@meith/cli 0.17.1 → 0.18.0

package/LICENSE.md

@@ -1,165 +1,21 @@
-                   GNU LESSER GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-
-  This version of the GNU Lesser General Public License incorporates
-the terms and conditions of version 3 of the GNU General Public
-License, supplemented by the additional permissions listed below.
-
-  0. Additional Definitions.
-
-  As used herein, "this License" refers to version 3 of the GNU Lesser
-General Public License, and the "GNU GPL" refers to version 3 of the GNU
-General Public License.
-
-  "The Library" refers to a covered work governed by this License,
-other than an Application or a Combined Work as defined below.
-
-  An "Application" is any work that makes use of an interface provided
-by the Library, but which is not otherwise based on the Library.
-Defining a subclass of a class defined by the Library is deemed a mode
-of using an interface provided by the Library.
-
-  A "Combined Work" is a work produced by combining or linking an
-Application with the Library.  The particular version of the Library
-with which the Combined Work was made is also called the "Linked
-Version".
-
-  The "Minimal Corresponding Source" for a Combined Work means the
-Corresponding Source for the Combined Work, excluding any source code
-for portions of the Combined Work that, considered in isolation, are
-based on the Application, and not on the Linked Version.
-
-  The "Corresponding Application Code" for a Combined Work means the
-object code and/or source code for the Application, including any data
-and utility programs needed for reproducing the Combined Work from the
-Application, but excluding the System Libraries of the Combined Work.
-
-  1. Exception to Section 3 of the GNU GPL.
-
-  You may convey a covered work under sections 3 and 4 of this License
-without being bound by section 3 of the GNU GPL.
-
-  2. Conveying Modified Versions.
-
-  If you modify a copy of the Library, and, in your modifications, a
-facility refers to a function or data to be supplied by an Application
-that uses the facility (other than as an argument passed when the
-facility is invoked), then you may convey a copy of the modified
-version:
-
-   a) under this License, provided that you make a good faith effort to
-   ensure that, in the event an Application does not supply the
-   function or data, the facility still operates, and performs
-   whatever part of its purpose remains meaningful, or
-
-   b) under the GNU GPL, with none of the additional permissions of
-   this License applicable to that copy.
-
-  3. Object Code Incorporating Material from Library Header Files.
-
-  The object code form of an Application may incorporate material from
-a header file that is part of the Library.  You may convey such object
-code under terms of your choice, provided that, if the incorporated
-material is not limited to numerical parameters, data structure
-layouts and accessors, or small macros, inline functions and templates
-(ten or fewer lines in length), you do both of the following:
-
-   a) Give prominent notice with each copy of the object code that the
-   Library is used in it and that the Library and its use are
-   covered by this License.
-
-   b) Accompany the object code with a copy of the GNU GPL and this license
-   document.
-
-  4. Combined Works.
-
-  You may convey a Combined Work under terms of your choice that,
-taken together, effectively do not restrict modification of the
-portions of the Library contained in the Combined Work and reverse
-engineering for debugging such modifications, if you also do each of
-the following:
-
-   a) Give prominent notice with each copy of the Combined Work that
-   the Library is used in it and that the Library and its use are
-   covered by this License.
-
-   b) Accompany the Combined Work with a copy of the GNU GPL and this license
-   document.
-
-   c) For a Combined Work that displays copyright notices during
-   execution, include the copyright notice for the Library among
-   these notices, as well as a reference directing the user to the
-   copies of the GNU GPL and this license document.
-
-   d) Do one of the following:
-
-       0) Convey the Minimal Corresponding Source under the terms of this
-       License, and the Corresponding Application Code in a form
-       suitable for, and under terms that permit, the user to
-       recombine or relink the Application with a modified version of
-       the Linked Version to produce a modified Combined Work, in the
-       manner specified by section 6 of the GNU GPL for conveying
-       Corresponding Source.
-
-       1) Use a suitable shared library mechanism for linking with the
-       Library.  A suitable mechanism is one that (a) uses at run time
-       a copy of the Library already present on the user's computer
-       system, and (b) will operate properly with a modified version
-       of the Library that is interface-compatible with the Linked
-       Version.
-
-   e) Provide Installation Information, but only if you would otherwise
-   be required to provide such information under section 6 of the
-   GNU GPL, and only to the extent that such information is
-   necessary to install and execute a modified version of the
-   Combined Work produced by recombining or relinking the
-   Application with a modified version of the Linked Version. (If
-   you use option 4d0, the Installation Information must accompany
-   the Minimal Corresponding Source and Corresponding Application
-   Code. If you use option 4d1, you must provide the Installation
-   Information in the manner specified by section 6 of the GNU GPL
-   for conveying Corresponding Source.)
-
-  5. Combined Libraries.
-
-  You may place library facilities that are a work based on the
-Library side by side in a single library together with other library
-facilities that are not Applications and are not covered by this
-License, and convey such a combined library under terms of your
-choice, if you do both of the following:
-
-   a) Accompany the combined library with a copy of the same work based
-   on the Library, uncombined with any other library facilities,
-   conveyed under the terms of this License.
-
-   b) Give prominent notice with the combined library that part of it
-   is a work based on the Library, and explaining where to find the
-   accompanying uncombined form of the same work.
-
-  6. Revised Versions of the GNU Lesser General Public License.
-
-  The Free Software Foundation may publish revised and/or new versions
-of the GNU Lesser General Public License from time to time. Such new
-versions will be similar in spirit to the present version, but may
-differ in detail to address new problems or concerns.
-
-  Each version is given a distinguishing version number. If the
-Library as you received it specifies that a certain numbered version
-of the GNU Lesser General Public License "or any later version"
-applies to it, you have the option of following the terms and
-conditions either of that published version or of any later version
-published by the Free Software Foundation. If the Library as you
-received it does not specify a version number of the GNU Lesser
-General Public License, you may choose any version of the GNU Lesser
-General Public License ever published by the Free Software Foundation.
-
-  If the Library as you received it specifies that a proxy can decide
-whether future versions of the GNU Lesser General Public License shall
-apply, that proxy's public statement of acceptance of any version is
-permanent authorization for you to choose that version for the
-Library.
+MIT License
+
+Copyright (c) 2026 Jordan Harrison and the Meith contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bin/community.mjs

