@flaredev/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,3664 @@
+// src/index.ts
+import pc16 from "picocolors";
+
+// src/cli.ts
+import { cac } from "cac";
+import { FLARE_VERSION as FLARE_VERSION2 } from "@flaredev/core";
+
+// src/commands/create.ts
+import { randomBytes } from "crypto";
+import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2 } from "path";
+import pc from "picocolors";
+import { FLARE_VERSION } from "@flaredev/core";
+
+// src/auth-providers.ts
+var AUTH_PROVIDERS = {
+  google: { envPrefix: "GOOGLE", console: "https://console.cloud.google.com/apis/credentials" },
+  github: { envPrefix: "GITHUB", console: "https://github.com/settings/developers" }
+};
+function parseAuthProviders(input) {
+  if (!input) return [];
+  const names = input.split(",").map((name) => name.trim().toLowerCase()).filter(Boolean);
+  const unknown = names.filter((name) => !(name in AUTH_PROVIDERS));
+  if (unknown.length > 0) {
+    throw new Error(
+      `Unknown auth provider${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}. Supported: ${Object.keys(AUTH_PROVIDERS).join(", ")}.`
+    );
+  }
+  return [...new Set(names)];
+}
+function socialProvidersCode(providers) {
+  if (providers.length === 0) return "{}";
+  const entries = providers.map((provider) => {
+    const id = `env.${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_ID`;
+    const secret = `env.${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_SECRET`;
+    return `    ...(${id} && ${secret} ? { ${provider}: { clientId: ${id}, clientSecret: ${secret} } } : {}),`;
+  });
+  return [
+    "{",
+    "    // Each provider switches on once its credentials are set: .dev.vars locally,",
+    "    // `wrangler secret put` in production.",
+    ...entries,
+    "  }"
+  ].join("\n");
+}
+function devVarsEntries(providers) {
+  return providers.map((provider) => `${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_ID=
+${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_SECRET=
+`).join("");
+}
+function devVarsExampleEntries(providers) {
+  return providers.map((provider) => {
+    const { envPrefix, console: console2 } = AUTH_PROVIDERS[provider];
+    return [
+      "",
+      `# ${provider} OAuth app: ${console2}`,
+      `# Callback URL: <your app URL>/api/auth/callback/${provider}`,
+      `${envPrefix}_CLIENT_ID=`,
+      `${envPrefix}_CLIENT_SECRET=`,
+      ""
+    ].join("\n");
+  }).join("");
+}
+
+// src/versions.ts
+var APP_DEPENDENCIES = {
+  "@better-auth/drizzle-adapter": "1.7.5",
+  // Server components import Slot from here rather than the "radix-ui" umbrella (see components/ui/button.tsx).
+  "@radix-ui/react-slot": "1.3.3",
+  "@vinext/cloudflare": "1.0.0-beta.8",
+  "better-auth": "1.7.5",
+  // Admin UI (shadcn/ui primitives in components/ui).
+  "class-variance-authority": "^0.7.1",
+  clsx: "^2.1.1",
+  cmdk: "^1.1.1",
+  "date-fns": "^4.4.0",
+  "lucide-react": "^1.46.0",
+  "radix-ui": "^1.6.7",
+  "react-day-picker": "^10.0.1",
+  sonner: "^2.0.8",
+  "tailwind-merge": "^3.7.0",
+  "tw-animate-css": "^1.4.0",
+  "drizzle-orm": "^0.45.2",
+  react: "19.3.0",
+  "react-dom": "19.3.0",
+  "react-server-dom-webpack": "19.3.0",
+  vinext: "1.0.0-beta.10"
+};
+var APP_DEV_DEPENDENCIES = {
+  "@cloudflare/vite-plugin": "^1.54.10",
+  "@tailwindcss/postcss": "^4.3.3",
+  "@types/node": "^22.20.3",
+  "@types/react": "^19.3.0",
+  "@types/react-dom": "^19.3.0",
+  "@vitejs/plugin-react": "^6.1.1",
+  "@vitejs/plugin-rsc": "^0.5.35",
+  "drizzle-kit": "^0.31.10",
+  tailwindcss: "^4.3.3",
+  typescript: "^7.0.2",
+  vite: "^8.3.0",
+  wrangler: "^4.132.0"
+};
+
+// src/utils/fs.ts
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+var RENAMES = { _gitignore: ".gitignore" };
+function copyTemplate(from, to, tokens) {
+  mkdirSync(to, { recursive: true });
+  for (const entry of readdirSync(from)) {
+    const src = join(from, entry);
+    const dest = join(to, RENAMES[entry] ?? entry);
+    if (statSync(src).isDirectory()) {
+      copyTemplate(src, dest, tokens);
+      continue;
+    }
+    const content = readFileSync(src, "utf8").replace(/__([A-Z_]+)__/g, (match, key) => tokens[key] ?? match);
+    writeFileSync(dest, content);
+  }
+}
+function writeJson(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(value, null, 2) + "\n");
+}
+function findUp(file, start) {
+  let dir = resolve(start);
+  while (true) {
+    if (existsSync(join(dir, file))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+var templatesDir = join(findUp("templates", dirname(fileURLToPath(import.meta.url))), "templates");
+
+// src/utils/pm.ts
+import { spawnSync } from "child_process";
+var MANAGERS = ["pnpm", "npm", "yarn", "bun"];
+function isPackageManager(value) {
+  return MANAGERS.includes(value);
+}
+function detectPackageManager(userAgent = process.env.npm_config_user_agent ?? "") {
+  const name = userAgent.split("/")[0];
+  return isPackageManager(name) ? name : "pnpm";
+}
+function run(command, args, cwd) {
+  const env = childEnv();
+  const result = process.platform === "win32" ? spawnSync([command, ...args].join(" "), { cwd, stdio: "inherit", shell: true, env }) : spawnSync(command, args, { cwd, stdio: "inherit", env });
+  return result.status ?? 1;
+}
+var EXEC_ONLY_CONFIG = ["npm_config_allow_scripts", "npm_config_yes", "npm_config_call", "npm_config_package"];
+function childEnv(env = process.env) {
+  const next = { ...env };
+  for (const key of Object.keys(next)) {
+    if (EXEC_ONLY_CONFIG.includes(key.toLowerCase())) delete next[key];
+  }
+  return next;
+}
+
+// src/commands/create.ts
+function toAppName(dir) {
+  const name = basename(resolve2(dir)).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!name) throw new Error(`Cannot derive an app name from "${dir}". Use letters, digits, and dashes.`);
+  return name;
+}
+function flarePackageSpec(pkg, appDir, packageManager) {
+  const repoPackage = resolve2(templatesDir, "../..", pkg);
+  const repoRoot = resolve2(repoPackage, "../..");
+  const fromCheckout = existsSync2(join2(repoPackage, "package.json")) && existsSync2(join2(repoRoot, "pnpm-workspace.yaml")) && !repoPackage.split(/[\\/]/).includes("node_modules");
+  if (!fromCheckout) return `^${FLARE_VERSION}`;
+  const rel = relative(repoRoot, appDir);
+  if (rel && !rel.startsWith("..") && !isAbsolute(rel)) return "workspace:*";
+  const protocol = packageManager === "pnpm" ? "link" : "file";
+  return `${protocol}:${repoPackage.replaceAll("\\", "/")}`;
+}
+function createApp(target, options2 = {}) {
+  const dir = resolve2(target);
+  const name = toAppName(dir);
+  if (existsSync2(dir) && readdirSync2(dir).length > 0) {
+    throw new Error(`Directory ${dir} already exists and is not empty.`);
+  }
+  if (options2.pm !== void 0 && !isPackageManager(options2.pm)) {
+    throw new Error(`Unknown package manager "${options2.pm}". Use pnpm, npm, yarn, or bun.`);
+  }
+  const packageManager = options2.pm ?? detectPackageManager();
+  const authProviders = parseAuthProviders(options2.authProviders);
+  const inWorkspace = findUp("pnpm-workspace.yaml", dirname2(dir)) !== void 0;
+  const compatibilityDate = options2.compatibilityDate ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  copyTemplate(join2(templatesDir, "app"), dir, {
+    APP_NAME: name,
+    COMPAT_DATE: compatibilityDate,
+    PM: packageManager,
+    SOCIAL_PROVIDERS: socialProvidersCode(authProviders)
+  });
+  appendFileSync(join2(dir, ".dev.vars.example"), devVarsExampleEntries(authProviders));
+  writeJson(join2(dir, "package.json"), {
+    name,
+    version: "0.1.0",
+    private: true,
+    type: "module",
+    scripts: {
+      dev: "flare dev",
+      build: "flare build",
+      start: "flare start",
+      deploy: "flare deploy",
+      "cf-typegen": "wrangler types",
+      "db:generate": "drizzle-kit generate",
+      "db:migrate:local": "wrangler d1 migrations apply DB --local"
+    },
+    dependencies: { "@flaredev/core": flarePackageSpec("core", dir, packageManager), ...APP_DEPENDENCIES },
+    devDependencies: { "@flaredev/cli": flarePackageSpec("cli", dir, packageManager), ...APP_DEV_DEPENDENCIES }
+  });
+  writeFileSync2(
+    join2(dir, ".dev.vars"),
+    `BETTER_AUTH_SECRET=${randomBytes(32).toString("base64")}
+RESEND_API_KEY=
+MAIL_FROM=
+${devVarsEntries(authProviders)}`
+  );
+  if (packageManager === "pnpm" && !inWorkspace) {
+    writeFileSync2(join2(dir, "pnpm-workspace.yaml"), "allowBuilds:\n  esbuild: true\n  workerd: true\n  sharp: false\n");
+  }
+  if (options2.install !== false) {
+    const code = run(packageManager, ["install"], dir);
+    if (code !== 0) throw new Error(`${packageManager} install failed (exit code ${code}).`);
+    const typegen = run(packageManager, ["run", "cf-typegen"], dir);
+    if (typegen !== 0) throw new Error(`wrangler types failed (exit code ${typegen}).`);
+  }
+  return { dir, name, packageManager, inWorkspace };
+}
+function printNextSteps(result, installed) {
+  const rel = relative(process.cwd(), result.dir) || ".";
+  const pm = result.packageManager;
+  console.log(`
+${pc.green("\u2714")} Created ${pc.bold(result.name)} in ${rel}
+`);
+  console.log("Next steps:");
+  console.log(`  cd ${rel}`);
+  if (!installed) console.log(`  ${pm} install`);
+  console.log(`  ${pm} run dev`);
+}
+
+// src/commands/gen-billing.ts
+import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, join as join10 } from "path";
+import pc4 from "picocolors";
+
+// src/generator/grammar.ts
+import { camelCase, FILE_CATEGORIES } from "@flaredev/core";
+var SIMPLE_KINDS = ["string", "text", "int", "float", "boolean", "date", "datetime"];
+var ALL_KINDS = [...SIMPLE_KINDS, "enum", "file", "belongsTo", "hasMany"];
+var FieldGrammarError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FieldGrammarError";
+  }
+};
+function splitTopLevel(input) {
+  const parts = [];
+  let depth = 0;
+  let current = "";
+  for (const char of input) {
+    if (char === "(" || char === "[") depth++;
+    if (char === ")" || char === "]") depth = Math.max(0, depth - 1);
+    if (char === "," && depth === 0) {
+      parts.push(current);
+      current = "";
+    } else {
+      current += char;
+    }
+  }
+  parts.push(current);
+  return parts.map((part) => part.trim()).filter(Boolean);
+}
+function editDistance(a, b) {
+  const dp = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
+  for (let j = 1; j <= b.length; j++) dp[0][j] = j;
+  for (let i = 1; i <= a.length; i++) {
+    for (let j = 1; j <= b.length; j++) {
+      dp[i][j] = Math.min(
+        dp[i - 1][j] + 1,
+        dp[i][j - 1] + 1,
+        dp[i - 1][j - 1] + (a[i - 1].toLowerCase() === b[j - 1].toLowerCase() ? 0 : 1)
+      );
+    }
+  }
+  return dp[a.length][b.length];
+}
+function suggest(value, candidates) {
+  const best = candidates.map((candidate) => ({ candidate, distance: editDistance(value, candidate) })).sort((x, y) => x.distance - y.distance)[0];
+  return best && best.distance <= 2 ? ` Did you mean "${best.candidate}"?` : "";
+}
+function list(raw, what, spec) {
+  const items = raw.split(",").map((item) => item.trim()).filter(Boolean);
+  if (items.length === 0) throw new FieldGrammarError(`"${spec}": ${what} list is empty.`);
+  return items;
+}
+var RESOURCE_NAME = /^[A-Z][A-Za-z0-9]*$/;
+function parseField(spec) {
+  const colon = spec.indexOf(":");
+  if (colon <= 0) throw new FieldGrammarError(`"${spec}": expected name:type, e.g. "title:string".`);
+  const rawName = spec.slice(0, colon).trim();
+  let type = spec.slice(colon + 1).trim();
+  let required = true;
+  let unique = false;
+  while (/[?!]$/.test(type)) {
+    if (type.endsWith("?")) required = false;
+    else unique = true;
+    type = type.slice(0, -1).trimEnd();
+  }
+  if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(rawName)) {
+    throw new FieldGrammarError(`"${spec}": field name "${rawName}" must start with a letter and use letters, digits, or _.`);
+  }
+  let key = camelCase(rawName);
+  const field = { key, kind: "string", required, unique };
+  let match;
+  if (SIMPLE_KINDS.includes(type)) {
+    field.kind = type;
+  } else if (match = /^enum\((.*)\)$/.exec(type)) {
+    field.kind = "enum";
+    const options2 = list(match[1], "enum option", spec);
+    for (const option of options2) {
+      if (!/^[A-Za-z0-9_-]+$/.test(option)) {
+        throw new FieldGrammarError(`"${spec}": enum option "${option}" may only use letters, digits, _ and -.`);
+      }
+    }
+    if (new Set(options2).size !== options2.length) throw new FieldGrammarError(`"${spec}": duplicate enum options.`);
+    field.options = options2;
+  } else if (match = /^file(?::\[(.*)\])?$/.exec(type)) {
+    field.kind = "file";
+    if (match[1] === void 0) {
+      throw new FieldGrammarError(`"${spec}": file fields list accepted types, e.g. "file:[image,pdf]".`);
+    }
+    const categories = Object.keys(FILE_CATEGORIES);
+    const accept = list(match[1], "file type", spec).map((category) => category.toLowerCase());
+    for (const category of accept) {
+      if (!categories.includes(category)) {
+        throw new FieldGrammarError(
+          `"${spec}": unknown file type "${category}".${suggest(category, categories)} Supported: ${categories.join(", ")}.`
+        );
+      }
+    }
+    field.accept = [...new Set(accept)];
+  } else if (match = /^(belongsTo|hasMany)\((.*)\)$/i.exec(type)) {
+    const kind = match[1].toLowerCase() === "belongsto" ? "belongsTo" : "hasMany";
+    const target = match[2].trim();
+    if (!RESOURCE_NAME.test(target)) {
+      throw new FieldGrammarError(`"${spec}": relation target "${target}" must be a PascalCase resource name, e.g. "Company".`);
+    }
+    field.kind = kind;
+    field.target = target;
+    if (kind === "belongsTo" && !key.endsWith("Id")) key = `${key}Id`;
+    if (kind === "hasMany") {
+      if (!required || unique) throw new FieldGrammarError(`"${spec}": hasMany fields can't be optional or unique.`);
+      field.required = false;
+    }
+    field.key = key;
+  } else {
+    const base = type.replace(/[([].*$/, "").replace(/:$/, "");
+    throw new FieldGrammarError(`"${spec}": unknown type "${type}".${suggest(base, ALL_KINDS)} Types: ${ALL_KINDS.join(", ")}.`);
+  }
+  if (field.kind === "string") {
+    if (/^email$|Email$/.test(key)) field.format = "email";
+    else if (/^(url|website)$|(Url|Website)$/.test(key)) field.format = "url";
+  }
+  return field;
+}
+function parseFields(input) {
+  const specs = splitTopLevel(input);
+  if (specs.length === 0) throw new FieldGrammarError('No fields given. Example: --fields "name:string, email:string"');
+  const fields = specs.map(parseField);
+  const seen = /* @__PURE__ */ new Set();
+  for (const field of fields) {
+    if (seen.has(field.key)) throw new FieldGrammarError(`Field "${field.key}" is declared more than once.`);
+    seen.add(field.key);
+  }
+  return fields;
+}
+
+// src/generator/descriptor.ts
+import { defineResource, field as builders, kebabCase, pascalCase } from "@flaredev/core";
+
+// src/generator/markers.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3 } from "path";
+var START = "// generated:start";
+var END = "// generated:end";
+var normalize = (content) => content.replace(/\r\n/g, "\n").replace(/[ \t]+$/gm, "");
+function hashBlock(content) {
+  return createHash("sha256").update(normalize(content)).digest("hex").slice(0, 12);
+}
+function dedent(content, indent) {
+  if (!indent) return content;
+  return content.split("\n").map((line) => line.startsWith(indent) ? line.slice(indent.length) : line).join("\n");
+}
+function indentBlock(content, indent) {
+  if (!indent) return content;
+  return content.split("\n").map((line) => line ? indent + line : line).join("\n");
+}
+function splitMarkers(source) {
+  const text = source.replace(/\r\n/g, "\n");
+  const startCount = text.split(START).length - 1;
+  const endCount = text.split(END).length - 1;
+  if (startCount === 0 && endCount === 0) return null;
+  const start = text.indexOf(START);
+  const end = text.indexOf(END);
+  if (startCount !== 1 || endCount !== 1 || end < start) {
+    throw new Error("Expected exactly one // generated:start \u2026 // generated:end block.");
+  }
+  const lineStart = text.lastIndexOf("\n", start) + 1;
+  const indent = text.slice(lineStart, start);
+  const startLineEnd = text.indexOf("\n", start);
+  const startLine = text.slice(start, startLineEnd === -1 ? void 0 : startLineEnd);
+  const hash = /hash=([0-9a-f]{12})/.exec(startLine)?.[1];
+  const endLineStart = text.lastIndexOf("\n", end) + 1;
+  const endLineEnd = text.indexOf("\n", end);
+  return {
+    before: text.slice(0, lineStart),
+    block: dedent(text.slice(startLineEnd + 1, endLineStart), indent),
+    after: endLineEnd === -1 ? "" : text.slice(endLineEnd + 1),
+    indent,
+    hash
+  };
+}
+function joinMarkers({ before, block, after, indent, hash }) {
+  const body = block === "" || block.endsWith("\n") ? block : `${block}
+`;
+  const startMarker = hash ? `${START} hash=${hash}` : START;
+  return `${before}${indent}${startMarker}
+${indentBlock(body, indent)}${indent}${END}
+${after}`;
+}
+function inspectGenerated(path, content) {
+  if (!existsSync3(path)) return "missing";
+  const parts = splitMarkers(readFileSync2(path, "utf8"));
+  if (!parts) return "unmarked";
+  if (parts.hash && hashBlock(parts.block) !== parts.hash) return "drift";
+  if (normalize(parts.block) !== normalize(content)) return "outdated";
+  return parts.hash === hashBlock(content) ? "identical" : "untracked";
+}
+var DriftError = class extends Error {
+  constructor(path) {
+    super(`${path}: the generated block was edited by hand. Move custom code outside the block, or pass --force to overwrite it.`);
+    this.path = path;
+    this.name = "DriftError";
+  }
+  path;
+};
+function writeGenerated(path, content, options2 = {}) {
+  const hash = hashBlock(content);
+  if (!existsSync3(path)) {
+    mkdirSync2(dirname3(path), { recursive: true });
+    writeFileSync3(path, joinMarkers({ before: options2.header ?? "", block: content, after: "", indent: "", hash }));
+    return "create";
+  }
+  const source = readFileSync2(path, "utf8");
+  const parts = splitMarkers(source);
+  if (!parts) throw new Error(`${path} exists but has no generated block; refusing to overwrite hand-written code.`);
+  if (parts.hash && hashBlock(parts.block) !== parts.hash && !options2.force) throw new DriftError(path);
+  const next = joinMarkers({ ...parts, block: content, hash });
+  if (next === source) return "identical";
+  writeFileSync3(path, next);
+  return "update";
+}
+
+// src/generator/descriptor.ts
+function resourceName(input) {
+  const name = pascalCase(input);
+  if (!/^[A-Z][A-Za-z0-9]*$/.test(name)) throw new Error(`Invalid resource name "${input}". Use letters and digits, e.g. "Contact".`);
+  return name;
+}
+var descriptorPath = (name) => `resources/${kebabCase(name)}.resource.ts`;
+function options(field) {
+  const opts = {};
+  if (field.kind === "hasMany") return opts;
+  if (!field.required) opts.required = false;
+  if (field.unique) opts.unique = true;
+  if (field.format) opts.format = field.format;
+  if (field.kind === "belongsTo" && !field.required) opts.onDelete = "set null";
+  return opts;
+}
+function toField(field) {
+  const opts = options(field);
+  switch (field.kind) {
+    case "enum":
+      return builders.enum(field.options, opts);
+    case "file":
+      return builders.file(field.accept, opts);
+    case "belongsTo":
+      return builders.belongsTo(field.target, opts);
+    case "hasMany":
+      return builders.hasMany(field.target);
+    default:
+      return builders[field.kind](opts);
+  }
+}
+var literal = (value) => JSON.stringify(value);
+function renderOptions(opts) {
+  const entries = Object.entries(opts);
+  return entries.length ? `{ ${entries.map(([k, v]) => `${k}: ${literal(v)}`).join(", ")} }` : "";
+}
+function renderField(field) {
+  const opts = renderOptions(options(field));
+  const args = (...parts) => parts.filter(Boolean).join(", ");
+  switch (field.kind) {
+    case "enum":
+      return `${field.key}: field.enum(${args(literal(field.options), opts)}),`;
+    case "file":
+      return `${field.key}: field.file(${args(literal(field.accept), opts)}),`;
+    case "belongsTo":
+      return `${field.key}: field.belongsTo(${args(literal(field.target), opts)}),`;
+    case "hasMany":
+      return `${field.key}: field.hasMany(${literal(field.target)}),`;
+    default:
+      return `${field.key}: field.${field.kind}(${opts}),`;
+  }
+}
+function renderFieldsBlock(fields) {
+  return fields.map((f) => `${renderField(f)}
+`).join("");
+}
+function renderDescriptor(name, fields) {
+  defineResource({ name, fields: Object.fromEntries(fields.map((f) => [f.key, toField(f)])) });
+  const block = renderFieldsBlock(fields);
+  return joinMarkers({
+    before: `import { defineResource, field } from "@flaredev/core";
+
+export default defineResource({
+  name: ${literal(name)},
+  fields: {
+`,
+    block,
+    after: `  },
+});
+`,
+    indent: "    ",
+    hash: hashBlock(block)
+  });
+}
+
+// src/generator/billing.ts
+var BILLING_PROVIDER = "stripe";
+var BILLING_MODES = ["subscriptions"];
+function validateBillingOptions(provider, mode) {
+  if (provider && provider !== BILLING_PROVIDER) {
+    throw new Error(`--provider "${provider}" is not supported yet. Supported: ${BILLING_PROVIDER}.`);
+  }
+  if (mode && !BILLING_MODES.includes(mode)) {
+    throw new Error(`--mode "${mode}" is not supported. Supported: ${BILLING_MODES.join(", ")} (it includes one-time checkout too).`);
+  }
+}
+var PLAN_FIELDS = "name:string, slug:string!, description:text?, stripeProductId:string?, stripePriceId:string!, amount:int, currency:string, interval:enum(month,year)?, active:boolean?, sort:int?";
+var CUSTOMER_FIELDS = "name:string, email:string!, userId:string!?, stripeCustomerId:string!?, stripeSubscriptionId:string?, subscriptionStatus:enum(none,incomplete,trialing,active,past_due,paused,canceled,unpaid)?, subscriptionEndsAt:datetime?, cancelAtPeriodEnd:boolean?, planId:belongsTo(Plan)?";
+var PURCHASE_FIELDS = "customerId:belongsTo(Customer), planId:belongsTo(Plan)?, stripeCheckoutSessionId:string!, amount:int, currency:string, status:enum(pending,paid,failed)";
+var BILLING_RESOURCES = {
+  Plan: PLAN_FIELDS,
+  Customer: CUSTOMER_FIELDS,
+  Purchase: PURCHASE_FIELDS
+};
+var billingFields = (name) => parseFields(BILLING_RESOURCES[name]);
+var renderBillingDescriptor = (name) => renderDescriptor(name, billingFields(name));
+function mergeBillingFields(name, block) {
+  const present = new Set([...block.matchAll(/^\s*(\w+)\s*:/gm)].map((match) => match[1]));
+  const missing = billingFields(name).filter((field) => !present.has(field.key));
+  if (missing.length === 0) return null;
+  const lines = missing.map((field) => `${renderField(field)}
+`).join("");
+  return `${block.replace(/\s*$/, "\n")}${lines}`;
+}
+var BILLING_POLICIES = {
+  Plan: { read: ["*"], create: ["admin"], update: ["admin"], delete: ["admin"] },
+  Customer: { read: ["admin", "staff"], create: ["admin"], update: ["admin"], delete: ["admin"] },
+  Purchase: { read: ["admin", "staff"], create: ["admin"], update: ["admin"], delete: ["admin"] }
+};
+var billingHeader = () => `// Generated by \`flare gen billing\`. Code inside the generated block is
+// rewritten on regeneration; add your own code outside it.
