@flaredev/cli 0.6.2 → 0.7.1

package/dist/index.js

@@ -2310,31 +2310,23 @@ ${lines.join("\n")}
   const imports = [...used].sort((a, b) => a.table.localeCompare(b.table)).map((resource) => `import { ${tableExport(resource)} } from "./schema/${resource.table}";`);
   return [`import { relations } from "drizzle-orm";`, ...imports, "", blocks.join("\n")].join("\n");
 }
-var handlerImports = (entry, stack = "cloudflare") => {
+var routeHeader = (entry, stack) => {
   const local = resourceLocal(entry.stem);
-  const source = stack === "next" ? {
-    imports: [`import { createResourceHandlers, prismaRows } from "@/lib/resource";`, `import { prisma } from "@/lib/db";`],
-    wiring: [`  rows: prismaRows(prisma.${camelCase4(entry.resource.name)}, prisma),`]
-  } : {
-    imports: [
-      `import { createResourceHandlers, drizzleRows } from "@/lib/resource";`,
-      `import { getDb } from "@/db";`,
-      `import { ${tableExport(entry.resource)} } from "@/db/schema";`
-    ],
-    // Named rather than implied: the adapter is the one thing about this route
-    // that differs between stacks, so it is written out.
-    wiring: [`  rows: drizzleRows(${tableExport(entry.resource)}, getDb),`]
+  const source = stack === "next" ? { imports: [`import { prisma } from "@/lib/db";`], rows: `prismaRows(prisma.${camelCase4(entry.resource.name)}, prisma)` } : {
+    imports: [`import { getDb } from "@/db";`, `import { ${tableExport(entry.resource)} } from "@/db/schema";`],
+    rows: `drizzleRows(${tableExport(entry.resource)}, getDb)`
   };
-  return [
+  const adapter = stack === "next" ? "prismaRows" : "drizzleRows";
+  return (helpers) => [
+    `import { createResourceStore, ${[adapter, ...helpers].join(", ")} } from "@/lib/resource";`,
     ...source.imports,
     `import { authorize, currentUser } from "@/lib/api";`,
     `import { revalidateResource } from "@/lib/cache";`,
     `import ${local} from "@/resources/${entry.stem}.resource";`,
     "",
-    `const handlers = createResourceHandlers({`,
+    `const store = createResourceStore({`,
     `  resource: ${local},`,
-    ...source.wiring,
-    `  authorize,`,
+    `  rows: ${source.rows},`,
     `  currentUser,`,
     `  onChange: revalidateResource,`,
     `});`,
@@ -2342,18 +2334,99 @@ var handlerImports = (entry, stack = "cloudflare") => {
   ];
 };
 function renderCollectionRoute(entry, stack = "cloudflare") {
-  return [...handlerImports(entry, stack), "export const GET = handlers.collection.GET;", "export const POST = handlers.collection.POST;", ""].join(
-    "\n"
-  );
+  const local = resourceLocal(entry.stem);
+  const plural = entry.resource.pluralLabel.toLowerCase();
+  return [
+    ...routeHeader(entry, stack)(["crossOrigin", "drain", "failureResponse", "problem", "readJson", "respond"]),
+    `/** GET /api/${entry.resource.slug} \u2014 list ${plural}. Query: page, perPage, sort, q, filter[field], cursor. */`,
+    `export async function GET(request: Request): Promise<Response> {`,
+    `  const denied = await authorize({ request, resource: ${local}, action: "list" });`,
+    `  if (denied) return denied;`,
+    "",
+    `  return respond(await store.list(new URL(request.url).searchParams));`,
+    `}`,
+    "",
+    `/** POST /api/${entry.resource.slug} \u2014 create one. */`,
+    `export async function POST(request: Request): Promise<Response> {`,
+    `  try {`,
+    `    const denied = await authorize({ request, resource: ${local}, action: "create" });`,
+    `    if (denied) return denied;`,
+    `    if (crossOrigin(request)) return problem(403, "Cross-origin request blocked.");`,
+    "",
+    `    const read = await readJson(request);`,
+    `    if ("response" in read) return read.response;`,
+    "",
+    `    const result = await store.create(read.body);`,