@@ -92,11 +92,13 @@ function materialize() {
   return join(srcTarget, 'index.ts')
 }
 
+/**
+ * Resolved from this package's own directory — `tsx` is `@meith/cli`'s
+ * dependency, found either hoisted to the workspace root or nested under
+ * this package's own `node_modules`, the same reasoning as forum-web's
+ * `resolveNextBin()`.
+ */
 function resolveTsx() {
-  // Resolved from this package's own directory — `tsx` is @meith/cli's
-  // dependency, found either hoisted to the workspace root or nested under
-  // this package's own node_modules, the same reasoning as forum-web's
-  // resolveNextBin().
   const require = createRequire(join(packageRoot, 'package.json'))
   try {
     return require.resolve('tsx/cli')

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@meith/cli",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "description": "The operator CLI: migrations, backup and restore, imports, users and settings — and the community bin that runs it against an external board workspace.",
-  "license": "LGPL-3.0-or-later",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/meith-dev/meith.git",
@@ -23,18 +23,18 @@
   },
   "dependencies": {
     "tsx": "^4.23.12",
-    "@meith/accounts": "0.17.1",
-    "@meith/core": "0.17.1",
-    "@meith/db": "0.17.1",
-    "@meith/demo": "0.17.1",
-    "@meith/forums": "0.17.1",
-    "@meith/drivers": "0.17.1",
-    "@meith/plugin-kit": "0.17.1",
-    "@meith/profile-fields": "0.17.1",
-    "@meith/settings": "0.17.1",
-    "create-meith": "0.17.1",
-    "@meith/tasks": "0.17.1",
-    "@meith/runtime": "0.17.1"
+    "@meith/accounts": "0.18.0",
+    "@meith/core": "0.18.0",
+    "@meith/db": "0.18.0",
+    "@meith/demo": "0.18.0",
+    "@meith/forums": "0.18.0",
+    "@meith/drivers": "0.18.0",
+    "@meith/plugin-kit": "0.18.0",
+    "@meith/profile-fields": "0.18.0",
+    "@meith/settings": "0.18.0",
+    "@meith/tasks": "0.18.0",
+    "@meith/runtime": "0.18.0",
+    "create-meith": "0.18.0"
   },
   "devDependencies": {
     "esbuild": "^0.28.2"

package/src/backup.ts

@@ -14,9 +14,9 @@ import {
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 
-import { ConfigurationError, env, ValidationError } from '@meith/core'
+import { ConfigurationError, env, type FileStore, ValidationError } from '@meith/core'
 import { migrationUrl, runMigrations } from '@meith/db'
-import { S3FileStore } from '@meith/drivers'
+import { BlobFileStore, S3FileStore } from '@meith/drivers'
 
 import { optional, parseFlags } from './args'
 import { requirePostgres } from './context'
@@ -24,17 +24,19 @@ import { CODE_VERSION } from './upgrade'
 
 export type UploadsMode = 'include' | 'skip'
 
+export type FilestoreDriver = 'local' | 's3' | 'blob'
+
 export interface BackupManifest {
   readonly format: 1
   readonly createdAt: string
   readonly version: string
-  readonly filestore: 'local' | 's3'
+  readonly filestore: FilestoreDriver
   readonly uploads: 'included' | 'skipped'
   readonly bucket?: string
 }
 