+`;
+var STRIPE_API_VERSION = "2026-08-26.dahlia";
+var renderLibStripe = (appName) => `import Stripe from "stripe";
+import { env } from "cloudflare:workers";
+import { and, eq, isNull } from "drizzle-orm";
+import { checkoutPaid, shouldApplySubscription, subscriptionState } from "@flaredev/core";
+import { getDb } from "@/db";
+import { customers, plans, purchases } from "@/db/schema";
+
+export type CustomerRow = typeof customers.$inferSelect;
+
+/** This app's tag in Stripe metadata (flare_app), so several apps can share one Stripe account. */
+const FLARE_APP = ${JSON.stringify(appName)};
+
+export function stripeSecrets(): { STRIPE_SECRET_KEY?: string; STRIPE_WEBHOOK_SECRET?: string; BETTER_AUTH_URL?: string } {
+  return env as { STRIPE_SECRET_KEY?: string; STRIPE_WEBHOOK_SECRET?: string; BETTER_AUTH_URL?: string };
+}
+
+/** The Stripe client. Throws a clear error when STRIPE_SECRET_KEY is unset. */
+export function createStripe(): Stripe {
+  const { STRIPE_SECRET_KEY } = stripeSecrets();
+  if (!STRIPE_SECRET_KEY) {
+    throw new Error("STRIPE_SECRET_KEY is not set. Add it to .dev.vars locally and run \`wrangler secret put STRIPE_SECRET_KEY\` for production.");
+  }
+  return new Stripe(STRIPE_SECRET_KEY, { apiVersion: "${STRIPE_API_VERSION}", httpClient: Stripe.createFetchHttpClient() });
+}
+
+/**
+ * The app's own origin for Checkout and portal return URLs. Comes from
+ * BETTER_AUTH_URL when set, else the request URL, never from forwarded headers
+ * a client could spoof to send users elsewhere after paying.
+ */
+export function appOrigin(request: Request): string {
+  const configured = stripeSecrets().BETTER_AUTH_URL;
+  return (configured ? new URL(configured) : new URL(request.url)).origin;
+}
+
+/**
+ * The Customer row that pays for a signed-in user, with a Stripe customer attached.
+ * Creates both on first use, links a row an admin created for the same email, and
+ * backfills a row that has no Stripe customer yet. The idempotency key makes a
+ * double click create one Stripe customer, not two.
+ */
+export async function getOrCreateCustomer(user: { id: string; email: string; name: string | null }): Promise<CustomerRow & { stripeCustomerId: string }> {
+  const db = getDb();
+  let row: CustomerRow | undefined =
+    (await db.select().from(customers).where(eq(customers.userId, user.id)).get()) ??
+    (await db
+      .update(customers)
+      .set({ userId: user.id })
+      .where(and(eq(customers.email, user.email), isNull(customers.userId)))
+      .returning()
+      .get());
+  if (!row) {
+    row = await db
+      .insert(customers)
+      .values({ id: crypto.randomUUID(), name: user.name ?? user.email, email: user.email, userId: user.id, subscriptionStatus: "none", createdAt: new Date(), updatedAt: new Date() })
+      .onConflictDoNothing()
+      .returning()
+      .get();
+    row ??= await db.select().from(customers).where(eq(customers.userId, user.id)).get();
+    if (!row) throw new Error("Could not create the customer record.");
+  }
+  if (row.stripeCustomerId) return row as CustomerRow & { stripeCustomerId: string };
+
+  const stripeCustomer = await createStripe().customers.create(
+    { email: user.email, name: user.name ?? undefined, metadata: { flareCustomerId: row.id } },
+    { idempotencyKey: \`flare-customer-\${row.id}\` },
+  );
+  const linked = await db.update(customers).set({ stripeCustomerId: stripeCustomer.id, updatedAt: new Date() }).where(eq(customers.id, row.id)).returning().get();
+  return linked as CustomerRow & { stripeCustomerId: string };
+}
+
+let portalConfiguration: string | undefined;
+
+/**
+ * The portal configuration \`flare billing:sync-plans\` maintains for this app (metadata flare_app),
+ * which allows switching between the synced plans. Undefined falls back to the
+ * account's default portal settings.
+ */
+export async function billingPortalConfiguration(stripe: Stripe): Promise<string | undefined> {
+  if (portalConfiguration) return portalConfiguration;
+  for await (const configuration of stripe.billingPortal.configurations.list({ active: true, limit: 100 })) {
+    if (configuration.metadata?.flare_app === FLARE_APP) return (portalConfiguration = configuration.id);
+  }
+  return undefined;
+}
+
+function idOf(value: string | { id: string } | null | undefined): string | null {
+  if (!value) return null;
+  return typeof value === "string" ? value : value.id;
+}
+
+/**
+ * Write a subscription's CURRENT state to its Customer. Every event re-fetches the
+ * subscription from Stripe instead of trusting the event payload, so duplicate and
+ * out-of-order deliveries all converge on the same, latest state.
+ */
+export async function syncSubscription(subscriptionId: string): Promise<void> {
+  const subscription = await createStripe().subscriptions.retrieve(subscriptionId);
+  const db = getDb();
+  const customer = await db.select().from(customers).where(eq(customers.stripeCustomerId, idOf(subscription.customer) ?? "")).get();
+  if (!customer) return;
+  if (!shouldApplySubscription(customer, subscription)) return;
+
+  const state = subscriptionState(subscription);
+  const plan = state.priceId ? await db.select({ id: plans.id }).from(plans).where(eq(plans.stripePriceId, state.priceId)).get() : undefined;
+  await db
+    .update(customers)
+    .set({
+      stripeSubscriptionId: state.stripeSubscriptionId,
+      subscriptionStatus: state.subscriptionStatus,
+      // datetime fields are stored as ISO text.
+      subscriptionEndsAt: state.subscriptionEndsAt?.toISOString() ?? null,
+      cancelAtPeriodEnd: state.cancelAtPeriodEnd,
+      planId: plan?.id ?? null,
+      updatedAt: new Date(),
+    })
+    .where(eq(customers.id, customer.id));
+}
+
+/**
+ * A Checkout Session finished. Subscriptions sync from Stripe; one-time payments
+ * record a Purchase, marked paid only once the money has settled.
+ */
+export async function syncCheckoutSession(sessionId: string): Promise<void> {
+  const session = await createStripe().checkout.sessions.retrieve(sessionId, { expand: ["line_items"] });
+  if (session.mode === "subscription") {
+    const subscriptionId = idOf(session.subscription);
+    if (subscriptionId) await syncSubscription(subscriptionId);
+    return;
+  }
+  if (session.mode !== "payment") return;
+
+  const db = getDb();
+  const customer = await db.select().from(customers).where(eq(customers.stripeCustomerId, idOf(session.customer) ?? "")).get();
+  if (!customer) return;
+  const priceId = session.line_items?.data?.[0]?.price?.id ?? null;
+  const plan = priceId ? await db.select({ id: plans.id }).from(plans).where(eq(plans.stripePriceId, priceId)).get() : undefined;
+  const status = checkoutPaid(session) ? "paid" : session.status === "expired" ? "failed" : "pending";
+  await db
+    .insert(purchases)
+    .values({
+      id: crypto.randomUUID(),
+      customerId: customer.id,
+      planId: plan?.id ?? null,
+      stripeCheckoutSessionId: session.id,
+      amount: session.amount_total ?? 0,
+      currency: session.currency ?? "usd",
+      status,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    })
+    .onConflictDoUpdate({ target: purchases.stripeCheckoutSessionId, set: { status, updatedAt: new Date() } });
+}
+
+/** A delayed one-time payment failed after the session completed. */
+export async function failCheckoutSession(sessionId: string): Promise<void> {
+  await getDb().update(purchases).set({ status: "failed", updatedAt: new Date() }).where(eq(purchases.stripeCheckoutSessionId, sessionId));
+}
+
+/** The subscription an invoice belongs to (its location moved in API 2025-03-31). */
+export function invoiceSubscriptionId(invoice: Stripe.Invoice): string | null {
+  const legacy = (invoice as unknown as { subscription?: string | { id: string } | null }).subscription;
+  return idOf(invoice.parent?.subscription_details?.subscription ?? legacy ?? null);
+}
+`;
+var renderLibBilling = () => `import { asc, desc, eq } from "drizzle-orm";
+import { grantsAccess, isLiveSubscription, type SubscriptionStatus } from "@flaredev/core";
+import { getDb } from "@/db";
+import { customers, plans, purchases } from "@/db/schema";
+
+export interface BillingSnapshot {
+  status: SubscriptionStatus;
+  /** Has a subscription that must be changed through the portal, not bought again. */
+  live: boolean;
+  /** Paid features should be on. */
+  access: boolean;
+  planId: string | null;
+  endsAt: Date | null;
+  cancelAtPeriodEnd: boolean;
+}
+
+/** The subscription state of a user's Customer row. */
+export async function billingSnapshot(userId: string): Promise<BillingSnapshot> {
+  const customer = await getDb().select().from(customers).where(eq(customers.userId, userId)).get();
+  const status = (customer?.subscriptionStatus ?? "none") as SubscriptionStatus;
+  return {
+    status,
+    live: isLiveSubscription(status),
+    access: grantsAccess(status),
+    planId: customer?.planId ?? null,
+    endsAt: customer?.subscriptionEndsAt ? new Date(customer.subscriptionEndsAt) : null,
+    cancelAtPeriodEnd: customer?.cancelAtPeriodEnd ?? false,
+  };
+}
+
+/** Active plans, cheapest first: subscriptions (with an interval) and one-time products. */
+export async function availablePlans() {
+  const rows = await getDb()
+    .select({ id: plans.id, name: plans.name, slug: plans.slug, description: plans.description, amount: plans.amount, currency: plans.currency, interval: plans.interval, active: plans.active })
+    .from(plans)
+    .orderBy(asc(plans.sort), asc(plans.amount));
+  const active = rows.filter((plan) => plan.active !== false);
+  return { subscriptions: active.filter((plan) => plan.interval), oneTime: active.filter((plan) => !plan.interval) };
+}
+
+/** A user's one-time purchases, newest first. */
+export async function userPurchases(userId: string) {
+  const customer = await getDb().select({ id: customers.id }).from(customers).where(eq(customers.userId, userId)).get();
+  if (!customer) return [];
+  return getDb()
+    .select({ id: purchases.id, status: purchases.status, amount: purchases.amount, currency: purchases.currency, createdAt: purchases.createdAt, plan: plans.name })
+    .from(purchases)
+    .leftJoin(plans, eq(purchases.planId, plans.id))
+    .where(eq(purchases.customerId, customer.id))
+    .orderBy(desc(purchases.createdAt));
+}
+`;
+var renderCheckoutRoute = () => `import { NextRequest, NextResponse } from "next/server";
+import { eq } from "drizzle-orm";
+import { isLiveSubscription, randomLetters } from "@flaredev/core";
+import { getDb } from "@/db";
+import { plans } from "@/db/schema";
+import { getSession } from "@/lib/session";
+import { appOrigin, createStripe, getOrCreateCustomer } from "@/lib/stripe";
+
+/**
+ * POST { planSlug }. The plan decides the mode: a recurring price starts a
+ * subscription, a one-time price a payment. Prices only ever come from the Plan
+ * table, so a client can't pay for an arbitrary price. A customer who already has
+ * a subscription changes plans through the portal instead of buying a second one.
+ */
+export async function POST(request: NextRequest) {
+  const raw = await request.text();
+  const session = await getSession();
+  if (!session) return NextResponse.json({ error: "Sign in to check out." }, { status: 401 });
+
+  let planSlug = "";
+  try {
+    planSlug = String((JSON.parse(raw) as { planSlug?: unknown }).planSlug ?? "");
+  } catch {
+    return NextResponse.json({ error: "Send JSON like {\\"planSlug\\": \\"pro\\"}." }, { status: 400 });
+  }
+  const plan = planSlug ? await getDb().select().from(plans).where(eq(plans.slug, planSlug)).get() : undefined;
+  if (!plan || plan.active === false) return NextResponse.json({ error: "That plan isn't available." }, { status: 404 });
+
+  const mode = plan.interval ? "subscription" : "payment";
+  const customer = await getOrCreateCustomer(session.user);
+  if (mode === "subscription" && isLiveSubscription(customer.subscriptionStatus)) {
+    return NextResponse.json({ error: "You already have a subscription. Change plans from the billing page." }, { status: 409 });
+  }
+
+  const base = appOrigin(request);
+  const checkout = await createStripe().checkout.sessions.create({
+    mode,
+    line_items: [{ price: plan.stripePriceId, quantity: 1 }],
+    customer: customer.stripeCustomerId,
+    client_reference_id: customer.id,
+    integration_identifier: \`flare-billing-\${randomLetters()}\`,
+    success_url: \`\${base}/dashboard/billing?checkout=success&session_id={CHECKOUT_SESSION_ID}\`,
+    cancel_url: \`\${base}/dashboard/billing?checkout=cancelled\`,
+  });
+  if (!checkout.url) return NextResponse.json({ error: "Stripe did not return a checkout URL." }, { status: 502 });
+  return NextResponse.json({ url: checkout.url });
+}
+`;
+var renderPortalRoute = () => `import { NextRequest, NextResponse } from "next/server";
+import { eq } from "drizzle-orm";
+import { isLiveSubscription } from "@flaredev/core";
+import { getDb } from "@/db";
+import { plans } from "@/db/schema";
+import { getSession } from "@/lib/session";
+import { appOrigin, billingPortalConfiguration, createStripe, getOrCreateCustomer } from "@/lib/stripe";
+
+/**
+ * POST {} opens the portal (payment methods, invoices, cancel). POST { planSlug }
+ * opens its plan-change confirmation for that plan: Stripe shows the prorated
+ * amount and applies the change to the existing subscription, so switching plans
+ * never starts a second one.
+ */
+export async function POST(request: NextRequest) {
+  const raw = await request.text();
+  const session = await getSession();
+  if (!session) return NextResponse.json({ error: "Sign in to manage billing." }, { status: 401 });
+
+  let planSlug = "";
+  try {
+    planSlug = raw ? String((JSON.parse(raw) as { planSlug?: unknown }).planSlug ?? "") : "";
+  } catch {
+    return NextResponse.json({ error: "Send JSON like {\\"planSlug\\": \\"pro\\"}, or no body." }, { status: 400 });
+  }
+
+  const customer = await getOrCreateCustomer(session.user);
+  const stripe = createStripe();
+  const returnUrl = \`\${appOrigin(request)}/dashboard/billing\`;
+
+  const configuration = await billingPortalConfiguration(stripe);
+
+  if (!planSlug) {
+    const portal = await stripe.billingPortal.sessions.create({ customer: customer.stripeCustomerId, return_url: returnUrl, configuration });
+    return NextResponse.json({ url: portal.url });
+  }
+
+  const plan = await getDb().select().from(plans).where(eq(plans.slug, planSlug)).get();
+  if (!plan || plan.active === false || !plan.interval) return NextResponse.json({ error: "That plan isn't available." }, { status: 404 });
+  if (!customer.stripeSubscriptionId || !isLiveSubscription(customer.subscriptionStatus)) {
+    return NextResponse.json({ error: "You don't have a subscription to change yet. Subscribe first." }, { status: 409 });
+  }
+  const subscription = await stripe.subscriptions.retrieve(customer.stripeSubscriptionId);
+  const item = subscription.items.data[0];
+  if (!item) return NextResponse.json({ error: "The subscription has no items to change." }, { status: 409 });
+
+  const portal = await stripe.billingPortal.sessions.create({
+    customer: customer.stripeCustomerId,
+    return_url: returnUrl,
+    configuration,
+    flow_data: {
+      type: "subscription_update_confirm",
+      subscription_update_confirm: {
+        subscription: subscription.id,
+        items: [{ id: item.id, price: plan.stripePriceId, quantity: 1 }],
+      },
+      after_completion: { type: "redirect", redirect: { return_url: \`\${returnUrl}?changed=1\` } },
+    },
+  });
+  return NextResponse.json({ url: portal.url });
+}
+`;
+var renderWebhookRoute = () => `import { NextRequest, NextResponse } from "next/server";
+import Stripe from "stripe";
+import { createStripe, failCheckoutSession, invoiceSubscriptionId, stripeSecrets, syncCheckoutSession, syncSubscription } from "@/lib/stripe";
+
+/**
+ * Stripe calls this, so it has no session: the signature is the authentication.
+ * Point a webhook endpoint at /api/webhooks/stripe with these events:
+ *   checkout.session.completed, checkout.session.async_payment_succeeded,
+ *   checkout.session.async_payment_failed, customer.subscription.created,
+ *   customer.subscription.updated, customer.subscription.deleted,
+ *   customer.subscription.paused, customer.subscription.resumed,
+ *   invoice.paid, invoice.payment_failed
+ */
+export async function POST(request: NextRequest) {
+  // The raw body: the signature covers these exact bytes.
+  const payload = await request.text();
+  const { STRIPE_WEBHOOK_SECRET } = stripeSecrets();
+  if (!STRIPE_WEBHOOK_SECRET) {
+    return NextResponse.json({ error: "STRIPE_WEBHOOK_SECRET is not set." }, { status: 501 });
+  }
+  const signature = request.headers.get("stripe-signature");
+  if (!signature) return NextResponse.json({ error: "Missing stripe-signature header." }, { status: 400 });
+
+  let event: Stripe.Event;
+  try {
+    // Workers only offer async (SubtleCrypto) HMAC, so the async variant is required here.
