@flaredev/cli 0.8.1 → 0.9.1

package/templates/app/components/dashboard/resource-form-page.tsx

@@ -1,6 +1,6 @@
 import { notFound } from "next/navigation";
 import { clientResource, formatValue, storedFields, type Resource } from "@flaredev/core";
-import { resourcePath, allResources, dashboardStore, requireAccess } from "@/lib/dashboard";
+import { resourcePath, allResources, confinedField, dashboardStore, requireAccess } from "@/lib/dashboard";
 import type { RelationMeta } from "./fields/field-widget";
 import { PageHeader } from "./page-header";
 import { ResourceForm } from "./resource-form";
@@ -8,6 +8,9 @@ import { ResourceForm } from "./resource-form";
 /** Server wrapper for create/edit pages: loads the record and relation titles, renders the heading and form. */
 export async function ResourceFormPage({ resource, id }: { resource: Resource; id?: string }) {
   await requireAccess(resource, id ? "update" : "create");
+  // A field this user is confined by is set from their session, so the form leaves it out.
+  const owned = await confinedField(resource.name);
+  const omit = owned ? [owned] : undefined;
   // Hooks and computed values are functions, and a function can't be sent to the browser.
   // This is the same resource without them, for the client components below.
   const forClient = clientResource(resource);
@@ -58,6 +61,7 @@ export async function ResourceFormPage({ resource, id }: { resource: Resource; i
         record={record}
         relations={relations}
         listHref={resourcePath(resource)}
+        omit={omit}
       />
     </div>
   );

package/templates/app/components/dashboard/resource-form-sheet.tsx

@@ -18,6 +18,8 @@ interface Props {
   /** Edit: the record and its id. */
   id?: string;
   record?: Record<string, unknown> | null;
+  /** Fields to leave out — see ResourceForm. */
+  omit?: string[];
   /** Controlled use (a row menu opens it); otherwise pass `trigger`. */
   open?: boolean;
   onOpenChange?: (open: boolean) => void;
@@ -33,7 +35,7 @@ interface Props {
  * the fields being squeezed into a box. Apps that would rather have a page set
  * `site.dashboard.forms` to "page" (lib/site.ts) and get the same form full width.
  */
-export function ResourceFormSheet({ resource, relations, listHref, mode, id, record, open, onOpenChange, trigger }: Props) {
+export function ResourceFormSheet({ resource, relations, listHref, mode, id, record, omit, open, onOpenChange, trigger }: Props) {
   const [internalOpen, setInternalOpen] = useState(false);
   const isOpen = open ?? internalOpen;
   const setOpen = onOpenChange ?? setInternalOpen;
@@ -58,6 +60,7 @@ export function ResourceFormSheet({ resource, relations, listHref, mode, id, rec
               record={record}
               relations={relations}
               listHref={listHref}
+              omit={omit}
               onDone={() => setOpen(false)}
             />
           </div>
@@ -68,12 +71,23 @@ export function ResourceFormSheet({ resource, relations, listHref, mode, id, rec
 }
 
 /** The list's "New …" button, with the sheet it opens. */
-export function NewRecordButton({ resource, relations, listHref }: { resource: ClientResource; relations: FormRelations; listHref: string }) {
+export function NewRecordButton({
+  resource,
+  relations,
+  listHref,
+  omit,
+}: {
+  resource: ClientResource;
+  relations: FormRelations;
+  listHref: string;
+  omit?: string[];
+}) {
   return (
     <ResourceFormSheet
       resource={resource}
       relations={relations}
       listHref={listHref}
+      omit={omit}
       mode="create"
       trigger={
         <Button>

package/templates/app/components/dashboard/resource-form.tsx

@@ -27,6 +27,14 @@ export interface ResourceFormProps {
   listHref: string;
   /** In a sheet: close it instead of navigating, and drop the card around the fields. */
   onDone?: () => void;
+  /**
+   * Fields to leave out.
+   *
+   * The owner field of a resource with per-record ownership, for the users it confines:
+   * the store sets it from their session, so an input for it would discard whatever they
+   * typed. A field that ignores you is worse than no field.
+   */
+  omit?: string[];
 }
 
