@flaredev/cli 0.10.0 → 0.11.0

package/dist/index.js

@@ -141,12 +141,12 @@ function parseTheme(value) {
 // src/versions.ts
 var COMPATIBILITY_DATE = "2026-09-15";
 var APP_DEPENDENCIES = {
-  "@better-auth/drizzle-adapter": "1.7.7",
-  "@better-auth/passkey": "1.7.7",
+  "@better-auth/drizzle-adapter": "1.7.14",
+  "@better-auth/passkey": "1.7.14",
   // Server components import Slot from here rather than the "radix-ui" umbrella (see components/ui/button.tsx).
   "@radix-ui/react-slot": "1.3.3",
   "@vinext/cloudflare": "1.0.0-beta.8",
-  "better-auth": "1.7.7",
+  "better-auth": "1.7.14",
   // Admin UI (shadcn/ui primitives in components/ui).
   "class-variance-authority": "^0.7.1",
   clsx: "^2.1.1",
@@ -172,7 +172,7 @@ var APP_DEPENDENCIES = {
   "react-server-dom-webpack": "19.3.0",
   vinext: "1.0.0-beta.10"
 };
-var BETTER_AUTH_VERSION = "1.7.7";
+var BETTER_AUTH_VERSION = "1.7.14";
 var API_KEY_PACKAGE = "@better-auth/api-key";
 var APP_DEV_DEPENDENCIES = {
   "@cloudflare/vite-plugin": "^1.54.10",
@@ -198,7 +198,7 @@ var NEXT_DEPENDENCIES = {
   "@prisma/adapter-pg": "7.10.0",
   pg: "^8.16.3",
   "@upstash/redis": "^1.36.0",
-  "@better-auth/prisma-adapter": "1.7.7",
+  "@better-auth/prisma-adapter": "1.7.14",
   // Signs S3 requests in a few kilobytes, where the AWS SDK is megabytes.
   aws4fetch: "^1.0.20",
   dotenv: "^17.2.3"
@@ -233,7 +233,7 @@ var CLOUDFLARE_ONLY = [
 // src/stack.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
-var STACKS = ["cloudflare", "next"];
+var STACKS = ["next", "cloudflare"];
 var isStack = (value) => STACKS.includes(value);
 var STACK_LABELS = {
   cloudflare: "Cloudflare Workers, D1 and Drizzle \u2014 cheapest to run, deploys everywhere",
@@ -357,7 +357,7 @@ function createApp(target, options2 = {}) {
   if (options2.stack !== void 0 && !isStack(options2.stack)) {
     throw new Error(`Unknown stack "${options2.stack}". Use ${STACKS.join(" or ")}.`);
   }
-  const stack = options2.stack ?? "cloudflare";
+  const stack = options2.stack ?? "next";
   const authProviders = parseAuthProviders(options2.authProviders);
   const authMethods = parseAuthMethods(options2.auth);
   const theme = parseTheme(options2.theme);
@@ -376,9 +376,8 @@ function createApp(target, options2 = {}) {
   writeFileSync3(join4(dir, "lib", "auth-config.ts"), renderAuthConfig(authMethods, authProviders));
   appendFileSync(join4(dir, stack === "next" ? ".env.example" : ".dev.vars.example"), devVarsExampleEntries(authProviders));
   const shared = { react: APP_DEPENDENCIES.react, "react-dom": APP_DEPENDENCIES["react-dom"] };
-  const uiOnly = Object.fromEntries(
-    Object.entries(APP_DEPENDENCIES).filter(([key]) => !["vinext", "@vinext/cloudflare", "drizzle-orm", "react-server-dom-webpack"].includes(key))
-  );
+  const cloudflareOnlyPackages = ["vinext", "@vinext/cloudflare", "drizzle-orm", "react-server-dom-webpack", "@better-auth/drizzle-adapter"];
+  const uiOnly = Object.fromEntries(Object.entries(APP_DEPENDENCIES).filter(([key]) => !cloudflareOnlyPackages.includes(key)));
   writeJson(join4(dir, "package.json"), {
     name,
     version: "0.1.0",
@@ -417,7 +416,8 @@ function createApp(target, options2 = {}) {
     `BETTER_AUTH_SECRET=${randomBytes(32).toString("base64")}
 RESEND_API_KEY=
 MAIL_FROM=
-${devVarsEntries(authProviders)}`
+${devVarsEntries(authProviders)}` + (stack === "next" ? `
+${LOCAL_SERVICES}` : "")
   );
   if (packageManager === "pnpm" && !inWorkspace) {
     writeFileSync3(join4(dir, "pnpm-workspace.yaml"), `allowBuilds:
@@ -425,16 +425,28 @@ ${ALLOW_BUILDS}
 `);
   }
   const pinned = flarePackageSpec("core", dir, packageManager).startsWith("^");
-  if (pinned) copyLockfile(packageManager, dir);
+  if (pinned) copyLockfile(packageManager, dir, stack);
   const log2 = options2.log ?? ((message) => console.log(message));
   log2(`${pc.green("\u2714")} Wrote ${files} files to ${relative(process.cwd(), dir) || "."}`);
   if (prefersPnpm) log2(pc.dim(`Installing with pnpm \u2014 far quicker for an app this size. Use ${pc.bold("--pm npm")} to change that.`));
   return { dir, name, packageManager, inWorkspace };
 }
-function copyLockfile(packageManager, dir) {
+var LOCAL_SERVICES = [
+  "# Local services (docker-compose.yml). Swap these for Neon, R2 and Upstash to deploy.",
+  "DATABASE_URL=postgresql://flare:flare@127.0.0.1:5432/app",
+  "BETTER_AUTH_URL=http://localhost:3000",
+  "R2_ENDPOINT=http://127.0.0.1:9000",