+    event = await createStripe().webhooks.constructEventAsync(payload, signature, STRIPE_WEBHOOK_SECRET, undefined, Stripe.createSubtleCryptoProvider());
+  } catch {
+    return NextResponse.json({ error: "Invalid signature." }, { status: 400 });
+  }
+
+  // Each handler re-fetches the object from Stripe, so duplicates and
+  // out-of-order deliveries are harmless. A thrown error returns 500 and Stripe retries.
+  switch (event.type) {
+    case "checkout.session.completed":
+    case "checkout.session.async_payment_succeeded":
+      await syncCheckoutSession(event.data.object.id);
+      break;
+    case "checkout.session.async_payment_failed":
+      await failCheckoutSession(event.data.object.id);
+      break;
+    case "customer.subscription.created":
+    case "customer.subscription.updated":
+    case "customer.subscription.deleted":
+    case "customer.subscription.paused":
+    case "customer.subscription.resumed":
+      await syncSubscription(event.data.object.id);
+      break;
+    case "invoice.paid":
+    case "invoice.payment_failed": {
+      const subscriptionId = invoiceSubscriptionId(event.data.object);
+      if (subscriptionId) await syncSubscription(subscriptionId);
+      break;
+    }
+  }
+  return NextResponse.json({ received: true });
+}
+`;
+var renderBillingButton = () => `"use client";
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Spinner } from "@/components/ui/spinner";
+
+/**
+ * Starts a Stripe flow: Checkout (\`/api/billing/checkout\`) or the portal
+ * (\`/api/billing/portal\`), optionally for one plan. Errors show under the button.
+ */
+export function BillingButton({
+  endpoint,
+  planSlug,
+  variant = "default",
+  children,
+}: {
+  endpoint: "/api/billing/checkout" | "/api/billing/portal";
+  planSlug?: string;
+  variant?: "default" | "outline" | "secondary";
+  children: React.ReactNode;
+}) {
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function start() {
+    setBusy(true);
+    setError(null);
+    try {
+      const response = await fetch(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(planSlug ? { planSlug } : {}),
+      });
+      const data = (await response.json().catch(() => null)) as { url?: string; error?: string } | null;
+      if (!response.ok || !data?.url) {
+        setError(data?.error ?? "Stripe could not be reached. Try again in a moment.");
+        setBusy(false);
+        return;
+      }
+      window.location.assign(data.url);
+    } catch {
+      setError("Stripe could not be reached. Try again in a moment.");
+      setBusy(false);
+    }
+  }
+
+  return (
+    <div className="flex flex-col items-start gap-2">
+      <Button onClick={start} disabled={busy} variant={variant}>
+        {busy && <Spinner data-icon="inline-start" />}
+        {children}
+      </Button>
+      {error && (
+        <p role="alert" className="text-sm text-destructive">
+          {error}
+        </p>
+      )}
+    </div>
+  );
+}
+`;
+var renderBillingPortalButton = () => `"use client";
+
+import { BillingButton } from "./billing-button";
+
+/** Opens the Stripe Customer Portal: payment methods, invoices, and cancellation. */
+export function BillingPortalButton({ children = "Manage billing" }: { children?: React.ReactNode }) {
+  return (
+    <BillingButton endpoint="/api/billing/portal" variant="outline">
+      {children}
+    </BillingButton>
+  );
+}
+`;
+var renderBillingPage = () => `import Link from "next/link";
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "@/components/ui/card";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { BillingButton } from "@/components/billing/billing-button";
+import { BillingPortalButton } from "@/components/billing/billing-portal-button";
+import { requireSession } from "@/lib/session";
+import { availablePlans, billingSnapshot, userPurchases } from "@/lib/billing";
+
+const STATUS: Record<string, { label: string; tone: "secondary" | "success" | "warning" | "danger" }> = {
+  none: { label: "No subscription", tone: "secondary" },
+  incomplete: { label: "Payment pending", tone: "warning" },
+  trialing: { label: "Trial", tone: "success" },
+  active: { label: "Active", tone: "success" },
+  past_due: { label: "Payment failed, retrying", tone: "warning" },
+  paused: { label: "Paused", tone: "secondary" },
+  canceled: { label: "Canceled", tone: "secondary" },
+  unpaid: { label: "Unpaid", tone: "danger" },
+};
+
+const money = (cents: number, currency: string) =>
+  new Intl.NumberFormat(undefined, { style: "currency", currency: currency.toUpperCase() }).format(cents / 100);
+const day = (date: Date) => new Intl.DateTimeFormat(undefined, { dateStyle: "medium" }).format(date);
+
+export default async function BillingPage({ searchParams }: { searchParams: Promise<Record<string, string | undefined>> }) {
+  const session = await requireSession("/dashboard/billing");
+  const [billing, { subscriptions, oneTime }, purchases, params] = await Promise.all([
+    billingSnapshot(session.user.id),
+    availablePlans(),
+    userPurchases(session.user.id),
+    searchParams,
+  ]);
+  const status = STATUS[billing.status] ?? STATUS.none!;
+  const current = subscriptions.find((plan) => billing.live && plan.id === billing.planId);
+
+  return (
+    <main className="mx-auto flex w-full max-w-3xl flex-col gap-8 px-4 py-10">
+      <div className="flex flex-wrap items-start justify-between gap-4">
+        <div className="flex flex-col gap-1">
+          <h1 className="text-2xl font-semibold">Billing</h1>
+          <p className="text-sm text-muted-foreground">
+            {current
+              ? billing.cancelAtPeriodEnd && billing.endsAt
+                ? \`\${current.name} ends on \${day(billing.endsAt)}.\`
+                : billing.endsAt
+                  ? \`\${current.name} renews on \${day(billing.endsAt)}.\`
+                  : \`You're on \${current.name}.\`
+              : "Choose a plan to get started."}
+          </p>
+        </div>
+        <div className="flex items-center gap-3">
+          <Badge variant={status.tone}>{status.label}</Badge>
+          {billing.live && <BillingPortalButton />}
+        </div>
+      </div>
+
+      {params.checkout === "success" && (
+        <Alert>
+          <AlertDescription>Payment received. Your plan updates here as soon as Stripe confirms it, usually within seconds.</AlertDescription>
+        </Alert>
+      )}
+
+      {subscriptions.length > 0 && (
+        <section className="flex flex-col gap-4">
+          <h2 className="text-sm font-medium">Plans</h2>
+          <div className="grid gap-4 sm:grid-cols-2">
+            {subscriptions.map((plan) => {
+              const isCurrent = plan.id === current?.id;
+              return (
+                <Card key={plan.id} className={isCurrent ? "border-primary" : undefined}>
+                  <CardHeader>
+                    <CardTitle>{plan.name}</CardTitle>
+                    <CardDescription>
+                      {money(plan.amount, plan.currency)} per {plan.interval}
+                    </CardDescription>
+                  </CardHeader>
+                  {plan.description && <CardContent className="text-sm text-muted-foreground">{plan.description}</CardContent>}
+                  <CardFooter>
+                    {isCurrent ? (
+                      <span className="text-sm text-muted-foreground">Your current plan</span>
+                    ) : billing.live ? (
+                      <BillingButton endpoint="/api/billing/portal" planSlug={plan.slug} variant="outline">
+                        Switch to {plan.name}
+                      </BillingButton>
+                    ) : (
+                      <BillingButton endpoint="/api/billing/checkout" planSlug={plan.slug}>
+                        Subscribe
+                      </BillingButton>
+                    )}
+                  </CardFooter>
+                </Card>
+              );
+            })}
+          </div>
+        </section>
+      )}
+
+      {oneTime.length > 0 && (
+        <section className="flex flex-col gap-4">
+          <h2 className="text-sm font-medium">Buy once</h2>
+          <div className="grid gap-4 sm:grid-cols-2">
+            {oneTime.map((plan) => (
+              <Card key={plan.id}>
+                <CardHeader>
+                  <CardTitle>{plan.name}</CardTitle>
+                  <CardDescription>{money(plan.amount, plan.currency)}, one-time</CardDescription>
+                </CardHeader>
+                {plan.description && <CardContent className="text-sm text-muted-foreground">{plan.description}</CardContent>}
+                <CardFooter>
+                  <BillingButton endpoint="/api/billing/checkout" planSlug={plan.slug} variant="outline">
+                    Buy {plan.name}
+                  </BillingButton>
+                </CardFooter>
+              </Card>
+            ))}
+          </div>
+        </section>
+      )}
+
+      {subscriptions.length === 0 && oneTime.length === 0 && (
+        <p className="text-sm text-muted-foreground">
+          No plans yet. Create products in Stripe, then run <code>flare billing:sync-plans</code>.
+        </p>
+      )}
+
+      {purchases.length > 0 && (
+        <section className="flex flex-col gap-2">
+          <h2 className="text-sm font-medium">Purchases</h2>
+          <ul className="flex flex-col divide-y rounded-lg border text-sm">
+            {purchases.map((purchase) => (
+              <li key={purchase.id} className="flex items-center justify-between gap-4 px-4 py-3">
+                <span className="truncate">{purchase.plan ?? "One-time purchase"}</span>
+                <span className="flex items-center gap-3 tabular-nums text-muted-foreground">
+                  {money(purchase.amount, purchase.currency)}
+                  <Badge variant={purchase.status === "paid" ? "success" : purchase.status === "failed" ? "danger" : "warning"}>
+                    {purchase.status === "paid" ? "Paid" : purchase.status === "failed" ? "Failed" : "Pending"}
+                  </Badge>
+                </span>
+              </li>
+            ))}
+          </ul>
+        </section>
+      )}
+
+      <Link href="/dashboard" className="text-sm text-muted-foreground underline underline-offset-4">
+        Back to the dashboard
+      </Link>
+    </main>
+  );
+}
+`;
+var billingDevVarsEntries = () => "STRIPE_SECRET_KEY=\nSTRIPE_WEBHOOK_SECRET=\n";
+var billingDevVarsExampleEntries = () => [
+  "",
+  "# Stripe. Use a restricted key (rk_test_ / rk_live_) with write access to",
+  "# Customers, Checkout Sessions and Customer portal, and read access to",
+  "# Subscriptions, Products and Prices. Test in a Stripe sandbox, never with live keys.",
+  "# Production: wrangler secret put STRIPE_SECRET_KEY",
+  "STRIPE_SECRET_KEY=",
+  "# billing:sync-plans imports Products whose metadata has flare_app=<this app's name>.",
+  "# The signing secret of the webhook endpoint pointing at <app URL>/api/webhooks/stripe.",
+  "# Locally: stripe listen --forward-to localhost:8787/api/webhooks/stripe prints one.",
+  "STRIPE_WEBHOOK_SECRET=",
+  ""
+].join("\n");
+
+// src/generator/load.ts
+import { existsSync as existsSync4, readdirSync as readdirSync3 } from "fs";
+import { join as join3, resolve as resolve3 } from "path";
+import { createJiti } from "jiti";
+async function loadResources(root) {
+  const appRoot = resolve3(root);
+  const dir = join3(appRoot, "resources");
+  if (!existsSync4(dir)) return [];
+  const jiti = createJiti(join3(appRoot, "package.json"), { moduleCache: false, fsCache: false });
+  const loaded = [];
+  for (const file of readdirSync3(dir).filter((name) => name.endsWith(".resource.ts")).sort()) {
+    const path = join3(dir, file);
+    const mod = await jiti.import(path);
+    const resource = mod.default;
+    if (!resource || typeof resource !== "object" || !("fields" in resource) || !("table" in resource)) {
+      throw new Error(`resources/${file} must \`export default defineResource({ ... })\`.`);
+    }
+    loaded.push({ resource, file: `resources/${file}`, stem: file.replace(/\.resource\.ts$/, "") });
+  }
+  const byName = /* @__PURE__ */ new Map();
+  for (const { resource, file } of loaded) {
+    if (byName.has(resource.name)) throw new Error(`Resource "${resource.name}" is defined twice: ${byName.get(resource.name)} and ${file}.`);
+    byName.set(resource.name, file);
+  }
+  return loaded;
+}
+
+// src/generator/migrations.ts
+import { spawn as spawn3 } from "child_process";
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
+
+// src/commands/run.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname4, join as join6, resolve as resolve4 } from "path";
+
+// src/commands/deploy.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+import { createZoneClient } from "@flaredev/core/security";
+import { createJiti as createJiti2 } from "jiti";
+import pc2 from "picocolors";
+
+// src/utils/wrangler.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
+import { parse as parseJsonc } from "jsonc-parser";
+function runWrangler(wranglerBin, args, cwd, options2 = {}) {
+  return new Promise((resolve6, reject) => {
+    const child = spawn(process.execPath, [wranglerBin, ...args], {
+      cwd,
+      stdio: [options2.stdin !== void 0 ? "pipe" : "ignore", options2.capture ? "pipe" : "inherit", options2.capture ? "pipe" : "inherit"]
+    });
+    let output = "";
+    child.stdout?.on("data", (chunk) => output += chunk);
+    child.stderr?.on("data", (chunk) => output += chunk);
+    if (options2.stdin !== void 0) child.stdin.end(options2.stdin);
+    child.on("error", reject);
+    child.on("exit", (code) => resolve6({ code: code ?? 1, output }));
+  });
+}
+function extractJson(output, open = "[") {
+  const close = open === "[" ? "]" : "}";
+  const start = output.indexOf(open);
+  const end = output.lastIndexOf(close);
+  if (start === -1 || end < start) throw new Error(`Expected JSON from wrangler, got:
+${output.trim()}`);
+  return JSON.parse(output.slice(start, end + 1));
+}
+function readD1Databases(appRoot) {
+  const path = join4(appRoot, "wrangler.jsonc");
+  if (!existsSync5(path)) return [];
+  const config = parseJsonc(readFileSync3(path, "utf8"));
+  return (config?.d1_databases ?? []).filter((db) => db.binding && db.database_name);
+}
+
+// src/commands/deploy.ts
+var REQUIRED_SECRET = "BETTER_AUTH_SECRET";
+var MISSING_DATABASE = /Couldn't find a D1 DB/i;
+function parseDeployArgs(args) {
+  const forwarded = [];
+  let skipMigrations = false;
+  let skipSecrets = false;
+  let skipSecurity = false;
+  let env;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--skip-migrations") skipMigrations = true;
+    else if (arg === "--skip-secrets") skipSecrets = true;
+    else if (arg === "--skip-security") skipSecurity = true;
+    else {
+      forwarded.push(arg);
+      if (arg === "--env" && args[i + 1]) env = args[i + 1];
+      else if (arg.startsWith("--env=")) env = arg.slice("--env=".length);
+      else if (arg === "--preview") env = "preview";
+    }
+  }
+  const passthroughOnly = forwarded.some((arg) => ["--dry-run", "--help", "-h"].includes(arg));
+  return { forwarded, skipMigrations, skipSecrets, skipSecurity, env, passthroughOnly };
+}
+function parseSecretNames(output) {
+  const start = output.indexOf("[");
+  const end = output.lastIndexOf("]");
+  if (start === -1 || end < start) throw new Error(`Unexpected output from wrangler secret list:
+${output}`);
+  return JSON.parse(output.slice(start, end + 1)).map((secret) => secret.name);
+}
+function declaredSecretNames(devVarsExample) {
+  return devVarsExample.split(/\r?\n/).map((line) => /^([A-Z][A-Z0-9_]*)=/.exec(line.trim())?.[1]).filter((name) => Boolean(name));
+}
+async function loadSecurityConfig(appRoot) {
+  const path = join5(appRoot, "security.config.ts");
+  if (!existsSync6(path)) return null;
+  const jiti = createJiti2(join5(appRoot, "package.json"), { moduleCache: false, fsCache: false });
+  const mod = await jiti.import(path);
+  if (!mod.default) throw new Error("security.config.ts must `export default defineSecurity({ ... })`.");
+  return mod.default;
+}
+async function provisionZoneSecurity(appRoot, config, credentials, options2) {
+  const app = JSON.parse(readFileSync4(join5(appRoot, "package.json"), "utf8")).name ?? "app";
+  const zone = createZoneClient({ ...credentials, app, fetch: options2.fetch });
+  if (config.zone?.rateLimits) {
+    const result = await zone.syncRateLimits(config.zone.rateLimits);
+    options2.log(`  rate limiting: ${result.written} Flare rule(s), ${result.kept} other rule(s) kept`);
+  }
+  if (config.zone?.customRules) {
+    const result = await zone.syncCustomRules(config.zone.customRules);
+    options2.log(`  custom rules: ${result.written} Flare rule(s), ${result.kept} other rule(s) kept`);
+  }
+}
+async function runDeploy(args, context3) {
+  const plan = parseDeployArgs(args);
+  if (plan.passthroughOnly) return context3.deploy(plan.forwarded);
+  const { appRoot, wranglerBin } = context3;
+  const shellEnv = context3.env ?? process.env;
+  const log = context3.log ?? ((message) => console.log(message));
+  const envArgs = plan.env ? ["--env", plan.env] : [];
+  const step = (message) => log(`
+${pc2.bold(pc2.cyan("flare"))} ${message}`);
+  const databases = plan.skipMigrations ? [] : readD1Databases(appRoot).filter((db) => existsSync6(join5(appRoot, db.migrations_dir ?? "migrations")));
+  const migrateAfterDeploy = [];
+  const migrate2 = async (db) => {
+    step(`Applying migrations to ${db.database_name} (remote)`);
+    const result = await runWrangler(wranglerBin, ["d1", "migrations", "apply", db.binding, "--remote", ...envArgs], appRoot);
+    if (result.code !== 0) throw new Error(`Migrations failed for ${db.database_name}.`);
+  };
+  for (const db of databases) {
+    const info = await runWrangler(wranglerBin, ["d1", "info", db.database_name, "--json", ...envArgs], appRoot, {
+      capture: true
+    });
+    if (info.code === 0) {
+      await migrate2(db);
+    } else if (MISSING_DATABASE.test(info.output)) {
+      step(`${db.database_name} doesn't exist yet: wrangler will create it during deploy, then migrations run.`);
+      migrateAfterDeploy.push(db);
+    } else {
+      throw new Error(`Could not look up D1 database ${db.database_name}:
+${info.output.trim()}`);
+    }
+  }
+  step("Deploying");
+  const code = await context3.deploy(plan.forwarded);
+  if (code !== 0) return code;
+  for (const db of migrateAfterDeploy) await migrate2(db);
+  const security = plan.skipSecurity ? null : await loadSecurityConfig(appRoot);
+  const zoneId = shellEnv.FLARE_SECURITY_ZONE_ID;
+  const apiToken = shellEnv.FLARE_SECURITY_API_TOKEN;
+  if (security && zoneId && apiToken) {
+    step("Provisioning zone security rules");
+    await provisionZoneSecurity(appRoot, security, { zoneId, apiToken }, { log, fetch: context3.fetch });
+  } else if (security) {
+    step("Zone security rules skipped (Worker-layer protection is on). To add them, deploy with FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN set.");
+  }
+  if (!plan.skipSecrets) {
+    const listed = await runWrangler(wranglerBin, ["secret", "list", ...envArgs], appRoot, { capture: true });
+    if (listed.code !== 0) throw new Error(`wrangler secret list failed:
+${listed.output.trim()}`);
+    const existing = new Set(parseSecretNames(listed.output));
+    if (!existing.has(REQUIRED_SECRET)) {
+      step(`Generating ${REQUIRED_SECRET} for production`);
+      const put = await runWrangler(wranglerBin, ["secret", "put", REQUIRED_SECRET, ...envArgs], appRoot, {
+        capture: true,
+        stdin: randomBytes2(32).toString("base64")
+      });
+      if (put.code !== 0) throw new Error(`Uploading ${REQUIRED_SECRET} failed:
+${put.output.trim()}`);
+      existing.add(REQUIRED_SECRET);
+    }
+    if (security && zoneId && apiToken) {
+      for (const [name, value] of [["FLARE_SECURITY_ZONE_ID", zoneId], ["FLARE_SECURITY_API_TOKEN", apiToken]]) {
+        if (existing.has(name)) continue;
+        step(`Uploading ${name}`);
+        const put = await runWrangler(wranglerBin, ["secret", "put", name, ...envArgs], appRoot, { capture: true, stdin: value });
+        if (put.code !== 0) throw new Error(`Uploading ${name} failed:
+${put.output.trim()}`);
+        existing.add(name);
+      }
+    }
+    const examplePath = join5(appRoot, ".dev.vars.example");
+    const optional = existsSync6(examplePath) ? declaredSecretNames(readFileSync4(examplePath, "utf8")).filter((name) => !existing.has(name)) : [];
+    if (optional.length > 0) {
+      step("Optional secrets not set in production (features using them stay off):");
+      for (const name of optional) log(`  wrangler secret put ${name}${plan.env ? ` --env ${plan.env}` : ""}`);
+    }
+  }
+  return 0;
+}
+
+// src/commands/run.ts
+var DELEGATED_COMMANDS = {
+  dev: { description: "Start the vinext dev server", pkg: "vinext", bin: "vinext", args: ["dev"] },
+  build: { description: "Build for production (vinext build)", pkg: "vinext", bin: "vinext", args: ["build"] },
+  start: {
+    description: "Serve the production build locally in workerd (builds first if needed)",
+    pkg: "wrangler",
+    bin: "wrangler",
+    // --persist-to shares local D1/R2 state with `flare dev` and local migrations.
