@flaredev/cli 0.1.2 → 0.3.0

package/dist/index.js

@@ -1,47 +1,105 @@
 // src/index.ts
-import pc18 from "picocolors";
+import pc21 from "picocolors";
 
 // src/cli.ts
 import { cac } from "cac";
-import { FLARE_VERSION as FLARE_VERSION2 } from "@flaredev/core";
+import * as prompts3 from "@clack/prompts";
+import { FLARE_VERSION as FLARE_VERSION3 } from "@flaredev/core";
 
 // src/commands/create.ts
 import { randomBytes } from "crypto";
-import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { appendFileSync, copyFileSync, existsSync as existsSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { basename, dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2 } from "path";
+import * as prompts from "@clack/prompts";
 import pc from "picocolors";
 import { FLARE_VERSION } from "@flaredev/core";
 
 // src/auth-providers.ts
 var AUTH_PROVIDERS = {
-  google: { envPrefix: "GOOGLE", console: "https://console.cloud.google.com/apis/credentials" },
-  github: { envPrefix: "GITHUB", console: "https://github.com/settings/developers" }
+  google: { label: "Google", envPrefix: "GOOGLE", console: "https://console.cloud.google.com/apis/credentials", extra: [] },
+  github: { label: "GitHub", envPrefix: "GITHUB", console: "https://github.com/settings/developers", extra: [] },
+  apple: {
+    label: "Apple",
+    envPrefix: "APPLE",
+    console: "https://developer.apple.com/account/resources/identifiers/list/serviceId",
+    // The client secret is a JWT signed with your key; the bundle id is only for native apps.
+    extra: ["# APPLE_CLIENT_SECRET is a JWT you generate from your Sign in with Apple key (see the auth guide).", "APPLE_APP_BUNDLE_ID="]
+  },
+  microsoft: {
+    label: "Microsoft",
+    envPrefix: "MICROSOFT",
+    console: "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+    extra: ['# "common" (the default) accepts personal and work accounts; a tenant id limits sign-in to one organisation.', "MICROSOFT_TENANT_ID="]
+  }
 };
-function parseAuthProviders(input) {
-  if (!input) return [];
+var AUTH_METHODS = {
+  "magic-link": "Magic links (a sign-in link by email)",
+  "email-otp": "Email codes (a 6-digit sign-in code)",
+  passkeys: "Passkeys (Face ID, Touch ID, Windows Hello)",
+  "2fa-app": "Two-factor with an authenticator app, plus backup codes",
+  "2fa-email": "Two-factor with codes by email"
+};
+var DEFAULT_AUTH_METHODS = ["magic-link", "email-otp", "passkeys", "2fa-app", "2fa-email"];
+function parseList(input, known, what) {
   const names = input.split(",").map((name) => name.trim().toLowerCase()).filter(Boolean);
-  const unknown = names.filter((name) => !(name in AUTH_PROVIDERS));
+  const unknown = names.filter((name) => !known.includes(name));
   if (unknown.length > 0) {
-    throw new Error(
-      `Unknown auth provider${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}. Supported: ${Object.keys(AUTH_PROVIDERS).join(", ")}.`
-    );
+    throw new Error(`Unknown ${what}${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}. Supported: ${known.join(", ")}.`);
   }
   return [...new Set(names)];
 }
-function socialProvidersCode(providers) {
-  if (providers.length === 0) return "{}";
-  const entries = providers.map((provider) => {
-    const id = `env.${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_ID`;
-    const secret = `env.${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_SECRET`;
-    return `    ...(${id} && ${secret} ? { ${provider}: { clientId: ${id}, clientSecret: ${secret} } } : {}),`;
-  });
-  return [
-    "{",
-    "    // Each provider switches on once its credentials are set: .dev.vars locally,",
-    "    // `wrangler secret put` in production.",
-    ...entries,
-    "  }"
-  ].join("\n");
+function parseAuthProviders(input) {
+  if (!input) return [];
+  return parseList(input, Object.keys(AUTH_PROVIDERS), "auth provider");
+}
+function parseAuthMethods(input) {
+  if (input === void 0) return DEFAULT_AUTH_METHODS;
+  const value = input.trim().toLowerCase();
+  if (value === "all") return [...DEFAULT_AUTH_METHODS];
+  if (value === "none" || value === "") return [];
+  return parseList(value, Object.keys(AUTH_METHODS), "sign-in method");
+}
+function renderAuthConfig(methods, providers) {
+  const on = (method) => methods.includes(method);
+  return `/**
+ * How people sign in to this app. \`flare create\` wrote the choices you made; change
+ * them here any time. Every method's tables already exist, so switching one on or off
+ * needs no migration, and a method that's off is refused by the API, not just hidden.
+ *
+ * Email and password sign-in is always available.
+ */
+export const authConfig = {
+  /** A sign-in link by email. */
+  magicLink: ${on("magic-link")},
+  /** A 6-digit sign-in code by email. */
+  emailOtp: ${on("email-otp")},
+  /** Face ID, Touch ID, Windows Hello or a security key. */
+  passkeys: ${on("passkeys")},
+  twoFactor: {
+    /** Codes from an authenticator app (TOTP), with backup codes. */
+    authenticator: ${on("2fa-app")},
+    /** Codes by email as the second step. */
+    email: ${on("2fa-email")},
+  },
+  /**
+   * Social sign-in. Each provider also needs its credentials (see .dev.vars.example);
+   * without them its button stays hidden.
+   */
+  social: ${JSON.stringify(providers).replace(/","/g, '", "')} as SocialProvider[],
+  /** Refuse password sign-in until the email address is verified. */
+  requireEmailVerification: false,
+  /**
+   * Check new passwords against Have I Been Pwned's breach list. Only the first five
+   * characters of the password's hash are sent, and an outage lets the password through.
+   */
+  checkBreachedPasswords: true,
+};
+
+export type SocialProvider = "google" | "github" | "apple" | "microsoft";
+
+/** Whether any second factor can be set up. */
+export const twoFactorAvailable = authConfig.twoFactor.authenticator || authConfig.twoFactor.email;
+`;
 }
 function devVarsEntries(providers) {
   return providers.map((provider) => `${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_ID=
@@ -50,21 +108,39 @@ ${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_SECRET=
 }
 function devVarsExampleEntries(providers) {
   return providers.map((provider) => {
-    const { envPrefix, console: console2 } = AUTH_PROVIDERS[provider];
+    const { label, envPrefix, console: console2, extra } = AUTH_PROVIDERS[provider];
     return [
       "",
-      `# ${provider} OAuth app: ${console2}`,
+      `# ${label} sign-in: ${console2}`,
       `# Callback URL: <your app URL>/api/auth/callback/${provider}`,
       `${envPrefix}_CLIENT_ID=`,
       `${envPrefix}_CLIENT_SECRET=`,
+      ...extra,
       ""
     ].join("\n");
   }).join("");
 }
 
+// src/themes.ts
+var THEMES = {
+  default: "Calm and centred, indigo accents",
+  coral: "Warm and rounded, sign-in as a card over the page",
+  amber: "Plain and direct, boxed forms with pill buttons",
+  sky: "Crisp blue, bold headings, social sign-in first",
+  mono: "Black and white on a fine grid",
+  emerald: "Fresh green, sign-in beside a customer quote"
+};
+function parseTheme(value) {
+  if (value === void 0) return "default";
+  const name = value.trim().toLowerCase();
+  if (!(name in THEMES)) throw new Error(`Unknown theme "${value}". Themes: ${Object.keys(THEMES).join(", ")}.`);
+  return name;
+}
+
 // src/versions.ts
 var APP_DEPENDENCIES = {
   "@better-auth/drizzle-adapter": "1.7.5",
+  "@better-auth/passkey": "1.7.5",
   // Server components import Slot from here rather than the "radix-ui" umbrella (see components/ui/button.tsx).
   "@radix-ui/react-slot": "1.3.3",
   "@vinext/cloudflare": "1.0.0-beta.8",
@@ -80,6 +156,14 @@ var APP_DEPENDENCIES = {
   sonner: "^2.0.8",
   "tailwind-merge": "^3.7.0",
   "tw-animate-css": "^1.4.0",
+  // Typefaces for the six themes (app/globals.css).
+  "@fontsource-variable/figtree": "5.3.0",
+  "@fontsource-variable/geist": "5.3.0",
+  "@fontsource-variable/inter": "5.3.0",
+  "@fontsource-variable/noto-sans": "5.3.0",
+  "@fontsource-variable/plus-jakarta-sans": "5.3.0",
+  // QR codes for authenticator-app (2FA) setup.
+  uqr: "0.1.3",
   "drizzle-orm": "^0.45.2",
   react: "19.3.0",
   "react-dom": "19.3.0",
@@ -101,6 +185,43 @@ var APP_DEV_DEPENDENCIES = {
   wrangler: "^4.132.0"
 };
 
+// src/terminal.ts
+var isTTY = () => Boolean(process.stdout.isTTY);
+function formatDuration(ms) {
+  const seconds = Math.round(ms / 1e3);
+  if (seconds < 60) return `${seconds}s`;
+  if (seconds < 3600) return `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
+  return `${Math.floor(seconds / 3600)}h ${String(Math.floor(seconds % 3600 / 60)).padStart(2, "0")}m`;
+}
+var formatCount = (value) => value.toLocaleString();
+function formatRate(count, ms, unit = "rows") {
+  if (ms <= 0) return `${formatCount(count)} ${unit}/s`;
+  return `${formatCount(Math.round(count / ms * 1e3))} ${unit}/s`;
+}
+function progressLine(everyMs = 120) {
+  if (!isTTY()) return { update: () => {
+  }, done: () => {
+  } };
+  let last = 0;
+  let width = 0;
+  const write = (message) => {
+    process.stdout.write(`\r${message.padEnd(width)}`);
+    width = Math.max(width, message.length);
+  };
+  return {
+    update(message) {
+      const now = Date.now();
+      if (now - last < everyMs) return;
+      last = now;
+      write(message);
+    },
+    done() {
+      if (width > 0) process.stdout.write(`\r${" ".repeat(width)}\r`);
+      width = 0;
+    }
+  };
+}
+
 // src/utils/fs.ts
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { dirname, join, resolve } from "path";
@@ -108,16 +229,19 @@ import { fileURLToPath } from "url";
 var RENAMES = { _gitignore: ".gitignore" };
 function copyTemplate(from, to, tokens) {
   mkdirSync(to, { recursive: true });
+  let files = 0;
   for (const entry of readdirSync(from)) {
     const src = join(from, entry);
     const dest = join(to, RENAMES[entry] ?? entry);
     if (statSync(src).isDirectory()) {
-      copyTemplate(src, dest, tokens);
+      files += copyTemplate(src, dest, tokens);
       continue;
     }
     const content = readFileSync(src, "utf8").replace(/__([A-Z_]+)__/g, (match, key) => tokens[key] ?? match);
     writeFileSync(dest, content);
+    files++;
   }
+  return files;
 }
 function writeJson(path, value) {
   mkdirSync(dirname(path), { recursive: true });
@@ -194,14 +318,17 @@ function createApp(target, options2 = {}) {
   }
   const packageManager = options2.pm ?? detectPackageManager();
   const authProviders = parseAuthProviders(options2.authProviders);
+  const authMethods = parseAuthMethods(options2.auth);
+  const theme = parseTheme(options2.theme);
   const inWorkspace = findUp("pnpm-workspace.yaml", dirname2(dir)) !== void 0;
   const compatibilityDate = options2.compatibilityDate ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  copyTemplate(join2(templatesDir, "app"), dir, {
+  const files = copyTemplate(join2(templatesDir, "app"), dir, {
     APP_NAME: name,
     COMPAT_DATE: compatibilityDate,
     PM: packageManager,
-    SOCIAL_PROVIDERS: socialProvidersCode(authProviders)
+    THEME: theme
   });
+  writeFileSync2(join2(dir, "lib", "auth-config.ts"), renderAuthConfig(authMethods, authProviders));
   appendFileSync(join2(dir, ".dev.vars.example"), devVarsExampleEntries(authProviders));
   writeJson(join2(dir, "package.json"), {
     name,
@@ -230,42 +357,40 @@ ${devVarsEntries(authProviders)}`
   if (packageManager === "pnpm" && !inWorkspace) {
     writeFileSync2(join2(dir, "pnpm-workspace.yaml"), "allowBuilds:\n  esbuild: true\n  workerd: true\n  sharp: false\n");
   }
-  const log = options2.log ?? ((message) => console.log(message));
+  const pinned = flarePackageSpec("core", dir, packageManager).startsWith("^");
+  if (pinned) copyLockfile(packageManager, dir);
+  const log2 = options2.log ?? ((message) => console.log(message));
+  log2(`${pc.green("\u2714")} Wrote ${files} files to ${relative(process.cwd(), dir) || "."}`);
   if (options2.install !== false) {
-    log(`${pc.green("\u2714")} Wrote the app to ${relative(process.cwd(), dir) || "."}`);
-    log(`${pc.cyan("\u25CF")} Installing dependencies with ${packageManager}. The first install downloads the Workers runtime and toolchain, so it can take a few minutes.
-`);
     const started = Date.now();
-    const code = run(packageManager, installArgs(packageManager), dir);
+    const code = (options2.installer ?? run)(packageManager, installArgs(packageManager), dir);
     if (code !== 0) throw new Error(`${packageManager} install failed (exit code ${code}).`);
-    log(`${pc.green("\u2714")} Installed dependencies ${pc.dim(`(${formatDuration(Date.now() - started)})`)}`);
-    const typegen = runQuiet(packageManager, ["run", "cf-typegen"], dir);
-    if (typegen.code !== 0) {
-      process.stderr.write(typegen.output);
-      throw new Error(`wrangler types failed (exit code ${typegen.code}).`);
-    }
-    log(`${pc.green("\u2714")} Generated types for the Cloudflare bindings`);
+    if (!options2.installer) log2(`${pc.green("\u2714")} Installed dependencies ${pc.dim(`(${formatDuration(Date.now() - started)})`)}`);
   }
   return { dir, name, packageManager, inWorkspace };
 }
-function formatDuration(ms) {
-  const seconds = Math.round(ms / 1e3);
-  return seconds < 60 ? `${seconds}s` : `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
+function copyLockfile(packageManager, dir) {
+  const file = packageManager === "npm" ? "package-lock.json" : packageManager === "pnpm" ? "pnpm-lock.yaml" : void 0;
+  if (!file) return false;
+  const source = join2(templatesDir, "locks", file);
+  if (!existsSync2(source)) return false;
+  copyFileSync(source, join2(dir, file));
+  return true;
 }
 function printNextSteps(result, installed) {
   const rel = relative(process.cwd(), result.dir) || ".";
   const pm = result.packageManager;
-  const step = (command, note) => `  ${command.padEnd(30)}${pc.dim(note)}`;
-  console.log(`
-${pc.green("\u2714")} Created ${pc.bold(result.name)}
-`);
-  console.log("Next steps:");
-  console.log(`  cd ${rel}`);
-  if (!installed) console.log(`  ${pm} install`);
-  console.log(step(`${pm} run dev`, "start it at http://localhost:3000"));
-  console.log(step("npx flare gen resource ...", "add your first resource"));
-  console.log(`
-Quickstart: ${pc.cyan("https://flare-docs.codetotech.com/start/quickstart/")}`);
+  const commands = [
+    [`cd ${rel}`, "your new app"],
+    ...installed ? [] : [[`${pm} install`, "dependencies first"]],
+    [`${pm} run dev`, "http://localhost:3000"],
+    ["npx flare gen resource Contact", "a table, API and admin screens"],
+    ["npx flare seed:resource Contact 1000", "fill it with sample rows"]
+  ];
+  const width = Math.max(...commands.map(([command]) => command.length)) + 2;
+  const steps = commands.map(([command, note2]) => `${pc.cyan(command.padEnd(width))}${pc.dim(note2)}`);
+  prompts.note(steps.join("\n"), "Next");
+  prompts.outro(`${pc.bold(result.name)} is ready ${pc.dim("\xB7")} ${pc.cyan("https://flare-docs.codetotech.com/start/quickstart/")}`);
 }
 
