@flaredev/cli 0.1.2 → 0.3.0

package/templates/app/components/ui/checkbox.tsx

@@ -0,0 +1,25 @@
+"use client"
+
+import * as React from "react"
+import { CheckIcon } from "lucide-react"
+import { Checkbox as CheckboxPrimitive } from "radix-ui"
+import { cn } from "@/lib/utils"
+
+function Checkbox({ className, ...props }: React.ComponentProps<typeof CheckboxPrimitive.Root>) {
+  return (
+    <CheckboxPrimitive.Root
+      data-slot="checkbox"
+      className={cn(
+        "peer size-4 shrink-0 rounded-[4px] border border-input shadow-xs transition-shadow outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 data-[state=checked]:border-primary data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground dark:bg-input/30 dark:aria-invalid:ring-destructive/40 dark:data-[state=checked]:bg-primary",
+        className
+      )}
+      {...props}
+    >
+      <CheckboxPrimitive.Indicator data-slot="checkbox-indicator" className="grid place-content-center text-current transition-none">
+        <CheckIcon className="size-3.5" />
+      </CheckboxPrimitive.Indicator>
+    </CheckboxPrimitive.Root>
+  )
+}
+
+export { Checkbox }

package/templates/app/components/ui/radio-group.tsx

@@ -0,0 +1,29 @@
+"use client"
+
+import * as React from "react"
+import { CircleIcon } from "lucide-react"
+import { RadioGroup as RadioGroupPrimitive } from "radix-ui"
+import { cn } from "@/lib/utils"
+
+function RadioGroup({ className, ...props }: React.ComponentProps<typeof RadioGroupPrimitive.Root>) {
+  return <RadioGroupPrimitive.Root data-slot="radio-group" className={cn("grid gap-3", className)} {...props} />
+}
+
+function RadioGroupItem({ className, ...props }: React.ComponentProps<typeof RadioGroupPrimitive.Item>) {
+  return (
+    <RadioGroupPrimitive.Item
+      data-slot="radio-group-item"
+      className={cn(
+        "aspect-square size-4 shrink-0 rounded-full border border-input text-primary shadow-xs transition-[color,box-shadow] outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:bg-input/30 dark:aria-invalid:ring-destructive/40",
+        className
+      )}
+      {...props}
+    >
+      <RadioGroupPrimitive.Indicator data-slot="radio-group-indicator" className="relative flex items-center justify-center">
+        <CircleIcon className="absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2 fill-primary" />
+      </RadioGroupPrimitive.Indicator>
+    </RadioGroupPrimitive.Item>
+  )
+}
+
+export { RadioGroup, RadioGroupItem }

