create-efc-app 0.4.3 → 0.4.5

package/dist/index.js

@@ -9,9 +9,33 @@ import { spawn } from "child_process";
 import fs from "fs-extra";
 import path from "path";
 import crypto from "crypto";
+var NO_ADMIN_FEATURES = {
+  userManagement: false,
+  adminManagement: false,
+  analytics: false,
+  contentManagement: false,
+  billingManagement: false,
+  supportManagement: false,
+  notificationsAndLogs: false,
+  systemSettings: false
+};
+var NO_USER_FEATURES = {
+  profileViewing: false,
+  forgotPassword: false,
+  accountSecurity: false,
+  emailVerification: false,
+  accountSettings: false,
+  notifications: false,
+  filesAndMedia: false,
+  apiAndBilling: false,
+  support: false
+};
 async function scaffold(opts) {
   const dest = path.resolve(process.cwd(), opts.projectName);
   await fs.ensureDir(dest);
+  const uf = opts.userFeatures;
+  const af = opts.adminFeatures;
+  const needsUserModel = opts.userPortal || opts.adminPortal && af.userManagement;
   await writePackageJson(dest, opts);
   await writeTsConfig(dest, opts);
   await writeEfcConfig(dest, opts);
@@ -19,30 +43,32 @@ async function scaffold(opts) {
   await writeGitignore(dest);
   await writeEnvFiles(dest, opts);
   await writeExampleRoute(dest, opts);
-  if (opts.userPortal) await writeUserModel(dest, opts);
+  if (needsUserModel) await writeUserModel(dest, opts);
   if (opts.adminPortal) await writeAdminModel(dest, opts);
   await writeAuthRoutes(dest, opts);
   if (opts.adminPortal) await writeAdminRoutes(dest, opts);
-  if (opts.userPortal) await writeUserRoutes(dest, opts);
+  if (opts.userPortal && uf.profileViewing) await writeUserRoutes(dest, opts);
   if (opts.tasks) await writeExampleTask(dest, opts);
-  if (opts.userPortal) await writeSessionModel(dest, opts);
-  if (opts.userPortal) await writeNotificationModel(dest, opts);
-  if (opts.userPortal) await writeFileModel(dest, opts);
-  if (opts.userPortal || opts.adminPortal) await writeSupportTicketModel(dest, opts);
-  if (opts.adminPortal) await writeAuditLogModel(dest, opts);
-  if (opts.userPortal) await writeSubscriptionModel(dest, opts);
-  if (opts.adminPortal) await writePlanModel(dest, opts);
-  if (opts.userPortal) await writeInvoiceModel(dest, opts);
-  if (opts.userPortal) await writeApiKeyModel(dest, opts);
-  if (opts.rbac) await writeRoleModel(dest, opts);
-  if (opts.adminPortal) await writeFAQModel(dest, opts);
-  if (opts.adminPortal) await writeBlogModel(dest, opts);
-  if (opts.adminPortal) await writeCategoryModel(dest, opts);
-  if (opts.adminPortal) await writeCouponModel(dest, opts);
+  if (opts.userPortal && uf.accountSecurity) await writeSessionModel(dest, opts);
+  if (opts.userPortal && uf.notifications || opts.adminPortal && af.notificationsAndLogs)
+    await writeNotificationModel(dest, opts);
+  if (opts.userPortal && uf.filesAndMedia) await writeFileModel(dest, opts);
+  if (opts.userPortal && uf.support || opts.adminPortal && af.supportManagement)
+    await writeSupportTicketModel(dest, opts);
+  if (opts.adminPortal && af.notificationsAndLogs) await writeAuditLogModel(dest, opts);
+  if (opts.userPortal && uf.apiAndBilling) await writeSubscriptionModel(dest, opts);
+  if (opts.adminPortal && af.billingManagement) await writePlanModel(dest, opts);
+  if (opts.userPortal && uf.apiAndBilling) await writeInvoiceModel(dest, opts);
+  if (opts.userPortal && uf.apiAndBilling) await writeApiKeyModel(dest, opts);
+  if (opts.rbac && opts.adminPortal && af.adminManagement) await writeRoleModel(dest, opts);
+  if (opts.adminPortal && af.contentManagement) await writeFAQModel(dest, opts);
+  if (opts.adminPortal && af.contentManagement) await writeBlogModel(dest, opts);
+  if (opts.adminPortal && af.contentManagement) await writeCategoryModel(dest, opts);
+  if (opts.adminPortal && af.billingManagement) await writeCouponModel(dest, opts);
   if (opts.userPortal) await writeAuthExtendedRoutes(dest, opts);
   if (opts.userPortal) await writeUserExtendedRoutes(dest, opts);
-  if (opts.userPortal) await writeUserBillingRoutes(dest, opts);
-  if (opts.userPortal) await writeSupportRoutes(dest, opts);
+  if (opts.userPortal && uf.apiAndBilling) await writeUserBillingRoutes(dest, opts);
+  if (opts.userPortal && uf.support) await writeSupportRoutes(dest, opts);
   if (opts.adminPortal) await writeAdminExtendedRoutes(dest, opts);
 }
 async function writePackageJson(dest, opts) {
@@ -440,16 +466,47 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const loginDbImports = opts.database === "mongodb" ? ts ? `import bcrypt from 'bcrypt';
-import crypto from 'node:crypto';
-import { User } from '../../model/User.js';
-import { Admin } from '../../model/Admin.js';
-` : `import bcrypt from 'bcrypt';
+  const hasUser = opts.userPortal;
+  const hasAdmin = opts.adminPortal;
+  const mongo = opts.database === "mongodb" && (hasUser || hasAdmin);
+  const loginDbImports = mongo ? `import bcrypt from 'bcrypt';
 import crypto from 'node:crypto';
-import { User } from '../../model/User.js';
-import { Admin } from '../../model/Admin.js';
-` : "";
-  const loginContent = opts.database === "mongodb" ? ts ? `import { issueToken } from 'express-file-cluster/auth';
+${hasUser ? `import { User } from '../../model/User.js';
+` : ""}${hasAdmin ? `import { Admin } from '../../model/Admin.js';
+` : ""}` : "";
+  const loginBody = hasAdmin && hasUser ? `  const admin = await Admin.findOne({ email });
+  if (admin) {
+    const match = await bcrypt.compare(password, admin.password);
+    if (!match) return res.status(401).json({ error: 'Invalid credentials' });
+    if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
+    await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
+    await issueRefreshToken(res, Admin, admin.id);
+    return res.json({ message: 'Logged in as admin' });
+  }
+
+  const user = await User.findOne({ email });
+  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
+  const match = await bcrypt.compare(password, user.password);
+  if (!match) return res.status(401).json({ error: 'Invalid credentials' });
+  if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
+  await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  await issueRefreshToken(res, User, user.id);
+  res.json({ message: 'Logged in' });` : hasAdmin ? `  const admin = await Admin.findOne({ email });
+  if (!admin) return res.status(401).json({ error: 'Invalid credentials' });
+  const match = await bcrypt.compare(password, admin.password);
+  if (!match) return res.status(401).json({ error: 'Invalid credentials' });
+  if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
+  await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
+  await issueRefreshToken(res, Admin, admin.id);
+  res.json({ message: 'Logged in as admin' });` : `  const user = await User.findOne({ email });
+  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
+  const match = await bcrypt.compare(password, user.password);
+  if (!match) return res.status(401).json({ error: 'Invalid credentials' });
+  if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
+  await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  await issueRefreshToken(res, User, user.id);
+  res.json({ message: 'Logged in' });`;
+  const loginContent = mongo ? ts ? `import { issueToken } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 ${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
@@ -472,24 +529,7 @@ export const POST = async (req: Request, res: Response) => {
   const { email, password } = req.body;
   if (!email || !password) return res.status(400).json({ error: 'email and password are required' });
 
-  const admin = await Admin.findOne({ email });
-  if (admin) {
-    const match = await bcrypt.compare(password, admin.password);
-    if (!match) return res.status(401).json({ error: 'Invalid credentials' });
-    if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
-    await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
-    await issueRefreshToken(res, Admin, admin.id);
-    return res.json({ message: 'Logged in as admin' });
-  }
-
-  const user = await User.findOne({ email });
-  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
-  const match = await bcrypt.compare(password, user.password);
-  if (!match) return res.status(401).json({ error: 'Invalid credentials' });
-  if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
-  await issueToken(res, { id: user.id, role: user.role, email: user.email });
-  await issueRefreshToken(res, User, user.id);
-  res.json({ message: 'Logged in' });
+${loginBody}
 };
 ` : `import { issueToken } from 'express-file-cluster/auth';
 ${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
@@ -509,24 +549,7 @@ export const POST = async (req, res) => {
   const { email, password } = req.body;
   if (!email || !password) return res.status(400).json({ error: 'email and password are required' });
 
-  const admin = await Admin.findOne({ email });
-  if (admin) {
-    const match = await bcrypt.compare(password, admin.password);
-    if (!match) return res.status(401).json({ error: 'Invalid credentials' });
-    if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
-    await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
-    await issueRefreshToken(res, Admin, admin.id);
-    return res.json({ message: 'Logged in as admin' });
-  }
-
-  const user = await User.findOne({ email });
-  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
-  const match = await bcrypt.compare(password, user.password);
-  if (!match) return res.status(401).json({ error: 'Invalid credentials' });
-  if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
-  await issueToken(res, { id: user.id, role: user.role, email: user.email });
-  await issueRefreshToken(res, User, user.id);
-  res.json({ message: 'Logged in' });
+${loginBody}
 };
 ` : ts ? `import { issueToken } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
@@ -725,9 +748,10 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const dashboardDbImport = opts.database === "mongodb" ? `import { User } from '../../model/User.js';
+  const dashboardHasUserModel = opts.database === "mongodb" && opts.adminFeatures.userManagement;
+  const dashboardDbImport = dashboardHasUserModel ? `import { User } from '../../model/User.js';
 ` : "";
-  const dashboardContent = opts.database === "mongodb" ? ts ? `import { requireAuth } from 'express-file-cluster/auth';
+  const dashboardContent = dashboardHasUserModel ? ts ? `import { requireAuth } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 ${dashboardDbImport}${dashboardMeta}${middlewares}
 export const GET = async (_req: Request, res: Response) => {
@@ -763,6 +787,7 @@ ${roleGuard}  // TODO: aggregate stats from DB
 };
 `;
   await fs.outputFile(path.join(dest, "src", "api", "admin", `dashboard.${ext}`), dashboardContent);
+  if (!opts.adminFeatures.userManagement) return;
   const usersListMeta = opts.routeDocs ? ts ? `import type { RouteMeta } from 'express-file-cluster';
 
 export const meta: RouteMeta = {
@@ -866,7 +891,10 @@ ${roleGuard}  const { name, email, role } = req.body;
   res.status(201).json({ message: 'User created', user: { id: 'new-id', name, email, role: role ?? 'user' } });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "users", `index.${ext}`), usersListContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "admin", "users", `index.${ext}`),
+    usersListContent
+  );
   const userByIdMeta = opts.routeDocs ? ts ? `import type { RouteMeta } from 'express-file-cluster';
 