 const WIDE = new Set(["text", "file"]);
@@ -57,10 +65,11 @@ function toSteps(fields: Entry[]): Entry[][] {
  * with the descriptor's zod schemas, then again on the server by the same store the
  * REST API uses; server errors (e.g. unique conflicts) land on their fields.
  */
-export function ResourceForm({ resource, mode, id, record, relations = {}, listHref, onDone }: ResourceFormProps) {
+export function ResourceForm({ resource, mode, id, record, relations = {}, listHref, onDone, omit }: ResourceFormProps) {
   const router = useRouter();
   const validators = useMemo(() => createValidators(resource), [resource]);
-  const fields = useMemo(() => storedFields(resource), [resource]);
+  const hidden = useMemo(() => new Set(omit ?? []), [omit]);
+  const fields = useMemo(() => storedFields(resource).filter(([key]) => !hidden.has(key)), [resource, hidden]);
   const steps = useMemo(() => toSteps(fields), [fields]);
   const [step, setStep] = useState(0);
   const [values, setValues] = useState(() => initialFormValues(resource, record));

package/templates/app/components/dashboard/resource-table.tsx

@@ -16,11 +16,12 @@ import {
   PaginationPrevious,
 } from "@/components/ui/pagination";
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
-import { resourcePath, adminPermissions, allResources, dashboardStore, requireAccess } from "@/lib/dashboard";
+import { resourcePath, adminPermissions, allResources, confinedField, dashboardStore, requireAccess } from "@/lib/dashboard";
 import { site } from "@/lib/site";
 import { cn } from "@/lib/utils";
 import { ColumnMenu } from "./column-menu";
 import { ExportButton } from "./export-button";
+import { TrashToggle } from "./trash-toggle";
 import { isInlineEditable } from "./editable";
 import { InlineCell } from "./inline-cell";
 import type { RelationMeta } from "./fields/field-widget";
@@ -50,7 +51,12 @@ export async function ResourceTable({ resource, searchParams }: { resource: Reso
   const forClient = clientResource(resource);
   const basePath = resourcePath(resource);
   const permissions = await adminPermissions(resource.name);
+  // A field this user is confined by is set from their session, so the forms leave it out.
+  const owned = await confinedField(resource.name);
+  const omit = owned ? [owned] : undefined;
   const params = toSearchParams(searchParams);
+  // Which view this is. State in the URL like ?page and ?sort, so the trash is linkable.
+  const viewingTrash = resource.softDelete && params.get("deleted") === "only";
   const store = dashboardStore(resource.name);
 
   let result = await store.list(params);
@@ -108,13 +114,14 @@ export async function ResourceTable({ resource, searchParams }: { resource: Reso
       <div className="flex flex-wrap items-center justify-between gap-2">
         <ResourceTableToolbar resource={forClient} />
         <div className="flex flex-wrap items-center gap-2">
+          {resource.softDelete && <TrashToggle basePath={basePath} viewingTrash={viewingTrash} />}
           <SaveViewButton resourceName={resource.name} label={resource.pluralLabel} />
           <ColumnMenu columns={allColumns.map(({ key, label }) => ({ key, label }))} visible={columns.map((column) => column.key)} />
           <ExportButton resourceName={resource.name} pluralLabel={resource.pluralLabel} />
           {permissions.create && <ImportDialog resource={forClient} />}
           {permissions.create &&
             (overlayForms ? (
-              <NewRecordButton resource={forClient} relations={relations} listHref={basePath} />
+              <NewRecordButton resource={forClient} relations={relations} listHref={basePath} omit={omit} />
             ) : (
               <Button asChild>
                 <Link href={resourcePath(resource, "new")}>
@@ -212,6 +219,16 @@ export async function ResourceTable({ resource, searchParams }: { resource: Reso
                         // A thumbnail for an image, a filename for anything else — the raw
                         // object key is noise in a table.
                         content = <FileCell resourceName={resource.name} fieldKey={column.key} value={value} />;
+                      } else if (column.def.kind === "tags" && Array.isArray(value) && value.length) {
+                        content = (
+                          <span className="flex flex-wrap gap-1">
+                            {value.map((item) => (
+                              <Badge key={String(item)} variant="outline">
+                                {String(item)}
+                              </Badge>
+                            ))}
+                          </span>
+                        );
                       } else if (column.def.kind === "multiselect" && Array.isArray(value) && value.length) {
                         const def = column.def;
                         content = (
@@ -293,6 +310,8 @@ export async function ResourceTable({ resource, searchParams }: { resource: Reso
                         id={id}
                         record={overlayForms ? row : undefined}
                         relations={relations}
+                        omit={omit}
+                        inTrash={viewingTrash}
                         listHref={basePath}
                         editHref={resourcePath(resource, id, "edit")}
                         detailHref={resourcePath(resource, id)}