+  "R2_BUCKET=app-uploads",
+  "R2_ACCESS_KEY_ID=flare",
+  "R2_SECRET_ACCESS_KEY=flare-secret-123",
+  "UPSTASH_REDIS_REST_URL=http://127.0.0.1:8079",
+  "UPSTASH_REDIS_REST_TOKEN=flare-local-token",
+  ""
+].join("\n");
+function copyLockfile(packageManager, dir, stack) {
   const file = packageManager === "pnpm" ? "pnpm-lock.yaml" : packageManager === "yarn" ? "yarn.lock" : "package-lock.json";
   if (!file) return false;
-  const source = join4(templatesDir, "locks", file);
+  const source = join4(templatesDir, "locks", stack, file);
   if (!existsSync4(source)) return false;
   copyFileSync(source, join4(dir, file));
   return true;
@@ -1692,11 +1704,37 @@ function list(raw, what, spec) {
   return items;
 }
 var RESOURCE_NAME = /^[A-Z][A-Za-z0-9]*$/;
+var CONDITION = /^(.*?)\s+if\s+(.+)$/s;
+var COMPARISON = /^([A-Za-z][A-Za-z0-9_]*)\s*(==|!=|\bin\b)\s*(.+)$/;
+function parseCondition(clause, spec) {
+  const match = COMPARISON.exec(clause.trim());
+  if (!match) {
+    throw new FieldGrammarError(`"${spec}": "${clause.trim()}" isn't a condition. Write it like "if kind == recurring".`);
+  }
+  const [, dependsOn, operator, rawValue] = match;
+  const op = operator === "==" ? "eq" : operator === "!=" ? "ne" : "in";
+  const text = rawValue.trim();
+  if (op === "in") {
+    const inner = /^\((.*)\)$/.exec(text);
+    if (!inner) throw new FieldGrammarError(`"${spec}": "in" takes a list in brackets, e.g. "if kind in (recurring, retainer)".`);
+    return { field: dependsOn, op, value: list(inner[1], "condition value", spec) };
+  }
+  if (!text || /\s/.test(text)) {
+    throw new FieldGrammarError(`"${spec}": "${text}" isn't a single value. Write it like "if kind == recurring".`);
+  }
+  return { field: dependsOn, op, value: text };
+}
 function parseField(spec) {
   const colon = spec.indexOf(":");
   if (colon <= 0) throw new FieldGrammarError(`"${spec}": expected name:type, e.g. "title:string".`);
   const rawName = spec.slice(0, colon).trim();
   let type = spec.slice(colon + 1).trim();
+  let showWhen;
+  const conditioned = CONDITION.exec(type);
+  if (conditioned) {
+    type = conditioned[1].trim();
+    showWhen = parseCondition(conditioned[2], spec);
+  }
   let required = true;
   let unique = false;
   while (/[?!]$/.test(type)) {
@@ -1709,6 +1747,7 @@ function parseField(spec) {
   }
   let key = camelCase(rawName);
   const field = { key, kind: "string", required, unique };
+  if (showWhen) field.showWhen = showWhen;
   let match;
   if (SIMPLE_KINDS.includes(type)) {
     field.kind = type;
@@ -1786,6 +1825,40 @@ function parseFields(input) {
     if (seen.has(field.key)) throw new FieldGrammarError(`Field "${field.key}" is declared more than once.`);
     seen.add(field.key);
   }
+  const byKey = new Map(fields.map((field) => [field.key, field]));
+  for (const field of fields) {
+    const condition = field.showWhen;
+    if (!condition) continue;
+    if (condition.field === field.key) {
+      throw new FieldGrammarError(`Field "${field.key}" cannot depend on itself.`);
+    }
+    const target = byKey.get(condition.field);
+    if (!target) {
+      const names = fields.map((other) => other.key).filter((name) => name !== field.key);
+      throw new FieldGrammarError(
+        `Field "${field.key}" depends on "${condition.field}", which isn't a field here.${suggest(condition.field, names)} Fields: ${names.join(", ")}.`
+      );
+    }
+    if (target.showWhen) {
+      throw new FieldGrammarError(`Field "${field.key}" depends on "${target.key}", which is itself conditional. Conditions only go one level deep.`);
+    }
+    const values = Array.isArray(condition.value) ? condition.value : [condition.value];
+    if (target.options) {
+      for (const value of values) {
+        if (!target.options.includes(value)) {
+          throw new FieldGrammarError(
+            `Field "${field.key}" is shown when ${condition.field} is "${value}", which isn't one of its options.${suggest(value, target.options)} Options: ${target.options.join(", ")}.`
+          );
+        }
+      }
+    } else if (target.kind === "boolean") {
+      for (const value of values) {
+        if (value !== "true" && value !== "false") {
+          throw new FieldGrammarError(`Field "${field.key}" depends on the boolean "${condition.field}", so compare it with true or false, not "${value}".`);
+        }
+      }
+    }
+  }
   return fields;
 }
 
