@flaredev/cli 0.9.0 → 0.10.0

package/templates/app/lib/auth.ts

@@ -1,154 +1,177 @@
-import { env, waitUntil } from "cloudflare:workers";
-import { passkey } from "@better-auth/passkey";
-import { drizzleAdapter } from "@better-auth/drizzle-adapter";
-import { betterAuth } from "better-auth";
-import { APIError, createAuthMiddleware } from "better-auth/api";
-import { nextCookies } from "better-auth/next-js";
-import { admin } from "better-auth/plugins/admin";
-import { emailOTP } from "better-auth/plugins/email-otp";
-import { magicLink } from "better-auth/plugins/magic-link";
-import { twoFactor } from "better-auth/plugins/two-factor";
-import { hashPassword, verifyPassword } from "@flaredev/core";
-import { getDb, schema } from "@/db";
-import { authConfig, type SocialProvider } from "./auth-config";
-import { checkPassword, isBreachedPassword, PASSWORD_MAX_LENGTH } from "./password-rules";
-import { sendEmailCode, sendMagicLink, sendPasswordReset, sendTwoFactorCode, sendVerificationEmail } from "./auth-emails";
-
-const vars = env as unknown as Record<string, string | undefined>;
-
-/** Optional: set when serving from a custom domain (e.g. https://example.com). */
-const configuredURL = vars.BETTER_AUTH_URL;
-
-/** A provider's credentials from the environment, when both are set. */
-function credentials(prefix: string) {
-  const clientId = vars[`${prefix}_CLIENT_ID`];
-  const clientSecret = vars[`${prefix}_CLIENT_SECRET`];
-  return clientId && clientSecret ? { clientId, clientSecret } : undefined;
-}
-
-const providerSettings: Record<SocialProvider, Record<string, string> | undefined> = {
-  google: credentials("GOOGLE"),
-  github: credentials("GITHUB"),
-  // Apple's client secret is a JWT you generate from your key (see the auth guide).
-  apple: credentials("APPLE") && { ...credentials("APPLE")!, ...(vars.APPLE_APP_BUNDLE_ID ? { appBundleIdentifier: vars.APPLE_APP_BUNDLE_ID } : {}) },
-  // "common" accepts personal and work accounts; set a tenant id to allow only your organisation.
-  microsoft: credentials("MICROSOFT") && { ...credentials("MICROSOFT")!, tenantId: vars.MICROSOFT_TENANT_ID || "common" },
-};
-
-/** Social providers switched on in lib/auth-config.ts that also have credentials. */
-const socialProviders = Object.fromEntries(
-  authConfig.social.flatMap((provider) => (providerSettings[provider] ? [[provider, providerSettings[provider]]] : [])),
-);
-
-/** Endpoints of methods switched off in lib/auth-config.ts: refused, not just hidden. */
-function disabledPath(path: string): boolean {
-  if (!authConfig.magicLink && (path === "/sign-in/magic-link" || path === "/magic-link/verify")) return true;
-  if (!authConfig.emailOtp && (path.startsWith("/email-otp/") || path === "/sign-in/email-otp" || path === "/forget-password/email-otp")) return true;
-  if (!authConfig.passkeys && path.startsWith("/passkey/")) return true;
-  const { authenticator, email } = authConfig.twoFactor;
-  if (!authenticator && !email && path.startsWith("/two-factor/")) return true;
-  if (!authenticator && (path === "/two-factor/get-totp-uri" || path === "/two-factor/verify-totp")) return true;
-  if (!email && (path === "/two-factor/send-otp" || path === "/two-factor/verify-otp")) return true;
-  return false;
-}
-
-/** Where a new password arrives, and what it's called in the body. */
-const NEW_PASSWORD_FIELDS: Record<string, string> = {
-  "/sign-up/email": "password",
-  "/reset-password": "newPassword",
-  "/change-password": "newPassword",
-};
-
-/**
- * The same password rules the sign-up and reset forms show as you type
- * (lib/password-rules.ts), enforced here so the API agrees with the screens.
- * Checked on the way in, before the password is hashed or stored.
