create-efc-app 0.7.1 → 0.8.0

package/dist/index.js

@@ -4,6 +4,7 @@
 import * as p from "@clack/prompts";
 import pc from "picocolors";
 import { spawn } from "child_process";
+import path3 from "path";
 
 // src/scaffold.ts
 import fs from "fs-extra";
@@ -30,6 +31,18 @@ var NO_USER_FEATURES = {
   apiAndBilling: false,
   support: false
 };
+function usesOAuth(opts) {
+  return !!(opts.oauth?.google || opts.oauth?.apple);
+}
+function principals(opts) {
+  return {
+    user: !!opts.registry || opts.userPortal,
+    admin: !!opts.registry || opts.adminPortal
+  };
+}
+function sendsMail(opts) {
+  return !!opts.registry || opts.mailer;
+}
 function usesTables(opts) {
   return opts.database === "postgresql" && opts.modelApi !== "defineModel";
 }
@@ -50,20 +63,23 @@ function orm(opts) {
 function generatedModels(opts) {
   const uf = opts.userFeatures;
   const af = opts.adminFeatures;
-  const user = opts.userPortal;
-  const admin = opts.adminPortal;
+  const user2 = opts.userPortal;
+  const admin2 = opts.adminPortal;
   const m = /* @__PURE__ */ new Set();
-  if (user || admin && af.userManagement) m.add("User");
-  if (admin) m.add("Admin");
-  if (user && uf.accountSecurity) m.add("Session");
-  if (user && uf.notifications || admin && af.notificationsAndLogs) m.add("Notification");
-  if (user && uf.filesAndMedia) m.add("File");
-  if (user && uf.support || admin && af.supportManagement) m.add("SupportTicket");
-  if (admin && af.notificationsAndLogs) m.add("AuditLog");
-  if (user && uf.apiAndBilling) m.add("Subscription").add("Invoice").add("ApiKey");
-  if (admin && af.billingManagement) m.add("Plan").add("Coupon");
-  if (opts.rbac && admin && af.adminManagement) m.add("Role");
-  if (admin && af.contentManagement) m.add("FAQ").add("Blog").add("Category");
+  if (user2 || admin2 && af.userManagement) m.add("User");
+  if (admin2) m.add("Admin");
+  if (opts.registry && (user2 || admin2)) m.add("User").add("Admin");
+  if (user2 && uf.accountSecurity) m.add("Session");
+  if (user2 && uf.notifications || admin2 && af.notificationsAndLogs) m.add("Notification");
+  if (user2 && uf.filesAndMedia) m.add("File");
+  if (user2 && uf.support || admin2 && af.supportManagement) m.add("SupportTicket");
+  if (admin2 && af.notificationsAndLogs) m.add("AuditLog");
+  if (user2 && uf.apiAndBilling) m.add("Subscription").add("Invoice").add("ApiKey");
+  if (usesOAuth(opts)) m.add("OAuthAccount");
+  if (admin2 && af.billingManagement) m.add("Plan").add("Coupon");
+  if (opts.rbac && admin2 && af.adminManagement) m.add("Role");
+  if (admin2 && af.contentManagement) m.add("FAQ").add("Blog").add("Category");
+  if (opts.registry && m.has("Subscription")) m.add("Plan");
   return m;
 }
 function modelApi(opts) {
@@ -76,7 +92,7 @@ function refField(opts, r) {
   return `  ${(r.field + ":").padEnd(13)}{ type: 'uuid', ref: '${r.target}'${opts2} },`;
 }
 function relationsOption(opts, rels) {
-  if (!usesTables(opts)) return "";
+  if (!usesTables(opts) || opts.registry) return "";
   const models = generatedModels(opts);
   const live = rels.filter((r) => models.has(r.target));
   if (live.length === 0) return "";
@@ -104,7 +120,7 @@ async function scaffold(opts) {
   await writeExampleRoute(dest, opts);
   if (models.has("User")) await writeUserModel(dest, opts);
   if (models.has("Admin")) await writeAdminModel(dest, opts);
-  await writeAuthRoutes(dest, opts);
+  if (!opts.registry || opts.userPortal || opts.adminPortal) await writeAuthRoutes(dest, opts);
   if (opts.adminPortal) await writeAdminRoutes(dest, opts);
   if (opts.userPortal && uf.profileViewing) await writeUserRoutes(dest, opts);
   if (opts.tasks) await writeExampleTask(dest, opts);
@@ -125,6 +141,8 @@ async function scaffold(opts) {
     ["Coupon", writeCouponModel]
   ];
   for (const [name, write] of extended) if (models.has(name)) await write(dest, opts);
+  if (models.has("OAuthAccount")) await writeOAuthAccountModel(dest, opts);
+  if (usesOAuth(opts)) await writeOAuth(dest, opts);
   if (usesTables(opts)) await writeModelIndex(dest, opts);
   if (opts.userPortal) await writeAuthExtendedRoutes(dest, opts);
   if (opts.userPortal) await writeUserExtendedRoutes(dest, opts);
@@ -135,7 +153,7 @@ async function scaffold(opts) {
 }
 async function writePackageJson(dest, opts) {
   const deps = {
-    "express-file-cluster": "^0.7.1"
+    "express-file-cluster": "^0.8.0"
   };
   if (opts.database === "mongodb") deps["mongoose"] = "^9.7.2";
   if (opts.database === "postgresql") {
@@ -145,7 +163,9 @@ async function writePackageJson(dest, opts) {
   if (opts.tasks && opts.taskBackend === "bullmq") deps["bullmq"] = "^5.0.0";
   if (opts.tasks && opts.taskBackend === "pg-boss") deps["pg-boss"] = "^12.0.0";
   if (opts.mailer) deps["nodemailer"] = "^6.9.0";
-  deps["bcrypt"] = "^5.1.0";
+  if (usesOAuth(opts)) deps["jose"] = "^6.2.3";
+  const auth = !opts.registry || opts.userPortal || opts.adminPortal;
+  if (auth) deps["bcrypt"] = "^5.1.0";
   const devDeps = {
     vitest: "^5.0.3"
   };
@@ -156,7 +176,7 @@ async function writePackageJson(dest, opts) {
     devDeps["@types/express"] = "^4.17.21";
     devDeps["tsx"] = "^4.0.0";
     if (opts.mailer) devDeps["@types/nodemailer"] = "^6.4.0";
-    devDeps["@types/bcrypt"] = "^5.0.0";
+    if (auth) devDeps["@types/bcrypt"] = "^5.0.0";
     if (opts.database === "postgresql") devDeps["@types/pg"] = "^8.11.0";
   }
   const pkg = {
@@ -291,12 +311,15 @@ Optional \u2014 the same docs over MCP, with search and scaffolding tools:
 - \`src/tasks/*.${ext}\` \u2014 background tasks; the file name is the task name (not recursive).
 ${usesTables(opts) ? `- \`src/model/*.${ext}\` \u2014 \`defineTable\` models (PostgreSQL-native, Prisma-style queries:
   \`findMany({ where, include })\`, \`create({ data })\`, \`update({ where, data })\`). A \`ref\` is a
-  foreign key; back-relations are in each model's \`relations\`. \`src/model/index.${ext}\` imports
+  foreign key; ${opts.registry ? "add back-relations to a model's `relations` when you need `include`" : "back-relations are in each model's `relations`"}. \`src/model/index.${ext}\` imports
   them all${opts.language === "typescript" ? " and declares `Tables` (typed `include`)" : ""} \u2014 add new models there.` : `- \`src/model/*.${ext}\` \u2014 \`defineModel\` models.`}
 - \`src/index.${ext}\` is the entry point; it imports \`efc.config.${ext}\` and passes it to \`ignite()\`.
 - Only three import paths exist: \`express-file-cluster\`, \`express-file-cluster/auth\`,
   \`express-file-cluster/tasks\`.