package/templates/app/components/dashboard/row-actions.tsx

@@ -3,10 +3,10 @@
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useState, useTransition } from "react";
-import { ExternalLinkIcon, MoreHorizontalIcon, PencilIcon, Trash2Icon } from "lucide-react";
+import { ExternalLinkIcon, MoreHorizontalIcon, PencilIcon, Trash2Icon, Undo2Icon as UndoIcon } from "lucide-react";
 import { toast } from "sonner";
 import type { ClientResource } from "@flaredev/core";
-import { deleteRecordAction } from "@/app/dashboard/actions";
+import { deleteRecordAction, restoreRecordAction } from "@/app/dashboard/actions";
 import {
   AlertDialog,
   AlertDialogCancel,
@@ -37,23 +37,29 @@ export function RowActions({
   id,
   record,
   relations = {},
+  omit,
   listHref,
   editHref,
   detailHref,
   canUpdate = true,
   canDelete = true,
+  inTrash = false,
 }: {
   resource: ClientResource;
   id: string;
   /** The record itself, when the form opens in a dialog. */
   record?: Record<string, unknown>;
   relations?: FormRelations;
+  /** Fields the edit form leaves out — see ResourceForm. */
+  omit?: string[];
   listHref: string;
   editHref: string;
   /** The record's own page. */
   detailHref: string;
   canUpdate?: boolean;
   canDelete?: boolean;
+  /** Viewing the trash of a softDelete resource: restore and empty, not edit and delete. */
+  inTrash?: boolean;
 }) {
   const router = useRouter();
   const [confirming, setConfirming] = useState(false);
@@ -63,9 +69,10 @@ export function RowActions({
 
   function onDelete() {
     startTransition(async () => {
-      const result = await deleteRecordAction(resourceName, id);
+      // In the trash, Delete means for good — there is nowhere further to move it.
+      const result = await deleteRecordAction(resourceName, id, { force: inTrash });
       if (result.ok) {
-        toast.success(`${label} deleted.`);
+        toast.success(inTrash ? `${label} deleted for good.` : `${label} moved to the trash.`);
         setConfirming(false);
         router.refresh();
       } else {
@@ -74,6 +81,18 @@ export function RowActions({
     });
   }
 
+  function onRestore() {
+    startTransition(async () => {
+      const result = await restoreRecordAction(resourceName, id);
+      if (result.ok) {
+        toast.success(`${label} restored.`);
+        router.refresh();
+      } else {
+        toast.error(result.error);
+      }
+    });
+  }
+
 
