@flaredev/cli 0.10.0 → 0.12.0

package/templates/app/lib/invitations.ts

@@ -0,0 +1,142 @@
+// This file is yours.
+//
+// Flare copies the code that turns a resource descriptor into a working endpoint into
+// your app rather than hiding it in node_modules, for the same reason shadcn/ui copies
+// a component: you cannot fix, read or reason about what you cannot see.
+//
+// `flare diff` shows how your copy differs from the version Flare ships, and
+// `flare update` applies the parts you choose. Neither runs unless you ask.
+
+/**
+ * Invitations, for an app whose sign-up is `invite` (see lib/auth-config.ts).
+ *
+ * **They live in the `verification` table**, which Better Auth already has and already
+ * uses for exactly this shape of thing: a single-use token with an expiry. Reusing it
+ * means invitations need no table of their own and so no migration — an app switching to
+ * `invite` changes one line in auth-config.ts and nothing else.
+ *
+ * Rows are keyed `invite:<hash>`. Only the hash is stored, never the token itself, for the
+ * same reason a password is not: a leaked database should not be a pile of working
+ * invitations.
+ *
+ * The flow:
+ *
+ *   1. An admin creates one. `createInvitation` returns the token once — it is not
+ *      recoverable afterwards, which is why the link is shown on screen to copy.
+ *   2. The invited person opens the link. `/invite/[token]` puts the token in a
+ *      short-lived cookie and sends them to the sign-up page.
+ *   3. They sign up. `lib/auth.ts` reads the cookie, checks the invitation, and lets the
+ *      account be created — then spends it, so the link cannot be used twice.
+ */
+import { and, eq, like, lt } from "drizzle-orm";
+import { getDb } from "@/db";
+import { verification } from "@/db/auth-schema";
+
+/** How long an invitation is good for, unless you say otherwise. */
+export const DEFAULT_INVITE_DAYS = 7;
+
+/** The cookie an opened invitation link leaves behind, for the sign-up that follows. */
+export const INVITE_COOKIE = "flare_invite";
+
+/** How long that cookie lives: long enough to fill in a form, not long enough to forget. */
+export const INVITE_COOKIE_MAX_AGE = 60 * 60;
+
+const KEY_PREFIX = "invite:";
+
+/**
+ * WebCrypto rather than node:crypto, so the same file runs on Workers and on Node
+ * without a compatibility flag deciding whether it does.
+ */
+const randomToken = () => {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+
+/** Only the hash is stored, so a copy of the table is not a pile of working invitations. */
+async function hash(token: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+const key = async (token: string) => `${KEY_PREFIX}${await hash(token)}`;
+
+/** What an invitation is for: one address, or anybody who has the link. */
+export type InviteFor = { email: string } | { anyone: true };
+
+/** An invitation. The token is returned once and never stored. */
+export interface CreatedInvitation {
+  token: string;
+  expiresAt: Date;
+  /** Who it is for, or null when anybody with the link may use it. */
+  email: string | null;
+}
+
+/** Create one. The returned token is the only copy. */
+export async function createInvitation(options: { for: InviteFor; days?: number }): Promise<CreatedInvitation> {
+  const token = randomToken();
+  const email = "email" in options.for ? options.for.email.trim().toLowerCase() : null;
+  const expiresAt = new Date(Date.now() + (options.days ?? DEFAULT_INVITE_DAYS) * 86_400_000);
+  await getDb()
+    .insert(verification)
+    .values({
+      id: crypto.randomUUID(),
+      identifier: await key(token),
+      // `*` rather than an empty string, so "for anybody" is a value and not a mistake.
+      value: email ?? "*",
+      expiresAt,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+  return { token, expiresAt, email };
+}
+
+/** The link to send somebody, given the app's own origin. */
+export const invitationLink = (baseUrl: string, token: string) => `${baseUrl.replace(/\/$/, "")}/invite/${token}`;
+
+/**
+ * Whether this token is a live invitation for this email address.
+ *
+ * Checked, not spent: the account does not exist yet when this is asked, and an
+ * invitation should survive a sign-up that fails validation.
+ */
+export async function invitationAllows(token: string | undefined, email: string): Promise<boolean> {
+  if (!token) return false;
+  const rows = await getDb().select().from(verification).where(eq(verification.identifier, await key(token))).limit(1);
+  const row = rows[0];
+  if (!row) return false;
+  if (row.expiresAt.getTime() <= Date.now()) return false;
+  // An invitation addressed to somebody is for them alone; `*` is for whoever has the link.
+  return row.value === "*" || row.value === email.trim().toLowerCase();
+}
+
+/** Spend it, so the link cannot be used again. Called once the account exists. */
+export async function spendInvitation(token: string | undefined): Promise<void> {
+  if (!token) return;
+  await getDb().delete(verification).where(eq(verification.identifier, await key(token)));
+}
+
+/** Invitations an admin can see: live ones, newest first. Never the tokens. */
+export async function listInvitations(): Promise<{ id: string; email: string | null; expiresAt: Date; createdAt: Date }[]> {
+  const rows = await getDb().select().from(verification).where(like(verification.identifier, `${KEY_PREFIX}%`));
+  return rows
+    .filter((row) => row.expiresAt.getTime() > Date.now())
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())
+    .map((row) => ({ id: row.id, email: row.value === "*" ? null : row.value, expiresAt: row.expiresAt, createdAt: row.createdAt }));
+}
+
+/** Revoke one by its row id, so a link sent to the wrong address stops working. */
+export async function revokeInvitation(id: string): Promise<void> {
+  await getDb().delete(verification).where(eq(verification.id, id));
+}
+
+/**
+ * Drop invitations that have expired.
+ *
+ * Only rows under the `invite:` prefix — the rest of this table is Better Auth's, and
+ * deleting its tokens would sign people out and break magic links.
+ */
+export async function pruneInvitations(): Promise<void> {
+  await getDb()
+    .delete(verification)
+    .where(and(like(verification.identifier, `${KEY_PREFIX}%`), lt(verification.expiresAt, new Date())));
+}