-
+${opts.registry ? `- Ready-made features (auth, user/admin portals, billing, mailer\u2026) come from the registry:
+  \`npx efc list\`, then \`npx efc add <item> --yes\` \u2014 check it before hand-writing auth or CRUD
+  (\`${D}/cli/add.md\`). \`efc.json\` tracks what was added; commit it.
+` : ""}
 ## Commands
 
 \`\`\`bash
@@ -334,16 +357,48 @@ SMTP_PASS=${isGmail ? "your_16_char_app_password" : "your_smtp_password"}${passC
 SMTP_FROM=noreply@yourapp.com
 ` : "";
   const redis = opts.tasks && opts.taskBackend !== "pg-boss" ? "\nREDIS_URL=redis://localhost:6379" : "";
+  const oauth = opts.oauth ?? {};
+  const oauthVars = [
+    ...oauth.google ? [
+      ["GOOGLE_CLIENT_ID", "", "your-client-id.apps.googleusercontent.com"],
+      ["GOOGLE_CLIENT_SECRET", "", "your-client-secret"],
+      [
+        "GOOGLE_REDIRECT_URI",
+        "http://localhost:3000/v1/api/auth/google/callback",
+        "https://api.yourapp.com/v1/api/auth/google/callback"
+      ]
+    ] : [],
+    ...oauth.apple ? [
+      ["APPLE_CLIENT_ID", "", "com.yourapp.signin"],
+      ["APPLE_TEAM_ID", "", "ABCDE12345"],
+      ["APPLE_KEY_ID", "", "FGHIJ67890"],
+      [
+        "APPLE_PRIVATE_KEY",
+        "",
+        "-----BEGIN PRIVATE KEY-----\\n...\\n-----END PRIVATE KEY-----"
+      ],
+      [
+        "APPLE_REDIRECT_URI",
+        "https://api.yourapp.com/v1/api/auth/apple/callback",
+        "https://api.yourapp.com/v1/api/auth/apple/callback"
+      ]
+    ] : [],
+    ...usesOAuth(opts) ? [["OAUTH_SUCCESS_REDIRECT", "http://localhost:3000/", "https://yourapp.com/"]] : []
+  ];
+  const oauthEnv = oauthVars.map(([k, v]) => `
+${k}=${v}`).join("");
+  const oauthExample = oauthVars.map(([k, , ex]) => `
+${k}=${ex}`).join("");
   const dotenv = `PORT=3000
 NODE_ENV=development
 DATABASE_URL=${dbUrl}
 JWT_SECRET=${secret}${redis}
-CORS_ORIGINS=http://localhost:3000${smtpVars}`;
+CORS_ORIGINS=http://localhost:3000${smtpVars}${oauthEnv}`;
   const example = `PORT=3000
 NODE_ENV=development
 DATABASE_URL=${dbExampleUrl}
 JWT_SECRET=<generate with: openssl rand -hex 64>${redis}
-CORS_ORIGINS=http://localhost:3000,https://yourapp.com${smtpExample}`;
+CORS_ORIGINS=http://localhost:3000,https://yourapp.com${smtpExample}${oauthExample}`;
   await fs.outputFile(path.join(dest, ".env"), dotenv);
   await fs.outputFile(path.join(dest, ".env.example"), example);
 }
@@ -527,8 +582,7 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const hasUser = opts.userPortal;
-  const hasAdmin = opts.adminPortal;
+  const { user: hasUser, admin: hasAdmin } = principals(opts);
   const hasModels = hasUser || hasAdmin;
   const loginDbImports = hasModels ? `import bcrypt from 'bcrypt';
 import crypto from 'node:crypto';
@@ -661,7 +715,7 @@ ${logoutMeta}export const POST = async (req, res) => {
 `;
   await fs.outputFile(path.join(dest, "src", "api", "auth", `login.${ext}`), loginContent);
   await fs.outputFile(path.join(dest, "src", "api", "auth", `logout.${ext}`), logoutContent);
-  if (!opts.userPortal) return;
+  if (!hasUser) return;
   const registerMeta = opts.routeDocs ? ts ? `import type { RouteMeta } from 'express-file-cluster';
 
 export const meta: RouteMeta = {
@@ -683,9 +737,9 @@ export const meta: RouteMeta = {
 ` : "";
   const registerDbImports = `import bcrypt from 'bcrypt';
 import crypto from 'node:crypto';
-${opts.mailer ? "import { enqueue } from 'express-file-cluster/tasks';\n" : ""}import { User } from '../../model/User.js';
+${sendsMail(opts) ? "import { enqueue } from 'express-file-cluster/tasks';\n" : ""}import { User } from '../../model/User.js';
 `;
-  const sendVerifyEmail = opts.mailer ? `
+  const sendVerifyEmail = sendsMail(opts) ? `
   var appUrl = process.env.APP_URL || 'http://localhost:3000';
   await enqueue('SendEmail', {
     to: email,
@@ -795,7 +849,7 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const dashboardHasUserModel = opts.adminFeatures.userManagement;
+  const dashboardHasUserModel = !!opts.registry || opts.adminFeatures.userManagement;
   const dashboardDbImport = dashboardHasUserModel ? `import { User } from '../../model/User.js';
 ` : "";
   const dashboardContent = dashboardHasUserModel ? ts ? `import { requireAuth } from 'express-file-cluster/auth';
@@ -1339,9 +1393,9 @@ async function writeAuthExtendedRoutes(dest, opts) {
   const mwUser3 = mwUser2;
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
-  const hasAdmin = opts.adminPortal;
+  const hasAdmin = principals(opts).admin;
   const uf = opts.userFeatures;
-  const sendResetEmail = opts.mailer ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
+  const sendResetEmail = sendsMail(opts) ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
     await enqueue('SendEmail', {
       to: email,
       subject: 'Reset your password',
@@ -1349,7 +1403,7 @@ async function writeAuthExtendedRoutes(dest, opts) {
     });
 ` : `    // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail
 `;
-  const sendVerifyEmailResend = opts.mailer ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
+  const sendVerifyEmailResend = sendsMail(opts) ? `    var appUrl = process.env.APP_URL || 'http://localhost:3000';
     await enqueue('SendEmail', {
       to: email,
       subject: 'Verify your email address',
@@ -1357,7 +1411,7 @@ async function writeAuthExtendedRoutes(dest, opts) {
     });
 ` : `    // TODO: email this token to the user \u2014 enable the Mailer feature to auto-wire SendEmail
 `;
-  const mailerTaskImport = opts.mailer ? `import { enqueue } from 'express-file-cluster/tasks';
+  const mailerTaskImport = sendsMail(opts) ? `import { enqueue } from 'express-file-cluster/tasks';
 ` : "";
   if (uf.accountSecurity) {
     const refreshMeta = mkMeta(opts, {
@@ -1795,7 +1849,7 @@ async function writeUserExtendedRoutes(dest, opts) {
   const mw3 = mw2;
   const RA = `import { requireAuth } from 'express-file-cluster/auth';
 `;
-  const user = ts ? `(req as any).user` : `req.user`;
+  const user2 = ts ? `(req as any).user` : `req.user`;
   const uf = opts.userFeatures;
   if (uf.accountSettings) {
     const avatarMeta = mkMeta(opts, {
@@ -1882,7 +1936,7 @@ export const PUT = async (req, res) => {
 ${accountMeta}${mw2}
 export const GET = async (req: Request, res: Response) => {
   // TODO: compile and return personal data export
-  res.json({ data: { user: ${user}, exportedAt: new Date().toISOString() } });
+  res.json({ data: { user: ${user2}, exportedAt: new Date().toISOString() } });
 };
 
 export const DELETE = async (req: Request, res: Response) => {
@@ -1894,7 +1948,7 @@ export const DELETE = async (req: Request, res: Response) => {
 ` : `${RA}${accountMeta}${mw2}
 export const GET = async (req, res) => {
   // TODO: compile and return personal data export
-  res.json({ data: { user: ${user}, exportedAt: new Date().toISOString() } });
+  res.json({ data: { user: ${user2}, exportedAt: new Date().toISOString() } });
 };
 
 export const DELETE = async (req, res) => {
@@ -3559,6 +3613,7 @@ var MODEL_ORDER = [
   "Role",
   "FAQ",
   "Coupon",
+  "OAuthAccount",
   "Session",
   "Notification",
   "File",
@@ -3594,6 +3649,845 @@ export async function down${sig} {
 `;
   await fs.outputFile(path.join(dest, "src", "migrations", `00000000000000_init.${ext}`), content);
 }
+async function writeOAuthAccountModel(dest, opts) {
+  const ext = opts.language === "typescript" ? "ts" : "js";
+  const content = `${modelApi(opts).import}
+
+// One row per provider identity ("google:<sub>"), linked to the User it signs in as.