 
   return (
@@ -94,7 +113,15 @@ export function RowActions({
             </DropdownMenuItem>
           </DropdownMenuGroup>
           <DropdownMenuSeparator />
-          {canUpdate && (
+          {canUpdate && inTrash && (
+            <DropdownMenuGroup>
+              <DropdownMenuItem onSelect={onRestore}>
+                <UndoIcon />
+                Restore
+              </DropdownMenuItem>
+            </DropdownMenuGroup>
+          )}
+          {canUpdate && !inTrash && (
             <DropdownMenuGroup>
               {record ? (
                 <DropdownMenuItem onSelect={() => setEditing(true)}>
@@ -116,7 +143,7 @@ export function RowActions({
             <DropdownMenuGroup>
               <DropdownMenuItem variant="destructive" onSelect={() => setConfirming(true)}>
                 <Trash2Icon />
-                Delete
+                {inTrash ? "Delete forever" : "Delete"}
               </DropdownMenuItem>
             </DropdownMenuGroup>
           )}
@@ -127,6 +154,7 @@ export function RowActions({
         <ResourceFormSheet
           resource={resource}
           relations={relations}
+          omit={omit}
           listHref={listHref}
           mode="edit"
           id={id}
@@ -139,8 +167,14 @@ export function RowActions({
       <AlertDialog open={confirming} onOpenChange={setConfirming}>
         <AlertDialogContent>
           <AlertDialogHeader>
-            <AlertDialogTitle>Delete this {label.toLowerCase()}?</AlertDialogTitle>
-            <AlertDialogDescription>This can&apos;t be undone.</AlertDialogDescription>
+            <AlertDialogTitle>
+              {inTrash ? `Delete this ${label.toLowerCase()} for good?` : `Delete this ${label.toLowerCase()}?`}
+            </AlertDialogTitle>
+            <AlertDialogDescription>
+              {inTrash
+                ? "The record and its uploaded files are removed. This cannot be undone."
+                : "It moves to the trash, where you can restore it."}
+            </AlertDialogDescription>
           </AlertDialogHeader>
           <AlertDialogFooter>
             <AlertDialogCancel disabled={pending}>Cancel</AlertDialogCancel>

package/templates/app/components/dashboard/trash-toggle.tsx

@@ -0,0 +1,30 @@
+import Link from "next/link";
+import { ListIcon, Trash2Icon } from "lucide-react";
+import { Button } from "@/components/ui/button";
+
+/**
+ * Switch a `softDelete` resource's list between its records and its trash.
+ *
+ * Two links rather than a control with state: the view is `?deleted=only` in the URL, like
+ * `?page` and `?sort`, so it is linkable, it survives a reload, and the back button means
+ * what it looks like it means. Dropping the other parameters is deliberate — a filter or a
+ * page number from the live list rarely makes sense against the trash.
+ */
+export function TrashToggle({ basePath, viewingTrash }: { basePath: string; viewingTrash: boolean }) {
+  return (
+    <div className="flex items-center gap-1" role="group" aria-label="Which records to show">
+      <Button asChild size="sm" variant={viewingTrash ? "ghost" : "secondary"}>
+        <Link href={basePath} aria-current={viewingTrash ? undefined : "page"}>
+          <ListIcon data-icon="inline-start" />
+          Records
+        </Link>
+      </Button>
+      <Button asChild size="sm" variant={viewingTrash ? "secondary" : "ghost"}>
+        <Link href={`${basePath}?deleted=only`} aria-current={viewingTrash ? "page" : undefined}>
+          <Trash2Icon data-icon="inline-start" />
+          Trash
+        </Link>
+      </Button>
+    </div>
+  );
+}

