@flaredev/cli 0.1.0 → 0.1.1

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import pc16 from "picocolors";
+import pc18 from "picocolors";
 
 // src/cli.ts
 import { cac } from "cac";
@@ -242,9 +242,9 @@ ${pc.green("\u2714")} Created ${pc.bold(result.name)} in ${rel}
 }
 
 // src/commands/gen-billing.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname6, join as join10 } from "path";
-import pc4 from "picocolors";
+import { appendFileSync as appendFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join11 } from "path";
+import pc6 from "picocolors";
 
 // src/generator/grammar.ts
 import { camelCase, FILE_CATEGORIES } from "@flaredev/core";
@@ -1231,31 +1231,146 @@ async function loadResources(root) {
 }
 
 // src/generator/migrations.ts
-import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { spawn as spawn4 } from "child_process";
+import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { join as join8 } from "path";
 
 // src/commands/run.ts
-import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname4, join as join6, resolve as resolve4 } from "path";
+import { spawn as spawn3 } from "child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname4, join as join7, resolve as resolve4 } from "path";
+import pc4 from "picocolors";
+
+// src/tunnel.ts
+import { spawn, spawnSync as spawnSync2 } from "child_process";
+import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { homedir } from "os";
+import { join as join4 } from "path";
+import pc2 from "picocolors";
+var TUNNEL_URL = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+var LOCAL_URL = /https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0):\d+/;
+function parseTunnelUrl(output) {
+  return TUNNEL_URL.exec(output)?.[0] ?? null;
+}
+function parseLocalUrl(output) {
+  const match = LOCAL_URL.exec(output.replace(/\x1b\[[0-9;]*m/g, ""));
+  return match ? match[0].replace("0.0.0.0", "localhost") : null;
+}
+function toLocalUrl(target) {
+  if (!target) return "http://localhost:3000";
+  if (/^\d+$/.test(target.replace(/^:/, ""))) return `http://localhost:${target.replace(/^:/, "")}`;
+  if (/^https?:\/\//.test(target)) return target;
+  throw new Error(`"${target}" isn't a port or URL. Try: flare tunnel 3000`);
+}
+function releaseAsset(platform = process.platform, arch = process.arch) {
+  const cpu = { x64: "amd64", arm64: "arm64", ia32: "386", arm: "arm" }[arch];
+  if (platform === "win32" && (cpu === "amd64" || cpu === "386")) return `cloudflared-windows-${cpu}.exe`;
+  if (platform === "linux" && cpu) return `cloudflared-linux-${cpu}`;
+  if (platform === "darwin" && (cpu === "amd64" || cpu === "arm64")) return `cloudflared-darwin-${cpu}.tgz`;
+  throw new Error(`No cloudflared build for ${platform}/${arch}. Install it yourself: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/`);
+}
+var binName = process.platform === "win32" ? "cloudflared.exe" : "cloudflared";
+var cacheDir = () => join4(homedir(), ".flare", "bin");
+function onPath() {
+  const probe = spawnSync2(process.platform === "win32" ? "where" : "which", ["cloudflared"], { encoding: "utf8" });
+  return probe.status === 0 ? probe.stdout.split(/\r?\n/)[0]?.trim() ?? null : null;
+}
+async function download(log) {
+  const asset = releaseAsset();
+  const dir = cacheDir();
+  mkdirSync3(dir, { recursive: true });
+  const target = join4(dir, binName);
+  log(pc2.dim(`Downloading cloudflared (one time) into ${dir}\u2026`));
+  const response = await fetch(`https://github.com/cloudflare/cloudflared/releases/latest/download/${asset}`);
+  if (!response.ok) throw new Error(`Downloading cloudflared failed: HTTP ${response.status}.`);
+  const bytes = Buffer.from(await response.arrayBuffer());
+  const partial = `${target}.download`;
+  if (asset.endsWith(".tgz")) {
+    writeFileSync4(`${partial}.tgz`, bytes);
+    const untar = spawnSync2("tar", ["-xzf", `${partial}.tgz`, "-C", dir], { encoding: "utf8" });
+    rmSync(`${partial}.tgz`, { force: true });
+    if (untar.status !== 0) throw new Error(`Unpacking cloudflared failed: ${untar.stderr}`);
+  } else {
+    writeFileSync4(partial, bytes);
+    renameSync(partial, target);
+  }
+  if (process.platform !== "win32") chmodSync(target, 493);
+  return target;
+}
+async function ensureCloudflared(log = console.log) {
+  const found = onPath();
+  if (found) return found;
+  const cached = join4(cacheDir(), binName);
+  if (existsSync5(cached)) return cached;
+  return download(log);
+}
+async function openTunnel(localUrl, options2 = {}) {
+  const bin = await ensureCloudflared(options2.log);
+  const child = spawn(bin, ["tunnel", "--no-autoupdate", "--url", localUrl], { stdio: ["ignore", "pipe", "pipe"] });
+  const close = () => {
+    if (child.exitCode === null) child.kill();
+  };
+  process.once("exit", close);
+  const url = await new Promise((resolve6, reject) => {
+    let output = "";
+    const timer = setTimeout(() => {
+      close();
+      reject(new Error(`cloudflared didn't report a tunnel URL within ${(options2.timeoutMs ?? 3e4) / 1e3}s:
+${output.slice(-2e3)}`));
+    }, options2.timeoutMs ?? 3e4);
+    const scan = (chunk) => {
+      output += chunk.toString();
+      const found = parseTunnelUrl(output);
+      if (found) {
+        clearTimeout(timer);
+        resolve6(found);
+      }
+    };
+    child.stdout?.on("data", scan);
+    child.stderr?.on("data", scan);
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("exit", (code) => {
+      clearTimeout(timer);
+      reject(new Error(`cloudflared exited (code ${code}) before the tunnel was ready:
+${output.slice(-2e3)}`));
+    });
+  });
+  child.stdout?.resume();
+  child.stderr?.resume();
+  return { url, process: child, close };
+}
+function tunnelBanner(publicUrl, localUrl) {
+  const line = "\u2500".repeat(Math.max(publicUrl.length, localUrl.length) + 14);
+  return [
+    "",
+    pc2.cyan(line),
+    `  ${pc2.bold("Public URL")}  ${pc2.green(pc2.bold(publicUrl))}`,
+    `  ${pc2.dim("Forwarding")}  ${pc2.dim(localUrl)}`,
+    pc2.cyan(line),
+    pc2.dim("  Anyone with this link can reach your local server. Stop with Ctrl+C."),
+    ""
+  ].join("\n");
+}
 
 // src/commands/deploy.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
 import { createZoneClient } from "@flaredev/core/security";
 import { createJiti as createJiti2 } from "jiti";
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 
 // src/utils/wrangler.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
+import { join as join5 } from "path";
 import { parse as parseJsonc } from "jsonc-parser";
 function runWrangler(wranglerBin, args, cwd, options2 = {}) {
   return new Promise((resolve6, reject) => {
-    const child = spawn(process.execPath, [wranglerBin, ...args], {
+    const child = spawn2(process.execPath, [wranglerBin, ...args], {
       cwd,
       stdio: [options2.stdin !== void 0 ? "pipe" : "ignore", options2.capture ? "pipe" : "inherit", options2.capture ? "pipe" : "inherit"]
     });
@@ -1276,8 +1391,8 @@ ${output.trim()}`);
   return JSON.parse(output.slice(start, end + 1));
 }
 function readD1Databases(appRoot) {
-  const path = join4(appRoot, "wrangler.jsonc");
-  if (!existsSync5(path)) return [];
+  const path = join5(appRoot, "wrangler.jsonc");
+  if (!existsSync6(path)) return [];
   const config = parseJsonc(readFileSync3(path, "utf8"));
   return (config?.d1_databases ?? []).filter((db) => db.binding && db.database_name);
 }
@@ -1317,15 +1432,15 @@ function declaredSecretNames(devVarsExample) {
   return devVarsExample.split(/\r?\n/).map((line) => /^([A-Z][A-Z0-9_]*)=/.exec(line.trim())?.[1]).filter((name) => Boolean(name));
 }
 async function loadSecurityConfig(appRoot) {
-  const path = join5(appRoot, "security.config.ts");
-  if (!existsSync6(path)) return null;
-  const jiti = createJiti2(join5(appRoot, "package.json"), { moduleCache: false, fsCache: false });
+  const path = join6(appRoot, "security.config.ts");
+  if (!existsSync7(path)) return null;
+  const jiti = createJiti2(join6(appRoot, "package.json"), { moduleCache: false, fsCache: false });
   const mod = await jiti.import(path);
   if (!mod.default) throw new Error("security.config.ts must `export default defineSecurity({ ... })`.");
   return mod.default;
 }
 async function provisionZoneSecurity(appRoot, config, credentials, options2) {
-  const app = JSON.parse(readFileSync4(join5(appRoot, "package.json"), "utf8")).name ?? "app";
+  const app = JSON.parse(readFileSync4(join6(appRoot, "package.json"), "utf8")).name ?? "app";
   const zone = createZoneClient({ ...credentials, app, fetch: options2.fetch });
   if (config.zone?.rateLimits) {
     const result = await zone.syncRateLimits(config.zone.rateLimits);
@@ -1344,8 +1459,8 @@ async function runDeploy(args, context3) {
   const log = context3.log ?? ((message) => console.log(message));
   const envArgs = plan.env ? ["--env", plan.env] : [];
   const step = (message) => log(`
-${pc2.bold(pc2.cyan("flare"))} ${message}`);
-  const databases = plan.skipMigrations ? [] : readD1Databases(appRoot).filter((db) => existsSync6(join5(appRoot, db.migrations_dir ?? "migrations")));
+${pc3.bold(pc3.cyan("flare"))} ${message}`);
+  const databases = plan.skipMigrations ? [] : readD1Databases(appRoot).filter((db) => existsSync7(join6(appRoot, db.migrations_dir ?? "migrations")));
   const migrateAfterDeploy = [];
   const migrate2 = async (db) => {
     step(`Applying migrations to ${db.database_name} (remote)`);
@@ -1404,8 +1519,8 @@ ${put.output.trim()}`);
         existing.add(name);
       }
     }
-    const examplePath = join5(appRoot, ".dev.vars.example");
-    const optional = existsSync6(examplePath) ? declaredSecretNames(readFileSync4(examplePath, "utf8")).filter((name) => !existing.has(name)) : [];
+    const examplePath = join6(appRoot, ".dev.vars.example");
+    const optional = existsSync7(examplePath) ? declaredSecretNames(readFileSync4(examplePath, "utf8")).filter((name) => !existing.has(name)) : [];
     if (optional.length > 0) {
       step("Optional secrets not set in production (features using them stay off):");
       for (const name of optional) log(`  wrangler secret put ${name}${plan.env ? ` --env ${plan.env}` : ""}`);
@@ -1416,10 +1531,10 @@ ${put.output.trim()}`);
 
