@flaredev/cli 0.5.1 → 0.6.1

package/dist/index.js

@@ -1,9 +1,9 @@
 // src/index.ts
-import pc24 from "picocolors";
+import pc25 from "picocolors";
 
 // src/cli.ts
 import { cac } from "cac";
-import pc23 from "picocolors";
+import pc24 from "picocolors";
 import * as prompts3 from "@clack/prompts";
 import { FLARE_VERSION as FLARE_VERSION3 } from "@flaredev/core";
 
@@ -201,6 +201,9 @@ var NEXT_DEV_DEPENDENCIES = {
   prisma: "7.10.0",
   // Runs seeds: the generated Prisma client is TypeScript a bundler compiles.
   tsx: "^4.23.13",
+  // `flare deploy` and `npm run deploy`. Local rather than global, so the deploy works
+  // on a fresh clone and every app pins its own version.
+  vercel: "^60.1.3",
   "@types/node": "^22.20.3",
   "@types/react": "^19.3.0",
   "@types/react-dom": "^19.3.0",
@@ -216,7 +219,9 @@ var CLOUDFLARE_ONLY = [
   "migrations",
   "drizzle.config.ts",
   ".dev.vars.example",
-  "worker-configuration.d.ts"
+  "worker-configuration.d.ts",
+  // The engine's Drizzle adapter; the Next.js overlay brings prisma-rows.ts instead.
+  "lib/resource/drizzle-rows.ts"
 ];
 
 // src/stack.ts
@@ -285,6 +290,20 @@ function detectPackageManager(userAgent = process.env.npm_config_user_agent ?? "
   const name = userAgent.split("/")[0];
   return isPackageManager(name) ? name : "pnpm";
 }
+function isInstalled(packageManager) {
+  const probe = [packageManager, "--version"].join(" ");
+  const result = process.platform === "win32" ? spawnSync(probe, { stdio: "ignore", shell: true, env: childEnv() }) : spawnSync(packageManager, ["--version"], { stdio: "ignore", env: childEnv() });
+  return result.status === 0;
+}
+function choosePackageManager(explicit) {
+  if (explicit !== void 0) {
+    if (!isPackageManager(explicit)) throw new Error(`Unknown package manager "${explicit}". Use pnpm, npm, yarn, or bun.`);
+    return { packageManager: explicit, preferred: false };
+  }
+  const detected = detectPackageManager();
+  if (detected !== "pnpm" && isInstalled("pnpm")) return { packageManager: "pnpm", preferred: true };
+  return { packageManager: detected, preferred: false };
+}
 function run(command, args, cwd) {
   const env = childEnv();
   const result = process.platform === "win32" ? spawnSync([command, ...args].join(" "), { cwd, stdio: "inherit", shell: true, env }) : spawnSync(command, args, { cwd, stdio: "inherit", env });
@@ -304,6 +323,7 @@ function installArgs(pm) {
 }
 
 // src/commands/create.ts
+var ALLOW_BUILDS = ["'@prisma/engines': true", "esbuild: true", "prisma: true", "sharp: false", "workerd: true"].map((line) => `  ${line}`).join("\n");
 function toAppName(dir) {
   const name = basename(resolve2(dir)).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
   if (!name) throw new Error(`Cannot derive an app name from "${dir}". Use letters, digits, and dashes.`);
@@ -325,10 +345,7 @@ function createApp(target, options2 = {}) {
   if (existsSync3(dir) && readdirSync2(dir).length > 0) {
     throw new Error(`Directory ${dir} already exists and is not empty.`);
   }
-  if (options2.pm !== void 0 && !isPackageManager(options2.pm)) {
-    throw new Error(`Unknown package manager "${options2.pm}". Use pnpm, npm, yarn, or bun.`);
-  }
-  const packageManager = options2.pm ?? detectPackageManager();
+  const { packageManager, preferred: prefersPnpm } = choosePackageManager(options2.pm);
   if (options2.stack !== void 0 && !isStack(options2.stack)) {
     throw new Error(`Unknown stack "${options2.stack}". Use ${STACKS.join(" or ")}.`);
   }
@@ -395,13 +412,15 @@ MAIL_FROM=
 ${devVarsEntries(authProviders)}`
   );
   if (packageManager === "pnpm" && !inWorkspace) {
-    const allowBuilds = stack === "next" ? "allowBuilds:\n  '@prisma/engines': true\n  prisma: true\n  sharp: false\n" : "allowBuilds:\n  esbuild: true\n  workerd: true\n  sharp: false\n";
-    writeFileSync3(join3(dir, "pnpm-workspace.yaml"), allowBuilds);
+    writeFileSync3(join3(dir, "pnpm-workspace.yaml"), `allowBuilds:
+${ALLOW_BUILDS}
+`);
   }
   const pinned = flarePackageSpec("core", dir, packageManager).startsWith("^");
   if (pinned) copyLockfile(packageManager, dir);
   const log2 = options2.log ?? ((message) => console.log(message));
   log2(`${pc.green("\u2714")} Wrote ${files} files to ${relative(process.cwd(), dir) || "."}`);
+  if (prefersPnpm) log2(pc.dim(`Installing with pnpm \u2014 far quicker for an app this size. Use ${pc.bold("--pm npm")} to change that.`));
   return { dir, name, packageManager, inWorkspace };
 }
 function copyLockfile(packageManager, dir) {
@@ -1798,12 +1817,14 @@ function resolveBin(appRoot, pkgName, binName2) {
   if (!relativeBin) throw new Error(`${pkgName} does not provide a "${binName2}" executable.`);
   return join8(dirname4(manifestPath), relativeBin);
 }
+var NEXT_COMMANDS = {
+  dev: { pkg: "next", bin: "next", args: ["dev"] },
+  build: { pkg: "next", bin: "next", args: ["build"] },
+  start: { pkg: "next", bin: "next", args: ["start"] },
+  deploy: { pkg: "vercel", bin: "vercel", args: ["deploy", "--prod"] }
+};
 function delegatedArgv(appRoot, command, forwarded) {
-  if (readStack(appRoot) === "next") {
-    const script = { dev: "npm run dev", build: "npm run build", start: "npm start", deploy: "npm run deploy" }[command];
-    throw new Error(`\`flare ${command}\` is for the Cloudflare stack. This app targets Next.js \u2014 run \`${script}\` instead.`);
-  }
-  const spec = DELEGATED_COMMANDS[command];
+  const spec = readStack(appRoot) === "next" ? NEXT_COMMANDS[command] : DELEGATED_COMMANDS[command];
   return [resolveBin(appRoot, spec.pkg, spec.bin), ...spec.args, ...forwarded];
 }
 function runNode(argv, cwd) {
@@ -1858,15 +1879,22 @@ function portArg(args) {
 }
 async function runDelegated(command, forwarded, cwd = process.cwd()) {
   const appRoot = findAppRoot(cwd);
+  const next = readStack(appRoot) === "next";
   const tunnel = (command === "dev" || command === "start") && forwarded.includes("--tunnel");
   if (tunnel) forwarded = forwarded.filter((arg) => arg !== "--tunnel");
   const wantsHelp = forwarded.includes("--help") || forwarded.includes("-h");
-  if (command === "start" && !wantsHelp && !existsSync9(join8(appRoot, "dist/server/wrangler.json"))) {
+  if (next && command === "build" && !wantsHelp) {
+    const code = await runNode([resolveBin(appRoot, "prisma", "prisma"), "generate"], appRoot);
+    if (code !== 0) return code;
+  }
+  const built = next ? ".next" : "dist/server/wrangler.json";
+  if (command === "start" && !wantsHelp && !existsSync9(join8(appRoot, built))) {
     console.log("No production build found; running `flare build` first.\n");
-    const code = await runNode(delegatedArgv(appRoot, "build", []), appRoot);
+    const code = await runDelegated("build", [], appRoot);
     if (code !== 0) return code;
   }
   if (command === "deploy") {
+    if (next) return runNode(delegatedArgv(appRoot, "deploy", forwarded), appRoot);
     return runDeploy(forwarded, {
       appRoot,
       wranglerBin: resolveBin(appRoot, "wrangler", "wrangler"),
@@ -1960,7 +1988,7 @@ function previousSnapshot(dir, migrationFile) {
 