package/templates/app/lib/api-keys.ts

@@ -0,0 +1,61 @@
+// API keys for non-browser clients — off until `flare gen apikeys`.
+//
+// A cookie works for a browser and for nothing else. A cron job, a mobile app, a partner
+// integration or a shell script needs a credential it can put in a header, and this is
+// where one is turned into a user.
+//
+// Until `flare gen apikeys` runs there is no key plugin and no apikey table, so
+// `userFromApiKey` finds nothing and every request is authenticated by its cookie exactly
+// as before. The call stays in `lib/api.ts` either way, so switching keys on does not
+// change the shape of authorize().
+import { auth } from "./auth";
+
+/** Where a key may arrive. `Authorization: Bearer <key>` is the convention most clients expect. */
+export function keyFromRequest(headers: Headers): string | null {
+  const direct = headers.get("x-api-key");
+  if (direct) return direct;
+  const bearer = headers.get("authorization");
+  const match = bearer?.match(/^Bearer\s+(.+)$/i);
+  return match?.[1] ?? null;
+}
+
+/**
+ * The user a request's API key belongs to, or null.
+ *
+ * Deliberately not Better Auth's `enableSessionForAPIKeys`. That option mocks a session
+ * for any request carrying a valid key, and its own documentation says it is not
+ * recommended for production — so the key is verified explicitly here instead, where the
+ * check is readable and the failure cases are visible.
+ *
+ * `verifyApiKey` is where expiry, revocation, the per-key rate limit and the request
+ * count all happen, so every call has to go through it rather than reading the table.
+ */
+export async function userFromApiKey(headers: Headers): Promise<{ id: string; email: string; role: string | null } | null> {
+  const key = keyFromRequest(headers);
+  if (!key) return null;
+
+  // Loosely typed on purpose: `verifyApiKey` only exists once the apiKey plugin is in
+  // lib/auth.ts, and this file ships before it. Absent, keys are simply not in use.
+  const api = auth.api as {
+    verifyApiKey?: (input: { body: { key: string }; headers: Headers }) => Promise<{ valid: boolean; error?: unknown; key?: { referenceId?: string } | null }>;
+  };
+  if (!api.verifyApiKey) return null;
+
+  // `headers` is required, not optional: this app resolves its baseURL from the request
+  // (lib/auth.ts), and a direct auth.api call without them throws rather than returning
+  // invalid — which would read as "wrong key" for a configuration problem.
+  const verified = await api.verifyApiKey({ body: { key }, headers }).catch((error: unknown) => {
+    console.error("[flare] verifying an API key failed:", error);
+    return null;
+  });
+  const referenceId = verified?.valid ? verified.key?.referenceId : undefined;
+  if (!referenceId) return null;
+
+  // Through Better Auth's own adapter, so this is the same call on D1 and on Postgres.
+  // The role matters: policies are checked against it, and a key with no role would be
+  // refused by every policy including `["*"]`.
+  const context = await auth.$context;
+  const user = await context.internalAdapter.findUserById(referenceId);
+  if (!user) return null;
+  return { id: user.id, email: user.email, role: (user as { role?: string | null }).role ?? null };
+}

package/templates/app/lib/api.ts

@@ -2,17 +2,37 @@ import { headers } from "next/headers";
 import { can, type Policy } from "@flaredev/core";
 import type { Authorize } from "@/lib/resource/handlers";
 import { policies } from "@/policies";
+import { userFromApiKey } from "./api-keys";
 import { auth } from "./auth";
 
 /**
  * Who is making this request, for a resource's hooks (`hooks.beforeCreate` and friends
- * in the descriptor). Reads the session the same way everything else does.
+ * in the descriptor) and for per-record ownership in the store.
+ *
+ * The cookie first, then an API key. The store reads this to decide which rows a request
+ * may touch, so a key-authenticated call has to resolve to the same user a cookie would
+ * — otherwise a policy with `own` would refuse it.
  */
 export async function currentUser() {
-  const session = await auth.api.getSession({ headers: await headers() });
-  if (!session) return null;
-  const { id, email } = session.user;
-  return { id, email, role: (session.user as { role?: string | null }).role ?? null };
+  const incoming = await headers();
+  const session = await auth.api.getSession({ headers: incoming });
+  if (session) {
+    const { id, email } = session.user;
+    return { id, email, role: (session.user as { role?: string | null }).role ?? null };
+  }
+  return userFromApiKey(incoming);
+}
+
+/**
+ * A resource's policy, or undefined when it has none.
+ *
+ * Routes pass this to `createResourceStore` as well as to `authorize`, because the two
+ * halves of a policy are enforced in different places: the role check is a 403 before
+ * anything is read, and `own` is a restriction on which rows exist as far as this user
+ * is concerned, which only the store can apply.
+ */
+export function policyFor(resourceName: string): Policy | undefined {
+  return (policies as Record<string, Policy | undefined>)[resourceName];
 }
 