- */
-async function guardPassword(path: string, body: Record<string, unknown> | undefined) {
-  const field = NEW_PASSWORD_FIELDS[path];
-  if (!field) return;
-  const password = body?.[field];
-  if (typeof password !== "string") return;
-
-  if (password.length > PASSWORD_MAX_LENGTH) {
-    throw new APIError("BAD_REQUEST", { message: `Passwords can be at most ${PASSWORD_MAX_LENGTH} characters.` });
-  }
-  const check = checkPassword(password, [body?.email as string | undefined, body?.name as string | undefined]);
-  if (!check.valid) throw new APIError("BAD_REQUEST", { message: check.advice ?? "That password is too short." });
-
-  // A password in a public breach list is already guessed, however strong it looks.
-  if (authConfig.checkBreachedPasswords && (await isBreachedPassword(password))) {
-    throw new APIError("BAD_REQUEST", {
-      message: "That password has appeared in a data breach, so it isn't safe to use here. Pick a different one.",
-    });
-  }
-}
-
-export const auth = betterAuth({
-  appName: "__APP_NAME__",
-  secret: env.BETTER_AUTH_SECRET,
-  // Without BETTER_AUTH_URL, accept local dev on any port, a `flare dev --tunnel` URL and
-  // this app's workers.dev host. Cloudflare only routes hosts this Worker serves, so a
-  // deployed app never sees a trycloudflare.com host and the allowlist can't be spoofed.
-  baseURL: configuredURL || {
-    allowedHosts: ["localhost:*", "127.0.0.1:*", "*.trycloudflare.com", "__APP_NAME__.*.workers.dev"],
-  },
-  // Sign in with Apple posts back from Apple's own origin.
-  trustedOrigins: authConfig.social.includes("apple") ? ["https://appleid.apple.com"] : [],
-  database: drizzleAdapter(getDb(), { provider: "sqlite", schema }),
-  socialProviders,
-  account: {
-    // Signing in with Google as ada@example.com joins Ada's existing account (the provider has verified the address).
-    accountLinking: { enabled: true, trustedProviders: ["google", "github", "apple", "microsoft"] },
-  },
-  emailAndPassword: {
-    enabled: true,
-    requireEmailVerification: authConfig.requireEmailVerification,
-    // PBKDF2 via WebCrypto: the default scrypt exceeds Workers CPU limits.
-    password: { hash: hashPassword, verify: verifyPassword },
-    sendResetPassword: ({ user, url }) => sendPasswordReset({ user, url }),
-    resetPasswordTokenExpiresIn: 60 * 60,
-    // A password reset signs every other device out.
-    revokeSessionsOnPasswordReset: true,
-  },
-  emailVerification: {
-    sendVerificationEmail: ({ user, url }) => sendVerificationEmail({ user, url }),
-    sendOnSignUp: true,
-    autoSignInAfterVerification: true,
-  },
-  advanced: {
-    // Let emails and other deferred work finish after the response is sent.
-    backgroundTasks: { handler: waitUntil },
-  },
-  hooks: {
-    before: createAuthMiddleware(async (ctx) => {
-      if (disabledPath(ctx.path)) throw new APIError("NOT_FOUND", { message: "This sign-in method isn't enabled." });
-      await guardPassword(ctx.path, ctx.body as Record<string, unknown> | undefined);
-    }),
-  },
-  plugins: [
-    // Adds user.role (default "user") and admin APIs. The /admin area allows ADMIN_ROLES (lib/admin.ts).
-    admin({ defaultRole: "user", adminRoles: ["admin"] }),
-    magicLink({ sendMagicLink: ({ email, url }) => sendMagicLink({ email, url }), expiresIn: 5 * 60, disableSignUp: false }),
-    emailOTP({ sendVerificationOTP: (data) => sendEmailCode(data), otpLength: 6, expiresIn: 5 * 60, allowedAttempts: 5 }),
-    twoFactor({
-      issuer: "__APP_NAME__",
-      otpOptions: { sendOTP: ({ user, otp }) => sendTwoFactorCode({ user, otp }), allowedAttempts: 5 },
-      // With only email codes switched on there's no authenticator app to confirm first.
-      skipVerificationOnEnable: !authConfig.twoFactor.authenticator,
-      // People who signed up with a social account have no password to confirm with;
-      // accounts that do have one must still give it.
-      allowPasswordless: true,
-    }),
-    passkey({ rpName: "__APP_NAME__" }),
-    // Must stay last: lets server actions set auth cookies.