+    `    if (!result.ok) return failureResponse(result);`,
+    "",
+    '    const location = `${new URL(request.url).pathname.replace(/\\/$/, "")}/${result.data.id as string}`;',
+    `    return Response.json(result.data, { status: 201, headers: { location } });`,
+    `  } finally {`,
+    `    // A body left unread breaks the next request through wrangler's dev proxy.`,
+    `    await drain(request);`,
+    `  }`,
+    `}`,
+    ""
+  ].join("\n");
 }
 function renderItemRoute(entry, stack = "cloudflare") {
-  return [
-    ...handlerImports(entry, stack),
-    "export const GET = handlers.item.GET;",
-    "export const PATCH = handlers.item.PATCH;",
-    "export const PUT = handlers.item.PUT;",
-    "export const DELETE = handlers.item.DELETE;",
+  const local = resourceLocal(entry.stem);
+  const one = entry.resource.label.toLowerCase();
+  const write = (method, action, call, doc) => [
+    `/** ${doc} */`,
+    `export async function ${method}(request: Request, context: RouteContext): Promise<Response> {`,
+    `  try {`,
+    `    const { id } = await context.params;`,
+    `    const denied = await authorize({ request, resource: ${local}, action: "${action}", id });`,
+    `    if (denied) return denied;`,
+    `    if (crossOrigin(request)) return problem(403, "Cross-origin request blocked.");`,
+    "",
+    ...call.split("\n"),
+    `  } finally {`,
+    `    await drain(request);`,
+    `  }`,
+    `}`,
     ""
+  ];
+  return [
+    ...routeHeader(entry, stack)(["crossOrigin", "drain", "failureResponse", "problem", "readJson", "respond", "type RouteContext"]),
+    `/** GET /api/${entry.resource.slug}/[id] \u2014 read one ${one}. */`,
+    `export async function GET(request: Request, context: RouteContext): Promise<Response> {`,
+    `  const { id } = await context.params;`,
+    `  const denied = await authorize({ request, resource: ${local}, action: "read", id });`,
+    `  if (denied) return denied;`,
+    "",
+    `  return respond(await store.get(id));`,
+    `}`,
+    "",
+    ...write(
+      "PATCH",
+      "update",
+      [
+        `    const read = await readJson(request);`,
+        `    if ("response" in read) return read.response;`,
+        "",
+        `    return respond(await store.update(id, read.body));`
+      ].join("\n"),
+      `PATCH /api/${entry.resource.slug}/[id] \u2014 change some fields of one ${one}.`
+    ),
+    ...write(
+      "PUT",
+      "update",
+      [
+        `    const read = await readJson(request);`,
+        `    if ("response" in read) return read.response;`,
+        "",
+        `    return respond(await store.replace(id, read.body));`
+      ].join("\n"),
+      `PUT /api/${entry.resource.slug}/[id] \u2014 replace one ${one} entirely.`
+    ),
+    ...write(
+      "DELETE",
+      "delete",
+      [`    const result = await store.delete(id);`, `    return result.ok ? new Response(null, { status: 204 }) : failureResponse(result);`].join("\n"),
+      `DELETE /api/${entry.resource.slug}/[id] \u2014 remove one ${one}.`
+    )
   ].join("\n");
 }
 var adminImports = (entry) => [
@@ -2645,7 +2718,7 @@ function findOrphans(appRoot, all) {
 }
 function ensureSupportFiles(appRoot, log2) {
   const stack = readStack(appRoot);
-  const engine = ["rows.ts", "query.ts", "store.ts", "handlers.ts", "index.ts", stack === "next" ? "prisma-rows.ts" : "drizzle-rows.ts"].map(
+  const engine = ["rows.ts", "query.ts", "http.ts", "store.ts", "handlers.ts", "index.ts", stack === "next" ? "prisma-rows.ts" : "drizzle-rows.ts"].map(
     (name) => `lib/resource/${name}`
   );
   for (const path of ["lib/api.ts", "lib/cache.ts", ...engine]) {
@@ -5132,6 +5205,8 @@ ${pc22.red("Out of sync:")} ${stale} file(s) would change. Run ${pc22.bold("flar
 }
 
