@flaredev/cli 0.2.0 → 0.4.0

package/dist/index.js

@@ -1,14 +1,17 @@
 // src/index.ts
-import pc19 from "picocolors";
+import pc23 from "picocolors";
 
 // src/cli.ts
 import { cac } from "cac";
-import { FLARE_VERSION as FLARE_VERSION2 } from "@flaredev/core";
+import pc22 from "picocolors";
+import * as prompts3 from "@clack/prompts";
+import { FLARE_VERSION as FLARE_VERSION3 } from "@flaredev/core";
 
 // src/commands/create.ts
 import { randomBytes } from "crypto";
-import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { appendFileSync, copyFileSync, existsSync as existsSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { basename, dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2 } from "path";
+import * as prompts from "@clack/prompts";
 import pc from "picocolors";
 import { FLARE_VERSION } from "@flaredev/core";
 
@@ -86,6 +89,11 @@ export const authConfig = {
   social: ${JSON.stringify(providers).replace(/","/g, '", "')} as SocialProvider[],
   /** Refuse password sign-in until the email address is verified. */
   requireEmailVerification: false,
+  /**
+   * Check new passwords against Have I Been Pwned's breach list. Only the first five
+   * characters of the password's hash are sent, and an outage lets the password through.
+   */
+  checkBreachedPasswords: true,
 };
 
 export type SocialProvider = "google" | "github" | "apple" | "microsoft";
@@ -185,16 +193,19 @@ import { fileURLToPath } from "url";
 var RENAMES = { _gitignore: ".gitignore" };
 function copyTemplate(from, to, tokens) {
   mkdirSync(to, { recursive: true });
+  let files = 0;
   for (const entry of readdirSync(from)) {
     const src = join(from, entry);
     const dest = join(to, RENAMES[entry] ?? entry);
     if (statSync(src).isDirectory()) {
-      copyTemplate(src, dest, tokens);
+      files += copyTemplate(src, dest, tokens);
       continue;
     }
     const content = readFileSync(src, "utf8").replace(/__([A-Z_]+)__/g, (match, key) => tokens[key] ?? match);
     writeFileSync(dest, content);
+    files++;
   }
+  return files;
 }
 function writeJson(path, value) {
   mkdirSync(dirname(path), { recursive: true });
@@ -234,11 +245,6 @@ function childEnv(env = process.env) {
   }
   return next;
 }
-function runQuiet(command, args, cwd) {
-  const env = childEnv();
-  const result = process.platform === "win32" ? spawnSync([command, ...args].join(" "), { cwd, env, shell: true, encoding: "utf8" }) : spawnSync(command, args, { cwd, env, encoding: "utf8" });
-  return { code: result.status ?? 1, output: `${result.stdout ?? ""}${result.stderr ?? ""}` };
-}
 function installArgs(pm) {
   if (pm === "npm") return ["install", "--no-audit", "--no-fund", "--loglevel=error"];
   return ["install"];
@@ -275,7 +281,7 @@ function createApp(target, options2 = {}) {
   const theme = parseTheme(options2.theme);
   const inWorkspace = findUp("pnpm-workspace.yaml", dirname2(dir)) !== void 0;
   const compatibilityDate = options2.compatibilityDate ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  copyTemplate(join2(templatesDir, "app"), dir, {
+  const files = copyTemplate(join2(templatesDir, "app"), dir, {
     APP_NAME: name,
     COMPAT_DATE: compatibilityDate,
     PM: packageManager,
@@ -310,42 +316,34 @@ ${devVarsEntries(authProviders)}`
   if (packageManager === "pnpm" && !inWorkspace) {
     writeFileSync2(join2(dir, "pnpm-workspace.yaml"), "allowBuilds:\n  esbuild: true\n  workerd: true\n  sharp: false\n");
   }
-  const log = options2.log ?? ((message) => console.log(message));
-  if (options2.install !== false) {
-    log(`${pc.green("\u2714")} Wrote the app to ${relative(process.cwd(), dir) || "."}`);
-    log(`${pc.cyan("\u25CF")} Installing dependencies with ${packageManager}. The first install downloads the Workers runtime and toolchain, so it can take a few minutes.
-`);
-    const started = Date.now();
-    const code = run(packageManager, installArgs(packageManager), dir);
-    if (code !== 0) throw new Error(`${packageManager} install failed (exit code ${code}).`);
-    log(`${pc.green("\u2714")} Installed dependencies ${pc.dim(`(${formatDuration(Date.now() - started)})`)}`);
-    const typegen = runQuiet(packageManager, ["run", "cf-typegen"], dir);
-    if (typegen.code !== 0) {
-      process.stderr.write(typegen.output);
-      throw new Error(`wrangler types failed (exit code ${typegen.code}).`);
-    }
-    log(`${pc.green("\u2714")} Generated types for the Cloudflare bindings`);
-  }
+  const pinned = flarePackageSpec("core", dir, packageManager).startsWith("^");
+  if (pinned) copyLockfile(packageManager, dir);
+  const log2 = options2.log ?? ((message) => console.log(message));
+  log2(`${pc.green("\u2714")} Wrote ${files} files to ${relative(process.cwd(), dir) || "."}`);
   return { dir, name, packageManager, inWorkspace };
 }
-function formatDuration(ms) {
-  const seconds = Math.round(ms / 1e3);
-  return seconds < 60 ? `${seconds}s` : `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
+function copyLockfile(packageManager, dir) {
+  const file = packageManager === "pnpm" ? "pnpm-lock.yaml" : packageManager === "yarn" ? "yarn.lock" : "package-lock.json";
+  if (!file) return false;
+  const source = join2(templatesDir, "locks", file);
+  if (!existsSync2(source)) return false;
+  copyFileSync(source, join2(dir, file));
+  return true;
 }
 function printNextSteps(result, installed) {
   const rel = relative(process.cwd(), result.dir) || ".";
   const pm = result.packageManager;
-  const step = (command, note) => `  ${command.padEnd(30)}${pc.dim(note)}`;
-  console.log(`
-${pc.green("\u2714")} Created ${pc.bold(result.name)}
-`);
-  console.log("Next steps:");
-  console.log(`  cd ${rel}`);
-  if (!installed) console.log(`  ${pm} install`);
-  console.log(step(`${pm} run dev`, "start it at http://localhost:3000"));
-  console.log(step("npx flare gen resource ...", "add your first resource"));
-  console.log(`
-Quickstart: ${pc.cyan("https://flare-docs.codetotech.com/start/quickstart/")}`);
+  const commands = [
+    [`cd ${rel}`, "your new app"],
+    ...installed ? [] : [[`${pm} install`, "dependencies first"]],
+    [`${pm} run dev`, "http://localhost:3000"],
+    ["npx flare gen resource Contact", "a table, API and admin screens"],
+    ["npx flare seed:resource Contact 1000", "fill it with sample rows"]
+  ];
+  const width = Math.max(...commands.map(([command]) => command.length)) + 2;
+  const steps = commands.map(([command, note2]) => `${pc.cyan(command.padEnd(width))}${pc.dim(note2)}`);
+  prompts.note(steps.join("\n"), "Next");
+  prompts.outro(`${pc.bold(result.name)} is ready ${pc.dim("\xB7")} ${pc.cyan("https://flare-docs.codetotech.com/start/quickstart/")}`);
 }
 
 // src/commands/gen-billing.ts
@@ -640,15 +638,21 @@ function renderFieldsBlock(fields) {
   return fields.map((f) => `${renderField(f)}
 `).join("");
 }
-function renderDescriptor(name, fields) {
+function renderDescriptor(name, fields, options2 = {}) {
   defineResource({ name, fields: Object.fromEntries(fields.map((f) => [f.key, toField(f)])) });
   const block = renderFieldsBlock(fields);
+  const heading = [
+    options2.icon ? `  icon: ${literal(options2.icon)},
+` : "",
+    options2.group ? `  group: ${literal(options2.group)},
+` : ""
+  ].join("");
   return joinMarkers({
     before: `import { defineResource, field } from "@flaredev/core";
 
 export default defineResource({
   name: ${literal(name)},
-  fields: {
+${heading}  fields: {
 `,
     block,
     after: `  },
@@ -1394,12 +1398,12 @@ function onPath() {
   const probe = spawnSync2(process.platform === "win32" ? "where" : "which", ["cloudflared"], { encoding: "utf8" });
   return probe.status === 0 ? probe.stdout.split(/\r?\n/)[0]?.trim() ?? null : null;
 }
-async function download(log) {
+async function download(log2) {
   const asset = releaseAsset();
   const dir = cacheDir();
   mkdirSync3(dir, { recursive: true });
   const target = join4(dir, binName);
-  log(pc2.dim(`Downloading cloudflared (one time) into ${dir}\u2026`));
+  log2(pc2.dim(`Downloading cloudflared (one time) into ${dir}\u2026`));
   const response = await fetch(`https://github.com/cloudflare/cloudflared/releases/latest/download/${asset}`);
   if (!response.ok) throw new Error(`Downloading cloudflared failed: HTTP ${response.status}.`);
   const bytes = Buffer.from(await response.arrayBuffer());
@@ -1416,12 +1420,12 @@ async function download(log) {
   if (process.platform !== "win32") chmodSync(target, 493);
   return target;
 }
-async function ensureCloudflared(log = console.log) {
+async function ensureCloudflared(log2 = console.log) {
   const found = onPath();
   if (found) return found;
   const cached = join4(cacheDir(), binName);
   if (existsSync5(cached)) return cached;
-  return download(log);
+  return download(log2);
 }
 async function openTunnel(localUrl, options2 = {}) {
   const bin = await ensureCloudflared(options2.log);
@@ -1575,9 +1579,9 @@ async function runDeploy(args, context3) {
   if (plan.passthroughOnly) return context3.deploy(plan.forwarded);
   const { appRoot, wranglerBin } = context3;
   const shellEnv = context3.env ?? process.env;
-  const log = context3.log ?? ((message) => console.log(message));
+  const log2 = context3.log ?? ((message) => console.log(message));
   const envArgs = plan.env ? ["--env", plan.env] : [];
-  const step = (message) => log(`
+  const step = (message) => log2(`
 ${pc3.bold(pc3.cyan("flare"))} ${message}`);
   const databases = plan.skipMigrations ? [] : readD1Databases(appRoot).filter((db) => existsSync7(join6(appRoot, db.migrations_dir ?? "migrations")));
   const migrateAfterDeploy = [];
@@ -1609,7 +1613,7 @@ ${info.output.trim()}`);
   const apiToken = shellEnv.FLARE_SECURITY_API_TOKEN;
   if (security && zoneId && apiToken) {
     step("Provisioning zone security rules");
-    await provisionZoneSecurity(appRoot, security, { zoneId, apiToken }, { log, fetch: context3.fetch });
+    await provisionZoneSecurity(appRoot, security, { zoneId, apiToken }, { log: log2, fetch: context3.fetch });
   } else if (security) {
     step("Zone security rules skipped (Worker-layer protection is on). To add them, deploy with FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN set.");
   }
@@ -1642,7 +1646,7 @@ ${put.output.trim()}`);
     const optional = existsSync7(examplePath) ? declaredSecretNames(readFileSync4(examplePath, "utf8")).filter((name) => !existing.has(name)) : [];
     if (optional.length > 0) {
       step("Optional secrets not set in production (features using them stay off):");
-      for (const name of optional) log(`  wrangler secret put ${name}${plan.env ? ` --env ${plan.env}` : ""}`);
+      for (const name of optional) log2(`  wrangler secret put ${name}${plan.env ? ` --env ${plan.env}` : ""}`);
     }
   }
   return 0;
@@ -1849,7 +1853,7 @@ function previousSnapshot(dir, migrationFile) {
 }
 
 // src/generator/plan.ts
-import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync4, readdirSync as readdirSync6, readFileSync as readFileSync7 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync4, readdirSync as readdirSync6, readFileSync as readFileSync7 } from "fs";
 import { dirname as dirname5, join as join10 } from "path";
 import pc5 from "picocolors";
 
