npm - create-lacspace-app - Versions diffs - 2.5.0 → 2.7.0 - Mend

create-lacspace-app 2.5.0 → 2.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/lib.cjs CHANGED Viewed

@@ -40,7 +40,8 @@ function resolveContext(options = {}) {
   const seg = raw.split(/[\\/]/).filter(Boolean).pop() ?? "my-app";
   const name = seg.toLowerCase().replace(/[^a-z0-9-_]/g, "-").replace(/^-+|-+$/g, "") || "my-app";
   const features = normalizeFeatures(options.features);
-  const mode = options.mode === "dynamic" ? "dynamic" : "static";
+  let mode = options.mode === "dynamic" ? "dynamic" : "static";
+  if (mode === "static" && features.some((f) => f.requiresBackend)) mode = "dynamic";
   return { name, template, features, mode };
 }
 function normalizeFeatures(requested) {
@@ -2166,6 +2167,117 @@ var FEATURES = [
       "Want semantic search? Upgrade to @lacspace/embeddings + @lacspace/vector (keyless-local via Ollama)."
     ],
     learn: "https://developer.lacspace.com/packages/rerank"
+  },
+  {
+    key: "auth-pages",
+    label: "Auth & account",
+    description: "Account management on top of the built-in login/register: edit profile, change password, and TOTP two-factor auth (2FA) with backup codes. Full-stack.",
+    requiresBackend: true,
+    deps: {},
+    files: () => ({ "app/account/settings/page.tsx": authSettingsPage() }),
+    backend: (ctx) => ({
+      deps: { "@lacspace/otp": "^1.2.0" },
+      files: {
+        "src/models/two-factor.ts": authTwoFactorModel(),
+        "src/routes/account.ts": authAccountRoutes(ctx)
+      },
+      routes: [{ path: "/account", handler: "accountRoutes", auth: true, importLine: 'import accountRoutes from "./account.js";' }]
+    }),
+    nextSteps: [
+      "Sign in, then open http://localhost:3000/account/settings.",
+      "Enable 2FA: add the shown secret to an authenticator app (Google Authenticator, Authy\u2026), then verify.",
+      "Backup codes are shown once on enable \u2014 store them somewhere safe."
+    ],
+    learn: "https://developer.lacspace.com/packages/otp"
+  },
+  {
+    key: "analytics",
+    label: "Analytics",
+    description: "Privacy-first, cookieless web analytics: a tracker (@lacspace/analytics-lite), a collector that stores events in MongoDB, and a dashboard. Full-stack.",
+    requiresBackend: true,
+    deps: { "@lacspace/analytics-lite": "^1.1.0" },
+    files: (ctx) => ({
+      "components/analytics.tsx": analyticsComponent(ctx),
+      "app/analytics/page.tsx": analyticsDashboard()
+    }),
+    backend: () => ({
+      files: {
+        "src/models/event.ts": analyticsEventModel(),
+        "src/routes/events.ts": analyticsEventsRoutes()
+      },
+      routes: [{ path: "/events", handler: "eventRoutes", auth: false, importLine: 'import eventRoutes from "./events.js";' }]
+    }),
+    nextSteps: [
+      "Add <Analytics /> to app/layout.tsx (inside <body>) to start tracking page views.",
+      "Browse your site, then open http://localhost:3000/analytics (sign in) to see the dashboard.",
+      "It's cookieless and stores no personal data \u2014 privacy-first by default."
+    ],
+    learn: "https://developer.lacspace.com/packages/analytics-lite"
+  },
+  {
+    key: "payments",
+    label: "Payments (Nepal)",
+    description: "A checkout wired to eSewa & Khalti \u2014 orders, the signed eSewa flow (works in TEST with NO credentials), Khalti when keyed, integer-safe money. Full-stack.",
+    requiresBackend: true,
+    deps: {},
+    files: () => ({
+      "app/checkout/page.tsx": checkoutPage(),
+      "app/checkout/success/page.tsx": checkoutSuccessPage(),
+      "app/checkout/failed/page.tsx": checkoutFailedPage()
+    }),
+    backend: () => ({
+      deps: { "@lacspace/esewa": "^1.2.0", "@lacspace/khalti": "^1.1.0", "@lacspace/money": "^1.1.0" },
+      files: {
+        "src/models/order.ts": ordersModel(),
+        "src/routes/checkout.ts": checkoutRoutes()
+      },
+      routes: [{ path: "/checkout", handler: "checkoutRoutes", auth: true, importLine: 'import checkoutRoutes from "./checkout.js";' }],
+      env: {
+        ESEWA_MERCHANT_CODE: "eSewa merchant/product code (blank = eSewa TEST sandbox).",
+        ESEWA_SECRET: "eSewa secret key (blank = TEST sandbox \u2014 payments work end-to-end in test).",
+        KHALTI_SECRET: "Khalti secret key (required to enable Khalti; blank shows a 'configure Khalti' message)."
+      }
+    }),
+    nextSteps: [
+      "Sign in, then open http://localhost:3000/checkout and pay with eSewa \u2014 it works in TEST mode with no credentials.",
+      "Enable Khalti by setting KHALTI_SECRET in .env (get a test key from https://khalti.com).",
+      "Go live: set ESEWA_MERCHANT_CODE + ESEWA_SECRET (and a live KHALTI_SECRET)."
+    ],
+    learn: "https://developer.lacspace.com/packages/esewa"
+  },
+  {
+    key: "email",
+    label: "Email",
+    description: "Transactional email \u2014 a ready mail service (@lacspace/mailer) with beautiful templates + address validation. Logs to the console until you add SMTP. Full-stack.",
+    requiresBackend: true,
+    deps: {},
+    files: () => ({ "app/email-test/page.tsx": emailTestPage() }),
+    backend: (ctx) => ({
+      deps: {
+        "@lacspace/mailer": "^1.2.0",
+        "@lacspace/email-templates": "^1.1.0",
+        "@lacspace/email-validate": "^1.1.0"
+      },
+      files: {
+        "src/mail/mailer.ts": mailerLib(ctx),
+        "src/routes/email.ts": emailRoutes()
+      },
+      routes: [{ path: "/email", handler: "emailRoutes", auth: true, importLine: 'import emailRoutes from "./email.js";' }],
+      env: {
+        SMTP_HOST: "SMTP host (blank in dev \u2014 emails are logged to the API console instead of sent).",
+        SMTP_PORT: "SMTP port (default 587).",
+        SMTP_SECURE: "true for implicit TLS on port 465; otherwise false.",
+        SMTP_USER: "SMTP username.",
+        SMTP_PASS: "SMTP password.",
+        SMTP_FROM: 'Default From address, e.g. "Acme <no-reply@acme.com>".'
