@flaredev/cli 0.9.1 → 0.11.0

package/dist/index.js

@@ -141,12 +141,12 @@ function parseTheme(value) {
 // src/versions.ts
 var COMPATIBILITY_DATE = "2026-09-15";
 var APP_DEPENDENCIES = {
-  "@better-auth/drizzle-adapter": "1.7.7",
-  "@better-auth/passkey": "1.7.7",
+  "@better-auth/drizzle-adapter": "1.7.14",
+  "@better-auth/passkey": "1.7.14",
   // Server components import Slot from here rather than the "radix-ui" umbrella (see components/ui/button.tsx).
   "@radix-ui/react-slot": "1.3.3",
   "@vinext/cloudflare": "1.0.0-beta.8",
-  "better-auth": "1.7.7",
+  "better-auth": "1.7.14",
   // Admin UI (shadcn/ui primitives in components/ui).
   "class-variance-authority": "^0.7.1",
   clsx: "^2.1.1",
@@ -172,7 +172,7 @@ var APP_DEPENDENCIES = {
   "react-server-dom-webpack": "19.3.0",
   vinext: "1.0.0-beta.10"
 };
-var BETTER_AUTH_VERSION = "1.7.7";
+var BETTER_AUTH_VERSION = "1.7.14";
 var API_KEY_PACKAGE = "@better-auth/api-key";
 var APP_DEV_DEPENDENCIES = {
   "@cloudflare/vite-plugin": "^1.54.10",
@@ -189,12 +189,16 @@ var APP_DEV_DEPENDENCIES = {
   wrangler: "^4.132.0"
 };
 var NEXT_DEPENDENCIES = {
-  next: "16.0.4",
+  // 16.0.4 was carrying 36 advisories, three of them critical: unauthenticated RCE in the
+  // image optimizer and on Windows hosts (both fixed in 16.3.3), and RCE in the flight
+  // protocol. Vercel refuses to build it. A pin is only worth having if it is moved when
+  // one of these lands, so treat a critical against this line as a release of its own.
+  next: "16.3.8",
   "@prisma/client": "7.10.0",
   "@prisma/adapter-pg": "7.10.0",
   pg: "^8.16.3",
   "@upstash/redis": "^1.36.0",
-  "@better-auth/prisma-adapter": "1.7.7",
+  "@better-auth/prisma-adapter": "1.7.14",
   // Signs S3 requests in a few kilobytes, where the AWS SDK is megabytes.
   aws4fetch: "^1.0.20",
   dotenv: "^17.2.3"
@@ -229,7 +233,7 @@ var CLOUDFLARE_ONLY = [
 // src/stack.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
-var STACKS = ["cloudflare", "next"];
+var STACKS = ["next", "cloudflare"];
 var isStack = (value) => STACKS.includes(value);
 var STACK_LABELS = {
   cloudflare: "Cloudflare Workers, D1 and Drizzle \u2014 cheapest to run, deploys everywhere",
@@ -353,7 +357,7 @@ function createApp(target, options2 = {}) {
   if (options2.stack !== void 0 && !isStack(options2.stack)) {
     throw new Error(`Unknown stack "${options2.stack}". Use ${STACKS.join(" or ")}.`);
   }
-  const stack = options2.stack ?? "cloudflare";
+  const stack = options2.stack ?? "next";
   const authProviders = parseAuthProviders(options2.authProviders);
   const authMethods = parseAuthMethods(options2.auth);
   const theme = parseTheme(options2.theme);
@@ -372,9 +376,8 @@ function createApp(target, options2 = {}) {
   writeFileSync3(join4(dir, "lib", "auth-config.ts"), renderAuthConfig(authMethods, authProviders));
   appendFileSync(join4(dir, stack === "next" ? ".env.example" : ".dev.vars.example"), devVarsExampleEntries(authProviders));
   const shared = { react: APP_DEPENDENCIES.react, "react-dom": APP_DEPENDENCIES["react-dom"] };
-  const uiOnly = Object.fromEntries(
-    Object.entries(APP_DEPENDENCIES).filter(([key]) => !["vinext", "@vinext/cloudflare", "drizzle-orm", "react-server-dom-webpack"].includes(key))
-  );
+  const cloudflareOnlyPackages = ["vinext", "@vinext/cloudflare", "drizzle-orm", "react-server-dom-webpack", "@better-auth/drizzle-adapter"];
+  const uiOnly = Object.fromEntries(Object.entries(APP_DEPENDENCIES).filter(([key]) => !cloudflareOnlyPackages.includes(key)));
   writeJson(join4(dir, "package.json"), {
     name,
     version: "0.1.0",
@@ -413,7 +416,8 @@ function createApp(target, options2 = {}) {
     `BETTER_AUTH_SECRET=${randomBytes(32).toString("base64")}
 RESEND_API_KEY=
 MAIL_FROM=
-${devVarsEntries(authProviders)}`
+${devVarsEntries(authProviders)}` + (stack === "next" ? `
+${LOCAL_SERVICES}` : "")
   );
   if (packageManager === "pnpm" && !inWorkspace) {
     writeFileSync3(join4(dir, "pnpm-workspace.yaml"), `allowBuilds:
@@ -421,16 +425,28 @@ ${ALLOW_BUILDS}
 `);
   }
   const pinned = flarePackageSpec("core", dir, packageManager).startsWith("^");
-  if (pinned) copyLockfile(packageManager, dir);
+  if (pinned) copyLockfile(packageManager, dir, stack);
   const log2 = options2.log ?? ((message) => console.log(message));
   log2(`${pc.green("\u2714")} Wrote ${files} files to ${relative(process.cwd(), dir) || "."}`);
   if (prefersPnpm) log2(pc.dim(`Installing with pnpm \u2014 far quicker for an app this size. Use ${pc.bold("--pm npm")} to change that.`));
   return { dir, name, packageManager, inWorkspace };
 }
-function copyLockfile(packageManager, dir) {
+var LOCAL_SERVICES = [
+  "# Local services (docker-compose.yml). Swap these for Neon, R2 and Upstash to deploy.",
+  "DATABASE_URL=postgresql://flare:flare@127.0.0.1:5432/app",
+  "BETTER_AUTH_URL=http://localhost:3000",
+  "R2_ENDPOINT=http://127.0.0.1:9000",
+  "R2_BUCKET=app-uploads",
+  "R2_ACCESS_KEY_ID=flare",
+  "R2_SECRET_ACCESS_KEY=flare-secret-123",
+  "UPSTASH_REDIS_REST_URL=http://127.0.0.1:8079",
+  "UPSTASH_REDIS_REST_TOKEN=flare-local-token",
+  ""
