create-efc-app 0.7.0 → 0.8.0

package/dist/index.js

@@ -4,6 +4,7 @@
 import * as p from "@clack/prompts";
 import pc from "picocolors";
 import { spawn } from "child_process";
+import path3 from "path";
 
 // src/scaffold.ts
 import fs from "fs-extra";
@@ -30,12 +31,85 @@ var NO_USER_FEATURES = {
   apiAndBilling: false,
   support: false
 };
+function usesOAuth(opts) {
+  return !!(opts.oauth?.google || opts.oauth?.apple);
+}
+function principals(opts) {
+  return {
+    user: !!opts.registry || opts.userPortal,
+    admin: !!opts.registry || opts.adminPortal
+  };
+}
+function sendsMail(opts) {
+  return !!opts.registry || opts.mailer;
+}
+function usesTables(opts) {
+  return opts.database === "postgresql" && opts.modelApi !== "defineModel";
+}
+function orm(opts) {
+  const t = usesTables(opts);
+  const where = (filter) => filter.replace(/\s/g, "") === "{}" ? "" : `{ where: ${filter} }`;
+  const byId = (id) => id === "id" ? "{ id }" : `{ id: ${id} }`;
+  return {
+    findOne: (m, filter) => t ? `${m}.findFirst({ where: ${filter} })` : `${m}.findOne(${filter})`,
+    findById: (m, id) => t ? `${m}.findUnique({ where: ${byId(id)} })` : `${m}.findById(${id})`,
+    find: (m, filter) => t ? `${m}.findMany(${where(filter)})` : `${m}.find(${filter})`,
+    count: (m, filter) => t ? `${m}.count(${where(filter)})` : `${m}.count(${filter})`,
+    create: (m, data) => t ? `${m}.create({ data: ${data} })` : `${m}.create(${data})`,
+    update: (m, id, data) => t ? `${m}.update({ where: ${byId(id)}, data: ${data} })` : `${m}.update(${id}, ${data})`,
+    delete: (m, id) => t ? `${m}.delete({ where: ${byId(id)} })` : `${m}.delete(${id})`
+  };
+}
+function generatedModels(opts) {
+  const uf = opts.userFeatures;
+  const af = opts.adminFeatures;
+  const user2 = opts.userPortal;
+  const admin2 = opts.adminPortal;
+  const m = /* @__PURE__ */ new Set();
+  if (user2 || admin2 && af.userManagement) m.add("User");
+  if (admin2) m.add("Admin");
+  if (opts.registry && (user2 || admin2)) m.add("User").add("Admin");
+  if (user2 && uf.accountSecurity) m.add("Session");
+  if (user2 && uf.notifications || admin2 && af.notificationsAndLogs) m.add("Notification");
+  if (user2 && uf.filesAndMedia) m.add("File");
+  if (user2 && uf.support || admin2 && af.supportManagement) m.add("SupportTicket");
+  if (admin2 && af.notificationsAndLogs) m.add("AuditLog");
+  if (user2 && uf.apiAndBilling) m.add("Subscription").add("Invoice").add("ApiKey");
+  if (usesOAuth(opts)) m.add("OAuthAccount");
+  if (admin2 && af.billingManagement) m.add("Plan").add("Coupon");
+  if (opts.rbac && admin2 && af.adminManagement) m.add("Role");
+  if (admin2 && af.contentManagement) m.add("FAQ").add("Blog").add("Category");
+  if (opts.registry && m.has("Subscription")) m.add("Plan");
+  return m;
+}
+function modelApi(opts) {
+  const name = usesTables(opts) ? "defineTable" : "defineModel";
+  return { name, import: `import { ${name} } from 'express-file-cluster';` };
+}
+function refField(opts, r) {
+  if (!usesTables(opts) || !generatedModels(opts).has(r.target)) return r.legacy;
+  const opts2 = `${r.required ? ", required: true" : ""}${r.onDelete === "restrict" ? "" : `, onDelete: '${r.onDelete}'`}`;
+  return `  ${(r.field + ":").padEnd(13)}{ type: 'uuid', ref: '${r.target}'${opts2} },`;
+}
+function relationsOption(opts, rels) {
+  if (!usesTables(opts) || opts.registry) return "";
+  const models = generatedModels(opts);
+  const live = rels.filter((r) => models.has(r.target));
+  if (live.length === 0) return "";
+  const lines = live.map(
+    (r) => `    ${r.name}: { ${r.kind}: '${r.target}', foreignKey: '${r.foreignKey}' },`
+  );
+  return `, {
+  relations: {
+${lines.join("\n")}
+  },
+}`;
+}
 async function scaffold(opts) {
   const dest = path.resolve(process.cwd(), opts.projectName);
   await fs.ensureDir(dest);
   const uf = opts.userFeatures;
-  const af = opts.adminFeatures;
-  const needsUserModel = opts.userPortal || opts.adminPortal && af.userManagement;
+  const models = generatedModels(opts);
   await writePackageJson(dest, opts);
   await writeTsConfig(dest, opts);
   await writeEfcConfig(dest, opts);
@@ -44,28 +118,32 @@ async function scaffold(opts) {
   await writeAgentsMd(dest, opts);
   await writeEnvFiles(dest, opts);
   await writeExampleRoute(dest, opts);
-  if (needsUserModel) await writeUserModel(dest, opts);
-  if (opts.adminPortal) await writeAdminModel(dest, opts);
-  await writeAuthRoutes(dest, opts);
+  if (models.has("User")) await writeUserModel(dest, opts);
+  if (models.has("Admin")) await writeAdminModel(dest, opts);
+  if (!opts.registry || opts.userPortal || opts.adminPortal) await writeAuthRoutes(dest, opts);
   if (opts.adminPortal) await writeAdminRoutes(dest, opts);
   if (opts.userPortal && uf.profileViewing) await writeUserRoutes(dest, opts);
   if (opts.tasks) await writeExampleTask(dest, opts);
-  if (opts.userPortal && uf.accountSecurity) await writeSessionModel(dest, opts);
-  if (opts.userPortal && uf.notifications || opts.adminPortal && af.notificationsAndLogs)
-    await writeNotificationModel(dest, opts);
-  if (opts.userPortal && uf.filesAndMedia) await writeFileModel(dest, opts);
-  if (opts.userPortal && uf.support || opts.adminPortal && af.supportManagement)
-    await writeSupportTicketModel(dest, opts);
-  if (opts.adminPortal && af.notificationsAndLogs) await writeAuditLogModel(dest, opts);
-  if (opts.userPortal && uf.apiAndBilling) await writeSubscriptionModel(dest, opts);
-  if (opts.adminPortal && af.billingManagement) await writePlanModel(dest, opts);
-  if (opts.userPortal && uf.apiAndBilling) await writeInvoiceModel(dest, opts);
-  if (opts.userPortal && uf.apiAndBilling) await writeApiKeyModel(dest, opts);
-  if (opts.rbac && opts.adminPortal && af.adminManagement) await writeRoleModel(dest, opts);
-  if (opts.adminPortal && af.contentManagement) await writeFAQModel(dest, opts);
-  if (opts.adminPortal && af.contentManagement) await writeBlogModel(dest, opts);
-  if (opts.adminPortal && af.contentManagement) await writeCategoryModel(dest, opts);
-  if (opts.adminPortal && af.billingManagement) await writeCouponModel(dest, opts);
+  const extended = [
+    ["Session", writeSessionModel],
+    ["Notification", writeNotificationModel],
+    ["File", writeFileModel],
+    ["SupportTicket", writeSupportTicketModel],
+    ["AuditLog", writeAuditLogModel],
+    ["Subscription", writeSubscriptionModel],
+    ["Plan", writePlanModel],
+    ["Invoice", writeInvoiceModel],
+    ["ApiKey", writeApiKeyModel],
+    ["Role", writeRoleModel],
+    ["FAQ", writeFAQModel],
+    ["Blog", writeBlogModel],
+    ["Category", writeCategoryModel],
+    ["Coupon", writeCouponModel]
+  ];
+  for (const [name, write] of extended) if (models.has(name)) await write(dest, opts);
+  if (models.has("OAuthAccount")) await writeOAuthAccountModel(dest, opts);
+  if (usesOAuth(opts)) await writeOAuth(dest, opts);
+  if (usesTables(opts)) await writeModelIndex(dest, opts);
   if (opts.userPortal) await writeAuthExtendedRoutes(dest, opts);
   if (opts.userPortal) await writeUserExtendedRoutes(dest, opts);
   if (opts.userPortal && uf.apiAndBilling) await writeUserBillingRoutes(dest, opts);
@@ -75,7 +153,7 @@ async function scaffold(opts) {
 }
 async function writePackageJson(dest, opts) {
   const deps = {
-    "express-file-cluster": "^0.7.0"
+    "express-file-cluster": "^0.8.0"
   };
   if (opts.database === "mongodb") deps["mongoose"] = "^9.7.2";
   if (opts.database === "postgresql") {
@@ -85,7 +163,9 @@ async function writePackageJson(dest, opts) {
   if (opts.tasks && opts.taskBackend === "bullmq") deps["bullmq"] = "^5.0.0";
   if (opts.tasks && opts.taskBackend === "pg-boss") deps["pg-boss"] = "^12.0.0";
   if (opts.mailer) deps["nodemailer"] = "^6.9.0";
-  deps["bcrypt"] = "^5.1.0";
+  if (usesOAuth(opts)) deps["jose"] = "^6.2.3";
+  const auth = !opts.registry || opts.userPortal || opts.adminPortal;
+  if (auth) deps["bcrypt"] = "^5.1.0";
   const devDeps = {
     vitest: "^5.0.3"
   };
@@ -96,7 +176,7 @@ async function writePackageJson(dest, opts) {
     devDeps["@types/express"] = "^4.17.21";
     devDeps["tsx"] = "^4.0.0";
     if (opts.mailer) devDeps["@types/nodemailer"] = "^6.4.0";
-    devDeps["@types/bcrypt"] = "^5.0.0";
+    if (auth) devDeps["@types/bcrypt"] = "^5.0.0";
     if (opts.database === "postgresql") devDeps["@types/pg"] = "^8.11.0";
   }
   const pkg = {
@@ -229,11 +309,17 @@ Optional \u2014 the same docs over MCP, with search and scaffolding tools:
 - \`src/api/**\` \u2014 every file is a route (\`users/[id].${ext}\` \u2192 \`/v1/api/users/:id\`); export
   uppercase \`GET\`/\`POST\`/\u2026 handlers.
 - \`src/tasks/*.${ext}\` \u2014 background tasks; the file name is the task name (not recursive).
-- \`src/model/*.${ext}\` \u2014 \`defineModel\` models.
+${usesTables(opts) ? `- \`src/model/*.${ext}\` \u2014 \`defineTable\` models (PostgreSQL-native, Prisma-style queries:
+  \`findMany({ where, include })\`, \`create({ data })\`, \`update({ where, data })\`). A \`ref\` is a
+  foreign key; ${opts.registry ? "add back-relations to a model's `relations` when you need `include`" : "back-relations are in each model's `relations`"}. \`src/model/index.${ext}\` imports
+  them all${opts.language === "typescript" ? " and declares `Tables` (typed `include`)" : ""} \u2014 add new models there.` : `- \`src/model/*.${ext}\` \u2014 \`defineModel\` models.`}
 - \`src/index.${ext}\` is the entry point; it imports \`efc.config.${ext}\` and passes it to \`ignite()\`.
 - Only three import paths exist: \`express-file-cluster\`, \`express-file-cluster/auth\`,
   \`express-file-cluster/tasks\`.
-
+${opts.registry ? `- Ready-made features (auth, user/admin portals, billing, mailer\u2026) come from the registry:
+  \`npx efc list\`, then \`npx efc add <item> --yes\` \u2014 check it before hand-writing auth or CRUD
+  (\`${D}/cli/add.md\`). \`efc.json\` tracks what was added; commit it.
+` : ""}
 ## Commands
 
