create-efc-app 0.3.6 → 0.3.7

package/dist/index.js

@@ -19,7 +19,6 @@ async function scaffold(opts) {
   await writeGitignore(dest);
   await writeEnvFiles(dest, opts);
   await writeExampleRoute(dest, opts);
-  if (opts.rbac) await writeRequireRoleMiddleware(dest, opts);
   if (opts.userPortal) await writeUserModel(dest, opts);
   if (opts.adminPortal) await writeAdminModel(dest, opts);
   await writeAuthRoutes(dest, opts);
@@ -149,6 +148,7 @@ async function writeEnvFiles(dest, opts) {
   const resolvedPort = isGmail ? "465" : opts.smtpPort ?? "587";
   const passComment = isGmail ? " # Gmail App Password (16 chars) \u2014 NOT your regular Gmail password. Generate at: Google Account > Security > 2-Step Verification > App passwords" : "";
   const smtpVars = opts.mailer ? `
+APP_URL=http://localhost:3000
 SMTP_HOST=${resolvedHost}
 SMTP_PORT=${resolvedPort}
 SMTP_USER=${opts.smtpUser ?? ""}
@@ -156,6 +156,7 @@ SMTP_PASS=${opts.smtpPass ?? ""}${passComment}
 SMTP_FROM=${opts.smtpUser ?? "noreply@example.com"}
 ` : "";
   const smtpExample = opts.mailer ? `
+APP_URL=http://localhost:3000
 SMTP_HOST=${resolvedHost}
 SMTP_PORT=${resolvedPort}
 SMTP_USER=your@email.com
@@ -291,27 +292,42 @@ export interface UserDocument {
   avatar?: string;
   isVerified: boolean;
   isActive: boolean;
+  verifyToken?: string;
+  resetToken?: string;
+  resetTokenExpiry?: Date;
+  refreshToken?: string;
+  refreshTokenExpiry?: Date;
 }
 
 export const User = defineModel<UserDocument>('User', {
-  name:       { type: 'string',  required: true },
-  email:      { type: 'string',  required: true, unique: true },
-  password:   { type: 'string',  required: true },
-  role:       { type: 'string',  required: true, default: 'user' },
-  avatar:     { type: 'string' },
-  isVerified: { type: 'boolean', default: false },
-  isActive:   { type: 'boolean', default: true },
+  name:               { type: 'string',  required: true },
+  email:              { type: 'string',  required: true, unique: true },
+  password:           { type: 'string',  required: true },
+  role:               { type: 'string',  required: true, default: 'user' },
+  avatar:             { type: 'string' },
+  isVerified:         { type: 'boolean', default: false },
+  isActive:           { type: 'boolean', default: true },
+  verifyToken:        { type: 'string' },
+  resetToken:         { type: 'string' },
+  resetTokenExpiry:   { type: 'date' },
+  refreshToken:       { type: 'string' },
+  refreshTokenExpiry: { type: 'date' },
 });
 ` : `import { defineModel } from 'express-file-cluster';
 
 export const User = defineModel('User', {
-  name:       { type: 'string',  required: true },
-  email:      { type: 'string',  required: true, unique: true },
-  password:   { type: 'string',  required: true },
-  role:       { type: 'string',  required: true, default: 'user' },
-  avatar:     { type: 'string' },
-  isVerified: { type: 'boolean', default: false },
-  isActive:   { type: 'boolean', default: true },
+  name:               { type: 'string',  required: true },
+  email:              { type: 'string',  required: true, unique: true },
+  password:           { type: 'string',  required: true },
+  role:               { type: 'string',  required: true, default: 'user' },
+  avatar:             { type: 'string' },
+  isVerified:         { type: 'boolean', default: false },
+  isActive:           { type: 'boolean', default: true },
+  verifyToken:        { type: 'string' },
+  resetToken:         { type: 'string' },
+  resetTokenExpiry:   { type: 'date' },
+  refreshToken:       { type: 'string' },
+  refreshTokenExpiry: { type: 'date' },
 });
 ` : ts ? `// TODO: define your Drizzle schema for User
 // import { pgTable, serial, text, boolean, timestamp } from 'drizzle-orm/pg-core';
@@ -346,25 +362,37 @@ export interface AdminDocument {
   role: string;
   permissions: string[];
   isActive: boolean;
+  resetToken?: string;
+  resetTokenExpiry?: Date;
+  refreshToken?: string;
+  refreshTokenExpiry?: Date;
 }
 
 export const Admin = defineModel<AdminDocument>('Admin', {
-  name:        { type: 'string',  required: true },
-  email:       { type: 'string',  required: true, unique: true },
-  password:    { type: 'string',  required: true },
-  role:        { type: 'string',  required: true, default: 'admin' },
-  permissions: { type: 'array',   default: [] },
-  isActive:    { type: 'boolean', default: true },
+  name:               { type: 'string',  required: true },
+  email:              { type: 'string',  required: true, unique: true },
+  password:           { type: 'string',  required: true },
+  role:               { type: 'string',  required: true, default: 'admin' },
+  permissions:        { type: 'array',   default: [] },
+  isActive:           { type: 'boolean', default: true },
+  resetToken:         { type: 'string' },
+  resetTokenExpiry:   { type: 'date' },
+  refreshToken:       { type: 'string' },
+  refreshTokenExpiry: { type: 'date' },
 });
 ` : `import { defineModel } from 'express-file-cluster';
 
 export const Admin = defineModel('Admin', {
-  name:        { type: 'string',  required: true },
-  email:       { type: 'string',  required: true, unique: true },
-  password:    { type: 'string',  required: true },
-  role:        { type: 'string',  required: true, default: 'admin' },
-  permissions: { type: 'array',   default: [] },
-  isActive:    { type: 'boolean', default: true },
+  name:               { type: 'string',  required: true },
+  email:              { type: 'string',  required: true, unique: true },
+  password:           { type: 'string',  required: true },
+  role:               { type: 'string',  required: true, default: 'admin' },
+  permissions:        { type: 'array',   default: [] },
+  isActive:           { type: 'boolean', default: true },
+  resetToken:         { type: 'string' },
+  resetTokenExpiry:   { type: 'date' },
+  refreshToken:       { type: 'string' },
+  refreshTokenExpiry: { type: 'date' },
 });
 ` : ts ? `// TODO: define your Drizzle schema for Admin
 // import { pgTable, serial, text, boolean, timestamp } from 'drizzle-orm/pg-core';
@@ -405,15 +433,34 @@ export const meta: RouteMeta = {
 
 ` : "";
   const loginDbImports = opts.database === "mongodb" ? ts ? `import bcrypt from 'bcrypt';
+import crypto from 'node:crypto';
 import { User } from '../../model/User.js';
 import { Admin } from '../../model/Admin.js';
 ` : `import bcrypt from 'bcrypt';
+import crypto from 'node:crypto';
 import { User } from '../../model/User.js';
 import { Admin } from '../../model/Admin.js';
 ` : "";
   const loginContent = opts.database === "mongodb" ? ts ? `import { issueToken } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
-${loginDbImports}${loginMeta}export const POST = async (req: Request, res: Response) => {
+${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+
+async function issueRefreshToken(
+  res: Response,
+  model: { update: (id: string, data: Record<string, unknown>) => Promise<unknown> },
+  id: string,
+): Promise<void> {
+  const refreshToken = crypto.randomBytes(40).toString('hex');
+  await model.update(id, { refreshToken, refreshTokenExpiry: new Date(Date.now() + REFRESH_TOKEN_TTL_MS) });
+  res.cookie('efc_refresh_token', refreshToken, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    maxAge: REFRESH_TOKEN_TTL_MS,
+  });
+}
+
+export const POST = async (req: Request, res: Response) => {
   const { email, password } = req.body;
   if (!email || !password) return res.status(400).json({ error: 'email and password are required' });
 
@@ -423,6 +470,7 @@ ${loginDbImports}${loginMeta}export const POST = async (req: Request, res: Respo
     if (!match) return res.status(401).json({ error: 'Invalid credentials' });
     if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
     await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
+    await issueRefreshToken(res, Admin, admin.id);
     return res.json({ message: 'Logged in as admin' });
   }
 
@@ -432,10 +480,24 @@ ${loginDbImports}${loginMeta}export const POST = async (req: Request, res: Respo
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
   await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  await issueRefreshToken(res, User, user.id);
   res.json({ message: 'Logged in' });
 };
 ` : `import { issueToken } from 'express-file-cluster/auth';
-${loginDbImports}${loginMeta}export const POST = async (req, res) => {
+${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+
+async function issueRefreshToken(res, model, id) {
+  const refreshToken = crypto.randomBytes(40).toString('hex');
+  await model.update(id, { refreshToken, refreshTokenExpiry: new Date(Date.now() + REFRESH_TOKEN_TTL_MS) });
+  res.cookie('efc_refresh_token', refreshToken, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    maxAge: REFRESH_TOKEN_TTL_MS,
+  });
+}
+
+export const POST = async (req, res) => {
   const { email, password } = req.body;
   if (!email || !password) return res.status(400).json({ error: 'email and password are required' });
 
@@ -445,6 +507,7 @@ ${loginDbImports}${loginMeta}export const POST = async (req, res) => {
     if (!match) return res.status(401).json({ error: 'Invalid credentials' });
     if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
     await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
+    await issueRefreshToken(res, Admin, admin.id);
     return res.json({ message: 'Logged in as admin' });
   }
 
@@ -454,6 +517,7 @@ ${loginDbImports}${loginMeta}export const POST = async (req, res) => {
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
   await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  await issueRefreshToken(res, User, user.id);
   res.json({ message: 'Logged in' });
 };
 ` : ts ? `import { issueToken } from 'express-file-cluster/auth';
@@ -487,11 +551,13 @@ export const meta: RouteMeta = {
 import type { Request, Response } from 'express';
 ${logoutMeta}export const POST = async (_req: Request, res: Response) => {
   revokeToken(res);
+  res.clearCookie('efc_refresh_token');
   res.json({ message: 'Logged out successfully' });
 };
 ` : `import { revokeToken } from 'express-file-cluster/auth';
 ${logoutMeta}export const POST = async (_req, res) => {
   revokeToken(res);
+  res.clearCookie('efc_refresh_token');
   res.json({ message: 'Logged out successfully' });
 };
 `;
@@ -513,11 +579,20 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const registerDbImports = opts.database === "mongodb" ? ts ? `import bcrypt from 'bcrypt';