 // src/generator/plan.ts
 import { copyFileSync as copyFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync4, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname5, join as join11 } from "path";
+import { dirname as dirname5, join as join11, sep } from "path";
 import pc5 from "picocolors";
 
 // src/generator/policy.ts
@@ -2285,14 +2313,19 @@ ${lines.join("\n")}
 var handlerImports = (entry, stack = "cloudflare") => {
   const local = resourceLocal(entry.stem);
   const source = stack === "next" ? {
-    imports: [`import { prismaRows } from "@flaredev/core/server";`, `import { prisma } from "@/lib/db";`],
+    imports: [`import { createResourceHandlers, prismaRows } from "@/lib/resource";`, `import { prisma } from "@/lib/db";`],
     wiring: [`  rows: prismaRows(prisma.${camelCase4(entry.resource.name)}, prisma),`]
   } : {
-    imports: [`import { getDb } from "@/db";`, `import { ${tableExport(entry.resource)} } from "@/db/schema";`],
-    wiring: [`  table: ${tableExport(entry.resource)},`, `  getDb,`]
+    imports: [
+      `import { createResourceHandlers, drizzleRows } from "@/lib/resource";`,
+      `import { getDb } from "@/db";`,
+      `import { ${tableExport(entry.resource)} } from "@/db/schema";`
+    ],
+    // Named rather than implied: the adapter is the one thing about this route
+    // that differs between stacks, so it is written out.
+    wiring: [`  rows: drizzleRows(${tableExport(entry.resource)}, getDb),`]
   };
   return [
-    `import { createResourceHandlers } from "@flaredev/core/server";`,
     ...source.imports,
     `import { authorize, currentUser } from "@/lib/api";`,
     `import { revalidateResource } from "@/lib/cache";`,
@@ -2326,6 +2359,49 @@ function renderItemRoute(entry, stack = "cloudflare") {
 var adminImports = (entry) => [
   `import ${resourceLocal(entry.stem)} from "@/resources/${entry.stem}.resource";`
 ];
+function renderAdminListLoading(entry) {
+  const columns = Math.min(6, storedFields2(entry.resource).length + 1);
+  return [
+    `import { ResourceListSkeleton } from "@/components/dashboard/skeletons";`,
+    "",
+    `export default function Loading() {`,
+    `  return <ResourceListSkeleton columns={${columns}} />;`,
+    "}",
+    ""
+  ].join("\n");
+}
+function renderAdminFormLoading(entry) {
+  const fields = Math.min(8, Math.max(1, storedFields2(entry.resource).length));
+  return [
+    `import { FormSkeleton, PageHeaderSkeleton } from "@/components/dashboard/skeletons";`,
+    "",
+    `export default function Loading() {`,
+    "  return (",
+    "    <>",
+    "      <PageHeaderSkeleton actions={0} />",
+    `      <FormSkeleton fields={${fields}} />`,
+    "    </>",
+    "  );",
+    "}",
+    ""
+  ].join("\n");
+}
+function renderAdminDetailLoading(entry) {
+  const rows = Math.min(10, Math.max(1, storedFields2(entry.resource).length));
+  return [
+    `import { DetailSkeleton, PageHeaderSkeleton } from "@/components/dashboard/skeletons";`,
+    "",
+    `export default function Loading() {`,
+    "  return (",
+    "    <>",
+    "      <PageHeaderSkeleton />",
+    `      <DetailSkeleton rows={${rows}} />`,
+    "    </>",
+    "  );",
+    "}",
+    ""
+  ].join("\n");
+}
 function renderAdminListPage(entry) {
   const local = resourceLocal(entry.stem);
   return [
@@ -2468,7 +2544,11 @@ function resourceFiles(entry, all, stack = "cloudflare") {
     { path: `app/dashboard/${resource.slug}/page.tsx`, content: renderAdminListPage(entry) },
     { path: `app/dashboard/${resource.slug}/[id]/page.tsx`, content: renderAdminDetailPage(entry) },
     { path: `app/dashboard/${resource.slug}/new/page.tsx`, content: renderAdminNewPage(entry) },
-    { path: `app/dashboard/${resource.slug}/[id]/edit/page.tsx`, content: renderAdminEditPage(entry) }
+    { path: `app/dashboard/${resource.slug}/[id]/edit/page.tsx`, content: renderAdminEditPage(entry) },
+    { path: `app/dashboard/${resource.slug}/loading.tsx`, content: renderAdminListLoading(entry) },
+    { path: `app/dashboard/${resource.slug}/new/loading.tsx`, content: renderAdminFormLoading(entry) },
+    { path: `app/dashboard/${resource.slug}/[id]/loading.tsx`, content: renderAdminDetailLoading(entry) },
+    { path: `app/dashboard/${resource.slug}/[id]/edit/loading.tsx`, content: renderAdminFormLoading(entry) }
   ];
 }
 