@@ -1807,6 +1880,7 @@ function options(field) {
   if (field.widget) opts.widget = field.widget;
   if (field.kind === "belongsTo" && !field.required) opts.onDelete = "set null";
   if (field.maxBytes !== void 0) opts.maxBytes = field.maxBytes;
+  if (field.showWhen) opts.showWhen = field.showWhen;
   return opts;
 }
 function toField(field) {
@@ -1830,7 +1904,13 @@ function toField(field) {
       return builders[field.kind](opts);
   }
 }
-var literal = (value) => JSON.stringify(value);
+var literal = (value) => {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const entries = Object.entries(value);
+    return `{ ${entries.map(([key, inner]) => `${/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key)}: ${literal(inner)}`).join(", ")} }`;
+  }
+  return JSON.stringify(value);
+};
 function renderOptions(opts) {
   const entries = Object.entries(opts);
   return entries.length ? `{ ${entries.map(([k, v]) => `${k}: ${literal(v)}`).join(", ")} }` : "";
@@ -2731,7 +2811,7 @@ function renderPrismaModel(entry, all) {
     if (def.kind === "belongsTo") {
       const target = byName.get(def.target);
       if (!target) throw new Error(`${resource.name}.${key} belongs to "${def.target}", but there is no ${def.target} resource. Generate it first.`);
-      const optional2 = def.required ? "" : "?";
+      const optional2 = def.required && !def.showWhen ? "" : "?";
       const relationField = key.replace(/Id$/, "");
       const named = backReferences(target, all).find((back) => back.from === resource.name && back.relationName?.endsWith(`_${key}`));
       const relationArgs = [
@@ -2745,7 +2825,7 @@ function renderPrismaModel(entry, all) {
       indexes.push(`  @@index([${key}])`);
       continue;
     }
-    const optional = def.required || def.kind === "multiselect" || def.kind === "tags" ? "" : "?";
+    const optional = def.required && !def.showWhen || def.kind === "multiselect" || def.kind === "tags" ? "" : "?";
     lines.push(`  ${key} ${prismaType(resource, key, def)}${optional} ${attributes(key, def).join(" ")}`.trimEnd());
   }
   for (const back of backReferences(resource, all)) {
@@ -2820,7 +2900,7 @@ function columnExpression(key, def, resources, selfName) {
     default:
       expr = `text(${col})`;
   }
-  if (def.required) expr += ".notNull()";
+  if (def.required && !def.showWhen) expr += ".notNull()";
   if ("unique" in def && def.unique) expr += ".unique()";
   if ("default" in def && def.default !== void 0) expr += `.default(${q2(def.default)})`;
   return expr;
@@ -4137,7 +4217,7 @@ async function askCreateQuestions(given, appName) {
     answers.stack = stopIfCancelled(
       await prompts2.select({
         message: "Where will it run?",
-        initialValue: "cloudflare",
+        initialValue: "next",
         options: STACKS.map((value) => ({ value, label: value === "next" ? "Next.js" : "Cloudflare", hint: STACK_LABELS[value] }))
       })
     );
@@ -4231,13 +4311,22 @@ async function genResource(rawName, options2) {
       }
     }
   }
+  const policyRelative = policyPath(name);
+  const policyAbsolute = join17(appRoot, policyRelative);
+  const wrotePolicy = !exists && !existsSync18(policyAbsolute);
+  if (wrotePolicy) {
+    mkdirSync8(dirname9(policyAbsolute), { recursive: true });
+    writeFileSync11(policyAbsolute, renderPolicy(name, { read: ["admin"], create: ["admin"], update: ["admin"], delete: ["admin"] }));
+    log2(`${pc11.green("create".padEnd(9))} ${policyRelative}`);
+  }
   let written;
   let table;
   try {
     const all = await loadResources(appRoot);
     table = all.find(({ resource }) => resource.name === name).resource.table;
     ensureSupportFiles(appRoot, log2);
-    written = applyPlan(appRoot, planFiles(all, void 0, readStack(appRoot)), { force: options2.force });
+    const policies = wrotePolicy ? await loadPolicies(appRoot) : void 0;
+    written = applyPlan(appRoot, planFiles(all, policies, readStack(appRoot)), { force: options2.force });
     logResults(written, log2);
   } catch (error) {
     const hint = exists ? "" : `
@@ -4265,7 +4354,8 @@ Next: ${pc11.bold("flare migrate")} to apply it locally.`);
     }
   }
   const descriptor = { path: relativePath, status: exists ? "outdated" : "missing", outcome: exists ? "update" : "create" };
-  return { name, mode: exists ? "update" : "create", written: [descriptor, ...written], migrations };
+  const policy = wrotePolicy ? [{ path: policyRelative, status: "missing", outcome: "create" }] : [];
+  return { name, mode: exists ? "update" : "create", written: [descriptor, ...policy, ...written], migrations };
 }
 