+    args: ["dev", "--config", "dist/server/wrangler.json", "--persist-to", ".wrangler/state"]
+  },
+  deploy: {
+    description: "Migrate D1, build and deploy to Cloudflare Workers (vinext-cloudflare deploy), then ensure secrets and push security.config.ts zone rules. Flags: --skip-migrations, --skip-secrets, --skip-security",
+    pkg: "@vinext/cloudflare",
+    bin: "vinext-cloudflare",
+    args: ["deploy", "--config", "dist/server/wrangler.json"]
+  }
+};
+function isDelegatedCommand(value) {
+  return value !== void 0 && Object.hasOwn(DELEGATED_COMMANDS, value);
+}
+function findAppRoot(cwd) {
+  let dir = resolve4(cwd);
+  while (dir) {
+    const root = findUp("package.json", dir);
+    if (!root) break;
+    const pkg = JSON.parse(readFileSync5(join6(root, "package.json"), "utf8"));
+    if (pkg.dependencies?.vinext || pkg.devDependencies?.vinext) return root;
+    const parent = dirname4(root);
+    dir = parent === root ? void 0 : parent;
+  }
+  throw new Error("Not inside a Flare app (no package.json depending on vinext found). Run this from your app directory.");
+}
+function resolveBin(appRoot, pkgName, binName) {
+  const pkgDir = findUp(join6("node_modules", pkgName, "package.json"), appRoot);
+  if (!pkgDir) {
+    throw new Error(`Cannot find ${pkgName} in ${appRoot}. Install dependencies first (e.g. pnpm install).`);
+  }
+  const manifestPath = join6(pkgDir, "node_modules", pkgName, "package.json");
+  const { bin } = JSON.parse(readFileSync5(manifestPath, "utf8"));
+  const relativeBin = typeof bin === "string" ? bin : bin?.[binName];
+  if (!relativeBin) throw new Error(`${pkgName} does not provide a "${binName}" executable.`);
+  return join6(dirname4(manifestPath), relativeBin);
+}
+function delegatedArgv(appRoot, command, forwarded) {
+  const spec = DELEGATED_COMMANDS[command];
+  return [resolveBin(appRoot, spec.pkg, spec.bin), ...spec.args, ...forwarded];
+}
+function runNode(argv, cwd) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn2(process.execPath, argv, { cwd, stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code, signal) => resolvePromise(code ?? (signal ? 1 : 0)));
+  });
+}
+async function runDelegated(command, forwarded, cwd = process.cwd()) {
+  const appRoot = findAppRoot(cwd);
+  const wantsHelp = forwarded.includes("--help") || forwarded.includes("-h");
+  if (command === "start" && !wantsHelp && !existsSync7(join6(appRoot, "dist/server/wrangler.json"))) {
+    console.log("No production build found; running `flare build` first.\n");
+    const code = await runNode(delegatedArgv(appRoot, "build", []), appRoot);
+    if (code !== 0) return code;
+  }
+  if (command === "deploy") {
+    return runDeploy(forwarded, {
+      appRoot,
+      wranglerBin: resolveBin(appRoot, "wrangler", "wrangler"),
+      deploy: (args) => runNode(delegatedArgv(appRoot, "deploy", args), appRoot)
+    });
+  }
+  return runNode(delegatedArgv(appRoot, command, forwarded), appRoot);
+}
+
+// src/generator/repair.ts
+var COPY = /INSERT INTO `__new_(\w+)`\(([^)]*)\) SELECT ([^;]*?) FROM `\1`;/g;
+var columnsOf = (list2) => list2.split(",").map((column) => column.trim().replace(/^"|"$/g, ""));
+function repairRebuildMigration(sql2, previousColumns) {
+  const changes = [];
+  let repaired = sql2.replace(COPY, (statement, table, insertList, selectList) => {
+    const existing = previousColumns[table];
+    if (!existing) return statement;
+    const insertColumns = columnsOf(insertList);
+    const selectColumns = columnsOf(selectList);
+    if (insertColumns.join() !== selectColumns.join()) return statement;
+    const kept = insertColumns.filter((column) => existing.includes(column));
+    if (kept.length === insertColumns.length) return statement;
+    const dropped = insertColumns.filter((column) => !kept.includes(column));
+    changes.push(`${table}: don't copy new column(s) ${dropped.join(", ")} from the old table`);
+    const list2 = kept.map((column) => `"${column}"`).join(", ");
+    return `INSERT INTO \`__new_${table}\`(${list2}) SELECT ${list2} FROM \`${table}\`;`;
+  });
+  if (/PRAGMA foreign_keys=OFF;/i.test(repaired)) {
+    repaired = repaired.replace(/PRAGMA foreign_keys=OFF;/gi, "PRAGMA defer_foreign_keys = on;").replace(/PRAGMA foreign_keys=ON;/gi, "PRAGMA defer_foreign_keys = off;");
+    changes.push("use PRAGMA defer_foreign_keys (D1) instead of PRAGMA foreign_keys");
+  }
+  return { sql: repaired, changes };
+}
+function snapshotColumns(snapshot) {
+  return Object.fromEntries(Object.entries(snapshot.tables ?? {}).map(([name, table]) => [name, Object.keys(table.columns ?? {})]));
+}
+
+// src/generator/migrations.ts
+var listSql = (dir) => existsSync8(dir) ? readdirSync4(dir).filter((file) => file.endsWith(".sql")) : [];
+async function generateSchemaMigration(appRoot, name, options2 = {}) {
+  const dir = join7(appRoot, "migrations");
+  const before = new Set(listSql(dir));
+  const bin = resolveBin(appRoot, "drizzle-kit", "drizzle-kit");
+  const { code, output } = await new Promise((resolve6, reject) => {
+    const args = ["generate", "--name", name, ...options2.custom ? ["--custom"] : []];
+    const child = spawn3(process.execPath, [bin, ...args], {
+      cwd: appRoot,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let text = "";
+    child.stdout.on("data", (chunk) => text += chunk);
+    child.stderr.on("data", (chunk) => text += chunk);
+    child.on("error", reject);
+    child.on("exit", (exitCode) => resolve6({ code: exitCode ?? 1, output: text }));
+  });
+  if (code !== 0) {
+    throw new Error(
+      `drizzle-kit generate failed:
+${output.trim()}
+
+If it asked whether a column was renamed, run \`pnpm exec drizzle-kit generate\` in a terminal to answer interactively.`
+    );
+  }
+  const created = listSql(dir).filter((file) => !before.has(file)).sort();
+  const repairs = [];
+  for (const file of created) {
+    const previous = previousSnapshot(dir, file);
+    if (!previous) continue;
+    const path = join7(dir, file);
+    const { sql: sql2, changes } = repairRebuildMigration(readFileSync6(path, "utf8"), snapshotColumns(previous));
+    if (changes.length) {
+      writeFileSync4(path, sql2);
+      repairs.push(...changes.map((change) => `${file}: ${change}`));
+    }
+  }
+  return { files: created.map((file) => `migrations/${file}`), output, repairs };
+}
+function previousSnapshot(dir, migrationFile) {
+  const prefix = /^(\d+)_/.exec(migrationFile)?.[1];
+  const metaDir = join7(dir, "meta");
+  if (!prefix || !existsSync8(metaDir)) return void 0;
+  const earlier = readdirSync4(metaDir).filter((file) => /^\d+_snapshot\.json$/.test(file) && file < `${prefix}_snapshot.json`).sort().pop();
+  return earlier ? JSON.parse(readFileSync6(join7(metaDir, earlier), "utf8")) : void 0;
+}
+
+// src/generator/plan.ts
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync6, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname5, join as join9 } from "path";
+import pc3 from "picocolors";
+
+// src/generator/policy.ts
+import { existsSync as existsSync9, readdirSync as readdirSync5 } from "fs";
+import { join as join8, resolve as resolve5 } from "path";
+import { camelCase as camelCase2, kebabCase as kebabCase2 } from "@flaredev/core";
+import { createJiti as createJiti3 } from "jiti";
+var policyPath = (name) => `policies/${kebabCase2(name)}.policy.ts`;
+var policyLocal = (stem) => `${camelCase2(stem)}Policy`;
+async function loadPolicies(root) {
+  const appRoot = resolve5(root);
+  const dir = join8(appRoot, "policies");
+  if (!existsSync9(dir)) return [];
+  const jiti = createJiti3(join8(appRoot, "package.json"), { moduleCache: false, fsCache: false });
+  const loaded = [];
+  for (const file of readdirSync5(dir).filter((name) => name.endsWith(".policy.ts")).sort()) {
+    const mod = await jiti.import(join8(dir, file));
+    const policy = mod.default;
+    if (!policy || typeof policy !== "object" || !("resource" in policy) || !Array.isArray(policy.read)) {
+      throw new Error(`policies/${file} must \`export default definePolicy({ ... })\`.`);
+    }
+    loaded.push({ policy, file: `policies/${file}`, stem: file.replace(/\.policy\.ts$/, "") });
+  }
+  return loaded;
+}
+function renderPolicyBlock(roles) {
+  const list2 = (values) => `[${values.map((value) => JSON.stringify(value)).join(", ")}]`;
+  return ["read", "create", "update", "delete"].map((action) => `${action}: ${list2(roles[action])},`).join("\n") + "\n";
+}
+function renderPolicy(resource, roles) {
+  const block = renderPolicyBlock(roles);
+  return joinMarkers({
+    before: `import { definePolicy } from "@flaredev/core";
+
+/**
+ * Who may do what with ${resource} records. Roles come from \`flare role:add\`;
+ * "*" means any signed-in user. The API layer and the admin UI both read this.
+ */
+export default definePolicy({
+  resource: ${JSON.stringify(resource)},
+`,
+    block,
+    after: `});
+`,
+    indent: "  ",
+    hash: hashBlock(block)
+  });
+}
+function renderPolicyRegistry(all) {
+  if (all.length === 0) return "export const policies = {} as const;\n";
+  const sorted = [...all].sort((a, b) => a.policy.resource.localeCompare(b.policy.resource));
+  return [
+    ...sorted.map(({ stem }) => `import ${policyLocal(stem)} from "./${stem}.policy";`),
+    "",
+    "export const policies = {",
+    ...sorted.map(({ policy, stem }) => `  ${policy.resource}: ${policyLocal(stem)},`),
+    "} as const;",
+    ""
+  ].join("\n");
+}
+
+// src/generator/render.ts
+import { camelCase as camelCase3, columnName, relationGraph, storedFields } from "@flaredev/core";
+var resourceLocal = (stem) => `${camelCase3(stem)}Resource`;
+var tableExport = (resource) => camelCase3(resource.table);
+var q = (value) => JSON.stringify(value);
+var sqlString = (value) => `'${value.replace(/'/g, "''")}'`;
+var TIMESTAMP_DEFAULT = "sql`(cast(unixepoch('subsecond') * 1000 as integer))`";
+function columnExpression(key, def, resources, selfName) {
+  const col = q(columnName(key));
+  let expr;
+  switch (def.kind) {
+    case "int":
+      expr = `integer(${col})`;
+      break;
+    case "float":
+      expr = `real(${col})`;
+      break;
+    case "boolean":
+      expr = `integer(${col}, { mode: "boolean" })`;
+      break;
+    case "enum":
+      expr = `text(${col}, { enum: ${q(def.options)} })`;
+      break;
+    case "belongsTo": {
+      const target = resources.get(def.target);
+      if (!target) {
+        throw new Error(`${selfName}.${key} belongs to "${def.target}", but there is no ${def.target} resource. Generate it first.`);
+      }
+      const onDelete = def.onDelete ?? "restrict";
+      expr = `text(${col}).references(() => ${tableExport(target)}.id, { onDelete: ${q(onDelete)} })`;
+      break;
+    }
+    default:
+      expr = `text(${col})`;
+  }
+  if (def.required) expr += ".notNull()";
+  if (def.unique) expr += ".unique()";
+  if ("default" in def && def.default !== void 0) expr += `.default(${q(def.default)})`;
+  return expr;
+}
+function renderTableModule(entry, all) {
+  const { resource } = entry;
+  const resources = new Map(all.map((item) => [item.resource.name, item.resource]));
+  const fields = storedFields(resource);
+  const name = tableExport(resource);
+  const columns = fields.map(([key, def]) => `    ${key}: ${columnExpression(key, def, resources, resource.name)},`);
+  const extras = [];
+  for (const [key, def] of fields) {
+    if (def.kind === "enum") {
+      const options2 = def.options.map(sqlString).join(", ");
+      extras.push(`    check(${q(`${resource.table}_${columnName(key)}_check`)}, sql\`\${table.${key}} in (${options2})\`),`);
+    }
+    if (def.kind === "belongsTo") extras.push(`    index(${q(`${resource.table}_${columnName(key)}_idx`)}).on(table.${key}),`);
+  }
+  const targets = [...new Set(fields.flatMap(([, def]) => def.kind === "belongsTo" ? [resources.get(def.target)] : []))].filter((target) => target.name !== resource.name).sort((a, b) => a.table.localeCompare(b.table));
+  const coreImports = ["integer", "sqliteTable", "text"];
+  if (fields.some(([, def]) => def.kind === "float")) coreImports.push("real");
+  if (extras.some((line) => line.includes("check("))) coreImports.push("check");
+  if (extras.some((line) => line.includes("index("))) coreImports.push("index");
+  const selfReference = fields.some(([, def]) => def.kind === "belongsTo" && def.target === resource.name);
+  return [
+    `import { sql } from "drizzle-orm";`,
+    `import { ${coreImports.sort().join(", ")} } from "drizzle-orm/sqlite-core";`,
+    ...selfReference ? [`import type { AnySQLiteColumn } from "drizzle-orm/sqlite-core";`] : [],
+    ...targets.map((target) => `import { ${tableExport(target)} } from "./${target.table}";`),
+    "",
+    `export const ${name} = sqliteTable(`,
+    `  ${q(resource.table)},`,
+    "  {",
+    `    id: text("id").primaryKey().$defaultFn(() => crypto.randomUUID()),`,
+    ...columns.map(
+      (line) => selfReference ? line.replace(`() => ${name}.id`, `(): AnySQLiteColumn => ${name}.id`) : line
+    ),
+    `    createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull().default(${TIMESTAMP_DEFAULT}),`,
+    `    updatedAt: integer("updated_at", { mode: "timestamp_ms" })`,
+    `      .notNull()`,
+    `      .default(${TIMESTAMP_DEFAULT})`,
+    `      .$onUpdate(() => new Date()),`,
+    "  },",
+    ...extras.length ? ["  (table) => [", ...extras, "  ],"] : [],
+    ");",
+    ""
+  ].join("\n");
+}
+function renderSchemaIndex(all) {
+  if (all.length === 0) return "";
+  const tables = all.map(({ resource }) => resource.table).sort().map((table) => `export * from "./schema/${table}";
+`).join("");
+  return `${tables}export * from "./relations";
+`;
+}
+function renderRelations(all) {
+  const resources = all.map(({ resource }) => resource);
+  const byName = new Map(resources.map((resource) => [resource.name, resource]));
+  const graph = relationGraph(resources);
+  const blocks = [];
+  const used = /* @__PURE__ */ new Set();
+  for (const resource of [...resources].sort((a, b) => a.table.localeCompare(b.table))) {
+    const { belongsTo, hasMany } = graph.byResource[resource.name];
+    if (belongsTo.length === 0 && hasMany.length === 0) continue;
+    const self = tableExport(resource);
+    used.add(resource);
+    const lines = [
+      ...belongsTo.map((relation) => {
+        const target = byName.get(relation.target);
+        used.add(target);
+        const other = tableExport(target);
+        return `  ${relation.name}: one(${other}, { fields: [${self}.${relation.key}], references: [${other}.id], relationName: ${q(relation.relationName)} }),`;
+      }),
+      ...hasMany.map((relation) => {
+        const target = byName.get(relation.target);
+        used.add(target);
+        return `  ${relation.key}: many(${tableExport(target)}, { relationName: ${q(relation.relationName)} }),`;
+      })
+    ];
+    const helpers = [belongsTo.length ? "one" : "", hasMany.length ? "many" : ""].filter(Boolean).join(", ");
+    blocks.push(`export const ${self}Relations = relations(${self}, ({ ${helpers} }) => ({
+${lines.join("\n")}
+}));
+`);
+  }
+  if (blocks.length === 0) return "export {};\n";
+  const imports = [...used].sort((a, b) => a.table.localeCompare(b.table)).map((resource) => `import { ${tableExport(resource)} } from "./schema/${resource.table}";`);
+  return [`import { relations } from "drizzle-orm";`, ...imports, "", blocks.join("\n")].join("\n");
+}
+var handlerImports = (entry) => [
+  `import { createResourceHandlers } from "@flaredev/core/server";`,
+  `import { getDb } from "@/db";`,
+  `import { ${tableExport(entry.resource)} } from "@/db/schema";`,
+  `import { authorize } from "@/lib/api";`,
+  `import { revalidateResource } from "@/lib/cache";`,
+  `import ${resourceLocal(entry.stem)} from "@/resources/${entry.stem}.resource";`,
+  "",
+  `const handlers = createResourceHandlers({`,
+  `  resource: ${resourceLocal(entry.stem)},`,
+  `  table: ${tableExport(entry.resource)},`,
+  `  getDb,`,
+  `  authorize,`,
+  `  onChange: revalidateResource,`,
+  `});`,
+  ""
+];
+function renderCollectionRoute(entry) {
+  return [...handlerImports(entry), "export const GET = handlers.collection.GET;", "export const POST = handlers.collection.POST;", ""].join(
+    "\n"
+  );
+}
+function renderItemRoute(entry) {
+  return [
+    ...handlerImports(entry),
+    "export const GET = handlers.item.GET;",
+    "export const PATCH = handlers.item.PATCH;",
+    "export const PUT = handlers.item.PUT;",
+    "export const DELETE = handlers.item.DELETE;",
+    ""
+  ].join("\n");
+}
+var adminImports = (entry) => [
+  `import ${resourceLocal(entry.stem)} from "@/resources/${entry.stem}.resource";`
+];
+function renderAdminListPage(entry) {
+  const local = resourceLocal(entry.stem);
+  return [
+    `import { ResourceTable } from "@/components/admin/resource-table";`,
+    `import type { SearchParams } from "@/components/admin/query";`,
+    ...adminImports(entry),
+    "",
+    `export default async function ${entry.resource.name}ListPage({ searchParams }: { searchParams: Promise<SearchParams> }) {`,
+    "  return (",
+    `    <div className="flex flex-col gap-6">`,
+    `      <h1 className="text-2xl font-semibold">{${local}.pluralLabel}</h1>`,
+    `      <ResourceTable resource={${local}} searchParams={await searchParams} />`,
+    "    </div>",
+    "  );",
+    "}",
+    ""
+  ].join("\n");
+}
+function renderAdminNewPage(entry) {
+  return [
+    `import { ResourceFormPage } from "@/components/admin/resource-form-page";`,
+    ...adminImports(entry),
+    "",
+    `export default function New${entry.resource.name}Page() {`,
+    `  return <ResourceFormPage resource={${resourceLocal(entry.stem)}} />;`,
+    "}",
+    ""
+  ].join("\n");
+}
+function renderAdminEditPage(entry) {
+  return [
+    `import { ResourceFormPage } from "@/components/admin/resource-form-page";`,
+    ...adminImports(entry),
+    "",
+    `export default async function Edit${entry.resource.name}Page({ params }: { params: Promise<{ id: string }> }) {`,
+    `  return <ResourceFormPage resource={${resourceLocal(entry.stem)}} id={(await params).id} />;`,
+    "}",
+    ""
+  ].join("\n");
+}
+function renderClient(entry) {
+  const { resource, stem } = entry;
+  const local = resourceLocal(stem);
+  return [
+    `import { createResourceClient } from "@flaredev/core/client";`,
+    `import type ${local} from "./${stem}.resource";`,
+    "",
+    `export const ${camelCase3(stem)}Client = createResourceClient<typeof ${local}>(${q(`/api/${resource.slug}`)});`,
+    "",
+    `export type ${resource.name} = typeof ${local}.$types.record;`,
+    `export type ${resource.name}Create = typeof ${local}.$types.create;`,
+    `export type ${resource.name}Update = typeof ${local}.$types.update;`,
+    ""
+  ].join("\n");
+}
+function renderValidators(entry) {
+  const local = resourceLocal(entry.stem);
+  return [
+    `import { createValidators } from "@flaredev/core";`,
+    `import ${local} from "./${entry.stem}.resource";`,
+    "",
+    `export const ${camelCase3(entry.stem)}Validators = createValidators(${local});`,
+    ""
+  ].join("\n");
+}
+function renderRegistry(all) {
+  if (all.length === 0) return "export const resources = [] as const;\n";
+  const locals = all.map(({ stem }) => ({ stem, local: resourceLocal(stem) }));
+  return [
+    ...locals.map(({ stem, local }) => `import ${local} from "./${stem}.resource";`),
+    "",
+    `export { ${locals.map(({ local }) => local).join(", ")} };`,
+    `export const resources = [${locals.map(({ local }) => local).join(", ")}] as const;`,
+    ""
+  ].join("\n");
+}
+function renderServerRegistry(all) {
+  if (all.length === 0) return "export const resourceTables = {} as const;\n";
+  const sorted = [...all].sort((a, b) => a.resource.name.localeCompare(b.resource.name));
+  return [
+    `import { ${sorted.map(({ resource }) => tableExport(resource)).join(", ")} } from "@/db/schema";`,
+    `import { ${sorted.map(({ stem }) => resourceLocal(stem)).join(", ")} } from "./index";`,
+    "",
+    "export const resourceTables = {",
+    ...sorted.map(({ resource, stem }) => `  ${resource.name}: { resource: ${resourceLocal(stem)}, table: ${tableExport(resource)} },`),
+    "} as const;",
+    "",
+    "export type ResourceName = keyof typeof resourceTables;",
+    ""
+  ].join("\n");
+}
+function resourceFiles(entry, all) {
+  const { resource, stem } = entry;
+  return [
+    { path: `db/schema/${resource.table}.ts`, content: renderTableModule(entry, all) },
+    { path: `app/api/${resource.slug}/route.ts`, content: renderCollectionRoute(entry) },
+    { path: `app/api/${resource.slug}/[id]/route.ts`, content: renderItemRoute(entry) },
+    { path: `resources/${stem}.client.ts`, content: renderClient(entry) },
+    { path: `resources/${stem}.validators.ts`, content: renderValidators(entry) },
+    { path: `app/admin/${resource.slug}/page.tsx`, content: renderAdminListPage(entry) },
+    { path: `app/admin/${resource.slug}/new/page.tsx`, content: renderAdminNewPage(entry) },
+    { path: `app/admin/${resource.slug}/[id]/edit/page.tsx`, content: renderAdminEditPage(entry) }
+  ];
+}
+
+// src/generator/plan.ts
+var resourceHeader = (name) => `// Generated by \`flare gen resource ${name}\`. Code inside the generated block is
+// rewritten on regeneration; add your own code outside it.