 // src/commands/run.ts
 var DELEGATED_COMMANDS = {
-  dev: { description: "Start the vinext dev server", pkg: "vinext", bin: "vinext", args: ["dev"] },
+  dev: { description: "Start the vinext dev server (--tunnel: also share it on a public URL)", pkg: "vinext", bin: "vinext", args: ["dev"] },
   build: { description: "Build for production (vinext build)", pkg: "vinext", bin: "vinext", args: ["build"] },
   start: {
-    description: "Serve the production build locally in workerd (builds first if needed)",
+    description: "Serve the production build locally in workerd, building first if needed (--tunnel: also share it on a public URL)",
     pkg: "wrangler",
     bin: "wrangler",
     // --persist-to shares local D1/R2 state with `flare dev` and local migrations.
@@ -1440,23 +1555,23 @@ function findAppRoot(cwd) {
   while (dir) {
     const root = findUp("package.json", dir);
     if (!root) break;
-    const pkg = JSON.parse(readFileSync5(join6(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync5(join7(root, "package.json"), "utf8"));
     if (pkg.dependencies?.vinext || pkg.devDependencies?.vinext) return root;
     const parent = dirname4(root);
     dir = parent === root ? void 0 : parent;
   }
   throw new Error("Not inside a Flare app (no package.json depending on vinext found). Run this from your app directory.");
 }
-function resolveBin(appRoot, pkgName, binName) {
-  const pkgDir = findUp(join6("node_modules", pkgName, "package.json"), appRoot);
+function resolveBin(appRoot, pkgName, binName2) {
+  const pkgDir = findUp(join7("node_modules", pkgName, "package.json"), appRoot);
   if (!pkgDir) {
     throw new Error(`Cannot find ${pkgName} in ${appRoot}. Install dependencies first (e.g. pnpm install).`);
   }
-  const manifestPath = join6(pkgDir, "node_modules", pkgName, "package.json");
+  const manifestPath = join7(pkgDir, "node_modules", pkgName, "package.json");
   const { bin } = JSON.parse(readFileSync5(manifestPath, "utf8"));
-  const relativeBin = typeof bin === "string" ? bin : bin?.[binName];
-  if (!relativeBin) throw new Error(`${pkgName} does not provide a "${binName}" executable.`);
-  return join6(dirname4(manifestPath), relativeBin);
+  const relativeBin = typeof bin === "string" ? bin : bin?.[binName2];
+  if (!relativeBin) throw new Error(`${pkgName} does not provide a "${binName2}" executable.`);
+  return join7(dirname4(manifestPath), relativeBin);
 }
 function delegatedArgv(appRoot, command, forwarded) {
   const spec = DELEGATED_COMMANDS[command];
@@ -1464,15 +1579,60 @@ function delegatedArgv(appRoot, command, forwarded) {
 }
 function runNode(argv, cwd) {
   return new Promise((resolvePromise, reject) => {
-    const child = spawn2(process.execPath, argv, { cwd, stdio: "inherit" });
+    const child = spawn3(process.execPath, argv, { cwd, stdio: "inherit" });
     child.on("error", reject);
     child.on("exit", (code, signal) => resolvePromise(code ?? (signal ? 1 : 0)));
   });
 }
+function runNodeWithTunnel(argv, cwd, opened) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn3(process.execPath, argv, { cwd, stdio: ["inherit", "pipe", "pipe"], env: { ...process.env, FORCE_COLOR: process.env.FORCE_COLOR ?? "1" } });
+    let tunnel = opened;
+    let seen = "";
+    let announced = false;
+    const watch = (chunk, out) => {
+      out.write(chunk);
+      if (announced) return;
+      seen += chunk.toString();
+      const local = parseLocalUrl(seen);
+      if (!local) return;
+      announced = true;
+      if (opened) {
+        process.stdout.write(tunnelBanner(opened.url, local));
+        return;
+      }
+      openTunnel(local).then(
+        (fresh) => {
+          tunnel = fresh;
+          if (child.exitCode !== null) fresh.close();
+          else process.stdout.write(tunnelBanner(fresh.url, local));
+        },
+        (error) => process.stderr.write(pc4.red(`
+The tunnel couldn't start: ${error.message}
+The server is still running locally.
+`))
+      );
+    };
+    child.stdout.on("data", (chunk) => watch(chunk, process.stdout));
+    child.stderr.on("data", (chunk) => watch(chunk, process.stderr));
+    child.on("error", reject);
+    child.on("exit", (code, signal) => {
+      tunnel?.close();
+      resolvePromise(code ?? (signal ? 1 : 0));
+    });
+  });
+}
+function portArg(args) {
+  const index = args.findIndex((arg) => arg === "--port" || arg === "-p");
+  if (index !== -1) return args[index + 1];
+  return args.find((arg) => arg.startsWith("--port="))?.slice("--port=".length);
+}
 async function runDelegated(command, forwarded, cwd = process.cwd()) {
   const appRoot = findAppRoot(cwd);
+  const tunnel = (command === "dev" || command === "start") && forwarded.includes("--tunnel");
+  if (tunnel) forwarded = forwarded.filter((arg) => arg !== "--tunnel");
   const wantsHelp = forwarded.includes("--help") || forwarded.includes("-h");
-  if (command === "start" && !wantsHelp && !existsSync7(join6(appRoot, "dist/server/wrangler.json"))) {
+  if (command === "start" && !wantsHelp && !existsSync8(join7(appRoot, "dist/server/wrangler.json"))) {
     console.log("No production build found; running `flare build` first.\n");
     const code = await runNode(delegatedArgv(appRoot, "build", []), appRoot);
     if (code !== 0) return code;
@@ -1484,6 +1644,12 @@ async function runDelegated(command, forwarded, cwd = process.cwd()) {
       deploy: (args) => runNode(delegatedArgv(appRoot, "deploy", args), appRoot)
     });
   }
+  if (tunnel && !wantsHelp && command === "start") {
+    const opened = await openTunnel(`http://127.0.0.1:${portArg(forwarded) ?? "8787"}`);
+    const origin = ["--local-upstream", new URL(opened.url).host, "--upstream-protocol", "https"];
+    return runNodeWithTunnel(delegatedArgv(appRoot, command, [...forwarded, ...origin]), appRoot, opened);
+  }
+  if (tunnel && !wantsHelp) return runNodeWithTunnel(delegatedArgv(appRoot, command, forwarded), appRoot);
   return runNode(delegatedArgv(appRoot, command, forwarded), appRoot);
 }
 