package/templates/app/db/auth-schema.ts

@@ -1,118 +1,167 @@
-/**
- * Better Auth tables (user, session, account, verification), including the admin
- * plugin's columns (user.role/banned/ban_reason/ban_expires, session.impersonated_by).
- * Generated with `auth generate --adapter drizzle --dialect sqlite` (better-auth 1.7.5).
- * Re-generate if you add Better Auth plugins that extend the schema.
- */
-import { relations, sql } from "drizzle-orm";
-import { sqliteTable, text, integer, index } from "drizzle-orm/sqlite-core";
-
-export const user = sqliteTable("user", {
-  id: text("id").primaryKey(),
-  name: text("name").notNull(),
-  email: text("email").notNull().unique(),
-  emailVerified: integer("email_verified", { mode: "boolean" })
-    .default(false)
-    .notNull(),
-  image: text("image"),
-  createdAt: integer("created_at", { mode: "timestamp_ms" })
-    .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
-    .notNull(),
-  updatedAt: integer("updated_at", { mode: "timestamp_ms" })
-    .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
-    .$onUpdate(() => /* @__PURE__ */ new Date())
-    .notNull(),
-  role: text("role"),
-  banned: integer("banned", { mode: "boolean" }).default(false),
-  banReason: text("ban_reason"),
-  banExpires: integer("ban_expires", { mode: "timestamp_ms" }),
-});
-
-export const session = sqliteTable(
-  "session",
-  {
-    id: text("id").primaryKey(),
-    expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
-    token: text("token").notNull().unique(),
-    createdAt: integer("created_at", { mode: "timestamp_ms" })
-      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
-      .notNull(),
-    updatedAt: integer("updated_at", { mode: "timestamp_ms" })
-      .$onUpdate(() => /* @__PURE__ */ new Date())
-      .notNull(),
-    ipAddress: text("ip_address"),
-    userAgent: text("user_agent"),
-    userId: text("user_id")
-      .notNull()
-      .references(() => user.id, { onDelete: "cascade" }),
-    impersonatedBy: text("impersonated_by"),
-  },
-  (table) => [index("session_userId_idx").on(table.userId)],
-);
-
-export const account = sqliteTable(
-  "account",
-  {
-    id: text("id").primaryKey(),
-    accountId: text("account_id").notNull(),
-    providerId: text("provider_id").notNull(),
-    userId: text("user_id")
-      .notNull()
-      .references(() => user.id, { onDelete: "cascade" }),
-    accessToken: text("access_token"),
-    refreshToken: text("refresh_token"),
-    idToken: text("id_token"),
-    accessTokenExpiresAt: integer("access_token_expires_at", {
-      mode: "timestamp_ms",
-    }),
-    refreshTokenExpiresAt: integer("refresh_token_expires_at", {
-      mode: "timestamp_ms",
-    }),
-    scope: text("scope"),
-    password: text("password"),
-    createdAt: integer("created_at", { mode: "timestamp_ms" })
-      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
-      .notNull(),
-    updatedAt: integer("updated_at", { mode: "timestamp_ms" })
-      .$onUpdate(() => /* @__PURE__ */ new Date())
-      .notNull(),
-  },
-  (table) => [index("account_userId_idx").on(table.userId)],
-);
-
-export const verification = sqliteTable(
-  "verification",
-  {
-    id: text("id").primaryKey(),
-    identifier: text("identifier").notNull(),
-    value: text("value").notNull(),
-    expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
-    createdAt: integer("created_at", { mode: "timestamp_ms" })
-      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
-      .notNull(),
-    updatedAt: integer("updated_at", { mode: "timestamp_ms" })
-      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
-      .$onUpdate(() => /* @__PURE__ */ new Date())
-      .notNull(),
-  },
-  (table) => [index("verification_identifier_idx").on(table.identifier)],
-);
-
-export const userRelations = relations(user, ({ many }) => ({
-  sessions: many(session),
-  accounts: many(account),
-}));
-
-export const sessionRelations = relations(session, ({ one }) => ({
-  user: one(user, {
-    fields: [session.userId],
-    references: [user.id],
-  }),
-}));
-
-export const accountRelations = relations(account, ({ one }) => ({
-  user: one(user, {
-    fields: [account.userId],
-    references: [user.id],
-  }),
-}));
+/**
+ * Better Auth tables (user, session, account, verification), including the admin
+ * plugin's columns (user.role/banned/ban_reason/ban_expires, session.impersonated_by),
+ * the two-factor plugin (user.two_factor_enabled, two_factor) and passkeys (passkey).
+ * Every sign-in method's tables exist whether or not lib/auth-config.ts switches it on.
+ * Generated with `auth generate --adapter drizzle --dialect sqlite` (better-auth 1.7.5).
+ * Re-generate if you add Better Auth plugins that extend the schema.
+ */
+import { relations, sql } from "drizzle-orm";
