@geekity/cms 0.29.0 → 0.31.0

package/dist/cli.js

@@ -1,27 +1,20 @@
 #!/usr/bin/env node
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
 import cluster from 'node:cluster';
 import { existsSync, realpathSync } from 'node:fs';
-import { createRequire } from 'node:module';
 import path from 'node:path';
 import { createInterface } from 'node:readline';
 import { DatabaseSync } from 'node:sqlite';
 import { Writable } from 'node:stream';
 import { pathToFileURL } from 'node:url';
-import { createUser, DuplicateUsernameError, migrateUsersToFile } from './admin/accounts.js';
 import { credentialProblem, emailProblem } from './admin/credentials.js';
-import { openAdminStore } from './admin/store.js';
+import { migrateUsersToFile } from './admin/legacy-migrations.js';
+import { adminStoreOwning, openAdminDatabase } from './store/admin-store.js';
 import { databaseFile, discardDatabase } from './cache.js';
-import { resolveConfig } from './config.js';
+import { CONFIG_FILENAMES, loadResolvedConfig } from './config-loader.js';
+import { migrateCommentEmails, migrateCommentKeys } from './comments/migrations.js';
 import { stripStoredUploads } from './content/metadata/sweep.js';
-import { UPLOAD_DIRECTORY } from './web/assets.js';
+import { createUser, DuplicateUsernameError } from './site/users.js';
+import { UPLOAD_DIRECTORY } from './content/uploads.js';
 import { createCms } from './index.js';
 import { initSite, ownManifest, seedStarterContent } from './init.js';
 import { importPluginFolders, scanPluginFolders } from './plugins/folder.js';
@@ -33,19 +26,151 @@ import { superviseCluster } from './supervisor/primary.js';
 import { processChannel, superviseWorker } from './supervisor/worker.js';
 import { enterMaintenance, leaveMaintenance, maintenanceFile, readMaintenance, } from './maintenance.js';
 import { devModeOn, enterDevMode, leaveDevMode } from './dev-mode.js';
-/** The commands a site can name on the command line, as opposed to the flags. */
-const COMMANDS = [
-    'serve',
-    'init',
-    'sync',
-    'rebuild',
-    'resend',
-    'user',
-    'maintenance',
-    'dev-mode',
-    'strip-metadata',
-    'plugin',
-];
+import { messageOf } from './util/errors.js';
+const COMMANDS = {
+    serve: {
+        synopsis: ['[serve] [--config <file>]'],
+        help: [['serve', ['Start the CMS (the default when no command is given).']]],
+        run: serveCommand,
+    },
+    init: {
+        synopsis: ['init <directory>'],
+        help: [['init', ['Create a new site in <directory>.']]],
+        run: initCommand,
+    },
+    sync: {
+        synopsis: ['sync [--config <file>]'],
+        help: [['sync', ['Rebuild the content index once and exit.']]],
+        run: syncCommand,
+    },
+    rebuild: {
+        synopsis: ['rebuild [--config <file>]'],
+        help: [
+            [
+                'rebuild',
+                [
+                    'Delete data/geekity.db and build it again from the files.',
+                    'Everything in it is derived, so this is always safe with the',
+                    'site stopped; sessions and delivery outcomes start empty.',
+                ],
+            ],
+        ],
+        run: rebuildCommand,
+    },
+    resend: {
+        synopsis: ['resend (--all | <slug>...) [--config <file>]'],
+        help: [
+            [
+                'resend',
+                [
+                    'Send announced posts to every follower and relay again, as',
+                    'they read now: an Update for a post still published, a',
+                    'Delete for one withdrawn. --all resends every post the site',
+                    'has announced; this is how posts federated before a new',
+                    'federation feature (such as quote posts) pick it up.',
+                ],
+            ],
+        ],
+        run: resendCommand,
+    },
+    maintenance: {
+        synopsis: ['maintenance (on [--until <time>] | off | status) [--config <file>]'],
+        help: [
+            [
+                'maintenance',
+                [
+                    'Take the public site down on purpose, or bring it back.',
+                    'While on, pages, feeds, sitemaps and inbox deliveries answer',
+                    '503 with Retry-After; the admin, /healthz and signed-in',
+                    'users are let through. A running site notices within a',
+                    'second, with no restart.',
+                ],
+            ],
+        ],
+        run: maintenanceCommand,