@@ -1516,14 +1682,14 @@ function snapshotColumns(snapshot) {
 }
 
 // src/generator/migrations.ts
-var listSql = (dir) => existsSync8(dir) ? readdirSync4(dir).filter((file) => file.endsWith(".sql")) : [];
+var listSql = (dir) => existsSync9(dir) ? readdirSync4(dir).filter((file) => file.endsWith(".sql")) : [];
 async function generateSchemaMigration(appRoot, name, options2 = {}) {
-  const dir = join7(appRoot, "migrations");
+  const dir = join8(appRoot, "migrations");
   const before = new Set(listSql(dir));
   const bin = resolveBin(appRoot, "drizzle-kit", "drizzle-kit");
   const { code, output } = await new Promise((resolve6, reject) => {
     const args = ["generate", "--name", name, ...options2.custom ? ["--custom"] : []];
-    const child = spawn3(process.execPath, [bin, ...args], {
+    const child = spawn4(process.execPath, [bin, ...args], {
       cwd: appRoot,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -1546,10 +1712,10 @@ If it asked whether a column was renamed, run \`pnpm exec drizzle-kit generate\`
   for (const file of created) {
     const previous = previousSnapshot(dir, file);
     if (!previous) continue;
-    const path = join7(dir, file);
+    const path = join8(dir, file);
     const { sql: sql2, changes } = repairRebuildMigration(readFileSync6(path, "utf8"), snapshotColumns(previous));
     if (changes.length) {
-      writeFileSync4(path, sql2);
+      writeFileSync5(path, sql2);
       repairs.push(...changes.map((change) => `${file}: ${change}`));
     }
   }
@@ -1557,32 +1723,32 @@ If it asked whether a column was renamed, run \`pnpm exec drizzle-kit generate\`
 }
 function previousSnapshot(dir, migrationFile) {
   const prefix = /^(\d+)_/.exec(migrationFile)?.[1];
-  const metaDir = join7(dir, "meta");
-  if (!prefix || !existsSync8(metaDir)) return void 0;
+  const metaDir = join8(dir, "meta");
+  if (!prefix || !existsSync9(metaDir)) return void 0;
   const earlier = readdirSync4(metaDir).filter((file) => /^\d+_snapshot\.json$/.test(file) && file < `${prefix}_snapshot.json`).sort().pop();
-  return earlier ? JSON.parse(readFileSync6(join7(metaDir, earlier), "utf8")) : void 0;
+  return earlier ? JSON.parse(readFileSync6(join8(metaDir, earlier), "utf8")) : void 0;
 }
 
 // src/generator/plan.ts
-import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync6, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname5, join as join9 } from "path";
-import pc3 from "picocolors";
+import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync4, readdirSync as readdirSync6, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname5, join as join10 } from "path";
+import pc5 from "picocolors";
 
