create-meith 0.20.0 → 0.21.0

package/dist/bin.mjs

@@ -26,6 +26,7 @@ var MATERIALIZED_AT_ROOT = [
 var VERCEL_BUILD_COMMAND = `community migrate && forum-web build ${AT_ROOT_FLAG}`;
 var TICK_PATH = "/api/system/tick";
 var TICK_SCHEDULE = "0 3 * * *";
+var RESEND_SENDER_MAILBOX = "noreply";
 var MATERIALIZED_PUBLIC = [
   "placeholder-logo.png",
   "placeholder-logo.svg",
@@ -278,15 +279,17 @@ BLOB_READ_WRITE_TOKEN=
 # board refuses it on Vercel; 587 with STARTTLS may work, but an API does not
 # depend on the platform's egress rules staying as they are.
 #
-# MAIL_FROM is yours to decide, and it belongs to the step that adds Resend
-# rather than to the deploy: it must be an address at a domain the provider has
-# verified for you, no default is right, and until a provider is added the board
-# cannot send from any address at all. Set it alongside the integration.
+# MAIL_FROM is optional where a provider publishes the domain it sends from:
+# with RESEND_API_KEY and RESEND_EMAIL_DOMAIN both set, the board sends from
+# noreply@ that domain and this can stay empty. Set it to send from another
+# address \u2014 it must be at a domain the provider has verified for you, and an
+# address set here always wins over the derived one.
 MAIL_FROM=
 
 # Add the Resend integration to the project from Vercel's marketplace and it
-# publishes its key under this name, which the board reads: with RESEND_API_KEY
-# set, and MAIL_FROM beside it, the board sends over Resend's HTTPS API and
+# publishes its key and its sending domain under these names, which the board
+# reads: with RESEND_API_KEY set, and either RESEND_EMAIL_DOMAIN or a MAIL_FROM
+# beside it, the board sends over Resend's HTTPS API and
 # needs neither of the two variables below. The mail driver itself is a plain
 # JSON-over-HTTPS sender and is not Resend-specific \u2014 this is one injected name
 # bridged to the generic pair, not a provider baked into the board.
@@ -435,6 +438,7 @@ import { defineForumConfig } from '@meith/web/config'
 import {
   BROWSER_THEME_COLOR,
   DARK_TOKENS,
+  defaultMessages,
   defaultTheme,
   LIGHT_TOKENS,
 } from '@meith/theme-default'
@@ -449,6 +453,7 @@ export default defineForumConfig({
       tokens: { light: LIGHT_TOKENS, dark: DARK_TOKENS },
       browserThemeColor: BROWSER_THEME_COLOR,
       theme: defaultTheme,
+      messages: defaultMessages,
     },
   },
   defaultTheme: 'default',
@@ -1014,18 +1019,19 @@ A forum, built on [Meith](${repositoryUrl}), running as Vercel functions.
   there is no token to copy. This is what used to be four hand-typed \`S3_*\`
   secrets.
 - **A Resend mail account**, attached the same way, which publishes
-  \`RESEND_API_KEY\`. The board reads that name directly: its mail driver already
-  speaks Resend's request shape, so there is nothing to adapt.
+  \`RESEND_API_KEY\` and \`RESEND_EMAIL_DOMAIN\`. The board reads both names
+  directly: its mail driver already speaks Resend's request shape, so there is
+  nothing to adapt, and the sending domain is what the sender is built from.
 - **A Vercel project** carrying \`vercel.json\` \u2014 the build command
   \`${VERCEL_BUILD_COMMAND}\`,
   which applies the schema before it builds, materializes the board's app at
   the project root so the artefact lands where Vercel reads it, and the cron
   entry that drives the tick.
 
-**Mail needs one thing after the deploy**: the address the board sends from.
-It has to be at a domain Resend has verified, and no form can ask for that
-before the account exists \u2014 see *Mail, after the deploy* below. The board boots
-and runs without it, and delivers nothing, silently, until it is done.
+**Mail needs no variables after the deploy.** Resend publishes both its key
+and its sending domain, and the board sends from \`${RESEND_SENDER_MAILBOX}@\`
+that domain \u2014 see *Mail* below to send from a different address, and for the
+one case that does need you: a domain Resend has not verified yet.
 
