@flaredev/cli 0.13.0 → 0.14.0

package/dist/index.js

@@ -730,7 +730,7 @@ function printNextSteps(result, installed) {
       [
         `${pc.cyan(SEED_ADMIN.email)}  ${pc.dim("\xB7")}  ${pc.cyan(SEED_ADMIN.password)}`,
         "",
-        pc.dim(`Made by ${pm} run db:seed, as an admin. Change it before this app is anywhere but your machine.`)
+        pc.dim("Made by npx flare db:seed, as an admin. Change it before this app is anywhere but your machine.")
       ].join("\n"),
       "Sign in with"
     );
@@ -3116,7 +3116,7 @@ async function diagnose(options2 = {}) {
     }
   }
   if (stack === "next") {
-    findings.push({ check: "Migrations", verdict: "skip", detail: "Prisma tracks these in the database; run `npx prisma migrate status`." });
+    findings.push({ check: "Migrations", verdict: "skip", detail: "Prisma tracks these in the database; run `npx flare migrate --deploy` to apply any that are pending." });
   } else if (options2.offline) {
     findings.push({ check: "Migrations", verdict: "skip", detail: "Skipped (--offline)." });
   } else {
@@ -3889,7 +3889,7 @@ async function genApiKeys(options2 = {}) {
   }
   const steps = [
     ...installed ? [`${pc10.bold("install")} (pnpm install) to fetch ${API_KEY_PACKAGE}.`] : [],
-    stack === "next" ? `${pc10.bold("npx prisma migrate dev --name apikeys")} to create the table.` : `${pc10.bold("flare migrate")} to create the apikey table.`,
+    stack === "next" ? `${pc10.bold("npx flare migrate --name apikeys")} to create the table.` : `${pc10.bold("flare migrate")} to create the apikey table.`,
     `${pc10.bold("flare dev")}, then ${pc10.bold("/dashboard/api-keys")} to mint one.`,
     `Call the API with it: ${pc10.bold("-H 'Authorization: Bearer <key>'")} (or ${pc10.bold("x-api-key")}).`
   ];
@@ -4241,15 +4241,20 @@ function renderFieldsBlock(fields) {
 function renderDescriptor(name, fields, options2 = {}) {
   defineResource({ name, fields: Object.fromEntries(fields.map((f) => [f.key, toField(f)])) });
   const block = renderFieldsBlock(fields);
-  const heading = [
-    options2.icon ? `  icon: ${literal(options2.icon)},
-` : "",
-    options2.group ? `  group: ${literal(options2.group)},
-` : "",
-    options2.softDelete ? `  // A delete stamps deletedAt instead of removing the row; the dashboard grows a Trash view.
+  const set = (key, value) => `  ${key}: ${value},
+`;
+  const suggestion = (code, note2 = "") => {
+    const line = `  // ${code}`;
+    return note2 && line.length <= 52 ? `${line.padEnd(53)}// ${note2}
+` : `${line}
+`;
+  };
+  const heading = (options2.icon ? set("icon", literal(options2.icon)) : suggestion(`icon: "file-text",`, "any lucide-react name")) + (options2.group ? set("group", literal(options2.group)) : suggestion(`group: "Sales",`, "sidebar heading")) + suggestion(`titleField: "${fields[0]?.key ?? "name"}",`, "what lists and pickers show") + suggestion(`defaultSort: { field: "createdAt", direction: "desc" },`) + suggestion(`perPage: 25,`, "rows per page") + (options2.softDelete ? `  // A delete stamps deletedAt instead of removing the row; the dashboard grows a Trash view.
   softDelete: true,
-` : ""
-  ].join("");
+` : suggestion(`softDelete: true,`, "keep deleted rows, with a Trash view")) + suggestion(`rateLimit: { create: "10/min", "*": "120/min" },`) + `  // Uncomment what you need. Hooks, computed values, table and slug:
+  // https://flare-docs.codetotech.com/concepts/resource-descriptor/
+
+`;
   return joinMarkers({
     before: `import { defineResource, field } from "@flaredev/core";
 