@@ -2550,7 +2630,9 @@ function findOrphans(appRoot, all) {
     for (const file of [`${dir}/route.ts`, `${dir}/[id]/route.ts`]) if (existsSync12(join11(appRoot, file))) candidates.push(file);
   }
   for (const dir of list2("app/dashboard", () => true)) {
-    for (const file of [`${dir}/page.tsx`, `${dir}/new/page.tsx`, `${dir}/[id]/page.tsx`, `${dir}/[id]/edit/page.tsx`]) {
+    const pages = [`${dir}/page.tsx`, `${dir}/new/page.tsx`, `${dir}/[id]/page.tsx`, `${dir}/[id]/edit/page.tsx`];
+    const skeletons = [`${dir}/loading.tsx`, `${dir}/new/loading.tsx`, `${dir}/[id]/loading.tsx`, `${dir}/[id]/edit/loading.tsx`];
+    for (const file of [...pages, ...skeletons]) {
       if (existsSync12(join11(appRoot, file))) candidates.push(file);
     }
   }
@@ -2562,11 +2644,19 @@ function findOrphans(appRoot, all) {
   return orphans;
 }
 function ensureSupportFiles(appRoot, log2) {
-  for (const path of ["lib/api.ts", "lib/cache.ts"]) {
+  const stack = readStack(appRoot);
+  const engine = ["rows.ts", "query.ts", "store.ts", "handlers.ts", "index.ts", stack === "next" ? "prisma-rows.ts" : "drizzle-rows.ts"].map(
+    (name) => `lib/resource/${name}`
+  );
+  for (const path of ["lib/api.ts", "lib/cache.ts", ...engine]) {
     const target = join11(appRoot, path);
     if (existsSync12(target)) continue;
+    const source = [join11(templatesDir, "next", path), join11(templatesDir, "app", path)].find(
+      (candidate) => (stack === "next" || !candidate.includes(`${sep}next${sep}`)) && existsSync12(candidate)
+    );
+    if (!source) continue;
     mkdirSync4(dirname5(target), { recursive: true });
-    copyFileSync2(join11(templatesDir, "app", path), target);
+    copyFileSync2(source, target);
     log2(`${pc5.green("create".padEnd(9))} ${path}`);
   }
 }
@@ -2610,30 +2700,30 @@ function addStripeDependency(appRoot) {
   return true;
 }
 function writeBillingResource(appRoot, name, force, log2) {
-  const relative2 = descriptorPath(name);
-  const path = join12(appRoot, relative2);
+  const relative3 = descriptorPath(name);
+  const path = join12(appRoot, relative3);
   if (!existsSync13(path)) {
     mkdirSync5(dirname6(path), { recursive: true });
     writeFileSync7(path, renderBillingDescriptor(name));
-    log2(`${pc6.green("create".padEnd(9))} ${relative2}`);
+    log2(`${pc6.green("create".padEnd(9))} ${relative3}`);
     return;
   }
   const parts = splitMarkers(readFileSync9(path, "utf8"));
-  if (!parts) throw new Error(`${relative2} has no generated fields block, so the billing fields can't be merged. Add them by hand: ${BILLING_RESOURCES[name]}`);
+  if (!parts) throw new Error(`${relative3} has no generated fields block, so the billing fields can't be merged. Add them by hand: ${BILLING_RESOURCES[name]}`);
   const merged = mergeBillingFields(name, parts.block);
   if (!merged) {
-    log2(`${pc6.dim("identical".padEnd(9))} ${relative2} (has every billing field)`);
+    log2(`${pc6.dim("identical".padEnd(9))} ${relative3} (has every billing field)`);
     return;
   }
   try {
     writeGenerated(path, merged, { force });
   } catch (error) {
     if (error instanceof DriftError) {
-      throw new Error(`${relative2}: its fields block was edited by hand, so the billing fields weren't merged. Pass --force, or add them yourself: ${BILLING_RESOURCES[name]}`);
+      throw new Error(`${relative3}: its fields block was edited by hand, so the billing fields weren't merged. Pass --force, or add them yourself: ${BILLING_RESOURCES[name]}`);
     }
     throw error;
   }
-  log2(`${pc6.yellow("update".padEnd(9))} ${relative2} (added billing fields, kept yours)`);
+  log2(`${pc6.yellow("update".padEnd(9))} ${relative3} (added billing fields, kept yours)`);
 }
 async function genBilling(options2 = {}) {
   const log2 = options2.log ?? ((message) => console.log(message));
@@ -2641,14 +2731,14 @@ async function genBilling(options2 = {}) {
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   for (const name of ["Plan", "Customer", "Purchase"]) writeBillingResource(appRoot, name, options2.force, log2);
   for (const [name, roles] of Object.entries(BILLING_POLICIES)) {
-    const relative2 = policyPath(name);
-    if (existsSync13(join12(appRoot, relative2))) {
-      log2(`${pc6.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+    const relative3 = policyPath(name);
+    if (existsSync13(join12(appRoot, relative3))) {
+      log2(`${pc6.dim("kept".padEnd(9))} ${relative3} (already exists)`);
       continue;
     }
     mkdirSync5(join12(appRoot, "policies"), { recursive: true });
-    writeFileSync7(join12(appRoot, relative2), renderPolicy(name, roles));
-    log2(`${pc6.green("create".padEnd(9))} ${relative2}`);
+    writeFileSync7(join12(appRoot, relative3), renderPolicy(name, roles));
+    log2(`${pc6.green("create".padEnd(9))} ${relative3}`);
   }
   const files = [];
   const appName = JSON.parse(readFileSync9(join12(appRoot, "package.json"), "utf8")).name ?? "app";
@@ -3233,15 +3323,15 @@ function securityFiles(appName) {
   ];
 }
 var PASS_THROUGH_HEADER = /^\/\/ Request protection for worker\/index\.ts\.[\s\S]*?\n(?=\/\/ generated:start)/;
-function writeOnce(appRoot, relative2, content, log2) {
-  const path = join13(appRoot, relative2);
+function writeOnce(appRoot, relative3, content, log2) {
+  const path = join13(appRoot, relative3);
   if (existsSync14(path)) {
-    log2(`${pc7.dim("kept".padEnd(9))} ${relative2} (already exists)`);
+    log2(`${pc7.dim("kept".padEnd(9))} ${relative3} (already exists)`);
     return;
   }
   mkdirSync6(dirname7(path), { recursive: true });
   writeFileSync8(path, content);
-  log2(`${pc7.green("create".padEnd(9))} ${relative2}`);
+  log2(`${pc7.green("create".padEnd(9))} ${relative3}`);
 }
 async function genSecurity(options2 = {}) {
   const log2 = options2.log ?? ((message) => console.log(message));
@@ -3513,16 +3603,16 @@ async function genEndpoint(resourceName2, rawName, options2 = {}) {
   const action = options2.action ?? (method === "GET" ? "read" : "update");
   if (!ACTIONS.includes(action)) throw new Error(`Unknown action "${action}". Use one of ${ACTIONS.join(", ")}.`);
   const { resource, stem } = entry;
-  const relative2 = options2.record ? `app/api/${resource.slug}/[id]/${name}/route.ts` : `app/api/${resource.slug}/${name}/route.ts`;
-  const path = join16(appRoot, relative2);
-  if (existsSync17(path)) throw new Error(`${relative2} already exists.`);
+  const relative3 = options2.record ? `app/api/${resource.slug}/[id]/${name}/route.ts` : `app/api/${resource.slug}/${name}/route.ts`;
+  const path = join16(appRoot, relative3);
+  if (existsSync17(path)) throw new Error(`${relative3} already exists.`);
   mkdirSync8(join16(path, ".."), { recursive: true });
   const route = options2.record ? `/api/${resource.slug}/[id]/${name}` : `/api/${resource.slug}/${name}`;
   writeFileSync11(path, renderEndpoint({ resource: resource.name, stem, method, action, record: Boolean(options2.record), name, route }));
-  log2(`${pc11.green("create".padEnd(9))} ${relative2}`);
+  log2(`${pc11.green("create".padEnd(9))} ${relative3}`);
   log2(`
 It's an ordinary route handler \u2014 edit it freely; regeneration leaves it alone.`);
-  return relative2;
+  return relative3;
 }
 function renderEndpoint({ resource, stem, method, action, record, route }) {
   const body = method === "GET" || method === "DELETE" ? "" : "  const body = (await request.json()) as Record<string, unknown>;\n";
@@ -3612,8 +3702,8 @@ async function genPolicy(rawName, options2) {
     const known = resources.map(({ resource }) => resource.name).join(", ") || "none";
     throw new Error(`No resource "${name}". Generate it first. Known resources: ${known}.`);
   }
-  const relative2 = policyPath(name);
-  const path = join18(appRoot, relative2);
+  const relative3 = policyPath(name);
+  const path = join18(appRoot, relative3);
   const exists = existsSync19(path);
   let roles;
   let deleteRoles;
@@ -3627,14 +3717,14 @@ async function genPolicy(rawName, options2) {
     if (!exists) {
       mkdirSync10(dirname9(path), { recursive: true });
       writeFileSync13(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
-      log2(`${pc13.green("create".padEnd(9))} ${relative2}`);
+      log2(`${pc13.green("create".padEnd(9))} ${relative3}`);
     } else {
       try {
         const outcome = writeGenerated(path, block, { force: options2.force });
-        log2(`${(outcome === "identical" ? pc13.dim : pc13.yellow)(outcome.padEnd(9))} ${relative2}`);
+        log2(`${(outcome === "identical" ? pc13.dim : pc13.yellow)(outcome.padEnd(9))} ${relative3}`);
       } catch (error) {
         if (error instanceof DriftError) {
-          throw new Error(`The roles in ${relative2} were edited by hand, so --roles won't overwrite them. Edit the file directly, or pass --force.`);
+          throw new Error(`The roles in ${relative3} were edited by hand, so --roles won't overwrite them. Edit the file directly, or pass --force.`);
         }
         throw error;
       }
@@ -3644,7 +3734,7 @@ async function genPolicy(rawName, options2) {
   logResults(applyPlan(appRoot, planFiles(resources, policies, readStack(appRoot))), log2);
   log2(`
 ${pc13.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
-  return { name, path: relative2 };
+  return { name, path: relative3 };
 }
 
