),
+  email: v.string().email(),
+  password: v.string().min(8).max(200),
+});
+
+export const LoginInput = v.object({
+  email: v.string().email(),
+  password: v.string().min(1),
+});
+
+export const NoteInput = v.object({
+  title: v.string().min(1).max(200),
+  body: v.string().max(10_000).default(""),
+});
+
+export type RegisterBody = Infer<typeof RegisterInput>;
+export type LoginBody = Infer<typeof LoginInput>;
+export type NoteBody = Infer<typeof NoteInput>;
+`;
+var backendAuthRoutes = (ctx) => `import express from "express";
+import { hash, verify as verifyPassword } from "@lacspace/password";
+import { sign } from "@lacspace/jwt";
+import { asyncHandler, HttpError } from "../http.js";
+import { requireAuth } from "../middleware/auth.js";
+import { User, type UserDoc } from "../models/user.js";
+import { env } from "../env.js";
+import { RegisterInput, LoginInput } from "../validation.js";
+import type { AuthResponse, User as UserDTO } from "${scope(ctx)}/types";
+
+const ISSUER = "${ctx.name}-api";
+const WEEK = 60 * 60 * 24 * 7; // token lifetime, in seconds
+const router = express.Router();
+
+function toDTO(u: UserDoc): UserDTO {
+  return { id: String(u._id), email: u.email, name: u.name, createdAt: u.createdAt.toISOString() };
+}
+function tokenFor(u: UserDoc): Promise<string> {
+  return sign({ sub: String(u._id), email: u.email }, env.JWT_SECRET, { expiresIn: WEEK, issuer: ISSUER });
+}
+
+// POST /auth/register \u2014 create an account, return a JWT + the user.
+router.post("/register", asyncHandler(async (req, res) => {
+  const { name, email, password } = RegisterInput.parse(req.body);
+  if (await User.findOne({ email })) throw new HttpError(409, "That email is already registered");
+  const passwordHash = await hash(password); // PBKDF2 via @lacspace/password
+  const user = await User.create({ name, email, passwordHash });
+  const out: AuthResponse = { token: await tokenFor(user), user: toDTO(user) };
+  res.status(201).json(out);
+}));
+
+// POST /auth/login \u2014 verify credentials, return a JWT + the user.
+router.post("/login", asyncHandler(async (req, res) => {
+  const { email, password } = LoginInput.parse(req.body);
+  const user = await User.findOne({ email });
+  if (!user || !(await verifyPassword(password, user.passwordHash))) {
+    throw new HttpError(401, "Invalid email or password");
+  }
+  const out: AuthResponse = { token: await tokenFor(user), user: toDTO(user) };
+  res.json(out);
+}));
+
+// GET /auth/me \u2014 the current user (requires a valid token).
+router.get("/me", requireAuth, asyncHandler(async (req, res) => {
+  const user = await User.findById(req.user!.sub);
+  if (!user) throw new HttpError(404, "User not found");
+  res.json(toDTO(user));
+}));
+
+export default router;
+`;
+var backendNoteRoutes = (ctx) => `import express from "express";
+import { asyncHandler, HttpError } from "../http.js";
+import { requireAuth } from "../middleware/auth.js";
+import { Note, type NoteDoc } from "../models/note.js";
+import { cache } from "../cache.js";
+import { NoteInput } from "../validation.js";
+import type { Note as NoteDTO } from "${scope(ctx)}/types";
+
+const router = express.Router();
+router.use(requireAuth); // every /notes route requires a valid token
+
+function toDTO(n: NoteDoc): NoteDTO {
+  return {
+    id: String(n._id),
+    title: n.title,
+    body: n.body,
+    userId: String(n.userId),
+    createdAt: n.createdAt.toISOString(),
+    updatedAt: n.updatedAt.toISOString(),
+  };
+}
+const listKey = (userId: string): string => \`notes:\${userId}\`;
+
+// GET /notes \u2014 this user's notes. Cached for 30s (Redis or in-memory); every write
+// below busts the cache, so reads are fast but never stale after a change.
+router.get("/", asyncHandler(async (req, res) => {
+  const userId = req.user!.sub;
+  const cached = await cache.get(listKey(userId));
+  if (cached) { res.json(JSON.parse(cached) as NoteDTO[]); return; }
+  const notes = await Note.find({ userId }).sort({ createdAt: -1 });
+  const dto = notes.map(toDTO);
+  await cache.set(listKey(userId), JSON.stringify(dto), 30);
+  res.json(dto);
+}));
+
+// POST /notes \u2014 create a note.
+router.post("/", asyncHandler(async (req, res) => {
+  const userId = req.user!.sub;
+  const { title, body } = NoteInput.parse(req.body);
+  const note = await Note.create({ title, body, userId });
+  await cache.del(listKey(userId));
+  res.status(201).json(toDTO(note));
+}));
+
+// GET /notes/:id \u2014 one note (only if it's yours).
+router.get("/:id", asyncHandler(async (req, res) => {
+  const note = await Note.findOne({ _id: req.params.id, userId: req.user!.sub });
+  if (!note) throw new HttpError(404, "Note not found");
+  res.json(toDTO(note));
+}));
+
+// PATCH /notes/:id \u2014 update a note.
