@meith/cli 0.17.2 → 0.18.0

package/LICENSE.md

@@ -1,165 +1,21 @@
-                   GNU LESSER GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-
-  This version of the GNU Lesser General Public License incorporates
-the terms and conditions of version 3 of the GNU General Public
-License, supplemented by the additional permissions listed below.
-
-  0. Additional Definitions.
-
-  As used herein, "this License" refers to version 3 of the GNU Lesser
-General Public License, and the "GNU GPL" refers to version 3 of the GNU
-General Public License.
-
-  "The Library" refers to a covered work governed by this License,
-other than an Application or a Combined Work as defined below.
-
-  An "Application" is any work that makes use of an interface provided
-by the Library, but which is not otherwise based on the Library.
-Defining a subclass of a class defined by the Library is deemed a mode
-of using an interface provided by the Library.
-
-  A "Combined Work" is a work produced by combining or linking an
-Application with the Library.  The particular version of the Library
-with which the Combined Work was made is also called the "Linked
-Version".
-
-  The "Minimal Corresponding Source" for a Combined Work means the
-Corresponding Source for the Combined Work, excluding any source code
-for portions of the Combined Work that, considered in isolation, are
-based on the Application, and not on the Linked Version.
-
-  The "Corresponding Application Code" for a Combined Work means the
-object code and/or source code for the Application, including any data
-and utility programs needed for reproducing the Combined Work from the
-Application, but excluding the System Libraries of the Combined Work.
-
-  1. Exception to Section 3 of the GNU GPL.
-
-  You may convey a covered work under sections 3 and 4 of this License
-without being bound by section 3 of the GNU GPL.
-
-  2. Conveying Modified Versions.
-
-  If you modify a copy of the Library, and, in your modifications, a
-facility refers to a function or data to be supplied by an Application
-that uses the facility (other than as an argument passed when the
-facility is invoked), then you may convey a copy of the modified
-version:
-
-   a) under this License, provided that you make a good faith effort to
-   ensure that, in the event an Application does not supply the
-   function or data, the facility still operates, and performs
-   whatever part of its purpose remains meaningful, or
-
-   b) under the GNU GPL, with none of the additional permissions of
-   this License applicable to that copy.
-
-  3. Object Code Incorporating Material from Library Header Files.
-
-  The object code form of an Application may incorporate material from
-a header file that is part of the Library.  You may convey such object
-code under terms of your choice, provided that, if the incorporated
-material is not limited to numerical parameters, data structure
-layouts and accessors, or small macros, inline functions and templates
-(ten or fewer lines in length), you do both of the following:
-
-   a) Give prominent notice with each copy of the object code that the
-   Library is used in it and that the Library and its use are
-   covered by this License.
-
-   b) Accompany the object code with a copy of the GNU GPL and this license
-   document.
-
-  4. Combined Works.
-
-  You may convey a Combined Work under terms of your choice that,
-taken together, effectively do not restrict modification of the
-portions of the Library contained in the Combined Work and reverse
-engineering for debugging such modifications, if you also do each of
-the following:
-
-   a) Give prominent notice with each copy of the Combined Work that
-   the Library is used in it and that the Library and its use are
-   covered by this License.
-
-   b) Accompany the Combined Work with a copy of the GNU GPL and this license
-   document.
-
-   c) For a Combined Work that displays copyright notices during
-   execution, include the copyright notice for the Library among
-   these notices, as well as a reference directing the user to the
-   copies of the GNU GPL and this license document.
-
-   d) Do one of the following:
-
-       0) Convey the Minimal Corresponding Source under the terms of this
-       License, and the Corresponding Application Code in a form
-       suitable for, and under terms that permit, the user to
-       recombine or relink the Application with a modified version of
-       the Linked Version to produce a modified Combined Work, in the
