@clubedge/create-clubedge-app 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to `create-clubedge-app` are documented here.
 
+## 0.18.0
+
+- Add `try` (experimental): `pnpm dlx @clubedge/create-clubedge-app try` creates a new project on a free, temporary [Railway VM](https://railway.com/free-vm) instead of your machine, and prints its preview URL and the link to claim the VM. No Railway account, database, or Docker needed.
+  - The VM has no Docker, so the project uses `--infra local` (PGlite) and Better Auth, with email off; `--framework` and other module flags apply as usual. `--infra` other than `local` and `--auth supabase` are rejected.
+  - It asks before creating anything (`--yes` agrees), keeps its own SSH key in the CLI's config directory apart from `~/.ssh`, and connects only to Railway's known host key (`CLUBEDGE_RAILWAY_HOST_KEY` adds one if Railway rotates it).
+  - The VM lasts 60 minutes and can be claimed for 24 hours after; until then, the preview opens only from your network. Railway allows 3 free VMs per network per day.
+- Still on Starter `v0.15.0`.
+
+## 0.17.0
+
+- Default to Starter `v0.15.0`, whose dashboard has the docs' layout and colors in both frameworks: a collapsible sidebar with a section switcher, the dashboard's sections, resources, and an account card with Settings and Sign out; the page in a rounded card that scrolls on its own; a top bar with Home, GitHub, and a light and dark switch; and a drawer on phones.
+- None of this needs CLI code: it all comes from the Starter.
+
 ## 0.16.0
 
 - Default to Starter `v0.14.0`, which adds:

package/README.md

@@ -127,7 +127,7 @@ pnpm dlx @clubedge/create-clubedge-app my-app --yes --no-git --framework tanstac
 pnpm dlx @clubedge/create-clubedge-app my-app --ref main
 
 # Reproduce a specific Starter release or commit
-pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.14.0
+pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.15.0
 pnpm dlx @clubedge/create-clubedge-app my-app --ref <commit-sha>
 
 # Test local Starter changes before releasing them
@@ -146,7 +146,7 @@ pnpm clubedge add email resend payments stripe              # several modules as
 pnpm clubedge remove storage payments
 pnpm dlx @clubedge/create-clubedge-app add infra local --dry-run
 pnpm dlx @clubedge/create-clubedge-app@latest upgrade        # to the newest CLI's Starter release
-pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.14.0 # or a specific tag, branch, or commit
+pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.15.0 # or a specific tag, branch, or commit
 ```
 
 The CLI renders the project twice, from the Starter commit and modules recorded in your `package.json` and from the new state, and merges the difference into your project. The new state has other modules for `add` and `remove`, and the newer Starter with the same modules for `upgrade`. Modules a newer Starter introduces start as `none` where possible, so an upgrade never adds a service on its own.
@@ -172,32 +172,45 @@ pnpm clubedge doctor    # Node.js, pnpm, dependencies, lockfile, env file, and p
 
 `status` ends with the command to run next, such as `pnpm clubedge upgrade` when a newer Starter release is available; it asks npm for the newest CLI and still works offline. `doctor` checks that Node.js and pnpm meet the project's versions, that dependencies are installed, that `pnpm-lock.yaml` matches every `package.json`, and that `apps/web/.env.local` has every variable in `.env.example`, then runs `pnpm check:services` (skip it with `--no-services`). It exits with an error when a check fails, so it also works in CI.
 
+## Try it on a Railway VM (experimental)
+
+No Node.js setup, database, or Docker to spare? `try` creates the project on a free, temporary Linux VM from [Railway](https://railway.com/free-vm) instead of your machine, and prints a preview URL:
+
+```sh
+pnpm dlx @clubedge/create-clubedge-app try
+pnpm dlx @clubedge/create-clubedge-app try --framework tanstack-start --auth none
+```
+
+The VM needs no Railway account and lasts 60 minutes; to keep it, open the claim link the CLI prints within 24 hours after, which moves the VM, its files, and its URL into a Railway account. Keep that link private. Until the VM is claimed, the preview opens only from your network. Railway allows 3 free VMs per network per day.
