create-strata 1.0.1

package/dist/cli.js

@@ -0,0 +1,4222 @@
+#!/usr/bin/env bun
+// @bun
+
+// ../strata-starter/src/generate.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, rmSync as rmSync2 } from "fs";
+import { basename, join as join2, resolve } from "path";
+
+// ../strata-starter/src/copy.ts
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { join } from "path";
+var PLACEHOLDER = /\{\{PROJECT_NAME\}\}/g;
+function copyTree(source, target, projectName, skipNames = new Set) {
+  mkdirSync(target, { recursive: true });
+  for (const entry of readdirSync(source)) {
+    if (skipNames.has(entry) || entry === ".DS_Store") {
+      continue;
+    }
+    const from = join(source, entry);
+    const to = join(target, entry.replace(PLACEHOLDER, projectName));
+    const info = statSync(from);
+    if (info.isDirectory()) {
+      copyTree(from, to, projectName, skipNames);
+      continue;
+    }
+    let contents = readFileSync(from, "utf8");
+    if (contents.includes("{{PROJECT_NAME}}")) {
+      contents = contents.replace(PLACEHOLDER, projectName);
+    }
+    writeFileSync(to, contents, { mode: info.mode & 511 });
+  }
+}
+function copyOverlayTree(sourceRoot, targetRoot) {
+  if (!existsSync(sourceRoot)) {
+    return;
+  }
+  for (const entry of readdirSync(sourceRoot, { withFileTypes: true })) {
+    const sourcePath = join(sourceRoot, entry.name);
+    const targetPath = join(targetRoot, entry.name);
+    if (entry.isDirectory()) {
+      mkdirSync(targetPath, { recursive: true });
+      copyOverlayTree(sourcePath, targetPath);
+      continue;
+    }
+    if (existsSync(targetPath)) {
+      continue;
+    }
+    mkdirSync(join(targetPath, ".."), { recursive: true });
+    const contents = readFileSync(sourcePath);
+    writeFileSync(targetPath, contents);
+  }
+}
+function writeText(target, contents) {
+  mkdirSync(join(target, ".."), { recursive: true });
+  writeFileSync(target, contents.endsWith(`
+`) ? contents : `${contents}
+`);
+}
+function removeIfExists(path) {
+  if (existsSync(path)) {
+    rmSync(path, { recursive: true, force: true });
+  }
+}
+
+// ../strata-starter/src/types.ts
+var FRONTENDS = ["api", "server-htmx", "spa-react", "hybrid"];
+var DATABASES = ["sqlite", "postgres", "mysql"];
+var AUTH_STACKS = [
+  "headers",
+  "cookie",
+  "token",
+  "jwt",
+  "cookie-token",
+  "cookie-token-jwt"
+];
+var TENANCY_DRIVERS = ["none", "column", "rls"];
+var CACHE_DRIVERS = ["array", "redis"];
+var QUEUE_DRIVERS = ["sync", "redis"];
+var MAIL_DRIVERS = ["log", "smtp"];
+var DOCKER_SERVICE_NAMES = ["postgres", "mysql", "redis", "mailpit", "adminer"];
+var DOCKER_SERVICE_LABELS = {
+  postgres: "Postgres",
+  mysql: "MySQL",
+  redis: "Redis",
+  mailpit: "SMTP (Mailpit)",
+  adminer: "Adminer (database UI)"
+};
+function authUsesCookie(auth) {
+  return auth === "cookie" || auth.startsWith("cookie-");
+}
+function authUsesToken(auth) {
+  return auth === "token" || auth.includes("token");
+}
+function authUsesJwt(auth) {
+  return auth === "jwt" || auth.endsWith("jwt");
+}
+function authNeedsUsers(auth) {
+  return auth !== "headers";
+}
+function usesTenantTable(tenancy) {
+  return tenancy === "rls" || tenancy === "column";
+}
+function htmlAuthKit(auth) {
+  return authUsesCookie(auth);
+}
+function needsFrontendBuild(frontend) {
+  return frontend === "spa-react" || frontend === "hybrid";
+}
+function nowTimestampLiteral(database) {
+  return database === "mysql" ? `new Date().toISOString().slice(0, 19).replace("T", " ")` : "new Date().toISOString()";
+}
+function extraApplies(extra, auth) {
+  if (extra === "metrics") {
+    return true;
+  }
+  if (extra === "mfa") {
+    return htmlAuthKit(auth);
+  }
+  return authNeedsUsers(auth);
+}
+function needsRedis(layers) {
+  return layers.cache === "redis" || layers.queue === "redis";
+}
+function emptyDockerServices() {
+  return { postgres: false, mysql: false, redis: false, mailpit: false, adminer: false };
+}
+function dockerDatabaseService(database) {
+  if (database === "postgres" || database === "mysql") {
+    return database;
+  }
+  return null;
+}
+function enableDockerServices(names) {
+  const services = emptyDockerServices();
+  for (const name of names) {
+    services[name] = true;
+  }
+  return services;
+}
+function neededDockerServices(layers) {
+  const needed = [];
+  if (layers.database === "postgres") {
+    needed.push("postgres");
+  }
+  if (layers.database === "mysql") {
+    needed.push("mysql");
+  }
+  if (needsRedis(layers)) {
+    needed.push("redis");
+  }
+  if (layers.mail === "smtp") {
+    needed.push("mailpit");
+  }
+  return needed;
+}
+function selectedDockerServices(layers) {
+  if (!layers.docker.enabled) {
+    return [];
+  }
+  const selected = neededDockerServices(layers).filter((name) => layers.docker.services[name]);
+  const databaseService = dockerDatabaseService(layers.database);
+  if (databaseService && selected.includes(databaseService) && layers.docker.services.adminer) {
+    selected.push("adminer");
+  }
+  return selected;
+}
+function reconcileDocker(layers) {
+  const selected = selectedDockerServices(layers);
+  return {
+    ...layers,
+    docker: {
+      enabled: selected.length > 0,
+      services: enableDockerServices(selected)
+    }
+  };
+}
+function dockerLayerForNeeded(layers, enabled) {
+  const needed = neededDockerServices(layers);
+  if (!enabled || needed.length === 0) {
+    return { enabled: false, services: emptyDockerServices() };
+  }
+  const names = [...needed];
+  if (dockerDatabaseService(layers.database)) {
+    names.push("adminer");
+  }
+  return { enabled: true, services: enableDockerServices(names) };
+}
+
+// ../strata-starter/src/presets.ts
+var noneExtras = {
+  mfa: false,
+  emailVerification: false,
+  scim: false,
+  metrics: false
+};
+var enterpriseExtras = {
+  mfa: true,
+  emailVerification: true,
+  scim: true,
+  metrics: true
+};
+function withDocker(layers, composeForNeededTools) {
+  return {
+    ...layers,
+    docker: dockerLayerForNeeded(layers, composeForNeededTools)
+  };
+}
+function defaultLayers() {
+  return withDocker({
+    frontend: "api",
+    database: "sqlite",
+    auth: "headers",
+    tenancy: "none",
+    cache: "array",
+    queue: "sync",
+    mail: "log",
+    spaPrefix: "/app",
+    extras: { ...noneExtras }
+  }, false);
+}
+var EXAMPLE_APPS = {
+  "hiroapp-hobby": defaultLayers(),
+  "hiroapp-team": withDocker({
+    frontend: "server-htmx",
+    database: "postgres",
+    auth: "cookie",
+    tenancy: "none",
+    cache: "redis",
+    queue: "redis",
+    mail: "log",
+    spaPrefix: "/app",
+    extras: { ...noneExtras, metrics: true }
+  }, true),
+  hiroapp: withDocker({
+    frontend: "server-htmx",
+    database: "postgres",
+    auth: "cookie-token-jwt",
+    tenancy: "rls",
+    cache: "redis",
+    queue: "redis",
+    mail: "smtp",
+    spaPrefix: "/app",
+    extras: { ...enterpriseExtras }
+  }, true)
+};
+
+// ../strata-starter/src/parseArgs.ts
+function usage() {
+  return `Usage: create-strata [project-name] [options]
+
+Scaffold a runnable Strata app. The wizard always asks each layer. For CI, pass --yes
+and the layer flags you want (defaults are SQLite, JSON API, header auth).
+
+Options:
+  --frontend          api | server-htmx | spa-react | hybrid
+  --database          sqlite | postgres | mysql (one database; not mixed)
+  --auth              headers | cookie | token | jwt | cookie-token | cookie-token-jwt
+  --tenancy           none | column | rls (rls is Postgres SET LOCAL; sqlite/mysql coerce rls to column)
+  --cache             array | redis
+  --queue             sync | redis
+  --mail              log | smtp
+  --spa-prefix        SPA URL prefix (default /app)
+  --mfa / --no-mfa
+  --email-verification / --no-email-verification
+  --scim / --no-scim
+  --metrics / --no-metrics
+  --extras            Interactive extras list (MFA, email verification, SCIM, metrics)
+  --docker            Write Docker Compose for every selected tool that needs a service
+  --no-docker         Skip docker-compose.yml; use installs already on this machine
+  --docker-services   Subset: postgres, mysql, redis, mailpit, adminer (comma-separated)
+  --force             Replace an existing directory
+  --yes, --no-interactive
+  -h, --help
+
+Examples:
+  bunx create-strata my-app
+  bunx create-strata my-app --yes
+  bunx create-strata html --frontend server-htmx --database postgres --auth cookie --cache redis --queue redis --docker --yes
+  bunx create-strata html --frontend server-htmx --database postgres --no-docker --yes
+`;
+}
+function takeValue(arg, prefix) {
+  if (arg.startsWith(`${prefix}=`)) {
+    return arg.slice(prefix.length + 1);
+  }
+  return;
+}
+function parseEnum(value, allowed, label) {
+  if (allowed.includes(value)) {
+    return value;
+  }
+  throw new Error(`Unknown ${label} "${value}". Expected ${allowed.join(", ")}.`);
+}
+function parseDockerServiceList(raw) {
+  const names = raw.split(",").map((part) => part.trim().toLowerCase()).filter((part) => part.length > 0);
+  const unknown = names.filter((name) => !DOCKER_SERVICE_NAMES.includes(name));
+  if (unknown.length > 0) {
+    throw new Error(`Unknown docker service "${unknown.join(", ")}". Expected ${DOCKER_SERVICE_NAMES.join(", ")}.`);
+  }
+  return names;
+}
+function dockerFlagsProvided(flags) {
+  return flags.docker !== undefined || flags.dockerServices !== undefined;
+}
+function parseCreateStrataArgs(argv) {
+  const flags = {
+    help: false,
+    yes: false,
+    noInteractive: false,
+    force: false,
+    extrasPrompt: false,
+    extras: {}
+  };
+  const positional = [];
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg) {
+      continue;
+    }
+    if (arg === "-h" || arg === "--help") {
+      flags.help = true;
+      continue;
+    }
+    if (arg === "--yes" || arg === "-y") {
+      flags.yes = true;
+      continue;
+    }
+    if (arg === "--no-interactive") {
+      flags.noInteractive = true;
+      continue;
+    }
+    if (arg === "--force") {
+      flags.force = true;
+      continue;
+    }
+    if (arg === "--extras" || arg === "--corporate") {
+      flags.extrasPrompt = true;
+      continue;
+    }
+    if (arg === "--docker") {
+      flags.docker = true;
+      flags.dockerServices = undefined;
+      continue;
+    }
+    if (arg === "--no-docker") {
+      flags.docker = false;
+      flags.dockerServices = undefined;
+      continue;
+    }
+    const dockerServicesInline = takeValue(arg, "--docker-services");
+    if (dockerServicesInline !== undefined) {
+      flags.docker = true;
+      flags.dockerServices = parseDockerServiceList(dockerServicesInline);
+      continue;
+    }
+    if (arg === "--docker-services") {
+      flags.docker = true;
+      flags.dockerServices = parseDockerServiceList(argv[index + 1] ?? "");
+      index += 1;
+      continue;
+    }
+    const boolFlags = [
+      ["--mfa", "mfa", true],
+      ["--no-mfa", "mfa", false],
+      ["--email-verification", "emailVerification", true],
+      ["--no-email-verification", "emailVerification", false],
+      ["--scim", "scim", true],
+      ["--no-scim", "scim", false],
+      ["--metrics", "metrics", true],
+      ["--no-metrics", "metrics", false]
+    ];
+    const boolMatch = boolFlags.find(([name]) => name === arg);
+    if (boolMatch) {
+      flags.extras[boolMatch[1]] = boolMatch[2];
+      continue;
+    }
+    const pairs = [
+      [
+        "--frontend",
+        (value) => {
+          flags.frontend = parseEnum(value, FRONTENDS, "frontend");
+        }
+      ],
+      [
+        "--database",
+        (value) => {
+          flags.database = parseEnum(value, DATABASES, "database");
+        }
+      ],
+      [
+        "--auth",
+        (value) => {
+          flags.auth = parseEnum(value, AUTH_STACKS, "auth");
+        }
+      ],
+      [
+        "--tenancy",
+        (value) => {
+          flags.tenancy = parseEnum(value, TENANCY_DRIVERS, "tenancy");
+        }
+      ],
+      [
+        "--cache",
+        (value) => {
+          flags.cache = parseEnum(value, CACHE_DRIVERS, "cache");
+        }
+      ],
+      [
+        "--queue",
+        (value) => {
+          flags.queue = parseEnum(value, QUEUE_DRIVERS, "queue");
+        }
+      ],
+      [
+        "--mail",
+        (value) => {
+          flags.mail = parseEnum(value, MAIL_DRIVERS, "mail");
+        }
+      ],
+      [
+        "--spa-prefix",
+        (value) => {
+          flags.spaPrefix = value.startsWith("/") ? value : `/${value}`;
+        }
+      ]
+    ];
+    let matched = false;
+    for (const [name, apply] of pairs) {
+      const inline = takeValue(arg, name);
+      if (inline !== undefined) {
+        apply(inline);
+        matched = true;
+        break;
+      }
+      if (arg === name) {
+        apply(argv[index + 1] ?? "");
+        index += 1;
+        matched = true;
+        break;
+      }
+    }
+    if (matched) {
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      throw new Error(`Unknown option ${arg}. Pass --help to list flags.`);
+    }
+    positional.push(arg);
+  }
+  if (positional[0]) {
+    flags.projectName = positional[0];
+  }
+  return flags;
+}
+function applyDockerFlags(layers, flags) {
+  const needed = neededDockerServices(layers);
+  if (flags.docker === false) {
+    return {
+      ...layers,
+      docker: dockerLayerForNeeded(layers, false)
+    };
+  }
+  if (flags.dockerServices) {
+    const databaseService = dockerDatabaseService(layers.database);
+    const selected = flags.dockerServices.filter((name) => {
+      if (needed.includes(name)) {
+        return true;
+      }
+      return name === "adminer" && databaseService !== null && flags.dockerServices?.includes(databaseService) === true;
+    });
+    return {
+      ...layers,
+      docker: {
+        enabled: selected.length > 0,
+        services: enableDockerServices(selected)
+      }
+    };
+  }
+  if (flags.docker === true) {
+    return {
+      ...layers,
+      docker: dockerLayerForNeeded(layers, true)
+    };
+  }
+  return layers;
+}
+function extraFlagName(extra) {
+  return extra === "emailVerification" ? "email-verification" : extra;
+}
+function dropInapplicableExtras(layers, flags) {
+  for (const key of Object.keys(layers.extras)) {
+    if (extraApplies(key, layers.auth)) {
+      continue;
+    }
+    if (flags.extras[key] === true) {
+      console.warn(`Ignoring --${extraFlagName(key)}: not available with --auth ${layers.auth}.`);
+    }
+    layers.extras[key] = false;
+  }
+}
+function applyFlagOverrides(base, flags) {
+  const next = {
+    ...base,
+    frontend: flags.frontend ?? base.frontend,
+    database: flags.database ?? base.database,
+    auth: flags.auth ?? base.auth,
+    tenancy: flags.tenancy ?? base.tenancy,
+    cache: flags.cache ?? base.cache,
+    queue: flags.queue ?? base.queue,
+    mail: flags.mail ?? base.mail,
+    spaPrefix: flags.spaPrefix ?? base.spaPrefix,
+    extras: { ...base.extras, ...flags.extras }
+  };
+  if (next.database !== "postgres" && next.tenancy === "rls") {
+    console.warn(`Using --tenancy column: rls is Postgres-only (SET LOCAL app.tenant_id) and ${next.database} has no equivalent.`);
+    next.tenancy = "column";
+  }
+  dropInapplicableExtras(next, flags);
+  return reconcileDocker(applyDockerFlags(next, flags));
+}
+function layersFromFlags(flags) {
+  return applyFlagOverrides(defaultLayers(), flags);
+}
+
+// ../strata-starter/src/prompt.ts
+import { createInterface } from "readline/promises";
+import tty2 from "tty";
+
+// ../strata-starter/src/selectPrompt.ts
+import tty from "tty";
+function hasRawMode(input) {
+  return Boolean(input.isTTY && typeof input.setRawMode === "function");
+}
+var cachedFdIo;
+function resolveSelectIo(preferred) {
+  if (preferred) {
+    return preferred;
+  }
+  const live = { input: process.stdin, output: process.stdout };
+  if (hasRawMode(live.input)) {
+    return live;
+  }
+  if (cachedFdIo && hasRawMode(cachedFdIo.input)) {
+    return cachedFdIo;
+  }
+  if (tty.isatty(0)) {
+    cachedFdIo = {
+      input: new tty.ReadStream(0),
+      output: tty.isatty(1) ? new tty.WriteStream(1) : process.stdout
+    };
+    return cachedFdIo;
+  }
+  return live;
+}
+
+class PromptCancelledError extends Error {
+  constructor() {
+    super("Cancelled");
+    this.name = "PromptCancelledError";
+  }
+}
+function consumeSelectKeys(buffer) {
+  const events = [];
+  let rest = buffer;
+  while (rest.length > 0) {
+    if (rest[0] === "\x1B") {
+      if (rest.length === 1) {
+        break;
+      }
+      if (rest.startsWith("\x1B[")) {
+        const end = rest.search(/[A-Za-z]/);
+        if (end < 2) {
+          break;
+        }
+        const command = rest[end];
+        rest = rest.slice(end + 1);
+        if (command === "A") {
+          events.push({ type: "up" });
+        } else if (command === "B") {
+          events.push({ type: "down" });
+        } else if (command === "C") {
+          events.push({ type: "right" });
+        } else if (command === "D") {
+          events.push({ type: "left" });
+        }
+        continue;
+      }
+      if (rest.startsWith("\x1BO")) {
+        if (rest.length < 3) {
+          break;
+        }
+        const command = rest[2];
+        rest = rest.slice(3);
+        if (command === "A") {
+          events.push({ type: "up" });
+        } else if (command === "B") {
+          events.push({ type: "down" });
+        } else if (command === "C") {
+          events.push({ type: "right" });
+        } else if (command === "D") {
+          events.push({ type: "left" });
+        }
+        continue;
+      }
+      rest = rest.slice(1);
+      events.push({ type: "abort" });
+      continue;
+    }
+    const next = rest[0] ?? "";
+    rest = rest.slice(1);
+    if (next === "\x03") {
+      events.push({ type: "abort" });
+      continue;
+    }
+    if (next === "\r" || next === `
+`) {
+      events.push({ type: "submit" });
+      continue;
+    }
+    if (next === " ") {
+      events.push({ type: "toggle" });
+      continue;
+    }
+    if (next === "y" || next === "Y") {
+      events.push({ type: "yes" });
+      continue;
+    }
+    if (next === "n" || next === "N") {
+      events.push({ type: "no" });
+      continue;
+    }
+    if (next >= "1" && next <= "9") {
+      events.push({ type: "digit", value: Number(next) });
+    }
+  }
+  return { events, rest };
+}
+function moveSelectIndex(index, delta, length) {
+  if (length <= 0) {
+    return 0;
+  }
+  return (index + delta + length) % length;
+}
+function highlight(line, on) {
+  return on ? `\x1B[7m${line}\x1B[0m` : line;
+}
+function renderSelectLines(message, choices, index) {
+  return [
+    message,
+    ...choices.map((choice, choiceIndex) => {
+      const selected = choiceIndex === index;
+      const marker = selected ? ">" : " ";
+      return highlight(`  ${marker} ${choiceIndex + 1}) ${choice.label}`, selected);
+    }),
+    `  \u2191/\u2193 and Enter, or 1-${choices.length}`
+  ];
+}
+function renderConfirmLines(message, yes) {
+  return [
+    message,
+    highlight(`  ${yes ? ">" : " "} yes`, yes),
+    highlight(`  ${yes ? " " : ">"} no`, !yes),
+    "  \u2191/\u2193 and Enter, or y / n"
+  ];
+}
+function renderMultiSelectLines(message, choices, index) {
+  return [
+    message,
+    ...choices.map((choice, choiceIndex) => {
+      const focused = choiceIndex === index;
+      const box = choice.enabled ? "[x]" : "[ ]";
+      const marker = focused ? ">" : " ";
+      return highlight(`  ${marker} ${box} ${choiceIndex + 1}) ${choice.label}`, focused);
+    }),
+    "  \u2191/\u2193 move, Space or 1-9 toggle, Enter to continue"
+  ];
+}
+function writeLines(output, lines) {
+  for (const line of lines) {
+    output.write(`\x1B[2K${line}
+`);
+  }
+}
+function clearDrawnLines(output, lineCount) {
+  if (lineCount <= 0) {
+    return;
+  }
+  output.write(`\x1B[${lineCount}F`);
+  for (let i = 0;i < lineCount; i += 1) {
+    output.write(`\x1B[2K
+`);
+  }
+  output.write(`\x1B[${lineCount}F`);
+}
+function runRawPrompt(io, render, onEvent, summary) {
+  const { input, output } = io;
+  const wasRaw = Boolean(input.isTTY && typeof input.setRawMode === "function");
+  let buffer = "";
+  let lineCount = 0;
+  let settled = false;
+  const restore = () => {
+    output.write("\x1B[?25h");
+    if (wasRaw) {
+      input.setRawMode?.(false);
+    }
+  };
+  const paint = () => {
+    const lines = render();
+    if (lineCount > 0) {
+      output.write(`\x1B[${lineCount}F`);
+    }
+    writeLines(output, lines);
+    lineCount = lines.length;
+  };
+  input.setEncoding("utf8");
+  if (wasRaw) {
+    input.setRawMode?.(true);
+  }
+  if (typeof input.resume === "function") {
+    input.resume();
+  }
+  output.write("\x1B[?25l");