@@ -5761,7 +5766,7 @@ async function askCreateQuestions(given, appName) {
 }
 
 // src/commands/gen.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync8, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync8, readFileSync as readFileSync15, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname9, join as join20 } from "path";
 import { AUTH_USER as AUTH_USER2, camelCase as camelCase5, defineResource as defineResource2, relationGraph as relationGraph2 } from "@flaredev/core";
 import pc15 from "picocolors";
@@ -5785,11 +5790,37 @@ async function genResource(rawName, options2) {
   const relativePath = descriptorPath(name);
   const path = join20(appRoot, relativePath);
   const exists = existsSync20(path);
-  if (!exists && !options2.fields) {
+  if (!exists && !options2.fields && !options2.add) {
     throw new Error(`--fields is required, e.g. flare gen resource ${name} --fields "name:string, email:string"`);
   }
+  if (options2.add && options2.fields) {
+    throw new Error("--add appends to the fields you have; --fields replaces them. Use one or the other.");
+  }
+  if (options2.add && !exists) {
+    throw new Error(`There is no ${relativePath} to add to. Create it first: flare gen resource ${name} --fields "${options2.add}"`);
+  }
   const existing = await loadResources(appRoot);
   const others = existing.filter(({ resource }) => resource.name !== name).map(({ resource }) => resource);
+  if (options2.add) {
+    const additions = parseFields(options2.add);
+    const current = existing.find(({ resource }) => resource.name === name)?.resource;
+    const taken = new Set(Object.keys(current?.fields ?? {}));
+    const clash = additions.find((candidate) => taken.has(candidate.key));
+    if (clash) {
+      throw new Error(
+        `${name} already has a field called "${clash.key}". Edit it in ${relativePath}, or rename it there with \`${clash.key}: field.string({ rename: { from: "old" } })\`.`
+      );
+    }
+    validateFields(name, additions, others, log2);
+    const source = readFileSync15(path, "utf8");
+    const marked = splitMarkers(source);
+    if (!marked) throw new Error(`${relativePath} has no generated block to add to. Add the field by hand.`);
+    const existingBlock = marked.block === "" || marked.block.endsWith("\n") ? marked.block : `${marked.block}
+`;
+    const appended = `${existingBlock}${renderFieldsBlock(additions)}`;
+    const outcome = writeGenerated(path, appended, { force: true });
+    log2(`${pc15.yellow(outcome.padEnd(9))} ${relativePath} ${pc15.dim(`(+${additions.map((f) => f.key).join(", ")})`)}`);
+  }
   if (options2.fields) {
     const fields = parseFields(options2.fields);
     validateFields(name, fields, others, log2);
@@ -5842,7 +5873,7 @@ Skipped ${skipped.length} hand-edited file(s); run \`flare sync-types\` for deta
   if (!options2.skipMigration) {
     if (readStack(appRoot) === "next") {
       log2(`
-Next: ${pc15.bold("npx prisma migrate dev")} to turn the schema into a migration and apply it.`);
+Next: ${pc15.bold("npx flare migrate")} to turn the schema into a migration and apply it.`);
     } else {
       const renamed = await applyDeclaredRenames(appRoot, await loadResources(appRoot));
       for (const [index, file] of renamed.files.entries()) {
@@ -5937,7 +5968,7 @@ ${body}
 }
 
 // src/commands/gen-migration.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync10, readFileSync as readFileSync15, readdirSync as readdirSync8, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync10, readFileSync as readFileSync16, readdirSync as readdirSync8, writeFileSync as writeFileSync16 } from "fs";
 import { basename as basename2, join as join22 } from "path";
 import { snakeCase } from "@flaredev/core";
 import pc17 from "picocolors";
@@ -6132,7 +6163,7 @@ ${applied.output.trim()}`);
     const relative3 = `prisma/migrations/${entry}/migration.sql`;
     written.push(relative3);
     log2(`${pc17.green("create".padEnd(9))} ${relative3}`);
-    const found = destructiveStatements(readFileSync15(file, "utf8"));
+    const found = destructiveStatements(readFileSync16(file, "utf8"));
     if (found.length > 0) destructive.push({ file: relative3, found });
   }
   if (destructive.length > 0) {
@@ -6246,16 +6277,19 @@ ${pc18.dim("Roles come from `flare role:add`; the API and the admin both enforce
 }
 