 // src/commands/gen-billing.ts
@@ -274,9 +399,10 @@ import { dirname as dirname6, join as join11 } from "path";
 import pc6 from "picocolors";
 
 // src/generator/grammar.ts
-import { camelCase, FILE_CATEGORIES } from "@flaredev/core";
+import { camelCase, FILE_CATEGORIES, STRING_FORMATS } from "@flaredev/core";
 var SIMPLE_KINDS = ["string", "text", "int", "float", "boolean", "date", "datetime"];
-var ALL_KINDS = [...SIMPLE_KINDS, "enum", "file", "belongsTo", "hasMany"];
+var FORMAT_ALIASES = { phone: "tel" };
+var ALL_KINDS = [...SIMPLE_KINDS, ...STRING_FORMATS, "phone", "enum", "select", "radio", "multiselect", "file", "belongsTo", "hasMany"];
 var FieldGrammarError = class extends Error {
   constructor(message) {
     super(message);
@@ -344,15 +470,21 @@ function parseField(spec) {
   let match;
   if (SIMPLE_KINDS.includes(type)) {
     field.kind = type;
-  } else if (match = /^enum\((.*)\)$/.exec(type)) {
-    field.kind = "enum";
-    const options2 = list(match[1], "enum option", spec);
+  } else if (STRING_FORMATS.includes(type) || type in FORMAT_ALIASES) {
+    field.kind = "string";
+    field.format = FORMAT_ALIASES[type] ?? type;
+  } else if (match = /^(enum|select|radio|multiselect)\((.*)\)$/.exec(type)) {
+    const choice = match[1];
+    field.kind = choice === "multiselect" ? "multiselect" : "enum";
+    if (choice === "radio") field.widget = "radio";
+    if (choice === "multiselect" && unique) throw new FieldGrammarError(`"${spec}": multiselect fields can't be unique.`);
+    const options2 = list(match[2], `${choice} option`, spec);
     for (const option of options2) {
       if (!/^[A-Za-z0-9_-]+$/.test(option)) {
-        throw new FieldGrammarError(`"${spec}": enum option "${option}" may only use letters, digits, _ and -.`);
+        throw new FieldGrammarError(`"${spec}": ${choice} option "${option}" may only use letters, digits, _ and -.`);
       }
     }
-    if (new Set(options2).size !== options2.length) throw new FieldGrammarError(`"${spec}": duplicate enum options.`);
+    if (new Set(options2).size !== options2.length) throw new FieldGrammarError(`"${spec}": duplicate ${choice} options.`);
     field.options = options2;
   } else if (match = /^file(?::\[(.*)\])?$/.exec(type)) {
     field.kind = "file";
@@ -387,7 +519,7 @@ function parseField(spec) {
     const base = type.replace(/[([].*$/, "").replace(/:$/, "");
     throw new FieldGrammarError(`"${spec}": unknown type "${type}".${suggest(base, ALL_KINDS)} Types: ${ALL_KINDS.join(", ")}.`);
   }
-  if (field.kind === "string") {
+  if (field.kind === "string" && !field.format) {
     if (/^email$|Email$/.test(key)) field.format = "email";
     else if (/^(url|website)$|(Url|Website)$/.test(key)) field.format = "url";
   }
@@ -505,6 +637,7 @@ function options(field) {
   if (!field.required) opts.required = false;
   if (field.unique) opts.unique = true;
   if (field.format) opts.format = field.format;
+  if (field.widget) opts.widget = field.widget;
   if (field.kind === "belongsTo" && !field.required) opts.onDelete = "set null";
   return opts;
 }
@@ -513,6 +646,8 @@ function toField(field) {
   switch (field.kind) {
     case "enum":
       return builders.enum(field.options, opts);
+    case "multiselect":
+      return builders.multiselect(field.options, opts);
     case "file":
       return builders.file(field.accept, opts);
     case "belongsTo":
@@ -534,6 +669,8 @@ function renderField(field) {
   switch (field.kind) {
     case "enum":
       return `${field.key}: field.enum(${args(literal(field.options), opts)}),`;
+    case "multiselect":
+      return `${field.key}: field.multiselect(${args(literal(field.options), opts)}),`;
     case "file":
       return `${field.key}: field.file(${args(literal(field.accept), opts)}),`;
     case "belongsTo":
@@ -1302,12 +1439,12 @@ function onPath() {
   const probe = spawnSync2(process.platform === "win32" ? "where" : "which", ["cloudflared"], { encoding: "utf8" });
   return probe.status === 0 ? probe.stdout.split(/\r?\n/)[0]?.trim() ?? null : null;
 }
-async function download(log) {
+async function download(log2) {
   const asset = releaseAsset();
   const dir = cacheDir();
   mkdirSync3(dir, { recursive: true });
   const target = join4(dir, binName);
-  log(pc2.dim(`Downloading cloudflared (one time) into ${dir}\u2026`));
+  log2(pc2.dim(`Downloading cloudflared (one time) into ${dir}\u2026`));
   const response = await fetch(`https://github.com/cloudflare/cloudflared/releases/latest/download/${asset}`);
   if (!response.ok) throw new Error(`Downloading cloudflared failed: HTTP ${response.status}.`);
   const bytes = Buffer.from(await response.arrayBuffer());
@@ -1324,12 +1461,12 @@ async function download(log) {
   if (process.platform !== "win32") chmodSync(target, 493);
   return target;
 }
-async function ensureCloudflared(log = console.log) {
+async function ensureCloudflared(log2 = console.log) {
   const found = onPath();
   if (found) return found;
   const cached = join4(cacheDir(), binName);
   if (existsSync5(cached)) return cached;
-  return download(log);
+  return download(log2);
 }
 async function openTunnel(localUrl, options2 = {}) {
   const bin = await ensureCloudflared(options2.log);
@@ -1483,9 +1620,9 @@ async function runDeploy(args, context3) {
   if (plan.passthroughOnly) return context3.deploy(plan.forwarded);
   const { appRoot, wranglerBin } = context3;
   const shellEnv = context3.env ?? process.env;
-  const log = context3.log ?? ((message) => console.log(message));
+  const log2 = context3.log ?? ((message) => console.log(message));
   const envArgs = plan.env ? ["--env", plan.env] : [];
-  const step = (message) => log(`
+  const step = (message) => log2(`
 ${pc3.bold(pc3.cyan("flare"))} ${message}`);
   const databases = plan.skipMigrations ? [] : readD1Databases(appRoot).filter((db) => existsSync7(join6(appRoot, db.migrations_dir ?? "migrations")));
   const migrateAfterDeploy = [];
@@ -1517,7 +1654,7 @@ ${info.output.trim()}`);
   const apiToken = shellEnv.FLARE_SECURITY_API_TOKEN;
   if (security && zoneId && apiToken) {
     step("Provisioning zone security rules");
-    await provisionZoneSecurity(appRoot, security, { zoneId, apiToken }, { log, fetch: context3.fetch });
+    await provisionZoneSecurity(appRoot, security, { zoneId, apiToken }, { log: log2, fetch: context3.fetch });
   } else if (security) {
     step("Zone security rules skipped (Worker-layer protection is on). To add them, deploy with FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN set.");
   }
@@ -1550,7 +1687,7 @@ ${put.output.trim()}`);
     const optional = existsSync7(examplePath) ? declaredSecretNames(readFileSync4(examplePath, "utf8")).filter((name) => !existing.has(name)) : [];
     if (optional.length > 0) {
       step("Optional secrets not set in production (features using them stay off):");
-      for (const name of optional) log(`  wrangler secret put ${name}${plan.env ? ` --env ${plan.env}` : ""}`);
+      for (const name of optional) log2(`  wrangler secret put ${name}${plan.env ? ` --env ${plan.env}` : ""}`);
     }
   }
   return 0;
@@ -1757,7 +1894,7 @@ function previousSnapshot(dir, migrationFile) {
 }
 
 // src/generator/plan.ts
-import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync4, readdirSync as readdirSync6, readFileSync as readFileSync7 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync4, readdirSync as readdirSync6, readFileSync as readFileSync7 } from "fs";
 import { dirname as dirname5, join as join10 } from "path";
 import pc5 from "picocolors";
 
@@ -1843,6 +1980,9 @@ function columnExpression(key, def, resources, selfName) {
     case "enum":
       expr = `text(${col}, { enum: ${q(def.options)} })`;
       break;
+    case "multiselect":
+      expr = `text(${col}, { mode: "json" }).$type<(${def.options.map((option) => q(option)).join(" | ")})[]>()`;
+      break;
     case "belongsTo": {
       const target = resources.get(def.target);
       if (!target) {
@@ -1856,7 +1996,7 @@ function columnExpression(key, def, resources, selfName) {
       expr = `text(${col})`;
   }
   if (def.required) expr += ".notNull()";
-  if (def.unique) expr += ".unique()";
+  if ("unique" in def && def.unique) expr += ".unique()";
   if ("default" in def && def.default !== void 0) expr += `.default(${q(def.default)})`;
   return expr;
 }
@@ -1983,16 +2123,24 @@ var adminImports = (entry) => [
 function renderAdminListPage(entry) {
   const local = resourceLocal(entry.stem);
   return [
-    `import { ResourceTable } from "@/components/admin/resource-table";`,
-    `import type { SearchParams } from "@/components/admin/query";`,
+    `import { PageHeader } from "@/components/dashboard/page-header";`,
+    `import { ResourceStats } from "@/components/dashboard/resource-stats";`,
+    `import { ResourceTable } from "@/components/dashboard/resource-table";`,
+    `import type { SearchParams } from "@/components/dashboard/query";`,
     ...adminImports(entry),
     "",
+    `export const metadata = { title: ${local}.pluralLabel };`,
+    "",
     `export default async function ${entry.resource.name}ListPage({ searchParams }: { searchParams: Promise<SearchParams> }) {`,
     "  return (",
-    `    <div className="flex flex-col gap-6">`,
-    `      <h1 className="text-2xl font-semibold">{${local}.pluralLabel}</h1>`,
+    "    <>",
+    "      <PageHeader",
+    `        title={${local}.pluralLabel}`,
+    `        crumbs={[{ label: "Dashboard", href: "/dashboard" }, { label: ${local}.pluralLabel }]}`,
+    "      />",
+    `      <ResourceStats resource={${local}} />`,
     `      <ResourceTable resource={${local}} searchParams={await searchParams} />`,
-    "    </div>",
+    "    </>",
     "  );",
     "}",
     ""
@@ -2000,7 +2148,7 @@ function renderAdminListPage(entry) {
 }
 function renderAdminNewPage(entry) {
   return [
-    `import { ResourceFormPage } from "@/components/admin/resource-form-page";`,
+    `import { ResourceFormPage } from "@/components/dashboard/resource-form-page";`,
     ...adminImports(entry),
     "",
     `export default function New${entry.resource.name}Page() {`,
@@ -2011,7 +2159,7 @@ function renderAdminNewPage(entry) {
 }
 function renderAdminEditPage(entry) {
   return [
-    `import { ResourceFormPage } from "@/components/admin/resource-form-page";`,
+    `import { ResourceFormPage } from "@/components/dashboard/resource-form-page";`,
     ...adminImports(entry),
     "",
     `export default async function Edit${entry.resource.name}Page({ params }: { params: Promise<{ id: string }> }) {`,
@@ -2079,9 +2227,9 @@ function resourceFiles(entry, all) {
     { path: `app/api/${resource.slug}/[id]/route.ts`, content: renderItemRoute(entry) },
     { path: `resources/${stem}.client.ts`, content: renderClient(entry) },
     { path: `resources/${stem}.validators.ts`, content: renderValidators(entry) },
-    { path: `app/admin/${resource.slug}/page.tsx`, content: renderAdminListPage(entry) },
-    { path: `app/admin/${resource.slug}/new/page.tsx`, content: renderAdminNewPage(entry) },
-    { path: `app/admin/${resource.slug}/[id]/edit/page.tsx`, content: renderAdminEditPage(entry) }
+    { path: `app/dashboard/${resource.slug}/page.tsx`, content: renderAdminListPage(entry) },
+    { path: `app/dashboard/${resource.slug}/new/page.tsx`, content: renderAdminNewPage(entry) },
+    { path: `app/dashboard/${resource.slug}/[id]/edit/page.tsx`, content: renderAdminEditPage(entry) }
   ];
 }
 