 // src/generator/policy.ts
-import { existsSync as existsSync9, readdirSync as readdirSync5 } from "fs";
-import { join as join8, resolve as resolve5 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync5 } from "fs";
+import { join as join9, resolve as resolve5 } from "path";
 import { camelCase as camelCase2, kebabCase as kebabCase2 } from "@flaredev/core";
 import { createJiti as createJiti3 } from "jiti";
 var policyPath = (name) => `policies/${kebabCase2(name)}.policy.ts`;
 var policyLocal = (stem) => `${camelCase2(stem)}Policy`;
 async function loadPolicies(root) {
   const appRoot = resolve5(root);
-  const dir = join8(appRoot, "policies");
-  if (!existsSync9(dir)) return [];
-  const jiti = createJiti3(join8(appRoot, "package.json"), { moduleCache: false, fsCache: false });
+  const dir = join9(appRoot, "policies");
+  if (!existsSync10(dir)) return [];
+  const jiti = createJiti3(join9(appRoot, "package.json"), { moduleCache: false, fsCache: false });
   const loaded = [];
   for (const file of readdirSync5(dir).filter((name) => name.endsWith(".policy.ts")).sort()) {
-    const mod = await jiti.import(join8(dir, file));
+    const mod = await jiti.import(join9(dir, file));
     const policy = mod.default;
     if (!policy || typeof policy !== "object" || !("resource" in policy) || !Array.isArray(policy.read)) {
       throw new Error(`policies/${file} must \`export default definePolicy({ ... })\`.`);
@@ -1923,7 +2089,7 @@ function planFiles(all, policies) {
 }
 function applyPlan(appRoot, plan, options2 = {}) {
   return plan.map(({ path, content, header }) => {
-    const absolute = join9(appRoot, path);
+    const absolute = join10(appRoot, path);
     const status = inspectGenerated(absolute, content);
     if (status === "unmarked") return { path, status, outcome: "skipped-unmarked" };
     if (status === "drift" && !options2.force) return { path, status, outcome: "skipped-drift" };
@@ -1942,37 +2108,37 @@ function applyPlan(appRoot, plan, options2 = {}) {
 function findOrphans(appRoot, all) {
   const planned = new Set(planFiles(all).map((file) => file.path));
   const candidates = [];
-  const list2 = (dir, match) => existsSync10(join9(appRoot, dir)) ? readdirSync6(join9(appRoot, dir)).filter(match).map((name) => `${dir}/${name}`) : [];
+  const list2 = (dir, match) => existsSync11(join10(appRoot, dir)) ? readdirSync6(join10(appRoot, dir)).filter(match).map((name) => `${dir}/${name}`) : [];
   candidates.push(...list2("db/schema", (name) => name.endsWith(".ts")));
   candidates.push(...list2("resources", (name) => /\.(client|validators)\.ts$/.test(name)));
   for (const dir of list2("app/api", () => true)) {
-    for (const file of [`${dir}/route.ts`, `${dir}/[id]/route.ts`]) if (existsSync10(join9(appRoot, file))) candidates.push(file);
+    for (const file of [`${dir}/route.ts`, `${dir}/[id]/route.ts`]) if (existsSync11(join10(appRoot, file))) candidates.push(file);
   }
   for (const dir of list2("app/admin", () => true)) {
     for (const file of [`${dir}/page.tsx`, `${dir}/new/page.tsx`, `${dir}/[id]/edit/page.tsx`]) {
-      if (existsSync10(join9(appRoot, file))) candidates.push(file);
+      if (existsSync11(join10(appRoot, file))) candidates.push(file);
     }
   }
   const orphans = [];
   for (const path of candidates) {
-    const match = HEADER_PATTERN.exec(readFileSync7(join9(appRoot, path), "utf8"));
+    const match = HEADER_PATTERN.exec(readFileSync7(join10(appRoot, path), "utf8"));
     if (match && !planned.has(path)) orphans.push({ path, resource: match[1] });
   }
   return orphans;
 }
 function ensureSupportFiles(appRoot, log) {
   for (const path of ["lib/api.ts", "lib/cache.ts"]) {
-    const target = join9(appRoot, path);
-    if (existsSync10(target)) continue;
-    mkdirSync3(dirname5(target), { recursive: true });
-    copyFileSync(join9(templatesDir, "app", path), target);
-    log(`${pc3.green("create".padEnd(9))} ${path}`);
+    const target = join10(appRoot, path);
+    if (existsSync11(target)) continue;
+    mkdirSync4(dirname5(target), { recursive: true });
+    copyFileSync(join10(templatesDir, "app", path), target);
+    log(`${pc5.green("create".padEnd(9))} ${path}`);
   }
 }
 function logResults(results, log, options2 = {}) {
   for (const { path, outcome } of results) {
     if (outcome === "identical" && !options2.showIdentical) continue;
-    const label = outcome === "create" ? pc3.green("create") : outcome === "update" ? pc3.yellow("update") : outcome === "identical" ? pc3.dim("identical") : pc3.red(outcome === "skipped-drift" ? "drift" : "hand-written");
+    const label = outcome === "create" ? pc5.green("create") : outcome === "update" ? pc5.yellow("update") : outcome === "identical" ? pc5.dim("identical") : pc5.red(outcome === "skipped-drift" ? "drift" : "hand-written");
     log(`${label.padEnd(18)} ${path}`);
   }
 }
@@ -1993,14 +2159,14 @@ function billingFiles(appName) {
 }
 var RETIRED_FILES = ["app/api/billing/status/route.ts", "components/billing/subscribe-button.tsx"];
 function appendVars(appRoot, target) {
-  const path = join10(appRoot, target);
-  const text = existsSync11(path) ? readFileSync8(path, "utf8") : "";
+  const path = join11(appRoot, target);
+  const text = existsSync12(path) ? readFileSync8(path, "utf8") : "";
   if (/STRIPE_SECRET_KEY/.test(text)) return false;
   appendFileSync2(path, target === ".dev.vars" ? billingDevVarsEntries() : billingDevVarsExampleEntries());
   return true;
 }
 function addStripeDependency(appRoot) {
-  const path = join10(appRoot, "package.json");
+  const path = join11(appRoot, "package.json");
   const pkg = JSON.parse(readFileSync8(path, "utf8"));
   pkg.dependencies ??= {};
   if (pkg.dependencies.stripe) return false;
@@ -2010,18 +2176,18 @@ function addStripeDependency(appRoot) {
 }
 function writeBillingResource(appRoot, name, force, log) {
   const relative2 = descriptorPath(name);
-  const path = join10(appRoot, relative2);
-  if (!existsSync11(path)) {
-    mkdirSync4(dirname6(path), { recursive: true });
-    writeFileSync5(path, renderBillingDescriptor(name));
-    log(`${pc4.green("create".padEnd(9))} ${relative2}`);
+  const path = join11(appRoot, relative2);
+  if (!existsSync12(path)) {
+    mkdirSync5(dirname6(path), { recursive: true });
+    writeFileSync6(path, renderBillingDescriptor(name));
+    log(`${pc6.green("create".padEnd(9))} ${relative2}`);
     return;
   }
   const parts = splitMarkers(readFileSync8(path, "utf8"));
   if (!parts) throw new Error(`${relative2} has no generated fields block, so the billing fields can't be merged. Add them by hand: ${BILLING_RESOURCES[name]}`);
   const merged = mergeBillingFields(name, parts.block);
   if (!merged) {
-    log(`${pc4.dim("identical".padEnd(9))} ${relative2} (has every billing field)`);
+    log(`${pc6.dim("identical".padEnd(9))} ${relative2} (has every billing field)`);
     return;
   }
   try {
@@ -2032,7 +2198,7 @@ function writeBillingResource(appRoot, name, force, log) {
     }
     throw error;
   }
-  log(`${pc4.yellow("update".padEnd(9))} ${relative2} (added billing fields, kept yours)`);
+  log(`${pc6.yellow("update".padEnd(9))} ${relative2} (added billing fields, kept yours)`);
 }
 async function genBilling(options2 = {}) {
   const log = options2.log ?? ((message) => console.log(message));
@@ -2041,38 +2207,38 @@ async function genBilling(options2 = {}) {
   for (const name of ["Plan", "Customer", "Purchase"]) writeBillingResource(appRoot, name, options2.force, log);
   for (const [name, roles] of Object.entries(BILLING_POLICIES)) {
     const relative2 = policyPath(name);
-    if (existsSync11(join10(appRoot, relative2))) {
-      log(`${pc4.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+    if (existsSync12(join11(appRoot, relative2))) {
+      log(`${pc6.dim("kept".padEnd(9))} ${relative2} (already exists)`);
       continue;
     }
-    mkdirSync4(join10(appRoot, "policies"), { recursive: true });
-    writeFileSync5(join10(appRoot, relative2), renderPolicy(name, roles));
-    log(`${pc4.green("create".padEnd(9))} ${relative2}`);
+    mkdirSync5(join11(appRoot, "policies"), { recursive: true });
+    writeFileSync6(join11(appRoot, relative2), renderPolicy(name, roles));
+    log(`${pc6.green("create".padEnd(9))} ${relative2}`);
   }
   const files = [];
-  const appName = JSON.parse(readFileSync8(join10(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync8(join11(appRoot, "package.json"), "utf8")).name ?? "app";
   for (const { path, content } of billingFiles(appName)) {
-    const outcome = writeGenerated(join10(appRoot, path), content, { header: billingHeader(), force: options2.force });
+    const outcome = writeGenerated(join11(appRoot, path), content, { header: billingHeader(), force: options2.force });
     files.push({ path, status: "missing", outcome });
-    const label = outcome === "create" ? pc4.green("create") : outcome === "update" ? pc4.yellow("update") : pc4.dim("identical");
+    const label = outcome === "create" ? pc6.green("create") : outcome === "update" ? pc6.yellow("update") : pc6.dim("identical");
     log(`${label.padEnd(18)} ${path}`);
   }
   for (const path of RETIRED_FILES) {
-    const absolute = join10(appRoot, path);
-    if (!existsSync11(absolute)) continue;
+    const absolute = join11(appRoot, path);
+    if (!existsSync12(absolute)) continue;
     const parts = splitMarkers(readFileSync8(absolute, "utf8"));
     const untouched = parts && parts.before.includes("flare gen billing") && !parts.after.trim() && parts.hash !== void 0 && hashBlock(parts.block) === parts.hash;
     if (untouched) {
       unlinkSync(absolute);
-      log(`${pc4.red("remove".padEnd(9))} ${path} (no longer generated)`);
+      log(`${pc6.red("remove".padEnd(9))} ${path} (no longer generated)`);
     } else {
-      log(pc4.yellow(`${path} is no longer generated but has your changes; remove it when you're done with it.`));
+      log(pc6.yellow(`${path} is no longer generated but has your changes; remove it when you're done with it.`));
     }
   }
-  if (appendVars(appRoot, ".dev.vars.example")) log(`${pc4.green("append".padEnd(9))} .dev.vars.example`);
-  if (appendVars(appRoot, ".dev.vars")) log(`${pc4.green("append".padEnd(9))} .dev.vars`);
+  if (appendVars(appRoot, ".dev.vars.example")) log(`${pc6.green("append".padEnd(9))} .dev.vars.example`);
+  if (appendVars(appRoot, ".dev.vars")) log(`${pc6.green("append".padEnd(9))} .dev.vars`);
   const addedStripe = addStripeDependency(appRoot);
-  if (addedStripe) log(`${pc4.yellow("update".padEnd(9))} package.json (stripe@${STRIPE_DEP})`);
+  if (addedStripe) log(`${pc6.yellow("update".padEnd(9))} package.json (stripe@${STRIPE_DEP})`);
   if (!options2.skipInstall) {
     const pm = detectPackageManager();
     const code = run(pm, ["install"], appRoot);
@@ -2086,27 +2252,27 @@ async function genBilling(options2 = {}) {
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, "billing");
     migrations = result.files;
-    for (const file of migrations) log(`${pc4.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc4.dim(`repaired  ${repair}`));
+    for (const file of migrations) log(`${pc6.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc6.dim(`repaired  ${repair}`));
   }
   log(
     [
       "",
       `Next:`,
       `  1. Put a Stripe test key in .dev.vars (STRIPE_SECRET_KEY, ideally a restricted rk_test_ key).`,
-      `  2. ${pc4.bold("flare migrate")} to create the billing tables.`,
-      `  3. Create one Product per plan in Stripe with metadata flare_app=${appName}, then ${pc4.bold("flare billing:sync-plans")}.`,
-      `  4. ${pc4.bold("stripe listen --forward-to localhost:8787/api/webhooks/stripe")} and put its signing secret in STRIPE_WEBHOOK_SECRET.`,
-      `  5. ${pc4.bold("flare start")} and open ${pc4.bold("/dashboard/billing")}.`
+      `  2. ${pc6.bold("flare migrate")} to create the billing tables.`,
+      `  3. Create one Product per plan in Stripe with metadata flare_app=${appName}, then ${pc6.bold("flare billing:sync-plans")}.`,
+      `  4. ${pc6.bold("stripe listen --forward-to localhost:8787/api/webhooks/stripe")} and put its signing secret in STRIPE_WEBHOOK_SECRET.`,
+      `  5. ${pc6.bold("flare start")} and open ${pc6.bold("/dashboard/billing")}.`
     ].join("\n")
   );
   return { files, migrations, addedStripe };
 }
 
 // src/commands/gen-security.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname7, join as join11 } from "path";
-import pc5 from "picocolors";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname7, join as join12 } from "path";
+import pc7 from "picocolors";
 