+    },
+    'dev-mode': {
+        synopsis: ['dev-mode (on | off | status) [--config <file>]'],
+        help: [
+            [
+                'dev-mode',
+                [
+                    'Hold everything the site would send to the outside world',
+                    '(ActivityPub deliveries and relay follows, webmentions,',
+                    'rssCloud and WebSub pings, IndexNow, email) while it is',
+                    'built or migrated, and record each one in',
+                    'data/dev-mode.jsonl. off takes the site live: nothing held',
+                    'is sent then, and the record says when it went live.',
+                ],
+            ],
+        ],
+        run: devModeCommand,
+    },
+    'strip-metadata': {
+        synopsis: ['strip-metadata [--config <file>]'],
+        help: [
+            [
+                'strip-metadata',
+                [
+                    'Remove location and camera metadata (EXIF, XMP, IPTC, a',
+                    "video's location) from files already in content/uploads.",
+                    'New uploads are stripped as they arrive; this is for the',
+                    'ones from before. Safe to run again: a clean file is left',
+                    'as it is.',
+                ],
+            ],
+        ],
+        run: stripMetadataCommand,
+    },
+    user: {
+        synopsis: ['user add <username> [--password <pw>] [--email <address>] [--config <file>]'],
+        help: [
+            [
+                'user add',
+                ['Create an admin user, so a site can get its first login', 'without the setup screen.'],
+            ],
+        ],
+        run: userCommand,
+    },
+    plugin: {
+        synopsis: [
+            'plugin (add <package>[@version] | remove <package>) [--config <file>]',
+            'plugin upgrade [<package>...] [--check] [--config <file>]',
+        ],
+        help: [
+            [
+                'plugin add',
+                [
+                    "Install a plugin package's bundle from the npm registry",
+                    '(npm_config_registry, or registry.npmjs.org) into the',
+                    'plugins folder, GEEKITY_PLUGINS_DIR. It installs only the',
+                    'package named, and names any plugin it requires that is',
+                    'missing. Reload on the Plugins screen loads it.',
+                ],
+            ],
+            [
+                'plugin remove',
+                [
+                    "Delete a plugin's folder from the plugins folder. Reload on",
+                    'the Plugins screen unloads it. It refuses a plugin the site',
+                    'has enabled: disable it first.',
+                ],
+            ],
+            [
+                'plugin upgrade',
+                [
+                    'Bring each plugin in the plugins folder, or only the ones',
+                    'named, up to its newest version that this core and the',
+                    'other installed plugins can run, installed as plugin add',
+                    'installs one. Plugins that must move together do. It says,',
+                    'for each plugin, what it upgraded, or why it held a newer',
+                    'version back. --check reports and installs nothing.',
+                ],
+            ],
+        ],
+        run: pluginFolderCommand,
+    },
+};
 /**
  * The options one command reads out of {@link ParsedArgs.flags}, each of which
  * carries a value.
@@ -53,68 +178,7 @@ const COMMANDS = [
 const VALUE_FLAGS = ['until'];
 /** The options that are simply on or off. */
 const SWITCH_FLAGS = ['all', 'check'];
-const CONFIG_FILENAMES = ['geekity.config.ts', 'geekity.config.js', 'geekity.config.mjs'];
-const USAGE = `geekity — the Geekity CMS command line
-
-Usage:
-  geekity [serve] [--config <file>]
-  geekity init <directory>
-  geekity sync [--config <file>]
-  geekity rebuild [--config <file>]
-  geekity resend (--all | <slug>...) [--config <file>]
-  geekity maintenance (on [--until <time>] | off | status) [--config <file>]
-  geekity dev-mode (on | off | status) [--config <file>]
-  geekity strip-metadata [--config <file>]
-  geekity user add <username> [--password <pw>] [--email <address>] [--config <file>]
-  geekity plugin (add <package>[@version] | remove <package>) [--config <file>]
-  geekity plugin upgrade [<package>...] [--check] [--config <file>]
-
-Commands:
-  serve            Start the CMS (the default when no command is given).