 // src/commands/user-role.ts
+import { rmSync as rmSync9, writeFileSync as writeFileSync21 } from "fs";
+import { join as join28 } from "path";
 import pc23 from "picocolors";
 var ROLE = /^[a-z][a-z0-9_-]{0,31}$/;
 var EMAIL = /^[^\s@'"\\]+@[^\s@'"\\]+\.[^\s@'"\\]+$/;
@@ -5144,6 +5219,7 @@ async function setUserRole(email, role, options2 = {}) {
   const log2 = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const sql2 = userRoleSql(email, role);
+  if (readStack(appRoot) === "next") return setUserRoleOnPrisma(appRoot, email, role, log2);
   const roles = await listRoles(options2);
   if (roles && !roles.includes(role)) {
     log2(pc23.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
@@ -5167,13 +5243,45 @@ ${result.output.trim()}`);
   log2(pc23.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
   return 0;
 }
+async function setUserRoleOnPrisma(appRoot, email, role, log2) {
+  const runner = join28(appRoot, ".flare-role-runner.mts");
+  const script = [
+    `import "dotenv/config";`,
+    `import { prisma } from "./lib/db";`,
+    "",
+    `const client = prisma as unknown as { user: { updateMany(args: unknown): Promise<{ count: number }> }; $disconnect(): Promise<void> };`,
+    `const { count } = await client.user.updateMany({`,
+    `  where: { email: { equals: ${JSON.stringify(email)}, mode: "insensitive" } },`,
+    `  data: { role: ${JSON.stringify(role)} },`,
+    `});`,
+    `await client.$disconnect();`,
+    `// 3 means "no account with that email", which the CLI turns into a useful message.`,
+    `if (count === 0) process.exit(3);`,
+    ""
+  ].join("\n");
+  writeFileSync21(runner, script);
+  try {
+    const tsx = resolveBin(appRoot, "tsx", "tsx");
+    const code = await runNode([tsx, runner], appRoot);
+    if (code === 3) {
+      log2(pc23.red(`No account with the email ${email}.`));
+      log2(pc23.dim("Sign up first, then set the role."));
+      return 1;
+    }
+    if (code !== 0) return code;
+    log2(pc23.green(`\u2714 ${email} is now ${role}.`));
+    return 0;
+  } finally {
+    rmSync9(runner, { force: true });
+  }
+}
 
 // src/utils/install.ts
 import { spawn as spawn5 } from "child_process";
 import { existsSync as existsSync26, readFileSync as readFileSync17, readdirSync as readdirSync10 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 function expectedPackages(dir) {
-  const npmLock = join28(dir, "package-lock.json");
+  const npmLock = join29(dir, "package-lock.json");
   if (existsSync26(npmLock)) {
     try {
       const lock = JSON.parse(readFileSync17(npmLock, "utf8"));
@@ -5182,7 +5290,7 @@ function expectedPackages(dir) {
       return 0;
     }
   }
-  const pnpmLock = join28(dir, "pnpm-lock.yaml");
+  const pnpmLock = join29(dir, "pnpm-lock.yaml");
   if (existsSync26(pnpmLock)) {
     try {
       const text = readFileSync17(pnpmLock, "utf8");
@@ -5195,7 +5303,7 @@ function expectedPackages(dir) {
   return 0;
 }
 function installedPackages(dir) {
-  const root = join28(dir, "node_modules");
+  const root = join29(dir, "node_modules");
   if (!existsSync26(root)) return 0;
   let total = 0;
   try {
@@ -5203,7 +5311,7 @@ function installedPackages(dir) {
       if (!entry.isDirectory() || entry.name === ".bin") continue;
       if (entry.name.startsWith("@")) {
         try {
-          total += readdirSync10(join28(root, entry.name)).length;
+          total += readdirSync10(join29(root, entry.name)).length;
         } catch {
         }
       } else if (entry.name !== ".pnpm" && entry.name !== ".vite") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaredev/cli",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "The flare command-line tool: create, generate, migrate, and deploy Flare apps",
   "license": "MIT",
   "author": "Muke Johnbaptist",
@@ -41,7 +41,7 @@
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
-    "@flaredev/core": "0.6.2"
+    "@flaredev/core": "0.7.1"
   },
   "engines": {
     "node": ">=22"