-       manner specified by section 6 of the GNU GPL for conveying
-       Corresponding Source.
-
-       1) Use a suitable shared library mechanism for linking with the
-       Library.  A suitable mechanism is one that (a) uses at run time
-       a copy of the Library already present on the user's computer
-       system, and (b) will operate properly with a modified version
-       of the Library that is interface-compatible with the Linked
-       Version.
-
-   e) Provide Installation Information, but only if you would otherwise
-   be required to provide such information under section 6 of the
-   GNU GPL, and only to the extent that such information is
-   necessary to install and execute a modified version of the
-   Combined Work produced by recombining or relinking the
-   Application with a modified version of the Linked Version. (If
-   you use option 4d0, the Installation Information must accompany
-   the Minimal Corresponding Source and Corresponding Application
-   Code. If you use option 4d1, you must provide the Installation
-   Information in the manner specified by section 6 of the GNU GPL
-   for conveying Corresponding Source.)
-
-  5. Combined Libraries.
-
-  You may place library facilities that are a work based on the
-Library side by side in a single library together with other library
-facilities that are not Applications and are not covered by this
-License, and convey such a combined library under terms of your
-choice, if you do both of the following:
-
-   a) Accompany the combined library with a copy of the same work based
-   on the Library, uncombined with any other library facilities,
-   conveyed under the terms of this License.
-
-   b) Give prominent notice with the combined library that part of it
-   is a work based on the Library, and explaining where to find the
-   accompanying uncombined form of the same work.
-
-  6. Revised Versions of the GNU Lesser General Public License.
-
-  The Free Software Foundation may publish revised and/or new versions
-of the GNU Lesser General Public License from time to time. Such new
-versions will be similar in spirit to the present version, but may
-differ in detail to address new problems or concerns.
-
-  Each version is given a distinguishing version number. If the
-Library as you received it specifies that a certain numbered version
-of the GNU Lesser General Public License "or any later version"
-applies to it, you have the option of following the terms and
-conditions either of that published version or of any later version
-published by the Free Software Foundation. If the Library as you
-received it does not specify a version number of the GNU Lesser
-General Public License, you may choose any version of the GNU Lesser
-General Public License ever published by the Free Software Foundation.
-
-  If the Library as you received it specifies that a proxy can decide
-whether future versions of the GNU Lesser General Public License shall
-apply, that proxy's public statement of acceptance of any version is
-permanent authorization for you to choose that version for the
-Library.
+MIT License
+
+Copyright (c) 2026 Jordan Harrison and the Meith contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@meith/cli",
-  "version": "0.17.2",
+  "version": "0.18.0",
   "description": "The operator CLI: migrations, backup and restore, imports, users and settings — and the community bin that runs it against an external board workspace.",
-  "license": "LGPL-3.0-or-later",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/meith-dev/meith.git",
@@ -23,18 +23,18 @@
   },
   "dependencies": {
     "tsx": "^4.23.12",
-    "@meith/accounts": "0.17.2",
-    "@meith/db": "0.17.2",
-    "@meith/drivers": "0.17.2",
-    "@meith/demo": "0.17.2",
-    "@meith/forums": "0.17.2",
-    "@meith/core": "0.17.2",
-    "@meith/plugin-kit": "0.17.2",
-    "@meith/profile-fields": "0.17.2",
-    "@meith/tasks": "0.17.2",
-    "@meith/runtime": "0.17.2",
-    "@meith/settings": "0.17.2",
-    "create-meith": "0.17.2"
+    "@meith/accounts": "0.18.0",
+    "@meith/core": "0.18.0",
+    "@meith/db": "0.18.0",
+    "@meith/demo": "0.18.0",
+    "@meith/forums": "0.18.0",
+    "@meith/drivers": "0.18.0",
+    "@meith/plugin-kit": "0.18.0",
+    "@meith/profile-fields": "0.18.0",
+    "@meith/settings": "0.18.0",
+    "@meith/tasks": "0.18.0",
+    "@meith/runtime": "0.18.0",
+    "create-meith": "0.18.0"
   },
   "devDependencies": {
     "esbuild": "^0.28.2"