+].join("\n");
+function copyLockfile(packageManager, dir, stack) {
   const file = packageManager === "pnpm" ? "pnpm-lock.yaml" : packageManager === "yarn" ? "yarn.lock" : "package-lock.json";
   if (!file) return false;
-  const source = join4(templatesDir, "locks", file);
+  const source = join4(templatesDir, "locks", stack, file);
   if (!existsSync4(source)) return false;
   copyFileSync(source, join4(dir, file));
   return true;
@@ -1275,6 +1291,20 @@ function runNode(argv, cwd) {
     child.on("exit", (code, signal) => resolvePromise(code ?? (signal ? 1 : 0)));
   });
 }
+function runNodeCapturing(argv, cwd) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn3(process.execPath, argv, { cwd, stdio: ["inherit", "pipe", "pipe"] });
+    let output = "";
+    for (const stream of [child.stdout, child.stderr]) {
+      stream?.on("data", (chunk) => {
+        output += chunk.toString();
+        process.stdout.write(chunk);
+      });
+    }
+    child.on("error", reject);
+    child.on("exit", (code, signal) => resolvePromise({ code: code ?? (signal ? 1 : 0), output }));
+  });
+}
 function runNodeWithTunnel(argv, cwd, opened) {
   return new Promise((resolvePromise, reject) => {
     const child = spawn3(process.execPath, argv, { cwd, stdio: ["inherit", "pipe", "pipe"], env: { ...process.env, FORCE_COLOR: process.env.FORCE_COLOR ?? "1" } });
@@ -1674,11 +1704,37 @@ function list(raw, what, spec) {
   return items;
 }
 var RESOURCE_NAME = /^[A-Z][A-Za-z0-9]*$/;
+var CONDITION = /^(.*?)\s+if\s+(.+)$/s;
+var COMPARISON = /^([A-Za-z][A-Za-z0-9_]*)\s*(==|!=|\bin\b)\s*(.+)$/;
+function parseCondition(clause, spec) {
+  const match = COMPARISON.exec(clause.trim());
+  if (!match) {
+    throw new FieldGrammarError(`"${spec}": "${clause.trim()}" isn't a condition. Write it like "if kind == recurring".`);
+  }
+  const [, dependsOn, operator, rawValue] = match;
+  const op = operator === "==" ? "eq" : operator === "!=" ? "ne" : "in";
+  const text = rawValue.trim();
+  if (op === "in") {
+    const inner = /^\((.*)\)$/.exec(text);
+    if (!inner) throw new FieldGrammarError(`"${spec}": "in" takes a list in brackets, e.g. "if kind in (recurring, retainer)".`);
+    return { field: dependsOn, op, value: list(inner[1], "condition value", spec) };
+  }
+  if (!text || /\s/.test(text)) {
+    throw new FieldGrammarError(`"${spec}": "${text}" isn't a single value. Write it like "if kind == recurring".`);
+  }
+  return { field: dependsOn, op, value: text };
+}
 function parseField(spec) {
   const colon = spec.indexOf(":");
   if (colon <= 0) throw new FieldGrammarError(`"${spec}": expected name:type, e.g. "title:string".`);
   const rawName = spec.slice(0, colon).trim();
   let type = spec.slice(colon + 1).trim();
+  let showWhen;
+  const conditioned = CONDITION.exec(type);
+  if (conditioned) {
+    type = conditioned[1].trim();
+    showWhen = parseCondition(conditioned[2], spec);
+  }
   let required = true;
   let unique = false;
   while (/[?!]$/.test(type)) {
@@ -1691,6 +1747,7 @@ function parseField(spec) {
   }
   let key = camelCase(rawName);
   const field = { key, kind: "string", required, unique };
+  if (showWhen) field.showWhen = showWhen;
   let match;
   if (SIMPLE_KINDS.includes(type)) {
     field.kind = type;
@@ -1768,6 +1825,40 @@ function parseFields(input) {
     if (seen.has(field.key)) throw new FieldGrammarError(`Field "${field.key}" is declared more than once.`);
     seen.add(field.key);
   }
+  const byKey = new Map(fields.map((field) => [field.key, field]));
+  for (const field of fields) {
+    const condition = field.showWhen;
+    if (!condition) continue;
+    if (condition.field === field.key) {
+      throw new FieldGrammarError(`Field "${field.key}" cannot depend on itself.`);
+    }
+    const target = byKey.get(condition.field);
+    if (!target) {
+      const names = fields.map((other) => other.key).filter((name) => name !== field.key);
+      throw new FieldGrammarError(
+        `Field "${field.key}" depends on "${condition.field}", which isn't a field here.${suggest(condition.field, names)} Fields: ${names.join(", ")}.`
+      );
+    }
+    if (target.showWhen) {
+      throw new FieldGrammarError(`Field "${field.key}" depends on "${target.key}", which is itself conditional. Conditions only go one level deep.`);
+    }
+    const values = Array.isArray(condition.value) ? condition.value : [condition.value];
+    if (target.options) {
+      for (const value of values) {
+        if (!target.options.includes(value)) {
+          throw new FieldGrammarError(
+            `Field "${field.key}" is shown when ${condition.field} is "${value}", which isn't one of its options.${suggest(value, target.options)} Options: ${target.options.join(", ")}.`
+          );
+        }
+      }
+    } else if (target.kind === "boolean") {
+      for (const value of values) {
+        if (value !== "true" && value !== "false") {
+          throw new FieldGrammarError(`Field "${field.key}" depends on the boolean "${condition.field}", so compare it with true or false, not "${value}".`);
+        }
+      }
+    }
+  }
   return fields;
 }
 