+export const OAuthAccount = ${modelApi(opts).name}('OAuthAccount', {
+  key:        { type: 'string', required: true, unique: true },
+  provider:   { type: 'string', required: true, enum: ['google', 'apple'] },
+  providerId: { type: 'string', required: true },
+  email:      { type: 'string' },
+${refField(opts, { field: "user", target: "User", legacy: `  userId:     { type: 'string', required: true },`, required: true, onDelete: "cascade" })}
+});
+`;
+  await fs.outputFile(path.join(dest, "src", "model", `OAuthAccount.${ext}`), content);
+}
+async function writeOAuth(dest, opts) {
+  const ts = opts.language === "typescript";
+  const ext = ts ? "ts" : "js";
+  const db = orm(opts);
+  const T = (s) => ts ? s : "";
+  const userField = usesTables(opts) && generatedModels(opts).has("User") ? "user" : "userId";
+  const lib = `import crypto from 'node:crypto';
+import bcrypt from 'bcrypt';
+import { HttpError } from 'express-file-cluster';
+import { issueToken } from 'express-file-cluster/auth';
+${T("import type { Request, Response } from 'express';\n")}import { User } from '../model/User.js';
+import { OAuthAccount } from '../model/OAuthAccount.js';
+
+// Shared by the OAuth sign-in routes (src/api/auth/<provider>/).
+
+const STATE_TTL_MS = 10 * 60 * 1000; // a sign-in attempt has 10 minutes to come back
+${T(`
+export interface OAuthState {
+  state: string;
+  nonce: string;
+  verifier?: string;
+}
+
+export interface OAuthProfile {
+  provider: 'google' | 'apple';
+  providerId: string;
+  email?: string;
+  emailVerified: boolean;
+  name?: string;
+}
+`)}
+/** A random URL-safe string (state, nonce, PKCE verifier). */
+export function randomToken()${T(": string")} {
+  return crypto.randomBytes(32).toString('base64url');
+}
+
+/** The PKCE S256 challenge for a verifier. */
+export function pkceChallenge(verifier${T(": string")})${T(": string")} {
+  return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
+
+/**
+ * Remembers a sign-in attempt in a short-lived cookie until the provider redirects back.
+ * \`crossSite\`: the provider POSTs the callback from its own site (Apple), so the cookie must
+ * be SameSite=None \u2014 which browsers only accept with Secure (https, or localhost).
+ */
+export function rememberState(
+  res${T(": Response")},
+  provider${T(": string")},
+  data${T(": OAuthState")},
+  crossSite = false,
+)${T(": void")} {
+  res.cookie(\`efc_oauth_\${provider}\`, JSON.stringify(data), {
+    httpOnly: true,
+    secure: crossSite || process.env.NODE_ENV === 'production',
+    sameSite: crossSite ? 'none' : 'lax',
+    maxAge: STATE_TTL_MS,
+    path: '/',
+  });
+}
+
+/** The remembered attempt (cleared) \u2014 or undefined if \`state\` doesn't match it. */
+export function takeState(
+  req${T(": Request")},
+  res${T(": Response")},
+  provider${T(": string")},
+  state${T(": unknown")},
+)${T(": OAuthState | undefined")} {
+  const name = \`efc_oauth_\${provider}\`;
+  const raw = ${ts ? "(req as Request & { cookies?: Record<string, string> }).cookies?.[name]" : "req.cookies?.[name]"};
+  res.clearCookie(name, { path: '/' });
+  if (!raw || typeof state !== 'string') return undefined;
+  try {
+    const saved = JSON.parse(raw)${T(" as OAuthState")};
+    const a = Buffer.from(String(saved.state));
+    const b = Buffer.from(state);
+    return a.length === b.length && crypto.timingSafeEqual(a, b) ? saved : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Signs in the user behind a provider identity: the account already linked to it, else the
+ * user with the same (provider-verified) email, else a new user. New users get a random
+ * password \u2014 they can set a real one with the forgot-password flow.
+ */
+export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuthProfile")})${T(": Promise<void>")} {
+  const key = \`\${profile.provider}:\${profile.providerId}\`;
+  const account = await ${db.findOne("OAuthAccount", "{ key }")};
+  let user = account ? await ${db.findById("User", `account.${userField}`)} : null;
+  if (!user) {
+    if (!profile.email || !profile.emailVerified) {
+      throw new HttpError(400, \`\${profile.provider} did not return a verified email address\`);
+    }
+    const email = profile.email;
+    user =
+      (await ${db.findOne("User", "{ email }")}) ??
+      (await ${db.create(
+    "User",
+    `{
+        name: profile.name || email.split('@')[0],
+        email,
+        password: await bcrypt.hash(randomToken(), 10),
+        isVerified: true,
+      }`
+  )});
+    if (account) await ${db.update("OAuthAccount", "account.id", `{ ${userField}: user.id }`)};
+    else {
+      await ${db.create(
+    "OAuthAccount",
+    `{
+        key,
+        provider: profile.provider,
+        providerId: profile.providerId,
+        email,
+        ${userField}: user.id,
+      }`
+  )};
+    }
+  }
+  if (!user.isActive) throw new HttpError(403, 'Account suspended');
+  await issueToken(res, { id: user.id, role: user.role, email: user.email });
+}
+
+/** Where the browser goes once signed in. */
+export function successRedirect()${T(": string")} {
+  return process.env.OAUTH_SUCCESS_REDIRECT || '/';
+}
+`;
+  const reqRes = (r) => ts ? `(${r}: Request, res: Response)` : `(${r}, res)`;
+  const typeImport = T("import type { Request, Response } from 'express';\n");
+  const meta = (method, description) => `${ts ? "import type { RouteMeta } from 'express-file-cluster';\n\n" : ""}export const meta${T(": RouteMeta")} = {
+  ${method}: { description: '${description}' },
+};
+
+`;
+  const googleStart = `${typeImport}import { pkceChallenge, randomToken, rememberState } from '../../../lib/oauth.js';
+${meta("GET", 'Start "Sign in with Google": redirects to Google.')}// Redirects to Google's consent screen; Google sends the browser back to the callback route
+// (GOOGLE_REDIRECT_URI \u2014 register that exact URL in the Google Cloud console).