@@ -2141,7 +2289,7 @@ function findOrphans(appRoot, all) {
   for (const dir of list2("app/api", () => true)) {
     for (const file of [`${dir}/route.ts`, `${dir}/[id]/route.ts`]) if (existsSync11(join10(appRoot, file))) candidates.push(file);
   }
-  for (const dir of list2("app/admin", () => true)) {
+  for (const dir of list2("app/dashboard", () => true)) {
     for (const file of [`${dir}/page.tsx`, `${dir}/new/page.tsx`, `${dir}/[id]/edit/page.tsx`]) {
       if (existsSync11(join10(appRoot, file))) candidates.push(file);
     }
@@ -2153,20 +2301,20 @@ function findOrphans(appRoot, all) {
   }
   return orphans;
 }
-function ensureSupportFiles(appRoot, log) {
+function ensureSupportFiles(appRoot, log2) {
   for (const path of ["lib/api.ts", "lib/cache.ts"]) {
     const target = join10(appRoot, path);
     if (existsSync11(target)) continue;
     mkdirSync4(dirname5(target), { recursive: true });
-    copyFileSync(join10(templatesDir, "app", path), target);
-    log(`${pc5.green("create".padEnd(9))} ${path}`);
+    copyFileSync2(join10(templatesDir, "app", path), target);
+    log2(`${pc5.green("create".padEnd(9))} ${path}`);
   }
 }
-function logResults(results, log, options2 = {}) {
+function logResults(results, log2, options2 = {}) {
   for (const { path, outcome } of results) {
     if (outcome === "identical" && !options2.showIdentical) continue;
     const label = outcome === "create" ? pc5.green("create") : outcome === "update" ? pc5.yellow("update") : outcome === "identical" ? pc5.dim("identical") : pc5.red(outcome === "skipped-drift" ? "drift" : "hand-written");
-    log(`${label.padEnd(18)} ${path}`);
+    log2(`${label.padEnd(18)} ${path}`);
   }
 }
 
@@ -2201,20 +2349,20 @@ function addStripeDependency(appRoot) {
   writeJson(path, pkg);
   return true;
 }
-function writeBillingResource(appRoot, name, force, log) {
+function writeBillingResource(appRoot, name, force, log2) {
   const relative2 = descriptorPath(name);
   const path = join11(appRoot, relative2);
   if (!existsSync12(path)) {
     mkdirSync5(dirname6(path), { recursive: true });
     writeFileSync6(path, renderBillingDescriptor(name));
-    log(`${pc6.green("create".padEnd(9))} ${relative2}`);
+    log2(`${pc6.green("create".padEnd(9))} ${relative2}`);
     return;
   }
   const parts = splitMarkers(readFileSync8(path, "utf8"));
   if (!parts) throw new Error(`${relative2} has no generated fields block, so the billing fields can't be merged. Add them by hand: ${BILLING_RESOURCES[name]}`);
   const merged = mergeBillingFields(name, parts.block);
   if (!merged) {
-    log(`${pc6.dim("identical".padEnd(9))} ${relative2} (has every billing field)`);
+    log2(`${pc6.dim("identical".padEnd(9))} ${relative2} (has every billing field)`);
     return;
   }
   try {
@@ -2225,22 +2373,22 @@ function writeBillingResource(appRoot, name, force, log) {
     }
     throw error;
   }
-  log(`${pc6.yellow("update".padEnd(9))} ${relative2} (added billing fields, kept yours)`);
+  log2(`${pc6.yellow("update".padEnd(9))} ${relative2} (added billing fields, kept yours)`);
 }
 async function genBilling(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   validateBillingOptions(options2.provider, options2.mode);
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
-  for (const name of ["Plan", "Customer", "Purchase"]) writeBillingResource(appRoot, name, options2.force, log);
+  for (const name of ["Plan", "Customer", "Purchase"]) writeBillingResource(appRoot, name, options2.force, log2);
   for (const [name, roles] of Object.entries(BILLING_POLICIES)) {
     const relative2 = policyPath(name);
     if (existsSync12(join11(appRoot, relative2))) {
-      log(`${pc6.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+      log2(`${pc6.dim("kept".padEnd(9))} ${relative2} (already exists)`);
       continue;
     }
     mkdirSync5(join11(appRoot, "policies"), { recursive: true });
     writeFileSync6(join11(appRoot, relative2), renderPolicy(name, roles));
-    log(`${pc6.green("create".padEnd(9))} ${relative2}`);
+    log2(`${pc6.green("create".padEnd(9))} ${relative2}`);
   }
   const files = [];
   const appName = JSON.parse(readFileSync8(join11(appRoot, "package.json"), "utf8")).name ?? "app";
@@ -2248,7 +2396,7 @@ async function genBilling(options2 = {}) {
     const outcome = writeGenerated(join11(appRoot, path), content, { header: billingHeader(), force: options2.force });
     files.push({ path, status: "missing", outcome });
     const label = outcome === "create" ? pc6.green("create") : outcome === "update" ? pc6.yellow("update") : pc6.dim("identical");
-    log(`${label.padEnd(18)} ${path}`);
+    log2(`${label.padEnd(18)} ${path}`);
   }
   for (const path of RETIRED_FILES) {
     const absolute = join11(appRoot, path);
@@ -2257,15 +2405,15 @@ async function genBilling(options2 = {}) {
     const untouched = parts && parts.before.includes("flare gen billing") && !parts.after.trim() && parts.hash !== void 0 && hashBlock(parts.block) === parts.hash;
     if (untouched) {
       unlinkSync(absolute);
-      log(`${pc6.red("remove".padEnd(9))} ${path} (no longer generated)`);
+      log2(`${pc6.red("remove".padEnd(9))} ${path} (no longer generated)`);
     } else {
-      log(pc6.yellow(`${path} is no longer generated but has your changes; remove it when you're done with it.`));
+      log2(pc6.yellow(`${path} is no longer generated but has your changes; remove it when you're done with it.`));
     }
   }
-  if (appendVars(appRoot, ".dev.vars.example")) log(`${pc6.green("append".padEnd(9))} .dev.vars.example`);
-  if (appendVars(appRoot, ".dev.vars")) log(`${pc6.green("append".padEnd(9))} .dev.vars`);
+  if (appendVars(appRoot, ".dev.vars.example")) log2(`${pc6.green("append".padEnd(9))} .dev.vars.example`);
+  if (appendVars(appRoot, ".dev.vars")) log2(`${pc6.green("append".padEnd(9))} .dev.vars`);
   const addedStripe = addStripeDependency(appRoot);
-  if (addedStripe) log(`${pc6.yellow("update".padEnd(9))} package.json (stripe@${STRIPE_DEP})`);
+  if (addedStripe) log2(`${pc6.yellow("update".padEnd(9))} package.json (stripe@${STRIPE_DEP})`);
   if (!options2.skipInstall) {
     const pm = detectPackageManager();
     const code = run(pm, ["install"], appRoot);
@@ -2273,16 +2421,16 @@ async function genBilling(options2 = {}) {
     run(pm, ["run", "cf-typegen"], appRoot);
   }
   const all = await loadResources(appRoot);
-  ensureSupportFiles(appRoot, log);
-  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log);
+  ensureSupportFiles(appRoot, log2);
+  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log2);
   let migrations = [];
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, "billing");
     migrations = result.files;
-    for (const file of migrations) log(`${pc6.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc6.dim(`repaired  ${repair}`));
+    for (const file of migrations) log2(`${pc6.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log2(pc6.dim(`repaired  ${repair}`));
   }
-  log(
+  log2(
     [
       "",
       `Next:`,
@@ -2424,7 +2572,7 @@ var renderSecurityActions = () => `"use server";
 import { revalidatePath } from "next/cache";
 import { can } from "@flaredev/core";
 import { isIp } from "@flaredev/core/security";
-import { adminSession, policyFor } from "@/lib/admin";
+import { dashboardSession, policyFor } from "@/lib/dashboard";
 import { logSecurityEvent, security } from "@/lib/security";
 
 /** On failure the submitted values come back, so the form (which React resets) keeps them. */
@@ -2433,7 +2581,7 @@ export type BanResult = { ok: true } | { ok: false; error: string; ip?: string;
 const DURATIONS: Record<string, number | null> = { "1h": 3600, "24h": 86_400, "7d": 604_800, permanent: null };
 
 async function adminOnly(): Promise<{ email: string } | { error: string }> {
-  const { session, role } = await adminSession();
+  const { session, role } = await dashboardSession();
   if (!session) return { error: "Sign in required." };
   if (!can(policyFor("SecurityEvent"), role, "create")) return { error: "Only admins can ban or unban." };
   return { email: session.user.email };
@@ -2454,8 +2602,8 @@ export async function banAction(_previous: BanResult | null, form: FormData): Pr
   } catch (error) {
     return { ok: false, error: \`The ban didn't reach every layer: \${error instanceof Error ? error.message : String(error)}\`, ip, reason };
   }
-  await logSecurityEvent({ kind: "manual-ban", severity: "medium", ip, path: "/admin/security", userAgent: null, count: 0, banned: true, detail: \`\${reason} (by \${admin.email})\` });
-  revalidatePath("/admin/security");
+  await logSecurityEvent({ kind: "manual-ban", severity: "medium", ip, path: "/dashboard/security", userAgent: null, count: 0, banned: true, detail: \`\${reason} (by \${admin.email})\` });
+  revalidatePath("/dashboard/security");
   return { ok: true };
 }
 
@@ -2468,8 +2616,8 @@ export async function unbanAction(ip: string): Promise<BanResult> {
   } catch (error) {
     return { ok: false, error: \`The unban didn't reach every layer: \${error instanceof Error ? error.message : String(error)}\` };
   }
-  await logSecurityEvent({ kind: "manual-unban", severity: "low", ip, path: "/admin/security", userAgent: null, count: 0, banned: false, detail: \`by \${admin.email}\` });
-  revalidatePath("/admin/security");
+  await logSecurityEvent({ kind: "manual-unban", severity: "low", ip, path: "/dashboard/security", userAgent: null, count: 0, banned: false, detail: \`by \${admin.email}\` });
+  revalidatePath("/dashboard/security");
   return { ok: true };
 }
 `;
@@ -2562,7 +2710,7 @@ import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/com
 import { Separator } from "@/components/ui/separator";
 import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
-import { adminStore, policyFor, requireAdmin } from "@/lib/admin";
+import { dashboardStore, policyFor, requireDashboard } from "@/lib/dashboard";
 import { security, zoneClient } from "@/lib/security";
 import { BanForm, UnbanButton } from "./ban-controls";
 
@@ -2571,7 +2719,7 @@ const when = (value: string | number | Date | null) =>
   value ? new Intl.DateTimeFormat(undefined, { dateStyle: "medium", timeStyle: "short" }).format(new Date(value)) : "Until unbanned";
 
 export default async function SecurityPage() {
-  const { role } = await requireAdmin("/admin/security");
+  const { role } = await requireDashboard("/dashboard/security");
   if (!can(policyFor("SecurityEvent"), role, "read")) {
     return (
       <Alert>
@@ -2584,7 +2732,7 @@ export default async function SecurityPage() {
 
   const [bans, events, edge] = await Promise.all([
     security().bans(),
-    adminStore("SecurityEvent").list(new URLSearchParams({ sort: "-createdAt", perPage: "20" })),
+    dashboardStore("SecurityEvent").list(new URLSearchParams({ sort: "-createdAt", perPage: "20" })),
     zone
       ? Promise.all([zone.bans(), zone.firewallEvents(new Date(Date.now() - 24 * 3600 * 1000))]).then(
           ([zoneBans, firewall]) => ({ ok: true as const, zoneBans, firewall }),
@@ -2695,7 +2843,7 @@ export default async function SecurityPage() {
         <CardHeader>
           <CardTitle>Recent events</CardTitle>
           <CardDescription>
-            Detectors that tripped, and manual bans. <Link href="/admin/security-events" className="underline underline-offset-4">All events</Link>
+            Detectors that tripped, and manual bans. <Link href="/dashboard/security-events" className="underline underline-offset-4">All events</Link>
           </CardDescription>
         </CardHeader>
         <CardContent>
@@ -2805,43 +2953,43 @@ function addSecurityBindings(source) {
   }
   return { text, added };
 }
-var renderAdminNavBlock = () => `export interface AdminLink {
+var renderAdminNavBlock = () => `export interface DashboardLink {
   label: string;
   href: string;
-  /** A resource icon name, e.g. "shield" (see components/admin/resource-icon.tsx). */
+  /** A resource icon name, e.g. "shield" (see components/dashboard/resource-icon.tsx). */
   icon: string;
 }
 
-export const generatedAdminLinks: AdminLink[] = [{ label: "Security", href: "/admin/security", icon: "shield" }];
+export const generatedDashboardLinks: DashboardLink[] = [{ label: "Security", href: "/dashboard/security", icon: "shield" }];
 `;
 
