Auth, security, migrations and tests come standard. One codebase, one test runner, one deploy target.
Raw SQL via tagged templates, migrations, seeds and fixtures. Data is resolved before the template renders, so there are no loading states.
Magic link or password, sessions and guest sessions, admin roles. Teams with email invites when you need them.
CSRF protection, rate limiting, CSP, HSTS and security headers by default. An optional proof-of-work captcha.
Templates are deterministic functions of their props, so they test without a headless browser. One runner, a real database.
Five layers of automated checks tell your agent it's wrong immediately, before you ever have to.
Everything agents get wrong by default is already in place and checked on every push. You review the product, not the plumbing.