+import { sqliteTable, text, integer, index } from "drizzle-orm/sqlite-core";
+
+export const user = sqliteTable("user", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  emailVerified: integer("email_verified", { mode: "boolean" })
+    .default(false)
+    .notNull(),
+  image: text("image"),
+  createdAt: integer("created_at", { mode: "timestamp_ms" })
+    .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
+    .notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp_ms" })
+    .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
+    .$onUpdate(() => /* @__PURE__ */ new Date())
+    .notNull(),
+  role: text("role"),
+  banned: integer("banned", { mode: "boolean" }).default(false),
+  banReason: text("ban_reason"),
+  banExpires: integer("ban_expires", { mode: "timestamp_ms" }),
+  twoFactorEnabled: integer("two_factor_enabled", { mode: "boolean" }).default(false),
+});
+
+export const session = sqliteTable(
+  "session",
+  {
+    id: text("id").primaryKey(),
+    expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
+    token: text("token").notNull().unique(),
+    createdAt: integer("created_at", { mode: "timestamp_ms" })
+      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
+      .notNull(),
+    updatedAt: integer("updated_at", { mode: "timestamp_ms" })
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    impersonatedBy: text("impersonated_by"),
+  },
+  (table) => [index("session_userId_idx").on(table.userId)],
+);
+
+export const account = sqliteTable(
+  "account",
+  {
+    id: text("id").primaryKey(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: integer("access_token_expires_at", {
+      mode: "timestamp_ms",
+    }),
+    refreshTokenExpiresAt: integer("refresh_token_expires_at", {
+      mode: "timestamp_ms",
+    }),
+    scope: text("scope"),
+    password: text("password"),
+    createdAt: integer("created_at", { mode: "timestamp_ms" })
+      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
+      .notNull(),
+    updatedAt: integer("updated_at", { mode: "timestamp_ms" })
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+  },
+  (table) => [index("account_userId_idx").on(table.userId)],
+);
+
+export const verification = sqliteTable(
+  "verification",
+  {
+    id: text("id").primaryKey(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
+    createdAt: integer("created_at", { mode: "timestamp_ms" })
+      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
+      .notNull(),
+    updatedAt: integer("updated_at", { mode: "timestamp_ms" })
+      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`)
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+  },
+  (table) => [index("verification_identifier_idx").on(table.identifier)],
+);
+
+export const twoFactor = sqliteTable(
+  "two_factor",
+  {
+    id: text("id").primaryKey(),
+    secret: text("secret").notNull(),
+    backupCodes: text("backup_codes").notNull(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    verified: integer("verified", { mode: "boolean" }).default(true),
+    failedVerificationCount: integer("failed_verification_count").default(0),
+    lockedUntil: integer("locked_until", { mode: "timestamp_ms" }),
+  },
+  (table) => [index("twoFactor_secret_idx").on(table.secret), index("twoFactor_userId_idx").on(table.userId)],
+);
+
+export const passkey = sqliteTable(
+  "passkey",
+  {
+    id: text("id").primaryKey(),
+    name: text("name"),
+    publicKey: text("public_key").notNull(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    credentialID: text("credential_id").notNull(),
+    counter: integer("counter").notNull(),
+    deviceType: text("device_type").notNull(),
+    backedUp: integer("backed_up", { mode: "boolean" }).notNull(),
+    transports: text("transports"),
+    createdAt: integer("created_at", { mode: "timestamp_ms" }),
+    aaguid: text("aaguid"),
+  },
+  (table) => [index("passkey_userId_idx").on(table.userId), index("passkey_credentialID_idx").on(table.credentialID)],
+);
+
+export const userRelations = relations(user, ({ many }) => ({
+  sessions: many(session),
+  accounts: many(account),
+  twoFactors: many(twoFactor),
+  passkeys: many(passkey),
+}));
+
+export const twoFactorRelations = relations(twoFactor, ({ one }) => ({
+  user: one(user, { fields: [twoFactor.userId], references: [user.id] }),
+}));
+
+export const passkeyRelations = relations(passkey, ({ one }) => ({
+  user: one(user, { fields: [passkey.userId], references: [user.id] }),
+}));
+
+export const sessionRelations = relations(session, ({ one }) => ({
+  user: one(user, {
+    fields: [session.userId],
+    references: [user.id],
+  }),
+}));
+
+export const accountRelations = relations(account, ({ one }) => ({
+  user: one(user, {
+    fields: [account.userId],
+    references: [user.id],
+  }),
+}));