@@ -1962,13 +1966,24 @@ function renderTableModule(entry, all) {
   const name = tableExport(resource);
   const columns = fields.map(([key, def]) => `    ${key}: ${columnExpression(key, def, resources, resource.name)},`);
   const extras = [];
+  const indexed = /* @__PURE__ */ new Set();
+  const addIndex = (key, column) => {
+    if (indexed.has(key)) return;
+    indexed.add(key);
+    extras.push(`    index(${q(`${resource.table}_${columnName(column)}_idx`)}).on(table.${key}),`);
+  };
   for (const [key, def] of fields) {
     if (def.kind === "enum") {
       const options2 = def.options.map(sqlString).join(", ");
       extras.push(`    check(${q(`${resource.table}_${columnName(key)}_check`)}, sql\`\${table.${key}} in (${options2})\`),`);
+      if (def.filterable !== false) addIndex(key, key);
     }
-    if (def.kind === "belongsTo") extras.push(`    index(${q(`${resource.table}_${columnName(key)}_idx`)}).on(table.${key}),`);
+    if (def.kind === "belongsTo") addIndex(key, key);
   }
+  const sortKey = resource.defaultSort.field;
+  if (sortKey === "createdAt" || sortKey === "updatedAt") addIndex(sortKey, sortKey === "createdAt" ? "created_at" : "updated_at");
+  else if (fields.some(([key]) => key === sortKey)) addIndex(sortKey, sortKey);
+  addIndex("createdAt", "created_at");
   const targets = [...new Set(fields.flatMap(([, def]) => def.kind === "belongsTo" ? [resources.get(def.target)] : []))].filter((target) => target.name !== resource.name).sort((a, b) => a.table.localeCompare(b.table));
   const coreImports = ["integer", "sqliteTable", "text"];
   if (fields.some(([, def]) => def.kind === "float")) coreImports.push("real");
@@ -2044,7 +2059,7 @@ var handlerImports = (entry) => [
   `import { createResourceHandlers } from "@flaredev/core/server";`,
   `import { getDb } from "@/db";`,
   `import { ${tableExport(entry.resource)} } from "@/db/schema";`,
-  `import { authorize } from "@/lib/api";`,
+  `import { authorize, currentUser } from "@/lib/api";`,
   `import { revalidateResource } from "@/lib/cache";`,
   `import ${resourceLocal(entry.stem)} from "@/resources/${entry.stem}.resource";`,
   "",
@@ -2053,6 +2068,7 @@ var handlerImports = (entry) => [
   `  table: ${tableExport(entry.resource)},`,
   `  getDb,`,
   `  authorize,`,
+  `  currentUser,`,
   `  onChange: revalidateResource,`,
   `});`,
   ""
@@ -2078,24 +2094,45 @@ var adminImports = (entry) => [
 function renderAdminListPage(entry) {
   const local = resourceLocal(entry.stem);
   return [
-    `import { ResourceTable } from "@/components/admin/resource-table";`,
-    `import type { SearchParams } from "@/components/admin/query";`,
+    `import { PageHeader } from "@/components/dashboard/page-header";`,
+    `import { ResourceChart } from "@/components/dashboard/resource-chart";`,
+    `import { ResourceStats } from "@/components/dashboard/resource-stats";`,
+    `import { ResourceTable } from "@/components/dashboard/resource-table";`,
+    `import type { SearchParams } from "@/components/dashboard/query";`,
     ...adminImports(entry),
     "",
+    `export const metadata = { title: ${local}.pluralLabel };`,
+    "",
     `export default async function ${entry.resource.name}ListPage({ searchParams }: { searchParams: Promise<SearchParams> }) {`,
     "  return (",
-    `    <div className="flex flex-col gap-6">`,
-    `      <h1 className="text-2xl font-semibold">{${local}.pluralLabel}</h1>`,
+    "    <>",
+    "      <PageHeader",
+    `        title={${local}.pluralLabel}`,
+    `        crumbs={[{ label: "Dashboard", href: "/dashboard" }, { label: ${local}.pluralLabel }]}`,
+    "      />",
+    `      <ResourceStats resource={${local}} />`,
+    `      <ResourceChart resource={${local}} />`,
     `      <ResourceTable resource={${local}} searchParams={await searchParams} />`,
-    "    </div>",
+    "    </>",
     "  );",
     "}",
     ""
   ].join("\n");
 }
+function renderAdminDetailPage(entry) {
+  return [
+    `import { RecordDetail } from "@/components/dashboard/record-detail";`,
+    ...adminImports(entry),
+    "",
+    `export default async function ${entry.resource.name}DetailPage({ params }: { params: Promise<{ id: string }> }) {`,
+    `  return <RecordDetail resource={${resourceLocal(entry.stem)}} id={(await params).id} />;`,
+    "}",
+    ""
+  ].join("\n");
+}
 function renderAdminNewPage(entry) {
   return [
-    `import { ResourceFormPage } from "@/components/admin/resource-form-page";`,
+    `import { ResourceFormPage } from "@/components/dashboard/resource-form-page";`,
     ...adminImports(entry),
     "",
     `export default function New${entry.resource.name}Page() {`,
@@ -2106,7 +2143,7 @@ function renderAdminNewPage(entry) {
 }
 function renderAdminEditPage(entry) {
   return [
-    `import { ResourceFormPage } from "@/components/admin/resource-form-page";`,
+    `import { ResourceFormPage } from "@/components/dashboard/resource-form-page";`,
     ...adminImports(entry),
     "",
     `export default async function Edit${entry.resource.name}Page({ params }: { params: Promise<{ id: string }> }) {`,
@@ -2174,9 +2211,10 @@ function resourceFiles(entry, all) {
     { path: `app/api/${resource.slug}/[id]/route.ts`, content: renderItemRoute(entry) },
     { path: `resources/${stem}.client.ts`, content: renderClient(entry) },
     { path: `resources/${stem}.validators.ts`, content: renderValidators(entry) },
-    { path: `app/admin/${resource.slug}/page.tsx`, content: renderAdminListPage(entry) },
-    { path: `app/admin/${resource.slug}/new/page.tsx`, content: renderAdminNewPage(entry) },
-    { path: `app/admin/${resource.slug}/[id]/edit/page.tsx`, content: renderAdminEditPage(entry) }
+    { path: `app/dashboard/${resource.slug}/page.tsx`, content: renderAdminListPage(entry) },
+    { path: `app/dashboard/${resource.slug}/[id]/page.tsx`, content: renderAdminDetailPage(entry) },
+    { path: `app/dashboard/${resource.slug}/new/page.tsx`, content: renderAdminNewPage(entry) },
+    { path: `app/dashboard/${resource.slug}/[id]/edit/page.tsx`, content: renderAdminEditPage(entry) }
   ];
 }
 
@@ -2236,8 +2274,8 @@ function findOrphans(appRoot, all) {
   for (const dir of list2("app/api", () => true)) {
     for (const file of [`${dir}/route.ts`, `${dir}/[id]/route.ts`]) if (existsSync11(join10(appRoot, file))) candidates.push(file);
   }
-  for (const dir of list2("app/admin", () => true)) {
-    for (const file of [`${dir}/page.tsx`, `${dir}/new/page.tsx`, `${dir}/[id]/edit/page.tsx`]) {
+  for (const dir of list2("app/dashboard", () => true)) {
+    for (const file of [`${dir}/page.tsx`, `${dir}/new/page.tsx`, `${dir}/[id]/page.tsx`, `${dir}/[id]/edit/page.tsx`]) {
       if (existsSync11(join10(appRoot, file))) candidates.push(file);
     }
   }
@@ -2248,20 +2286,20 @@ function findOrphans(appRoot, all) {
   }
   return orphans;
 }
-function ensureSupportFiles(appRoot, log) {
+function ensureSupportFiles(appRoot, log2) {
   for (const path of ["lib/api.ts", "lib/cache.ts"]) {
     const target = join10(appRoot, path);
     if (existsSync11(target)) continue;
     mkdirSync4(dirname5(target), { recursive: true });
-    copyFileSync(join10(templatesDir, "app", path), target);
-    log(`${pc5.green("create".padEnd(9))} ${path}`);
+    copyFileSync2(join10(templatesDir, "app", path), target);
+    log2(`${pc5.green("create".padEnd(9))} ${path}`);
   }
 }
-function logResults(results, log, options2 = {}) {
+function logResults(results, log2, options2 = {}) {
   for (const { path, outcome } of results) {
     if (outcome === "identical" && !options2.showIdentical) continue;
     const label = outcome === "create" ? pc5.green("create") : outcome === "update" ? pc5.yellow("update") : outcome === "identical" ? pc5.dim("identical") : pc5.red(outcome === "skipped-drift" ? "drift" : "hand-written");
-    log(`${label.padEnd(18)} ${path}`);
+    log2(`${label.padEnd(18)} ${path}`);
   }
 }
 
@@ -2296,20 +2334,20 @@ function addStripeDependency(appRoot) {
   writeJson(path, pkg);
   return true;
 }
-function writeBillingResource(appRoot, name, force, log) {
+function writeBillingResource(appRoot, name, force, log2) {
   const relative2 = descriptorPath(name);
   const path = join11(appRoot, relative2);
   if (!existsSync12(path)) {
     mkdirSync5(dirname6(path), { recursive: true });
     writeFileSync6(path, renderBillingDescriptor(name));
-    log(`${pc6.green("create".padEnd(9))} ${relative2}`);
+    log2(`${pc6.green("create".padEnd(9))} ${relative2}`);
     return;
   }
   const parts = splitMarkers(readFileSync8(path, "utf8"));
   if (!parts) throw new Error(`${relative2} has no generated fields block, so the billing fields can't be merged. Add them by hand: ${BILLING_RESOURCES[name]}`);
   const merged = mergeBillingFields(name, parts.block);
   if (!merged) {
-    log(`${pc6.dim("identical".padEnd(9))} ${relative2} (has every billing field)`);
+    log2(`${pc6.dim("identical".padEnd(9))} ${relative2} (has every billing field)`);
     return;
   }
   try {
@@ -2320,22 +2358,22 @@ function writeBillingResource(appRoot, name, force, log) {
     }
     throw error;
   }
-  log(`${pc6.yellow("update".padEnd(9))} ${relative2} (added billing fields, kept yours)`);
+  log2(`${pc6.yellow("update".padEnd(9))} ${relative2} (added billing fields, kept yours)`);
 }
 async function genBilling(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   validateBillingOptions(options2.provider, options2.mode);
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
-  for (const name of ["Plan", "Customer", "Purchase"]) writeBillingResource(appRoot, name, options2.force, log);
+  for (const name of ["Plan", "Customer", "Purchase"]) writeBillingResource(appRoot, name, options2.force, log2);
   for (const [name, roles] of Object.entries(BILLING_POLICIES)) {
     const relative2 = policyPath(name);
     if (existsSync12(join11(appRoot, relative2))) {
-      log(`${pc6.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+      log2(`${pc6.dim("kept".padEnd(9))} ${relative2} (already exists)`);
       continue;
     }
     mkdirSync5(join11(appRoot, "policies"), { recursive: true });
     writeFileSync6(join11(appRoot, relative2), renderPolicy(name, roles));
-    log(`${pc6.green("create".padEnd(9))} ${relative2}`);
+    log2(`${pc6.green("create".padEnd(9))} ${relative2}`);
   }
   const files = [];
   const appName = JSON.parse(readFileSync8(join11(appRoot, "package.json"), "utf8")).name ?? "app";
@@ -2343,7 +2381,7 @@ async function genBilling(options2 = {}) {
     const outcome = writeGenerated(join11(appRoot, path), content, { header: billingHeader(), force: options2.force });
     files.push({ path, status: "missing", outcome });
     const label = outcome === "create" ? pc6.green("create") : outcome === "update" ? pc6.yellow("update") : pc6.dim("identical");
-    log(`${label.padEnd(18)} ${path}`);
+    log2(`${label.padEnd(18)} ${path}`);
   }
   for (const path of RETIRED_FILES) {
     const absolute = join11(appRoot, path);
@@ -2352,15 +2390,15 @@ async function genBilling(options2 = {}) {
     const untouched = parts && parts.before.includes("flare gen billing") && !parts.after.trim() && parts.hash !== void 0 && hashBlock(parts.block) === parts.hash;
     if (untouched) {
       unlinkSync(absolute);
-      log(`${pc6.red("remove".padEnd(9))} ${path} (no longer generated)`);
+      log2(`${pc6.red("remove".padEnd(9))} ${path} (no longer generated)`);
     } else {
-      log(pc6.yellow(`${path} is no longer generated but has your changes; remove it when you're done with it.`));
+      log2(pc6.yellow(`${path} is no longer generated but has your changes; remove it when you're done with it.`));
     }
   }
-  if (appendVars(appRoot, ".dev.vars.example")) log(`${pc6.green("append".padEnd(9))} .dev.vars.example`);
-  if (appendVars(appRoot, ".dev.vars")) log(`${pc6.green("append".padEnd(9))} .dev.vars`);
+  if (appendVars(appRoot, ".dev.vars.example")) log2(`${pc6.green("append".padEnd(9))} .dev.vars.example`);
+  if (appendVars(appRoot, ".dev.vars")) log2(`${pc6.green("append".padEnd(9))} .dev.vars`);
   const addedStripe = addStripeDependency(appRoot);
-  if (addedStripe) log(`${pc6.yellow("update".padEnd(9))} package.json (stripe@${STRIPE_DEP})`);
+  if (addedStripe) log2(`${pc6.yellow("update".padEnd(9))} package.json (stripe@${STRIPE_DEP})`);
   if (!options2.skipInstall) {
     const pm = detectPackageManager();
     const code = run(pm, ["install"], appRoot);
@@ -2368,16 +2406,16 @@ async function genBilling(options2 = {}) {
     run(pm, ["run", "cf-typegen"], appRoot);
   }
   const all = await loadResources(appRoot);
-  ensureSupportFiles(appRoot, log);
-  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log);
+  ensureSupportFiles(appRoot, log2);
+  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log2);
   let migrations = [];
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, "billing");
     migrations = result.files;
-    for (const file of migrations) log(`${pc6.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc6.dim(`repaired  ${repair}`));
+    for (const file of migrations) log2(`${pc6.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log2(pc6.dim(`repaired  ${repair}`));
   }
-  log(
+  log2(
     [
       "",
       `Next:`,
@@ -2519,7 +2557,7 @@ var renderSecurityActions = () => `"use server";
 import { revalidatePath } from "next/cache";
 import { can } from "@flaredev/core";
 import { isIp } from "@flaredev/core/security";
-import { adminSession, policyFor } from "@/lib/admin";
+import { dashboardSession, policyFor } from "@/lib/dashboard";
 import { logSecurityEvent, security } from "@/lib/security";
 
 /** On failure the submitted values come back, so the form (which React resets) keeps them. */
@@ -2528,7 +2566,7 @@ export type BanResult = { ok: true } | { ok: false; error: string; ip?: string;
 const DURATIONS: Record<string, number | null> = { "1h": 3600, "24h": 86_400, "7d": 604_800, permanent: null };
 
 async function adminOnly(): Promise<{ email: string } | { error: string }> {
-  const { session, role } = await adminSession();
+  const { session, role } = await dashboardSession();
   if (!session) return { error: "Sign in required." };
   if (!can(policyFor("SecurityEvent"), role, "create")) return { error: "Only admins can ban or unban." };
   return { email: session.user.email };
@@ -2549,8 +2587,8 @@ export async function banAction(_previous: BanResult | null, form: FormData): Pr
   } catch (error) {
     return { ok: false, error: \`The ban didn't reach every layer: \${error instanceof Error ? error.message : String(error)}\`, ip, reason };
   }
-  await logSecurityEvent({ kind: "manual-ban", severity: "medium", ip, path: "/admin/security", userAgent: null, count: 0, banned: true, detail: \`\${reason} (by \${admin.email})\` });
-  revalidatePath("/admin/security");
+  await logSecurityEvent({ kind: "manual-ban", severity: "medium", ip, path: "/dashboard/security", userAgent: null, count: 0, banned: true, detail: \`\${reason} (by \${admin.email})\` });
+  revalidatePath("/dashboard/security");
   return { ok: true };
 }
 