 // src/generator/security.ts
 import { applyEdits, modify, parse as parseJsonc2 } from "jsonc-parser";
@@ -2633,49 +2799,49 @@ function securityFiles(appName) {
 }
 var PASS_THROUGH_HEADER = /^\/\/ Request protection for worker\/index\.ts\.[\s\S]*?\n(?=\/\/ generated:start)/;
 function writeOnce(appRoot, relative2, content, log) {
-  const path = join11(appRoot, relative2);
-  if (existsSync12(path)) {
-    log(`${pc5.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+  const path = join12(appRoot, relative2);
+  if (existsSync13(path)) {
+    log(`${pc7.dim("kept".padEnd(9))} ${relative2} (already exists)`);
     return;
   }
-  mkdirSync5(dirname7(path), { recursive: true });
-  writeFileSync6(path, content);
-  log(`${pc5.green("create".padEnd(9))} ${relative2}`);
+  mkdirSync6(dirname7(path), { recursive: true });
+  writeFileSync7(path, content);
+  log(`${pc7.green("create".padEnd(9))} ${relative2}`);
 }
 async function genSecurity(options2 = {}) {
   const log = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
-  const appName = JSON.parse(readFileSync9(join11(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync9(join12(appRoot, "package.json"), "utf8")).name ?? "app";
   writeOnce(appRoot, "security.config.ts", renderSecurityConfig(), log);
   writeOnce(appRoot, descriptorPath("SecurityEvent"), renderSecurityDescriptor(), log);
   writeOnce(appRoot, policyPath("SecurityEvent"), renderPolicy("SecurityEvent", SECURITY_EVENT_POLICY), log);
   const files = [];
   const write = (path, content, header) => {
-    const absolute = join11(appRoot, path);
-    if (path === "lib/security.ts" && existsSync12(absolute)) {
+    const absolute = join12(appRoot, path);
+    if (path === "lib/security.ts" && existsSync13(absolute)) {
       const source = readFileSync9(absolute, "utf8");
-      if (PASS_THROUGH_HEADER.test(source)) writeFileSync6(absolute, source.replace(PASS_THROUGH_HEADER, securityHeader()));
+      if (PASS_THROUGH_HEADER.test(source)) writeFileSync7(absolute, source.replace(PASS_THROUGH_HEADER, securityHeader()));
     }
     const outcome = writeGenerated(absolute, content, { header, force: options2.force });
     files.push({ path, status: "missing", outcome });
-    const label = outcome === "create" ? pc5.green("create") : outcome === "update" ? pc5.yellow("update") : pc5.dim("identical");
+    const label = outcome === "create" ? pc7.green("create") : outcome === "update" ? pc7.yellow("update") : pc7.dim("identical");
     log(`${label.padEnd(18)} ${path}`);
   };
   for (const { path, content } of securityFiles(appName)) write(path, content, securityHeader());
-  const navPath = join11(appRoot, "lib/admin-nav.ts");
-  if (existsSync12(navPath) && splitMarkers(readFileSync9(navPath, "utf8"))) write("lib/admin-nav.ts", renderAdminNavBlock());
-  else log(pc5.yellow(`lib/admin-nav.ts not found: link to /admin/security from your admin sidebar yourself.`));
-  const wranglerPath = join11(appRoot, "wrangler.jsonc");
+  const navPath = join12(appRoot, "lib/admin-nav.ts");
+  if (existsSync13(navPath) && splitMarkers(readFileSync9(navPath, "utf8"))) write("lib/admin-nav.ts", renderAdminNavBlock());
+  else log(pc7.yellow(`lib/admin-nav.ts not found: link to /admin/security from your admin sidebar yourself.`));
+  const wranglerPath = join12(appRoot, "wrangler.jsonc");
   let bindings = [];
-  if (existsSync12(wranglerPath)) {
+  if (existsSync13(wranglerPath)) {
     const { text, added } = addSecurityBindings(readFileSync9(wranglerPath, "utf8"));
     bindings = added;
     if (added.length) {
-      writeFileSync6(wranglerPath, text);
-      for (const line of added) log(`${pc5.yellow("update".padEnd(9))} wrangler.jsonc (${line})`);
+      writeFileSync7(wranglerPath, text);
+      for (const line of added) log(`${pc7.yellow("update".padEnd(9))} wrangler.jsonc (${line})`);
     }
   } else {
-    log(pc5.yellow("wrangler.jsonc not found: add the FLARE_SECURITY, FLARE_SECURITY_MONITOR and FLARE_RATE_LIMIT bindings yourself."));
+    log(pc7.yellow("wrangler.jsonc not found: add the FLARE_SECURITY, FLARE_SECURITY_MONITOR and FLARE_RATE_LIMIT bindings yourself."));
   }
   const all = await loadResources(appRoot);
   ensureSupportFiles(appRoot, log);
@@ -2684,17 +2850,17 @@ async function genSecurity(options2 = {}) {
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, "security");
     migrations = result.files;
-    for (const file of migrations) log(`${pc5.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc5.dim(`repaired  ${repair}`));
+    for (const file of migrations) log(`${pc7.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc7.dim(`repaired  ${repair}`));
   }
   log(
     [
       "",
       `Next:`,
-      `  1. ${pc5.bold("flare migrate")} to create the security_events table.`,
-      `  2. ${pc5.bold("flare dev")}, then open ${pc5.bold("/admin/security")}. Tune detectors in security.config.ts.`,
+      `  1. ${pc7.bold("flare migrate")} to create the security_events table.`,
+      `  2. ${pc7.bold("flare dev")}, then open ${pc7.bold("/admin/security")}. Tune detectors in security.config.ts.`,
       `  3. Optional zone layer: deploy with FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN set (a token scoped to that`,
-      `     one zone with Zone WAF Edit, Firewall Services Edit, Analytics Read, Zone Read). ${pc5.bold("flare deploy")} pushes the`,
+      `     one zone with Zone WAF Edit, Firewall Services Edit, Analytics Read, Zone Read). ${pc7.bold("flare deploy")} pushes the`,
       `     zone rules and uploads both as secrets.`
     ].join("\n")
   );
@@ -2702,10 +2868,10 @@ async function genSecurity(options2 = {}) {
 }
 
 // src/commands/gen.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname8, join as join12 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname8, join as join13 } from "path";
 import { camelCase as camelCase4, defineResource as defineResource2, relationGraph as relationGraph2 } from "@flaredev/core";
-import pc6 from "picocolors";
+import pc8 from "picocolors";
 function validateFields(name, fields, others, log) {
   const known = /* @__PURE__ */ new Set([name, ...others.map((resource) => resource.name)]);
   for (const field of fields) {
@@ -2716,7 +2882,7 @@ function validateFields(name, fields, others, log) {
   const candidate = defineResource2({ name, fields: Object.fromEntries(fields.map((f) => [f.key, toField(f)])) });
   const graph = relationGraph2([...others, candidate]);
   for (const pending of graph.pending.filter((p) => p.resource === name)) {
-    log(pc6.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
+    log(pc8.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
   }
 }
 async function genResource(rawName, options2) {
@@ -2724,8 +2890,8 @@ async function genResource(rawName, options2) {
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = resourceName(rawName);
   const relativePath = descriptorPath(name);
-  const path = join12(appRoot, relativePath);
-  const exists = existsSync13(path);
+  const path = join13(appRoot, relativePath);
+  const exists = existsSync14(path);
   if (!exists && !options2.fields) {
     throw new Error(`--fields is required, e.g. flare gen resource ${name} --fields "name:string, email:string"`);
   }
@@ -2735,13 +2901,13 @@ async function genResource(rawName, options2) {
     const fields = parseFields(options2.fields);
     validateFields(name, fields, others, log);
     if (!exists) {
-      mkdirSync6(dirname8(path), { recursive: true });
-      writeFileSync7(path, renderDescriptor(name, fields));
-      log(`${pc6.green("create".padEnd(9))} ${relativePath}`);
+      mkdirSync7(dirname8(path), { recursive: true });
+      writeFileSync8(path, renderDescriptor(name, fields));
+      log(`${pc8.green("create".padEnd(9))} ${relativePath}`);
     } else {
       try {
         const outcome = writeGenerated(path, renderFieldsBlock(fields), { force: options2.force });
-        log(`${(outcome === "identical" ? pc6.dim : pc6.yellow)(outcome.padEnd(9))} ${relativePath}`);
+        log(`${(outcome === "identical" ? pc8.dim : pc8.yellow)(outcome.padEnd(9))} ${relativePath}`);
       } catch (error) {
         if (error instanceof DriftError) {
           throw new Error(
@@ -2767,28 +2933,28 @@ async function genResource(rawName, options2) {
   }
   const skipped = written.filter((r) => r.outcome.startsWith("skipped"));
   if (skipped.length) {
-    log(pc6.yellow(`
+    log(pc8.yellow(`
 Skipped ${skipped.length} hand-edited file(s); run \`flare sync-types\` for details.`));
   }
   let migrations = [];
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, `${exists ? "update" : "create"}_${table}`);
     migrations = result.files;
-    for (const file of migrations) log(`${pc6.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc6.dim(`repaired  ${repair}`));
+    for (const file of migrations) log(`${pc8.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc8.dim(`repaired  ${repair}`));
     if (migrations.length) log(`
-Next: ${pc6.bold("flare migrate")} to apply it locally.`);
-    else if (exists) log(pc6.dim("\nNo table changes, so no migration."));
+Next: ${pc8.bold("flare migrate")} to apply it locally.`);
+    else if (exists) log(pc8.dim("\nNo table changes, so no migration."));
   }
   const descriptor = { path: relativePath, status: exists ? "outdated" : "missing", outcome: exists ? "update" : "create" };
   return { name, mode: exists ? "update" : "create", written: [descriptor, ...written], migrations };
 }
 