+
+The VM has no Docker, so the project uses `--infra local` (PGlite) and Better Auth unless you choose `--auth none`, with email off; other module flags apply as usual. The CLI asks before creating anything (`--yes` agrees), keeps its own SSH key in your config directory (`~/.config/clubedge`, or `%APPDATA%\clubedge` on Windows) apart from `~/.ssh`, and connects only to Railway's known host key. Railway's [terms](https://railway.com/legal/terms) apply, and Railway can change or pause its free VM.
+
 ## Version relationship
 
 Each CLI release is tested against one specific Starter release:
 
 ```text
-create-clubedge-app v0.16.0
+create-clubedge-app v0.18.0
         |
         v
-Clubedge Starter v0.14.0
-commit 2219a21c2eb237b7d8ee004ea8bbeb098b70106e
+Clubedge Starter v0.15.0
+commit 239f9e9fd575165d72f70a91592cafbd43bb7574
 ```
 
 The current relationship is:
 
 | CLI release | Default Starter release | Meaning |
 | --- | --- | --- |
-| `create-clubedge-app@0.16.0` | `clubedge-starter@v0.14.0` | The CLI's required, tested default |
+| `create-clubedge-app@0.18.0` | `clubedge-starter@v0.15.0` | The CLI's required, tested default |
 
 This means the same CLI version always scaffolds the same Starter revision by default. The CLI does not silently follow Starter `main`.
 
-The `v0.14.0` tag is expected to resolve to commit
-`2219a21c2eb237b7d8ee004ea8bbeb098b70106e`. The CLI verifies this before
+The `v0.15.0` tag is expected to resolve to commit
+`239f9e9fd575165d72f70a91592cafbd43bb7574`. The CLI verifies this before
 scaffolding with the default reference and fails rather than silently using a
 moved tag.
 
-When the Starter changes, its maintainers first publish a new versioned release, such as `v0.14.0`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
+When the Starter changes, its maintainers first publish a new versioned release, such as `v0.15.0`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
 
 Every generated project records its CLI version, Starter repository, Starter ref, Starter commit, framework, and modules in `package.json` and `README.md`.
 
@@ -252,7 +265,7 @@ CI packs the CLI with `npm pack`, scaffolds clean projects from the packed tarba
 1. Make and validate changes in `clubedge-starter`.
 2. Run lint, typecheck, unit tests, browser tests, and production build.
 3. Update the Starter package versions.
-4. Commit `main`, create a release tag such as `v0.14.0`, and publish the Starter release.
+4. Commit `main`, create a release tag such as `v0.15.0`, and publish the Starter release.
 
 ### CLI maintainers
 
@@ -278,6 +291,8 @@ Each phase ends with a Starter release and a CLI release pinned to it. The full
 | 0.14.0 | v0.13.0 | Observability |
 | 0.15.0 | v0.13.1 | `status` and `doctor`, several modules in one change, conflict and upgrade summaries, macOS CI |
 | 0.16.0 | v0.14.0 | Account settings page, browser error reporting and Sentry source maps, auth emails through the jobs queue |
+| 0.17.0 | v0.15.0 | Docs-style dashboard: sidebar with a section switcher and account card, page in a scrolling card, phone drawer |
+| 0.18.0 | v0.15.0 | `try`: a new project on a free, temporary Railway VM, with a preview URL and a claim link (experimental) |
 | next | | Show the Starter's version of a conflicted file next to yours |
 
 ## Community

package/dist/cli/args.js

@@ -75,15 +75,20 @@ export function parseCliArgs(argv) {
     }
     const { values, positionals } = parsed;
     const command = parseCommand(positionals);
+    // try creates a project too, on a VM, so it takes the same selection flags as create.