 // src/commands/migrate.ts
@@ -3993,12 +4083,118 @@ ${result.output.trim()}`);
   return 0;
 }
 
+// src/commands/eject.ts
+import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync14, readdirSync as readdirSync8, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname11, join as join21, relative as relative2 } from "path";
+import pc17 from "picocolors";
+var TRACKED = ["lib/resource"];
+var prunedOn = (path, stack) => stack === "next" && CLOUDFLARE_ONLY.some((only) => path === only || path.startsWith(`${only}/`));
+function upstreamFile(path, stack) {
+  if (prunedOn(path, stack)) return void 0;
+  const candidates = stack === "next" ? [join21(templatesDir, "next", path), join21(templatesDir, "app", path)] : [join21(templatesDir, "app", path)];
+  return candidates.find((candidate) => existsSync22(candidate));
+}
+function trackedPaths(appRoot, stack) {
+  const paths = /* @__PURE__ */ new Set();
+  const walk = (base, dir) => {
+    if (!existsSync22(join21(base, dir))) return;
+    for (const entry of readdirSync8(join21(base, dir), { withFileTypes: true })) {
+      const next = `${dir}/${entry.name}`;
+      if (entry.isDirectory()) walk(base, next);
+      else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) paths.add(next);
+    }
+  };
+  for (const root of TRACKED) {
+    walk(appRoot, root);
+    walk(join21(templatesDir, "app"), root);
+    if (stack === "next") walk(join21(templatesDir, "next"), root);
+  }
+  return [...paths].filter((path) => upstreamFile(path, stack) !== void 0).sort();
+}
+function compareTracked(appRoot, stack, filter) {
+  return trackedPaths(appRoot, stack).filter((path) => !filter || path.includes(filter)).map((path) => {
+    const source = upstreamFile(path, stack);
+    const theirs = readFileSync14(source, "utf8");
+    const target = join21(appRoot, path);
+    if (!existsSync22(target)) return { path, state: "missing", theirs };
+    const mine = readFileSync14(target, "utf8");
+    return { path, state: mine === theirs ? "same" : "changed", mine, theirs };
+  });
+}
+function summarise(mine, theirs) {
+  const a = mine.split("\n");
+  const b = theirs.split("\n");
+  const lines = [];
+  const max = Math.max(a.length, b.length);
+  let shown = 0;
+  for (let index = 0; index < max && shown < 12; index += 1) {
+    if (a[index] === b[index]) continue;
+    if (a[index] !== void 0) lines.push(pc17.red(`  - ${a[index].slice(0, 100)}`));
+    if (b[index] !== void 0) lines.push(pc17.green(`  + ${b[index].slice(0, 100)}`));
+    shown += 1;
+  }
+  return lines;
+}
+function diffTracked(options2 = {}) {
+  const log2 = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const stack = readStack(appRoot);
+  const comparisons = compareTracked(appRoot, stack, options2.filter);
+  const changed = comparisons.filter((entry) => entry.state !== "same");
+  if (changed.length === 0) {
+    log2(pc17.green(`Up to date: ${comparisons.length} file(s) match this version of Flare.`));
+    return comparisons;
+  }
+  log2(pc17.bold(`${changed.length} of ${comparisons.length} file(s) differ from this version of Flare:
+`));
+  for (const entry of changed) {
+    if (entry.state === "missing") {
+      log2(`${pc17.yellow("missing")}  ${entry.path} ${pc17.dim("(Flare ships this; your app doesn't have it)")}`);
+      continue;
+    }
+    log2(`${pc17.cyan("changed")}  ${entry.path}`);
+    for (const line of summarise(entry.mine, entry.theirs)) log2(line);
+    log2("");
+  }
+  log2(pc17.dim(`Yours is "-", Flare's is "+". Apply with ${pc17.bold("flare update")}, or keep yours and do nothing.`));
+  return comparisons;
+}
+function updateTracked(options2 = {}) {
+  const log2 = options2.log ?? ((message) => console.log(message));
+  const appRoot = findAppRoot(options2.cwd ?? process.cwd());
+  const stack = readStack(appRoot);
+  const comparisons = compareTracked(appRoot, stack, options2.filter);
+  const changed = comparisons.filter((entry) => entry.state !== "same");
+  if (changed.length === 0) {
+    log2(pc17.green("Nothing to update."));
+    return 0;
+  }
+  if (!options2.yes) {
+    log2(pc17.bold(`${changed.length} file(s) would be overwritten with Flare's version:
+`));
+    for (const entry of changed) log2(`  ${entry.path}`);
+    log2(pc17.yellow(`
+This discards your edits to those files. Re-run with ${pc17.bold("--yes")} to proceed.`));
+    log2(pc17.dim(`See what would change first with ${pc17.bold("flare diff")}.`));
+    return 1;
+  }
+  for (const entry of changed) {
+    const target = join21(appRoot, entry.path);
+    mkdirSync11(dirname11(target), { recursive: true });
+    writeFileSync15(target, entry.theirs);
+    log2(`${pc17.green("update")}   ${relative2(process.cwd(), target) || entry.path}`);
+  }
+  log2(pc17.green(`
+Updated ${changed.length} file(s).`));
+  return 0;
+}
+
 // src/commands/seed.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, readdirSync as readdirSync8, rmSync as rmSync4, writeFileSync as writeFileSync15 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync12, readdirSync as readdirSync9, rmSync as rmSync5, writeFileSync as writeFileSync17 } from "fs";
+import { join as join23 } from "path";
 import { camelCase as camelCase6, createFake, kebabCase as kebabCase4, storedFields as storedFields3 } from "@flaredev/core";
 import { createJiti as createJiti4 } from "jiti";
-import pc17 from "picocolors";
+import pc18 from "picocolors";
 