@@ -2563,8 +2601,8 @@ export async function unbanAction(ip: string): Promise<BanResult> {
   } catch (error) {
     return { ok: false, error: \`The unban didn't reach every layer: \${error instanceof Error ? error.message : String(error)}\` };
   }
-  await logSecurityEvent({ kind: "manual-unban", severity: "low", ip, path: "/admin/security", userAgent: null, count: 0, banned: false, detail: \`by \${admin.email}\` });
-  revalidatePath("/admin/security");
+  await logSecurityEvent({ kind: "manual-unban", severity: "low", ip, path: "/dashboard/security", userAgent: null, count: 0, banned: false, detail: \`by \${admin.email}\` });
+  revalidatePath("/dashboard/security");
   return { ok: true };
 }
 `;
@@ -2657,7 +2695,7 @@ import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/com
 import { Separator } from "@/components/ui/separator";
 import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
-import { adminStore, policyFor, requireAdmin } from "@/lib/admin";
+import { dashboardStore, policyFor, requireDashboard } from "@/lib/dashboard";
 import { security, zoneClient } from "@/lib/security";
 import { BanForm, UnbanButton } from "./ban-controls";
 
@@ -2666,7 +2704,7 @@ const when = (value: string | number | Date | null) =>
   value ? new Intl.DateTimeFormat(undefined, { dateStyle: "medium", timeStyle: "short" }).format(new Date(value)) : "Until unbanned";
 
 export default async function SecurityPage() {
-  const { role } = await requireAdmin("/admin/security");
+  const { role } = await requireDashboard("/dashboard/security");
   if (!can(policyFor("SecurityEvent"), role, "read")) {
     return (
       <Alert>
@@ -2679,7 +2717,7 @@ export default async function SecurityPage() {
 
   const [bans, events, edge] = await Promise.all([
     security().bans(),
-    adminStore("SecurityEvent").list(new URLSearchParams({ sort: "-createdAt", perPage: "20" })),
+    dashboardStore("SecurityEvent").list(new URLSearchParams({ sort: "-createdAt", perPage: "20" })),
     zone
       ? Promise.all([zone.bans(), zone.firewallEvents(new Date(Date.now() - 24 * 3600 * 1000))]).then(
           ([zoneBans, firewall]) => ({ ok: true as const, zoneBans, firewall }),
@@ -2790,7 +2828,7 @@ export default async function SecurityPage() {
         <CardHeader>
           <CardTitle>Recent events</CardTitle>
           <CardDescription>
-            Detectors that tripped, and manual bans. <Link href="/admin/security-events" className="underline underline-offset-4">All events</Link>
+            Detectors that tripped, and manual bans. <Link href="/dashboard/security-events" className="underline underline-offset-4">All events</Link>
           </CardDescription>
         </CardHeader>
         <CardContent>
@@ -2900,43 +2938,43 @@ function addSecurityBindings(source) {
   }
   return { text, added };
 }
-var renderAdminNavBlock = () => `export interface AdminLink {
+var renderAdminNavBlock = () => `export interface DashboardLink {
   label: string;
   href: string;
-  /** A resource icon name, e.g. "shield" (see components/admin/resource-icon.tsx). */
+  /** A resource icon name, e.g. "shield" (see components/dashboard/resource-icon.tsx). */
   icon: string;
 }
 
-export const generatedAdminLinks: AdminLink[] = [{ label: "Security", href: "/admin/security", icon: "shield" }];
+export const generatedDashboardLinks: DashboardLink[] = [{ label: "Security", href: "/dashboard/security", icon: "shield" }];
 `;
 
 // src/commands/gen-security.ts
 function securityFiles(appName) {
   return [
     { path: "lib/security.ts", content: renderLibSecurity(appName) },
-    { path: "app/admin/security/page.tsx", content: renderSecurityPage() },
-    { path: "app/admin/security/actions.ts", content: renderSecurityActions() },
-    { path: "app/admin/security/ban-controls.tsx", content: renderBanControls() }
+    { path: "app/dashboard/security/page.tsx", content: renderSecurityPage() },
+    { path: "app/dashboard/security/actions.ts", content: renderSecurityActions() },
+    { path: "app/dashboard/security/ban-controls.tsx", content: renderBanControls() }
   ];
 }
 var PASS_THROUGH_HEADER = /^\/\/ Request protection for worker\/index\.ts\.[\s\S]*?\n(?=\/\/ generated:start)/;
-function writeOnce(appRoot, relative2, content, log) {
+function writeOnce(appRoot, relative2, content, log2) {
   const path = join12(appRoot, relative2);
   if (existsSync13(path)) {
-    log(`${pc7.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+    log2(`${pc7.dim("kept".padEnd(9))} ${relative2} (already exists)`);
     return;
   }
   mkdirSync6(dirname7(path), { recursive: true });
   writeFileSync7(path, content);
-  log(`${pc7.green("create".padEnd(9))} ${relative2}`);
+  log2(`${pc7.green("create".padEnd(9))} ${relative2}`);
 }
 async function genSecurity(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const appName = JSON.parse(readFileSync9(join12(appRoot, "package.json"), "utf8")).name ?? "app";
-  writeOnce(appRoot, "security.config.ts", renderSecurityConfig(), log);
-  writeOnce(appRoot, descriptorPath("SecurityEvent"), renderSecurityDescriptor(), log);
-  writeOnce(appRoot, policyPath("SecurityEvent"), renderPolicy("SecurityEvent", SECURITY_EVENT_POLICY), log);
+  writeOnce(appRoot, "security.config.ts", renderSecurityConfig(), log2);
+  writeOnce(appRoot, descriptorPath("SecurityEvent"), renderSecurityDescriptor(), log2);
+  writeOnce(appRoot, policyPath("SecurityEvent"), renderPolicy("SecurityEvent", SECURITY_EVENT_POLICY), log2);
   const files = [];
   const write = (path, content, header) => {
     const absolute = join12(appRoot, path);
@@ -2947,12 +2985,12 @@ async function genSecurity(options2 = {}) {
     const outcome = writeGenerated(absolute, content, { header, force: options2.force });
     files.push({ path, status: "missing", outcome });
     const label = outcome === "create" ? pc7.green("create") : outcome === "update" ? pc7.yellow("update") : pc7.dim("identical");
-    log(`${label.padEnd(18)} ${path}`);
+    log2(`${label.padEnd(18)} ${path}`);
   };
   for (const { path, content } of securityFiles(appName)) write(path, content, securityHeader());
-  const navPath = join12(appRoot, "lib/admin-nav.ts");
-  if (existsSync13(navPath) && splitMarkers(readFileSync9(navPath, "utf8"))) write("lib/admin-nav.ts", renderAdminNavBlock());
-  else log(pc7.yellow(`lib/admin-nav.ts not found: link to /admin/security from your admin sidebar yourself.`));
+  const navPath = join12(appRoot, "lib/dashboard-nav.ts");
+  if (existsSync13(navPath) && splitMarkers(readFileSync9(navPath, "utf8"))) write("lib/dashboard-nav.ts", renderAdminNavBlock());
+  else log2(pc7.yellow(`lib/dashboard-nav.ts not found: link to /dashboard/security from your dashboard sidebar yourself.`));
   const wranglerPath = join12(appRoot, "wrangler.jsonc");
   let bindings = [];
   if (existsSync13(wranglerPath)) {
@@ -2960,27 +2998,27 @@ async function genSecurity(options2 = {}) {
     bindings = added;
     if (added.length) {
       writeFileSync7(wranglerPath, text);
-      for (const line of added) log(`${pc7.yellow("update".padEnd(9))} wrangler.jsonc (${line})`);
+      for (const line of added) log2(`${pc7.yellow("update".padEnd(9))} wrangler.jsonc (${line})`);
     }
   } else {
-    log(pc7.yellow("wrangler.jsonc not found: add the FLARE_SECURITY, FLARE_SECURITY_MONITOR and FLARE_RATE_LIMIT bindings yourself."));
+    log2(pc7.yellow("wrangler.jsonc not found: add the FLARE_SECURITY, FLARE_SECURITY_MONITOR and FLARE_RATE_LIMIT bindings yourself."));
   }
   const all = await loadResources(appRoot);
-  ensureSupportFiles(appRoot, log);
-  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log);
+  ensureSupportFiles(appRoot, log2);
+  logResults(applyPlan(appRoot, planFiles(all, await loadPolicies(appRoot)), { force: options2.force }), log2);
   let migrations = [];
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, "security");
     migrations = result.files;
-    for (const file of migrations) log(`${pc7.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc7.dim(`repaired  ${repair}`));
+    for (const file of migrations) log2(`${pc7.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log2(pc7.dim(`repaired  ${repair}`));
   }
-  log(
+  log2(
     [
       "",
       `Next:`,
       `  1. ${pc7.bold("flare migrate")} to create the security_events table.`,
-      `  2. ${pc7.bold("flare dev")}, then open ${pc7.bold("/admin/security")}. Tune detectors in security.config.ts.`,
+      `  2. ${pc7.bold("flare dev")}, then open ${pc7.bold("/dashboard/security")}. Tune detectors in security.config.ts.`,
       `  3. Optional zone layer: deploy with FLARE_SECURITY_ZONE_ID and FLARE_SECURITY_API_TOKEN set (a token scoped to that`,
       `     one zone with Zone WAF Edit, Firewall Services Edit, Analytics Read, Zone Read). ${pc7.bold("flare deploy")} pushes the`,
       `     zone rules and uploads both as secrets.`
@@ -2994,7 +3032,7 @@ import { existsSync as existsSync14, readFileSync as readFileSync10, writeFileSy
 import { join as join13 } from "path";
 import pc8 from "picocolors";
 var THEME_LINE = /theme: "([a-z]+)" as ThemeName,/;
-function setTheme(name, cwd = process.cwd(), log = console.log) {
+function setTheme(name, cwd = process.cwd(), log2 = console.log) {
   const appRoot = findAppRoot(cwd);
   const path = join13(appRoot, "lib/site.ts");
   if (!existsSync14(path)) throw new Error("lib/site.ts not found: this app was created before themes. Add it from the Flare app template.");
@@ -3002,34 +3040,50 @@ function setTheme(name, cwd = process.cwd(), log = console.log) {
   const current = THEME_LINE.exec(source)?.[1];
   if (!name) {
     for (const [theme2, description] of Object.entries(THEMES)) {
-      log(`${theme2 === current ? pc8.green("\u25CF") : " "} ${theme2.padEnd(8)} ${pc8.dim(description)}`);
+      log2(`${theme2 === current ? pc8.green("\u25CF") : " "} ${theme2.padEnd(8)} ${pc8.dim(description)}`);
     }
-    log(pc8.dim("\nSwitch with `flare theme <name>`. FLARE_THEME in .env overrides it for a build."));
+    log2(pc8.dim("\nSwitch with `flare theme <name>`. FLARE_THEME in .env overrides it for a build."));
     return;
   }
   const theme = parseTheme(name);
   if (!current) throw new Error('lib/site.ts has no `theme: "\u2026" as ThemeName,` line to change.');
   writeFileSync8(path, source.replace(THEME_LINE, `theme: "${theme}" as ThemeName,`));
-  log(`${pc8.green("\u2714")} Theme is now ${pc8.bold(theme)}. Restart \`flare dev\` (or rebuild) to see it.`);
+  log2(`${pc8.green("\u2714")} Theme is now ${pc8.bold(theme)}. Restart \`flare dev\` (or rebuild) to see it.`);
 }
 
 // src/commands/create-prompts.ts
-import * as prompts from "@clack/prompts";
+import * as prompts2 from "@clack/prompts";
+import pc9 from "picocolors";
+import { FLARE_VERSION as FLARE_VERSION2 } from "@flaredev/core";
 var canPrompt = (yes) => !yes && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+var AUTH_HINTS = {
+  "magic-link": "a sign-in link by email",
+  "email-otp": "a 6-digit sign-in code by email",
+  passkeys: "Face ID, Touch ID, Windows Hello",
+  "2fa-app": "authenticator app, with backup codes",
+  "2fa-email": "a code by email as the second step"
+};
+var AUTH_LABELS = {
+  "magic-link": "Magic links",
+  "email-otp": "Email codes",
+  passkeys: "Passkeys",
+  "2fa-app": "Two-factor: authenticator app",
+  "2fa-email": "Two-factor: email code"
+};
 function stopIfCancelled(value) {
-  if (prompts.isCancel(value)) {
-    prompts.cancel("Cancelled: nothing was created.");
+  if (prompts2.isCancel(value)) {
+    prompts2.cancel("Cancelled: nothing was created.");
     process.exit(1);
   }
   return value;
 }
-async function askCreateQuestions(given) {
-  prompts.intro("Let's set up your Flare app");
+async function askCreateQuestions(given, appName) {
+  prompts2.intro(`${pc9.bgRed(pc9.white(" Flare "))} ${pc9.dim(`v${FLARE_VERSION2}`)}${appName ? ` ${pc9.dim("\xB7")} ${pc9.bold(appName)}` : ""}`);
   const answers = { ...given };
   if (given.theme === void 0) {
     answers.theme = stopIfCancelled(
-      await prompts.select({
-        message: "Pick a look (change it later in lib/site.ts or with FLARE_THEME)",
+      await prompts2.select({
+        message: "Pick a look",
         initialValue: "default",
         options: Object.entries(THEMES).map(([value, hint]) => ({ value, label: value, hint }))
       })
@@ -3037,19 +3091,23 @@ async function askCreateQuestions(given) {
   }
   if (given.auth === void 0) {
     const methods = stopIfCancelled(
-      await prompts.multiselect({
-        message: "How can people sign in? Email and password is always on. (space to toggle)",
+      await prompts2.multiselect({
+        message: `How can people sign in? ${pc9.dim("Email and password is always on")}`,
         initialValues: DEFAULT_AUTH_METHODS,
         required: false,
-        options: Object.entries(AUTH_METHODS).map(([value, label]) => ({ value, label }))
+        options: Object.keys(AUTH_METHODS).map((value) => ({
+          value,
+          label: AUTH_LABELS[value],
+          hint: AUTH_HINTS[value]
+        }))
       })
     );
     answers.auth = methods.length ? methods.join(",") : "none";
   }
   if (given.authProviders === void 0) {
     const providers = stopIfCancelled(
-      await prompts.multiselect({
-        message: "Social sign-in? Each needs its own credentials later. (space to toggle, enter to skip)",
+      await prompts2.multiselect({
+        message: `Social sign-in? ${pc9.dim("each needs its own credentials later")}`,
         initialValues: [],
         required: false,
         options: Object.entries(AUTH_PROVIDERS).map(([value, { label }]) => ({ value, label }))
@@ -3057,7 +3115,6 @@ async function askCreateQuestions(given) {
     );
     answers.authProviders = providers.join(",");
   }
-  prompts.outro("Creating your app");
   return answers;
 }
 