+    const creates = command.name === "create" || command.name === "try";
     if (command.name === "create" && positionals.length > 1) {
         throw new UsageError("Only one project directory can be provided.");
     }
-    if (command.name !== "create" && (values.framework !== undefined || Object.keys(modules).length)) {
+    if (!creates && (values.framework !== undefined || Object.keys(modules).length)) {
         throw new UsageError("--framework and module flags only apply when creating a project; use add or remove to change modules.");
     }
-    if (command.name !== "create" && command.name !== "upgrade" && values.ref !== undefined) {
+    if (!creates && command.name !== "upgrade" && values.ref !== undefined) {
         throw new UsageError("--ref only applies when creating or upgrading a project.");
     }
+    if (command.name === "try" && values["template-dir"] !== undefined) {
+        throw new UsageError("--template-dir does not apply to try: the VM downloads the Starter itself.");
+    }
     if (values.framework !== undefined && !values.framework.trim()) {
         throw new UsageError("--framework requires a framework id, such as next or tanstack-start.");
     }
@@ -116,9 +121,9 @@ function assertDistinct(modules) {
         throw new UsageError(`The module "${repeated}" is named more than once.`);
 }
 /**
- * `add <module> <option>...`, `remove <module>...`, and `upgrade` change an existing project, and `status`
- * and `doctor` inspect one; anything else is the directory of a new project. Create a project
- * literally named "add" with `./add`.
+ * `add <module> <option>...`, `remove <module>...`, and `upgrade` change an existing project, `status`
+ * and `doctor` inspect one, and `try` creates one on a Railway VM; anything else is the directory
+ * of a new project. Create a project literally named "add" with `./add`.
  */
 function parseCommand(positionals) {
     const [name, ...rest] = positionals;
@@ -142,6 +147,11 @@ function parseCommand(positionals) {
             throw new UsageError(`Usage: ${name}, run inside a project.`);
         return { name };
     }
+    if (name === "try") {
+        if (module !== undefined)
+            throw new UsageError("Usage: try [--framework <id>] [module flags], for example: try --framework tanstack-start");
+        return { name };
+    }
     if (name === "upgrade") {
         if (module !== undefined)
             throw new UsageError("Usage: upgrade [--ref <tag>], for example: upgrade --ref v0.8.0");

package/dist/cli/ui.js

@@ -91,6 +91,7 @@ Usage:
   pnpm dlx @clubedge/create-clubedge-app upgrade [--ref <tag>]   (inside a project)
   pnpm dlx @clubedge/create-clubedge-app status                  (inside a project)
   pnpm dlx @clubedge/create-clubedge-app doctor                  (inside a project)
+  pnpm dlx @clubedge/create-clubedge-app try [options]           (experimental)
 
   Inside a project with the clubedge script, use pnpm clubedge add, remove,
   upgrade, status, or doctor. Without a module or option, add and remove ask for them.
@@ -105,6 +106,12 @@ Usage:
   newer Starter is available. doctor checks Node.js, pnpm, the dependencies, the
   lockfile, and the env file, then runs pnpm check:services; it changes nothing.
 
+  try creates a new project on a free, temporary Railway VM (no account, 60 minutes)
+  and prints its preview URL and the link to claim the VM. The VM has no Docker, so
+  it uses --infra local (PGlite) and Better Auth, with email off. It asks first, and
+  keeps its own SSH key apart from ~/.ssh. Experimental: Railway can change or pause
+  its free VM.
+
 Options:
 ${selectionHelp(manifest)}
   --ref <ref>             Download this Starter tag, branch, or commit from GitHub instead
@@ -132,6 +139,7 @@ Examples:
   pnpm dlx @clubedge/create-clubedge-app@latest upgrade
   pnpm clubedge status
   pnpm clubedge doctor --no-services
+  pnpm dlx @clubedge/create-clubedge-app try --framework tanstack-start
 
 Learn more:
   CLI      ${cliUrl}

package/dist/core/railway.js

@@ -0,0 +1,222 @@
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+import { UsageError } from "../cli/args.js";
+/*
+ * Railway's free VM (https://railway.com/free-vm): `ssh railway.new` gives a temporary Linux box
+ * with no account. Everything this CLI relies on about it is in this file, so a change on
+ * Railway's side is a change here.