package/src/backup.ts

@@ -14,9 +14,9 @@ import {
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 
-import { ConfigurationError, env, ValidationError } from '@meith/core'
+import { ConfigurationError, env, type FileStore, ValidationError } from '@meith/core'
 import { migrationUrl, runMigrations } from '@meith/db'
-import { S3FileStore } from '@meith/drivers'
+import { BlobFileStore, S3FileStore } from '@meith/drivers'
 
 import { optional, parseFlags } from './args'
 import { requirePostgres } from './context'
@@ -24,17 +24,19 @@ import { CODE_VERSION } from './upgrade'
 
 export type UploadsMode = 'include' | 'skip'
 
+export type FilestoreDriver = 'local' | 's3' | 'blob'
+
 export interface BackupManifest {
   readonly format: 1
   readonly createdAt: string
   readonly version: string
-  readonly filestore: 'local' | 's3'
+  readonly filestore: FilestoreDriver
   readonly uploads: 'included' | 'skipped'
   readonly bucket?: string
 }
 
-export function resolveUploadsMode(driver: 'local' | 's3', flag: string | undefined): UploadsMode {
-  if (flag === undefined) return driver === 'local' ? 'include' : 'skip'
+export function resolveUploadsMode(driver: FilestoreDriver, flag: string | undefined): UploadsMode {
+  if (flag === undefined) return driver === 's3' ? 'skip' : 'include'
   if (flag === 'include' || flag === 'skip') return flag
   throw new ValidationError(`--uploads must be "include" or "skip", got "${flag}".`)
 }
@@ -67,7 +69,11 @@ export function parseManifest(raw: string): BackupManifest {
   if (typeof manifest.createdAt !== 'string' || typeof manifest.version !== 'string') {
     throw new ValidationError('The bundle manifest is missing createdAt or version.')
   }
-  if (manifest.filestore !== 'local' && manifest.filestore !== 's3') {
+  if (
+    manifest.filestore !== 'local' &&
+    manifest.filestore !== 's3' &&
+    manifest.filestore !== 'blob'
+  ) {
     throw new ValidationError('The bundle manifest does not name a known file driver.')
   }
 
@@ -378,12 +384,14 @@ async function stageLocalUploads(stage: string): Promise<'included' | 'skipped'>
   return 'included'
 }
 
-async function stageS3Uploads(stage: string): Promise<'included' | 'skipped'> {
-  const store = S3FileStore.fromEnv(env)
-  const dir = path.join(stage, 'uploads')
-  await mkdir(dir, { recursive: true })
+export interface ListableStore {
+  listKeys(): AsyncGenerator<string>
+  get(key: string): Promise<Uint8Array | undefined>
+}
 
+export async function drainStoreToDirectory(store: ListableStore, dir: string): Promise<number> {
   let pulled = 0
+
   for await (const key of store.listKeys()) {
     const target = path.resolve(dir, key)
     if (target !== dir && !target.startsWith(dir + path.sep)) {
@@ -397,18 +405,66 @@ async function stageS3Uploads(stage: string): Promise<'included' | 'skipped'> {
     pulled++
   }
 
+  return pulled
+}
+
+export async function uploadDirectoryToStore(
+  store: { put: FileStore['put'] },
+  dir: string,
+): Promise<number> {
+  let pushed = 0
+
+  for (const file of await walk(dir)) {
+    const key = path.relative(dir, file).split(path.sep).join('/')
+    await store.put(key, await readFile(file), {
+      contentType: contentTypeFor(key),
+      visibility: 'public',
+    })
+    pushed++
+  }
+
+  return pushed
+}
+
+async function stageObjectStoreUploads(
+  stage: string,
+  store: ListableStore,
+  origin: string,
+): Promise<'included' | 'skipped'> {
+  const dir = path.join(stage, 'uploads')
+  await mkdir(dir, { recursive: true })
+
+  const pulled = await drainStoreToDirectory(store, dir)
+
   if (pulled === 0) {
-    console.log(`The ${env.S3_BUCKET} bucket is empty; the bundle carries no uploads.`)
+    console.log(`Found no objects in ${origin}; the bundle carries no uploads.`)
     await rm(dir, { recursive: true, force: true })
     return 'skipped'
   }
 