 export const meta: RouteMeta = {
@@ -1001,7 +1029,10 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: \`User \${id} deleted\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "users", `[id].${ext}`), userByIdContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "admin", "users", `[id].${ext}`),
+    userByIdContent
+  );
 }
 async function writeUserRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
@@ -1850,6 +1881,8 @@ async function writeAuthExtendedRoutes(dest, opts) {
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
   const mongo = opts.database === "mongodb";
+  const hasAdmin = opts.adminPortal;
+  const uf = opts.userFeatures;
   const sendResetEmail = opts.mailer ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
     await enqueue('SendEmail', {
       to: email,
@@ -1868,23 +1901,32 @@ async function writeAuthExtendedRoutes(dest, opts) {
 `;
   const mailerTaskImport = opts.mailer ? `import { enqueue } from 'express-file-cluster/tasks';
 ` : "";
-  const refreshMeta = mkMeta(opts, {
-    POST: { description: "Refresh the JWT using the refresh-token cookie and issue a new access token.", response: `{ message: 'Token refreshed' }` }
-  });
-  const refreshContent = mongo ? ts ? `import { issueToken } from 'express-file-cluster/auth';
+  if (uf.accountSecurity) {
+    const refreshMeta = mkMeta(opts, {
+      POST: {
+        description: "Refresh the JWT using the refresh-token cookie and issue a new access token.",
+        response: `{ message: 'Token refreshed' }`
+      }
+    });
+    const refreshModelImports = `import { User } from '../../model/User.js';
+${hasAdmin ? `import { Admin } from '../../model/Admin.js';
+` : ""}`;
+    const refreshLookup = hasAdmin ? `  const user = await User.findOne({ refreshToken: token });
+  const admin = user ? null : await Admin.findOne({ refreshToken: token });
+  const account = user || admin;` : `  const user = await User.findOne({ refreshToken: token });
+  const account = user;`;
+    const refreshPersist = hasAdmin ? `  if (user) await User.update(user.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
+  else if (admin) await Admin.update(admin.id, { refreshToken: newRefreshToken, refreshTokenExpiry });` : `  await User.update(user.id, { refreshToken: newRefreshToken, refreshTokenExpiry });`;
+    const refreshContent = mongo ? ts ? `import { issueToken } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 import crypto from 'node:crypto';
-import { User } from '../../model/User.js';
-import { Admin } from '../../model/Admin.js';
-${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+${refreshModelImports}${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
 export const POST = async (req: Request, res: Response) => {
   const token = req.cookies?.['efc_refresh_token'] || req.body?.refreshToken;
   if (!token) return res.status(401).json({ error: 'Refresh token required' });
 
-  const user = await User.findOne({ refreshToken: token });
-  const admin = user ? null : await Admin.findOne({ refreshToken: token });
-  const account = user || admin;
+${refreshLookup}
 
   if (!account || !account.refreshTokenExpiry || new Date(account.refreshTokenExpiry) < new Date()) {
     return res.status(401).json({ error: 'Invalid or expired refresh token' });
@@ -1892,8 +1934,7 @@ export const POST = async (req: Request, res: Response) => {
 
   const newRefreshToken = crypto.randomBytes(40).toString('hex');
   const refreshTokenExpiry = new Date(Date.now() + REFRESH_TOKEN_TTL_MS);
-  if (user) await User.update(user.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
-  else if (admin) await Admin.update(admin.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
+${refreshPersist}
 
   res.cookie('efc_refresh_token', newRefreshToken, {
     httpOnly: true,
@@ -1907,17 +1948,13 @@ export const POST = async (req: Request, res: Response) => {
 };
 ` : `import { issueToken } from 'express-file-cluster/auth';
 import crypto from 'node:crypto';
-import { User } from '../../model/User.js';
-import { Admin } from '../../model/Admin.js';
-${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+${refreshModelImports}${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
 export const POST = async (req, res) => {
   const token = req.cookies?.efc_refresh_token || req.body?.refreshToken;
   if (!token) return res.status(401).json({ error: 'Refresh token required' });
 
-  const user = await User.findOne({ refreshToken: token });
-  const admin = user ? null : await Admin.findOne({ refreshToken: token });
-  const account = user || admin;
+${refreshLookup}
 
   if (!account || !account.refreshTokenExpiry || new Date(account.refreshTokenExpiry) < new Date()) {
     return res.status(401).json({ error: 'Invalid or expired refresh token' });
@@ -1925,8 +1962,7 @@ export const POST = async (req, res) => {
 
   const newRefreshToken = crypto.randomBytes(40).toString('hex');
   const refreshTokenExpiry = new Date(Date.now() + REFRESH_TOKEN_TTL_MS);
-  if (user) await User.update(user.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
-  else if (admin) await Admin.update(admin.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
+${refreshPersist}
 
   res.cookie('efc_refresh_token', newRefreshToken, {
     httpOnly: true,
@@ -1948,12 +1984,22 @@ ${refreshMeta}export const POST = async (_req: Request, res: Response) => {
   res.json({ message: 'Token refreshed' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", `refresh.${ext}`), refreshContent);
-  const veMeta = mkMeta(opts, {
-    GET: { description: "Verify an email address using the token from the verification link.", query: `{ token: 'a1b2c3d4' }`, response: `{ message: 'Email verified' }` },
-    POST: { description: "Resend the verification email to a given address.", request: `{ email: 'user@example.com' }`, response: `{ message: 'Verification email sent' }` }
-  });
-  const veContent = mongo ? ts ? `import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "auth", `refresh.${ext}`), refreshContent);
+  }
+  if (uf.emailVerification) {
+    const veMeta = mkMeta(opts, {
+      GET: {
+        description: "Verify an email address using the token from the verification link.",
+        query: `{ token: 'a1b2c3d4' }`,
+        response: `{ message: 'Email verified' }`
+      },
+      POST: {
+        description: "Resend the verification email to a given address.",
+        request: `{ email: 'user@example.com' }`,
+        response: `{ message: 'Verification email sent' }`
+      }
+    });
+    const veContent = mongo ? ts ? `import type { Request, Response } from 'express';
 import crypto from 'node:crypto';
 ${mailerTaskImport}import { User } from '../../model/User.js';
 ${veMeta}export const GET = async (req: Request, res: Response) => {
@@ -2026,53 +2072,59 @@ export const POST = async (_req, res) => {
   res.json({ message: 'Verification email sent' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", `verify-email.${ext}`), veContent);
-  const fpMeta = mkMeta(opts, {
-    POST: { description: "Send a password reset email to the given address.", request: `{ email: 'user@example.com' }`, response: `{ message: 'Reset email sent' }` }
-  });
-  const fpContent = mongo ? ts ? `import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "auth", `verify-email.${ext}`), veContent);
+  }
+  if (uf.forgotPassword) {
+    const fpMeta = mkMeta(opts, {
+      POST: {
+        description: "Send a password reset email to the given address.",
+        request: `{ email: 'user@example.com' }`,
+        response: `{ message: 'Reset email sent' }`
+      }
+    });
+    const fpModelImports = `import { User } from '../../model/User.js';
+${hasAdmin ? `import { Admin } from '../../model/Admin.js';
+` : ""}`;
+    const fpLookup = hasAdmin ? `  const user = await User.findOne({ email });
+  const admin = user ? null : await Admin.findOne({ email });` : `  const user = await User.findOne({ email });`;
+    const fpGuard = hasAdmin ? "user || admin" : "user";
+    const fpPersist = hasAdmin ? `    if (user) await User.update(user.id, { resetToken, resetTokenExpiry });
+    else if (admin) await Admin.update(admin.id, { resetToken, resetTokenExpiry });` : `    await User.update(user.id, { resetToken, resetTokenExpiry });`;
+    const fpContent = mongo ? ts ? `import type { Request, Response } from 'express';
 import crypto from 'node:crypto';
-${mailerTaskImport}import { User } from '../../model/User.js';
-import { Admin } from '../../model/Admin.js';
-${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
+${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
 
 export const POST = async (req: Request, res: Response) => {
   const { email } = req.body;
   if (!email) return res.status(400).json({ error: 'email is required' });
 
-  const user = await User.findOne({ email });
-  const admin = user ? null : await Admin.findOne({ email });
+${fpLookup}
 
   // Always respond the same way whether or not the account exists, so this
   // endpoint can't be used to enumerate registered emails.
-  if (user || admin) {
+  if (${fpGuard}) {
     const resetToken = crypto.randomBytes(32).toString('hex');
     const resetTokenExpiry = new Date(Date.now() + RESET_TOKEN_TTL_MS);
-    if (user) await User.update(user.id, { resetToken, resetTokenExpiry });
-    else if (admin) await Admin.update(admin.id, { resetToken, resetTokenExpiry });
+${fpPersist}
 ${sendResetEmail}  }
 
   res.json({ message: 'Reset email sent' });
 };
 ` : `import crypto from 'node:crypto';
-${mailerTaskImport}import { User } from '../../model/User.js';
-import { Admin } from '../../model/Admin.js';
-${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
+${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
 
 export const POST = async (req, res) => {
   const { email } = req.body;
   if (!email) return res.status(400).json({ error: 'email is required' });
 
-  const user = await User.findOne({ email });
-  const admin = user ? null : await Admin.findOne({ email });
+${fpLookup}
 
   // Always respond the same way whether or not the account exists, so this
   // endpoint can't be used to enumerate registered emails.
-  if (user || admin) {
+  if (${fpGuard}) {
     const resetToken = crypto.randomBytes(32).toString('hex');
     const resetTokenExpiry = new Date(Date.now() + RESET_TOKEN_TTL_MS);
-    if (user) await User.update(user.id, { resetToken, resetTokenExpiry });
-    else if (admin) await Admin.update(admin.id, { resetToken, resetTokenExpiry });
+${fpPersist}
 ${sendResetEmail}  }
 
   res.json({ message: 'Reset email sent' });
@@ -2091,50 +2143,53 @@ ${fpMeta}export const POST = async (req: Request, res: Response) => {
   res.json({ message: 'Reset email sent' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", `forgot-password.${ext}`), fpContent);
-  const rpMeta = mkMeta(opts, {
-    POST: { description: "Reset password using a valid reset token.", request: `{ token: 'reset-token', password: 'newpassword' }`, response: `{ message: 'Password reset successfully' }` }
-  });
-  const rpContent = mongo ? ts ? `import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "auth", `forgot-password.${ext}`), fpContent);
+    const rpMeta = mkMeta(opts, {
+      POST: {
+        description: "Reset password using a valid reset token.",
+        request: `{ token: 'reset-token', password: 'newpassword' }`,
+        response: `{ message: 'Password reset successfully' }`
+      }
+    });
+    const rpModelImports = `import { User } from '../../model/User.js';
+${hasAdmin ? `import { Admin } from '../../model/Admin.js';
+` : ""}`;
+    const rpLookup = hasAdmin ? `  const user = await User.findOne({ resetToken: token });
+  const admin = user ? null : await Admin.findOne({ resetToken: token });
+  const account = user || admin;` : `  const user = await User.findOne({ resetToken: token });
+  const account = user;`;
+    const rpPersist = hasAdmin ? `  if (user) await User.update(user.id, { password: hashed, resetToken: '' });
+  else if (admin) await Admin.update(admin.id, { password: hashed, resetToken: '' });` : `  await User.update(user.id, { password: hashed, resetToken: '' });`;
+    const rpContent = mongo ? ts ? `import type { Request, Response } from 'express';
 import bcrypt from 'bcrypt';
-import { User } from '../../model/User.js';
-import { Admin } from '../../model/Admin.js';
-${rpMeta}export const POST = async (req: Request, res: Response) => {
+${rpModelImports}${rpMeta}export const POST = async (req: Request, res: Response) => {
   const { token, password } = req.body;
   if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
 