 \`\`\`bash
@@ -271,16 +357,48 @@ SMTP_PASS=${isGmail ? "your_16_char_app_password" : "your_smtp_password"}${passC
 SMTP_FROM=noreply@yourapp.com
 ` : "";
   const redis = opts.tasks && opts.taskBackend !== "pg-boss" ? "\nREDIS_URL=redis://localhost:6379" : "";
+  const oauth = opts.oauth ?? {};
+  const oauthVars = [
+    ...oauth.google ? [
+      ["GOOGLE_CLIENT_ID", "", "your-client-id.apps.googleusercontent.com"],
+      ["GOOGLE_CLIENT_SECRET", "", "your-client-secret"],
+      [
+        "GOOGLE_REDIRECT_URI",
+        "http://localhost:3000/v1/api/auth/google/callback",
+        "https://api.yourapp.com/v1/api/auth/google/callback"
+      ]
+    ] : [],
+    ...oauth.apple ? [
+      ["APPLE_CLIENT_ID", "", "com.yourapp.signin"],
+      ["APPLE_TEAM_ID", "", "ABCDE12345"],
+      ["APPLE_KEY_ID", "", "FGHIJ67890"],
+      [
+        "APPLE_PRIVATE_KEY",
+        "",
+        "-----BEGIN PRIVATE KEY-----\\n...\\n-----END PRIVATE KEY-----"
+      ],
+      [
+        "APPLE_REDIRECT_URI",
+        "https://api.yourapp.com/v1/api/auth/apple/callback",
+        "https://api.yourapp.com/v1/api/auth/apple/callback"
+      ]
+    ] : [],
+    ...usesOAuth(opts) ? [["OAUTH_SUCCESS_REDIRECT", "http://localhost:3000/", "https://yourapp.com/"]] : []
+  ];
+  const oauthEnv = oauthVars.map(([k, v]) => `
+${k}=${v}`).join("");
+  const oauthExample = oauthVars.map(([k, , ex]) => `
+${k}=${ex}`).join("");
   const dotenv = `PORT=3000
 NODE_ENV=development
 DATABASE_URL=${dbUrl}
 JWT_SECRET=${secret}${redis}
-CORS_ORIGINS=http://localhost:3000${smtpVars}`;
+CORS_ORIGINS=http://localhost:3000${smtpVars}${oauthEnv}`;
   const example = `PORT=3000
 NODE_ENV=development
 DATABASE_URL=${dbExampleUrl}
 JWT_SECRET=<generate with: openssl rand -hex 64>${redis}
-CORS_ORIGINS=http://localhost:3000,https://yourapp.com${smtpExample}`;
+CORS_ORIGINS=http://localhost:3000,https://yourapp.com${smtpExample}${oauthExample}`;
   await fs.outputFile(path.join(dest, ".env"), dotenv);
   await fs.outputFile(path.join(dest, ".env.example"), example);
 }
@@ -391,9 +509,9 @@ export default defineTask(async (payload) => {
 }
 async function writeUserModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const User = defineModel('User', {
+export const User = ${modelApi(opts).name}('User', {
   name:               { type: 'string',  required: true },
   email:              { type: 'string',  required: true, unique: true },
   password:           { type: 'string',  required: true },
@@ -406,15 +524,23 @@ export const User = defineModel('User', {
   resetTokenExpiry:   { type: 'date' },
   refreshToken:       { type: 'string' },
   refreshTokenExpiry: { type: 'date' },
-});
+}${relationsOption(opts, [
+    { name: "sessions", kind: "hasMany", target: "Session", foreignKey: "user" },
+    { name: "notifications", kind: "hasMany", target: "Notification", foreignKey: "user" },
+    { name: "files", kind: "hasMany", target: "File", foreignKey: "user" },
+    { name: "tickets", kind: "hasMany", target: "SupportTicket", foreignKey: "user" },
+    { name: "subscriptions", kind: "hasMany", target: "Subscription", foreignKey: "user" },
+    { name: "invoices", kind: "hasMany", target: "Invoice", foreignKey: "user" },
+    { name: "apiKeys", kind: "hasMany", target: "ApiKey", foreignKey: "user" }
+  ])});
 `;
   await fs.outputFile(path.join(dest, "src", "model", `User.${ext}`), content);
 }
 async function writeAdminModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Admin = defineModel('Admin', {
+export const Admin = ${modelApi(opts).name}('Admin', {
   name:               { type: 'string',  required: true },
   email:              { type: 'string',  required: true, unique: true },
   password:           { type: 'string',  required: true },
@@ -425,11 +551,16 @@ export const Admin = defineModel('Admin', {
   resetTokenExpiry:   { type: 'date' },
   refreshToken:       { type: 'string' },
   refreshTokenExpiry: { type: 'date' },
-});
+}${relationsOption(opts, [
+    { name: "assignedTickets", kind: "hasMany", target: "SupportTicket", foreignKey: "assignedTo" },
+    { name: "auditLogs", kind: "hasMany", target: "AuditLog", foreignKey: "admin" },
+    { name: "posts", kind: "hasMany", target: "Blog", foreignKey: "author" }
+  ])});
 `;
   await fs.outputFile(path.join(dest, "src", "model", `Admin.${ext}`), content);
 }
 async function writeAuthRoutes(dest, opts) {
+  const db = orm(opts);
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
   const loginMeta = opts.routeDocs ? ts ? `import type { RouteMeta } from 'express-file-cluster';
@@ -451,15 +582,14 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const hasUser = opts.userPortal;
-  const hasAdmin = opts.adminPortal;
+  const { user: hasUser, admin: hasAdmin } = principals(opts);
   const hasModels = hasUser || hasAdmin;
   const loginDbImports = hasModels ? `import bcrypt from 'bcrypt';
 import crypto from 'node:crypto';
 ${hasUser ? `import { User } from '../../model/User.js';
 ` : ""}${hasAdmin ? `import { Admin } from '../../model/Admin.js';
 ` : ""}` : "";
-  const loginBody = hasAdmin && hasUser ? `  const admin = await Admin.findOne({ email });
+  const loginBody = hasAdmin && hasUser ? `  const admin = await ${db.findOne("Admin", `{ email }`)};
   if (admin) {
     const match = await bcrypt.compare(password, admin.password);
     if (!match) return res.status(401).json({ error: 'Invalid credentials' });
@@ -469,21 +599,21 @@ ${hasUser ? `import { User } from '../../model/User.js';
     return res.json({ message: 'Logged in as admin' });
   }
 
-  const user = await User.findOne({ email });
+  const user = await ${db.findOne("User", `{ email }`)};
   if (!user) return res.status(401).json({ error: 'Invalid credentials' });
   const match = await bcrypt.compare(password, user.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
   await issueToken(res, { id: user.id, role: user.role, email: user.email });
   await issueRefreshToken(res, User, user.id);
-  res.json({ message: 'Logged in' });` : hasAdmin ? `  const admin = await Admin.findOne({ email });
+  res.json({ message: 'Logged in' });` : hasAdmin ? `  const admin = await ${db.findOne("Admin", `{ email }`)};
   if (!admin) return res.status(401).json({ error: 'Invalid credentials' });
   const match = await bcrypt.compare(password, admin.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
   await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
   await issueRefreshToken(res, Admin, admin.id);
-  res.json({ message: 'Logged in as admin' });` : `  const user = await User.findOne({ email });
+  res.json({ message: 'Logged in as admin' });` : `  const user = await ${db.findOne("User", `{ email }`)};
   if (!user) return res.status(401).json({ error: 'Invalid credentials' });
   const match = await bcrypt.compare(password, user.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
@@ -497,11 +627,11 @@ ${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 *
 
 async function issueRefreshToken(
   res: Response,
-  model: { update: (id: string, data: Record<string, unknown>) => Promise<unknown> },
+  model: ${usesTables(opts) ? "{ update: (args: { where: { id: string }; data: Record<string, unknown> }) => Promise<unknown> }" : "{ update: (id: string, data: Record<string, unknown>) => Promise<unknown> }"},
   id: string,
 ): Promise<void> {
   const refreshToken = crypto.randomBytes(40).toString('hex');
-  await model.update(id, { refreshToken, refreshTokenExpiry: new Date(Date.now() + REFRESH_TOKEN_TTL_MS) });
+  await ${db.update("model", "id", "{ refreshToken, refreshTokenExpiry: new Date(Date.now() + REFRESH_TOKEN_TTL_MS) }")};
   res.cookie('efc_refresh_token', refreshToken, {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',
@@ -521,7 +651,7 @@ ${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 *
 
 async function issueRefreshToken(res, model, id) {
   const refreshToken = crypto.randomBytes(40).toString('hex');
-  await model.update(id, { refreshToken, refreshTokenExpiry: new Date(Date.now() + REFRESH_TOKEN_TTL_MS) });
+  await ${db.update("model", "id", "{ refreshToken, refreshTokenExpiry: new Date(Date.now() + REFRESH_TOKEN_TTL_MS) }")};
   res.cookie('efc_refresh_token', refreshToken, {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',
@@ -585,7 +715,7 @@ ${logoutMeta}export const POST = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", `login.${ext}`), loginContent);
   await fs.outputFile(path.join(dest, "src", "api", "auth", `logout.${ext}`), logoutContent);
-  if (!opts.userPortal) return;
+  if (!hasUser) return;
   const registerMeta = opts.routeDocs ? ts ? `import type { RouteMeta } from 'express-file-cluster';
 
 export const meta: RouteMeta = {
@@ -607,9 +737,9 @@ export const meta: RouteMeta = {
 ` : "";
   const registerDbImports = `import bcrypt from 'bcrypt';
 import crypto from 'node:crypto';
-${opts.mailer ? "import { enqueue } from 'express-file-cluster/tasks';\n" : ""}import { User } from '../../model/User.js';
+${sendsMail(opts) ? "import { enqueue } from 'express-file-cluster/tasks';\n" : ""}import { User } from '../../model/User.js';
 `;
-  const sendVerifyEmail = opts.mailer ? `
+  const sendVerifyEmail = sendsMail(opts) ? `
   var appUrl = process.env.APP_URL || 'http://localhost:3000';
   await enqueue('SendEmail', {
     to: email,
@@ -625,11 +755,11 @@ ${registerDbImports}${registerMeta}export const POST = async (req: Request, res:
   if (!name || !email || !password) {
     return res.status(400).json({ error: 'name, email and password are required' });
   }
-  const existing = await User.findOne({ email });
+  const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await bcrypt.hash(password, 10);
   const verifyToken = crypto.randomBytes(32).toString('hex');
-  const user = await User.create({ name, email, password: hashed, verifyToken });
+  const user = await ${db.create("User", `{ name, email, password: hashed, verifyToken }`)};
 ${sendVerifyEmail}
   const { password: _, verifyToken: __, ...safe } = user;
   res.status(201).json({ message: 'Account created successfully', user: safe });
@@ -639,11 +769,11 @@ ${sendVerifyEmail}
   if (!name || !email || !password) {
     return res.status(400).json({ error: 'name, email and password are required' });
   }
-  const existing = await User.findOne({ email });
+  const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await bcrypt.hash(password, 10);
   const verifyToken = crypto.randomBytes(32).toString('hex');
-  const user = await User.create({ name, email, password: hashed, verifyToken });
+  const user = await ${db.create("User", `{ name, email, password: hashed, verifyToken }`)};
 ${sendVerifyEmail}
   const { password: _, verifyToken: __, ...safe } = user;
   res.status(201).json({ message: 'Account created successfully', user: safe });
@@ -685,6 +815,7 @@ ${meMeta}${meMiddlewares}export const GET = async (req, res) => {
   await fs.outputFile(path.join(dest, "src", "api", "auth", `me.${ext}`), meContent);
 }
 async function writeAdminRoutes(dest, opts) {
+  const db = orm(opts);
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
   const middlewares = opts.rbac ? `export const middlewares = [requireAuth('admin')];
@@ -718,7 +849,7 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const dashboardHasUserModel = opts.adminFeatures.userManagement;
+  const dashboardHasUserModel = !!opts.registry || opts.adminFeatures.userManagement;
   const dashboardDbImport = dashboardHasUserModel ? `import { User } from '../../model/User.js';
 ` : "";
   const dashboardContent = dashboardHasUserModel ? ts ? `import { requireAuth } from 'express-file-cluster/auth';
@@ -726,9 +857,9 @@ import type { Request, Response } from 'express';
 ${dashboardDbImport}${dashboardMeta}${middlewares}
 export const GET = async (_req: Request, res: Response) => {
 ${roleGuard}  const [totalUsers, activeUsers, verifiedUsers] = await Promise.all([
-    User.count({}),
-    User.count({ isActive: true }),
-    User.count({ isVerified: true }),
+    ${db.count("User", `{}`)},
+    ${db.count("User", `{ isActive: true }`)},
+    ${db.count("User", `{ isVerified: true }`)},
   ]);
   res.json({ stats: { totalUsers, activeUsers, verifiedUsers } });
 };
@@ -736,9 +867,9 @@ ${roleGuard}  const [totalUsers, activeUsers, verifiedUsers] = await Promise.all
 ${dashboardDbImport}${dashboardMeta}${middlewares}
 export const GET = async (_req, res) => {
 ${roleGuard}  const [totalUsers, activeUsers, verifiedUsers] = await Promise.all([
-    User.count({}),
-    User.count({ isActive: true }),
-    User.count({ isVerified: true }),
+    ${db.count("User", `{}`)},
+    ${db.count("User", `{ isActive: true }`)},
+    ${db.count("User", `{ isVerified: true }`)},
   ]);
   res.json({ stats: { totalUsers, activeUsers, verifiedUsers } });
 };
@@ -798,7 +929,7 @@ ${adminUsersDbImport}${usersListMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
   const limit = Math.min(100, Number(req.query.limit) || 20);
-  const [all, total] = await Promise.all([User.find({}), User.count({})]);
+  const [all, total] = await Promise.all([${db.find("User", `{}`)}, ${db.count("User", `{}`)}]);
   const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, ...u }) => u);
   res.json({ users, total, page, limit });
 };
@@ -806,10 +937,10 @@ ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { name, email, password, role } = req.body;
   if (!name || !email || !password) return res.status(400).json({ error: 'name, email and password are required' });
-  const existing = await User.findOne({ email });
+  const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await bcrypt.hash(password, 10);
-  const user = await User.create({ name, email, password: hashed, role: role ?? 'user' });
+  const user = await ${db.create("User", `{ name, email, password: hashed, role: role ?? 'user' }`)};
   const { password: _, ...safe } = user;
   res.status(201).json({ message: 'User created', user: safe });
 };
@@ -818,7 +949,7 @@ ${adminUsersDbImport}${usersListMeta}${middlewares}
 export const GET = async (req, res) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
   const limit = Math.min(100, Number(req.query.limit) || 20);
-  const [all, total] = await Promise.all([User.find({}), User.count({})]);
+  const [all, total] = await Promise.all([${db.find("User", `{}`)}, ${db.count("User", `{}`)}]);
   const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, ...u }) => u);
   res.json({ users, total, page, limit });
 };
@@ -826,10 +957,10 @@ ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
 export const POST = async (req, res) => {
 ${roleGuard}  const { name, email, password, role } = req.body;
   if (!name || !email || !password) return res.status(400).json({ error: 'name, email and password are required' });
-  const existing = await User.findOne({ email });
+  const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await bcrypt.hash(password, 10);
-  const user = await User.create({ name, email, password: hashed, role: role ?? 'user' });
+  const user = await ${db.create("User", `{ name, email, password: hashed, role: role ?? 'user' }`)};
   const { password: _, ...safe } = user;
   res.status(201).json({ message: 'User created', user: safe });
 };
@@ -884,7 +1015,7 @@ import type { Request, Response } from 'express';
 ${adminUserByIdDbImport}${userByIdMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
-  const user = await User.findById(id);
+  const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
   const { password: _, ...safe } = user;
   res.json({ user: safe });
@@ -893,7 +1024,7 @@ ${roleGuard}  const { id } = req.params;
 export const PUT = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
   const { name, email, role, isActive } = req.body;
-  const updated = await User.update(id, { name, email, role, isActive });
+  const updated = await ${db.update("User", `id`, `{ name, email, role, isActive }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
   const { password: _, ...safe } = updated;
   res.json({ message: 'User updated', user: safe });
@@ -901,16 +1032,16 @@ ${roleGuard}  const { id } = req.params;
 