package/templates/app/db/flare-schema.ts

@@ -1,5 +1,5 @@
 import { sql } from "drizzle-orm";
-import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
 
 /**
  * Roles a user can hold (`user.role` from Better Auth's admin plugin).
@@ -13,3 +13,35 @@ export const role = sqliteTable("role", {
     .notNull()
     .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`),
 });
+
+/**
+ * Who changed what, and when. Written by the dashboard's actions (lib/audit.ts) for
+ * every create, update, delete and import, and read by /dashboard/observability.
+ *
+ * `changes` holds only the fields that moved, as JSON, never the whole record: an audit
+ * trail that copies every row is a second database of the same data, and a place for
+ * secrets to leak into.
+ */
+export const auditLog = sqliteTable(
+  "audit_log",
+  {
+    id: text("id").primaryKey().$defaultFn(() => crypto.randomUUID()),
+    /** "create", "update", "delete", "import" or "bulk-delete". */
+    action: text("action").notNull(),
+    /** The resource's descriptor name, e.g. "Contact". */
+    resource: text("resource").notNull(),
+    /** The record, when the action was about one. */
+    recordId: text("record_id"),
+    /** How the record reads afterwards, for the log's own listing. */
+    recordLabel: text("record_label"),
+    userId: text("user_id"),
+    userEmail: text("user_email"),
+    /** Fields that changed: { field: { from, to } }, or a count for bulk actions. */
+    changes: text("changes", { mode: "json" }).$type<Record<string, unknown> | null>(),
+    ip: text("ip"),
+    createdAt: integer("created_at", { mode: "timestamp_ms" })
+      .notNull()
+      .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`),
+  },
+  (table) => [index("audit_log_created_at_idx").on(table.createdAt), index("audit_log_resource_idx").on(table.resource)],
+);

