create-meith 0.19.0 → 0.21.0

package/dist/bin.mjs

@@ -25,7 +25,8 @@ var MATERIALIZED_AT_ROOT = [
 ];
 var VERCEL_BUILD_COMMAND = `community migrate && forum-web build ${AT_ROOT_FLAG}`;
 var TICK_PATH = "/api/system/tick";
-var TICK_SCHEDULE = "* * * * *";
+var TICK_SCHEDULE = "0 3 * * *";
+var RESEND_SENDER_MAILBOX = "noreply";
 var MATERIALIZED_PUBLIC = [
   "placeholder-logo.png",
   "placeholder-logo.svg",
@@ -278,15 +279,17 @@ BLOB_READ_WRITE_TOKEN=
 # board refuses it on Vercel; 587 with STARTTLS may work, but an API does not
 # depend on the platform's egress rules staying as they are.
 #
-# MAIL_FROM is yours to decide, and it belongs to the step that adds Resend
-# rather than to the deploy: it must be an address at a domain the provider has
-# verified for you, no default is right, and until a provider is added the board
-# cannot send from any address at all. Set it alongside the integration.
+# MAIL_FROM is optional where a provider publishes the domain it sends from:
+# with RESEND_API_KEY and RESEND_EMAIL_DOMAIN both set, the board sends from
+# noreply@ that domain and this can stay empty. Set it to send from another
+# address \u2014 it must be at a domain the provider has verified for you, and an
+# address set here always wins over the derived one.
 MAIL_FROM=
 
 # Add the Resend integration to the project from Vercel's marketplace and it
-# publishes its key under this name, which the board reads: with RESEND_API_KEY
-# set, and MAIL_FROM beside it, the board sends over Resend's HTTPS API and
+# publishes its key and its sending domain under these names, which the board
+# reads: with RESEND_API_KEY set, and either RESEND_EMAIL_DOMAIN or a MAIL_FROM
+# beside it, the board sends over Resend's HTTPS API and
 # needs neither of the two variables below. The mail driver itself is a plain
 # JSON-over-HTTPS sender and is not Resend-specific \u2014 this is one injected name
 # bridged to the generic pair, not a provider baked into the board.
@@ -330,7 +333,7 @@ var VERCEL_DERIVED_DRIVERS = [
   "MAIL_DRIVER=http"
 ];
 var VERCEL_PROMPTED_ENV = ["AUTH_SECRET", "CRON_SECRET"];
-var VERCEL_MARKETPLACE_STORES = [
+var VERCEL_MARKETPLACE_PRODUCTS = [
   { type: "integration", integrationSlug: "neon", productSlug: "neon", protocol: "storage" },
   {
     type: "integration",
@@ -338,7 +341,13 @@ var VERCEL_MARKETPLACE_STORES = [
     productSlug: "upstash-kv",
     protocol: "storage"
   },
-  { type: "blob" }
+  { type: "blob" },
+  {
+    type: "integration",
+    integrationSlug: "resend",
+    productSlug: "resend-email",
+    protocol: "messaging"
+  }
 ];
 function deployButtonUrl(templateRepositoryUrl) {
   const params = new URLSearchParams([
@@ -348,10 +357,10 @@ function deployButtonUrl(templateRepositoryUrl) {
     ["env", VERCEL_PROMPTED_ENV.join(",")],
     [
       "envDescription",
-      "Two secrets, generated rather than chosen \u2014 32 characters or more each. Everything else the board reads from the database, cache and blob store this form links."
+      "Two secrets, generated rather than chosen \u2014 32 characters or more each. Everything else the board reads from the database, cache, blob store and mail provider this form links."
     ],
     ["envLink", `${templateRepositoryUrl}/blob/main/.env.example`],
-    ["stores", JSON.stringify(VERCEL_MARKETPLACE_STORES)],
+    ["products", JSON.stringify(VERCEL_MARKETPLACE_PRODUCTS)],
     ["skippable-integrations", "1"]
   ]);
   return `https://vercel.com/new/clone?${params.toString()}`;
@@ -429,6 +438,7 @@ import { defineForumConfig } from '@meith/web/config'
 import {
   BROWSER_THEME_COLOR,
   DARK_TOKENS,
+  defaultMessages,
   defaultTheme,
   LIGHT_TOKENS,
 } from '@meith/theme-default'
@@ -443,6 +453,7 @@ export default defineForumConfig({
       tokens: { light: LIGHT_TOKENS, dark: DARK_TOKENS },
       browserThemeColor: BROWSER_THEME_COLOR,
       theme: defaultTheme,
+      messages: defaultMessages,
     },
   },
   defaultTheme: 'default',
@@ -1007,18 +1018,20 @@ A forum, built on [Meith](${repositoryUrl}), running as Vercel functions.
   Vercel's SDK, which authenticates with the deployment's own OIDC identity, so
   there is no token to copy. This is what used to be four hand-typed \`S3_*\`
   secrets.
+- **A Resend mail account**, attached the same way, which publishes
+  \`RESEND_API_KEY\` and \`RESEND_EMAIL_DOMAIN\`. The board reads both names
+  directly: its mail driver already speaks Resend's request shape, so there is
+  nothing to adapt, and the sending domain is what the sender is built from.
 - **A Vercel project** carrying \`vercel.json\` \u2014 the build command
   \`${VERCEL_BUILD_COMMAND}\`,
   which applies the schema before it builds, materializes the board's app at
   the project root so the artefact lands where Vercel reads it, and the cron
   entry that drives the tick.
 