 // src/seed/bulk.ts
 var MAX_STATEMENT_BYTES = 8e4;
@@ -4092,17 +4288,20 @@ function createInsertMany(sink, drizzle, onProgress) {
 }
 
 // src/seed/local-d1.ts
+import { readFileSync as readFileSync15, rmSync as rmSync4, writeFileSync as writeFileSync16 } from "fs";
 import { createRequire } from "module";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 import { pathToFileURL } from "url";
+import { parse as parseJsonc3 } from "jsonc-parser";
 var LOCAL_STATE = ".wrangler/state/v3";
 async function openLocalD1(appRoot, binding) {
   process.env.WRANGLER_LOG ??= "error";
-  const appRequire = createRequire(join21(appRoot, "package.json"));
+  const appRequire = createRequire(join22(appRoot, "package.json"));
   const wrangler = await import(pathToFileURL(appRequire.resolve("wrangler")).href);
+  const configPath = seedConfig(appRoot);
   const { env, dispose } = await wrangler.getPlatformProxy({
-    configPath: join21(appRoot, "wrangler.jsonc"),
-    persist: { path: join21(appRoot, LOCAL_STATE) }
+    configPath,
+    persist: { path: join22(appRoot, LOCAL_STATE) }
   });
   const bindings = env;
   const name = binding ?? "DB";
@@ -4111,14 +4310,30 @@ async function openLocalD1(appRoot, binding) {
     const available = Object.keys(bindings).filter((key) => typeof bindings[key]?.prepare === "function");
     throw new Error(`No "${name}" database binding in wrangler.jsonc.${available.length ? ` Available: ${available.join(", ")}.` : ""}`);
   }
-  return { db, env: bindings, dispose };
+  return {
+    db,
+    env: bindings,
+    dispose: async () => {
+      await dispose();
+      rmSync4(configPath, { force: true });
+    }
+  };
+}
+function seedConfig(appRoot) {
+  const source = join22(appRoot, "wrangler.jsonc");
+  const config = parseJsonc3(readFileSync15(source, "utf8")) ?? {};
+  delete config.durable_objects;
+  delete config.migrations;
+  const path = join22(appRoot, ".flare-seed.wrangler.json");
+  writeFileSync16(path, JSON.stringify(config, null, 2));
+  return path;
 }
 
 // src/commands/seed.ts
 var SEEDS_DIR = "seeds";
 function seedFiles(appRoot, names) {
-  const dir = join22(appRoot, SEEDS_DIR);
-  const all = existsSync22(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
+  const dir = join23(appRoot, SEEDS_DIR);
+  const all = existsSync23(dir) ? readdirSync9(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
   if (!names?.length) return all;
   return names.map((name) => {
     const file = `${name.replace(/\.seed\.ts$/, "")}.seed.ts`;
@@ -4133,28 +4348,28 @@ async function runSeeds(options2 = {}) {
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const files = seedFiles(appRoot, options2.names);
   if (files.length === 0) {
-    log2(`No seeds found. Create one with ${pc17.bold("flare seed:make <name>")}.`);
+    log2(`No seeds found. Create one with ${pc18.bold("flare seed:make <name>")}.`);
     return;
   }
   if (readStack(appRoot) === "next") {
     await runPrismaSeeds(appRoot, files, log2);
     return;
   }
-  const jiti = createJiti4(join22(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
+  const jiti = createJiti4(join23(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
   const { drizzle } = await jiti.import("drizzle-orm/d1");
   const drizzleHelpers = await jiti.import("drizzle-orm");
-  const schema = await jiti.import(join22(appRoot, "db/schema.ts"));
+  const schema = await jiti.import(join23(appRoot, "db/schema.ts"));
   const local = await openLocalD1(appRoot);
   try {
     const db = drizzle(local.db, { schema });
     const insertMany = createInsertMany(local.db, drizzleHelpers);
     for (const file of files) {
-      const mod = await jiti.import(join22(appRoot, SEEDS_DIR, file));
+      const mod = await jiti.import(join23(appRoot, SEEDS_DIR, file));
       if (typeof mod.default !== "function") throw new Error(`${SEEDS_DIR}/${file} must \`export default defineSeed(async ({ db }) => { ... })\`.`);
-      log2(`${pc17.cyan("seed")} ${file}`);
+      log2(`${pc18.cyan("seed")} ${file}`);
       await mod.default({ db, env: local.env, insertMany, fake: createFake(), log: (message) => log2(`  ${message}`) });
     }
-    log2(pc17.green(`
+    log2(pc18.green(`
 Ran ${files.length} seed(s) against the local database.`));
   } finally {
     await local.dispose();
@@ -4265,9 +4480,9 @@ async function makeSeed(rawName, options2 = {}) {
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = kebabCase4(rawName);
   if (!name) throw new Error(`Invalid seed name "${rawName}".`);
-  const relative2 = `${SEEDS_DIR}/${name}.seed.ts`;
-  const path = join22(appRoot, relative2);
-  if (existsSync22(path)) throw new Error(`${relative2} already exists.`);
+  const relative3 = `${SEEDS_DIR}/${name}.seed.ts`;
+  const path = join23(appRoot, relative3);
+  if (existsSync23(path)) throw new Error(`${relative3} already exists.`);
   const resources = (await loadResources(appRoot)).map(({ resource: resource2 }) => resource2);
   let resource;
   if (options2.resource) {
@@ -4276,15 +4491,15 @@ async function makeSeed(rawName, options2 = {}) {
   } else {
     resource = resources.find((r) => [kebabCase4(r.name), r.slug].includes(name));
   }
-  mkdirSync11(join22(appRoot, SEEDS_DIR), { recursive: true });
-  writeFileSync15(path, renderSeed(resource, readStack(appRoot)));
-  log2(`${pc17.green("create".padEnd(9))} ${relative2}`);
+  mkdirSync12(join23(appRoot, SEEDS_DIR), { recursive: true });
+  writeFileSync17(path, renderSeed(resource, readStack(appRoot)));
+  log2(`${pc18.green("create".padEnd(9))} ${relative3}`);
   log2(`
-Run it with ${pc17.bold(`flare seed ${name}`)}.`);
-  return relative2;
+Run it with ${pc18.bold(`flare seed ${name}`)}.`);
+  return relative3;
 }
 async function runPrismaSeeds(appRoot, files, log2) {
-  const runner = join22(appRoot, ".flare-seed-runner.mts");
+  const runner = join23(appRoot, ".flare-seed-runner.mts");
   const script = [
     `import "dotenv/config";`,
     `import { createFake } from "@flaredev/core";`,
@@ -4312,23 +4527,23 @@ async function runPrismaSeeds(appRoot, files, log2) {
     `await (prisma as unknown as { $disconnect(): Promise<void> }).$disconnect();`,
     ""
   ].join("\n");
-  writeFileSync15(runner, script);
+  writeFileSync17(runner, script);
   try {
     const tsx = resolveBin(appRoot, "tsx", "tsx");
     const code = await runNode([tsx, runner], appRoot);
     if (code !== 0) throw new Error("A seed failed; nothing further was run.");
-    log2(pc17.green(`
+    log2(pc18.green(`
 Ran ${files.length} seed(s).`));
   } finally {
-    rmSync4(runner, { force: true });
+    rmSync5(runner, { force: true });
   }
 }
 