 export const DELETE = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
-  const user = await User.findById(id);
+  const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  await User.delete(id);
+  await ${db.delete("User", `id`)};
   res.json({ message: \`User \${id} deleted\` });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
 ${adminUserByIdDbImport}${userByIdMeta}${middlewares}
 export const GET = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
-  const user = await User.findById(id);
+  const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
   const { password: _, ...safe } = user;
   res.json({ user: safe });
@@ -919,7 +1050,7 @@ ${roleGuard}  const { id } = req.params;
 export const PUT = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   const { name, email, role, isActive } = req.body;
-  const updated = await User.update(id, { name, email, role, isActive });
+  const updated = await ${db.update("User", `id`, `{ name, email, role, isActive }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
   const { password: _, ...safe } = updated;
   res.json({ message: 'User updated', user: safe });
@@ -927,9 +1058,9 @@ ${roleGuard}  const { id } = req.params;
 
 export const DELETE = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
-  const user = await User.findById(id);
+  const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  await User.delete(id);
+  await ${db.delete("User", `id`)};
   res.json({ message: \`User \${id} deleted\` });
 };
 `;
@@ -939,6 +1070,7 @@ ${roleGuard}  const { id } = req.params;
   );
 }
 async function writeUserRoutes(dest, opts) {
+  const db = orm(opts);
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
   const middlewares = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];
@@ -978,7 +1110,7 @@ import type { Request, Response } from 'express';
 ${profileDbImport}${profileMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
   const { id } = (req as any).user;
-  const user = await User.findById(id);
+  const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
   const { password: _, ...safe } = user;
   res.json({ user: safe });
@@ -987,7 +1119,7 @@ export const GET = async (req: Request, res: Response) => {
 export const PUT = async (req: Request, res: Response) => {
   const { id } = (req as any).user;
   const { name, email } = req.body;
-  const updated = await User.update(id, { name, email });
+  const updated = await ${db.update("User", `id`, `{ name, email }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
   const { password: _, ...safe } = updated;
   res.json({ message: 'Profile updated', user: safe });
@@ -996,7 +1128,7 @@ export const PUT = async (req: Request, res: Response) => {
 ${profileDbImport}${profileMeta}${middlewares}
 export const GET = async (req, res) => {
   const { id } = req.user;
-  const user = await User.findById(id);
+  const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
   const { password: _, ...safe } = user;
   res.json({ user: safe });
@@ -1005,7 +1137,7 @@ export const GET = async (req, res) => {
 export const PUT = async (req, res) => {
   const { id } = req.user;
   const { name, email } = req.body;
-  const updated = await User.update(id, { name, email });
+  const updated = await ${db.update("User", `id`, `{ name, email }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
   const { password: _, ...safe } = updated;
   res.json({ message: 'Profile updated', user: safe });
@@ -1045,10 +1177,10 @@ ${blocks}
 }
 async function writeSessionModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Session = defineModel('Session', {
-  userId:    { type: 'string',  required: true },
+export const Session = ${modelApi(opts).name}('Session', {
+${refField(opts, { field: "user", target: "User", legacy: `  userId:    { type: 'string',  required: true },`, required: true, onDelete: "cascade" })}
   token:     { type: 'string',  required: true, unique: true },
   ip:        { type: 'string',  required: true },
   userAgent: { type: 'string',  required: true },
@@ -1060,10 +1192,10 @@ export const Session = defineModel('Session', {
 }
 async function writeNotificationModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Notification = defineModel('Notification', {
-  userId:  { type: 'string',  required: true },
+export const Notification = ${modelApi(opts).name}('Notification', {
+${refField(opts, { field: "user", target: "User", legacy: `  userId:  { type: 'string',  required: true },`, required: true, onDelete: "cascade" })}
   title:   { type: 'string',  required: true },
   message: { type: 'string',  required: true },
   type:    { type: 'string',  required: true, default: 'info' },
@@ -1075,10 +1207,10 @@ export const Notification = defineModel('Notification', {
 }
 async function writeFileModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const File = defineModel('File', {
-  userId:       { type: 'string',  required: true },
+export const File = ${modelApi(opts).name}('File', {
+${refField(opts, { field: "user", target: "User", legacy: `  userId:       { type: 'string',  required: true },`, required: true, onDelete: "cascade" })}
   filename:     { type: 'string',  required: true },
   originalName: { type: 'string',  required: true },
   mimeType:     { type: 'string',  required: true },
@@ -1091,25 +1223,25 @@ export const File = defineModel('File', {
 }
 async function writeSupportTicketModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const SupportTicket = defineModel('SupportTicket', {
-  userId:     { type: 'string', required: true },
+export const SupportTicket = ${modelApi(opts).name}('SupportTicket', {
+${refField(opts, { field: "user", target: "User", legacy: `  userId:     { type: 'string', required: true },`, required: true, onDelete: "cascade" })}
   subject:    { type: 'string', required: true },
   message:    { type: 'string', required: true },
   status:     { type: 'string', required: true, default: 'open' },
   priority:   { type: 'string', required: true, default: 'normal' },
-  assignedTo: { type: 'string' },
+${refField(opts, { field: "assignedTo", target: "Admin", legacy: `  assignedTo: { type: 'string' },`, onDelete: "setNull" })}
 });
 `;
   await fs.outputFile(path.join(dest, "src", "model", `SupportTicket.${ext}`), content);
 }
 async function writeAuditLogModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const AuditLog = defineModel('AuditLog', {
-  adminId:  { type: 'string', required: true },
+export const AuditLog = ${modelApi(opts).name}('AuditLog', {
+${refField(opts, { field: "admin", target: "Admin", legacy: `  adminId:  { type: 'string', required: true },`, onDelete: "setNull" })}
   action:   { type: 'string', required: true },
   entity:   { type: 'string', required: true },
   entityId: { type: 'string', required: true },
@@ -1121,41 +1253,41 @@ export const AuditLog = defineModel('AuditLog', {
 }
 async function writeSubscriptionModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Subscription = defineModel('Subscription', {
-  userId:      { type: 'string', required: true },
-  planId:      { type: 'string', required: true },
+export const Subscription = ${modelApi(opts).name}('Subscription', {
+${refField(opts, { field: "user", target: "User", legacy: `  userId:      { type: 'string', required: true },`, required: true, onDelete: "cascade" })}
+${refField(opts, { field: "plan", target: "Plan", legacy: `  planId:      { type: 'string', required: true },`, required: true, onDelete: "restrict" })}
   status:      { type: 'string', required: true, default: 'active' },
   startDate:   { type: 'date',   required: true },
   endDate:     { type: 'date',   required: true },
   cancelledAt: { type: 'date' },
-});
+}${relationsOption(opts, [{ name: "invoices", kind: "hasMany", target: "Invoice", foreignKey: "subscription" }])});
 `;
   await fs.outputFile(path.join(dest, "src", "model", `Subscription.${ext}`), content);
 }
 async function writePlanModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Plan = defineModel('Plan', {
+export const Plan = ${modelApi(opts).name}('Plan', {
   name:        { type: 'string',  required: true },
   description: { type: 'string',  required: true },
   price:       { type: 'number',  required: true },
   interval:    { type: 'string',  required: true, default: 'monthly' },
   features:    { type: 'array',   of: 'string', default: [] },
   isActive:    { type: 'boolean', default: true },
-});
+}${relationsOption(opts, [{ name: "subscriptions", kind: "hasMany", target: "Subscription", foreignKey: "plan" }])});
 `;
   await fs.outputFile(path.join(dest, "src", "model", `Plan.${ext}`), content);
 }
 async function writeInvoiceModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Invoice = defineModel('Invoice', {
-  userId:         { type: 'string', required: true },
-  subscriptionId: { type: 'string', required: true },
+export const Invoice = ${modelApi(opts).name}('Invoice', {
+${refField(opts, { field: "user", target: "User", legacy: `  userId:         { type: 'string', required: true },`, required: true, onDelete: "cascade" })}
+${refField(opts, { field: "subscription", target: "Subscription", legacy: `  subscriptionId: { type: 'string', required: true },`, onDelete: "setNull" })}
   amount:         { type: 'number', required: true },
   currency:       { type: 'string', required: true, default: 'USD' },
   status:         { type: 'string', required: true, default: 'pending' },
@@ -1166,10 +1298,10 @@ export const Invoice = defineModel('Invoice', {
 }
 async function writeApiKeyModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const ApiKey = defineModel('ApiKey', {
-  userId:    { type: 'string',  required: true },
+export const ApiKey = ${modelApi(opts).name}('ApiKey', {
+${refField(opts, { field: "user", target: "User", legacy: `  userId:    { type: 'string',  required: true },`, required: true, onDelete: "cascade" })}
   name:      { type: 'string',  required: true },
   key:       { type: 'string',  required: true, unique: true },
   lastUsed:  { type: 'date' },
@@ -1181,9 +1313,9 @@ export const ApiKey = defineModel('ApiKey', {
 }
 async function writeRoleModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Role = defineModel('Role', {
+export const Role = ${modelApi(opts).name}('Role', {
   name:        { type: 'string', required: true, unique: true },
   description: { type: 'string', required: true },
   permissions: { type: 'array',  of: 'string', default: [] },
@@ -1193,9 +1325,9 @@ export const Role = defineModel('Role', {
 }
 async function writeFAQModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const FAQ = defineModel('FAQ', {
+export const FAQ = ${modelApi(opts).name}('FAQ', {
   question:    { type: 'string',  required: true },
   answer:      { type: 'string',  required: true },
   category:    { type: 'string',  required: true, default: 'general' },
@@ -1207,13 +1339,13 @@ export const FAQ = defineModel('FAQ', {
 }
 async function writeBlogModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Blog = defineModel('Blog', {
+export const Blog = ${modelApi(opts).name}('Blog', {
   title:       { type: 'string', required: true },
   slug:        { type: 'string', required: true, unique: true },
   content:     { type: 'string', required: true },
-  authorId:    { type: 'string', required: true },
+${refField(opts, { field: "author", target: "Admin", legacy: `  authorId:    { type: 'string', required: true },`, onDelete: "setNull" })}
   category:    { type: 'string', required: true, default: 'general' },
   tags:        { type: 'array',  of: 'string', default: [] },
   status:      { type: 'string', required: true, default: 'draft' },
@@ -1224,22 +1356,22 @@ export const Blog = defineModel('Blog', {
 }
 async function writeCategoryModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Category = defineModel('Category', {
+export const Category = ${modelApi(opts).name}('Category', {
   name:        { type: 'string', required: true },
   slug:        { type: 'string', required: true, unique: true },
   description: { type: 'string' },
-  parentId:    { type: 'string' },
-});
+${refField(opts, { field: "parent", target: "Category", legacy: `  parentId:    { type: 'string' },`, onDelete: "setNull" })}
+}${relationsOption(opts, [{ name: "children", kind: "hasMany", target: "Category", foreignKey: "parent" }])});
 `;
   await fs.outputFile(path.join(dest, "src", "model", `Category.${ext}`), content);
 }
 async function writeCouponModel(dest, opts) {
   const ext = opts.language === "typescript" ? "ts" : "js";
-  const content = `import { defineModel } from 'express-file-cluster';
+  const content = `${modelApi(opts).import}
 