-**Mail is the one thing the button does not set up**, and it takes one click
-after the deploy \u2014 see *Mail, in one click* below. That is also where the
-address the board sends from goes: it has to be at a domain your provider has
-verified, which cannot be true of any domain before a provider exists. The
-board boots and runs without mail, and delivers nothing, silently, until it is
-done.
+**Mail needs no variables after the deploy.** Resend publishes both its key
+and its sending domain, and the board sends from \`${RESEND_SENDER_MAILBOX}@\`
+that domain \u2014 see *Mail* below to send from a different address, and for the
+one case that does need you: a domain Resend has not verified yet.
 
 ## What to type into the deploy form
 
@@ -1069,26 +1082,30 @@ Vercel* below for why that matters \u2014 set \`FILESTORE_DRIVER=s3\` and add
 project's environment settings, with \`S3_ENDPOINT\` for a bucket that is not AWS
 (\`S3_REGION=auto\` for R2). The same board runs either way.
 
-## Mail, in one click
+## Mail
+
+**There is nothing to set.** The Resend the deploy form added publishes two
+names into the project: \`RESEND_API_KEY\`, and \`RESEND_EMAIL_DOMAIN\` \u2014 the
+domain it sends from. The board reads both, sends from
+\`${RESEND_SENDER_MAILBOX}@\` that domain, and posts over Resend's HTTPS API.
 
-A board that cannot send mail cannot reset a password, so do this before you
-invite anybody.
+**If Resend refuses the messages**, that domain is not verified yet. Resend
+will not send from a domain it has not verified, whoever set the address, so
+verify it from the Resend dashboard \u2014 the deploy cannot do that step for you,
+because it is Resend confirming you own the domain. This is the one thing here
+that can need attention, and it announces itself: the test button below says
+so rather than the board failing quietly.
 
-1. Open your project on Vercel, go to **Storage \u2192 Marketplace** (or
-   **Integrations**), and add **Resend**. It creates a Resend account linked to
-   the project and connects your sending domain.
-2. Verify that domain in the Resend dashboard if you have not already. Resend
-   refuses to send from an address at a domain it has not verified.
-3. Add \`MAIL_FROM\` to the project's environment settings \u2014 an address at that
-   verified domain, and the only mail value you ever type. The deploy form does
-   not ask for it, because a sender address is not something you can know
-   before there is a provider to verify it.
-4. Redeploy, or let the next push redeploy.
+**To send from a different address**, set \`MAIL_FROM\` in the project's
+environment settings and redeploy. It must be at a domain Resend has verified,
+for the same reason. An address you set always wins over the derived one.
 