 // src/commands/db-push.ts
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync5, writeFileSync as writeFileSync16 } from "fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync18 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join23 } from "path";
-import pc18 from "picocolors";
+import { join as join24 } from "path";
+import pc19 from "picocolors";
 
 // src/terminal.ts
 var isTTY = () => Boolean(process.stdout.isTTY);
@@ -4392,7 +4607,7 @@ async function dbPush(tables, options2 = {}) {
   const wrangler = resolveBin(appRoot, "wrangler", "wrangler");
   const started = Date.now();
   const local = await openLocalD1(appRoot, options2.database);
-  const dir = mkdtempSync2(join23(tmpdir2(), "flare-push-"));
+  const dir = mkdtempSync2(join24(tmpdir2(), "flare-push-"));
   try {
     const statements = [];
     const counts = [];
@@ -4411,33 +4626,33 @@ async function dbPush(tables, options2 = {}) {
         offset += PAGE;
       }
       counts.push({ table, rows });
-      log2(`${pc18.cyan("read")} ${table} ${pc18.dim(`(${formatCount(rows)} rows)`)}`);
+      log2(`${pc19.cyan("read")} ${table} ${pc19.dim(`(${formatCount(rows)} rows)`)}`);
     }
     const total = counts.reduce((sum, entry) => sum + entry.rows, 0);
     if (total === 0) {
       log2("Nothing to push: those tables are empty locally.");
       return { tables: counts, ms: Date.now() - started };
     }
-    const file = join23(dir, "push.sql");
-    writeFileSync16(file, statements.join("\n"));
+    const file = join24(dir, "push.sql");
+    writeFileSync18(file, statements.join("\n"));
     const target = ["--remote", ...options2.env ? ["--env", options2.env] : []];
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--yes", "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Pushing to ${db.database_name} failed:
 ${result.output.trim()}`);
     const ms = Date.now() - started;
-    log2(`${pc18.green("\u2714")} Pushed ${pc18.bold(formatCount(total))} rows to ${pc18.bold(db.database_name)} ${pc18.dim(`(${formatDuration(ms)})`)}`);
+    log2(`${pc19.green("\u2714")} Pushed ${pc19.bold(formatCount(total))} rows to ${pc19.bold(db.database_name)} ${pc19.dim(`(${formatDuration(ms)})`)}`);
     return { tables: counts, ms };
   } finally {
-    rmSync5(dir, { recursive: true, force: true });
+    rmSync6(dir, { recursive: true, force: true });
     await local.dispose();
   }
 }
 
 // src/commands/seed-resource.ts
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync19 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join24 } from "path";
-import pc19 from "picocolors";
+import { join as join25 } from "path";
+import pc20 from "picocolors";
 
 // src/seed/rows.ts
 import { columnName as columnName3, createFake as createFake2, storedFields as storedFields4 } from "@flaredev/core";
@@ -4621,13 +4836,13 @@ async function seedResourceCommand(name, options2 = {}) {
       ...options2,
       onProgress: (written, total) => {
         const elapsed = Date.now() - started;
-        progress.update(`  ${pc19.cyan(formatCount(written))} of ${formatCount(total)} rows  ${pc19.dim(formatRate(written, elapsed))}`);
+        progress.update(`  ${pc20.cyan(formatCount(written))} of ${formatCount(total)} rows  ${pc20.dim(formatRate(written, elapsed))}`);
       }
     });
     progress.done();
     const { rows, ms, where } = result;
     console.log(
-      `${pc19.green("\u2714")} Seeded ${pc19.bold(formatCount(rows))} ${result.resource.pluralLabel.toLowerCase()} into the ${where} database ` + pc19.dim(`(${formatDuration(ms)}, ${formatRate(rows, ms)})`)
+      `${pc20.green("\u2714")} Seeded ${pc20.bold(formatCount(rows))} ${result.resource.pluralLabel.toLowerCase()} into the ${where} database ` + pc20.dim(`(${formatDuration(ms)}, ${formatRate(rows, ms)})`)
     );
     return result;
   } catch (error) {
@@ -4675,8 +4890,8 @@ ${result.output.trim()}`);
       const [counted] = await query(`SELECT count(*) AS total FROM "${resource.table}"`);
       startIndex = counted?.total ?? 0;
     }
-    const dir = mkdtempSync3(join24(tmpdir3(), "flare-seed-"));
-    const file = join24(dir, `${resource.table}.sql`);
+    const dir = mkdtempSync3(join25(tmpdir3(), "flare-seed-"));
+    const file = join25(dir, `${resource.table}.sql`);
     try {
       const statements = [];
       if (options2.truncate) statements.push(`DELETE FROM "${resource.table}";`);
@@ -4686,13 +4901,13 @@ ${result.output.trim()}`);
         written += statement.rows;
         options2.onProgress?.(written, total);
       }
-      writeFileSync17(file, statements.join("\n"));
-      log2(`${pc19.cyan("\u25CF")} Uploading ${total.toLocaleString()} rows to ${pc19.bold(db.database_name)}`);
+      writeFileSync19(file, statements.join("\n"));
+      log2(`${pc20.cyan("\u25CF")} Uploading ${total.toLocaleString()} rows to ${pc20.bold(db.database_name)}`);
       const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--yes", "--file", file], appRoot, { capture: true });
       if (result.code !== 0) throw new Error(`Seeding the remote database failed:
 ${result.output.trim()}`);
     } finally {
-      rmSync6(dir, { recursive: true, force: true });
+      rmSync7(dir, { recursive: true, force: true });
     }
     return { resource, rows: total, ms: Date.now() - started, where };
   }
@@ -4719,17 +4934,17 @@ ${result.output.trim()}`);
 
