create-meith 0.19.0 → 0.20.0

package/dist/bin.mjs

@@ -25,7 +25,7 @@ var MATERIALIZED_AT_ROOT = [
 ];
 var VERCEL_BUILD_COMMAND = `community migrate && forum-web build ${AT_ROOT_FLAG}`;
 var TICK_PATH = "/api/system/tick";
-var TICK_SCHEDULE = "* * * * *";
+var TICK_SCHEDULE = "0 3 * * *";
 var MATERIALIZED_PUBLIC = [
   "placeholder-logo.png",
   "placeholder-logo.svg",
@@ -330,7 +330,7 @@ var VERCEL_DERIVED_DRIVERS = [
   "MAIL_DRIVER=http"
 ];
 var VERCEL_PROMPTED_ENV = ["AUTH_SECRET", "CRON_SECRET"];
-var VERCEL_MARKETPLACE_STORES = [
+var VERCEL_MARKETPLACE_PRODUCTS = [
   { type: "integration", integrationSlug: "neon", productSlug: "neon", protocol: "storage" },
   {
     type: "integration",
@@ -338,7 +338,13 @@ var VERCEL_MARKETPLACE_STORES = [
     productSlug: "upstash-kv",
     protocol: "storage"
   },
-  { type: "blob" }
+  { type: "blob" },
+  {
+    type: "integration",
+    integrationSlug: "resend",
+    productSlug: "resend-email",
+    protocol: "messaging"
+  }
 ];
 function deployButtonUrl(templateRepositoryUrl) {
   const params = new URLSearchParams([
@@ -348,10 +354,10 @@ function deployButtonUrl(templateRepositoryUrl) {
     ["env", VERCEL_PROMPTED_ENV.join(",")],
     [
       "envDescription",
-      "Two secrets, generated rather than chosen \u2014 32 characters or more each. Everything else the board reads from the database, cache and blob store this form links."
+      "Two secrets, generated rather than chosen \u2014 32 characters or more each. Everything else the board reads from the database, cache, blob store and mail provider this form links."
     ],
     ["envLink", `${templateRepositoryUrl}/blob/main/.env.example`],
-    ["stores", JSON.stringify(VERCEL_MARKETPLACE_STORES)],
+    ["products", JSON.stringify(VERCEL_MARKETPLACE_PRODUCTS)],
     ["skippable-integrations", "1"]
   ]);
   return `https://vercel.com/new/clone?${params.toString()}`;
@@ -1007,18 +1013,19 @@ A forum, built on [Meith](${repositoryUrl}), running as Vercel functions.
   Vercel's SDK, which authenticates with the deployment's own OIDC identity, so
   there is no token to copy. This is what used to be four hand-typed \`S3_*\`
   secrets.
+- **A Resend mail account**, attached the same way, which publishes
+  \`RESEND_API_KEY\`. The board reads that name directly: its mail driver already
+  speaks Resend's request shape, so there is nothing to adapt.
 - **A Vercel project** carrying \`vercel.json\` \u2014 the build command
   \`${VERCEL_BUILD_COMMAND}\`,
   which applies the schema before it builds, materializes the board's app at
   the project root so the artefact lands where Vercel reads it, and the cron
   entry that drives the tick.
 
-**Mail is the one thing the button does not set up**, and it takes one click
-after the deploy \u2014 see *Mail, in one click* below. That is also where the
-address the board sends from goes: it has to be at a domain your provider has
-verified, which cannot be true of any domain before a provider exists. The
-board boots and runs without mail, and delivers nothing, silently, until it is
-done.
+**Mail needs one thing after the deploy**: the address the board sends from.
+It has to be at a domain Resend has verified, and no form can ask for that
+before the account exists \u2014 see *Mail, after the deploy* below. The board boots
+and runs without it, and delivers nothing, silently, until it is done.
 
 ## What to type into the deploy form
 
@@ -1069,26 +1076,22 @@ Vercel* below for why that matters \u2014 set \`FILESTORE_DRIVER=s3\` and add
 project's environment settings, with \`S3_ENDPOINT\` for a bucket that is not AWS
 (\`S3_REGION=auto\` for R2). The same board runs either way.
 