-    nextCookies(),
-  ],
-});
-
-export type Session = typeof auth.$Infer.Session;
-
-/** OAuth providers switched on and configured, e.g. ["github"], for the sign-in buttons. */
-export function enabledSocialProviders(): SocialProvider[] {
-  return Object.keys(socialProviders) as SocialProvider[];
-}
+import { env, waitUntil } from "cloudflare:workers";
+import { passkey } from "@better-auth/passkey";
+import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+import { betterAuth } from "better-auth";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { nextCookies } from "better-auth/next-js";
+import { admin } from "better-auth/plugins/admin";
+import { emailOTP } from "better-auth/plugins/email-otp";
+import { magicLink } from "better-auth/plugins/magic-link";
+import { twoFactor } from "better-auth/plugins/two-factor";
+import { hashPassword, verifyPassword } from "@flaredev/core";
+import { getDb, schema } from "@/db";
+import { authConfig, type SocialProvider } from "./auth-config";
+import { checkPassword, isBreachedPassword, PASSWORD_MAX_LENGTH } from "./password-rules";
+import { sendEmailCode, sendMagicLink, sendPasswordReset, sendTwoFactorCode, sendVerificationEmail } from "./auth-emails";
+
+const vars = env as unknown as Record<string, string | undefined>;
+
+/**
+ * Optional: set when serving from a custom domain (e.g. https://example.com).
+ *
+ * Better Auth compares the request's Origin header against this string, and an Origin never
+ * carries a trailing slash. So `https://example.com/` — which is what you get copying a
+ * domain out of a browser bar or the Vercel dashboard — matches nothing, and every sign-in
+ * comes back 403 with nothing in the log saying why. Correct it and say so: a warning that
+ * leaves sign-in broken is not much better than the silence it replaces.
+ */
+function authBaseURL(raw: string | undefined): string | undefined {
+  const value = raw?.trim();
+  if (!value) return undefined;
+  // Only a trailing slash is removed. A path stays: an app served under one legitimately
+  // sets BETTER_AUTH_URL to https://example.com/app.
+  const url = value.replace(/\/+$/, "");
+  if (url !== value) {
+    console.warn(`[auth] BETTER_AUTH_URL has a trailing slash, which never matches an Origin header and makes every sign-in 403. Using "${url}" — set BETTER_AUTH_URL to that to silence this.`);
+  }
+  if (url && !/^https?:\/\//.test(url)) {
+    console.warn(`[auth] BETTER_AUTH_URL ("${url}") has no scheme, so it cannot match an Origin. Set it to a full origin, e.g. https://example.com.`);
+  }
+  return url || undefined;
+}
+
+const configuredURL = authBaseURL(vars.BETTER_AUTH_URL);
+
+/** A provider's credentials from the environment, when both are set. */
+function credentials(prefix: string) {
+  const clientId = vars[`${prefix}_CLIENT_ID`];
+  const clientSecret = vars[`${prefix}_CLIENT_SECRET`];
+  return clientId && clientSecret ? { clientId, clientSecret } : undefined;
+}
+
+const providerSettings: Record<SocialProvider, Record<string, string> | undefined> = {
+  google: credentials("GOOGLE"),
+  github: credentials("GITHUB"),
+  // Apple's client secret is a JWT you generate from your key (see the auth guide).
+  apple: credentials("APPLE") && { ...credentials("APPLE")!, ...(vars.APPLE_APP_BUNDLE_ID ? { appBundleIdentifier: vars.APPLE_APP_BUNDLE_ID } : {}) },
+  // "common" accepts personal and work accounts; set a tenant id to allow only your organisation.