package/templates/app/lib/rate-limit.ts

@@ -0,0 +1,71 @@
+// This file is yours.
+//
+// Flare copies the code that turns a resource descriptor into a working endpoint into
+// your app rather than hiding it in node_modules, for the same reason shadcn/ui copies
+// a component: you cannot fix, read or reason about what you cannot see.
+//
+// `flare diff` shows how your copy differs from the version Flare ships, and
+// `flare update` applies the parts you choose. Neither runs unless you ask.
+
+/**
+ * Where a resource's rate limits are counted — the Cloudflare half.
+ *
+ * A descriptor says `rateLimit: { create: "10/min" }`; the generated route asks here
+ * whether this call is within it. The counters live in a Durable Object, one instance per
+ * resource and action holding a map of caller → count, so a limited call costs one object
+ * request rather than one per caller.
+ *
+ * **If the binding is missing, nothing is limited.** Say so loudly once rather than
+ * failing every request: an app that will not serve anything is worse than one that logs
+ * that a limit is not being enforced, and `flare doctor` reports it as a problem. The
+ * binding is in wrangler.jsonc as FLARE_RATE_LIMIT.
+ */
+import { env } from "cloudflare:workers";
+import { rateLimitKey, type Rate, type RateLimitDecision } from "@flaredev/core";
+import type { RateLimitNamespace } from "@flaredev/core/rate-limit/server";
+
+/** Allowed, with no count kept — what an unconfigured limiter answers. */
+const UNLIMITED: RateLimitDecision = { allowed: true, remaining: Number.MAX_SAFE_INTEGER, retryAfter: 0 };
+
+let warned = false;
+
+/** The FLARE_RATE_LIMIT binding, or undefined when the app has none. */
+function namespace(): RateLimitNamespace | undefined {
+  const binding = (env as { FLARE_RATE_LIMIT?: RateLimitNamespace } | undefined)?.FLARE_RATE_LIMIT;
+  if (binding) return binding;
+  if (!warned) {
+    warned = true;
+    console.warn(
+      "[flare] A resource declares a rateLimit, but there is no FLARE_RATE_LIMIT binding, so nothing is being limited. " +
+        "Add it to wrangler.jsonc (flare doctor will show you).",
+    );
+  }
+  return undefined;
+}
+
+/**
+ * Count one call and say whether it was within the limit.
+ *
+ * `caller` is the signed-in account's id where there is one and the client IP otherwise,
+ * so a limit is per person rather than per everyone behind one connection.
+ */
+export async function checkRateLimit(
+  resource: string,
+  action: string,
+  caller: string,
+  rate: Rate,
+): Promise<RateLimitDecision> {
+  const binding = namespace();
+  if (!binding) return UNLIMITED;
+  try {
+    // One object per resource and action; the caller is a key inside it.
+    const stub = binding.get(binding.idFromName(`${resource}:${action}`));
+    return await stub.hit(rateLimitKey(resource, action, caller), rate);
+  } catch (error) {
+    // A counter that is unreachable must not take the endpoint down with it. Letting the
+    // call through is the safer failure: the alternative is an outage in the limiter
+    // becoming an outage in the app.
+    console.error("[flare] rate limit counter failed, allowing the request:", error);
+    return UNLIMITED;
+  }
+}