+  paint();
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      input.off("data", onData);
+      restore();
+    };
+    const succeed = (result) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      clearDrawnLines(output, lineCount);
+      output.write(`${summary(result)}
+`);
+      resolve(result);
+    };
+    const fail = (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      clearDrawnLines(output, lineCount);
+      reject(error);
+    };
+    function onData(chunk) {
+      buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      const consumed = consumeSelectKeys(buffer);
+      buffer = consumed.rest;
+      for (const event of consumed.events) {
+        const outcome = onEvent(event);
+        if (outcome === "abort") {
+          fail(new PromptCancelledError);
+          return;
+        }
+        if (outcome === "continue") {
+          paint();
+          continue;
+        }
+        succeed(outcome.done);
+        return;
+      }
+    }
+    input.on("data", onData);
+  });
+}
+async function promptSelect(message, choices, defaultValue, io) {
+  if (choices.length === 0) {
+    throw new Error(`No choices for "${message}".`);
+  }
+  const found = choices.findIndex((choice) => choice.value === defaultValue);
+  let index = found >= 0 ? found : 0;
+  return runRawPrompt(io, () => renderSelectLines(message, choices, index), (event) => {
+    if (event.type === "abort") {
+      return "abort";
+    }
+    if (event.type === "up") {
+      index = moveSelectIndex(index, -1, choices.length);
+      return "continue";
+    }
+    if (event.type === "down") {
+      index = moveSelectIndex(index, 1, choices.length);
+      return "continue";
+    }
+    if (event.type === "digit") {
+      if (event.value >= 1 && event.value <= choices.length) {
+        const choice = choices[event.value - 1];
+        if (choice) {
+          return { done: choice.value };
+        }
+      }
+      return "continue";
+    }
+    if (event.type === "submit") {
+      const choice = choices[index];
+      if (choice) {
+        return { done: choice.value };
+      }
+    }
+    return "continue";
+  }, (value) => `${message}  ${choices.find((choice) => choice.value === value)?.label ?? value}`);
+}
+async function promptConfirm(message, defaultValue, io) {
+  let yes = defaultValue;
+  return runRawPrompt(io, () => renderConfirmLines(message, yes), (event) => {
+    if (event.type === "abort") {
+      return "abort";
+    }
+    if (event.type === "up" || event.type === "right" || event.type === "yes") {
+      if (event.type === "yes") {
+        return { done: true };
+      }
+      yes = true;
+      return "continue";
+    }
+    if (event.type === "down" || event.type === "left" || event.type === "no") {
+      if (event.type === "no") {
+        return { done: false };
+      }
+      yes = false;
+      return "continue";
+    }
+    if (event.type === "digit") {
+      if (event.value === 1) {
+        return { done: true };
+      }
+      if (event.value === 2) {
+        return { done: false };
+      }
+    }
+    if (event.type === "submit") {
+      return { done: yes };
+    }
+    return "continue";
+  }, (value) => `${message}  ${value ? "yes" : "no"}`);
+}
+async function promptMultiSelect(message, choices, io) {
+  if (choices.length === 0) {
+    return [];
+  }
+  const selected = choices.map((choice) => choice.enabled);
+  let index = 0;
+  const enabledValues = () => choices.filter((_, choiceIndex) => selected[choiceIndex]).map((choice) => choice.value);
+  return runRawPrompt(io, () => renderMultiSelectLines(message, choices.map((choice, choiceIndex) => ({
+    ...choice,
+    enabled: Boolean(selected[choiceIndex])
+  })), index), (event) => {
+    if (event.type === "abort") {
+      return "abort";
+    }
+    if (event.type === "up") {
+      index = moveSelectIndex(index, -1, choices.length);
+      return "continue";
+    }
+    if (event.type === "down") {
+      index = moveSelectIndex(index, 1, choices.length);
+      return "continue";
+    }
+    if (event.type === "toggle") {
+      selected[index] = !selected[index];
+      return "continue";
+    }
+    if (event.type === "digit") {
+      if (event.value >= 1 && event.value <= choices.length) {
+        const target = event.value - 1;
+        selected[target] = !selected[target];
+        index = target;
+      }
+      return "continue";
+    }
+    if (event.type === "submit") {
+      return { done: enabledValues() };
+    }
+    return "continue";
+  }, (values) => {
+    const labels = choices.filter((choice) => values.includes(choice.value)).map((choice) => choice.value);
+    return `${message}  ${labels.length > 0 ? labels.join(", ") : "none"}`;
+  });
+}
+
+// ../strata-starter/src/prompt.ts
+var EXTRA_CHOICES = [
+  { value: "mfa", label: "mfa: authenticator challenge + setup pages" },
+  { value: "emailVerification", label: "email-verification: signed links + /email/verify" },
+  { value: "scim", label: "scim: /Users adapter" },
+  { value: "metrics", label: "metrics: Prometheus token" }
+];
+function isInteractive(flags) {
+  if (flags.yes || flags.noInteractive) {
+    return false;
+  }
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY || tty2.isatty(0) && tty2.isatty(1));
+}
+function createReadlinePrompter(io) {
+  const stdio = () => resolveSelectIo(io);
+  async function askLine(message) {
+    const current = stdio();
+    const rl = createInterface({ input: current.input, output: current.output });
+    try {
+      return (await rl.question(message)).trim();
+    } finally {
+      rl.close();
+    }
+  }
+  return {
+    async question(message, defaultValue) {
+      const suffix = defaultValue ? ` [${defaultValue}]` : "";
+      const answer = await askLine(`${message}${suffix}: `);
+      return answer || defaultValue || "";
+    },
+    async confirm(message, defaultValue = false) {
+      const current = stdio();
+      if (hasRawMode(current.input)) {
+        return promptConfirm(message, defaultValue, current);
+      }
+      const hint = defaultValue ? "Y/n" : "y/N";
+      const answer = (await askLine(`${message} (${hint}): `)).toLowerCase();
+      if (!answer) {
+        return defaultValue;
+      }
+      return answer === "y" || answer === "yes";
+    },
+    async select(message, choices, defaultValue) {
+      const current = stdio();
+      if (hasRawMode(current.input)) {
+        return promptSelect(message, choices, defaultValue, current);
+      }
+      current.output.write(`${message}
+`);
+      for (const [index, choice] of choices.entries()) {
+        const marker = choice.value === defaultValue ? "*" : " ";
+        current.output.write(`  ${index + 1}) ${marker} ${choice.label}
+`);
+      }
+      const defaultIndex = choices.findIndex((choice) => choice.value === defaultValue) + 1;
+      const answer = await askLine(`Choose [${defaultIndex}]: `);
+      if (!answer) {
+        return defaultValue;
+      }
+      const asNumber = Number.parseInt(answer, 10);
+      if (Number.isInteger(asNumber) && asNumber >= 1 && asNumber <= choices.length) {
+        const selected = choices[asNumber - 1];
+        return selected?.value ?? defaultValue;
+      }
+      const match = choices.find((choice) => choice.value === answer || choice.label === answer);
+      return match?.value ?? defaultValue;
+    },
+    async multiSelect(message, choices) {
+      const current = stdio();
+      if (hasRawMode(current.input)) {
+        return promptMultiSelect(message, choices, current);
+      }
+      const enabled = new Set(choices.filter((choice) => choice.enabled).map((choice) => choice.value));
+      current.output.write(`${message} (yes/no each)
+`);
+      for (const choice of choices) {
+        const hint = enabled.has(choice.value) ? "Y/n" : "y/N";
+        const answer = (await askLine(`  ${choice.label} (${hint}): `)).toLowerCase();
+        if (!answer) {
+          continue;
+        }
+        if (answer === "y" || answer === "yes") {
+          enabled.add(choice.value);
+        } else if (answer === "n" || answer === "no") {
+          enabled.delete(choice.value);
+        }
+      }
+      return [...enabled];
+    },
+    close() {
+      return;
+    }
+  };
+}
+function extrasStillToAsk(layers, flags) {
+  return EXTRA_CHOICES.filter((choice) => {
+    if (flags.extras[choice.value] !== undefined) {
+      return false;
+    }
+    return extraApplies(choice.value, layers.auth);
+  });
+}
+async function promptExtras(prompter, extras, layers, flags) {
+  const choices = extrasStillToAsk(layers, flags);
+  if (choices.length === 0) {
+    return extras;
+  }
+  const picked = new Set(await prompter.multiSelect("Extras", choices.map((choice) => ({
+    value: choice.value,
+    label: choice.label,
+    enabled: extras[choice.value]
+  }))));
+  const next = { ...extras };
+  for (const choice of choices) {
+    next[choice.value] = picked.has(choice.value);
+  }
+  for (const choice of EXTRA_CHOICES) {
+    if (!extraApplies(choice.value, layers.auth) && flags.extras[choice.value] === undefined) {
+      next[choice.value] = false;
+    }
+  }
+  return next;
+}
+async function promptLayers(flags, prompter) {
+  const layers = applyFlagOverrides(defaultLayers(), flags);
+  layers.frontend = await prompter.select("Frontend", [
+    { value: "api", label: "api: JSON only" },
+    { value: "server-htmx", label: "server-htmx: Eta HTML + HTMX" },
+    { value: "spa-react", label: "spa-react: JSON + React under SPA_PREFIX" },
+    { value: "hybrid", label: "hybrid: HTML at / plus SPA prefix" }
+  ], layers.frontend);
+  layers.database = await prompter.select("Database (one engine)", [
+    { value: "sqlite", label: "sqlite: file database" },
+    { value: "postgres", label: "postgres" },
+    { value: "mysql", label: "mysql" }
+  ], layers.database);
+  layers.auth = await prompter.select("Auth", [
+    { value: "headers", label: "headers: x-authenticated-user-id (local/tests)" },
+    { value: "cookie", label: "cookie: sessions table + CSRF" },
+    { value: "token", label: "token: opaque hashed Bearer" },
+    { value: "jwt", label: "jwt: short-lived HS256" },
+    { value: "cookie-token", label: "cookie-token: HTML cookies + API tokens" },
+    { value: "cookie-token-jwt", label: "cookie-token-jwt: cookies, tokens, and JWT" }
+  ], layers.auth);
+  layers.tenancy = await prompter.select("Tenancy", layers.database === "postgres" ? [
+    { value: "none", label: "none: no tenant table" },
+    {
+      value: "column",
+      label: "column: tenant table + users.tenant_id (no Postgres SET LOCAL)"
+    },
+    { value: "rls", label: "rls: Postgres row-level security plus a tenant table" }
+  ] : [
+    { value: "none", label: "none: no tenant table" },
+    {
+      value: "column",
+      label: "column: tenant table + users.tenant_id (SQLite/MySQL cannot run Postgres RLS)"
+    }
+  ], layers.database === "postgres" ? layers.tenancy : layers.tenancy === "rls" ? "column" : layers.tenancy);
+  layers.cache = await prompter.select("Cache", [
+    { value: "array", label: "array: in-process" },
+    { value: "redis", label: "redis" }
+  ], layers.cache);
+  layers.queue = await prompter.select("Queue", [
+    { value: "sync", label: "sync: run jobs inline" },
+    { value: "redis", label: "redis: background worker" }
+  ], layers.queue);
+  layers.mail = await prompter.select("Mail", [
+    { value: "log", label: "log: print messages" },
+    { value: "smtp", label: "smtp" }
+  ], layers.mail);
+  if (flags.spaPrefix === undefined && (layers.frontend === "spa-react" || layers.frontend === "hybrid")) {
+    layers.spaPrefix = await prompter.question("SPA prefix", layers.spaPrefix);
+  }
+  layers.extras = await promptExtras(prompter, layers.extras, layers, flags);
+  if (!dockerFlagsProvided(flags)) {
+    layers.docker = await promptDockerLayer(prompter, layers);
+  }
+  return applyFlagOverrides(layers, flags);
+}
+async function promptDockerLayer(prompter, layers) {
+  const needed = neededDockerServices(layers);
+  if (needed.length === 0) {
+    return dockerLayerForNeeded(layers, false);
+  }
+  const labels = needed.map((name) => DOCKER_SERVICE_LABELS[name]).join(", ");
+  const mode = await prompter.select(`How should supporting tools run (${labels})?`, [
+    { value: "local", label: "local: installs already on this machine" },
+    { value: "docker", label: "docker: Compose for all of them" },
+    { value: "mix", label: "mix: pick Docker Compose vs local per tool" }
+  ], "docker");
+  if (mode === "local") {
+    return dockerLayerForNeeded(layers, false);
+  }
+  if (mode === "docker") {
+    return dockerLayerForNeeded(layers, true);
+  }
+  const services = emptyDockerServices();
+  for (const name of needed) {
+    services[name] = await prompter.confirm(`Docker Compose for ${DOCKER_SERVICE_LABELS[name]}?`, true);
+  }
+  const databaseService = dockerDatabaseService(layers.database);
+  if (databaseService && services[databaseService]) {
+    services.adminer = await prompter.confirm(`Docker Compose for ${DOCKER_SERVICE_LABELS.adminer}?`, true);
+  }
+  const selected = needed.filter((name) => services[name]);
+  if (services.adminer) {
+    selected.push("adminer");
+  }
+  return {
+    enabled: selected.length > 0,
+    services
+  };
+}
+async function resolveStarterPlan(flags, injected) {
+  if (!isInteractive(flags)) {
+    return {
+      projectName: flags.projectName ?? "strata-app",
+      layers: layersFromFlags(flags)
+    };
+  }
+  const prompter = injected ?? createReadlinePrompter();
+  try {
+    const projectName = flags.projectName || await prompter.question("Project name", "strata-app") || "strata-app";
+    const layers = await promptLayers({ ...flags, projectName }, prompter);
+    return { projectName, layers };
+  } finally {
+    if (!injected) {
+      prompter.close();
+    }
+  }
+}
+
+// ../strata-starter/src/renderAuthFlows.ts
+function ph(layers, count, start = 1) {
+  if (layers.database === "postgres") {
+    return Array.from({ length: count }, (_, index) => `$${start + index}`).join(", ");
+  }
+  return Array.from({ length: count }, () => "?").join(", ");
+}
+function sqlFalse(layers) {
+  return layers.database === "postgres" ? "false" : "0";
+}
+function sqlTrue(layers) {
+  return layers.database === "postgres" ? "true" : "1";
+}
+function renderPendingMfaTs() {
+  return `import { createHmac, timingSafeEqual } from "node:crypto";
+import { sessionSecret } from "./config.ts";
+
+const COOKIE = "strata_mfa_pending";
+
+function sign(userId: number, issuedAt: number): string {
+  const payload = \`\${userId}.\${issuedAt}\`;
+  const signature = createHmac("sha256", sessionSecret()).update(payload).digest("hex");
+  return \`\${payload}.\${signature}\`;
+}
+
+export function pendingMfaSetCookie(userId: number): string {
+  const issuedAt = Date.now();
+  return \`\${COOKIE}=\${sign(userId, issuedAt)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600\`;
+}
+
+export function pendingMfaClearCookie(): string {
+  return \`\${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\`;
+}
+
+export function readPendingMfaUserId(request: Request): number | null {
+  const header = request.headers.get("cookie") ?? "";
+  for (const part of header.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name !== COOKIE) {
+      continue;
+    }
+    const value = rest.join("=");
+    const pieces = value.split(".");
+    if (pieces.length !== 3) {
+      return null;
+    }
+    const userId = Number.parseInt(pieces[0] ?? "", 10);
+    const issuedAt = Number.parseInt(pieces[1] ?? "", 10);
+    const signature = pieces[2] ?? "";
+    if (!Number.isInteger(userId) || userId <= 0 || Date.now() - issuedAt > 10 * 60 * 1000) {
+      return null;
+    }
+    const expected = sign(userId, issuedAt).split(".").pop() ?? "";
+    const left = Buffer.from(signature);
+    const right = Buffer.from(expected);
+    if (left.length !== right.length || !timingSafeEqual(left, right)) {
+      return null;
+    }
+    return userId;
+  }
+  return null;
+}
+`;
+}
+function renderAuthModule(layers) {
+  if (!authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const cookie = htmlAuthKit(layers.auth);
+  const mfa = Boolean(layers.extras.mfa && cookie);
+  const verify = Boolean(layers.extras.emailVerification);
+  const jsonApi = authUsesToken(layers.auth) || authUsesJwt(layers.auth);
+  const tenantInsert = usesTenantTable(layers.tenancy);
+  const insertCols = tenantInsert ? "name, email, password, is_admin, tenant_id" : "name, email, password, is_admin";
+  const insertPh = tenantInsert ? ph(layers, 5) : ph(layers, 4);
+  const insertTail = tenantInsert ? `, ${sqlFalse(layers)}, 1` : `, ${sqlFalse(layers)}`;
+  const passwordPh = `${ph(layers, 1)}`;
+  const emailPh = `${ph(layers, 1, 2)}`;
+  const idPh = `${ph(layers, 1, 2)}`;
+  const verifiedPh = `${ph(layers, 1)}`;
+  const mfaUpdatePh = `${ph(layers, 1)}, ${ph(layers, 1, 2)}, ${ph(layers, 1, 3)}`;
+  const mfaIdPh = `${ph(layers, 1, 4)}`;
+  const imports = [];
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { randomBytes } from "node:crypto";`);
+  }
+  imports.push(`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`);
+  imports.push(`import type { AppModule } from "@getstrata/bootstrap/contracts";`);
+  if (cookie) {
+    imports.push(`import { parseFormBody } from "@getstrata/bootstrap/web/forms";`);
+    imports.push(`import { wrapWebLogin, wrapWebRegister } from "@getstrata/bootstrap/web/routing";`);
+    imports.push(`import type { CookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+  }
+  if (jsonApi) {
+    imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
+  }
+  if (authUsesJwt(layers.auth)) {
+    imports.push(`import { jwtTtlSeconds, signJwt } from "@getstrata/core/auth/jwt";`);
+  }
+  imports.push(`import { hashPassword, verifyPassword } from "@getstrata/core/auth/password";`);
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { hashApiToken } from "@getstrata/core/auth/tokenHash";`);
+    imports.push(`import { sqlTimestamp } from "@getstrata/core/database/dialect";`);
+    imports.push(`import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";`);
+  }
+  if (mfa) {
+    imports.push(`import { protectMfaSecret, revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";`);
+  }
+  if (cookie) {
+    imports.push(`import { flashResponse } from "@getstrata/core/http/flashSession";`);
+  }
+  if (jsonApi) {
+    imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
+  }
+  imports.push(`import { absoluteTemporarySignedUrl, assertValidSignature } from "@getstrata/core/http/signedUrl";`);
+  imports.push(`import { mailer } from "@getstrata/core/mail/mailer";`);
+  if (mfa) {
+    imports.push(`import { generateRecoveryCodes, hashRecoveryCode, recoveryCodeMatches } from "@getstrata/core/security/recoveryCodes";`);
+    imports.push(`import { buildOtpauthUrl, generateTotpSecret, verifyTotp } from "@getstrata/core/security/totp";`);
+  }
+  imports.push(`import { starterAuthDirectory } from "../../bootstrap/authDirectory.ts";`);
+  imports.push(`import { getSql } from "../../bootstrap/database.ts";`);
+  if (cookie) {
+    imports.push(`import { renderPage } from "../../lib/view.ts";`);
+  }
+  if (mfa) {
+    imports.push(`import { pendingMfaClearCookie, pendingMfaSetCookie, readPendingMfaUserId } from "../../bootstrap/pendingMfa.ts";`);
+  }
+  const helpers = `
+async function sendSignedMail(to: string, subject: string, path: string, query: Record<string, string>) {
+  const link = absoluteTemporarySignedUrl(path, 3600, query);
+  await mailer().send({
+    to,
+    subject,
+    body: \`\${subject}\\n\\n\${link}\\n\`,
+  });
+}
+${cookie ? `
+function redirectTo(path: string, status = 302): Response {
+  return new Response(null, { status, headers: { location: path } });
+}
+
+function sessionUser(user: { id: number; name?: string | null; email?: string | null; role: string }) {
+  return {
+    id: user.id,
+    name: user.name ?? user.email ?? "",
+    email: user.email ?? "",
+    is_admin: user.role === "admin",
+  };
+}
+` : ""}`;
+  const tokenLogin = authUsesToken(layers.auth) ? `
+        "/api/v1/auth/login": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { email?: string; password?: string };
+            const email = (body.email ?? "").trim().toLowerCase();
+            const password = body.password ?? "";
+            const user = await starterAuthDirectory.verifyCredentials?.(email, password);
+            if (!user) {
+              return jsonResponse({ error: "Invalid credentials" }, { status: 422 });
+            }
+            const plain = \`strp_\${randomBytes(24).toString("hex")}\`;
+            // API_TOKEN_DEFAULT_EXPIRY_DAYS bounds every minted token; unset means no expiry.