package/templates/app/lib/analytics.ts

@@ -0,0 +1,121 @@
+/**
+ * Traffic, errors and latency for this Worker, from Cloudflare's GraphQL Analytics API.
+ *
+ * Needs two secrets, and works without them: `CLOUDFLARE_ACCOUNT_ID` and
+ * `CLOUDFLARE_API_TOKEN` (a token with Account Analytics: Read). Without them the
+ * dashboard says so and shows the rest of the page, because analytics is the one part
+ * of an app that can't be read from its own database.
+ *
+ *   wrangler secret put CLOUDFLARE_API_TOKEN
+ */
+import { env } from "cloudflare:workers";
+
+const ENDPOINT = "https://api.cloudflare.com/client/v4/graphql";
+
+export interface RequestPoint {
+  /** "2026-09-22" */
+  date: string;
+  requests: number;
+  errors: number;
+  /** Median CPU time in milliseconds. */
+  medianCpuMs: number;
+}
+
+export interface WorkerAnalytics {
+  points: RequestPoint[];
+  requests: number;
+  errors: number;
+  /** Errors as a percentage of requests. */
+  errorRate: number;
+  medianCpuMs: number;
+}
+
+/** Why there's nothing to show, when there's nothing to show. */
+export type AnalyticsResult = { ok: true; data: WorkerAnalytics } | { ok: false; reason: "unconfigured" | "failed"; message: string };
+
+interface GraphQlResponse {
+  data?: {
+    viewer?: {
+      accounts?: {
+        workersInvocationsAdaptive?: {
+          dimensions: { date: string };
+          sum: { requests: number; errors: number };
+          quantiles: { cpuTimeP50: number };
+        }[];
+      }[];
+    };
+  };
+  errors?: { message: string }[];
+}
+
+const QUERY = `query WorkerTraffic($accountTag: String!, $scriptName: String!, $since: Date!, $until: Date!) {
+  viewer {
+    accounts(filter: { accountTag: $accountTag }) {
+      workersInvocationsAdaptive(
+        limit: 100
+        filter: { scriptName: $scriptName, date_geq: $since, date_leq: $until }
+        orderBy: [date_ASC]
+      ) {
+        dimensions { date }
+        sum { requests errors }
+        quantiles { cpuTimeP50 }
+      }
+    }
+  }
+}`;
+
+/** Traffic for the last `days` days, a point per day. */
+export async function workerAnalytics(scriptName: string, days = 7): Promise<AnalyticsResult> {
+  const vars = env as unknown as Record<string, string | undefined>;
+  const accountTag = vars.CLOUDFLARE_ACCOUNT_ID;
+  const token = vars.CLOUDFLARE_API_TOKEN;
+  if (!accountTag || !token) {
+    return {
+      ok: false,
+      reason: "unconfigured",
+      message: "Set CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN to read traffic, errors and CPU time from Cloudflare.",
+    };
+  }
+
+  const day = (offset: number) => new Date(Date.now() - offset * 86_400_000).toISOString().slice(0, 10);
+  try {
+    const response = await fetch(ENDPOINT, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({
+        query: QUERY,
+        variables: { accountTag, scriptName, since: day(days - 1), until: day(0) },
+      }),
+      signal: AbortSignal.timeout(8000),
+    });
+    if (!response.ok) {
+      return { ok: false, reason: "failed", message: `Cloudflare answered ${response.status}. Check the token's Account Analytics: Read permission.` };
+    }
+    const body = (await response.json()) as GraphQlResponse;
+    if (body.errors?.length) return { ok: false, reason: "failed", message: body.errors[0]!.message };
+
+    const series = body.data?.viewer?.accounts?.[0]?.workersInvocationsAdaptive ?? [];
+    const points: RequestPoint[] = series.map((entry) => ({
+      date: entry.dimensions.date,
+      requests: entry.sum.requests,
+      errors: entry.sum.errors,
+      // Cloudflare reports CPU time in microseconds.
+      medianCpuMs: Math.round((entry.quantiles.cpuTimeP50 / 1000) * 100) / 100,
+    }));
+    const requests = points.reduce((total, point) => total + point.requests, 0);
+    const errors = points.reduce((total, point) => total + point.errors, 0);
+    const medians = points.map((point) => point.medianCpuMs).sort((a, b) => a - b);
+    return {
+      ok: true,
+      data: {
+        points,
+        requests,
+        errors,
+        errorRate: requests > 0 ? (errors / requests) * 100 : 0,
+        medianCpuMs: medians.length ? medians[Math.floor(medians.length / 2)]! : 0,
+      },
+    };
+  } catch (error) {
+    return { ok: false, reason: "failed", message: error instanceof Error ? error.message : "Couldn't reach Cloudflare." };
+  }
+}

package/templates/app/lib/api-docs.ts

@@ -0,0 +1,16 @@
+/**
+ * The API reference at /api/reference (Scalar), built from the OpenAPI document at
+ * /api/openapi.json. Both are generated from resources/ and policies/ on every
+ * request, so they always match the API.
+ */
+export const apiDocs = {
+  title: "__APP_NAME__ API",
+  description: "",
+  version: "1.0.0",
+  /**
+   * "role": a signed-in user sees the endpoints their role may call (admins see
+   * everything), a visitor only the sign-in endpoints.
+   * "public": everyone sees every endpoint (requests still need the right role).
+   */
+  visibility: "role" as "role" | "public",
+};