 // src/commands/gen-security.ts
 function securityFiles(appName) {
   return [
     { path: "lib/security.ts", content: renderLibSecurity(appName) },
-    { path: "app/admin/security/page.tsx", content: renderSecurityPage() },
-    { path: "app/admin/security/actions.ts", content: renderSecurityActions() },
-    { path: "app/admin/security/ban-controls.tsx", content: renderBanControls() }
+    { path: "app/dashboard/security/page.tsx", content: renderSecurityPage() },
+    { path: "app/dashboard/security/actions.ts", content: renderSecurityActions() },
+    { path: "app/dashboard/security/ban-controls.tsx", content: renderBanControls() }
   ];
 }
 var PASS_THROUGH_HEADER = /^\/\/ Request protection for worker\/index\.ts\.[\s\S]*?\n(?=\/\/ generated:start)/;
-function writeOnce(appRoot, relative2, content, log) {
+function writeOnce(appRoot, relative2, content, log2) {
   const path = join12(appRoot, relative2);
   if (existsSync13(path)) {
-    log(`${pc7.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+    log2(`${pc7.dim("kept".padEnd(9))} ${relative2} (already exists)`);
     return;
   }
   mkdirSync6(dirname7(path), { recursive: true });
   writeFileSync7(path, content);
-  log(`${pc7.green("create".padEnd(9))} ${relative2}`);
+  log2(`${pc7.green("create".padEnd(9))} ${relative2}`);
 }
 async function genSecurity(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const appName = JSON.parse(readFileSync9(join12(appRoot, "package.json"), "utf8")).name ?? "app";
-  writeOnce(appRoot, "security.config.ts", renderSecurityConfig(), log);
-  writeOnce(appRoot, descriptorPath("SecurityEvent"), renderSecurityDescriptor(), log);
-  writeOnce(appRoot, policyPath("SecurityEvent"), renderPolicy("SecurityEvent", SECURITY_EVENT_POLICY), log);
+  writeOnce(appRoot, "security.config.ts", renderSecurityConfig(), log2);
+  writeOnce(appRoot, descriptorPath("SecurityEvent"), renderSecurityDescriptor(), log2);
+  writeOnce(appRoot, policyPath("SecurityEvent"), renderPolicy("SecurityEvent", SECURITY_EVENT_POLICY), log2);
   const files = [];
   const write = (path, content, header) => {
     const absolute = join12(appRoot, path);
@@ -2852,12 +3000,12 @@ async function genSecurity(options2 = {}) {
     const outcome = writeGenerated(absolute, content, { header, force: options2.force });
     files.push({ path, status: "missing", outcome });
     const label = outcome === "create" ? pc7.green("create") : outcome === "update" ? pc7.yellow("update") : pc7.dim("identical");
-    log(`${label.padEnd(18)} ${path}`);
+    log2(`${label.padEnd(18)} ${path}`);
   };
   for (const { path, content } of securityFiles(appName)) write(path, content, securityHeader());
-  const navPath = join12(appRoot, "lib/admin-nav.ts");
-  if (existsSync13(navPath) && splitMarkers(readFileSync9(navPath, "utf8"))) write("lib/admin-nav.ts", renderAdminNavBlock());
-  else log(pc7.yellow(`lib/admin-nav.ts not found: link to /admin/security from your admin sidebar yourself.`));
+  const navPath = join12(appRoot, "lib/dashboard-nav.ts");
+  if (existsSync13(navPath) && splitMarkers(readFileSync9(navPath, "utf8"))) write("lib/dashboard-nav.ts", renderAdminNavBlock());
+  else log2(pc7.yellow(`lib/dashboard-nav.ts not found: link to /dashboard/security from your dashboard sidebar yourself.`));
   const wranglerPath = join12(appRoot, "wrangler.jsonc");
   let bindings = [];
   if (existsSync13(wranglerPath)) {
@@ -2865,27 +3013,27 @@ async function genSecurity(options2 = {}) {
     bindings = added;
     if (added.length) {
       writeFileSync7(wranglerPath, text);
-      for (const line of added) log(`${pc7.yellow("update".padEnd(9))} wrangler.jsonc (${line})`);
+      for (const line of added) log2(`${pc7.yellow("update".padEnd(9))} wrangler.jsonc (${line})`);
     }
   } else {
-    log(pc7.yellow("wrangler.jsonc not found: add the FLARE_SECURITY, FLARE_SECURITY_MONITOR and FLARE_RATE_LIMIT bindings yourself."));
+    log2(pc7.yellow("wrangler.jsonc not found: add the FLARE_SECURITY, FLARE_SECURITY_MONITOR and FLARE_RATE_LIMIT bindings yourself."));
   }
   const all = await loadResources(appRoot);
-  ensureSupportFiles(appRoot, log);
-  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log);
+  ensureSupportFiles(appRoot, log2);
+  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log2);
   let migrations = [];
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, "security");
     migrations = result.files;
-    for (const file of migrations) log(`${pc7.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc7.dim(`repaired  ${repair}`));
+    for (const file of migrations) log2(`${pc7.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log2(pc7.dim(`repaired  ${repair}`));
   }
-  log(
+  log2(
     [
       "",
       `Next:`,
       `  1. ${pc7.bold("flare migrate")} to create the security_events table.`,
-      `  2. ${pc7.bold("flare dev")}, then open ${pc7.bold("/admin/security")}. Tune detectors in security.config.ts.`,
+      `  2. ${pc7.bold("flare dev")}, then open ${pc7.bold("/dashboard/security")}. Tune detectors in security.config.ts.`,
       `  3. Optional zone layer: deploy with FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN set (a token scoped to that`,
       `     one zone with Zone WAF Edit, Firewall Services Edit, Analytics Read, Zone Read). ${pc7.bold("flare deploy")} pushes the`,
       `     zone rules and uploads both as secrets.`
@@ -2894,12 +3042,103 @@ async function genSecurity(options2 = {}) {
   return { files, migrations, bindings };
 }
 
+// src/commands/theme.ts
+import { existsSync as existsSync14, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { join as join13 } from "path";
+import pc8 from "picocolors";
+var THEME_LINE = /theme: "([a-z]+)" as ThemeName,/;
+function setTheme(name, cwd = process.cwd(), log2 = console.log) {
+  const appRoot = findAppRoot(cwd);
+  const path = join13(appRoot, "lib/site.ts");
+  if (!existsSync14(path)) throw new Error("lib/site.ts not found: this app was created before themes. Add it from the Flare app template.");
+  const source = readFileSync10(path, "utf8");
+  const current = THEME_LINE.exec(source)?.[1];
+  if (!name) {
+    for (const [theme2, description] of Object.entries(THEMES)) {
+      log2(`${theme2 === current ? pc8.green("\u25CF") : " "} ${theme2.padEnd(8)} ${pc8.dim(description)}`);
+    }
+    log2(pc8.dim("\nSwitch with `flare theme <name>`. FLARE_THEME in .env overrides it for a build."));
+    return;
+  }
+  const theme = parseTheme(name);
+  if (!current) throw new Error('lib/site.ts has no `theme: "\u2026" as ThemeName,` line to change.');
+  writeFileSync8(path, source.replace(THEME_LINE, `theme: "${theme}" as ThemeName,`));
+  log2(`${pc8.green("\u2714")} Theme is now ${pc8.bold(theme)}. Restart \`flare dev\` (or rebuild) to see it.`);
+}
+
+// src/commands/create-prompts.ts
+import * as prompts2 from "@clack/prompts";
+import pc9 from "picocolors";
+import { FLARE_VERSION as FLARE_VERSION2 } from "@flaredev/core";
+var canPrompt = (yes) => !yes && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+var AUTH_HINTS = {
+  "magic-link": "a sign-in link by email",
+  "email-otp": "a 6-digit sign-in code by email",
+  passkeys: "Face ID, Touch ID, Windows Hello",
+  "2fa-app": "authenticator app, with backup codes",
+  "2fa-email": "a code by email as the second step"
+};
+var AUTH_LABELS = {
+  "magic-link": "Magic links",
+  "email-otp": "Email codes",
+  passkeys: "Passkeys",
+  "2fa-app": "Two-factor: authenticator app",
+  "2fa-email": "Two-factor: email code"
+};
+function stopIfCancelled(value) {
+  if (prompts2.isCancel(value)) {
+    prompts2.cancel("Cancelled: nothing was created.");
+    process.exit(1);
+  }
+  return value;
+}
+async function askCreateQuestions(given, appName) {
+  prompts2.intro(`${pc9.bgRed(pc9.white(" Flare "))} ${pc9.dim(`v${FLARE_VERSION2}`)}${appName ? ` ${pc9.dim("\xB7")} ${pc9.bold(appName)}` : ""}`);
+  const answers = { ...given };
+  if (given.theme === void 0) {
+    answers.theme = stopIfCancelled(
+      await prompts2.select({
+        message: "Pick a look",
+        initialValue: "default",
+        options: Object.entries(THEMES).map(([value, hint]) => ({ value, label: value, hint }))
+      })
+    );
+  }
+  if (given.auth === void 0) {
+    const methods = stopIfCancelled(
+      await prompts2.multiselect({
+        message: `How can people sign in? ${pc9.dim("Email and password is always on")}`,
+        initialValues: DEFAULT_AUTH_METHODS,
+        required: false,
+        options: Object.keys(AUTH_METHODS).map((value) => ({
+          value,
+          label: AUTH_LABELS[value],
+          hint: AUTH_HINTS[value]
+        }))
+      })
+    );
+    answers.auth = methods.length ? methods.join(",") : "none";
+  }
+  if (given.authProviders === void 0) {
+    const providers = stopIfCancelled(
+      await prompts2.multiselect({
+        message: `Social sign-in? ${pc9.dim("each needs its own credentials later")}`,
+        initialValues: [],
+        required: false,
+        options: Object.entries(AUTH_PROVIDERS).map(([value, { label }]) => ({ value, label }))
+      })
+    );
+    answers.authProviders = providers.join(",");
+  }
+  return answers;
+}
+
 // src/commands/gen.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8, join as join13 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join14 } from "path";
 import { camelCase as camelCase4, defineResource as defineResource2, relationGraph as relationGraph2 } from "@flaredev/core";
-import pc8 from "picocolors";
-function validateFields(name, fields, others, log) {
+import pc10 from "picocolors";
+function validateFields(name, fields, others, log2) {
   const known = /* @__PURE__ */ new Set([name, ...others.map((resource) => resource.name)]);
   for (const field of fields) {
     if (field.kind === "belongsTo" && !known.has(field.target)) {
@@ -2909,16 +3148,16 @@ function validateFields(name, fields, others, log) {
   const candidate = defineResource2({ name, fields: Object.fromEntries(fields.map((f) => [f.key, toField(f)])) });
   const graph = relationGraph2([...others, candidate]);
   for (const pending of graph.pending.filter((p) => p.resource === name)) {
-    log(pc8.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
+    log2(pc10.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
   }
 }
 async function genResource(rawName, options2) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = resourceName(rawName);
   const relativePath = descriptorPath(name);
-  const path = join13(appRoot, relativePath);
-  const exists = existsSync14(path);
+  const path = join14(appRoot, relativePath);
+  const exists = existsSync15(path);
   if (!exists && !options2.fields) {
     throw new Error(`--fields is required, e.g. flare gen resource ${name} --fields "name:string, email:string"`);
   }
@@ -2926,15 +3165,15 @@ async function genResource(rawName, options2) {
   const others = existing.filter(({ resource }) => resource.name !== name).map(({ resource }) => resource);
   if (options2.fields) {
     const fields = parseFields(options2.fields);
-    validateFields(name, fields, others, log);
+    validateFields(name, fields, others, log2);
     if (!exists) {
       mkdirSync7(dirname8(path), { recursive: true });
-      writeFileSync8(path, renderDescriptor(name, fields));
-      log(`${pc8.green("create".padEnd(9))} ${relativePath}`);
+      writeFileSync9(path, renderDescriptor(name, fields));
+      log2(`${pc10.green("create".padEnd(9))} ${relativePath}`);
     } else {
       try {
         const outcome = writeGenerated(path, renderFieldsBlock(fields), { force: options2.force });
-        log(`${(outcome === "identical" ? pc8.dim : pc8.yellow)(outcome.padEnd(9))} ${relativePath}`);
+        log2(`${(outcome === "identical" ? pc10.dim : pc10.yellow)(outcome.padEnd(9))} ${relativePath}`);
       } catch (error) {
         if (error instanceof DriftError) {
           throw new Error(
@@ -2950,9 +3189,9 @@ async function genResource(rawName, options2) {
   try {
     const all = await loadResources(appRoot);
     table = all.find(({ resource }) => resource.name === name).resource.table;
-    ensureSupportFiles(appRoot, log);
+    ensureSupportFiles(appRoot, log2);
     written = applyPlan(appRoot, planFiles(all), { force: options2.force });
-    logResults(written, log);
+    logResults(written, log2);
   } catch (error) {
     const hint = exists ? "" : `
 (${relativePath} was written; fix it and run \`flare sync-types\`.)`;
@@ -2960,75 +3199,75 @@ async function genResource(rawName, options2) {
   }
   const skipped = written.filter((r) => r.outcome.startsWith("skipped"));
   if (skipped.length) {
-    log(pc8.yellow(`
+    log2(pc10.yellow(`
 Skipped ${skipped.length} hand-edited file(s); run \`flare sync-types\` for details.`));
   }
   let migrations = [];
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, `${exists ? "update" : "create"}_${table}`);
     migrations = result.files;
-    for (const file of migrations) log(`${pc8.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc8.dim(`repaired  ${repair}`));
-    if (migrations.length) log(`
-Next: ${pc8.bold("flare migrate")} to apply it locally.`);
-    else if (exists) log(pc8.dim("\nNo table changes, so no migration."));
+    for (const file of migrations) log2(`${pc10.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log2(pc10.dim(`repaired  ${repair}`));
+    if (migrations.length) log2(`
+Next: ${pc10.bold("flare migrate")} to apply it locally.`);
+    else if (exists) log2(pc10.dim("\nNo table changes, so no migration."));
   }
   const descriptor = { path: relativePath, status: exists ? "outdated" : "missing", outcome: exists ? "update" : "create" };
   return { name, mode: exists ? "update" : "create", written: [descriptor, ...written], migrations };
 }
 