-export const Coupon = defineModel('Coupon', {
+export const Coupon = ${modelApi(opts).name}('Coupon', {
   code:      { type: 'string',  required: true, unique: true },
   type:      { type: 'string',  required: true, default: 'percent' },
   value:     { type: 'number',  required: true },
@@ -1252,6 +1384,7 @@ export const Coupon = defineModel('Coupon', {
   await fs.outputFile(path.join(dest, "src", "model", `Coupon.${ext}`), content);
 }
 async function writeAuthExtendedRoutes(dest, opts) {
+  const db = orm(opts);
   const ext = opts.language === "typescript" ? "ts" : "js";
   const ts = opts.language === "typescript";
   const mwUser2 = opts.rbac ? `export const middlewares = [requireAuth('user', 'admin')];
@@ -1260,9 +1393,9 @@ async function writeAuthExtendedRoutes(dest, opts) {
   const mwUser3 = mwUser2;
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
-  const hasAdmin = opts.adminPortal;
+  const hasAdmin = principals(opts).admin;
   const uf = opts.userFeatures;
-  const sendResetEmail = opts.mailer ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
+  const sendResetEmail = sendsMail(opts) ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
     await enqueue('SendEmail', {
       to: email,
       subject: 'Reset your password',
@@ -1270,7 +1403,7 @@ async function writeAuthExtendedRoutes(dest, opts) {
     });
 ` : `    // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail
 `;
-  const sendVerifyEmailResend = opts.mailer ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
+  const sendVerifyEmailResend = sendsMail(opts) ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
     await enqueue('SendEmail', {
       to: email,
       subject: 'Verify your email address',
@@ -1278,7 +1411,7 @@ async function writeAuthExtendedRoutes(dest, opts) {
     });
 ` : `    // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail
 `;
-  const mailerTaskImport = opts.mailer ? `import { enqueue } from 'express-file-cluster/tasks';
+  const mailerTaskImport = sendsMail(opts) ? `import { enqueue } from 'express-file-cluster/tasks';
 ` : "";
   if (uf.accountSecurity) {
     const refreshMeta = mkMeta(opts, {
@@ -1290,12 +1423,12 @@ async function writeAuthExtendedRoutes(dest, opts) {
     const refreshModelImports = `import { User } from '../../model/User.js';
 ${hasAdmin ? `import { Admin } from '../../model/Admin.js';
 ` : ""}`;
-    const refreshLookup = hasAdmin ? `  const user = await User.findOne({ refreshToken: token });
-  const admin = user ? null : await Admin.findOne({ refreshToken: token });
-  const account = user || admin;` : `  const user = await User.findOne({ refreshToken: token });
+    const refreshLookup = hasAdmin ? `  const user = await ${db.findOne("User", `{ refreshToken: token }`)};
+  const admin = user ? null : await ${db.findOne("Admin", `{ refreshToken: token }`)};
+  const account = user || admin;` : `  const user = await ${db.findOne("User", `{ refreshToken: token }`)};
   const account = user;`;
-    const refreshPersist = hasAdmin ? `  if (user) await User.update(user.id, { refreshToken: newRefreshToken, refreshTokenExpiry });
-  else if (admin) await Admin.update(admin.id, { refreshToken: newRefreshToken, refreshTokenExpiry });` : `  await User.update(user.id, { refreshToken: newRefreshToken, refreshTokenExpiry });`;
+    const refreshPersist = hasAdmin ? `  if (user) await ${db.update("User", `user.id`, `{ refreshToken: newRefreshToken, refreshTokenExpiry }`)};
+  else if (admin) await ${db.update("Admin", `admin.id`, `{ refreshToken: newRefreshToken, refreshTokenExpiry }`)};` : `  await ${db.update("User", `user.id`, `{ refreshToken: newRefreshToken, refreshTokenExpiry }`)};`;
     const refreshContent = ts ? `import { issueToken } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 import crypto from 'node:crypto';
@@ -1376,10 +1509,10 @@ ${veMeta}export const GET = async (req: Request, res: Response) => {
   const { token } = req.query;
   if (!token || typeof token !== 'string') return res.status(400).json({ error: 'token is required' });
 
-  const user = await User.findOne({ verifyToken: token });
+  const user = await ${db.findOne("User", `{ verifyToken: token }`)};
   if (!user) return res.status(400).json({ error: 'Invalid or expired verification token' });
 
-  await User.update(user.id, { isVerified: true, verifyToken: '' });
+  await ${db.update("User", `user.id`, `{ isVerified: true, verifyToken: '' }`)};
   res.json({ message: 'Email verified' });
 };
 
@@ -1387,10 +1520,10 @@ export const POST = async (req: Request, res: Response) => {
   const { email } = req.body;
   if (!email) return res.status(400).json({ error: 'email is required' });
 
-  const user = await User.findOne({ email });
+  const user = await ${db.findOne("User", `{ email }`)};
   if (user && !user.isVerified) {
     const verifyToken = crypto.randomBytes(32).toString('hex');
-    await User.update(user.id, { verifyToken });
+    await ${db.update("User", `user.id`, `{ verifyToken }`)};
 ${sendVerifyEmailResend}  }
 
   res.json({ message: 'Verification email sent' });
@@ -1401,10 +1534,10 @@ ${veMeta}export const GET = async (req, res) => {
   const { token } = req.query;
   if (!token || typeof token !== 'string') return res.status(400).json({ error: 'token is required' });
 
-  const user = await User.findOne({ verifyToken: token });
+  const user = await ${db.findOne("User", `{ verifyToken: token }`)};
   if (!user) return res.status(400).json({ error: 'Invalid or expired verification token' });
 
-  await User.update(user.id, { isVerified: true, verifyToken: '' });
+  await ${db.update("User", `user.id`, `{ isVerified: true, verifyToken: '' }`)};
   res.json({ message: 'Email verified' });
 };
 
@@ -1412,10 +1545,10 @@ export const POST = async (req, res) => {
   const { email } = req.body;
   if (!email) return res.status(400).json({ error: 'email is required' });
 
-  const user = await User.findOne({ email });
+  const user = await ${db.findOne("User", `{ email }`)};
   if (user && !user.isVerified) {
     const verifyToken = crypto.randomBytes(32).toString('hex');
-    await User.update(user.id, { verifyToken });
+    await ${db.update("User", `user.id`, `{ verifyToken }`)};
 ${sendVerifyEmailResend}  }
 
   res.json({ message: 'Verification email sent' });
@@ -1434,11 +1567,11 @@ ${sendVerifyEmailResend}  }
     const fpModelImports = `import { User } from '../../model/User.js';
 ${hasAdmin ? `import { Admin } from '../../model/Admin.js';
 ` : ""}`;
-    const fpLookup = hasAdmin ? `  const user = await User.findOne({ email });
-  const admin = user ? null : await Admin.findOne({ email });` : `  const user = await User.findOne({ email });`;
+    const fpLookup = hasAdmin ? `  const user = await ${db.findOne("User", `{ email }`)};
+  const admin = user ? null : await ${db.findOne("Admin", `{ email }`)};` : `  const user = await ${db.findOne("User", `{ email }`)};`;
     const fpGuard = hasAdmin ? "user || admin" : "user";
-    const fpPersist = hasAdmin ? `    if (user) await User.update(user.id, { resetToken, resetTokenExpiry });
-    else if (admin) await Admin.update(admin.id, { resetToken, resetTokenExpiry });` : `    await User.update(user.id, { resetToken, resetTokenExpiry });`;
+    const fpPersist = hasAdmin ? `    if (user) await ${db.update("User", `user.id`, `{ resetToken, resetTokenExpiry }`)};
+    else if (admin) await ${db.update("Admin", `admin.id`, `{ resetToken, resetTokenExpiry }`)};` : `    await ${db.update("User", `user.id`, `{ resetToken, resetTokenExpiry }`)};`;
     const fpContent = ts ? `import type { Request, Response } from 'express';
 import crypto from 'node:crypto';
 ${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
@@ -1490,12 +1623,12 @@ ${sendResetEmail}  }
     const rpModelImports = `import { User } from '../../model/User.js';
 ${hasAdmin ? `import { Admin } from '../../model/Admin.js';
 ` : ""}`;
-    const rpLookup = hasAdmin ? `  const user = await User.findOne({ resetToken: token });
-  const admin = user ? null : await Admin.findOne({ resetToken: token });
-  const account = user || admin;` : `  const user = await User.findOne({ resetToken: token });
+    const rpLookup = hasAdmin ? `  const user = await ${db.findOne("User", `{ resetToken: token }`)};
+  const admin = user ? null : await ${db.findOne("Admin", `{ resetToken: token }`)};
+  const account = user || admin;` : `  const user = await ${db.findOne("User", `{ resetToken: token }`)};
   const account = user;`;
-    const rpPersist = hasAdmin ? `  if (user) await User.update(user.id, { password: hashed, resetToken: '' });
-  else if (admin) await Admin.update(admin.id, { password: hashed, resetToken: '' });` : `  await User.update(user.id, { password: hashed, resetToken: '' });`;
+    const rpPersist = hasAdmin ? `  if (user) await ${db.update("User", `user.id`, `{ password: hashed, resetToken: '' }`)};
+  else if (admin) await ${db.update("Admin", `admin.id`, `{ password: hashed, resetToken: '' }`)};` : `  await ${db.update("User", `user.id`, `{ password: hashed, resetToken: '' }`)};`;
     const rpContent = ts ? `import type { Request, Response } from 'express';
 import bcrypt from 'bcrypt';
 import { revokeAllSessions } from 'express-file-cluster/auth';
@@ -1716,7 +1849,7 @@ async function writeUserExtendedRoutes(dest, opts) {
   const mw3 = mw2;
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
-  const user = ts ? `(req as any).user` : `req.user`;
+  const user2 = ts ? `(req as any).user` : `req.user`;
   const uf = opts.userFeatures;
   if (uf.accountSettings) {
     const avatarMeta = mkMeta(opts, {
@@ -1803,7 +1936,7 @@ export const PUT = async (req, res) => {
 ${accountMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   // TODO: compile and return personal data export
-  res.json({ data: { user: ${user}, exportedAt: new Date().toISOString() } });
+  res.json({ data: { user: ${user2}, exportedAt: new Date().toISOString() } });
 };
 