 ## What to type into the deploy form
 
@@ -1076,22 +1082,30 @@ Vercel* below for why that matters \u2014 set \`FILESTORE_DRIVER=s3\` and add
 project's environment settings, with \`S3_ENDPOINT\` for a bucket that is not AWS
 (\`S3_REGION=auto\` for R2). The same board runs either way.
 
-## Mail, after the deploy
+## Mail
 
-A board that cannot send mail cannot reset a password, so do this before you
-invite anybody. The deploy form already added Resend and published its key; two
-steps remain, and neither could have been answered on the form.
+**There is nothing to set.** The Resend the deploy form added publishes two
+names into the project: \`RESEND_API_KEY\`, and \`RESEND_EMAIL_DOMAIN\` \u2014 the
+domain it sends from. The board reads both, sends from
+\`${RESEND_SENDER_MAILBOX}@\` that domain, and posts over Resend's HTTPS API.
 
-1. Verify your sending domain in the Resend dashboard if you have not already.
-   Resend refuses to send from an address at a domain it has not verified.
-2. Add \`MAIL_FROM\` to the project's environment settings \u2014 an address at that
-   verified domain, and the only mail value you ever type.
-3. Redeploy, or let the next push redeploy.
+**If Resend refuses the messages**, that domain is not verified yet. Resend
+will not send from a domain it has not verified, whoever set the address, so
+verify it from the Resend dashboard \u2014 the deploy cannot do that step for you,
+because it is Resend confirming you own the domain. This is the one thing here
+that can need attention, and it announces itself: the test button below says
+so rather than the board failing quietly.
 
-That is all. The integration published its key into the project as
-\`RESEND_API_KEY\` when you deployed, and the board reads that name: with it set,
-and \`MAIL_FROM\` beside it, mail sends over Resend's HTTPS API with nothing
-further to configure.
+**To send from a different address**, set \`MAIL_FROM\` in the project's
+environment settings and redeploy. It must be at a domain Resend has verified,
+for the same reason. An address you set always wins over the derived one.
+
+A board with the key but no verified domain \u2014 which is what you get if you
+remove the integration's \`RESEND_EMAIL_DOMAIN\` without putting a
+\`MAIL_FROM\` in its place \u2014 does not guess a sender. It stays on the log
+driver and delivers nothing, which is the honest outcome: a guessed sender at
+an unverified domain would be refused by Resend anyway, one message at a
+time.
 
 The board is not tied to Resend. Its mail driver is a plain JSON-over-HTTPS
 sender that posts \`{from, to, subject, text, html, reply_to}\` with a bearer
@@ -1100,8 +1114,10 @@ it needs no adapter. Any provider with the same shape works: set
 \`MAIL_HTTP_ENDPOINT\`, \`MAIL_HTTP_TOKEN\` and \`MAIL_DRIVER=http\` in the
 project's environment settings, and set the first two **together** \u2014 either
 one on its own stands the Resend bridge down, so a key issued for Resend is
-never presented to an endpoint you chose. Only \`RESEND_API_KEY\` turns the
-driver on by itself. Delete it once you have moved off Resend.
+never presented to an endpoint you chose. Setting \`MAIL_DRIVER\` to anything
+but \`http\` stands the bridge down too, for the same reason: a board that
+moved to SMTP must not send through its new provider from Resend's domain.
+Delete \`RESEND_API_KEY\` once you have moved off Resend.
 