-import { User } from '../../model/User.js';
-` : `import bcrypt from 'bcrypt';
-import { User } from '../../model/User.js';
+  const registerDbImports = opts.database === "mongodb" ? `import bcrypt from 'bcrypt';
+import crypto from 'node:crypto';
+${opts.mailer ? "import { enqueue } from 'express-file-cluster/tasks';\n" : ""}import { User } from '../../model/User.js';
 ` : "";
+  const sendVerifyEmail = opts.mailer ? `
+  var appUrl = process.env.APP_URL || 'http://localhost:3000';
+  await enqueue('SendEmail', {
+    to: email,
+    subject: 'Verify your email address',
+    body: 'Welcome, ' + name + '! Verify your email: ' + appUrl + '/auth/verify-email?token=' + verifyToken,
+  });
+` : `
+  // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail
+`;
   const registerContent = opts.database === "mongodb" ? ts ? `import type { Request, Response } from 'express';
 ${registerDbImports}${registerMeta}export const POST = async (req: Request, res: Response) => {
   const { name, email, password } = req.body;
@@ -527,8 +602,10 @@ ${registerDbImports}${registerMeta}export const POST = async (req: Request, res:
   const existing = await User.findOne({ email });
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await bcrypt.hash(password, 10);
-  const user = await User.create({ name, email, password: hashed });
-  const { password: _, ...safe } = user;
+  const verifyToken = crypto.randomBytes(32).toString('hex');
+  const user = await User.create({ name, email, password: hashed, verifyToken });
+${sendVerifyEmail}
+  const { password: _, verifyToken: __, ...safe } = user;
   res.status(201).json({ message: 'Account created successfully', user: safe });
 };
 ` : `${registerDbImports}${registerMeta}export const POST = async (req, res) => {
@@ -539,8 +616,10 @@ ${registerDbImports}${registerMeta}export const POST = async (req: Request, res:
   const existing = await User.findOne({ email });
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await bcrypt.hash(password, 10);
-  const user = await User.create({ name, email, password: hashed });
-  const { password: _, ...safe } = user;
+  const verifyToken = crypto.randomBytes(32).toString('hex');
+  const user = await User.create({ name, email, password: hashed, verifyToken });
+${sendVerifyEmail}
+  const { password: _, verifyToken: __, ...safe } = user;
   res.status(201).json({ message: 'Account created successfully', user: safe });
 };
 ` : ts ? `import type { Request, Response } from 'express';
@@ -574,58 +653,28 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const requireRoleImport = opts.rbac ? ts ? `import { requireRole } from '../../middleware/requireRole.js';
-` : `import { requireRole } from '../../middleware/requireRole.js';
-` : "";
-  const meMiddlewares = opts.rbac ? `export const middlewares = [requireAuth, requireRole('user', 'admin')];
+  const meMiddlewares = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];
 
 ` : `export const middlewares = [requireAuth];
 
 `;
   const meContent = ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${meMeta}${meMiddlewares}export const GET = async (req: Request, res: Response) => {
   res.json({ user: (req as any).user });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}${meMeta}${meMiddlewares}export const GET = async (req, res) => {
+${meMeta}${meMiddlewares}export const GET = async (req, res) => {
   res.json({ user: req.user });
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", `register.${ext}`), registerContent);
   await fs.outputFile(path.join(dest, "src", "api", "auth", `me.${ext}`), meContent);
 }
-async function writeRequireRoleMiddleware(dest, opts) {
-  const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = opts.language === "typescript" ? `import type { Request, Response, NextFunction } from 'express';
-
-export function requireRole(...roles: string[]) {
-  return (req: Request, res: Response, next: NextFunction) => {
-    const user = (req as any).user;
-    if (!user) return res.status(401).json({ error: 'Unauthorized' });
-    if (!roles.includes(user.role)) return res.status(403).json({ error: 'Forbidden' });
-    next();
-  };
-}
-` : `export function requireRole(...roles) {
-  return (req, res, next) => {
-    const user = req.user;
-    if (!user) return res.status(401).json({ error: 'Unauthorized' });
-    if (!roles.includes(user.role)) return res.status(403).json({ error: 'Forbidden' });
-    next();
-  };
-}
-`;
-  await fs.outputFile(path.join(dest, "src", "middleware", `requireRole.${ext}`), content);
-}
 async function writeAdminRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
-  const requireRoleImport = opts.rbac ? `import { requireRole } from '../../middleware/requireRole.js';
-` : "";
-  const usersRequireRoleImport = opts.rbac ? `import { requireRole } from '../../../middleware/requireRole.js';
-` : "";
-  const middlewares = opts.rbac ? `export const middlewares = [requireAuth, requireRole('admin')];
+  const middlewares = opts.rbac ? `export const middlewares = [requireAuth('admin')];
 ` : `export const middlewares = [requireAuth];
 `;
   const roleGuard = opts.rbac ? "" : ts ? `  const user = (req as any).user;
@@ -655,7 +704,7 @@ export const meta: RouteMeta = {
   const dashboardDbImport = opts.database === "mongodb" ? `import { User } from '../../model/User.js';
 ` : "";
   const dashboardContent = opts.database === "mongodb" ? ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${dashboardDbImport}${dashboardMeta}${middlewares}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  const [totalUsers, activeUsers, verifiedUsers] = await Promise.all([
@@ -666,7 +715,7 @@ ${roleGuard}  const [totalUsers, activeUsers, verifiedUsers] = await Promise.all
   res.json({ stats: { totalUsers, activeUsers, verifiedUsers } });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}${dashboardDbImport}${dashboardMeta}${middlewares}
+${dashboardDbImport}${dashboardMeta}${middlewares}
 export const GET = async (_req, res) => {
 ${roleGuard}  const [totalUsers, activeUsers, verifiedUsers] = await Promise.all([
     User.count({}),
@@ -676,14 +725,14 @@ ${roleGuard}  const [totalUsers, activeUsers, verifiedUsers] = await Promise.all
   res.json({ stats: { totalUsers, activeUsers, verifiedUsers } });
 };
 ` : ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${dashboardMeta}${middlewares}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: aggregate stats from DB
   res.json({ stats: { users: 0 } });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}${dashboardMeta}${middlewares}
+${dashboardMeta}${middlewares}
 export const GET = async (_req, res) => {
 ${roleGuard}  // TODO: aggregate stats from DB
   res.json({ stats: { users: 0 } });
@@ -709,7 +758,7 @@ import { User } from '../../../model/User.js';
 import { User } from '../../../model/User.js';
 ` : "";
   const usersListContent = opts.database === "mongodb" ? ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${usersRequireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${adminUsersDbImport}${usersListMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
@@ -730,7 +779,7 @@ ${roleGuard}  const { name, email, password, role } = req.body;
   res.status(201).json({ message: 'User created', user: safe });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${usersRequireRoleImport}${adminUsersDbImport}${usersListMeta}${middlewares}
+${adminUsersDbImport}${usersListMeta}${middlewares}
 export const GET = async (req, res) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
   const limit = Math.min(100, Number(req.query.limit) || 20);
@@ -750,7 +799,7 @@ ${roleGuard}  const { name, email, password, role } = req.body;
   res.status(201).json({ message: 'User created', user: safe });
 };
 ` : ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${usersRequireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${usersListMeta}${middlewares}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: fetch users from DB with pagination
@@ -764,7 +813,7 @@ ${roleGuard}  const { name, email, role } = req.body;
   res.status(201).json({ message: 'User created', user: { id: 'new-id', name, email, role: role ?? 'user' } });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${usersRequireRoleImport}${usersListMeta}${middlewares}
+${usersListMeta}${middlewares}
 export const GET = async (_req, res) => {
 ${roleGuard}  // TODO: fetch users from DB with pagination
   res.json({ users: [], total: 0 });
@@ -792,7 +841,7 @@ export const meta: RouteMeta = {
   const adminUserByIdDbImport = opts.database === "mongodb" ? `import { User } from '../../../model/User.js';
 ` : "";
   const userByIdContent = opts.database === "mongodb" ? ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${usersRequireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${adminUserByIdDbImport}${userByIdMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -819,7 +868,7 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: \`User \${id} deleted\` });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${usersRequireRoleImport}${adminUserByIdDbImport}${userByIdMeta}${middlewares}
+${adminUserByIdDbImport}${userByIdMeta}${middlewares}
 export const GET = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   const user = await User.findById(id);
@@ -845,7 +894,7 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: \`User \${id} deleted\` });
 };
 ` : ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${usersRequireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${userByIdMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -865,7 +914,7 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: \`User \${id} deleted\` });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${usersRequireRoleImport}${userByIdMeta}${middlewares}
+${userByIdMeta}${middlewares}
 export const GET = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   // TODO: fetch user from DB
@@ -889,9 +938,7 @@ ${roleGuard}  const { id } = req.params;
 async function writeUserRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
-  const requireRoleImport = opts.rbac ? `import { requireRole } from '../../middleware/requireRole.js';
-` : "";
-  const middlewares = opts.rbac ? `export const middlewares = [requireAuth, requireRole('user', 'admin')];
+  const middlewares = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];
 ` : `export const middlewares = [requireAuth];