-  const user = await User.findOne({ resetToken: token });
-  const admin = user ? null : await Admin.findOne({ resetToken: token });
-  const account = user || admin;
+${rpLookup}
 
   if (!account || !account.resetTokenExpiry || new Date(account.resetTokenExpiry) < new Date()) {
     return res.status(400).json({ error: 'Invalid or expired reset token' });
   }
 
   const hashed = await bcrypt.hash(password, 10);
-  if (user) await User.update(user.id, { password: hashed, resetToken: '' });
-  else if (admin) await Admin.update(admin.id, { password: hashed, resetToken: '' });
+${rpPersist}
 
   res.json({ message: 'Password reset successfully' });
 };
 ` : `import bcrypt from 'bcrypt';
-import { User } from '../../model/User.js';
-import { Admin } from '../../model/Admin.js';
-${rpMeta}export const POST = async (req, res) => {
+${rpModelImports}${rpMeta}export const POST = async (req, res) => {
   const { token, password } = req.body;
   if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
 
-  const user = await User.findOne({ resetToken: token });
-  const admin = user ? null : await Admin.findOne({ resetToken: token });
-  const account = user || admin;
+${rpLookup}
 
   if (!account || !account.resetTokenExpiry || new Date(account.resetTokenExpiry) < new Date()) {
     return res.status(400).json({ error: 'Invalid or expired reset token' });
   }
 
   const hashed = await bcrypt.hash(password, 10);
-  if (user) await User.update(user.id, { password: hashed, resetToken: '' });
-  else if (admin) await Admin.update(admin.id, { password: hashed, resetToken: '' });
+${rpPersist}
 