package/templates/app/lib/resource/handlers.ts

@@ -9,6 +9,17 @@
 // `flare update` applies the parts you choose. Neither runs unless you ask.
 
 import type { Resource } from "@flaredev/core";
+import {
+  crossOrigin,
+  drain,
+  failureResponse,
+  problem,
+  readJson,
+  respond,
+  type Authorize,
+  type AuthorizeContext,
+  type RouteContext,
+} from "./http";
 import type { ResourceRows } from "./rows";
 import {
   createResourceStore,
@@ -21,15 +32,7 @@ import {
 
 export type { ResourceAction } from "./store";
 
-export interface AuthorizeContext {
-  request: Request;
-  resource: Resource;
-  action: ResourceAction;
-  id?: string;
-}
-
-/** Return a Response (e.g. 401/403) to deny the request; return nothing to allow it. */
-export type Authorize = (context: AuthorizeContext) => Response | void | Promise<Response | void>;
+export type { Authorize, AuthorizeContext } from "./http";
 
 export interface ResourceHandlerOptions {
   resource: Resource;
@@ -42,59 +45,17 @@ export interface ResourceHandlerOptions {
   onChange?: (event: ChangeEvent) => void | Promise<void>;
 }
 
-type RouteContext = { params: Promise<{ id: string }> };
-
-const problem = (status: number, error: string, extra: object = {}) => Response.json({ error, ...extra }, { status });
-
-function failureResponse(failure: Failure): Response {
-  if (failure.queryIssues) return problem(failure.status, failure.error, { issues: failure.queryIssues });
-  const extra: Record<string, unknown> = {};
-  if (failure.issues) extra.issues = failure.issues;
-  if (failure.field) extra.field = failure.field;
-  return problem(failure.status, failure.error, extra);
-}
-
-const respond = <T>(result: Result<T>, init?: ResponseInit) =>
-  result.ok ? Response.json(result.data, init) : failureResponse(result);
-
 /** REST route handlers for a resource: thin HTTP wrappers over `createResourceStore`. */
 export function createResourceHandlers(options: ResourceHandlerOptions) {
   const { resource, authorize } = options;
   const store = createResourceStore(options);
 
-  /** Deny cross-site writes: browsers send Origin on POST/PATCH/PUT/DELETE. */
-  const crossOrigin = (request: Request) => {
-    const origin = request.headers.get("origin");
-    return origin !== null && origin !== new URL(request.url).origin;
-  };
-
-  async function readBody(request: Request): Promise<{ body: unknown } | { response: Response }> {
-    if (crossOrigin(request)) return { response: problem(403, "Cross-origin request blocked.") };
-    const type = request.headers.get("content-type") ?? "";
-    if (!/^application\/json\b/i.test(type)) return { response: problem(415, "Send JSON with Content-Type: application/json.") };
-    try {
-      return { body: await request.json() };
-    } catch {
-      return { response: problem(400, "Request body isn't valid JSON.") };
-    }
-  }
+  /** The cross-origin guard and the JSON read, in the order a write needs them. */
+  const readBody = async (request: Request): Promise<{ body: unknown } | { response: Response }> =>
+    crossOrigin(request) ? { response: problem(403, "Cross-origin request blocked.") } : readJson(request);
 
   const guard = async (context: AuthorizeContext) => (await authorize(context)) ?? undefined;
 