   await run('tar', ['czf', path.join(stage, 'uploads.tar.gz'), '-C', dir, '.'])
   await rm(dir, { recursive: true, force: true })
-  console.log(`Pulled ${pulled} object(s) from ${env.S3_BUCKET}.`)
+  console.log(`Pulled ${pulled} object(s) from ${origin}.`)
   return 'included'
 }
 
+async function stageUploads(stage: string, mode: UploadsMode): Promise<'included' | 'skipped'> {
+  if (mode === 'skip') return 'skipped'
+
+  switch (env.FILESTORE_DRIVER) {
+    case 's3':
+      return await stageObjectStoreUploads(
+        stage,
+        S3FileStore.fromEnv(env),
+        `the ${env.S3_BUCKET} bucket`,
+      )
+    case 'blob':
+      return await stageObjectStoreUploads(stage, BlobFileStore.fromEnv(env), 'the Blob store')
+    case 'local':
+      return await stageLocalUploads(stage)
+  }
+}
+
 export async function backupCommand(args: readonly string[]): Promise<number> {
   const { flags } = parseFlags(args)
   requirePostgres()
@@ -434,12 +490,7 @@ export async function backupCommand(args: readonly string[]): Promise<number> {
       databaseEnvironment,
     )
 
-    const uploads =
-      mode === 'skip'
-        ? 'skipped'
-        : env.FILESTORE_DRIVER === 's3'
-          ? await stageS3Uploads(stage)
-          : await stageLocalUploads(stage)
+    const uploads = await stageUploads(stage, mode)
 
     const manifest: BackupManifest = {
       format: 1,
@@ -526,23 +577,19 @@ async function extractUploads(stage: string, dir: string, limits: RestoreLimits)
   console.log(`Restored the uploads into ${dir}.`)
 }
 
-async function pushUploadsToS3(stage: string, limits: RestoreLimits): Promise<void> {
+async function pushUploadsToStore(
+  stage: string,
+  limits: RestoreLimits,
+  store: { put: FileStore['put'] },
+  destination: string,
+): Promise<void> {
   await validateUploadsArchive(stage, limits)
   const dir = path.join(stage, 'uploads-extract')
   await mkdir(dir, { recursive: true })
   await run('tar', ['xzf', path.join(stage, 'uploads.tar.gz'), '-C', dir])
 
-  const store = S3FileStore.fromEnv(env)
-  let pushed = 0
-  for (const file of await walk(dir)) {
-    const key = path.relative(dir, file).split(path.sep).join('/')
-    await store.put(key, await readFile(file), {
-      contentType: contentTypeFor(key),
-      visibility: 'public',
-    })
-    pushed++
-  }
-  console.log(`Uploaded ${pushed} object(s) to ${env.S3_BUCKET}.`)
+  const pushed = await uploadDirectoryToStore(store, dir)
+  console.log(`Uploaded ${pushed} object(s) to ${destination}.`)
 }
 