 export const DELETE = async (req: Request, res: Response) => {
@@ -1815,7 +1948,7 @@ export const DELETE = async (req: Request, res: Response) => {
 ` : `${RA}${accountMeta}${mw2}
 export const GET = async (req, res) => {
   // TODO: compile and return personal data export
-  res.json({ data: { user: ${user}, exportedAt: new Date().toISOString() } });
+  res.json({ data: { user: ${user2}, exportedAt: new Date().toISOString() } });
 };
 
 export const DELETE = async (req, res) => {
@@ -2204,7 +2337,10 @@ export const GET = async (req, res) => {
   }
   if (uf.apiAndBilling) {
     const akListMeta = mkMeta(opts, {
-      GET: { description: "List API keys for the authenticated user.", response: `{ apiKeys: [] }` },
+      GET: {
+        description: "List API keys for the authenticated user.",
+        response: `{ apiKeys: [] }`
+      },
       POST: {
         description: "Generate a new API key for the authenticated user.",
         request: `{ name: 'CI key' }`,
@@ -3447,12 +3583,54 @@ ${roleGuard}  const { status, page = 1, limit = 20 } = req.query;
     );
   }
 }
+async function writeModelIndex(dest, opts) {
+  const ts = opts.language === "typescript";
+  const ext = ts ? "ts" : "js";
+  const names = [...generatedModels(opts)].sort();
+  if (names.length === 0) return;
+  const exports = names.map((n) => `export { ${n} } from './${n}.js';`).join("\n");
+  const tables = ts ? `
+${names.map((n) => `import type { ${n} } from './${n}.js';`).join("\n")}
+
+// Types \`include\` results: relations name models by string, this maps the names to models.
+declare module 'express-file-cluster' {
+  interface Tables {
+${names.map((n) => `    ${n}: typeof ${n};`).join("\n")}
+  }
+}
+` : "";
+  const content = `// Every model, in one import: \`import { User } from '../model/index.js'\` also registers the
+// models its relations reach, which \`include\` needs.
+${exports}
+${tables}`;
+  await fs.outputFile(path.join(dest, "src", "model", `index.${ext}`), content);
+}
+var MODEL_ORDER = [
+  "User",
+  "Admin",
+  "Plan",
+  "Category",
+  "Role",
+  "FAQ",
+  "Coupon",
+  "OAuthAccount",
+  "Session",
+  "Notification",
+  "File",
+  "SupportTicket",
+  "AuditLog",
+  "Subscription",
+  "Invoice",
+  "ApiKey",
+  "Blog"
+];
 async function writeInitMigration(dest, opts) {
   const modelDir = path.join(dest, "src", "model");
   if (!await fs.pathExists(modelDir)) return;
   const ts = opts.language === "typescript";
   const ext = ts ? "ts" : "js";
-  const names = (await fs.readdir(modelDir)).filter((f) => f.endsWith(`.${ext}`)).map((f) => f.slice(0, -(ext.length + 1))).sort();
+  const rank = (n) => MODEL_ORDER.includes(n) ? MODEL_ORDER.indexOf(n) : MODEL_ORDER.length;
+  const names = (await fs.readdir(modelDir)).filter((f) => f.endsWith(`.${ext}`) && f !== `index.${ext}`).map((f) => f.slice(0, -(ext.length + 1))).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
   if (names.length === 0) return;
   const imports = names.map((n) => `import { ${n} } from '../model/${n}.js';`).join("\n");
   const typeImport = ts ? "import type { MigrationContext } from 'express-file-cluster';\n" : "";
@@ -3471,6 +3649,845 @@ export async function down${sig} {
 `;
   await fs.outputFile(path.join(dest, "src", "migrations", `00000000000000_init.${ext}`), content);
 }
+async function writeOAuthAccountModel(dest, opts) {
+  const ext = opts.language === "typescript" ? "ts" : "js";
+  const content = `${modelApi(opts).import}
+
+// One row per provider identity ("google:<sub>"), linked to the User it signs in as.
+export const OAuthAccount = ${modelApi(opts).name}('OAuthAccount', {
+  key:        { type: 'string', required: true, unique: true },
+  provider:   { type: 'string', required: true, enum: ['google', 'apple'] },
+  providerId: { type: 'string', required: true },
+  email:      { type: 'string' },
+${refField(opts, { field: "user", target: "User", legacy: `  userId:     { type: 'string', required: true },`, required: true, onDelete: "cascade" })}
+});
+`;
+  await fs.outputFile(path.join(dest, "src", "model", `OAuthAccount.${ext}`), content);
+}
+async function writeOAuth(dest, opts) {
+  const ts = opts.language === "typescript";
+  const ext = ts ? "ts" : "js";
+  const db = orm(opts);
+  const T = (s) => ts ? s : "";
+  const userField = usesTables(opts) && generatedModels(opts).has("User") ? "user" : "userId";
+  const lib = `import crypto from 'node:crypto';
+import bcrypt from 'bcrypt';
+import { HttpError } from 'express-file-cluster';
+import { issueToken } from 'express-file-cluster/auth';
+${T("import type { Request, Response } from 'express';\n")}import { User } from '../model/User.js';
+import { OAuthAccount } from '../model/OAuthAccount.js';
+
+// Shared by the OAuth sign-in routes (src/api/auth/<provider>/).
+
+const STATE_TTL_MS = 10 * 60 * 1000; // a sign-in attempt has 10 minutes to come back
+${T(`
+export interface OAuthState {
+  state: string;
+  nonce: string;
+  verifier?: string;
+}
+
+export interface OAuthProfile {
+  provider: 'google' | 'apple';
+  providerId: string;
+  email?: string;
+  emailVerified: boolean;
+  name?: string;
+}
+`)}
+/** A random URL-safe string (state, nonce, PKCE verifier). */
+export function randomToken()${T(": string")} {
+  return crypto.randomBytes(32).toString('base64url');
+}
+
+/** The PKCE S256 challenge for a verifier. */
+export function pkceChallenge(verifier${T(": string")})${T(": string")} {
+  return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
+
+/**
+ * Remembers a sign-in attempt in a short-lived cookie until the provider redirects back.
+ * \`crossSite\`: the provider POSTs the callback from its own site (Apple), so the cookie must
+ * be SameSite=None \u2014 which browsers only accept with Secure (https, or localhost).
+ */
+export function rememberState(
+  res${T(": Response")},
+  provider${T(": string")},
+  data${T(": OAuthState")},
+  crossSite = false,
+)${T(": void")} {
+  res.cookie(\`efc_oauth_\${provider}\`, JSON.stringify(data), {
+    httpOnly: true,
+    secure: crossSite || process.env.NODE_ENV === 'production',
+    sameSite: crossSite ? 'none' : 'lax',
+    maxAge: STATE_TTL_MS,
+    path: '/',
+  });
+}
+
+/** The remembered attempt (cleared) \u2014 or undefined if \`state\` doesn't match it. */
+export function takeState(
+  req${T(": Request")},
+  res${T(": Response")},
+  provider${T(": string")},
+  state${T(": unknown")},
+)${T(": OAuthState | undefined")} {
+  const name = \`efc_oauth_\${provider}\`;
+  const raw = ${ts ? "(req as Request & { cookies?: Record<string, string> }).cookies?.[name]" : "req.cookies?.[name]"};
+  res.clearCookie(name, { path: '/' });
+  if (!raw || typeof state !== 'string') return undefined;
+  try {
+    const saved = JSON.parse(raw)${T(" as OAuthState")};
+    const a = Buffer.from(String(saved.state));
+    const b = Buffer.from(state);
+    return a.length === b.length && crypto.timingSafeEqual(a, b) ? saved : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Signs in the user behind a provider identity: the account already linked to it, else the
+ * user with the same (provider-verified) email, else a new user. New users get a random
+ * password \u2014 they can set a real one with the forgot-password flow.
+ */
+export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuthProfile")})${T(": Promise<void>")} {
+  const key = \`\${profile.provider}:\${profile.providerId}\`;
+  const account = await ${db.findOne("OAuthAccount", "{ key }")};
+  let user = account ? await ${db.findById("User", `account.${userField}`)} : null;
+  if (!user) {
+    if (!profile.email || !profile.emailVerified) {
+      throw new HttpError(400, \`\${profile.provider} did not return a verified email address\`);
+    }
+    const email = profile.email;
+    user =
+      (await ${db.findOne("User", "{ email }")}) ??
+      (await ${db.create(
+    "User",
+    `{
+        name: profile.name || email.split('@')[0],
+        email,
+        password: await bcrypt.hash(randomToken(), 10),
+        isVerified: true,
+      }`
+  )});
+    if (account) await ${db.update("OAuthAccount", "account.id", `{ ${userField}: user.id }`)};
+    else {
+      await ${db.create(
+    "OAuthAccount",
+    `{
+        key,
+        provider: profile.provider,
+        providerId: profile.providerId,
+        email,
+        ${userField}: user.id,
+      }`
+  )};
+    }
+  }
+  if (!user.isActive) throw new HttpError(403, 'Account suspended');
+  await issueToken(res, { id: user.id, role: user.role, email: user.email });
+}
+
+/** Where the browser goes once signed in. */
+export function successRedirect()${T(": string")} {
+  return process.env.OAUTH_SUCCESS_REDIRECT || '/';
+}
+`;
+  const reqRes = (r) => ts ? `(${r}: Request, res: Response)` : `(${r}, res)`;
+  const typeImport = T("import type { Request, Response } from 'express';\n");
+  const meta = (method, description) => `${ts ? "import type { RouteMeta } from 'express-file-cluster';\n\n" : ""}export const meta${T(": RouteMeta")} = {
+  ${method}: { description: '${description}' },
+};
+
+`;
+  const googleStart = `${typeImport}import { pkceChallenge, randomToken, rememberState } from '../../../lib/oauth.js';
+${meta("GET", 'Start "Sign in with Google": redirects to Google.')}// Redirects to Google's consent screen; Google sends the browser back to the callback route
+// (GOOGLE_REDIRECT_URI \u2014 register that exact URL in the Google Cloud console).
+export const GET = async ${reqRes("_req")} => {
+  const state = randomToken();
+  const nonce = randomToken();
+  const verifier = randomToken();
+  rememberState(res, 'google', { state, nonce, verifier });
+  const params = new URLSearchParams({
+    client_id: process.env.GOOGLE_CLIENT_ID ?? '',
+    redirect_uri: process.env.GOOGLE_REDIRECT_URI ?? '',
+    response_type: 'code',
+    scope: 'openid email profile',
+    state,
+    nonce,
+    code_challenge: pkceChallenge(verifier),
+    code_challenge_method: 'S256',
+    prompt: 'select_account',
+  });
+  res.redirect(\`https://accounts.google.com/o/oauth2/v2/auth?\${params}\`);
+};
+`;
+  const googleCallback = `import { HttpError } from 'express-file-cluster';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+${typeImport}import { signInWithOAuth, successRedirect, takeState } from '../../../lib/oauth.js';
+${meta("GET", "Google redirects here after sign-in; signs the user in and redirects to OAUTH_SUCCESS_REDIRECT.")}const GOOGLE_KEYS = createRemoteJWKSet(new URL('https://www.googleapis.com/oauth2/v3/certs'));
+
+export const GET = async ${reqRes("req")} => {
+  const { code, state, error } = req.query;
+  if (error) throw new HttpError(400, \`Google sign-in failed: \${String(error)}\`);
+  const saved = takeState(req, res, 'google', state);
+  if (!saved || typeof code !== 'string') {
+    throw new HttpError(400, 'Sign-in attempt expired or invalid \u2014 start again');
+  }
+
+  const tokens = await fetch('https://oauth2.googleapis.com/token', {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      code,
+      client_id: process.env.GOOGLE_CLIENT_ID ?? '',
+      client_secret: process.env.GOOGLE_CLIENT_SECRET ?? '',