 Check it worked: sign in as the administrator and use the test button on
 **/admin \u2192 Settings \u2192 Mail**.
@@ -1340,7 +1356,7 @@ async function run(argv, version) {
 }
 
 // src/bin.ts
-var result = await run(process.argv.slice(2), "0.20.0");
+var result = await run(process.argv.slice(2), "0.21.0");
 for (const line of result.lines) {
   if (result.code === 0) console.log(line);
   else console.error(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-meith",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Scaffold a Meith board — npx create-meith <name> writes a workspace that depends on @meith/web and @meith/cli.",
   "license": "MIT",
   "repository": {

package/src/bin.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { run } from './cli'
 
-const result = await run(process.argv.slice(2), '0.20.0')
+const result = await run(process.argv.slice(2), '0.21.0')
 for (const line of result.lines) {
   if (result.code === 0) console.log(line)
   else console.error(line)

package/src/scaffold.ts

@@ -35,6 +35,8 @@ export const TICK_PATH = '/api/system/tick'
 
 export const TICK_SCHEDULE = '0 3 * * *'
 
+export const RESEND_SENDER_MAILBOX = 'noreply'
+
 export const MATERIALIZED_PUBLIC = [
   'placeholder-logo.png',
   'placeholder-logo.svg',
@@ -302,15 +304,17 @@ BLOB_READ_WRITE_TOKEN=
 # board refuses it on Vercel; 587 with STARTTLS may work, but an API does not
 # depend on the platform's egress rules staying as they are.
 #
-# MAIL_FROM is yours to decide, and it belongs to the step that adds Resend
-# rather than to the deploy: it must be an address at a domain the provider has
-# verified for you, no default is right, and until a provider is added the board
-# cannot send from any address at all. Set it alongside the integration.
+# MAIL_FROM is optional where a provider publishes the domain it sends from:
+# with RESEND_API_KEY and RESEND_EMAIL_DOMAIN both set, the board sends from
+# noreply@ that domain and this can stay empty. Set it to send from another
+# address — it must be at a domain the provider has verified for you, and an
+# address set here always wins over the derived one.
 MAIL_FROM=
 
 # Add the Resend integration to the project from Vercel's marketplace and it
-# publishes its key under this name, which the board reads: with RESEND_API_KEY
-# set, and MAIL_FROM beside it, the board sends over Resend's HTTPS API and
+# publishes its key and its sending domain under these names, which the board
+# reads: with RESEND_API_KEY set, and either RESEND_EMAIL_DOMAIN or a MAIL_FROM
+# beside it, the board sends over Resend's HTTPS API and
 # needs neither of the two variables below. The mail driver itself is a plain
 # JSON-over-HTTPS sender and is not Resend-specific — this is one injected name
 # bridged to the generic pair, not a provider baked into the board.
@@ -469,6 +473,7 @@ import { defineForumConfig } from '@meith/web/config'
 import {
   BROWSER_THEME_COLOR,
   DARK_TOKENS,
+  defaultMessages,
   defaultTheme,
   LIGHT_TOKENS,
 } from '@meith/theme-default'
@@ -483,6 +488,7 @@ export default defineForumConfig({
       tokens: { light: LIGHT_TOKENS, dark: DARK_TOKENS },
       browserThemeColor: BROWSER_THEME_COLOR,
       theme: defaultTheme,
+      messages: defaultMessages,
     },
   },
   defaultTheme: 'default',
@@ -1075,18 +1081,19 @@ A forum, built on [Meith](${repositoryUrl}), running as Vercel functions.
   there is no token to copy. This is what used to be four hand-typed \`S3_*\`
   secrets.
 - **A Resend mail account**, attached the same way, which publishes
-  \`RESEND_API_KEY\`. The board reads that name directly: its mail driver already
-  speaks Resend's request shape, so there is nothing to adapt.
+  \`RESEND_API_KEY\` and \`RESEND_EMAIL_DOMAIN\`. The board reads both names
+  directly: its mail driver already speaks Resend's request shape, so there is
+  nothing to adapt, and the sending domain is what the sender is built from.
 - **A Vercel project** carrying \`vercel.json\` — the build command
   \`${VERCEL_BUILD_COMMAND}\`,
   which applies the schema before it builds, materializes the board's app at
   the project root so the artefact lands where Vercel reads it, and the cron
   entry that drives the tick.
 