+  microsoft: credentials("MICROSOFT") && { ...credentials("MICROSOFT")!, tenantId: vars.MICROSOFT_TENANT_ID || "common" },
+};
+
+/** Social providers switched on in lib/auth-config.ts that also have credentials. */
+const socialProviders = Object.fromEntries(
+  authConfig.social.flatMap((provider) => (providerSettings[provider] ? [[provider, providerSettings[provider]]] : [])),
+);
+
+/** Endpoints of methods switched off in lib/auth-config.ts: refused, not just hidden. */
+function disabledPath(path: string): boolean {
+  if (!authConfig.magicLink && (path === "/sign-in/magic-link" || path === "/magic-link/verify")) return true;
+  if (!authConfig.emailOtp && (path.startsWith("/email-otp/") || path === "/sign-in/email-otp" || path === "/forget-password/email-otp")) return true;
+  if (!authConfig.passkeys && path.startsWith("/passkey/")) return true;
+  const { authenticator, email } = authConfig.twoFactor;
+  if (!authenticator && !email && path.startsWith("/two-factor/")) return true;
+  if (!authenticator && (path === "/two-factor/get-totp-uri" || path === "/two-factor/verify-totp")) return true;
+  if (!email && (path === "/two-factor/send-otp" || path === "/two-factor/verify-otp")) return true;
+  return false;
+}
+
+/** Where a new password arrives, and what it's called in the body. */
+const NEW_PASSWORD_FIELDS: Record<string, string> = {
+  "/sign-up/email": "password",
+  "/reset-password": "newPassword",
+  "/change-password": "newPassword",
+};
+
+/**
+ * The same password rules the sign-up and reset forms show as you type
+ * (lib/password-rules.ts), enforced here so the API agrees with the screens.
+ * Checked on the way in, before the password is hashed or stored.
+ */
+async function guardPassword(path: string, body: Record<string, unknown> | undefined) {
+  const field = NEW_PASSWORD_FIELDS[path];
+  if (!field) return;
+  const password = body?.[field];
+  if (typeof password !== "string") return;
+
+  if (password.length > PASSWORD_MAX_LENGTH) {
+    throw new APIError("BAD_REQUEST", { message: `Passwords can be at most ${PASSWORD_MAX_LENGTH} characters.` });
+  }
+  const check = checkPassword(password, [body?.email as string | undefined, body?.name as string | undefined]);
+  if (!check.valid) throw new APIError("BAD_REQUEST", { message: check.advice ?? "That password is too short." });
+
+  // A password in a public breach list is already guessed, however strong it looks.
+  if (authConfig.checkBreachedPasswords && (await isBreachedPassword(password))) {
+    throw new APIError("BAD_REQUEST", {
+      message: "That password has appeared in a data breach, so it isn't safe to use here. Pick a different one.",
+    });
+  }
+}
+
+export const auth = betterAuth({
+  appName: "__APP_NAME__",
+  secret: env.BETTER_AUTH_SECRET,
+  // Without BETTER_AUTH_URL, accept local dev on any port, a `flare dev --tunnel` URL and
+  // this app's workers.dev host. Cloudflare only routes hosts this Worker serves, so a
+  // deployed app never sees a trycloudflare.com host and the allowlist can't be spoofed.
+  baseURL: configuredURL || {
+    allowedHosts: ["localhost:*", "127.0.0.1:*", "*.trycloudflare.com", "__APP_NAME__.*.workers.dev"],
+  },
+  // Sign in with Apple posts back from Apple's own origin.
+  trustedOrigins: authConfig.social.includes("apple") ? ["https://appleid.apple.com"] : [],
+  database: drizzleAdapter(getDb(), { provider: "sqlite", schema }),
+  socialProviders,
+  account: {
+    // Signing in with Google as ada@example.com joins Ada's existing account (the provider has verified the address).
+    accountLinking: { enabled: true, trustedProviders: ["google", "github", "apple", "microsoft"] },
+  },
+  emailAndPassword: {
+    enabled: true,
+    requireEmailVerification: authConfig.requireEmailVerification,
+    // PBKDF2 via WebCrypto: the default scrypt exceeds Workers CPU limits.
+    password: { hash: hashPassword, verify: verifyPassword },
+    sendResetPassword: ({ user, url }) => sendPasswordReset({ user, url }),
+    resetPasswordTokenExpiresIn: 60 * 60,
+    // A password reset signs every other device out.
+    revokeSessionsOnPasswordReset: true,
+  },
+  emailVerification: {
+    sendVerificationEmail: ({ user, url }) => sendVerificationEmail({ user, url }),
+    sendOnSignUp: true,
+    autoSignInAfterVerification: true,
+  },
+  advanced: {
+    // Let emails and other deferred work finish after the response is sent.