+      redirect_uri: process.env.GOOGLE_REDIRECT_URI ?? '',
+      grant_type: 'authorization_code',
+      code_verifier: saved.verifier ?? '',
+    }),
+  });
+  if (!tokens.ok) throw new HttpError(502, \`Google rejected the sign-in (\${tokens.status})\`);
+  const { id_token } = (await tokens.json())${T(" as { id_token: string }")};
+
+  const { payload } = await jwtVerify(id_token, GOOGLE_KEYS, {
+    issuer: ['https://accounts.google.com', 'accounts.google.com'],
+    audience: process.env.GOOGLE_CLIENT_ID ?? '',
+  });
+  if (payload.nonce !== saved.nonce) throw new HttpError(400, 'Invalid sign-in response');
+
+  await signInWithOAuth(res, {
+    provider: 'google',
+    providerId: String(payload.sub),
+    email: ${ts ? "payload.email as string | undefined" : "payload.email"},
+    emailVerified: payload.email_verified === true,
+    name: ${ts ? "payload.name as string | undefined" : "payload.name"},
+  });
+  res.redirect(successRedirect());
+};
+`;
+  const appleStart = `${typeImport}import { randomToken, rememberState } from '../../../lib/oauth.js';
+${meta("GET", 'Start "Sign in with Apple": redirects to Apple.')}// Redirects to Apple; Apple POSTs the result to the callback route (APPLE_REDIRECT_URI \u2014
+// register it on the Services ID; Apple only accepts https URLs on a verified domain).
+export const GET = async ${reqRes("_req")} => {
+  const state = randomToken();
+  const nonce = randomToken();
+  rememberState(res, 'apple', { state, nonce }, true);
+  const params = new URLSearchParams({
+    client_id: process.env.APPLE_CLIENT_ID ?? '',
+    redirect_uri: process.env.APPLE_REDIRECT_URI ?? '',
+    response_type: 'code',
+    response_mode: 'form_post',
+    scope: 'name email',
+    state,
+    nonce,
+  });
+  res.redirect(\`https://appleid.apple.com/auth/authorize?\${params}\`);
+};
+`;
+  const appleCallback = `import { HttpError } from 'express-file-cluster';
+import { SignJWT, createRemoteJWKSet, importPKCS8, jwtVerify } from 'jose';
+${typeImport}import { signInWithOAuth, successRedirect, takeState } from '../../../lib/oauth.js';
+${meta("POST", "Apple posts here after sign-in; signs the user in and redirects to OAUTH_SUCCESS_REDIRECT.")}const APPLE_KEYS = createRemoteJWKSet(new URL('https://appleid.apple.com/auth/keys'));
+
+// Apple's client secret is a short-lived ES256 JWT signed with your Sign in with Apple key
+// (APPLE_PRIVATE_KEY: the .p8 file's contents, newlines written as \\n).
+async function clientSecret()${T(": Promise<string>")} {
+  const key = await importPKCS8((process.env.APPLE_PRIVATE_KEY ?? '').replace(/\\\\n/g, '\\n'), 'ES256');
+  return new SignJWT({})
+    .setProtectedHeader({ alg: 'ES256', kid: process.env.APPLE_KEY_ID ?? '' })
+    .setIssuer(process.env.APPLE_TEAM_ID ?? '')
+    .setSubject(process.env.APPLE_CLIENT_ID ?? '')
+    .setAudience('https://appleid.apple.com')
+    .setIssuedAt()
+    .setExpirationTime('5m')
+    .sign(key);
+}
+
+export const POST = async ${reqRes("req")} => {
+  const { code, state, user, error } = req.body ?? {};
+  if (error) throw new HttpError(400, \`Apple sign-in failed: \${String(error)}\`);
+  const saved = takeState(req, res, 'apple', state);
+  if (!saved || typeof code !== 'string') {
+    throw new HttpError(400, 'Sign-in attempt expired or invalid \u2014 start again');
+  }
+
+  const tokens = await fetch('https://appleid.apple.com/auth/token', {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      code,
+      client_id: process.env.APPLE_CLIENT_ID ?? '',
+      client_secret: await clientSecret(),
+      redirect_uri: process.env.APPLE_REDIRECT_URI ?? '',
+      grant_type: 'authorization_code',
+    }),
+  });
+  if (!tokens.ok) throw new HttpError(502, \`Apple rejected the sign-in (\${tokens.status})\`);
+  const { id_token } = (await tokens.json())${T(" as { id_token: string }")};
+
+  const { payload } = await jwtVerify(id_token, APPLE_KEYS, {
+    issuer: 'https://appleid.apple.com',
+    audience: process.env.APPLE_CLIENT_ID ?? '',
+  });
+  if (payload.nonce !== saved.nonce) throw new HttpError(400, 'Invalid sign-in response');
+
+  // Apple sends the user's name once, on their first sign-in, as a JSON form field.
+  let name${T(": string | undefined")};
+  try {
+    const n = typeof user === 'string' ? JSON.parse(user).name : undefined;
+    name = [n?.firstName, n?.lastName].filter(Boolean).join(' ') || undefined;
+  } catch {
+    name = undefined;
+  }
+
+  await signInWithOAuth(res, {
+    provider: 'apple',
+    providerId: String(payload.sub),
+    email: ${ts ? "payload.email as string | undefined" : "payload.email"},
+    emailVerified: payload.email_verified === true || payload.email_verified === 'true',
+    name,
+  });
+  res.redirect(303, successRedirect());
+};
+`;
+  const oauth = opts.oauth ?? {};
+  await fs.outputFile(path.join(dest, "src", "lib", `oauth.${ext}`), lib);
+  if (oauth.google) {
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "google", `index.${ext}`),
+      googleStart
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "google", `callback.${ext}`),
+      googleCallback
+    );
+  }
+  if (oauth.apple) {
+    await fs.outputFile(path.join(dest, "src", "api", "auth", "apple", `index.${ext}`), appleStart);
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "apple", `callback.${ext}`),
+      appleCallback
+    );
+  }
+}
+
+// src/registry.ts
+import crypto2 from "crypto";
+import os from "os";
+import path2 from "path";
+import fs2 from "fs-extra";
+var VARIANTS = ["typescript", "javascript"].flatMap((language) => {
+  const lang = language === "typescript" ? "ts" : "js";
+  return [
+    {
+      key: `${lang}-mongo`,
+      language,
+      database: "mongodb",
+      modelApi: "defineModel"
+    },
+    {
+      key: `${lang}-pg-model`,
+      language,
+      database: "postgresql",
+      modelApi: "defineModel"
+    },
+    {
+      key: `${lang}-pg-table`,
+      language,
+      database: "postgresql",
+      modelApi: "defineTable"
+    }
+  ];
+});
+var user = (flag) => (o) => {
+  o.userPortal = true;
+  o.userFeatures = { ...o.userFeatures, [flag]: true };
+};
+var admin = (flag) => (o) => {
+  o.adminPortal = true;
+  o.adminFeatures = { ...o.adminFeatures, [flag]: true };
+};
+var ITEMS = [
+  {
+    name: "auth",
+    title: "Authentication",
+    description: "User & Admin models; register, login, logout and me routes",
+    group: "auth",
+    registryDependencies: [],
+    docs: "Tokens are issued per `authStrategy` in efc.config \u2014 'http-only' (cookie) or 'localStorage' (Bearer). Verification emails go through the SendEmail task; `efc add email-client` makes it send real mail.",
+    enable: (o) => {
+      o.userPortal = true;
+    }
+  },
+  {
+    name: "user-profile",
+    title: "Profile",
+    description: "GET/PUT /user/profile",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("profileViewing")
+  },
+  {
+    name: "forgot-password",
+    title: "Forgot / reset password",
+    description: "forgot-password and reset-password routes",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("forgotPassword")
+  },
+  {
+    name: "account-security",
+    title: "Account security",
+    description: "change password, 2FA, sessions, token refresh",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("accountSecurity")
+  },
+  {
+    name: "email-verification",
+    title: "Email verification",
+    description: "verify-email and resend-verification routes",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("emailVerification")
+  },
+  {
+    name: "account-settings",
+    title: "Account settings",
+    description: "avatar, settings, account, dashboard, activity",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("accountSettings")
+  },
+  {
+    name: "notifications",
+    title: "Notifications",
+    description: "Notification model + /user/notifications",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("notifications")
+  },
+  {
+    name: "files",
+    title: "Files, favorites & bookmarks",
+    description: "File model + files, favorites, bookmarks, search",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("filesAndMedia")
+  },
+  {
+    name: "billing",
+    title: "API keys & billing",
+    description: "Plan, Subscription, Invoice, ApiKey models + user billing routes",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("apiAndBilling")
+  },
+  {
+    name: "support",
+    title: "Support tickets",
+    description: "SupportTicket model + create & view own tickets",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("support")
+  },
+  {
+    name: "admin",
+    title: "Admin portal",
+    description: "admin dashboard stats, behind requireAuth('admin')",
+    group: "admin",
+    registryDependencies: ["auth"],
+    enable: (o) => {
+      o.adminPortal = true;
+    }
+  },
+  {
+    name: "admin-users",
+    title: "User management",
+    description: "list/create/suspend/verify/export users + stats",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("userManagement")
+  },
+  {
+    name: "admin-admins",
+    title: "Admin & role management",
+    description: "manage other admins + Role model",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("adminManagement")
+  },
+  {
+    name: "admin-analytics",
+    title: "Analytics",
+    description: "users, revenue, traffic dashboards",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("analytics")
+  },
+  {
+    name: "admin-content",
+    title: "Content management",
+    description: "FAQ, Blog, Category models + admin routes",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("contentManagement")
+  },
+  {
+    name: "admin-billing",
+    title: "Billing management",
+    description: "Plan, Coupon models + plans, coupons, subscriptions",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("billingManagement")
+  },
+  {
+    name: "admin-support",
+    title: "Support desk",
+    description: "view & respond to support tickets",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("supportManagement")
+  },
+  {
+    name: "admin-logs",
+    title: "Notifications & audit logs",
+    description: "broadcast + audit/activity/security logs",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("notificationsAndLogs")
+  },
+  {
+    name: "admin-system",
+    title: "System settings & health",
+    description: "app settings, health check, cache",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("systemSettings")
+  },
+  {
+    name: "auth@google",
+    title: "Sign in with Google",
+    description: "GET /auth/google \u2192 Google \u2192 /auth/google/callback (OpenID Connect + PKCE)",
+    group: "auth",
+    registryDependencies: ["auth"],
+    docs: 'Create an OAuth client (type "Web application") at console.cloud.google.com \u2192 APIs & Services \u2192 Credentials, and add GOOGLE_REDIRECT_URI as an authorised redirect URI. Send users to GET /v1/api/auth/google to sign in.',
+    prompts: [
+      {
+        name: "GOOGLE_CLIENT_ID",
+        type: "text",
+        message: "Google OAuth client ID:",
+        placeholder: "1234-abc.apps.googleusercontent.com",
+        required: true,