 `;
   const profileMeta = opts.routeDocs ? ts ? `import type { RouteMeta } from 'express-file-cluster';
@@ -910,7 +957,7 @@ export const meta: RouteMeta = {
   const profileDbImport = opts.database === "mongodb" ? `import { User } from '../../model/User.js';
 ` : "";
   const profileContent = opts.database === "mongodb" ? ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${profileDbImport}${profileMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
   const { id } = (req as any).user;
@@ -929,7 +976,7 @@ export const PUT = async (req: Request, res: Response) => {
   res.json({ message: 'Profile updated', user: safe });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}${profileDbImport}${profileMeta}${middlewares}
+${profileDbImport}${profileMeta}${middlewares}
 export const GET = async (req, res) => {
   const { id } = req.user;
   const user = await User.findById(id);
@@ -947,7 +994,7 @@ export const PUT = async (req, res) => {
   res.json({ message: 'Profile updated', user: safe });
 };
 ` : ts ? `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}import type { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 ${profileMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
   res.json({ user: (req as any).user });
@@ -959,7 +1006,7 @@ export const PUT = async (req: Request, res: Response) => {
   res.json({ message: 'Profile updated', user: { ...(req as any).user, name, email } });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
-${requireRoleImport}${profileMeta}${middlewares}
+${profileMeta}${middlewares}
 export const GET = async (req, res) => {
   res.json({ user: req.user });
 };
@@ -1700,11 +1747,7 @@ export {};
 async function writeAuthExtendedRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
-  const rr2 = opts.rbac ? `import { requireRole } from '../../middleware/requireRole.js';
-` : "";
-  const rr3 = opts.rbac ? `import { requireRole } from '../../../middleware/requireRole.js';
-` : "";
-  const mwUser2 = opts.rbac ? `export const middlewares = [requireAuth, requireRole('user', 'admin')];
+  const mwUser2 = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];
 ` : `export const middlewares = [requireAuth];
 `;
   const mwUser3 = mwUser2;
@@ -1712,8 +1755,94 @@ async function writeAuthExtendedRoutes(dest, opts) {
 ` : "";
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
+  const mongo = opts.database === "mongodb";
+  const sendResetEmail = opts.mailer ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
+    await enqueue('SendEmail', {
+      to: email,
+      subject: 'Reset your password',
+      body: 'Reset your password: ' + appUrl + '/auth/reset-password?token=' + resetToken,
+    });
+` : `    // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail
+`;
+  const sendVerifyEmailResend = opts.mailer ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
+    await enqueue('SendEmail', {
+      to: email,
+      subject: 'Verify your email address',
+      body: 'Verify your email: ' + appUrl + '/auth/verify-email?token=' + verifyToken,
+    });
+` : `    // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail
+`;
+  const mailerTaskImport = opts.mailer ? `import { enqueue } from 'express-file-cluster/tasks';
+` : "";
   const refreshMeta = mkMeta(opts, "Refresh the JWT and issue a new token.", `{ message: 'Token refreshed' }`);
-  const refreshContent = ts ? `${RA}import type { Request, Response } from 'express';
+  const refreshContent = mongo ? ts ? `import { issueToken } from 'express-file-cluster/auth';
+import type { Request, Response } from 'express';
+import crypto from 'node:crypto';
+import { User } from '../../model/User.js';
+import { Admin } from '../../model/Admin.js';
+${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+
+export const POST = async (req: Request, res: Response) => {
+  const token = req.cookies?.['efc_refresh_token'] || req.body?.refreshToken;
+  if (!token) return res.status(401).json({ error: 'Refresh token required' });
+
+  const user = await User.findOne({ refreshToken: token });
+  const admin = user ? null : await Admin.findOne({ refreshToken: token });
+  const account = user || admin;
+
+  if (!account || !account.refreshTokenExpiry || new Date(account.refreshTokenExpiry) < new Date()) {
+    return res.status(401).json({ error: 'Invalid or expired refresh token' });
+  }
+
+  const newRefreshToken = crypto.randomBytes(40).toString('hex');
+  const refreshTokenExpiry = new Date(Date.now() + REFRESH_TOKEN_TTL_MS);
+  if (user) await User.update(user.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
+  else if (admin) await Admin.update(admin.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
+
+  res.cookie('efc_refresh_token', newRefreshToken, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    maxAge: REFRESH_TOKEN_TTL_MS,
+  });
+
+  await issueToken(res, { id: account.id, role: account.role, email: account.email });
+  res.json({ message: 'Token refreshed' });
+};
+` : `import { issueToken } from 'express-file-cluster/auth';
+import crypto from 'node:crypto';
+import { User } from '../../model/User.js';
+import { Admin } from '../../model/Admin.js';
+${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+
+export const POST = async (req, res) => {
+  const token = req.cookies?.efc_refresh_token || req.body?.refreshToken;
+  if (!token) return res.status(401).json({ error: 'Refresh token required' });
+
+  const user = await User.findOne({ refreshToken: token });
+  const admin = user ? null : await Admin.findOne({ refreshToken: token });
+  const account = user || admin;
+
+  if (!account || !account.refreshTokenExpiry || new Date(account.refreshTokenExpiry) < new Date()) {
+    return res.status(401).json({ error: 'Invalid or expired refresh token' });
+  }
+
+  const newRefreshToken = crypto.randomBytes(40).toString('hex');
+  const refreshTokenExpiry = new Date(Date.now() + REFRESH_TOKEN_TTL_MS);
+  if (user) await User.update(user.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
+  else if (admin) await Admin.update(admin.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
+
+  res.cookie('efc_refresh_token', newRefreshToken, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    maxAge: REFRESH_TOKEN_TTL_MS,
+  });
+
+  await issueToken(res, { id: account.id, role: account.role, email: account.email });
+  res.json({ message: 'Token refreshed' });
+};
+` : ts ? `${RA}import type { Request, Response } from 'express';
 ${refreshMeta}export const POST = async (_req: Request, res: Response) => {
   // TODO: validate refresh token, issue new JWT
   res.json({ message: 'Token refreshed' });
@@ -1725,7 +1854,58 @@ ${refreshMeta}export const POST = async (_req: Request, res: Response) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", `refresh.${ext}`), refreshContent);
   const veMeta = mkMeta(opts, "Verify email address via token or resend verification email.", `{ message: 'Email verified' }`);
-  const veContent = ts ? `${RA}import type { Request, Response } from 'express';
+  const veContent = mongo ? ts ? `import type { Request, Response } from 'express';
+import crypto from 'node:crypto';
+${mailerTaskImport}import { User } from '../../model/User.js';
+${veMeta}export const GET = async (req: Request, res: Response) => {
+  const { token } = req.query;
+  if (!token || typeof token !== 'string') return res.status(400).json({ error: 'token is required' });
+
+  const user = await User.findOne({ verifyToken: token });
+  if (!user) return res.status(400).json({ error: 'Invalid or expired verification token' });
+
+  await User.update(user.id, { isVerified: true, verifyToken: '' });
+  res.json({ message: 'Email verified' });
+};
+
+export const POST = async (req: Request, res: Response) => {
+  const { email } = req.body;
+  if (!email) return res.status(400).json({ error: 'email is required' });
+
+  const user = await User.findOne({ email });
+  if (user && !user.isVerified) {
+    const verifyToken = crypto.randomBytes(32).toString('hex');
+    await User.update(user.id, { verifyToken });
+${sendVerifyEmailResend}  }
+
+  res.json({ message: 'Verification email sent' });
+};
+` : `import crypto from 'node:crypto';
+${mailerTaskImport}import { User } from '../../model/User.js';
+${veMeta}export const GET = async (req, res) => {
+  const { token } = req.query;
+  if (!token || typeof token !== 'string') return res.status(400).json({ error: 'token is required' });
+
+  const user = await User.findOne({ verifyToken: token });
+  if (!user) return res.status(400).json({ error: 'Invalid or expired verification token' });
+
+  await User.update(user.id, { isVerified: true, verifyToken: '' });
+  res.json({ message: 'Email verified' });
+};
+
+export const POST = async (req, res) => {
+  const { email } = req.body;
+  if (!email) return res.status(400).json({ error: 'email is required' });
+
+  const user = await User.findOne({ email });
+  if (user && !user.isVerified) {
+    const verifyToken = crypto.randomBytes(32).toString('hex');
+    await User.update(user.id, { verifyToken });
+${sendVerifyEmailResend}  }
+
+  res.json({ message: 'Verification email sent' });
+};
+` : ts ? `${RA}import type { Request, Response } from 'express';
 ${veMeta}export const GET = async (req: Request, res: Response) => {
   const { token } = req.query;
   // TODO: verify token and mark user as verified
@@ -1749,7 +1929,54 @@ export const POST = async (_req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", `verify-email.${ext}`), veContent);
   const fpMeta = mkMeta(opts, "Send a password reset email to the given address.", `{ message: 'Reset email sent' }`, `{ email: 'user@example.com' }`);
-  const fpContent = ts ? `${RA}import type { Request, Response } from 'express';
+  const fpContent = mongo ? ts ? `import type { Request, Response } from 'express';
+import crypto from 'node:crypto';
+${mailerTaskImport}import { User } from '../../model/User.js';
+import { Admin } from '../../model/Admin.js';
+${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
+
+export const POST = async (req: Request, res: Response) => {
+  const { email } = req.body;
+  if (!email) return res.status(400).json({ error: 'email is required' });
+
+  const user = await User.findOne({ email });
+  const admin = user ? null : await Admin.findOne({ email });
+
+  // Always respond the same way whether or not the account exists, so this
+  // endpoint can't be used to enumerate registered emails.