 // src/commands/billing-sync.ts
 import { createRequire as createRequire2 } from "module";
-import { existsSync as existsSync23, mkdtempSync as mkdtempSync4, readFileSync as readFileSync14, rmSync as rmSync7, writeFileSync as writeFileSync18 } from "fs";
+import { existsSync as existsSync24, mkdtempSync as mkdtempSync4, readFileSync as readFileSync16, rmSync as rmSync8, writeFileSync as writeFileSync20 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import { kebabCase as kebabCase5 } from "@flaredev/core";
-import pc20 from "picocolors";
+import pc21 from "picocolors";
 function stripeKeys(appRoot) {
   const map = {};
-  const path = join25(appRoot, ".dev.vars");
-  if (existsSync23(path)) {
-    for (const line of readFileSync14(path, "utf8").split(/\r?\n/)) {
+  const path = join26(appRoot, ".dev.vars");
+  if (existsSync24(path)) {
+    for (const line of readFileSync16(path, "utf8").split(/\r?\n/)) {
       const match = /^\s*([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match) map[match[1]] = match[2].trim();
     }
@@ -4812,10 +5027,10 @@ async function syncPlans(options2 = {}) {
   if (!key) throw new Error("STRIPE_SECRET_KEY is not set in .dev.vars or the environment.");
   const db = readD1Databases(appRoot)[0];
   if (!db) throw new Error("No d1_databases in wrangler.jsonc.");
-  const appRequire = createRequire2(join25(appRoot, "package.json"));
+  const appRequire = createRequire2(join26(appRoot, "package.json"));
   const stripeModule = await import(pathToFileURL2(appRequire.resolve("stripe")).href);
   const stripe = new stripeModule.default(key, { apiVersion: "2026-08-26.dahlia" });
-  const appName = JSON.parse(readFileSync14(join25(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync16(join26(appRoot, "package.json"), "utf8")).name ?? "app";
   const everything = await stripe.products.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 });
   const products = options2.all ? everything : everything.filter((product) => product.metadata?.flare_app === appName);
   if (products.length === 0) {
@@ -4836,41 +5051,41 @@ async function syncPlans(options2 = {}) {
 ${existingResult.output.trim()}`);
   }
   const known = new Set(extractJson(existingResult.output)[0]?.results.map((row) => row.stripe_price_id));
-  const dir = mkdtempSync4(join25(tmpdir4(), "flare-sync-"));
+  const dir = mkdtempSync4(join26(tmpdir4(), "flare-sync-"));
   try {
-    const file = join25(dir, "sync-plans.sql");
-    writeFileSync18(file, renderSyncSql(rows));
+    const file = join26(dir, "sync-plans.sql");
+    writeFileSync20(file, renderSyncSql(rows));
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Could not write plans:
 ${result.output.trim()}`);
   } finally {
-    rmSync7(dir, { recursive: true, force: true });
+    rmSync8(dir, { recursive: true, force: true });
   }
   let created = 0;
   for (const row of rows) {
     const isNew = !known.has(row.stripePriceId);
     if (isNew) created++;
     const price = `${row.currency.toUpperCase()} ${(row.amount / 100).toFixed(2)}${row.interval ? `/${row.interval}` : " once"}`;
-    log2(`${(isNew ? pc20.green("create") : pc20.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc20.dim(price)}`);
+    log2(`${(isNew ? pc21.green("create") : pc21.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc21.dim(price)}`);
   }
-  for (const name of skipped) log2(pc20.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
+  for (const name of skipped) log2(pc21.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
   const configuration = await syncPortalConfiguration(stripe, rows, appName);
-  if (configuration) log2(`${pc20.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
-  log2(pc20.green(`
+  if (configuration) log2(`${pc21.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
+  log2(pc21.green(`
 ${rows.length} plan(s) synced to the ${options2.remote ? "remote" : "local"} database; plans no longer active in Stripe were deactivated.`));
   return { created, updated: rows.length - created, skipped };
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync24 } from "fs";
-import { join as join26 } from "path";
-import pc21 from "picocolors";
+import { existsSync as existsSync25 } from "fs";
+import { join as join27 } from "path";
+import pc22 from "picocolors";
 async function syncTypes(options2 = {}) {
   const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const all = await loadResources(appRoot);
   const policies = await loadPolicies(appRoot);
-  const tracksPolicies = policies.length > 0 || existsSync24(join26(appRoot, "policies/index.ts"));
+  const tracksPolicies = policies.length > 0 || existsSync25(join27(appRoot, "policies/index.ts"));
   const plan = planFiles(all, tracksPolicies ? policies : void 0, readStack(appRoot));
   if (!options2.check) ensureSupportFiles(appRoot, log2);
   const results = applyPlan(appRoot, plan, { force: options2.force, dryRun: options2.check });
@@ -4882,42 +5097,42 @@ async function syncTypes(options2 = {}) {
   if (drift.length) {
     log2(
       `
-${pc21.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
+${pc22.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
 Move custom code outside the // generated:start \u2026 // generated:end block, or re-run with --force to overwrite.`
     );
   }
   if (unmarked.length) {
     log2(`
-${pc21.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
+${pc22.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
   }
   if (orphans.length) {
     const resources = [...new Set(orphans.map((o) => o.resource))];
     log2(`
-${pc21.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
+${pc22.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
     for (const orphan of orphans) log2(`  ${orphan.path}`);
     log2(
-      `If the resource was deleted, remove them with ${pc21.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
+      `If the resource was deleted, remove them with ${pc22.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
     );
   }
   const tablesChanged = changed.some((r) => r.path.startsWith("db/schema/") && (r.status === "outdated" || r.status === "missing"));
   if (tablesChanged && !options2.check) {
     log2(`
-${pc21.cyan("Tables changed.")} Create a migration with ${pc21.bold("flare gen migration <name> --from-schema")}, then ${pc21.bold("flare migrate")}.`);
+${pc22.cyan("Tables changed.")} Create a migration with ${pc22.bold("flare gen migration <name> --from-schema")}, then ${pc22.bold("flare migrate")}.`);
   }
   const problems = drift.length + unmarked.length + orphans.length;
   if (options2.check) {
     const stale = changed.length;
-    if (stale === 0 && problems === 0) log2(pc21.green("Generated files are in sync with the resource descriptors."));
+    if (stale === 0 && problems === 0) log2(pc22.green("Generated files are in sync with the resource descriptors."));
     else log2(`
-${pc21.red("Out of sync:")} ${stale} file(s) would change. Run ${pc21.bold("flare sync-types")}.`);
+${pc22.red("Out of sync:")} ${stale} file(s) would change. Run ${pc22.bold("flare sync-types")}.`);
     return stale + problems > 0 ? 1 : 0;
   }
-  if (changed.length === 0 && problems === 0) log2(pc21.green("Everything is in sync."));
+  if (changed.length === 0 && problems === 0) log2(pc22.green("Everything is in sync."));
   return problems > 0 ? 1 : 0;
 }
 