package/templates/app/lib/resource/drizzle-rows.ts

@@ -108,9 +108,14 @@ export function drizzleRows(table: SQLiteTable, getDb: () => AnyDatabase): Resou
       return (record as Row | undefined) ?? null;
     },
 
-    async titles(ids, titleField) {
+    async titles(ids, titleField, owner) {
       const titleColumn = columns[titleField] ?? idColumn;
-      const rows = await getDb().select({ id: idColumn, title: titleColumn }).from(table).where(inArray(idColumn, ids));
+      const ownerColumn = owner ? columns[owner.field] : undefined;
+      // An owner naming a column this table does not have would widen the query rather
+      // than narrow it, so it answers nothing instead.
+      if (owner && !ownerColumn) return [];
+      const where = ownerColumn ? and(inArray(idColumn, ids), eq(ownerColumn, owner!.value)) : inArray(idColumn, ids);
+      const rows = await getDb().select({ id: idColumn, title: titleColumn }).from(table).where(where);
       return rows as { id: string; title: unknown }[];
     },
 

package/templates/app/lib/resource/handlers.ts

@@ -13,6 +13,7 @@ import {
   crossOrigin,
   drain,
   failureResponse,
+  PROBLEM_CODES,
   problem,
   readJson,
   respond,
@@ -41,6 +42,12 @@ export interface ResourceHandlerOptions {
   authorize: Authorize;
   /** Who is making the request, for the descriptor's hooks. */
   currentUser?: ResourceStoreOptions["currentUser"];
+  /**
+   * Serve every row, whoever is asking. See {@link ResourceStoreOptions.system} — the
+   * store needs this or `currentUser`, and a route that genuinely has no session is the
+   * one case where it is the honest answer.
+   */
+  system?: ResourceStoreOptions["system"];
   /** Called after a write succeeds, for cache invalidation. */
   onChange?: (event: ChangeEvent) => void | Promise<void>;
 }
@@ -52,7 +59,7 @@ export function createResourceHandlers(options: ResourceHandlerOptions) {
 
   /** The cross-origin guard and the JSON read, in the order a write needs them. */
   const readBody = async (request: Request): Promise<{ body: unknown } | { response: Response }> =>
-    crossOrigin(request) ? { response: problem(403, "Cross-origin request blocked.") } : readJson(request);
+    crossOrigin(request) ? { response: problem(403, "Cross-origin request blocked.", PROBLEM_CODES.crossOriginBlocked) } : readJson(request);
 
   const guard = async (context: AuthorizeContext) => (await authorize(context)) ?? undefined;
 