   res.json({ message: 'Password reset successfully' });
 };
@@ -2152,11 +2207,17 @@ ${rpMeta}export const POST = async (req: Request, res: Response) => {
   res.json({ message: 'Password reset successfully' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", `reset-password.${ext}`), rpContent);
-  const cpMeta = mkMeta(opts, {
-    POST: { description: "Change password for the authenticated user.", request: `{ oldPassword: 'current', newPassword: 'newpassword' }`, response: `{ message: 'Password changed successfully' }` }
-  });
-  const cpContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "auth", `reset-password.${ext}`), rpContent);
+  }
+  if (uf.accountSecurity) {
+    const cpMeta = mkMeta(opts, {
+      POST: {
+        description: "Change password for the authenticated user.",
+        request: `{ oldPassword: 'current', newPassword: 'newpassword' }`,
+        response: `{ message: 'Password changed successfully' }`
+      }
+    });
+    const cpContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${cpMeta}${mwUser2}
 export const POST = async (req: Request, res: Response) => {
   const { oldPassword, newPassword } = req.body;
@@ -2172,12 +2233,19 @@ export const POST = async (req, res) => {
   res.json({ message: 'Password changed successfully' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", `change-password.${ext}`), cpContent);
-  const tfaSetupMeta = mkMeta(opts, {
-    GET: { description: "Generate a TOTP secret and QR code to set up 2FA.", response: `{ qrCode: 'otpauth://totp/...', secret: 'BASE32SECRET' }` },
-    POST: { description: "Confirm a TOTP code to enable 2FA for the authenticated user.", request: `{ code: '123456' }`, response: `{ message: '2FA enabled' }` }
-  });
-  const tfaSetupContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "auth", `change-password.${ext}`), cpContent);
+    const tfaSetupMeta = mkMeta(opts, {
+      GET: {
+        description: "Generate a TOTP secret and QR code to set up 2FA.",
+        response: `{ qrCode: 'otpauth://totp/...', secret: 'BASE32SECRET' }`
+      },
+      POST: {
+        description: "Confirm a TOTP code to enable 2FA for the authenticated user.",
+        request: `{ code: '123456' }`,
+        response: `{ message: '2FA enabled' }`
+      }
+    });
+    const tfaSetupContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${tfaSetupMeta}${mwUser3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: generate TOTP secret and return QR code URL
@@ -2203,11 +2271,18 @@ export const POST = async (req, res) => {
   res.json({ message: '2FA enabled' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", "2fa", `setup.${ext}`), tfaSetupContent);
-  const tfaVerifyMeta = mkMeta(opts, {
-    POST: { description: "Verify a TOTP code during login.", request: `{ code: '123456' }`, response: `{ message: '2FA verified' }` }
-  });
-  const tfaVerifyContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "2fa", `setup.${ext}`),
+      tfaSetupContent
+    );
+    const tfaVerifyMeta = mkMeta(opts, {
+      POST: {
+        description: "Verify a TOTP code during login.",
+        request: `{ code: '123456' }`,
+        response: `{ message: '2FA verified' }`
+      }
+    });
+    const tfaVerifyContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${tfaVerifyMeta}export const POST = async (req: Request, res: Response) => {
   const { code } = req.body;
   if (!code) return res.status(400).json({ error: 'code is required' });
@@ -2221,11 +2296,18 @@ ${tfaVerifyMeta}export const POST = async (req: Request, res: Response) => {
   res.json({ message: '2FA verified' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", "2fa", `verify.${ext}`), tfaVerifyContent);
-  const tfaDisableMeta = mkMeta(opts, {
-    POST: { description: "Disable 2FA for the authenticated user.", request: `{ code: '123456' }`, response: `{ message: '2FA disabled' }` }
-  });
-  const tfaDisableContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "2fa", `verify.${ext}`),
+      tfaVerifyContent
+    );
+    const tfaDisableMeta = mkMeta(opts, {
+      POST: {
+        description: "Disable 2FA for the authenticated user.",
+        request: `{ code: '123456' }`,
+        response: `{ message: '2FA disabled' }`
+      }
+    });
+    const tfaDisableContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${tfaDisableMeta}${mwUser3}
 export const POST = async (req: Request, res: Response) => {
   const { code } = req.body;
@@ -2241,11 +2323,17 @@ export const POST = async (req, res) => {
   res.json({ message: '2FA disabled' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", "2fa", `disable.${ext}`), tfaDisableContent);
-  const sessListMeta = mkMeta(opts, {
-    GET: { description: "List all active sessions for the authenticated user.", response: `{ sessions: [] }` }
-  });
-  const sessListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "2fa", `disable.${ext}`),
+      tfaDisableContent
+    );
+    const sessListMeta = mkMeta(opts, {
+      GET: {
+        description: "List all active sessions for the authenticated user.",
+        response: `{ sessions: [] }`
+      }
+    });
+    const sessListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${sessListMeta}${mwUser3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch sessions for req.user.id
@@ -2257,11 +2345,18 @@ export const GET = async (req, res) => {
   res.json({ sessions: [] });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", "sessions", `index.${ext}`), sessListContent);
-  const sessRevokeMeta = mkMeta(opts, {
-    DELETE: { description: "Revoke a single active session by ID.", params: `{ id: 'sess_01HXZ' }`, response: `{ message: 'Session sess_01HXZ revoked' }` }
-  });
-  const sessRevokeContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "sessions", `index.${ext}`),
+      sessListContent
+    );
+    const sessRevokeMeta = mkMeta(opts, {
+      DELETE: {
+        description: "Revoke a single active session by ID.",
+        params: `{ id: 'sess_01HXZ' }`,
+        response: `{ message: 'Session sess_01HXZ revoked' }`
+      }
+    });
+    const sessRevokeContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${sessRevokeMeta}${mwUser3}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2275,7 +2370,11 @@ export const DELETE = async (req, res) => {
   res.json({ message: \`Session \${id} revoked\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "auth", "sessions", `[id].${ext}`), sessRevokeContent);
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "sessions", `[id].${ext}`),
+      sessRevokeContent
+    );
+  }
 }
 async function writeUserExtendedRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
@@ -2287,11 +2386,19 @@ async function writeUserExtendedRoutes(dest, opts) {
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
   const user = ts ? `(req as any).user` : `req.user`;
-  const avatarMeta = mkMeta(opts, {
-    POST: { description: "Upload a new avatar image for the authenticated user.", response: `{ message: 'Avatar updated', url: 'https://example.com/avatar.jpg' }` },
-    DELETE: { description: "Remove the authenticated user's avatar.", response: `{ message: 'Avatar removed' }` }
-  });
-  const avatarContent = ts ? `${RA}import type { Request, Response } from 'express';
+  const uf = opts.userFeatures;
+  if (uf.accountSettings) {
+    const avatarMeta = mkMeta(opts, {
+      POST: {
+        description: "Upload a new avatar image for the authenticated user.",
+        response: `{ message: 'Avatar updated', url: 'https://example.com/avatar.jpg' }`
+      },
+      DELETE: {
+        description: "Remove the authenticated user's avatar.",
+        response: `{ message: 'Avatar removed' }`
+      }
+    });
+    const avatarContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${avatarMeta}${mw2}
 export const POST = async (req: Request, res: Response) => {
   // TODO: handle multipart upload, store file, update user.avatar
@@ -2313,12 +2420,19 @@ export const DELETE = async (req, res) => {
   res.json({ message: 'Avatar removed' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", `avatar.${ext}`), avatarContent);
-  const settingsMeta = mkMeta(opts, {
-    GET: { description: "Get account settings (notifications, language, theme, privacy) for the authenticated user.", response: `{ settings: { notifications: true, language: 'en', theme: 'system', privacy: 'public' } }` },
-    PUT: { description: "Update account settings for the authenticated user.", request: `{ notifications: true, language: 'en', theme: 'system', privacy: 'public' }`, response: `{ message: 'Settings updated', settings: { notifications: true, language: 'en', theme: 'system', privacy: 'public' } }` }
-  });
-  const settingsContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "user", `avatar.${ext}`), avatarContent);
+    const settingsMeta = mkMeta(opts, {
+      GET: {
+        description: "Get account settings (notifications, language, theme, privacy) for the authenticated user.",
+        response: `{ settings: { notifications: true, language: 'en', theme: 'system', privacy: 'public' } }`
+      },
+      PUT: {
+        description: "Update account settings for the authenticated user.",
+        request: `{ notifications: true, language: 'en', theme: 'system', privacy: 'public' }`,
+        response: `{ message: 'Settings updated', settings: { notifications: true, language: 'en', theme: 'system', privacy: 'public' } }`
+      }
+    });
+    const settingsContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${settingsMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch user settings from DB
@@ -2342,12 +2456,19 @@ export const PUT = async (req, res) => {
   res.json({ message: 'Settings updated', settings: { notifications, language, theme, privacy } });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", `settings.${ext}`), settingsContent);
-  const accountMeta = mkMeta(opts, {
-    GET: { description: "Download a personal data export for the authenticated user.", response: `{ data: { user: { id: '1', role: 'user', email: 'user@example.com' }, exportedAt: '2026-01-01T00:00:00.000Z' } }` },
-    DELETE: { description: "Schedule the authenticated account for deletion (requires password confirmation).", request: `{ password: 'current' }`, response: `{ message: 'Account scheduled for deletion' }` }
-  });
-  const accountContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "user", `settings.${ext}`), settingsContent);
+    const accountMeta = mkMeta(opts, {
+      GET: {
+        description: "Download a personal data export for the authenticated user.",
+        response: `{ data: { user: { id: '1', role: 'user', email: 'user@example.com' }, exportedAt: '2026-01-01T00:00:00.000Z' } }`
+      },
+      DELETE: {
+        description: "Schedule the authenticated account for deletion (requires password confirmation).",
+        request: `{ password: 'current' }`,
+        response: `{ message: 'Account scheduled for deletion' }`
+      }
+    });
+    const accountContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${accountMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   // TODO: compile and return personal data export
@@ -2373,11 +2494,14 @@ export const DELETE = async (req, res) => {
   res.json({ message: 'Account scheduled for deletion' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", `account.${ext}`), accountContent);
-  const dashMeta = mkMeta(opts, {
-    GET: { description: "Personal dashboard: stats, recent activity, and quick actions.", response: `{ stats: {}, recentActivity: [], quickActions: [] }` }
-  });
-  const dashContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "user", `account.${ext}`), accountContent);
+    const dashMeta = mkMeta(opts, {
+      GET: {
+        description: "Personal dashboard: stats, recent activity, and quick actions.",
+        response: `{ stats: {}, recentActivity: [], quickActions: [] }`
+      }
+    });
+    const dashContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${dashMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   // TODO: aggregate personal stats and activity
@@ -2389,11 +2513,15 @@ export const GET = async (req, res) => {
   res.json({ stats: {}, recentActivity: [], quickActions: [] });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", `dashboard.${ext}`), dashContent);
-  const actMeta = mkMeta(opts, {
-    GET: { description: "Paginated activity history for the authenticated user.", query: `{ page: '1', limit: '20' }`, response: `{ activities: [], total: 0, page: 1, limit: 20 }` }
-  });
-  const actContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "user", `dashboard.${ext}`), dashContent);
+    const actMeta = mkMeta(opts, {
+      GET: {
+        description: "Paginated activity history for the authenticated user.",
+        query: `{ page: '1', limit: '20' }`,
+        response: `{ activities: [], total: 0, page: 1, limit: 20 }`
+      }
+    });
+    const actContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${actMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   const { page = 1, limit = 20 } = req.query;
@@ -2407,12 +2535,20 @@ export const GET = async (req, res) => {
   res.json({ activities: [], total: 0, page: Number(page), limit: Number(limit) });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", `activity.${ext}`), actContent);
-  const notifListMeta = mkMeta(opts, {
-    GET: { description: "List notifications for the authenticated user.", response: `{ notifications: [], total: 0, unread: 0 }` },
-    POST: { description: "Mark all notifications as read for the authenticated user.", response: `{ message: 'All notifications marked as read' }` }
-  });
-  const notifListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "user", `activity.${ext}`), actContent);
+  }
+  if (uf.notifications) {
+    const notifListMeta = mkMeta(opts, {
+      GET: {
+        description: "List notifications for the authenticated user.",
+        response: `{ notifications: [], total: 0, unread: 0 }`
+      },
+      POST: {
+        description: "Mark all notifications as read for the authenticated user.",
+        response: `{ message: 'All notifications marked as read' }`
+      }
+    });
+    const notifListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${notifListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch notifications for user
@@ -2434,13 +2570,28 @@ export const POST = async (req, res) => {
   res.json({ message: 'All notifications marked as read' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "notifications", `index.${ext}`), notifListContent);
-  const notifByIdMeta = mkMeta(opts, {
-    GET: { description: "Fetch a single notification by ID.", params: `{ id: 'notif_01HXZ' }`, response: `{ notification: { id: 'notif_01HXZ' } }` },
-    PATCH: { description: "Mark a single notification as read.", params: `{ id: 'notif_01HXZ' }`, response: `{ message: 'Notification marked as read', id: 'notif_01HXZ' }` },
-    DELETE: { description: "Delete a single notification.", params: `{ id: 'notif_01HXZ' }`, response: `{ message: 'Notification notif_01HXZ deleted' }` }
-  });
-  const notifByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "notifications", `index.${ext}`),
+      notifListContent
+    );
+    const notifByIdMeta = mkMeta(opts, {
+      GET: {
+        description: "Fetch a single notification by ID.",
+        params: `{ id: 'notif_01HXZ' }`,
+        response: `{ notification: { id: 'notif_01HXZ' } }`
+      },
+      PATCH: {
+        description: "Mark a single notification as read.",
+        params: `{ id: 'notif_01HXZ' }`,
+        response: `{ message: 'Notification marked as read', id: 'notif_01HXZ' }`
+      },
+      DELETE: {
+        description: "Delete a single notification.",
+        params: `{ id: 'notif_01HXZ' }`,
+        response: `{ message: 'Notification notif_01HXZ deleted' }`
+      }
+    });
+    const notifByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${notifByIdMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2478,12 +2629,24 @@ export const DELETE = async (req, res) => {
   res.json({ message: \`Notification \${id} deleted\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "notifications", `[id].${ext}`), notifByIdContent);
-  const filesListMeta = mkMeta(opts, {
-    GET: { description: "List uploaded files with storage usage for the authenticated user.", response: `{ files: [], total: 0, storageUsed: 0 }` },
-    POST: { description: "Upload a new file for the authenticated user.", response: `{ message: 'File uploaded', file: { id: 'new-id' } }`, status: 201 }
-  });
-  const filesListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "notifications", `[id].${ext}`),
+      notifByIdContent
+    );
+  }
+  if (uf.filesAndMedia) {
+    const filesListMeta = mkMeta(opts, {
+      GET: {
+        description: "List uploaded files with storage usage for the authenticated user.",
+        response: `{ files: [], total: 0, storageUsed: 0 }`
+      },
+      POST: {
+        description: "Upload a new file for the authenticated user.",
+        response: `{ message: 'File uploaded', file: { id: 'new-id' } }`,
+        status: 201
+      }
+    });
+    const filesListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${filesListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch user files and compute storage usage