-export function resolveUploadsMode(driver: 'local' | 's3', flag: string | undefined): UploadsMode {
-  if (flag === undefined) return driver === 'local' ? 'include' : 'skip'
+export function resolveUploadsMode(driver: FilestoreDriver, flag: string | undefined): UploadsMode {
+  if (flag === undefined) return driver === 's3' ? 'skip' : 'include'
   if (flag === 'include' || flag === 'skip') return flag
   throw new ValidationError(`--uploads must be "include" or "skip", got "${flag}".`)
 }
@@ -67,7 +69,11 @@ export function parseManifest(raw: string): BackupManifest {
   if (typeof manifest.createdAt !== 'string' || typeof manifest.version !== 'string') {
     throw new ValidationError('The bundle manifest is missing createdAt or version.')
   }
-  if (manifest.filestore !== 'local' && manifest.filestore !== 's3') {
+  if (
+    manifest.filestore !== 'local' &&
+    manifest.filestore !== 's3' &&
+    manifest.filestore !== 'blob'
+  ) {
     throw new ValidationError('The bundle manifest does not name a known file driver.')
   }
 
@@ -378,12 +384,14 @@ async function stageLocalUploads(stage: string): Promise<'included' | 'skipped'>
   return 'included'
 }
 
-async function stageS3Uploads(stage: string): Promise<'included' | 'skipped'> {
-  const store = S3FileStore.fromEnv(env)
-  const dir = path.join(stage, 'uploads')
-  await mkdir(dir, { recursive: true })
+export interface ListableStore {
+  listKeys(): AsyncGenerator<string>
+  get(key: string): Promise<Uint8Array | undefined>
+}
 
+export async function drainStoreToDirectory(store: ListableStore, dir: string): Promise<number> {
   let pulled = 0
+
   for await (const key of store.listKeys()) {
     const target = path.resolve(dir, key)
     if (target !== dir && !target.startsWith(dir + path.sep)) {
@@ -397,18 +405,66 @@ async function stageS3Uploads(stage: string): Promise<'included' | 'skipped'> {
     pulled++
   }
 
+  return pulled
+}
+
+export async function uploadDirectoryToStore(
+  store: { put: FileStore['put'] },
+  dir: string,
+): Promise<number> {
+  let pushed = 0
+
+  for (const file of await walk(dir)) {
+    const key = path.relative(dir, file).split(path.sep).join('/')
+    await store.put(key, await readFile(file), {
+      contentType: contentTypeFor(key),
+      visibility: 'public',
+    })
+    pushed++
+  }
+
+  return pushed
+}
+
+async function stageObjectStoreUploads(
+  stage: string,
+  store: ListableStore,
+  origin: string,
+): Promise<'included' | 'skipped'> {
+  const dir = path.join(stage, 'uploads')
+  await mkdir(dir, { recursive: true })
+
+  const pulled = await drainStoreToDirectory(store, dir)
+
   if (pulled === 0) {
-    console.log(`The ${env.S3_BUCKET} bucket is empty; the bundle carries no uploads.`)
+    console.log(`Found no objects in ${origin}; the bundle carries no uploads.`)
     await rm(dir, { recursive: true, force: true })
     return 'skipped'
   }
 
   await run('tar', ['czf', path.join(stage, 'uploads.tar.gz'), '-C', dir, '.'])
   await rm(dir, { recursive: true, force: true })
-  console.log(`Pulled ${pulled} object(s) from ${env.S3_BUCKET}.`)
+  console.log(`Pulled ${pulled} object(s) from ${origin}.`)
   return 'included'
 }
 
+async function stageUploads(stage: string, mode: UploadsMode): Promise<'included' | 'skipped'> {
+  if (mode === 'skip') return 'skipped'
+
+  switch (env.FILESTORE_DRIVER) {
+    case 's3':
+      return await stageObjectStoreUploads(
+        stage,
+        S3FileStore.fromEnv(env),
+        `the ${env.S3_BUCKET} bucket`,
+      )
+    case 'blob':
+      return await stageObjectStoreUploads(stage, BlobFileStore.fromEnv(env), 'the Blob store')
+    case 'local':
+      return await stageLocalUploads(stage)
+  }
+}
+
 export async function backupCommand(args: readonly string[]): Promise<number> {
   const { flags } = parseFlags(args)
   requirePostgres()
@@ -434,12 +490,7 @@ export async function backupCommand(args: readonly string[]): Promise<number> {
       databaseEnvironment,
     )
 
-    const uploads =
-      mode === 'skip'
-        ? 'skipped'
-        : env.FILESTORE_DRIVER === 's3'
-          ? await stageS3Uploads(stage)
-          : await stageLocalUploads(stage)
+    const uploads = await stageUploads(stage, mode)
 
     const manifest: BackupManifest = {
       format: 1,
@@ -526,23 +577,19 @@ async function extractUploads(stage: string, dir: string, limits: RestoreLimits)
   console.log(`Restored the uploads into ${dir}.`)
 }
 