 // src/commands/gen-migration.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
-import { basename as basename2, join as join13 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename2, join as join14 } from "path";
 import { snakeCase } from "@flaredev/core";
-import pc7 from "picocolors";
+import pc9 from "picocolors";
 var DOWN_TEMPLATE = (up) => `-- Rollback for ${up}, run by \`flare migrate:rollback\`.
 -- Write SQL that undoes the up migration, e.g.:
 --   DROP INDEX IF EXISTS \`contacts_phone_idx\`;
@@ -2804,31 +2970,31 @@ async function genMigration(rawName, options2 = {}) {
     log(options2.fromSchema ? "No schema changes, so no migration was created." : "drizzle-kit didn't create a migration.");
     return [];
   }
-  for (const file of files) log(`${pc7.green("create".padEnd(9))} ${file}`);
-  for (const repair of repairs) log(pc7.dim(`repaired  ${repair}`));
+  for (const file of files) log(`${pc9.green("create".padEnd(9))} ${file}`);
+  for (const repair of repairs) log(pc9.dim(`repaired  ${repair}`));
   if (!options2.fromSchema) {
-    const downDir = join13(appRoot, "migrations", "down");
-    mkdirSync7(downDir, { recursive: true });
+    const downDir = join14(appRoot, "migrations", "down");
+    mkdirSync8(downDir, { recursive: true });
     for (const file of files) {
-      const down = join13(downDir, basename2(file));
-      if (existsSync14(down)) continue;
-      writeFileSync8(down, DOWN_TEMPLATE(basename2(file)));
-      log(`${pc7.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
+      const down = join14(downDir, basename2(file));
+      if (existsSync15(down)) continue;
+      writeFileSync9(down, DOWN_TEMPLATE(basename2(file)));
+      log(`${pc9.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
     }
     log(`
-Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc7.bold("flare migrate")}.`);
+Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc9.bold("flare migrate")}.`);
   } else {
     log(`
-Next: ${pc7.bold("flare migrate")}.`);
+Next: ${pc9.bold("flare migrate")}.`);
   }
   return files;
 }
 
 // src/commands/gen-policy.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname9, join as join14 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname9, join as join15 } from "path";
 import { definePolicy } from "@flaredev/core";
-import pc8 from "picocolors";
+import pc10 from "picocolors";
 function parseRoles(input, what = "--roles") {
   const roles = (input ?? "").split(",").map((role) => role.trim()).filter(Boolean);
   if (roles.length === 0) throw new Error(`${what} is required, e.g. ${what} admin,staff`);
@@ -2844,8 +3010,8 @@ async function genPolicy(rawName, options2) {
     throw new Error(`No resource "${name}". Generate it first. Known resources: ${known}.`);
   }
   const relative2 = policyPath(name);
-  const path = join14(appRoot, relative2);
-  const exists = existsSync15(path);
+  const path = join15(appRoot, relative2);
+  const exists = existsSync16(path);
   let roles;
   let deleteRoles;
   if (options2.roles || !exists) {
@@ -2856,13 +3022,13 @@ async function genPolicy(rawName, options2) {
   if (roles && deleteRoles) {
     const block = renderPolicyBlock({ read: roles, create: roles, update: roles, delete: deleteRoles });
     if (!exists) {
-      mkdirSync8(dirname9(path), { recursive: true });
-      writeFileSync9(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
-      log(`${pc8.green("create".padEnd(9))} ${relative2}`);
+      mkdirSync9(dirname9(path), { recursive: true });
+      writeFileSync10(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
+      log(`${pc10.green("create".padEnd(9))} ${relative2}`);
     } else {
       try {
         const outcome = writeGenerated(path, block, { force: options2.force });
-        log(`${(outcome === "identical" ? pc8.dim : pc8.yellow)(outcome.padEnd(9))} ${relative2}`);
+        log(`${(outcome === "identical" ? pc10.dim : pc10.yellow)(outcome.padEnd(9))} ${relative2}`);
       } catch (error) {
         if (error instanceof DriftError) {
           throw new Error(`The roles in ${relative2} were edited by hand, so --roles won't overwrite them. Edit the file directly, or pass --force.`);
@@ -2874,15 +3040,15 @@ async function genPolicy(rawName, options2) {
   const policies = await loadPolicies(appRoot);
   logResults(applyPlan(appRoot, planFiles(resources, policies)), log);
   log(`
-${pc8.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
+${pc10.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
   return { name, path: relative2 };
 }
 
 // src/commands/migrate.ts
-import { existsSync as existsSync16, mkdtempSync, readFileSync as readFileSync10, rmSync, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync17, mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync2, writeFileSync as writeFileSync11 } from "fs";
 import { tmpdir } from "os";
-import { join as join15 } from "path";
-import pc9 from "picocolors";
+import { join as join16 } from "path";
+import pc11 from "picocolors";
 
 // src/generator/down.ts
 var IDENT = '(`[^`]+`|"[^"]+"|\\[[^\\]]+\\]|[A-Za-z_][\\w$]*)';
@@ -2999,7 +3165,7 @@ async function rollback(options2 = {}) {
   const steps = options2.steps ?? 1;
   if (!Number.isInteger(steps) || steps < 1) throw new Error("--steps must be a positive integer.");
   const { appRoot, db, target, where, wrangler, log } = context(options2);
-  const migrationsDir = join15(appRoot, db.migrations_dir ?? "migrations");
+  const migrationsDir = join16(appRoot, db.migrations_dir ?? "migrations");
   const applied = await appliedMigrations(options2, steps);
   if (applied.length === 0) {
     log("Nothing to roll back.");
@@ -3008,8 +3174,8 @@ async function rollback(options2 = {}) {
   const plan = [];
   for (const { name } of applied) {
     if (!/^[\w.-]+\.sql$/.test(name)) throw new Error(`Unexpected migration name "${name}" in d1_migrations.`);
-    const handWritten = join15(migrationsDir, "down", name);
-    if (existsSync16(handWritten)) {
+    const handWritten = join16(migrationsDir, "down", name);
+    if (existsSync17(handWritten)) {
       const sql2 = readFileSync10(handWritten, "utf8");
       if (splitStatements(sql2).length === 0) {
         throw new Error(`Can't roll back ${name}: migrations/down/${name} has no SQL statements yet. Write the rollback SQL, then run the rollback again. Nothing was changed.`);
@@ -3017,8 +3183,8 @@ async function rollback(options2 = {}) {
       plan.push({ name, sql: sql2, source: `migrations/down/${name}` });
       continue;
     }
-    const upPath = join15(migrationsDir, name);
-    if (!existsSync16(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
+    const upPath = join16(migrationsDir, name);
+    if (!existsSync17(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
     const down = deriveDown(readFileSync10(upPath, "utf8"));
     if (!down.reversible) {
       throw new Error(
@@ -3028,37 +3194,37 @@ Write the reverse SQL to migrations/down/${name} and run the rollback again. Not
     }
     plan.push({ name, sql: down.sql, source: "derived" });
   }
-  log(`${pc9.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
+  log(`${pc11.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
   for (const step of plan) {
-    log(`  ${step.name} ${pc9.dim(`(${step.source})`)}`);
-    for (const line of step.sql.trim().split("\n")) log(pc9.dim(`    ${line}`));
+    log(`  ${step.name} ${pc11.dim(`(${step.source})`)}`);
+    for (const line of step.sql.trim().split("\n")) log(pc11.dim(`    ${line}`));
   }
   if (options2.remote && !options2.yes) {
-    log(pc9.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
+    log(pc11.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
     return 1;
   }
   const script = plan.map(({ name, sql: sql2 }) => `${sql2.trim()}
 DELETE FROM d1_migrations WHERE name = '${name.replace(/'/g, "''")}';`).join("\n") + "\n";
-  const dir = mkdtempSync(join15(tmpdir(), "flare-rollback-"));
+  const dir = mkdtempSync(join16(tmpdir(), "flare-rollback-"));
   try {
-    const file = join15(dir, "rollback.sql");
-    writeFileSync10(file, script);
+    const file = join16(dir, "rollback.sql");
+    writeFileSync11(file, script);
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Rollback failed:
 ${result.output.trim()}`);
   } finally {
-    rmSync(dir, { recursive: true, force: true });
+    rmSync2(dir, { recursive: true, force: true });
   }
-  log(pc9.green(`
+  log(pc11.green(`
 Rolled back ${plan.map((step) => step.name).join(", ")}.`));
   return 0;
 }
 