-  init             Create a new site in <directory>.
-  sync             Rebuild the content index once and exit.
-  rebuild          Delete data/geekity.db and build it again from the files.
-                   Everything in it is derived, so this is always safe with the
-                   site stopped; sessions and delivery outcomes start empty.
-  resend           Send announced posts to every follower and relay again, as
-                   they read now: an Update for a post still published, a
-                   Delete for one withdrawn. --all resends every post the site
-                   has announced; this is how posts federated before a new
-                   federation feature (such as quote posts) pick it up.
-  maintenance      Take the public site down on purpose, or bring it back.
-                   While on, pages, feeds, sitemaps and inbox deliveries answer
-                   503 with Retry-After; the admin, /healthz and signed-in
-                   users are let through. A running site notices within a
-                   second, with no restart.
-  dev-mode         Hold everything the site would send to the outside world
-                   (ActivityPub deliveries and relay follows, webmentions,
-                   rssCloud and WebSub pings, IndexNow, email) while it is
-                   built or migrated, and record each one in
-                   data/dev-mode.jsonl. off takes the site live: nothing held
-                   is sent then, and the record says when it went live.
-  strip-metadata   Remove location and camera metadata (EXIF, XMP, IPTC, a
-                   video's location) from files already in content/uploads.
-                   New uploads are stripped as they arrive; this is for the
-                   ones from before. Safe to run again: a clean file is left
-                   as it is.
-  user add         Create an admin user, so a site can get its first login
-                   without the setup screen.
-  plugin add       Install a plugin package's bundle from the npm registry
-                   (npm_config_registry, or registry.npmjs.org) into the
-                   plugins folder, GEEKITY_PLUGINS_DIR. It installs only the
-                   package named, and names any plugin it requires that is
-                   missing. Reload on the Plugins screen loads it.
-  plugin remove    Delete a plugin's folder from the plugins folder. Reload on
-                   the Plugins screen unloads it. It refuses a plugin the site
-                   has enabled: disable it first.
-  plugin upgrade   Bring each plugin in the plugins folder, or only the ones
-                   named, up to its newest version that this core and the
-                   other installed plugins can run, installed as plugin add
-                   installs one. Plugins that must move together do. It says,
-                   for each plugin, what it upgraded, or why it held a newer
-                   version back. --check reports and installs nothing.
-
-Options:
+const OPTIONS_HELP = `Options:
   --config <file>  Config file to load. Defaults to the first of
                    ${CONFIG_FILENAMES.join(', ')} found in the working directory.
   --password <pw>  The new user's password. Left off, it is asked for without
@@ -246,105 +310,7 @@ export function parseArgs(argv) {
     return { command: command ?? 'serve', configPath, password, email, flags, args };
 }
 function isCommand(value) {
-    return COMMANDS.includes(value);
-}
-/** Extensions that need TypeScript support in the loader. */
-const TYPESCRIPT_EXTENSIONS = new Set(['.ts', '.mts', '.cts']);
-/**
- * Load a config module, returning `{}` when the site has no config file.
- *
- * A TypeScript config is imported directly first. That is all it takes on Node
- * 24, which strips types without a flag, and inside this repository, where
- * the CLI already runs under tsx. A Node started with stripping disabled — and
- * any file carrying TypeScript syntax that stripping cannot erase — falls back to
- * registering tsx from the *site's* own dependencies, which is where a site
- * scaffolded by `geekity init` has it. A site with neither writes
- * `geekity.config.js` instead; it is in the candidate list for exactly that.