@@ -2505,12 +2668,23 @@ export const POST = async (req, res) => {
   res.status(201).json({ message: 'File uploaded', file: { id: 'new-id' } });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "files", `index.${ext}`), filesListContent);
-  const fileByIdMeta = mkMeta(opts, {
-    GET: { description: "Get a download/preview URL for a single file by ID.", params: `{ id: 'file_01HXZ' }`, response: `{ file: { id: 'file_01HXZ', url: 'https://example.com/files/file_01HXZ' } }` },
-    DELETE: { description: "Delete a file from storage.", params: `{ id: 'file_01HXZ' }`, response: `{ message: 'File file_01HXZ deleted' }` }
-  });
-  const fileByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "files", `index.${ext}`),
+      filesListContent
+    );
+    const fileByIdMeta = mkMeta(opts, {
+      GET: {
+        description: "Get a download/preview URL for a single file by ID.",
+        params: `{ id: 'file_01HXZ' }`,
+        response: `{ file: { id: 'file_01HXZ', url: 'https://example.com/files/file_01HXZ' } }`
+      },
+      DELETE: {
+        description: "Delete a file from storage.",
+        params: `{ id: 'file_01HXZ' }`,
+        response: `{ message: 'File file_01HXZ deleted' }`
+      }
+    });
+    const fileByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${fileByIdMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2536,12 +2710,23 @@ export const DELETE = async (req, res) => {
   res.json({ message: \`File \${id} deleted\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "files", `[id].${ext}`), fileByIdContent);
-  const favListMeta = mkMeta(opts, {
-    GET: { description: "List favorites for the authenticated user.", response: `{ favorites: [] }` },
-    POST: { description: "Add an entity to the authenticated user's favorites.", request: `{ entityId: 'post_01HXZ', entityType: 'post' }`, response: `{ message: 'Added to favorites' }`, status: 201 }
-  });
-  const favListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "files", `[id].${ext}`),
+      fileByIdContent
+    );
+    const favListMeta = mkMeta(opts, {
+      GET: {
+        description: "List favorites for the authenticated user.",
+        response: `{ favorites: [] }`
+      },
+      POST: {
+        description: "Add an entity to the authenticated user's favorites.",
+        request: `{ entityId: 'post_01HXZ', entityType: 'post' }`,
+        response: `{ message: 'Added to favorites' }`,
+        status: 201
+      }
+    });
+    const favListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${favListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch user favorites
@@ -2567,11 +2752,18 @@ export const POST = async (req, res) => {
   res.status(201).json({ message: 'Added to favorites' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "favorites", `index.${ext}`), favListContent);
-  const favByIdMeta = mkMeta(opts, {
-    DELETE: { description: "Remove an entity from the authenticated user favorites.", params: `{ id: 'fav_01HXZ' }`, response: `{ message: 'Removed favorite fav_01HXZ' }` }
-  });
-  const favByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "favorites", `index.${ext}`),
+      favListContent
+    );
+    const favByIdMeta = mkMeta(opts, {
+      DELETE: {
+        description: "Remove an entity from the authenticated user favorites.",
+        params: `{ id: 'fav_01HXZ' }`,
+        response: `{ message: 'Removed favorite fav_01HXZ' }`
+      }
+    });
+    const favByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${favByIdMeta}${mw3}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2585,12 +2777,23 @@ export const DELETE = async (req, res) => {
   res.json({ message: \`Removed favorite \${id}\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "favorites", `[id].${ext}`), favByIdContent);
-  const bkListMeta = mkMeta(opts, {
-    GET: { description: "List bookmarks for the authenticated user.", response: `{ bookmarks: [] }` },
-    POST: { description: "Save a new bookmark for the authenticated user.", request: `{ url: 'https://example.com', title: 'Example' }`, response: `{ message: 'Bookmark saved' }`, status: 201 }
-  });
-  const bkListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "favorites", `[id].${ext}`),
+      favByIdContent
+    );
+    const bkListMeta = mkMeta(opts, {
+      GET: {
+        description: "List bookmarks for the authenticated user.",
+        response: `{ bookmarks: [] }`
+      },
+      POST: {
+        description: "Save a new bookmark for the authenticated user.",
+        request: `{ url: 'https://example.com', title: 'Example' }`,
+        response: `{ message: 'Bookmark saved' }`,
+        status: 201
+      }
+    });
+    const bkListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${bkListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch user bookmarks
@@ -2616,11 +2819,18 @@ export const POST = async (req, res) => {
   res.status(201).json({ message: 'Bookmark saved' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "bookmarks", `index.${ext}`), bkListContent);
-  const bkByIdMeta = mkMeta(opts, {
-    DELETE: { description: "Delete a bookmark by ID.", params: `{ id: 'bm_01HXZ' }`, response: `{ message: 'Bookmark bm_01HXZ removed' }` }
-  });
-  const bkByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "bookmarks", `index.${ext}`),
+      bkListContent
+    );
+    const bkByIdMeta = mkMeta(opts, {
+      DELETE: {
+        description: "Delete a bookmark by ID.",
+        params: `{ id: 'bm_01HXZ' }`,
+        response: `{ message: 'Bookmark bm_01HXZ removed' }`
+      }
+    });
+    const bkByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${bkByIdMeta}${mw3}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2634,11 +2844,18 @@ export const DELETE = async (req, res) => {
   res.json({ message: \`Bookmark \${id} removed\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "bookmarks", `[id].${ext}`), bkByIdContent);
-  const searchMeta = mkMeta(opts, {
-    GET: { description: "Search with filters, sort, and pagination.", query: `{ q: 'query', filter: 'active', sort: 'newest', page: '1', limit: '20' }`, response: `{ results: [], total: 0, page: 1, limit: 20 }` }
-  });
-  const searchContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "bookmarks", `[id].${ext}`),
+      bkByIdContent
+    );
+    const searchMeta = mkMeta(opts, {
+      GET: {
+        description: "Search with filters, sort, and pagination.",
+        query: `{ q: 'query', filter: 'active', sort: 'newest', page: '1', limit: '20' }`,
+        response: `{ results: [], total: 0, page: 1, limit: 20 }`
+      }
+    });
+    const searchContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${searchMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   const { q, filter, sort, page = 1, limit = 20 } = req.query;
@@ -2652,12 +2869,19 @@ export const GET = async (req, res) => {
   res.json({ results: [], total: 0, page: Number(page), limit: Number(limit) });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", `search.${ext}`), searchContent);
-  const akListMeta = mkMeta(opts, {
-    GET: { description: "List API keys for the authenticated user.", response: `{ apiKeys: [] }` },
-    POST: { description: "Generate a new API key for the authenticated user.", request: `{ name: 'CI key' }`, response: `{ message: 'API key created', key: 'efc_...' }`, status: 201 }
-  });
-  const akListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(path.join(dest, "src", "api", "user", `search.${ext}`), searchContent);
+  }
+  if (uf.apiAndBilling) {
+    const akListMeta = mkMeta(opts, {
+      GET: { description: "List API keys for the authenticated user.", response: `{ apiKeys: [] }` },
+      POST: {
+        description: "Generate a new API key for the authenticated user.",
+        request: `{ name: 'CI key' }`,
+        response: `{ message: 'API key created', key: 'efc_...' }`,
+        status: 201
+      }
+    });
+    const akListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${akListMeta}${mw3}
 export const GET = async (req: Request, res: Response) => {
   // TODO: fetch api keys for user
@@ -2683,11 +2907,18 @@ export const POST = async (req, res) => {
   res.status(201).json({ message: 'API key created', key: 'efc_...' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "api-keys", `index.${ext}`), akListContent);
-  const akByIdMeta = mkMeta(opts, {
-    DELETE: { description: "Revoke and delete an API key by ID.", params: `{ id: 'key_01HXZ' }`, response: `{ message: 'API key key_01HXZ revoked' }` }
-  });
-  const akByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "api-keys", `index.${ext}`),
+      akListContent
+    );
+    const akByIdMeta = mkMeta(opts, {
+      DELETE: {
+        description: "Revoke and delete an API key by ID.",
+        params: `{ id: 'key_01HXZ' }`,
+        response: `{ message: 'API key key_01HXZ revoked' }`
+      }
+    });
+    const akByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${akByIdMeta}${mw3}
 export const DELETE = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -2701,7 +2932,11 @@ export const DELETE = async (req, res) => {
   res.json({ message: \`API key \${id} revoked\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "api-keys", `[id].${ext}`), akByIdContent);
+    await fs.outputFile(
+      path.join(dest, "src", "api", "user", "api-keys", `[id].${ext}`),
+      akByIdContent
+    );
+  }
 }
 async function writeUserBillingRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
@@ -2727,11 +2962,25 @@ export const GET = async (_req, res) => {
   res.json({ plans: [] });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "billing", `plans.${ext}`), plansContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "user", "billing", `plans.${ext}`),
+    plansContent
+  );
   const subMeta = mkMeta(opts, {
-    GET: { description: "Get the current subscription for the authenticated user.", response: `{ subscription: null }` },
-    POST: { description: "Subscribe the authenticated user to a plan.", request: `{ planId: 'plan_01HXZ' }`, response: `{ message: 'Subscribed', subscription: { planId: 'plan_01HXZ' } }`, status: 201 },
-    DELETE: { description: "Cancel the current subscription at period end.", response: `{ message: 'Subscription cancelled' }` }
+    GET: {
+      description: "Get the current subscription for the authenticated user.",
+      response: `{ subscription: null }`
+    },
+    POST: {
+      description: "Subscribe the authenticated user to a plan.",
+      request: `{ planId: 'plan_01HXZ' }`,
+      response: `{ message: 'Subscribed', subscription: { planId: 'plan_01HXZ' } }`,
+      status: 201
+    },
+    DELETE: {
+      description: "Cancel the current subscription at period end.",
+      response: `{ message: 'Subscription cancelled' }`
+    }
   });
   const subContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${subMeta}${mw3}
@@ -2769,10 +3018,21 @@ export const DELETE = async (req, res) => {
   res.json({ message: 'Subscription cancelled' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "billing", `subscription.${ext}`), subContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "user", "billing", `subscription.${ext}`),
+    subContent
+  );
   const pmListMeta = mkMeta(opts, {
-    GET: { description: "List payment methods for the authenticated user.", response: `{ paymentMethods: [] }` },
-    POST: { description: "Attach a new payment method via the payment gateway.", request: `{ token: 'tok_...' }`, response: `{ message: 'Payment method added' }`, status: 201 }
+    GET: {
+      description: "List payment methods for the authenticated user.",
+      response: `{ paymentMethods: [] }`
+    },
+    POST: {
+      description: "Attach a new payment method via the payment gateway.",
+      request: `{ token: 'tok_...' }`,
+      response: `{ message: 'Payment method added' }`,
+      status: 201
+    }
   });
   const pmListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${pmListMeta}${mw4}
@@ -2800,9 +3060,16 @@ export const POST = async (req, res) => {
   res.status(201).json({ message: 'Payment method added' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "billing", "payment-methods", `index.${ext}`), pmListContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "user", "billing", "payment-methods", `index.${ext}`),
+    pmListContent
+  );
   const pmByIdMeta = mkMeta(opts, {
-    DELETE: { description: "Detach a payment method from the payment gateway.", params: `{ id: 'pm_01HXZ' }`, response: `{ message: 'Payment method pm_01HXZ removed' }` }
+    DELETE: {
+      description: "Detach a payment method from the payment gateway.",
+      params: `{ id: 'pm_01HXZ' }`,
+      response: `{ message: 'Payment method pm_01HXZ removed' }`
+    }
   });
   const pmByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${pmByIdMeta}${mw4}
@@ -2818,9 +3085,15 @@ export const DELETE = async (req, res) => {
   res.json({ message: \`Payment method \${id} removed\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "billing", "payment-methods", `[id].${ext}`), pmByIdContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "user", "billing", "payment-methods", `[id].${ext}`),
+    pmByIdContent
+  );
   const invListMeta = mkMeta(opts, {
-    GET: { description: "List all invoices for the authenticated user.", response: `{ invoices: [], total: 0 }` }
+    GET: {
+      description: "List all invoices for the authenticated user.",
+      response: `{ invoices: [], total: 0 }`
+    }
   });
   const invListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${invListMeta}${mw4}
@@ -2834,9 +3107,16 @@ export const GET = async (req, res) => {
   res.json({ invoices: [], total: 0 });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "billing", "invoices", `index.${ext}`), invListContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "user", "billing", "invoices", `index.${ext}`),
+    invListContent
+  );
   const invByIdMeta = mkMeta(opts, {
-    GET: { description: "Get the download URL for a single invoice by ID.", params: `{ id: 'inv_01HXZ' }`, response: `{ invoice: { id: 'inv_01HXZ', downloadUrl: 'https://example.com/invoices/inv_01HXZ.pdf' } }` }
+    GET: {
+      description: "Get the download URL for a single invoice by ID.",
+      params: `{ id: 'inv_01HXZ' }`,
+      response: `{ invoice: { id: 'inv_01HXZ', downloadUrl: 'https://example.com/invoices/inv_01HXZ.pdf' } }`
+    }
   });
   const invByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${invByIdMeta}${mw4}
@@ -2852,7 +3132,10 @@ export const GET = async (req, res) => {
   res.json({ invoice: { id, downloadUrl: 'https://...' } });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "user", "billing", "invoices", `[id].${ext}`), invByIdContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "user", "billing", "invoices", `[id].${ext}`),
+    invByIdContent
+  );
 }
 async function writeSupportRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
@@ -2863,8 +3146,16 @@ async function writeSupportRoutes(dest, opts) {
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
   const ticketListMeta = mkMeta(opts, {
-    GET: { description: "List the authenticated user's own support tickets.", response: `{ tickets: [], total: 0 }` },
-    POST: { description: "Create a new support ticket.", request: `{ subject: 'Issue with login', message: 'I cannot log in', priority: 'normal' }`, response: `{ message: 'Ticket created', ticket: { id: 'new-id', subject: 'Issue with login', status: 'open' } }`, status: 201 }
+    GET: {
+      description: "List the authenticated user's own support tickets.",
+      response: `{ tickets: [], total: 0 }`
+    },
+    POST: {
+      description: "Create a new support ticket.",
+      request: `{ subject: 'Issue with login', message: 'I cannot log in', priority: 'normal' }`,
+      response: `{ message: 'Ticket created', ticket: { id: 'new-id', subject: 'Issue with login', status: 'open' } }`,
+      status: 201
+    }
   });
   const ticketListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${ticketListMeta}${mw3}
@@ -2892,10 +3183,22 @@ export const POST = async (req, res) => {
   res.status(201).json({ message: 'Ticket created', ticket: { id: 'new-id', subject, status: 'open' } });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "support", "tickets", `index.${ext}`), ticketListContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "support", "tickets", `index.${ext}`),
+    ticketListContent
+  );
   const ticketByIdMeta = mkMeta(opts, {
-    GET: { description: "Fetch a single support ticket by ID.", params: `{ id: 'tk_01HXZ' }`, response: `{ ticket: { id: 'tk_01HXZ', subject: 'Issue', status: 'open', replies: [] } }` },
-    PUT: { description: "Add a reply to a support ticket or update its status.", params: `{ id: 'tk_01HXZ' }`, request: `{ reply: 'Thanks, resolved.', status: 'closed' }`, response: `{ message: 'Ticket updated', ticket: { id: 'tk_01HXZ', status: 'closed' } }` }
+    GET: {
+      description: "Fetch a single support ticket by ID.",
+      params: `{ id: 'tk_01HXZ' }`,
+      response: `{ ticket: { id: 'tk_01HXZ', subject: 'Issue', status: 'open', replies: [] } }`
+    },
+    PUT: {