@@ -3065,8 +3122,8 @@ async function askCreateQuestions(given) {
 import { existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname8, join as join14 } from "path";
 import { camelCase as camelCase4, defineResource as defineResource2, relationGraph as relationGraph2 } from "@flaredev/core";
-import pc9 from "picocolors";
-function validateFields(name, fields, others, log) {
+import pc10 from "picocolors";
+function validateFields(name, fields, others, log2) {
   const known = /* @__PURE__ */ new Set([name, ...others.map((resource) => resource.name)]);
   for (const field of fields) {
     if (field.kind === "belongsTo" && !known.has(field.target)) {
@@ -3076,11 +3133,11 @@ function validateFields(name, fields, others, log) {
   const candidate = defineResource2({ name, fields: Object.fromEntries(fields.map((f) => [f.key, toField(f)])) });
   const graph = relationGraph2([...others, candidate]);
   for (const pending of graph.pending.filter((p) => p.resource === name)) {
-    log(pc9.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
+    log2(pc10.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
   }
 }
 async function genResource(rawName, options2) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = resourceName(rawName);
   const relativePath = descriptorPath(name);
@@ -3093,15 +3150,15 @@ async function genResource(rawName, options2) {
   const others = existing.filter(({ resource }) => resource.name !== name).map(({ resource }) => resource);
   if (options2.fields) {
     const fields = parseFields(options2.fields);
-    validateFields(name, fields, others, log);
+    validateFields(name, fields, others, log2);
     if (!exists) {
       mkdirSync7(dirname8(path), { recursive: true });
-      writeFileSync9(path, renderDescriptor(name, fields));
-      log(`${pc9.green("create".padEnd(9))} ${relativePath}`);
+      writeFileSync9(path, renderDescriptor(name, fields, { group: options2.group, icon: options2.icon }));
+      log2(`${pc10.green("create".padEnd(9))} ${relativePath}`);
     } else {
       try {
         const outcome = writeGenerated(path, renderFieldsBlock(fields), { force: options2.force });
-        log(`${(outcome === "identical" ? pc9.dim : pc9.yellow)(outcome.padEnd(9))} ${relativePath}`);
+        log2(`${(outcome === "identical" ? pc10.dim : pc10.yellow)(outcome.padEnd(9))} ${relativePath}`);
       } catch (error) {
         if (error instanceof DriftError) {
           throw new Error(
@@ -3117,9 +3174,9 @@ async function genResource(rawName, options2) {
   try {
     const all = await loadResources(appRoot);
     table = all.find(({ resource }) => resource.name === name).resource.table;
-    ensureSupportFiles(appRoot, log);
+    ensureSupportFiles(appRoot, log2);
     written = applyPlan(appRoot, planFiles(all), { force: options2.force });
-    logResults(written, log);
+    logResults(written, log2);
   } catch (error) {
     const hint = exists ? "" : `
 (${relativePath} was written; fix it and run \`flare sync-types\`.)`;
@@ -3127,75 +3184,138 @@ async function genResource(rawName, options2) {
   }
   const skipped = written.filter((r) => r.outcome.startsWith("skipped"));
   if (skipped.length) {
-    log(pc9.yellow(`
+    log2(pc10.yellow(`
 Skipped ${skipped.length} hand-edited file(s); run \`flare sync-types\` for details.`));
   }
   let migrations = [];
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, `${exists ? "update" : "create"}_${table}`);
     migrations = result.files;
-    for (const file of migrations) log(`${pc9.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc9.dim(`repaired  ${repair}`));
-    if (migrations.length) log(`
-Next: ${pc9.bold("flare migrate")} to apply it locally.`);
-    else if (exists) log(pc9.dim("\nNo table changes, so no migration."));
+    for (const file of migrations) log2(`${pc10.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log2(pc10.dim(`repaired  ${repair}`));
+    if (migrations.length) log2(`
+Next: ${pc10.bold("flare migrate")} to apply it locally.`);
+    else if (exists) log2(pc10.dim("\nNo table changes, so no migration."));
   }
   const descriptor = { path: relativePath, status: exists ? "outdated" : "missing", outcome: exists ? "update" : "create" };
   return { name, mode: exists ? "update" : "create", written: [descriptor, ...written], migrations };
 }
 
-// src/commands/gen-migration.ts
+// src/commands/gen-endpoint.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "fs";
-import { basename as basename2, join as join15 } from "path";
+import { join as join15 } from "path";
+import { kebabCase as kebabCase3, pascalCase as pascalCase2 } from "@flaredev/core";
+import pc11 from "picocolors";
+var METHODS = ["GET", "POST", "PATCH", "PUT", "DELETE"];
+var ACTIONS = ["read", "create", "update", "delete"];
+async function genEndpoint(resourceName2, rawName, options2 = {}) {
+  const log2 = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const method = (options2.method ?? "GET").toUpperCase();
+  if (!METHODS.includes(method)) throw new Error(`Unknown method "${method}". Use one of ${METHODS.join(", ")}.`);
+  const name = kebabCase3(rawName);
+  if (!name) throw new Error(`Invalid endpoint name "${rawName}".`);
+  const resources = await loadResources(appRoot);
+  const wanted = pascalCase2(resourceName2);
+  const entry = resources.find(({ resource: resource2 }) => resource2.name === wanted);
+  if (!entry) {
+    throw new Error(`No resource "${resourceName2}". Available: ${resources.map(({ resource: resource2 }) => resource2.name).join(", ") || "none"}.`);
+  }
+  const action = options2.action ?? (method === "GET" ? "read" : "update");
+  if (!ACTIONS.includes(action)) throw new Error(`Unknown action "${action}". Use one of ${ACTIONS.join(", ")}.`);
+  const { resource, stem } = entry;
+  const relative2 = options2.record ? `app/api/${resource.slug}/[id]/${name}/route.ts` : `app/api/${resource.slug}/${name}/route.ts`;
+  const path = join15(appRoot, relative2);
+  if (existsSync16(path)) throw new Error(`${relative2} already exists.`);
+  mkdirSync8(join15(path, ".."), { recursive: true });
+  const route = options2.record ? `/api/${resource.slug}/[id]/${name}` : `/api/${resource.slug}/${name}`;
+  writeFileSync10(path, renderEndpoint({ resource: resource.name, stem, method, action, record: Boolean(options2.record), name, route }));
+  log2(`${pc11.green("create".padEnd(9))} ${relative2}`);
+  log2(`
+It's an ordinary route handler \u2014 edit it freely; regeneration leaves it alone.`);
+  return relative2;
+}
+function renderEndpoint({ resource, stem, method, action, record, route }) {
+  const body = method === "GET" || method === "DELETE" ? "" : "  const body = (await request.json()) as Record<string, unknown>;\n";
+  const params = record ? ", { params }: { params: Promise<{ id: string }> }" : "";
+  const id = record ? "  const { id } = await params;\n" : "";
+  return `import { authorize, currentUser } from "@/lib/api";
+import { dashboardStore } from "@/lib/dashboard";
+import ${stem.replace(/-([a-z])/g, (_match, letter) => letter.toUpperCase())}Resource from "@/resources/${stem}.resource";
+
+/**
+ * ${method} ${route}
+ *
+ * Yours to change. The session and the policy are checked the same way the generated
+ * CRUD routes check them, and \`store\` is the same store they use \u2014 so hooks, validation
+ * and cache invalidation all still apply.
+ */
+export async function ${method}(request: Request${params}) {
+${id}  const denied = await authorize({ request, resource: ${stem.replace(/-([a-z])/g, (_match, letter) => letter.toUpperCase())}Resource, action: "${action}" });
+  if (denied) return denied;
+
+  const user = await currentUser();
+  const store = dashboardStore("${resource}");
+${body}
+  // Your logic here. \`store.list\`, \`store.get\`, \`store.create\`, \`store.update\` and
+  // \`store.delete\` are available, or reach for Drizzle directly with \`getDb()\`.
+  return Response.json({ ok: true, ${record ? "id, " : ""}${method === "GET" || method === "DELETE" ? "" : "received: body, "}user: user?.email ?? null });
+}
+`;
+}
+
+// src/commands/gen-migration.ts
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "fs";
+import { basename as basename2, join as join16 } from "path";
 import { snakeCase } from "@flaredev/core";
-import pc10 from "picocolors";
+import pc12 from "picocolors";
 var DOWN_TEMPLATE = (up) => `-- Rollback for ${up}, run by \`flare migrate:rollback\`.
 -- Write SQL that undoes the up migration, e.g.:
 --   DROP INDEX IF EXISTS \`contacts_phone_idx\`;
 -- While this file has no statements, rollback of ${up} is refused.
 `;
 async function genMigration(rawName, options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = snakeCase(rawName);
   if (!name) throw new Error(`Invalid migration name "${rawName}". Use letters, digits, and underscores.`);
   const { files, repairs } = await generateSchemaMigration(appRoot, name, { custom: !options2.fromSchema });
   if (files.length === 0) {
-    log(options2.fromSchema ? "No schema changes, so no migration was created." : "drizzle-kit didn't create a migration.");
+    log2(options2.fromSchema ? "No schema changes, so no migration was created." : "drizzle-kit didn't create a migration.");
     return [];
   }
-  for (const file of files) log(`${pc10.green("create".padEnd(9))} ${file}`);
-  for (const repair of repairs) log(pc10.dim(`repaired  ${repair}`));
+  for (const file of files) log2(`${pc12.green("create".padEnd(9))} ${file}`);
+  for (const repair of repairs) log2(pc12.dim(`repaired  ${repair}`));
   if (!options2.fromSchema) {
-    const downDir = join15(appRoot, "migrations", "down");
-    mkdirSync8(downDir, { recursive: true });
+    const downDir = join16(appRoot, "migrations", "down");
+    mkdirSync9(downDir, { recursive: true });
     for (const file of files) {
-      const down = join15(downDir, basename2(file));
-      if (existsSync16(down)) continue;
-      writeFileSync10(down, DOWN_TEMPLATE(basename2(file)));
-      log(`${pc10.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
+      const down = join16(downDir, basename2(file));
+      if (existsSync17(down)) continue;
+      writeFileSync11(down, DOWN_TEMPLATE(basename2(file)));
+      log2(`${pc12.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
     }
-    log(`
-Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc10.bold("flare migrate")}.`);
+    log2(`
+Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc12.bold("flare migrate")}.`);
   } else {
-    log(`
-Next: ${pc10.bold("flare migrate")}.`);
+    log2(`
+Next: ${pc12.bold("flare migrate")}.`);
   }
   return files;
 }
 
 // src/commands/gen-policy.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname9, join as join16 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync10, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname9, join as join17 } from "path";
 import { definePolicy } from "@flaredev/core";
-import pc11 from "picocolors";
+import pc13 from "picocolors";
 function parseRoles(input, what = "--roles") {
   const roles = (input ?? "").split(",").map((role) => role.trim()).filter(Boolean);
   if (roles.length === 0) throw new Error(`${what} is required, e.g. ${what} admin,staff`);
   return [...new Set(roles)];
 }
 async function genPolicy(rawName, options2) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = resourceName(rawName);
   const resources = await loadResources(appRoot);
@@ -3204,8 +3324,8 @@ async function genPolicy(rawName, options2) {
     throw new Error(`No resource "${name}". Generate it first. Known resources: ${known}.`);
   }
   const relative2 = policyPath(name);
-  const path = join16(appRoot, relative2);
-  const exists = existsSync17(path);
+  const path = join17(appRoot, relative2);
+  const exists = existsSync18(path);
   let roles;
   let deleteRoles;
   if (options2.roles || !exists) {
@@ -3216,13 +3336,13 @@ async function genPolicy(rawName, options2) {
   if (roles && deleteRoles) {
     const block = renderPolicyBlock({ read: roles, create: roles, update: roles, delete: deleteRoles });
     if (!exists) {
-      mkdirSync9(dirname9(path), { recursive: true });
-      writeFileSync11(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
-      log(`${pc11.green("create".padEnd(9))} ${relative2}`);
+      mkdirSync10(dirname9(path), { recursive: true });
+      writeFileSync12(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
+      log2(`${pc13.green("create".padEnd(9))} ${relative2}`);
     } else {
       try {
         const outcome = writeGenerated(path, block, { force: options2.force });
-        log(`${(outcome === "identical" ? pc11.dim : pc11.yellow)(outcome.padEnd(9))} ${relative2}`);
+        log2(`${(outcome === "identical" ? pc13.dim : pc13.yellow)(outcome.padEnd(9))} ${relative2}`);
       } catch (error) {
         if (error instanceof DriftError) {
           throw new Error(`The roles in ${relative2} were edited by hand, so --roles won't overwrite them. Edit the file directly, or pass --force.`);
@@ -3232,17 +3352,17 @@ async function genPolicy(rawName, options2) {
     }
   }
   const policies = await loadPolicies(appRoot);
-  logResults(applyPlan(appRoot, planFiles(resources, policies)), log);
-  log(`
-${pc11.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
+  logResults(applyPlan(appRoot, planFiles(resources, policies)), log2);
+  log2(`
+${pc13.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
   return { name, path: relative2 };
 }
 
 // src/commands/migrate.ts
-import { existsSync as existsSync18, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync19, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync2, writeFileSync as writeFileSync13 } from "fs";
 import { tmpdir } from "os";
-import { join as join17 } from "path";
-import pc12 from "picocolors";
+import { join as join18 } from "path";
+import pc14 from "picocolors";
 