 // src/commands/gen-migration.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename2, join as join14 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "fs";
+import { basename as basename2, join as join15 } from "path";
 import { snakeCase } from "@flaredev/core";
-import pc9 from "picocolors";
+import pc11 from "picocolors";
 var DOWN_TEMPLATE = (up) => `-- Rollback for ${up}, run by \`flare migrate:rollback\`.
 -- Write SQL that undoes the up migration, e.g.:
 --   DROP INDEX IF EXISTS \`contacts_phone_idx\`;
 -- While this file has no statements, rollback of ${up} is refused.
 `;
 async function genMigration(rawName, options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = snakeCase(rawName);
   if (!name) throw new Error(`Invalid migration name "${rawName}". Use letters, digits, and underscores.`);
   const { files, repairs } = await generateSchemaMigration(appRoot, name, { custom: !options2.fromSchema });
   if (files.length === 0) {
-    log(options2.fromSchema ? "No schema changes, so no migration was created." : "drizzle-kit didn't create a migration.");
+    log2(options2.fromSchema ? "No schema changes, so no migration was created." : "drizzle-kit didn't create a migration.");
     return [];
   }
-  for (const file of files) log(`${pc9.green("create".padEnd(9))} ${file}`);
-  for (const repair of repairs) log(pc9.dim(`repaired  ${repair}`));
+  for (const file of files) log2(`${pc11.green("create".padEnd(9))} ${file}`);
+  for (const repair of repairs) log2(pc11.dim(`repaired  ${repair}`));
   if (!options2.fromSchema) {
-    const downDir = join14(appRoot, "migrations", "down");
+    const downDir = join15(appRoot, "migrations", "down");
     mkdirSync8(downDir, { recursive: true });
     for (const file of files) {
-      const down = join14(downDir, basename2(file));
-      if (existsSync15(down)) continue;
-      writeFileSync9(down, DOWN_TEMPLATE(basename2(file)));
-      log(`${pc9.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
+      const down = join15(downDir, basename2(file));
+      if (existsSync16(down)) continue;
+      writeFileSync10(down, DOWN_TEMPLATE(basename2(file)));
+      log2(`${pc11.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
     }
-    log(`
-Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc9.bold("flare migrate")}.`);
+    log2(`
+Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc11.bold("flare migrate")}.`);
   } else {
-    log(`
-Next: ${pc9.bold("flare migrate")}.`);
+    log2(`
+Next: ${pc11.bold("flare migrate")}.`);
   }
   return files;
 }
 
 // src/commands/gen-policy.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname9, join as join15 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname9, join as join16 } from "path";
 import { definePolicy } from "@flaredev/core";
-import pc10 from "picocolors";
+import pc12 from "picocolors";
 function parseRoles(input, what = "--roles") {
   const roles = (input ?? "").split(",").map((role) => role.trim()).filter(Boolean);
   if (roles.length === 0) throw new Error(`${what} is required, e.g. ${what} admin,staff`);
   return [...new Set(roles)];
 }
 async function genPolicy(rawName, options2) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = resourceName(rawName);
   const resources = await loadResources(appRoot);
@@ -3037,8 +3276,8 @@ async function genPolicy(rawName, options2) {
     throw new Error(`No resource "${name}". Generate it first. Known resources: ${known}.`);
   }
   const relative2 = policyPath(name);
-  const path = join15(appRoot, relative2);
-  const exists = existsSync16(path);
+  const path = join16(appRoot, relative2);
+  const exists = existsSync17(path);
   let roles;
   let deleteRoles;
   if (options2.roles || !exists) {
@@ -3050,12 +3289,12 @@ async function genPolicy(rawName, options2) {
     const block = renderPolicyBlock({ read: roles, create: roles, update: roles, delete: deleteRoles });
     if (!exists) {
       mkdirSync9(dirname9(path), { recursive: true });
-      writeFileSync10(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
-      log(`${pc10.green("create".padEnd(9))} ${relative2}`);
+      writeFileSync11(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
+      log2(`${pc12.green("create".padEnd(9))} ${relative2}`);
     } else {
       try {
         const outcome = writeGenerated(path, block, { force: options2.force });
-        log(`${(outcome === "identical" ? pc10.dim : pc10.yellow)(outcome.padEnd(9))} ${relative2}`);
+        log2(`${(outcome === "identical" ? pc12.dim : pc12.yellow)(outcome.padEnd(9))} ${relative2}`);
       } catch (error) {
         if (error instanceof DriftError) {
           throw new Error(`The roles in ${relative2} were edited by hand, so --roles won't overwrite them. Edit the file directly, or pass --force.`);
@@ -3065,17 +3304,17 @@ async function genPolicy(rawName, options2) {
     }
   }
   const policies = await loadPolicies(appRoot);
-  logResults(applyPlan(appRoot, planFiles(resources, policies)), log);
-  log(`
-${pc10.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
+  logResults(applyPlan(appRoot, planFiles(resources, policies)), log2);
+  log2(`
+${pc12.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
   return { name, path: relative2 };
 }
 
 // src/commands/migrate.ts
-import { existsSync as existsSync17, mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync2, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync18, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
 import { tmpdir } from "os";
-import { join as join16 } from "path";
-import pc11 from "picocolors";
+import { join as join17 } from "path";
+import pc13 from "picocolors";
 
 // src/generator/down.ts
 var IDENT = '(`[^`]+`|"[^"]+"|\\[[^\\]]+\\]|[A-Za-z_][\\w$]*)';
@@ -3191,28 +3430,28 @@ ${result.output.trim()}`);
 async function rollback(options2 = {}) {
   const steps = options2.steps ?? 1;
   if (!Number.isInteger(steps) || steps < 1) throw new Error("--steps must be a positive integer.");
-  const { appRoot, db, target, where, wrangler, log } = context(options2);
-  const migrationsDir = join16(appRoot, db.migrations_dir ?? "migrations");
+  const { appRoot, db, target, where, wrangler, log: log2 } = context(options2);
+  const migrationsDir = join17(appRoot, db.migrations_dir ?? "migrations");
   const applied = await appliedMigrations(options2, steps);
   if (applied.length === 0) {
-    log("Nothing to roll back.");
+    log2("Nothing to roll back.");
     return 0;
   }
   const plan = [];
   for (const { name } of applied) {
     if (!/^[\w.-]+\.sql$/.test(name)) throw new Error(`Unexpected migration name "${name}" in d1_migrations.`);
-    const handWritten = join16(migrationsDir, "down", name);
-    if (existsSync17(handWritten)) {
-      const sql2 = readFileSync10(handWritten, "utf8");
+    const handWritten = join17(migrationsDir, "down", name);
+    if (existsSync18(handWritten)) {
+      const sql2 = readFileSync11(handWritten, "utf8");
       if (splitStatements(sql2).length === 0) {
         throw new Error(`Can't roll back ${name}: migrations/down/${name} has no SQL statements yet. Write the rollback SQL, then run the rollback again. Nothing was changed.`);
       }
       plan.push({ name, sql: sql2, source: `migrations/down/${name}` });
       continue;
     }
-    const upPath = join16(migrationsDir, name);
-    if (!existsSync17(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
-    const down = deriveDown(readFileSync10(upPath, "utf8"));
+    const upPath = join17(migrationsDir, name);
+    if (!existsSync18(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
+    const down = deriveDown(readFileSync11(upPath, "utf8"));
     if (!down.reversible) {
       throw new Error(
         `Can't roll back ${name}: ${down.reason}
@@ -3221,37 +3460,37 @@ Write the reverse SQL to migrations/down/${name} and run the rollback again. Not
     }
     plan.push({ name, sql: down.sql, source: "derived" });
   }
-  log(`${pc11.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
+  log2(`${pc13.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
   for (const step of plan) {
-    log(`  ${step.name} ${pc11.dim(`(${step.source})`)}`);
-    for (const line of step.sql.trim().split("\n")) log(pc11.dim(`    ${line}`));
+    log2(`  ${step.name} ${pc13.dim(`(${step.source})`)}`);
+    for (const line of step.sql.trim().split("\n")) log2(pc13.dim(`    ${line}`));
   }
   if (options2.remote && !options2.yes) {
-    log(pc11.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
+    log2(pc13.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
     return 1;
   }
   const script = plan.map(({ name, sql: sql2 }) => `${sql2.trim()}
 DELETE FROM d1_migrations WHERE name = '${name.replace(/'/g, "''")}';`).join("\n") + "\n";
-  const dir = mkdtempSync(join16(tmpdir(), "flare-rollback-"));
+  const dir = mkdtempSync(join17(tmpdir(), "flare-rollback-"));
   try {
-    const file = join16(dir, "rollback.sql");
-    writeFileSync11(file, script);
+    const file = join17(dir, "rollback.sql");
+    writeFileSync12(file, script);
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Rollback failed:
 ${result.output.trim()}`);
   } finally {
     rmSync2(dir, { recursive: true, force: true });
   }
-  log(pc11.green(`
+  log2(pc13.green(`
 Rolled back ${plan.map((step) => step.name).join(", ")}.`));
   return 0;
 }
 
 // src/commands/rm.ts
-import { existsSync as existsSync18, readdirSync as readdirSync7, readFileSync as readFileSync11, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname10, join as join17 } from "path";
+import { existsSync as existsSync19, readdirSync as readdirSync7, readFileSync as readFileSync12, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname10, join as join18 } from "path";
 import { relationGraph as relationGraph3 } from "@flaredev/core";
-import pc12 from "picocolors";
+import pc14 from "picocolors";
 var squash = (text) => text.replace(/\r\n/g, "\n").replace(/\s+/g, " ").trim();
 function handWrittenReason(source, header, options2 = {}) {
   const parts = splitMarkers(source);
@@ -3268,16 +3507,16 @@ function handWrittenReason(source, header, options2 = {}) {
   return null;
 }
 function removeEmptyDirs(appRoot, start) {
-  let dir = dirname10(join17(appRoot, start));
-  const roots = [join17(appRoot, "app", "api"), join17(appRoot, "app", "admin")];
+  let dir = dirname10(join18(appRoot, start));
+  const roots = [join18(appRoot, "app", "api"), join18(appRoot, "app", "dashboard")];
   const inside = () => roots.some((root) => dir.startsWith(root) && dir !== root);
-  while (inside() && existsSync18(dir) && readdirSync7(dir).length === 0) {
+  while (inside() && existsSync19(dir) && readdirSync7(dir).length === 0) {
     rmdirSync(dir);
     dir = dirname10(dir);
   }
 }
 async function rmResource(rawName, options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = resourceName(rawName);
   const all = await loadResources(appRoot);
@@ -3300,7 +3539,7 @@ async function rmResource(rawName, options2 = {}) {
   if (entry) {
     owned.add(entry.file);
     for (const file of planFiles(all)) {
-      if (existsSync18(join17(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
+      if (existsSync19(join18(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
     }
   }
   for (const orphan of findOrphans(appRoot, remaining)) if (orphan.resource === name) owned.add(orphan.path);
@@ -3309,7 +3548,7 @@ async function rmResource(rawName, options2 = {}) {
   if (!entry && owned.size === 0) throw new Error(`No resource "${name}" (no ${descriptorPath(name)} and no generated files).`);
   const findings = [];
   for (const path of owned) {
-    const source = readFileSync11(join17(appRoot, path), "utf8");
+    const source = readFileSync12(join18(appRoot, path), "utf8");
     let wrapper;
     if (entry && path === entry.file) {
       const standard = splitMarkers(renderDescriptor(name, [{ key: "placeholder", kind: "string", required: true, unique: false }]));
@@ -3330,34 +3569,34 @@ Move what you want to keep, or pass --force to delete anyway.`);
   }
   const removed = [...owned].sort();
   for (const path of removed) {
-    unlinkSync2(join17(appRoot, path));
+    unlinkSync2(join18(appRoot, path));
     removeEmptyDirs(appRoot, path);
-    log(`${pc12.red("remove".padEnd(9))} ${path}`);
+    log2(`${pc14.red("remove".padEnd(9))} ${path}`);
   }
-  logResults(applyPlan(appRoot, planFiles(remaining, policy ? await loadPolicies(appRoot) : void 0)), log);
+  logResults(applyPlan(appRoot, planFiles(remaining, policy ? await loadPolicies(appRoot) : void 0)), log2);
   const table = entry ? tableExport(entry.resource) : void 0;
-  if (table && existsSync18(join17(appRoot, "seeds"))) {
-    const seeds = readdirSync7(join17(appRoot, "seeds")).filter(
-      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync11(join17(appRoot, "seeds", file), "utf8"))
+  if (table && existsSync19(join18(appRoot, "seeds"))) {
+    const seeds = readdirSync7(join18(appRoot, "seeds")).filter(
+      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync12(join18(appRoot, "seeds", file), "utf8"))
     );
-    if (seeds.length) log(pc12.yellow(`
+    if (seeds.length) log2(pc14.yellow(`
 These seeds still use ${table}: ${seeds.map((s) => `seeds/${s}`).join(", ")}.`));
   }
   let migrations = [];
   if (!options2.skipMigration && entry) {
     const result = await generateSchemaMigration(appRoot, `drop_${entry.resource.table}`);
     migrations = result.files;
-    for (const file of migrations) log(`${pc12.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc12.dim(`repaired  ${repair}`));
-    if (migrations.length) log(`
-Next: ${pc12.bold("flare migrate")} to drop the table locally.`);
+    for (const file of migrations) log2(`${pc14.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log2(pc14.dim(`repaired  ${repair}`));
+    if (migrations.length) log2(`
+Next: ${pc14.bold("flare migrate")} to drop the table locally.`);
   }
   return { removed, migrations };
 }
 