 // src/commands/gen-endpoint.ts
@@ -5421,6 +5511,13 @@ Run it with ${pc19.bold(`flare seed ${name}`)}.`);
   return relative3;
 }
 async function runPrismaSeeds(appRoot, files, log2) {
+  if (!existsSync25(join25(appRoot, "lib", "generated", "prisma"))) {
+    log2(pc19.dim("Generating the Prisma client first (migrate dev no longer does)\u2026"));
+    const prisma = resolveBin(appRoot, "prisma", "prisma");
+    if (await runNode([prisma, "generate"], appRoot) !== 0) {
+      throw new Error("`prisma generate` failed, so there is no client for the seeds to use.");
+    }
+  }
   const runner = join25(appRoot, ".flare-seed-runner.mts");
   const script = [
     `import "dotenv/config";`,
@@ -6228,7 +6325,7 @@ function createCli() {
   const stack = currentStack();
   const perStack = (cloudflare, next, either) => stack === "next" ? next : stack === "cloudflare" ? cloudflare : either;
   const cloudflareOnly = (text) => stack === void 0 ? `${text} (Cloudflare only)` : text;
-  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--stack <name>", "Where it runs: cloudflare (default) or next").option("--theme <name>", "Look of the app: default, coral, amber, sky, mono or emerald").option("--auth <list>", "Sign-in methods: magic-link, email-otp, passkeys, 2fa-app, 2fa-email, all or none (default: all)").option("--auth-providers <list>", "Social sign-in, comma-separated: google, github, apple, microsoft").option("-y, --yes", "Don't ask: use the flags given and the defaults for the rest").option("--skip-install", "Write files without installing dependencies").example("flare create shop").example("flare create shop --stack next").example("flare create shop --theme mono --auth passkeys,2fa-app --auth-providers google,github --yes").action(
+  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--stack <name>", "Where it runs: next (default) or cloudflare").option("--theme <name>", "Look of the app: default, coral, amber, sky, mono or emerald").option("--auth <list>", "Sign-in methods: magic-link, email-otp, passkeys, 2fa-app, 2fa-email, all or none (default: all)").option("--auth-providers <list>", "Social sign-in, comma-separated: google, github, apple, microsoft").option("-y, --yes", "Don't ask: use the flags given and the defaults for the rest").option("--skip-install", "Write files without installing dependencies").example("flare create shop").example("flare create shop --stack next").example("flare create shop --theme mono --auth passkeys,2fa-app --auth-providers google,github --yes").action(
     async (dir, options2) => {
       const wanted = !options2.skipInstall;
       let answers = { stack: options2.stack, theme: options2.theme, auth: options2.auth, authProviders: options2.authProviders };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaredev/cli",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "The flare command-line tool: create, generate, migrate, and deploy Flare apps",
   "license": "MIT",
   "author": "Muke Johnbaptist",
@@ -41,7 +41,7 @@
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
-    "@flaredev/core": "0.10.0"
+    "@flaredev/core": "0.11.0"
   },
   "engines": {
     "node": ">=22"