+      }
+    }),
+    nextSteps: [
+      "Sign in, then open http://localhost:3000/email-test and send yourself a sample email.",
+      "With no SMTP_* set, the email is printed to the API console (dev). Set SMTP_* in .env to send for real.",
+      "Reuse the helpers in backend/src/mail/mailer.ts: sendWelcome / sendVerify / sendReset."
+    ],
+    learn: "https://developer.lacspace.com/packages/mailer"
   }
 ];
 var aiChatRoute = (_ctx) => `import { resolveConfig } from "@lacspace/providers";
@@ -5416,6 +5528,733 @@ export default function SearchPage() {
   );
 }
 `;
+var authTwoFactorModel = () => `import mongoose from "mongoose";
+import { uuidv7 } from "@lacspace/id";
+// how this works: a separate collection for 2FA so the base User model stays simple.
+// NOTE: the TOTP secret is stored as-is here \u2014 in production, encrypt it at rest with
+// @lacspace/crypto (encrypt/decrypt) using a key from your env.
+export interface TwoFactorDoc {
+  _id: string;
+  userId: string;
+  secret: string;
+  enabled: boolean;
+  backupHashes: string[];
+  createdAt: Date;
+  updatedAt: Date;
+}
+const schema = new mongoose.Schema<TwoFactorDoc>(
+  {
+    _id: { type: String, default: () => uuidv7() },
+    userId: { type: String, required: true, unique: true, index: true },
+    secret: { type: String, required: true },
+    enabled: { type: Boolean, default: false },
+    backupHashes: { type: [String], default: [] },
+  },
+  { timestamps: true },
+);
+export const TwoFactor =
+  (mongoose.models.TwoFactor as mongoose.Model<TwoFactorDoc>) ?? mongoose.model<TwoFactorDoc>("TwoFactor", schema);
+`;
+var authAccountRoutes = (ctx) => `import express from "express";
+import { hash, verify as verifyPassword } from "@lacspace/password";
+import { setupTotp, verifyTotp, generateBackupCodes, verifyBackupCode } from "@lacspace/otp";
+import { v } from "@lacspace/validate";
+import { asyncHandler, HttpError } from "../http.js";
+import { User } from "../models/user.js";
+import { TwoFactor } from "../models/two-factor.js";
+// This whole group is mounted behind requireAuth (see routes/index.ts), so
+// req.user is always set here.
+const router = express.Router();
+const ISSUER = "${ctx.name}";
+const ProfileInput = v.object({ name: v.string().min(2).max(80) });
+const PasswordInput = v.object({ currentPassword: v.string().min(1), newPassword: v.string().min(8).max(200) });
+const CodeInput = v.object({ code: v.string().min(6).max(12) });
+// GET /account/2fa \u2014 is two-factor enabled?
+router.get("/2fa", asyncHandler(async (req, res) => {
+  const tf = await TwoFactor.findOne({ userId: req.user!.sub });
+  res.json({ enabled: Boolean(tf?.enabled) });
+}));
+// PATCH /account/profile \u2014 update your display name.
+router.patch("/profile", asyncHandler(async (req, res) => {
+  const { name } = ProfileInput.parse(req.body);
+  const user = await User.findByIdAndUpdate(req.user!.sub, { $set: { name } }, { new: true });
+  if (!user) throw new HttpError(404, "User not found");
+  res.json({ id: String(user._id), name: user.name, email: user.email });
+}));
+// POST /account/password \u2014 change your password (verifies the current one).
+router.post("/password", asyncHandler(async (req, res) => {
+  const { currentPassword, newPassword } = PasswordInput.parse(req.body);
+  const user = await User.findById(req.user!.sub);
+  if (!user || !(await verifyPassword(currentPassword, user.passwordHash))) {
+    throw new HttpError(401, "Current password is incorrect");
+  }
+  user.passwordHash = await hash(newPassword);
+  await user.save();
+  res.json({ ok: true });
+}));
+// POST /account/2fa/setup \u2014 create a TOTP secret; show \`uri\` as a QR / \`secret\` to type.
+router.post("/2fa/setup", asyncHandler(async (req, res) => {
+  const user = await User.findById(req.user!.sub);
+  if (!user) throw new HttpError(404, "User not found");
+  const { secret, uri } = setupTotp({ account: user.email, issuer: ISSUER });
+  await TwoFactor.findOneAndUpdate(
+    { userId: String(user._id) },
+    { $set: { secret, enabled: false } },
+    { upsert: true, new: true },
+  );
+  res.json({ secret, uri });
+}));
+// POST /account/2fa/enable \u2014 verify a code, turn 2FA on, return one-time backup codes.
+router.post("/2fa/enable", asyncHandler(async (req, res) => {
+  const { code } = CodeInput.parse(req.body);
+  const tf = await TwoFactor.findOne({ userId: req.user!.sub });
+  if (!tf) throw new HttpError(400, "Run 2FA setup first");
+  if ((await verifyTotp(code, tf.secret, { window: 1 })) === null) throw new HttpError(401, "Invalid code");
+  const { codes, hashes } = await generateBackupCodes(10);
+  tf.enabled = true;
+  tf.backupHashes = hashes;
+  await tf.save();
+  res.json({ enabled: true, backupCodes: codes });
+}));
+// POST /account/2fa/disable \u2014 verify a TOTP or backup code, then turn 2FA off.