 // src/commands/rm.ts
-import { existsSync as existsSync24, readdirSync as readdirSync9, readFileSync as readFileSync16, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync24, readdirSync as readdirSync9, readFileSync as readFileSync17, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
 import { dirname as dirname11, join as join24 } from "path";
 import { relationGraph as relationGraph3 } from "@flaredev/core";
 import pc19 from "picocolors";
 var squash = (text) => text.replace(/\r\n/g, "\n").replace(/\s+/g, " ").trim();
+var squashCode = (text) => squash(
+  text.replace(/\r\n/g, "\n").split("\n").filter((line) => !line.trim().startsWith("//")).join("\n")
+);
 function handWrittenReason(source, header2, options2 = {}) {
   const parts = splitMarkers(source);
   if (!parts) return "has no generated block (entirely hand-written)";
   if (options2.descriptorWrapper) {
-    if (squash(parts.before) !== squash(options2.descriptorWrapper.before) || squash(parts.after) !== squash(options2.descriptorWrapper.after)) {
+    if (squashCode(parts.before) !== squashCode(options2.descriptorWrapper.before) || squashCode(parts.after) !== squashCode(options2.descriptorWrapper.after)) {
       return "has hand-written changes outside the fields block";
     }
     return null;
@@ -6307,7 +6341,7 @@ async function rmResource(rawName, options2 = {}) {
   if (!entry && owned.size === 0) throw new Error(`No resource "${name}" (no ${descriptorPath(name)} and no generated files).`);
   const findings = [];
   for (const path of owned) {
-    const source = readFileSync16(join24(appRoot, path), "utf8");
+    const source = readFileSync17(join24(appRoot, path), "utf8");
     let wrapper;
     if (entry && path === entry.file) {
       const standard = splitMarkers(renderDescriptor(name, [{ key: "placeholder", kind: "string", required: true, unique: false }]));
@@ -6336,7 +6370,7 @@ Move what you want to keep, or pass --force to delete anyway.`);
   const table = entry ? tableExport(entry.resource) : void 0;
   if (table && existsSync24(join24(appRoot, "seeds"))) {
     const seeds = readdirSync9(join24(appRoot, "seeds")).filter(
-      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync16(join24(appRoot, "seeds", file), "utf8"))
+      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync17(join24(appRoot, "seeds", file), "utf8"))
     );
     if (seeds.length) log2(pc19.yellow(`
 These seeds still use ${table}: ${seeds.map((s) => `seeds/${s}`).join(", ")}.`));
@@ -6344,7 +6378,7 @@ These seeds still use ${table}: ${seeds.map((s) => `seeds/${s}`).join(", ")}.`))
   let migrations = [];
   if (readStack(appRoot) === "next") {
     if (entry) log2(`
-Next: ${pc19.bold("npx prisma migrate dev")} to drop the table.`);
+Next: ${pc19.bold("npx flare migrate")} to drop the table.`);
     return { removed, migrations };
   }
   if (!options2.skipMigration && entry) {
@@ -6359,7 +6393,7 @@ Next: ${pc19.bold("flare migrate")} to drop the table locally.`);
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync17, readdirSync as readdirSync10, writeFileSync as writeFileSync18 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync18, readdirSync as readdirSync10, writeFileSync as writeFileSync18 } from "fs";
 import { dirname as dirname12, join as join25, relative as relative2 } from "path";
 import pc20 from "picocolors";
 var TRACKED = ["app", "lib", "components"];
@@ -6369,7 +6403,7 @@ var prunedOn = (path, stack) => stack === "next" && CLOUDFLARE_ONLY.some((only)
 function upstreamFile(path, stack) {
   if (prunedOn(path, stack) || WRITTEN_PER_APP.has(path)) return void 0;
   const found = locate(path, stack);
-  if (found && PER_APP.test(readFileSync17(found, "utf8"))) return void 0;
+  if (found && PER_APP.test(readFileSync18(found, "utf8"))) return void 0;
   return found;
 }
 function locate(path, stack) {
@@ -6396,10 +6430,10 @@ function trackedPaths(appRoot, stack) {
 function compareTracked(appRoot, stack, filter) {
   return trackedPaths(appRoot, stack).filter((path) => !filter || path.includes(filter)).map((path) => {
     const source = upstreamFile(path, stack);
-    const theirs = readFileSync17(source, "utf8");
+    const theirs = readFileSync18(source, "utf8");
     const target = join25(appRoot, path);
     if (!existsSync25(target)) return { path, state: "missing", theirs };
-    const mine = readFileSync17(target, "utf8");
+    const mine = readFileSync18(target, "utf8");
     if (mine === theirs) return { path, state: "same", mine, theirs };
     const merged = mergeGeneratedBlock(mine, theirs);
     if (merged !== void 0) {
@@ -6589,7 +6623,7 @@ function createInsertMany(sink, drizzle, onProgress) {
 }
 
 // src/seed/local-d1.ts
-import { readFileSync as readFileSync18, rmSync as rmSync5, writeFileSync as writeFileSync19 } from "fs";
+import { readFileSync as readFileSync19, rmSync as rmSync5, writeFileSync as writeFileSync19 } from "fs";
 import { createRequire } from "module";
 import { join as join26 } from "path";
 import { pathToFileURL } from "url";
@@ -6622,7 +6656,7 @@ async function openLocalD1(appRoot, binding) {
 }
 function seedConfig(appRoot) {
   const source = join26(appRoot, "wrangler.jsonc");
-  const config = parseJsonc3(readFileSync18(source, "utf8")) ?? {};
+  const config = parseJsonc3(readFileSync19(source, "utf8")) ?? {};
   delete config.durable_objects;
   delete config.migrations;
   const path = join26(appRoot, ".flare-seed.wrangler.json");
@@ -7171,7 +7205,7 @@ function* seedRows(resource, count, options2 = {}) {
 