- */
-export async function loadConfig(cwd, configPath) {
-    const candidates = configPath === undefined
-        ? CONFIG_FILENAMES.map((name) => path.resolve(cwd, name))
-        : [path.resolve(cwd, configPath)];
-    for (const candidate of candidates) {
-        const href = pathToFileURL(candidate).href;
-        let module;
-        try {
-            module = (await import(__rewriteRelativeImportExtension(href)));
-        }
-        catch (error) {
-            if (isModuleNotFound(error, candidate))
-                continue;
-            if (!needsTypeScriptLoader(error, candidate))
-                throw error;
-            await registerTypeScriptLoader(cwd, candidate);
-            module = (await import(__rewriteRelativeImportExtension(href)));
-        }
-        return module.default ?? {};
-    }
-    if (configPath !== undefined) {
-        throw new Error(`Config file not found: ${path.resolve(cwd, configPath)}`);
-    }
-    return {};
-}
-/**
- * The site's own tsx, as the directory the package was installed into, or
- * `undefined` when the site does not have one.
- *
- * Node's resolver is deliberately not asked: this has to be the tsx the *site*
- * installed, and a resolver anchored anywhere else — or patched by a tsx that
- * is already loaded, which is what happens inside this repository — would
- * happily answer with somebody else's copy.
- */
-export function findSiteTsx(cwd) {
-    let directory = path.resolve(cwd);
-    for (;;) {
-        const candidate = path.join(directory, 'node_modules', 'tsx');
-        if (existsSync(path.join(candidate, 'package.json')))
-            return candidate;
-        const parent = path.dirname(directory);
-        if (parent === directory)
-            return undefined;
-        directory = parent;
-    }
-}
-/**
- * Teach this process to import TypeScript, using the tsx installed alongside
- * the site.
- *
- * tsx is the site's rather than this package's because the CMS does not depend
- * on it at runtime: a site that runs `server.ts` already has it, and a site
- * that does not want it writes its config in JavaScript instead.
- */
-export async function registerTypeScriptLoader(cwd, configFile) {
-    const tsx = findSiteTsx(cwd);
-    if (tsx === undefined) {
-        throw new Error(`Could not load ${configFile}: this Node cannot import TypeScript on its own and tsx is ` +
-            'not installed in this site. Either add it (pnpm add -D tsx), or write the config as ' +
-            'geekity.config.js instead.');
-    }
-    const fromTsx = createRequire(path.join(tsx, 'package.json'));
-    const api = (await import(__rewriteRelativeImportExtension(pathToFileURL(fromTsx.resolve('tsx/esm/api')).href)));
-    api.register();
-}
-/**
- * Whether an import failed because the loader could not handle TypeScript.
- *
- * `ERR_UNKNOWN_FILE_EXTENSION` is Node before type stripping was on by
- * default; `ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX` is a file using `enum` or
- * `namespace`, which stripping refuses because erasing it is not enough.