+router.post("/2fa/disable", asyncHandler(async (req, res) => {
+  const { code } = CodeInput.parse(req.body);
+  const tf = await TwoFactor.findOne({ userId: req.user!.sub });
+  if (!tf || !tf.enabled) { res.json({ enabled: false }); return; }
+  const ok = (await verifyTotp(code, tf.secret, { window: 1 })) !== null || (await verifyBackupCode(code, tf.backupHashes)) >= 0;
+  if (!ok) throw new HttpError(401, "Invalid code");
+  await TwoFactor.deleteOne({ userId: req.user!.sub });
+  res.json({ enabled: false });
+}));
+export default router;
+`;
+var authSettingsPage = () => `"use client";
+import { useEffect, useState } from "react";
+import { useRouter } from "next/navigation";
+import { getToken } from "@/lib/api";
+const API = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:4000";
+async function call<T>(path: string, body?: unknown, method = "POST"): Promise<T> {
+  const token = getToken();
+  const res = await fetch(API + path, {
+    method,
+    headers: { "Content-Type": "application/json", ...(token ? { Authorization: "Bearer " + token } : {}) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  const data: unknown = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error((data as { error?: string }).error ?? "Request failed");
+  return data as T;
+}
+const msgOf = (e: unknown) => (e instanceof Error ? e.message : "Something went wrong");
+const field = "w-full rounded-xl border border-hairline bg-surface px-4 py-2 outline-none";
+const card = "rounded-2xl border border-hairline p-5 space-y-3";
+const btn = "rounded-full gradient-bg px-4 py-2 text-sm font-semibold on-accent";
+export default function SettingsPage() {
+  const router = useRouter();
+  const [name, setName] = useState("");
+  const [current, setCurrent] = useState("");
+  const [next, setNext] = useState("");
+  const [enabled, setEnabled] = useState(false);
+  const [setup, setSetup] = useState<{ secret: string; uri: string } | null>(null);
+  const [code, setCode] = useState("");
+  const [backup, setBackup] = useState<string[] | null>(null);
+  const [msg, setMsg] = useState<string | null>(null);
+  const flash = (m: string) => { setMsg(m); setTimeout(() => setMsg(null), 3000); };
+  useEffect(() => {
+    if (!getToken()) { router.push("/login"); return; }
+    call<{ enabled: boolean }>("/account/2fa", undefined, "GET").then((r) => setEnabled(r.enabled)).catch(() => {});
+  }, [router]);
+  async function saveName(e: React.FormEvent) {
+    e.preventDefault();
+    try { await call("/account/profile", { name }, "PATCH"); flash("Profile updated"); } catch (err) { flash(msgOf(err)); }
+  }
+  async function savePassword(e: React.FormEvent) {
+    e.preventDefault();
+    try { await call("/account/password", { currentPassword: current, newPassword: next }); setCurrent(""); setNext(""); flash("Password changed"); } catch (err) { flash(msgOf(err)); }
+  }
+  async function begin2fa() {
+    try { setSetup(await call<{ secret: string; uri: string }>("/account/2fa/setup")); } catch (err) { flash(msgOf(err)); }
+  }
+  async function enable2fa() {
+    try { const r = await call<{ backupCodes: string[] }>("/account/2fa/enable", { code }); setBackup(r.backupCodes); setEnabled(true); setSetup(null); setCode(""); } catch (err) { flash(msgOf(err)); }
+  }
+  async function disable2fa() {
+    const c = window.prompt("Enter a current 2FA code (or a backup code) to disable:");
+    if (!c) return;
+    try { await call("/account/2fa/disable", { code: c }); setEnabled(false); flash("2FA disabled"); } catch (err) { flash(msgOf(err)); }
+  }
+  return (
+    <main className="mx-auto max-w-lg space-y-6 px-6 py-16">
+      <h1 className="text-2xl font-bold">Account settings</h1>
+      {msg && <p className="rounded-xl border border-hairline bg-surface px-4 py-2 text-sm">{msg}</p>}
+      <form onSubmit={saveName} className={card}>
+        <h2 className="font-semibold">Profile</h2>
+        <input value={name} onChange={(e) => setName(e.target.value)} placeholder="New display name" className={field} />
+        <button className={btn}>Save name</button>
+      </form>
+      <form onSubmit={savePassword} className={card}>
+        <h2 className="font-semibold">Change password</h2>
+        <input type="password" value={current} onChange={(e) => setCurrent(e.target.value)} placeholder="Current password" className={field} />
+        <input type="password" value={next} onChange={(e) => setNext(e.target.value)} placeholder="New password (min 8)" className={field} />
+        <button className={btn}>Change password</button>
+      </form>
+      <div className={card}>
+        <h2 className="font-semibold">Two-factor authentication {enabled && <span className="text-green-500">\xB7 on</span>}</h2>
+        {!enabled && !setup && <button onClick={begin2fa} className={btn}>Enable 2FA</button>}
+        {!enabled && setup && (
+          <div className="space-y-3">
+            <p className="text-sm text-muted">Add this secret to your authenticator app (Google Authenticator, Authy\u2026):</p>
+            <code className="block break-all rounded-lg bg-surface p-3 text-sm">{setup.secret}</code>
+            <input value={code} onChange={(e) => setCode(e.target.value)} placeholder="6-digit code" className={field} />
+            <button onClick={enable2fa} className={btn}>Verify & enable</button>
+          </div>
+        )}
+        {enabled && <button onClick={disable2fa} className="rounded-full border border-hairline px-4 py-2 text-sm">Disable 2FA</button>}
+        {backup && (
+          <div className="mt-2 space-y-2">
+            <p className="text-sm font-medium">Save these backup codes (shown once):</p>
+            <ul className="grid grid-cols-2 gap-1 rounded-lg bg-surface p-3 font-mono text-sm">
+              {backup.map((b) => <li key={b}>{b}</li>)}
+            </ul>
+          </div>
+        )}
+      </div>
+    </main>
+  );
+}
+`;
+var analyticsEventModel = () => `import mongoose from "mongoose";
+import { uuidv7 } from "@lacspace/id";
+export interface EventDoc {
+  _id: string;
+  type: string;
+  path: string;
+  referrer: string;
+  screen: string;
+  sid: string;
+  props: Record<string, unknown>;
+  ts: Date;
+}
+const schema = new mongoose.Schema<EventDoc>({
+  _id: { type: String, default: () => uuidv7() },
+  type: { type: String, default: "pageview", index: true },
+  path: { type: String, default: "/" },
+  referrer: { type: String, default: "" },
+  screen: { type: String, default: "" },
+  sid: { type: String, default: "" },
+  props: { type: mongoose.Schema.Types.Mixed, default: {} },
+  ts: { type: Date, default: Date.now, index: true },
+});
+export const Event =
+  (mongoose.models.Event as mongoose.Model<EventDoc>) ?? mongoose.model<EventDoc>("Event", schema);
+`;
+var analyticsEventsRoutes = () => `import express from "express";
+import { asyncHandler } from "../http.js";
+import { requireAuth } from "../middleware/auth.js";
+import { Event } from "../models/event.js";
+const router = express.Router();
+// POST /events \u2014 the tracker beacon posts here. Public + cookieless (no PII stored).