package/templates/app/lib/audit.ts

@@ -0,0 +1,80 @@
+import { headers } from "next/headers";
+import { desc, eq, gte, sql } from "drizzle-orm";
+import { getDb } from "@/db";
+import { auditLog } from "@/db/flare-schema";
+import { dashboardSession } from "./dashboard";
+
+export type AuditAction = "create" | "update" | "delete" | "import" | "bulk-delete";
+
+export interface AuditEntry {
+  action: AuditAction;
+  resource: string;
+  recordId?: string | null;
+  recordLabel?: string | null;
+  changes?: Record<string, unknown> | null;
+}
+
+/**
+ * Record a change in the audit log.
+ *
+ * Never throws: an audit trail that can take the write down with it is worse than one
+ * with a gap, and the caller has already changed the database by the time we're here.
+ */
+export async function recordAudit(entry: AuditEntry): Promise<void> {
+  try {
+    const { session } = await dashboardSession();
+    const headerList = await headers();
+    await getDb()
+      .insert(auditLog)
+      .values({
+        action: entry.action,
+        resource: entry.resource,
+        recordId: entry.recordId ?? null,
+        recordLabel: entry.recordLabel ?? null,
+        userId: session?.user.id ?? null,
+        userEmail: session?.user.email ?? null,
+        changes: entry.changes ?? null,
+        ip: headerList.get("cf-connecting-ip") ?? null,
+      });
+  } catch {
+    // Deliberately quiet.
+  }
+}
+
+/** Which fields moved, and from what to what. Only the differences, never the whole record. */
+export function diffFields(before: Record<string, unknown> | null | undefined, after: Record<string, unknown>): Record<string, { from: unknown; to: unknown }> {
+  const changes: Record<string, { from: unknown; to: unknown }> = {};
+  for (const [key, value] of Object.entries(after)) {
+    if (key === "updatedAt" || key === "createdAt") continue;
+    const previous = before?.[key];
+    const same = JSON.stringify(previous ?? null) === JSON.stringify(value ?? null);
+    if (!same) changes[key] = { from: previous ?? null, to: value ?? null };
+  }
+  return changes;
+}
+
+export interface AuditRow {
+  id: string;
+  action: string;
+  resource: string;
+  recordId: string | null;
+  recordLabel: string | null;
+  userEmail: string | null;
+  changes: Record<string, unknown> | null;
+  createdAt: Date;
+}
+
+/** The most recent entries, newest first. */
+export async function recentAudit(limit = 25, resource?: string): Promise<AuditRow[]> {
+  const db = getDb();
+  const query = db.select().from(auditLog).orderBy(desc(auditLog.createdAt)).limit(limit);
+  const rows = resource ? await query.where(eq(auditLog.resource, resource)) : await query;
+  return rows as AuditRow[];
+}
+
+/** How many changes were recorded in the last `days` days, for the observability summary. */
+export async function auditCount(days = 7): Promise<number> {
+  const since = new Date(Date.now() - days * 86_400_000);
+  const [row] = await getDb().select({ total: sql<number>`count(*)` }).from(auditLog).where(gte(auditLog.createdAt, since));
+  return row?.total ?? 0;
+}

package/templates/app/lib/auth-client.ts

@@ -1,4 +1,19 @@
+import { passkeyClient } from "@better-auth/passkey/client";
+import { emailOTPClient, magicLinkClient, twoFactorClient } from "better-auth/client/plugins";
 import { createAuthClient } from "better-auth/react";
 
 /** Browser-side auth client. Same origin as the app, so no baseURL is needed. */
-export const authClient = createAuthClient();
+export const authClient = createAuthClient({
+  plugins: [
+    magicLinkClient(),
+    emailOTPClient(),
+    passkeyClient(),
+    // A password sign-in that needs a second factor continues on /two-factor.
+    twoFactorClient({
+      onTwoFactorRedirect: () => {
+        const next = new URLSearchParams(window.location.search).get("next");
+        window.location.href = `/two-factor${next ? `?next=${encodeURIComponent(next)}` : ""}`;
+      },
+    }),
+  ],
+});