@@ -1789,6 +1880,7 @@ function options(field) {
   if (field.widget) opts.widget = field.widget;
   if (field.kind === "belongsTo" && !field.required) opts.onDelete = "set null";
   if (field.maxBytes !== void 0) opts.maxBytes = field.maxBytes;
+  if (field.showWhen) opts.showWhen = field.showWhen;
   return opts;
 }
 function toField(field) {
@@ -1812,7 +1904,13 @@ function toField(field) {
       return builders[field.kind](opts);
   }
 }
-var literal = (value) => JSON.stringify(value);
+var literal = (value) => {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const entries = Object.entries(value);
+    return `{ ${entries.map(([key, inner]) => `${/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key)}: ${literal(inner)}`).join(", ")} }`;
+  }
+  return JSON.stringify(value);
+};
 function renderOptions(opts) {
   const entries = Object.entries(opts);
   return entries.length ? `{ ${entries.map(([k, v]) => `${k}: ${literal(v)}`).join(", ")} }` : "";
@@ -2644,7 +2742,7 @@ function prismaType(resource, key, def) {
     case "int":
       return "Int";
     case "float":
-      return "Float";
+      return def.format === "money" ? "BigInt" : "Float";
     case "boolean":
       return "Boolean";
     case "date":
@@ -2713,7 +2811,7 @@ function renderPrismaModel(entry, all) {
     if (def.kind === "belongsTo") {
       const target = byName.get(def.target);
       if (!target) throw new Error(`${resource.name}.${key} belongs to "${def.target}", but there is no ${def.target} resource. Generate it first.`);
-      const optional2 = def.required ? "" : "?";
+      const optional2 = def.required && !def.showWhen ? "" : "?";
       const relationField = key.replace(/Id$/, "");
       const named = backReferences(target, all).find((back) => back.from === resource.name && back.relationName?.endsWith(`_${key}`));
       const relationArgs = [
@@ -2727,7 +2825,7 @@ function renderPrismaModel(entry, all) {
       indexes.push(`  @@index([${key}])`);
       continue;
     }
-    const optional = def.required || def.kind === "multiselect" || def.kind === "tags" ? "" : "?";
+    const optional = def.required && !def.showWhen || def.kind === "multiselect" || def.kind === "tags" ? "" : "?";
     lines.push(`  ${key} ${prismaType(resource, key, def)}${optional} ${attributes(key, def).join(" ")}`.trimEnd());
   }
   for (const back of backReferences(resource, all)) {
@@ -2773,7 +2871,7 @@ function columnExpression(key, def, resources, selfName) {
       expr = `integer(${col})`;
       break;
     case "float":
-      expr = `real(${col})`;
+      expr = def.format === "money" ? `integer(${col})` : `real(${col})`;
       break;
     case "boolean":
       expr = `integer(${col}, { mode: "boolean" })`;
@@ -2802,7 +2900,7 @@ function columnExpression(key, def, resources, selfName) {
     default:
       expr = `text(${col})`;
   }
-  if (def.required) expr += ".notNull()";
+  if (def.required && !def.showWhen) expr += ".notNull()";
   if ("unique" in def && def.unique) expr += ".unique()";
   if ("default" in def && def.default !== void 0) expr += `.default(${q2(def.default)})`;
   return expr;
@@ -4119,7 +4217,7 @@ async function askCreateQuestions(given, appName) {
     answers.stack = stopIfCancelled(
       await prompts2.select({
         message: "Where will it run?",
-        initialValue: "cloudflare",
+        initialValue: "next",
         options: STACKS.map((value) => ({ value, label: value === "next" ? "Next.js" : "Cloudflare", hint: STACK_LABELS[value] }))
       })
     );
@@ -4213,13 +4311,22 @@ async function genResource(rawName, options2) {
       }
     }
   }
+  const policyRelative = policyPath(name);
+  const policyAbsolute = join17(appRoot, policyRelative);
+  const wrotePolicy = !exists && !existsSync18(policyAbsolute);
+  if (wrotePolicy) {
+    mkdirSync8(dirname9(policyAbsolute), { recursive: true });
+    writeFileSync11(policyAbsolute, renderPolicy(name, { read: ["admin"], create: ["admin"], update: ["admin"], delete: ["admin"] }));
+    log2(`${pc11.green("create".padEnd(9))} ${policyRelative}`);
+  }
   let written;
   let table;
   try {
     const all = await loadResources(appRoot);
     table = all.find(({ resource }) => resource.name === name).resource.table;
     ensureSupportFiles(appRoot, log2);
-    written = applyPlan(appRoot, planFiles(all, void 0, readStack(appRoot)), { force: options2.force });
+    const policies = wrotePolicy ? await loadPolicies(appRoot) : void 0;
+    written = applyPlan(appRoot, planFiles(all, policies, readStack(appRoot)), { force: options2.force });
     logResults(written, log2);
   } catch (error) {
     const hint = exists ? "" : `
@@ -4247,7 +4354,8 @@ Next: ${pc11.bold("flare migrate")} to apply it locally.`);
     }
   }
   const descriptor = { path: relativePath, status: exists ? "outdated" : "missing", outcome: exists ? "update" : "create" };
-  return { name, mode: exists ? "update" : "create", written: [descriptor, ...written], migrations };
+  const policy = wrotePolicy ? [{ path: policyRelative, status: "missing", outcome: "create" }] : [];
+  return { name, mode: exists ? "update" : "create", written: [descriptor, ...policy, ...written], migrations };
 }
 