+      description: "Add a reply to a support ticket or update its status.",
+      params: `{ id: 'tk_01HXZ' }`,
+      request: `{ reply: 'Thanks, resolved.', status: 'closed' }`,
+      response: `{ message: 'Ticket updated', ticket: { id: 'tk_01HXZ', status: 'closed' } }`
+    }
   });
   const ticketByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${ticketByIdMeta}${mw3}
@@ -2925,7 +3228,10 @@ export const PUT = async (req, res) => {
   res.json({ message: 'Ticket updated', ticket: { id, status: status ?? 'open' } });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "support", "tickets", `[id].${ext}`), ticketByIdContent);
+  await fs.outputFile(
+    path.join(dest, "src", "api", "support", "tickets", `[id].${ext}`),
+    ticketByIdContent
+  );
 }
 async function writeAdminExtendedRoutes(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
@@ -2941,10 +3247,15 @@ async function writeAdminExtendedRoutes(dest, opts) {
 `;
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
-  const analyticsOverviewMeta = mkMeta(opts, {
-    GET: { description: "Analytics overview: users, revenue, traffic (admin only).", response: `{ users: {}, revenue: {}, traffic: {} }` }
-  });
-  const analyticsOverviewContent = ts ? `${RA}import type { Request, Response } from 'express';
+  const af = opts.adminFeatures;
+  if (af.analytics) {
+    const analyticsOverviewMeta = mkMeta(opts, {
+      GET: {
+        description: "Analytics overview: users, revenue, traffic (admin only).",
+        response: `{ users: {}, revenue: {}, traffic: {} }`
+      }
+    });
+    const analyticsOverviewContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${analyticsOverviewMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  // TODO: aggregate analytics overview
@@ -2956,11 +3267,18 @@ ${roleGuard}  // TODO: aggregate analytics overview
   res.json({ users: {}, revenue: {}, traffic: {} });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "analytics", `index.${ext}`), analyticsOverviewContent);
-  const analyticsUsersMeta = mkMeta(opts, {
-    GET: { description: "User analytics: registrations, active users, churn (admin only).", query: `{ period: '30d' }`, response: `{ registrations: [], activeUsers: 0, churn: 0, period: '30d' }` }
-  });
-  const analyticsUsersContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "analytics", `index.${ext}`),
+      analyticsOverviewContent
+    );
+    const analyticsUsersMeta = mkMeta(opts, {
+      GET: {
+        description: "User analytics: registrations, active users, churn (admin only).",
+        query: `{ period: '30d' }`,
+        response: `{ registrations: [], activeUsers: 0, churn: 0, period: '30d' }`
+      }
+    });
+    const analyticsUsersContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${analyticsUsersMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { period = '30d' } = req.query;
@@ -2974,11 +3292,18 @@ ${roleGuard}  const { period = '30d' } = req.query;
   res.json({ registrations: [], activeUsers: 0, churn: 0, period });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "analytics", `users.${ext}`), analyticsUsersContent);
-  const analyticsRevenueMeta = mkMeta(opts, {
-    GET: { description: "Revenue analytics: MRR, ARR, payment history (admin only).", query: `{ period: '30d' }`, response: `{ mrr: 0, arr: 0, history: [], period: '30d' }` }
-  });
-  const analyticsRevenueContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "analytics", `users.${ext}`),
+      analyticsUsersContent
+    );
+    const analyticsRevenueMeta = mkMeta(opts, {
+      GET: {
+        description: "Revenue analytics: MRR, ARR, payment history (admin only).",
+        query: `{ period: '30d' }`,
+        response: `{ mrr: 0, arr: 0, history: [], period: '30d' }`
+      }
+    });
+    const analyticsRevenueContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${analyticsRevenueMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { period = '30d' } = req.query;
@@ -2992,11 +3317,18 @@ ${roleGuard}  const { period = '30d' } = req.query;
   res.json({ mrr: 0, arr: 0, history: [], period });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "analytics", `revenue.${ext}`), analyticsRevenueContent);
-  const analyticsTrafficMeta = mkMeta(opts, {
-    GET: { description: "Traffic analytics: page views, devices, countries (admin only).", query: `{ period: '30d' }`, response: `{ pageViews: 0, devices: {}, countries: {}, period: '30d' }` }
-  });
-  const analyticsTrafficContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "analytics", `revenue.${ext}`),
+      analyticsRevenueContent
+    );
+    const analyticsTrafficMeta = mkMeta(opts, {
+      GET: {
+        description: "Traffic analytics: page views, devices, countries (admin only).",
+        query: `{ period: '30d' }`,
+        response: `{ pageViews: 0, devices: {}, countries: {}, period: '30d' }`
+      }
+    });
+    const analyticsTrafficContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${analyticsTrafficMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { period = '30d' } = req.query;
@@ -3010,11 +3342,21 @@ ${roleGuard}  const { period = '30d' } = req.query;
   res.json({ pageViews: 0, devices: {}, countries: {}, period });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "analytics", `traffic.${ext}`), analyticsTrafficContent);
-  const suspendMeta = mkMeta(opts, {
-    POST: { description: "Suspend a user account (admin only).", params: `{ id: 'usr_01HXZ' }`, request: `{ reason: 'Terms of service violation' }`, response: `{ message: 'User usr_01HXZ suspended', reason: 'Terms of service violation' }` }
-  });
-  const suspendContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "analytics", `traffic.${ext}`),
+      analyticsTrafficContent
+    );
+  }
+  if (af.userManagement) {
+    const suspendMeta = mkMeta(opts, {
+      POST: {
+        description: "Suspend a user account (admin only).",
+        params: `{ id: 'usr_01HXZ' }`,
+        request: `{ reason: 'Terms of service violation' }`,
+        response: `{ message: 'User usr_01HXZ suspended', reason: 'Terms of service violation' }`
+      }
+    });
+    const suspendContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${suspendMeta}${mwAdmin4}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -3030,11 +3372,18 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: \`User \${id} suspended\`, reason });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "users", "[id]", `suspend.${ext}`), suspendContent);
-  const activateMeta = mkMeta(opts, {
-    POST: { description: "Reactivate a suspended user account (admin only).", params: `{ id: 'usr_01HXZ' }`, response: `{ message: 'User usr_01HXZ activated' }` }
-  });
-  const activateContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "users", "[id]", `suspend.${ext}`),
+      suspendContent
+    );
+    const activateMeta = mkMeta(opts, {
+      POST: {
+        description: "Reactivate a suspended user account (admin only).",
+        params: `{ id: 'usr_01HXZ' }`,
+        response: `{ message: 'User usr_01HXZ activated' }`
+      }
+    });
+    const activateContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${activateMeta}${mwAdmin4}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -3048,11 +3397,18 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: \`User \${id} activated\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "users", "[id]", `activate.${ext}`), activateContent);
-  const verifyUserMeta = mkMeta(opts, {
-    POST: { description: "Mark a user's email as verified (admin only).", params: `{ id: 'usr_01HXZ' }`, response: `{ message: 'User usr_01HXZ verified' }` }
-  });
-  const verifyUserContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "users", "[id]", `activate.${ext}`),
+      activateContent
+    );
+    const verifyUserMeta = mkMeta(opts, {
+      POST: {
+        description: "Mark a user's email as verified (admin only).",
+        params: `{ id: 'usr_01HXZ' }`,
+        response: `{ message: 'User usr_01HXZ verified' }`
+      }
+    });
+    const verifyUserContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${verifyUserMeta}${mwAdmin4}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -3066,11 +3422,17 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: \`User \${id} verified\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "users", "[id]", `verify.${ext}`), verifyUserContent);
-  const exportMeta = mkMeta(opts, {
-    GET: { description: "Export all users as a CSV download (admin only).", response: `'id,name,email,role,createdAt\\n'` }
-  });
-  const exportContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "users", "[id]", `verify.${ext}`),
+      verifyUserContent
+    );
+    const exportMeta = mkMeta(opts, {
+      GET: {
+        description: "Export all users as a CSV download (admin only).",
+        response: `'id,name,email,role,createdAt\\n'`
+      }
+    });
+    const exportContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${exportMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: generate CSV of all users and stream response
@@ -3086,12 +3448,25 @@ ${roleGuard}  // TODO: generate CSV of all users and stream response
   res.send('id,name,email,role,createdAt\\n');
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "users", `export.${ext}`), exportContent);
-  const adminsListMeta = mkMeta(opts, {
-    GET: { description: "List all admin accounts (admin only).", response: `{ admins: [], total: 0 }` },
-    POST: { description: "Create a new admin account (admin only).", request: `{ name: 'Jane Doe', email: 'jane@example.com', role: 'admin' }`, response: `{ message: 'Admin created', admin: { id: 'new-id', name: 'Jane Doe', email: 'jane@example.com', role: 'admin' } }`, status: 201 }
-  });
-  const adminsListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "users", `export.${ext}`),
+      exportContent
+    );
+  }
+  if (af.adminManagement) {
+    const adminsListMeta = mkMeta(opts, {
+      GET: {
+        description: "List all admin accounts (admin only).",
+        response: `{ admins: [], total: 0 }`
+      },
+      POST: {
+        description: "Create a new admin account (admin only).",
+        request: `{ name: 'Jane Doe', email: 'jane@example.com', role: 'admin' }`,
+        response: `{ message: 'Admin created', admin: { id: 'new-id', name: 'Jane Doe', email: 'jane@example.com', role: 'admin' } }`,
+        status: 201
+      }
+    });
+    const adminsListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminsListMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: fetch admins from DB
@@ -3117,13 +3492,29 @@ ${roleGuard}  const { name, email, role } = req.body;
   res.status(201).json({ message: 'Admin created', admin: { id: 'new-id', name, email, role: role ?? 'admin' } });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "admins", `index.${ext}`), adminsListContent);
-  const adminByIdMeta = mkMeta(opts, {
-    GET: { description: "Fetch a single admin account by ID (admin only).", params: `{ id: 'adm_01HXZ' }`, response: `{ admin: { id: 'adm_01HXZ' } }` },
-    PUT: { description: "Update an admin account by ID (admin only).", params: `{ id: 'adm_01HXZ' }`, request: `{ name: 'Jane Doe', role: 'admin' }`, response: `{ message: 'Admin updated', admin: { id: 'adm_01HXZ', name: 'Jane Doe', role: 'admin' } }` },
-    DELETE: { description: "Delete an admin account by ID (admin only).", params: `{ id: 'adm_01HXZ' }`, response: `{ message: 'Admin adm_01HXZ deleted' }` }
-  });
-  const adminByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "admins", `index.${ext}`),
+      adminsListContent
+    );
+    const adminByIdMeta = mkMeta(opts, {
+      GET: {
+        description: "Fetch a single admin account by ID (admin only).",
+        params: `{ id: 'adm_01HXZ' }`,
+        response: `{ admin: { id: 'adm_01HXZ' } }`
+      },
+      PUT: {
+        description: "Update an admin account by ID (admin only).",
+        params: `{ id: 'adm_01HXZ' }`,
+        request: `{ name: 'Jane Doe', role: 'admin' }`,
+        response: `{ message: 'Admin updated', admin: { id: 'adm_01HXZ', name: 'Jane Doe', role: 'admin' } }`
+      },
+      DELETE: {
+        description: "Delete an admin account by ID (admin only).",
+        params: `{ id: 'adm_01HXZ' }`,
+        response: `{ message: 'Admin adm_01HXZ deleted' }`
+      }
+    });
+    const adminByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminByIdMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -3161,13 +3552,21 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: \`Admin \${id} deleted\` });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "admins", `[id].${ext}`), adminByIdContent);
-  if (opts.rbac) {
-    const rolesListMeta = mkMeta(opts, {
-      GET: { description: "List all roles (admin only).", response: `{ roles: [] }` },
-      POST: { description: "Create a new role (admin only).", request: `{ name: 'editor', description: 'Can edit content', permissions: ['content:write'] }`, response: `{ message: 'Role created', role: { id: 'new-id', name: 'editor', permissions: ['content:write'] } }`, status: 201 }
-    });
-    const rolesListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "admins", `[id].${ext}`),
+      adminByIdContent
+    );
+    if (opts.rbac) {
+      const rolesListMeta = mkMeta(opts, {
+        GET: { description: "List all roles (admin only).", response: `{ roles: [] }` },
+        POST: {
+          description: "Create a new role (admin only).",
+          request: `{ name: 'editor', description: 'Can edit content', permissions: ['content:write'] }`,
+          response: `{ message: 'Role created', role: { id: 'new-id', name: 'editor', permissions: ['content:write'] } }`,
+          status: 201
+        }
+      });
+      const rolesListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${rolesListMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
   // TODO: fetch all roles
@@ -3193,13 +3592,29 @@ export const POST = async (req, res) => {
   res.status(201).json({ message: 'Role created', role: { id: 'new-id', name, permissions: permissions ?? [] } });
 };
 `;
-    await fs.outputFile(path.join(dest, "src", "api", "admin", "roles", `index.${ext}`), rolesListContent);
-    const roleByIdMeta = mkMeta(opts, {
-      GET: { description: "Fetch a single role by ID (admin only).", params: `{ id: 'role_01HXZ' }`, response: `{ role: { id: 'role_01HXZ', name: 'editor', permissions: ['content:write'] } }` },
-      PUT: { description: "Update a role by ID (admin only).", params: `{ id: 'role_01HXZ' }`, request: `{ name: 'editor', permissions: ['content:write'] }`, response: `{ message: 'Role updated', role: { id: 'role_01HXZ', name: 'editor', permissions: ['content:write'] } }` },
-      DELETE: { description: "Delete a role by ID (admin only).", params: `{ id: 'role_01HXZ' }`, response: `{ message: 'Role role_01HXZ deleted' }` }
-    });
-    const roleByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
+      await fs.outputFile(
+        path.join(dest, "src", "api", "admin", "roles", `index.${ext}`),
+        rolesListContent
+      );
+      const roleByIdMeta = mkMeta(opts, {
+        GET: {
+          description: "Fetch a single role by ID (admin only).",
+          params: `{ id: 'role_01HXZ' }`,
+          response: `{ role: { id: 'role_01HXZ', name: 'editor', permissions: ['content:write'] } }`
+        },
+        PUT: {
+          description: "Update a role by ID (admin only).",
+          params: `{ id: 'role_01HXZ' }`,
+          request: `{ name: 'editor', permissions: ['content:write'] }`,
+          response: `{ message: 'Role updated', role: { id: 'role_01HXZ', name: 'editor', permissions: ['content:write'] } }`
+        },
+        DELETE: {
+          description: "Delete a role by ID (admin only).",
+          params: `{ id: 'role_01HXZ' }`,
+          response: `{ message: 'Role role_01HXZ deleted' }`
+        }
+      });
+      const roleByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${roleByIdMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
   const { id } = req.params;
@@ -3237,13 +3652,26 @@ export const DELETE = async (req, res) => {
   res.json({ message: \`Role \${id} deleted\` });
 };
 `;
-    await fs.outputFile(path.join(dest, "src", "api", "admin", "roles", `[id].${ext}`), roleByIdContent);
+      await fs.outputFile(
+        path.join(dest, "src", "api", "admin", "roles", `[id].${ext}`),
+        roleByIdContent
+      );
+    }
   }
-  const adminNotifMeta = mkMeta(opts, {
-    GET: { description: "List all sent notifications (admin only).", response: `{ notifications: [], total: 0 }` },
-    POST: { description: "Send a notification to a specific user (admin only).", request: `{ userId: 'usr_01HXZ', title: 'Welcome', message: 'Thanks for joining!', type: 'info' }`, response: `{ message: 'Notification sent' }`, status: 201 }
-  });
-  const adminNotifContent = ts ? `${RA}import type { Request, Response } from 'express';
+  if (af.notificationsAndLogs) {
+    const adminNotifMeta = mkMeta(opts, {
+      GET: {
+        description: "List all sent notifications (admin only).",
+        response: `{ notifications: [], total: 0 }`
+      },
+      POST: {
+        description: "Send a notification to a specific user (admin only).",