+ */
+export const railwayHost = "railway.new";
+export const railwayTermsUrl = "https://railway.com/legal/terms";
+export const railwayFreeVmUrl = "https://railway.com/free-vm";
+/**
+ * The host keys railway.new presents, as OpenSSH SHA256 fingerprints. Connecting to anything
+ * else fails. CLUBEDGE_RAILWAY_HOST_KEY adds one (comma-separated), for when Railway rotates its
+ * key before a CLI release catches up.
+ */
+const pinnedHostKeys = ["SHA256:+S1xg92FrnHz6pY3bpkmh1OGtWQGNANXilPzlxA7B1g"];
+export function trustedHostKeys(env = process.env) {
+    const extra = (env.CLUBEDGE_RAILWAY_HOST_KEY ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    return [...pinnedHostKeys, ...extra];
+}
+/** The OpenSSH fingerprint of a raw host key: "SHA256:" and unpadded base64, as ssh prints it. */
+export function hostKeyFingerprint(key) {
+    return `SHA256:${createHash("sha256").update(key).digest("base64").replace(/=+$/, "")}`;
+}
+/**
+ * Finds Railway's JSON status line in a command's stderr. Returns null when there is none, and
+ * throws when there is one without the fields this CLI needs.
+ */
+export function parseRailwayStatus(stderr) {
+    for (const line of stderr.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("{"))
+            continue;
+        let value;
+        try {
+            value = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        if (typeof value.status !== "string")
+            continue;
+        const previewUrl = value.preview_url;
+        const claimUrl = value.human_claim_url;
+        const expiresAt = new Date(String(value.build_expires_at));
+        if (typeof previewUrl !== "string" || !/^https:\/\//.test(previewUrl) || typeof claimUrl !== "string" || Number.isNaN(expiresAt.getTime())) {
+            throw new Error(`Railway answered, but not as this CLI expects (status "${value.status}"). Railway may have changed its free VM; update the CLI, or see ${railwayFreeVmUrl}.`);
+        }
+        return { status: value.status, state: String(value.state ?? ""), previewUrl: previewUrl.replace(/\/+$/, ""), claimUrl, expiresAt };
+    }
+    return null;
+}
+/** Where the CLI keeps its own SSH key for Railway, apart from the user's ~/.ssh. */
+export function railwayKeyPath(env = process.env, platform = process.platform) {
+    const configHome = env.XDG_CONFIG_HOME || (platform === "win32" && env.APPDATA ? env.APPDATA : join(homedir(), ".config"));
+    return join(configHome, "clubedge", "railway_ed25519");
+}
+/**
+ * The modules for a project on the VM. It has no Docker, so the database is PGlite (--infra
+ * local) and sign-in is Better Auth; email is off, since nothing there receives it. Flags the
+ * user passed win, unless the VM cannot run them.