+        pattern: "\\.apps\\.googleusercontent\\.com$",
+        patternMessage: "Google client IDs end in .apps.googleusercontent.com",
+        note: "console.cloud.google.com \u2192 APIs & Services \u2192 Credentials \u2192 Create credentials \u2192 OAuth client ID (Web application)."
+      },
+      {
+        name: "GOOGLE_CLIENT_SECRET",
+        type: "password",
+        message: "Google OAuth client secret:",
+        required: true
+      },
+      {
+        name: "GOOGLE_REDIRECT_URI",
+        type: "text",
+        message: "Redirect URI (register it on the client):",
+        default: "http://localhost:3000/v1/api/auth/google/callback"
+      },
+      {
+        name: "OAUTH_SUCCESS_REDIRECT",
+        type: "text",
+        message: "Where to send the browser after sign-in:",
+        default: "http://localhost:3000/"
+      }
+    ],
+    enable: (o) => {
+      o.userPortal = true;
+      o.oauth = { ...o.oauth, google: true };
+    }
+  },
+  {
+    name: "auth@apple",
+    title: "Sign in with Apple",
+    description: "GET /auth/apple \u2192 Apple \u2192 POST /auth/apple/callback (form_post)",
+    group: "auth",
+    registryDependencies: ["auth"],
+    docs: "Needs a Services ID with Sign in with Apple enabled, its return URL set to APPLE_REDIRECT_URI (https, on a verified domain \u2014 Apple rejects localhost), and a Sign in with Apple key (.p8). Send users to GET /v1/api/auth/apple to sign in.",
+    prompts: [
+      {
+        name: "APPLE_CLIENT_ID",
+        type: "text",
+        message: "Services ID (client ID):",
+        placeholder: "com.yourapp.signin",
+        required: true,
+        note: "developer.apple.com \u2192 Certificates, IDs & Profiles: a Services ID with Sign in with Apple, and a key with Sign in with Apple (.p8)."
+      },
+      {
+        name: "APPLE_TEAM_ID",
+        type: "text",
+        message: "Team ID:",
+        required: true,
+        pattern: "^[A-Z0-9]{10}$",
+        patternMessage: "Team IDs are 10 characters (A-Z, 0-9)"
+      },
+      {
+        name: "APPLE_KEY_ID",
+        type: "text",
+        message: "Key ID:",
+        required: true,
+        pattern: "^[A-Z0-9]{10}$",
+        patternMessage: "Key IDs are 10 characters (A-Z, 0-9)"
+      },
+      {
+        name: "APPLE_PRIVATE_KEY",
+        type: "file",
+        message: "Path to the .p8 key file:",
+        placeholder: "./AuthKey_ABCDE12345.p8",
+        required: true,
+        pattern: "BEGIN PRIVATE KEY",
+        patternMessage: "That file doesn't look like a .p8 private key"
+      },
+      {
+        name: "APPLE_REDIRECT_URI",
+        type: "text",
+        message: "Return URL (https, registered on the Services ID):",
+        default: "https://api.yourapp.com/v1/api/auth/apple/callback",
+        pattern: "^https://",
+        patternMessage: "Apple only accepts https return URLs"
+      },
+      {
+        name: "OAUTH_SUCCESS_REDIRECT",
+        type: "text",
+        message: "Where to send the browser after sign-in:",
+        default: "http://localhost:3000/"
+      }
+    ],
+    enable: (o) => {
+      o.userPortal = true;
+      o.oauth = { ...o.oauth, apple: true };
+    }
+  },
+  {
+    name: "email-client",
+    aliases: ["mailer"],
+    title: "Email client",
+    description: "SendEmail task over SMTP (nodemailer) \u2014 Gmail or any SMTP server",
+    group: "integrations",
+    registryDependencies: [],
+    replaces: ["src/tasks/SendEmail.ts", "src/tasks/SendEmail.js"],
+    docs: "Every enqueue('SendEmail', { to, subject, body }) now sends real mail. Change SMTP settings in .env.",
+    prompts: [
+      {
+        name: "provider",
+        type: "select",
+        message: "Email provider:",
+        options: [
+          {
+            value: "gmail",
+            label: "Gmail",
+            hint: "smtp.gmail.com, preconfigured",
+            env: { SMTP_HOST: "smtp.gmail.com", SMTP_PORT: "465" }
+          },
+          { value: "custom", label: "Other (custom SMTP)", hint: "you'll provide host + port" }
+        ]
+      },
+      {
+        name: "SMTP_HOST",
+        type: "text",
+        message: "SMTP host:",
+        placeholder: "smtp.mailtrap.io",
+        required: true,
+        when: { provider: "custom" }
+      },
+      {
+        name: "SMTP_PORT",
+        type: "text",
+        message: "SMTP port:",
+        default: "587",
+        when: { provider: "custom" }
+      },
+      {
+        name: "SMTP_USER",
+        type: "text",
+        message: "Gmail address:",
+        placeholder: "you@gmail.com",
+        required: true,
+        when: { provider: "gmail" }
+      },
+      {
+        name: "SMTP_USER",
+        type: "text",
+        message: "SMTP username / email:",
+        placeholder: "you@example.com",
+        required: true,
+        when: { provider: "custom" }
+      },
+      {
+        name: "SMTP_PASS",
+        type: "password",
+        message: "Gmail app password (16 characters):",
+        required: true,
+        stripSpaces: true,
+        pattern: "^\\S{16}$",
+        patternMessage: "Gmail app passwords are 16 characters \u2014 this looks like a regular password, not an app password",
+        when: { provider: "gmail" },
+        note: "Google no longer accepts your regular password for SMTP. Generate a 16-character App Password: Google Account \u2192 Security \u2192 2-Step Verification \u2192 App passwords."
+      },
+      {
+        name: "SMTP_PASS",
+        type: "password",
+        message: "SMTP password:",
+        required: true,
+        when: { provider: "custom" }
+      },
+      { name: "SMTP_FROM", type: "text", message: "From address:", default: "{{SMTP_USER}}" },
+      {
+        name: "APP_URL",
+        type: "text",
+        message: "App URL (used in email links):",
+        default: "http://localhost:3000"
+      }
+    ],
+    enable: (o) => {
+      o.mailer = true;
+    }
+  }
+];
+var BY_NAME = new Map(
+  ITEMS.flatMap((i) => [i.name, ...i.aliases ?? []].map((n) => [n, i]))
+);
+function getItem(name) {
+  const item = BY_NAME.get(name);
+  if (!item) throw new Error(`Unknown registry item "${name}"`);
+  return item;
+}
+function withDependencies(names) {
+  const out = [];
+  const visit = (alias, stack) => {
+    const name = getItem(alias).name;
+    if (out.includes(name)) return;
+    if (stack.includes(name)) throw new Error(`Dependency cycle: ${[...stack, name].join(" \u2192 ")}`);
+    for (const dep of getItem(name).registryDependencies) visit(dep, [...stack, name]);
+    out.push(name);
+  };
+  for (const name of names) visit(name, []);
+  return out;
+}
+function registryOptions(v, items = [], extra = {}) {
+  const o = {
+    projectName: "efc-app",
+    language: v.language,
+    database: v.database,
+    ...v.database === "postgresql" && { modelApi: v.modelApi },
+    authStrategy: "http-only",
+    cluster: true,
+    tasks: true,
+    taskBackend: v.database === "postgresql" ? "pg-boss" : "bullmq",
+    routeDocs: true,
+    userPortal: false,
+    adminPortal: false,
+    adminFeatures: { ...NO_ADMIN_FEATURES },
+    userFeatures: { ...NO_USER_FEATURES },
+    rbac: true,
+    mailer: false,
+    ...extra,
+    registry: true
+  };
+  for (const name of withDependencies(items)) getItem(name).enable(o);
+  return o;
+}
+function isManagedPath(p2) {
+  return p2 === "package.json" || p2 === ".env" || p2 === ".env.example" || p2 === "AGENTS.md" || p2 === ".gitignore" || p2 === "tsconfig.json" || /^efc\.config\.[jt]s$/.test(p2) || /^src\/index\.[jt]s$/.test(p2) || /^src\/model\/index\.[jt]s$/.test(p2) || p2.startsWith("src/migrations/");
+}
+function sha256(content) {
+  return crypto2.createHash("sha256").update(content).digest("hex");
+}
+async function writeManifest(dest, opts, items) {
+  const pkg = await fs2.readJson(path2.join(dest, "package.json"));
+  const files = {};
+  const walk = async (dir) => {
+    for (const entry of await fs2.readdir(dir, { withFileTypes: true })) {
+      if (entry.name === "node_modules") continue;
+      const abs = path2.join(dir, entry.name);
+      if (entry.isDirectory()) await walk(abs);
+      else {
+        const rel = path2.relative(dest, abs).split(path2.sep).join("/");
+        if (!isManagedPath(rel)) files[rel] = sha256(await fs2.readFile(abs, "utf8"));
+      }
+    }
+  };
+  await walk(dest);
+  const manifest = {
+    registry: (pkg.dependencies["express-file-cluster"] ?? "").replace(/^[^\d]*/, ""),
+    language: opts.language,
+    database: opts.database,
+    modelApi: opts.database === "postgresql" ? opts.modelApi ?? "defineTable" : "defineModel",
+    tasks: opts.tasks ? opts.taskBackend ?? "bullmq" : null,
+    items: [...withDependencies(items)].sort(),
+    files: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)))
+  };
+  await fs2.writeFile(path2.join(dest, "efc.json"), JSON.stringify(manifest, null, 2) + "\n");
+}
+var isEnvName = (name) => /^[A-Z][A-Z0-9_]*$/.test(name);
+function promptApplies(p2, answers) {
+  return Object.entries(p2.when ?? {}).every(([k, v]) => answers[k] === v);
+}
+function promptDefault(p2, answers) {
+  return p2.default?.replace(/\{\{(\w+)\}\}/g, (_, k) => answers[k] ?? "");
+}
+function normalizeAnswer(p2, raw, cwd = process.cwd()) {
+  let value = p2.stripSpaces ? raw.replace(/\s/g, "") : raw.trim();
+  if (!value) return p2.required ? { error: "Required" } : { value };
+  if (p2.type === "file") {
+    const file = path2.resolve(cwd, value.replace(/^~(?=$|\/)/, os.homedir()));
+    if (!fs2.existsSync(file)) return { error: `No such file: ${file}` };
+    value = fs2.readFileSync(file, "utf8").trim();
+  }
+  if (p2.pattern && !new RegExp(p2.pattern).test(value)) {
+    return { error: p2.patternMessage ?? `Must match ${p2.pattern}` };
+  }
+  if (p2.type === "file") value = value.replace(/\r?\n/g, "\\n");
+  return { value };
+}
+function envFromAnswers(prompts, answers) {
+  const env = {};
+  for (const p2 of prompts) {
+    if (!(p2.name in answers) || !promptApplies(p2, answers)) continue;
+    if (isEnvName(p2.name)) env[p2.name] = answers[p2.name];
+    const chosen = p2.options?.find((o) => o.value === answers[p2.name]);
+    Object.assign(env, chosen?.env ?? {});
+  }
+  return env;
+}
+function itemPrompts(items) {
+  const out = [];
+  for (const name of items) {
+    for (const p2 of getItem(name).prompts ?? []) {
+      const dup = out.some(
+        (q) => q.name === p2.name && JSON.stringify(q.when) === JSON.stringify(p2.when)
+      );
+      if (!dup) out.push(p2);
+    }
+  }
+  return out;
+}
+async function setEnvValues(file, env) {
+  const line = (k, v) => !/[\s#"'`]/.test(v) ? `${k}=${v}` : v.includes("'") ? `${k}="${v.replace(/"/g, '\\"')}"` : `${k}='${v}'`;
+  const lines = await fs2.pathExists(file) ? (await fs2.readFile(file, "utf8")).split("\n") : [];
+  const rest = { ...env };
+  const out = lines.map((l) => {
+    const key = /^([A-Za-z0-9_]+)=/.exec(l)?.[1];
+    if (key === void 0 || !(key in rest)) return l;
+    const v = rest[key];
+    delete rest[key];
+    return line(key, v);
+  });
+  for (const [k, v] of Object.entries(rest)) out.push(line(k, v));
+  await fs2.writeFile(file, out.join("\n"));
+}
 