+            const expiryDays = resolveDefaultTokenExpiryDays();
+            const expiresAt = expiryDays
+              ? new Date(Date.now() + expiryDays * 24 * 60 * 60 * 1000)
+              : null;
+            await getSql().unsafe(
+              "INSERT INTO api_tokens (user_id, name, token_hash, abilities, expires_at) VALUES (${ph(layers, 5)})",
+              [
+                user.id,
+                "spa",
+                hashApiToken(plain),
+                JSON.stringify(["profile:read"]),
+                expiresAt ? sqlTimestamp(expiresAt) : null,
+              ],
+            );
+            return jsonResponse({ token: plain, expires_at: expiresAt?.toISOString() ?? null });
+          })),
+        },
+        "/api/v1/auth/me": {
+          GET: kernel.wrapApi(async (request) => {
+            const user = await dependencies.container.resolve<AuthManager>(CORE_AUTH_TOKEN).requireUser(request);
+            const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
+            return jsonResponse({
+              id: record.id,
+              name: record.name ?? record.email,
+              email: record.email,
+              role: record.role,
+            });
+          }),
+        },` : "";
+  const jsonRegister = jsonApi ? `
+        "/api/v1/auth/register": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { name?: string; email?: string; password?: string };
+            const name = (body.name ?? "").trim();
+            const email = (body.email ?? "").trim().toLowerCase();
+            const password = body.password ?? "";
+            if (!name || !email || password.length < 8) {
+              return jsonResponse({ error: "Name, email, and a password of 8+ characters are required." }, { status: 422 });
+            }
+            if (await starterAuthDirectory.findByEmail?.(email)) {
+              return jsonResponse({ error: "Email is already registered." }, { status: 422 });
+            }
+            const hashed = await hashPassword(password);
+            await getSql().unsafe(
+              "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+              [name, email, hashed${insertTail}],
+            );
+            const created = await starterAuthDirectory.findByEmail?.(email);
+            ${verify ? `if (created) {
+              await sendSignedMail(email, "Verify your email", "/api/v1/auth/verify-email", { id: String(created.id) });
+            }` : ""}
+            return jsonResponse({ ok: true }, { status: 201 });
+          })),
+        },` : "";
+  const jwtLogin = authUsesJwt(layers.auth) ? `
+        "/api/auth/token": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { email?: string; password?: string };
+            const email = (body.email ?? "").trim().toLowerCase();
+            const password = body.password ?? "";
+            const user = await starterAuthDirectory.verifyCredentials?.(email, password);
+            if (!user) {
+              return jsonResponse({ error: "Invalid credentials" }, { status: 422 });
+            }
+            const token = signJwt({
+              sub: user.id,
+              role: user.role,
+              abilities: user.role === "admin" ? ["profile:read", "reports:export"] : ["profile:read"],${verify ? `
+              emailVerifiedAt: user.emailVerifiedAt ?? null,` : ""}
+            });
+            return jsonResponse({
+              token,
+              token_type: "bearer",
+              expires_in: jwtTtlSeconds(),
+            });
+          })),
+        },` : "";
+  const apiUser = jsonApi ? `
+        "/api/user": {
+          GET: kernel.wrapApi(async (request) => {
+            const user = await dependencies.container.resolve<AuthManager>(CORE_AUTH_TOKEN).requireUser(request);
+            return jsonResponse({ id: user.id, role: user.role ?? "member" });
+          }),
+        },` : "";
+  const jsonPassword = jsonApi ? `
+        "/api/v1/auth/forgot-password": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            const body = (await request.json()) as { email?: string };
+            const email = (body.email ?? "").trim().toLowerCase();
+            const user = await starterAuthDirectory.findByEmail?.(email);
+            if (user) {
+              await sendSignedMail(email, "Reset your password", "/api/v1/auth/reset-password", { email });
+            }
+            return jsonResponse({ ok: true });
+          })),
+        },
+        "/api/v1/auth/reset-password": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            assertValidSignature(request);
+            const body = (await request.json()) as { password?: string };
+            const email = new URL(request.url).searchParams.get("email") ?? "";
+            if (!email || !(body.password && body.password.length >= 8)) {
+              return jsonResponse({ error: "Invalid reset payload." }, { status: 422 });
+            }
+            await getSql().unsafe(
+              "UPDATE users SET password = ${passwordPh} WHERE email = ${emailPh}",
+              [await hashPassword(body.password), email],
+            );
+            return jsonResponse({ ok: true });
+          })),
+        },` : "";
+  const jsonVerify = jsonApi && verify ? `
+        "/api/v1/auth/verify-email": {
+          POST: kernel.wrap("api", withErrorHandling(async (request) => {
+            assertValidSignature(request);
+            const id = Number.parseInt(new URL(request.url).searchParams.get("id") ?? "", 10);
+            if (!Number.isInteger(id) || id <= 0) {
+              return jsonResponse({ error: "Invalid verification link." }, { status: 422 });
+            }
+            await getSql().unsafe(
+              "UPDATE users SET email_verified_at = ${verifiedPh} WHERE id = ${idPh}",
+              [${nowTimestampLiteral(layers.database)}, id],
+            );
+            return jsonResponse({ ok: true });
+          })),
+        },` : "";
+  const apiRoutes = jsonApi ? `
+    routes({ kernel, dependencies }) {
+      return {${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
+      };
+    },` : "";
+  const mfaLoginBranch = mfa ? `if (user.mfa_enabled) {
+                const pending = redirectTo("/login/mfa");
+                pending.headers.append("set-cookie", pendingMfaSetCookie(user.id));
+                return pending;
+              }` : "";
+  const verifyRegisterBranch = verify ? `await sendSignedMail(email, "Verify your email", "/email/verify", { id: String(insertedId) });
+              return flashResponse(
+                await auth.signInRedirect(sessionUser({ id: insertedId, name, email, role: "member" }), "/email/verify"),
+                { level: "info", message: "Check your email for a verification link." },
+              );` : `return auth.signInRedirect(sessionUser({ id: insertedId, name, email, role: "member" }), "/");`;
+  const cookieRoutes = cookie ? `
+    webRoutes({ kernel, dependencies }) {
+      const auth = dependencies.container.resolve<CookieSessionAuthManager>(CORE_AUTH_TOKEN);
+      return {
+        "/login": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/login.eta", { layout: { title: "Sign in" }, errors: {}, email: "", password: "" }, request),
+          ),
+          POST: wrapWebLogin(
+            kernel,
+            async (request) => {
+              const { fields } = await parseFormBody(request);
+              const email = (fields.email ?? "").trim().toLowerCase();
+              const password = fields.password ?? "";
+              const user = await starterAuthDirectory.findByEmail?.(email);
+              if (!user?.password || !(await verifyPassword(password, user.password))) {
+                return renderPage(
+                  "auth/login.eta",
+                  { layout: { title: "Sign in" }, errors: { email: "These credentials do not match our records." }, email, password: "" },
+                  request,
+                );
+              }
+              ${mfaLoginBranch}
+              return auth.signInRedirect(sessionUser(user), "/");
+            },
+            async (request) =>
+              renderPage(
+                "auth/login.eta",
+                { layout: { title: "Sign in" }, errors: { email: "Too many login attempts. Try again shortly." }, email: "", password: "" },
+                request,
+                429,
+              ),
+          ),
+        },
+        "/register": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/register.eta", { layout: { title: "Create account" }, errors: {}, name: "", email: "", password: "" }, request),
+          ),
+          POST: wrapWebRegister(
+            kernel,
+            async (request) => {
+              const { fields } = await parseFormBody(request);
+              const name = (fields.name ?? "").trim();
+              const email = (fields.email ?? "").trim().toLowerCase();
+              const password = fields.password ?? "";
+              const errors: Record<string, string> = {};
+              if (!name) {
+                errors.name = "Name is required.";
+              }
+              if (!email) {
+                errors.email = "Email is required.";
+              }
+              if (password.length < 8) {
+                errors.password = "Use at least 8 characters.";
+              }
+              if (email && (await starterAuthDirectory.findByEmail?.(email))) {
+                errors.email = "Email is already registered.";
+              }
+              if (Object.keys(errors).length > 0) {
+                return renderPage(
+                  "auth/register.eta",
+                  { layout: { title: "Create account" }, errors, name, email, password: "" },
+                  request,
+                );
+              }
+              const hashed = await hashPassword(password);
+              await getSql().unsafe(
+                "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+                [name, email, hashed${insertTail}],
+              );
+              const created = await starterAuthDirectory.findByEmail?.(email);
+              const insertedId = created?.id ?? 0;
+              ${verifyRegisterBranch}
+            },
+            async (request) =>
+              renderPage(
+                "auth/register.eta",
+                { layout: { title: "Create account" }, errors: { form: "Too many registration attempts. Try again shortly." }, name: "", email: "", password: "" },
+                request,
+                429,
+              ),
+          ),
+        },
+        "/forgot-password": {
+          GET: kernel.wrapWebGuest(async (request) =>
+            renderPage("auth/forgot-password.eta", { layout: { title: "Forgot password" }, errors: {}, email: "" }, request),
+          ),
+          POST: kernel.wrapWeb(async (request) => {
+            const { fields } = await parseFormBody(request);
+            const email = (fields.email ?? "").trim().toLowerCase();
+            const user = await starterAuthDirectory.findByEmail?.(email);
+            if (user) {
+              await sendSignedMail(email, "Reset your password", "/reset-password", { email });
+            }
+            return flashResponse(redirectTo("/forgot-password"), {
+              level: "success",
+              message: "If that account exists, a reset link is on its way.",
+            });
+          }),
+        },
+        "/reset-password": {
+          GET: kernel.wrapWebGuest(async (request) => {
+            assertValidSignature(request);
+            const email = new URL(request.url).searchParams.get("email") ?? "";
+            return renderPage(
+              "auth/reset-password.eta",
+              { layout: { title: "Reset password" }, errors: {}, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
+              request,
+            );
+          }),
+          POST: kernel.wrapWeb(async (request) => {
+            assertValidSignature(request);
+            const { fields } = await parseFormBody(request);
+            const email = new URL(request.url).searchParams.get("email") ?? fields.email ?? "";
+            const password = fields.password ?? "";
+            if (!email || password.length < 8) {
+              return renderPage(
+                "auth/reset-password.eta",
+                { layout: { title: "Reset password" }, errors: { password: "Use at least 8 characters." }, password: "", email, action: \`\${new URL(request.url).pathname}\${new URL(request.url).search}\` },
+                request,
+              );
+            }
+            await getSql().unsafe(
+              "UPDATE users SET password = ${passwordPh} WHERE email = ${emailPh}",
+              [await hashPassword(password), email],
+            );
+            return flashResponse(redirectTo("/login"), { level: "success", message: "Password updated. Sign in." });
+          }),
+        },
+        "/logout": {
+          POST: kernel.wrapWebAuthenticatedAllowUnverified((request) => auth.signOutRedirect(request, "/")),
+        },${verify ? `
+        "/email/verify": {
+          GET: kernel.wrapWeb(async (request) => {
+            const url = new URL(request.url);
+            if (url.searchParams.get("signature")) {
+              assertValidSignature(request);
+              const id = Number.parseInt(url.searchParams.get("id") ?? "", 10);
+              if (Number.isInteger(id) && id > 0) {
+                await getSql().unsafe(
+                  "UPDATE users SET email_verified_at = ${verifiedPh} WHERE id = ${idPh}",
+                  [${nowTimestampLiteral(layers.database)}, id],
+                );
+                const record = await starterAuthDirectory.findByIdOrThrow(id);
+                return flashResponse(
+                  await auth.signInRedirect(sessionUser(record), "/"),
+                  { level: "success", message: "Email verified." },
+                );
+              }
+            }
+            return renderPage("auth/verify-email.eta", { layout: { title: "Verify email" } }, request);
+          }),
+        },
+        "/email/verification-notification": {
+          POST: kernel.wrapWebAuthenticatedAllowUnverified(async (request) => {
+            const user = await auth.user(request);
+            if (user) {
+              const record = await starterAuthDirectory.findByIdOrThrow(Number(user.id));
+              await sendSignedMail(record.email ?? "", "Verify your email", "/email/verify", { id: String(record.id) });
+            }
+            return flashResponse(redirectTo("/email/verify"), { level: "info", message: "Verification link sent." });
+          }),
+        },` : ""}${mfa ? `
+        "/login/mfa": {
+          GET: kernel.wrapWebGuest(async (request) => {
+            if (!readPendingMfaUserId(request)) {
+              return redirectTo("/login");
+            }
+            return renderPage("auth/mfa-challenge.eta", { layout: { title: "MFA" }, errors: {}, code: "" }, request);
+          }),
+          POST: kernel.wrapWeb(async (request) => {
+            const pendingId = readPendingMfaUserId(request);
+            if (!pendingId) {
+              return redirectTo("/login");
+            }
+            const { fields } = await parseFormBody(request);
+            const submitted = (fields.code ?? "").trim();
+            const record = await starterAuthDirectory.findByIdOrThrow(pendingId);
+            const secret = revealMfaSecret(record.mfa_secret ?? null);
+            const hashedCodes: string[] = record.mfa_recovery_codes
+              ? (JSON.parse(record.mfa_recovery_codes) as string[])
+              : [];
+            const totpOk = secret ? verifyTotp(secret, submitted) : false;
+            const recoveryOk = hashedCodes.some((hash) => recoveryCodeMatches(submitted, hash));
+            if (!totpOk && !recoveryOk) {
+              return renderPage(
+                "auth/mfa-challenge.eta",
+                { layout: { title: "MFA" }, errors: { code: "That code is not valid." }, code: "" },
+                request,
+              );
+            }
+            if (recoveryOk) {
+              const remaining = hashedCodes.filter((hash) => !recoveryCodeMatches(submitted, hash));
+              await getSql().unsafe(
+                "UPDATE users SET mfa_recovery_codes = ${passwordPh} WHERE id = ${idPh}",
+                [JSON.stringify(remaining), pendingId],
+              );
+            }
+            const signed = await auth.signInRedirect(sessionUser(record), "/");
+            signed.headers.append("set-cookie", pendingMfaClearCookie());
+            return signed;
+          }),
+        },
+        "/account/mfa": {
+          GET: kernel.wrapWebAuthenticated(async (request) => {
+            const secret = generateTotpSecret();
+            const user = await auth.user(request);
+            const record = user ? await starterAuthDirectory.findByIdOrThrow(Number(user.id)) : null;
+            const otpauth = buildOtpauthUrl({
+              secret,
+              account: record?.email ?? "user",
+              issuer: process.env.APP_NAME ?? "Strata",
+            });
+            return renderPage(
+              "auth/mfa-setup.eta",
+              { layout: { title: "MFA" }, errors: {}, code: "", secret, otpauth },
+              request,
+            );
+          }),
+          POST: kernel.wrapWebAuthenticated(async (request) => {
+            const user = await auth.user(request);
+            if (!user) {
+              return redirectTo("/login");
+            }
+            const { fields } = await parseFormBody(request);
+            const secret = (fields.secret ?? "").trim();
+            const submitted = (fields.code ?? "").trim();
+            if (!secret || !verifyTotp(secret, submitted)) {
+              return renderPage(
+                "auth/mfa-setup.eta",
+                {
+                  layout: { title: "MFA" },
+                  errors: { code: "Could not confirm that code." },
+                  code: "",
+                  secret,
+                  otpauth: buildOtpauthUrl({ secret, account: "user", issuer: process.env.APP_NAME ?? "Strata" }),
+                },
+                request,
+              );
+            }
+            const recoveryCodes = generateRecoveryCodes();
+            const stored = protectMfaSecret(secret);
+            await getSql().unsafe(
+              "UPDATE users SET mfa_secret = ${mfaUpdatePh.split(", ")[0]}, mfa_enabled = ${mfaUpdatePh.split(", ")[1]}, mfa_recovery_codes = ${mfaUpdatePh.split(", ")[2]} WHERE id = ${mfaIdPh}",
+              [stored, ${sqlTrue(layers)}, JSON.stringify(recoveryCodes.map((item) => hashRecoveryCode(item))), Number(user.id)],
+            );
+            return renderPage(
+              "auth/mfa-setup.eta",
+              {
+                layout: { title: "MFA" },
+                errors: {},
+                code: "",
+                secret,
+                otpauth: buildOtpauthUrl({ secret, account: "user", issuer: process.env.APP_NAME ?? "Strata" }),
+                recoveryCodes,
+              },
+              request,
+            );
+          }),
+        },` : ""}
+      };
+    },` : "";
+  return `${imports.join(`
+`)}
+${helpers}
+const authModule: AppModule = {
+  name: "auth",
+  order: 2,${apiRoutes}${cookieRoutes}
+};
+
+export default authModule;
+`;
+}
+function renderSiteModule(_layers) {
+  return `import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { withErrorHandling } from "@getstrata/core/http/response";
+import { getSql, pingDatabase } from "../../bootstrap/database.ts";
+import { plainText, renderPage } from "../../lib/view.ts";
+
+// Proves the database answers and the schema is migrated. Point it at a table your app owns.