@@ -99,7 +106,7 @@ export function createResourceHandlers(options: ResourceHandlerOptions) {
       item(request, context, "update", (id) => withBody(request, async (body) => respond(await store.replace(id, body)))),
     DELETE: (request: Request, context: RouteContext) =>
       item(request, context, "delete", async (id) => {
-        if (crossOrigin(request)) return problem(403, "Cross-origin request blocked.");
+        if (crossOrigin(request)) return problem(403, "Cross-origin request blocked.", PROBLEM_CODES.crossOriginBlocked);
         const result = await store.delete(id);
         return result.ok ? new Response(null, { status: 204 }) : failureResponse(result);
       }),

package/templates/app/lib/resource/http.ts

@@ -9,6 +9,11 @@
 // `flare update` applies the parts you choose. Neither runs unless you ask.
 
 import type { Resource } from "@flaredev/core";
+import { PROBLEM_CODES, problemResponse, type ProblemCode, type ProblemIssue } from "@flaredev/core";
+
+// Re-exported so a generated route reads every error code from `@/lib/resource` like
+// everything else it uses. The route never imports the framework directly.
+export { ISSUE_CODES, PROBLEM_CODES, type IssueCode, type ProblemCode, type ProblemIssue } from "@flaredev/core";
 import type { Failure, ResourceAction, Result } from "./store";
 
 export interface AuthorizeContext {
@@ -24,22 +29,26 @@ export type Authorize = (context: AuthorizeContext) => Response | void | Promise
 /** The context Next.js and vinext hand a route under `[id]`. */
 export type RouteContext = { params: Promise<{ id: string }> };
 
-/** A JSON error response. */
-export const problem = (status: number, error: string, extra: object = {}) => Response.json({ error, ...extra }, { status });
+/**
+ * A JSON error response, in the one shape the whole API uses:
+ *
+ *     { "error": "…", "code": "unique_violation", "issues": [{ "path": "…", "message": "…", "code": "unique" }] }
+ *
+ * `error` is the sentence a person reads and its wording may change; `code` is for a
+ * program and does not. `issues` is there whenever the answer is about fields. See
+ * PROBLEM_CODES for the codes, and the API reference for the contract.
+ */
+export const problem = (status: number, error: string, code: ProblemCode, issues?: ProblemIssue[]) =>
+  problemResponse(status, error, code, issues);
 
 /**
  * A store failure as HTTP.
  *
- * The status is decided in store.ts, where the reason is known: 422 with field issues
- * for validation, 409 with the column for a unique conflict, 404 for a missing row.
+ * The status and the code are decided in store.ts, where the reason is known: 422 with
+ * field issues for validation, 409 naming the column for a unique conflict, 404 for a
+ * missing row.
  */
-export function failureResponse(failure: Failure): Response {
-  if (failure.queryIssues) return problem(failure.status, failure.error, { issues: failure.queryIssues });
-  const extra: Record<string, unknown> = {};
-  if (failure.issues) extra.issues = failure.issues;
-  if (failure.field) extra.field = failure.field;
-  return problem(failure.status, failure.error, extra);
-}
+export const failureResponse = (failure: Failure): Response => problemResponse(failure.status, failure.error, failure.code, failure.issues);
 
 /** A store result as HTTP: the data, or the failure above. */
 export const respond = <T>(result: Result<T>, init?: ResponseInit) => (result.ok ? Response.json(result.data, init) : failureResponse(result));
@@ -80,11 +89,13 @@ export const crossOrigin = (request: Request) => {
  */
 export async function readJson(request: Request): Promise<{ body: unknown } | { response: Response }> {
   const type = request.headers.get("content-type") ?? "";
-  if (!/^application\/json\b/i.test(type)) return { response: problem(415, "Send JSON with Content-Type: application/json.") };
+  if (!/^application\/json\b/i.test(type)) {
+    return { response: problem(415, "Send JSON with Content-Type: application/json.", PROBLEM_CODES.unsupportedMediaType) };
+  }
   try {
     return { body: await request.json() };
   } catch {
-    return { response: problem(400, "Request body isn't valid JSON.") };
+    return { response: problem(400, "Request body isn't valid JSON.", PROBLEM_CODES.invalidJson) };
   }
 }
 