-  /**
-   * Read and drop a body the handler didn't consume (a 401/403/415 answered early).
-   * Answering with it unread breaks the next request through wrangler's local dev
-   * proxy ("Network connection lost"). Streams, so memory stays flat.
-   */
-  async function drain(request: Request) {
-    if (!request.body || request.bodyUsed) return;
-    try {
-      const reader = request.body.getReader();
-      while (!(await reader.read()).done);
-    } catch {
-      // The client went away.
-    }
-  }
   const draining =
     <Rest extends unknown[]>(handler: (request: Request, ...rest: Rest) => Promise<Response>) =>
     async (request: Request, ...rest: Rest): Promise<Response> => {

package/templates/app/lib/resource/http.ts

@@ -0,0 +1,92 @@
+// This file is yours.
+//
+// The small pieces a route handler needs: how a failure becomes a status code, how a
+// JSON body is read safely, and the two guards that are easy to forget. Routes call
+// these by name so the request flow is visible where it happens, rather than hidden
+// behind a factory.
+//
+// `flare diff` shows how your copy differs from the version Flare ships, and
+// `flare update` applies the parts you choose. Neither runs unless you ask.
+
+import type { Resource } from "@flaredev/core";
+import type { Failure, ResourceAction, Result } from "./store";
+
+export interface AuthorizeContext {
+  request: Request;
+  resource: Resource;
+  action: ResourceAction;
+  id?: string;
+}
+
+/** Return a Response (401/403) to deny the request; return nothing to allow it. */
+export type Authorize = (context: AuthorizeContext) => Response | void | Promise<Response | void>;
+
+/** The context Next.js and vinext hand a route under `[id]`. */
+export type RouteContext = { params: Promise<{ id: string }> };
+
+/** A JSON error response. */
+export const problem = (status: number, error: string, extra: object = {}) => Response.json({ error, ...extra }, { status });
+
+/**
+ * A store failure as HTTP.
+ *
+ * The status is decided in store.ts, where the reason is known: 422 with field issues
+ * for validation, 409 with the column for a unique conflict, 404 for a missing row.
+ */
+export function failureResponse(failure: Failure): Response {
+  if (failure.queryIssues) return problem(failure.status, failure.error, { issues: failure.queryIssues });
+  const extra: Record<string, unknown> = {};
+  if (failure.issues) extra.issues = failure.issues;
+  if (failure.field) extra.field = failure.field;
+  return problem(failure.status, failure.error, extra);
+}
+
+/** A store result as HTTP: the data, or the failure above. */
+export const respond = <T>(result: Result<T>, init?: ResponseInit) => (result.ok ? Response.json(result.data, init) : failureResponse(result));
+
+/**
+ * Whether this write came from another site.
+ *
+ * Browsers always send `Origin` on POST, PATCH, PUT and DELETE, so a mismatch is a
+ * cross-site request and a request with no Origin at all is not from a browser form.
+ * This is the CSRF guard; a route that writes should call it.
+ */
+export const crossOrigin = (request: Request) => {
+  const origin = request.headers.get("origin");
+  return origin !== null && origin !== new URL(request.url).origin;
+};
+
+/**
+ * The request's JSON body, or the response to send instead.
+ *
+ * Returns `{ body }` or `{ response }`, so a caller can't forget to handle the bad
+ * cases: the wrong content type, or a body that isn't JSON.
+ */
+export async function readJson(request: Request): Promise<{ body: unknown } | { response: Response }> {
+  const type = request.headers.get("content-type") ?? "";
+  if (!/^application\/json\b/i.test(type)) return { response: problem(415, "Send JSON with Content-Type: application/json.") };
+  try {
+    return { body: await request.json() };
+  } catch {
+    return { response: problem(400, "Request body isn't valid JSON.") };
+  }
+}
+
+/**
+ * Read and discard a body the handler never consumed.
+ *
+ * A request answered early — 401, 403, 415 — still has its body waiting. Replying
+ * without reading it breaks the *next* request through wrangler's local dev proxy
+ * ("Network connection lost"), which is a baffling thing to debug. Routes call this in
+ * a `finally`, so it happens whichever way they returned. It streams, so memory stays
+ * flat however large the body was.
+ */
+export async function drain(request: Request): Promise<void> {
+  if (!request.body || request.bodyUsed) return;
+  try {
+    const reader = request.body.getReader();
+    while (!(await reader.read()).done);
+  } catch {
+    // The client went away.
+  }
+}