 // src/generator/down.ts
 var IDENT = '(`[^`]+`|"[^"]+"|\\[[^\\]]+\\]|[A-Za-z_][\\w$]*)';
@@ -3358,18 +3478,18 @@ ${result.output.trim()}`);
 async function rollback(options2 = {}) {
   const steps = options2.steps ?? 1;
   if (!Number.isInteger(steps) || steps < 1) throw new Error("--steps must be a positive integer.");
-  const { appRoot, db, target, where, wrangler, log } = context(options2);
-  const migrationsDir = join17(appRoot, db.migrations_dir ?? "migrations");
+  const { appRoot, db, target, where, wrangler, log: log2 } = context(options2);
+  const migrationsDir = join18(appRoot, db.migrations_dir ?? "migrations");
   const applied = await appliedMigrations(options2, steps);
   if (applied.length === 0) {
-    log("Nothing to roll back.");
+    log2("Nothing to roll back.");
     return 0;
   }
   const plan = [];
   for (const { name } of applied) {
     if (!/^[\w.-]+\.sql$/.test(name)) throw new Error(`Unexpected migration name "${name}" in d1_migrations.`);
-    const handWritten = join17(migrationsDir, "down", name);
-    if (existsSync18(handWritten)) {
+    const handWritten = join18(migrationsDir, "down", name);
+    if (existsSync19(handWritten)) {
       const sql2 = readFileSync11(handWritten, "utf8");
       if (splitStatements(sql2).length === 0) {
         throw new Error(`Can't roll back ${name}: migrations/down/${name} has no SQL statements yet. Write the rollback SQL, then run the rollback again. Nothing was changed.`);
@@ -3377,8 +3497,8 @@ async function rollback(options2 = {}) {
       plan.push({ name, sql: sql2, source: `migrations/down/${name}` });
       continue;
     }
-    const upPath = join17(migrationsDir, name);
-    if (!existsSync18(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
+    const upPath = join18(migrationsDir, name);
+    if (!existsSync19(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
     const down = deriveDown(readFileSync11(upPath, "utf8"));
     if (!down.reversible) {
       throw new Error(
@@ -3388,37 +3508,37 @@ Write the reverse SQL to migrations/down/${name} and run the rollback again. Not
     }
     plan.push({ name, sql: down.sql, source: "derived" });
   }
-  log(`${pc12.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
+  log2(`${pc14.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
   for (const step of plan) {
-    log(`  ${step.name} ${pc12.dim(`(${step.source})`)}`);
-    for (const line of step.sql.trim().split("\n")) log(pc12.dim(`    ${line}`));
+    log2(`  ${step.name} ${pc14.dim(`(${step.source})`)}`);
+    for (const line of step.sql.trim().split("\n")) log2(pc14.dim(`    ${line}`));
   }
   if (options2.remote && !options2.yes) {
-    log(pc12.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
+    log2(pc14.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
     return 1;
   }
   const script = plan.map(({ name, sql: sql2 }) => `${sql2.trim()}
 DELETE FROM d1_migrations WHERE name = '${name.replace(/'/g, "''")}';`).join("\n") + "\n";
-  const dir = mkdtempSync(join17(tmpdir(), "flare-rollback-"));
+  const dir = mkdtempSync(join18(tmpdir(), "flare-rollback-"));
   try {
-    const file = join17(dir, "rollback.sql");
-    writeFileSync12(file, script);
+    const file = join18(dir, "rollback.sql");
+    writeFileSync13(file, script);
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Rollback failed:
 ${result.output.trim()}`);
   } finally {
     rmSync2(dir, { recursive: true, force: true });
   }
-  log(pc12.green(`
+  log2(pc14.green(`
 Rolled back ${plan.map((step) => step.name).join(", ")}.`));
   return 0;
 }
 
 // src/commands/rm.ts
-import { existsSync as existsSync19, readdirSync as readdirSync7, readFileSync as readFileSync12, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname10, join as join18 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync7, readFileSync as readFileSync12, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname10, join as join19 } from "path";
 import { relationGraph as relationGraph3 } from "@flaredev/core";
-import pc13 from "picocolors";
+import pc15 from "picocolors";
 var squash = (text) => text.replace(/\r\n/g, "\n").replace(/\s+/g, " ").trim();
 function handWrittenReason(source, header, options2 = {}) {
   const parts = splitMarkers(source);
@@ -3435,16 +3555,16 @@ function handWrittenReason(source, header, options2 = {}) {
   return null;
 }
 function removeEmptyDirs(appRoot, start) {
-  let dir = dirname10(join18(appRoot, start));
-  const roots = [join18(appRoot, "app", "api"), join18(appRoot, "app", "admin")];
+  let dir = dirname10(join19(appRoot, start));
+  const roots = [join19(appRoot, "app", "api"), join19(appRoot, "app", "dashboard")];
   const inside = () => roots.some((root) => dir.startsWith(root) && dir !== root);
-  while (inside() && existsSync19(dir) && readdirSync7(dir).length === 0) {
+  while (inside() && existsSync20(dir) && readdirSync7(dir).length === 0) {
     rmdirSync(dir);
     dir = dirname10(dir);
   }
 }
 async function rmResource(rawName, options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = resourceName(rawName);
   const all = await loadResources(appRoot);
@@ -3467,7 +3587,7 @@ async function rmResource(rawName, options2 = {}) {
   if (entry) {
     owned.add(entry.file);
     for (const file of planFiles(all)) {
-      if (existsSync19(join18(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
+      if (existsSync20(join19(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
     }
   }
   for (const orphan of findOrphans(appRoot, remaining)) if (orphan.resource === name) owned.add(orphan.path);
@@ -3476,7 +3596,7 @@ async function rmResource(rawName, options2 = {}) {
   if (!entry && owned.size === 0) throw new Error(`No resource "${name}" (no ${descriptorPath(name)} and no generated files).`);
   const findings = [];
   for (const path of owned) {
-    const source = readFileSync12(join18(appRoot, path), "utf8");
+    const source = readFileSync12(join19(appRoot, path), "utf8");
     let wrapper;
     if (entry && path === entry.file) {
       const standard = splitMarkers(renderDescriptor(name, [{ key: "placeholder", kind: "string", required: true, unique: false }]));
@@ -3497,34 +3617,34 @@ Move what you want to keep, or pass --force to delete anyway.`);
   }
   const removed = [...owned].sort();
   for (const path of removed) {
-    unlinkSync2(join18(appRoot, path));
+    unlinkSync2(join19(appRoot, path));
     removeEmptyDirs(appRoot, path);
-    log(`${pc13.red("remove".padEnd(9))} ${path}`);
+    log2(`${pc15.red("remove".padEnd(9))} ${path}`);
   }
-  logResults(applyPlan(appRoot, planFiles(remaining, policy ? await loadPolicies(appRoot) : void 0)), log);
+  logResults(applyPlan(appRoot, planFiles(remaining, policy ? await loadPolicies(appRoot) : void 0)), log2);
   const table = entry ? tableExport(entry.resource) : void 0;
-  if (table && existsSync19(join18(appRoot, "seeds"))) {
-    const seeds = readdirSync7(join18(appRoot, "seeds")).filter(
-      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync12(join18(appRoot, "seeds", file), "utf8"))
+  if (table && existsSync20(join19(appRoot, "seeds"))) {
+    const seeds = readdirSync7(join19(appRoot, "seeds")).filter(
+      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync12(join19(appRoot, "seeds", file), "utf8"))
     );
-    if (seeds.length) log(pc13.yellow(`
+    if (seeds.length) log2(pc15.yellow(`
 These seeds still use ${table}: ${seeds.map((s) => `seeds/${s}`).join(", ")}.`));
   }
   let migrations = [];
   if (!options2.skipMigration && entry) {
     const result = await generateSchemaMigration(appRoot, `drop_${entry.resource.table}`);
     migrations = result.files;
-    for (const file of migrations) log(`${pc13.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc13.dim(`repaired  ${repair}`));
-    if (migrations.length) log(`
-Next: ${pc13.bold("flare migrate")} to drop the table locally.`);
+    for (const file of migrations) log2(`${pc15.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log2(pc15.dim(`repaired  ${repair}`));
+    if (migrations.length) log2(`
+Next: ${pc15.bold("flare migrate")} to drop the table locally.`);
   }
   return { removed, migrations };
 }
 
 // src/commands/role.ts
 import { humanize } from "@flaredev/core";
-import pc14 from "picocolors";
+import pc16 from "picocolors";
 var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
 function roleInsertSql(name, label) {
   if (!ROLE_NAME.test(name)) throw new Error(`Invalid role "${name}". Use lowercase letters, digits, _ or -, e.g. admin or support-agent.`);
@@ -3557,7 +3677,7 @@ ${result.output.trim()}`);
   return (first?.results ?? []).map((row) => row.name);
 }
 async function addRole(name, options2 = {}) {
-  const { appRoot, binding, wrangler, target, log } = context2(options2);
+  const { appRoot, binding, wrangler, target, log: log2 } = context2(options2);
   const sql2 = roleInsertSql(name, options2.label ?? humanize(name));
   const result = await runWrangler(wrangler, ["d1", "execute", binding, ...target, "--json", "--command", sql2], appRoot, { capture: true });
   if (result.code !== 0) {
@@ -3569,24 +3689,137 @@ ${result.output.trim()}`);
   }
   const [first] = extractJson(result.output);
   const added = first?.results?.[0];
-  log(pc14.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
-  log(pc14.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
+  log2(pc16.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
+  log2(pc16.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
   return 0;
 }
 