-That is all. The integration publishes its key into the project as
-\`RESEND_API_KEY\`, and the board reads that name: with it set, and \`MAIL_FROM\`
-beside it, mail sends over Resend's HTTPS API with nothing further to
-configure.
+A board with the key but no verified domain \u2014 which is what you get if you
+remove the integration's \`RESEND_EMAIL_DOMAIN\` without putting a
+\`MAIL_FROM\` in its place \u2014 does not guess a sender. It stays on the log
+driver and delivers nothing, which is the honest outcome: a guessed sender at
+an unverified domain would be refused by Resend anyway, one message at a
+time.
 
 The board is not tied to Resend. Its mail driver is a plain JSON-over-HTTPS
 sender that posts \`{from, to, subject, text, html, reply_to}\` with a bearer
@@ -1097,8 +1114,10 @@ it needs no adapter. Any provider with the same shape works: set
 \`MAIL_HTTP_ENDPOINT\`, \`MAIL_HTTP_TOKEN\` and \`MAIL_DRIVER=http\` in the
 project's environment settings, and set the first two **together** \u2014 either
 one on its own stands the Resend bridge down, so a key issued for Resend is
-never presented to an endpoint you chose. Only \`RESEND_API_KEY\` turns the
-driver on by itself. Delete it once you have moved off Resend.
+never presented to an endpoint you chose. Setting \`MAIL_DRIVER\` to anything
+but \`http\` stands the bridge down too, for the same reason: a board that
+moved to SMTP must not send through its new provider from Resend's domain.
+Delete \`RESEND_API_KEY\` once you have moved off Resend.
 
 Check it worked: sign in as the administrator and use the test button on
 **/admin \u2192 Settings \u2192 Mail**.
@@ -1122,15 +1141,23 @@ drains; nothing here runs it on its own, because there is no worker process on
 a function platform. Two things about it are worth knowing **before** you
 deploy rather than after:
 
-- **A per-minute schedule needs a paid plan.** Hobby allows a couple of cron
-  jobs and runs each of them roughly once a day, at an hour Vercel chooses;
-  only paid plans accept an arbitrary cron expression. A board ticking daily
-  still loses nothing \u2014 tasks are written so a missed run delays work rather
-  than dropping it \u2014 but "as it happens" notifications become a daily digest in
-  all but name. To keep a minute-by-minute tick on Hobby, drive
-  \`${TICK_PATH}\` from something else that can call a URL on a schedule \u2014 a
-  GitHub Actions workflow, a systemd timer, an uptime pinger \u2014 presenting
-  \`TICK_SECRET\` instead.
+- **This ships a daily schedule, because Hobby refuses anything faster.** A
+  Hobby plan rejects a cron expression that would run more than once a day \u2014
+  the deployment fails outright rather than being slowed down \u2014 so
+  \`vercel.json\` carries \`${TICK_SCHEDULE}\` and deploys anywhere. On a
+  paid plan, edit it to \`* * * * *\` and the board ticks every minute.
+
+  A daily tick loses nothing permanently: tasks are written so a missed run
+  delays work rather than dropping it, and a password reset is sent as the
+  request is handled rather than waiting for a tick. What it does delay is
+  everything the tick drives \u2014 a new post is not findable in search, and a
+  notification is not sent, until the next run.
+
+  **To keep a fast tick without paying**, drive \`${TICK_PATH}\` from anything
+  that can call a URL on a schedule \u2014 a GitHub Actions workflow, a systemd
+  timer, an uptime pinger \u2014 presenting \`TICK_SECRET\` instead of
+  \`CRON_SECRET\`. The endpoint accepts either, so the Vercel cron and an
+  outside scheduler can both drive it.
 - **\`maxDuration = 300\` is validated when the project builds, not when the
   function runs.** A plan that does not allow 300 seconds therefore **fails the
   deployment** rather than clamping the request. With Fluid Compute \u2014 the
@@ -1329,7 +1356,7 @@ async function run(argv, version) {
 }
 