package/templates/app/lib/resource/rows.ts

@@ -78,7 +78,11 @@ export interface ResourceRows {
   /** How many rows match, giving up at `limit` so a huge table is never fully counted. */
   countUpTo(query: Pick<RowsQuery, "search" | "filters" | "deleted">, limit: number): Promise<number>;
   byId(id: string): Promise<Row | null>;
-  titles(ids: string[], titleField: string): Promise<{ id: string; title: unknown }[]>;
+  /**
+   * Title values for a set of ids. `owner`, when given, restricts the rows considered —
+   * a relation picker shown to a confined user must not name records they cannot see.
+   */
+  titles(ids: string[], titleField: string, owner?: { field: string; value: string }): Promise<{ id: string; title: unknown }[]>;
   insert(values: Row): Promise<Row>;
   /** The saved row, or null when there was nothing with that id. */
   update(id: string, values: Row): Promise<Row | null>;

package/templates/app/lib/resource/store.ts

@@ -8,7 +8,8 @@
 // `flare diff` shows how your copy differs from the version Flare ships, and
 // `flare update` applies the parts you choose. Neither runs unless you ask.
 
-import { columnName, fromMinorUnits, ownershipFilter, storedFields, toMinorUnits, type Policy, type Resource } from "@flaredev/core";
+import { columnName, conditionHolds, fromMinorUnits, ownershipFilter, storedFields, toMinorUnits, type Policy, type Resource } from "@flaredev/core";
+import { ISSUE_CODES, PROBLEM_CODES, type ProblemCode, type ProblemIssue } from "@flaredev/core";
 import { createValidators } from "@flaredev/core";
 import { encodeCursor, isSearchable, parseListQuery, type QueryIssue } from "./query";
 import type { ResourceRows, Row } from "./rows";
@@ -24,14 +25,19 @@ export interface FieldIssue {
 
 export type Failure = {
   ok: false;
-  status: 400 | 403 | 404 | 409 | 422;
+  status: 400 | 401 | 403 | 404 | 409 | 422;
+  /** The sentence a person reads. Its wording is not part of the contract. */
   error: string;
-  /** Validation issues per field. */
-  issues?: FieldIssue[];
-  /** Invalid query parameters. */
-  queryIssues?: QueryIssue[];
-  /** Field that caused a conflict (e.g. a unique violation). */
-  field?: string;
+  /** Why, as a value a program can switch on. See PROBLEM_CODES. */
+  code: ProblemCode;
+  /**
+   * Which fields, whenever the answer is about fields at all: one issue for a unique
+   * conflict, one per failed rule for a validation error, one per bad parameter for a
+   * query. There used to be three ways of saying this — `issues` with a `path`, `issues`
+   * with a `param`, and a bare `field` — and a client had to handle whichever one the
+   * guard that refused it happened to use.
+   */
+  issues?: ProblemIssue[];
 };
 
 export type Result<T> = { ok: true; data: T } | Failure;
@@ -105,10 +111,21 @@ export interface ResourceStoreOptions {
    * perform the action at all is decided before the store is reached, by `authorize` on
    * the API and by the dashboard's own check.
    *
-   * Ownership applies only when `currentUser` is also given. A store built without one
-   * has no session to scope to, which is how a seed or a script writes rows for anybody.
+   * Ownership applies unless `system` says otherwise.
    */
   policy?: Policy | null;
+  /**
+   * Run unconfined, on purpose.
+   *
+   * A store with no session cannot scope anything to an owner, which is right for a
+   * seed, a cron job or a migration script and wrong for anything serving a request.
+   * The two used to look identical — leave `currentUser` off and an `own` policy simply
+   * stopped applying — so the dangerous case was the one you got by forgetting.
+   *
+   * Now it has to be said. Pass `currentUser`, or pass `system: true`; a store with
+   * neither throws where it is built rather than returning everybody's rows at runtime.
+   */
+  system?: true;
   /**
    * Called after a write succeeds, for cache invalidation. Runs before the
    * operation returns, so a caller that revalidates tags can't hand back a
@@ -129,6 +146,16 @@ export function createResourceStore(options: ResourceStoreOptions) {
   const validators = createValidators(resource);
   const fields = storedFields(resource);
 