- */
-function needsTypeScriptLoader(error, candidate) {
-    if (!TYPESCRIPT_EXTENSIONS.has(path.extname(candidate).toLowerCase()))
-        return false;
-    const code = error?.code;
-    return code === 'ERR_UNKNOWN_FILE_EXTENSION' || code === 'ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX';
-}
-function isModuleNotFound(error, candidate) {
-    return (typeof error === 'object' &&
-        error !== null &&
-        'code' in error &&
-        error.code === 'ERR_MODULE_NOT_FOUND' &&
-        String(error.message ?? '').includes(candidate));
+    return Object.hasOwn(COMMANDS, value);
 }
 /** Run one command. Resolves with the exit code the process should use. */
 async function main(argv) {
@@ -352,37 +318,19 @@ async function main(argv) {
     if (first !== undefined && !isCommand(first) && !argv.some(isHelpOrVersion)) {
         return await pluginCommand(argv);
     }
-    const { command, configPath, password, email, flags, args } = parseArgs(argv);
-    if (command === 'help') {
-        process.stdout.write(await usage(configPath));
+    const parsed = parseArgs(argv);
+    if (parsed.command === 'help') {
+        process.stdout.write(await usage(parsed.configPath));
         return 0;
     }
-    if (command === 'version') {
+    if (parsed.command === 'version') {
         process.stdout.write(`${ownManifest().version}\n`);
         return 0;
     }
-    if (command === 'init')
-        return init(args);
-    if (command === 'user')
-        return userCommand(args, configPath, password, email);
-    if (command === 'sync')
-        return syncCommand(configPath);
-    if (command === 'rebuild')
-        return rebuildCommand(configPath);
-    if (command === 'resend')
-        return resendCommand(args, configPath, flags);
-    if (command === 'maintenance')
-        return maintenanceCommand(args, configPath, flags);
-    if (command === 'dev-mode')
-        return devModeCommand(args, configPath);
-    if (command === 'strip-metadata')
-        return stripMetadataCommand(configPath);
-    if (command === 'plugin')
-        return pluginFolderCommand(args, configPath, flags);
-    return serveCommand(configPath);
+    return COMMANDS[parsed.command].run(parsed);
 }
 /** `geekity init <directory>`: scaffold a new site. */
-async function init(args) {
+async function initCommand({ args }) {
     const directory = args[0];
     if (directory === undefined) {
         throw new Error('geekity init <directory> needs the directory to create.');
@@ -406,9 +354,9 @@ async function init(args) {
  * Only the file under `data/` is touched, so this works the same with the
  * site running or stopped: a running site re-reads it within a second.
  */
-async function maintenanceCommand(args, configPath, flags) {
+async function maintenanceCommand({ args, configPath, flags }) {
     const action = args[0];
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const config = await loadResolvedConfig(configPath);
     const file = maintenanceFile(config.dataDir);
     if (action === 'on') {
         const until = untilFlag(text(flags, 'until'));
@@ -433,11 +381,11 @@ async function maintenanceCommand(args, configPath, flags) {
     }
     throw new Error('geekity maintenance needs on, off or status.');
 }
-async function devModeCommand(args, configPath) {
+async function devModeCommand({ args, configPath }) {
     const action = args[0];
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const config = await loadResolvedConfig(configPath);
     if (action === 'on') {
-        enterDevMode(config.dataDir, 'command');
+        enterDevMode(config.dataDir, 'command', config.now());
         process.stdout.write('Dev mode is on: nothing the site does is sent until `geekity dev-mode off`.\n');
         return 0;
     }
@@ -446,7 +394,7 @@ async function devModeCommand(args, configPath) {
             throw new Error('GEEKITY_DEV_MODE or the devMode setting still asks for dev mode. ' +
                 'Remove it, then run geekity dev-mode off again.');
         }
-        const wasOn = leaveDevMode(config.dataDir);
+        const wasOn = leaveDevMode(config.dataDir, config.now());
         process.stdout.write(wasOn
             ? 'Dev mode is off: the site is live. Nothing held while it was on will be sent.\n'
             : 'Dev mode was already off: the site is live.\n');
@@ -475,8 +423,8 @@ function forcedLine(forced) {
         ? ' GEEKITY_MAINTENANCE or the maintenance setting keeps it on until the site restarts without it.'
         : '';
 }
-async function stripMetadataCommand(configPath) {
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
+async function stripMetadataCommand({ configPath }) {
+    const config = await loadResolvedConfig(configPath);
     const results = await stripStoredUploads(path.join(config.contentDir, UPLOAD_DIRECTORY));
     let stripped = 0;
     let clean = 0;
@@ -504,9 +452,8 @@ async function stripMetadataCommand(configPath) {
  * Watching is forced off whatever the config says, because a one-shot scan
  * that then sat in a watcher would never exit.