+ */
+export function tryModules(requested) {
+    const infra = requested.infra ?? "local";
+    if (infra !== "local") {
+        throw new UsageError(`try runs on a VM without Docker, so it needs --infra local (not --infra ${infra}).`);
+    }
+    const auth = requested.auth ?? "better-auth";
+    if (auth === "supabase") {
+        throw new UsageError("try cannot run Supabase Auth, which needs Docker or a Supabase project. Use --auth better-auth or --auth none.");
+    }
+    return { ...requested, infra, auth, email: requested.email ?? "none" };
+}
+/** A value as one single-quoted shell word. */
+export const shellQuote = (value) => `'${value.replaceAll("'", `'\\''`)}'`;
+/** The create command run on the VM: this CLI's own version, with the chosen selection. */
+export function tryCreateArgs({ framework, modules, ref }) {
+    return [
+        ...(framework ? ["--framework", framework] : []),
+        ...Object.entries(modules).flatMap(([module, option]) => [`--${module}`, option]),
+        ...(ref ? ["--ref", ref] : []),
+        "--yes",
+    ];
+}
+export const remoteDir = "/app";
+export const remoteLog = `${remoteDir}/clubedge-try.log`;
+export const remoteDevLog = `${remoteDir}/clubedge-dev.log`;
+export const remoteScriptPath = `${remoteDir}/clubedge-try.sh`;
+export const remoteProxyPath = `${remoteDir}/clubedge-proxy.mjs`;
+/**
+ * The script the VM runs. It reports progress on stdout as "@@step <text>", then "@@ready", or
+ * "@@fail <text>" followed by the end of the log as "@@log <line>". The servers it starts keep
+ * running after the SSH session ends.
+ */
+export function tryScript(options) {
+    const create = ["pnpm", "dlx", `@clubedge/create-clubedge-app@${options.cliVersion}`, '"$dir"', ...tryCreateArgs(options).map(shellQuote)].join(" ");
+    const betterAuth = options.modules.auth === "better-auth";
+    return `#!/usr/bin/env bash
+# Written by create-clubedge-app try. Logs: ${remoteLog}, ${remoteDevLog}
+set -uo pipefail
+cd ${remoteDir}
+log=${remoteLog}
+: > "$log"
+step() { echo "@@step $*"; echo "== $*" >> "$log"; }
+fail() { echo "@@fail $*"; tail -n 40 "$log" | sed 's/^/@@log /'; exit 1; }
+port="\${PORT:-8080}"
+
+step "Preparing pnpm"
+command -v pnpm >/dev/null 2>&1 || corepack enable pnpm >>"$log" 2>&1 || npm install -g pnpm@10 >>"$log" 2>&1 || fail "pnpm could not be installed"
+
+# A second run on the same VM replaces the servers of the first, and creates a new directory.
+pkill -f clubedge-proxy.mjs >/dev/null 2>&1
+pkill -f "next dev|vite dev|local-db" >/dev/null 2>&1
+
+step "Starting the preview proxy"
+setsid nohup node ${remoteProxyPath} "$port" 3000 ${shellQuote(options.previewUrl)} >>${remoteDir}/clubedge-proxy.log 2>&1 < /dev/null &
+
+dir=my-app
+n=2
+while [ -e "$dir" ]; do dir="my-app-$n"; n=$((n + 1)); done
+step "Creating the project in ${remoteDir}/$dir"
+${create} >>"$log" 2>&1 || fail "The project could not be created"
+cd "$dir" || fail "The project directory is missing"
+${betterAuth
+        ? `
+envfile=$(ls apps/*/.env.local 2>/dev/null | head -n 1)
+[ -n "$envfile" ] || fail "The project has no apps/*/.env.local"
+secret=$(node -e 'console.log(require("node:crypto").randomBytes(32).toString("hex"))')
+if grep -q '^BETTER_AUTH_SECRET=' "$envfile"; then
+  sed -i "s/^BETTER_AUTH_SECRET=.*/BETTER_AUTH_SECRET=$secret/" "$envfile"
+else
+  echo "BETTER_AUTH_SECRET=$secret" >> "$envfile"
+fi
+`
+        : ""}
+step "Starting the local database"
+setsid nohup pnpm infra:up >>${remoteDir}/clubedge-db.log 2>&1 < /dev/null &
+for _ in $(seq 120); do grep -q "Local database ready" ${remoteDir}/clubedge-db.log && break; sleep 1; done
+grep -q "Local database ready" ${remoteDir}/clubedge-db.log || { cat ${remoteDir}/clubedge-db.log >> "$log"; fail "The local database did not start"; }
+
+step "Migrating the database"
+pnpm run --if-present db:migrate >>"$log" 2>&1 || fail "The database migration failed"
+
+step "Starting the app"
+setsid nohup pnpm dev >>${remoteDevLog} 2>&1 < /dev/null &
+for _ in $(seq 300); do
+  code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/ || true)
+  [ "$code" != "000" ] && break
+  sleep 1
+done
+[ "$code" != "000" ] || { tail -n 40 ${remoteDevLog} >> "$log"; fail "The app did not start"; }
+echo "@@ready $dir"
+`;
+}
+/**
+ * A small reverse proxy for the VM: Railway's preview URL reaches it on $PORT, and it forwards to
+ * the dev server on localhost. The Starter's dev servers only serve their scripts to localhost
+ * (Next.js allowedDevOrigins, Vite's host check), and Next.js compares Origin with the forwarded
+ * host for form posts, so requests are made to look local, and redirects to localhost are pointed
+ * back at the preview URL. Until the app answers, it shows a page that reloads itself.