+`;
+var HEADER_PATTERN = /^\/\/ Generated by `flare gen resource (\w+)`/;
+function planFiles(all, policies) {
+  const files = [];
+  for (const entry of all) {
+    for (const file of resourceFiles(entry, all)) files.push({ ...file, header: resourceHeader(entry.resource.name) });
+  }
+  files.push(
+    { path: "db/relations.ts", content: renderRelations(all), header: "// Drizzle relations for every resource (maintained by flare gen).\n" },
+    { path: "resources/index.ts", content: renderRegistry(all), header: "// Registry of every resource descriptor (maintained by flare gen).\n" },
+    {
+      path: "resources/server.ts",
+      content: renderServerRegistry(all),
+      header: "// Server-only: resource name \u2192 descriptor and table (maintained by flare gen).\n"
+    },
+    { path: "db/schema.ts", content: renderSchemaIndex(all) }
+  );
+  if (policies) {
+    files.push({
+      path: "policies/index.ts",
+      content: renderPolicyRegistry(policies),
+      header: "// Registry of every resource policy (maintained by flare gen policy).\n"
+    });
+  }
+  return files;
+}
+function applyPlan(appRoot, plan, options2 = {}) {
+  return plan.map(({ path, content, header }) => {
+    const absolute = join9(appRoot, path);
+    const status = inspectGenerated(absolute, content);
+    if (status === "unmarked") return { path, status, outcome: "skipped-unmarked" };
+    if (status === "drift" && !options2.force) return { path, status, outcome: "skipped-drift" };
+    if (options2.dryRun) {
+      const outcome = status === "missing" ? "create" : status === "identical" ? "identical" : "update";
+      return { path, status, outcome };
+    }
+    try {
+      return { path, status, outcome: writeGenerated(absolute, content, { header, force: options2.force }) };
+    } catch (error) {
+      if (error instanceof DriftError) return { path, status: "drift", outcome: "skipped-drift" };
+      throw error;
+    }
+  });
+}
+function findOrphans(appRoot, all) {
+  const planned = new Set(planFiles(all).map((file) => file.path));
+  const candidates = [];
+  const list2 = (dir, match) => existsSync10(join9(appRoot, dir)) ? readdirSync6(join9(appRoot, dir)).filter(match).map((name) => `${dir}/${name}`) : [];
+  candidates.push(...list2("db/schema", (name) => name.endsWith(".ts")));
+  candidates.push(...list2("resources", (name) => /\.(client|validators)\.ts$/.test(name)));
+  for (const dir of list2("app/api", () => true)) {
+    for (const file of [`${dir}/route.ts`, `${dir}/[id]/route.ts`]) if (existsSync10(join9(appRoot, file))) candidates.push(file);
+  }
+  for (const dir of list2("app/admin", () => true)) {
+    for (const file of [`${dir}/page.tsx`, `${dir}/new/page.tsx`, `${dir}/[id]/edit/page.tsx`]) {
+      if (existsSync10(join9(appRoot, file))) candidates.push(file);
+    }
+  }
+  const orphans = [];
+  for (const path of candidates) {
+    const match = HEADER_PATTERN.exec(readFileSync7(join9(appRoot, path), "utf8"));
+    if (match && !planned.has(path)) orphans.push({ path, resource: match[1] });
+  }
+  return orphans;
+}
+function ensureSupportFiles(appRoot, log) {
+  for (const path of ["lib/api.ts", "lib/cache.ts"]) {
+    const target = join9(appRoot, path);
+    if (existsSync10(target)) continue;
+    mkdirSync3(dirname5(target), { recursive: true });
+    copyFileSync(join9(templatesDir, "app", path), target);
+    log(`${pc3.green("create".padEnd(9))} ${path}`);
+  }
+}
+function logResults(results, log, options2 = {}) {
+  for (const { path, outcome } of results) {
+    if (outcome === "identical" && !options2.showIdentical) continue;
+    const label = outcome === "create" ? pc3.green("create") : outcome === "update" ? pc3.yellow("update") : outcome === "identical" ? pc3.dim("identical") : pc3.red(outcome === "skipped-drift" ? "drift" : "hand-written");
+    log(`${label.padEnd(18)} ${path}`);
+  }
+}
+
+// src/commands/gen-billing.ts
+var STRIPE_DEP = "22.6.0";
+function billingFiles(appName) {
+  return [
+    { path: "lib/stripe.ts", content: renderLibStripe(appName) },
+    { path: "lib/billing.ts", content: renderLibBilling() },
+    { path: "app/api/billing/checkout/route.ts", content: renderCheckoutRoute() },
+    { path: "app/api/billing/portal/route.ts", content: renderPortalRoute() },
+    { path: "app/api/webhooks/stripe/route.ts", content: renderWebhookRoute() },
+    { path: "components/billing/billing-button.tsx", content: renderBillingButton() },
+    { path: "components/billing/billing-portal-button.tsx", content: renderBillingPortalButton() },
+    { path: "app/dashboard/billing/page.tsx", content: renderBillingPage() }
+  ];
+}
+var RETIRED_FILES = ["app/api/billing/status/route.ts", "components/billing/subscribe-button.tsx"];
+function appendVars(appRoot, target) {
+  const path = join10(appRoot, target);
+  const text = existsSync11(path) ? readFileSync8(path, "utf8") : "";
+  if (/STRIPE_SECRET_KEY/.test(text)) return false;
+  appendFileSync2(path, target === ".dev.vars" ? billingDevVarsEntries() : billingDevVarsExampleEntries());
+  return true;
+}
+function addStripeDependency(appRoot) {
+  const path = join10(appRoot, "package.json");
+  const pkg = JSON.parse(readFileSync8(path, "utf8"));
+  pkg.dependencies ??= {};
+  if (pkg.dependencies.stripe) return false;
+  pkg.dependencies.stripe = STRIPE_DEP;
+  writeJson(path, pkg);
+  return true;
+}
+function writeBillingResource(appRoot, name, force, log) {
+  const relative2 = descriptorPath(name);
+  const path = join10(appRoot, relative2);
+  if (!existsSync11(path)) {
+    mkdirSync4(dirname6(path), { recursive: true });
+    writeFileSync5(path, renderBillingDescriptor(name));
+    log(`${pc4.green("create".padEnd(9))} ${relative2}`);
+    return;
+  }
+  const parts = splitMarkers(readFileSync8(path, "utf8"));
+  if (!parts) throw new Error(`${relative2} has no generated fields block, so the billing fields can't be merged. Add them by hand: ${BILLING_RESOURCES[name]}`);
+  const merged = mergeBillingFields(name, parts.block);
+  if (!merged) {
+    log(`${pc4.dim("identical".padEnd(9))} ${relative2} (has every billing field)`);
+    return;
+  }
+  try {
+    writeGenerated(path, merged, { force });
+  } catch (error) {
+    if (error instanceof DriftError) {
+      throw new Error(`${relative2}: its fields block was edited by hand, so the billing fields weren't merged. Pass --force, or add them yourself: ${BILLING_RESOURCES[name]}`);
+    }
+    throw error;
+  }
+  log(`${pc4.yellow("update".padEnd(9))} ${relative2} (added billing fields, kept yours)`);
+}
+async function genBilling(options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  validateBillingOptions(options2.provider, options2.mode);
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  for (const name of ["Plan", "Customer", "Purchase"]) writeBillingResource(appRoot, name, options2.force, log);
+  for (const [name, roles] of Object.entries(BILLING_POLICIES)) {
+    const relative2 = policyPath(name);
+    if (existsSync11(join10(appRoot, relative2))) {
+      log(`${pc4.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+      continue;
+    }
+    mkdirSync4(join10(appRoot, "policies"), { recursive: true });
+    writeFileSync5(join10(appRoot, relative2), renderPolicy(name, roles));
+    log(`${pc4.green("create".padEnd(9))} ${relative2}`);
+  }
+  const files = [];
+  const appName = JSON.parse(readFileSync8(join10(appRoot, "package.json"), "utf8")).name ?? "app";
+  for (const { path, content } of billingFiles(appName)) {
+    const outcome = writeGenerated(join10(appRoot, path), content, { header: billingHeader(), force: options2.force });
+    files.push({ path, status: "missing", outcome });
+    const label = outcome === "create" ? pc4.green("create") : outcome === "update" ? pc4.yellow("update") : pc4.dim("identical");
+    log(`${label.padEnd(18)} ${path}`);
+  }
+  for (const path of RETIRED_FILES) {
+    const absolute = join10(appRoot, path);
+    if (!existsSync11(absolute)) continue;
+    const parts = splitMarkers(readFileSync8(absolute, "utf8"));
+    const untouched = parts && parts.before.includes("flare gen billing") && !parts.after.trim() && parts.hash !== void 0 && hashBlock(parts.block) === parts.hash;
+    if (untouched) {
+      unlinkSync(absolute);
+      log(`${pc4.red("remove".padEnd(9))} ${path} (no longer generated)`);
+    } else {
+      log(pc4.yellow(`${path} is no longer generated but has your changes; remove it when you're done with it.`));
+    }
+  }
+  if (appendVars(appRoot, ".dev.vars.example")) log(`${pc4.green("append".padEnd(9))} .dev.vars.example`);
+  if (appendVars(appRoot, ".dev.vars")) log(`${pc4.green("append".padEnd(9))} .dev.vars`);
+  const addedStripe = addStripeDependency(appRoot);
+  if (addedStripe) log(`${pc4.yellow("update".padEnd(9))} package.json (stripe@${STRIPE_DEP})`);
+  if (!options2.skipInstall) {
+    const pm = detectPackageManager();
+    const code = run(pm, ["install"], appRoot);
+    if (code !== 0) throw new Error(`${pm} install failed (exit code ${code}).`);
+    run(pm, ["run", "cf-typegen"], appRoot);
+  }
+  const all = await loadResources(appRoot);
+  ensureSupportFiles(appRoot, log);
+  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log);
+  let migrations = [];
+  if (!options2.skipMigration) {
+    const result = await generateSchemaMigration(appRoot, "billing");
+    migrations = result.files;
+    for (const file of migrations) log(`${pc4.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc4.dim(`repaired  ${repair}`));
+  }
+  log(
+    [
+      "",
+      `Next:`,
+      `  1. Put a Stripe test key in .dev.vars (STRIPE_SECRET_KEY, ideally a restricted rk_test_ key).`,
+      `  2. ${pc4.bold("flare migrate")} to create the billing tables.`,
+      `  3. Create one Product per plan in Stripe with metadata flare_app=${appName}, then ${pc4.bold("flare billing:sync-plans")}.`,
+      `  4. ${pc4.bold("stripe listen --forward-to localhost:8787/api/webhooks/stripe")} and put its signing secret in STRIPE_WEBHOOK_SECRET.`,
+      `  5. ${pc4.bold("flare start")} and open ${pc4.bold("/dashboard/billing")}.`
+    ].join("\n")
+  );
+  return { files, migrations, addedStripe };
+}
+
+// src/commands/gen-security.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname7, join as join11 } from "path";
+import pc5 from "picocolors";
+
+// src/generator/security.ts
+import { applyEdits, modify, parse as parseJsonc2 } from "jsonc-parser";
+var SECURITY_EVENT_FIELDS = "kind:string, severity:enum(low,medium,high), ip:string, path:string, userAgent:text?, count:int, banned:boolean?, detail:text?";
+var renderSecurityDescriptor = () => renderDescriptor("SecurityEvent", parseFields(SECURITY_EVENT_FIELDS));
+var SECURITY_EVENT_POLICY = { read: ["admin", "staff"], create: ["admin"], update: ["admin"], delete: ["admin"] };
+var securityHeader = () => `// Generated by \`flare gen security\`. Code inside the generated block is
+// rewritten on regeneration; add your own code outside it.
+`;
+var renderSecurityConfig = () => `import { DEFAULT_DETECTORS, defineSecurity } from "@flaredev/core/security";
+
+/**
+ * What Flare watches for and blocks. The Worker layer applies this on every request
+ * (any plan, workers.dev included). The \`zone\` rules are pushed to your zone by
+ * \`flare deploy\` when FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN are set.
+ */
+export default defineSecurity({
+  // IPs never banned or rate-limited: your office, uptime monitors.
+  allow: [],
+
+  // Failed-login bursts, checkout abuse and API scraping. Each trip is logged as a
+  // SecurityEvent; detectors with \`ban\` also block the IP.
+  detectors: DEFAULT_DETECTORS,
+
+  // Worker-level rate limit for the API (limit and period are set on the
+  // FLARE_RATE_LIMIT binding in wrangler.jsonc).
+  rateLimit: { binding: "FLARE_RATE_LIMIT", paths: /^\\/api\\// },
+
+  zone: {
+    // The Free plan allows one rate-limiting rule, with a 10-second period.
+    rateLimits: [
+      {
+        name: "sign-in",
+        expression: 'http.request.uri.path eq "/api/auth/sign-in/email"',
+        requests: 10,
+        periodSeconds: 10,
+        mitigationSeconds: 10,
+      },
+    ],
+    customRules: [
+      {
+        name: "block-scanners",
+        expression:
+          '(http.request.uri.path contains "/wp-login.php") or (http.request.uri.path contains "/xmlrpc.php") or (http.request.uri.path contains "/.env") or (http.request.uri.path contains "/.git/")',
+        action: "block",
+      },
+    ],
+  },
+});
+`;
+var renderLibSecurity = (app) => `import { env as runtimeEnv } from "cloudflare:workers";
+import { createZoneClient } from "@flaredev/core/security";
+import { createSecurity, type BanStore, type MonitorNamespace, type RateLimiter, type Security } from "@flaredev/core/security/server";
+import { getDb } from "../db";
+import { securityEvents } from "../db/schema";
+import config from "../security.config";
+
+/** Minimal ExecutionContext surface worker/index.ts passes in. */
+export interface SecurityContext {
+  waitUntil(promise: Promise<unknown>): void;
+}
+
+interface SecurityEnv {
+  FLARE_SECURITY: BanStore;
+  FLARE_SECURITY_MONITOR: MonitorNamespace;
+  FLARE_RATE_LIMIT?: RateLimiter;
+  /** With both set (wrangler secrets), bans also become zone IP Access Rules. */
+  FLARE_SECURITY_ZONE_ID?: string;
+  FLARE_SECURITY_API_TOKEN?: string;
+}
+
+/** This app's tag on zone rules, so Flare only ever changes its own. */
+const APP = ${JSON.stringify(app)};
+
+const bindings = () => runtimeEnv as unknown as SecurityEnv;
+let instance: Security | undefined;
+
+/** The app's security layer, one per isolate. */
+export function security(): Security {
+  const env = bindings();
+  instance ??= createSecurity({
+    config,
+    bans: env.FLARE_SECURITY,
+    monitors: env.FLARE_SECURITY_MONITOR,
+    rateLimiter: env.FLARE_RATE_LIMIT,
+    zone: zoneClient(),
+    // Every tripped detector becomes a SecurityEvent row.
+    onTrip: (trip) =>
+      logSecurityEvent({
+        kind: trip.detector.name,
+        severity: trip.detector.severity ?? "medium",
+        ip: trip.ip,
+        path: trip.path,
+        userAgent: trip.userAgent,
+        count: trip.count,
+        banned: trip.banned,
+        detail: trip.detector.description ?? null,
+      }),
+  });
+  return instance;
+}
+
+/** The zone layer, when this app has a zone and a scoped API token configured. */
+export function zoneClient() {
+  const env = bindings();
+  return env.FLARE_SECURITY_ZONE_ID && env.FLARE_SECURITY_API_TOKEN
+    ? createZoneClient({ zoneId: env.FLARE_SECURITY_ZONE_ID, apiToken: env.FLARE_SECURITY_API_TOKEN, app: APP })
+    : null;
+}
+
+export async function logSecurityEvent(event: typeof securityEvents.$inferInsert): Promise<void> {
+  await getDb().insert(securityEvents).values(event);
+}
+
+/** Called by worker/index.ts for every request. */
+export function protect(request: Request, _env: unknown, ctx: SecurityContext, next: () => Promise<Response>): Promise<Response> {
+  return security().protect(request, ctx, next);
+}
+`;
+var renderSecurityActions = () => `"use server";
+
+import { revalidatePath } from "next/cache";
+import { can } from "@flaredev/core";
+import { isIp } from "@flaredev/core/security";
+import { adminSession, policyFor } from "@/lib/admin";
+import { logSecurityEvent, security } from "@/lib/security";
+
+/** On failure the submitted values come back, so the form (which React resets) keeps them. */
+export type BanResult = { ok: true } | { ok: false; error: string; ip?: string; reason?: string };
+
+const DURATIONS: Record<string, number | null> = { "1h": 3600, "24h": 86_400, "7d": 604_800, permanent: null };
+
+async function adminOnly(): Promise<{ email: string } | { error: string }> {
+  const { session, role } = await adminSession();
+  if (!session) return { error: "Sign in required." };
+  if (!can(policyFor("SecurityEvent"), role, "create")) return { error: "Only admins can ban or unban." };
+  return { email: session.user.email };
+}
+
+/** Ban an IP at every layer this app has (Worker, and the zone when configured). */
+export async function banAction(_previous: BanResult | null, form: FormData): Promise<BanResult> {
+  const admin = await adminOnly();
+  if ("error" in admin) return { ok: false, error: admin.error };
+  const ip = String(form.get("ip") ?? "").trim();
+  const reason = String(form.get("reason") ?? "").trim() || "Banned manually";
+  const duration = String(form.get("duration") ?? "24h");
+  if (!isIp(ip)) return { ok: false, error: \`"\${ip}" isn't an IP address.\`, ip, reason };
+  if (!(duration in DURATIONS)) return { ok: false, error: "Choose how long to ban for.", ip, reason };
+
+  try {
+    await security().ban(ip, \`\${reason} (by \${admin.email})\`, DURATIONS[duration]!, null);
+  } catch (error) {
+    return { ok: false, error: \`The ban didn't reach every layer: \${error instanceof Error ? error.message : String(error)}\`, ip, reason };
+  }
+  await logSecurityEvent({ kind: "manual-ban", severity: "medium", ip, path: "/admin/security", userAgent: null, count: 0, banned: true, detail: \`\${reason} (by \${admin.email})\` });
+  revalidatePath("/admin/security");
+  return { ok: true };
+}
+
+export async function unbanAction(ip: string): Promise<BanResult> {
+  const admin = await adminOnly();
+  if ("error" in admin) return { ok: false, error: admin.error };
+  if (!isIp(ip)) return { ok: false, error: \`"\${ip}" isn't an IP address.\` };
+  try {
+    await security().unban(ip);
+  } catch (error) {
+    return { ok: false, error: \`The unban didn't reach every layer: \${error instanceof Error ? error.message : String(error)}\` };
+  }
+  await logSecurityEvent({ kind: "manual-unban", severity: "low", ip, path: "/admin/security", userAgent: null, count: 0, banned: false, detail: \`by \${admin.email}\` });
+  revalidatePath("/admin/security");
+  return { ok: true };
+}
+`;
+var renderBanControls = () => `"use client";
+
+import { useActionState, useState, useTransition } from "react";
+import { toast } from "sonner";
+import { banAction, unbanAction, type BanResult } from "./actions";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Field, FieldDescription, FieldError, FieldGroup, FieldLabel } from "@/components/ui/field";
+import { Select, SelectContent, SelectGroup, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Spinner } from "@/components/ui/spinner";
+
+const DURATIONS = { "1h": "1 hour", "24h": "24 hours", "7d": "7 days", permanent: "Until unbanned" } as const;
+
+export function BanForm() {
+  const [state, action, pending] = useActionState<BanResult | null, FormData>(banAction, null);
+  const [duration, setDuration] = useState<keyof typeof DURATIONS>("24h");
+  return (
+    <form action={action}>
+      <FieldGroup className="gap-4">
+        <div className="grid gap-4 sm:grid-cols-[1fr_12rem_auto] sm:items-end">
+          <Field data-invalid={state && !state.ok ? true : undefined}>
+            <FieldLabel htmlFor="ban-ip">IP address</FieldLabel>
+            <Input id="ban-ip" name="ip" defaultValue={state && !state.ok ? state.ip : undefined} placeholder="203.0.113.7" required autoComplete="off" spellCheck={false} aria-invalid={state && !state.ok ? true : undefined} />
+          </Field>
+          <Field>
+            <FieldLabel htmlFor="ban-duration">For</FieldLabel>
+            <Select name="duration" value={duration} onValueChange={(value) => setDuration(value as keyof typeof DURATIONS)}>
+              <SelectTrigger id="ban-duration" className="w-full">
+                {/* Radix fills SelectValue only once the list has mounted; give it the label up front. */}
+                <SelectValue>{DURATIONS[duration]}</SelectValue>
+              </SelectTrigger>
+              <SelectContent>
+                <SelectGroup>
+                  {Object.entries(DURATIONS).map(([value, label]) => (
+                    <SelectItem key={value} value={value}>
+                      {label}
+                    </SelectItem>
+                  ))}
+                </SelectGroup>
+              </SelectContent>
+            </Select>
+          </Field>
+          <Button type="submit" disabled={pending}>
+            {pending && <Spinner data-icon="inline-start" />}
+            Ban IP
+          </Button>
+        </div>
+        <Field>
+          <FieldLabel htmlFor="ban-reason">Reason</FieldLabel>
+          <Input id="ban-reason" name="reason" defaultValue={state && !state.ok ? state.reason : undefined} placeholder="Credential stuffing from this address\u2026" autoComplete="off" />
+        </Field>
+        {state && !state.ok && <FieldError role="alert">{state.error}</FieldError>}
+        {state?.ok && (
+          <FieldDescription role="status">Banned.</FieldDescription>
+        )}
+      </FieldGroup>
+    </form>
+  );
+}
+
+export function UnbanButton({ ip }: { ip: string }) {
+  const [pending, start] = useTransition();
+  return (
+    <Button
+      variant="outline"
+      size="sm"
+      disabled={pending}
+      onClick={() =>
+        start(async () => {
+          const result = await unbanAction(ip);
+          if (result.ok) toast.success(\`Unbanned \${ip}.\`);
+          else toast.error(result.error);
+        })
+      }
+    >
+      {pending && <Spinner data-icon="inline-start" />}
+      Unban<span className="sr-only"> {ip}</span>
+    </Button>
+  );
+}
+`;
+var renderSecurityPage = () => `import Link from "next/link";
+import { can } from "@flaredev/core";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Separator } from "@/components/ui/separator";
+import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { adminStore, policyFor, requireAdmin } from "@/lib/admin";
+import { security, zoneClient } from "@/lib/security";
+import { BanForm, UnbanButton } from "./ban-controls";
+
+const TONE = { high: "danger", medium: "warning", low: "secondary" } as const;
+const when = (value: string | number | Date | null) =>
+  value ? new Intl.DateTimeFormat(undefined, { dateStyle: "medium", timeStyle: "short" }).format(new Date(value)) : "Until unbanned";
+
+export default async function SecurityPage() {
+  const { role } = await requireAdmin("/admin/security");
+  if (!can(policyFor("SecurityEvent"), role, "read")) {
+    return (
+      <Alert>
+        <AlertDescription>Your role can't view security activity.</AlertDescription>
+      </Alert>
+    );
+  }
+  const canBan = can(policyFor("SecurityEvent"), role, "create");
+  const zone = zoneClient();
+
+  const [bans, events, edge] = await Promise.all([
+    security().bans(),
+    adminStore("SecurityEvent").list(new URLSearchParams({ sort: "-createdAt", perPage: "20" })),
+    zone
+      ? Promise.all([zone.bans(), zone.firewallEvents(new Date(Date.now() - 24 * 3600 * 1000))]).then(
+          ([zoneBans, firewall]) => ({ ok: true as const, zoneBans, firewall }),
+          (error: unknown) => ({ ok: false as const, error: error instanceof Error ? error.message : String(error) }),
+        )
+      : Promise.resolve(null),
+  ]);
+  const recent = events.ok ? events.data.data : [];
+  const zoneIps = new Set(edge?.ok ? edge.zoneBans.map((ban) => ban.ip) : []);
+  const blockedTotal = bans.reduce((sum, ban) => sum + ban.blocked, 0);
+
+  return (
+    <div className="flex flex-col gap-6">
+      <div className="flex flex-wrap items-end justify-between gap-4">
+        <div className="flex flex-col gap-1">
+          <h1 className="text-2xl font-semibold">Security</h1>
+          <p className="text-sm text-muted-foreground">
+            Worker layer on{zone ? ", zone rules on" : "; zone rules off (set FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN)"}.