+  if (user || admin) {
+    const resetToken = crypto.randomBytes(32).toString('hex');
+    const resetTokenExpiry = new Date(Date.now() + RESET_TOKEN_TTL_MS);
+    if (user) await User.update(user.id, { resetToken, resetTokenExpiry });
+    else if (admin) await Admin.update(admin.id, { resetToken, resetTokenExpiry });
+${sendResetEmail}  }
+
+  res.json({ message: 'Reset email sent' });
+};
+` : `import crypto from 'node:crypto';
+${mailerTaskImport}import { User } from '../../model/User.js';
+import { Admin } from '../../model/Admin.js';
+${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
+
+export const POST = async (req, res) => {
+  const { email } = req.body;
+  if (!email) return res.status(400).json({ error: 'email is required' });
+
+  const user = await User.findOne({ email });
+  const admin = user ? null : await Admin.findOne({ email });
+
+  // Always respond the same way whether or not the account exists, so this
+  // endpoint can't be used to enumerate registered emails.
+  if (user || admin) {
+    const resetToken = crypto.randomBytes(32).toString('hex');
+    const resetTokenExpiry = new Date(Date.now() + RESET_TOKEN_TTL_MS);
+    if (user) await User.update(user.id, { resetToken, resetTokenExpiry });
+    else if (admin) await Admin.update(admin.id, { resetToken, resetTokenExpiry });
+${sendResetEmail}  }
+
+  res.json({ message: 'Reset email sent' });
+};
+` : ts ? `${RA}import type { Request, Response } from 'express';
 ${fpMeta}export const POST = async (req: Request, res: Response) => {
   const { email } = req.body;
   if (!email) return res.status(400).json({ error: 'email is required' });
@@ -1765,7 +1992,50 @@ ${fpMeta}export const POST = async (req: Request, res: Response) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", `forgot-password.${ext}`), fpContent);
   const rpMeta = mkMeta(opts, "Reset password using a valid reset token.", `{ message: 'Password reset successfully' }`, `{ token: 'reset-token', password: 'newpassword' }`);
-  const rpContent = ts ? `${RA}import type { Request, Response } from 'express';
+  const rpContent = mongo ? ts ? `import type { Request, Response } from 'express';
+import bcrypt from 'bcrypt';
+import { User } from '../../model/User.js';
+import { Admin } from '../../model/Admin.js';
+${rpMeta}export const POST = async (req: Request, res: Response) => {
+  const { token, password } = req.body;
+  if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
+
+  const user = await User.findOne({ resetToken: token });
+  const admin = user ? null : await Admin.findOne({ resetToken: token });
+  const account = user || admin;
+
+  if (!account || !account.resetTokenExpiry || new Date(account.resetTokenExpiry) < new Date()) {
+    return res.status(400).json({ error: 'Invalid or expired reset token' });
+  }
+
+  const hashed = await bcrypt.hash(password, 10);
+  if (user) await User.update(user.id, { password: hashed, resetToken: '' });
+  else if (admin) await Admin.update(admin.id, { password: hashed, resetToken: '' });
+
+  res.json({ message: 'Password reset successfully' });
+};
+` : `import bcrypt from 'bcrypt';
+import { User } from '../../model/User.js';
+import { Admin } from '../../model/Admin.js';
+${rpMeta}export const POST = async (req, res) => {
+  const { token, password } = req.body;
+  if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
+
+  const user = await User.findOne({ resetToken: token });
+  const admin = user ? null : await Admin.findOne({ resetToken: token });
+  const account = user || admin;
+
+  if (!account || !account.resetTokenExpiry || new Date(account.resetTokenExpiry) < new Date()) {
+    return res.status(400).json({ error: 'Invalid or expired reset token' });
+  }
+
+  const hashed = await bcrypt.hash(password, 10);
+  if (user) await User.update(user.id, { password: hashed, resetToken: '' });
+  else if (admin) await Admin.update(admin.id, { password: hashed, resetToken: '' });
+
+  res.json({ message: 'Password reset successfully' });
+};
+` : ts ? `${RA}import type { Request, Response } from 'express';
 ${rpMeta}export const POST = async (req: Request, res: Response) => {
   const { token, password } = req.body;
   if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
@@ -1781,7 +2051,7 @@ ${rpMeta}export const POST = async (req: Request, res: Response) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", `reset-password.${ext}`), rpContent);
   const cpMeta = mkMeta(opts, "Change password for the authenticated user.", `{ message: 'Password changed successfully' }`, `{ oldPassword: 'current', newPassword: 'newpassword' }`);
-  const cpContent = ts ? `${RA}${rr2}import type { Request, Response } from 'express';
+  const cpContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${cpMeta}${mwUser2}
 export const POST = async (req: Request, res: Response) => {
   const { oldPassword, newPassword } = req.body;
@@ -1789,7 +2059,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: verify old password, hash and update new password
   res.json({ message: 'Password changed successfully' });
 };
-` : `${RA}${rr2}${cpMeta}${mwUser2}
+` : `${RA}${cpMeta}${mwUser2}
 export const POST = async (req, res) => {
   const { oldPassword, newPassword } = req.body;
   if (!oldPassword || !newPassword) return res.status(400).json({ error: 'oldPassword and newPassword are required' });
@@ -1799,7 +2069,7 @@ export const POST = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", `change-password.${ext}`), cpContent);
   const tfaSetupMeta = mkMeta(opts, "Get 2FA QR code (GET) or enable 2FA with a verified TOTP code (POST).", `{ message: '2FA enabled' }`);
-  const tfaSetupContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const tfaSetupContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${tfaSetupMeta}${mwUser3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: generate TOTP secret and return QR code URL
@@ -1812,7 +2082,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: verify TOTP code and enable 2FA
   res.json({ message: '2FA enabled' });
 };
-` : `${RA}${rr3}${tfaSetupMeta}${mwUser3}
+` : `${RA}${tfaSetupMeta}${mwUser3}
 export const GET = async (req, res) => {
   // TODO: generate TOTP secret and return QR code URL
   res.json({ qrCode: 'otpauth://totp/...', secret: 'BASE32SECRET' });
@@ -1843,7 +2113,7 @@ ${tfaVerifyMeta}export const POST = async (req: Request, res: Response) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", "2fa", `verify.${ext}`), tfaVerifyContent);
   const tfaDisableMeta = mkMeta(opts, "Disable 2FA for the authenticated user.", `{ message: '2FA disabled' }`);
-  const tfaDisableContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const tfaDisableContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${tfaDisableMeta}${mwUser3}
 export const POST = async (req: Request, res: Response) => {
   const { code } = req.body;
@@ -1851,7 +2121,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: verify code and disable 2FA
   res.json({ message: '2FA disabled' });
 };
-` : `${RA}${rr3}${tfaDisableMeta}${mwUser3}
+` : `${RA}${tfaDisableMeta}${mwUser3}
 export const POST = async (req, res) => {
   const { code } = req.body;
   if (!code) return res.status(400).json({ error: 'code is required' });
@@ -1861,27 +2131,27 @@ export const POST = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", "2fa", `disable.${ext}`), tfaDisableContent);
   const sessListMeta = mkMeta(opts, "List all active sessions for the authenticated user.", `{ sessions: [] }`);
-  const sessListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const sessListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${sessListMeta}${mwUser3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch sessions for req.user.id
   res.json({ sessions: [] });
 };
-` : `${RA}${rr3}${sessListMeta}${mwUser3}
+` : `${RA}${sessListMeta}${mwUser3}
 export const GET = async (req, res) => {
   // TODO: fetch sessions for req.user.id
   res.json({ sessions: [] });
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", "sessions", `index.${ext}`), sessListContent);
-  const sessRevokeContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const sessRevokeContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwUser3}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
   // TODO: revoke session by id
   res.json({ message: \`Session \${id} revoked\` });
 };
-` : `${RA}${rr3}${mwUser3}
+` : `${RA}${mwUser3}
 export const DELETE = async (req, res) => {
   const { id } = req.params;
   // TODO: revoke session by id
@@ -1893,11 +2163,7 @@ export const DELETE = async (req, res) => {
 async function writeUserExtendedRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
-  const rr2 = opts.rbac ? `import { requireRole } from '../../middleware/requireRole.js';
-` : "";
-  const rr3 = opts.rbac ? `import { requireRole } from '../../../middleware/requireRole.js';
-` : "";
-  const mw2 = opts.rbac ? `export const middlewares = [requireAuth, requireRole('user', 'admin')];
+  const mw2 = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];
 ` : `export const middlewares = [requireAuth];
 `;
   const mw3 = mw2;
@@ -1905,7 +2171,7 @@ async function writeUserExtendedRoutes(dest, opts) {
 `;
   const user = ts ? `(req as any).user` : `req.user`;
   const avatarMeta = mkMeta(opts, "Upload (POST) or remove (DELETE) the authenticated user avatar.", `{ message: 'Avatar updated', url: 'https://...' }`);
-  const avatarContent = ts ? `${RA}${rr2}import type { Request, Response } from 'express';
+  const avatarContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${avatarMeta}${mw2}
 export const POST = async (req: Request, res: Response) => {
   // TODO: handle multipart upload, store file, update user.avatar
@@ -1916,7 +2182,7 @@ export const DELETE = async (req: Request, res: Response) => {
   // TODO: remove avatar and clear user.avatar
   res.json({ message: 'Avatar removed' });
 };
-` : `${RA}${rr2}${avatarMeta}${mw2}
+` : `${RA}${avatarMeta}${mw2}
 export const POST = async (req, res) => {
   // TODO: handle multipart upload, store file, update user.avatar