+ */
+export const proxySource = `import http from "node:http";
+import net from "node:net";
+
+const [port = "8080", upstreamPort = "3000", publicOrigin = ""] = process.argv.slice(2);
+const local = "http://localhost:" + upstreamPort;
+
+function toLocal(headers) {
+  const result = { ...headers, host: "localhost:" + upstreamPort };
+  delete result["x-forwarded-host"];
+  delete result.forwarded;
+  if (result.origin) result.origin = local;
+  if (result.referer && publicOrigin) result.referer = result.referer.replace(publicOrigin, local);
+  return result;
+}
+
+const starting = '<!doctype html><meta charset="utf-8"><meta http-equiv="refresh" content="5"><title>Starting</title>' +
+  '<body style="font:16px system-ui;display:grid;place-items:center;height:90vh;color:#444">' +
+  "<p>Your Clubedge app is starting. This page reloads by itself.</p>";
+
+const server = http.createServer((req, res) => {
+  const upstream = http.request(
+    { host: "127.0.0.1", port: Number(upstreamPort), method: req.method, path: req.url, headers: toLocal(req.headers) },
+    (answer) => {
+      const headers = { ...answer.headers };
+      if (headers.location && publicOrigin) headers.location = headers.location.replace(local, publicOrigin);
+      res.writeHead(answer.statusCode ?? 502, headers);
+      answer.pipe(res);
+    },
+  );
+  upstream.on("error", () => {
+    if (res.headersSent) return res.destroy();
+    res.writeHead(503, { "content-type": "text/html; charset=utf-8", "retry-after": "5" });
+    res.end(starting);
+  });
+  req.pipe(upstream);
+});
+
+// Hot reload: pass WebSocket upgrades through with the same local headers.
+server.on("upgrade", (req, socket, head) => {
+  const upstream = net.connect(Number(upstreamPort), "127.0.0.1", () => {
+    const lines = [req.method + " " + req.url + " HTTP/1.1"];
+    for (const [name, value] of Object.entries(toLocal(req.headers))) {
+      for (const item of [].concat(value)) lines.push(name + ": " + item);
+    }
+    upstream.write(lines.join("\\r\\n") + "\\r\\n\\r\\n");
+    if (head && head.length) upstream.write(head);
+    upstream.pipe(socket);
+    socket.pipe(upstream);
+  });
+  upstream.on("error", () => socket.destroy());
+  socket.on("error", () => upstream.destroy());
+});
+
+server.listen(Number(port), "0.0.0.0");
+`;

package/dist/index.js

@@ -11,6 +11,7 @@ import { readBundledTemplate, resolveTemplateSource } from "./core/source.js";
 import { cliUrl, cliVersion, siteUrl, starterPin } from "./package-info.js";
 import { runDoctor, showStatus } from "./inspect.js";
 import { changeProject } from "./modify.js";
+import { tryOnRailway } from "./try.js";
 import { initializeGit } from "./steps/git.js";
 import { detectLauncher, installDependencies, resolvePnpm } from "./steps/install.js";
 import { displayNameFromPackageName, packageNameFromDirectory } from "./utils/names.js";
@@ -234,6 +235,10 @@ export async function main(argv = process.argv.slice(2)) {
             intro("Check this project's setup");
             await runDoctor(args);
         }
+        else if (args.command.name === "try") {
+            intro("Try a project on a free Railway VM");