 // src/commands/gen-endpoint.ts
@@ -4314,10 +4422,88 @@ ${body}
 }
 
 // src/commands/gen-migration.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync10, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync10, readFileSync as readFileSync13, readdirSync as readdirSync7, writeFileSync as writeFileSync13 } from "fs";
 import { basename as basename2, join as join19 } from "path";
 import { snakeCase } from "@flaredev/core";
 import pc13 from "picocolors";
+
+// src/generator/destructive.ts
+function stripNoise(sql2) {
+  let out = "";
+  let index = 0;
+  while (index < sql2.length) {
+    const two = sql2.slice(index, index + 2);
+    if (two === "--") {
+      const end = sql2.indexOf("\n", index);
+      const stop = end === -1 ? sql2.length : end;
+      out += " ".repeat(stop - index);
+      index = stop;
+      continue;
+    }
+    if (two === "/*") {
+      const end = sql2.indexOf("*/", index + 2);
+      const skipped = sql2.slice(index, end === -1 ? sql2.length : end + 2);
+      out += skipped.replaceAll(/[^\n]/g, " ");
+      index = end === -1 ? sql2.length : end + 2;
+      continue;
+    }
+    const char = sql2[index];
+    if (char === "'" || char === '"' || char === "`") {
+      let at = index + 1;
+      while (at < sql2.length) {
+        if (sql2[at] === char) {
+          if (sql2[at + 1] === char) at += 2;
+          else break;
+        } else at += 1;
+      }
+      const literal2 = sql2.slice(index, Math.min(at + 1, sql2.length));
+      out += literal2.replaceAll(/[^\n]/g, " ");
+      index = at + 1;
+      continue;
+    }
+    out += char;
+    index += 1;
+  }
+  return out;
+}
+var PATTERNS = [
+  [/\bDROP\s+COLUMN\b/i, "a column, and the values in it"],
+  [/\bDROP\s+TABLE\b/i, "a table, and every row in it"],
+  [/\bTRUNCATE\b/i, "every row in a table"],
+  [/\bDROP\s+(?:MATERIALIZED\s+)?VIEW\b/i, "a view"],
+  [/\bDROP\s+INDEX\b/i, "an index \u2014 if it was written by hand, Prisma cannot recreate it"],
+  [/\bDROP\s+TRIGGER\b/i, "a trigger \u2014 Prisma does not know about it and will not put it back"],
+  [/\bDROP\s+FUNCTION\b/i, "a function"],
+  [/\bDROP\s+CONSTRAINT\b/i, "a constraint"],
+  [/\bDROP\s+TYPE\b/i, "a type"],
+  [/\bDROP\s+SEQUENCE\b/i, "a sequence"],
+  [/\bDROP\s+SCHEMA\b/i, "a schema, and everything in it"],
+  [/\bDROP\s+DATABASE\b/i, "the database"]
+];
+function destructiveStatements(sql2) {
+  const cleaned = stripNoise(sql2);
+  const found = [];
+  let start = 0;
+  for (let index = 0; index <= cleaned.length; index += 1) {
+    if (index !== cleaned.length && cleaned[index] !== ";") continue;
+    const statement = cleaned.slice(start, index);
+    const trimmed = statement.trim();
+    const from = start;
+    start = index + 1;
+    if (!trimmed) continue;
+    const match = PATTERNS.find(([pattern]) => pattern.test(trimmed));
+    if (!match) continue;
+    const offset = from + statement.search(/\S/);
+    found.push({
+      statement: sql2.slice(offset, index).trim().replaceAll(/\s+/g, " ").slice(0, 160),
+      kind: match[1],
+      line: cleaned.slice(0, offset).split("\n").length
+    });
+  }
+  return found;
+}
+
+// src/commands/gen-migration.ts
 var DOWN_TEMPLATE = (up) => `-- Rollback for ${up}, run by \`flare migrate:rollback\`.
 -- Write SQL that undoes the up migration, e.g.:
 --   DROP INDEX IF EXISTS \`contacts_phone_idx\`;
@@ -4328,6 +4514,7 @@ async function genMigration(rawName, options2 = {}) {
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = snakeCase(rawName);
   if (!name) throw new Error(`Invalid migration name "${rawName}". Use letters, digits, and underscores.`);
+  if (readStack(appRoot) === "next") return genPrismaMigration(appRoot, name, options2);
   const { files, repairs } = await generateSchemaMigration(appRoot, name, { custom: !options2.fromSchema });
   if (files.length === 0) {
     log2(options2.fromSchema ? "No schema changes, so no migration was created." : "drizzle-kit didn't create a migration.");
@@ -4352,6 +4539,89 @@ Next: ${pc13.bold("flare migrate")}.`);
   }
   return files;
 }
+async function genPrismaMigration(appRoot, name, options2) {
+  const log2 = options2.log ?? ((message) => console.log(message));
+  const prisma = resolveBin(appRoot, "prisma", "prisma");
+  const migrations = join19(appRoot, "prisma", "migrations");
+  const before = new Set(existsSync20(migrations) ? readdirSync7(migrations) : []);
+  log2(`${pc13.cyan("prisma")} migrate dev --create-only --name ${name}`);
+  const { code, output } = await runNodeCapturing([prisma, "migrate", "dev", "--create-only", "--name", name], appRoot);
+  if (code !== 0) {
+    if (/drift detected|we need to reset/i.test(output)) {
+      log2("");
+      log2(pc13.yellow("Prisma found something in the database that its schema does not describe."));
+      log2(
+        [
+          "",
+          `Nothing has been changed \u2014 ${pc13.bold("--create-only")} writes a migration, it does not apply one, and no`,
+          "migration was written. Do not run `prisma migrate reset`: it drops the database, and what it",
+          "would drop is the thing Prisma is complaining it cannot see.",
+          "",
+          "Drift above is reported as changes to get from your migrations to the database, so it lists",
+          "what the database has and the migrations do not. Usually that is something added by hand:",
+          "",
+          `  ${pc13.bold("It should be there")} \u2014 write it into a migration so the history matches. Add the SQL to a`,
+          "  new migration and mark it applied with `prisma migrate resolve --applied <name>`.",
+          "",
+          `  ${pc13.bold("It should not be there")} \u2014 remove it from the database yourself, then run this again.`,
+          "",
+          "An index, a trigger or a function is not reported as drift at all; Prisma does not look at",
+          "those. They survive a migration and are lost by a reset, which is the other reason not to."
+        ].join("\n")
+      );
+    }
+    return [];
+  }
+  const added = (existsSync20(migrations) ? readdirSync7(migrations) : []).filter((entry) => !before.has(entry));
+  if (added.length === 0) {
+    log2("No schema changes, so no migration was created.");
+    return [];
+  }
+  const written = [];
+  const destructive = [];
+  for (const entry of added) {
+    const file = join19(migrations, entry, "migration.sql");
+    if (!existsSync20(file)) continue;
+    const relative3 = `prisma/migrations/${entry}/migration.sql`;
+    written.push(relative3);
+    log2(`${pc13.green("create".padEnd(9))} ${relative3}`);
+    const found = destructiveStatements(readFileSync13(file, "utf8"));
+    if (found.length > 0) destructive.push({ file: relative3, found });
+  }
+  if (destructive.length > 0) {
+    log2("");
+    log2(pc13.yellow(`This migration throws things away, so it has not been applied:`));
+    for (const { file, found } of destructive) {
+      log2(pc13.dim(`
+  ${file}`));
+      for (const entry of found) {
+        log2(`    ${pc13.red(`line ${entry.line}`)}  ${entry.statement}`);
+        log2(`             ${pc13.dim(`drops ${entry.kind}`)}`);
+      }
+    }
+    log2(
+      [
+        "",
+        "There are two reasons Prisma writes a drop, and only you can tell them apart:",
+        "",
+        `  ${pc13.bold("You asked for it")} \u2014 a field left a descriptor, or a resource was removed. Then the drop is`,
+        `  the point, and ${pc13.bold("flare migrate")} applies it.`,
+        "",
+        `  ${pc13.bold("Prisma cannot see it")} \u2014 the column, index or constraint was added by hand, so the schema`,
+        "  does not describe it and the diff reads it as something to remove. Then applying this",
+        "  loses it, and Prisma will not put it back.",
+        "",
+        `Read ${pc13.bold(destructive[0].file)} before deciding. To keep an object Prisma does not`,
+        "know about, delete those statements from the migration \u2014 and consider writing the object into",
+        "a migration of its own so the next diff stops proposing to drop it."
+      ].join("\n")
+    );
+    return written;
+  }
+  log2(`
+Nothing destructive in it. Next: ${pc13.bold("flare migrate")} to apply it.`);
+  return written;
+}
 