+router.post("/", asyncHandler(async (req, res) => {
+  const b = (req.body ?? {}) as Record<string, unknown>;
+  await Event.create({
+    type: String(b.type ?? "pageview"),
+    path: String(b.path ?? "/"),
+    referrer: String(b.referrer ?? ""),
+    screen: String(b.screen ?? ""),
+    sid: String(b.sid ?? ""),
+    props: b.props && typeof b.props === "object" ? (b.props as Record<string, unknown>) : {},
+  });
+  res.status(204).end();
+}));
+// GET /events/summary \u2014 dashboard aggregates (protected: only signed-in owners).
+router.get("/summary", requireAuth, asyncHandler(async (_req, res) => {
+  const since = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+  const [total, pageviews, topPaths, byDay] = await Promise.all([
+    Event.countDocuments({}),
+    Event.countDocuments({ type: "pageview" }),
+    Event.aggregate([
+      { $match: { type: "pageview" } },
+      { $group: { _id: "$path", count: { $sum: 1 } } },
+      { $sort: { count: -1 } },
+      { $limit: 8 },
+    ]),
+    Event.aggregate([
+      { $match: { ts: { $gte: since } } },
+      { $group: { _id: { $dateToString: { format: "%Y-%m-%d", date: "$ts" } }, count: { $sum: 1 } } },
+      { $sort: { _id: 1 } },
+    ]),
+  ]);
+  res.json({
+    total,
+    pageviews,
+    topPaths: topPaths.map((p: { _id: string; count: number }) => ({ path: p._id, count: p.count })),
+    byDay: byDay.map((d: { _id: string; count: number }) => ({ day: d._id, count: d.count })),
+  });
+}));
+export default router;
+`;
+var analyticsComponent = (ctx) => `"use client";
+import { useEffect } from "react";
+import { createAnalytics } from "@lacspace/analytics-lite";
+// how this works: cookieless, privacy-first tracking. It POSTs page views + events to
+// your backend /events collector (stored in MongoDB). No cookies, no localStorage, no
+// personal data. Respects the browser's Do-Not-Track.
+const ENDPOINT = (process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:4000") + "/events";
+export function Analytics() {
+  useEffect(() => {
+    const a = createAnalytics({ endpoint: ENDPOINT, siteId: ${JSON.stringify(ctx.name)}, respectDNT: true });
+    a.pageview();
+    return a.autoTrack();
+  }, []);
+  return null;
+}
+`;
+var analyticsDashboard = () => `"use client";
+import { useEffect, useState } from "react";
+import { useRouter } from "next/navigation";
+import { getToken } from "@/lib/api";
+const API = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:4000";
+interface Summary {
+  total: number;
+  pageviews: number;
+  topPaths: { path: string; count: number }[];
+  byDay: { day: string; count: number }[];
+}
+export default function AnalyticsPage() {
+  const router = useRouter();
+  const [data, setData] = useState<Summary | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  useEffect(() => {
+    const token = getToken();
+    if (!token) { router.push("/login"); return; }
+    fetch(API + "/events/summary", { headers: { Authorization: "Bearer " + token } })
+      .then((r) => (r.ok ? r.json() : Promise.reject(new Error("Please sign in"))))
+      .then(setData)
+      .catch((e) => setError(e instanceof Error ? e.message : "Failed to load"));
+  }, [router]);
+  if (error) return <main className="mx-auto max-w-3xl px-6 py-16 text-muted">{error}</main>;
+  if (!data) return <main className="mx-auto max-w-3xl px-6 py-16 text-muted">Loading\u2026</main>;
+  const max = Math.max(1, ...data.byDay.map((d) => d.count));
+  return (
+    <main className="mx-auto max-w-3xl px-6 py-16">
+      <h1 className="text-3xl font-bold">Analytics</h1>
+      <p className="mt-1 text-muted">Cookieless, privacy-first \u2014 last 30 days.</p>
+      <div className="mt-6 grid grid-cols-2 gap-4">
+        <div className="rounded-2xl border border-hairline p-5"><p className="text-sm text-muted">Total events</p><p className="text-3xl font-bold">{data.total}</p></div>
+        <div className="rounded-2xl border border-hairline p-5"><p className="text-sm text-muted">Page views</p><p className="text-3xl font-bold">{data.pageviews}</p></div>
+      </div>
+      <h2 className="mt-8 font-semibold">Top pages</h2>
+      <ul className="mt-3 space-y-2">
+        {data.topPaths.length === 0 && <li className="text-muted">No data yet \u2014 browse your site with &lt;Analytics/&gt; mounted.</li>}
+        {data.topPaths.map((p) => (
+          <li key={p.path} className="flex justify-between border-b border-hairline pb-2"><span className="truncate">{p.path}</span><span className="text-muted">{p.count}</span></li>
+        ))}
+      </ul>
+      <h2 className="mt-8 font-semibold">Events per day</h2>
+      <div className="mt-3 flex items-end gap-1" style={{ height: 120 }}>
+        {data.byDay.map((d) => (
+          <div key={d.day} className="flex-1 rounded-t" style={{ height: (d.count / max) * 100 + "%", backgroundColor: "var(--accent, #6366f1)" }} title={d.day + ": " + d.count} />
+        ))}
+      </div>
+    </main>
+  );
+}
+`;
+var ordersModel = () => `import mongoose from "mongoose";
+import { uuidv7 } from "@lacspace/id";
+export interface OrderDoc {
+  _id: string;
+  userId: string;
+  label: string;
+  amountPaisa: number;
+  currency: string;
+  status: "pending" | "paid" | "failed";
+  gateway: string;
+  ref: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+const schema = new mongoose.Schema<OrderDoc>(
+  {
+    _id: { type: String, default: () => uuidv7() },
+    userId: { type: String, required: true, index: true },
+    label: { type: String, required: true },
+    amountPaisa: { type: Number, required: true },
+    currency: { type: String, default: "NPR" },
+    status: { type: String, enum: ["pending", "paid", "failed"], default: "pending" },
+    gateway: { type: String, default: "" },
+    ref: { type: String, default: "" },
+  },
+  { timestamps: true },
+);
+export const Order =
+  (mongoose.models.Order as mongoose.Model<OrderDoc>) ?? mongoose.model<OrderDoc>("Order", schema);
+`;
+var checkoutRoutes = () => `import express from "express";
+import {
+  buildForm, verifyResponse, paisaToRupees, generateTransactionUuid,
+  ESEWA_TEST_SECRET, ESEWA_TEST_PRODUCT_CODE,
+} from "@lacspace/esewa";
+import { initiate, lookup } from "@lacspace/khalti";
+import { Money, formatBasic } from "@lacspace/money";
+import { v } from "@lacspace/validate";
+import { asyncHandler, HttpError } from "../http.js";
+import { env } from "../env.js";
+import { Order } from "../models/order.js";
+// how this works: create an order, then start a gateway payment. eSewa works in TEST
+// mode with the package's baked-in sandbox keys (no credentials!). Khalti needs a real
+// secret. After the customer returns, the frontend calls /verify \u2014 never trust the
+// redirect alone, always confirm server-side.