 // src/commands/seed-resource-prisma.ts
 import { createWriteStream } from "fs";
-import { mkdtempSync as mkdtempSync3, readFileSync as readFileSync19, rmSync as rmSync8, writeFileSync as writeFileSync22 } from "fs";
+import { mkdtempSync as mkdtempSync3, readFileSync as readFileSync20, rmSync as rmSync8, writeFileSync as writeFileSync22 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
 import { join as join29 } from "path";
 import { once } from "events";
@@ -7295,7 +7329,7 @@ async function seedResourceWithPrisma(appRoot, resource, options2, log2) {
       const { code: code2, output } = await runNodeCapturing([tsx, runner, "probe", planFile], appRoot);
       if (code2 !== 0) throw new Error(`Could not read the database before seeding.
 ${output.trim()}`);
-      probe = JSON.parse(readFileSync19(outFile, "utf8"));
+      probe = JSON.parse(readFileSync20(outFile, "utf8"));
     }
     const parentIds = new Map(Object.entries(probe.parents));
     for (const target of options2.parentTargets) {
@@ -7308,7 +7342,7 @@ ${output.trim()}`);
     writeFileSync22(planFile, JSON.stringify({ model, table: resource.table, out: outFile, rows: rowsFile, truncate: !!options2.truncate, total: options2.count }));
     const code = await runNode([tsx, runner, "insert", planFile], appRoot);
     if (code !== 0) throw new Error("Seeding stopped; the reason is above.");
-    const { written } = JSON.parse(readFileSync19(outFile, "utf8"));
+    const { written } = JSON.parse(readFileSync20(outFile, "utf8"));
     return written;
   } finally {
     rmSync8(runner, { force: true });
@@ -7490,7 +7524,7 @@ ${result.output.trim()}`);
 
 // src/commands/billing-sync.ts
 import { createRequire as createRequire2 } from "module";
-import { existsSync as existsSync27, mkdtempSync as mkdtempSync5, readFileSync as readFileSync20, rmSync as rmSync10, writeFileSync as writeFileSync24 } from "fs";
+import { existsSync as existsSync27, mkdtempSync as mkdtempSync5, readFileSync as readFileSync21, rmSync as rmSync10, writeFileSync as writeFileSync24 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { join as join31 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
@@ -7500,7 +7534,7 @@ function stripeKeys(appRoot) {
   const map = {};
   const path = join31(appRoot, ".dev.vars");
   if (existsSync27(path)) {
-    for (const line of readFileSync20(path, "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync21(path, "utf8").split(/\r?\n/)) {
       const match = /^\s*([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match) map[match[1]] = match[2].trim();
     }
@@ -7586,7 +7620,7 @@ async function syncPlans(options2 = {}) {
   const appRequire = createRequire2(join31(appRoot, "package.json"));
   const stripeModule = await import(pathToFileURL2(appRequire.resolve("stripe")).href);
   const stripe = new stripeModule.default(key, { apiVersion: "2026-08-26.dahlia" });
-  const appName = JSON.parse(readFileSync20(join31(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync21(join31(appRoot, "package.json"), "utf8")).name ?? "app";
   const everything = await stripe.products.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 });
   const products = options2.all ? everything : everything.filter((product) => product.metadata?.flare_app === appName);
   if (products.length === 0) {
@@ -7761,13 +7795,13 @@ async function setUserRoleOnPrisma(appRoot, email, role, log2) {
 