+router.patch("/:id", asyncHandler(async (req, res) => {
+  const patch = NoteInput.partial().parse(req.body);
+  const note = await Note.findOneAndUpdate({ _id: req.params.id, userId: req.user!.sub }, { $set: patch }, { new: true });
+  if (!note) throw new HttpError(404, "Note not found");
+  await cache.del(listKey(req.user!.sub));
+  res.json(toDTO(note));
+}));
+
+// DELETE /notes/:id \u2014 delete a note.
+router.delete("/:id", asyncHandler(async (req, res) => {
+  const note = await Note.findOneAndDelete({ _id: req.params.id, userId: req.user!.sub });
+  if (!note) throw new HttpError(404, "Note not found");
+  await cache.del(listKey(req.user!.sub));
+  res.status(204).end();
+}));
+
+export default router;
+`;
+var backendApp = (ctx) => `import express from "express";
+import type { RequestHandler } from "express";
+import cors from "cors";
+import { rateLimit, expressRateLimit } from "@lacspace/rate-limit";
+import { env } from "./env.js";
+import { errorHandler } from "./middleware/error.js";
+import authRoutes from "./routes/auth.js";
+import noteRoutes from "./routes/notes.js";
+
+// how this works: assembles the Express app \u2014 CORS for the frontend, JSON parsing,
+// a health check, the auth + notes routers, then the error handler LAST.
+export function createApp(): express.Express {
+  const app = express();
+
+  app.use(cors({ origin: env.CORS_ORIGIN.split(",").map((o) => o.trim()), credentials: true }));
+  app.use(express.json());
+
+  // Brute-force protection on auth: 20 requests / minute / IP (@lacspace/rate-limit).
+  const authLimiter = expressRateLimit(rateLimit({ limit: 20, windowMs: 60_000 })) as unknown as RequestHandler;
+
+  app.get("/health", (_req, res) => { res.json({ ok: true, service: "${ctx.name}-api" }); });
+  app.use("/auth", authLimiter, authRoutes);
+  app.use("/notes", noteRoutes);
+
+  app.use(errorHandler);
+  return app;
+}
+`;
+function backendFiles(ctx) {
+  return {
+    "backend/package.json": backendPkgJson(ctx),
+    "backend/tsconfig.json": backendTsconfig(ctx),
+    "backend/.gitignore": backendGitignore(),
+    "backend/README.md": backendReadme(ctx),
+    "backend/src/index.ts": backendIndex(ctx),
+    "backend/src/load-env.ts": backendLoadEnv(),
+    "backend/src/env.ts": backendEnv(ctx),
+    "backend/src/db.ts": backendDb(),
+    "backend/src/cache.ts": backendCache(),
+    "backend/src/app.ts": backendApp(ctx),
+    "backend/src/http.ts": backendHttp(),
+    "backend/src/express.d.ts": backendExpressTypes(),
+    "backend/src/validation.ts": backendValidation(),
+    "backend/src/middleware/auth.ts": backendAuthMw(ctx),
+    "backend/src/middleware/error.ts": backendErrorMw(),
+    "backend/src/models/user.ts": backendUserModel(),
+    "backend/src/models/note.ts": backendNoteModel(),
+    "backend/src/routes/auth.ts": backendAuthRoutes(ctx),
+    "backend/src/routes/notes.ts": backendNoteRoutes(ctx)
+  };
+}
 var splitList = (s) => s.split(",").map((x) => x.trim()).filter(Boolean);
 function parseArgs(list) {
   const a = { features: [], yes: false, install: true, git: true, pm: "npm", help: false };
@@ -5104,7 +6338,15 @@ function parseArgs(list) {
     else if (arg === "--pm") a.pm = next();
     else if (arg === "--theme" || arg === "--accent") a.theme = next();
     else if (arg === "--with" || arg === "--features") a.features.push(...splitList(next()));
-    else if (arg === "-h" || arg === "--help") a.help = true;
+    else if (arg === "--fullstack" || arg === "--full-stack" || arg === "--dynamic") a.mode = "dynamic";
+    else if (arg === "--static") a.mode = "static";
+    else if (arg === "--mode") {
+      const m = next().toLowerCase();
+      a.mode = m === "dynamic" ? "dynamic" : "static";
+    } else if (arg.startsWith("--mode=")) {
+      const m = arg.slice(7).toLowerCase();
+      a.mode = m === "dynamic" ? "dynamic" : "static";
+    } else if (arg === "-h" || arg === "--help") a.help = true;
     else if (arg.startsWith("--template=")) a.template = arg.slice(11);
     else if (arg.startsWith("--theme=")) a.theme = arg.slice(8);
     else if (arg.startsWith("--accent=")) a.theme = arg.slice(9);
@@ -5204,6 +6446,9 @@ ${TEMPLATES.map((t) => `  ${t.key.padEnd(10)} ${t.description}`).join("\n")}
 
 ${c("bold", "Options")}
   -t, --template <key>   Template (${TEMPLATES.map((t) => t.key).join(" | ")})
+  --fullstack            Full-stack monorepo: Next.js frontend + Node/Express/
+                         MongoDB/Redis backend (JWT auth + CRUD) + shared types
+                         ${c("dim", "(alias --dynamic; default is --static, a single Next.js app)")}
   --with <a,b>           Feature add-ons, comma-separated (alias --features)
   --theme <name|hex>     Accent: a preset, a "#hex", or "from,to" (e.g. --theme lacspace)
   --pm <npm|pnpm|yarn|bun>  Package manager (default npm)
@@ -5595,6 +6840,7 @@ ${c("bold", c("magenta", "\u25C6 create-lacspace-app"))} ${c("dim", "\u2014 a go
 `);
   let name = args.name;
   let templateKey = args.template;
+  let mode = args.mode ?? "static";
   const featureKeys = [...args.features];
   if (!args.yes && stdin.isTTY) {
     const rl = createInterface({ input: stdin, output: stdout });
@@ -5611,6 +6857,18 @@ ${c("green", "?")} Template ${c("dim", "(1)")}: `)).trim() || "1";
         const idx = /^\d+$/.test(ans) ? parseInt(ans, 10) - 1 : TEMPLATES.findIndex((t) => t.key === ans);
         templateKey = TEMPLATES[idx]?.key ?? "personal";
       }
+      if (args.mode === void 0) {
+        stdout.write(`
+  What kind of app?