+async function schemaReady(): Promise<boolean> {
+  try {
+    await getSql().unsafe("SELECT 1 FROM notes LIMIT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const siteModule: AppModule = {
+  name: "site",
+  order: 1,
+  routes({ kernel }) {
+    return {
+      "/health": kernel.wrap("api", withErrorHandling(async () => {
+        const ok = (await pingDatabase()) && (await schemaReady());
+        return plainText(ok ? "ok" : "degraded", ok ? 200 : 503);
+      })),
+    };
+  },
+  webRoutes({ kernel }) {
+    return {
+      "/": kernel.wrapWeb(async (request) =>
+        renderPage(
+          "home.eta",
+          {
+            layout: {
+              title: "Welcome",
+              description: "Welcome to your Strata app. Restyle views/home.eta and public/assets/site.css.",
+            },
+          },
+          request,
+        ),
+      ),
+    };
+  },
+};
+
+export default siteModule;
+`;
+}
+// ../strata-starter/src/renderAuthViews.ts
+function renderSiteCss() {
+  return `:root {
+  color-scheme: light;
+  --bg: #f4f1ea;
+  --ink: #1c1917;
+  --muted: #57534e;
+  --card: #fffdf8;
+  --line: #e7e0d4;
+  --accent: #1d4e4f;
+  --accent-ink: #f8faf8;
+  --danger: #9f1239;
+  --ok: #166534;
+  font-family: "Iowan Old Style", "Palatino Linotype", Palatino, serif;
+  line-height: 1.5;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  min-height: 100vh;
+  background: var(--bg);
+  color: var(--ink);
+}
+
+.site-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  padding: 1rem 1.5rem;
+  border-bottom: 1px solid var(--line);
+  background: var(--card);
+}
+
+.brand {
+  font-weight: 700;
+  text-decoration: none;
+  color: inherit;
+  letter-spacing: 0.02em;
+}
+
+.site-header nav {
+  display: flex;
+  gap: 0.75rem;
+  align-items: center;
+  font-size: 0.95rem;
+}
+
+.site-header a { color: inherit; }
+
+.site-header form { display: inline; }
+
+main {
+  padding: 2rem 1.5rem 3rem;
+}
+
+.section, .auth-card {
+  max-width: 36rem;
+  margin: 0 auto;
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: 1rem;
+  padding: 1.5rem 1.5rem 1.75rem;
+}
+
+.hero {
+  max-width: 40rem;
+}
+
+.section h1, .auth-card h1, .hero h1 {
+  margin: 0 0 0.5rem;
+  font-size: 1.8rem;
+}
+
+.lede, .muted { color: var(--muted); }
+
+.actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem;
+  margin-top: 1.25rem;
+}
+
+label {
+  display: block;
+  margin: 0.85rem 0;
+  font-size: 0.95rem;
+}
+
+input[type="email"],
+input[type="password"],
+input[type="text"] {
+  display: block;
+  width: 100%;
+  margin-top: 0.35rem;
+  padding: 0.55rem 0.7rem;
+  border: 1px solid var(--line);
+  border-radius: 0.5rem;
+  background: #fff;
+  font: inherit;
+}
+
+button, .button {
+  display: inline-block;
+  border: 0;
+  border-radius: 999px;
+  padding: 0.55rem 1rem;
+  background: var(--accent);
+  color: var(--accent-ink);
+  font: inherit;
+  text-decoration: none;
+  cursor: pointer;
+}
+
+.button-secondary {
+  background: transparent;
+  color: var(--ink);
+  border: 1px solid var(--line);
+}
+
+.error { color: var(--danger); }
+.ok, .flash-success { color: var(--ok); }
+.flash-error { color: var(--danger); }
+.flash {
+  margin: 0 0 1rem;
+  padding: 0.6rem 0.8rem;
+  border-radius: 0.5rem;
+  border: 1px solid var(--line);
+}
+
+.auth-links {
+  margin-top: 1rem;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem 1rem;
+}
+
+code { font-size: 0.9em; }
+`;
+}
+function renderLayout(layers, projectName) {
+  const kit = htmlAuthKit(layers.auth);
+  const guestNav = kit ? `<a href="/login">Sign in</a>
+        <a href="/register">Create account</a>` : "";
+  const userNav = kit ? `<% if (it.currentUser) { %>
+        <span class="muted"><%= it.currentUser.email %></span>
+        ${layers.extras.mfa ? '<a href="/account/mfa">MFA</a>' : ""}
+        <form method="post" action="/logout">
+          <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+          <button class="button-secondary" type="submit">Sign out</button>
+        </form>
+      <% } else { %>
+        ${guestNav}
+      <% } %>` : "";
+  return `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title><%= it.layout.title %> \xB7 ${projectName}</title>
+    <% if (it.layout.description) { %>
+    <meta name="description" content="<%= it.layout.description %>" />
+    <% } %>
+    <link rel="stylesheet" href="/assets/site.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">${projectName}</a>
+      <nav>
+        ${userNav}
+      </nav>
+    </header>
+    <main>
+      <% if (it.flash && it.flash.message) { %>
+      <p class="flash flash-<%= it.flash.level %>"><%= it.flash.message %></p>
+      <% } %>
+      <%~ it.body %>
+    </main>
+  </body>
+</html>
+`;
+}
+function renderHomeView(projectName, layers) {
+  const kit = htmlAuthKit(layers.auth);
+  const tokenHint = authUsesToken(layers.auth) ? '<p class="muted">API token: <code>POST /api/v1/auth/login</code> with email and password.</p>' : "";
+  const jwtHint = authUsesJwt(layers.auth) ? '<p class="muted">JWT: <code>POST /api/auth/token</code> with email and password.</p>' : "";
+  const guest = kit ? `<% if (!it.currentUser) { %>
+  <p class="lede">Sign in or create an account. Edit <code>views/home.eta</code> and <code>public/assets/site.css</code> to restyle this page.</p>
+  <div class="actions">
+    <a class="button" href="/register">Create account</a>
+    <a class="button button-secondary" href="/login">Sign in</a>
+  </div>
+  <p class="muted">Seeded demo: <code>demo@example.com</code> / <code>password</code>.</p>
+<% } else { %>
+  <p class="lede">You are signed in as <strong><%= it.currentUser.email %></strong>.</p>
+  <p>Add routes in <code>src/modules</code>. This homepage is yours to restyle.</p>
+<% } %>` : `<p class="lede">Edit <code>views/home.eta</code> and <code>public/assets/site.css</code> to restyle this page.</p>
+  <p class="muted">Auth stack: <code>${layers.auth}</code>.</p>`;
+  const extras = [tokenHint, jwtHint].filter(Boolean).join(`
+  `);
+  return `<section class="section hero">
+  <h1>Welcome to ${projectName}</h1>
+  ${guest}
+  <p>Health check: <a href="/health"><code>/health</code></a>.</p>${extras ? `
+  ${extras}` : ""}
+</section>
+`;
+}
+function renderFormView(title, fields, submit, links) {
+  return `<section class="auth-card">
+  <h1>${title}</h1>
+  <% if (it.status) { %>
+  <p class="ok"><%= it.status %></p>
+  <% } %>
+  <% if (it.errors && it.errors.form) { %>
+  <p class="error"><%= it.errors.form %></p>
+  <% } %>
+  <form method="post" action="<%= it.action || "" %>">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    ${fields}
+    <div class="actions">
+      <button type="submit">${submit}</button>
+    </div>
+  </form>
+  <div class="auth-links">
+    ${links}
+  </div>
+</section>
+`;
+}
+function textField(name, label, type, extra = "") {
+  return `<label>
+      ${label}
+      <% if (it.errors && it.errors.${name}) { %><span class="error"><%= it.errors.${name} %></span><% } %>
+      <input type="${type}" name="${name}" value="<%= it.${name} || "" %>" ${extra} />
+    </label>`;
+}
+function renderLoginView() {
+  return renderFormView("Sign in", `${textField("email", "Email", "email", 'required autocomplete="username"')}
+    ${textField("password", "Password", "password", 'required autocomplete="current-password"')}`, "Sign in", `<a href="/register">Create account</a>
+    <a href="/forgot-password">Forgot password</a>`).replace('action="<%= it.action || "" %>"', 'action="/login"');
+}
+function renderRegisterView() {
+  return renderFormView("Create account", `${textField("name", "Name", "text", "required")}
+    ${textField("email", "Email", "email", 'required autocomplete="email"')}
+    ${textField("password", "Password", "password", 'required minlength="8" autocomplete="new-password"')}`, "Create account", `<a href="/login">Already have an account</a>`).replace('action="<%= it.action || "" %>"', 'action="/register"');
+}
+function renderForgotPasswordView() {
+  return renderFormView("Forgot password", textField("email", "Email", "email", "required"), "Send reset link", `<a href="/login">Back to sign in</a>`).replace('action="<%= it.action || "" %>"', 'action="/forgot-password"');
+}
+function renderResetPasswordView() {
+  return renderFormView("Set a new password", `${textField("password", "New password", "password", 'required minlength="8" autocomplete="new-password"')}
+    <input type="hidden" name="email" value="<%= it.email || "" %>" />`, "Update password", `<a href="/login">Back to sign in</a>`).replace('action="<%= it.action || "" %>"', 'action="<%= it.action %>"');
+}
+function renderVerifyEmailView() {
+  return `<section class="auth-card">
+  <h1>Verify your email</h1>
+  <p>We sent a signed link to your inbox (or the mail log when <code>MAIL_DRIVER=log</code>).</p>
+  <form method="post" action="/email/verification-notification">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    <button type="submit">Resend link</button>
+  </form>
+</section>
+`;
+}
+function renderMfaChallengeView() {
+  return renderFormView("Two-factor code", `${textField("code", "Authenticator or recovery code", "text", 'required autocomplete="one-time-code"')}`, "Continue", `<a href="/login">Cancel</a>`).replace('action="<%= it.action || "" %>"', 'action="/login/mfa"');
+}
+function renderMfaSetupView() {
+  return `<section class="auth-card">
+  <h1>Authenticator app</h1>
+  <p class="muted">Scan this otpauth URL in your authenticator, then confirm a code. Restyle this page in <code>views/auth/mfa-setup.eta</code>.</p>
+  <p><code><%= it.otpauth %></code></p>
+  <form method="post" action="/account/mfa">
+    <input type="hidden" name="_token" value="<%= it.csrfToken %>" />
+    <input type="hidden" name="secret" value="<%= it.secret %>" />
+    ${textField("code", "Confirmation code", "text", "required")}
+    <div class="actions"><button type="submit">Enable MFA</button></div>
+  </form>
+  <% if (it.recoveryCodes) { %>
+  <h2>Recovery codes</h2>
+  <p>Store these once. They will not be shown again.</p>
+  <ul>
+    <% for (const code of it.recoveryCodes) { %>
+    <li><code><%= code %></code></li>
+    <% } %>
+  </ul>
+  <% } %>
+</section>
+`;
+}
+
+// ../strata-starter/src/renderAuth.ts
+function renderAuthDirectory(layers) {
+  if (!authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const tokenLookup = authUsesToken(layers.auth) ? `
+  async resolveUserFromToken(token: string) {
+    if (!token || token.split(".").length === 3) {
+      return null;
+    }
+    const hashed = hashApiToken(token);
+    const rows = await getSql().unsafe<
+      {
+        id: number;
+        user_id: number;
+        abilities: string;
+        expires_at: Date | string | null;
+        role?: string;
+        is_admin?: number | boolean;
+        email_verified_at?: Date | string | null;
+      }
+    >(
+      \`SELECT t.id, t.user_id, t.abilities, t.expires_at, u.is_admin, u.email_verified_at
+       FROM api_tokens t INNER JOIN users u ON u.id = t.user_id
+       WHERE t.token_hash = ?\`,
+      [hashed],
+    );
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    if (row.expires_at && new Date(row.expires_at).getTime() <= Date.now()) {
+      return null;
+    }
+    let abilities: string[] = [];
+    try {
+      abilities = JSON.parse(String(row.abilities ?? "[]")) as string[];
+    } catch {
+      abilities = ["profile:read"];
+    }
+    return {
+      id: Number(row.user_id),
+      role: row.is_admin ? "admin" : "member",
+      abilities,
+      tokenId: Number(row.id),
+      emailVerifiedAt: row.email_verified_at ?? null,
+    };
+  },` : `
+  async resolveUserFromToken() {
+    return null;
+  },`;
+  const placeholder = layers.database === "postgres" ? "$1" : "?";
+  const hashImport = authUsesToken(layers.auth) ? `import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+` : "";
+  const mfaSelect = layers.extras.mfa ? ", mfa_enabled, mfa_secret, mfa_recovery_codes" : "";
+  const mfaColumns = layers.extras.mfa ? `
+  mfa_enabled?: number | boolean;
+  mfa_secret?: string | null;
+  mfa_recovery_codes?: string | null;` : "";
+  const mfaReturn = layers.extras.mfa ? `
+    mfa_enabled: row.mfa_enabled === true || row.mfa_enabled === 1,
+    mfa_secret: row.mfa_secret ?? null,
+    mfa_recovery_codes: row.mfa_recovery_codes ?? null,` : "";
+  const userColumns = `id, name, email, is_admin, email_verified_at, password${mfaSelect}`;
+  return `import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { verifyPassword } from "@getstrata/core/auth/password";
+${hashImport}import type { AuthUserDirectory } from "@getstrata/core/contracts/authUserDirectory";
+import { getSql } from "./database.ts";
+
+type UserRow = {
+  id: number;
+  name: string;
+  email: string;
+  is_admin: number | boolean;
+  email_verified_at: Date | string | null;
+  password: string;${mfaColumns}
+};
+
+function mapRole(isAdmin: unknown): string {
+  return isAdmin === true || isAdmin === 1 || isAdmin === "1" ? "admin" : "member";
+}
+
+function mapUserRow(row: UserRow) {
+  return {
+    id: Number(row.id),
+    name: row.name,
+    email: row.email,
+    role: mapRole(row.is_admin),
+    email_verified_at: row.email_verified_at ?? null,
+    password: row.password,${mfaReturn}
+  };
+}
+
+async function findUserById(id: number) {
+  const rows = await getSql().unsafe<UserRow>(
+    "SELECT ${userColumns} FROM users WHERE id = ${placeholder}",
+    [id],
+  );
+  const row = rows[0];
+  if (!row) {
+    throw new Error(\`User \${id} not found.\`);
+  }
+  return mapUserRow(row);
+}
+
+async function findUserByEmail(email: string) {
+  const rows = await getSql().unsafe<UserRow>(
+    "SELECT ${userColumns} FROM users WHERE email = ${placeholder}",
+    [email.trim().toLowerCase()],
+  );
+  const row = rows[0];
+  return row ? mapUserRow(row) : null;
+}
+
+export const starterAuthDirectory: AuthUserDirectory = {
+${tokenLookup.replace("WHERE t.token_hash = ?", `WHERE t.token_hash = ${placeholder}`)}
+
+  findByIdOrThrow: findUserById,
+
+  findByEmail: findUserByEmail,
+
+  async verifyCredentials(email: string, password: string): Promise<AuthUser | null> {
+    const user = await findUserByEmail(email);
+    if (!user?.password || !(await verifyPassword(password, user.password))) {
+      return null;
+    }
+    return {
+      id: user.id,
+      role: user.role,
+      emailVerifiedAt: user.email_verified_at ?? null,
+    };
+  },
+};
+`;
+}
+function renderAuthProvider(layers) {
+  if (layers.auth === "headers") {
+    return `import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";
+import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { currentAuthUser } from "@getstrata/core/auth/authContext";
+import type { ServiceProvider } from "@getstrata/core/contracts/di";
+
+class StarterAuthManager {
+  async resolve(request?: Request): Promise<AuthUser | null> {
+    if (process.env.AUTH_DEV_HEADERS === "false") {
+      return request ? null : currentAuthUser();
+    }
+    if (request) {
+      const userId = request.headers.get("x-authenticated-user-id");
+      if (!userId) {
+        return null;
+      }
+      const role = request.headers.get("x-authenticated-user-role");
+      return {
+        id: userId,
+        ...(role ? { role } : {}),
+      };
+    }
+    return currentAuthUser();
+  }
+
+  user(request?: Request) {
+    return this.resolve(request);
+  }
+
+  async check(request: Request) {
+    return (await this.user(request)) !== null;
+  }
+}
+
+const authProvider: ServiceProvider = {
+  name: "starter.auth",
+  register({ container }) {
+    container.set(CORE_AUTH_TOKEN, new StarterAuthManager());
+  },
+};
+
+export default authProvider;
+`;
+  }
+  const cookieBlock = authUsesCookie(layers.auth) ? `    const auth = createCookieSessionAuthManager({
+      secret: sessionSecret(),
+      cookieName: "strata_session",
+      mapUser: (user) => ({
+        id: user.id,
+        role: user.is_admin ? "admin" : "member",
+        ...(user.email_verified_at !== undefined ? { emailVerifiedAt: user.email_verified_at } : {}),
+      }),
+    });` : `    const fallback = ${authUsesToken(layers.auth) ? "new DatabaseTokenGuard(container)" : "new JwtGuard()"};
+    const auth = new AuthManager(fallback);`;