-## Mail, in one click
+## Mail, after the deploy
 
 A board that cannot send mail cannot reset a password, so do this before you
-invite anybody.
-
-1. Open your project on Vercel, go to **Storage \u2192 Marketplace** (or
-   **Integrations**), and add **Resend**. It creates a Resend account linked to
-   the project and connects your sending domain.
-2. Verify that domain in the Resend dashboard if you have not already. Resend
-   refuses to send from an address at a domain it has not verified.
-3. Add \`MAIL_FROM\` to the project's environment settings \u2014 an address at that
-   verified domain, and the only mail value you ever type. The deploy form does
-   not ask for it, because a sender address is not something you can know
-   before there is a provider to verify it.
-4. Redeploy, or let the next push redeploy.
-
-That is all. The integration publishes its key into the project as
-\`RESEND_API_KEY\`, and the board reads that name: with it set, and \`MAIL_FROM\`
-beside it, mail sends over Resend's HTTPS API with nothing further to
-configure.
+invite anybody. The deploy form already added Resend and published its key; two
+steps remain, and neither could have been answered on the form.
+
+1. Verify your sending domain in the Resend dashboard if you have not already.
+   Resend refuses to send from an address at a domain it has not verified.
+2. Add \`MAIL_FROM\` to the project's environment settings \u2014 an address at that
+   verified domain, and the only mail value you ever type.
+3. Redeploy, or let the next push redeploy.
+
+That is all. The integration published its key into the project as
+\`RESEND_API_KEY\` when you deployed, and the board reads that name: with it set,
+and \`MAIL_FROM\` beside it, mail sends over Resend's HTTPS API with nothing
+further to configure.
 
 The board is not tied to Resend. Its mail driver is a plain JSON-over-HTTPS
 sender that posts \`{from, to, subject, text, html, reply_to}\` with a bearer
@@ -1122,15 +1125,23 @@ drains; nothing here runs it on its own, because there is no worker process on
 a function platform. Two things about it are worth knowing **before** you
 deploy rather than after:
 
-- **A per-minute schedule needs a paid plan.** Hobby allows a couple of cron
-  jobs and runs each of them roughly once a day, at an hour Vercel chooses;
-  only paid plans accept an arbitrary cron expression. A board ticking daily
-  still loses nothing \u2014 tasks are written so a missed run delays work rather
-  than dropping it \u2014 but "as it happens" notifications become a daily digest in
-  all but name. To keep a minute-by-minute tick on Hobby, drive
-  \`${TICK_PATH}\` from something else that can call a URL on a schedule \u2014 a
-  GitHub Actions workflow, a systemd timer, an uptime pinger \u2014 presenting
-  \`TICK_SECRET\` instead.
+- **This ships a daily schedule, because Hobby refuses anything faster.** A
+  Hobby plan rejects a cron expression that would run more than once a day \u2014
+  the deployment fails outright rather than being slowed down \u2014 so
+  \`vercel.json\` carries \`${TICK_SCHEDULE}\` and deploys anywhere. On a
+  paid plan, edit it to \`* * * * *\` and the board ticks every minute.
+
+  A daily tick loses nothing permanently: tasks are written so a missed run
+  delays work rather than dropping it, and a password reset is sent as the
+  request is handled rather than waiting for a tick. What it does delay is
+  everything the tick drives \u2014 a new post is not findable in search, and a
+  notification is not sent, until the next run.
+
+  **To keep a fast tick without paying**, drive \`${TICK_PATH}\` from anything
+  that can call a URL on a schedule \u2014 a GitHub Actions workflow, a systemd
+  timer, an uptime pinger \u2014 presenting \`TICK_SECRET\` instead of
+  \`CRON_SECRET\`. The endpoint accepts either, so the Vercel cron and an
+  outside scheduler can both drive it.
 - **\`maxDuration = 300\` is validated when the project builds, not when the
   function runs.** A plan that does not allow 300 seconds therefore **fails the
   deployment** rather than clamping the request. With Fluid Compute \u2014 the
@@ -1329,7 +1340,7 @@ async function run(argv, version) {
 }
 
 // src/bin.ts
-var result = await run(process.argv.slice(2), "0.19.0");
+var result = await run(process.argv.slice(2), "0.20.0");
 for (const line of result.lines) {
   if (result.code === 0) console.log(line);
   else console.error(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-meith",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Scaffold a Meith board — npx create-meith <name> writes a workspace that depends on @meith/web and @meith/cli.",
   "license": "MIT",
   "repository": {

package/src/bin.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { run } from './cli'
 