+          </p>
+        </div>
+      </div>
+
+      <div className="grid gap-4 sm:grid-cols-3">
+        <Card>
+          <CardHeader>
+            <CardDescription>Active bans</CardDescription>
+            <CardTitle className="text-3xl font-bold tabular-nums">{bans.length}</CardTitle>
+          </CardHeader>
+        </Card>
+        <Card>
+          <CardHeader>
+            <CardDescription>Requests blocked by bans</CardDescription>
+            <CardTitle className="text-3xl font-bold tabular-nums">{blockedTotal}</CardTitle>
+          </CardHeader>
+        </Card>
+        <Card>
+          <CardHeader>
+            <CardDescription>Zone firewall events, 24h</CardDescription>
+            <CardTitle className="text-3xl font-bold tabular-nums">
+              {edge?.ok ? edge.firewall.reduce((sum, row) => sum + row.count, 0) : "\u2014"}
+            </CardTitle>
+          </CardHeader>
+        </Card>
+      </div>
+
+      {edge && !edge.ok && (
+        <Alert>
+          <AlertDescription>The zone layer couldn't be read: {edge.error}</AlertDescription>
+        </Alert>
+      )}
+
+      <Card>
+        <CardHeader>
+          <CardTitle>Banned IPs</CardTitle>
+          <CardDescription>Refused before the app runs{zone ? ", and blocked at the zone edge" : ""}.</CardDescription>
+        </CardHeader>
+        <CardContent className="flex flex-col gap-6">
+          {bans.length === 0 ? (
+            <Empty className="border border-dashed">
+              <EmptyHeader>
+                <EmptyTitle>No active bans</EmptyTitle>
+                <EmptyDescription>IPs that trip a detector with a ban, or that you ban here, appear in this list.</EmptyDescription>
+              </EmptyHeader>
+            </Empty>
+          ) : (
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>IP</TableHead>
+                  <TableHead>Reason</TableHead>
+                  <TableHead>Blocked</TableHead>
+                  <TableHead>Until</TableHead>
+                  {canBan && <TableHead className="w-0" />}
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {bans.map((ban) => (
+                  <TableRow key={ban.ip}>
+                    <TableCell className="font-medium tabular-nums">
+                      <span className="flex items-center gap-2">
+                        {ban.ip}
+                        {zoneIps.has(ban.ip) && <Badge variant="secondary">zone</Badge>}
+                      </span>
+                    </TableCell>
+                    <TableCell className="max-w-80 truncate text-muted-foreground">{ban.reason}</TableCell>
+                    <TableCell className="tabular-nums">{ban.blocked}</TableCell>
+                    <TableCell className="text-muted-foreground">{when(ban.until)}</TableCell>
+                    {canBan && (
+                      <TableCell>
+                        <UnbanButton ip={ban.ip} />
+                      </TableCell>
+                    )}
+                  </TableRow>
+                ))}
+              </TableBody>
+            </Table>
+          )}
+          {canBan && (
+            <>
+              <Separator />
+              <BanForm />
+            </>
+          )}
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>Recent events</CardTitle>
+          <CardDescription>
+            Detectors that tripped, and manual bans. <Link href="/admin/security-events" className="underline underline-offset-4">All events</Link>
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          {recent.length === 0 ? (
+            <p className="text-sm text-muted-foreground">Nothing yet.</p>
+          ) : (
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>When</TableHead>
+                  <TableHead>Event</TableHead>
+                  <TableHead>IP</TableHead>
+                  <TableHead>Count</TableHead>
+                  <TableHead>Action</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {recent.map((event) => (
+                  <TableRow key={String(event.id)}>
+                    <TableCell className="text-muted-foreground">{when(event.createdAt as Date)}</TableCell>
+                    <TableCell>
+                      <span className="flex items-center gap-2">
+                        <Badge variant={TONE[event.severity as keyof typeof TONE] ?? "secondary"}>{String(event.severity)}</Badge>
+                        {String(event.kind)}
+                      </span>
+                    </TableCell>
+                    <TableCell className="tabular-nums">{String(event.ip)}</TableCell>
+                    <TableCell className="tabular-nums">{Number(event.count) || "\u2014"}</TableCell>
+                    <TableCell className="text-muted-foreground">{event.banned ? "Banned" : "Logged"}</TableCell>
+                  </TableRow>
+                ))}
+              </TableBody>
+            </Table>
+          )}
+        </CardContent>
+      </Card>
+
+      {edge?.ok && (
+        <Card>
+          <CardHeader>
+            <CardTitle>Zone firewall, last 24 hours</CardTitle>
+            <CardDescription>What Cloudflare's edge did before requests reached the Worker.</CardDescription>
+          </CardHeader>
+          <CardContent>
+            {edge.firewall.length === 0 ? (
+              <p className="text-sm text-muted-foreground">No firewall events.</p>
+            ) : (
+              <Table>
+                <TableHeader>
+                  <TableRow>
+                    <TableHead>Action</TableHead>
+                    <TableHead>Source</TableHead>
+                    <TableHead>Rule</TableHead>
+                    <TableHead>Events</TableHead>
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
+                  {edge.firewall.map((row, index) => (
+                    <TableRow key={index}>
+                      <TableCell>{row.action}</TableCell>
+                      <TableCell className="text-muted-foreground">{row.source}</TableCell>
+                      <TableCell className="text-muted-foreground">{row.description ?? "\u2014"}</TableCell>
+                      <TableCell className="tabular-nums">{row.count}</TableCell>
+                    </TableRow>
+                  ))}
+                </TableBody>
+              </Table>
+            )}
+          </CardContent>
+        </Card>
+      )}
+    </div>
+  );
+}
+`;
+function addSecurityBindings(source) {
+  const config = parseJsonc2(source) ?? {};
+  let text = source;
+  const added = [];
+  const format = { formattingOptions: { insertSpaces: true, tabSize: 2 } };
+  const append = (path, value) => {
+    text = applyEdits(text, modify(text, path, value, { ...format, isArrayInsertion: true }));
+  };
+  if (!config.kv_namespaces?.some((entry) => entry.binding === "FLARE_SECURITY")) {
+    if (config.kv_namespaces) append(["kv_namespaces", config.kv_namespaces.length], { binding: "FLARE_SECURITY" });
+    else text = applyEdits(text, modify(text, ["kv_namespaces"], [{ binding: "FLARE_SECURITY" }], format));
+    added.push("kv_namespaces: FLARE_SECURITY (ban list)");
+  }
+  if (!config.durable_objects?.bindings?.some((entry) => entry.name === "FLARE_SECURITY_MONITOR")) {
+    const binding = { name: "FLARE_SECURITY_MONITOR", class_name: "SecurityMonitor" };
+    if (config.durable_objects?.bindings) append(["durable_objects", "bindings", config.durable_objects.bindings.length], binding);
+    else text = applyEdits(text, modify(text, ["durable_objects", "bindings"], [binding], format));
+    added.push("durable_objects: FLARE_SECURITY_MONITOR (per-IP counters)");
+  }
+  const classes = (config.migrations ?? []).flatMap((migration) => [...migration.new_sqlite_classes ?? [], ...migration.new_classes ?? []]);
+  if (!classes.includes("SecurityMonitor")) {
+    const migration = { tag: "flare-security-v1", new_sqlite_classes: ["SecurityMonitor"] };
+    if (config.migrations) append(["migrations", config.migrations.length], migration);
+    else text = applyEdits(text, modify(text, ["migrations"], [migration], format));
+    added.push("migrations: SecurityMonitor");
+  }
+  if (!config.ratelimits?.some((entry) => entry.name === "FLARE_RATE_LIMIT")) {
+    const binding = { name: "FLARE_RATE_LIMIT", namespace_id: String(1e3 + Math.floor(Math.random() * 9e3)), simple: { limit: 120, period: 60 } };
+    if (config.ratelimits) append(["ratelimits", config.ratelimits.length], binding);
+    else text = applyEdits(text, modify(text, ["ratelimits"], [binding], format));
+    added.push("ratelimits: FLARE_RATE_LIMIT (120 requests/minute per IP on /api)");
+  }
+  return { text, added };
+}
+var renderAdminNavBlock = () => `export interface AdminLink {
+  label: string;
+  href: string;
+  /** A resource icon name, e.g. "shield" (see components/admin/resource-icon.tsx). */
+  icon: string;
+}
+
+export const generatedAdminLinks: AdminLink[] = [{ label: "Security", href: "/admin/security", icon: "shield" }];
+`;
+
+// src/commands/gen-security.ts
+function securityFiles(appName) {
+  return [
+    { path: "lib/security.ts", content: renderLibSecurity(appName) },
+    { path: "app/admin/security/page.tsx", content: renderSecurityPage() },
+    { path: "app/admin/security/actions.ts", content: renderSecurityActions() },
+    { path: "app/admin/security/ban-controls.tsx", content: renderBanControls() }
+  ];
+}
+var PASS_THROUGH_HEADER = /^\/\/ Request protection for worker\/index\.ts\.[\s\S]*?\n(?=\/\/ generated:start)/;
+function writeOnce(appRoot, relative2, content, log) {
+  const path = join11(appRoot, relative2);
+  if (existsSync12(path)) {
+    log(`${pc5.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+    return;
+  }
+  mkdirSync5(dirname7(path), { recursive: true });
+  writeFileSync6(path, content);
+  log(`${pc5.green("create".padEnd(9))} ${relative2}`);
+}
+async function genSecurity(options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const appName = JSON.parse(readFileSync9(join11(appRoot, "package.json"), "utf8")).name ?? "app";
+  writeOnce(appRoot, "security.config.ts", renderSecurityConfig(), log);
+  writeOnce(appRoot, descriptorPath("SecurityEvent"), renderSecurityDescriptor(), log);
+  writeOnce(appRoot, policyPath("SecurityEvent"), renderPolicy("SecurityEvent", SECURITY_EVENT_POLICY), log);
+  const files = [];
+  const write = (path, content, header) => {
+    const absolute = join11(appRoot, path);
+    if (path === "lib/security.ts" && existsSync12(absolute)) {
+      const source = readFileSync9(absolute, "utf8");
+      if (PASS_THROUGH_HEADER.test(source)) writeFileSync6(absolute, source.replace(PASS_THROUGH_HEADER, securityHeader()));
+    }
+    const outcome = writeGenerated(absolute, content, { header, force: options2.force });
+    files.push({ path, status: "missing", outcome });
+    const label = outcome === "create" ? pc5.green("create") : outcome === "update" ? pc5.yellow("update") : pc5.dim("identical");
+    log(`${label.padEnd(18)} ${path}`);
+  };
+  for (const { path, content } of securityFiles(appName)) write(path, content, securityHeader());
+  const navPath = join11(appRoot, "lib/admin-nav.ts");
+  if (existsSync12(navPath) && splitMarkers(readFileSync9(navPath, "utf8"))) write("lib/admin-nav.ts", renderAdminNavBlock());
+  else log(pc5.yellow(`lib/admin-nav.ts not found: link to /admin/security from your admin sidebar yourself.`));
+  const wranglerPath = join11(appRoot, "wrangler.jsonc");
+  let bindings = [];
+  if (existsSync12(wranglerPath)) {
+    const { text, added } = addSecurityBindings(readFileSync9(wranglerPath, "utf8"));
+    bindings = added;
+    if (added.length) {
+      writeFileSync6(wranglerPath, text);
+      for (const line of added) log(`${pc5.yellow("update".padEnd(9))} wrangler.jsonc (${line})`);
+    }
+  } else {
+    log(pc5.yellow("wrangler.jsonc not found: add the FLARE_SECURITY, FLARE_SECURITY_MONITOR and FLARE_RATE_LIMIT bindings yourself."));
+  }
+  const all = await loadResources(appRoot);
+  ensureSupportFiles(appRoot, log);
+  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log);
+  let migrations = [];
+  if (!options2.skipMigration) {
+    const result = await generateSchemaMigration(appRoot, "security");
+    migrations = result.files;
+    for (const file of migrations) log(`${pc5.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc5.dim(`repaired  ${repair}`));
+  }
+  log(
+    [
+      "",
+      `Next:`,
+      `  1. ${pc5.bold("flare migrate")} to create the security_events table.`,
+      `  2. ${pc5.bold("flare dev")}, then open ${pc5.bold("/admin/security")}. Tune detectors in security.config.ts.`,
+      `  3. Optional zone layer: deploy with FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN set (a token scoped to that`,
+      `     one zone with Zone WAF Edit, Firewall Services Edit, Analytics Read, Zone Read). ${pc5.bold("flare deploy")} pushes the`,
+      `     zone rules and uploads both as secrets.`
+    ].join("\n")
+  );
+  return { files, migrations, bindings };
+}
+
+// src/commands/gen.ts
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname8, join as join12 } from "path";
+import { camelCase as camelCase4, defineResource as defineResource2, relationGraph as relationGraph2 } from "@flaredev/core";
+import pc6 from "picocolors";
+function validateFields(name, fields, others, log) {
+  const known = /* @__PURE__ */ new Set([name, ...others.map((resource) => resource.name)]);
+  for (const field of fields) {
+    if (field.kind === "belongsTo" && !known.has(field.target)) {
+      throw new Error(`${name}.${field.key} belongs to "${field.target}", which doesn't exist yet. Generate ${field.target} first.`);
+    }
+  }
+  const candidate = defineResource2({ name, fields: Object.fromEntries(fields.map((f) => [f.key, toField(f)])) });
+  const graph = relationGraph2([...others, candidate]);
+  for (const pending of graph.pending.filter((p) => p.resource === name)) {
+    log(pc6.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
+  }
+}
+async function genResource(rawName, options2) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const name = resourceName(rawName);
+  const relativePath = descriptorPath(name);
+  const path = join12(appRoot, relativePath);
+  const exists = existsSync13(path);
+  if (!exists && !options2.fields) {
+    throw new Error(`--fields is required, e.g. flare gen resource ${name} --fields "name:string, email:string"`);
+  }
+  const existing = await loadResources(appRoot);
+  const others = existing.filter(({ resource }) => resource.name !== name).map(({ resource }) => resource);
+  if (options2.fields) {
+    const fields = parseFields(options2.fields);
+    validateFields(name, fields, others, log);
+    if (!exists) {
+      mkdirSync6(dirname8(path), { recursive: true });
+      writeFileSync7(path, renderDescriptor(name, fields));
+      log(`${pc6.green("create".padEnd(9))} ${relativePath}`);
+    } else {
+      try {
+        const outcome = writeGenerated(path, renderFieldsBlock(fields), { force: options2.force });
+        log(`${(outcome === "identical" ? pc6.dim : pc6.yellow)(outcome.padEnd(9))} ${relativePath}`);
+      } catch (error) {
+        if (error instanceof DriftError) {
+          throw new Error(
+            `The fields in ${relativePath} were edited by hand, so --fields won't overwrite them. Edit the descriptor directly and run \`flare gen resource ${name}\` (or \`flare sync-types\`), or pass --force.`
+          );
+        }
+        throw error;
+      }
+    }
+  }
+  let written;
+  let table;
+  try {
+    const all = await loadResources(appRoot);
+    table = all.find(({ resource }) => resource.name === name).resource.table;
+    ensureSupportFiles(appRoot, log);
+    written = applyPlan(appRoot, planFiles(all), { force: options2.force });
+    logResults(written, log);
+  } catch (error) {
+    const hint = exists ? "" : `
+(${relativePath} was written; fix it and run \`flare sync-types\`.)`;
+    throw new Error(`${error instanceof Error ? error.message : String(error)}${hint}`);
+  }
+  const skipped = written.filter((r) => r.outcome.startsWith("skipped"));
+  if (skipped.length) {
+    log(pc6.yellow(`
+Skipped ${skipped.length} hand-edited file(s); run \`flare sync-types\` for details.`));
+  }
+  let migrations = [];
+  if (!options2.skipMigration) {
+    const result = await generateSchemaMigration(appRoot, `${exists ? "update" : "create"}_${table}`);
+    migrations = result.files;
+    for (const file of migrations) log(`${pc6.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc6.dim(`repaired  ${repair}`));
+    if (migrations.length) log(`
+Next: ${pc6.bold("flare migrate")} to apply it locally.`);
+    else if (exists) log(pc6.dim("\nNo table changes, so no migration."));
+  }
+  const descriptor = { path: relativePath, status: exists ? "outdated" : "missing", outcome: exists ? "update" : "create" };
+  return { name, mode: exists ? "update" : "create", written: [descriptor, ...written], migrations };
+}
+
+// src/commands/gen-migration.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename2, join as join13 } from "path";
+import { snakeCase } from "@flaredev/core";
+import pc7 from "picocolors";
+var DOWN_TEMPLATE = (up) => `-- Rollback for ${up}, run by \`flare migrate:rollback\`.
+-- Write SQL that undoes the up migration, e.g.:
+--   DROP INDEX IF EXISTS \`contacts_phone_idx\`;
+-- While this file has no statements, rollback of ${up} is refused.