 // src/commands/role.ts
 import { humanize } from "@flaredev/core";
-import pc13 from "picocolors";
+import pc15 from "picocolors";
 var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
 function roleInsertSql(name, label) {
   if (!ROLE_NAME.test(name)) throw new Error(`Invalid role "${name}". Use lowercase letters, digits, _ or -, e.g. admin or support-agent.`);
@@ -3390,7 +3629,7 @@ ${result.output.trim()}`);
   return (first?.results ?? []).map((row) => row.name);
 }
 async function addRole(name, options2 = {}) {
-  const { appRoot, binding, wrangler, target, log } = context2(options2);
+  const { appRoot, binding, wrangler, target, log: log2 } = context2(options2);
   const sql2 = roleInsertSql(name, options2.label ?? humanize(name));
   const result = await runWrangler(wrangler, ["d1", "execute", binding, ...target, "--json", "--command", sql2], appRoot, { capture: true });
   if (result.code !== 0) {
@@ -3402,24 +3641,137 @@ ${result.output.trim()}`);
   }
   const [first] = extractJson(result.output);
   const added = first?.results?.[0];
-  log(pc13.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
-  log(pc13.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
+  log2(pc15.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
+  log2(pc15.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
   return 0;
 }
 
 // src/commands/seed.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, readdirSync as readdirSync8, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync10, readdirSync as readdirSync8, writeFileSync as writeFileSync13 } from "fs";
+import { join as join20 } from "path";
+import { createFake, kebabCase as kebabCase3, storedFields as storedFields2 } from "@flaredev/core";
+import { createJiti as createJiti4 } from "jiti";
+import pc16 from "picocolors";
+
+// src/seed/bulk.ts
+var MAX_STATEMENT_BYTES = 8e4;
+var STATEMENTS_PER_CALL = 25;
+function sqlLiteral(value) {
+  if (value === null || value === void 0) return "NULL";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "NULL";
+  if (typeof value === "boolean") return value ? "1" : "0";
+  if (value instanceof Date) return String(value.getTime());
+  const text = typeof value === "object" ? JSON.stringify(value) : String(value);
+  return `'${text.replaceAll("'", "''")}'`;
+}
+var tuple = (row, columns) => `(${columns.map((column) => sqlLiteral(row[column])).join(",")})`;
+function* insertStatements(table, columns, rows, maxBytes = MAX_STATEMENT_BYTES) {
+  const head = `INSERT INTO "${table}" (${columns.map((column) => `"${column}"`).join(",")}) VALUES `;
+  let values = [];
+  let bytes = head.length;
+  for (const row of rows) {
+    const text = tuple(row, columns);
+    if (values.length > 0 && bytes + text.length + 1 > maxBytes) {
+      yield { sql: `${head}${values.join(",")};`, rows: values.length };
+      values = [];
+      bytes = head.length;
+    }
+    values.push(text);
+    bytes += text.length + 1;
+  }
+  if (values.length > 0) yield { sql: `${head}${values.join(",")};`, rows: values.length };
+}
+async function bulkInsert(sink, options2) {
+  const perCall = options2.statementsPerCall ?? STATEMENTS_PER_CALL;
+  let written = 0;
+  let batch = [];
+  let batchRows = 0;
+  const flush = async () => {
+    if (batch.length === 0) return;
+    await sink.exec(batch.join("\n"));
+    written += batchRows;
+    batch = [];
+    batchRows = 0;
+    options2.onProgress?.(written);
+  };
+  for (const statement of insertStatements(options2.table, options2.columns, options2.rows, options2.maxBytes)) {
+    batch.push(statement.sql);
+    batchRows += statement.rows;
+    if (batch.length === perCall) await flush();
+  }
+  await flush();
+  return written;
+}
+
+// src/seed/insert-many.ts
+var isIterable = (value) => typeof value === "object" && value !== null && Symbol.iterator in value;
+function createInsertMany(sink, drizzle, onProgress) {
+  return async function insertMany(table, count, build) {
+    const name = drizzle.getTableName(table);
+    const columns = drizzle.getTableColumns(table);
+    if (typeof count === "number" && !build) throw new Error(`insertMany(${name}, ${count}) needs a function to build each row.`);
+    const source = typeof count === "number" ? (function* () {
+      for (let i = 0; i < count; i++) yield build(i);
+    })() : isIterable(count) ? count : [];
+    const iterator = source[Symbol.iterator]();
+    const first = iterator.next();
+    if (first.done) return 0;
+    const keys = new Set(Object.keys(first.value));
+    for (const [key, column] of Object.entries(columns)) if (column.defaultFn) keys.add(key);
+    const used = Object.keys(columns).filter((key) => keys.has(key));
+    const unknownKeys = [...keys].filter((key) => !columns[key]);
+    if (unknownKeys.length) throw new Error(`${name} has no column called ${unknownKeys.join(", ")}.`);
+    const toRow = (value) => {
+      const row = {};
+      for (const key of used) {
+        const column = columns[key];
+        let raw = value[key];
+        if (raw === void 0 && column.defaultFn) raw = column.defaultFn();
+        row[column.name] = raw === void 0 || raw === null ? null : column.mapToDriverValue?.(raw) ?? raw;
+      }
+      return row;
+    };
+    const rows = (function* () {
+      yield toRow(first.value);
+      for (let next = iterator.next(); !next.done; next = iterator.next()) yield toRow(next.value);
+    })();
+    return bulkInsert(sink, {
+      table: name,
+      columns: used.map((key) => columns[key].name),
+      rows,
+      onProgress: onProgress && ((written) => onProgress(written, name))
+    });
+  };
+}
+
+// src/seed/local-d1.ts
 import { createRequire } from "module";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import { pathToFileURL } from "url";
-import { kebabCase as kebabCase3, storedFields as storedFields2 } from "@flaredev/core";
-import { createJiti as createJiti4 } from "jiti";
-import pc14 from "picocolors";
-var SEEDS_DIR = "seeds";
 var LOCAL_STATE = ".wrangler/state/v3";
+async function openLocalD1(appRoot, binding) {
+  process.env.WRANGLER_LOG ??= "error";
+  const appRequire = createRequire(join19(appRoot, "package.json"));
+  const wrangler = await import(pathToFileURL(appRequire.resolve("wrangler")).href);
+  const { env, dispose } = await wrangler.getPlatformProxy({
+    configPath: join19(appRoot, "wrangler.jsonc"),
+    persist: { path: join19(appRoot, LOCAL_STATE) }
+  });
+  const bindings = env;
+  const name = binding ?? "DB";
+  const db = bindings[name];
+  if (!db) {
+    const available = Object.keys(bindings).filter((key) => typeof bindings[key]?.prepare === "function");
+    throw new Error(`No "${name}" database binding in wrangler.jsonc.${available.length ? ` Available: ${available.join(", ")}.` : ""}`);
+  }
+  return { db, env: bindings, dispose };
+}
+
+// src/commands/seed.ts
+var SEEDS_DIR = "seeds";
 function seedFiles(appRoot, names) {
-  const dir = join18(appRoot, SEEDS_DIR);
-  const all = existsSync19(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
+  const dir = join20(appRoot, SEEDS_DIR);
+  const all = existsSync20(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
   if (!names?.length) return all;
   return names.map((name) => {
     const file = `${name.replace(/\.seed\.ts$/, "")}.seed.ts`;
@@ -3430,58 +3782,66 @@ function seedFiles(appRoot, names) {
   });
 }
 async function runSeeds(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const files = seedFiles(appRoot, options2.names);
   if (files.length === 0) {
-    log(`No seeds found. Create one with ${pc14.bold("flare seed:make <name>")}.`);
+    log2(`No seeds found. Create one with ${pc16.bold("flare seed:make <name>")}.`);
     return;
   }
-  const jiti = createJiti4(join18(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
-  const appRequire = createRequire(join18(appRoot, "package.json"));
-  const wrangler = await import(pathToFileURL(appRequire.resolve("wrangler")).href);
+  const jiti = createJiti4(join20(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
   const { drizzle } = await jiti.import("drizzle-orm/d1");
-  const schema = await jiti.import(join18(appRoot, "db/schema.ts"));
-  const { env, dispose } = await wrangler.getPlatformProxy({
-    configPath: join18(appRoot, "wrangler.jsonc"),
-    persist: { path: join18(appRoot, LOCAL_STATE) }
-  });
+  const drizzleHelpers = await jiti.import("drizzle-orm");
+  const schema = await jiti.import(join20(appRoot, "db/schema.ts"));
+  const local = await openLocalD1(appRoot);
   try {
-    const bindings = env;
-    if (!bindings.DB) throw new Error("No DB binding found in wrangler.jsonc.");
-    const db = drizzle(bindings.DB, { schema });
+    const db = drizzle(local.db, { schema });
+    const insertMany = createInsertMany(local.db, drizzleHelpers);
     for (const file of files) {
-      const mod = await jiti.import(join18(appRoot, SEEDS_DIR, file));
+      const mod = await jiti.import(join20(appRoot, SEEDS_DIR, file));
       if (typeof mod.default !== "function") throw new Error(`${SEEDS_DIR}/${file} must \`export default defineSeed(async ({ db }) => { ... })\`.`);
-      log(`${pc14.cyan("seed")} ${file}`);
-      await mod.default({ db, env: bindings, log: (message) => log(`  ${message}`) });
+      log2(`${pc16.cyan("seed")} ${file}`);
+      await mod.default({ db, env: local.env, insertMany, fake: createFake(), log: (message) => log2(`  ${message}`) });
     }
-    log(pc14.green(`
+    log2(pc16.green(`
 Ran ${files.length} seed(s) against the local database.`));
   } finally {
-    await dispose();
+    await local.dispose();
   }
 }
-function sampleValue(key, def, row) {
+function sampleValue(key, def) {
+  const name = key.toLowerCase();
   switch (def.kind) {
     case "string":
-      if (def.format === "email") return `\`${kebabCase3(key).replace(/-?email$/, "") || "user"}\${i}@example.com\``;
-      if (def.format === "url") return `\`https://example.com/\${i}\``;
-      return `\`${def.label} \${i}\``;
+      if (def.format === "email") return "fake.email()";
+      if (def.format === "url") return "fake.url()";
+      if (def.format === "tel") return "fake.phone()";
+      if (def.format === "domain") return "fake.domain()";
+      if (def.format === "country") return "fake.country()";
+      if (def.format === "color") return "fake.color()";
+      if (def.format === "slug") return "fake.slug()";
+      if (name.includes("email")) return "fake.email()";
+      if (name.includes("phone") || name.includes("mobile")) return "fake.phone()";
+      if (name.includes("company")) return "fake.company()";
+      if (name.includes("city")) return "fake.city()";
+      if (name.includes("name")) return "fake.fullName()";
+      return "fake.words(2)";
     case "text":
-      return `"Lorem ipsum dolor sit amet."`;
+      return "fake.paragraph()";
     case "int":
-      return "i";
+      return "fake.int(1, 1000)";
     case "float":
-      return "i * 1.5";
+      return "fake.float(1, 1000)";
     case "boolean":
-      return "i % 2 === 0";
+      return "fake.bool()";
     case "date":
-      return "`2026-01-0${i}`";
+      return "fake.date()";
     case "datetime":
-      return "new Date().toISOString()";
+      return "fake.datetime()";
     case "enum":
-      return JSON.stringify(def.options[row % def.options.length]);
+      return `fake.pick(${JSON.stringify(def.options)})`;
+    case "multiselect":
+      return `fake.some(${JSON.stringify(def.options)}, ${Math.max(1, def.minItems ?? 1)})`;
     case "file":
       return void 0;
     case "belongsTo":
@@ -3492,9 +3852,10 @@ function renderSeed(resource) {
   if (!resource) {
     return `import { defineSeed } from "@flaredev/core";
 
-export default defineSeed(async ({ db, log }) => {
+export default defineSeed(async ({ db, insertMany, fake, log }) => {
   // Insert rows with Drizzle, e.g.:
   // await db.insert(contacts).values([{ name: "Ada", email: "ada@example.com" }]);
+  // Or many at once, batched: insertMany(contacts, 10_000, () => ({ name: fake.fullName() }));
   log("nothing to seed yet");
 });
 `;
@@ -3503,30 +3864,32 @@ export default defineSeed(async ({ db, log }) => {
   const lines = [];
   const todos = [];
   for (const [key, def] of storedFields2(resource)) {
-    const value = sampleValue(key, def, 0);
+    const value = sampleValue(key, def);
     if (value !== void 0) lines.push(`    ${key}: ${value},`);
     else if (def.required) todos.push(`    // ${key}: TODO (${def.kind === "belongsTo" ? `id of an existing ${def.target}` : "R2 object key"}),`);
   }
   return `import { defineSeed } from "@flaredev/core";
 import { ${table} } from "@/db/schema";
 