 /**
@@ -23,14 +43,20 @@ export async function currentUser() {
  * (`flare gen policy <Resource> --roles admin,staff`); resources without a policy
  * are open to any signed-in user. The admin UI reads the same policies, so the two
  * never drift apart.
+ *
+ * This is the role half only. A policy with `own` also restricts which rows each user
+ * sees, and that is enforced by the store — see `policyFor`.
+ *
+ * A request may authenticate with a cookie or with an API key (`flare gen apikeys`).
+ * Either way it is a user with a role, and the policy is the same one.
  */
 export const authorize: Authorize = async ({ request, resource, action }) => {
   const session = await auth.api.getSession({ headers: request.headers });
-  if (!session) return Response.json({ error: "Sign in required." }, { status: 401 });
+  const viaKey = session ? null : await userFromApiKey(request.headers);
+  if (!session && !viaKey) return Response.json({ error: "Sign in required." }, { status: 401 });
 
-  const role = (session.user as { role?: string | null }).role ?? null;
-  const policy = (policies as Record<string, Policy | undefined>)[resource.name];
-  if (!can(policy, role, action)) {
+  const role = session ? ((session.user as { role?: string | null }).role ?? null) : viaKey!.role;
+  if (!can(policyFor(resource.name), role, action)) {
     return Response.json({ error: `Your role can't ${action} ${resource.pluralLabel.toLowerCase()}.` }, { status: 403 });
   }
 };

package/templates/app/lib/dashboard.ts

@@ -1,7 +1,7 @@
 import { headers } from "next/headers";
 import { notFound, redirect } from "next/navigation";
-import { allowedActions, can, type Policy, type PolicyAction, type Resource } from "@flaredev/core";
-import { count, sql } from "drizzle-orm";
+import { allowedActions, can, ownershipFilter, type Policy, type PolicyAction, type Resource } from "@flaredev/core";
+import { count, eq, sql } from "drizzle-orm";
 import type { SQLiteTable } from "drizzle-orm/sqlite-core";
 import { createResourceStore, drizzleRows, type ResourceStore } from "@/lib/resource";
 import { getDb } from "@/db";
@@ -58,6 +58,17 @@ export async function adminPermissions(resourceName: string) {
   return allowedActions(policyFor(resourceName), role);
 }
 
+/**
+ * The field the current user is confined by on this resource, or undefined.
+ *
+ * Forms leave it out: the store sets it from the session, so an input for it would throw
+ * away whatever was typed into it. Everyone exempt from `own` sees and edits it normally,
+ * because for them it really is just a field.
+ */
+export async function confinedField(resourceName: string): Promise<string | undefined> {
+  return ownershipFilter(policyFor(resourceName), await currentUser())?.field;
+}
+
 const stores = new Map<string, ResourceStore>();
 
 /** CRUD store for a resource by name (404 for unknown names). */
@@ -66,7 +77,16 @@ export function dashboardStore(name: string): ResourceStore {
   if (!entry) notFound();
   let store = stores.get(name);
   if (!store) {
-    store = createResourceStore({ resource: entry.resource, rows: drizzleRows(entry.table, getDb), onChange: revalidateResource, currentUser });
+    store = createResourceStore({
+      resource: entry.resource,
+      rows: drizzleRows(entry.table, getDb),
+      // The admin is not exempt from ownership. A policy that confines staff to their own
+      // rows has to mean the same thing here as it does over the API, or the dashboard is
+      // a way around it.
+      policy: policyFor(name),
+      onChange: revalidateResource,
+      currentUser,
+    });
     stores.set(name, store);
   }
   return store;
@@ -93,9 +113,16 @@ export interface ResourceStats {
   values: Record<string, number>;
 }
 