+const router = express.Router();
+const web = () => env.CORS_ORIGIN.split(",")[0]!.trim();
+const CreateInput = v.object({ label: v.string().min(1).max(120), amount: v.number().positive() });
+// POST /checkout \u2014 create a pending order (amount in RUPEES from the UI \u2192 stored as paisa).
+router.post("/", asyncHandler(async (req, res) => {
+  const { label, amount } = CreateInput.parse(req.body);
+  const amountPaisa = Money.of(amount, "NPR").toMinor();
+  const order = await Order.create({ userId: req.user!.sub, label, amountPaisa });
+  res.status(201).json({ id: String(order._id), label, amountPaisa, display: formatBasic(Money.fromMinor(amountPaisa, "NPR")) });
+}));
+// POST /checkout/:id/esewa \u2014 build the signed eSewa form to auto-POST from the browser.
+router.post("/:id/esewa", asyncHandler(async (req, res) => {
+  const order = await Order.findOne({ _id: req.params.id, userId: req.user!.sub });
+  if (!order) throw new HttpError(404, "Order not found");
+  const secret = process.env.ESEWA_SECRET ?? ESEWA_TEST_SECRET;
+  const productCode = process.env.ESEWA_MERCHANT_CODE ?? ESEWA_TEST_PRODUCT_CODE;
+  const esewaEnv: "test" | "prod" = process.env.ESEWA_SECRET ? "prod" : "test";
+  const uuid = generateTransactionUuid();
+  order.ref = uuid;
+  order.gateway = "esewa";
+  await order.save();
+  const form = await buildForm(
+    {
+      amount: paisaToRupees(order.amountPaisa),
+      transactionUuid: uuid,
+      productCode,
+      successUrl: web() + "/checkout/success?orderId=" + String(order._id),
+      failureUrl: web() + "/checkout/failed?orderId=" + String(order._id),
+    },
+    { secret, env: esewaEnv },
+  );
+  res.json(form);
+}));
+// POST /checkout/:id/esewa/verify \u2014 verify the base64 \`data\` eSewa returned; mark paid.
+router.post("/:id/esewa/verify", asyncHandler(async (req, res) => {
+  const { data } = v.object({ data: v.string().min(1) }).parse(req.body);
+  const order = await Order.findOne({ _id: req.params.id, userId: req.user!.sub });
+  if (!order) throw new HttpError(404, "Order not found");
+  const secret = process.env.ESEWA_SECRET ?? ESEWA_TEST_SECRET;
+  const result = await verifyResponse(data, secret);
+  const status = String((result.data as { status?: string }).status ?? "");
+  if (!result.valid || status !== "COMPLETE") throw new HttpError(400, "Payment could not be verified");
+  order.status = "paid";
+  await order.save();
+  res.json({ id: String(order._id), status: "paid" });
+}));
+// POST /checkout/:id/khalti \u2014 start a Khalti payment (needs KHALTI_SECRET, else 501).
+router.post("/:id/khalti", asyncHandler(async (req, res) => {
+  const secretKey = process.env.KHALTI_SECRET;
+  if (!secretKey) throw new HttpError(501, "Set KHALTI_SECRET in .env to enable Khalti (see .env.example).");
+  const order = await Order.findOne({ _id: req.params.id, userId: req.user!.sub });
+  if (!order) throw new HttpError(404, "Order not found");
+  order.gateway = "khalti";
+  await order.save();
+  const r = await initiate(
+    {
+      return_url: web() + "/checkout/success?orderId=" + String(order._id),
+      website_url: web(),
+      amount: order.amountPaisa,
+      purchase_order_id: String(order._id),
+      purchase_order_name: order.label,
+    },
+    { secretKey, env: "test" },
+  );
+  order.ref = r.pidx;
+  await order.save();
+  res.json({ paymentUrl: r.payment_url, pidx: r.pidx });
+}));
+// POST /checkout/:id/khalti/verify \u2014 authoritative lookup by pidx; mark paid.