-async function pushUploadsToS3(stage: string, limits: RestoreLimits): Promise<void> {
+async function pushUploadsToStore(
+  stage: string,
+  limits: RestoreLimits,
+  store: { put: FileStore['put'] },
+  destination: string,
+): Promise<void> {
   await validateUploadsArchive(stage, limits)
   const dir = path.join(stage, 'uploads-extract')
   await mkdir(dir, { recursive: true })
   await run('tar', ['xzf', path.join(stage, 'uploads.tar.gz'), '-C', dir])
 
-  const store = S3FileStore.fromEnv(env)
-  let pushed = 0
-  for (const file of await walk(dir)) {
-    const key = path.relative(dir, file).split(path.sep).join('/')
-    await store.put(key, await readFile(file), {
-      contentType: contentTypeFor(key),
-      visibility: 'public',
-    })
-    pushed++
-  }
-  console.log(`Uploaded ${pushed} object(s) to ${env.S3_BUCKET}.`)
+  const pushed = await uploadDirectoryToStore(store, dir)
+  console.log(`Uploaded ${pushed} object(s) to ${destination}.`)
 }
 
 const RESTORE_USAGE =
@@ -652,7 +699,9 @@ export async function restoreCommand(args: readonly string[]): Promise<number> {
     if (manifest.uploads === 'included' && flags.get('skip-uploads') !== 'true') {
       const uploadsDir = optional(flags, 'uploads-dir')
       if (env.FILESTORE_DRIVER === 's3' && uploadsDir === undefined) {
-        await pushUploadsToS3(stage, limits)
+        await pushUploadsToStore(stage, limits, S3FileStore.fromEnv(env), `${env.S3_BUCKET}`)
+      } else if (env.FILESTORE_DRIVER === 'blob' && uploadsDir === undefined) {
+        await pushUploadsToStore(stage, limits, BlobFileStore.fromEnv(env), 'the Blob store')
       } else {
         await extractUploads(stage, uploadsDir ?? env.UPLOADS_DIR, limits)
       }
@@ -662,7 +711,11 @@ export async function restoreCommand(args: readonly string[]): Promise<number> {
           ? `This bundle carries no uploads — they live in the S3 bucket${
               manifest.bucket === undefined ? '' : ` (${manifest.bucket})`
             }.`
-          : 'This bundle carries no uploads.',
+          : manifest.filestore === 'blob'
+            ? 'This bundle carries no uploads, and a Vercel Blob store is not ' +
+              'something you can copy out by hand. Take another backup with ' +
+              '--uploads include while the old board still exists.'
+            : 'This bundle carries no uploads.',
       )
     }
 

package/src/board-eject.ts

@@ -17,8 +17,12 @@ import { CODE_VERSION } from './upgrade'
  * bundled `dist/cli.cjs` does not sit at that same distance — Docker's own
  * `COPY apps/cli/dist/ ./apps/cli/` drops the `dist` segment.
  */
-const ROOT = fileURLToPath(new URL('../../../', import.meta.url))
-const DEFAULT_MANIFEST_PATH = join(ROOT, 'boards/stock/board.plugins.json')
+function defaultManifestPath(): string {
+  return join(
+    fileURLToPath(new URL('../../../', import.meta.url)),
+    'boards/stock/board.plugins.json',
+  )
+}
 
 interface ManifestEntry {
   readonly key: string
@@ -31,7 +35,81 @@ interface Manifest {
 }
 