-const result = await run(process.argv.slice(2), '0.19.0')
+const result = await run(process.argv.slice(2), '0.20.0')
 for (const line of result.lines) {
   if (result.code === 0) console.log(line)
   else console.error(line)

package/src/index.ts

@@ -10,7 +10,7 @@ export {
   TICK_PATH,
   TICK_SCHEDULE,
   VERCEL_BUILD_COMMAND,
-  VERCEL_MARKETPLACE_STORES,
+  VERCEL_MARKETPLACE_PRODUCTS,
   VERCEL_PROMPTED_ENV,
   validateName,
 } from './scaffold'

package/src/scaffold.ts

@@ -33,7 +33,7 @@ export const VERCEL_BUILD_COMMAND = `community migrate && forum-web build ${AT_R
 
 export const TICK_PATH = '/api/system/tick'
 
-export const TICK_SCHEDULE = '* * * * *'
+export const TICK_SCHEDULE = '0 3 * * *'
 
 export const MATERIALIZED_PUBLIC = [
   'placeholder-logo.png',
@@ -359,7 +359,7 @@ const VERCEL_DERIVED_DRIVERS = [
 
 export const VERCEL_PROMPTED_ENV = ['AUTH_SECRET', 'CRON_SECRET'] as const
 
-export const VERCEL_MARKETPLACE_STORES = [
+export const VERCEL_MARKETPLACE_PRODUCTS = [
   { type: 'integration', integrationSlug: 'neon', productSlug: 'neon', protocol: 'storage' },
   {
     type: 'integration',
@@ -368,6 +368,12 @@ export const VERCEL_MARKETPLACE_STORES = [
     protocol: 'storage',
   },
   { type: 'blob' },
+  {
+    type: 'integration',
+    integrationSlug: 'resend',
+    productSlug: 'resend-email',
+    protocol: 'messaging',
+  },
 ] as const
 
 export function deployButtonUrl(templateRepositoryUrl: string): string {
@@ -378,10 +384,10 @@ export function deployButtonUrl(templateRepositoryUrl: string): string {
     ['env', VERCEL_PROMPTED_ENV.join(',')],
     [
       'envDescription',
-      'Two secrets, generated rather than chosen — 32 characters or more each. Everything else the board reads from the database, cache and blob store this form links.',
+      'Two secrets, generated rather than chosen — 32 characters or more each. Everything else the board reads from the database, cache, blob store and mail provider this form links.',
     ],
     ['envLink', `${templateRepositoryUrl}/blob/main/.env.example`],
-    ['stores', JSON.stringify(VERCEL_MARKETPLACE_STORES)],
+    ['products', JSON.stringify(VERCEL_MARKETPLACE_PRODUCTS)],
     ['skippable-integrations', '1'],
   ])
 
@@ -1068,18 +1074,19 @@ A forum, built on [Meith](${repositoryUrl}), running as Vercel functions.
   Vercel's SDK, which authenticates with the deployment's own OIDC identity, so
   there is no token to copy. This is what used to be four hand-typed \`S3_*\`
   secrets.
+- **A Resend mail account**, attached the same way, which publishes
+  \`RESEND_API_KEY\`. The board reads that name directly: its mail driver already
+  speaks Resend's request shape, so there is nothing to adapt.
 - **A Vercel project** carrying \`vercel.json\` — the build command
   \`${VERCEL_BUILD_COMMAND}\`,
   which applies the schema before it builds, materializes the board's app at
   the project root so the artefact lands where Vercel reads it, and the cron
   entry that drives the tick.
 
-**Mail is the one thing the button does not set up**, and it takes one click
-after the deploy — see *Mail, in one click* below. That is also where the
-address the board sends from goes: it has to be at a domain your provider has
-verified, which cannot be true of any domain before a provider exists. The
-board boots and runs without mail, and delivers nothing, silently, until it is
-done.
+**Mail needs one thing after the deploy**: the address the board sends from.
+It has to be at a domain Resend has verified, and no form can ask for that
+before the account exists — see *Mail, after the deploy* below. The board boots
+and runs without it, and delivers nothing, silently, until it is done.
 