package/templates/app/components/dashboard/resource-form.tsx

@@ -3,7 +3,7 @@
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useMemo, useState, useTransition, type FormEvent, type MouseEvent } from "react";
-import { createValidators, formValuesToInput, initialFormValues, issuesByField, storedFields, type ClientResource, type StoredField } from "@flaredev/core";
+import { conditionHolds, createValidators, formValuesToInput, initialFormValues, issuesByField, storedFields, type ClientResource, type StoredField } from "@flaredev/core";
 import { toast } from "sonner";
 import { createRecordAction, updateRecordAction } from "@/app/dashboard/actions";
 import { Alert, AlertDescription } from "@/components/ui/alert";
@@ -69,10 +69,21 @@ export function ResourceForm({ resource, mode, id, record, relations = {}, listH
   const router = useRouter();
   const validators = useMemo(() => createValidators(resource), [resource]);
   const hidden = useMemo(() => new Set(omit ?? []), [omit]);
-  const fields = useMemo(() => storedFields(resource).filter(([key]) => !hidden.has(key)), [resource, hidden]);
-  const steps = useMemo(() => toSteps(fields), [fields]);
   const [step, setStep] = useState(0);
   const [values, setValues] = useState(() => initialFormValues(resource, record));
+  /**
+   * The fields on show. A conditional field appears only while its condition holds, so
+   * this is recomputed as the form is filled in: choose "recurring" and the billing cycle
+   * appears, choose "one-off" and it goes away again.
+   *
+   * The same condition decides what the server requires, so a field that is not on show
+   * is never one the save is about to fail on.
+   */
+  const fields = useMemo(
+    () => storedFields(resource).filter(([key, def]) => !hidden.has(key) && conditionHolds(def.showWhen, values)),
+    [resource, hidden, values],
+  );
+  const steps = useMemo(() => toSteps(fields), [fields]);
   const [errors, setErrors] = useState<Record<string, string>>({});
   const [pending, startTransition] = useTransition();
 