 function manifestPath(): string {
-  return process.env.BOARD_PLUGINS_MANIFEST ?? DEFAULT_MANIFEST_PATH
+  return process.env.BOARD_PLUGINS_MANIFEST ?? defaultManifestPath()
+}
+
+/**
+ * Duplicated from scripts/board-plugins.mjs's own PLUGIN_KEY_PATTERN, IDENTIFIER_PATTERN
+ * and NPM_PACKAGE_NAME_PATTERN rather than imported — see docs/plugin-api.md, "The board
+ * plugin manifests" — and pinned to agree with it by board-eject.test.ts.
+ */
+const PLUGIN_KEY_PATTERN = /^[a-z][a-z0-9-]{1,39}$/
+const IDENTIFIER_PATTERN = /^[A-Za-z_$][A-Za-z0-9_$]*$/
+const NPM_PACKAGE_NAME_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/
+
+/**
+ * The same shape of refusal scripts/board-plugins.mjs's validateManifest makes for
+ * apps/community and boards/stock, minus the dependency check — a deployed image
+ * carries no package.json listing what it was actually built with. A manifest that
+ * gets this far already passed that check once, when plugin:add wrote it; this is
+ * defense against a manifest hand-edited after the fact, not the primary gate.
+ */
+export function validateEjectManifest(plugins: readonly ManifestEntry[], path: string): void {
+  const seen = new Set<string>()
+  const identifiers = new Map<string, string>()
+
+  for (const entry of plugins) {
+    if (typeof entry.key !== 'string' || typeof entry.package !== 'string') {
+      throw new ValidationError(
+        `${path}: every entry needs a string "key" and "package". Got ${JSON.stringify(entry)}.`,
+      )
+    }
+
+    if (seen.has(entry.key)) {
+      throw new ValidationError(`${path}: "${entry.key}" is listed twice.`)
+    }
+    seen.add(entry.key)
+
+    if (!PLUGIN_KEY_PATTERN.test(entry.key)) {
+      throw new ValidationError(
+        `${path}: "${entry.key}" is not a valid plugin key. definePlugin requires lower-case ` +
+          'letters, digits and hyphens, starting with a letter, 2-40 characters long.',
+      )
+    }
+
+    if (entry.enabled !== undefined && typeof entry.enabled !== 'boolean') {
+      throw new ValidationError(
+        `${path}: "${entry.key}" has a non-boolean "enabled" (${JSON.stringify(entry.enabled)}). ` +
+          'Omit the field to enable the plugin, or set it to true or false.',
+      )
+    }
+
+    if (!NPM_PACKAGE_NAME_PATTERN.test(entry.package) || entry.package.length > 214) {
+      throw new ValidationError(
+        `${path}: "${entry.package}" (key "${entry.key}") is not a valid npm package name.`,
+      )
+    }
+
+    const identifier = toIdentifier(entry.key)
+    if (!IDENTIFIER_PATTERN.test(identifier)) {
+      throw new ValidationError(
+        `${path}: "${entry.key}" is a valid plugin key, but the identifier ` +
+          `community.plugins.ts would bind for it, "${identifier}", is not a valid TypeScript ` +
+          'identifier. Each hyphen must be followed by exactly one lower-case letter or digit, ' +
+          'and a key cannot end in a hyphen.',
+      )
+    }
+
+    const collidingKey = identifiers.get(identifier)
+    if (collidingKey !== undefined) {
+      throw new ValidationError(
+        `${path}: "${entry.key}" and "${collidingKey}" both generate the identifier ` +
+          `"${identifier}" for community.plugins.ts. Rename one of the keys so the generated ` +
+          'imports do not collide.',
+      )
+    }
+    identifiers.set(identifier, entry.key)
+  }
 }
 
 /**
@@ -63,6 +141,7 @@ async function readManifest(): Promise<Manifest> {
   if (!Array.isArray(parsed.plugins)) {
     throw new ValidationError(`${path} must have a "plugins" array.`)
   }
+  validateEjectManifest(parsed.plugins, path)
   return { plugins: parsed.plugins }
 }
 
@@ -75,10 +154,33 @@ async function isEmptyOrMissing(target: string): Promise<boolean> {
   }
 }
 
-function toIdentifier(key: string): string {
+export function toIdentifier(key: string): string {
   return key.replace(/-([a-z0-9])/g, (_match, char) => char.toUpperCase())
 }
 
+interface EjectedPackageJson {
+  dependencies: Record<string, string>
+  [key: string]: unknown
+}
+
+/**
+ * Every manifest entry's package pinned into the scaffolded package.json's
+ * dependencies, at this exact running version — see docs/marketplace.md,
+ * "1. Eject", for why never `latest`, and for the collision policy this
+ * implements: a package scaffold() already pins is left exactly where it
+ * is, never duplicated or reordered, because both pins are always this
+ * same CODE_VERSION.
+ */
+function mergePluginDependencies(packageJson: string, plugins: readonly ManifestEntry[]): string {
+  const parsed = JSON.parse(packageJson) as EjectedPackageJson
+  for (const entry of plugins) {
+    if (!(entry.package in parsed.dependencies)) {
+      parsed.dependencies[entry.package] = CODE_VERSION
+    }
+  }
+  return `${JSON.stringify(parsed, null, 2)}\n`
+}
+
 /**
  * The ejected workspace's own community.plugins.ts — the same shape
  * create-meith's scaffold() writes for a plugin-free board (see
@@ -122,6 +224,30 @@ export function installedPluginDefinitions() {
 `
 }
 
+function isFsPermissionError(error: unknown): error is NodeJS.ErrnoException {
+  const code = (error as NodeJS.ErrnoException | undefined)?.code
+  return code === 'EACCES' || code === 'EPERM'
+}
+
+/**
+ * Turns an EACCES/EPERM from the write loop below into this instead of a
+ * bare Node stack trace — see docs/marketplace.md, "1. Eject", for the
+ * bind-mount ownership rule this message is naming. Anything else passes
+ * through unchanged.
+ */
+function translateWriteError(error: unknown, target: string, path: string): never {
+  if (isFsPermissionError(error)) {
+    throw new ValidationError(
+      `board:eject could not write to ${path}: permission denied. The account running this ` +
+        `command needs write access to ${target} — inside the official image that account is ` +
+        'a fixed, non-root user, so a bind-mounted target directory has to already be owned by ' +
+        '(or writable by) that same account before eject runs. See docs/marketplace.md, ' +
+        '"Moving to a custom board", for the exact invocation.',
+    )
+  }
+  throw error
+}
+
 export async function boardEject(args: readonly string[]): Promise<number> {
   const positional = args.filter((arg) => !arg.startsWith('-'))
   const [dir] = positional
@@ -150,13 +276,22 @@ export async function boardEject(args: readonly string[]): Promise<number> {
   const files = new Map(
     scaffold({ name, version: CODE_VERSION, repositoryUrl: DEFAULT_REPOSITORY_URL }),
   )
+  const packageJson = files.get('package.json')
+  if (packageJson === undefined) {
+    throw new Error('scaffold() did not emit package.json')
+  }
+  files.set('package.json', mergePluginDependencies(packageJson, manifest.plugins))
   files.set('board.plugins.json', `${JSON.stringify({ plugins: manifest.plugins }, null, 2)}\n`)
   files.set('community.plugins.ts', renderInstalledPluginsModule(manifest.plugins))
 