 // src/commands/rm.ts
-import { existsSync as existsSync17, readdirSync as readdirSync7, readFileSync as readFileSync11, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname10, join as join16 } from "path";
+import { existsSync as existsSync18, readdirSync as readdirSync7, readFileSync as readFileSync11, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname10, join as join17 } from "path";
 import { relationGraph as relationGraph3 } from "@flaredev/core";
-import pc10 from "picocolors";
+import pc12 from "picocolors";
 var squash = (text) => text.replace(/\r\n/g, "\n").replace(/\s+/g, " ").trim();
 function handWrittenReason(source, header, options2 = {}) {
   const parts = splitMarkers(source);
@@ -3075,10 +3241,10 @@ function handWrittenReason(source, header, options2 = {}) {
   return null;
 }
 function removeEmptyDirs(appRoot, start) {
-  let dir = dirname10(join16(appRoot, start));
-  const roots = [join16(appRoot, "app", "api"), join16(appRoot, "app", "admin")];
+  let dir = dirname10(join17(appRoot, start));
+  const roots = [join17(appRoot, "app", "api"), join17(appRoot, "app", "admin")];
   const inside = () => roots.some((root) => dir.startsWith(root) && dir !== root);
-  while (inside() && existsSync17(dir) && readdirSync7(dir).length === 0) {
+  while (inside() && existsSync18(dir) && readdirSync7(dir).length === 0) {
     rmdirSync(dir);
     dir = dirname10(dir);
   }
@@ -3107,7 +3273,7 @@ async function rmResource(rawName, options2 = {}) {
   if (entry) {
     owned.add(entry.file);
     for (const file of planFiles(all)) {
-      if (existsSync17(join16(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
+      if (existsSync18(join17(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
     }
   }
   for (const orphan of findOrphans(appRoot, remaining)) if (orphan.resource === name) owned.add(orphan.path);
@@ -3116,7 +3282,7 @@ async function rmResource(rawName, options2 = {}) {
   if (!entry && owned.size === 0) throw new Error(`No resource "${name}" (no ${descriptorPath(name)} and no generated files).`);
   const findings = [];
   for (const path of owned) {
-    const source = readFileSync11(join16(appRoot, path), "utf8");
+    const source = readFileSync11(join17(appRoot, path), "utf8");
     let wrapper;
     if (entry && path === entry.file) {
       const standard = splitMarkers(renderDescriptor(name, [{ key: "placeholder", kind: "string", required: true, unique: false }]));
@@ -3137,34 +3303,34 @@ Move what you want to keep, or pass --force to delete anyway.`);
   }
   const removed = [...owned].sort();
   for (const path of removed) {
-    unlinkSync2(join16(appRoot, path));
+    unlinkSync2(join17(appRoot, path));
     removeEmptyDirs(appRoot, path);
-    log(`${pc10.red("remove".padEnd(9))} ${path}`);
+    log(`${pc12.red("remove".padEnd(9))} ${path}`);
   }
   logResults(applyPlan(appRoot, planFiles(remaining, policy ? await loadPolicies(appRoot) : void 0)), log);
   const table = entry ? tableExport(entry.resource) : void 0;
-  if (table && existsSync17(join16(appRoot, "seeds"))) {
-    const seeds = readdirSync7(join16(appRoot, "seeds")).filter(
-      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync11(join16(appRoot, "seeds", file), "utf8"))
+  if (table && existsSync18(join17(appRoot, "seeds"))) {
+    const seeds = readdirSync7(join17(appRoot, "seeds")).filter(
+      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync11(join17(appRoot, "seeds", file), "utf8"))
     );
-    if (seeds.length) log(pc10.yellow(`
+    if (seeds.length) log(pc12.yellow(`
 These seeds still use ${table}: ${seeds.map((s) => `seeds/${s}`).join(", ")}.`));
   }
   let migrations = [];
   if (!options2.skipMigration && entry) {
     const result = await generateSchemaMigration(appRoot, `drop_${entry.resource.table}`);
     migrations = result.files;
-    for (const file of migrations) log(`${pc10.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc10.dim(`repaired  ${repair}`));
+    for (const file of migrations) log(`${pc12.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc12.dim(`repaired  ${repair}`));
     if (migrations.length) log(`
-Next: ${pc10.bold("flare migrate")} to drop the table locally.`);
+Next: ${pc12.bold("flare migrate")} to drop the table locally.`);
   }
   return { removed, migrations };
 }
 
 // src/commands/role.ts
 import { humanize } from "@flaredev/core";
-import pc11 from "picocolors";
+import pc13 from "picocolors";
 var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
 function roleInsertSql(name, label) {
   if (!ROLE_NAME.test(name)) throw new Error(`Invalid role "${name}". Use lowercase letters, digits, _ or -, e.g. admin or support-agent.`);
@@ -3209,24 +3375,24 @@ ${result.output.trim()}`);
   }
   const [first] = extractJson(result.output);
   const added = first?.results?.[0];
-  log(pc11.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
-  log(pc11.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
+  log(pc13.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
+  log(pc13.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
   return 0;
 }
 
 // src/commands/seed.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync8, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, readdirSync as readdirSync8, writeFileSync as writeFileSync12 } from "fs";
 import { createRequire } from "module";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { pathToFileURL } from "url";
 import { kebabCase as kebabCase3, storedFields as storedFields2 } from "@flaredev/core";
 import { createJiti as createJiti4 } from "jiti";
-import pc12 from "picocolors";
+import pc14 from "picocolors";
 var SEEDS_DIR = "seeds";
 var LOCAL_STATE = ".wrangler/state/v3";
 function seedFiles(appRoot, names) {
-  const dir = join17(appRoot, SEEDS_DIR);
-  const all = existsSync18(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
+  const dir = join18(appRoot, SEEDS_DIR);
+  const all = existsSync19(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
   if (!names?.length) return all;
   return names.map((name) => {
     const file = `${name.replace(/\.seed\.ts$/, "")}.seed.ts`;
@@ -3241,29 +3407,29 @@ async function runSeeds(options2 = {}) {
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const files = seedFiles(appRoot, options2.names);
   if (files.length === 0) {
-    log(`No seeds found. Create one with ${pc12.bold("flare seed:make <name>")}.`);
+    log(`No seeds found. Create one with ${pc14.bold("flare seed:make <name>")}.`);
     return;
   }
-  const jiti = createJiti4(join17(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
-  const appRequire = createRequire(join17(appRoot, "package.json"));
+  const jiti = createJiti4(join18(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
+  const appRequire = createRequire(join18(appRoot, "package.json"));
   const wrangler = await import(pathToFileURL(appRequire.resolve("wrangler")).href);
   const { drizzle } = await jiti.import("drizzle-orm/d1");
-  const schema = await jiti.import(join17(appRoot, "db/schema.ts"));
+  const schema = await jiti.import(join18(appRoot, "db/schema.ts"));
   const { env, dispose } = await wrangler.getPlatformProxy({
-    configPath: join17(appRoot, "wrangler.jsonc"),
-    persist: { path: join17(appRoot, LOCAL_STATE) }
+    configPath: join18(appRoot, "wrangler.jsonc"),
+    persist: { path: join18(appRoot, LOCAL_STATE) }
   });
   try {
     const bindings = env;
     if (!bindings.DB) throw new Error("No DB binding found in wrangler.jsonc.");
     const db = drizzle(bindings.DB, { schema });
     for (const file of files) {
-      const mod = await jiti.import(join17(appRoot, SEEDS_DIR, file));
+      const mod = await jiti.import(join18(appRoot, SEEDS_DIR, file));
       if (typeof mod.default !== "function") throw new Error(`${SEEDS_DIR}/${file} must \`export default defineSeed(async ({ db }) => { ... })\`.`);
-      log(`${pc12.cyan("seed")} ${file}`);
+      log(`${pc14.cyan("seed")} ${file}`);
       await mod.default({ db, env: bindings, log: (message) => log(`  ${message}`) });
     }
-    log(pc12.green(`
+    log(pc14.green(`
 Ran ${files.length} seed(s) against the local database.`));
   } finally {
     await dispose();
@@ -3332,8 +3498,8 @@ async function makeSeed(rawName, options2 = {}) {
   const name = kebabCase3(rawName);
   if (!name) throw new Error(`Invalid seed name "${rawName}".`);
   const relative2 = `${SEEDS_DIR}/${name}.seed.ts`;
-  const path = join17(appRoot, relative2);
-  if (existsSync18(path)) throw new Error(`${relative2} already exists.`);
+  const path = join18(appRoot, relative2);
+  if (existsSync19(path)) throw new Error(`${relative2} already exists.`);
   const resources = (await loadResources(appRoot)).map(({ resource: resource2 }) => resource2);
   let resource;
   if (options2.resource) {
@@ -3342,26 +3508,26 @@ async function makeSeed(rawName, options2 = {}) {
   } else {
     resource = resources.find((r) => [kebabCase3(r.name), r.slug].includes(name));
   }
-  mkdirSync9(join17(appRoot, SEEDS_DIR), { recursive: true });
-  writeFileSync11(path, renderSeed(resource));
-  log(`${pc12.green("create".padEnd(9))} ${relative2}`);
+  mkdirSync10(join18(appRoot, SEEDS_DIR), { recursive: true });
+  writeFileSync12(path, renderSeed(resource));
+  log(`${pc14.green("create".padEnd(9))} ${relative2}`);
   log(`
-Run it with ${pc12.bold(`flare seed ${name}`)}.`);
+Run it with ${pc14.bold(`flare seed ${name}`)}.`);
   return relative2;
 }
 