 // src/utils/install.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync29, readFileSync as readFileSync21, readdirSync as readdirSync12 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync22, readdirSync as readdirSync12 } from "fs";
 import { join as join34 } from "path";
 function expectedPackages(dir) {
   const npmLock = join34(dir, "package-lock.json");
   if (existsSync29(npmLock)) {
     try {
-      const lock = JSON.parse(readFileSync21(npmLock, "utf8"));
+      const lock = JSON.parse(readFileSync22(npmLock, "utf8"));
       return Math.max(0, Object.keys(lock.packages ?? {}).length - 1);
     } catch {
       return 0;
@@ -7776,7 +7810,7 @@ function expectedPackages(dir) {
   const pnpmLock = join34(dir, "pnpm-lock.yaml");
   if (existsSync29(pnpmLock)) {
     try {
-      const text = readFileSync21(pnpmLock, "utf8");
+      const text = readFileSync22(pnpmLock, "utf8");
       const packages = text.slice(text.indexOf("\npackages:"));
       return (packages.match(/\n {2}[^\s:]+:/g) ?? []).length;
     } catch {
@@ -7882,7 +7916,7 @@ function createCli() {
       printNextSteps(result, installed);
     }
   );
-  cli.command("gen <generator> [name] [second]", `Generate code. Generators: ${GENERATORS.join(", ")}`).option("--fields <fields>", "resource: fields, e.g. 'name:string, email:string!, status:enum(lead,customer)' (single quotes: bash treats ! in double quotes as history)").option("--group <name>", "resource: sidebar heading to file it under, e.g. Sales").option("--icon <name>", "resource: lucide icon for the sidebar, e.g. users").option("--soft-delete", "resource: keep deleted rows and hide them, with a Trash view in the dashboard").option("--method <verb>", "endpoint: GET (default), POST, PATCH, PUT or DELETE").option("--action <action>", "endpoint: policy action to require (read, create, update, delete)").option("--record", "endpoint: put it under one record, /api/<resource>/[id]/<name>").option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration; on Next.js, also apply declared renames").example("flare gen migration add_phone --from-schema         # Cloudflare: diff the Drizzle tables").example("flare gen migration add_phone                       # Next.js: prisma migrate dev, refusing a drop").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--own <field>", "policy: confine each user to rows whose field holds their id, e.g. --own userId").option("--own-except <roles>", "policy: roles that see every row despite --own, e.g. admin").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing/apikeys: write files without adding the dependency").option("--skip-migration", "billing/security/apikeys: skip generating the schema migration").example("flare gen resource Contact --fields 'name:string, email:string!, company:belongsTo(Company)?'").example("flare gen resource Invoice --fields 'number:string!' --soft-delete   # a delete goes to the Trash").example("flare gen endpoint Order publish --method POST --record").example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen policy Invoice --roles staff --own userId --own-except admin   # each user sees only their own").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").example("flare gen apikeys                                   # API keys for cron jobs, scripts and mobile apps").example("flare gen apikeys                                     # bearer keys for crons, scripts and mobile apps").action(
+  cli.command("gen <generator> [name] [second]", `Generate code. Generators: ${GENERATORS.join(", ")}`).option("--fields <fields>", "resource: fields, e.g. 'name:string, email:string!, status:enum(lead,customer)' (single quotes: bash treats ! in double quotes as history)").option("--add <fields>", "resource: add fields to one that exists, in the same grammar as --fields").option("--group <name>", "resource: sidebar heading to file it under, e.g. Sales").option("--icon <name>", "resource: lucide icon for the sidebar, e.g. users").option("--soft-delete", "resource: keep deleted rows and hide them, with a Trash view in the dashboard").option("--method <verb>", "endpoint: GET (default), POST, PATCH, PUT or DELETE").option("--action <action>", "endpoint: policy action to require (read, create, update, delete)").option("--record", "endpoint: put it under one record, /api/<resource>/[id]/<name>").option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration; on Next.js, also apply declared renames").example("flare gen migration add_phone --from-schema         # Cloudflare: diff the Drizzle tables").example("flare gen migration add_phone                       # Next.js: prisma migrate dev, refusing a drop").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--own <field>", "policy: confine each user to rows whose field holds their id, e.g. --own userId").option("--own-except <roles>", "policy: roles that see every row despite --own, e.g. admin").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing/apikeys: write files without adding the dependency").option("--skip-migration", "billing/security/apikeys: skip generating the schema migration").example("flare gen resource Contact --fields 'name:string, email:string!, company:belongsTo(Company)?'").example("flare gen resource Contact --add 'phone:phone?, notes:text?'     # add columns to one you have").example("flare gen resource Invoice --fields 'number:string!' --soft-delete   # a delete goes to the Trash").example("flare gen endpoint Order publish --method POST --record").example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen policy Invoice --roles staff --own userId --own-except admin   # each user sees only their own").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").example("flare gen apikeys                                   # API keys for cron jobs, scripts and mobile apps").example("flare gen apikeys                                     # bearer keys for crons, scripts and mobile apps").action(
     async (generator, name, second, options2) => {
       if (generator === "billing")
         return genBilling({ provider: options2.provider, mode: options2.mode, force: options2.force, skipInstall: options2.skipInstall, skipMigration: options2.skipMigration });
@@ -7895,6 +7929,7 @@ function createCli() {
       if (generator === "resource")
         return genResource(name, {
           fields: options2.fields,
+          add: options2.add,
           force: options2.force,
           group: options2.group,
           icon: options2.icon,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaredev/cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "The flare command-line tool: create, generate, migrate, and deploy Flare apps",
   "license": "MIT",
   "author": "Muke Johnbaptist",
@@ -41,7 +41,7 @@
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
-    "@flaredev/core": "0.13.0"
+    "@flaredev/core": "0.14.0"
   },
   "engines": {
     "node": ">=22"

package/templates/app/app/dashboard/error.tsx

@@ -4,33 +4,46 @@ import { useEffect } from "react";
 import { RefreshCwIcon, TriangleAlertIcon } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { Empty, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle } from "@/components/ui/empty";
+import { hardReload, isStaleChunkError } from "@/lib/stale-chunk";
 