+`);
+        stdout.write(`   ${c("cyan", "1")}. ${c("bold", "Static / frontend only")} ${c("dim", "\u2014 a single Next.js app (SEO site, marketing, blog, docs). Fast, deploy anywhere.")}
+`);
+        stdout.write(`   ${c("cyan", "2")}. ${c("bold", "Dynamic / full-stack")} ${c("dim", "\u2014 frontend + a Node\xB7Express\xB7MongoDB\xB7Redis API with working auth & CRUD, wired together.")}
+`);
+        const ans = (await rl.question(`
+${c("green", "?")} Type ${c("dim", "(1)")}: `)).trim() || "1";
+        mode = ans === "2" || ans.toLowerCase().startsWith("dyn") || ans.toLowerCase().startsWith("full") ? "dynamic" : "static";
+      }
       if (featureKeys.length === 0) {
         stdout.write(`
   Add feature add-ons? ${c("dim", "(free & keyless \u2014 local AI by default)")}
@@ -5652,14 +6910,15 @@ ${c("green", "?")} Add features? ${c("dim", "(comma-separated numbers, or Enter
     return;
   }
   const features = normalizeFeatures(featureKeys);
-  const files = buildFiles({ name: projectName, template, features });
+  const files = buildFiles({ name: projectName, template, features, mode });
   for (const [rel, content] of Object.entries(files)) {
     const full = join(dir, rel);
     mkdirSync(dirname(full), { recursive: true });
     writeFileSync(full, content);
   }
+  const shape = mode === "dynamic" ? " \xB7 full-stack" : "";
   stdout.write(`
-  ${c("green", "\u2714")} Created ${c("bold", name)} ${c("dim", `(${template.label})`)}
+  ${c("green", "\u2714")} Created ${c("bold", name)} ${c("dim", `(${template.label}${shape})`)}
 `);
   if (features.length) stdout.write(`  ${c("green", "\u2714")} Feature add-ons: ${features.map((f) => c("cyan", f.key)).join(", ")}
 `);
@@ -5689,11 +6948,25 @@ ${c("bold", "Done! Next steps")}
 `);
   if (!args.install) stdout.write(`  ${c("cyan", `${args.pm} install`)}
 `);
-  stdout.write(`  ${c("cyan", run)}
+  if (mode === "dynamic") {
+    stdout.write(`  ${c("cyan", "cp .env.example .env")} ${c("dim", "\u2014 then, optionally:")} ${c("cyan", "docker compose up -d")} ${c("dim", "(Mongo + Redis)")}
 `);
-  stdout.write(`
+    stdout.write(`  ${c("cyan", run)} ${c("dim", "\u2014 runs the API (:4000) and the frontend (:3000) together")}
+`);
+    stdout.write(`
+  ${c("dim", "backend \u2192")} ${c("cyan", "backend/src/")} ${c("dim", "(Express \xB7 MongoDB \xB7 Redis \xB7 JWT auth \xB7 example CRUD)")}
+`);
+    stdout.write(`  ${c("dim", "frontend \u2192")} ${c("cyan", "frontend/app/")} ${c("dim", "\xB7 shared API types \u2192")} ${c("cyan", "types/src/")}
+`);
+    stdout.write(`  ${c("dim", "No Docker? Point")} ${c("cyan", "MONGODB_URI")} ${c("dim", "at any MongoDB (e.g. free Atlas); Redis is optional.")}
+`);
+  } else {
+    stdout.write(`  ${c("cyan", run)}
+`);
+    stdout.write(`
   Edit ${c("cyan", "lib/site.ts")} (your SEO config) and ${c("cyan", "app/page.tsx")}.
 `);
+  }
   if (features.length) {
     const hasAi = features.some((f) => f.key === "ai-chat" || f.key === "rag");
     stdout.write(`