+        request: `{ userId: 'usr_01HXZ', title: 'Welcome', message: 'Thanks for joining!', type: 'info' }`,
+        response: `{ message: 'Notification sent' }`,
+        status: 201
+      }
+    });
+    const adminNotifContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminNotifMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: fetch sent notifications
@@ -3269,11 +3697,18 @@ ${roleGuard}  const { userId, title, message, type } = req.body;
   res.status(201).json({ message: 'Notification sent' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "notifications", `index.${ext}`), adminNotifContent);
-  const broadcastMeta = mkMeta(opts, {
-    POST: { description: "Broadcast a notification to all users (admin only).", request: `{ title: 'Announcement', message: 'Hello everyone!', type: 'info' }`, response: `{ message: 'Broadcast sent', count: 0 }` }
-  });
-  const broadcastContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "notifications", `index.${ext}`),
+      adminNotifContent
+    );
+    const broadcastMeta = mkMeta(opts, {
+      POST: {
+        description: "Broadcast a notification to all users (admin only).",
+        request: `{ title: 'Announcement', message: 'Hello everyone!', type: 'info' }`,
+        response: `{ message: 'Broadcast sent', count: 0 }`
+      }
+    });
+    const broadcastContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${broadcastMeta}${mwAdmin3}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { title, message, type } = req.body;
@@ -3289,12 +3724,19 @@ ${roleGuard}  const { title, message, type } = req.body;
   res.json({ message: 'Broadcast sent', count: 0 });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "notifications", `broadcast.${ext}`), broadcastContent);
-  const mkLogContent = (label) => {
-    const meta = mkMeta(opts, {
-      GET: { description: `Paginated ${label} log entries (admin only).`, query: `{ page: '1', limit: '50' }`, response: `{ logs: [], total: 0, page: 1, limit: 50 }` }
-    });
-    return ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "notifications", `broadcast.${ext}`),
+      broadcastContent
+    );
+    const mkLogContent = (label) => {
+      const meta = mkMeta(opts, {
+        GET: {
+          description: `Paginated ${label} log entries (admin only).`,
+          query: `{ page: '1', limit: '50' }`,
+          response: `{ logs: [], total: 0, page: 1, limit: 50 }`
+        }
+      });
+      return ts ? `${RA}import type { Request, Response } from 'express';
 ${meta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { page = 1, limit = 50 } = req.query;
@@ -3308,15 +3750,30 @@ ${roleGuard}  const { page = 1, limit = 50 } = req.query;
   res.json({ logs: [], total: 0, page: Number(page), limit: Number(limit) });
 };
 `;
-  };
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "logs", `audit.${ext}`), mkLogContent("audit"));
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "logs", `activity.${ext}`), mkLogContent("activity"));
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "logs", `security.${ext}`), mkLogContent("security"));
-  const settingsMeta = mkMeta(opts, {
-    GET: { description: "Get system-wide settings (admin only).", response: `{ settings: {} }` },
-    PUT: { description: "Update system-wide settings (admin only).", request: `{ maintenanceMode: false }`, response: `{ message: 'Settings updated', settings: { maintenanceMode: false } }` }
-  });
-  const settingsContent = ts ? `${RA}import type { Request, Response } from 'express';
+    };
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "logs", `audit.${ext}`),
+      mkLogContent("audit")
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "logs", `activity.${ext}`),
+      mkLogContent("activity")
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "logs", `security.${ext}`),
+      mkLogContent("security")
+    );
+  }
+  if (af.systemSettings) {
+    const settingsMeta = mkMeta(opts, {
+      GET: { description: "Get system-wide settings (admin only).", response: `{ settings: {} }` },
+      PUT: {
+        description: "Update system-wide settings (admin only).",
+        request: `{ maintenanceMode: false }`,
+        response: `{ message: 'Settings updated', settings: { maintenanceMode: false } }`
+      }
+    });
+    const settingsContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${settingsMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: fetch system settings from DB
@@ -3338,11 +3795,17 @@ ${roleGuard}  // TODO: update system settings
   res.json({ message: 'Settings updated', settings: req.body });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "settings", `index.${ext}`), settingsContent);
-  const healthMeta = mkMeta(opts, {
-    GET: { description: "System health check: DB, queue, cache status (admin only).", response: `{ status: 'ok', db: 'ok', queue: 'ok', uptime: 12345 }` }
-  });
-  const healthContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "settings", `index.${ext}`),
+      settingsContent
+    );
+    const healthMeta = mkMeta(opts, {
+      GET: {
+        description: "System health check: DB, queue, cache status (admin only).",
+        response: `{ status: 'ok', db: 'ok', queue: 'ok', uptime: 12345 }`
+      }
+    });
+    const healthContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${healthMeta}${mwAdmin3}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: check DB connection, queue, cache health
@@ -3354,11 +3817,17 @@ ${roleGuard}  // TODO: check DB connection, queue, cache health
   res.json({ status: 'ok', db: 'ok', queue: 'ok', uptime: process.uptime() });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "system", `health.${ext}`), healthContent);
-  const cacheMeta = mkMeta(opts, {
-    DELETE: { description: "Flush the application cache (admin only).", response: `{ message: 'Cache cleared' }` }
-  });
-  const cacheContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "system", `health.${ext}`),
+      healthContent
+    );
+    const cacheMeta = mkMeta(opts, {
+      DELETE: {
+        description: "Flush the application cache (admin only).",
+        response: `{ message: 'Cache cleared' }`
+      }
+    });
+    const cacheContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${cacheMeta}${mwAdmin3}
 export const DELETE = async (_req: Request, res: Response) => {
 ${roleGuard}  // TODO: flush Redis or in-memory cache
@@ -3370,11 +3839,20 @@ ${roleGuard}  // TODO: flush Redis or in-memory cache
   res.json({ message: 'Cache cleared' });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "system", `cache.${ext}`), cacheContent);
-  const adminTicketsListMeta = mkMeta(opts, {
-    GET: { description: "List all support tickets with filters (admin only).", query: `{ status: 'open', priority: 'normal', page: '1', limit: '20' }`, response: `{ tickets: [], total: 0, page: 1, limit: 20 }` }
-  });
-  const adminTicketsListContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "system", `cache.${ext}`),
+      cacheContent
+    );
+  }
+  if (af.supportManagement) {
+    const adminTicketsListMeta = mkMeta(opts, {
+      GET: {
+        description: "List all support tickets with filters (admin only).",
+        query: `{ status: 'open', priority: 'normal', page: '1', limit: '20' }`,
+        response: `{ tickets: [], total: 0, page: 1, limit: 20 }`
+      }
+    });
+    const adminTicketsListContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminTicketsListMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { status, priority, page = 1, limit = 20 } = req.query;
@@ -3388,12 +3866,24 @@ ${roleGuard}  const { status, priority, page = 1, limit = 20 } = req.query;
   res.json({ tickets: [], total: 0, page: Number(page), limit: Number(limit) });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "tickets", `index.${ext}`), adminTicketsListContent);
-  const adminTicketByIdMeta = mkMeta(opts, {
-    GET: { description: "Fetch a single support ticket by ID (admin only).", params: `{ id: 'tk_01HXZ' }`, response: `{ ticket: { id: 'tk_01HXZ' } }` },
-    PUT: { description: "Assign, reply to, or change the status of a support ticket (admin only).", params: `{ id: 'tk_01HXZ' }`, request: `{ reply: 'Looking into it.', status: 'in_progress', assignedTo: 'adm_01HXZ' }`, response: `{ message: 'Ticket updated', ticket: { id: 'tk_01HXZ', status: 'in_progress', assignedTo: 'adm_01HXZ' } }` }
-  });
-  const adminTicketByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "tickets", `index.${ext}`),
+      adminTicketsListContent
+    );
+    const adminTicketByIdMeta = mkMeta(opts, {
+      GET: {
+        description: "Fetch a single support ticket by ID (admin only).",
+        params: `{ id: 'tk_01HXZ' }`,
+        response: `{ ticket: { id: 'tk_01HXZ' } }`
+      },
+      PUT: {
+        description: "Assign, reply to, or change the status of a support ticket (admin only).",
+        params: `{ id: 'tk_01HXZ' }`,
+        request: `{ reply: 'Looking into it.', status: 'in_progress', assignedTo: 'adm_01HXZ' }`,
+        response: `{ message: 'Ticket updated', ticket: { id: 'tk_01HXZ', status: 'in_progress', assignedTo: 'adm_01HXZ' } }`
+      }
+    });
+    const adminTicketByIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminTicketByIdMeta}${mwAdmin3}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
@@ -3421,7 +3911,11 @@ ${roleGuard}  const { id } = req.params;
   res.json({ message: 'Ticket updated', ticket: { id, status, assignedTo } });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "tickets", `[id].${ext}`), adminTicketByIdContent);
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "tickets", `[id].${ext}`),
+      adminTicketByIdContent
+    );
+  }
   const mkContentCrud = (name, namePlural, dir, createFields) => {
     const lower = name.toLowerCase();
     const firstField = createFields.split(", ")[0];
@@ -3429,8 +3923,16 @@ ${roleGuard}  const { id } = req.params;
     const sampleCreatedRecord = `{ id: 'new-id', ${firstField}: 'sample-${firstField}' }`;
     const sampleFullRecord = `{ id: '${lower}_01HXZ', ${createFields.split(", ").map((f) => `${f}: 'sample-${f}'`).join(", ")} }`;
     const listMeta = mkMeta(opts, {
-      GET: { description: `List all ${namePlural} (admin only).`, response: `{ ${namePlural}: [], total: 0 }` },
-      POST: { description: `Create a new ${lower} (admin only).`, request: sampleCreateBody, response: `{ message: '${name} created', ${lower}: ${sampleCreatedRecord} }`, status: 201 }
+      GET: {
+        description: `List all ${namePlural} (admin only).`,
+        response: `{ ${namePlural}: [], total: 0 }`
+      },
+      POST: {
+        description: `Create a new ${lower} (admin only).`,
+        request: sampleCreateBody,
+        response: `{ message: '${name} created', ${lower}: ${sampleCreatedRecord} }`,
+        status: 201
+      }
     });
     const listContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${listMeta}${mwAdmin4}
@@ -3457,9 +3959,22 @@ ${roleGuard}  const { ${createFields} } = req.body;
 };
 `;
     const byIdMeta = mkMeta(opts, {
-      GET: { description: `Fetch a single ${lower} by ID (admin only).`, params: `{ id: '${lower}_01HXZ' }`, response: `{ ${lower}: ${sampleFullRecord} }` },
-      PUT: { description: `Update a ${lower} by ID (admin only).`, params: `{ id: '${lower}_01HXZ' }`, request: sampleCreateBody, response: `{ message: '${name} updated', ${lower}: ${sampleFullRecord} }` },
-      DELETE: { description: `Delete a ${lower} by ID (admin only).`, params: `{ id: '${lower}_01HXZ' }`, response: `{ message: '${name} ${lower}_01HXZ deleted' }` }
+      GET: {
+        description: `Fetch a single ${lower} by ID (admin only).`,
+        params: `{ id: '${lower}_01HXZ' }`,
+        response: `{ ${lower}: ${sampleFullRecord} }`
+      },
+      PUT: {
+        description: `Update a ${lower} by ID (admin only).`,
+        params: `{ id: '${lower}_01HXZ' }`,
+        request: sampleCreateBody,
+        response: `{ message: '${name} updated', ${lower}: ${sampleFullRecord} }`
+      },
+      DELETE: {
+        description: `Delete a ${lower} by ID (admin only).`,
+        params: `{ id: '${lower}_01HXZ' }`,
+        response: `{ message: '${name} ${lower}_01HXZ deleted' }`
+      }
     });
     const byIdContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${byIdMeta}${mwAdmin4}
@@ -3501,25 +4016,87 @@ ${roleGuard}  const { id } = req.params;
 `;
     return { listContent, byIdContent };
   };
-  const { listContent: faqList, byIdContent: faqById } = mkContentCrud("FAQ", "faqs", [], "question, answer, category");
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "content", "faqs", `index.${ext}`), faqList);
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "content", "faqs", `[id].${ext}`), faqById);
-  const { listContent: blogList, byIdContent: blogById } = mkContentCrud("Blog", "blogs", [], "title, slug, content");
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "content", "blogs", `index.${ext}`), blogList);
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "content", "blogs", `[id].${ext}`), blogById);
-  const { listContent: catList, byIdContent: catById } = mkContentCrud("Category", "categories", [], "name, slug");
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "content", "categories", `index.${ext}`), catList);
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "content", "categories", `[id].${ext}`), catById);
-  const { listContent: planList, byIdContent: planById } = mkContentCrud("Plan", "plans", [], "name, price, interval");
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "billing", "plans", `index.${ext}`), planList);
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "billing", "plans", `[id].${ext}`), planById);
-  const { listContent: couponList, byIdContent: couponById } = mkContentCrud("Coupon", "coupons", [], "code, type, value");
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "billing", "coupons", `index.${ext}`), couponList);
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "billing", "coupons", `[id].${ext}`), couponById);
-  const adminSubsMeta = mkMeta(opts, {
-    GET: { description: "List all subscriptions with filters (admin only).", query: `{ status: 'active', page: '1', limit: '20' }`, response: `{ subscriptions: [], total: 0, page: 1, limit: 20 }` }
-  });
-  const adminSubsContent = ts ? `${RA}import type { Request, Response } from 'express';
+  if (af.contentManagement) {
+    const { listContent: faqList, byIdContent: faqById } = mkContentCrud(
+      "FAQ",
+      "faqs",
+      [],
+      "question, answer, category"
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "content", "faqs", `index.${ext}`),
+      faqList
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "content", "faqs", `[id].${ext}`),
+      faqById
+    );
+    const { listContent: blogList, byIdContent: blogById } = mkContentCrud(
+      "Blog",
+      "blogs",
+      [],
+      "title, slug, content"
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "content", "blogs", `index.${ext}`),
+      blogList
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "content", "blogs", `[id].${ext}`),
+      blogById
+    );
+    const { listContent: catList, byIdContent: catById } = mkContentCrud(
+      "Category",
+      "categories",
+      [],
+      "name, slug"
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "content", "categories", `index.${ext}`),
+      catList
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "content", "categories", `[id].${ext}`),
+      catById
+    );
+  }
+  if (af.billingManagement) {
+    const { listContent: planList, byIdContent: planById } = mkContentCrud(
+      "Plan",
+      "plans",
+      [],
+      "name, price, interval"
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "billing", "plans", `index.${ext}`),
+      planList
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "billing", "plans", `[id].${ext}`),
+      planById
+    );
+    const { listContent: couponList, byIdContent: couponById } = mkContentCrud(
+      "Coupon",
+      "coupons",
+      [],
+      "code, type, value"
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "billing", "coupons", `index.${ext}`),
+      couponList
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "billing", "coupons", `[id].${ext}`),
+      couponById
+    );
+    const adminSubsMeta = mkMeta(opts, {
+      GET: {
+        description: "List all subscriptions with filters (admin only).",
+        query: `{ status: 'active', page: '1', limit: '20' }`,
+        response: `{ subscriptions: [], total: 0, page: 1, limit: 20 }`
+      }
+    });
+    const adminSubsContent = ts ? `${RA}import type { Request, Response } from 'express';
 ${adminSubsMeta}${mwAdmin4}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { status, page = 1, limit = 20 } = req.query;
@@ -3533,7 +4110,11 @@ ${roleGuard}  const { status, page = 1, limit = 20 } = req.query;
   res.json({ subscriptions: [], total: 0, page: Number(page), limit: Number(limit) });
 };
 `;
-  await fs.outputFile(path.join(dest, "src", "api", "admin", "billing", "subscriptions", `index.${ext}`), adminSubsContent);
+    await fs.outputFile(
+      path.join(dest, "src", "api", "admin", "billing", "subscriptions", `index.${ext}`),
+      adminSubsContent
+    );
+  }
 }
 