-export function resourceStats(name: string, field?: string, days = 7): Promise<ResourceStats> {
+export async function resourceStats(name: string, field?: string, days = 7): Promise<ResourceStats> {
+  // Counted over the rows this user may see, not the table. A policy with `own` that the
+  // table above obeys and the cards above it don't would report 142 invoices to someone
+  // who owns three — wrong, and a leak besides. The owner is an argument rather than a
+  // closed-over value because unstable_cache keys on the arguments: without it one user's
+  // numbers would be served to the next.
+  const limit = ownershipFilter(policyFor(name), await currentUser());
+
   const read = cached(
-    async (resourceName: string, key: string | undefined, windowDays: number): Promise<ResourceStats> => {
+    async (resourceName: string, key: string | undefined, windowDays: number, owner?: { field: string; value: string }): Promise<ResourceStats> => {
       const entry = (resourceTables as unknown as Record<string, { table: SQLiteTable } | undefined>)[resourceName];
       if (!entry) return { total: 0, current: 0, previous: 0, values: {} };
 
@@ -118,9 +145,11 @@ export function resourceStats(name: string, field?: string, days = 7): Promise<R
 
       const select: Record<string, unknown> = { total: count(), ...windows };
       if (grouped) select.value = grouped;
-      const query = getDb()
+      let query = getDb()
         .select(select as never)
         .from(entry.table);
+      const ownerColumn = owner ? columns[owner.field] : undefined;
+      if (owner && ownerColumn) query = query.where(eq(ownerColumn as never, owner.value)) as never;
       const rows = (await (grouped ? query.groupBy(grouped as never) : query)) as {
         total: number;
         current: number;
@@ -140,7 +169,7 @@ export function resourceStats(name: string, field?: string, days = 7): Promise<R
     ["flare", "resource-stats"],
     { tags: [resourceTag(name)], revalidate: TTL.medium },
   );
-  return read(name, field, days);
+  return read(name, field, days, limit ?? undefined);
 }
 
 /** How many records a resource has. One field of {@link resourceStats}. */

package/templates/app/lib/realtime.ts

@@ -7,6 +7,11 @@ import {
 import { env } from "cloudflare:workers";
 import { auth } from "./auth";
 
+// Re-exported so `import type { RealtimeChannel } from "@/lib/realtime"` compiles on both
+// stacks. The Next.js copy has no hub to import it from and declares the same shape, so
+// without this a type that is identical in both apps would only be importable in one.
+export type { RealtimeChannel } from "@flaredev/core/realtime/server";
+
 /**
  * Who may open a realtime connection, per channel. `worker/index.ts` calls this for
  * every `/realtime/<channel>/ws` upgrade, after rejecting cross-site origins.

package/templates/app/lib/resource/drizzle-rows.ts

@@ -15,7 +15,7 @@
  * itself has no dialect in it. Behaviour is unchanged on purpose: the same LIKE search,
  * the same `(sort, id)` cursor comparison, the same capped count.
  */
-import { and, asc, count, desc, eq, getTableColumns, inArray, isNull, or, sql, type SQL } from "drizzle-orm";
+import { and, asc, count, desc, eq, getTableColumns, inArray, isNotNull, isNull, or, sql, type SQL } from "drizzle-orm";
 import type { BaseSQLiteDatabase, SQLiteColumn, SQLiteTable } from "drizzle-orm/sqlite-core";
 import type { ConstraintHit, ResourceRows, Row, RowsQuery } from "./rows";
 
@@ -43,8 +43,15 @@ export function drizzleRows(table: SQLiteTable, getDb: () => AnyDatabase): Resou
   const byId = (id: string) => eq(idColumn, id);
 