 // src/commands/seed.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync10, readdirSync as readdirSync8, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync11, readdirSync as readdirSync8, writeFileSync as writeFileSync14 } from "fs";
+import { join as join21 } from "path";
+import { createFake, kebabCase as kebabCase4, storedFields as storedFields2 } from "@flaredev/core";
+import { createJiti as createJiti4 } from "jiti";
+import pc17 from "picocolors";
+
+// src/seed/bulk.ts
+var MAX_STATEMENT_BYTES = 8e4;
+var STATEMENTS_PER_CALL = 25;
+function sqlLiteral(value) {
+  if (value === null || value === void 0) return "NULL";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "NULL";
+  if (typeof value === "boolean") return value ? "1" : "0";
+  if (value instanceof Date) return String(value.getTime());
+  const text = typeof value === "object" ? JSON.stringify(value) : String(value);
+  return `'${text.replaceAll("'", "''")}'`;
+}
+var tuple = (row, columns) => `(${columns.map((column) => sqlLiteral(row[column])).join(",")})`;
+function* insertStatements(table, columns, rows, maxBytes = MAX_STATEMENT_BYTES) {
+  const head = `INSERT INTO "${table}" (${columns.map((column) => `"${column}"`).join(",")}) VALUES `;
+  let values = [];
+  let bytes = head.length;
+  for (const row of rows) {
+    const text = tuple(row, columns);
+    if (values.length > 0 && bytes + text.length + 1 > maxBytes) {
+      yield { sql: `${head}${values.join(",")};`, rows: values.length };
+      values = [];
+      bytes = head.length;
+    }
+    values.push(text);
+    bytes += text.length + 1;
+  }
+  if (values.length > 0) yield { sql: `${head}${values.join(",")};`, rows: values.length };
+}
+async function bulkInsert(sink, options2) {
+  const perCall = options2.statementsPerCall ?? STATEMENTS_PER_CALL;
+  let written = 0;
+  let batch = [];
+  let batchRows = 0;
+  const flush = async () => {
+    if (batch.length === 0) return;
+    await sink.exec(batch.join("\n"));
+    written += batchRows;
+    batch = [];
+    batchRows = 0;
+    options2.onProgress?.(written);
+  };
+  for (const statement of insertStatements(options2.table, options2.columns, options2.rows, options2.maxBytes)) {
+    batch.push(statement.sql);
+    batchRows += statement.rows;
+    if (batch.length === perCall) await flush();
+  }
+  await flush();
+  return written;
+}
+
+// src/seed/insert-many.ts
+var isIterable = (value) => typeof value === "object" && value !== null && Symbol.iterator in value;
+function createInsertMany(sink, drizzle, onProgress) {
+  return async function insertMany(table, count, build) {
+    const name = drizzle.getTableName(table);
+    const columns = drizzle.getTableColumns(table);
+    if (typeof count === "number" && !build) throw new Error(`insertMany(${name}, ${count}) needs a function to build each row.`);
+    const source = typeof count === "number" ? (function* () {
+      for (let i = 0; i < count; i++) yield build(i);
+    })() : isIterable(count) ? count : [];
+    const iterator = source[Symbol.iterator]();
+    const first = iterator.next();
+    if (first.done) return 0;
+    const keys = new Set(Object.keys(first.value));
+    for (const [key, column] of Object.entries(columns)) if (column.defaultFn) keys.add(key);
+    const used = Object.keys(columns).filter((key) => keys.has(key));
+    const unknownKeys = [...keys].filter((key) => !columns[key]);
+    if (unknownKeys.length) throw new Error(`${name} has no column called ${unknownKeys.join(", ")}.`);
+    const toRow = (value) => {
+      const row = {};
+      for (const key of used) {
+        const column = columns[key];
+        let raw = value[key];
+        if (raw === void 0 && column.defaultFn) raw = column.defaultFn();
+        row[column.name] = raw === void 0 || raw === null ? null : column.mapToDriverValue?.(raw) ?? raw;
+      }
+      return row;
+    };
+    const rows = (function* () {
+      yield toRow(first.value);
+      for (let next = iterator.next(); !next.done; next = iterator.next()) yield toRow(next.value);
+    })();
+    return bulkInsert(sink, {
+      table: name,
+      columns: used.map((key) => columns[key].name),
+      rows,
+      onProgress: onProgress && ((written) => onProgress(written, name))
+    });
+  };
+}
+
+// src/seed/local-d1.ts
 import { createRequire } from "module";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 import { pathToFileURL } from "url";
-import { kebabCase as kebabCase3, storedFields as storedFields2 } from "@flaredev/core";
-import { createJiti as createJiti4 } from "jiti";
-import pc15 from "picocolors";
-var SEEDS_DIR = "seeds";
 var LOCAL_STATE = ".wrangler/state/v3";
+async function openLocalD1(appRoot, binding) {
+  process.env.WRANGLER_LOG ??= "error";
+  const appRequire = createRequire(join20(appRoot, "package.json"));
+  const wrangler = await import(pathToFileURL(appRequire.resolve("wrangler")).href);
+  const { env, dispose } = await wrangler.getPlatformProxy({
+    configPath: join20(appRoot, "wrangler.jsonc"),
+    persist: { path: join20(appRoot, LOCAL_STATE) }
+  });
+  const bindings = env;
+  const name = binding ?? "DB";
+  const db = bindings[name];
+  if (!db) {
+    const available = Object.keys(bindings).filter((key) => typeof bindings[key]?.prepare === "function");
+    throw new Error(`No "${name}" database binding in wrangler.jsonc.${available.length ? ` Available: ${available.join(", ")}.` : ""}`);
+  }
+  return { db, env: bindings, dispose };
+}
+
+// src/commands/seed.ts
+var SEEDS_DIR = "seeds";
 function seedFiles(appRoot, names) {
-  const dir = join19(appRoot, SEEDS_DIR);
-  const all = existsSync20(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
+  const dir = join21(appRoot, SEEDS_DIR);
+  const all = existsSync21(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
   if (!names?.length) return all;
   return names.map((name) => {
     const file = `${name.replace(/\.seed\.ts$/, "")}.seed.ts`;
@@ -3597,65 +3830,66 @@ function seedFiles(appRoot, names) {
   });
 }
 async function runSeeds(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const files = seedFiles(appRoot, options2.names);
   if (files.length === 0) {
-    log(`No seeds found. Create one with ${pc15.bold("flare seed:make <name>")}.`);
+    log2(`No seeds found. Create one with ${pc17.bold("flare seed:make <name>")}.`);
     return;
   }
-  const jiti = createJiti4(join19(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
-  const appRequire = createRequire(join19(appRoot, "package.json"));
-  const wrangler = await import(pathToFileURL(appRequire.resolve("wrangler")).href);
+  const jiti = createJiti4(join21(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
   const { drizzle } = await jiti.import("drizzle-orm/d1");
-  const schema = await jiti.import(join19(appRoot, "db/schema.ts"));
-  const { env, dispose } = await wrangler.getPlatformProxy({
-    configPath: join19(appRoot, "wrangler.jsonc"),
-    persist: { path: join19(appRoot, LOCAL_STATE) }
-  });
+  const drizzleHelpers = await jiti.import("drizzle-orm");
+  const schema = await jiti.import(join21(appRoot, "db/schema.ts"));
+  const local = await openLocalD1(appRoot);
   try {
-    const bindings = env;
-    if (!bindings.DB) throw new Error("No DB binding found in wrangler.jsonc.");
-    const db = drizzle(bindings.DB, { schema });
+    const db = drizzle(local.db, { schema });
+    const insertMany = createInsertMany(local.db, drizzleHelpers);
     for (const file of files) {
-      const mod = await jiti.import(join19(appRoot, SEEDS_DIR, file));
+      const mod = await jiti.import(join21(appRoot, SEEDS_DIR, file));
       if (typeof mod.default !== "function") throw new Error(`${SEEDS_DIR}/${file} must \`export default defineSeed(async ({ db }) => { ... })\`.`);
-      log(`${pc15.cyan("seed")} ${file}`);
-      await mod.default({ db, env: bindings, log: (message) => log(`  ${message}`) });
+      log2(`${pc17.cyan("seed")} ${file}`);
+      await mod.default({ db, env: local.env, insertMany, fake: createFake(), log: (message) => log2(`  ${message}`) });
     }
-    log(pc15.green(`
+    log2(pc17.green(`
 Ran ${files.length} seed(s) against the local database.`));
   } finally {
-    await dispose();
+    await local.dispose();
   }
 }
-function sampleValue(key, def, row) {
+function sampleValue(key, def) {
+  const name = key.toLowerCase();
   switch (def.kind) {
     case "string":
-      if (def.format === "email") return `\`${kebabCase3(key).replace(/-?email$/, "") || "user"}\${i}@example.com\``;
-      if (def.format === "url") return `\`https://example.com/\${i}\``;
-      if (def.format === "tel") return `\`+1202555\${String(1000 + i).slice(-4)}\``;
-      if (def.format === "domain") return `\`example\${i}.com\``;
-      if (def.format === "country") return JSON.stringify(["US", "GB", "UG", "KE", "DE"][row % 5]);
-      if (def.format === "color") return JSON.stringify("#f2541d");
-      if (def.format === "slug") return `\`${kebabCase3(def.label ?? key)}-\${i}\``;
-      return `\`${def.label} \${i}\``;
+      if (def.format === "email") return "fake.email()";
+      if (def.format === "url") return "fake.url()";
+      if (def.format === "tel") return "fake.phone()";
+      if (def.format === "domain") return "fake.domain()";
+      if (def.format === "country") return "fake.country()";
+      if (def.format === "color") return "fake.color()";
+      if (def.format === "slug") return "fake.slug()";
+      if (name.includes("email")) return "fake.email()";
+      if (name.includes("phone") || name.includes("mobile")) return "fake.phone()";
+      if (name.includes("company")) return "fake.company()";
+      if (name.includes("city")) return "fake.city()";
+      if (name.includes("name")) return "fake.fullName()";
+      return "fake.words(2)";
     case "text":
-      return `"Lorem ipsum dolor sit amet."`;
+      return "fake.paragraph()";
     case "int":
-      return "i";
+      return "fake.int(1, 1000)";
     case "float":
-      return "i * 1.5";
+      return "fake.float(1, 1000)";
     case "boolean":
-      return "i % 2 === 0";
+      return "fake.bool()";
     case "date":
-      return "`2026-01-0${i}`";
+      return "fake.date()";
     case "datetime":
-      return "new Date().toISOString()";
+      return "fake.datetime()";
     case "enum":
-      return JSON.stringify(def.options[row % def.options.length]);
+      return `fake.pick(${JSON.stringify(def.options)})`;
     case "multiselect":
-      return JSON.stringify(def.options.slice(0, Math.max(1, def.minItems ?? 1)));
+      return `fake.some(${JSON.stringify(def.options)}, ${Math.max(1, def.minItems ?? 1)})`;
     case "file":
       return void 0;
     case "belongsTo":
@@ -3666,9 +3900,10 @@ function renderSeed(resource) {
   if (!resource) {
     return `import { defineSeed } from "@flaredev/core";
 
-export default defineSeed(async ({ db, log }) => {
+export default defineSeed(async ({ db, insertMany, fake, log }) => {
   // Insert rows with Drizzle, e.g.:
   // await db.insert(contacts).values([{ name: "Ada", email: "ada@example.com" }]);
+  // Or many at once, batched: insertMany(contacts, 10_000, () => ({ name: fake.fullName() }));
   log("nothing to seed yet");
 });
 `;
@@ -3677,58 +3912,369 @@ export default defineSeed(async ({ db, log }) => {
   const lines = [];
   const todos = [];
   for (const [key, def] of storedFields2(resource)) {
-    const value = sampleValue(key, def, 0);
+    const value = sampleValue(key, def);
     if (value !== void 0) lines.push(`    ${key}: ${value},`);
     else if (def.required) todos.push(`    // ${key}: TODO (${def.kind === "belongsTo" ? `id of an existing ${def.target}` : "R2 object key"}),`);
   }
   return `import { defineSeed } from "@flaredev/core";
 import { ${table} } from "@/db/schema";
 
-export default defineSeed(async ({ db, log }) => {
-  const rows = [1, 2, 3].map((i) => ({
+/** How many to create. insertMany batches them, so hundreds of thousands are fine. */
+const COUNT = 50;
+
+export default defineSeed(async ({ insertMany, fake, log }) => {
+  const rows = await insertMany(${table}, COUNT, () => ({
 ${[...lines, ...todos].join("\n")}
   }));
-  await db.insert(${table}).values(rows);
-  log(\`inserted \${rows.length} ${resource.pluralLabel.toLowerCase()}\`);
+  log(\`inserted \${rows.toLocaleString()} ${resource.pluralLabel.toLowerCase()}\`);
 });
 `;
 }
 async function makeSeed(rawName, options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
-  const name = kebabCase3(rawName);
+  const name = kebabCase4(rawName);
   if (!name) throw new Error(`Invalid seed name "${rawName}".`);
   const relative2 = `${SEEDS_DIR}/${name}.seed.ts`;
-  const path = join19(appRoot, relative2);
-  if (existsSync20(path)) throw new Error(`${relative2} already exists.`);
+  const path = join21(appRoot, relative2);
+  if (existsSync21(path)) throw new Error(`${relative2} already exists.`);
   const resources = (await loadResources(appRoot)).map(({ resource: resource2 }) => resource2);
   let resource;
   if (options2.resource) {
     resource = resources.find((r) => r.name.toLowerCase() === options2.resource.toLowerCase());
     if (!resource) throw new Error(`No resource "${options2.resource}". Available: ${resources.map((r) => r.name).join(", ") || "none"}.`);
   } else {
-    resource = resources.find((r) => [kebabCase3(r.name), r.slug].includes(name));
+    resource = resources.find((r) => [kebabCase4(r.name), r.slug].includes(name));
   }
-  mkdirSync10(join19(appRoot, SEEDS_DIR), { recursive: true });
-  writeFileSync13(path, renderSeed(resource));
-  log(`${pc15.green("create".padEnd(9))} ${relative2}`);
-  log(`
-Run it with ${pc15.bold(`flare seed ${name}`)}.`);
+  mkdirSync11(join21(appRoot, SEEDS_DIR), { recursive: true });
+  writeFileSync14(path, renderSeed(resource));
+  log2(`${pc17.green("create".padEnd(9))} ${relative2}`);
+  log2(`
+Run it with ${pc17.bold(`flare seed ${name}`)}.`);
   return relative2;
 }
 