-export default defineSeed(async ({ db, log }) => {
-  const rows = [1, 2, 3].map((i) => ({
+/** How many to create. insertMany batches them, so hundreds of thousands are fine. */
+const COUNT = 50;
+
+export default defineSeed(async ({ insertMany, fake, log }) => {
+  const rows = await insertMany(${table}, COUNT, () => ({
 ${[...lines, ...todos].join("\n")}
   }));
-  await db.insert(${table}).values(rows);
-  log(\`inserted \${rows.length} ${resource.pluralLabel.toLowerCase()}\`);
+  log(\`inserted \${rows.toLocaleString()} ${resource.pluralLabel.toLowerCase()}\`);
 });
 `;
 }
 async function makeSeed(rawName, options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = kebabCase3(rawName);
   if (!name) throw new Error(`Invalid seed name "${rawName}".`);
   const relative2 = `${SEEDS_DIR}/${name}.seed.ts`;
-  const path = join18(appRoot, relative2);
-  if (existsSync19(path)) throw new Error(`${relative2} already exists.`);
+  const path = join20(appRoot, relative2);
+  if (existsSync20(path)) throw new Error(`${relative2} already exists.`);
   const resources = (await loadResources(appRoot)).map(({ resource: resource2 }) => resource2);
   let resource;
   if (options2.resource) {
@@ -3535,27 +3898,287 @@ async function makeSeed(rawName, options2 = {}) {
   } else {
     resource = resources.find((r) => [kebabCase3(r.name), r.slug].includes(name));
   }
-  mkdirSync10(join18(appRoot, SEEDS_DIR), { recursive: true });
-  writeFileSync12(path, renderSeed(resource));
-  log(`${pc14.green("create".padEnd(9))} ${relative2}`);
-  log(`
-Run it with ${pc14.bold(`flare seed ${name}`)}.`);
+  mkdirSync10(join20(appRoot, SEEDS_DIR), { recursive: true });
+  writeFileSync13(path, renderSeed(resource));
+  log2(`${pc16.green("create".padEnd(9))} ${relative2}`);
+  log2(`
+Run it with ${pc16.bold(`flare seed ${name}`)}.`);
   return relative2;
 }
 
+// src/commands/seed-resource.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync14 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join21 } from "path";
+import pc17 from "picocolors";
+
+// src/seed/rows.ts
+import { columnName as columnName2, createFake as createFake2, storedFields as storedFields3 } from "@flaredev/core";
+var has = (key, ...words) => words.some((word) => key.includes(word));
+function stringValue(key, def, fake, resource, index) {
+  switch (def.format) {
+    case "email":
+      return fake.email();
+    case "url":
+      return fake.url();
+    case "tel":
+      return fake.phone();
+    case "domain":
+      return fake.domain();
+    case "country":
+      return fake.country();
+    case "color":
+      return fake.color();
+    case "slug":
+      return fake.slug();
+  }
+  const name = key.toLowerCase();
+  const organisation = has(resource.name.toLowerCase(), "company", "vendor", "supplier", "organisation", "organization", "account", "team", "store", "brand");
+  let value;
+  if (has(name, "email")) value = fake.email();
+  else if (has(name, "phone", "mobile", "tel", "whatsapp")) value = fake.phone();
+  else if (has(name, "firstname", "givenname")) value = fake.firstName();
+  else if (has(name, "lastname", "surname", "familyname")) value = fake.lastName();
+  else if (has(name, "company", "organisation", "organization", "employer", "vendor", "supplier", "business")) value = fake.company();
+  else if (has(name, "city", "town")) value = fake.city();
+  else if (has(name, "country")) value = fake.country();
+  else if (has(name, "address", "street")) value = `${fake.int(1, 240)} ${fake.words(1)} Street, ${fake.city()}`;
+  else if (has(name, "website", "url", "link")) value = fake.url();
+  else if (has(name, "slug", "handle", "username")) value = fake.slug();
+  else if (has(name, "colour", "color")) value = fake.color();
+  else if (has(name, "code", "sku", "reference", "number")) value = `${fake.words(1).slice(0, 3).toUpperCase()}-${String(index + 1).padStart(6, "0")}`;
+  else if (has(name, "title", "position", "role", "job")) value = fake.jobTitle();
+  else if (has(name, "name")) value = organisation ? fake.company() : fake.fullName();
+  else if (has(name, "description", "summary", "note", "bio", "about", "message", "comment")) value = fake.sentence();
+  else value = `${fake.words(2)}`.replace(/^./, (letter) => letter.toUpperCase());
+  if (def.maxLength && value.length > def.maxLength) value = value.slice(0, def.maxLength);
+  if (def.minLength && value.length < def.minLength) value = value.padEnd(def.minLength, "x");
+  return value;
+}
+function numberValue(key, def, fake) {
+  const name = key.toLowerCase();
+  const money = has(name, "price", "amount", "total", "cost", "fee", "revenue", "salary", "balance");
+  let min = def.min;
+  let max = def.max;
+  if (min === void 0 || max === void 0) {
+    const [low, high] = money ? [5, 5e3] : has(name, "age") ? [18, 78] : has(name, "year") ? [2015, (/* @__PURE__ */ new Date()).getFullYear()] : has(name, "quantity", "qty", "stock", "seats", "items") ? [1, 250] : has(name, "percent", "rate", "score", "discount") ? [0, 100] : [1, 1e3];
+    min = min ?? low;
+    max = max ?? high;
+  }
+  return def.kind === "int" ? fake.int(Math.ceil(min), Math.floor(max)) : fake.float(min, max, money ? 2 : 2);
+}
+function fieldValue(key, def, fake, resource, parentIds, index) {
+  const name = key.toLowerCase();
+  if (!def.required && def.kind !== "belongsTo" && fake.bool(0.15)) return null;
+  switch (def.kind) {
+    case "string":
+      return stringValue(key, def, fake, resource, index);
+    case "text":
+      return fake.paragraph(fake.int(1, 3));
+    case "int":
+    case "float":
+      return numberValue(key, def, fake);
+    case "boolean":
+      return fake.bool(has(name, "active", "enabled", "published", "verified", "visible") ? 0.85 : 0.4);
+    case "date":
+      return has(name, "due", "expire", "end", "renew") ? fake.date(-90) : fake.date();
+    case "datetime":
+      return has(name, "due", "expire", "end", "renew") ? fake.datetime(-90) : fake.datetime();
+    case "enum":
+      return fake.pick(def.options);
+    case "multiselect":
+      return fake.some(def.options, Math.max(1, def.minItems ?? 1), def.maxItems ?? def.options.length);
+    case "file":
+      return def.required ? `seed/${resource.table}/${fake.count}.bin` : null;
+    case "belongsTo": {
+      const ids = parentIds.get(def.target) ?? [];
+      if (ids.length === 0) {
+        if (def.required) {
+          throw new Error(`${resource.name}.${key} needs a ${def.target} to belong to, and there are none. Seed ${def.target} first.`);
+        }
+        return null;
+      }
+      return fake.pick(ids);
+    }
+  }
+}
+function uniquify(value, row) {
+  const trailing = /(\d+)$/.exec(value)?.[1];
+  if (trailing && Number(trailing) === row) return value;
+  const at = value.indexOf("@");
+  if (at > 0) return `${value.slice(0, at)}.${row}${value.slice(at)}`;
+  if (/^[a-z0-9.-]+$/.test(value)) return `${value}-${row}`;
+  return `${value} ${row}`;
+}
+function seedColumns(resource) {
+  return ["id", ...storedFields3(resource).map(([key]) => columnName2(key)), "created_at", "updated_at"];
+}
+function* seedRows(resource, count, options2 = {}) {
+  const fake = createFake2(options2.seed ?? Math.floor(Math.random() * 2 ** 31));
+  const parentIds = options2.parentIds ?? /* @__PURE__ */ new Map();
+  const fields = storedFields3(resource);
+  const now = options2.now ?? Date.now();
+  for (let i = 0; i < count; i++) {
+    const row = { id: fake.id() };
+    for (const [key, def] of fields) {
+      let value = fieldValue(key, def, fake, resource, parentIds, i);
+      if (typeof value === "string" && "unique" in def && def.unique) value = uniquify(value, i + 1);
+      row[columnName2(key)] = value;
+    }
+    const created = now - fake.int(0, 365) * 864e5 - fake.int(0, 86399999);
+    row.created_at = created;
+    row.updated_at = created + fake.int(0, Math.min(now - created, 30 * 864e5));
+    yield row;
+  }
+}
+
+// src/commands/seed-resource.ts
+var PARENT_SAMPLE = 5e3;
+function parseCount(value, fallback = 25) {
+  if (value === void 0 || value === "") return fallback;
+  if (typeof value === "number") return Math.floor(value);
+  const text = String(value).trim().toLowerCase().replaceAll(",", "").replaceAll("_", "").replaceAll(" ", "");
+  const match = /^(\d+(?:\.\d+)?)([km])?$/.exec(text);
+  if (!match) throw new Error(`"${value}" is not a number of rows. Try 1000, 25k or 1m.`);
+  const size = Number(match[1]) * (match[2] === "k" ? 1e3 : match[2] === "m" ? 1e6 : 1);
+  if (size < 1) throw new Error("Ask for at least one row.");
+  return Math.floor(size);
+}
+function pickResource(resources, name) {
+  const wanted = name.toLowerCase();
+  const match = resources.find((resource) => [resource.name.toLowerCase(), resource.slug, resource.table].includes(wanted));
+  if (!match) {
+    throw new Error(`No resource "${name}". Available: ${resources.map((resource) => resource.name).join(", ") || "none"}.`);
+  }
+  return match;
+}
+function pickDatabase(databases, wanted) {
+  if (databases.length === 0) throw new Error("No d1_databases in wrangler.jsonc.");
+  if (wanted) {
+    const match = databases.find((db) => db.binding === wanted || db.database_name === wanted);
+    if (!match) throw new Error(`No D1 database "${wanted}". Available: ${databases.map((db) => db.binding).join(", ")}.`);
+    return match;
+  }
+  if (databases.length > 1) throw new Error(`Several D1 databases; pick one with --database (${databases.map((db) => db.binding).join(", ")}).`);
+  return databases[0];
+}
+async function parentsOf(resource, all, ids) {
+  const targets = new Set(
+    Object.values(resource.fields).filter((field) => field.kind === "belongsTo").map((field) => field.target)
+  );
+  const parents = /* @__PURE__ */ new Map();
+  for (const target of targets) {
+    const parent = all.find((candidate) => candidate.name === target);
+    if (parent) parents.set(target, await ids(parent.table));
+  }
+  return parents;
+}
+async function seedResourceCommand(name, options2 = {}) {
+  const progress = progressLine();
+  const started = Date.now();
+  try {
+    const result = await seedResource(name, {
+      ...options2,
+      onProgress: (written, total) => {
+        const elapsed = Date.now() - started;
+        progress.update(`  ${pc17.cyan(formatCount(written))} of ${formatCount(total)} rows  ${pc17.dim(formatRate(written, elapsed))}`);
+      }
+    });
+    progress.done();
+    const { rows, ms, where } = result;
+    console.log(
+      `${pc17.green("\u2714")} Seeded ${pc17.bold(formatCount(rows))} ${result.resource.pluralLabel.toLowerCase()} into the ${where} database ` + pc17.dim(`(${formatDuration(ms)}, ${formatRate(rows, ms)})`)
+    );
+    return result;
+  } catch (error) {
+    progress.done();
+    throw error;
+  }
+}
+async function seedResource(name, options2 = {}) {
+  const log2 = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const resources = (await loadResources(appRoot)).map(({ resource: resource2 }) => resource2);
+  const resource = pickResource(resources, name);
+  const total = parseCount(options2.count);
+  const where = options2.remote ? "remote" : "local";
+  if (options2.remote && !options2.yes) {
+    throw new Error(`Seeding the remote database writes ${total.toLocaleString()} rows to ${resource.table}. Re-run with --yes to confirm.`);
+  }
+  const columns = seedColumns(resource);
+  const started = Date.now();
+  let parents = /* @__PURE__ */ new Map();
+  const rows = () => seedRows(resource, total, { seed: options2.seed, parentIds: parents });
+  if (options2.remote) {
+    const db = pickDatabase(readD1Databases(appRoot), options2.database);
+    const wrangler = resolveBin(appRoot, "wrangler", "wrangler");
+    const target = ["--remote", ...options2.env ? ["--env", options2.env] : []];
+    const query = async (sql2) => {
+      const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--json", "--command", sql2], appRoot, { capture: true });
+      if (result.code !== 0) throw new Error(`Query failed on the remote database:
+${result.output.trim()}`);
+      const start = result.output.indexOf("[");
+      const parsed = JSON.parse(result.output.slice(start, result.output.lastIndexOf("]") + 1));
+      return parsed[0]?.results ?? [];
+    };
+    parents = await parentsOf(resource, resources, async (table) => {
+      const found = await query(`SELECT id FROM "${table}" LIMIT ${PARENT_SAMPLE}`);
+      return found.map((row) => row.id);
+    });
+    const dir = mkdtempSync2(join21(tmpdir2(), "flare-seed-"));
+    const file = join21(dir, `${resource.table}.sql`);
+    try {
+      const statements = [];
+      if (options2.truncate) statements.push(`DELETE FROM "${resource.table}";`);
+      let written = 0;
+      for (const statement of insertStatements(resource.table, columns, rows())) {
+        statements.push(statement.sql);
+        written += statement.rows;
+        options2.onProgress?.(written, total);
+      }
+      writeFileSync14(file, statements.join("\n"));
+      log2(`${pc17.cyan("\u25CF")} Uploading ${total.toLocaleString()} rows to ${pc17.bold(db.database_name)}`);
+      const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--yes", "--file", file], appRoot, { capture: true });
+      if (result.code !== 0) throw new Error(`Seeding the remote database failed:
+${result.output.trim()}`);
+    } finally {
+      rmSync3(dir, { recursive: true, force: true });
+    }
+    return { resource, rows: total, ms: Date.now() - started, where };
+  }
+  const local = await openLocalD1(appRoot, options2.database);
+  try {
+    parents = await parentsOf(resource, resources, async (table) => {
+      const found = await local.db.prepare(`SELECT id FROM "${table}" LIMIT ${PARENT_SAMPLE}`).all();
+      return (found.results ?? []).map((row) => row.id);
+    });
+    if (options2.truncate) await local.db.exec(`DELETE FROM "${resource.table}";`);
+    const sink = { exec: (sql2) => local.db.exec(sql2) };
+    const written = await bulkInsert(sink, {
+      table: resource.table,
+      columns,
+      rows: rows(),
+      onProgress: (count) => options2.onProgress?.(count, total)
+    });
+    return { resource, rows: written, ms: Date.now() - started, where };
+  } finally {
+    await local.dispose();
+  }
+}
+
 // src/commands/billing-sync.ts
 import { createRequire as createRequire2 } from "module";
-import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync3, writeFileSync as writeFileSync13 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join19 } from "path";
+import { existsSync as existsSync21, mkdtempSync as mkdtempSync3, readFileSync as readFileSync13, rmSync as rmSync4, writeFileSync as writeFileSync15 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join22 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import { kebabCase as kebabCase4 } from "@flaredev/core";
-import pc15 from "picocolors";
+import pc18 from "picocolors";
 function stripeKeys(appRoot) {
   const map = {};
-  const path = join19(appRoot, ".dev.vars");
-  if (existsSync20(path)) {
-    for (const line of readFileSync12(path, "utf8").split(/\r?\n/)) {
+  const path = join22(appRoot, ".dev.vars");
+  if (existsSync21(path)) {
+    for (const line of readFileSync13(path, "utf8").split(/\r?\n/)) {
       const match = /^\s*([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match) map[match[1]] = match[2].trim();
     }
@@ -3632,16 +4255,16 @@ async function syncPortalConfiguration(stripe, rows, appName) {
   return existing ? (await stripe.billingPortal.configurations.update(existing.id, settings)).id : (await stripe.billingPortal.configurations.create(settings)).id;
 }
 async function syncPlans(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const key = stripeKeys(appRoot).STRIPE_SECRET_KEY;
   if (!key) throw new Error("STRIPE_SECRET_KEY is not set in .dev.vars or the environment.");
   const db = readD1Databases(appRoot)[0];
   if (!db) throw new Error("No d1_databases in wrangler.jsonc.");
-  const appRequire = createRequire2(join19(appRoot, "package.json"));
+  const appRequire = createRequire2(join22(appRoot, "package.json"));
   const stripeModule = await import(pathToFileURL2(appRequire.resolve("stripe")).href);
   const stripe = new stripeModule.default(key, { apiVersion: "2026-08-26.dahlia" });
-  const appName = JSON.parse(readFileSync12(join19(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync13(join22(appRoot, "package.json"), "utf8")).name ?? "app";
   const everything = await stripe.products.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 });
   const products = options2.all ? everything : everything.filter((product) => product.metadata?.flare_app === appName);
   if (products.length === 0) {
@@ -3662,88 +4285,88 @@ async function syncPlans(options2 = {}) {
 ${existingResult.output.trim()}`);
   }
   const known = new Set(extractJson(existingResult.output)[0]?.results.map((row) => row.stripe_price_id));
-  const dir = mkdtempSync2(join19(tmpdir2(), "flare-sync-"));
+  const dir = mkdtempSync3(join22(tmpdir3(), "flare-sync-"));
   try {
-    const file = join19(dir, "sync-plans.sql");
-    writeFileSync13(file, renderSyncSql(rows));
+    const file = join22(dir, "sync-plans.sql");
+    writeFileSync15(file, renderSyncSql(rows));
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Could not write plans:
 ${result.output.trim()}`);
   } finally {
-    rmSync3(dir, { recursive: true, force: true });
+    rmSync4(dir, { recursive: true, force: true });
   }
   let created = 0;
   for (const row of rows) {
     const isNew = !known.has(row.stripePriceId);
     if (isNew) created++;
     const price = `${row.currency.toUpperCase()} ${(row.amount / 100).toFixed(2)}${row.interval ? `/${row.interval}` : " once"}`;
-    log(`${(isNew ? pc15.green("create") : pc15.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc15.dim(price)}`);
+    log2(`${(isNew ? pc18.green("create") : pc18.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc18.dim(price)}`);
   }
-  for (const name of skipped) log(pc15.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
+  for (const name of skipped) log2(pc18.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
   const configuration = await syncPortalConfiguration(stripe, rows, appName);
-  if (configuration) log(`${pc15.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
-  log(pc15.green(`
+  if (configuration) log2(`${pc18.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
+  log2(pc18.green(`
 ${rows.length} plan(s) synced to the ${options2.remote ? "remote" : "local"} database; plans no longer active in Stripe were deactivated.`));
   return { created, updated: rows.length - created, skipped };
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync21 } from "fs";
-import { join as join20 } from "path";
-import pc16 from "picocolors";
+import { existsSync as existsSync22 } from "fs";
+import { join as join23 } from "path";
+import pc19 from "picocolors";
 async function syncTypes(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const all = await loadResources(appRoot);
   const policies = await loadPolicies(appRoot);
-  const tracksPolicies = policies.length > 0 || existsSync21(join20(appRoot, "policies/index.ts"));
+  const tracksPolicies = policies.length > 0 || existsSync22(join23(appRoot, "policies/index.ts"));
   const plan = planFiles(all, tracksPolicies ? policies : void 0);
-  if (!options2.check) ensureSupportFiles(appRoot, log);
+  if (!options2.check) ensureSupportFiles(appRoot, log2);
   const results = applyPlan(appRoot, plan, { force: options2.force, dryRun: options2.check });
-  logResults(results, log);
+  logResults(results, log2);
   const drift = results.filter((r) => r.outcome === "skipped-drift");
   const unmarked = results.filter((r) => r.outcome === "skipped-unmarked");
   const changed = results.filter((r) => r.outcome === "create" || r.outcome === "update");
   const orphans = findOrphans(appRoot, all);
   if (drift.length) {
-    log(
+    log2(
       `
-${pc16.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
+${pc19.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
 Move custom code outside the // generated:start \u2026 // generated:end block, or re-run with --force to overwrite.`
     );
   }
   if (unmarked.length) {
-    log(`
-${pc16.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
+    log2(`
+${pc19.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
   }
   if (orphans.length) {
     const resources = [...new Set(orphans.map((o) => o.resource))];
-    log(`
-${pc16.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
-    for (const orphan of orphans) log(`  ${orphan.path}`);
-    log(
-      `If the resource was deleted, remove them with ${pc16.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
+    log2(`
+${pc19.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
+    for (const orphan of orphans) log2(`  ${orphan.path}`);
+    log2(
+      `If the resource was deleted, remove them with ${pc19.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
     );
   }
   const tablesChanged = changed.some((r) => r.path.startsWith("db/schema/") && (r.status === "outdated" || r.status === "missing"));
   if (tablesChanged && !options2.check) {
-    log(`
-${pc16.cyan("Tables changed.")} Create a migration with ${pc16.bold("flare gen migration <name> --from-schema")}, then ${pc16.bold("flare migrate")}.`);
+    log2(`
+${pc19.cyan("Tables changed.")} Create a migration with ${pc19.bold("flare gen migration <name> --from-schema")}, then ${pc19.bold("flare migrate")}.`);
   }
   const problems = drift.length + unmarked.length + orphans.length;
   if (options2.check) {
     const stale = changed.length;
-    if (stale === 0 && problems === 0) log(pc16.green("Generated files are in sync with the resource descriptors."));
-    else log(`
-${pc16.red("Out of sync:")} ${stale} file(s) would change. Run ${pc16.bold("flare sync-types")}.`);
+    if (stale === 0 && problems === 0) log2(pc19.green("Generated files are in sync with the resource descriptors."));
+    else log2(`
+${pc19.red("Out of sync:")} ${stale} file(s) would change. Run ${pc19.bold("flare sync-types")}.`);
     return stale + problems > 0 ? 1 : 0;
   }
-  if (changed.length === 0 && problems === 0) log(pc16.green("Everything is in sync."));
+  if (changed.length === 0 && problems === 0) log2(pc19.green("Everything is in sync."));
   return problems > 0 ? 1 : 0;
 }
 