 // src/commands/user-role.ts
-import pc22 from "picocolors";
+import pc23 from "picocolors";
 var ROLE = /^[a-z][a-z0-9_-]{0,31}$/;
 var EMAIL = /^[^\s@'"\\]+@[^\s@'"\\]+\.[^\s@'"\\]+$/;
 function userRoleSql(email, role) {
@@ -4931,8 +5146,8 @@ async function setUserRole(email, role, options2 = {}) {
   const sql2 = userRoleSql(email, role);
   const roles = await listRoles(options2);
   if (roles && !roles.includes(role)) {
-    log2(pc22.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
-    log2(pc22.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
+    log2(pc23.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
+    log2(pc23.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
     return 1;
   }
   const db = readD1Databases(appRoot)[0];
@@ -4946,31 +5161,31 @@ ${result.output.trim()}`);
   const [first] = extractJson(result.output);
   const updated = first?.results ?? [];
   if (updated.length === 0) {
-    log2(pc22.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
+    log2(pc23.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
     return 1;
   }
-  log2(pc22.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
+  log2(pc23.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
   return 0;
 }
 
 // src/utils/install.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync25, readFileSync as readFileSync15, readdirSync as readdirSync9 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync17, readdirSync as readdirSync10 } from "fs";
+import { join as join28 } from "path";
 function expectedPackages(dir) {
-  const npmLock = join27(dir, "package-lock.json");
-  if (existsSync25(npmLock)) {
+  const npmLock = join28(dir, "package-lock.json");
+  if (existsSync26(npmLock)) {
     try {
-      const lock = JSON.parse(readFileSync15(npmLock, "utf8"));
+      const lock = JSON.parse(readFileSync17(npmLock, "utf8"));
       return Math.max(0, Object.keys(lock.packages ?? {}).length - 1);
     } catch {
       return 0;
     }
   }
-  const pnpmLock = join27(dir, "pnpm-lock.yaml");
-  if (existsSync25(pnpmLock)) {
+  const pnpmLock = join28(dir, "pnpm-lock.yaml");
+  if (existsSync26(pnpmLock)) {
     try {
-      const text = readFileSync15(pnpmLock, "utf8");
+      const text = readFileSync17(pnpmLock, "utf8");
       const packages = text.slice(text.indexOf("\npackages:"));
       return (packages.match(/\n {2}[^\s:]+:/g) ?? []).length;
     } catch {
@@ -4980,15 +5195,15 @@ function expectedPackages(dir) {
   return 0;
 }
 function installedPackages(dir) {
-  const root = join27(dir, "node_modules");
-  if (!existsSync25(root)) return 0;
+  const root = join28(dir, "node_modules");
+  if (!existsSync26(root)) return 0;
   let total = 0;
   try {
-    for (const entry of readdirSync9(root, { withFileTypes: true })) {
+    for (const entry of readdirSync10(root, { withFileTypes: true })) {
       if (!entry.isDirectory() || entry.name === ".bin") continue;
       if (entry.name.startsWith("@")) {
         try {
-          total += readdirSync9(join27(root, entry.name)).length;
+          total += readdirSync10(join28(root, entry.name)).length;
         } catch {
         }
       } else if (entry.name !== ".pnpm" && entry.name !== ".vite") {
@@ -5049,7 +5264,7 @@ function createCli() {
         });
         installed = outcome.code === 0;
         if (installed) {
-          spin.stop(`Installed ${formatCount(expectedPackages(result.dir) || 0)} packages with ${result.packageManager} ${pc23.dim(`(${formatDuration(outcome.ms)})`)}`);
+          spin.stop(`Installed ${formatCount(expectedPackages(result.dir) || 0)} packages with ${result.packageManager} ${pc24.dim(`(${formatDuration(outcome.ms)})`)}`);
         } else {
           spin.error(`${result.packageManager} install failed`);
           process.stderr.write(outcome.output);
@@ -5099,6 +5314,13 @@ function createCli() {
   cli.command("seed:resource <resource> [count]", "Fill a resource's table with sample rows built from its descriptor").option("--count <rows>", "How many rows: 1000, 25k, 1m (default: 25)").option("--remote", "Seed the deployed database instead of the local one (needs --yes)").option("--truncate", "Delete the table's rows first").option("--seed <number>", "Same number, same rows").option("--env <name>", "Wrangler environment").option("--database <binding>", "D1 binding, when the app has several").option("-y, --yes", "Confirm writing to the remote database").example("flare seed:resource Contact --count 1000").example("flare seed:resource Contact 1m            # a million rows").example("flare seed:resource Contact 5k --remote --yes").action(async (resource, count, options2) => {
     await seedResourceCommand(resource, { ...options2, count: options2.count ?? count });
   });
+  cli.command("diff [filter]", "Show how the code Flare copied into this app (lib/resource) differs from the current version").example("flare diff").example('flare diff store          # just the files whose path contains "store"').action((filter) => {
+    diffTracked({ filter });
+  });
+  cli.command("update [filter]", "Replace this app's copies of Flare's files with the current version (discards your edits)").option("-y, --yes", "Confirm overwriting").example("flare update            # lists what would change").example("flare update --yes      # applies it").action((filter, options2) => {
+    const code = updateTracked({ filter, yes: options2.yes });
+    if (code !== 0) process.exitCode = code;
+  });
   cli.command("db:push [...tables]", "Copy rows from the local database to the deployed one (seeded catalogues, reference data)").option("--truncate", "Delete the remote rows of those tables first").option("--database <binding>", "D1 binding, when the app has several").option("--env <name>", "Wrangler environment").option("-y, --yes", "Confirm writing to the deployed database").example("flare db:push products categories --yes").example("flare db:push plans --truncate --yes").action(async (tables, options2) => {
     await dbPush(tables, options2);
   });
@@ -5147,6 +5369,6 @@ try {
     }
   }
 } catch (error) {
-  console.error(pc24.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
+  console.error(pc25.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
   process.exitCode = 1;
 }