+    backgroundTasks: { handler: waitUntil },
+  },
+  hooks: {
+    before: createAuthMiddleware(async (ctx) => {
+      if (disabledPath(ctx.path)) throw new APIError("NOT_FOUND", { message: "This sign-in method isn't enabled." });
+      await guardPassword(ctx.path, ctx.body as Record<string, unknown> | undefined);
+    }),
+  },
+  plugins: [
+    // Adds user.role (default "user") and admin APIs. The /admin area allows ADMIN_ROLES (lib/admin.ts).
+    admin({ defaultRole: "user", adminRoles: ["admin"] }),
+    magicLink({ sendMagicLink: ({ email, url }) => sendMagicLink({ email, url }), expiresIn: 5 * 60, disableSignUp: false }),
+    emailOTP({ sendVerificationOTP: (data) => sendEmailCode(data), otpLength: 6, expiresIn: 5 * 60, allowedAttempts: 5 }),
+    twoFactor({
+      issuer: "__APP_NAME__",
+      otpOptions: { sendOTP: ({ user, otp }) => sendTwoFactorCode({ user, otp }), allowedAttempts: 5 },
+      // With only email codes switched on there's no authenticator app to confirm first.
+      skipVerificationOnEnable: !authConfig.twoFactor.authenticator,
+      // People who signed up with a social account have no password to confirm with;
+      // accounts that do have one must still give it.
+      allowPasswordless: true,
+    }),
+    passkey({ rpName: "__APP_NAME__" }),
+    // Must stay last: lets server actions set auth cookies.
+    nextCookies(),
+  ],
+});
+
+export type Session = typeof auth.$Infer.Session;
+
+/** OAuth providers switched on and configured, e.g. ["github"], for the sign-in buttons. */
+export function enabledSocialProviders(): SocialProvider[] {
+  return Object.keys(socialProviders) as SocialProvider[];
+}

package/templates/app/lib/resource/store.ts

@@ -8,7 +8,7 @@
 // `flare diff` shows how your copy differs from the version Flare ships, and
 // `flare update` applies the parts you choose. Neither runs unless you ask.
 
-import { columnName, ownershipFilter, storedFields, type Policy, type Resource } from "@flaredev/core";
+import { columnName, fromMinorUnits, ownershipFilter, storedFields, toMinorUnits, type Policy, type Resource } from "@flaredev/core";
 import { createValidators } from "@flaredev/core";
 import { encodeCursor, isSearchable, parseListQuery, type QueryIssue } from "./query";
 import type { ResourceRows, Row } from "./rows";
@@ -46,6 +46,11 @@ export const COUNT_LIMIT = 10_000;
 function toCursorValue(value: unknown): string | number | boolean | null {
   if (value instanceof Date) return value.getTime();
   if (value === null || value === undefined) return null;
+  // A money column is BigInt on Postgres, and Prisma hands those back as a bigint.
+  // JSON.stringify throws on one — "Do not know how to serialize a BigInt" — so sorting by
+  // a money field broke the cursor on that stack and nowhere else. Minor units fit a double
+  // to about ninety trillion, which is past any amount a column like this holds.
+  if (typeof value === "bigint") return Number(value);
   if (typeof value === "object") return String(value);
   return value as string | number | boolean;
 }
@@ -195,9 +200,48 @@ export function createResourceStore(options: ResourceStoreOptions) {
 
   const notFound = () => fail(404, `${resource.label} not found.`);
 
+  /**
+   * Money fields, and the currency each one counts in.
+   *
+   * A money column holds whole minor units, because a column of doubles drifts — sum a few
+   * thousand prices and the total is a penny out. Everything above this file works in the
+   * units people write, so the conversion happens here and nowhere else: the API sends
+   * 19.99, the form shows 19.99, and only the database sees 1999.
+   */
+  const moneyFields = fields.flatMap(([key, def]) =>
+    (def.kind === "int" || def.kind === "float") && def.format === "money" ? [{ key, currency: def.currency }] : [],
+  );
+
+  /** Amounts as the database stores them: 19.99 -> 1999. */
+  function toStored(values: Row): Row {
+    if (moneyFields.length === 0) return values;
+    const out = { ...values };
+    for (const { key, currency } of moneyFields) {
+      const value = out[key];
+      if (typeof value === "number") out[key] = toMinorUnits(value, currency);
+    }
+    return out;
+  }
+
+  /** Amounts as callers read them: 1999 -> 19.99. */
+  function toAmounts(row: Row): Row {
+    if (moneyFields.length === 0) return row;
+    const out = { ...row };
+    for (const { key, currency } of moneyFields) {
+      const value = out[key];
+      // Prisma hands a BigInt column back as a bigint; D1 gives a number.