+            await tryOnRailway(args);
+        }
         else {
             const intros = {
                 add: "Add a module to this project",

package/dist/try.js

@@ -0,0 +1,213 @@
+import { cancel, confirm, isCancel, log, note, outro, spinner } from "@clack/prompts";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { userInfo } from "node:os";
+import { dirname } from "node:path";
+import process from "node:process";
+import ssh2 from "ssh2";
+import { UsageError } from "./cli/args.js";
+import { bold, dim } from "./cli/ui.js";
+import { hostKeyFingerprint, parseRailwayStatus, proxySource, railwayFreeVmUrl, railwayHost, railwayKeyPath, railwayTermsUrl, remoteDevLog, remoteLog, remoteProxyPath, remoteScriptPath, shellQuote, trustedHostKeys, tryCreateArgs, tryModules, tryScript, } from "./core/railway.js";
+import { cliVersion } from "./package-info.js";
+const { Client, utils } = ssh2;
+/** The CLI's own key: created on first use, then reused so later runs reach the same VM. */
+async function loadOrCreateKey(path) {
+    try {
+        return { privateKey: await readFile(path, "utf8"), created: false };
+    }
+    catch {
+        const pair = utils.generateKeyPairSync("ed25519", { comment: "create-clubedge-app try" });
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, pair.private, { mode: 0o600 });
+        await chmod(path, 0o600).catch(() => { });
+        await writeFile(`${path}.pub`, `${pair.public}\n`);
+        return { privateKey: pair.private, created: true };
+    }
+}
+/** Opens the SSH connection, accepting only Railway's pinned host key. */
+async function connect(privateKey) {
+    const trusted = trustedHostKeys();
+    let seen = "";
+    return await new Promise((resolve, reject) => {
+        const connection = new Client();
+        connection
+            .once("ready", () => resolve(connection))
+            .once("error", (error) => {
+            if (seen && !trusted.includes(seen)) {
+                reject(new Error(`${railwayHost} presented an unknown host key (${seen}), so the CLI did not connect. ` +
+                    `If Railway announced a new key, set CLUBEDGE_RAILWAY_HOST_KEY=${seen} and run again.`));
+            }
+            else if (/authentication/i.test(error.message)) {
+                reject(new Error(`Railway refused the connection. The free VM may be paused or at its daily limit; see ${railwayFreeVmUrl}.`));
+            }
+            else {
+                reject(new Error(`Could not reach ${railwayHost}: ${error.message}`));
+            }
+        })
+            .connect({
+            host: railwayHost,
+            port: 22,
+            username: userInfo().username || "clubedge",
+            privateKey,
+            readyTimeout: 30_000,
+            keepaliveInterval: 15_000,
+            hostVerifier: (key) => {
+                seen = hostKeyFingerprint(key);
+                return trusted.includes(seen);
+            },
+        });
+    });
+}
+/**
+ * Runs a command on the VM. Railway's status line on stderr is taken out and parsed; stdout lines
+ * go to onLine as they arrive.