 // src/commands/gen-policy.ts
 import { existsSync as existsSync21, mkdirSync as mkdirSync11, writeFileSync as writeFileSync14 } from "fs";
@@ -4429,7 +4699,7 @@ ${pc14.dim("Roles come from `flare role:add`; the API and the admin both enforce
 }
 
 // src/commands/migrate.ts
-import { existsSync as existsSync22, mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync22, mkdtempSync, readFileSync as readFileSync14, rmSync as rmSync3, writeFileSync as writeFileSync15 } from "fs";
 import { tmpdir } from "os";
 import { join as join21 } from "path";
 import pc15 from "picocolors";
@@ -4570,7 +4840,7 @@ async function rollback(options2 = {}) {
     if (!/^[\w.-]+\.sql$/.test(name)) throw new Error(`Unexpected migration name "${name}" in d1_migrations.`);
     const handWritten = join21(migrationsDir, "down", name);
     if (existsSync22(handWritten)) {
-      const sql2 = readFileSync13(handWritten, "utf8");
+      const sql2 = readFileSync14(handWritten, "utf8");
       if (splitStatements(sql2).length === 0) {
         throw new Error(`Can't roll back ${name}: migrations/down/${name} has no SQL statements yet. Write the rollback SQL, then run the rollback again. Nothing was changed.`);
       }
@@ -4579,7 +4849,7 @@ async function rollback(options2 = {}) {
     }
     const upPath = join21(migrationsDir, name);
     if (!existsSync22(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
-    const down = deriveDown(readFileSync13(upPath, "utf8"));
+    const down = deriveDown(readFileSync14(upPath, "utf8"));
     if (!down.reversible) {
       throw new Error(
         `Can't roll back ${name}: ${down.reason}
@@ -4615,7 +4885,7 @@ Rolled back ${plan.map((step) => step.name).join(", ")}.`));
 }
 
 // src/commands/rm.ts
-import { existsSync as existsSync23, readdirSync as readdirSync7, readFileSync as readFileSync14, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync23, readdirSync as readdirSync8, readFileSync as readFileSync15, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
 import { dirname as dirname11, join as join22 } from "path";
 import { relationGraph as relationGraph3 } from "@flaredev/core";
 import pc16 from "picocolors";
@@ -4638,7 +4908,7 @@ function removeEmptyDirs(appRoot, start) {
   let dir = dirname11(join22(appRoot, start));
   const roots = [join22(appRoot, "app", "api"), join22(appRoot, "app", "dashboard")];
   const inside = () => roots.some((root) => dir.startsWith(root) && dir !== root);
-  while (inside() && existsSync23(dir) && readdirSync7(dir).length === 0) {
+  while (inside() && existsSync23(dir) && readdirSync8(dir).length === 0) {
     rmdirSync(dir);
     dir = dirname11(dir);
   }
@@ -4676,7 +4946,7 @@ async function rmResource(rawName, options2 = {}) {
   if (!entry && owned.size === 0) throw new Error(`No resource "${name}" (no ${descriptorPath(name)} and no generated files).`);
   const findings = [];
   for (const path of owned) {
-    const source = readFileSync14(join22(appRoot, path), "utf8");
+    const source = readFileSync15(join22(appRoot, path), "utf8");
     let wrapper;
     if (entry && path === entry.file) {
       const standard = splitMarkers(renderDescriptor(name, [{ key: "placeholder", kind: "string", required: true, unique: false }]));
@@ -4704,8 +4974,8 @@ Move what you want to keep, or pass --force to delete anyway.`);
   logResults(applyPlan(appRoot, planFiles(remaining, policy ? await loadPolicies(appRoot) : void 0, readStack(appRoot))), log2);
   const table = entry ? tableExport(entry.resource) : void 0;
   if (table && existsSync23(join22(appRoot, "seeds"))) {
-    const seeds = readdirSync7(join22(appRoot, "seeds")).filter(
-      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync14(join22(appRoot, "seeds", file), "utf8"))
+    const seeds = readdirSync8(join22(appRoot, "seeds")).filter(
+      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync15(join22(appRoot, "seeds", file), "utf8"))
     );
     if (seeds.length) log2(pc16.yellow(`
 These seeds still use ${table}: ${seeds.map((s) => `seeds/${s}`).join(", ")}.`));
@@ -4780,7 +5050,7 @@ ${result.output.trim()}`);
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync12, readFileSync as readFileSync15, readdirSync as readdirSync8, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync24, mkdirSync as mkdirSync12, readFileSync as readFileSync16, readdirSync as readdirSync9, writeFileSync as writeFileSync16 } from "fs";
 import { dirname as dirname12, join as join23, relative as relative2 } from "path";
 import pc18 from "picocolors";
 var TRACKED = ["app", "lib", "components"];
@@ -4790,7 +5060,7 @@ var prunedOn = (path, stack) => stack === "next" && CLOUDFLARE_ONLY.some((only)
 function upstreamFile(path, stack) {
   if (prunedOn(path, stack) || WRITTEN_PER_APP.has(path)) return void 0;
   const found = locate(path, stack);
-  if (found && PER_APP.test(readFileSync15(found, "utf8"))) return void 0;
+  if (found && PER_APP.test(readFileSync16(found, "utf8"))) return void 0;
   return found;
 }
 function locate(path, stack) {
@@ -4801,7 +5071,7 @@ function trackedPaths(appRoot, stack) {
   const paths = /* @__PURE__ */ new Set();
   const walk = (base, dir) => {
     if (!existsSync24(join23(base, dir))) return;
-    for (const entry of readdirSync8(join23(base, dir), { withFileTypes: true })) {
+    for (const entry of readdirSync9(join23(base, dir), { withFileTypes: true })) {
       const next = `${dir}/${entry.name}`;
       if (entry.isDirectory()) walk(base, next);
       else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) paths.add(next);
@@ -4817,10 +5087,10 @@ function trackedPaths(appRoot, stack) {
 function compareTracked(appRoot, stack, filter) {
   return trackedPaths(appRoot, stack).filter((path) => !filter || path.includes(filter)).map((path) => {
     const source = upstreamFile(path, stack);
-    const theirs = readFileSync15(source, "utf8");
+    const theirs = readFileSync16(source, "utf8");
     const target = join23(appRoot, path);
     if (!existsSync24(target)) return { path, state: "missing", theirs };
-    const mine = readFileSync15(target, "utf8");
+    const mine = readFileSync16(target, "utf8");
     if (mine === theirs) return { path, state: "same", mine, theirs };
     const merged = mergeGeneratedBlock(mine, theirs);
     if (merged !== void 0) {
@@ -4912,9 +5182,9 @@ Updated ${changed.length} file(s).`));
 }
 