   for (const [relative, contents] of files) {
     const path = join(target, relative)
-    await mkdir(dirname(path), { recursive: true })
-    await writeFile(path, contents, 'utf8')
+    try {
+      await mkdir(dirname(path), { recursive: true })
+      await writeFile(path, contents, 'utf8')
+    } catch (error) {
+      translateWriteError(error, target, path)
+    }
   }
 
   console.log(`Ejected ${files.size} files to ${target}, pinned to meith ${CODE_VERSION}.`)

package/src/index.ts

@@ -84,6 +84,19 @@ const commands: Command[] = [
   {
     name: 'migrate',
     summary: 'Apply pending database migrations.',
+    usage: [
+      'community migrate',
+      '',
+      'Applies every migration this release has that the board has not, then exits.',
+      'Safe to run concurrently: the runner holds a Postgres advisory lock for the',
+      'whole run, so a second deploy waits for the first and then finds nothing to do.',
+      '',
+      'Migrates over DIRECT_DATABASE_URL when it is set, and over DATABASE_URL when it',
+      'is not. On a managed database point DIRECT_DATABASE_URL at the direct',
+      '(non-pooler) connection string: a transaction-mode pooler hands the connection',
+      'back as soon as the lock statement ends, so the lock is left on a backend that',
+      'goes to somebody else and the run is no longer serialised against other runs.',
+    ].join('\n'),
     async run() {
       const { assertEnv } = await import('@meith/core')
       const env = assertEnv()
@@ -93,6 +106,12 @@ const commands: Command[] = [
         return 1
       }
 
+      console.log(
+        env.DIRECT_DATABASE_URL === undefined
+          ? 'Migrating over DATABASE_URL…'
+          : 'Migrating over DIRECT_DATABASE_URL…',
+      )
+
       const { runMigrations } = await import('@meith/db')
       const applied = await runMigrations()
       console.log(applied === 0 ? 'Already up to date.' : `Applied ${applied} migration(s).`)

package/src/plugin-manifest.ts

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url'
 
 import { ValidationError } from '@meith/core'
 
+import BOARDS_JSON from '../../../scripts/boards.json'
 import { optional, parseFlags } from './args'
 
 /**
@@ -12,9 +13,33 @@ import { optional, parseFlags } from './args'
  * distance from the repository root (apps/cli/{src,dist}/<file> either way), so this
  * offset holds whether these commands run from source (tsx) or the built dist/cli.cjs.
  */
-const ROOT = fileURLToPath(new URL('../../../', import.meta.url))
-const MANIFEST_PATH = join(ROOT, 'apps/community/board.plugins.json')
-const GENERATOR_SCRIPT = join(ROOT, 'scripts/board-plugins-gen.mjs')
+function repoRoot(): string {
+  return fileURLToPath(new URL('../../../', import.meta.url))
+}
+
+function generatorScript(): string {
+  return join(repoRoot(), 'scripts/board-plugins-gen.mjs')
+}
+
+/**
+ * Every board's board.plugins.json is edited together, from the one list in
+ * scripts/boards.json that scripts/board-plugins-gen.mjs reads too. That file
+ * and the MEITH_BOARD_PLUGINS_ROOT override are described in
+ * docs/development.md, "The board plugin manifests".
+ */
+interface Board {
+  readonly manifestFile: string
+  readonly packageFile: string
+  readonly outputFile: string
+  readonly packageLabel: string
+  readonly filterName: string
+}
+
+const BOARDS = BOARDS_JSON as readonly Board[]
+
+function boardsRoot(): string {
+  return process.env.MEITH_BOARD_PLUGINS_ROOT ?? repoRoot()
+}
 