+  const tokenRegs = authUsesToken(layers.auth) ? `    const apiGuard = new DatabaseTokenGuard(container);
+    auth.registerGuard("api", apiGuard);
+    auth.registerGuard("access_token", apiGuard);
+    auth.registerGuard("token", apiGuard);` : "";
+  const jwtReg = authUsesJwt(layers.auth) ? `    auth.registerGuard("jwt", new JwtGuard());` : "";
+  const basicReg = authUsesToken(layers.auth) || authUsesJwt(layers.auth) ? `    auth.registerGuard("basic", new BasicAuthGuard(container));` : "";
+  const ability = authUsesToken(layers.auth) ? `    container.set(CORE_ABILITY_CHECKER_TOKEN, createTokenAbilityChecker());` : "";
+  const imports = [`import { CORE_AUTH_TOKEN } from "@getstrata/bootstrap/config";`];
+  if (authUsesCookie(layers.auth)) {
+    imports.push(`import { createCookieSessionAuthManager } from "@getstrata/bootstrap/web/session";`);
+  }
+  if (authUsesToken(layers.auth) || authUsesJwt(layers.auth)) {
+    imports.push(`import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";`);
+  }
+  if (!authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
+    imports.push(`import { AuthManager, DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
+  } else if (!authUsesCookie(layers.auth) && authUsesJwt(layers.auth)) {
+    imports.push(`import { AuthManager } from "@getstrata/core/auth/guard";`);
+  } else if (authUsesCookie(layers.auth) && authUsesToken(layers.auth)) {
+    imports.push(`import { DatabaseTokenGuard } from "@getstrata/core/auth/guard";`);
+  }
+  if (authUsesJwt(layers.auth)) {
+    imports.push(`import { JwtGuard } from "@getstrata/core/auth/jwtGuard";`);
+  }
+  if (authUsesToken(layers.auth)) {
+    imports.push(`import { createTokenAbilityChecker } from "@getstrata/core/auth/tokenAbilityChecker";`);
+  }
+  imports.push(`import type { ServiceProvider } from "@getstrata/core/contracts/di";`);
+  const tokenImports = ["CORE_AUTH_USER_DIRECTORY_TOKEN"];
+  if (authUsesToken(layers.auth)) {
+    tokenImports.unshift("CORE_ABILITY_CHECKER_TOKEN");
+  }
+  imports.push(`import {
+  ${tokenImports.join(`,
+  `)},
+} from "@getstrata/core/contracts/serviceTokens";`);
+  imports.push(`import { starterAuthDirectory } from "../authDirectory.ts";`);
+  if (authUsesCookie(layers.auth)) {
+    imports.push(`import { sessionSecret } from "../config.ts";`);
+  }
+  return `${imports.join(`
+`)}
+
+const authProvider: ServiceProvider = {
+  name: "starter.auth",
+  register({ container }) {
+    container.set(CORE_AUTH_USER_DIRECTORY_TOKEN, starterAuthDirectory);
+${cookieBlock}
+${tokenRegs}
+${jwtReg}
+${basicReg}
+${ability}
+    container.set(CORE_AUTH_TOKEN, auth);
+  },
+};
+
+export default authProvider;
+`;
+}
+
+// ../strata-starter/src/renderEnv.ts
+function envFlag(value) {
+  return value ? "true" : "false";
+}
+function appDatabaseName(projectName) {
+  return projectName.replace(/[^A-Za-z0-9_]/g, "_");
+}
+function defaultDatabaseUrl(layers, projectName) {
+  if (layers.database === "sqlite") {
+    return "sqlite:./storage/app.sqlite";
+  }
+  const database = appDatabaseName(projectName);
+  if (layers.database === "mysql") {
+    return `mysql://root:root@localhost:3306/${database}`;
+  }
+  return `postgresql://postgres:postgres@localhost:5432/${database}`;
+}
+function renderEnvExample(projectName, layers) {
+  const lines = [
+    `APP_NAME=${projectName}`,
+    `APP_KEY_PREFIX=${projectName}`,
+    "APP_ENV=local",
+    "PORT=3000",
+    "APP_URL=http://localhost:3000",
+    `DATABASE_URL=${defaultDatabaseUrl(layers, projectName)}`,
+    ...layers.database === "sqlite" ? [] : [
+      "# Optional. Migrate and boot against a different database than DATABASE_URL.",
+      "# APP_DATABASE_URL="
+    ],
+    `DB_CONNECTION=${layers.database === "postgres" ? "pgsql" : layers.database}`,
+    `FRONTEND_MODE=${layers.frontend}`,
+    `SPA_PREFIX=${layers.spaPrefix}`,
+    `TENANCY_DRIVER=${layers.tenancy}`,
+    `CACHE_DRIVER=${layers.cache}`,
+    `QUEUE_DRIVER=${layers.queue}`,
+    `MAIL_DRIVER=${layers.mail}`,
+    `AUTH_DEV_HEADERS=${envFlag(layers.auth === "headers")}`
+  ];
+  if (layers.frontend === "api") {
+    lines.push("FEATURE_PUBLIC_READS=false");
+  } else {
+    lines.push("# Local convenience so the welcome page reads without a login.", "# Production boot is blocked unless this is false.", "FEATURE_PUBLIC_READS=true");
+  }
+  if (needsRedis(layers)) {
+    lines.push("REDIS_URL=redis://127.0.0.1:6379");
+  } else {
+    lines.push("# REDIS_URL=redis://127.0.0.1:6379");
+  }
+  if (authUsesCookie(layers.auth) || layers.frontend === "server-htmx" || layers.frontend === "hybrid") {
+    lines.push("SESSION_SECRET=dev-session-secret-change-me-please-32ch");
+  } else {
+    lines.push("# SESSION_SECRET=");
+  }
+  if (authUsesJwt(layers.auth)) {
+    lines.push("JWT_SECRET=dev-jwt-secret-change-me-please-32chars");
+    lines.push("JWT_TTL_SECONDS=3600");
+  } else {
+    lines.push("# JWT_SECRET=");
+  }
+  if (authUsesToken(layers.auth)) {
+    lines.push("FEATURE_API_TOKENS=true");
+    lines.push("TOKEN_HASH_PEPPER=dev-token-pepper-change-me");
+    lines.push("API_TOKEN_DEFAULT_EXPIRY_DAYS=30");
+  } else {
+    lines.push("# FEATURE_API_TOKENS=false");
+  }
+  lines.push(`FEATURE_MFA=${envFlag(layers.extras.mfa)}`);
+  lines.push(`FEATURE_EMAIL_VERIFICATION=${envFlag(layers.extras.emailVerification)}`);
+  if (layers.extras.metrics) {
+    lines.push("METRICS_TOKEN=dev-metrics-token-change-me");
+  } else {
+    lines.push("# METRICS_TOKEN=");
+  }
+  if (layers.extras.scim) {
+    lines.push("FEATURE_SCIM=true");
+    lines.push("SCIM_BEARER_TOKEN=dev-scim-token-change-me");
+    lines.push("# SCIM_TENANT_TOKENS=1:token-a");
+  } else {
+    lines.push("# FEATURE_SCIM=false");
+    lines.push("# SCIM_BEARER_TOKEN=");
+  }
+  if (layers.database === "mysql") {
+    lines.push(`MYSQL_URL=${defaultDatabaseUrl(layers, projectName)}`);
+  }
+  if (layers.mail === "smtp") {
+    lines.push("MAIL_HOST=localhost");
+    lines.push("MAIL_PORT=1025");
+    lines.push(`MAIL_FROM=noreply@${projectName}.local`);
+    lines.push("MAIL_SECURE=false");
+  } else {
+    lines.push("# MAIL_HOST=");
+    lines.push("# MAIL_FROM=");
+  }
+  lines.push("# Behind a reverse proxy, trust X-Forwarded-For (rightmost public hop) for throttles and session IPs.");
+  lines.push("# TRUST_FORWARDED_FOR=true");
+  return `${lines.join(`
+`)}
+`;
+}
+function renderDockerCompose(projectName, layers) {
+  const selected = selectedDockerServices(layers);
+  if (selected.length === 0) {
+    return null;
+  }
+  const selectedSet = new Set(selected);
+  const services = [];
+  if (selectedSet.has("postgres")) {
+    const database = appDatabaseName(projectName);
+    services.push(`  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: ${database}
+    ports:
+      - "5432:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data`);
+  }
+  if (selectedSet.has("mysql")) {
+    const database = appDatabaseName(projectName);
+    services.push(`  mysql:
+    image: mysql:8.4
+    environment:
+      MYSQL_ROOT_PASSWORD: root
+      MYSQL_DATABASE: ${database}
+    ports:
+      - "3306:3306"
+    volumes:
+      - mysqldata:/var/lib/mysql`);
+  }
+  if (selectedSet.has("adminer")) {
+    const server = selectedSet.has("mysql") ? "mysql" : "postgres";
+    services.push(`  adminer:
+    image: adminer:5.4.2
+    environment:
+      ADMINER_DEFAULT_SERVER: ${server}
+    depends_on:
+      - ${server}
+    ports:
+      - "8080:8080"`);
+  }
+  if (selectedSet.has("redis")) {
+    services.push(`  redis:
+    image: redis:7-alpine
+    ports:
+      - "6379:6379"`);
+  }
+  if (selectedSet.has("mailpit")) {
+    services.push(`  mailpit:
+    image: axllent/mailpit:latest
+    ports:
+      - "1025:1025"
+      - "8025:8025"`);
+  }
+  const volumes = [];
+  if (selectedSet.has("postgres")) {
+    volumes.push("  pgdata:");
+  }
+  if (selectedSet.has("mysql")) {
+    volumes.push("  mysqldata:");
+  }
+  return `services:
+${services.join(`
+
+`)}
+${volumes.length > 0 ? `
+volumes:
+${volumes.join(`
+`)}
+` : ""}`;
+}
+function renderGitignore() {
+  return `node_modules
+.env
+.env.local
+dist
+frontend/dist
+storage/*.sqlite
+storage/*.sqlite-journal
+storage/*.sqlite-wal
+storage/*.sqlite-shm
+coverage
+*.tsbuildinfo
+`;
+}
+function renderDockerfile(layers) {
+  const frontend = needsFrontendBuild(layers.frontend);
+  const lines = [
+    '# Production image. Build once, run with env from your platform; see README "Deploy".',
+    "FROM oven/bun:1.4 AS deps",
+    "WORKDIR /app",
+    "COPY package.json bun.lock ./",
+    "RUN bun install --frozen-lockfile --production",
+    ""
+  ];
+  if (frontend) {
+    lines.push("FROM oven/bun:1.4 AS frontend", "WORKDIR /app/frontend", "COPY frontend/package.json frontend/bun.lock ./", "RUN bun install --frozen-lockfile", "COPY frontend/ ./", "RUN bun run build", "");
+  }
+  lines.push("FROM oven/bun:1.4-slim AS runtime", "WORKDIR /app", "ENV APP_ENV=production", "ENV AUTH_DEV_HEADERS=false", "ENV PORT=3000", "COPY --from=deps /app/node_modules ./node_modules", "COPY . .");
+  if (frontend) {
+    lines.push("COPY --from=frontend /app/frontend/dist ./frontend/dist");
+  }
+  lines.push("RUN mkdir -p storage && chown -R bun:bun /app", "USER bun", "EXPOSE 3000");
+  if (layers.database === "sqlite") {
+    lines.push("# SQLite lives in storage/; mount a volume there or the data dies with the container.", 'VOLUME ["/app/storage"]');
+  }
+  lines.push(`HEALTHCHECK --interval=30s --timeout=3s --start-period=10s CMD ["bun", "-e", "fetch('http://127.0.0.1:' + process.env.PORT + '/health').then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1))"]`, 'CMD ["bun", "run", "start"]');
+  return `${lines.join(`
+`)}
+`;
+}
+function renderDockerignore(layers) {
+  const lines = [
+    ".git",
+    "node_modules",
+    ".env",
+    ".env.*",
+    "!.env.example",
+    "storage/*.sqlite",
+    "storage/*.sqlite-journal",
+    "storage/*.sqlite-wal",
+    "storage/*.sqlite-shm",
+    "coverage",
+    "docker-compose.yml"
+  ];
+  if (needsFrontendBuild(layers.frontend)) {
+    lines.push("frontend/node_modules", "frontend/dist");
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function renderPackageJson(projectName, options = {}) {
+  const coreDeps = options.workspaceDependencies ? {
+    "@getstrata/bootstrap": "workspace:*",
+    "@getstrata/cli": "workspace:*",
+    "@getstrata/core": "workspace:*"
+  } : {
+    "@getstrata/bootstrap": "^1.0.1",
+    "@getstrata/cli": "^1.0.1",
+    "@getstrata/core": "^1.0.1"
+  };
+  if (options.layers?.database === "mysql") {
+    coreDeps.mysql2 = "^3.24.3";
+  }
+  const scripts = {
+    dev: "strata dev",
+    start: "strata start",
+    "db:migrate": "strata migrate",
+    "db:fresh": "strata migrate:fresh",
+    check: "tsc --noEmit"
+  };
+  if (options.layers && needsFrontendBuild(options.layers.frontend)) {
+    scripts["frontend:install"] = "cd frontend && bun install";
+    scripts["frontend:build"] = "cd frontend && bun run build";
+    scripts["frontend:dev"] = "cd frontend && bun run dev";
+  }
+  return `${JSON.stringify({
+    name: projectName,
+    version: "0.1.0",
+    private: true,
+    type: "module",
+    scripts,
+    dependencies: coreDeps,
+    devDependencies: {
+      "@types/bun": "^1.4.0",
+      typescript: "^5.9.2"
+    }
+  }, null, 2)}
+`;
+}
+function renderLayersManifest(projectName, layers) {
+  return `${JSON.stringify({
+    name: projectName,
+    generatedBy: "create-strata",
+    layers: {
+      frontend: layers.frontend,
+      database: layers.database,
+      auth: layers.auth,
+      tenancy: layers.tenancy,
+      cache: layers.cache,
+      queue: layers.queue,
+      mail: layers.mail,
+      spaPrefix: layers.spaPrefix,
+      extras: layers.extras,
+      docker: layers.docker
+    },
+    notes: "Generated by create-strata. Change layers later with flags or by editing env and bootstrap files."
+  }, null, 2)}
+`;
+}
+function localEnvVars(services) {
+  const vars = [];
+  for (const name of services) {
+    if (name === "postgres" || name === "mysql") {
+      vars.push("DATABASE_URL");
+    } else if (name === "redis") {
+      vars.push("REDIS_URL");
+    } else if (name === "mailpit") {
+      vars.push("MAIL_HOST");
+    }
+  }
+  return [...new Set(vars)];
+}
+function renderSupportingToolsReadme(layers) {
+  const needed = neededDockerServices(layers);
+  if (needed.length === 0) {
+    return "";
+  }
+  const dockerOn = selectedDockerServices(layers);
+  const dockerSet = new Set(dockerOn);
+  const localOn = needed.filter((name) => !dockerSet.has(name));
+  const lines = ["## Supporting tools", ""];
+  if (dockerOn.length > 0) {
+    const names = dockerOn.map((name) => DOCKER_SERVICE_LABELS[name]).join(", ");
+    lines.push(`Docker Compose includes ${names}.`, "", "```bash", "docker compose up -d", "```", "");
+    if (dockerSet.has("adminer")) {
+      const mysql = layers.database === "mysql";
+      const system = mysql ? "MySQL" : "PostgreSQL";
+      const server = mysql ? "mysql" : "postgres";
+      const username = mysql ? "root" : "postgres";
+      const password = mysql ? "root" : "postgres";
+      lines.push(`Adminer: http://localhost:8080 (${system}, server \`${server}\`, username \`${username}\`, password \`${password}\`).`, "");
+    }
+  }
+  if (localOn.length > 0) {
+    const names = localOn.map((name) => DOCKER_SERVICE_LABELS[name]).join(", ");
+    const envVars = localEnvVars(localOn).map((name) => `\`${name}\``).join(", ");
+    lines.push(`Use local installs for ${names}. Point ${envVars} in \`.env\` at services on this machine.`, "");
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function renderApiDocs(projectName, layers) {
+  const rows = ["| Method | Path | Notes |", "| --- | --- | --- |"];
+  rows.push("| `GET` | `/health` | Plain text `ok` (200), or `degraded` (503) when the database or the migrated schema is unavailable. `/ready` returns the same checks as JSON. |");
+  rows.push("| `GET` | `/` | Welcome page. Restyle or replace it. |");
+  if (authUsesToken(layers.auth)) {
+    rows.push("| `POST` | `/api/v1/auth/login` | `{ email, password }` returns `{ token }`. |", "| `POST` | `/api/v1/auth/register` | Creates a user and returns a token. |", "| `GET` | `/api/v1/auth/me` | Requires `Authorization: Bearer <token>`. |");
+  }
+  if (authUsesJwt(layers.auth)) {
+    rows.push("| `POST` | `/api/auth/token` | Mints a short-lived JWT. Not an HTML session. |");
+  }
+  if (authNeedsUsers(layers.auth)) {
+    rows.push("| `POST` | `/api/v1/auth/forgot-password` | Sends a signed reset link through the mail driver. |", "| `POST` | `/api/v1/auth/reset-password` | Consumes the signed link. |", "| `GET` | `/api/user` | Current user for the active guard. |");
+  }
+  if (layers.extras.metrics) {
+    rows.push("| `GET` | `/metrics` | Prometheus text. Production requires `Authorization: Bearer <METRICS_TOKEN>`. |");
+  }
+  const authNote = layers.auth === "headers" ? `Auth is \`headers\`. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`) for local work and tests. There are no login endpoints and no \`users\` table. Production must set \`AUTH_DEV_HEADERS=false\`, which turns those headers off and leaves you without a guard, so pick another auth layer before you ship.` : authUsesToken(layers.auth) ? `Sign in with \`POST /api/v1/auth/login\`, then send \`Authorization: Bearer <token>\` on every request. Tokens are stored hashed in \`api_tokens\` and expire after \`API_TOKEN_DEFAULT_EXPIRY_DAYS\` (30 in \`.env.example\`). The response includes \`expires_at\`.` : `Mint a JWT with \`POST /api/auth/token\`, then send \`Authorization: Bearer <jwt>\`. JWTs expire; re-mint rather than refreshing in place.`;
+  return `# ${projectName} API
+
+\`FRONTEND_MODE=${layers.frontend}\`. ${layers.frontend === "api" ? "No server-rendered views beyond the welcome page and no SPA assets." : `HTML is served alongside this API. The SPA is mounted at \`${layers.spaPrefix}\`.`}
+
+## Routes this app serves today
+
+${rows.join(`
+`)}
+
+There is no CRUD endpoint for the seeded \`notes\` table. Adding your own routes is the first thing you do.
+
+## Auth
+
+${authNote}
+
+## Adding a route
+
+Create a module under \`src/modules/\` and return a route map. Modules are discovered on boot.