package/templates/app/lib/auth.ts

@@ -9,6 +9,7 @@ import { emailOTP } from "better-auth/plugins/email-otp";
 import { magicLink } from "better-auth/plugins/magic-link";
 import { twoFactor } from "better-auth/plugins/two-factor";
 import { hashPassword, verifyPassword } from "@flaredev/core";
+import { eq } from "drizzle-orm";
 import { getDb, schema } from "@/db";
 import { authConfig, type SocialProvider } from "./auth-config";
 import { checkPassword, isBreachedPassword, PASSWORD_MAX_LENGTH } from "./password-rules";
@@ -107,6 +108,45 @@ async function guardPassword(path: string, body: Record<string, unknown> | undef
   }
 }
 
+/**
+ * The first account to exist becomes the admin.
+ *
+ * Generated resources are admin-only, so without this a fresh app has a database, an API
+ * and a dashboard that nobody can reach — and the usual fix for that is to open
+ * everything up, which is how an admin panel ends up on the internet. The person running
+ * sign-up on an empty database is the person setting the app up.
+ *
+ * Done here rather than in `databaseHooks.user.create`, because the admin plugin already
+ * registers one of those (`{ role: defaultRole, ...user }`) and Better Auth does not merge
+ * the two — a second one is silently never called. This runs after the row exists and
+ * states the rule in SQL, which no plugin can quietly win.
+ *
+ * Everyone after them keeps the plugin's default role, and no role reaches an admin-only
+ * resource until you grant one with `flare user:role them@example.com admin`.
+ *
+ * Two people signing up in the same instant would both see two rows and neither would be
+ * promoted, leaving an app with no admin. It needs a brand-new app and millisecond timing,
+ * and `flare user:role you@example.com admin` fixes it, so this stays the simple rule
+ * rather than a transaction nobody can read.
+ */
+let adminSettled = false;
+
+async function promoteFirstUser() {
+  if (adminSettled) return;
+  const db = getDb();
+  // Two rows is all it takes to answer "is there exactly one?".
+  const rows = await db.select({ id: schema.user.id, role: schema.user.role }).from(schema.user).limit(2);
+  if (rows.length !== 1) {
+    // Nobody yet: the next sign-up asks again. More than one: the question is settled.
+    adminSettled = rows.length > 1;
+    return;
+  }
+  if (rows[0]!.role !== "admin") {
+    await db.update(schema.user).set({ role: "admin" }).where(eq(schema.user.id, rows[0]!.id));
+  }
+  adminSettled = true;
+}
+
 export const auth = betterAuth({
   appName: "__APP_NAME__",
   secret: env.BETTER_AUTH_SECRET,
@@ -148,6 +188,11 @@ export const auth = betterAuth({
       if (disabledPath(ctx.path)) throw new APIError("NOT_FOUND", { message: "This sign-in method isn't enabled." });
       await guardPassword(ctx.path, ctx.body as Record<string, unknown> | undefined);
     }),
+    // Any route can be the one that creates the first user — a password sign-up, a magic
+    // link, a social callback — so this asks after all of them rather than guessing which.
+    after: createAuthMiddleware(async () => {
+      await promoteFirstUser();
+    }),
   },
   plugins: [
     // Adds user.role (default "user") and admin APIs. The /admin area allows ADMIN_ROLES (lib/admin.ts).

package/templates/app/lib/resource/drizzle-rows.ts

@@ -108,9 +108,14 @@ export function drizzleRows(table: SQLiteTable, getDb: () => AnyDatabase): Resou
       return (record as Row | undefined) ?? null;
     },
 