+export const GET = async ${reqRes("_req")} => {
+  const state = randomToken();
+  const nonce = randomToken();
+  const verifier = randomToken();
+  rememberState(res, 'google', { state, nonce, verifier });
+  const params = new URLSearchParams({
+    client_id: process.env.GOOGLE_CLIENT_ID ?? '',
+    redirect_uri: process.env.GOOGLE_REDIRECT_URI ?? '',
+    response_type: 'code',
+    scope: 'openid email profile',
+    state,
+    nonce,
+    code_challenge: pkceChallenge(verifier),
+    code_challenge_method: 'S256',
+    prompt: 'select_account',
+  });
+  res.redirect(\`https://accounts.google.com/o/oauth2/v2/auth?\${params}\`);
+};
+`;
+  const googleCallback = `import { HttpError } from 'express-file-cluster';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+${typeImport}import { signInWithOAuth, successRedirect, takeState } from '../../../lib/oauth.js';
+${meta("GET", "Google redirects here after sign-in; signs the user in and redirects to OAUTH_SUCCESS_REDIRECT.")}const GOOGLE_KEYS = createRemoteJWKSet(new URL('https://www.googleapis.com/oauth2/v3/certs'));
+
+export const GET = async ${reqRes("req")} => {
+  const { code, state, error } = req.query;
+  if (error) throw new HttpError(400, \`Google sign-in failed: \${String(error)}\`);
+  const saved = takeState(req, res, 'google', state);
+  if (!saved || typeof code !== 'string') {
+    throw new HttpError(400, 'Sign-in attempt expired or invalid \u2014 start again');
+  }
+
+  const tokens = await fetch('https://oauth2.googleapis.com/token', {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      code,
+      client_id: process.env.GOOGLE_CLIENT_ID ?? '',
+      client_secret: process.env.GOOGLE_CLIENT_SECRET ?? '',
+      redirect_uri: process.env.GOOGLE_REDIRECT_URI ?? '',
+      grant_type: 'authorization_code',
+      code_verifier: saved.verifier ?? '',
+    }),
+  });
+  if (!tokens.ok) throw new HttpError(502, \`Google rejected the sign-in (\${tokens.status})\`);
+  const { id_token } = (await tokens.json())${T(" as { id_token: string }")};
+
+  const { payload } = await jwtVerify(id_token, GOOGLE_KEYS, {
+    issuer: ['https://accounts.google.com', 'accounts.google.com'],
+    audience: process.env.GOOGLE_CLIENT_ID ?? '',
+  });
+  if (payload.nonce !== saved.nonce) throw new HttpError(400, 'Invalid sign-in response');
+
+  await signInWithOAuth(res, {
+    provider: 'google',
+    providerId: String(payload.sub),
+    email: ${ts ? "payload.email as string | undefined" : "payload.email"},
+    emailVerified: payload.email_verified === true,
+    name: ${ts ? "payload.name as string | undefined" : "payload.name"},
+  });
+  res.redirect(successRedirect());
+};
+`;
+  const appleStart = `${typeImport}import { randomToken, rememberState } from '../../../lib/oauth.js';
+${meta("GET", 'Start "Sign in with Apple": redirects to Apple.')}// Redirects to Apple; Apple POSTs the result to the callback route (APPLE_REDIRECT_URI \u2014
+// register it on the Services ID; Apple only accepts https URLs on a verified domain).
+export const GET = async ${reqRes("_req")} => {
+  const state = randomToken();
+  const nonce = randomToken();
+  rememberState(res, 'apple', { state, nonce }, true);
+  const params = new URLSearchParams({
+    client_id: process.env.APPLE_CLIENT_ID ?? '',
+    redirect_uri: process.env.APPLE_REDIRECT_URI ?? '',
+    response_type: 'code',
+    response_mode: 'form_post',
+    scope: 'name email',
+    state,
+    nonce,
+  });
+  res.redirect(\`https://appleid.apple.com/auth/authorize?\${params}\`);
+};
+`;
+  const appleCallback = `import { HttpError } from 'express-file-cluster';
+import { SignJWT, createRemoteJWKSet, importPKCS8, jwtVerify } from 'jose';
+${typeImport}import { signInWithOAuth, successRedirect, takeState } from '../../../lib/oauth.js';
+${meta("POST", "Apple posts here after sign-in; signs the user in and redirects to OAUTH_SUCCESS_REDIRECT.")}const APPLE_KEYS = createRemoteJWKSet(new URL('https://appleid.apple.com/auth/keys'));
+
+// Apple's client secret is a short-lived ES256 JWT signed with your Sign in with Apple key
+// (APPLE_PRIVATE_KEY: the .p8 file's contents, newlines written as \\n).
+async function clientSecret()${T(": Promise<string>")} {
+  const key = await importPKCS8((process.env.APPLE_PRIVATE_KEY ?? '').replace(/\\\\n/g, '\\n'), 'ES256');
+  return new SignJWT({})
+    .setProtectedHeader({ alg: 'ES256', kid: process.env.APPLE_KEY_ID ?? '' })
+    .setIssuer(process.env.APPLE_TEAM_ID ?? '')
+    .setSubject(process.env.APPLE_CLIENT_ID ?? '')
+    .setAudience('https://appleid.apple.com')
+    .setIssuedAt()
+    .setExpirationTime('5m')
+    .sign(key);
+}
+
+export const POST = async ${reqRes("req")} => {
+  const { code, state, user, error } = req.body ?? {};
+  if (error) throw new HttpError(400, \`Apple sign-in failed: \${String(error)}\`);
+  const saved = takeState(req, res, 'apple', state);
+  if (!saved || typeof code !== 'string') {
+    throw new HttpError(400, 'Sign-in attempt expired or invalid \u2014 start again');
+  }
+
+  const tokens = await fetch('https://appleid.apple.com/auth/token', {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      code,
+      client_id: process.env.APPLE_CLIENT_ID ?? '',
+      client_secret: await clientSecret(),
+      redirect_uri: process.env.APPLE_REDIRECT_URI ?? '',
+      grant_type: 'authorization_code',
+    }),
+  });
+  if (!tokens.ok) throw new HttpError(502, \`Apple rejected the sign-in (\${tokens.status})\`);
+  const { id_token } = (await tokens.json())${T(" as { id_token: string }")};
+
+  const { payload } = await jwtVerify(id_token, APPLE_KEYS, {
+    issuer: 'https://appleid.apple.com',
+    audience: process.env.APPLE_CLIENT_ID ?? '',
+  });
+  if (payload.nonce !== saved.nonce) throw new HttpError(400, 'Invalid sign-in response');
+
+  // Apple sends the user's name once, on their first sign-in, as a JSON form field.