+// src/commands/seed-resource.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync15 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join22 } from "path";
+import pc18 from "picocolors";
+
+// src/seed/rows.ts
+import { columnName as columnName2, createFake as createFake2, storedFields as storedFields3 } from "@flaredev/core";
+var has = (key, ...words) => words.some((word) => key.includes(word));
+function stringValue(key, def, fake, resource, index) {
+  switch (def.format) {
+    case "email":
+      return fake.email();
+    case "url":
+      return fake.url();
+    case "tel":
+      return fake.phone();
+    case "domain":
+      return fake.domain();
+    case "country":
+      return fake.country();
+    case "color":
+      return fake.color();
+    case "slug":
+      return fake.slug();
+  }
+  const name = key.toLowerCase();
+  const organisation = has(resource.name.toLowerCase(), "company", "vendor", "supplier", "organisation", "organization", "account", "team", "store", "brand");
+  let value;
+  if (has(name, "email")) value = fake.email();
+  else if (has(name, "phone", "mobile", "tel", "whatsapp")) value = fake.phone();
+  else if (has(name, "firstname", "givenname")) value = fake.firstName();
+  else if (has(name, "lastname", "surname", "familyname")) value = fake.lastName();
+  else if (has(name, "company", "organisation", "organization", "employer", "vendor", "supplier", "business")) value = fake.company();
+  else if (has(name, "city", "town")) value = fake.city();
+  else if (has(name, "country")) value = fake.country();
+  else if (has(name, "address", "street")) value = `${fake.int(1, 240)} ${fake.words(1)} Street, ${fake.city()}`;
+  else if (has(name, "website", "url", "link")) value = fake.url();
+  else if (has(name, "slug", "handle", "username")) value = fake.slug();
+  else if (has(name, "colour", "color")) value = fake.color();
+  else if (has(name, "code", "sku", "reference", "number")) value = `${fake.words(1).slice(0, 3).toUpperCase()}-${String(index + 1).padStart(6, "0")}`;
+  else if (has(name, "title", "position", "role", "job")) value = fake.jobTitle();
+  else if (has(name, "name")) value = organisation ? fake.company() : fake.fullName();
+  else if (has(name, "description", "summary", "note", "bio", "about", "message", "comment")) value = fake.sentence();
+  else value = `${fake.words(2)}`.replace(/^./, (letter) => letter.toUpperCase());
+  if (def.maxLength && value.length > def.maxLength) value = value.slice(0, def.maxLength);
+  if (def.minLength && value.length < def.minLength) value = value.padEnd(def.minLength, "x");
+  return value;
+}
+function numberValue(key, def, fake) {
+  const name = key.toLowerCase();
+  const money = has(name, "price", "amount", "total", "cost", "fee", "revenue", "salary", "balance");
+  let min = def.min;
+  let max = def.max;
+  if (min === void 0 || max === void 0) {
+    const [low, high] = money ? [5, 5e3] : has(name, "age") ? [18, 78] : has(name, "year") ? [2015, (/* @__PURE__ */ new Date()).getFullYear()] : has(name, "quantity", "qty", "stock", "seats", "items") ? [1, 250] : has(name, "percent", "rate", "score", "discount") ? [0, 100] : [1, 1e3];
+    min = min ?? low;
+    max = max ?? high;
+  }
+  return def.kind === "int" ? fake.int(Math.ceil(min), Math.floor(max)) : fake.float(min, max, money ? 2 : 2);
+}
+function fieldValue(key, def, fake, resource, parentIds, index) {
+  const name = key.toLowerCase();
+  if (!def.required && def.kind !== "belongsTo" && fake.bool(0.15)) return null;
+  switch (def.kind) {
+    case "string":
+      return stringValue(key, def, fake, resource, index);
+    case "text":
+      return fake.paragraph(fake.int(1, 3));
+    case "int":
+    case "float":
+      return numberValue(key, def, fake);
+    case "boolean":
+      return fake.bool(has(name, "active", "enabled", "published", "verified", "visible") ? 0.85 : 0.4);
+    case "date":
+      return has(name, "due", "expire", "end", "renew") ? fake.date(-90) : fake.date();
+    case "datetime":
+      return has(name, "due", "expire", "end", "renew") ? fake.datetime(-90) : fake.datetime();
+    case "enum":
+      return fake.pick(def.options);
+    case "multiselect":
+      return fake.some(def.options, Math.max(1, def.minItems ?? 1), def.maxItems ?? def.options.length);
+    case "file":
+      return def.required ? `seed/${resource.table}/${fake.count}.bin` : null;
+    case "belongsTo": {
+      const ids = parentIds.get(def.target) ?? [];
+      if (ids.length === 0) {
+        if (def.required) {
+          throw new Error(`${resource.name}.${key} needs a ${def.target} to belong to, and there are none. Seed ${def.target} first.`);
+        }
+        return null;
+      }
+      return fake.pick(ids);
+    }
+  }
+}
+function uniquify(value, row) {
+  const trailing = /(\d+)$/.exec(value)?.[1];
+  if (trailing && Number(trailing) === row) return value;
+  const at = value.indexOf("@");
+  if (at > 0) return `${value.slice(0, at)}.${row}${value.slice(at)}`;
+  if (/^[a-z0-9.-]+$/.test(value)) return `${value}-${row}`;
+  return `${value} ${row}`;
+}
+function seedColumns(resource) {
+  return ["id", ...storedFields3(resource).map(([key]) => columnName2(key)), "created_at", "updated_at"];
+}
+function* seedRows(resource, count, options2 = {}) {
+  const fake = createFake2(options2.seed ?? Math.floor(Math.random() * 2 ** 31));
+  const parentIds = options2.parentIds ?? /* @__PURE__ */ new Map();
+  const fields = storedFields3(resource);
+  const now = options2.now ?? Date.now();
+  const start = options2.startIndex ?? 0;
+  for (let i = 0; i < count; i++) {
+    const number = start + i;
+    const row = { id: fake.id() };
+    for (const [key, def] of fields) {
+      let value = fieldValue(key, def, fake, resource, parentIds, number);
+      if (typeof value === "string" && "unique" in def && def.unique) value = uniquify(value, number + 1);
+      row[columnName2(key)] = value;
+    }
+    const created = now - fake.int(0, 365) * 864e5 - fake.int(0, 86399999);
+    row.created_at = created;
+    row.updated_at = created + fake.int(0, Math.min(now - created, 30 * 864e5));
+    yield row;
+  }
+}
+
+// src/terminal.ts
+var isTTY = () => Boolean(process.stdout.isTTY);
+function formatDuration(ms) {
+  const seconds = Math.round(ms / 1e3);
+  if (seconds < 60) return `${seconds}s`;
+  if (seconds < 3600) return `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
+  return `${Math.floor(seconds / 3600)}h ${String(Math.floor(seconds % 3600 / 60)).padStart(2, "0")}m`;
+}
+var formatCount = (value) => value.toLocaleString();
+function formatRate(count, ms, unit = "rows") {
+  if (ms <= 0) return `${formatCount(count)} ${unit}/s`;
+  return `${formatCount(Math.round(count / ms * 1e3))} ${unit}/s`;
+}
+function progressLine(everyMs = 120) {
+  if (!isTTY()) return { update: () => {
+  }, done: () => {
+  } };
+  let last = 0;
+  let width = 0;
+  const write = (message) => {
+    process.stdout.write(`\r${message.padEnd(width)}`);
+    width = Math.max(width, message.length);
+  };
+  return {
+    update(message) {
+      const now = Date.now();
+      if (now - last < everyMs) return;
+      last = now;
+      write(message);
+    },
+    done() {
+      if (width > 0) process.stdout.write(`\r${" ".repeat(width)}\r`);
+      width = 0;
+    }
+  };
+}
+
+// src/commands/seed-resource.ts
+async function countRows(db, table) {
+  const row = await db.prepare(`SELECT count(*) AS total FROM "${table}"`).first();
+  return row?.total ?? 0;
+}
+var PARENT_SAMPLE = 5e3;
+function parseCount(value, fallback = 25) {
+  if (value === void 0 || value === "") return fallback;
+  if (typeof value === "number") return Math.floor(value);
+  const text = String(value).trim().toLowerCase().replaceAll(",", "").replaceAll("_", "").replaceAll(" ", "");
+  const match = /^(\d+(?:\.\d+)?)([km])?$/.exec(text);
+  if (!match) throw new Error(`"${value}" is not a number of rows. Try 1000, 25k or 1m.`);
+  const size = Number(match[1]) * (match[2] === "k" ? 1e3 : match[2] === "m" ? 1e6 : 1);
+  if (size < 1) throw new Error("Ask for at least one row.");
+  return Math.floor(size);
+}
+function pickResource(resources, name) {
+  const wanted = name.toLowerCase();
+  const match = resources.find((resource) => [resource.name.toLowerCase(), resource.slug, resource.table].includes(wanted));
+  if (!match) {
+    throw new Error(`No resource "${name}". Available: ${resources.map((resource) => resource.name).join(", ") || "none"}.`);
+  }
+  return match;
+}
+function pickDatabase(databases, wanted) {
+  if (databases.length === 0) throw new Error("No d1_databases in wrangler.jsonc.");
+  if (wanted) {
+    const match = databases.find((db) => db.binding === wanted || db.database_name === wanted);
+    if (!match) throw new Error(`No D1 database "${wanted}". Available: ${databases.map((db) => db.binding).join(", ")}.`);
+    return match;
+  }
+  if (databases.length > 1) throw new Error(`Several D1 databases; pick one with --database (${databases.map((db) => db.binding).join(", ")}).`);
+  return databases[0];
+}
+async function parentsOf(resource, all, ids) {
+  const targets = new Set(
+    Object.values(resource.fields).filter((field) => field.kind === "belongsTo").map((field) => field.target)
+  );
+  const parents = /* @__PURE__ */ new Map();
+  for (const target of targets) {
+    const parent = all.find((candidate) => candidate.name === target);
+    if (parent) parents.set(target, await ids(parent.table));
+  }
+  return parents;
+}
+async function seedResourceCommand(name, options2 = {}) {
+  const progress = progressLine();
+  const started = Date.now();
+  try {
+    const result = await seedResource(name, {
+      ...options2,
+      onProgress: (written, total) => {
+        const elapsed = Date.now() - started;
+        progress.update(`  ${pc18.cyan(formatCount(written))} of ${formatCount(total)} rows  ${pc18.dim(formatRate(written, elapsed))}`);
+      }
+    });
+    progress.done();
+    const { rows, ms, where } = result;
+    console.log(
+      `${pc18.green("\u2714")} Seeded ${pc18.bold(formatCount(rows))} ${result.resource.pluralLabel.toLowerCase()} into the ${where} database ` + pc18.dim(`(${formatDuration(ms)}, ${formatRate(rows, ms)})`)
+    );
+    return result;
+  } catch (error) {
+    progress.done();
+    throw error;
+  }
+}
+async function seedResource(name, options2 = {}) {
+  const log2 = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const resources = (await loadResources(appRoot)).map(({ resource: resource2 }) => resource2);
+  const resource = pickResource(resources, name);
+  const total = parseCount(options2.count);
+  const where = options2.remote ? "remote" : "local";
+  if (options2.remote && !options2.yes) {
+    throw new Error(`Seeding the remote database writes ${total.toLocaleString()} rows to ${resource.table}. Re-run with --yes to confirm.`);
+  }
+  const columns = seedColumns(resource);
+  const started = Date.now();
+  let parents = /* @__PURE__ */ new Map();
+  let startIndex = 0;
+  const rows = () => seedRows(resource, total, { seed: options2.seed, parentIds: parents, startIndex });
+  if (options2.remote) {
+    const db = pickDatabase(readD1Databases(appRoot), options2.database);
+    const wrangler = resolveBin(appRoot, "wrangler", "wrangler");
+    const target = ["--remote", ...options2.env ? ["--env", options2.env] : []];
+    const query = async (sql2) => {
+      const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--json", "--command", sql2], appRoot, { capture: true });
+      if (result.code !== 0) throw new Error(`Query failed on the remote database:
+${result.output.trim()}`);
+      const start = result.output.indexOf("[");
+      const parsed = JSON.parse(result.output.slice(start, result.output.lastIndexOf("]") + 1));
+      return parsed[0]?.results ?? [];
+    };
+    parents = await parentsOf(resource, resources, async (table) => {
+      const found = await query(`SELECT id FROM "${table}" LIMIT ${PARENT_SAMPLE}`);
+      return found.map((row) => row.id);
+    });
+    if (!options2.truncate) {
+      const [counted] = await query(`SELECT count(*) AS total FROM "${resource.table}"`);
+      startIndex = counted?.total ?? 0;
+    }
+    const dir = mkdtempSync2(join22(tmpdir2(), "flare-seed-"));
+    const file = join22(dir, `${resource.table}.sql`);
+    try {
+      const statements = [];
+      if (options2.truncate) statements.push(`DELETE FROM "${resource.table}";`);
+      let written = 0;
+      for (const statement of insertStatements(resource.table, columns, rows())) {
+        statements.push(statement.sql);
+        written += statement.rows;
+        options2.onProgress?.(written, total);
+      }
+      writeFileSync15(file, statements.join("\n"));
+      log2(`${pc18.cyan("\u25CF")} Uploading ${total.toLocaleString()} rows to ${pc18.bold(db.database_name)}`);
+      const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--yes", "--file", file], appRoot, { capture: true });
+      if (result.code !== 0) throw new Error(`Seeding the remote database failed:
+${result.output.trim()}`);
+    } finally {
+      rmSync3(dir, { recursive: true, force: true });
+    }
+    return { resource, rows: total, ms: Date.now() - started, where };
+  }
+  const local = await openLocalD1(appRoot, options2.database);
+  try {
+    parents = await parentsOf(resource, resources, async (table) => {
+      const found = await local.db.prepare(`SELECT id FROM "${table}" LIMIT ${PARENT_SAMPLE}`).all();
+      return (found.results ?? []).map((row) => row.id);
+    });
+    if (options2.truncate) await local.db.exec(`DELETE FROM "${resource.table}";`);
+    else startIndex = await countRows(local.db, resource.table);
+    const sink = { exec: (sql2) => local.db.exec(sql2) };
+    const written = await bulkInsert(sink, {
+      table: resource.table,
+      columns,
+      rows: rows(),
+      onProgress: (count) => options2.onProgress?.(count, total)
+    });
+    return { resource, rows: written, ms: Date.now() - started, where };
+  } finally {
+    await local.dispose();
+  }
+}
+
 // src/commands/billing-sync.ts
 import { createRequire as createRequire2 } from "module";
-import { existsSync as existsSync21, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync14 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join20 } from "path";
+import { existsSync as existsSync22, mkdtempSync as mkdtempSync3, readFileSync as readFileSync13, rmSync as rmSync4, writeFileSync as writeFileSync16 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join23 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
-import { kebabCase as kebabCase4 } from "@flaredev/core";
-import pc16 from "picocolors";
+import { kebabCase as kebabCase5 } from "@flaredev/core";
+import pc19 from "picocolors";
 function stripeKeys(appRoot) {
   const map = {};
-  const path = join20(appRoot, ".dev.vars");
-  if (existsSync21(path)) {
+  const path = join23(appRoot, ".dev.vars");
+  if (existsSync22(path)) {
     for (const line of readFileSync13(path, "utf8").split(/\r?\n/)) {
       const match = /^\s*([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match) map[match[1]] = match[2].trim();
@@ -3749,7 +4295,7 @@ function planRows(catalog) {
       return ok;
     });
     const currencies = new Set(usable.map((price) => price.currency));
-    const base = product.metadata?.slug || kebabCase4(product.name);
+    const base = product.metadata?.slug || kebabCase5(product.name);
     for (const price of usable) {
       const interval = price.recurring?.interval ?? null;
       const parts = [base];
@@ -3806,16 +4352,16 @@ async function syncPortalConfiguration(stripe, rows, appName) {
   return existing ? (await stripe.billingPortal.configurations.update(existing.id, settings)).id : (await stripe.billingPortal.configurations.create(settings)).id;
 }
 async function syncPlans(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const key = stripeKeys(appRoot).STRIPE_SECRET_KEY;
   if (!key) throw new Error("STRIPE_SECRET_KEY is not set in .dev.vars or the environment.");
   const db = readD1Databases(appRoot)[0];
   if (!db) throw new Error("No d1_databases in wrangler.jsonc.");
-  const appRequire = createRequire2(join20(appRoot, "package.json"));
+  const appRequire = createRequire2(join23(appRoot, "package.json"));
   const stripeModule = await import(pathToFileURL2(appRequire.resolve("stripe")).href);
   const stripe = new stripeModule.default(key, { apiVersion: "2026-08-26.dahlia" });
-  const appName = JSON.parse(readFileSync13(join20(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync13(join23(appRoot, "package.json"), "utf8")).name ?? "app";
   const everything = await stripe.products.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 });
   const products = options2.all ? everything : everything.filter((product) => product.metadata?.flare_app === appName);
   if (products.length === 0) {
@@ -3836,88 +4382,88 @@ async function syncPlans(options2 = {}) {
 ${existingResult.output.trim()}`);
   }
   const known = new Set(extractJson(existingResult.output)[0]?.results.map((row) => row.stripe_price_id));
-  const dir = mkdtempSync2(join20(tmpdir2(), "flare-sync-"));
+  const dir = mkdtempSync3(join23(tmpdir3(), "flare-sync-"));
   try {
-    const file = join20(dir, "sync-plans.sql");
-    writeFileSync14(file, renderSyncSql(rows));
+    const file = join23(dir, "sync-plans.sql");
+    writeFileSync16(file, renderSyncSql(rows));
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Could not write plans:
 ${result.output.trim()}`);
   } finally {
-    rmSync3(dir, { recursive: true, force: true });
+    rmSync4(dir, { recursive: true, force: true });
   }
   let created = 0;
   for (const row of rows) {
     const isNew = !known.has(row.stripePriceId);
     if (isNew) created++;
     const price = `${row.currency.toUpperCase()} ${(row.amount / 100).toFixed(2)}${row.interval ? `/${row.interval}` : " once"}`;
-    log(`${(isNew ? pc16.green("create") : pc16.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc16.dim(price)}`);
+    log2(`${(isNew ? pc19.green("create") : pc19.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc19.dim(price)}`);
   }
-  for (const name of skipped) log(pc16.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
+  for (const name of skipped) log2(pc19.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
   const configuration = await syncPortalConfiguration(stripe, rows, appName);
-  if (configuration) log(`${pc16.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
-  log(pc16.green(`
+  if (configuration) log2(`${pc19.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
+  log2(pc19.green(`
 ${rows.length} plan(s) synced to the ${options2.remote ? "remote" : "local"} database; plans no longer active in Stripe were deactivated.`));
   return { created, updated: rows.length - created, skipped };
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync22 } from "fs";
-import { join as join21 } from "path";
-import pc17 from "picocolors";
+import { existsSync as existsSync23 } from "fs";
+import { join as join24 } from "path";
+import pc20 from "picocolors";
 async function syncTypes(options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const all = await loadResources(appRoot);
   const policies = await loadPolicies(appRoot);
-  const tracksPolicies = policies.length > 0 || existsSync22(join21(appRoot, "policies/index.ts"));
+  const tracksPolicies = policies.length > 0 || existsSync23(join24(appRoot, "policies/index.ts"));
   const plan = planFiles(all, tracksPolicies ? policies : void 0);
-  if (!options2.check) ensureSupportFiles(appRoot, log);
+  if (!options2.check) ensureSupportFiles(appRoot, log2);
   const results = applyPlan(appRoot, plan, { force: options2.force, dryRun: options2.check });
-  logResults(results, log);
+  logResults(results, log2);
   const drift = results.filter((r) => r.outcome === "skipped-drift");
   const unmarked = results.filter((r) => r.outcome === "skipped-unmarked");
   const changed = results.filter((r) => r.outcome === "create" || r.outcome === "update");
   const orphans = findOrphans(appRoot, all);
   if (drift.length) {
-    log(
+    log2(
       `
-${pc17.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
+${pc20.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
 Move custom code outside the // generated:start \u2026 // generated:end block, or re-run with --force to overwrite.`
     );
   }
   if (unmarked.length) {
-    log(`
-${pc17.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
+    log2(`
+${pc20.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
   }
   if (orphans.length) {
     const resources = [...new Set(orphans.map((o) => o.resource))];
-    log(`
-${pc17.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
-    for (const orphan of orphans) log(`  ${orphan.path}`);
-    log(
-      `If the resource was deleted, remove them with ${pc17.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
+    log2(`
+${pc20.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
+    for (const orphan of orphans) log2(`  ${orphan.path}`);
+    log2(
+      `If the resource was deleted, remove them with ${pc20.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
     );
   }
   const tablesChanged = changed.some((r) => r.path.startsWith("db/schema/") && (r.status === "outdated" || r.status === "missing"));
   if (tablesChanged && !options2.check) {
-    log(`
-${pc17.cyan("Tables changed.")} Create a migration with ${pc17.bold("flare gen migration <name> --from-schema")}, then ${pc17.bold("flare migrate")}.`);
+    log2(`
+${pc20.cyan("Tables changed.")} Create a migration with ${pc20.bold("flare gen migration <name> --from-schema")}, then ${pc20.bold("flare migrate")}.`);
   }
   const problems = drift.length + unmarked.length + orphans.length;
   if (options2.check) {
     const stale = changed.length;
-    if (stale === 0 && problems === 0) log(pc17.green("Generated files are in sync with the resource descriptors."));
-    else log(`
-${pc17.red("Out of sync:")} ${stale} file(s) would change. Run ${pc17.bold("flare sync-types")}.`);
+    if (stale === 0 && problems === 0) log2(pc20.green("Generated files are in sync with the resource descriptors."));
+    else log2(`
+${pc20.red("Out of sync:")} ${stale} file(s) would change. Run ${pc20.bold("flare sync-types")}.`);
     return stale + problems > 0 ? 1 : 0;
   }
-  if (changed.length === 0 && problems === 0) log(pc17.green("Everything is in sync."));
+  if (changed.length === 0 && problems === 0) log2(pc20.green("Everything is in sync."));
   return problems > 0 ? 1 : 0;
 }
 