-    async titles(ids, titleField) {
+    async titles(ids, titleField, owner) {
       const titleColumn = columns[titleField] ?? idColumn;
-      const rows = await getDb().select({ id: idColumn, title: titleColumn }).from(table).where(inArray(idColumn, ids));
+      const ownerColumn = owner ? columns[owner.field] : undefined;
+      // An owner naming a column this table does not have would widen the query rather
+      // than narrow it, so it answers nothing instead.
+      if (owner && !ownerColumn) return [];
+      const where = ownerColumn ? and(inArray(idColumn, ids), eq(ownerColumn, owner!.value)) : inArray(idColumn, ids);
+      const rows = await getDb().select({ id: idColumn, title: titleColumn }).from(table).where(where);
       return rows as { id: string; title: unknown }[];
     },
 

package/templates/app/lib/resource/rows.ts

@@ -78,7 +78,11 @@ export interface ResourceRows {
   /** How many rows match, giving up at `limit` so a huge table is never fully counted. */
   countUpTo(query: Pick<RowsQuery, "search" | "filters" | "deleted">, limit: number): Promise<number>;
   byId(id: string): Promise<Row | null>;
-  titles(ids: string[], titleField: string): Promise<{ id: string; title: unknown }[]>;
+  /**
+   * Title values for a set of ids. `owner`, when given, restricts the rows considered —
+   * a relation picker shown to a confined user must not name records they cannot see.
+   */
+  titles(ids: string[], titleField: string, owner?: { field: string; value: string }): Promise<{ id: string; title: unknown }[]>;
   insert(values: Row): Promise<Row>;
   /** The saved row, or null when there was nothing with that id. */
   update(id: string, values: Row): Promise<Row | null>;

package/templates/app/lib/resource/store.ts

@@ -8,7 +8,7 @@
 // `flare diff` shows how your copy differs from the version Flare ships, and
 // `flare update` applies the parts you choose. Neither runs unless you ask.
 
-import { columnName, fromMinorUnits, ownershipFilter, storedFields, toMinorUnits, type Policy, type Resource } from "@flaredev/core";
+import { columnName, conditionHolds, fromMinorUnits, ownershipFilter, storedFields, toMinorUnits, type Policy, type Resource } from "@flaredev/core";
 import { createValidators } from "@flaredev/core";
 import { encodeCursor, isSearchable, parseListQuery, type QueryIssue } from "./query";
 import type { ResourceRows, Row } from "./rows";
@@ -212,6 +212,34 @@ export function createResourceStore(options: ResourceStoreOptions) {
     (def.kind === "int" || def.kind === "float") && def.format === "money" ? [{ key, currency: def.currency }] : [],
   );
 