 interface ManifestEntry {
   readonly key: string
@@ -32,19 +57,21 @@ interface Manifest {
  * one meant to run as `docker compose run --rm web community plugin:purge`. The deployed
  * image is built `FROM node:26-alpine` with only `.next/standalone`, the worker and this
  * CLI's own bundle copied in (see docker/Dockerfile) — no `scripts/`, no `board.plugins.json`,
- * no Biome. Reading the manifest is where that shows up first, so this is where it is named.
+ * no Biome. Reading a manifest is where that shows up first, so this is where it is named.
  */
-async function readManifest(): Promise<Manifest> {
+async function readManifestFor(board: Board): Promise<Manifest> {
+  const path = join(boardsRoot(), board.manifestFile)
   let raw: string
   try {
-    raw = await readFile(MANIFEST_PATH, 'utf8')
+    raw = await readFile(path, 'utf8')
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
       throw new ValidationError(
-        `${MANIFEST_PATH} does not exist. This command edits source files and reruns the ` +
-          'generator, so it needs a checkout of the repository, not the deployed image — run ' +
-          'it where you would run `pnpm add`, commit board.plugins.json and ' +
-          'community.plugins.ts, then rebuild and redeploy.',
+        `${path} does not exist. This command edits source files for every board this ` +
+          'repository carries — apps/community and boards/stock — and reruns the generator, ' +
+          'so it needs a checkout of the repository, not the deployed image — run it where you ' +
+          'would run `pnpm add`, commit both board.plugins.json files and both ' +
+          'community.plugins.ts files, then rebuild and redeploy.',
       )
     }
     throw error
@@ -52,13 +79,25 @@ async function readManifest(): Promise<Manifest> {
 
   const parsed = JSON.parse(raw) as Partial<Manifest>
   if (!Array.isArray(parsed.plugins)) {
-    throw new ValidationError('apps/community/board.plugins.json must have a "plugins" array.')
+    throw new ValidationError(`${path} must have a "plugins" array.`)
   }
+
+  const extraFields = Object.keys(parsed).filter((field) => field !== 'plugins')
+  if (extraFields.length > 0) {
+    throw new ValidationError(
+      `${path} has ${extraFields.length === 1 ? 'a field' : 'fields'} plugin:add/plugin:remove ` +
+        `do not know how to carry forward: ${extraFields.join(', ')}. "plugins" is the ` +
+        "manifest's only field — remove the rest by hand, since rewriting the file here would " +
+        'otherwise drop them silently.',
+    )
+  }
+
   return { plugins: parsed.plugins }
 }
 
-async function writeManifest(manifest: Manifest): Promise<void> {
-  await writeFile(MANIFEST_PATH, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8')
+async function writeManifestFor(board: Board, manifest: Manifest): Promise<void> {
+  const path = join(boardsRoot(), board.manifestFile)
+  await writeFile(path, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8')
 }
 
 interface GeneratorResult {
@@ -68,14 +107,15 @@ interface GeneratorResult {
 
 /**
  * The one thing this file trusts to know whether a manifest edit is valid: the same
- * generator `pnpm board:gen` runs. Shelling out — rather than importing
- * scripts/board-plugins.mjs — keeps a plain script and a workspace TypeScript package
- * from needing to share a module; it also means a failed add or remove is reported in
- * exactly the words a person typing `pnpm board:gen` themselves would see.
+ * generator `pnpm board:gen` runs, for every board it carries. Shelling out — rather
+ * than importing scripts/board-plugins.mjs — keeps a plain script and a workspace
+ * TypeScript package from needing to share a module; it also means a failed add or
+ * remove is reported in exactly the words a person typing `pnpm board:gen` themselves
+ * would see, board by board.
  */
 function runGenerator(): GeneratorResult {
   try {
-    const output = execFileSync(process.execPath, [GENERATOR_SCRIPT], {
+    const output = execFileSync(process.execPath, [generatorScript()], {
       encoding: 'utf8',
       stdio: 'pipe',
     })
@@ -109,7 +149,7 @@ export async function pluginAdd(args: readonly string[]): Promise<number> {
     throw new ValidationError(
       `community plugin:add does not take plugin configuration (--${configFlags[0]}). The ` +
         "manifest has no field for it — a plugin's own settings are the only place its " +
-        'configuration lives now, the way plugins/dues moved its plans there. Export a ' +
+        "configuration lives now, the way MEI-74 moved plugins/dues's plans there. Export a " +
         'zero-argument plugin and add it with just its package name.',
     )
   }
@@ -122,23 +162,35 @@ export async function pluginAdd(args: readonly string[]): Promise<number> {
     )
   }
 
-  const manifest = await readManifest()
-  if (manifest.plugins.some((entry) => entry.key === key)) {
-    throw new ValidationError(`"${key}" is already in board.plugins.json.`)
-  }
+  const originals = await Promise.all(BOARDS.map((board) => readManifestFor(board)))
+
+  originals.forEach(({ plugins }, index) => {
+    if (plugins.some((entry) => entry.key === key)) {
+      throw new ValidationError(`"${key}" is already in ${BOARDS[index]?.manifestFile}.`)
+    }
+  })
 
   const entry: ManifestEntry = { key, package: packageName, enabled: !flags.has('disabled') }
-  await writeManifest({ plugins: [...manifest.plugins, entry] })
+
+  await Promise.all(
+    BOARDS.map((board, index) =>
+      writeManifestFor(board, { plugins: [...(originals[index]?.plugins ?? []), entry] }),
+    ),
+  )
 
   const result = runGenerator()
   if (!result.ok) {
-    await writeManifest(manifest)
+    await Promise.all(
+      BOARDS.map((board, index) => writeManifestFor(board, originals[index] ?? { plugins: [] })),
+    )
     throw new ValidationError(`Could not add "${key}":\n\n${result.output}`)
   }
 