  */
-async function syncCommand(configPath) {
-    const config = await loadConfig(process.cwd(), configPath);
-    const cms = createCms({ ...config, watch: false });
+async function syncCommand({ configPath }) {
+    const cms = createCms(await loadResolvedConfig(configPath, (config) => ({ ...config, watch: false })));
     try {
         const result = await cms.sync();
         process.stdout.write(`Scanned ${String(result.scanned)}: ${String(result.created)} created, ` +
@@ -534,17 +481,16 @@ async function syncCommand(configPath) {
  * button on the federation screen, for every post at once. Delivery runs with
  * no queue, so each activity has been posted before the process exits.
  */
-async function resendCommand(args, configPath, flags) {
+async function resendCommand({ args, configPath, flags }) {
     const all = flags['all'] === true;
     if (all === args.length > 0) {
         throw new Error('geekity resend needs either --all or the slugs of the posts to resend, and not both.');
     }
-    const config = await loadConfig(process.cwd(), configPath);
-    const cms = createCms({
+    const cms = createCms(await loadResolvedConfig(configPath, (config) => ({
         ...config,
         watch: false,
         federation: { ...config.federation, queue: null },
-    });
+    })));
     try {
         await cms.sync();
         const slugs = all ? cms.store.listFederated().map((document) => document.slug) : args;
@@ -589,9 +535,8 @@ async function resendCommand(args, configPath, flags) {
  * Watching is forced off for the reason `sync` forces it off: a one-shot
  * command that sat in a watcher would never exit.
  */
-async function rebuildCommand(configPath) {
-    const loaded = await loadConfig(process.cwd(), configPath);
-    const config = resolveConfig(loaded);
+async function rebuildCommand({ configPath }) {
+    const config = await loadResolvedConfig(configPath, (loaded) => ({ ...loaded, watch: false }));
     const file = databaseFile(config.dataDir);
     if (databaseInUse(config.dataDir)) {
         process.stderr.write(`${file} is in use: something else has it open, most likely the site itself. Stop the ` +
@@ -600,7 +545,7 @@ async function rebuildCommand(configPath) {
         return 1;
     }
     discardDatabase(config.dataDir);
-    const cms = createCms({ ...loaded, watch: false });
+    const cms = createCms(config);
     try {
         const result = await cms.sync();
         process.stdout.write(`Rebuilt ${file} from the files.\n` +
@@ -688,10 +633,10 @@ const SQLITE_LOCKED = 6;
  * to show and the setup screen. It happens here rather than in `createCms` so
  * a site that builds its own server never has content written for it.
  */
-async function serveCommand(configPath) {
+async function serveCommand({ configPath }) {
     if (cluster.isWorker)
         return serveWorker(configPath);
-    const resolved = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const resolved = await loadResolvedConfig(configPath);
     if (resolved.seedContent &&
         (await seedStarterContent({ contentDir: resolved.contentDir, baseUrl: resolved.baseUrl }))) {
         process.stdout.write(`Seeded ${resolved.contentDir} with the starter site\n`);
@@ -713,20 +658,26 @@ async function serveWorker(configPath) {
     for (const signal of ['SIGINT', 'SIGTERM'])
         process.on(signal, () => undefined);
     try {
-        const config = await loadConfig(process.cwd(), configPath);
-        const loaded = scanPluginFolders(resolveConfig(config).pluginsDir);
+        // The access log is on here and off in `createCms`: a server that answers
+        // the internet should be able to say what it answered, while a CMS embedded
+        // in somebody else's app has no business writing to their stdout uninvited.
+        // Named as a config value rather than forced, so `GEEKITY_ACCESS_LOG` still
+        // wins and a site that wrote `accessLog: false` still gets silence.
+        const config = await loadResolvedConfig(configPath, (site) => ({
+            ...site,
+            accessLog: site.accessLog ?? true,
+        }));
+        const loaded = scanPluginFolders(config.pluginsDir);
         const worker = superviseWorker({
             channel,
             loaded,
             exit: (code) => process.exit(code),
             log: (line) => process.stderr.write(`${line}\n`),
         });
-        // The access log is on here and off in `createCms`: a server that answers
-        // the internet should be able to say what it answered, while a CMS embedded
-        // in somebody else's app has no business writing to their stdout uninvited.