+
+\`\`\`typescript
+// src/modules/notes/index.ts
+import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { jsonResponse } from "@getstrata/core/http/response";
+import { getSql } from "../../bootstrap/database.ts";
+
+const notesModule: AppModule = {
+  name: "notes",
+  order: 2,
+  routes({ kernel }) {
+    return {
+      "/api/v1/notes": kernel.wrap("api", async () => {
+        const rows = await getSql().unsafe<{ id: number; body: string }>(
+          "SELECT id, body FROM notes ORDER BY id DESC",
+        );
+        return jsonResponse({ data: rows });
+      }),
+    };
+  },
+};
+
+export default notesModule;
+\`\`\`
+
+Import from \`@getstrata/core/...\` subpaths rather than the package root, so singleton state such as the database pool stays shared.
+
+## Docs
+
+- [Building apps](https://github.com/EyK-26/strata/blob/main/docs/BUILDING-APPS.md)
+- [Auth choices](https://github.com/EyK-26/strata/blob/main/docs/AUTH.md)
+- [Databases](https://github.com/EyK-26/strata/blob/main/docs/DATABASE.md)
+`;
+}
+function renderReadme(projectName, layers) {
+  const docker = renderDockerCompose(projectName, layers);
+  const next = [`cd ${projectName}`, "cp .env.example .env"];
+  if (docker) {
+    next.push("docker compose up -d");
+  }
+  next.push("bun install");
+  if (needsFrontendBuild(layers.frontend)) {
+    next.push("bun run frontend:install", "bun run frontend:build");
+  }
+  next.push("bun run db:migrate", "bun run dev");
+  const extras = Object.entries(layers.extras).filter(([, on]) => on).map(([key]) => key);
+  const dockerServices = selectedDockerServices(layers);
+  const neededTools = neededDockerServices(layers);
+  const dockerLabel = neededTools.length === 0 ? "not needed" : dockerServices.length > 0 ? dockerServices.join(", ") : "off (local installs)";
+  return `# ${projectName}
+
+Strata app generated by \`create-strata\`.
+
+## Layers
+
+| Layer | Choice |
+|-------|--------|
+| Frontend | \`${layers.frontend}\` |
+| Database | \`${layers.database}\` |
+| Auth | \`${layers.auth}\` |
+| Tenancy | \`${layers.tenancy}\` |
+| Cache | \`${layers.cache}\` |
+| Queue | \`${layers.queue}\` |
+| Mail | \`${layers.mail}\` |
+| SPA prefix | \`${layers.spaPrefix}\` |
+| Docker Compose | ${dockerLabel} |
+${extras.length > 0 ? `| Extras | ${extras.join(", ")} |
+` : ""}
+This file is the map for this app. Framework guides: [Building apps](https://github.com/EyK-26/strata/blob/main/docs/BUILDING-APPS.md), [Auth](https://github.com/EyK-26/strata/blob/main/docs/AUTH.md), [Starter](https://github.com/EyK-26/strata/blob/main/docs/STARTER.md).
+
+## Run it
+
+\`\`\`bash
+${next.join(`
+`)}
+\`\`\`
+
+Open http://localhost:3000. Health check: \`GET /health\`.
+
+${renderSupportingToolsReadme(layers)}${layers.auth !== "headers" ? `
+Seeded login (password \`password\`):
+
+- \`demo@example.com\` (member)
+- \`admin@example.test\` (admin)
+` : `
+Header auth is on for local use. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`). Production must set \`AUTH_DEV_HEADERS=false\`.
+`}${authUsesCookie(layers.auth) ? `
+HTML auth kit (restyle \`views/\` and \`public/assets/site.css\`):
+
+- Welcome: \`/\`
+- Sign in: \`/login\`
+- Register: \`/register\`
+- Forgot password: \`/forgot-password\`
+- Reset password: signed \`/reset-password\` (mail log when \`MAIL_DRIVER=log\`)
+${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}
+Cookie name is \`strata_session\`. Forms send CSRF as \`_token\`.
+` : ""}${authUsesToken(layers.auth) ? `
+Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Register: \`POST /api/v1/auth/register\`. Forgot/reset: \`POST /api/v1/auth/forgot-password\` and signed \`POST /api/v1/auth/reset-password\`. Send \`Authorization: Bearer\` after login.
+` : ""}${authUsesJwt(layers.auth) ? `
+JWT mint: \`POST /api/auth/token\` with email and password. Short-lived. Do not use JWT as an HTML cookie session.
+` : ""}${layers.extras.metrics ? `
+Prometheus scrape: \`GET /metrics\`. Production requires \`Authorization: Bearer <METRICS_TOKEN>\`.
+` : ""}${needsFrontendBuild(layers.frontend) ? `
+## Frontend
+
+The React app lives in \`frontend/\` with its own \`package.json\`. It is not built by \`bun install\` at the root.
+
+\`\`\`bash
+bun run frontend:install
+bun run frontend:build
+\`\`\`
+
+Until \`frontend/dist\` exists, \`${layers.spaPrefix}\` answers 503. Use \`bun run frontend:dev\` for the Vite-style dev server with hot reload.${layers.frontend === "hybrid" ? ` HTML stays at \`/\` and the SPA is served under \`${layers.spaPrefix}/*\`.` : ""}
+` : ""}${layers.database === "sqlite" ? "" : `
+## Database
+
+The app uses the database named in \`DATABASE_URL\` and creates it on first migrate when the connection user may. Set \`APP_DATABASE_URL\` only when migrations and the app should target a different database than \`DATABASE_URL\`.
+`}
+## Deploy
+
+\`Dockerfile\` builds a production image from the committed \`bun.lock\` (run \`bun install\` once and commit the lockfile).${needsFrontendBuild(layers.frontend) ? " The React frontend is built inside the image." : ""}
+
+\`\`\`bash
+docker build -t ${projectName} .
+docker run --rm -p 3000:3000 --env-file .env.production ${projectName}
+\`\`\`
+
+Migrations are a deploy step, not a boot step: run \`docker run --rm --env-file .env.production ${projectName} bun run db:migrate\` before the new version takes traffic.${layers.database === "sqlite" ? " SQLite stores its file in `/app/storage`; mount a volume there (`-v strata_data:/app/storage`) or the data is lost with the container." : ""}
+The image sets \`APP_ENV=production\` and \`AUTH_DEV_HEADERS=false\`; everything else in the Production list below comes from your environment (the \`.env.production\` file above is one way).
+
+## Production
+
+\`createApp\` calls \`assertProductionSecrets()\` when \`APP_ENV=production\`. That check fails closed, so read this before your first production boot.
+
+- Replace every \`change-me\` placeholder in \`.env\`. The guard rejects the values this generator wrote, not just empty ones.
+- Set \`APP_URL\` to the public origin (for example \`https://app.example.com\`). Signed links and redirects are built from it; localhost is rejected.
+- Set \`AUTH_DEV_HEADERS=false\`.
+- Set \`FEATURE_PUBLIC_READS=false\`. ${layers.frontend === "api" ? "This app already ships `false`." : "This app ships `true` so the local welcome page reads without a login. Production requires `false`."}
+- Cross-origin browser calls are off in production until you set \`CORS_ALLOWED_ORIGINS\` to explicit origins. A \`*\` entry is rejected. Non-browser clients are unaffected.
+- Behind a reverse proxy or load balancer, set \`TRUST_FORWARDED_FOR=true\` so throttles and session records see the client address instead of the proxy. Only the rightmost public hop of \`X-Forwarded-For\` is trusted.
+${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}
+\`strata start\` does not migrate when \`APP_ENV=production\`. Run \`bun run db:migrate\` as a deploy step. \`GET /health\` answers 503 until the schema exists, so a fresh deploy stays out of rotation until it is migrated.
+`;
+}
+
+// ../strata-starter/src/renderRuntime.ts
+function needsEnsure(layers) {
+  return layers.database !== "sqlite";
+}
+function ensureImport(layers) {
+  return needsEnsure(layers) ? `import { ensureAppDatabase } from "../bootstrap/ensureDatabase.ts";
+` : "";
+}
+function ensureCall(layers) {
+  return needsEnsure(layers) ? `  await ensureAppDatabase();
+` : "";
+}
+function dialectFragments(database) {
+  if (database === "sqlite") {
+    return {
+      id: "INTEGER PRIMARY KEY AUTOINCREMENT",
+      text: "TEXT",
+      keyText: "TEXT",
+      defaultText: "TEXT",
+      timestamp: "TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP",
+      timestampNull: "TEXT",
+      bool: "INTEGER NOT NULL DEFAULT 0"
+    };
+  }
+  if (database === "mysql") {
+    return {
+      id: "INT AUTO_INCREMENT PRIMARY KEY",
+      text: "TEXT",
+      keyText: "VARCHAR(255)",
+      defaultText: "VARCHAR(1024)",
+      timestamp: "DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP",
+      timestampNull: "DATETIME NULL",
+      bool: "TINYINT(1) NOT NULL DEFAULT 0"
+    };
+  }
+  return {
+    id: "SERIAL PRIMARY KEY",
+    text: "TEXT",
+    keyText: "TEXT",
+    defaultText: "TEXT",
+    timestamp: "TIMESTAMPTZ NOT NULL DEFAULT NOW()",
+    timestampNull: "TIMESTAMPTZ",
+    bool: "BOOLEAN NOT NULL DEFAULT FALSE"
+  };
+}
+function driverName(database) {
+  return database === "postgres" ? "pgsql" : database;
+}
+function renderDatabaseTs(layers) {
+  const driver = driverName(layers.database);
+  if (layers.database === "sqlite") {
+    return `import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import type { SqlDatabaseConnection } from "@getstrata/core/database/baseRepository";
+import { bindDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import { registerDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { createSqliteConnection } from "@getstrata/core/database/sqliteConnection";
+import { useSqlDialect } from "@getstrata/core/database/dialect";
+
+export type SqlClient = {
+  unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
+  close?: () => Promise<void> | void;
+};
+
+let sql: SqlClient | null = null;
+
+function sqliteFilename(url: string): string {
+  const trimmed = url.trim();
+  if (trimmed === ":memory:" || trimmed === "sqlite::memory:") {
+    return ":memory:";
+  }
+  if (trimmed.startsWith("sqlite:")) {
+    return trimmed.slice("sqlite:".length).replace(/^\\/\\//, "") || "./storage/app.sqlite";
+  }
+  return trimmed || "./storage/app.sqlite";
+}
+
+function asSqlPool(client: SqlClient): SqlDatabaseConnection {
+  const tagged = async () => {
+    throw new Error(
+      "SQLite starter connections do not run tagged SQL. Keep TENANCY_DRIVER=none or use Postgres.",
+    );
+  };
+  return Object.assign(tagged, client) as SqlDatabaseConnection;
+}
+
+export function getSql(): SqlClient {
+  if (sql) {
+    return sql;
+  }
+
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL is required");
+  }
+
+  useSqlDialect("${driver}");
+  const filename = sqliteFilename(url);
+  if (filename !== ":memory:") {
+    mkdirSync(dirname(filename), { recursive: true });
+  }
+  sql = createSqliteConnection(filename);
+  bindDatabaseConnection(sql);
+  registerDefaultDatabasePool(asSqlPool(sql));
+  return sql;
+}
+
+export async function pingDatabase(): Promise<boolean> {
+  try {
+    await getSql().unsafe("SELECT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function closeDatabase() {
+  if (sql?.close) {
+    await sql.close();
+  }
+  sql = null;
+}
+`;
+  }
+  if (layers.database === "mysql") {
+    return `import { bindDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import type { SqlDatabaseConnection } from "@getstrata/core/database/baseRepository";
+import { registerDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { createMysqlConnection } from "@getstrata/core/database/mysqlConnection";
+import { useSqlDialect } from "@getstrata/core/database/dialect";
+
+export type SqlClient = {
+  unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
+  close?: () => Promise<void> | void;
+};
+
+let sql: SqlClient | null = null;
+
+export function getSql(): SqlClient {
+  if (sql) {
+    return sql;
+  }
+
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL is required");
+  }
+
+  useSqlDialect("${driver}");
+  sql = createMysqlConnection(url);
+  bindDatabaseConnection(sql);
+  registerDefaultDatabasePool(sql as SqlDatabaseConnection);
+  return sql;
+}
+
+export async function pingDatabase(): Promise<boolean> {
+  try {
+    await getSql().unsafe("SELECT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function closeDatabase() {
+  if (sql?.close) {
+    await sql.close();
+  }
+  sql = null;
+}
+`;
+  }
+  return `import { createBunSqlPool } from "@getstrata/core/database/bunSql";
+import type { SqlDatabaseConnection } from "@getstrata/core/database/baseRepository";
+import { bindDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import {
+  getDefaultDatabaseQuery,
+  registerDefaultDatabasePool,
+} from "@getstrata/core/database/defaultConnection";
+import { useSqlDialect } from "@getstrata/core/database/dialect";
+
+export type SqlClient = {
+  unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
+  close?: () => Promise<void> | void;
+};
+
+let sql: SqlClient | null = null;
+
+export function getSql(): SqlClient {
+  if (sql) {
+    return sql;
+  }
+
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL is required");
+  }
+
+  useSqlDialect("${driver}");
+  const pool = createBunSqlPool({ url, max: 5 }) as SqlDatabaseConnection;
+  registerDefaultDatabasePool(pool);
+  bindDatabaseConnection(getDefaultDatabaseQuery());
+  sql = getDefaultDatabaseQuery() as SqlClient;
+  return sql;
+}
+
+export async function pingDatabase(): Promise<boolean> {
+  try {
+    await getSql().unsafe("SELECT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function closeDatabase() {
+  if (sql?.close) {
+    await sql.close();
+  }
+  sql = null;
+}
+`;
+}
+function renderMigrateTs(layers) {
+  const d = dialectFragments(layers.database);
+  const statements = [];
+  const tenancyOn = usesTenantTable(layers.tenancy);
+  const mfaOn = layers.extras.mfa && authNeedsUsers(layers.auth);
+  if (tenancyOn) {
+    statements.push(`CREATE TABLE IF NOT EXISTS tenant (
+    id ${d.id},
+    slug ${d.keyText} NOT NULL UNIQUE,
+    plan ${d.defaultText} NOT NULL DEFAULT 'enterprise',
+    region ${d.defaultText} NOT NULL DEFAULT 'eu'
+  )`);
+  }
+  statements.push(`CREATE TABLE IF NOT EXISTS notes (
+    id ${d.id},
+    body ${d.text} NOT NULL,
+    created_at ${d.timestamp}
+  )`);
+  if (authNeedsUsers(layers.auth)) {
+    const tenantColumn = tenancyOn ? `
+    tenant_id INTEGER NOT NULL DEFAULT 1,` : "";
+    const mfaColumns = mfaOn ? `
+    mfa_secret ${d.text},
+    mfa_enabled ${d.bool},
+    mfa_recovery_codes ${d.text},` : "";
+    statements.push(`CREATE TABLE IF NOT EXISTS users (
+    id ${d.id},
+    name ${d.text} NOT NULL,
+    email ${d.keyText} NOT NULL UNIQUE,
+    password ${d.text} NOT NULL,
+    is_admin ${d.bool},${tenantColumn}${mfaColumns}
+    email_verified_at ${d.timestampNull},
+    created_at ${d.timestamp}
+  )`);
+  }
+  if (authUsesCookie(layers.auth)) {
+    statements.push(`CREATE TABLE IF NOT EXISTS sessions (
+    id ${d.keyText} PRIMARY KEY,
+    user_id INTEGER NOT NULL,
+    expires_at ${d.timestamp},
+    user_agent ${d.text},
+    ip_address ${d.text},
+    last_active_at ${d.timestamp}
+  )`);
+  }
+  if (authUsesToken(layers.auth)) {
+    statements.push(`CREATE TABLE IF NOT EXISTS api_tokens (
+    id ${d.id},
+    user_id INTEGER NOT NULL,
+    name ${d.text} NOT NULL,
+    token_hash ${d.keyText} NOT NULL UNIQUE,
+    abilities ${d.defaultText} NOT NULL DEFAULT '[]',
+    expires_at ${d.timestampNull},
+    last_used_at ${d.timestampNull},
+    created_at ${d.timestamp}
+  )`);
+  }
+  const list = statements.map((sql) => `  \`${sql}\`,`).join(`
+`);
+  const ph2 = layers.database === "postgres";
+  const notePlaceholder = ph2 ? "$1" : "?";
+  const verifyOn = layers.extras.emailVerification && authNeedsUsers(layers.auth);
+  const userColumns = verifyOn ? "name, email, password, is_admin, email_verified_at" : "name, email, password, is_admin";
+  const userPlaceholders = verifyOn ? ph2 ? "$1, $2, $3, $4, $5), ($6, $7, $8, $9, $10" : "?, ?, ?, ?, ?), (?, ?, ?, ?, ?" : ph2 ? "$1, $2, $3, $4), ($5, $6, $7, $8" : "?, ?, ?, ?), (?, ?, ?, ?";
+  const adminFlag = ph2 ? "false" : "0";
+  const adminTrue = ph2 ? "true" : "1";
+  const verifiedNow = nowTimestampLiteral(layers.database);