+  const manifestFiles = BOARDS.map((board) => board.manifestFile).join(' and ')
+  const outputFiles = BOARDS.map((board) => board.outputFile).join(' and ')
   console.log(
-    `Added "${key}" (${packageName}${entry.enabled ? '' : ', disabled'}) to board.plugins.json ` +
-      'and regenerated community.plugins.ts.',
+    `Added "${key}" (${packageName}${entry.enabled ? '' : ', disabled'}) to ${manifestFiles} ` +
+      `and regenerated ${outputFiles}.`,
   )
   console.log('Rebuild and redeploy for it to take effect.')
   return 0
@@ -152,25 +204,38 @@ export async function pluginRemove(args: readonly string[]): Promise<number> {
     throw new ValidationError('Usage: community plugin:remove <key>')
   }
 
-  const manifest = await readManifest()
-  if (!manifest.plugins.some((entry) => entry.key === key)) {
-    const present = manifest.plugins.map((entry) => entry.key)
-    throw new ValidationError(
-      present.length === 0
-        ? `"${key}" is not in board.plugins.json — it lists no plugins.`
-        : `"${key}" is not in board.plugins.json. Present: ${present.join(', ')}.`,
-    )
-  }
+  const originals = await Promise.all(BOARDS.map((board) => readManifestFor(board)))
 
-  await writeManifest({ plugins: manifest.plugins.filter((entry) => entry.key !== key) })
+  originals.forEach(({ plugins }, index) => {
+    if (!plugins.some((entry) => entry.key === key)) {
+      const present = plugins.map((entry) => entry.key)
+      throw new ValidationError(
+        present.length === 0
+          ? `"${key}" is not in ${BOARDS[index]?.manifestFile} — it lists no plugins.`
+          : `"${key}" is not in ${BOARDS[index]?.manifestFile}. Present: ${present.join(', ')}.`,
+      )
+    }
+  })
+
+  await Promise.all(
+    BOARDS.map((board, index) =>
+      writeManifestFor(board, {
+        plugins: (originals[index]?.plugins ?? []).filter((entry) => entry.key !== key),
+      }),
+    ),
+  )
 
   const result = runGenerator()
   if (!result.ok) {
-    await writeManifest(manifest)
+    await Promise.all(
+      BOARDS.map((board, index) => writeManifestFor(board, originals[index] ?? { plugins: [] })),
+    )
     throw new ValidationError(`Could not remove "${key}":\n\n${result.output}`)
   }
 
-  console.log(`Removed "${key}" from board.plugins.json and regenerated community.plugins.ts.`)
+  const manifestFiles = BOARDS.map((board) => board.manifestFile).join(' and ')
+  const outputFiles = BOARDS.map((board) => board.outputFile).join(' and ')
+  console.log(`Removed "${key}" from ${manifestFiles} and regenerated ${outputFiles}.`)
   console.log('Rebuild and redeploy for it to take effect.')
   return 0
 }

package/src/redaction.ts

@@ -1,18 +1,22 @@
 export const SECRET_ENV_KEYS: ReadonlySet<string> = new Set([
   'AUTH_SECRET',
   'TICK_SECRET',
+  'CRON_SECRET',
   'METRICS_TOKEN',
   'DATABASE_URL',
   'DIRECT_DATABASE_URL',
   'MAIL_HTTP_TOKEN',
   'MAIL_SMTP_PASSWORD',
+  'RESEND_API_KEY',
   'REDIS_URL',
   'S3_SECRET_ACCESS_KEY',
+  'BLOB_READ_WRITE_TOKEN',
 ])
 
 export const NOT_SECRET_DESPITE_THE_NAME: ReadonlySet<string> = new Set([
   'MAIL_HTTP_ENDPOINT',
   'S3_ENDPOINT',
+  'S3_PUBLIC_BASE_URL',
   'APP_URL',
   'S3_ACCESS_KEY_ID',
   'MAIL_SMTP_USERNAME',

package/src/upgrade.ts

@@ -11,7 +11,7 @@ import { type PluginDefinition, pluginNavigationPlacements } from '@meith/plugin
 import { runPluginLifecycle } from '@meith/runtime'
 import { type PluginUpgrade, planUpgrade, upgradeNotice } from '@meith/upgrade'
 
-export const CODE_VERSION = '0.17.1'
+export const CODE_VERSION = '0.18.0'
 
 export function pluginUpgrades(plugins: readonly PluginDefinition[]): readonly PluginUpgrade[] {
   return plugins.map((plugin) => ({