 // src/commands/user-role.ts
-import pc18 from "picocolors";
+import pc21 from "picocolors";
 var ROLE = /^[a-z][a-z0-9_-]{0,31}$/;
 var EMAIL = /^[^\s@'"\\]+@[^\s@'"\\]+\.[^\s@'"\\]+$/;
 function userRoleSql(email, role) {
@@ -3926,13 +4472,13 @@ function userRoleSql(email, role) {
   return `UPDATE "user" SET role = '${role}', updated_at = cast(unixepoch('subsecond') * 1000 as integer) WHERE lower(email) = lower('${email}') RETURNING email, role`;
 }
 async function setUserRole(email, role, options2 = {}) {
-  const log = options2.log ?? ((message) => console.log(message));
+  const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const sql2 = userRoleSql(email, role);
   const roles = await listRoles(options2);
   if (roles && !roles.includes(role)) {
-    log(pc18.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
-    log(pc18.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
+    log2(pc21.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
+    log2(pc21.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
     return 1;
   }
   const db = readD1Databases(appRoot)[0];
@@ -3946,32 +4492,130 @@ ${result.output.trim()}`);
   const [first] = extractJson(result.output);
   const updated = first?.results ?? [];
   if (updated.length === 0) {
-    log(pc18.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
+    log2(pc21.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
     return 1;
   }
-  log(pc18.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
+  log2(pc21.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
   return 0;
 }
 
+// src/utils/install.ts
+import { spawn as spawn5 } from "child_process";
+import { existsSync as existsSync24, readFileSync as readFileSync14, readdirSync as readdirSync9 } from "fs";
+import { join as join25 } from "path";
+function expectedPackages(dir) {
+  const npmLock = join25(dir, "package-lock.json");
+  if (existsSync24(npmLock)) {
+    try {
+      const lock = JSON.parse(readFileSync14(npmLock, "utf8"));
+      return Math.max(0, Object.keys(lock.packages ?? {}).length - 1);
+    } catch {
+      return 0;
+    }
+  }
+  const pnpmLock = join25(dir, "pnpm-lock.yaml");
+  if (existsSync24(pnpmLock)) {
+    try {
+      const text = readFileSync14(pnpmLock, "utf8");
+      const packages = text.slice(text.indexOf("\npackages:"));
+      return (packages.match(/\n {2}[^\s:]+:/g) ?? []).length;
+    } catch {
+      return 0;
+    }
+  }
+  return 0;
+}
+function installedPackages(dir) {
+  const root = join25(dir, "node_modules");
+  if (!existsSync24(root)) return 0;
+  let total = 0;
+  try {
+    for (const entry of readdirSync9(root, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.name === ".bin") continue;
+      if (entry.name.startsWith("@")) {
+        try {
+          total += readdirSync9(join25(root, entry.name)).length;
+        } catch {
+        }
+      } else if (entry.name !== ".pnpm" && entry.name !== ".vite") {
+        total += 1;
+      }
+    }
+  } catch {
+    return total;
+  }
+  return total;
+}
+function install(packageManager, dir, onProgress) {
+  const args = installArgs(packageManager);
+  const started = Date.now();
+  const expected = expectedPackages(dir);
+  return new Promise((resolve6, reject) => {
+    const child = process.platform === "win32" ? spawn5([packageManager, ...args].join(" "), { cwd: dir, shell: true, env: childEnv(), stdio: ["ignore", "pipe", "pipe"] }) : spawn5(packageManager, args, { cwd: dir, env: childEnv(), stdio: ["ignore", "pipe", "pipe"] });
+    let output = "";
+    child.stdout?.on("data", (chunk) => output += chunk);
+    child.stderr?.on("data", (chunk) => output += chunk);
+    const timer = onProgress ? setInterval(() => {
+      const installed = installedPackages(dir);
+      onProgress({
+        installed,
+        expected,
+        percent: expected > 0 ? Math.min(99, Math.round(installed / expected * 100)) : void 0,
+        elapsedMs: Date.now() - started
+      });
+    }, 500) : void 0;
+    child.on("error", (error) => {
+      clearInterval(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearInterval(timer);
+      resolve6({ code: code ?? 1, output, ms: Date.now() - started });
+    });
+  });
+}
+
 // src/cli.ts
 function createCli() {
   const cli = cac("flare");
   cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--theme <name>", "Look of the app: default, coral, amber, sky, mono or emerald").option("--auth <list>", "Sign-in methods: magic-link, email-otp, passkeys, 2fa-app, 2fa-email, all or none (default: all)").option("--auth-providers <list>", "Social sign-in, comma-separated: google, github, apple, microsoft").option("-y, --yes", "Don't ask: use the flags given and the defaults for the rest").option("--skip-install", "Write files without installing dependencies").example("flare create shop").example("flare create shop --theme mono --auth passkeys,2fa-app --auth-providers google,github --yes").action(async (dir, options2) => {
-    const install = !options2.skipInstall;
+    const wanted = !options2.skipInstall;
     let answers = { theme: options2.theme, auth: options2.auth, authProviders: options2.authProviders };
-    if (canPrompt(options2.yes)) answers = await askCreateQuestions(answers);
-    const result = createApp(dir, { pm: options2.pm, install, ...answers });
-    printNextSteps(result, install);
+    if (canPrompt(options2.yes)) answers = await askCreateQuestions(answers, toAppName(dir));
+    const result = createApp(dir, { pm: options2.pm, install: false, ...answers, log: (message) => prompts3.log.message(message) });
+    let installed = false;
+    if (wanted) {
+      const spin = prompts3.spinner({ indicator: "timer" });
+      spin.start(`Installing dependencies with ${result.packageManager}`);
+      const outcome = await install(result.packageManager, result.dir, ({ installed: done, expected, percent }) => {
+        spin.message(
+          percent === void 0 ? `Installing dependencies with ${result.packageManager} \xB7 ${formatCount(done)} packages` : `Installing dependencies with ${result.packageManager} \xB7 ${percent}% (${formatCount(done)} of ${formatCount(expected)})`
+        );
+      });
+      installed = outcome.code === 0;
+      if (installed) {
+        spin.stop(`Installed ${formatCount(expectedPackages(result.dir) || 0)} packages with ${result.packageManager} ${pc22.dim(`(${formatDuration(outcome.ms)})`)}`);
+      } else {
+        spin.error(`${result.packageManager} install failed`);
+        process.stderr.write(outcome.output);
+        process.exitCode = 1;
+      }
+    }
+    printNextSteps(result, installed);
   });
-  cli.command("gen <generator> [name]", "Generate code. Generators: resource, migration, policy, billing, security").option("--fields <fields>", "resource: fields, e.g. 'name:string, email:string!, status:enum(lead,customer)' (single quotes: bash treats ! in double quotes as history)").option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing: write files without installing the stripe dependency").option("--skip-migration", "billing/security: skip generating the schema migration").example("flare gen resource Contact --fields 'name:string, email:string!, company:belongsTo(Company)?'").example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").action(
-    async (generator, name, options2) => {
+  cli.command("gen <generator> [name] [second]", "Generate code. Generators: resource, endpoint, migration, policy, billing, security").option("--fields <fields>", "resource: fields, e.g. 'name:string, email:string!, status:enum(lead,customer)' (single quotes: bash treats ! in double quotes as history)").option("--group <name>", "resource: sidebar heading to file it under, e.g. Sales").option("--icon <name>", "resource: lucide icon for the sidebar, e.g. users").option("--method <verb>", "endpoint: GET (default), POST, PATCH, PUT or DELETE").option("--action <action>", "endpoint: policy action to require (read, create, update, delete)").option("--record", "endpoint: put it under one record, /api/<resource>/[id]/<name>").option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing: write files without installing the stripe dependency").option("--skip-migration", "billing/security: skip generating the schema migration").example("flare gen resource Contact --fields 'name:string, email:string!, company:belongsTo(Company)?'").example("flare gen endpoint Order publish --method POST --record").example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").action(
+    async (generator, name, second, options2) => {
       if (generator === "billing")
         return genBilling({ provider: options2.provider, mode: options2.mode, force: options2.force, skipInstall: options2.skipInstall, skipMigration: options2.skipMigration });
       if (generator === "security") return genSecurity({ force: options2.force, skipMigration: options2.skipMigration });
       if (["resource", "migration", "policy"].includes(generator) && !name) {
         throw new Error(`flare gen ${generator} needs a name, e.g. flare gen ${generator} ${generator === "migration" ? "add_phone_to_contacts" : "Contact"}`);
       }
-      if (generator === "resource") return genResource(name, { fields: options2.fields, force: options2.force });
+      if (generator === "resource") return genResource(name, { fields: options2.fields, force: options2.force, group: options2.group, icon: options2.icon });
+      if (generator === "endpoint") {
+        if (!name || !second) throw new Error("flare gen endpoint needs a resource and a name, e.g. flare gen endpoint Order publish");
+        return genEndpoint(name, second, { method: options2.method, action: options2.action, record: options2.record });
+      }
       if (generator === "migration") return genMigration(name, { fromSchema: options2.fromSchema });
       if (generator === "policy") return genPolicy(name, { roles: options2.roles, deleteRoles: options2.deleteRoles, force: options2.force });
       throw new Error(`Unknown generator "${generator}". Available: resource, migration, policy, billing, security.`);
@@ -3996,6 +4640,9 @@ function createCli() {
   cli.command("seed [...names]", "Run seed files from seeds/ against the local D1 database").example("flare seed            # every seed, in file-name order").example("flare seed contacts   # just seeds/contacts.seed.ts").action(async (names) => {
     await runSeeds({ names });
   });
+  cli.command("seed:resource <resource> [count]", "Fill a resource's table with sample rows built from its descriptor").option("--count <rows>", "How many rows: 1000, 25k, 1m (default: 25)").option("--remote", "Seed the deployed database instead of the local one (needs --yes)").option("--truncate", "Delete the table's rows first").option("--seed <number>", "Same number, same rows").option("--env <name>", "Wrangler environment").option("--database <binding>", "D1 binding, when the app has several").option("-y, --yes", "Confirm writing to the remote database").example("flare seed:resource Contact --count 1000").example("flare seed:resource Contact 1m            # a million rows").example("flare seed:resource Contact 5k --remote --yes").action(async (resource, count, options2) => {
+    await seedResourceCommand(resource, { ...options2, count: options2.count ?? count });
+  });
   cli.command("seed:make <name>", "Create seeds/<name>.seed.ts (with example rows for a matching resource)").option("--resource <name>", "Resource to write example rows for").action(async (name, options2) => {
     await makeSeed(name, options2);
   });
@@ -4022,7 +4669,7 @@ function createCli() {
     cli.command(`${name} [...args]`, spec.description).allowUnknownOptions();
   }
   cli.help();
-  cli.version(FLARE_VERSION2);
+  cli.version(FLARE_VERSION3);
   return cli;
 }
 
@@ -4041,6 +4688,6 @@ try {
     }
   }
 } catch (error) {
-  console.error(pc19.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
+  console.error(pc23.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
   process.exitCode = 1;
 }