 /**
  * A dashboard page that threw.
  *
  * Inside the layout, so the sidebar stays and `reset` retries just this page — no
  * sign-out, no lost place in the app.
+ *
+ * Except when the tab is running stale JavaScript, where `reset` re-renders the same
+ * stale modules and can only fail again. That case gets a reload instead, which is the
+ * thing that actually works. See lib/stale-chunk.ts.
  */
 export default function DashboardError({ error, reset }: { error: Error & { digest?: string }; reset: () => void }) {
   useEffect(() => {
     console.error(error);
   }, [error]);
 
+  const stale = isStaleChunkError(error);
+
   return (
     <Empty className="min-h-[60vh]">
       <EmptyHeader>
         <EmptyMedia variant="icon">
           <TriangleAlertIcon />
         </EmptyMedia>
-        <EmptyTitle>This page didn&apos;t load</EmptyTitle>
+        <EmptyTitle>{stale ? "This tab is running old code" : "This page didn't load"}</EmptyTitle>
         <EmptyDescription>
-          Something went wrong fetching it.
-          {error.digest && <> Reference: <span className="font-mono select-all">{error.digest}</span>.</>}
+          {stale ? (
+            "Nothing is wrong with the app. This tab loaded one build and the server is serving another — usually after an update, or after starting a different app on this port. Reloading fixes it."
+          ) : (
+            <>
+              Something went wrong fetching it.
+              {error.digest && <> Reference: <span className="font-mono select-all">{error.digest}</span>.</>}
+            </>
+          )}
         </EmptyDescription>
       </EmptyHeader>
-      <Button onClick={reset}>
+      <Button onClick={stale ? hardReload : reset}>
         <RefreshCwIcon data-icon="inline-start" />
-        Try again
+        {stale ? "Reload the page" : "Try again"}
       </Button>
     </Empty>
   );

package/templates/app/app/dashboard/roles/actions.ts

@@ -0,0 +1,57 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { createRole, deleteRole, setGrant } from "@/lib/permissions";
+import { ADMIN_ROLES, dashboardSession } from "@/lib/dashboard";
+
+/**
+ * Changing who may do what.
+ *
+ * Admin only, and deliberately not policy-driven: these actions decide what the
+ * policies themselves allow, so gating them on a policy would be circular. ADMIN_ROLES
+ * (lib/dashboard.ts) is the one list that governs the app's own settings.
+ */
+
+export type RoleActionResult = { ok: true } | { ok: false; error: string };
+
+const ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+const ACTIONS = new Set(["read", "create", "update", "delete"]);
+
+async function requireAdmin(): Promise<RoleActionResult | undefined> {
+  const { session, role } = await dashboardSession();
+  if (!session) return { ok: false, error: "You're signed out." };
+  if (!role || !ADMIN_ROLES.includes(role)) return { ok: false, error: "Only an admin can change roles." };
+}
+
+export async function createRoleAction(input: { name: string; label: string }): Promise<RoleActionResult> {
+  const denied = await requireAdmin();
+  if (denied) return denied;
+  const name = input.name.trim().toLowerCase();
+  if (!ROLE_NAME.test(name)) {
+    return { ok: false, error: "A role is lowercase letters, digits, _ or -, starting with a letter — e.g. support-agent." };
+  }
+  await createRole(name, input.label.trim() || name);
+  revalidatePath("/dashboard/roles");
+  return { ok: true };
+}
+
+export async function deleteRoleAction(name: string): Promise<RoleActionResult> {
+  const denied = await requireAdmin();
+  if (denied) return denied;
+  // Not admin: the role this screen is gated on cannot be removed from this screen,
+  // which is the one mistake here that cannot be undone from the dashboard.
+  if (ADMIN_ROLES.includes(name)) return { ok: false, error: `"${name}" runs this screen, so it can't be deleted here.` };
+  await deleteRole(name);
+  revalidatePath("/dashboard/roles");
+  return { ok: true };
+}
+
+export async function setGrantAction(input: { role: string; resource: string; action: string; granted: boolean }): Promise<RoleActionResult> {
+  const denied = await requireAdmin();
+  if (denied) return denied;
+  if (!ROLE_NAME.test(input.role)) return { ok: false, error: `"${input.role}" is not a role name.` };
+  if (!ACTIONS.has(input.action)) return { ok: false, error: `"${input.action}" is not an action.` };
+  await setGrant(input.role, input.resource, input.action, input.granted);
+  revalidatePath("/dashboard/roles");
+  return { ok: true };
+}