 // src/bin.ts
-var result = await run(process.argv.slice(2), "0.19.0");
+var result = await run(process.argv.slice(2), "0.21.0");
 for (const line of result.lines) {
   if (result.code === 0) console.log(line);
   else console.error(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-meith",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Scaffold a Meith board — npx create-meith <name> writes a workspace that depends on @meith/web and @meith/cli.",
   "license": "MIT",
   "repository": {

package/src/bin.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { run } from './cli'
 
-const result = await run(process.argv.slice(2), '0.19.0')
+const result = await run(process.argv.slice(2), '0.21.0')
 for (const line of result.lines) {
   if (result.code === 0) console.log(line)
   else console.error(line)

package/src/index.ts

@@ -10,7 +10,7 @@ export {
   TICK_PATH,
   TICK_SCHEDULE,
   VERCEL_BUILD_COMMAND,
-  VERCEL_MARKETPLACE_STORES,
+  VERCEL_MARKETPLACE_PRODUCTS,
   VERCEL_PROMPTED_ENV,
   validateName,
 } from './scaffold'

package/src/scaffold.ts

@@ -33,7 +33,9 @@ export const VERCEL_BUILD_COMMAND = `community migrate && forum-web build ${AT_R
 
 export const TICK_PATH = '/api/system/tick'
 
-export const TICK_SCHEDULE = '* * * * *'
+export const TICK_SCHEDULE = '0 3 * * *'
+
+export const RESEND_SENDER_MAILBOX = 'noreply'
 
 export const MATERIALIZED_PUBLIC = [
   'placeholder-logo.png',
@@ -302,15 +304,17 @@ BLOB_READ_WRITE_TOKEN=
 # board refuses it on Vercel; 587 with STARTTLS may work, but an API does not
 # depend on the platform's egress rules staying as they are.
 #
-# MAIL_FROM is yours to decide, and it belongs to the step that adds Resend
-# rather than to the deploy: it must be an address at a domain the provider has
-# verified for you, no default is right, and until a provider is added the board
-# cannot send from any address at all. Set it alongside the integration.
+# MAIL_FROM is optional where a provider publishes the domain it sends from:
+# with RESEND_API_KEY and RESEND_EMAIL_DOMAIN both set, the board sends from
+# noreply@ that domain and this can stay empty. Set it to send from another
+# address — it must be at a domain the provider has verified for you, and an
+# address set here always wins over the derived one.
 MAIL_FROM=
 
 # Add the Resend integration to the project from Vercel's marketplace and it
-# publishes its key under this name, which the board reads: with RESEND_API_KEY
-# set, and MAIL_FROM beside it, the board sends over Resend's HTTPS API and
+# publishes its key and its sending domain under these names, which the board
+# reads: with RESEND_API_KEY set, and either RESEND_EMAIL_DOMAIN or a MAIL_FROM
+# beside it, the board sends over Resend's HTTPS API and
 # needs neither of the two variables below. The mail driver itself is a plain
 # JSON-over-HTTPS sender and is not Resend-specific — this is one injected name
 # bridged to the generic pair, not a provider baked into the board.
@@ -359,7 +363,7 @@ const VERCEL_DERIVED_DRIVERS = [
 
 export const VERCEL_PROMPTED_ENV = ['AUTH_SECRET', 'CRON_SECRET'] as const
 
-export const VERCEL_MARKETPLACE_STORES = [
+export const VERCEL_MARKETPLACE_PRODUCTS = [
   { type: 'integration', integrationSlug: 'neon', productSlug: 'neon', protocol: 'storage' },
   {
     type: 'integration',
@@ -368,6 +372,12 @@ export const VERCEL_MARKETPLACE_STORES = [
     protocol: 'storage',
   },
   { type: 'blob' },
+  {
+    type: 'integration',
+    integrationSlug: 'resend',
+    productSlug: 'resend-email',
+    protocol: 'messaging',
+  },
 ] as const
 
 export function deployButtonUrl(templateRepositoryUrl: string): string {
@@ -378,10 +388,10 @@ export function deployButtonUrl(templateRepositoryUrl: string): string {
     ['env', VERCEL_PROMPTED_ENV.join(',')],
     [
       'envDescription',
-      'Two secrets, generated rather than chosen — 32 characters or more each. Everything else the board reads from the database, cache and blob store this form links.',
+      'Two secrets, generated rather than chosen — 32 characters or more each. Everything else the board reads from the database, cache, blob store and mail provider this form links.',
     ],
     ['envLink', `${templateRepositoryUrl}/blob/main/.env.example`],
-    ['stores', JSON.stringify(VERCEL_MARKETPLACE_STORES)],
+    ['products', JSON.stringify(VERCEL_MARKETPLACE_PRODUCTS)],
     ['skippable-integrations', '1'],
   ])
 