   /** The search and filter half of a where clause — everything but the cursor. */
-  function matching(query: Pick<RowsQuery, "search" | "filters">): SQL[] {
+  function matching(query: Pick<RowsQuery, "search" | "filters" | "deleted">): SQL[] {
     const conditions: SQL[] = [];
+    // A soft-deleting resource hides its deleted rows. `filters` cannot say this: it means
+    // "equals, or is null", and "only" needs the opposite of its null case.
+    const deletedAt = columns.deletedAt;
+    if (query.deleted && deletedAt) {
+      if (query.deleted === "exclude") conditions.push(isNull(deletedAt));
+      else if (query.deleted === "only") conditions.push(isNotNull(deletedAt));
+    }
     if (query.search && query.search.fields.length > 0) {
       const pattern = `%${query.search.term.replace(/[\\%_]/g, (char) => `\\${char}`)}%`;
       const searchable = query.search.fields.map((key) => columns[key]!);

package/templates/app/lib/resource/http.ts

@@ -48,12 +48,28 @@ export const respond = <T>(result: Result<T>, init?: ResponseInit) => (result.ok
  * Whether this write came from another site.
  *
  * Browsers always send `Origin` on POST, PATCH, PUT and DELETE, so a mismatch is a
- * cross-site request and a request with no Origin at all is not from a browser form.
- * This is the CSRF guard; a route that writes should call it.
+ * cross-site request, and a request with no `Origin` at all is not from a browser form —
+ * which is why a script or a cron job with an API key is not caught by this. It is the
+ * CSRF guard; a route that writes should call it.
+ *
+ * `request.url` alone is not enough to compare against. On the Next.js stack it is built
+ * from the server's own idea of its address and ignores the `Host` header entirely: a
+ * request to `http://127.0.0.1:3000` arrives with `request.url` saying `localhost:3000`,
+ * so a page served from one of those addresses could not write to the other. The host the
+ * client actually addressed is in the headers, and either answer matching is same-site.
+ *
+ * Trusting a forwarded header is sound here, because of what this guard is for. It only
+ * has to hold against a browser, and a page cannot set `Origin` or `X-Forwarded-Host` on
+ * a request it makes. Anything that can set both already sends no cookie worth stealing.
  */
 export const crossOrigin = (request: Request) => {
   const origin = request.headers.get("origin");
-  return origin !== null && origin !== new URL(request.url).origin;
+  if (origin === null) return false;
+  const url = new URL(request.url);
+  const host = request.headers.get("x-forwarded-host") ?? request.headers.get("host");
+  if (!host) return origin !== url.origin;
+  const scheme = request.headers.get("x-forwarded-proto") ?? url.protocol.replace(":", "");
+  return origin !== `${scheme}://${host}` && origin !== url.origin;
 };
 
 /**

package/templates/app/lib/resource/query.ts

@@ -24,6 +24,8 @@ export interface ListQuery {
    * rows); a cursor turns that into a range scan (~100ms).
    */
   cursor?: Cursor;
+  /** Which rows a soft-deleting resource returns: ?deleted=only is the Trash view. */
+  deleted?: "exclude" | "only" | "all";
 }
 
 /** The last row of the page you came from, and which way you're going. */
@@ -135,6 +137,18 @@ export function parseListQuery(
 
   const q = params.get("q")?.trim().slice(0, MAX_SEARCH_LENGTH) || undefined;
 
+  /**
+   * `?deleted=only` is the Trash view; `?deleted=all` is both. Ignored by a resource that
+   * does not soft-delete, rather than refused: a client asking for deleted rows of a table
+   * that keeps none has asked for nothing, which is what it gets.
+   */
+  let deleted: ListQuery["deleted"];
+  const rawDeleted = params.get("deleted");
+  if (rawDeleted !== null) {
+    if (rawDeleted === "only" || rawDeleted === "all" || rawDeleted === "exclude") deleted = rawDeleted;
+    else issues.push({ param: "deleted", message: `must be "exclude", "only" or "all"` });
+  }
+
   const rawCursor = params.get("cursor");
   let cursor: Cursor | undefined;
   if (rawCursor) {
@@ -157,5 +171,5 @@ export function parseListQuery(
     else filters[key] = value;
   }
 
-  return issues.length ? { issues } : { query: { page, perPage, sort, q, filters, cursor } };
+  return issues.length ? { issues } : { query: { page, perPage, sort, q, filters, cursor, deleted } };
 }