+router.post("/:id/khalti/verify", asyncHandler(async (req, res) => {
+  const secretKey = process.env.KHALTI_SECRET;
+  if (!secretKey) throw new HttpError(501, "Khalti is not configured");
+  const { pidx } = v.object({ pidx: v.string().min(1) }).parse(req.body);
+  const order = await Order.findOne({ _id: req.params.id, userId: req.user!.sub });
+  if (!order) throw new HttpError(404, "Order not found");
+  const r = await lookup(pidx, { secretKey, env: "test" });
+  if (r.status !== "Completed") throw new HttpError(400, "Payment status: " + String(r.status));
+  order.status = "paid";
+  await order.save();
+  res.json({ id: String(order._id), status: "paid" });
+}));
+export default router;
+`;
+var checkoutPage = () => `"use client";
+import { useState } from "react";
+import { getToken } from "@/lib/api";
+const API = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:4000";
+const msgOf = (e: unknown) => (e instanceof Error ? e.message : "Something went wrong");
+async function call<T>(path: string, body: unknown): Promise<T> {
+  const token = getToken();
+  const res = await fetch(API + path, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...(token ? { Authorization: "Bearer " + token } : {}) },
+    body: JSON.stringify(body),
+  });
+  const data: unknown = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error((data as { error?: string }).error ?? "Request failed");
+  return data as T;
+}
+export default function CheckoutPage() {
+  const [label, setLabel] = useState("Pro plan");
+  const [amount, setAmount] = useState(1000);
+  const [orderId, setOrderId] = useState<string | null>(null);
+  const [msg, setMsg] = useState<string | null>(null);
+  async function createOrder(e: React.FormEvent) {
+    e.preventDefault();
+    try {
+      const o = await call<{ id: string; display: string }>("/checkout", { label, amount });
+      setOrderId(o.id);
+      setMsg("Order " + o.display + " created \u2014 choose how to pay.");
+    } catch (err) { setMsg(msgOf(err)); }
+  }
+  async function payEsewa() {
+    if (!orderId) return;
+    try {
+      const form = await call<{ action: string; fields: Record<string, string> }>("/checkout/" + orderId + "/esewa", {});
+      const f = document.createElement("form");
+      f.method = "POST";
+      f.action = form.action;
+      for (const [k, val] of Object.entries(form.fields)) {
+        const i = document.createElement("input");
+        i.type = "hidden"; i.name = k; i.value = val;
+        f.appendChild(i);
+      }
+      document.body.appendChild(f);
+      f.submit();
+    } catch (err) { setMsg(msgOf(err)); }
+  }
+  async function payKhalti() {
+    if (!orderId) return;
+    try {
+      const r = await call<{ paymentUrl: string }>("/checkout/" + orderId + "/khalti", {});
+      window.location.href = r.paymentUrl;
+    } catch (err) { setMsg(msgOf(err)); }
+  }
+  return (
+    <main className="mx-auto max-w-md px-6 py-16">
+      <h1 className="text-2xl font-bold">Checkout</h1>
+      <p className="mt-1 text-sm text-muted">Sign in first, then create an order and pay.</p>
+      <form onSubmit={createOrder} className="mt-6 space-y-3 rounded-2xl border border-hairline p-5">
+        <input value={label} onChange={(e) => setLabel(e.target.value)} placeholder="What are you buying?" className="w-full rounded-xl border border-hairline bg-surface px-4 py-2 outline-none" />
+        <input type="number" min={10} value={amount} onChange={(e) => setAmount(Number(e.target.value))} placeholder="Amount (NPR)" className="w-full rounded-xl border border-hairline bg-surface px-4 py-2 outline-none" />
+        <button className="w-full rounded-full gradient-bg px-4 py-2 font-semibold on-accent">Create order</button>
+      </form>
+      {msg && <p className="mt-4 text-sm text-muted">{msg}</p>}
+      {orderId && (
+        <div className="mt-6 space-y-3">
+          <button onClick={payEsewa} className="w-full rounded-full border border-hairline px-4 py-3 font-semibold transition hover:bg-surface">Pay with eSewa <span className="text-muted">(works in test)</span></button>
+          <button onClick={payKhalti} className="w-full rounded-full border border-hairline px-4 py-3 font-semibold transition hover:bg-surface">Pay with Khalti</button>
+        </div>
+      )}
+      <p className="mt-6 text-xs text-muted">eSewa works out-of-the-box in test mode. Khalti needs KHALTI_SECRET in .env.</p>
+    </main>
+  );
+}
+`;
+var checkoutSuccessPage = () => `"use client";
+import { useEffect, useState } from "react";
+import Link from "next/link";
+import { getToken } from "@/lib/api";
+const API = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:4000";
+export default function CheckoutSuccessPage() {
+  const [status, setStatus] = useState<"verifying" | "paid" | "failed">("verifying");
+  const [detail, setDetail] = useState("");
+  useEffect(() => {
+    const q = new URLSearchParams(window.location.search);
+    const orderId = q.get("orderId");
+    const data = q.get("data");   // eSewa returns a base64 \`data\` param
+    const pidx = q.get("pidx");   // Khalti returns \`pidx\`
+    const token = getToken();
+    if (!orderId || !token) { setStatus("failed"); setDetail("Missing order or session \u2014 please sign in."); return; }
+    (async () => {
+      let path = ""; let body: Record<string, string> = {};
+      if (data) { path = "/checkout/" + orderId + "/esewa/verify"; body = { data }; }
+      else if (pidx) { path = "/checkout/" + orderId + "/khalti/verify"; body = { pidx }; }
+      else { setStatus("failed"); setDetail("No payment token was returned."); return; }
+      try {
+        const res = await fetch(API + path, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: "Bearer " + token },
+          body: JSON.stringify(body),
+        });
+        if (!res.ok) { const e: unknown = await res.json().catch(() => ({})); throw new Error((e as { error?: string }).error ?? "Verification failed"); }
+        setStatus("paid");
+      } catch (e) { setStatus("failed"); setDetail(e instanceof Error ? e.message : "Verification failed"); }
+    })();
+  }, []);
+  return (
+    <main className="mx-auto max-w-md px-6 py-24 text-center">
+      {status === "verifying" && <p className="text-muted">Verifying your payment\u2026</p>}
+      {status === "paid" && (<><h1 className="text-3xl font-bold">Payment successful \u{1F389}</h1><p className="mt-2 text-muted">Thank you \u2014 your order is paid.</p></>)}
+      {status === "failed" && (<><h1 className="text-2xl font-bold">Payment not completed</h1><p className="mt-2 text-muted">{detail}</p></>)}
+      <Link href="/checkout" className="mt-6 inline-block rounded-full border border-hairline px-4 py-2 text-sm">Back to checkout</Link>
+    </main>
+  );
+}
+`;
+var checkoutFailedPage = () => `import Link from "next/link";
+export default function CheckoutFailedPage() {
+  return (
+    <main className="mx-auto max-w-md px-6 py-24 text-center">
+      <h1 className="text-2xl font-bold">Payment cancelled</h1>
+      <p className="mt-2 text-muted">Your payment was not completed.</p>
+      <Link href="/checkout" className="mt-6 inline-block rounded-full border border-hairline px-4 py-2 text-sm">Try again</Link>
+    </main>
+  );
+}
+`;
+var mailerLib = (ctx) => `import { createTransport, createJsonTransport, mailerFromEnv, type Transport } from "@lacspace/mailer";
+import { welcomeEmail, verifyEmail, passwordResetEmail, toPlainText } from "@lacspace/email-templates";
+// how this works: if SMTP_* env vars are set, it sends real email over SMTP; otherwise
+// it logs the full message to the console (so the app runs with NO credentials). Adding
+// SMTP_* later switches to real delivery with no code change.