@@ -463,6 +473,7 @@ import { defineForumConfig } from '@meith/web/config'
 import {
   BROWSER_THEME_COLOR,
   DARK_TOKENS,
+  defaultMessages,
   defaultTheme,
   LIGHT_TOKENS,
 } from '@meith/theme-default'
@@ -477,6 +488,7 @@ export default defineForumConfig({
       tokens: { light: LIGHT_TOKENS, dark: DARK_TOKENS },
       browserThemeColor: BROWSER_THEME_COLOR,
       theme: defaultTheme,
+      messages: defaultMessages,
     },
   },
   defaultTheme: 'default',
@@ -1068,18 +1080,20 @@ A forum, built on [Meith](${repositoryUrl}), running as Vercel functions.
   Vercel's SDK, which authenticates with the deployment's own OIDC identity, so
   there is no token to copy. This is what used to be four hand-typed \`S3_*\`
   secrets.
+- **A Resend mail account**, attached the same way, which publishes
+  \`RESEND_API_KEY\` and \`RESEND_EMAIL_DOMAIN\`. The board reads both names
+  directly: its mail driver already speaks Resend's request shape, so there is
+  nothing to adapt, and the sending domain is what the sender is built from.
 - **A Vercel project** carrying \`vercel.json\` — the build command
   \`${VERCEL_BUILD_COMMAND}\`,
   which applies the schema before it builds, materializes the board's app at
   the project root so the artefact lands where Vercel reads it, and the cron
   entry that drives the tick.
 
-**Mail is the one thing the button does not set up**, and it takes one click
-after the deploy — see *Mail, in one click* below. That is also where the
-address the board sends from goes: it has to be at a domain your provider has
-verified, which cannot be true of any domain before a provider exists. The
-board boots and runs without mail, and delivers nothing, silently, until it is
-done.
+**Mail needs no variables after the deploy.** Resend publishes both its key
+and its sending domain, and the board sends from \`${RESEND_SENDER_MAILBOX}@\`
+that domain — see *Mail* below to send from a different address, and for the
+one case that does need you: a domain Resend has not verified yet.
 
 ## What to type into the deploy form
 
@@ -1130,26 +1144,30 @@ Vercel* below for why that matters — set \`FILESTORE_DRIVER=s3\` and add
 project's environment settings, with \`S3_ENDPOINT\` for a bucket that is not AWS
 (\`S3_REGION=auto\` for R2). The same board runs either way.
 
-## Mail, in one click
+## Mail
+
+**There is nothing to set.** The Resend the deploy form added publishes two
+names into the project: \`RESEND_API_KEY\`, and \`RESEND_EMAIL_DOMAIN\` — the
+domain it sends from. The board reads both, sends from
+\`${RESEND_SENDER_MAILBOX}@\` that domain, and posts over Resend's HTTPS API.
 
-A board that cannot send mail cannot reset a password, so do this before you
-invite anybody.
+**If Resend refuses the messages**, that domain is not verified yet. Resend
+will not send from a domain it has not verified, whoever set the address, so
+verify it from the Resend dashboard — the deploy cannot do that step for you,
+because it is Resend confirming you own the domain. This is the one thing here
+that can need attention, and it announces itself: the test button below says
+so rather than the board failing quietly.
 
-1. Open your project on Vercel, go to **Storage → Marketplace** (or
-   **Integrations**), and add **Resend**. It creates a Resend account linked to
-   the project and connects your sending domain.
-2. Verify that domain in the Resend dashboard if you have not already. Resend
-   refuses to send from an address at a domain it has not verified.
-3. Add \`MAIL_FROM\` to the project's environment settings — an address at that
-   verified domain, and the only mail value you ever type. The deploy form does
-   not ask for it, because a sender address is not something you can know
-   before there is a provider to verify it.
-4. Redeploy, or let the next push redeploy.
+**To send from a different address**, set \`MAIL_FROM\` in the project's
+environment settings and redeploy. It must be at a domain Resend has verified,
+for the same reason. An address you set always wins over the derived one.
 