   res.json({ message: 'Avatar updated', url: 'https://example.com/avatar.jpg' });
@@ -1929,7 +2195,7 @@ export const DELETE = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", `avatar.${ext}`), avatarContent);
   const settingsMeta = mkMeta(opts, "Get or update account settings (notifications, language, theme, privacy).", `{ settings: { notifications: true, language: 'en', theme: 'system' } }`);
-  const settingsContent = ts ? `${RA}${rr2}import type { Request, Response } from 'express';
+  const settingsContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${settingsMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch user settings from DB
@@ -1941,7 +2207,7 @@ export const PUT = async (req: Request, res: Response) => {
   // TODO: update user settings in DB
   res.json({ message: 'Settings updated', settings: { notifications, language, theme, privacy } });
 };
-` : `${RA}${rr2}${settingsMeta}${mw2}
+` : `${RA}${settingsMeta}${mw2}
 export const GET = async (req, res) => {
   // TODO: fetch user settings from DB
   res.json({ settings: { notifications: true, language: 'en', theme: 'system', privacy: 'public' } });
@@ -1955,7 +2221,7 @@ export const PUT = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", `settings.${ext}`), settingsContent);
   const accountMeta = mkMeta(opts, "Delete account (DELETE) or download personal data (GET).", `{ message: 'Account deleted' }`);
-  const accountContent = ts ? `${RA}${rr2}import type { Request, Response } from 'express';
+  const accountContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${accountMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   // TODO: compile and return personal data export
@@ -1968,7 +2234,7 @@ export const DELETE = async (req: Request, res: Response) => {
   // TODO: verify password, schedule account deletion
   res.json({ message: 'Account scheduled for deletion' });
 };
-` : `${RA}${rr2}${accountMeta}${mw2}
+` : `${RA}${accountMeta}${mw2}
 export const GET = async (req, res) => {
   // TODO: compile and return personal data export
   res.json({ data: { user: ${user}, exportedAt: new Date().toISOString() } });
@@ -1983,13 +2249,13 @@ export const DELETE = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", `account.${ext}`), accountContent);
   const dashMeta = mkMeta(opts, "Personal dashboard: stats, recent activity, and quick actions.", `{ stats: {}, recentActivity: [], quickActions: [] }`);
-  const dashContent = ts ? `${RA}${rr2}import type { Request, Response } from 'express';
+  const dashContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${dashMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   // TODO: aggregate personal stats and activity
   res.json({ stats: {}, recentActivity: [], quickActions: [] });
 };
-` : `${RA}${rr2}${dashMeta}${mw2}
+` : `${RA}${dashMeta}${mw2}
 export const GET = async (req, res) => {
   // TODO: aggregate personal stats and activity
   res.json({ stats: {}, recentActivity: [], quickActions: [] });
@@ -1997,14 +2263,14 @@ export const GET = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", `dashboard.${ext}`), dashContent);
   const actMeta = mkMeta(opts, "Paginated activity history for the authenticated user.", `{ activities: [], total: 0, page: 1, limit: 20 }`);
-  const actContent = ts ? `${RA}${rr2}import type { Request, Response } from 'express';
+  const actContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${actMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   const { page = 1, limit = 20 } = req.query;
   // TODO: fetch paginated activity log
   res.json({ activities: [], total: 0, page: Number(page), limit: Number(limit) });
 };
-` : `${RA}${rr2}${actMeta}${mw2}
+` : `${RA}${actMeta}${mw2}
 export const GET = async (req, res) => {
   const { page = 1, limit = 20 } = req.query;
   // TODO: fetch paginated activity log
@@ -2013,7 +2279,7 @@ export const GET = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", `activity.${ext}`), actContent);
   const notifListMeta = mkMeta(opts, "List notifications (GET) or mark all as read (POST).", `{ notifications: [], total: 0, unread: 0 }`);
-  const notifListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const notifListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${notifListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch notifications for user
@@ -2024,7 +2290,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: mark all notifications as read
   res.json({ message: 'All notifications marked as read' });
 };
-` : `${RA}${rr3}${notifListMeta}${mw3}
+` : `${RA}${notifListMeta}${mw3}
 export const GET = async (req, res) => {
   // TODO: fetch notifications for user
   res.json({ notifications: [], total: 0, unread: 0 });
@@ -2036,7 +2302,7 @@ export const POST = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "notifications", `index.${ext}`), notifListContent);
-  const notifByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const notifByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw3}
 export const GET = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2055,7 +2321,7 @@ export const DELETE = async (req: Request, res: Response) => {
   // TODO: delete notification
   res.json({ message: \`Notification \${id} deleted\` });
 };
-` : `${RA}${rr3}${mw3}
+` : `${RA}${mw3}
 export const GET = async (req, res) => {
   const { id } = req.params;
   // TODO: fetch notification by id
@@ -2076,7 +2342,7 @@ export const DELETE = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "notifications", `[id].${ext}`), notifByIdContent);
   const filesListMeta = mkMeta(opts, "List uploaded files with storage usage (GET) or upload a new file (POST).", `{ files: [], total: 0, storageUsed: 0 }`);
-  const filesListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const filesListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${filesListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch user files and compute storage usage
@@ -2087,7 +2353,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: handle multipart upload, persist file record
   res.status(201).json({ message: 'File uploaded', file: { id: 'new-id' } });
 };
-` : `${RA}${rr3}${filesListMeta}${mw3}
+` : `${RA}${filesListMeta}${mw3}
 export const GET = async (req, res) => {
   // TODO: fetch user files and compute storage usage
   res.json({ files: [], total: 0, storageUsed: 0 });
@@ -2099,7 +2365,7 @@ export const POST = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "files", `index.${ext}`), filesListContent);
-  const fileByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const fileByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw3}
 export const GET = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2112,7 +2378,7 @@ export const DELETE = async (req: Request, res: Response) => {
   // TODO: delete file from storage and DB
   res.json({ message: \`File \${id} deleted\` });
 };
-` : `${RA}${rr3}${mw3}
+` : `${RA}${mw3}
 export const GET = async (req, res) => {
   const { id } = req.params;
   // TODO: stream or redirect to file download/preview URL
@@ -2126,7 +2392,7 @@ export const DELETE = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "files", `[id].${ext}`), fileByIdContent);
-  const favListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const favListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch user favorites
@@ -2139,7 +2405,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: add to favorites
   res.status(201).json({ message: 'Added to favorites' });
 };
-` : `${RA}${rr3}${mw3}
+` : `${RA}${mw3}
 export const GET = async (req, res) => {
   // TODO: fetch user favorites
   res.json({ favorites: [] });
@@ -2153,14 +2419,14 @@ export const POST = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "favorites", `index.${ext}`), favListContent);
-  const favByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const favByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw3}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
   // TODO: remove from favorites
   res.json({ message: \`Removed favorite \${id}\` });
 };
-` : `${RA}${rr3}${mw3}
+` : `${RA}${mw3}
 export const DELETE = async (req, res) => {
   const { id } = req.params;
   // TODO: remove from favorites
@@ -2168,7 +2434,7 @@ export const DELETE = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "favorites", `[id].${ext}`), favByIdContent);
-  const bkListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const bkListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch user bookmarks
@@ -2181,7 +2447,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: save bookmark
   res.status(201).json({ message: 'Bookmark saved' });
 };
-` : `${RA}${rr3}${mw3}
+` : `${RA}${mw3}
 export const GET = async (req, res) => {
   // TODO: fetch user bookmarks
   res.json({ bookmarks: [] });
@@ -2195,14 +2461,14 @@ export const POST = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "bookmarks", `index.${ext}`), bkListContent);
-  const bkByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const bkByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw3}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
   // TODO: delete bookmark
   res.json({ message: \`Bookmark \${id} removed\` });
 };
-` : `${RA}${rr3}${mw3}
+` : `${RA}${mw3}
 export const DELETE = async (req, res) => {
   const { id } = req.params;
   // TODO: delete bookmark
@@ -2211,14 +2477,14 @@ export const DELETE = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "bookmarks", `[id].${ext}`), bkByIdContent);
   const searchMeta = mkMeta(opts, "Search with filters, sort, and pagination.", `{ results: [], total: 0, page: 1, limit: 20 }`);
-  const searchContent = ts ? `${RA}${rr2}import type { Request, Response } from 'express';
+  const searchContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${searchMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   const { q, filter, sort, page = 1, limit = 20 } = req.query;
   // TODO: implement search
   res.json({ results: [], total: 0, page: Number(page), limit: Number(limit) });
 };