-        // Named as a config value rather than forced, so `GEEKITY_ACCESS_LOG` still
-        // wins and a site that wrote `accessLog: false` still gets silence.
-        const cms = createCms({ ...config, accessLog: config.accessLog ?? true }, { folderPlugins: await importPluginFolders(loaded), supervision: worker.supervision });
+        const cms = createCms(config, {
+            folderPlugins: await importPluginFolders(loaded),
+            supervision: worker.supervision,
+        });
         const { port } = await cms.serve();
         if (devModeOn(cms.config)) {
             process.stdout.write('Dev mode is on: ActivityPub, webmentions, feed pings, IndexNow and email are held ' +
@@ -736,18 +687,18 @@ async function serveWorker(configPath) {
         worker.serving(cms);
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+        const message = messageOf(error);
         channel.send({ type: 'boot-failed', error: message }, () => process.exit(1));
     }
     return 0;
 }
-async function pluginFolderCommand(args, configPath, flags) {
+async function pluginFolderCommand({ args, configPath, flags }) {
     const [action, ...names] = args;
     const spec = names.length === 1 ? names[0] : undefined;
     if (action !== 'upgrade' && action !== 'add' && action !== 'remove') {
         throw new Error(PLUGIN_USAGE);
     }
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const config = await loadResolvedConfig(configPath);
     const { pluginsDir } = config;
     if (pluginsDir === undefined) {
         throw new Error('geekity plugin needs a plugins folder: set GEEKITY_PLUGINS_DIR, or pluginsDir in the config.');
@@ -842,7 +793,7 @@ function upgradeReportText(report) {
  * holding nobody but the user added here — which, the file winning, is what
  * the next boot would keep. So the same boot migration runs first.
  */
-async function userCommand(args, configPath, flagPassword, flagEmail) {
+async function userCommand({ args, configPath, password: flagPassword, email: flagEmail, }) {
     const subcommand = args[0];
     if (subcommand === undefined) {
         throw new Error('geekity user add <username> needs a subcommand. The only one is: add.');
@@ -861,11 +812,18 @@ async function userCommand(args, configPath, flagPassword, flagEmail) {
         process.stderr.write(`${problem}\n`);
         return 1;
     }
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
-    const admin = openAdminStore({ dataDir: config.dataDir, baseUrl: config.baseUrl });
-    migrateUsersToFile({ admin, dataDir: config.dataDir });
+    const config = await loadResolvedConfig(configPath);
+    const adminDb = openAdminDatabase(config.dataDir, config.now);
+    migrateUsersToFile(adminDb, config.dataDir);
+    const admin = adminStoreOwning(adminDb, databaseFile(config.dataDir), config.now);
     try {
-        const user = await createUser({ dataDir: config.dataDir, username, password, email });
+        const user = await createUser({
+            dataDir: config.dataDir,
+            username,
+            password,
+            email,
+            now: config.now(),
+        });
         process.stdout.write(`Created admin user ${user.username}${user.email === undefined ? '' : ` (${user.email})`}. Sign in at ${LOGIN_URL}.\n`);
         return 0;
     }
@@ -935,19 +893,26 @@ async function pluginCommands(config) {
  *
  * The database is opened for the reason `user add` opens it: a command can
  * reach `data/users.json` before any server has, so a site upgrading from the
- * version that kept its accounts in SQLite is migrated first.
+ * version that kept its accounts in SQLite is migrated first. The comments
+ * are migrated as a boot would migrate them for the same reason: a command
+ * writing comments before any server has would otherwise meet ids the site
+ * refuses to store.