 // src/commands/user-role.ts
-import pc17 from "picocolors";
+import pc20 from "picocolors";
 var ROLE = /^[a-z][a-z0-9_-]{0,31}$/;
 var EMAIL = /^[^\s@'"\\]+@[^\s@'"\\]+\.[^\s@'"\\]+$/;
 function userRoleSql(email, role) {
@@ -3752,13 +4375,13 @@ function userRoleSql(email, role) {
   return `UPDATE "user" SET role = '${role}', updated_at = cast(unixepoch('subsecond') * 1000 as integer) WHERE lower(email) = lower('${email}') RETURNING email, role`;
 }
 async function setUserRole(email, role, options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const sql2 = userRoleSql(email, role);
   const roles = await listRoles(options2);
   if (roles && !roles.includes(role)) {
-    log(pc17.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
-    log(pc17.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
+    log2(pc20.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
+    log2(pc20.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
     return 1;
   }
   const db = readD1Databases(appRoot)[0];
@@ -3772,19 +4395,40 @@ ${result.output.trim()}`);
   const [first] = extractJson(result.output);
   const updated = first?.results ?? [];
   if (updated.length === 0) {
-    log(pc17.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
+    log2(pc20.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
     return 1;
   }
-  log(pc17.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
+  log2(pc20.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
   return 0;
 }
 
 // src/cli.ts
 function createCli() {
   const cli = cac("flare");
-  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--auth-providers <list>", "OAuth providers to scaffold, comma-separated (google, github)").option("--skip-install", "Write files without installing dependencies").example("flare create shop --auth-providers google,github").action((dir, options2) => {
+  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--theme <name>", "Look of the app: default, coral, amber, sky, mono or emerald").option("--auth <list>", "Sign-in methods: magic-link, email-otp, passkeys, 2fa-app, 2fa-email, all or none (default: all)").option("--auth-providers <list>", "Social sign-in, comma-separated: google, github, apple, microsoft").option("-y, --yes", "Don't ask: use the flags given and the defaults for the rest").option("--skip-install", "Write files without installing dependencies").example("flare create shop").example("flare create shop --theme mono --auth passkeys,2fa-app --auth-providers google,github --yes").action(async (dir, options2) => {
     const install = !options2.skipInstall;
-    const result = createApp(dir, { pm: options2.pm, install, authProviders: options2.authProviders });
+    let answers = { theme: options2.theme, auth: options2.auth, authProviders: options2.authProviders };
+    if (canPrompt(options2.yes)) answers = await askCreateQuestions(answers, toAppName(dir));
+    const result = createApp(dir, {
+      pm: options2.pm,
+      install,
+      ...answers,
+      log: (message) => prompts3.log.message(message),
+      // The install is the long part of `flare create`, so it gets a timer rather
+      // than a wall of package manager output. Output is kept for when it fails.
+      installer: (packageManager, args, cwd) => {
+        const spin = prompts3.spinner({ indicator: "timer" });
+        spin.start(`Installing dependencies with ${packageManager}`);
+        const { code, output } = runQuiet(packageManager, args, cwd);
+        if (code === 0) {
+          spin.stop(`Installed dependencies with ${packageManager}`);
+        } else {
+          spin.error(`${packageManager} install failed`);
+          process.stderr.write(output);
+        }
+        return code;
+      }
+    });
     printNextSteps(result, install);
   });
   cli.command("gen <generator> [name]", "Generate code. Generators: resource, migration, policy, billing, security").option("--fields <fields>", "resource: fields, e.g. 'name:string, email:string!, status:enum(lead,customer)' (single quotes: bash treats ! in double quotes as history)").option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing: write files without installing the stripe dependency").option("--skip-migration", "billing/security: skip generating the schema migration").example("flare gen resource Contact --fields 'name:string, email:string!, company:belongsTo(Company)?'").example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").action(
@@ -3820,6 +4464,9 @@ function createCli() {
   cli.command("seed [...names]", "Run seed files from seeds/ against the local D1 database").example("flare seed            # every seed, in file-name order").example("flare seed contacts   # just seeds/contacts.seed.ts").action(async (names) => {
     await runSeeds({ names });
   });
+  cli.command("seed:resource <resource> [count]", "Fill a resource's table with sample rows built from its descriptor").option("--count <rows>", "How many rows: 1000, 25k, 1m (default: 25)").option("--remote", "Seed the deployed database instead of the local one (needs --yes)").option("--truncate", "Delete the table's rows first").option("--seed <number>", "Same number, same rows").option("--env <name>", "Wrangler environment").option("--database <binding>", "D1 binding, when the app has several").option("-y, --yes", "Confirm writing to the remote database").example("flare seed:resource Contact --count 1000").example("flare seed:resource Contact 1m            # a million rows").example("flare seed:resource Contact 5k --remote --yes").action(async (resource, count, options2) => {
+    await seedResourceCommand(resource, { ...options2, count: options2.count ?? count });
+  });
   cli.command("seed:make <name>", "Create seeds/<name>.seed.ts (with example rows for a matching resource)").option("--resource <name>", "Resource to write example rows for").action(async (name, options2) => {
     await makeSeed(name, options2);
   });
@@ -3829,6 +4476,7 @@ function createCli() {
   cli.command("sync-types", "Regenerate schema, routes, clients, and validators from resource descriptors; report drift").option("--check", "Change nothing; exit 1 if anything is out of sync (CI)").option("--force", "Overwrite generated blocks that were edited by hand").action(async (options2) => {
     process.exitCode = await syncTypes(options2);
   });
+  cli.command("theme [name]", "List the themes, or switch the app to one: default, coral, amber, sky, mono, emerald").example("flare theme").example("flare theme mono").action((name) => setTheme(name));
   cli.command("tunnel [target]", "Share a local server on a public https://*.trycloudflare.com URL (Cloudflare Quick Tunnel; no account needed)").example("flare tunnel          # http://localhost:3000").example("flare tunnel 8787").example("flare tunnel http://localhost:5173").action(async (target) => {
     const local = toLocalUrl(target);
     const tunnel = await openTunnel(local);
@@ -3845,7 +4493,7 @@ function createCli() {
     cli.command(`${name} [...args]`, spec.description).allowUnknownOptions();
   }
   cli.help();
-  cli.version(FLARE_VERSION2);
+  cli.version(FLARE_VERSION3);
   return cli;
 }
 
@@ -3864,6 +4512,6 @@ try {
     }
   }
 } catch (error) {
-  console.error(pc18.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
+  console.error(pc21.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
   process.exitCode = 1;
 }