+  // Before anything else, because the failure it prevents is silent. A store with no
+  // session and no `system` cannot confine an `own` policy, so it would hand back every
+  // row — correct for a seed, a hole in a server action somebody wrote in a hurry.
+  if (!options.currentUser && !options.system) {
+    throw new Error(
+      `Resource "${resource.name}": a store needs \`currentUser\`, or \`system: true\` to say it is meant to run unconfined. ` +
+        `Without one of them an \`own\` policy cannot be applied, and every row would be returned.`,
+    );
+  }
+
   // Drizzle can say up front whether the table matches the descriptor; a Prisma client
   // can't be asked the same question without a round trip, so that check stays here.
   const columns = "columns" in rows ? (rows.columns as Record<string, { name: string }>) : undefined;
@@ -146,7 +173,13 @@ export function createResourceStore(options: ResourceStoreOptions) {
       ? Object.entries(columns).find(([, column]) => column.name === name)?.[0]
       : ["id", "createdAt", "updatedAt", ...fields.map(([key]) => key)].find((key) => columnName(key) === name || key === name);
 
-  const fail = (status: Failure["status"], error: string, extra: Partial<Failure> = {}): Failure => ({ ok: false, status, error, ...extra });
+  const fail = (status: Failure["status"], error: string, code: ProblemCode, issues?: ProblemIssue[]): Failure => ({
+    ok: false,
+    status,
+    error,
+    code,
+    ...(issues?.length ? { issues } : {}),
+  });
 
   /** The same wording whichever database refused the write. */
   function constraintFailure(error: unknown, action: ResourceAction): Failure | undefined {
@@ -155,14 +188,17 @@ export function createResourceStore(options: ResourceStoreOptions) {
     if (hit.kind === "unique") {
       const key = hit.column ? keyForColumn(hit.column) : undefined;
       const label = key ? (resource.fields[key]?.label ?? key) : "Value";
-      return fail(409, `${label} is already taken.`, key ? { field: key } : {});
+      const error = `${label} is already taken.`;
+      // The column goes in as an issue, so a form reads one shape whether a rule or the
+      // database refused the value.
+      return fail(409, error, PROBLEM_CODES.uniqueViolation, key ? [{ path: key, message: error, code: ISSUE_CODES.unique }] : undefined);
     }
     if (hit.kind === "foreignKey") {
       return action === "delete"
-        ? fail(409, `This ${resource.label.toLowerCase()} is still referenced by other records.`)
-        : fail(422, "A related record doesn't exist.");
+        ? fail(409, `This ${resource.label.toLowerCase()} is still referenced by other records.`, PROBLEM_CODES.stillReferenced)
+        : fail(422, "A related record doesn't exist.", PROBLEM_CODES.relatedRecordMissing);
     }
-    return fail(422, "A value is outside its allowed options.");
+    return fail(422, "A value is outside its allowed options.", PROBLEM_CODES.valueNotAllowed);
   }
 
   async function guarded<T>(action: ResourceAction, work: () => Promise<Result<T>>): Promise<Result<T>> {
@@ -196,9 +232,14 @@ export function createResourceStore(options: ResourceStoreOptions) {
   }
 
   const invalid = (issues: { path: PropertyKey[]; message: string }[]) =>
-    fail(422, "Validation failed.", { issues: issues.map((issue) => ({ path: issue.path.map(String).join("."), message: issue.message })) });
+    fail(
+      422,
+      "Validation failed.",
+      PROBLEM_CODES.validationFailed,
+      issues.map((issue) => ({ path: issue.path.map(String).join("."), message: issue.message, code: ISSUE_CODES.invalid })),
+    );
 
-  const notFound = () => fail(404, `${resource.label} not found.`);
+  const notFound = () => fail(404, `${resource.label} not found.`, PROBLEM_CODES.notFound);
 
   /**
    * Money fields, and the currency each one counts in.
@@ -212,6 +253,34 @@ export function createResourceStore(options: ResourceStoreOptions) {
     (def.kind === "int" || def.kind === "float") && def.format === "money" ? [{ key, currency: def.currency }] : [],
   );
 