+export const transport: Transport = process.env.SMTP_HOST
+  ? createTransport(mailerFromEnv())
+  : createJsonTransport((json) => console.log("\\n[email:dev] set SMTP_* in .env to deliver for real:\\n" + json + "\\n"));
+const FROM = process.env.SMTP_FROM ?? ${JSON.stringify(ctx.name + " <no-reply@example.com>")};
+const brand = { brandName: ${JSON.stringify(ctx.name)} };
+export function sendWelcome(to: string, name?: string) {
+  const html = welcomeEmail({ name, message: "Thanks for joining " + brand.brandName + "!", ...brand });
+  return transport.send({ from: FROM, to, subject: "Welcome to " + brand.brandName, html, text: toPlainText(html) });
+}
+export function sendVerify(to: string, verifyUrl: string) {
+  const html = verifyEmail({ verifyUrl, expiresMinutes: 30, ...brand });
+  return transport.send({ from: FROM, to, subject: "Verify your email", html, text: toPlainText(html) });
+}
+export function sendReset(to: string, resetUrl: string) {
+  const html = passwordResetEmail({ resetUrl, expiresMinutes: 30, ...brand });
+  return transport.send({ from: FROM, to, subject: "Reset your password", html, text: toPlainText(html) });
+}
+`;
+var emailRoutes = () => `import express from "express";
+import { validateEmail } from "@lacspace/email-validate";
+import { asyncHandler, HttpError } from "../http.js";
+import { sendWelcome } from "../mail/mailer.js";
+const router = express.Router();
+// POST /email/test \u2014 send a sample welcome email (validates the address first).
+router.post("/test", asyncHandler(async (req, res) => {
+  const to = String((req.body ?? {}).to ?? "").trim();
+  const check = validateEmail(to);
+  if (!check.valid) throw new HttpError(400, check.reason ?? "Invalid email address");
+  const result = await sendWelcome(check.normalized ?? to);
+  res.json({ ok: true, messageId: result.messageId });
+}));
+export default router;
+`;
+var emailTestPage = () => `"use client";
+import { useState } from "react";
+import { getToken } from "@/lib/api";
+const API = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:4000";
+export default function EmailTestPage() {
+  const [to, setTo] = useState("");
+  const [msg, setMsg] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  async function send(e: React.FormEvent) {
+    e.preventDefault();
+    setBusy(true); setMsg(null);
+    try {
+      const token = getToken();
+      const res = await fetch(API + "/email/test", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...(token ? { Authorization: "Bearer " + token } : {}) },
+        body: JSON.stringify({ to }),
+      });
+      const data: unknown = await res.json().catch(() => ({}));
+      if (!res.ok) throw new Error((data as { error?: string }).error ?? "Failed to send");
+      setMsg("Sent! If no SMTP is configured, check the API console for the email.");
+    } catch (err) { setMsg(err instanceof Error ? err.message : "Failed"); }
+    finally { setBusy(false); }
+  }
+  return (
+    <main className="mx-auto max-w-md px-6 py-16">
+      <h1 className="text-2xl font-bold">Send a test email</h1>
+      <p className="mt-1 text-muted">With no SMTP configured, the email is logged to the API console.</p>
+      <form onSubmit={send} className="mt-6 space-y-3">
+        <input type="email" required value={to} onChange={(e) => setTo(e.target.value)} placeholder="you@example.com" className="w-full rounded-xl border border-hairline bg-surface px-4 py-3 outline-none" />
+        <button disabled={busy} className="w-full rounded-full gradient-bg px-4 py-3 font-semibold on-accent disabled:opacity-60">{busy ? "Sending\u2026" : "Send test email"}</button>
+      </form>
+      {msg && <p className="mt-4 text-sm text-muted">{msg}</p>}
+    </main>
+  );
+}
+`;
 var scope = (ctx) => `@${ctx.name}`;
 var typesPkgJson = (ctx) => JSON.stringify({
   name: `${scope(ctx)}/types`,
@@ -5815,44 +6654,67 @@ function buildFullStack(ctx) {
   out[".gitignore"] = rootGitignore();
   out[".env.example"] = rootEnvExample(ctx);
   out["README.md"] = rootReadme(ctx);
+  const envBase = out[".env.example"];
+  const seen = new Set(
+    (envBase.match(/^#?\s*([A-Z0-9_]+)=/gm) ?? []).map((l) => l.replace(/^#?\s*/, "").replace(/=.*/, ""))
+  );
+  const lines = [];
+  for (const f of ctx.features) {
+    const b = f.backend?.(ctx);
+    if (!b?.env) continue;
+    const fresh = Object.entries(b.env).filter(([name]) => !seen.has(name));
+    if (!fresh.length) continue;
+    lines.push("", `# --- ${f.label} (${f.key}) ---`);
+    for (const [name, comment] of fresh) {
+      if (comment) lines.push(`# ${comment}`);
+      lines.push(`${name}=`);
+      seen.add(name);
+    }
+  }
+  if (lines.length) out[".env.example"] = envBase.replace(/\n?$/, "\n") + lines.join("\n") + "\n";
   return out;
 }
-var backendPkgJson = (ctx) => JSON.stringify({
-  name: `${scope(ctx)}/backend`,
-  version: "0.1.0",
-  private: true,
-  type: "module",
-  main: "dist/index.js",
-  scripts: {
-    dev: "tsx watch src/index.ts",
-    build: "tsc -p tsconfig.json",
-    start: "node dist/index.js",
-    typecheck: "tsc -p tsconfig.json --noEmit"
-  },
-  dependencies: {
-    express: "^4.21.2",
-    cors: "^2.8.5",
-    mongoose: "^8.9.0",
-    ioredis: "^5.4.2",
-    dotenv: "^16.4.7",
-    // ✨ Backend built on zero-dep @lacspace/* packages instead of the usual grab-bag.