package/templates/app/lib/resource/index.ts

@@ -8,6 +8,7 @@
 // contract — about fifty lines in rows.ts, and the reason a descriptor doesn't care
 // which database it is on.
 export * from "./rows";
+export * from "./http";
 export * from "./query";
 export * from "./store";
 export * from "./handlers";

package/templates/next/lib/resource/index.ts

@@ -8,6 +8,7 @@
 // which is the whole contract — about fifty lines in rows.ts, and the reason a
 // descriptor doesn't care which database it is on.
 export * from "./rows";
+export * from "./http";
 export * from "./query";
 export * from "./store";
 export * from "./handlers";

package/templates/next/lib/storage.ts

@@ -21,10 +21,26 @@ const client = new AwsClient({
 
 const endpoint = `${process.env.R2_ENDPOINT ?? ""}/${process.env.R2_BUCKET ?? ""}`;
 
+/**
+ * A key as a URL path.
+ *
+ * Each segment is escaped on its own, so the slashes in "products/2026/09/a.png" stay
+ * slashes. Escaping the whole key would turn them into %2F, which is a different object
+ * name to S3 even where a particular server is forgiving about it.
+ */
+const path = (key: string) => key.split("/").map(encodeURIComponent).join("/");
+
+/** Raise a bucket error rather than letting a failed write look like a successful one. */
+async function ok(response: Response, doing: string, key: string): Promise<Response> {
+  if (response.ok) return response;
+  const detail = await response.text().catch(() => "");
+  throw new Error(`Storage ${doing} failed for "${key}": ${response.status} ${detail.slice(0, 300)}`);
+}
+
 /** The bucket, shaped the way @flaredev/core expects, over plain HTTP calls. */
 const bucket = {
   async get(key: string) {
-    const response = await client.fetch(`${endpoint}/${encodeURIComponent(key)}`);
+    const response = await client.fetch(`${endpoint}/${path(key)}`);
     if (!response.ok || !response.body) return null;
     return {
       body: response.body,
@@ -35,15 +51,25 @@ const bucket = {
     };
   },
   async put(key: string, value: ReadableStream | ArrayBuffer | string | null, options?: { httpMetadata?: { contentType?: string } }) {
-    await client.fetch(`${endpoint}/${encodeURIComponent(key)}`, {
-      method: "PUT",
-      body: value,
-      headers: options?.httpMetadata?.contentType ? { "content-type": options.httpMetadata.contentType } : undefined,
-    });
+    // S3 needs a Content-Length, and a stream has no length to send — it answers
+    // "411 MissingContentLength" and stores nothing. Uploads are capped by the field's
+    // own maxBytes long before they reach here, so reading one into memory is safe and
+    // is what makes the length known.
+    //
+    // The length is set by hand rather than left to fetch. Next patches the global
+    // fetch, and in that runtime it does not derive content-length even from a buffered
+    // body — so S3 still answers 411 and stores nothing. Buffering everything through
+    // Response keeps one path for streams, buffers and strings alike.
+    const body = value === null ? new ArrayBuffer(0) : await new Response(value as BodyInit).arrayBuffer();
+    const headers: Record<string, string> = { "content-length": String(body.byteLength) };
+    if (options?.httpMetadata?.contentType) headers["content-type"] = options.httpMetadata.contentType;
+    await ok(await client.fetch(`${endpoint}/${path(key)}`, { method: "PUT", body, headers }), "upload", key);
   },
   async delete(keys: string | string[]) {
     for (const key of [keys].flat()) {
-      await client.fetch(`${endpoint}/${encodeURIComponent(key)}`, { method: "DELETE" });
+      const response = await client.fetch(`${endpoint}/${path(key)}`, { method: "DELETE" });
+      // S3 answers 204 for a key that was never there, which is the outcome we wanted.
+      if (response.status !== 404) await ok(response, "delete", key);
     }
   },
 };