-**Mail needs one thing after the deploy**: the address the board sends from.
-It has to be at a domain Resend has verified, and no form can ask for that
-before the account exists — see *Mail, after the deploy* below. The board boots
-and runs without it, and delivers nothing, silently, until it is done.
+**Mail needs no variables after the deploy.** Resend publishes both its key
+and its sending domain, and the board sends from \`${RESEND_SENDER_MAILBOX}@\`
+that domain — see *Mail* below to send from a different address, and for the
+one case that does need you: a domain Resend has not verified yet.
 
 ## What to type into the deploy form
 
@@ -1137,22 +1144,30 @@ Vercel* below for why that matters — set \`FILESTORE_DRIVER=s3\` and add
 project's environment settings, with \`S3_ENDPOINT\` for a bucket that is not AWS
 (\`S3_REGION=auto\` for R2). The same board runs either way.
 
-## Mail, after the deploy
+## Mail
+
+**There is nothing to set.** The Resend the deploy form added publishes two
+names into the project: \`RESEND_API_KEY\`, and \`RESEND_EMAIL_DOMAIN\` — the
+domain it sends from. The board reads both, sends from
+\`${RESEND_SENDER_MAILBOX}@\` that domain, and posts over Resend's HTTPS API.
 
-A board that cannot send mail cannot reset a password, so do this before you
-invite anybody. The deploy form already added Resend and published its key; two
-steps remain, and neither could have been answered on the form.
+**If Resend refuses the messages**, that domain is not verified yet. Resend
+will not send from a domain it has not verified, whoever set the address, so
+verify it from the Resend dashboard — the deploy cannot do that step for you,
+because it is Resend confirming you own the domain. This is the one thing here
+that can need attention, and it announces itself: the test button below says
+so rather than the board failing quietly.
 
-1. Verify your sending domain in the Resend dashboard if you have not already.
-   Resend refuses to send from an address at a domain it has not verified.
-2. Add \`MAIL_FROM\` to the project's environment settings — an address at that
-   verified domain, and the only mail value you ever type.
-3. Redeploy, or let the next push redeploy.
+**To send from a different address**, set \`MAIL_FROM\` in the project's
+environment settings and redeploy. It must be at a domain Resend has verified,
+for the same reason. An address you set always wins over the derived one.
 
-That is all. The integration published its key into the project as
-\`RESEND_API_KEY\` when you deployed, and the board reads that name: with it set,
-and \`MAIL_FROM\` beside it, mail sends over Resend's HTTPS API with nothing
-further to configure.
+A board with the key but no verified domain — which is what you get if you
+remove the integration's \`RESEND_EMAIL_DOMAIN\` without putting a
+\`MAIL_FROM\` in its place — does not guess a sender. It stays on the log
+driver and delivers nothing, which is the honest outcome: a guessed sender at
+an unverified domain would be refused by Resend anyway, one message at a
+time.
 
 The board is not tied to Resend. Its mail driver is a plain JSON-over-HTTPS
 sender that posts \`{from, to, subject, text, html, reply_to}\` with a bearer
@@ -1161,8 +1176,10 @@ it needs no adapter. Any provider with the same shape works: set
 \`MAIL_HTTP_ENDPOINT\`, \`MAIL_HTTP_TOKEN\` and \`MAIL_DRIVER=http\` in the
 project's environment settings, and set the first two **together** — either
 one on its own stands the Resend bridge down, so a key issued for Resend is
-never presented to an endpoint you chose. Only \`RESEND_API_KEY\` turns the
-driver on by itself. Delete it once you have moved off Resend.
+never presented to an endpoint you chose. Setting \`MAIL_DRIVER\` to anything
+but \`http\` stands the bridge down too, for the same reason: a board that
+moved to SMTP must not send through its new provider from Resend's domain.
+Delete \`RESEND_API_KEY\` once you have moved off Resend.
 
 Check it worked: sign in as the administrator and use the test button on
 **/admin → Settings → Mail**.