-    "@lacspace/env": "^1.1.0",
-    "@lacspace/jwt": "^1.4.0",
-    "@lacspace/password": "^1.1.0",
-    "@lacspace/validate": "^1.1.0",
-    "@lacspace/id": "^1.1.0",
-    "@lacspace/rate-limit": "^1.2.0",
-    "@lacspace/cache": "^1.1.0",
-    [`${scope(ctx)}/types`]: "*"
-  },
-  devDependencies: {
-    typescript: "^5.7.0",
-    tsx: "^4.19.2",
-    "@types/node": "^22.10.0",
-    "@types/express": "^4.17.21",
-    "@types/cors": "^2.8.17"
-  }
-}, null, 2) + "\n";
+var backendPkgJson = (ctx) => {
+  const featureDeps = {};
+  for (const f of ctx.features) Object.assign(featureDeps, f.backend?.(ctx)?.deps ?? {});
+  return JSON.stringify({
+    name: `${scope(ctx)}/backend`,
+    version: "0.1.0",
+    private: true,
+    type: "module",
+    main: "dist/index.js",
+    scripts: {
+      dev: "tsx watch src/index.ts",
+      build: "tsc -p tsconfig.json",
+      start: "node dist/index.js",
+      typecheck: "tsc -p tsconfig.json --noEmit"
+    },
+    dependencies: {
+      express: "^4.21.2",
+      cors: "^2.8.5",
+      mongoose: "^8.9.0",
+      ioredis: "^5.4.2",
+      dotenv: "^16.4.7",
+      // ✨ Backend built on zero-dep @lacspace/* packages instead of the usual grab-bag.
+      "@lacspace/env": "^1.1.0",
+      "@lacspace/jwt": "^1.4.0",
+      "@lacspace/password": "^1.1.0",
+      "@lacspace/validate": "^1.1.0",
+      "@lacspace/id": "^1.1.0",
+      "@lacspace/rate-limit": "^1.2.0",
+      "@lacspace/cache": "^1.1.0",
+      ...featureDeps,
+      [`${scope(ctx)}/types`]: "*"
+    },
+    devDependencies: {
+      typescript: "^5.7.0",
+      tsx: "^4.19.2",
+      "@types/node": "^22.10.0",
+      "@types/express": "^4.17.21",
+      "@types/cors": "^2.8.17"
+    }
+  }, null, 2) + "\n";
+};
 var backendTsconfig = (ctx) => JSON.stringify({
   compilerOptions: {
     target: "ES2022",
@@ -6278,35 +7140,49 @@ router.delete("/:id", asyncHandler(async (req, res) => {
 export default router;
 `;
 var backendApp = (ctx) => `import express from "express";
-import type { RequestHandler } from "express";
 import cors from "cors";
-import { rateLimit, expressRateLimit } from "@lacspace/rate-limit";
 import { env } from "./env.js";
 import { errorHandler } from "./middleware/error.js";
-import authRoutes from "./routes/auth.js";
-import noteRoutes from "./routes/notes.js";
+import { registerRoutes } from "./routes/index.js";
 // how this works: assembles the Express app \u2014 CORS for the frontend, JSON parsing,
-// a health check, the auth + notes routers, then the error handler LAST.
+// a health check, all route groups (see routes/index.ts), then the error handler LAST.
 export function createApp(): express.Express {
   const app = express();
   app.use(cors({ origin: env.CORS_ORIGIN.split(",").map((o) => o.trim()), credentials: true }));
   app.use(express.json());
-  // Brute-force protection on auth: 20 requests / minute / IP (@lacspace/rate-limit).
-  const authLimiter = expressRateLimit(rateLimit({ limit: 20, windowMs: 60_000 })) as unknown as RequestHandler;
   app.get("/health", (_req, res) => { res.json({ ok: true, service: "${ctx.name}-api" }); });
-  app.use("/auth", authLimiter, authRoutes);
-  app.use("/notes", noteRoutes);
+  registerRoutes(app);
   app.use(errorHandler);
   return app;
 }
 `;
+var backendRoutesIndex = (ctx) => {
+  const featureRoutes = ctx.features.flatMap((f) => f.backend?.(ctx)?.routes ?? []);
+  const needsAuth = featureRoutes.some((r) => r.auth);
+  const importLines = featureRoutes.map((r) => r.importLine).join("\n");
+  const mountLines = featureRoutes.map((r) => `  app.use(${JSON.stringify(r.path)}, ${r.auth ? "requireAuth, " : ""}${r.handler});`).join("\n");
+  return `import type { Express, RequestHandler } from "express";
+import { rateLimit, expressRateLimit } from "@lacspace/rate-limit";
+${needsAuth ? 'import { requireAuth } from "../middleware/auth.js";\n' : ""}import authRoutes from "./auth.js";
+import noteRoutes from "./notes.js";
+${importLines ? importLines + "\n" : ""}
+// how this works: every route group is mounted here. Add a new resource by creating
+// a router in routes/ and adding one app.use(...) line below.
+export function registerRoutes(app: Express): void {
+  // Brute-force protection on auth: 20 requests / minute / IP (@lacspace/rate-limit).
+  const authLimiter = expressRateLimit(rateLimit({ limit: 20, windowMs: 60_000 })) as unknown as RequestHandler;
+  app.use("/auth", authLimiter, authRoutes);
+  app.use("/notes", noteRoutes);
+${mountLines}
+}
+`;
+};
 function backendFiles(ctx) {
-  return {
+  const files = {
     "backend/package.json": backendPkgJson(ctx),
     "backend/tsconfig.json": backendTsconfig(ctx),
     "backend/.gitignore": backendGitignore(),
@@ -6325,8 +7201,15 @@ function backendFiles(ctx) {
     "backend/src/models/user.ts": backendUserModel(),
     "backend/src/models/note.ts": backendNoteModel(),
     "backend/src/routes/auth.ts": backendAuthRoutes(ctx),
-    "backend/src/routes/notes.ts": backendNoteRoutes(ctx)
+    "backend/src/routes/notes.ts": backendNoteRoutes(ctx),
+    "backend/src/routes/index.ts": backendRoutesIndex(ctx)
   };
+  for (const f of ctx.features) {
+    const b = f.backend?.(ctx);
+    if (!b?.files) continue;
+    for (const [rel, content] of Object.entries(b.files)) files["backend/" + rel] = content;
+  }
+  return files;
 }
 var splitList = (s) => s.split(",").map((x) => x.trim()).filter(Boolean);
 function parseArgs(list) {