+`;
+async function genMigration(rawName, options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const name = snakeCase(rawName);
+  if (!name) throw new Error(`Invalid migration name "${rawName}". Use letters, digits, and underscores.`);
+  const { files, repairs } = await generateSchemaMigration(appRoot, name, { custom: !options2.fromSchema });
+  if (files.length === 0) {
+    log(options2.fromSchema ? "No schema changes, so no migration was created." : "drizzle-kit didn't create a migration.");
+    return [];
+  }
+  for (const file of files) log(`${pc7.green("create".padEnd(9))} ${file}`);
+  for (const repair of repairs) log(pc7.dim(`repaired  ${repair}`));
+  if (!options2.fromSchema) {
+    const downDir = join13(appRoot, "migrations", "down");
+    mkdirSync7(downDir, { recursive: true });
+    for (const file of files) {
+      const down = join13(downDir, basename2(file));
+      if (existsSync14(down)) continue;
+      writeFileSync8(down, DOWN_TEMPLATE(basename2(file)));
+      log(`${pc7.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
+    }
+    log(`
+Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc7.bold("flare migrate")}.`);
+  } else {
+    log(`
+Next: ${pc7.bold("flare migrate")}.`);
+  }
+  return files;
+}
+
+// src/commands/gen-policy.ts
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9, join as join14 } from "path";
+import { definePolicy } from "@flaredev/core";
+import pc8 from "picocolors";
+function parseRoles(input, what = "--roles") {
+  const roles = (input ?? "").split(",").map((role) => role.trim()).filter(Boolean);
+  if (roles.length === 0) throw new Error(`${what} is required, e.g. ${what} admin,staff`);
+  return [...new Set(roles)];
+}
+async function genPolicy(rawName, options2) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const name = resourceName(rawName);
+  const resources = await loadResources(appRoot);
+  if (!resources.some(({ resource }) => resource.name === name)) {
+    const known = resources.map(({ resource }) => resource.name).join(", ") || "none";
+    throw new Error(`No resource "${name}". Generate it first. Known resources: ${known}.`);
+  }
+  const relative2 = policyPath(name);
+  const path = join14(appRoot, relative2);
+  const exists = existsSync15(path);
+  let roles;
+  let deleteRoles;
+  if (options2.roles || !exists) {
+    roles = parseRoles(options2.roles);
+    deleteRoles = options2.deleteRoles ? parseRoles(options2.deleteRoles, "--delete-roles") : [roles[0]];
+    definePolicy({ resource: name, read: roles, create: roles, update: roles, delete: deleteRoles });
+  }
+  if (roles && deleteRoles) {
+    const block = renderPolicyBlock({ read: roles, create: roles, update: roles, delete: deleteRoles });
+    if (!exists) {
+      mkdirSync8(dirname9(path), { recursive: true });
+      writeFileSync9(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
+      log(`${pc8.green("create".padEnd(9))} ${relative2}`);
+    } else {
+      try {
+        const outcome = writeGenerated(path, block, { force: options2.force });
+        log(`${(outcome === "identical" ? pc8.dim : pc8.yellow)(outcome.padEnd(9))} ${relative2}`);
+      } catch (error) {
+        if (error instanceof DriftError) {
+          throw new Error(`The roles in ${relative2} were edited by hand, so --roles won't overwrite them. Edit the file directly, or pass --force.`);
+        }
+        throw error;
+      }
+    }
+  }
+  const policies = await loadPolicies(appRoot);
+  logResults(applyPlan(appRoot, planFiles(resources, policies)), log);
+  log(`
+${pc8.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
+  return { name, path: relative2 };
+}
+
+// src/commands/migrate.ts
+import { existsSync as existsSync16, mkdtempSync, readFileSync as readFileSync10, rmSync, writeFileSync as writeFileSync10 } from "fs";
+import { tmpdir } from "os";
+import { join as join15 } from "path";
+import pc9 from "picocolors";
+
+// src/generator/down.ts
+var IDENT = '(`[^`]+`|"[^"]+"|\\[[^\\]]+\\]|[A-Za-z_][\\w$]*)';
+function splitStatements(sql2) {
+  const statements = [];
+  for (const chunk of sql2.split("--> statement-breakpoint")) {
+    let current = "";
+    let quote = null;
+    for (let i = 0; i < chunk.length; i++) {
+      const char = chunk[i];
+      if (quote) {
+        current += char;
+        if (char === quote) quote = null;
+        continue;
+      }
+      if (char === "-" && chunk[i + 1] === "-") {
+        const end = chunk.indexOf("\n", i);
+        i = end === -1 ? chunk.length : end;
+        current += "\n";
+        continue;
+      }
+      if (char === "'" || char === '"' || char === "`") quote = char;
+      if (char === ";") {
+        statements.push(current);
+        current = "";
+        continue;
+      }
+      current += char;
+    }
+    statements.push(current);
+  }
+  return statements.map((statement) => statement.trim()).filter(Boolean);
+}
+function inverse(statement) {
+  const s = statement.replace(/\s+/g, " ").trim();
+  let m;
+  if (m = new RegExp(`^CREATE TABLE (?:IF NOT EXISTS )?${IDENT}`, "i").exec(s)) return `DROP TABLE IF EXISTS ${m[1]};`;
+  if (m = new RegExp(`^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?${IDENT}`, "i").exec(s)) return `DROP INDEX IF EXISTS ${m[1]};`;
+  if (m = new RegExp(`^CREATE VIEW (?:IF NOT EXISTS )?${IDENT}`, "i").exec(s)) return `DROP VIEW IF EXISTS ${m[1]};`;
+  if (m = new RegExp(`^CREATE TRIGGER (?:IF NOT EXISTS )?${IDENT}`, "i").exec(s)) return `DROP TRIGGER IF EXISTS ${m[1]};`;
+  if (m = new RegExp(`^ALTER TABLE ${IDENT} RENAME TO ${IDENT}$`, "i").exec(s)) return `ALTER TABLE ${m[2]} RENAME TO ${m[1]};`;
+  if (m = new RegExp(`^ALTER TABLE ${IDENT} RENAME COLUMN ${IDENT} TO ${IDENT}$`, "i").exec(s)) {
+    return `ALTER TABLE ${m[1]} RENAME COLUMN ${m[3]} TO ${m[2]};`;
+  }
+  if (m = new RegExp(`^ALTER TABLE ${IDENT} ADD (?:COLUMN )?${IDENT}(.*)$`, "i").exec(s)) {
+    if (/\b(REFERENCES|UNIQUE|PRIMARY KEY)\b/i.test(m[3])) return null;
+    return `ALTER TABLE ${m[1]} DROP COLUMN ${m[2]};`;
+  }
+  return null;
+}
+function deriveDown(upSql) {
+  const statements = splitStatements(upSql);
+  if (statements.length === 0) return { reversible: false, reason: "the migration is empty" };
+  const down = [];
+  for (const statement of statements) {
+    const reversed = inverse(statement);
+    if (!reversed) {
+      const preview = statement.replace(/\s+/g, " ").slice(0, 80);
+      return { reversible: false, reason: `can't automatically reverse: ${preview}${statement.length > 80 ? "\u2026" : ""}` };
+    }
+    down.unshift(reversed);
+  }
+  return { reversible: true, sql: `${down.join("\n")}
+` };
+}
+
+// src/commands/migrate.ts
+function context(options2) {
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const databases = readD1Databases(appRoot);
+  if (databases.length === 0) throw new Error("No d1_databases in wrangler.jsonc.");
+  let db;
+  if (options2.database) {
+    const match = databases.find((candidate) => candidate.binding === options2.database || candidate.database_name === options2.database);
+    if (!match) throw new Error(`No D1 database "${options2.database}". Available: ${databases.map((d) => d.binding).join(", ")}.`);
+    db = match;
+  } else if (databases.length === 1) {
+    db = databases[0];
+  } else {
+    throw new Error(`Several D1 databases; pick one with --database (${databases.map((d) => d.binding).join(", ")}).`);
+  }
+  const target = [options2.remote ? "--remote" : "--local", ...options2.env ? ["--env", options2.env] : []];
+  return {
+    appRoot,
+    db,
+    target,
+    where: options2.remote ? "remote" : "local",
+    wrangler: resolveBin(appRoot, "wrangler", "wrangler"),
+    log: options2.log ?? ((message) => console.log(message))
+  };
+}
+async function migrate(options2 = {}) {
+  const { appRoot, db, target, wrangler } = context(options2);
+  const result = await runWrangler(wrangler, ["d1", "migrations", "apply", db.binding, ...target], appRoot);
+  return result.code;
+}
+async function appliedMigrations(options2, limit) {
+  const { appRoot, db, target, wrangler } = context(options2);
+  const result = await runWrangler(
+    wrangler,
+    ["d1", "execute", db.binding, ...target, "--json", "--command", `SELECT id, name FROM d1_migrations ORDER BY id DESC LIMIT ${limit}`],
+    appRoot,
+    { capture: true }
+  );
+  if (result.code !== 0) {
+    if (/no such table: d1_migrations/i.test(result.output)) return [];
+    throw new Error(`Could not read applied migrations:
+${result.output.trim()}`);
+  }
+  const [first] = extractJson(result.output);
+  return first?.results ?? [];
+}
+async function rollback(options2 = {}) {
+  const steps = options2.steps ?? 1;
+  if (!Number.isInteger(steps) || steps < 1) throw new Error("--steps must be a positive integer.");
+  const { appRoot, db, target, where, wrangler, log } = context(options2);
+  const migrationsDir = join15(appRoot, db.migrations_dir ?? "migrations");
+  const applied = await appliedMigrations(options2, steps);
+  if (applied.length === 0) {
+    log("Nothing to roll back.");
+    return 0;
+  }
+  const plan = [];
+  for (const { name } of applied) {
+    if (!/^[\w.-]+\.sql$/.test(name)) throw new Error(`Unexpected migration name "${name}" in d1_migrations.`);
+    const handWritten = join15(migrationsDir, "down", name);
+    if (existsSync16(handWritten)) {
+      const sql2 = readFileSync10(handWritten, "utf8");
+      if (splitStatements(sql2).length === 0) {
+        throw new Error(`Can't roll back ${name}: migrations/down/${name} has no SQL statements yet. Write the rollback SQL, then run the rollback again. Nothing was changed.`);
+      }
+      plan.push({ name, sql: sql2, source: `migrations/down/${name}` });
+      continue;
+    }
+    const upPath = join15(migrationsDir, name);
+    if (!existsSync16(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
+    const down = deriveDown(readFileSync10(upPath, "utf8"));
+    if (!down.reversible) {
+      throw new Error(
+        `Can't roll back ${name}: ${down.reason}
+Write the reverse SQL to migrations/down/${name} and run the rollback again. Nothing was changed.`
+      );
+    }
+    plan.push({ name, sql: down.sql, source: "derived" });
+  }
+  log(`${pc9.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
+  for (const step of plan) {
+    log(`  ${step.name} ${pc9.dim(`(${step.source})`)}`);
+    for (const line of step.sql.trim().split("\n")) log(pc9.dim(`    ${line}`));
+  }
+  if (options2.remote && !options2.yes) {
+    log(pc9.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
+    return 1;
+  }
+  const script = plan.map(({ name, sql: sql2 }) => `${sql2.trim()}
+DELETE FROM d1_migrations WHERE name = '${name.replace(/'/g, "''")}';`).join("\n") + "\n";
+  const dir = mkdtempSync(join15(tmpdir(), "flare-rollback-"));
+  try {
+    const file = join15(dir, "rollback.sql");
+    writeFileSync10(file, script);
+    const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
+    if (result.code !== 0) throw new Error(`Rollback failed:
+${result.output.trim()}`);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  log(pc9.green(`
+Rolled back ${plan.map((step) => step.name).join(", ")}.`));
+  return 0;
+}
+
+// src/commands/rm.ts
+import { existsSync as existsSync17, readdirSync as readdirSync7, readFileSync as readFileSync11, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname10, join as join16 } from "path";
+import { relationGraph as relationGraph3 } from "@flaredev/core";
+import pc10 from "picocolors";
+var squash = (text) => text.replace(/\r\n/g, "\n").replace(/\s+/g, " ").trim();
+function handWrittenReason(source, header, options2 = {}) {
+  const parts = splitMarkers(source);
+  if (!parts) return "has no generated block (entirely hand-written)";
+  if (options2.descriptorWrapper) {
+    if (squash(parts.before) !== squash(options2.descriptorWrapper.before) || squash(parts.after) !== squash(options2.descriptorWrapper.after)) {
+      return "has hand-written changes outside the fields block";
+    }
+    return null;
+  }
+  const outside = squash(parts.before.replace(header, "") + parts.after);
+  if (outside) return "has hand-written code outside the generated block";
+  if (parts.hash && hashBlock(parts.block) !== parts.hash) return "has hand edits inside the generated block";
+  return null;
+}
+function removeEmptyDirs(appRoot, start) {
+  let dir = dirname10(join16(appRoot, start));
+  const roots = [join16(appRoot, "app", "api"), join16(appRoot, "app", "admin")];
+  const inside = () => roots.some((root) => dir.startsWith(root) && dir !== root);
+  while (inside() && existsSync17(dir) && readdirSync7(dir).length === 0) {
+    rmdirSync(dir);
+    dir = dirname10(dir);
+  }
+}
+async function rmResource(rawName, options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const name = resourceName(rawName);
+  const all = await loadResources(appRoot);
+  const entry = all.find(({ resource }) => resource.name === name);
+  const remaining = all.filter(({ resource }) => resource.name !== name);
+  if (entry) {
+    const graph = relationGraph3(all.map(({ resource }) => resource));
+    const dependents = [];
+    for (const other of remaining) {
+      const relations = graph.byResource[other.resource.name];
+      for (const relation of relations.belongsTo) if (relation.target === name) dependents.push(`${other.resource.name}.${relation.key}`);
+      for (const relation of relations.hasMany) if (relation.target === name) dependents.push(`${other.resource.name}.${relation.key}`);
+    }
+    for (const pending of graph.pending) if (pending.target === name) dependents.push(`${pending.resource}.${pending.key}`);
+    if (dependents.length) {
+      throw new Error(`Can't remove ${name}: ${dependents.join(", ")} still reference${dependents.length === 1 ? "s" : ""} it. Remove those fields first.`);
+    }
+  }
+  const owned = /* @__PURE__ */ new Set();
+  if (entry) {
+    owned.add(entry.file);
+    for (const file of planFiles(all)) {
+      if (existsSync17(join16(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
+    }
+  }
+  for (const orphan of findOrphans(appRoot, remaining)) if (orphan.resource === name) owned.add(orphan.path);
+  const policy = (await loadPolicies(appRoot)).find(({ policy: policy2 }) => policy2.resource === name);
+  if (policy) owned.add(policy.file);
+  if (!entry && owned.size === 0) throw new Error(`No resource "${name}" (no ${descriptorPath(name)} and no generated files).`);
+  const findings = [];
+  for (const path of owned) {
+    const source = readFileSync11(join16(appRoot, path), "utf8");
+    let wrapper;
+    if (entry && path === entry.file) {
+      const standard = splitMarkers(renderDescriptor(name, [{ key: "placeholder", kind: "string", required: true, unique: false }]));
+      wrapper = { before: standard.before, after: standard.after };
+    }
+    if (policy && path === policy.file) {
+      const standard = splitMarkers(renderPolicy(name, { read: [], create: [], update: [], delete: [] }));
+      wrapper = { before: standard.before, after: standard.after };
+    }
+    const reason = handWrittenReason(source, resourceHeader(name), { descriptorWrapper: wrapper });
+    if (reason) findings.push({ path, reason });
+  }
+  if (findings.length && !options2.force) {
+    const list2 = findings.map((finding) => `  ${finding.path}: ${finding.reason}`).join("\n");
+    throw new Error(`Refusing to remove ${name}; these files contain hand-written code:
+${list2}
+Move what you want to keep, or pass --force to delete anyway.`);
+  }
+  const removed = [...owned].sort();
+  for (const path of removed) {
+    unlinkSync2(join16(appRoot, path));
+    removeEmptyDirs(appRoot, path);
+    log(`${pc10.red("remove".padEnd(9))} ${path}`);
+  }
+  logResults(applyPlan(appRoot, planFiles(remaining, policy ? await loadPolicies(appRoot) : void 0)), log);
+  const table = entry ? tableExport(entry.resource) : void 0;
+  if (table && existsSync17(join16(appRoot, "seeds"))) {
+    const seeds = readdirSync7(join16(appRoot, "seeds")).filter(
+      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync11(join16(appRoot, "seeds", file), "utf8"))
+    );
+    if (seeds.length) log(pc10.yellow(`
+These seeds still use ${table}: ${seeds.map((s) => `seeds/${s}`).join(", ")}.`));
+  }
+  let migrations = [];
+  if (!options2.skipMigration && entry) {
+    const result = await generateSchemaMigration(appRoot, `drop_${entry.resource.table}`);
+    migrations = result.files;
+    for (const file of migrations) log(`${pc10.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc10.dim(`repaired  ${repair}`));
+    if (migrations.length) log(`
+Next: ${pc10.bold("flare migrate")} to drop the table locally.`);
+  }
+  return { removed, migrations };
+}
+
+// src/commands/role.ts
+import { humanize } from "@flaredev/core";
+import pc11 from "picocolors";
+var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+function roleInsertSql(name, label) {
+  if (!ROLE_NAME.test(name)) throw new Error(`Invalid role "${name}". Use lowercase letters, digits, _ or -, e.g. admin or support-agent.`);
+  if (/['"\\]/.test(label) || label.length > 60) throw new Error(`Invalid label "${label}". Keep it short and avoid quotes.`);
+  return `INSERT INTO "role" (name, label) VALUES ('${name}', '${label}') ON CONFLICT(name) DO UPDATE SET label = excluded.label RETURNING name, label`;
+}
+function context2(options2) {
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const db = readD1Databases(appRoot)[0];
+  if (!db) throw new Error("No d1_databases in wrangler.jsonc.");
+  return {
+    appRoot,
+    binding: db.binding,
+    wrangler: resolveBin(appRoot, "wrangler", "wrangler"),
+    target: [options2.remote ? "--remote" : "--local", ...options2.env ? ["--env", options2.env] : []],
+    log: options2.log ?? ((message) => console.log(message))
+  };
+}
+async function listRoles(options2 = {}) {
+  const { appRoot, binding, wrangler, target } = context2(options2);
+  const result = await runWrangler(wrangler, ["d1", "execute", binding, ...target, "--json", "--command", "SELECT name FROM role ORDER BY name"], appRoot, {
+    capture: true
+  });
+  if (result.code !== 0) {
+    if (/no such table: role/i.test(result.output)) return null;
+    throw new Error(`Could not read roles:
+${result.output.trim()}`);
+  }
+  const [first] = extractJson(result.output);
+  return (first?.results ?? []).map((row) => row.name);
+}
+async function addRole(name, options2 = {}) {
+  const { appRoot, binding, wrangler, target, log } = context2(options2);
+  const sql2 = roleInsertSql(name, options2.label ?? humanize(name));
+  const result = await runWrangler(wrangler, ["d1", "execute", binding, ...target, "--json", "--command", sql2], appRoot, { capture: true });
+  if (result.code !== 0) {
+    if (/no such table: role/i.test(result.output)) {
+      throw new Error("No role table yet. Run `flare migrate` first (it's part of the initial migration).");
+    }
+    throw new Error(`Could not add the role:
+${result.output.trim()}`);
+  }
+  const [first] = extractJson(result.output);
+  const added = first?.results?.[0];
+  log(pc11.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
+  log(pc11.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
+  return 0;
+}
+
+// src/commands/seed.ts
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync8, writeFileSync as writeFileSync11 } from "fs";
+import { createRequire } from "module";
+import { join as join17 } from "path";
+import { pathToFileURL } from "url";
+import { kebabCase as kebabCase3, storedFields as storedFields2 } from "@flaredev/core";
+import { createJiti as createJiti4 } from "jiti";
+import pc12 from "picocolors";
+var SEEDS_DIR = "seeds";
+var LOCAL_STATE = ".wrangler/state/v3";
+function seedFiles(appRoot, names) {
+  const dir = join17(appRoot, SEEDS_DIR);
+  const all = existsSync18(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
+  if (!names?.length) return all;
+  return names.map((name) => {
+    const file = `${name.replace(/\.seed\.ts$/, "")}.seed.ts`;
+    if (!all.includes(file)) {
+      throw new Error(`No seed "${name}" in ${SEEDS_DIR}/. Available: ${all.map((f) => f.replace(".seed.ts", "")).join(", ") || "none"}.`);
+    }
+    return file;
+  });
+}
+async function runSeeds(options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const files = seedFiles(appRoot, options2.names);
+  if (files.length === 0) {
+    log(`No seeds found. Create one with ${pc12.bold("flare seed:make <name>")}.`);
+    return;
+  }
+  const jiti = createJiti4(join17(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
+  const appRequire = createRequire(join17(appRoot, "package.json"));
+  const wrangler = await import(pathToFileURL(appRequire.resolve("wrangler")).href);
+  const { drizzle } = await jiti.import("drizzle-orm/d1");
+  const schema = await jiti.import(join17(appRoot, "db/schema.ts"));
+  const { env, dispose } = await wrangler.getPlatformProxy({
+    configPath: join17(appRoot, "wrangler.jsonc"),
+    persist: { path: join17(appRoot, LOCAL_STATE) }
+  });
+  try {
+    const bindings = env;
+    if (!bindings.DB) throw new Error("No DB binding found in wrangler.jsonc.");
+    const db = drizzle(bindings.DB, { schema });
+    for (const file of files) {
+      const mod = await jiti.import(join17(appRoot, SEEDS_DIR, file));
+      if (typeof mod.default !== "function") throw new Error(`${SEEDS_DIR}/${file} must \`export default defineSeed(async ({ db }) => { ... })\`.`);
+      log(`${pc12.cyan("seed")} ${file}`);
+      await mod.default({ db, env: bindings, log: (message) => log(`  ${message}`) });
+    }
+    log(pc12.green(`
+Ran ${files.length} seed(s) against the local database.`));
+  } finally {
+    await dispose();
+  }
+}
+function sampleValue(key, def, row) {
+  switch (def.kind) {
+    case "string":
+      if (def.format === "email") return `\`${kebabCase3(key).replace(/-?email$/, "") || "user"}\${i}@example.com\``;