+  const userValues = verifyOn ? `["Demo User", "demo@example.com", password, ${adminFlag}, ${verifiedNow}, "Admin User", "admin@example.test", password, ${adminTrue}, ${verifiedNow}]` : `["Demo User", "demo@example.com", password, ${adminFlag}, "Admin User", "admin@example.test", password, ${adminTrue}]`;
+  const seedTenant = tenancyOn ? `
+  const [{ count: tenantCount }] = await sql.unsafe<{ count: string | number }>(
+    "SELECT COUNT(*) AS count FROM tenant",
+  );
+  if (Number(tenantCount) === 0) {
+    await sql.unsafe(
+      "INSERT INTO tenant (slug, plan, region) VALUES (${ph2 ? "$1, $2, $3" : "?, ?, ?"})",
+      ["default", "enterprise", "eu"],
+    );
+  }` : "";
+  const seedUsers = authNeedsUsers(layers.auth) ? `
+  const [{ count: userCount }] = await sql.unsafe<{ count: string | number }>(
+    "SELECT COUNT(*) AS count FROM users",
+  );
+  if (Number(userCount) === 0) {
+    const password = await hashPassword("password");
+    await sql.unsafe(
+      "INSERT INTO users (${userColumns}) VALUES (${userPlaceholders})",
+      ${userValues},
+    );
+  }` : "";
+  const hashImport = authNeedsUsers(layers.auth) ? `import { hashPassword } from "@getstrata/core/auth/password";
+` : "";
+  const seedBlock = `${seedTenant}${seedUsers}`;
+  return `${hashImport}${ensureImport(layers)}import { closeDatabase, getSql } from "../bootstrap/database.ts";
+
+const migrations = [
+${list}
+];
+
+export async function seed() {
+${ensureCall(layers)}  const sql = getSql();
+  const [{ count }] = await sql.unsafe<{ count: string | number }>(
+    "SELECT COUNT(*) AS count FROM notes",
+  );
+  if (Number(count) === 0) {
+    await sql.unsafe("INSERT INTO notes (body) VALUES (${notePlaceholder})", [
+      "Welcome to Strata!",
+    ]);
+  }${seedBlock}
+}
+
+export async function migrate() {
+${ensureCall(layers)}  const sql = getSql();
+  for (const statement of migrations) {
+    await sql.unsafe(statement);
+  }
+  await seed();
+}
+
+/** The CLI calls this after migrate() so pooled drivers do not hold the process open. */
+export async function close() {
+  await closeDatabase();
+}
+
+if (import.meta.main) {
+  await migrate();
+  console.log("Database migrated and seeded.");
+  await close();
+  process.exit(0);
+}
+`;
+}
+function dropTables(layers) {
+  const ordered = [];
+  if (authUsesToken(layers.auth)) {
+    ordered.push("api_tokens");
+  }
+  if (authUsesCookie(layers.auth)) {
+    ordered.push("sessions");
+  }
+  if (authNeedsUsers(layers.auth)) {
+    ordered.push("users");
+  }
+  ordered.push("notes");
+  if (usesTenantTable(layers.tenancy)) {
+    ordered.push("tenant");
+  }
+  return ordered;
+}
+function renderFreshTs(layers) {
+  const tables = dropTables(layers);
+  const cascade = layers.database === "sqlite" ? "" : " CASCADE";
+  return `${ensureImport(layers)}import { closeDatabase, getSql } from "../bootstrap/database.ts";
+import { migrate } from "./migrate.ts";
+
+const tables = ${JSON.stringify(tables)};
+
+export async function fresh() {
+${ensureCall(layers)}  const sql = getSql();
+  for (const table of tables) {
+    await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
+  }
+  await migrate();
+}
+
+/** The CLI calls this after fresh() so pooled drivers do not hold the process open. */
+export async function close() {
+  await closeDatabase();
+}
+
+if (import.meta.main) {
+  await fresh();
+  console.log("Database reset, migrated, and seeded.");
+  await close();
+  process.exit(0);
+}
+`;
+}
+function renderSeedTs() {
+  return `import { seed } from "./migrate.ts";
+
+export { seed };
+
+if (import.meta.main) {
+  await seed();
+  console.log("Database seeded.");
+  process.exit(0);
+}
+`;
+}
+function renderStatusTs(layers) {
+  const tables = dropTables(layers);
+  return `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
+
+const tables = ${JSON.stringify(tables)};
+
+export async function status() {
+${ensureCall(layers)}  const sql = getSql();
+  console.log("Starter schema (inline SQL, not a migration runner):");
+  for (const table of tables) {
+    try {
+      const rows = await sql.unsafe<{ count: string | number }>(
+        \`SELECT COUNT(*) AS count FROM \${table}\`,
+      );
+      console.log(\`- [present] \${table} (rows: \${rows[0]?.count ?? 0})\`);
+    } catch {
+      console.log(\`- [missing] \${table}\`);
+    }
+  }
+}
+
+if (import.meta.main) {
+  await status();
+  process.exit(0);
+}
+`;
+}
+function renderRollbackTs(layers) {
+  const tables = dropTables(layers);
+  const cascade = layers.database === "sqlite" ? "" : " CASCADE";
+  return `${ensureImport(layers)}import { getSql } from "../bootstrap/database.ts";
+
+const tables = ${JSON.stringify(tables)};
+
+export async function rollback() {
+${ensureCall(layers)}  const sql = getSql();
+  for (const table of tables) {
+    await sql.unsafe(\`DROP TABLE IF EXISTS \${table}${cascade}\`);
+    console.log(\`dropped \${table}\`);
+  }
+}
+
+if (import.meta.main) {
+  await rollback();
+  console.log("Rolled back starter tables.");
+  process.exit(0);
+}
+`;
+}
+function renderPreloadTs(layers, projectName) {
+  const database = appDatabaseName(projectName);
+  const fallback = layers.database === "sqlite" ? "sqlite:./storage/app.sqlite" : layers.database === "mysql" ? `mysql://root:root@localhost:3306/${database}` : `postgresql://postgres:postgres@localhost:5432/${database}`;
+  return `import { join } from "node:path";
+import { configureModulesDirectory } from "@getstrata/bootstrap/discoverModules";
+
+process.env.DATABASE_URL ??= ${JSON.stringify(fallback)};
+process.env.FRONTEND_MODE ??= ${JSON.stringify(layers.frontend)};
+process.env.SPA_PREFIX ??= ${JSON.stringify(layers.spaPrefix)};
+process.env.CACHE_DRIVER ??= ${JSON.stringify(layers.cache)};
+process.env.QUEUE_DRIVER ??= ${JSON.stringify(layers.queue)};
+process.env.MAIL_DRIVER ??= ${JSON.stringify(layers.mail)};
+process.env.TENANCY_DRIVER ??= ${JSON.stringify(layers.tenancy)};
+configureModulesDirectory(join(import.meta.dir, "../modules"));
+`;
+}
+function renderConfigTs() {
+  return `export interface AppConfig {
+  port: number;
+  appUrl: string;
+  databaseUrl: string;
+}
+
+export function loadConfig(): AppConfig {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is required");
+  }
+
+  return {
+    port: Number(process.env.PORT ?? 3000),
+    appUrl: process.env.APP_URL ?? "http://localhost:3000",
+    databaseUrl,
+  };
+}
+
+/** Cookie sessions and signed cookies are keyed by this; there is no default. */
+export function sessionSecret(): string {
+  const secret = process.env.SESSION_SECRET?.trim();
+  if (!secret) {
+    throw new Error(
+      "SESSION_SECRET is required. Copy .env.example to .env and set it (32+ characters).",
+    );
+  }
+  return secret;
+}
+`;
+}
+function renderConfigProvider(layers) {
+  return `import {
+  APP_PORT_CONFIG_KEY,
+  CORE_CONFIG_TOKEN,
+  DATABASE_URL_CONFIG_KEY,
+  REDIS_URL_CONFIG_KEY,
+} from "@getstrata/bootstrap/config";
+import type { ServiceProvider } from "@getstrata/core/contracts/di";
+import { loadConfig } from "../config.ts";
+
+const configProvider: ServiceProvider = {
+  name: "starter.config",
+  register({ container, config }) {
+    const appConfig = loadConfig();
+
+    container.set(CORE_CONFIG_TOKEN, config);
+    config.set(DATABASE_URL_CONFIG_KEY, appConfig.databaseUrl);
+    config.set(APP_PORT_CONFIG_KEY, appConfig.port);
+    config.set(REDIS_URL_CONFIG_KEY, process.env.REDIS_URL ?? "");
+    config.set("app.url", appConfig.appUrl);
+    config.set("cache.driver", process.env.CACHE_DRIVER ?? "${layers.cache}");
+    config.set("cache.ttlMs", 3_600_000);
+    config.set("cache.maxEntries", 100);
+    config.set("queue.driver", process.env.QUEUE_DRIVER ?? "${layers.queue}");
+  },
+};
+
+export default configProvider;
+`;
+}
+function renderQueueProvider() {
+  return `import type { ServiceProvider } from "@getstrata/core/contracts/di";
+import { CORE_QUEUE_TOKEN } from "@getstrata/core/contracts/serviceTokens";
+import {
+  createAppQueue,
+  createFailedJobService,
+  FAILED_JOB_SERVICE_TOKEN,
+} from "@getstrata/core/queue/createAppQueue";
+
+const queueProvider: ServiceProvider = {
+  name: "starter.queue",
+  register({ container }) {
+    const driver = (process.env.QUEUE_DRIVER ?? "sync") as "sync" | "async" | "redis";
+    const failedJobs = createFailedJobService();
+    container.set(FAILED_JOB_SERVICE_TOKEN, failedJobs);
+    container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, process.env.REDIS_URL, failedJobs));
+  },
+};
+
+export default queueProvider;
+`;
+}
+function renderEnsureDatabaseTs(layers, projectName) {
+  if (layers.database === "sqlite") {
+    return null;
+  }
+  const database = appDatabaseName(projectName);
+  const fallback = layers.database === "mysql" ? `mysql://root:root@localhost:3306/${database}` : `postgresql://postgres:postgres@localhost:5432/${database}`;
+  const resolveUrl = `/**
+ * The database name comes from DATABASE_URL. Set APP_DATABASE_URL to point
+ * migrations and the app at a different database than DATABASE_URL.
+ */
+function resolveAppDatabaseUrl(): string {
+  const explicit = process.env.APP_DATABASE_URL?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  return process.env.DATABASE_URL?.trim() || DEFAULT_DATABASE_URL;
+}
+
+/** Reject anything we would have to quote before interpolating into DDL. */
+function safeDatabaseName(url: string): string {
+  let name = "";
+  try {
+    name = decodeURIComponent(new URL(url).pathname.replace(/^\\//, ""));
+  } catch {
+    throw new Error(\`DATABASE_URL is not a valid URL: \${url}\`);
+  }
+  if (!name) {
+    throw new Error("DATABASE_URL is missing a database name.");
+  }
+  if (name.replace(/[^A-Za-z0-9_]/g, "") !== name) {
+    throw new Error(\`Refusing to create a database with an unsafe name: \${name}\`);
+  }
+  return name;
+}
+`;
+  if (layers.database === "mysql") {
+    return `import { createConnection } from "mysql2/promise";
+
+const DEFAULT_DATABASE_URL = ${JSON.stringify(fallback)};
+
+${resolveUrl}
+export async function ensureAppDatabase(): Promise<string> {
+  const url = resolveAppDatabaseUrl();
+  const name = safeDatabaseName(url);
+
+  const admin = new URL(url);
+  admin.pathname = "/";
+  const connection = await createConnection(admin.toString());
+  try {
+    await connection.query(\`CREATE DATABASE IF NOT EXISTS \${name}\`);
+  } finally {
+    await connection.end();
+  }
+
+  process.env.DATABASE_URL = url;
+  return url;
+}
+`;
+  }
+  return `const DEFAULT_DATABASE_URL = ${JSON.stringify(fallback)};
+
+${resolveUrl}
+function adminCandidateUrls(url: string): string[] {
+  const names = ["postgres", "template1"];
+  try {
+    const current = decodeURIComponent(new URL(url).pathname.replace(/^\\//, ""));
+    if (current && !names.includes(current)) {
+      names.push(current);
+    }
+  } catch {
+  }
+  return names.map((name) => {
+    const admin = new URL(url);
+    admin.pathname = \`/\${name}\`;
+    return admin.toString();
+  });
+}
+
+async function openAdminConnection(url: string): Promise<Bun.SQL> {
+  let lastError: unknown;
+  for (const candidate of adminCandidateUrls(url)) {
+    const adminSql = new Bun.SQL(candidate);
+    try {
+      await adminSql\`SELECT 1\`;
+      return adminSql;
+    } catch (error) {
+      lastError = error;
+      await adminSql.close().catch(() => undefined);
+    }
+  }
+  throw lastError instanceof Error
+    ? lastError
+    : new Error("Could not open an admin connection to create the app database.");
+}
+
+export async function ensureAppDatabase(): Promise<string> {
+  const url = resolveAppDatabaseUrl();
+  const name = safeDatabaseName(url);
+
+  const adminSql = await openAdminConnection(url);
+  try {
+    const rows = await adminSql\`
+      SELECT 1 AS ok FROM pg_database WHERE datname = \${name}
+    \`;
+    if (rows.length === 0) {
+      await adminSql.unsafe(\`CREATE DATABASE \${name}\`);
+    }
+  } finally {
+    await adminSql.close();
+  }
+
+  process.env.DATABASE_URL = url;
+  return url;
+}
+`;
+}
+function renderSidecarsTs(_layers) {
+  return null;
+}
+function renderProvidersIndex() {
+  return `import type { ServiceProvider } from "@getstrata/core/contracts/di";
+import authProvider from "./auth.ts";
+import cacheProvider from "./cache.ts";
+import configProvider from "./config.ts";
+import queueProvider from "./queue.ts";
+import storageProvider from "./storage.ts";
+
+const starterProviders: ServiceProvider[] = [
+  configProvider,
+  cacheProvider,
+  storageProvider,
+  queueProvider,
+  authProvider,
+];
+
+export { starterProviders };
+`;
+}
+function renderCreateAppTs(layers) {
+  const ensureLine = needsEnsure(layers) ? `import { ensureAppDatabase } from "./ensureDatabase.ts";
+` : "";
+  const metricsImport = layers.extras.metrics ? `import { createMetricsRoutes } from "@getstrata/bootstrap/metricsRoutes";
+` : "";
+  const metricsSpread = layers.extras.metrics ? `
+    ...createMetricsRoutes(),` : "";
+  return `import { join } from "node:path";
+import "./preload.ts";
+import { runProviderPhase } from "@getstrata/bootstrap/context";
+import {
+  type AppContext,
+  type AppDependencies,
+  type AppRouteMap,
+  assertAppDependenciesComplete,
+  type ConfigStore,
+  type MutableAppDependencies,
+  type ProviderContext,
+  ServiceContainer,
+} from "@getstrata/bootstrap/contracts";
+import { mergeSpaRoutes } from "@getstrata/bootstrap/createSpaRoutes";
+import {
+  configureModulesDirectory,
+  ensureModulesLoaded,
+} from "@getstrata/bootstrap/discoverModules";
+import { createHealthRoutes } from "@getstrata/bootstrap/health";
+${metricsImport}import { assertProductionSecrets } from "@getstrata/bootstrap/secretsGuard";
+import { createWebServer } from "@getstrata/bootstrap/web/server";
+import { setActiveApplicationContext } from "@getstrata/core/runtime/applicationRegistry";
+import { migrate } from "../db/migrate.ts";
+import { buildRoutes } from "../routes.ts";
+import { loadConfig } from "./config.ts";
+import { getSql } from "./database.ts";
+${ensureLine}import { starterProviders } from "./providers/index.ts";
+
+export interface BootstrapOptions {
+  migrate?: boolean;
+}
+
+export interface BootstrappedApp {
+  context: AppContext;
+  routes: AppRouteMap;
+  config: ReturnType<typeof loadConfig>;
+}
+
+class AppConfigStore {
+  private readonly values = new Map<string, unknown>();
+
+  set<T>(key: string, value: T): T {
+    this.values.set(key, value);
+    return value;
+  }
+
+  get<T>(key: string): T | undefined {
+    return this.values.get(key) as T | undefined;
+  }
+
+  require<T>(key: string): T {
+    const value = this.get<T>(key);
+    if (value === undefined) {
+      throw new Error(\`Missing required config value "\${key}".\`);
+    }
+    return value;
+  }
+
+  has(key: string): boolean {
+    return this.values.has(key);
+  }
+}
+
+function createAppContext(): AppContext {
+  const container = new ServiceContainer();
+  const config = new AppConfigStore() as unknown as ConfigStore;
+  const dependencies: MutableAppDependencies = { container };
+  const context: ProviderContext = { container, config, dependencies };
+
+  runProviderPhase(starterProviders, "register", context);
+  runProviderPhase(starterProviders, "boot", context);
+
+  assertAppDependenciesComplete(dependencies);
+
+  const appContext = { container, config, dependencies: dependencies as AppDependencies };
+  setActiveApplicationContext(appContext as never);
+  return appContext;
+}
+
+export async function bootstrapApp(options: BootstrapOptions = {}): Promise<BootstrappedApp> {
+  const isProduction = process.env.APP_ENV === "production";
+  // Dev boots migrate for convenience. Production must not mutate schema on
+  // start, so run \`strata migrate\` as an explicit deploy step instead.