 ## What to type into the deploy form
 
@@ -1130,26 +1137,22 @@ Vercel* below for why that matters — set \`FILESTORE_DRIVER=s3\` and add
 project's environment settings, with \`S3_ENDPOINT\` for a bucket that is not AWS
 (\`S3_REGION=auto\` for R2). The same board runs either way.
 
-## Mail, in one click
+## Mail, after the deploy
 
 A board that cannot send mail cannot reset a password, so do this before you
-invite anybody.
-
-1. Open your project on Vercel, go to **Storage → Marketplace** (or
-   **Integrations**), and add **Resend**. It creates a Resend account linked to
-   the project and connects your sending domain.
-2. Verify that domain in the Resend dashboard if you have not already. Resend
-   refuses to send from an address at a domain it has not verified.
-3. Add \`MAIL_FROM\` to the project's environment settings — an address at that
-   verified domain, and the only mail value you ever type. The deploy form does
-   not ask for it, because a sender address is not something you can know
-   before there is a provider to verify it.
-4. Redeploy, or let the next push redeploy.
-
-That is all. The integration publishes its key into the project as
-\`RESEND_API_KEY\`, and the board reads that name: with it set, and \`MAIL_FROM\`
-beside it, mail sends over Resend's HTTPS API with nothing further to
-configure.
+invite anybody. The deploy form already added Resend and published its key; two
+steps remain, and neither could have been answered on the form.
+
+1. Verify your sending domain in the Resend dashboard if you have not already.
+   Resend refuses to send from an address at a domain it has not verified.
+2. Add \`MAIL_FROM\` to the project's environment settings — an address at that
+   verified domain, and the only mail value you ever type.
+3. Redeploy, or let the next push redeploy.
+
+That is all. The integration published its key into the project as
+\`RESEND_API_KEY\` when you deployed, and the board reads that name: with it set,
+and \`MAIL_FROM\` beside it, mail sends over Resend's HTTPS API with nothing
+further to configure.
 
 The board is not tied to Resend. Its mail driver is a plain JSON-over-HTTPS
 sender that posts \`{from, to, subject, text, html, reply_to}\` with a bearer
@@ -1183,15 +1186,23 @@ drains; nothing here runs it on its own, because there is no worker process on
 a function platform. Two things about it are worth knowing **before** you
 deploy rather than after:
 
-- **A per-minute schedule needs a paid plan.** Hobby allows a couple of cron
-  jobs and runs each of them roughly once a day, at an hour Vercel chooses;
-  only paid plans accept an arbitrary cron expression. A board ticking daily
-  still loses nothing — tasks are written so a missed run delays work rather
-  than dropping it — but "as it happens" notifications become a daily digest in
-  all but name. To keep a minute-by-minute tick on Hobby, drive
-  \`${TICK_PATH}\` from something else that can call a URL on a schedule — a
-  GitHub Actions workflow, a systemd timer, an uptime pinger — presenting
-  \`TICK_SECRET\` instead.
+- **This ships a daily schedule, because Hobby refuses anything faster.** A
+  Hobby plan rejects a cron expression that would run more than once a day —
+  the deployment fails outright rather than being slowed down — so
+  \`vercel.json\` carries \`${TICK_SCHEDULE}\` and deploys anywhere. On a
+  paid plan, edit it to \`* * * * *\` and the board ticks every minute.
+
+  A daily tick loses nothing permanently: tasks are written so a missed run
+  delays work rather than dropping it, and a password reset is sent as the
+  request is handled rather than waiting for a tick. What it does delay is
+  everything the tick drives — a new post is not findable in search, and a
+  notification is not sent, until the next run.
+
+  **To keep a fast tick without paying**, drive \`${TICK_PATH}\` from anything
+  that can call a URL on a schedule — a GitHub Actions workflow, a systemd
+  timer, an uptime pinger — presenting \`TICK_SECRET\` instead of
+  \`CRON_SECRET\`. The endpoint accepts either, so the Vercel cron and an
+  outside scheduler can both drive it.
 - **\`maxDuration = 300\` is validated when the project builds, not when the
   function runs.** A plan that does not allow 300 seconds therefore **fails the
   deployment** rather than clamping the request. With Fluid Compute — the