  */
 async function pluginCommand(argv) {
     const configPath = configFlag(argv);
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const config = await loadResolvedConfig(configPath);
     const words = leadingWords(argv);
     const found = (await pluginCommands(config)).find(({ command }) => command.words.every((word, index) => words[index] === word));
     if (found === undefined) {
         throw new Error(`Unknown command "${words[0] ?? ''}". Run geekity --help to see what is available.`);
     }
     const { args, options } = parseCommandArgs(withoutConfig(argv).slice(found.command.words.length), found.command);
-    const admin = openAdminStore({ dataDir: config.dataDir, baseUrl: config.baseUrl });
-    migrateUsersToFile({ admin, dataDir: config.dataDir });
+    const adminDb = openAdminDatabase(config.dataDir, config.now);
+    migrateUsersToFile(adminDb, config.dataDir);
+    const admin = adminStoreOwning(adminDb, databaseFile(config.dataDir), config.now);
+    const comments = { contentDir: config.contentDir, dataDir: config.dataDir };
+    migrateCommentEmails(comments);
+    migrateCommentKeys(comments);
     try {
         return await found.command.run({
             args,
@@ -1018,14 +983,14 @@ function parseCommandArgs(argv, command) {
 async function usage(configPath) {
     let found;
     try {
-        found = await pluginCommands(resolveConfig(await loadConfig(process.cwd(), configPath)));
+        found = await pluginCommands(await loadResolvedConfig(configPath));
     }
     catch (error) {
-        process.stderr.write(`Plugin commands are not listed: ${error instanceof Error ? error.message : String(error)}\n`);
-        return USAGE;
+        process.stderr.write(`Plugin commands are not listed: ${messageOf(error)}\n`);
+        return coreUsage();
     }
     if (found.length === 0)
-        return USAGE;
+        return coreUsage();
     const lines = ['', 'Plugin commands:'];
     for (const { plugin, command } of found) {
         const synopsis = wrap(`geekity ${[...command.words, command.usage].join(' ').trim()} [--config <file>]`, USAGE_CONTINUATION);
@@ -1033,18 +998,31 @@ async function usage(configPath) {
         lines.push(...wrap(command.summary, HELP_INDENT), `${HELP_INDENT}From ${plugin}.`);
         for (const option of command.options ?? []) {
             const flag = `--${option.name}${option.value === undefined ? '' : ` ${option.value}`}`;
-            const described = wrap(option.description, HELP_INDENT);
-            const head = `    ${flag}`;
-            if (head.length < HELP_INDENT.length - 1 && described[0] !== undefined) {
-                described[0] = `${head.padEnd(HELP_INDENT.length)}${described[0].trimStart()}`;
-                lines.push(...described);
-            }
-            else {
-                lines.push(head, ...described);
-            }
+            lines.push(...helpEntry(`    ${flag}`, wrap(option.description, HELP_INDENT)));
         }
     }
-    return `${USAGE}${lines.join('\n')}\n`;
+    return `${coreUsage()}${lines.join('\n')}\n`;
+}
+function coreUsage() {
+    const entries = Object.values(COMMANDS);
+    return [
+        'geekity — the Geekity CMS command line',
+        '',
+        'Usage:',
+        ...entries.flatMap((entry) => entry.synopsis.map((line) => `  geekity ${line}`)),
+        '',
+        'Commands:',
+        ...entries.flatMap((entry) => entry.help.flatMap(([words, summary]) => helpEntry(`  ${words}`, summary.map((line) => `${HELP_INDENT}${line}`)))),
+        '',
+        OPTIONS_HELP,
+    ].join('\n');
+}
+function helpEntry(head, described) {
+    if (head.length < HELP_INDENT.length - 1 && described[0] !== undefined) {
+        described[0] = `${head.padEnd(HELP_INDENT.length)}${described[0].trimStart()}`;
+        return described;
+    }
+    return [head, ...described];
 }
 /** Where the help's descriptions start, as the core commands' do. */
 const HELP_INDENT = ' '.repeat(19);
@@ -1152,7 +1130,7 @@ if (isEntryPoint()) {
             process.exitCode = code;
     })
         .catch((error) => {
-        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.stderr.write(`${messageOf(error)}\n`);
         process.exit(1);
     });
 }