+  /**
+   * Fields that only apply when another field says so, e.g. a billing cycle that exists
+   * on a recurring project and not on a one-off one.
+   *
+   * The validator decides whether one is *required*; this decides whether it is *kept*.
+   * Without it, changing a project from recurring to one-off leaves last month's billing
+   * cycle sitting in the row — the form stopped showing the input, so nothing ever sent a
+   * value to overwrite it, and the record quietly disagrees with itself.
+   */
+  const conditionalFields = fields.flatMap(([key, def]) => (def.showWhen ? [{ key, condition: def.showWhen }] : []));
+
+  /**
+   * Null the fields that no longer apply.
+   *
+   * `record` is what the condition is judged against: the whole record as it will be once
+   * this write lands, which on a PATCH means the stored row with the patch laid over it.
+   * Judging the patch alone would read a field it never mentioned as absent and clear a
+   * value that was meant to stay.
+   */
+  function clearInapplicable(values: Row, record: Row): Row {
+    if (conditionalFields.length === 0) return values;
+    const out = { ...values };
+    for (const { key, condition } of conditionalFields) {
+      if (!conditionHolds(condition, record)) out[key] = null;
+    }
+    return out;
+  }
+
   /** Amounts as the database stores them: 19.99 -> 1999. */
   function toStored(values: Row): Row {
     if (moneyFields.length === 0) return values;
@@ -277,15 +346,17 @@ export function createResourceStore(options: ResourceStoreOptions) {
   /**
    * The owner this call is confined to: `null` to touch every row, or a Failure.
    *
-   * Only when a `currentUser` was given — see the option. A policy that restricts rows
-   * and a request with no session is a 403, not an unrestricted query: the API refuses
-   * that earlier, but the dashboard and server actions come through here too, and a
-   * missing session must never widen what a query returns.
+   * Unconfined only when the store said `system` — see the option. A policy that
+   * restricts rows and a request with no session is a 403, not an unrestricted query:
+   * the API refuses that earlier, but the dashboard and server actions come through here
+   * too, and a missing session must never widen what a query returns.
    */
   async function confine(): Promise<{ field: string; value: string } | Failure | null> {
-    if (!ownership || !options.currentUser) return null;
-    const user = await options.currentUser();
-    if (!user) return fail(403, "Sign in required.");
+    // `system` is the only way past an ownership policy, and the constructor has already
+    // insisted that a store without one has a `currentUser` to confine to.
+    if (!ownership || options.system) return null;
+    const user = await options.currentUser!();
+    if (!user) return fail(401, "Sign in required.", PROBLEM_CODES.unauthenticated);
     return ownershipFilter(options.policy, user);
   }
 
@@ -303,7 +374,16 @@ export function createResourceStore(options: ResourceStoreOptions) {
     /** `params`: page, perPage, sort, q, filter[field], cursor (as parsed by parseListQuery). */
     async list(params: URLSearchParams, options: { maxPerPage?: number } = {}): Promise<Result<ListResult>> {
       const parsed = parseListQuery(resource, params, options);
-      if ("issues" in parsed) return fail(400, "Invalid query.", { queryIssues: parsed.issues });
+      // A bad parameter is an issue like any other; it used to arrive under `param`
+      // rather than `path`, which was the fourth shape a client had to know about.
+      if ("issues" in parsed) {
+        return fail(
+          400,
+          "Invalid query.",
+          PROBLEM_CODES.invalidQuery,
+          parsed.issues.map((issue) => ({ path: issue.param, message: issue.message, code: ISSUE_CODES.invalidParameter })),
+        );
+      }
       const { page, perPage, sort, q, cursor } = parsed.query;
 