 // src/commands/seed.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync13, readdirSync as readdirSync9, rmSync as rmSync5, writeFileSync as writeFileSync18 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync13, readdirSync as readdirSync10, rmSync as rmSync5, writeFileSync as writeFileSync18 } from "fs";
 import { join as join25 } from "path";
-import { camelCase as camelCase6, createFake, kebabCase as kebabCase4, storedFields as storedFields3 } from "@flaredev/core";
+import { camelCase as camelCase6, createFake, credentialUserRows, kebabCase as kebabCase4, storedFields as storedFields3 } from "@flaredev/core";
 import { createJiti as createJiti4 } from "jiti";
 import pc19 from "picocolors";
 
@@ -5010,7 +5280,7 @@ function createInsertMany(sink, drizzle, onProgress) {
 }
 
 // src/seed/local-d1.ts
-import { readFileSync as readFileSync16, rmSync as rmSync4, writeFileSync as writeFileSync17 } from "fs";
+import { readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync17 } from "fs";
 import { createRequire } from "module";
 import { join as join24 } from "path";
 import { pathToFileURL } from "url";
@@ -5043,7 +5313,7 @@ async function openLocalD1(appRoot, binding) {
 }
 function seedConfig(appRoot) {
   const source = join24(appRoot, "wrangler.jsonc");
-  const config = parseJsonc3(readFileSync16(source, "utf8")) ?? {};
+  const config = parseJsonc3(readFileSync17(source, "utf8")) ?? {};
   delete config.durable_objects;
   delete config.migrations;
   const path = join24(appRoot, ".flare-seed.wrangler.json");
@@ -5055,7 +5325,7 @@ function seedConfig(appRoot) {
 var SEEDS_DIR = "seeds";
 function seedFiles(appRoot, names) {
   const dir = join25(appRoot, SEEDS_DIR);
-  const all = existsSync25(dir) ? readdirSync9(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
+  const all = existsSync25(dir) ? readdirSync10(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
   if (!names?.length) return all;
   return names.map((name) => {
     const file = `${name.replace(/\.seed\.ts$/, "")}.seed.ts`;
@@ -5085,11 +5355,12 @@ async function runSeeds(options2 = {}) {
   try {
     const db = drizzle(local.db, { schema });
     const insertMany = createInsertMany(local.db, drizzleHelpers);
+    const seedUser = drizzleSeedUser(db, schema);
     for (const file of files) {
       const mod = await jiti.import(join25(appRoot, SEEDS_DIR, file));
       if (typeof mod.default !== "function") throw new Error(`${SEEDS_DIR}/${file} must \`export default defineSeed(async ({ db }) => { ... })\`.`);
       log2(`${pc19.cyan("seed")} ${file}`);
-      await mod.default({ db, env: local.env, insertMany, fake: createFake(), log: (message) => log2(`  ${message}`) });
+      await mod.default({ db, env: local.env, insertMany, seedUser, fake: createFake(), log: (message) => log2(`  ${message}`) });
     }
     log2(pc19.green(`
 Ran ${files.length} seed(s) against the local database.`));
@@ -5097,6 +5368,17 @@ Ran ${files.length} seed(s) against the local database.`));
     await local.dispose();
   }
 }
+function drizzleSeedUser(db, schema) {
+  return async (input) => {
+    const user = schema.user;
+    const account = schema.account;
+    if (!user || !account) throw new Error("db/schema.ts has no `user` and `account` tables, so there is nothing to sign in against.");
+    const rows = await credentialUserRows(input);
+    await db.insert(user).values(rows.user);
+    await db.insert(account).values(rows.account);
+    return rows.user;
+  };
+}
 function sampleValue(key, def) {
   const name = key.toLowerCase();
   switch (def.kind) {
@@ -5144,18 +5426,22 @@ function renderSeed(resource, stack = "cloudflare") {
   if (!resource) {
     return stack === "next" ? `import { defineSeed } from "@flaredev/core";
 
-export default defineSeed(async ({ db, insertMany, fake, log }) => {
+export default defineSeed(async ({ db, insertMany, seedUser, fake, log }) => {
   // \`db\` is this app's Prisma client, e.g.:
   // await db.contact.create({ data: { name: "Ada", email: "ada@example.com" } });
   // Or many at once: await insertMany("contact", [{ name: fake.fullName() }]);
+  // Somebody you can sign in as, with the credential account Better Auth looks for:
+  // await seedUser({ email: "ada@example.com", password: "correct-horse-battery", role: "admin" });
   log("nothing to seed yet");
 });
 ` : `import { defineSeed } from "@flaredev/core";
 