 // src/commands/billing-sync.ts
 import { createRequire as createRequire2 } from "module";
-import { existsSync as existsSync19, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync3, writeFileSync as writeFileSync13 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import { kebabCase as kebabCase4 } from "@flaredev/core";
-import pc13 from "picocolors";
+import pc15 from "picocolors";
 function stripeKeys(appRoot) {
   const map = {};
-  const path = join18(appRoot, ".dev.vars");
-  if (existsSync19(path)) {
+  const path = join19(appRoot, ".dev.vars");
+  if (existsSync20(path)) {
     for (const line of readFileSync12(path, "utf8").split(/\r?\n/)) {
       const match = /^\s*([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match) map[match[1]] = match[2].trim();
@@ -3445,10 +3611,10 @@ async function syncPlans(options2 = {}) {
   if (!key) throw new Error("STRIPE_SECRET_KEY is not set in .dev.vars or the environment.");
   const db = readD1Databases(appRoot)[0];
   if (!db) throw new Error("No d1_databases in wrangler.jsonc.");
-  const appRequire = createRequire2(join18(appRoot, "package.json"));
+  const appRequire = createRequire2(join19(appRoot, "package.json"));
   const stripeModule = await import(pathToFileURL2(appRequire.resolve("stripe")).href);
   const stripe = new stripeModule.default(key, { apiVersion: "2026-08-26.dahlia" });
-  const appName = JSON.parse(readFileSync12(join18(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync12(join19(appRoot, "package.json"), "utf8")).name ?? "app";
   const everything = await stripe.products.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 });
   const products = options2.all ? everything : everything.filter((product) => product.metadata?.flare_app === appName);
   if (products.length === 0) {
@@ -3469,41 +3635,41 @@ async function syncPlans(options2 = {}) {
 ${existingResult.output.trim()}`);
   }
   const known = new Set(extractJson(existingResult.output)[0]?.results.map((row) => row.stripe_price_id));
-  const dir = mkdtempSync2(join18(tmpdir2(), "flare-sync-"));
+  const dir = mkdtempSync2(join19(tmpdir2(), "flare-sync-"));
   try {
-    const file = join18(dir, "sync-plans.sql");
-    writeFileSync12(file, renderSyncSql(rows));
+    const file = join19(dir, "sync-plans.sql");
+    writeFileSync13(file, renderSyncSql(rows));
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Could not write plans:
 ${result.output.trim()}`);
   } finally {
-    rmSync2(dir, { recursive: true, force: true });
+    rmSync3(dir, { recursive: true, force: true });
   }
   let created = 0;
   for (const row of rows) {
     const isNew = !known.has(row.stripePriceId);
     if (isNew) created++;
     const price = `${row.currency.toUpperCase()} ${(row.amount / 100).toFixed(2)}${row.interval ? `/${row.interval}` : " once"}`;
-    log(`${(isNew ? pc13.green("create") : pc13.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc13.dim(price)}`);
+    log(`${(isNew ? pc15.green("create") : pc15.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc15.dim(price)}`);
   }
-  for (const name of skipped) log(pc13.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
+  for (const name of skipped) log(pc15.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
   const configuration = await syncPortalConfiguration(stripe, rows, appName);
-  if (configuration) log(`${pc13.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
-  log(pc13.green(`
+  if (configuration) log(`${pc15.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
+  log(pc15.green(`
 ${rows.length} plan(s) synced to the ${options2.remote ? "remote" : "local"} database; plans no longer active in Stripe were deactivated.`));
   return { created, updated: rows.length - created, skipped };
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync20 } from "fs";
-import { join as join19 } from "path";
-import pc14 from "picocolors";
+import { existsSync as existsSync21 } from "fs";
+import { join as join20 } from "path";
+import pc16 from "picocolors";
 async function syncTypes(options2 = {}) {
   const log = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const all = await loadResources(appRoot);
   const policies = await loadPolicies(appRoot);
-  const tracksPolicies = policies.length > 0 || existsSync20(join19(appRoot, "policies/index.ts"));
+  const tracksPolicies = policies.length > 0 || existsSync21(join20(appRoot, "policies/index.ts"));
   const plan = planFiles(all, tracksPolicies ? policies : void 0);
   if (!options2.check) ensureSupportFiles(appRoot, log);
   const results = applyPlan(appRoot, plan, { force: options2.force, dryRun: options2.check });
@@ -3515,42 +3681,42 @@ async function syncTypes(options2 = {}) {
   if (drift.length) {
     log(
       `
-${pc14.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
+${pc16.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
 Move custom code outside the // generated:start \u2026 // generated:end block, or re-run with --force to overwrite.`
     );
   }
   if (unmarked.length) {
     log(`
-${pc14.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
+${pc16.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
   }
   if (orphans.length) {
     const resources = [...new Set(orphans.map((o) => o.resource))];
     log(`
-${pc14.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
+${pc16.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
     for (const orphan of orphans) log(`  ${orphan.path}`);
     log(
-      `If the resource was deleted, remove them with ${pc14.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
+      `If the resource was deleted, remove them with ${pc16.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
     );
   }
   const tablesChanged = changed.some((r) => r.path.startsWith("db/schema/") && (r.status === "outdated" || r.status === "missing"));
   if (tablesChanged && !options2.check) {
     log(`
-${pc14.cyan("Tables changed.")} Create a migration with ${pc14.bold("flare gen migration <name> --from-schema")}, then ${pc14.bold("flare migrate")}.`);
+${pc16.cyan("Tables changed.")} Create a migration with ${pc16.bold("flare gen migration <name> --from-schema")}, then ${pc16.bold("flare migrate")}.`);
   }
   const problems = drift.length + unmarked.length + orphans.length;
   if (options2.check) {
     const stale = changed.length;
-    if (stale === 0 && problems === 0) log(pc14.green("Generated files are in sync with the resource descriptors."));
+    if (stale === 0 && problems === 0) log(pc16.green("Generated files are in sync with the resource descriptors."));
     else log(`
-${pc14.red("Out of sync:")} ${stale} file(s) would change. Run ${pc14.bold("flare sync-types")}.`);
+${pc16.red("Out of sync:")} ${stale} file(s) would change. Run ${pc16.bold("flare sync-types")}.`);
     return stale + problems > 0 ? 1 : 0;
   }
-  if (changed.length === 0 && problems === 0) log(pc14.green("Everything is in sync."));
+  if (changed.length === 0 && problems === 0) log(pc16.green("Everything is in sync."));
   return problems > 0 ? 1 : 0;
 }
 
 // src/commands/user-role.ts
-import pc15 from "picocolors";
+import pc17 from "picocolors";
 var ROLE = /^[a-z][a-z0-9_-]{0,31}$/;
 var EMAIL = /^[^\s@'"\\]+@[^\s@'"\\]+\.[^\s@'"\\]+$/;
 function userRoleSql(email, role) {
@@ -3564,8 +3730,8 @@ async function setUserRole(email, role, options2 = {}) {
   const sql2 = userRoleSql(email, role);
   const roles = await listRoles(options2);
   if (roles && !roles.includes(role)) {
-    log(pc15.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
-    log(pc15.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
+    log(pc17.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
+    log(pc17.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
     return 1;
   }
   const db = readD1Databases(appRoot)[0];
@@ -3579,10 +3745,10 @@ ${result.output.trim()}`);
   const [first] = extractJson(result.output);
   const updated = first?.results ?? [];
   if (updated.length === 0) {
-    log(pc15.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
+    log(pc17.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
     return 1;
   }
-  log(pc15.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
+  log(pc17.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
   return 0;
 }
 
@@ -3636,6 +3802,18 @@ function createCli() {
   cli.command("sync-types", "Regenerate schema, routes, clients, and validators from resource descriptors; report drift").option("--check", "Change nothing; exit 1 if anything is out of sync (CI)").option("--force", "Overwrite generated blocks that were edited by hand").action(async (options2) => {
     process.exitCode = await syncTypes(options2);
   });
+  cli.command("tunnel [target]", "Share a local server on a public https://*.trycloudflare.com URL (Cloudflare Quick Tunnel; no account needed)").example("flare tunnel          # http://localhost:3000").example("flare tunnel 8787").example("flare tunnel http://localhost:5173").action(async (target) => {
+    const local = toLocalUrl(target);
+    const tunnel = await openTunnel(local);
+    console.log(tunnelBanner(tunnel.url, local));
+    process.exitCode = await new Promise((resolve6) => {
+      process.once("SIGINT", () => {
+        tunnel.close();
+        resolve6(0);
+      });
+      tunnel.process.once("exit", (code) => resolve6(code ?? 0));
+    });
+  });
   for (const [name, spec] of Object.entries(DELEGATED_COMMANDS)) {
     cli.command(`${name} [...args]`, spec.description).allowUnknownOptions();
   }
@@ -3659,6 +3837,6 @@ try {
     }
   }
 } catch (error) {
-  console.error(pc16.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
+  console.error(pc18.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
   process.exitCode = 1;
 }