       const limit = await confine();
@@ -405,16 +485,19 @@ export function createResourceStore(options: ResourceStoreOptions) {
     /**
      * Title-field values for a set of ids (for showing relations). Missing ids are omitted.
      *
-     * Not confined by ownership, and `rows.titles` has no way to be: it returns an id and
-     * a title, not the owner. It is called with ids this resource's rows already point at,
-     * so in practice it shows the names of records you can already see — but if you hand a
-     * confined user a relation picker over a confined resource, the titles are not the
-     * place that restriction is enforced. Filter the ids before calling it.
+     * Confined by ownership, like every other read: a relation picker shown to a user who
+     * only sees their own rows must not name anybody else's. An id they may not see is
+     * simply absent from the result, which the caller already handles — missing ids are
+     * omitted either way, so a title they are not entitled to looks the same as one that
+     * was deleted.
      */
     async titles(ids: string[]): Promise<Record<string, string>> {
       const unique = [...new Set(ids.filter(Boolean))];
       if (unique.length === 0) return {};
-      const found = await rows.titles(unique, resource.titleField);
+      const limit = await confine();
+      // Not signed in where sign-in is required: no titles rather than everyone's.
+      if (isFailure(limit)) return {};
+      const found = await rows.titles(unique, resource.titleField, limit ?? undefined);
       return Object.fromEntries(found.map((row) => [row.id, row.title == null ? row.id : String(row.title)]));
     },
 
@@ -436,7 +519,8 @@ export function createResourceStore(options: ResourceStoreOptions) {
         if (!result.success) return invalid(result.error.issues);
         const input = result.data as Record<string, unknown>;
         const now = new Date();
-        const record = await rows.insert(toStored({ ...input, id: crypto.randomUUID(), createdAt: now, updatedAt: now }));
+        const fresh = { ...input, id: crypto.randomUUID(), createdAt: now, updatedAt: now };
+        const record = await rows.insert(toStored(clearInapplicable(fresh, fresh)));
         const saved = withComputed(record);
         await hooks.afterCreate?.(saved, context);
         return { ok: true, data: saved };
@@ -452,7 +536,10 @@ export function createResourceStore(options: ResourceStoreOptions) {
 
         // A confined update has to read the row first: `rows.update(id, …)` takes an id
         // and nothing else, so this is where "is it yours" is answered.
-        const current = limit || hooks.beforeUpdate || hooks.afterUpdate ? await rows.byId(id) : null;
+        // Conditional fields join this list: deciding whether one still applies needs the
+        // whole record, and a PATCH on its own may not mention the field it depends on.
+        const needsCurrent = limit || hooks.beforeUpdate || hooks.afterUpdate || conditionalFields.length > 0;
+        const current = needsCurrent ? await rows.byId(id) : null;
         if (limit) {
           if (!current) return notFound();
           if (!owns(current, limit)) return notFound();
@@ -467,16 +554,17 @@ export function createResourceStore(options: ResourceStoreOptions) {
           const sent = (supplied as Record<string, unknown>)[limit.field];
           if (sent !== limit.value) {
             const label = resource.fields[limit.field]?.label ?? limit.field;
-            return fail(422, `You can't change which user this ${resource.label.toLowerCase()} belongs to.`, {
-              issues: [{ path: limit.field, message: `${label} can't be changed.` }],
-            });
+            return fail(422, `You can't change which user this ${resource.label.toLowerCase()} belongs to.`, PROBLEM_CODES.validationFailed, [
+              { path: limit.field, message: `${label} can't be changed.`, code: ISSUE_CODES.immutable },
+            ]);
           }
         }
 
         const result = validators.update.safeParse(supplied);
         if (!result.success) return invalid(result.error.issues);
         const input = result.data as Record<string, unknown>;
-        const record = await rows.update(id, toStored({ ...input, updatedAt: new Date() }));
+        const merged = { ...((current ?? {}) as Row), ...input };
+        const record = await rows.update(id, toStored(clearInapplicable({ ...input, updatedAt: new Date() }, merged)));
         if (!record) return notFound();
         const saved = withComputed(record);
         await hooks.afterUpdate?.(saved, { ...context, previous: current });
@@ -505,7 +593,7 @@ export function createResourceStore(options: ResourceStoreOptions) {
         // one of them, and a replace would quietly orphan the row it just saved.
         if (limit) values[limit.field] = limit.value;
 
-        const record = await rows.update(id, toStored(values));
+        const record = await rows.update(id, toStored(clearInapplicable(values, values)));
         return record ? { ok: true, data: withComputed(record) } : notFound();
       });
     },