 // src/index.ts
@@ -3591,6 +4172,68 @@ async function main() {
   });
   if (p.isCancel(features)) cancel2();
   const selected = new Set(features);
+  let userFeatures = NO_USER_FEATURES;
+  if (selected.has("userPortal")) {
+    const chosen = await p.multiselect({
+      message: "User portal features: (space to toggle, enter to confirm)",
+      options: [
+        { value: "profileViewing", label: "Profile viewing & editing", hint: "GET/PUT /user/profile" },
+        { value: "forgotPassword", label: "Forgot / reset password", hint: "forgot-password, reset-password" },
+        { value: "accountSecurity", label: "Change password, 2FA & sessions", hint: "change-password, 2fa/*, sessions/*, token refresh" },
+        { value: "emailVerification", label: "Email verification", hint: "verify-email route + registration flow" },
+        { value: "accountSettings", label: "Account settings", hint: "avatar, settings, account, dashboard, activity" },
+        { value: "notifications", label: "Notifications", hint: "user/notifications" },
+        { value: "filesAndMedia", label: "Files, favorites & bookmarks", hint: "files, favorites, bookmarks, search" },
+        { value: "apiAndBilling", label: "API keys & billing", hint: "api-keys, plans, subscription, invoices" },
+        { value: "support", label: "Support tickets", hint: "create & view own tickets" }
+      ],
+      initialValues: ["profileViewing", "forgotPassword", "accountSecurity", "emailVerification", "accountSettings", "notifications", "filesAndMedia", "apiAndBilling", "support"],
+      required: false
+    });
+    if (p.isCancel(chosen)) cancel2();
+    const uSet = new Set(chosen);
+    userFeatures = {
+      profileViewing: uSet.has("profileViewing"),
+      forgotPassword: uSet.has("forgotPassword"),
+      accountSecurity: uSet.has("accountSecurity"),
+      emailVerification: uSet.has("emailVerification"),
+      accountSettings: uSet.has("accountSettings"),
+      notifications: uSet.has("notifications"),
+      filesAndMedia: uSet.has("filesAndMedia"),
+      apiAndBilling: uSet.has("apiAndBilling"),
+      support: uSet.has("support")
+    };
+  }
+  let adminFeatures = NO_ADMIN_FEATURES;
+  if (selected.has("adminPortal")) {
+    const chosen = await p.multiselect({
+      message: "Admin panel features: (space to toggle, enter to confirm)",
+      options: [
+        { value: "userManagement", label: "User management", hint: "list/create/suspend/verify/export users + dashboard stats" },
+        { value: "adminManagement", label: "Admin & role management", hint: "manage other admins" + (selected.has("rbac") ? " + roles" : "") },
+        { value: "analytics", label: "Analytics", hint: "users, revenue, traffic dashboards" },
+        { value: "contentManagement", label: "Content management", hint: "FAQs, blog posts, categories" },
+        { value: "billingManagement", label: "Billing management", hint: "plans, coupons, subscriptions" },
+        { value: "supportManagement", label: "Support tickets", hint: "view & respond to tickets" },
+        { value: "notificationsAndLogs", label: "Notifications & audit logs", hint: "broadcast + audit/activity/security logs" },
+        { value: "systemSettings", label: "System settings & health", hint: "app settings, health check, cache" }
+      ],
+      initialValues: ["userManagement", "adminManagement", "analytics", "contentManagement", "billingManagement", "supportManagement", "notificationsAndLogs", "systemSettings"],
+      required: false
+    });
+    if (p.isCancel(chosen)) cancel2();
+    const aSet = new Set(chosen);
+    adminFeatures = {
+      userManagement: aSet.has("userManagement"),
+      adminManagement: aSet.has("adminManagement"),
+      analytics: aSet.has("analytics"),
+      contentManagement: aSet.has("contentManagement"),
+      billingManagement: aSet.has("billingManagement"),
+      supportManagement: aSet.has("supportManagement"),
+      notificationsAndLogs: aSet.has("notificationsAndLogs"),
+      systemSettings: aSet.has("systemSettings")
+    };
+  }
   let taskBackend;
   if (selected.has("tasks")) {
     const backend = await p.select({
@@ -3670,6 +4313,8 @@ async function main() {
     routeDocs: selected.has("routeDocs"),
     userPortal: selected.has("userPortal"),
     adminPortal: selected.has("adminPortal"),
+    userFeatures,
+    adminFeatures,
     rbac: selected.has("rbac"),
     mailer: selected.has("mailer"),
     ...taskBackend !== void 0 && { taskBackend },