-export default defineSeed(async ({ db, insertMany, fake, log }) => {
+export default defineSeed(async ({ db, insertMany, seedUser, fake, log }) => {
   // Insert rows with Drizzle, e.g.:
   // await db.insert(contacts).values([{ name: "Ada", email: "ada@example.com" }]);
   // Or many at once, batched: insertMany(contacts, 10_000, () => ({ name: fake.fullName() }));
+  // Somebody you can sign in as, with the credential account Better Auth looks for:
+  // await seedUser({ email: "ada@example.com", password: "correct-horse-battery", role: "admin" });
   log("nothing to seed yet");
 });
 `;
@@ -5225,10 +5511,17 @@ Run it with ${pc19.bold(`flare seed ${name}`)}.`);
   return relative3;
 }
 async function runPrismaSeeds(appRoot, files, log2) {
+  if (!existsSync25(join25(appRoot, "lib", "generated", "prisma"))) {
+    log2(pc19.dim("Generating the Prisma client first (migrate dev no longer does)\u2026"));
+    const prisma = resolveBin(appRoot, "prisma", "prisma");
+    if (await runNode([prisma, "generate"], appRoot) !== 0) {
+      throw new Error("`prisma generate` failed, so there is no client for the seeds to use.");
+    }
+  }
   const runner = join25(appRoot, ".flare-seed-runner.mts");
   const script = [
     `import "dotenv/config";`,
-    `import { createFake } from "@flaredev/core";`,
+    `import { createFake, credentialUserRows } from "@flaredev/core";`,
     `import { prisma } from "./lib/db";`,
     ...files.map((file, index) => `import seed${index} from "./${SEEDS_DIR}/${file.replace(/\.ts$/, "")}";`),
     "",
@@ -5246,6 +5539,13 @@ async function runPrismaSeeds(appRoot, files, log2) {
     `      if (!delegate) throw new Error('No Prisma model "' + model + '". Use the camelCase name, e.g. "orderItem".');`,
     `      await delegate.createMany({ data: rows });`,
     `    },`,
+    `    seedUser: async (input: Parameters<typeof credentialUserRows>[0]) => {`,
+    `      const rows = await credentialUserRows(input);`,
+    `      const models = prisma as unknown as Record<string, { create(args: { data: unknown }): Promise<unknown> }>;`,
+    `      await models.user.create({ data: rows.user });`,
+    `      await models.account.create({ data: rows.account });`,
+    `      return rows.user;`,
+    `    },`,
     `    fake: createFake(),`,
     `    log: (message: string) => console.log("  " + message),`,
     `  });`,
@@ -5381,7 +5681,7 @@ import { join as join27 } from "path";
 import pc21 from "picocolors";
 
 // src/seed/rows.ts
-import { columnName as columnName3, createFake as createFake2, storedFields as storedFields4 } from "@flaredev/core";
+import { columnName as columnName3, createFake as createFake2, storedFields as storedFields4, toMinorUnits } from "@flaredev/core";
 var has = (key, ...words) => words.some((word) => key.includes(word));
 function stringValue(key, def, fake, resource, index) {
   switch (def.format) {
@@ -5435,7 +5735,8 @@ function numberValue(key, def, fake) {
     min = min ?? low;
     max = max ?? high;
   }
-  return def.kind === "int" ? fake.int(Math.ceil(min), Math.floor(max)) : fake.float(min, max, money ? 2 : 2);
+  const amount = def.kind === "int" ? fake.int(Math.ceil(min), Math.floor(max)) : fake.float(min, max, 2);
+  return def.format === "money" ? toMinorUnits(amount, def.currency) : amount;
 }
 function fieldValue(key, def, fake, resource, parentIds, index) {
   const name = key.toLowerCase();
@@ -5665,7 +5966,7 @@ ${result.output.trim()}`);
 
 // src/commands/billing-sync.ts
 import { createRequire as createRequire2 } from "module";
-import { existsSync as existsSync26, mkdtempSync as mkdtempSync4, readFileSync as readFileSync17, rmSync as rmSync8, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync26, mkdtempSync as mkdtempSync4, readFileSync as readFileSync18, rmSync as rmSync8, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join28 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
@@ -5675,7 +5976,7 @@ function stripeKeys(appRoot) {
   const map = {};
   const path = join28(appRoot, ".dev.vars");
   if (existsSync26(path)) {
-    for (const line of readFileSync17(path, "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync18(path, "utf8").split(/\r?\n/)) {
       const match = /^\s*([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match) map[match[1]] = match[2].trim();
     }
@@ -5761,7 +6062,7 @@ async function syncPlans(options2 = {}) {
   const appRequire = createRequire2(join28(appRoot, "package.json"));
   const stripeModule = await import(pathToFileURL2(appRequire.resolve("stripe")).href);
   const stripe = new stripeModule.default(key, { apiVersion: "2026-08-26.dahlia" });
-  const appName = JSON.parse(readFileSync17(join28(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync18(join28(appRoot, "package.json"), "utf8")).name ?? "app";
   const everything = await stripe.products.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 });
   const products = options2.all ? everything : everything.filter((product) => product.metadata?.flare_app === appName);
   if (products.length === 0) {
@@ -5936,13 +6237,13 @@ async function setUserRoleOnPrisma(appRoot, email, role, log2) {
 