-That is all. The integration publishes its key into the project as
-\`RESEND_API_KEY\`, and the board reads that name: with it set, and \`MAIL_FROM\`
-beside it, mail sends over Resend's HTTPS API with nothing further to
-configure.
+A board with the key but no verified domain — which is what you get if you
+remove the integration's \`RESEND_EMAIL_DOMAIN\` without putting a
+\`MAIL_FROM\` in its place — does not guess a sender. It stays on the log
+driver and delivers nothing, which is the honest outcome: a guessed sender at
+an unverified domain would be refused by Resend anyway, one message at a
+time.
 
 The board is not tied to Resend. Its mail driver is a plain JSON-over-HTTPS
 sender that posts \`{from, to, subject, text, html, reply_to}\` with a bearer
@@ -1158,8 +1176,10 @@ it needs no adapter. Any provider with the same shape works: set
 \`MAIL_HTTP_ENDPOINT\`, \`MAIL_HTTP_TOKEN\` and \`MAIL_DRIVER=http\` in the
 project's environment settings, and set the first two **together** — either
 one on its own stands the Resend bridge down, so a key issued for Resend is
-never presented to an endpoint you chose. Only \`RESEND_API_KEY\` turns the
-driver on by itself. Delete it once you have moved off Resend.
+never presented to an endpoint you chose. Setting \`MAIL_DRIVER\` to anything
+but \`http\` stands the bridge down too, for the same reason: a board that
+moved to SMTP must not send through its new provider from Resend's domain.
+Delete \`RESEND_API_KEY\` once you have moved off Resend.
 
 Check it worked: sign in as the administrator and use the test button on
 **/admin → Settings → Mail**.
@@ -1183,15 +1203,23 @@ drains; nothing here runs it on its own, because there is no worker process on
 a function platform. Two things about it are worth knowing **before** you
 deploy rather than after:
 
-- **A per-minute schedule needs a paid plan.** Hobby allows a couple of cron
-  jobs and runs each of them roughly once a day, at an hour Vercel chooses;
-  only paid plans accept an arbitrary cron expression. A board ticking daily
-  still loses nothing — tasks are written so a missed run delays work rather
-  than dropping it — but "as it happens" notifications become a daily digest in
-  all but name. To keep a minute-by-minute tick on Hobby, drive
-  \`${TICK_PATH}\` from something else that can call a URL on a schedule — a
-  GitHub Actions workflow, a systemd timer, an uptime pinger — presenting
-  \`TICK_SECRET\` instead.
+- **This ships a daily schedule, because Hobby refuses anything faster.** A
+  Hobby plan rejects a cron expression that would run more than once a day —
+  the deployment fails outright rather than being slowed down — so
+  \`vercel.json\` carries \`${TICK_SCHEDULE}\` and deploys anywhere. On a
+  paid plan, edit it to \`* * * * *\` and the board ticks every minute.
+
+  A daily tick loses nothing permanently: tasks are written so a missed run
+  delays work rather than dropping it, and a password reset is sent as the
+  request is handled rather than waiting for a tick. What it does delay is
+  everything the tick drives — a new post is not findable in search, and a
+  notification is not sent, until the next run.
+
+  **To keep a fast tick without paying**, drive \`${TICK_PATH}\` from anything
+  that can call a URL on a schedule — a GitHub Actions workflow, a systemd
+  timer, an uptime pinger — presenting \`TICK_SECRET\` instead of
+  \`CRON_SECRET\`. The endpoint accepts either, so the Vercel cron and an
+  outside scheduler can both drive it.
 - **\`maxDuration = 300\` is validated when the project builds, not when the
   function runs.** A plan that does not allow 300 seconds therefore **fails the
   deployment** rather than clamping the request. With Fluid Compute — the