+  const { migrate: runMigrate = !isProduction } = options;
+
+  if (isProduction) {
+    assertProductionSecrets();
+  }
+
+${needsEnsure(layers) ? `  await ensureAppDatabase();
+` : ""}  const appConfig = loadConfig();
+  getSql();
+  configureModulesDirectory(join(import.meta.dir, "../modules"));
+  await ensureModulesLoaded();
+  const context = createAppContext();
+
+  if (runMigrate) {
+    await migrate();
+  }
+
+  const routes = mergeSpaRoutes(context.dependencies, {
+    ...createHealthRoutes(context.dependencies),
+    ...buildRoutes(context.dependencies),${metricsSpread}
+  }, {
+    distDirectory: join(import.meta.dir, "../../frontend/dist"),
+  });
+
+  return { context, routes, config: appConfig };
+}
+
+export async function createApp(options: BootstrapOptions = {}) {
+  return bootstrapApp({ migrate: false, ...options });
+}
+
+export function createAppServer(routes: AppRouteMap, port = 0) {
+  return createWebServer({
+    port,
+    publicDir: "./public",
+    routes,
+  });
+}
+
+export { createAppContext };
+`;
+}
+function renderRoutesTs() {
+  return `import { buildModuleRoutes } from "@getstrata/bootstrap/buildModuleRoutes";
+import { buildWebModuleRoutes } from "@getstrata/bootstrap/buildWebModuleRoutes";
+import type { AppDependencies, AppRouteMap } from "@getstrata/bootstrap/contracts";
+
+export function buildRoutes(dependencies: AppDependencies): AppRouteMap {
+  const api = buildModuleRoutes(dependencies);
+  return {
+    ...api,
+    ...buildWebModuleRoutes(dependencies, { clearRegistry: false }),
+  };
+}
+`;
+}
+function renderViewTs(layers) {
+  const authImport = authNeedsUsers(layers.auth) ? `import { currentAuthUser } from "@getstrata/core/auth/authContext";
+import { resolveCsrfTokenForRequest } from "@getstrata/core/http/csrfToken";
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { EtaViewEngine, htmlResponse } from "@getstrata/core/view";
+import { starterAuthDirectory } from "../bootstrap/authDirectory.ts";
+` : `import { resolveCsrfTokenForRequest } from "@getstrata/core/http/csrfToken";
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { EtaViewEngine, htmlResponse } from "@getstrata/core/view";
+`;
+  const userBlock = authNeedsUsers(layers.auth) ? `  let currentUser: { id: number; email: string; name: string | null } | null = null;
+  const authUser = currentAuthUser();
+  if (authUser) {
+    try {
+      const row = await starterAuthDirectory.findByIdOrThrow(Number(authUser.id));
+      currentUser = { id: row.id, email: row.email ?? "", name: row.name ?? null };
+    } catch {
+      currentUser = null;
+    }
+  }` : `  const currentUser = null;`;
+  return `import { join } from "node:path";
+${authImport}
+const engine = new EtaViewEngine(join(import.meta.dir, "../../views"));
+
+export interface LayoutData {
+  title: string;
+  description?: string;
+}
+
+export async function renderPage(
+  template: string,
+  data: Record<string, unknown> & { layout: LayoutData },
+  request?: Request,
+  status = 200,
+): Promise<Response> {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = currentRequestMeta().flash ?? null;
+${userBlock}
+  const html = await engine.render(
+    template,
+    { ...data, csrfToken, flash, currentUser },
+    { request },
+  );
+  return htmlResponse(html, { status });
+}
+
+export function plainText(body: string, status = 200): Response {
+  return new Response(body, { status, headers: { "content-type": "text/plain; charset=utf-8" } });
+}
+`;
+}
+
+// ../strata-starter/src/renderScim.ts
+function ph2(layers, count, start = 1) {
+  if (layers.database === "postgres") {
+    return Array.from({ length: count }, (_, index) => `$${start + index}`).join(", ");
+  }
+  return Array.from({ length: count }, () => "?").join(", ");
+}
+function sqlFalse2(layers) {
+  return layers.database === "postgres" ? "false" : "0";
+}
+function renderScimModule(layers) {
+  if (!layers.extras.scim || !authNeedsUsers(layers.auth)) {
+    return null;
+  }
+  const tenantOn = usesTenantTable(layers.tenancy);
+  const insertCols = tenantOn ? "name, email, password, is_admin, tenant_id" : "name, email, password, is_admin";
+  const insertPh = tenantOn ? ph2(layers, 5) : ph2(layers, 4);
+  const insertTail = tenantOn ? `, ${sqlFalse2(layers)}, tenantId` : `, ${sqlFalse2(layers)}`;
+  const emailPh = ph2(layers, 1);
+  const idPh = ph2(layers, 1);
+  const updatePh = `${ph2(layers, 1)}, ${ph2(layers, 1, 2)}, ${ph2(layers, 1, 3)}`;
+  return `import { randomBytes } from "node:crypto";
+import type { AppModule } from "@getstrata/bootstrap/contracts";
+import { routeParams } from "@getstrata/bootstrap/web/routing";
+import { createScimAuthMiddleware } from "@getstrata/core/auth/scimAuthMiddleware";
+import { hashPassword } from "@getstrata/core/auth/password";
+import { withErrorHandling } from "@getstrata/core/http/response";
+import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
+import { createScimThrottleMiddleware } from "@getstrata/core/http/scimThrottleMiddleware";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
+import { getSql } from "../../bootstrap/database.ts";
+
+const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+const CONFIG_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
+
+type UserRow = { id: number; name: string; email: string };
+
+function scimEnabled(): boolean {
+  return (process.env.FEATURE_SCIM ?? "false") === "true";
+}
+
+function scimJson(body: unknown, status = 200): Response {
+  return Response.json(body, {
+    status,
+    headers: { "content-type": "application/scim+json" },
+  });
+}
+
+function scimError(detail: string, status: number): Response {
+  return scimJson({ schemas: [ERROR_SCHEMA], detail, status: String(status) }, status);
+}
+
+function toScimUser(row: UserRow) {
+  return {
+    schemas: [USER_SCHEMA],
+    id: String(row.id),
+    userName: row.email,
+    name: { formatted: row.name },
+    emails: [{ value: row.email, primary: true }],
+    active: true,
+    meta: { resourceType: "User" },
+  };
+}
+
+function readUserName(body: Record<string, unknown>): string {
+  const emails = body.emails;
+  if (Array.isArray(emails) && emails[0] && typeof emails[0] === "object") {
+    const value = (emails[0] as { value?: unknown }).value;
+    if (typeof value === "string" && value.trim()) {
+      return value.trim().toLowerCase();
+    }
+  }
+  return typeof body.userName === "string" ? body.userName.trim().toLowerCase() : "";
+}
+
+function readName(body: Record<string, unknown>, fallback: string): string {
+  const name = body.name;
+  if (name && typeof name === "object") {
+    const formatted = (name as { formatted?: unknown; givenName?: unknown; familyName?: unknown }).formatted;
+    if (typeof formatted === "string" && formatted.trim()) {
+      return formatted.trim();
+    }
+    const given = (name as { givenName?: unknown }).givenName;
+    const family = (name as { familyName?: unknown }).familyName;
+    const combined = [given, family].filter((part) => typeof part === "string").join(" ").trim();
+    if (combined) {
+      return combined;
+    }
+  }
+  if (typeof body.displayName === "string" && body.displayName.trim()) {
+    return body.displayName.trim();
+  }
+  return fallback;
+}
+
+function wrapScim(handler: (request: Request) => Promise<Response>) {
+  const throttle = createScimThrottleMiddleware({
+    redisUrl: process.env.REDIS_URL,
+    maxAttempts: 120,
+    decaySeconds: 60,
+  });
+  return withMiddleware(throttle, createScimAuthMiddleware())(
+    withErrorHandling(async (request) => {
+      if (!scimEnabled()) {
+        return scimError("SCIM is off.", 404);
+      }
+      return handler(request);
+    }),
+  );
+}
+
+const scimModule: AppModule = {
+  name: "scim",
+  order: 8,
+  routes({ kernel }) {
+    return {
+      "/scim/v2/ServiceProviderConfig": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async () =>
+            scimJson({
+              schemas: [CONFIG_SCHEMA],
+              patch: { supported: true },
+              bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+              filter: { supported: true, maxResults: 200 },
+              changePassword: { supported: false },
+              sort: { supported: false },
+              etag: { supported: false },
+              authenticationSchemes: [
+                {
+                  type: "oauthbearertoken",
+                  name: "OAuth Bearer Token",
+                  description: "Bearer token in the Authorization header.",
+                  specUri: "https://www.rfc-editor.org/rfc/rfc6750",
+                  primary: true,
+                },
+              ],
+            }),
+          ),
+        ),
+      },
+      "/scim/v2/Users": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const url = new URL(request.url);
+            const filter = url.searchParams.get("filter") ?? "";
+            const match = /userName\\s+eq\\s+"([^"]+)"/i.exec(filter);
+            let rows: UserRow[];
+            if (match?.[1]) {
+              rows = await getSql().unsafe<UserRow>(
+                "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+                [match[1].trim().toLowerCase()],
+              );
+            } else {
+              rows = await getSql().unsafe<UserRow>("SELECT id, name, email FROM users");
+            }
+            const startIndex = Math.max(1, Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10) || 1);
+            const count = Math.min(200, Math.max(1, Number.parseInt(url.searchParams.get("count") ?? String(rows.length || 1), 10) || 200));
+            const slice = rows.slice(startIndex - 1, startIndex - 1 + count);
+            return scimJson({
+              schemas: [LIST_SCHEMA],
+              totalResults: rows.length,
+              startIndex,
+              itemsPerPage: slice.length,
+              Resources: slice.map(toScimUser),
+            });
+          }),
+        ),
+        POST: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const body = (await request.json()) as Record<string, unknown>;
+            const email = readUserName(body);
+            const name = readName(body, email.split("@")[0] ?? "User");
+            if (!email) {
+              return scimError("userName is required.", 400);
+            }
+            const existing = await getSql().unsafe<UserRow>(
+              "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+              [email],
+            );
+            if (existing[0]) {
+              return scimError("User already exists.", 409);
+            }
+            const hashed = await hashPassword(randomBytes(18).toString("hex"));
+            const tenantId = currentTenant()?.id ?? 1;
+            await getSql().unsafe(
+              "INSERT INTO users (${insertCols}) VALUES (${insertPh})",
+              [name, email, hashed${insertTail}],
+            );
+            const created = await getSql().unsafe<UserRow>(
+              "SELECT id, name, email FROM users WHERE email = ${emailPh}",
+              [email],
+            );
+            const row = created[0];
+            if (!row) {
+              return scimError("Could not create user.", 500);
+            }
+            return scimJson(toScimUser(row), 201);
+          }),
+        ),
+      },
+      "/scim/v2/Users/:id": {
+        GET: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const rows = await getSql().unsafe<UserRow>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = rows[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            return scimJson(toScimUser(row));
+          }),
+        ),
+        PUT: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const body = (await request.json()) as Record<string, unknown>;
+            const email = readUserName(body);
+            const name = readName(body, email);
+            if (!email || !name) {
+              return scimError("userName and name are required.", 400);
+            }
+            await getSql().unsafe(
+              "UPDATE users SET name = ${updatePh.split(", ")[0]}, email = ${updatePh.split(", ")[1]} WHERE id = ${updatePh.split(", ")[2]}",
+              [name, email, id],
+            );
+            const rows = await getSql().unsafe<UserRow>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = rows[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            return scimJson(toScimUser(row));
+          }),
+        ),
+        PATCH: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            const existing = await getSql().unsafe<UserRow>(
+              "SELECT id, name, email FROM users WHERE id = ${idPh}",
+              [id],
+            );
+            const row = existing[0];
+            if (!row) {
+              return scimError("User not found.", 404);
+            }
+            const body = (await request.json()) as { schemas?: string[]; Operations?: Array<{ op?: string; path?: string; value?: unknown }> };
+            if (body.schemas && !body.schemas.includes(PATCH_SCHEMA)) {
+              return scimError("Unsupported patch schema.", 400);
+            }
+            let name = row.name;
+            let email = row.email;
+            for (const operation of body.Operations ?? []) {
+              const op = (operation.op ?? "replace").toLowerCase();
+              if (op !== "replace" && op !== "add") {
+                continue;
+              }
+              const path = (operation.path ?? "").toLowerCase();
+              if (path === "username" || path === "emails") {
+                email = String(operation.value ?? email).trim().toLowerCase();
+              } else if (path === "name.formatted" || path === "displayname" || path === "name") {
+                if (typeof operation.value === "string") {
+                  name = operation.value.trim() || name;
+                } else if (operation.value && typeof operation.value === "object") {
+                  name = readName({ name: operation.value as Record<string, unknown> }, name);
+                }
+              } else if (!path && operation.value && typeof operation.value === "object") {
+                const value = operation.value as Record<string, unknown>;
+                email = readUserName(value) || email;
+                name = readName(value, name);
+              }
+            }
+            await getSql().unsafe(
+              "UPDATE users SET name = ${updatePh.split(", ")[0]}, email = ${updatePh.split(", ")[1]} WHERE id = ${updatePh.split(", ")[2]}",
+              [name, email, id],
+            );
+            return scimJson(toScimUser({ id: row.id, name, email }));
+          }),
+        ),
+        DELETE: kernel.wrap(
+          "api",
+          wrapScim(async (request) => {
+            const id = Number.parseInt(routeParams(request).id ?? "", 10);
+            await getSql().unsafe("DELETE FROM users WHERE id = ${idPh}", [id]);
+            return new Response(null, { status: 204 });
+          }),
+        ),
+      },
+    };
+  },
+};
+
+export default scimModule;
+`;
+}
+
+// ../strata-starter/src/generate.ts
+var PROJECT_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]*$/i;
+function starterPackageRoot() {
+  return join2(import.meta.dir, "..");
+}
+function resolveTemplateRoot(root = starterPackageRoot()) {
+  const fromDist = join2(root, "templates");
+  if (existsSync2(join2(fromDist, "src"))) {
+    return fromDist;
+  }
+  const nested = join2(root, "dist/templates");
+  if (existsSync2(join2(nested, "src"))) {
+    return nested;
+  }
+  return fromDist;
+}
+function resolveOverlayRoot(root = starterPackageRoot()) {
+  const candidates = [
+    join2(root, "templates/overlays"),
+    join2(root, "dist/templates/overlays"),
+    join2(root, "../../templates/scaffold")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync2(join2(candidate, "server-htmx")) || existsSync2(join2(candidate, "spa-react")) || existsSync2(join2(candidate, "api"))) {
+      return candidate;
+    }
+  }
+  return candidates[0] ?? join2(root, "templates/overlays");
+}
+function assertProjectName(projectName) {
+  if (!PROJECT_NAME_PATTERN.test(projectName)) {
+    throw new Error("Project name must contain only letters, numbers, hyphens, and underscores.");
+  }
+}
+function resolveProjectTarget(rawTarget, cwd) {
+  const targetDir = resolve(cwd, rawTarget.trim());
+  const projectName = basename(targetDir);
+  assertProjectName(projectName);
+  return { projectName, targetDir };
+}
+function applyFrontendOverlays(overlayRoot, targetDir, layers) {
+  if (layers.frontend === "hybrid" || layers.frontend === "spa-react") {
+    copyOverlayTree(join2(overlayRoot, "spa-react"), targetDir);
+  }
+}
+function writeGeneratedFiles(options) {
+  const { targetDir, projectName, layers } = options;
+  const src = join2(targetDir, "src");
+  writeText(join2(targetDir, ".env.example"), renderEnvExample(projectName, layers));
+  writeText(join2(targetDir, ".gitignore"), renderGitignore());
+  writeText(join2(targetDir, "package.json"), renderPackageJson(projectName, { ...options, layers }));
+  writeText(join2(targetDir, "README.md"), renderReadme(projectName, layers));
+  if (layers.frontend === "api") {
+    writeText(join2(targetDir, "docs/API.md"), renderApiDocs(projectName, layers));
+  } else {
+    removeIfExists(join2(targetDir, "docs/API.md"));
+  }
+  writeText(join2(targetDir, "strata.layers.json"), renderLayersManifest(projectName, layers));
+  writeText(join2(targetDir, "Dockerfile"), renderDockerfile(layers));
+  writeText(join2(targetDir, ".dockerignore"), renderDockerignore(layers));
+  const compose = renderDockerCompose(projectName, layers);
+  if (compose) {
+    writeText(join2(targetDir, "docker-compose.yml"), compose);
+  } else {
+    removeIfExists(join2(targetDir, "docker-compose.yml"));
+  }
+  writeText(join2(src, "routes.ts"), renderRoutesTs());
+  writeText(join2(src, "lib/view.ts"), renderViewTs(layers));
+  writeText(join2(src, "bootstrap/config.ts"), renderConfigTs());
+  writeText(join2(src, "bootstrap/preload.ts"), renderPreloadTs(layers, projectName));
+  writeText(join2(src, "bootstrap/database.ts"), renderDatabaseTs(layers));
+  const ensureDatabase = renderEnsureDatabaseTs(layers, projectName);
+  if (ensureDatabase) {
+    writeText(join2(src, "bootstrap/ensureDatabase.ts"), ensureDatabase);
+  } else {
+    removeIfExists(join2(src, "bootstrap/ensureDatabase.ts"));
+  }
+  writeText(join2(src, "bootstrap/createApp.ts"), renderCreateAppTs(layers));
+  writeText(join2(src, "bootstrap/providers/config.ts"), renderConfigProvider(layers));
+  writeText(join2(src, "bootstrap/providers/queue.ts"), renderQueueProvider());
+  writeText(join2(src, "bootstrap/providers/index.ts"), renderProvidersIndex());
+  writeText(join2(src, "bootstrap/providers/auth.ts"), renderAuthProvider(layers));
+  writeText(join2(src, "db/migrate.ts"), renderMigrateTs(layers));
+  writeText(join2(src, "db/fresh.ts"), renderFreshTs(layers));
+  writeText(join2(src, "db/seed.ts"), renderSeedTs());
+  writeText(join2(src, "db/status.ts"), renderStatusTs(layers));
+  writeText(join2(src, "db/rollback.ts"), renderRollbackTs(layers));
+  writeText(join2(src, "modules/site/index.ts"), renderSiteModule(layers));
+  const directory = renderAuthDirectory(layers);
+  if (directory) {
+    writeText(join2(src, "bootstrap/authDirectory.ts"), directory);
+  }
+  const sidecars = renderSidecarsTs(layers);
+  if (sidecars) {
+    writeText(join2(src, "bootstrap/sidecars.ts"), sidecars);
+  }
+  const authModule = renderAuthModule(layers);
+  if (authModule) {
+    writeText(join2(src, "modules/auth/index.ts"), authModule);
+  }
+  const scimModule = renderScimModule(layers);
+  if (scimModule) {
+    writeText(join2(src, "modules/scim/index.ts"), scimModule);
+  } else {
+    removeIfExists(join2(src, "modules/scim/index.ts"));
+  }
+  if (layers.extras.mfa && htmlAuthKit(layers.auth)) {
+    writeText(join2(src, "bootstrap/pendingMfa.ts"), renderPendingMfaTs());
+  } else {
+    removeIfExists(join2(src, "bootstrap/pendingMfa.ts"));
+  }
+  writeText(join2(targetDir, "public/assets/site.css"), renderSiteCss());
+  writeText(join2(targetDir, "views/home.eta"), renderHomeView(projectName, layers));
+  writeText(join2(targetDir, "views/layouts/app.eta"), renderLayout(layers, projectName));
+  if (htmlAuthKit(layers.auth)) {
+    writeText(join2(targetDir, "views/auth/login.eta"), renderLoginView());
+    writeText(join2(targetDir, "views/auth/register.eta"), renderRegisterView());
+    writeText(join2(targetDir, "views/auth/forgot-password.eta"), renderForgotPasswordView());
+    writeText(join2(targetDir, "views/auth/reset-password.eta"), renderResetPasswordView());
+    if (layers.extras.emailVerification) {
+      writeText(join2(targetDir, "views/auth/verify-email.eta"), renderVerifyEmailView());
+    }
+    if (layers.extras.mfa) {
+      writeText(join2(targetDir, "views/auth/mfa-challenge.eta"), renderMfaChallengeView());
+      writeText(join2(targetDir, "views/auth/mfa-setup.eta"), renderMfaSetupView());
+    }
+  }
+  mkdirSync2(join2(targetDir, "storage"), { recursive: true });
+  writeText(join2(targetDir, "storage/.gitkeep"), "");
+}
+function printNextSteps(projectName, layers, compose, cdTarget = projectName) {
+  const dockerOn = selectedDockerServices(layers);
+  const neededTools = neededDockerServices(layers);
+  const localOn = neededTools.filter((name) => !dockerOn.includes(name));
+  const dockerSummary = dockerOn.length > 0 ? dockerOn.join("+") : neededTools.length === 0 ? "none" : "local";
+  console.log(`
+Created Strata app in ${projectName}/
+`);
+  console.log(`frontend=${layers.frontend}  db=${layers.database}  auth=${layers.auth}  docker=${dockerSummary}`);
+  console.log(`
+Next steps:`);
+  console.log(`  cd ${cdTarget}`);
+  console.log("  cp .env.example .env");
+  if (compose) {
+    console.log("  docker compose up -d");
+  }
+  if (dockerOn.includes("adminer")) {
+    console.log("  Adminer: http://localhost:8080");
+  }
+  if (localOn.length > 0) {
+    console.log(`  Point env at local ${localOn.join(", ")} (see README).`);
+  }
+  console.log("  bun install");
+  if (needsFrontendBuild(layers.frontend)) {
+    console.log("  bun run frontend:install");
+    console.log("  bun run frontend:build");
+  }
+  console.log("  bun run db:migrate");
+  console.log(`  bun run dev
+`);
+  console.log("The strata binary is local to the app, so use the bun run scripts above.");
+  console.log(`Run it directly with bunx strata <command> from inside the app directory.
+`);
+}
+function generateProject(options) {
+  assertProjectName(options.projectName);
+  if (existsSync2(options.targetDir)) {
+    if (!options.force) {
+      throw new Error(`Directory already exists: ${options.targetDir}`);
+    }
+    rmSync2(options.targetDir, { recursive: true, force: true });
+  }
+  copyTree(options.templateRoot, options.targetDir, options.projectName, new Set(["overlays"]));
+  applyFrontendOverlays(options.overlayRoot, options.targetDir, options.layers);
+  writeGeneratedFiles(options);
+}
+async function runCreateStrata(argv, cwd = process.cwd()) {
+  let flags;
+  try {
+    flags = parseCreateStrataArgs(argv);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : error);
+    return 1;
+  }
+  if (flags.help) {
+    console.log(usage());
+    return 0;
+  }
+  try {
+    const plan = await resolveStarterPlan(flags);
+    const { projectName, targetDir } = resolveProjectTarget(plan.projectName, cwd);
+    generateProject({
+      projectName,
+      targetDir,
+      layers: plan.layers,
+      templateRoot: resolveTemplateRoot(),
+      overlayRoot: resolveOverlayRoot(),
+      force: flags.force
+    });
+    printNextSteps(projectName, plan.layers, renderDockerCompose(projectName, plan.layers) !== null, plan.projectName);
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : error);
+    return 1;
+  }
+}
+
+// ../strata-starter/cli.ts
+var code = await runCreateStrata(process.argv.slice(2));
+process.exit(code);