 // src/utils/install.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync28, readFileSync as readFileSync18, readdirSync as readdirSync10 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync19, readdirSync as readdirSync11 } from "fs";
 import { join as join31 } from "path";
 function expectedPackages(dir) {
   const npmLock = join31(dir, "package-lock.json");
   if (existsSync28(npmLock)) {
     try {
-      const lock = JSON.parse(readFileSync18(npmLock, "utf8"));
+      const lock = JSON.parse(readFileSync19(npmLock, "utf8"));
       return Math.max(0, Object.keys(lock.packages ?? {}).length - 1);
     } catch {
       return 0;
@@ -5951,7 +6252,7 @@ function expectedPackages(dir) {
   const pnpmLock = join31(dir, "pnpm-lock.yaml");
   if (existsSync28(pnpmLock)) {
     try {
-      const text = readFileSync18(pnpmLock, "utf8");
+      const text = readFileSync19(pnpmLock, "utf8");
       const packages = text.slice(text.indexOf("\npackages:"));
       return (packages.match(/\n {2}[^\s:]+:/g) ?? []).length;
     } catch {
@@ -5965,11 +6266,11 @@ function installedPackages(dir) {
   if (!existsSync28(root)) return 0;
   let total = 0;
   try {
-    for (const entry of readdirSync10(root, { withFileTypes: true })) {
+    for (const entry of readdirSync11(root, { withFileTypes: true })) {
       if (!entry.isDirectory() || entry.name === ".bin") continue;
       if (entry.name.startsWith("@")) {
         try {
-          total += readdirSync10(join31(root, entry.name)).length;
+          total += readdirSync11(join31(root, entry.name)).length;
         } catch {
         }
       } else if (entry.name !== ".pnpm" && entry.name !== ".vite") {
@@ -6024,7 +6325,7 @@ function createCli() {
   const stack = currentStack();
   const perStack = (cloudflare, next, either) => stack === "next" ? next : stack === "cloudflare" ? cloudflare : either;
   const cloudflareOnly = (text) => stack === void 0 ? `${text} (Cloudflare only)` : text;
-  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--stack <name>", "Where it runs: cloudflare (default) or next").option("--theme <name>", "Look of the app: default, coral, amber, sky, mono or emerald").option("--auth <list>", "Sign-in methods: magic-link, email-otp, passkeys, 2fa-app, 2fa-email, all or none (default: all)").option("--auth-providers <list>", "Social sign-in, comma-separated: google, github, apple, microsoft").option("-y, --yes", "Don't ask: use the flags given and the defaults for the rest").option("--skip-install", "Write files without installing dependencies").example("flare create shop").example("flare create shop --stack next").example("flare create shop --theme mono --auth passkeys,2fa-app --auth-providers google,github --yes").action(
+  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--stack <name>", "Where it runs: next (default) or cloudflare").option("--theme <name>", "Look of the app: default, coral, amber, sky, mono or emerald").option("--auth <list>", "Sign-in methods: magic-link, email-otp, passkeys, 2fa-app, 2fa-email, all or none (default: all)").option("--auth-providers <list>", "Social sign-in, comma-separated: google, github, apple, microsoft").option("-y, --yes", "Don't ask: use the flags given and the defaults for the rest").option("--skip-install", "Write files without installing dependencies").example("flare create shop").example("flare create shop --stack next").example("flare create shop --theme mono --auth passkeys,2fa-app --auth-providers google,github --yes").action(
     async (dir, options2) => {
       const wanted = !options2.skipInstall;
       let answers = { stack: options2.stack, theme: options2.theme, auth: options2.auth, authProviders: options2.authProviders };
@@ -6051,7 +6352,7 @@ function createCli() {
       printNextSteps(result, installed);
     }
   );
-  cli.command("gen <generator> [name] [second]", `Generate code. Generators: ${GENERATORS.join(", ")}`).option("--fields <fields>", "resource: fields, e.g. 'name:string, email:string!, status:enum(lead,customer)' (single quotes: bash treats ! in double quotes as history)").option("--group <name>", "resource: sidebar heading to file it under, e.g. Sales").option("--icon <name>", "resource: lucide icon for the sidebar, e.g. users").option("--soft-delete", "resource: keep deleted rows and hide them, with a Trash view in the dashboard").option("--method <verb>", "endpoint: GET (default), POST, PATCH, PUT or DELETE").option("--action <action>", "endpoint: policy action to require (read, create, update, delete)").option("--record", "endpoint: put it under one record, /api/<resource>/[id]/<name>").option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--own <field>", "policy: confine each user to rows whose belongsTo(User) field holds their id, e.g. --own userId").option("--own-except <roles>", "policy: roles that see every row despite --own, e.g. admin").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing/apikeys: write files without adding the dependency").option("--skip-migration", "billing/security/apikeys: skip generating the schema migration").example("flare gen resource Contact --fields 'name:string, email:string!, company:belongsTo(Company)?'").example("flare gen resource Invoice --fields 'number:string!' --soft-delete   # a delete goes to the Trash").example("flare gen endpoint Order publish --method POST --record").example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen policy Invoice --roles staff --own userId --own-except admin   # each user sees only their own").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").example("flare gen apikeys                                   # API keys for cron jobs, scripts and mobile apps").example("flare gen apikeys                                     # bearer keys for crons, scripts and mobile apps").action(
+  cli.command("gen <generator> [name] [second]", `Generate code. Generators: ${GENERATORS.join(", ")}`).option("--fields <fields>", "resource: fields, e.g. 'name:string, email:string!, status:enum(lead,customer)' (single quotes: bash treats ! in double quotes as history)").option("--group <name>", "resource: sidebar heading to file it under, e.g. Sales").option("--icon <name>", "resource: lucide icon for the sidebar, e.g. users").option("--soft-delete", "resource: keep deleted rows and hide them, with a Trash view in the dashboard").option("--method <verb>", "endpoint: GET (default), POST, PATCH, PUT or DELETE").option("--action <action>", "endpoint: policy action to require (read, create, update, delete)").option("--record", "endpoint: put it under one record, /api/<resource>/[id]/<name>").option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration (Cloudflare only)").example("flare gen migration add_phone --from-schema         # Cloudflare: diff the Drizzle tables").example("flare gen migration add_phone                       # Next.js: prisma migrate dev, refusing a drop").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--own <field>", "policy: confine each user to rows whose belongsTo(User) field holds their id, e.g. --own userId").option("--own-except <roles>", "policy: roles that see every row despite --own, e.g. admin").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing/apikeys: write files without adding the dependency").option("--skip-migration", "billing/security/apikeys: skip generating the schema migration").example("flare gen resource Contact --fields 'name:string, email:string!, company:belongsTo(Company)?'").example("flare gen resource Invoice --fields 'number:string!' --soft-delete   # a delete goes to the Trash").example("flare gen endpoint Order publish --method POST --record").example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen policy Invoice --roles staff --own userId --own-except admin   # each user sees only their own").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").example("flare gen apikeys                                   # API keys for cron jobs, scripts and mobile apps").example("flare gen apikeys                                     # bearer keys for crons, scripts and mobile apps").action(
     async (generator, name, second, options2) => {
       if (generator === "billing")
         return genBilling({ provider: options2.provider, mode: options2.mode, force: options2.force, skipInstall: options2.skipInstall, skipMigration: options2.skipMigration });