package/templates/app/app/dashboard/roles/page.tsx

@@ -0,0 +1,56 @@
+import { redirect } from "next/navigation";
+import { grantIndex } from "@flaredev/core";
+import { PageHeader } from "@/components/dashboard/page-header";
+import { RoleMatrix, type MatrixResource } from "@/components/dashboard/role-matrix";
+import { ADMIN_ROLES, allResources, dashboardSession } from "@/lib/dashboard";
+import { allGrants, codePolicy, GRANTABLE, listRoles, rolesInUse } from "@/lib/permissions";
+
+export const metadata = { title: "Roles & permissions" };
+
+/**
+ * Who may do what, per role.
+ *
+ * Admin only, and not governed by a resource policy: this screen decides what the
+ * policies allow, so gating it on one would be circular. It reads the policy files and
+ * the grants together, and shows which ticks came from which — a tick from a file is
+ * locked, because the file is the floor and the dashboard only widens it.
+ */
+export default async function RolesPage() {
+  const { session, role } = await dashboardSession();
+  if (!session) redirect("/sign-in?next=/dashboard/roles");
+  if (!role || !ADMIN_ROLES.includes(role)) redirect("/dashboard");
+
+  const [roles, grants, inUse] = await Promise.all([listRoles(), allGrants(), rolesInUse()]);
+  const index = grantIndex(grants);
+
+  // Every role an account could hold, not only the registered ones: the admin plugin's
+  // default is "user", and a role assigned with `flare user:role` before anybody opened
+  // this screen exists whether or not it was registered here. Showing it is how you
+  // discover you have one.
+  const known = new Map(roles.map((entry) => [entry.name, entry]));
+  for (const name of [...ADMIN_ROLES, "user", ...inUse]) {
+    if (!known.has(name)) known.set(name, { name, label: name });
+  }
+
+  const resources: MatrixResource[] = allResources().map((resource) => {
+    const policy = codePolicy(resource.name);
+    const fromCode: Record<string, string[]> = {};
+    const granted: Record<string, string[]> = {};
+    for (const action of GRANTABLE) {
+      fromCode[action] = policy ? policy[action] : [];
+      granted[action] = [...(index.get(`${resource.name}.${action}`) ?? [])];
+    }
+    return { name: resource.name, pluralLabel: resource.pluralLabel, restricted: Boolean(policy), fromCode, granted };
+  });
+
+  return (
+    <>
+      <PageHeader
+        title="Roles & permissions"
+        description="What each role may do, per resource. Policy files set the floor; what you tick here widens it."
+        crumbs={[{ label: "Dashboard", href: "/dashboard" }, { label: "Roles & permissions" }]}
+      />
+      <RoleMatrix roles={[...known.values()]} resources={resources} adminRoles={ADMIN_ROLES} />
+    </>
+  );
+}

package/templates/app/app/error.tsx

@@ -3,6 +3,7 @@
 import { useEffect } from "react";
 import Link from "next/link";
 import { RefreshCwIcon, TriangleAlertIcon } from "lucide-react";
+import { hardReload, isStaleChunkError } from "@/lib/stale-chunk";
 
 /**
  * The public error boundary.
@@ -11,6 +12,10 @@ import { RefreshCwIcon, TriangleAlertIcon } from "lucide-react";
  * needs somewhere to hand `reset`, which re-renders the segment without a full page
  * load, and that is usually all a transient failure needs.
  *
+ * Usually, but not always: a tab holding stale JavaScript throws too, and `reset` can
+ * never fix that one — it re-renders the same stale modules. So that case is told
+ * apart and offered a reload, which does fix it. See lib/stale-chunk.ts.
+ *
  * `error.digest` is the only detail shown. The message itself is deliberately not:
  * in production it is replaced by React anyway, and in development the overlay is
  * more use than anything printed here.
@@ -21,17 +26,21 @@ export default function Error({ error, reset }: { error: Error & { digest?: stri
     console.error(error);
   }, [error]);
 