+  let name${T(": string | undefined")};
+  try {
+    const n = typeof user === 'string' ? JSON.parse(user).name : undefined;
+    name = [n?.firstName, n?.lastName].filter(Boolean).join(' ') || undefined;
+  } catch {
+    name = undefined;
+  }
+
+  await signInWithOAuth(res, {
+    provider: 'apple',
+    providerId: String(payload.sub),
+    email: ${ts ? "payload.email as string | undefined" : "payload.email"},
+    emailVerified: payload.email_verified === true || payload.email_verified === 'true',
+    name,
+  });
+  res.redirect(303, successRedirect());
+};
+`;
+  const oauth = opts.oauth ?? {};
+  await fs.outputFile(path.join(dest, "src", "lib", `oauth.${ext}`), lib);
+  if (oauth.google) {
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "google", `index.${ext}`),
+      googleStart
+    );
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "google", `callback.${ext}`),
+      googleCallback
+    );
+  }
+  if (oauth.apple) {
+    await fs.outputFile(path.join(dest, "src", "api", "auth", "apple", `index.${ext}`), appleStart);
+    await fs.outputFile(
+      path.join(dest, "src", "api", "auth", "apple", `callback.${ext}`),
+      appleCallback
+    );
+  }
+}
+
+// src/registry.ts
+import crypto2 from "crypto";
+import os from "os";
+import path2 from "path";
+import fs2 from "fs-extra";
+var VARIANTS = ["typescript", "javascript"].flatMap((language) => {
+  const lang = language === "typescript" ? "ts" : "js";
+  return [
+    {
+      key: `${lang}-mongo`,
+      language,
+      database: "mongodb",
+      modelApi: "defineModel"
+    },
+    {
+      key: `${lang}-pg-model`,
+      language,
+      database: "postgresql",
+      modelApi: "defineModel"
+    },
+    {
+      key: `${lang}-pg-table`,
+      language,
+      database: "postgresql",
+      modelApi: "defineTable"
+    }
+  ];
+});
+var user = (flag) => (o) => {
+  o.userPortal = true;
+  o.userFeatures = { ...o.userFeatures, [flag]: true };
+};
+var admin = (flag) => (o) => {
+  o.adminPortal = true;
+  o.adminFeatures = { ...o.adminFeatures, [flag]: true };
+};
+var ITEMS = [
+  {
+    name: "auth",
+    title: "Authentication",
+    description: "User & Admin models; register, login, logout and me routes",
+    group: "auth",
+    registryDependencies: [],
+    docs: "Tokens are issued per `authStrategy` in efc.config \u2014 'http-only' (cookie) or 'localStorage' (Bearer). Verification emails go through the SendEmail task; `efc add email-client` makes it send real mail.",
+    enable: (o) => {
+      o.userPortal = true;
+    }
+  },
+  {
+    name: "user-profile",
+    title: "Profile",
+    description: "GET/PUT /user/profile",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("profileViewing")
+  },
+  {
+    name: "forgot-password",
+    title: "Forgot / reset password",
+    description: "forgot-password and reset-password routes",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("forgotPassword")
+  },
+  {
+    name: "account-security",
+    title: "Account security",
+    description: "change password, 2FA, sessions, token refresh",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("accountSecurity")
+  },
+  {
+    name: "email-verification",
+    title: "Email verification",
+    description: "verify-email and resend-verification routes",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("emailVerification")
+  },
+  {
+    name: "account-settings",
+    title: "Account settings",
+    description: "avatar, settings, account, dashboard, activity",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("accountSettings")
+  },
+  {
+    name: "notifications",
+    title: "Notifications",
+    description: "Notification model + /user/notifications",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("notifications")
+  },
+  {
+    name: "files",
+    title: "Files, favorites & bookmarks",
+    description: "File model + files, favorites, bookmarks, search",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("filesAndMedia")
+  },
+  {
+    name: "billing",
+    title: "API keys & billing",
+    description: "Plan, Subscription, Invoice, ApiKey models + user billing routes",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("apiAndBilling")
+  },
+  {
+    name: "support",
+    title: "Support tickets",
+    description: "SupportTicket model + create & view own tickets",
+    group: "user",
+    registryDependencies: ["auth"],
+    enable: user("support")
+  },
+  {
+    name: "admin",
+    title: "Admin portal",
+    description: "admin dashboard stats, behind requireAuth('admin')",
+    group: "admin",
+    registryDependencies: ["auth"],
+    enable: (o) => {
+      o.adminPortal = true;
+    }
+  },
+  {
+    name: "admin-users",
+    title: "User management",
+    description: "list/create/suspend/verify/export users + stats",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("userManagement")
+  },
+  {
+    name: "admin-admins",
+    title: "Admin & role management",
+    description: "manage other admins + Role model",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("adminManagement")
+  },
+  {
+    name: "admin-analytics",
+    title: "Analytics",
+    description: "users, revenue, traffic dashboards",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("analytics")
+  },
+  {
+    name: "admin-content",
+    title: "Content management",
+    description: "FAQ, Blog, Category models + admin routes",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("contentManagement")
+  },
+  {
+    name: "admin-billing",
+    title: "Billing management",
+    description: "Plan, Coupon models + plans, coupons, subscriptions",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("billingManagement")
+  },
+  {
+    name: "admin-support",
+    title: "Support desk",
+    description: "view & respond to support tickets",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("supportManagement")
+  },
+  {
+    name: "admin-logs",
+    title: "Notifications & audit logs",
+    description: "broadcast + audit/activity/security logs",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("notificationsAndLogs")
+  },
+  {
+    name: "admin-system",
+    title: "System settings & health",
+    description: "app settings, health check, cache",
+    group: "admin",
+    registryDependencies: ["admin"],
+    enable: admin("systemSettings")
+  },
+  {
+    name: "auth@google",
+    title: "Sign in with Google",
+    description: "GET /auth/google \u2192 Google \u2192 /auth/google/callback (OpenID Connect + PKCE)",
+    group: "auth",
+    registryDependencies: ["auth"],
+    docs: 'Create an OAuth client (type "Web application") at console.cloud.google.com \u2192 APIs & Services \u2192 Credentials, and add GOOGLE_REDIRECT_URI as an authorised redirect URI. Send users to GET /v1/api/auth/google to sign in.',
+    prompts: [
+      {
+        name: "GOOGLE_CLIENT_ID",
+        type: "text",
+        message: "Google OAuth client ID:",
+        placeholder: "1234-abc.apps.googleusercontent.com",
+        required: true,
+        pattern: "\\.apps\\.googleusercontent\\.com$",
+        patternMessage: "Google client IDs end in .apps.googleusercontent.com",
+        note: "console.cloud.google.com \u2192 APIs & Services \u2192 Credentials \u2192 Create credentials \u2192 OAuth client ID (Web application)."
+      },
+      {
+        name: "GOOGLE_CLIENT_SECRET",
+        type: "password",
+        message: "Google OAuth client secret:",
+        required: true
+      },
+      {
+        name: "GOOGLE_REDIRECT_URI",
+        type: "text",
+        message: "Redirect URI (register it on the client):",
+        default: "http://localhost:3000/v1/api/auth/google/callback"
+      },
+      {
+        name: "OAUTH_SUCCESS_REDIRECT",
+        type: "text",
+        message: "Where to send the browser after sign-in:",
+        default: "http://localhost:3000/"
+      }
+    ],
+    enable: (o) => {
+      o.userPortal = true;
+      o.oauth = { ...o.oauth, google: true };
+    }
+  },
+  {
+    name: "auth@apple",
+    title: "Sign in with Apple",
+    description: "GET /auth/apple \u2192 Apple \u2192 POST /auth/apple/callback (form_post)",
+    group: "auth",
+    registryDependencies: ["auth"],
+    docs: "Needs a Services ID with Sign in with Apple enabled, its return URL set to APPLE_REDIRECT_URI (https, on a verified domain \u2014 Apple rejects localhost), and a Sign in with Apple key (.p8). Send users to GET /v1/api/auth/apple to sign in.",
+    prompts: [
+      {
+        name: "APPLE_CLIENT_ID",
+        type: "text",
+        message: "Services ID (client ID):",
+        placeholder: "com.yourapp.signin",
+        required: true,
+        note: "developer.apple.com \u2192 Certificates, IDs & Profiles: a Services ID with Sign in with Apple, and a key with Sign in with Apple (.p8)."