+      if (def.format === "url") return `\`https://example.com/\${i}\``;
+      return `\`${def.label} \${i}\``;
+    case "text":
+      return `"Lorem ipsum dolor sit amet."`;
+    case "int":
+      return "i";
+    case "float":
+      return "i * 1.5";
+    case "boolean":
+      return "i % 2 === 0";
+    case "date":
+      return "`2026-01-0${i}`";
+    case "datetime":
+      return "new Date().toISOString()";
+    case "enum":
+      return JSON.stringify(def.options[row % def.options.length]);
+    case "file":
+      return void 0;
+    case "belongsTo":
+      return void 0;
+  }
+}
+function renderSeed(resource) {
+  if (!resource) {
+    return `import { defineSeed } from "@flaredev/core";
+
+export default defineSeed(async ({ db, log }) => {
+  // Insert rows with Drizzle, e.g.:
+  // await db.insert(contacts).values([{ name: "Ada", email: "ada@example.com" }]);
+  log("nothing to seed yet");
+});
+`;
+  }
+  const table = tableExport(resource);
+  const lines = [];
+  const todos = [];
+  for (const [key, def] of storedFields2(resource)) {
+    const value = sampleValue(key, def, 0);
+    if (value !== void 0) lines.push(`    ${key}: ${value},`);
+    else if (def.required) todos.push(`    // ${key}: TODO (${def.kind === "belongsTo" ? `id of an existing ${def.target}` : "R2 object key"}),`);
+  }
+  return `import { defineSeed } from "@flaredev/core";
+import { ${table} } from "@/db/schema";
+
+export default defineSeed(async ({ db, log }) => {
+  const rows = [1, 2, 3].map((i) => ({
+${[...lines, ...todos].join("\n")}
+  }));
+  await db.insert(${table}).values(rows);
+  log(\`inserted \${rows.length} ${resource.pluralLabel.toLowerCase()}\`);
+});
+`;
+}
+async function makeSeed(rawName, options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const name = kebabCase3(rawName);
+  if (!name) throw new Error(`Invalid seed name "${rawName}".`);
+  const relative2 = `${SEEDS_DIR}/${name}.seed.ts`;
+  const path = join17(appRoot, relative2);
+  if (existsSync18(path)) throw new Error(`${relative2} already exists.`);
+  const resources = (await loadResources(appRoot)).map(({ resource: resource2 }) => resource2);
+  let resource;
+  if (options2.resource) {
+    resource = resources.find((r) => r.name.toLowerCase() === options2.resource.toLowerCase());
+    if (!resource) throw new Error(`No resource "${options2.resource}". Available: ${resources.map((r) => r.name).join(", ") || "none"}.`);
+  } else {
+    resource = resources.find((r) => [kebabCase3(r.name), r.slug].includes(name));
+  }
+  mkdirSync9(join17(appRoot, SEEDS_DIR), { recursive: true });
+  writeFileSync11(path, renderSeed(resource));
+  log(`${pc12.green("create".padEnd(9))} ${relative2}`);
+  log(`
+Run it with ${pc12.bold(`flare seed ${name}`)}.`);
+  return relative2;
+}
+
+// src/commands/billing-sync.ts
+import { createRequire as createRequire2 } from "module";
+import { existsSync as existsSync19, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join18 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import { kebabCase as kebabCase4 } from "@flaredev/core";
+import pc13 from "picocolors";
+function stripeKeys(appRoot) {
+  const map = {};
+  const path = join18(appRoot, ".dev.vars");
+  if (existsSync19(path)) {
+    for (const line of readFileSync12(path, "utf8").split(/\r?\n/)) {
+      const match = /^\s*([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
+      if (match) map[match[1]] = match[2].trim();
+    }
+  }
+  for (const key of ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"]) {
+    if (process.env[key]) map[key] = process.env[key];
+  }
+  return map;
+}
+function planRows(catalog) {
+  const rows = [];
+  const skipped = [];
+  for (const { product, prices } of catalog) {
+    const usable = prices.filter((price) => {
+      const ok = price.unit_amount !== null && (price.type === "one_time" || price.recurring !== null && ["month", "year"].includes(price.recurring.interval) && (price.recurring.interval_count ?? 1) === 1);
+      if (!ok) skipped.push(`${product.name} (${price.id})`);
+      return ok;
+    });
+    const currencies = new Set(usable.map((price) => price.currency));
+    const base = product.metadata?.slug || kebabCase4(product.name);
+    for (const price of usable) {
+      const interval = price.recurring?.interval ?? null;
+      const parts = [base];
+      if (usable.length > 1) parts.push(interval ?? "once");
+      if (currencies.size > 1) parts.push(price.currency);
+      const label = usable.length > 1 ? ` (${interval ? `${interval}ly` : "one-time"}${currencies.size > 1 ? `, ${price.currency.toUpperCase()}` : ""})` : "";
+      rows.push({
+        name: `${product.name}${label}`,
+        slug: parts.join("-"),
+        description: product.description ?? null,
+        stripeProductId: product.id,
+        stripePriceId: price.id,
+        amount: price.unit_amount ?? 0,
+        currency: price.currency,
+        interval,
+        sort: Number(product.metadata?.sort ?? 0) || 0
+      });
+    }
+  }
+  return { rows, skipped };
+}
+var sql = (value) => value === null ? "NULL" : typeof value === "number" ? String(Math.trunc(value)) : `'${value.replace(/'/g, "''")}'`;
+function renderSyncSql(rows, newId = () => crypto.randomUUID()) {
+  const live = rows.map((row) => sql(row.stripePriceId)).join(", ");
+  const slugs = rows.map((row) => sql(row.slug)).join(", ");
+  const retire = `UPDATE plans SET active = 0` + (slugs ? `, slug = CASE WHEN slug IN (${slugs}) THEN slug || '-' || substr(coalesce(stripe_price_id, id), -8) ELSE slug END` : "") + ` WHERE stripe_price_id IS NOT NULL${live ? ` AND stripe_price_id NOT IN (${live})` : ""};`;
+  const upserts = rows.map(
+    (row) => `INSERT INTO plans (id, name, slug, description, stripe_product_id, stripe_price_id, amount, currency, \`interval\`, active, sort) VALUES (${[newId(), row.name, row.slug, row.description, row.stripeProductId, row.stripePriceId, row.amount, row.currency, row.interval].map(sql).join(", ")}, 1, ${sql(row.sort)}) ON CONFLICT(stripe_price_id) DO UPDATE SET name = excluded.name, slug = excluded.slug, description = excluded.description, stripe_product_id = excluded.stripe_product_id, amount = excluded.amount, currency = excluded.currency, \`interval\` = excluded.\`interval\`, active = 1, sort = excluded.sort;`
+  );
+  return [retire, ...upserts].join("\n") + "\n";
+}
+async function syncPortalConfiguration(stripe, rows, appName) {
+  const byProduct = /* @__PURE__ */ new Map();
+  for (const row of rows) if (row.interval) byProduct.set(row.stripeProductId, [...byProduct.get(row.stripeProductId) ?? [], row.stripePriceId]);
+  if (byProduct.size === 0) return null;
+  const settings = {
+    business_profile: { headline: "Manage your subscription" },
+    features: {
+      subscription_update: {
+        enabled: true,
+        default_allowed_updates: ["price"],
+        proration_behavior: "create_prorations",
+        products: [...byProduct].map(([product, prices]) => ({ product, prices }))
+      },
+      subscription_cancel: { enabled: true, mode: "at_period_end" },
+      payment_method_update: { enabled: true },
+      invoice_history: { enabled: true }
+    },
+    metadata: { flare_app: appName }
+  };
+  const existing = (await stripe.billingPortal.configurations.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e3 })).find(
+    (configuration) => configuration.metadata?.flare_app === appName
+  );
+  return existing ? (await stripe.billingPortal.configurations.update(existing.id, settings)).id : (await stripe.billingPortal.configurations.create(settings)).id;
+}
+async function syncPlans(options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const key = stripeKeys(appRoot).STRIPE_SECRET_KEY;
+  if (!key) throw new Error("STRIPE_SECRET_KEY is not set in .dev.vars or the environment.");
+  const db = readD1Databases(appRoot)[0];
+  if (!db) throw new Error("No d1_databases in wrangler.jsonc.");
+  const appRequire = createRequire2(join18(appRoot, "package.json"));
+  const stripeModule = await import(pathToFileURL2(appRequire.resolve("stripe")).href);
+  const stripe = new stripeModule.default(key, { apiVersion: "2026-08-26.dahlia" });
+  const appName = JSON.parse(readFileSync12(join18(appRoot, "package.json"), "utf8")).name ?? "app";
+  const everything = await stripe.products.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 });
+  const products = options2.all ? everything : everything.filter((product) => product.metadata?.flare_app === appName);
+  if (products.length === 0) {
+    throw new Error(
+      `No active Products in Stripe have metadata flare_app=${appName} (${everything.length} other active Products were ignored). Tag this app's Products, or pass --all to import every Product.`
+    );
+  }
+  const catalog = await Promise.all(
+    products.map(async (product) => ({ product, prices: await stripe.prices.list({ product: product.id, active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 }) }))
+  );
+  const { rows, skipped } = planRows(catalog);
+  const wrangler = resolveBin(appRoot, "wrangler", "wrangler");
+  const target = [options2.remote ? "--remote" : "--local", ...options2.env ? ["--env", options2.env] : []];
+  const existingResult = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--json", "--command", "SELECT stripe_price_id FROM plans"], appRoot, { capture: true });
+  if (existingResult.code !== 0) {
+    if (/no such table: plans/i.test(existingResult.output)) throw new Error(`The plans table doesn't exist yet. Run \`flare migrate${options2.remote ? " --remote" : ""}\` first.`);
+    throw new Error(`Could not read plans:
+${existingResult.output.trim()}`);
+  }
+  const known = new Set(extractJson(existingResult.output)[0]?.results.map((row) => row.stripe_price_id));
+  const dir = mkdtempSync2(join18(tmpdir2(), "flare-sync-"));
+  try {
+    const file = join18(dir, "sync-plans.sql");
+    writeFileSync12(file, renderSyncSql(rows));
+    const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
+    if (result.code !== 0) throw new Error(`Could not write plans:
+${result.output.trim()}`);
+  } finally {
+    rmSync2(dir, { recursive: true, force: true });
+  }
+  let created = 0;
+  for (const row of rows) {
+    const isNew = !known.has(row.stripePriceId);
+    if (isNew) created++;
+    const price = `${row.currency.toUpperCase()} ${(row.amount / 100).toFixed(2)}${row.interval ? `/${row.interval}` : " once"}`;
+    log(`${(isNew ? pc13.green("create") : pc13.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc13.dim(price)}`);
+  }
+  for (const name of skipped) log(pc13.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
+  const configuration = await syncPortalConfiguration(stripe, rows, appName);
+  if (configuration) log(`${pc13.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
+  log(pc13.green(`
+${rows.length} plan(s) synced to the ${options2.remote ? "remote" : "local"} database; plans no longer active in Stripe were deactivated.`));
+  return { created, updated: rows.length - created, skipped };
+}
+
+// src/commands/sync.ts
+import { existsSync as existsSync20 } from "fs";
+import { join as join19 } from "path";
+import pc14 from "picocolors";
+async function syncTypes(options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const all = await loadResources(appRoot);
+  const policies = await loadPolicies(appRoot);
+  const tracksPolicies = policies.length > 0 || existsSync20(join19(appRoot, "policies/index.ts"));
+  const plan = planFiles(all, tracksPolicies ? policies : void 0);
+  if (!options2.check) ensureSupportFiles(appRoot, log);
+  const results = applyPlan(appRoot, plan, { force: options2.force, dryRun: options2.check });
+  logResults(results, log);
+  const drift = results.filter((r) => r.outcome === "skipped-drift");
+  const unmarked = results.filter((r) => r.outcome === "skipped-unmarked");
+  const changed = results.filter((r) => r.outcome === "create" || r.outcome === "update");
+  const orphans = findOrphans(appRoot, all);
+  if (drift.length) {
+    log(
+      `
+${pc14.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
+Move custom code outside the // generated:start \u2026 // generated:end block, or re-run with --force to overwrite.`
+    );
+  }
+  if (unmarked.length) {
+    log(`
+${pc14.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
+  }
+  if (orphans.length) {
+    const resources = [...new Set(orphans.map((o) => o.resource))];
+    log(`
+${pc14.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
+    for (const orphan of orphans) log(`  ${orphan.path}`);
+    log(
+      `If the resource was deleted, remove them with ${pc14.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
+    );
+  }
+  const tablesChanged = changed.some((r) => r.path.startsWith("db/schema/") && (r.status === "outdated" || r.status === "missing"));
+  if (tablesChanged && !options2.check) {
+    log(`
+${pc14.cyan("Tables changed.")} Create a migration with ${pc14.bold("flare gen migration <name> --from-schema")}, then ${pc14.bold("flare migrate")}.`);
+  }
+  const problems = drift.length + unmarked.length + orphans.length;
+  if (options2.check) {
+    const stale = changed.length;
+    if (stale === 0 && problems === 0) log(pc14.green("Generated files are in sync with the resource descriptors."));
+    else log(`
+${pc14.red("Out of sync:")} ${stale} file(s) would change. Run ${pc14.bold("flare sync-types")}.`);
+    return stale + problems > 0 ? 1 : 0;
+  }
+  if (changed.length === 0 && problems === 0) log(pc14.green("Everything is in sync."));
+  return problems > 0 ? 1 : 0;
+}
+
+// src/commands/user-role.ts
+import pc15 from "picocolors";
+var ROLE = /^[a-z][a-z0-9_-]{0,31}$/;
+var EMAIL = /^[^\s@'"\\]+@[^\s@'"\\]+\.[^\s@'"\\]+$/;
+function userRoleSql(email, role) {
+  if (!EMAIL.test(email)) throw new Error(`"${email}" doesn't look like an email address.`);
+  if (!ROLE.test(role)) throw new Error(`Invalid role "${role}". Use lowercase letters, digits, _ or -, e.g. admin or staff.`);
+  return `UPDATE "user" SET role = '${role}', updated_at = cast(unixepoch('subsecond') * 1000 as integer) WHERE lower(email) = lower('${email}') RETURNING email, role`;
+}
+async function setUserRole(email, role, options2 = {}) {
+  const log = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const sql2 = userRoleSql(email, role);
+  const roles = await listRoles(options2);
+  if (roles && !roles.includes(role)) {
+    log(pc15.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
+    log(pc15.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
+    return 1;
+  }
+  const db = readD1Databases(appRoot)[0];
+  if (!db) throw new Error("No d1_databases in wrangler.jsonc.");
+  const target = [options2.remote ? "--remote" : "--local", ...options2.env ? ["--env", options2.env] : []];
+  const result = await runWrangler(resolveBin(appRoot, "wrangler", "wrangler"), ["d1", "execute", db.binding, ...target, "--json", "--command", sql2], appRoot, {
+    capture: true
+  });
+  if (result.code !== 0) throw new Error(`Could not update the user:
+${result.output.trim()}`);
+  const [first] = extractJson(result.output);
+  const updated = first?.results ?? [];
+  if (updated.length === 0) {
+    log(pc15.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
+    return 1;
+  }
+  log(pc15.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
+  return 0;
+}
+
+// src/cli.ts
+function createCli() {
+  const cli = cac("flare");
+  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--auth-providers <list>", "OAuth providers to scaffold, comma-separated (google, github)").option("--skip-install", "Write files without installing dependencies").example("flare create shop --auth-providers google,github").action((dir, options2) => {
+    const install = !options2.skipInstall;
+    const result = createApp(dir, { pm: options2.pm, install, authProviders: options2.authProviders });
+    printNextSteps(result, install);
+  });
+  cli.command("gen <generator> [name]", "Generate code. Generators: resource, migration, policy, billing, security").option("--fields <fields>", 'resource: fields, e.g. "name:string, email:string!, status:enum(lead,customer)"').option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing: write files without installing the stripe dependency").option("--skip-migration", "billing/security: skip generating the schema migration").example('flare gen resource Contact --fields "name:string, email:string!, company:belongsTo(Company)?"').example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").action(
+    async (generator, name, options2) => {
+      if (generator === "billing")
+        return genBilling({ provider: options2.provider, mode: options2.mode, force: options2.force, skipInstall: options2.skipInstall, skipMigration: options2.skipMigration });
+      if (generator === "security") return genSecurity({ force: options2.force, skipMigration: options2.skipMigration });
+      if (["resource", "migration", "policy"].includes(generator) && !name) {
+        throw new Error(`flare gen ${generator} needs a name, e.g. flare gen ${generator} ${generator === "migration" ? "add_phone_to_contacts" : "Contact"}`);
+      }
+      if (generator === "resource") return genResource(name, { fields: options2.fields, force: options2.force });
+      if (generator === "migration") return genMigration(name, { fromSchema: options2.fromSchema });
+      if (generator === "policy") return genPolicy(name, { roles: options2.roles, deleteRoles: options2.deleteRoles, force: options2.force });
+      throw new Error(`Unknown generator "${generator}". Available: resource, migration, policy, billing, security.`);
+    }
+  );
+  cli.command("rm <kind> <name>", "Remove generated code. Kinds: resource").option("--force", "Delete even when files contain hand-written code").example("flare rm resource Tag").action(async (kind, name, options2) => {
+    if (kind !== "resource") throw new Error(`Unknown kind "${kind}". Available: resource.`);
+    await rmResource(name, options2);
+  });
+  cli.command("role:add <name>", "Register a role users can be assigned (local database unless --remote)").option("--label <label>", "Display label (default: humanized name)").option("--remote", "Target the deployed database").option("--env <name>", "Wrangler environment").example("flare role:add support").action(async (name, options2) => {
+    process.exitCode = await addRole(name, options2);
+  });
+  cli.command("user:role <email> <role>", "Set a user's role, e.g. make the first admin (local database unless --remote)").option("--remote", "Target the deployed database").option("--env <name>", "Wrangler environment").example("flare user:role you@example.com admin").action(async (email, role, options2) => {
+    process.exitCode = await setUserRole(email, role, options2);
+  });
+  cli.command("migrate", "Apply pending D1 migrations (local database unless --remote)").option("--remote", "Target the deployed database").option("--env <name>", "Wrangler environment").option("--database <binding>", "D1 binding, when the app has several").action(async (options2) => {
+    process.exitCode = await migrate(options2);
+  });
+  cli.command("migrate:rollback", "Undo the most recently applied migrations").option("--steps <n>", "How many migrations to roll back", { default: 1 }).option("--remote", "Target the deployed database (requires --yes)").option("--yes", "Confirm a remote rollback").option("--env <name>", "Wrangler environment").option("--database <binding>", "D1 binding, when the app has several").action(async (options2) => {
+    process.exitCode = await rollback({ ...options2, steps: Number(options2.steps) });
+  });
+  cli.command("seed [...names]", "Run seed files from seeds/ against the local D1 database").example("flare seed            # every seed, in file-name order").example("flare seed contacts   # just seeds/contacts.seed.ts").action(async (names) => {
+    await runSeeds({ names });
+  });
+  cli.command("seed:make <name>", "Create seeds/<name>.seed.ts (with example rows for a matching resource)").option("--resource <name>", "Resource to write example rows for").action(async (name, options2) => {
+    await makeSeed(name, options2);
+  });
+  cli.command("billing:sync-plans", "Pull Stripe Products/Prices into the Plan table and enable plan changes in the portal (local database unless --remote)").option("--remote", "Write to the deployed database").option("--env <name>", "Wrangler environment").option("--all", "Import every active Product, not only those tagged flare_app=<app name>").example("flare billing:sync-plans").example("flare billing:sync-plans --remote").action(async (options2) => {
+    await syncPlans({ remote: options2.remote, env: options2.env, all: options2.all });
+  });
+  cli.command("sync-types", "Regenerate schema, routes, clients, and validators from resource descriptors; report drift").option("--check", "Change nothing; exit 1 if anything is out of sync (CI)").option("--force", "Overwrite generated blocks that were edited by hand").action(async (options2) => {
+    process.exitCode = await syncTypes(options2);
+  });
+  for (const [name, spec] of Object.entries(DELEGATED_COMMANDS)) {
+    cli.command(`${name} [...args]`, spec.description).allowUnknownOptions();
+  }
+  cli.help();
+  cli.version(FLARE_VERSION2);
+  return cli;
+}
+
+// src/index.ts
+try {
+  const [command, ...rest] = process.argv.slice(2);
+  if (isDelegatedCommand(command)) {
+    process.exitCode = await runDelegated(command, rest);
+  } else {
+    const cli = createCli();
+    cli.parse(process.argv, { run: false });
+    if (!cli.matchedCommand && cli.args.length === 0 && !cli.options.help && !cli.options.version) {
+      cli.outputHelp();
+    } else {
+      await cli.runMatchedCommand();
+    }
+  }
+} catch (error) {
+  console.error(pc16.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
+  process.exitCode = 1;
+}