 const RESTORE_USAGE =
@@ -652,7 +699,9 @@ export async function restoreCommand(args: readonly string[]): Promise<number> {
     if (manifest.uploads === 'included' && flags.get('skip-uploads') !== 'true') {
       const uploadsDir = optional(flags, 'uploads-dir')
       if (env.FILESTORE_DRIVER === 's3' && uploadsDir === undefined) {
-        await pushUploadsToS3(stage, limits)
+        await pushUploadsToStore(stage, limits, S3FileStore.fromEnv(env), `${env.S3_BUCKET}`)
+      } else if (env.FILESTORE_DRIVER === 'blob' && uploadsDir === undefined) {
+        await pushUploadsToStore(stage, limits, BlobFileStore.fromEnv(env), 'the Blob store')
       } else {
         await extractUploads(stage, uploadsDir ?? env.UPLOADS_DIR, limits)
       }
@@ -662,7 +711,11 @@ export async function restoreCommand(args: readonly string[]): Promise<number> {
           ? `This bundle carries no uploads — they live in the S3 bucket${
               manifest.bucket === undefined ? '' : ` (${manifest.bucket})`
             }.`
-          : 'This bundle carries no uploads.',
+          : manifest.filestore === 'blob'
+            ? 'This bundle carries no uploads, and a Vercel Blob store is not ' +
+              'something you can copy out by hand. Take another backup with ' +
+              '--uploads include while the old board still exists.'
+            : 'This bundle carries no uploads.',
       )
     }
 

package/src/index.ts

@@ -84,6 +84,19 @@ const commands: Command[] = [
   {
     name: 'migrate',
     summary: 'Apply pending database migrations.',
+    usage: [
+      'community migrate',
+      '',
+      'Applies every migration this release has that the board has not, then exits.',
+      'Safe to run concurrently: the runner holds a Postgres advisory lock for the',
+      'whole run, so a second deploy waits for the first and then finds nothing to do.',
+      '',
+      'Migrates over DIRECT_DATABASE_URL when it is set, and over DATABASE_URL when it',
+      'is not. On a managed database point DIRECT_DATABASE_URL at the direct',
+      '(non-pooler) connection string: a transaction-mode pooler hands the connection',
+      'back as soon as the lock statement ends, so the lock is left on a backend that',
+      'goes to somebody else and the run is no longer serialised against other runs.',
+    ].join('\n'),
     async run() {
       const { assertEnv } = await import('@meith/core')
       const env = assertEnv()
@@ -93,6 +106,12 @@ const commands: Command[] = [
         return 1
       }
 
+      console.log(
+        env.DIRECT_DATABASE_URL === undefined
+          ? 'Migrating over DATABASE_URL…'
+          : 'Migrating over DIRECT_DATABASE_URL…',
+      )
+
       const { runMigrations } = await import('@meith/db')
       const applied = await runMigrations()
       console.log(applied === 0 ? 'Already up to date.' : `Applied ${applied} migration(s).`)

package/src/redaction.ts

@@ -1,18 +1,22 @@
 export const SECRET_ENV_KEYS: ReadonlySet<string> = new Set([
   'AUTH_SECRET',
   'TICK_SECRET',
+  'CRON_SECRET',
   'METRICS_TOKEN',
   'DATABASE_URL',
   'DIRECT_DATABASE_URL',
   'MAIL_HTTP_TOKEN',
   'MAIL_SMTP_PASSWORD',
+  'RESEND_API_KEY',
   'REDIS_URL',
   'S3_SECRET_ACCESS_KEY',
+  'BLOB_READ_WRITE_TOKEN',
 ])
 
 export const NOT_SECRET_DESPITE_THE_NAME: ReadonlySet<string> = new Set([
   'MAIL_HTTP_ENDPOINT',
   'S3_ENDPOINT',
+  'S3_PUBLIC_BASE_URL',
   'APP_URL',
   'S3_ACCESS_KEY_ID',
   'MAIL_SMTP_USERNAME',

package/src/upgrade.ts

@@ -11,7 +11,7 @@ import { type PluginDefinition, pluginNavigationPlacements } from '@meith/plugin
 import { runPluginLifecycle } from '@meith/runtime'
 import { type PluginUpgrade, planUpgrade, upgradeNotice } from '@meith/upgrade'
 
-export const CODE_VERSION = '0.17.2'
+export const CODE_VERSION = '0.18.0'
 
 export function pluginUpgrades(plugins: readonly PluginDefinition[]): readonly PluginUpgrade[] {
   return plugins.map((plugin) => ({