+      },
+      {
+        name: "APPLE_TEAM_ID",
+        type: "text",
+        message: "Team ID:",
+        required: true,
+        pattern: "^[A-Z0-9]{10}$",
+        patternMessage: "Team IDs are 10 characters (A-Z, 0-9)"
+      },
+      {
+        name: "APPLE_KEY_ID",
+        type: "text",
+        message: "Key ID:",
+        required: true,
+        pattern: "^[A-Z0-9]{10}$",
+        patternMessage: "Key IDs are 10 characters (A-Z, 0-9)"
+      },
+      {
+        name: "APPLE_PRIVATE_KEY",
+        type: "file",
+        message: "Path to the .p8 key file:",
+        placeholder: "./AuthKey_ABCDE12345.p8",
+        required: true,
+        pattern: "BEGIN PRIVATE KEY",
+        patternMessage: "That file doesn't look like a .p8 private key"
+      },
+      {
+        name: "APPLE_REDIRECT_URI",
+        type: "text",
+        message: "Return URL (https, registered on the Services ID):",
+        default: "https://api.yourapp.com/v1/api/auth/apple/callback",
+        pattern: "^https://",
+        patternMessage: "Apple only accepts https return URLs"
+      },
+      {
+        name: "OAUTH_SUCCESS_REDIRECT",
+        type: "text",
+        message: "Where to send the browser after sign-in:",
+        default: "http://localhost:3000/"
+      }
+    ],
+    enable: (o) => {
+      o.userPortal = true;
+      o.oauth = { ...o.oauth, apple: true };
+    }
+  },
+  {
+    name: "email-client",
+    aliases: ["mailer"],
+    title: "Email client",
+    description: "SendEmail task over SMTP (nodemailer) \u2014 Gmail or any SMTP server",
+    group: "integrations",
+    registryDependencies: [],
+    replaces: ["src/tasks/SendEmail.ts", "src/tasks/SendEmail.js"],
+    docs: "Every enqueue('SendEmail', { to, subject, body }) now sends real mail. Change SMTP settings in .env.",
+    prompts: [
+      {
+        name: "provider",
+        type: "select",
+        message: "Email provider:",
+        options: [
+          {
+            value: "gmail",
+            label: "Gmail",
+            hint: "smtp.gmail.com, preconfigured",
+            env: { SMTP_HOST: "smtp.gmail.com", SMTP_PORT: "465" }
+          },
+          { value: "custom", label: "Other (custom SMTP)", hint: "you'll provide host + port" }
+        ]
+      },
+      {
+        name: "SMTP_HOST",
+        type: "text",
+        message: "SMTP host:",
+        placeholder: "smtp.mailtrap.io",
+        required: true,
+        when: { provider: "custom" }
+      },
+      {
+        name: "SMTP_PORT",
+        type: "text",
+        message: "SMTP port:",
+        default: "587",
+        when: { provider: "custom" }
+      },
+      {
+        name: "SMTP_USER",
+        type: "text",
+        message: "Gmail address:",
+        placeholder: "you@gmail.com",
+        required: true,
+        when: { provider: "gmail" }
+      },
+      {
+        name: "SMTP_USER",
+        type: "text",
+        message: "SMTP username / email:",
+        placeholder: "you@example.com",
+        required: true,
+        when: { provider: "custom" }
+      },
+      {
+        name: "SMTP_PASS",
+        type: "password",
+        message: "Gmail app password (16 characters):",
+        required: true,
+        stripSpaces: true,
+        pattern: "^\\S{16}$",
+        patternMessage: "Gmail app passwords are 16 characters \u2014 this looks like a regular password, not an app password",
+        when: { provider: "gmail" },
+        note: "Google no longer accepts your regular password for SMTP. Generate a 16-character App Password: Google Account \u2192 Security \u2192 2-Step Verification \u2192 App passwords."
+      },
+      {
+        name: "SMTP_PASS",
+        type: "password",
+        message: "SMTP password:",
+        required: true,
+        when: { provider: "custom" }
+      },
+      { name: "SMTP_FROM", type: "text", message: "From address:", default: "{{SMTP_USER}}" },
+      {
+        name: "APP_URL",
+        type: "text",
+        message: "App URL (used in email links):",
+        default: "http://localhost:3000"
+      }
+    ],
+    enable: (o) => {
+      o.mailer = true;
+    }
+  }
+];
+var BY_NAME = new Map(
+  ITEMS.flatMap((i) => [i.name, ...i.aliases ?? []].map((n) => [n, i]))
+);
+function getItem(name) {
+  const item = BY_NAME.get(name);
+  if (!item) throw new Error(`Unknown registry item "${name}"`);
+  return item;
+}
+function withDependencies(names) {
+  const out = [];
+  const visit = (alias, stack) => {
+    const name = getItem(alias).name;
+    if (out.includes(name)) return;
+    if (stack.includes(name)) throw new Error(`Dependency cycle: ${[...stack, name].join(" \u2192 ")}`);
+    for (const dep of getItem(name).registryDependencies) visit(dep, [...stack, name]);
+    out.push(name);
+  };
+  for (const name of names) visit(name, []);
+  return out;
+}
+function registryOptions(v, items = [], extra = {}) {
+  const o = {
+    projectName: "efc-app",
+    language: v.language,
+    database: v.database,
+    ...v.database === "postgresql" && { modelApi: v.modelApi },
+    authStrategy: "http-only",
+    cluster: true,
+    tasks: true,
+    taskBackend: v.database === "postgresql" ? "pg-boss" : "bullmq",
+    routeDocs: true,
+    userPortal: false,
+    adminPortal: false,
+    adminFeatures: { ...NO_ADMIN_FEATURES },
+    userFeatures: { ...NO_USER_FEATURES },
+    rbac: true,
+    mailer: false,
+    ...extra,
+    registry: true
+  };
+  for (const name of withDependencies(items)) getItem(name).enable(o);
+  return o;
+}
+function isManagedPath(p2) {
+  return p2 === "package.json" || p2 === ".env" || p2 === ".env.example" || p2 === "AGENTS.md" || p2 === ".gitignore" || p2 === "tsconfig.json" || /^efc\.config\.[jt]s$/.test(p2) || /^src\/index\.[jt]s$/.test(p2) || /^src\/model\/index\.[jt]s$/.test(p2) || p2.startsWith("src/migrations/");
+}
+function sha256(content) {
+  return crypto2.createHash("sha256").update(content).digest("hex");
+}
+async function writeManifest(dest, opts, items) {
+  const pkg = await fs2.readJson(path2.join(dest, "package.json"));
+  const files = {};
+  const walk = async (dir) => {
+    for (const entry of await fs2.readdir(dir, { withFileTypes: true })) {
+      if (entry.name === "node_modules") continue;
+      const abs = path2.join(dir, entry.name);
+      if (entry.isDirectory()) await walk(abs);
+      else {
+        const rel = path2.relative(dest, abs).split(path2.sep).join("/");
+        if (!isManagedPath(rel)) files[rel] = sha256(await fs2.readFile(abs, "utf8"));
+      }
+    }
+  };
+  await walk(dest);
+  const manifest = {
+    registry: (pkg.dependencies["express-file-cluster"] ?? "").replace(/^[^\d]*/, ""),
+    language: opts.language,
+    database: opts.database,
+    modelApi: opts.database === "postgresql" ? opts.modelApi ?? "defineTable" : "defineModel",
+    tasks: opts.tasks ? opts.taskBackend ?? "bullmq" : null,
+    items: [...withDependencies(items)].sort(),
+    files: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)))
+  };
+  await fs2.writeFile(path2.join(dest, "efc.json"), JSON.stringify(manifest, null, 2) + "\n");
+}
+var isEnvName = (name) => /^[A-Z][A-Z0-9_]*$/.test(name);
+function promptApplies(p2, answers) {
+  return Object.entries(p2.when ?? {}).every(([k, v]) => answers[k] === v);
+}
+function promptDefault(p2, answers) {
+  return p2.default?.replace(/\{\{(\w+)\}\}/g, (_, k) => answers[k] ?? "");
+}
+function normalizeAnswer(p2, raw, cwd = process.cwd()) {
+  let value = p2.stripSpaces ? raw.replace(/\s/g, "") : raw.trim();
+  if (!value) return p2.required ? { error: "Required" } : { value };
+  if (p2.type === "file") {
+    const file = path2.resolve(cwd, value.replace(/^~(?=$|\/)/, os.homedir()));
+    if (!fs2.existsSync(file)) return { error: `No such file: ${file}` };
+    value = fs2.readFileSync(file, "utf8").trim();
+  }