 // src/index.ts
 function cancel2(msg = "Cancelled") {
@@ -3503,190 +4520,125 @@ async function main() {
     ]
   });
   if (p.isCancel(database)) cancel2();
-  const authStrategy = await p.select({
-    message: "Authentication strategy:",
-    options: [
-      { value: "http-only", label: "http-only", hint: "secure cookie \u2014 recommended for SSR" },
-      { value: "localStorage", label: "localStorage", hint: "bearer token \u2014 for SPAs" }
-    ]
-  });
-  if (p.isCancel(authStrategy)) cancel2();
-  const features = await p.multiselect({
-    message: "Features: (space to toggle, enter to confirm)",
-    options: [
-      { value: "cluster", label: "Multi-core clustering", hint: "Node cluster module" },
-      { value: "tasks", label: "Background tasks", hint: "BullMQ / pg-boss" },
-      { value: "routeDocs", label: "API route documentation", hint: "meta exports + dashboard" },
-      { value: "userPortal", label: "User portal", hint: "auth, profile, billing routes" },
-      { value: "adminPortal", label: "Admin portal", hint: "dashboard, user mgmt, analytics" },
-      { value: "rbac", label: "Role-based access control", hint: "requireAuth('role') middleware" },
-      { value: "mailer", label: "Mailer", hint: "nodemailer + SMTP" }
-    ],
-    initialValues: ["cluster", "tasks", "routeDocs", "userPortal", "adminPortal", "rbac"],
-    required: false
-  });
-  if (p.isCancel(features)) cancel2();
-  const selected = new Set(features);
-  let userFeatures = NO_USER_FEATURES;
-  if (selected.has("userPortal")) {
-    const chosen = await p.multiselect({
-      message: "User portal features: (space to toggle, enter to confirm)",
+  let modelApi2;
+  if (database === "postgresql") {
+    const api = await p.select({
+      message: "Models:",
       options: [
-        { value: "profileViewing", label: "Profile viewing & editing", hint: "GET/PUT /user/profile" },
-        { value: "forgotPassword", label: "Forgot / reset password", hint: "forgot-password, reset-password" },
-        { value: "accountSecurity", label: "Change password, 2FA & sessions", hint: "change-password, 2fa/*, sessions/*, token refresh" },
-        { value: "emailVerification", label: "Email verification", hint: "verify-email route + registration flow" },
-        { value: "accountSettings", label: "Account settings", hint: "avatar, settings, account, dashboard, activity" },
-        { value: "notifications", label: "Notifications", hint: "user/notifications" },
-        { value: "filesAndMedia", label: "Files, favorites & bookmarks", hint: "files, favorites, bookmarks, search" },
-        { value: "apiAndBilling", label: "API keys & billing", hint: "api-keys, plans, subscription, invoices" },
-        { value: "support", label: "Support tickets", hint: "create & view own tickets" }
-      ],
-      initialValues: ["profileViewing", "forgotPassword", "accountSecurity", "emailVerification", "accountSettings", "notifications", "filesAndMedia", "apiAndBilling", "support"],
-      required: false
+        {
+          value: "defineTable",
+          label: "defineTable",
+          hint: "PostgreSQL-native \u2014 foreign keys, relations, include, Prisma-style queries"
+        },
+        { value: "defineModel", label: "defineModel", hint: "portable \u2014 the same API on MongoDB" }
+      ]
     });
-    if (p.isCancel(chosen)) cancel2();
-    const uSet = new Set(chosen);
-    userFeatures = {
-      profileViewing: uSet.has("profileViewing"),
-      forgotPassword: uSet.has("forgotPassword"),
-      accountSecurity: uSet.has("accountSecurity"),
-      emailVerification: uSet.has("emailVerification"),
-      accountSettings: uSet.has("accountSettings"),
-      notifications: uSet.has("notifications"),
-      filesAndMedia: uSet.has("filesAndMedia"),
-      apiAndBilling: uSet.has("apiAndBilling"),
-      support: uSet.has("support")
-    };
+    if (p.isCancel(api)) cancel2();
+    modelApi2 = api;
   }
-  let adminFeatures = NO_ADMIN_FEATURES;
-  if (selected.has("adminPortal")) {
-    const chosen = await p.multiselect({
-      message: "Admin panel features: (space to toggle, enter to confirm)",
-      options: [
-        { value: "userManagement", label: "User management", hint: "list/create/suspend/verify/export users + dashboard stats" },
-        { value: "adminManagement", label: "Admin & role management", hint: "manage other admins" + (selected.has("rbac") ? " + roles" : "") },
-        { value: "analytics", label: "Analytics", hint: "users, revenue, traffic dashboards" },
-        { value: "contentManagement", label: "Content management", hint: "FAQs, blog posts, categories" },
-        { value: "billingManagement", label: "Billing management", hint: "plans, coupons, subscriptions" },
-        { value: "supportManagement", label: "Support tickets", hint: "view & respond to tickets" },
-        { value: "notificationsAndLogs", label: "Notifications & audit logs", hint: "broadcast + audit/activity/security logs" },
-        { value: "systemSettings", label: "System settings & health", hint: "app settings, health check, cache" }
-      ],
-      initialValues: ["userManagement", "adminManagement", "analytics", "contentManagement", "billingManagement", "supportManagement", "notificationsAndLogs", "systemSettings"],
-      required: false
+  const taskBackend = await p.select({
+    message: "Task queue backend:",
+    options: database === "postgresql" ? [
+      { value: "pg-boss", label: "pg-boss", hint: "uses your PostgreSQL \u2014 no Redis" },
+      { value: "bullmq", label: "BullMQ", hint: "Redis" }
+    ] : [{ value: "bullmq", label: "BullMQ", hint: "Redis" }]
+  });
+  if (p.isCancel(taskBackend)) cancel2();
+  const cluster = await p.confirm({
+    message: "Multi-core clustering? (one worker per CPU in production)",
+    initialValue: true
+  });
+  if (p.isCancel(cluster)) cancel2();
+  const groupLabel = {
+    auth: "Auth",
+    user: "User portal",
+    admin: "Admin portal",
+    integrations: "Integrations"
+  };
+  const groups = {};
+  for (const item of ITEMS) {
+    (groups[groupLabel[item.group]] ??= []).push({
+      value: item.name,
+      label: item.title,
+      hint: item.description
     });
-    if (p.isCancel(chosen)) cancel2();
-    const aSet = new Set(chosen);
-    adminFeatures = {
-      userManagement: aSet.has("userManagement"),
-      adminManagement: aSet.has("adminManagement"),
-      analytics: aSet.has("analytics"),
-      contentManagement: aSet.has("contentManagement"),
-      billingManagement: aSet.has("billingManagement"),
-      supportManagement: aSet.has("supportManagement"),
-      notificationsAndLogs: aSet.has("notificationsAndLogs"),
-      systemSettings: aSet.has("systemSettings")
-    };
   }
-  let taskBackend;
-  if (selected.has("tasks")) {
-    const backend = await p.select({
-      message: "Task queue backend:",
+  const picked = await p.groupMultiselect({
+    message: `Add features now? ${pc.dim("(space to toggle, enter to confirm \u2014 or add any later with `efc add <item>`)")}`,
+    options: groups,
+    required: false
+  });
+  if (p.isCancel(picked)) cancel2();
+  const items = withDependencies(picked);
+  let authStrategy = "http-only";
+  if (items.includes("auth")) {
+    const strategy = await p.select({
+      message: "Authentication strategy:",
       options: [
-        { value: "bullmq", label: "BullMQ", hint: "Redis" },
-        {
-          value: "pg-boss",
-          label: "pg-boss",
-          hint: database === "postgresql" ? "uses your PostgreSQL \u2014 no Redis" : "needs PostgreSQL"
-        }
+        { value: "http-only", label: "http-only", hint: "secure cookie \u2014 recommended for SSR" },
+        { value: "localStorage", label: "localStorage", hint: "bearer token \u2014 for SPAs" }
       ]
     });
-    if (p.isCancel(backend)) cancel2();
-    taskBackend = backend;
+    if (p.isCancel(strategy)) cancel2();
+    authStrategy = strategy;
   }
-  let smtpProvider;
-  let smtpHost;
-  let smtpPort;
-  let smtpUser;
-  let smtpPass;
-  if (selected.has("mailer")) {
-    const provider = await p.select({
-      message: "Email provider:",
-      options: [
-        { value: "gmail", label: "Gmail", hint: "smtp.gmail.com, preconfigured" },
-        { value: "custom", label: "Other (custom SMTP)", hint: "you'll provide host + port" }
-      ]
-    });
-    if (p.isCancel(provider)) cancel2();
-    smtpProvider = provider;
-    if (smtpProvider === "custom") {
-      const host = await p.text({
-        message: "SMTP host:",
-        placeholder: "smtp.mailtrap.io",
-        validate: (v) => !v.trim() ? "SMTP host is required" : void 0
-      });
-      if (p.isCancel(host)) cancel2();
-      smtpHost = host;
-      const port = await p.text({
-        message: "SMTP port:",
-        placeholder: "587",
-        defaultValue: "587"
+  const answers = {};
+  const prompts = itemPrompts(items);
+  for (const q of prompts) {
+    if (!promptApplies(q, answers)) continue;
+    if (q.note) p.note(q.note);
+    if (q.type === "select") {
+      const choice = await p.select({
+        message: q.message,
+        options: (q.options ?? []).map((o) => ({
+          value: o.value,
+          label: o.label,
+          ...o.hint !== void 0 && { hint: o.hint }
+        }))
       });
-      if (p.isCancel(port)) cancel2();
-      smtpPort = port;
-    }
-    const user = await p.text({
-      message: smtpProvider === "gmail" ? "Gmail address:" : "SMTP username / email:",
-      placeholder: "you@example.com",
-      validate: (v) => !v.trim() ? "Email is required" : void 0
-    });
-    if (p.isCancel(user)) cancel2();
-    smtpUser = user;
-    if (smtpProvider === "gmail") {
-      p.note(
-        "Google no longer accepts your regular account password for SMTP.\nGenerate a 16-character App Password: Google Account -> Security -> 2-Step Verification -> App passwords.\nEnter it below without spaces (not your Gmail login password).",
-        "Gmail app password required"
-      );
+      if (p.isCancel(choice)) cancel2();
+      answers[q.name] = choice;
+      continue;
     }
-    const pass = await p.password({
-      message: smtpProvider === "gmail" ? "Gmail app password (16 characters):" : "SMTP password:",
-      validate: (v) => {
-        if (!v.trim()) return "Password is required";
-        if (smtpProvider === "gmail" && v.replace(/\s/g, "").length !== 16) {
-          return "Gmail app passwords are 16 characters \u2014 this looks like a regular password, not an app password";
-        }
-        return void 0;
-      }
+    const def = promptDefault(q, answers);
+    const check = (v) => {
+      const r2 = normalizeAnswer(q, v.trim() === "" ? def ?? "" : v);
+      return "error" in r2 ? r2.error : void 0;
+    };
+    const raw = q.type === "password" ? await p.password({ message: q.message, validate: check }) : await p.text({
+      message: q.message,
+      ...q.placeholder !== void 0 && { placeholder: q.placeholder },
+      ...def !== void 0 && { placeholder: def, defaultValue: def },
+      validate: check
     });
-    if (p.isCancel(pass)) cancel2();
-    smtpPass = pass.replace(/\s/g, "");
+    if (p.isCancel(raw)) cancel2();
+    const r = normalizeAnswer(q, raw.trim() === "" ? def ?? "" : raw);
+    answers[q.name] = "value" in r ? r.value : "";
   }
-  const opts = {
-    projectName,
-    language,
-    database,
-    authStrategy,
-    cluster: selected.has("cluster"),
-    tasks: selected.has("tasks"),
-    routeDocs: selected.has("routeDocs"),
-    userPortal: selected.has("userPortal"),
-    adminPortal: selected.has("adminPortal"),
-    userFeatures,
-    adminFeatures,
-    rbac: selected.has("rbac"),
-    mailer: selected.has("mailer"),
-    ...taskBackend !== void 0 && { taskBackend },
-    ...smtpProvider !== void 0 && { smtpProvider },
-    ...smtpHost !== void 0 && { smtpHost },
-    ...smtpPort !== void 0 && { smtpPort },
-    ...smtpUser !== void 0 && { smtpUser },
-    ...smtpPass !== void 0 && { smtpPass }
-  };
+  const env = envFromAnswers(prompts, answers);
+  const opts = registryOptions(
+    {
+      language,
+      database,
+      modelApi: modelApi2 ?? "defineModel"
+    },
+    items,
+    {
+      projectName,
+      authStrategy,
+      cluster,
+      taskBackend,
+      ...answers["provider"] === "custom" && { smtpProvider: "custom" }
+    }
+  );
   const spinner2 = p.spinner();
   spinner2.start("Scaffolding project\u2026");
   try {
     await scaffold(opts);
+    if (Object.keys(env).length) {
+      await setEnvValues(path3.resolve(process.cwd(), opts.projectName, ".env"), env);
+    }
+    await writeManifest(path3.resolve(process.cwd(), opts.projectName), opts, items);
     spinner2.stop("Project created");
   } catch (err) {
     spinner2.stop("Failed to scaffold project");
@@ -3700,11 +4652,12 @@ async function main() {
   await npmInstallGlobal().catch(() => {
   });
   spinner2.stop("efc CLI ready");
-  if (opts.mailer) {
+  const secrets = Object.keys(env).filter((k) => /PASS|SECRET|PRIVATE_KEY/.test(k));
+  if (secrets.length) {
     p.note(
-      `SMTP_USER and SMTP_PASS were written to ${projectName}/.env \u2014 that file is gitignored, never commit it.
-` + (opts.smtpProvider === "gmail" ? "If this Gmail app password ever leaks, revoke it and generate a new one." : "Rotate SMTP_PASS immediately if it is ever exposed."),
-      "Mailer credentials"
+      `${secrets.join(", ")} ${secrets.length > 1 ? "were" : "was"} written to ${projectName}/.env \u2014 that file is gitignored, never commit it.
+Rotate any of them immediately if it is ever exposed.`,
+      "Credentials"
     );
   }
   p.outro(
@@ -3715,6 +4668,8 @@ Your project is ready!
 `) + pc.dim(`  efc start dev
 `) + pc.dim(`
   (or: npm run dev)
+`) + pc.dim(`
+  Add features any time: efc list \xB7 efc add <item>
 `)
   );
 }
@@ -3727,7 +4682,10 @@ function npmInstall(projectDir) {
 function npmInstallGlobal() {
   return new Promise((resolve, reject) => {
     const child = spawn("npm", ["install", "-g", "express-file-cluster"], { stdio: "ignore" });
-    child.on("exit", (code) => code === 0 ? resolve() : reject(new Error("global install failed")));
+    child.on(
+      "exit",
+      (code) => code === 0 ? resolve() : reject(new Error("global install failed"))
+    );
   });
 }
 main().catch((err) => {