-` : `${RA}${rr2}${searchMeta}${mw2}
+` : `${RA}${searchMeta}${mw2}
 export const GET = async (req, res) => {
   const { q, filter, sort, page = 1, limit = 20 } = req.query;
   // TODO: implement search
@@ -2227,7 +2493,7 @@ export const GET = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", `search.${ext}`), searchContent);
   const akListMeta = mkMeta(opts, "List API keys (GET) or create a new one (POST).", `{ apiKeys: [] }`);
-  const akListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const akListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${akListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch api keys for user
@@ -2240,7 +2506,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: generate and store API key
   res.status(201).json({ message: 'API key created', key: 'efc_...' });
 };
-` : `${RA}${rr3}${akListMeta}${mw3}
+` : `${RA}${akListMeta}${mw3}
 export const GET = async (req, res) => {
   // TODO: fetch api keys for user
   res.json({ apiKeys: [] });
@@ -2254,14 +2520,14 @@ export const POST = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "api-keys", `index.${ext}`), akListContent);
-  const akByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const akByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw3}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
   // TODO: revoke and delete API key
   res.json({ message: \`API key \${id} revoked\` });
 };
-` : `${RA}${rr3}${mw3}
+` : `${RA}${mw3}
 export const DELETE = async (req, res) => {
   const { id } = req.params;
   // TODO: revoke and delete API key
@@ -2273,24 +2539,20 @@ export const DELETE = async (req, res) => {
 async function writeUserBillingRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
-  const rr3 = opts.rbac ? `import { requireRole } from '../../../middleware/requireRole.js';
-` : "";
-  const rr4 = opts.rbac ? `import { requireRole } from '../../../../middleware/requireRole.js';
-` : "";
-  const mw3 = opts.rbac ? `export const middlewares = [requireAuth, requireRole('user', 'admin')];
+  const mw3 = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];
 ` : `export const middlewares = [requireAuth];
 `;
   const mw4 = mw3;
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
   const plansMeta = mkMeta(opts, "List all available subscription plans.", `{ plans: [] }`);
-  const plansContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const plansContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${plansMeta}${mw3}
 export const GET = async (_req: Request, res: Response) => {
   // TODO: fetch active plans from DB
   res.json({ plans: [] });
 };
-` : `${RA}${rr3}${plansMeta}${mw3}
+` : `${RA}${plansMeta}${mw3}
 export const GET = async (_req, res) => {
   // TODO: fetch active plans from DB
   res.json({ plans: [] });
@@ -2298,7 +2560,7 @@ export const GET = async (_req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "billing", `plans.${ext}`), plansContent);
   const subMeta = mkMeta(opts, "Get current subscription (GET), subscribe to a plan (POST), or cancel (DELETE).", `{ subscription: null }`);
-  const subContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const subContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${subMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch current subscription for user
@@ -2316,7 +2578,7 @@ export const DELETE = async (req: Request, res: Response) => {
   // TODO: cancel subscription at period end
   res.json({ message: 'Subscription cancelled' });
 };
-` : `${RA}${rr3}${subMeta}${mw3}
+` : `${RA}${subMeta}${mw3}
 export const GET = async (req, res) => {
   // TODO: fetch current subscription for user
   res.json({ subscription: null });
@@ -2335,7 +2597,7 @@ export const DELETE = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "billing", `subscription.${ext}`), subContent);
-  const pmListContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+  const pmListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw4}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch payment methods for user
@@ -2348,7 +2610,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: attach payment method via payment gateway
   res.status(201).json({ message: 'Payment method added' });
 };
-` : `${RA}${rr4}${mw4}
+` : `${RA}${mw4}
 export const GET = async (req, res) => {
   // TODO: fetch payment methods for user
   res.json({ paymentMethods: [] });
@@ -2362,14 +2624,14 @@ export const POST = async (req, res) => {
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "billing", "payment-methods", `index.${ext}`), pmListContent);
-  const pmByIdContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+  const pmByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw4}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
   // TODO: detach payment method from payment gateway
   res.json({ message: \`Payment method \${id} removed\` });
 };
-` : `${RA}${rr4}${mw4}
+` : `${RA}${mw4}
 export const DELETE = async (req, res) => {
   const { id } = req.params;
   // TODO: detach payment method from payment gateway
@@ -2378,27 +2640,27 @@ export const DELETE = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "billing", "payment-methods", `[id].${ext}`), pmByIdContent);
   const invListMeta = mkMeta(opts, "List all invoices for the authenticated user.", `{ invoices: [], total: 0 }`);
-  const invListContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+  const invListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${invListMeta}${mw4}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch invoices for user
   res.json({ invoices: [], total: 0 });
 };
-` : `${RA}${rr4}${invListMeta}${mw4}
+` : `${RA}${invListMeta}${mw4}
 export const GET = async (req, res) => {
   // TODO: fetch invoices for user
   res.json({ invoices: [], total: 0 });
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "user", "billing", "invoices", `index.${ext}`), invListContent);
-  const invByIdContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+  const invByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mw4}
 export const GET = async (req: Request, res: Response) => {
   const { id } = req.params;
   // TODO: return invoice PDF URL or inline data
   res.json({ invoice: { id, downloadUrl: 'https://...' } });
 };
-` : `${RA}${rr4}${mw4}
+` : `${RA}${mw4}
 export const GET = async (req, res) => {
   const { id } = req.params;
   // TODO: return invoice PDF URL or inline data
@@ -2410,15 +2672,13 @@ export const GET = async (req, res) => {
 async function writeSupportRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
-  const rr3 = opts.rbac ? `import { requireRole } from '../../../middleware/requireRole.js';
-` : "";
-  const mw3 = opts.rbac ? `export const middlewares = [requireAuth, requireRole('user', 'admin')];
+  const mw3 = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];
 ` : `export const middlewares = [requireAuth];
 `;
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
   const ticketListMeta = mkMeta(opts, "List own support tickets (GET) or create a new one (POST).", `{ tickets: [], total: 0 }`, `{ subject: 'Issue with login', message: 'I cannot log in', priority: 'normal' }`);
-  const ticketListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const ticketListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${ticketListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch tickets for current user
@@ -2431,7 +2691,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: create support ticket in DB
   res.status(201).json({ message: 'Ticket created', ticket: { id: 'new-id', subject, status: 'open' } });
 };
-` : `${RA}${rr3}${ticketListMeta}${mw3}
+` : `${RA}${ticketListMeta}${mw3}
 export const GET = async (req, res) => {
   // TODO: fetch tickets for current user
   res.json({ tickets: [], total: 0 });
@@ -2446,7 +2706,7 @@ export const POST = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "support", "tickets", `index.${ext}`), ticketListContent);
   const ticketByIdMeta = mkMeta(opts, "View a support ticket (GET) or add a reply / close it (PUT).", `{ ticket: { id: '1', subject: 'Issue', status: 'open', replies: [] } }`);
-  const ticketByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const ticketByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${ticketByIdMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2460,7 +2720,7 @@ export const PUT = async (req: Request, res: Response) => {
   // TODO: add reply or update status
   res.json({ message: 'Ticket updated', ticket: { id, status: status ?? 'open' } });
 };
-` : `${RA}${rr3}${ticketByIdMeta}${mw3}
+` : `${RA}${ticketByIdMeta}${mw3}
 export const GET = async (req, res) => {
   const { id } = req.params;
   // TODO: fetch ticket by id, verify ownership
@@ -2479,11 +2739,7 @@ export const PUT = async (req, res) => {
 async function writeAdminExtendedRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
-  const rr3 = opts.rbac ? `import { requireRole } from '../../../middleware/requireRole.js';
-` : "";
-  const rr4 = opts.rbac ? `import { requireRole } from '../../../../middleware/requireRole.js';
-` : "";
-  const mwAdmin3 = opts.rbac ? `export const middlewares = [requireAuth, requireRole('admin')];
+  const mwAdmin3 = opts.rbac ? `export const middlewares = [requireAuth('admin')];
 ` : `export const middlewares = [requireAuth];
 `;
   const mwAdmin4 = mwAdmin3;
@@ -2495,13 +2751,13 @@ async function writeAdminExtendedRoutes(dest, opts) {
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
   const analyticsOverviewMeta = mkMeta(opts, "Analytics overview: users, revenue, traffic.", `{ users: {}, revenue: {}, traffic: {} }`);
-  const analyticsOverviewContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const analyticsOverviewContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${analyticsOverviewMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  // TODO: aggregate analytics overview
   res.json({ users: {}, revenue: {}, traffic: {} });
 };
-` : `${RA}${rr3}${analyticsOverviewMeta}${mwAdmin3}
+` : `${RA}${analyticsOverviewMeta}${mwAdmin3}