+  /**
+   * Fields that only apply when another field says so, e.g. a billing cycle that exists
+   * on a recurring project and not on a one-off one.
+   *
+   * The validator decides whether one is *required*; this decides whether it is *kept*.
+   * Without it, changing a project from recurring to one-off leaves last month's billing
+   * cycle sitting in the row — the form stopped showing the input, so nothing ever sent a
+   * value to overwrite it, and the record quietly disagrees with itself.
+   */
+  const conditionalFields = fields.flatMap(([key, def]) => (def.showWhen ? [{ key, condition: def.showWhen }] : []));
+
+  /**
+   * Null the fields that no longer apply.
+   *
+   * `record` is what the condition is judged against: the whole record as it will be once
+   * this write lands, which on a PATCH means the stored row with the patch laid over it.
+   * Judging the patch alone would read a field it never mentioned as absent and clear a
+   * value that was meant to stay.
+   */
+  function clearInapplicable(values: Row, record: Row): Row {
+    if (conditionalFields.length === 0) return values;
+    const out = { ...values };
+    for (const { key, condition } of conditionalFields) {
+      if (!conditionHolds(condition, record)) out[key] = null;
+    }
+    return out;
+  }
+
   /** Amounts as the database stores them: 19.99 -> 1999. */
   function toStored(values: Row): Row {
     if (moneyFields.length === 0) return values;
@@ -405,16 +433,19 @@ export function createResourceStore(options: ResourceStoreOptions) {
     /**
      * Title-field values for a set of ids (for showing relations). Missing ids are omitted.
      *
-     * Not confined by ownership, and `rows.titles` has no way to be: it returns an id and
-     * a title, not the owner. It is called with ids this resource's rows already point at,
-     * so in practice it shows the names of records you can already see — but if you hand a
-     * confined user a relation picker over a confined resource, the titles are not the
-     * place that restriction is enforced. Filter the ids before calling it.
+     * Confined by ownership, like every other read: a relation picker shown to a user who
+     * only sees their own rows must not name anybody else's. An id they may not see is
+     * simply absent from the result, which the caller already handles — missing ids are
+     * omitted either way, so a title they are not entitled to looks the same as one that
+     * was deleted.
      */
     async titles(ids: string[]): Promise<Record<string, string>> {
       const unique = [...new Set(ids.filter(Boolean))];
       if (unique.length === 0) return {};
-      const found = await rows.titles(unique, resource.titleField);
+      const limit = await confine();
+      // Not signed in where sign-in is required: no titles rather than everyone's.
+      if (isFailure(limit)) return {};
+      const found = await rows.titles(unique, resource.titleField, limit ?? undefined);
       return Object.fromEntries(found.map((row) => [row.id, row.title == null ? row.id : String(row.title)]));
     },
 
@@ -436,7 +467,8 @@ export function createResourceStore(options: ResourceStoreOptions) {
         if (!result.success) return invalid(result.error.issues);
         const input = result.data as Record<string, unknown>;
         const now = new Date();
-        const record = await rows.insert(toStored({ ...input, id: crypto.randomUUID(), createdAt: now, updatedAt: now }));
+        const fresh = { ...input, id: crypto.randomUUID(), createdAt: now, updatedAt: now };
+        const record = await rows.insert(toStored(clearInapplicable(fresh, fresh)));
         const saved = withComputed(record);
         await hooks.afterCreate?.(saved, context);
         return { ok: true, data: saved };
@@ -452,7 +484,10 @@ export function createResourceStore(options: ResourceStoreOptions) {
 
         // A confined update has to read the row first: `rows.update(id, …)` takes an id
         // and nothing else, so this is where "is it yours" is answered.
-        const current = limit || hooks.beforeUpdate || hooks.afterUpdate ? await rows.byId(id) : null;
+        // Conditional fields join this list: deciding whether one still applies needs the
+        // whole record, and a PATCH on its own may not mention the field it depends on.
+        const needsCurrent = limit || hooks.beforeUpdate || hooks.afterUpdate || conditionalFields.length > 0;
+        const current = needsCurrent ? await rows.byId(id) : null;
         if (limit) {
           if (!current) return notFound();
           if (!owns(current, limit)) return notFound();
@@ -476,7 +511,8 @@ export function createResourceStore(options: ResourceStoreOptions) {
         const result = validators.update.safeParse(supplied);
         if (!result.success) return invalid(result.error.issues);
         const input = result.data as Record<string, unknown>;
-        const record = await rows.update(id, toStored({ ...input, updatedAt: new Date() }));
+        const merged = { ...((current ?? {}) as Row), ...input };
+        const record = await rows.update(id, toStored(clearInapplicable({ ...input, updatedAt: new Date() }, merged)));
         if (!record) return notFound();
         const saved = withComputed(record);
         await hooks.afterUpdate?.(saved, { ...context, previous: current });
@@ -505,7 +541,7 @@ export function createResourceStore(options: ResourceStoreOptions) {
         // one of them, and a replace would quietly orphan the row it just saved.
         if (limit) values[limit.field] = limit.value;
 
-        const record = await rows.update(id, toStored(values));
+        const record = await rows.update(id, toStored(clearInapplicable(values, values)));
         return record ? { ok: true, data: withComputed(record) } : notFound();
       });
     },