+  if (p2.pattern && !new RegExp(p2.pattern).test(value)) {
+    return { error: p2.patternMessage ?? `Must match ${p2.pattern}` };
+  }
+  if (p2.type === "file") value = value.replace(/\r?\n/g, "\\n");
+  return { value };
+}
+function envFromAnswers(prompts, answers) {
+  const env = {};
+  for (const p2 of prompts) {
+    if (!(p2.name in answers) || !promptApplies(p2, answers)) continue;
+    if (isEnvName(p2.name)) env[p2.name] = answers[p2.name];
+    const chosen = p2.options?.find((o) => o.value === answers[p2.name]);
+    Object.assign(env, chosen?.env ?? {});
+  }
+  return env;
+}
+function itemPrompts(items) {
+  const out = [];
+  for (const name of items) {
+    for (const p2 of getItem(name).prompts ?? []) {
+      const dup = out.some(
+        (q) => q.name === p2.name && JSON.stringify(q.when) === JSON.stringify(p2.when)
+      );
+      if (!dup) out.push(p2);
+    }
+  }
+  return out;
+}
+async function setEnvValues(file, env) {
+  const line = (k, v) => !/[\s#"'`]/.test(v) ? `${k}=${v}` : v.includes("'") ? `${k}="${v.replace(/"/g, '\\"')}"` : `${k}='${v}'`;
+  const lines = await fs2.pathExists(file) ? (await fs2.readFile(file, "utf8")).split("\n") : [];
+  const rest = { ...env };
+  const out = lines.map((l) => {
+    const key = /^([A-Za-z0-9_]+)=/.exec(l)?.[1];
+    if (key === void 0 || !(key in rest)) return l;
+    const v = rest[key];
+    delete rest[key];
+    return line(key, v);
+  });
+  for (const [k, v] of Object.entries(rest)) out.push(line(k, v));
+  await fs2.writeFile(file, out.join("\n"));
+}
 
 // src/index.ts
 function cancel2(msg = "Cancelled") {
@@ -3642,262 +4536,109 @@ async function main() {
     if (p.isCancel(api)) cancel2();
     modelApi2 = api;
   }
-  const authStrategy = await p.select({
-    message: "Authentication strategy:",
-    options: [
-      { value: "http-only", label: "http-only", hint: "secure cookie \u2014 recommended for SSR" },
-      { value: "localStorage", label: "localStorage", hint: "bearer token \u2014 for SPAs" }
-    ]
+  const taskBackend = await p.select({
+    message: "Task queue backend:",
+    options: database === "postgresql" ? [
+      { value: "pg-boss", label: "pg-boss", hint: "uses your PostgreSQL \u2014 no Redis" },
+      { value: "bullmq", label: "BullMQ", hint: "Redis" }
+    ] : [{ value: "bullmq", label: "BullMQ", hint: "Redis" }]
   });
-  if (p.isCancel(authStrategy)) cancel2();
-  const features = await p.multiselect({
-    message: "Features: (space to toggle, enter to confirm)",
-    options: [
-      { value: "cluster", label: "Multi-core clustering", hint: "Node cluster module" },
-      { value: "tasks", label: "Background tasks", hint: "BullMQ / pg-boss" },
-      { value: "routeDocs", label: "API route documentation", hint: "meta exports + dashboard" },
-      { value: "userPortal", label: "User portal", hint: "auth, profile, billing routes" },
-      { value: "adminPortal", label: "Admin portal", hint: "dashboard, user mgmt, analytics" },
-      { value: "rbac", label: "Role-based access control", hint: "requireAuth('role') middleware" },
-      { value: "mailer", label: "Mailer", hint: "nodemailer + SMTP" }
-    ],
-    initialValues: ["cluster", "tasks", "routeDocs", "userPortal", "adminPortal", "rbac"],
-    required: false
+  if (p.isCancel(taskBackend)) cancel2();
+  const cluster = await p.confirm({
+    message: "Multi-core clustering? (one worker per CPU in production)",
+    initialValue: true
   });
-  if (p.isCancel(features)) cancel2();
-  const selected = new Set(features);
-  let userFeatures = NO_USER_FEATURES;
-  if (selected.has("userPortal")) {
-    const chosen = await p.multiselect({
-      message: "User portal features: (space to toggle, enter to confirm)",
-      options: [
-        {
-          value: "profileViewing",
-          label: "Profile viewing & editing",
-          hint: "GET/PUT /user/profile"
-        },
-        {
-          value: "forgotPassword",
-          label: "Forgot / reset password",
-          hint: "forgot-password, reset-password"
-        },
-        {
-          value: "accountSecurity",
-          label: "Change password, 2FA & sessions",
-          hint: "change-password, 2fa/*, sessions/*, token refresh"
-        },
-        {
-          value: "emailVerification",
-          label: "Email verification",
-          hint: "verify-email route + registration flow"
-        },
-        {
-          value: "accountSettings",
-          label: "Account settings",
-          hint: "avatar, settings, account, dashboard, activity"
-        },
-        { value: "notifications", label: "Notifications", hint: "user/notifications" },
-        {
-          value: "filesAndMedia",
-          label: "Files, favorites & bookmarks",
-          hint: "files, favorites, bookmarks, search"
-        },
-        {
-          value: "apiAndBilling",
-          label: "API keys & billing",
-          hint: "api-keys, plans, subscription, invoices"
-        },
-        { value: "support", label: "Support tickets", hint: "create & view own tickets" }
-      ],
-      initialValues: [
-        "profileViewing",
-        "forgotPassword",
-        "accountSecurity",
-        "emailVerification",
-        "accountSettings",
-        "notifications",
-        "filesAndMedia",
-        "apiAndBilling",
-        "support"
-      ],
-      required: false
-    });
-    if (p.isCancel(chosen)) cancel2();
-    const uSet = new Set(chosen);
-    userFeatures = {
-      profileViewing: uSet.has("profileViewing"),
-      forgotPassword: uSet.has("forgotPassword"),
-      accountSecurity: uSet.has("accountSecurity"),
-      emailVerification: uSet.has("emailVerification"),
-      accountSettings: uSet.has("accountSettings"),
-      notifications: uSet.has("notifications"),
-      filesAndMedia: uSet.has("filesAndMedia"),
-      apiAndBilling: uSet.has("apiAndBilling"),
-      support: uSet.has("support")
-    };
-  }
-  let adminFeatures = NO_ADMIN_FEATURES;
-  if (selected.has("adminPortal")) {
-    const chosen = await p.multiselect({
-      message: "Admin panel features: (space to toggle, enter to confirm)",
-      options: [
-        {
-          value: "userManagement",
-          label: "User management",
-          hint: "list/create/suspend/verify/export users + dashboard stats"
-        },
-        {
-          value: "adminManagement",
-          label: "Admin & role management",
-          hint: "manage other admins" + (selected.has("rbac") ? " + roles" : "")
-        },
-        { value: "analytics", label: "Analytics", hint: "users, revenue, traffic dashboards" },
-        {
-          value: "contentManagement",
-          label: "Content management",
-          hint: "FAQs, blog posts, categories"
-        },
-        {
-          value: "billingManagement",
-          label: "Billing management",
-          hint: "plans, coupons, subscriptions"
-        },
-        { value: "supportManagement", label: "Support tickets", hint: "view & respond to tickets" },
-        {
-          value: "notificationsAndLogs",
-          label: "Notifications & audit logs",
-          hint: "broadcast + audit/activity/security logs"
-        },
-        {
-          value: "systemSettings",
-          label: "System settings & health",
-          hint: "app settings, health check, cache"
-        }
-      ],
-      initialValues: [
-        "userManagement",
-        "adminManagement",
-        "analytics",
-        "contentManagement",
-        "billingManagement",
-        "supportManagement",
-        "notificationsAndLogs",
-        "systemSettings"
-      ],
-      required: false
+  if (p.isCancel(cluster)) cancel2();
+  const groupLabel = {
+    auth: "Auth",
+    user: "User portal",
+    admin: "Admin portal",
+    integrations: "Integrations"
+  };
+  const groups = {};
+  for (const item of ITEMS) {