 export const GET = async (req, res) => {
 ${roleGuard}  // TODO: aggregate analytics overview
   res.json({ users: {}, revenue: {}, traffic: {} });
@@ -2509,14 +2765,14 @@ ${roleGuard}  // TODO: aggregate analytics overview
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "analytics", `index.${ext}`), analyticsOverviewContent);
   const analyticsUsersMeta = mkMeta(opts, "User analytics: registrations, active users, churn.", `{ registrations: [], activeUsers: 0, churn: 0 }`);
-  const analyticsUsersContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const analyticsUsersContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${analyticsUsersMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { period = '30d' } = req.query;
   // TODO: fetch user analytics for period
   res.json({ registrations: [], activeUsers: 0, churn: 0, period });
 };
-` : `${RA}${rr3}${analyticsUsersMeta}${mwAdmin3}
+` : `${RA}${analyticsUsersMeta}${mwAdmin3}
 export const GET = async (req, res) => {
 ${roleGuard}  const { period = '30d' } = req.query;
   // TODO: fetch user analytics for period
@@ -2525,14 +2781,14 @@ ${roleGuard}  const { period = '30d' } = req.query;
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "analytics", `users.${ext}`), analyticsUsersContent);
   const analyticsRevenueMeta = mkMeta(opts, "Revenue analytics: MRR, ARR, payment history.", `{ mrr: 0, arr: 0, history: [] }`);
-  const analyticsRevenueContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const analyticsRevenueContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${analyticsRevenueMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { period = '30d' } = req.query;
   // TODO: fetch revenue analytics for period
   res.json({ mrr: 0, arr: 0, history: [], period });
 };
-` : `${RA}${rr3}${analyticsRevenueMeta}${mwAdmin3}
+` : `${RA}${analyticsRevenueMeta}${mwAdmin3}
 export const GET = async (req, res) => {
 ${roleGuard}  const { period = '30d' } = req.query;
   // TODO: fetch revenue analytics for period
@@ -2541,14 +2797,14 @@ ${roleGuard}  const { period = '30d' } = req.query;
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "analytics", `revenue.${ext}`), analyticsRevenueContent);
   const analyticsTrafficMeta = mkMeta(opts, "Traffic analytics: page views, devices, countries.", `{ pageViews: 0, devices: {}, countries: {} }`);
-  const analyticsTrafficContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const analyticsTrafficContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${analyticsTrafficMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { period = '30d' } = req.query;
   // TODO: fetch traffic analytics for period
   res.json({ pageViews: 0, devices: {}, countries: {}, period });
 };
-` : `${RA}${rr3}${analyticsTrafficMeta}${mwAdmin3}
+` : `${RA}${analyticsTrafficMeta}${mwAdmin3}
 export const GET = async (req, res) => {
 ${roleGuard}  const { period = '30d' } = req.query;
   // TODO: fetch traffic analytics for period
@@ -2556,7 +2812,7 @@ ${roleGuard}  const { period = '30d' } = req.query;
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "analytics", `traffic.${ext}`), analyticsTrafficContent);
-  const suspendContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+  const suspendContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin4}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -2564,7 +2820,7 @@ ${roleGuard}  const { id } = req.params;
   // TODO: set user.isActive = false, log audit event
   res.json({ message: \`User \${id} suspended\`, reason });
 };
-` : `${RA}${rr4}${mwAdmin4}
+` : `${RA}${mwAdmin4}
 export const POST = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   const { reason } = req.body;
@@ -2573,14 +2829,14 @@ ${roleGuard}  const { id } = req.params;
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "users", "[id]", `suspend.${ext}`), suspendContent);
-  const activateContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+  const activateContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin4}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
   // TODO: set user.isActive = true, log audit event
   res.json({ message: \`User \${id} activated\` });
 };
-` : `${RA}${rr4}${mwAdmin4}
+` : `${RA}${mwAdmin4}
 export const POST = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   // TODO: set user.isActive = true, log audit event
@@ -2588,14 +2844,14 @@ ${roleGuard}  const { id } = req.params;
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "users", "[id]", `activate.${ext}`), activateContent);
-  const verifyUserContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+  const verifyUserContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin4}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
   // TODO: set user.isVerified = true
   res.json({ message: \`User \${id} verified\` });
 };
-` : `${RA}${rr4}${mwAdmin4}
+` : `${RA}${mwAdmin4}
 export const POST = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   // TODO: set user.isVerified = true
@@ -2604,7 +2860,7 @@ ${roleGuard}  const { id } = req.params;
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "users", "[id]", `verify.${ext}`), verifyUserContent);
   const exportMeta = mkMeta(opts, "Export all users as CSV.", `{ csv: '...' }`);
-  const exportContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const exportContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${exportMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: generate CSV of all users and stream response
@@ -2612,7 +2868,7 @@ ${roleGuard}  // TODO: generate CSV of all users and stream response
   res.setHeader('Content-Disposition', 'attachment; filename="users.csv"');
   res.send('id,name,email,role,createdAt\\n');
 };
-` : `${RA}${rr3}${exportMeta}${mwAdmin3}
+` : `${RA}${exportMeta}${mwAdmin3}
 export const GET = async (_req, res) => {
 ${roleGuard}  // TODO: generate CSV of all users and stream response
   res.setHeader('Content-Type', 'text/csv');
@@ -2622,7 +2878,7 @@ ${roleGuard}  // TODO: generate CSV of all users and stream response
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "users", `export.${ext}`), exportContent);
   const adminsListMeta = mkMeta(opts, "List all admins (GET) or create a new admin (POST).", `{ admins: [], total: 0 }`);
-  const adminsListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const adminsListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminsListMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: fetch admins from DB
@@ -2635,7 +2891,7 @@ ${roleGuard}  const { name, email, role } = req.body;
   // TODO: create admin account
   res.status(201).json({ message: 'Admin created', admin: { id: 'new-id', name, email, role: role ?? 'admin' } });
 };
-` : `${RA}${rr3}${adminsListMeta}${mwAdmin3}
+` : `${RA}${adminsListMeta}${mwAdmin3}
 export const GET = async (_req, res) => {
 ${roleGuard}  // TODO: fetch admins from DB
   res.json({ admins: [], total: 0 });
@@ -2649,7 +2905,7 @@ ${roleGuard}  const { name, email, role } = req.body;
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "admins", `index.${ext}`), adminsListContent);
-  const adminByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const adminByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -2668,7 +2924,7 @@ ${roleGuard}  const { id } = req.params;
   // TODO: delete admin
   res.json({ message: \`Admin \${id} deleted\` });
 };
-` : `${RA}${rr3}${mwAdmin3}
+` : `${RA}${mwAdmin3}
 export const GET = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   // TODO: fetch admin by id
@@ -2689,7 +2945,7 @@ ${roleGuard}  const { id } = req.params;
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "admins", `[id].${ext}`), adminByIdContent);
   if (opts.rbac) {
-    const rolesListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+    const rolesListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
   // TODO: fetch all roles
@@ -2702,7 +2958,7 @@ export const POST = async (req: Request, res: Response) => {
   // TODO: create role
   res.status(201).json({ message: 'Role created', role: { id: 'new-id', name, permissions: permissions ?? [] } });
 };
-` : `${RA}${rr3}${mwAdmin3}
+` : `${RA}${mwAdmin3}
 export const GET = async (_req, res) => {
   // TODO: fetch all roles
   res.json({ roles: [] });
@@ -2716,7 +2972,7 @@ export const POST = async (req, res) => {
 };
 `;
     await fs.outputFile(path.join(dest, "src", "api", "admin", "roles", `index.${ext}`), rolesListContent);
-    const roleByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+    const roleByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2735,7 +2991,7 @@ export const DELETE = async (req: Request, res: Response) => {
   // TODO: delete role
   res.json({ message: \`Role \${id} deleted\` });
 };
-` : `${RA}${rr3}${mwAdmin3}
+` : `${RA}${mwAdmin3}
 export const GET = async (req, res) => {
   const { id } = req.params;
   // TODO: fetch role by id
@@ -2756,7 +3012,7 @@ export const DELETE = async (req, res) => {
 `;
     await fs.outputFile(path.join(dest, "src", "api", "admin", "roles", `[id].${ext}`), roleByIdContent);
   }
-  const adminNotifContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const adminNotifContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: fetch sent notifications
@@ -2769,7 +3025,7 @@ ${roleGuard}  const { userId, title, message, type } = req.body;
   // TODO: create and send notification to user
   res.status(201).json({ message: 'Notification sent' });
 };
-` : `${RA}${rr3}${mwAdmin3}
+` : `${RA}${mwAdmin3}
 export const GET = async (_req, res) => {
 ${roleGuard}  // TODO: fetch sent notifications
   res.json({ notifications: [], total: 0 });
@@ -2784,7 +3040,7 @@ ${roleGuard}  const { userId, title, message, type } = req.body;
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "notifications", `index.${ext}`), adminNotifContent);
   const broadcastMeta = mkMeta(opts, "Broadcast a notification to all users.", `{ message: 'Broadcast sent', count: 0 }`, `{ title: 'Announcement', message: 'Hello everyone!', type: 'info' }`);