+      if (typeof value === "number") out[key] = fromMinorUnits(value, currency);
+      else if (typeof value === "bigint") out[key] = fromMinorUnits(Number(value), currency);
+    }
+    return out;
+  }
+
   const computed = Object.entries(resource.computed ?? {});
   /** Add the descriptor's computed values to a row on its way out. */
-  const withComputed = (row: Record<string, unknown>): Record<string, unknown> => {
+  const withComputed = (stored: Record<string, unknown>): Record<string, unknown> => {
+    // Amounts first: a computed value like `total` is written against the units the
+    // descriptor talks about, so it has to see 19.99 rather than 1999.
+    const row = toAmounts(stored);
     if (computed.length === 0) return row;
     const result = { ...row };
     for (const [key, compute] of computed) {
@@ -265,7 +309,10 @@ export function createResourceStore(options: ResourceStoreOptions) {
       const limit = await confine();
       if (isFailure(limit)) return limit;
       // Last, so `?filter[userId]=someone-else` cannot widen the query past the owner.
-      const filters = limit ? { ...parsed.query.filters, [limit.field]: limit.value } : parsed.query.filters;
+      const parsedFilters = limit ? { ...parsed.query.filters, [limit.field]: limit.value } : parsed.query.filters;
+      // `?filter[price]=19.99` is written in the units the caller knows; the column counts
+      // cents, so it is converted here like any other amount crossing this boundary.
+      const filters = toStored(parsedFilters) as typeof parsedFilters;
 
       /**
        * Whether a sort column holds a date, so the adapter can shape the cursor for it.
@@ -310,8 +357,16 @@ export function createResourceStore(options: ResourceStoreOptions) {
       const exactTotal = counting <= COUNT_LIMIT;
       const total = exactTotal ? counting : COUNT_LIMIT;
 
-      const first = page_[0];
-      const last = page_[page_.length - 1];
+      // Cursors are built from the rows as the database gave them, not from `page_`.
+      // A cursor is compared against the column on the next request, so sorting by a money
+      // field has to carry 1999 — the stored value — and not the 19.99 callers see. Taking
+      // it from the converted rows paged by a number the column does not contain, which
+      // silently returned the same page forever.
+      const stored = hasMore ? found.slice(0, perPage) : found;
+      if (backwards) stored.reverse();
+
+      const first = stored[0];
+      const last = stored[stored.length - 1];
       const moreAfter = backwards ? true : hasMore;
       const moreBefore = backwards ? hasMore : Boolean(cursor) || page > 1;
       const cursorFor = (row: Record<string, unknown> | undefined, direction: "after" | "before") =>
@@ -381,7 +436,7 @@ export function createResourceStore(options: ResourceStoreOptions) {
         if (!result.success) return invalid(result.error.issues);
         const input = result.data as Record<string, unknown>;
         const now = new Date();
-        const record = await rows.insert({ ...input, id: crypto.randomUUID(), createdAt: now, updatedAt: now });
+        const record = await rows.insert(toStored({ ...input, id: crypto.randomUUID(), createdAt: now, updatedAt: now }));
         const saved = withComputed(record);
         await hooks.afterCreate?.(saved, context);
         return { ok: true, data: saved };
@@ -421,7 +476,7 @@ export function createResourceStore(options: ResourceStoreOptions) {
         const result = validators.update.safeParse(supplied);
         if (!result.success) return invalid(result.error.issues);
         const input = result.data as Record<string, unknown>;
-        const record = await rows.update(id, { ...input, updatedAt: new Date() });
+        const record = await rows.update(id, toStored({ ...input, updatedAt: new Date() }));
         if (!record) return notFound();
         const saved = withComputed(record);
         await hooks.afterUpdate?.(saved, { ...context, previous: current });
@@ -450,7 +505,7 @@ export function createResourceStore(options: ResourceStoreOptions) {
         // one of them, and a replace would quietly orphan the row it just saved.
         if (limit) values[limit.field] = limit.value;
 
-        const record = await rows.update(id, values);
+        const record = await rows.update(id, toStored(values));
         return record ? { ok: true, data: withComputed(record) } : notFound();
       });
     },