+  const stale = isStaleChunkError(error);
+
   return (
     <main className="mx-auto flex min-h-[70vh] max-w-2xl flex-col items-center justify-center gap-6 px-6 py-20 text-center">
       <div className="flex size-14 items-center justify-center rounded-2xl border border-border bg-surface">
         <TriangleAlertIcon className="size-6 text-danger" aria-hidden="true" />
       </div>
       <div className="flex flex-col gap-3">
-        <h1 className="text-3xl text-balance md:text-4xl">Something went wrong</h1>
+        <h1 className="text-3xl text-balance md:text-4xl">{stale ? "This tab is running old code" : "Something went wrong"}</h1>
         <p className="text-foreground-muted text-pretty">
-          This one is on us. Trying again often works; if it doesn&apos;t, the error has been logged.
+          {stale
+            ? "Nothing is wrong with the app. This tab loaded one build and the server is serving another — usually after an update, or after starting a different app on this port. Reloading fixes it."
+            : "This one is on us. Trying again often works; if it doesn't, the error has been logged."}
         </p>
-        {error.digest && (
+        {!stale && error.digest && (
           <p className="font-mono text-xs text-foreground-muted">
             Reference: <span className="select-all">{error.digest}</span>
           </p>
@@ -40,11 +49,11 @@ export default function Error({ error, reset }: { error: Error & { digest?: stri
       <div className="flex flex-wrap justify-center gap-3">
         <button
           type="button"
-          onClick={reset}
+          onClick={stale ? hardReload : reset}
           className="inline-flex h-11 items-center gap-2 rounded-[var(--button-radius)] bg-brand px-5 font-medium text-brand-foreground [background-image:var(--brand-gradient,none)] hover:brightness-95"
         >
           <RefreshCwIcon className="size-4" aria-hidden="true" />
-          Try again
+          {stale ? "Reload the page" : "Try again"}
         </button>
         <Link href="/" className="inline-flex h-11 items-center rounded-[var(--button-radius)] border border-border px-5 font-medium hover:bg-accent">
           Back home

package/templates/app/components/account/sections.tsx

@@ -5,7 +5,7 @@ import { useRouter } from "next/navigation";
 import { renderSVG } from "uqr";
 import { CheckIcon, CopyIcon, FingerprintIcon, LaptopIcon, ShieldCheckIcon, Trash2Icon } from "lucide-react";
 import { AuthInput, AuthLabel, FormMessage, PrimaryButton, SecondaryButton, TextButton } from "@/components/auth/ui";
-import { PasswordField } from "@/components/auth/password-field";
+import { PasswordField, PasswordInput } from "@/components/auth/password-field";
 import { authErrorMessage } from "@/components/auth/sign-in-flow";
 import { PROVIDER_LABELS, ProviderIcon } from "@/components/auth/provider-icons";
 import { authClient } from "@/lib/auth-client";
@@ -50,7 +50,7 @@ function PasswordConfirm({ value, onChange, id }: { value: string; onChange: (va
   return (
     <div className="flex flex-col gap-2">
       <AuthLabel htmlFor={id}>Your password</AuthLabel>
-      <AuthInput id={id} type="password" autoComplete="current-password" value={value} onChange={(event) => onChange(event.target.value)} required />
+      <PasswordInput id={id} autoComplete="current-password" value={value} onChange={(event) => onChange(event.target.value)} required />
     </div>
   );
 }
@@ -459,6 +459,26 @@ function describeDevice(agent?: string | null): string {
   return system ? `${browser} on ${system}` : browser;
 }
 
+/**
+ * Where a session came from, in words rather than a number nobody can read.
+ *
+ * Better Auth records whatever address the request arrived from, and on a machine
+ * talking to itself that is the loopback — which IPv6 writes in full as
+ * 0000:0000:0000:0000:0000:0000:0000:0001. Printing that in a list headed "Sign out of
+ * devices you don't recognise" is worse than printing nothing: it is unreadable, it is
+ * identical on every row, and it looks like a bug. Say "this computer" instead, which
+ * is both true and useful.
+ */
+function describeOrigin(ip?: string | null): string | null {
+  if (!ip) return null;
+  const address = ip.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  // Every spelling of "no address" and "here": IPv4 and IPv6 loopback, the unspecified
+  // address, and the IPv4-mapped forms a dual-stack listener reports.
+  if (/^(::1?|0+(:0+)*|127(\.\d+){3}|::ffff:127(\.\d+){3}|localhost)$/.test(address)) return "this computer";
+  if (/^(10|127)\.|^192\.168\.|^172\.(1[6-9]|2\d|3[01])\.|^fe80:/.test(address)) return `${ip} (local network)`;
+  return ip;
+}
+
 export function Sessions() {
   const [list, setList] = useState<SessionRow[] | null>(null);
   const [current, setCurrent] = useState<string | null>(null);
@@ -488,7 +508,7 @@ export function Sessions() {
             <span className="flex-1">
               <span className="font-medium">{describeDevice(item.userAgent)}</span>
               <span className="block text-xs text-foreground-muted">
-                {item.ipAddress || "Unknown location"}
+                {describeOrigin(item.ipAddress) ?? "Unknown location"}
                 {item.updatedAt && `, last active ${new Date(item.updatedAt).toLocaleString()}`}
               </span>
             </span>