-  const broadcastContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const broadcastContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${broadcastMeta}${mwAdmin3}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { title, message, type } = req.body;
@@ -2792,7 +3048,7 @@ ${roleGuard}  const { title, message, type } = req.body;
   // TODO: send notification to all users
   res.json({ message: 'Broadcast sent', count: 0 });
 };
-` : `${RA}${rr3}${broadcastMeta}${mwAdmin3}
+` : `${RA}${broadcastMeta}${mwAdmin3}
 export const POST = async (req, res) => {
 ${roleGuard}  const { title, message, type } = req.body;
   if (!title || !message) return res.status(400).json({ error: 'title and message are required' });
@@ -2803,14 +3059,14 @@ ${roleGuard}  const { title, message, type } = req.body;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "notifications", `broadcast.${ext}`), broadcastContent);
   const mkLogContent = (label) => {
     const meta = mkMeta(opts, `Paginated ${label} log entries.`, `{ logs: [], total: 0, page: 1, limit: 50 }`);
-    return ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+    return ts ? `${RA}import type { Request, Response } from 'express';
 ${meta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { page = 1, limit = 50 } = req.query;
   // TODO: fetch ${label} logs with pagination
   res.json({ logs: [], total: 0, page: Number(page), limit: Number(limit) });
 };
-` : `${RA}${rr3}${meta}${mwAdmin3}
+` : `${RA}${meta}${mwAdmin3}
 export const GET = async (req, res) => {
 ${roleGuard}  const { page = 1, limit = 50 } = req.query;
   // TODO: fetch ${label} logs with pagination
@@ -2822,7 +3078,7 @@ ${roleGuard}  const { page = 1, limit = 50 } = req.query;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "logs", `activity.${ext}`), mkLogContent("activity"));
   await fs.outputFile(path.join(dest, "src", "api", "admin", "logs", `security.${ext}`), mkLogContent("security"));
   const settingsMeta = mkMeta(opts, "Get or update system-wide settings.", `{ settings: {} }`);
-  const settingsContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const settingsContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${settingsMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: fetch system settings from DB
@@ -2833,7 +3089,7 @@ export const PUT = async (req: Request, res: Response) => {
 ${roleGuard}  // TODO: update system settings
   res.json({ message: 'Settings updated', settings: req.body });
 };
-` : `${RA}${rr3}${settingsMeta}${mwAdmin3}
+` : `${RA}${settingsMeta}${mwAdmin3}
 export const GET = async (_req, res) => {
 ${roleGuard}  // TODO: fetch system settings from DB
   res.json({ settings: {} });
@@ -2846,13 +3102,13 @@ ${roleGuard}  // TODO: update system settings
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "settings", `index.${ext}`), settingsContent);
   const healthMeta = mkMeta(opts, "System health check: DB, queue, cache status.", `{ status: 'ok', db: 'ok', queue: 'ok' }`);
-  const healthContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const healthContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${healthMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: check DB connection, queue, cache health
   res.json({ status: 'ok', db: 'ok', queue: 'ok', uptime: process.uptime() });
 };
-` : `${RA}${rr3}${healthMeta}${mwAdmin3}
+` : `${RA}${healthMeta}${mwAdmin3}
 export const GET = async (_req, res) => {
 ${roleGuard}  // TODO: check DB connection, queue, cache health
   res.json({ status: 'ok', db: 'ok', queue: 'ok', uptime: process.uptime() });
@@ -2860,13 +3116,13 @@ ${roleGuard}  // TODO: check DB connection, queue, cache health
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "system", `health.${ext}`), healthContent);
   const cacheMeta = mkMeta(opts, "Flush the application cache.", `{ message: 'Cache cleared' }`);
-  const cacheContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const cacheContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${cacheMeta}${mwAdmin3}
 export const DELETE = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: flush Redis or in-memory cache
   res.json({ message: 'Cache cleared' });
 };
-` : `${RA}${rr3}${cacheMeta}${mwAdmin3}
+` : `${RA}${cacheMeta}${mwAdmin3}
 export const DELETE = async (_req, res) => {
 ${roleGuard}  // TODO: flush Redis or in-memory cache
   res.json({ message: 'Cache cleared' });
@@ -2874,14 +3130,14 @@ ${roleGuard}  // TODO: flush Redis or in-memory cache
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "system", `cache.${ext}`), cacheContent);
   const adminTicketsListMeta = mkMeta(opts, "List all support tickets with filters.", `{ tickets: [], total: 0 }`);
-  const adminTicketsListContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const adminTicketsListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminTicketsListMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { status, priority, page = 1, limit = 20 } = req.query;
   // TODO: fetch all tickets with filters
   res.json({ tickets: [], total: 0, page: Number(page), limit: Number(limit) });
 };
-` : `${RA}${rr3}${adminTicketsListMeta}${mwAdmin3}
+` : `${RA}${adminTicketsListMeta}${mwAdmin3}
 export const GET = async (req, res) => {
 ${roleGuard}  const { status, priority, page = 1, limit = 20 } = req.query;
   // TODO: fetch all tickets with filters
@@ -2889,7 +3145,7 @@ ${roleGuard}  const { status, priority, page = 1, limit = 20 } = req.query;
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "tickets", `index.${ext}`), adminTicketsListContent);
-  const adminTicketByIdContent = ts ? `${RA}${rr3}import type { Request, Response } from 'express';
+  const adminTicketByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -2903,7 +3159,7 @@ ${roleGuard}  const { id } = req.params;
   // TODO: update ticket (assign, change status, add reply)
   res.json({ message: 'Ticket updated', ticket: { id, status, assignedTo } });
 };
-` : `${RA}${rr3}${mwAdmin3}
+` : `${RA}${mwAdmin3}
 export const GET = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   // TODO: fetch ticket by id
@@ -2920,7 +3176,7 @@ ${roleGuard}  const { id } = req.params;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "tickets", `[id].${ext}`), adminTicketByIdContent);
   const mkContentCrud = (name, namePlural, dir, createFields) => {
     const listMeta = mkMeta(opts, `List ${namePlural} (GET) or create a new ${name} (POST).`, `{ ${namePlural}: [], total: 0 }`);
-    const listContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+    const listContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${listMeta}${mwAdmin4}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: fetch ${namePlural}
@@ -2932,7 +3188,7 @@ ${roleGuard}  const { ${createFields} } = req.body;
   // TODO: create ${name}
   res.status(201).json({ message: '${name} created', ${name.toLowerCase()}: { id: 'new-id', ${createFields.split(", ")[0]} } });
 };
-` : `${RA}${rr4}${listMeta}${mwAdmin4}
+` : `${RA}${listMeta}${mwAdmin4}
 export const GET = async (_req, res) => {
 ${roleGuard}  // TODO: fetch ${namePlural}
   res.json({ ${namePlural}: [], total: 0 });
@@ -2944,7 +3200,7 @@ ${roleGuard}  const { ${createFields} } = req.body;
   res.status(201).json({ message: '${name} created', ${name.toLowerCase()}: { id: 'new-id' } });
 };
 `;
-    const byIdContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+    const byIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${mwAdmin4}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -2963,7 +3219,7 @@ ${roleGuard}  const { id } = req.params;
   // TODO: delete ${name}
   res.json({ message: \`${name} \${id} deleted\` });
 };
-` : `${RA}${rr4}${mwAdmin4}
+` : `${RA}${mwAdmin4}
 export const GET = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   // TODO: fetch ${name} by id
@@ -3000,14 +3256,14 @@ ${roleGuard}  const { id } = req.params;
   await fs.outputFile(path.join(dest, "src", "api", "admin", "billing", "coupons", `index.${ext}`), couponList);
   await fs.outputFile(path.join(dest, "src", "api", "admin", "billing", "coupons", `[id].${ext}`), couponById);
   const adminSubsMeta = mkMeta(opts, "List all subscriptions with filters.", `{ subscriptions: [], total: 0 }`);
-  const adminSubsContent = ts ? `${RA}${rr4}import type { Request, Response } from 'express';
+  const adminSubsContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminSubsMeta}${mwAdmin4}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { status, page = 1, limit = 20 } = req.query;
   // TODO: fetch all subscriptions with filters
   res.json({ subscriptions: [], total: 0, page: Number(page), limit: Number(limit) });
 };
-` : `${RA}${rr4}${adminSubsMeta}${mwAdmin4}
+` : `${RA}${adminSubsMeta}${mwAdmin4}
 export const GET = async (req, res) => {
 ${roleGuard}  const { status, page = 1, limit = 20 } = req.query;
   // TODO: fetch all subscriptions with filters
@@ -3064,7 +3320,7 @@ async function main() {
       { value: "routeDocs", label: "API route documentation", hint: "meta exports + dashboard" },
       { value: "userPortal", label: "User portal", hint: "auth, profile, billing routes" },
       { value: "adminPortal", label: "Admin portal", hint: "dashboard, user mgmt, analytics" },
-      { value: "rbac", label: "Role-based access control", hint: "requireRole middleware" },
+      { value: "rbac", label: "Role-based access control", hint: "requireAuth('role') middleware" },
       { value: "mailer", label: "Mailer", hint: "nodemailer + SMTP" }
     ],
     initialValues: ["cluster", "tasks", "routeDocs", "userPortal", "adminPortal", "rbac"],
@@ -3177,6 +3433,13 @@ async function main() {
   await npmInstallGlobal().catch(() => {
   });
   spinner2.stop("efc CLI ready");
+  if (opts.mailer) {
+    p.note(
+      `SMTP_USER and SMTP_PASS were written to ${projectName}/.env \u2014 that file is gitignored, never commit it.
+` + (opts.smtpProvider === "gmail" ? "If this Gmail app password ever leaks, revoke it and generate a new one." : "Rotate SMTP_PASS immediately if it is ever exposed."),
+      "Mailer credentials"
+    );
+  }
   p.outro(
     pc.green(`
 Your project is ready!