+    (groups[groupLabel[item.group]] ??= []).push({
+      value: item.name,
+      label: item.title,
+      hint: item.description
     });
-    if (p.isCancel(chosen)) cancel2();
-    const aSet = new Set(chosen);
-    adminFeatures = {
-      userManagement: aSet.has("userManagement"),
-      adminManagement: aSet.has("adminManagement"),
-      analytics: aSet.has("analytics"),
-      contentManagement: aSet.has("contentManagement"),
-      billingManagement: aSet.has("billingManagement"),
-      supportManagement: aSet.has("supportManagement"),
-      notificationsAndLogs: aSet.has("notificationsAndLogs"),
-      systemSettings: aSet.has("systemSettings")
-    };
   }
-  let taskBackend;
-  if (selected.has("tasks")) {
-    const backend = await p.select({
-      message: "Task queue backend:",
+  const picked = await p.groupMultiselect({
+    message: `Add features now? ${pc.dim("(space to toggle, enter to confirm \u2014 or add any later with `efc add <item>`)")}`,
+    options: groups,
+    required: false
+  });
+  if (p.isCancel(picked)) cancel2();
+  const items = withDependencies(picked);
+  let authStrategy = "http-only";
+  if (items.includes("auth")) {
+    const strategy = await p.select({
+      message: "Authentication strategy:",
       options: [
-        { value: "bullmq", label: "BullMQ", hint: "Redis" },
-        {
-          value: "pg-boss",
-          label: "pg-boss",
-          hint: database === "postgresql" ? "uses your PostgreSQL \u2014 no Redis" : "needs PostgreSQL"
-        }
+        { value: "http-only", label: "http-only", hint: "secure cookie \u2014 recommended for SSR" },
+        { value: "localStorage", label: "localStorage", hint: "bearer token \u2014 for SPAs" }
       ]
     });
-    if (p.isCancel(backend)) cancel2();
-    taskBackend = backend;
+    if (p.isCancel(strategy)) cancel2();
+    authStrategy = strategy;
   }
-  let smtpProvider;
-  let smtpHost;
-  let smtpPort;
-  let smtpUser;
-  let smtpPass;
-  if (selected.has("mailer")) {
-    const provider = await p.select({
-      message: "Email provider:",
-      options: [
-        { value: "gmail", label: "Gmail", hint: "smtp.gmail.com, preconfigured" },
-        { value: "custom", label: "Other (custom SMTP)", hint: "you'll provide host + port" }
-      ]
-    });
-    if (p.isCancel(provider)) cancel2();
-    smtpProvider = provider;
-    if (smtpProvider === "custom") {
-      const host = await p.text({
-        message: "SMTP host:",
-        placeholder: "smtp.mailtrap.io",
-        validate: (v) => !v.trim() ? "SMTP host is required" : void 0
+  const answers = {};
+  const prompts = itemPrompts(items);
+  for (const q of prompts) {
+    if (!promptApplies(q, answers)) continue;
+    if (q.note) p.note(q.note);
+    if (q.type === "select") {
+      const choice = await p.select({
+        message: q.message,
+        options: (q.options ?? []).map((o) => ({
+          value: o.value,
+          label: o.label,
+          ...o.hint !== void 0 && { hint: o.hint }
+        }))
       });
-      if (p.isCancel(host)) cancel2();
-      smtpHost = host;
-      const port = await p.text({
-        message: "SMTP port:",
-        placeholder: "587",
-        defaultValue: "587"
-      });
-      if (p.isCancel(port)) cancel2();
-      smtpPort = port;
+      if (p.isCancel(choice)) cancel2();
+      answers[q.name] = choice;
+      continue;
     }
-    const user = await p.text({
-      message: smtpProvider === "gmail" ? "Gmail address:" : "SMTP username / email:",
-      placeholder: "you@example.com",
-      validate: (v) => !v.trim() ? "Email is required" : void 0
-    });
-    if (p.isCancel(user)) cancel2();
-    smtpUser = user;
-    if (smtpProvider === "gmail") {
-      p.note(
-        "Google no longer accepts your regular account password for SMTP.\nGenerate a 16-character App Password: Google Account -> Security -> 2-Step Verification -> App passwords.\nEnter it below without spaces (not your Gmail login password).",
-        "Gmail app password required"
-      );
-    }
-    const pass = await p.password({
-      message: smtpProvider === "gmail" ? "Gmail app password (16 characters):" : "SMTP password:",
-      validate: (v) => {
-        if (!v.trim()) return "Password is required";
-        if (smtpProvider === "gmail" && v.replace(/\s/g, "").length !== 16) {
-          return "Gmail app passwords are 16 characters \u2014 this looks like a regular password, not an app password";
-        }
-        return void 0;
-      }
+    const def = promptDefault(q, answers);
+    const check = (v) => {
+      const r2 = normalizeAnswer(q, v.trim() === "" ? def ?? "" : v);
+      return "error" in r2 ? r2.error : void 0;
+    };
+    const raw = q.type === "password" ? await p.password({ message: q.message, validate: check }) : await p.text({
+      message: q.message,
+      ...q.placeholder !== void 0 && { placeholder: q.placeholder },
+      ...def !== void 0 && { placeholder: def, defaultValue: def },
+      validate: check
     });
-    if (p.isCancel(pass)) cancel2();
-    smtpPass = pass.replace(/\s/g, "");
+    if (p.isCancel(raw)) cancel2();
+    const r = normalizeAnswer(q, raw.trim() === "" ? def ?? "" : raw);
+    answers[q.name] = "value" in r ? r.value : "";
   }
-  const opts = {
-    projectName,
-    language,
-    database,
-    authStrategy,
-    cluster: selected.has("cluster"),
-    tasks: selected.has("tasks"),
-    routeDocs: selected.has("routeDocs"),
-    userPortal: selected.has("userPortal"),
-    adminPortal: selected.has("adminPortal"),
-    userFeatures,
-    adminFeatures,
-    rbac: selected.has("rbac"),
-    mailer: selected.has("mailer"),
-    ...modelApi2 !== void 0 && { modelApi: modelApi2 },
-    ...taskBackend !== void 0 && { taskBackend },
-    ...smtpProvider !== void 0 && { smtpProvider },
-    ...smtpHost !== void 0 && { smtpHost },
-    ...smtpPort !== void 0 && { smtpPort },
-    ...smtpUser !== void 0 && { smtpUser },
-    ...smtpPass !== void 0 && { smtpPass }
-  };
+  const env = envFromAnswers(prompts, answers);
+  const opts = registryOptions(
+    {
+      language,
+      database,
+      modelApi: modelApi2 ?? "defineModel"
+    },
+    items,
+    {
+      projectName,
+      authStrategy,
+      cluster,
+      taskBackend,
+      ...answers["provider"] === "custom" && { smtpProvider: "custom" }
+    }
+  );
   const spinner2 = p.spinner();
   spinner2.start("Scaffolding project\u2026");
   try {
     await scaffold(opts);
+    if (Object.keys(env).length) {
+      await setEnvValues(path3.resolve(process.cwd(), opts.projectName, ".env"), env);
+    }
+    await writeManifest(path3.resolve(process.cwd(), opts.projectName), opts, items);
     spinner2.stop("Project created");
   } catch (err) {
     spinner2.stop("Failed to scaffold project");
@@ -3911,11 +4652,12 @@ async function main() {
   await npmInstallGlobal().catch(() => {
   });
   spinner2.stop("efc CLI ready");
-  if (opts.mailer) {
+  const secrets = Object.keys(env).filter((k) => /PASS|SECRET|PRIVATE_KEY/.test(k));
+  if (secrets.length) {
     p.note(
-      `SMTP_USER and SMTP_PASS were written to ${projectName}/.env \u2014 that file is gitignored, never commit it.
-` + (opts.smtpProvider === "gmail" ? "If this Gmail app password ever leaks, revoke it and generate a new one." : "Rotate SMTP_PASS immediately if it is ever exposed."),
-      "Mailer credentials"
+      `${secrets.join(", ")} ${secrets.length > 1 ? "were" : "was"} written to ${projectName}/.env \u2014 that file is gitignored, never commit it.
+Rotate any of them immediately if it is ever exposed.`,
+      "Credentials"
     );
   }
   p.outro(
@@ -3926,6 +4668,8 @@ Your project is ready!
 `) + pc.dim(`  efc start dev
 `) + pc.dim(`
   (or: npm run dev)
+`) + pc.dim(`
+  Add features any time: efc list \xB7 efc add <item>
 `)
   );
 }