+ */
+async function exec(connection, command, { input, onLine } = {}) {
+    return await new Promise((resolve, reject) => {
+        connection.exec(command, (error, stream) => {
+            if (error)
+                return reject(error);
+            let stdout = "";
+            let stderr = "";
+            let pending = "";
+            stream.on("data", (chunk) => {
+                const text = chunk.toString();
+                stdout += text;
+                pending += text;
+                const lines = pending.split("\n");
+                pending = lines.pop() ?? "";
+                for (const line of lines)
+                    onLine?.(line.replace(/\r$/, ""));
+            });
+            stream.stderr.on("data", (chunk) => (stderr += chunk.toString()));
+            stream.once("close", (code) => {
+                if (pending)
+                    onLine?.(pending);
+                try {
+                    resolve({ code: code ?? 1, stdout, vm: parseRailwayStatus(stderr) });
+                }
+                catch (parseError) {
+                    reject(parseError);
+                }
+            });
+            if (input !== undefined)
+                stream.end(input);
+            else
+                stream.end();
+        });
+    });
+}
+/** Writes a file on the VM through the command's stdin. */
+async function upload(connection, path, content) {
+    const { code } = await exec(connection, `cat > ${shellQuote(path)}`, { input: content });
+    if (code !== 0)
+        throw new Error(`Could not write ${path} on the VM.`);
+}
+// A spinner line wider than the terminal wraps, and each frame then prints a new line.
+const fit = (text) => {
+    const width = (process.stdout.columns ?? 80) - 6;
+    return text.length > width ? `${text.slice(0, width - 1)}…` : text;
+};
+function minutesLeft(until) {
+    return Math.max(0, Math.round((until.getTime() - Date.now()) / 60_000));
+}
+async function agree(args, keyPath) {
+    note([
+        "This creates a free, temporary Linux VM on Railway and runs a new project there.",
+        "",
+        `• No Railway account is needed. You get 60 minutes, then 24 hours to claim the VM to keep it.`,
+        `• The preview opens only from your network until you claim the VM.`,
+        `• Railway allows 3 free VMs per network per day.`,
+        `• The CLI uses its own SSH key, ${keyPath}; your ~/.ssh is not used.`,
+        `• Railway's terms apply: ${railwayTermsUrl}`,
+        "",
+        dim(`Experimental: Railway can change or pause its free VM (${railwayFreeVmUrl}).`),
+    ].join("\n"), "Try it on Railway");
+    if (args.yes)
+        return true;
+    if (!process.stdin.isTTY) {
+        throw new UsageError("try creates a VM on Railway. Run it in a terminal to confirm, or pass --yes to agree.");
+    }
+    const answer = await confirm({ message: "Create the VM?", initialValue: true });
+    return !isCancel(answer) && answer;
+}
+export async function tryOnRailway(args) {
+    const modules = tryModules(args.modules);
+    const keyPath = railwayKeyPath();
+    const createArgs = tryCreateArgs({ framework: args.framework, modules, ref: args.ref });
+    if (args.dryRun) {
+        log.message([
+            `• Connect to ${railwayHost} with the key in ${keyPath}`,
+            `• Create the project: create-clubedge-app@${cliVersion} my-app ${createArgs.join(" ")}`,
+            "• Start the local database (PGlite), migrate, and start the app behind the preview URL",
+        ].join("\n"));
+        outro("Dry run: no VM was created. Run again without --dry-run to try it.");
+        return;
+    }
+    if (!(await agree(args, keyPath))) {
+        cancel("No VM was created.");
+        return;
+    }
+    const progress = spinner();
+    progress.start(`Connecting to ${railwayHost}`);
+    let spinning = "connect";
+    let connection;
+    try {
+        const key = await loadOrCreateKey(keyPath);
+        if (key.created)
+            log.info(`Created an SSH key for Railway in ${keyPath}`);
+        connection = await connect(key.privateKey);
+        const { vm } = await exec(connection, "true");
+        if (!vm)
+            throw new Error(`${railwayHost} did not describe the VM. Railway may have changed its free VM; see ${railwayFreeVmUrl}.`);
+        progress.stop(`VM ready, ${minutesLeft(vm.expiresAt)} minutes to try it`);
+        spinning = "setup";
+        progress.start("Preparing the VM");
+        await upload(connection, remoteProxyPath, proxySource);
+        await upload(connection, remoteScriptPath, tryScript({ cliVersion, framework: args.framework, modules, ref: args.ref, previewUrl: vm.previewUrl }));
+        const tail = [];
+        let failure = "";
+        let directory = "my-app";
+        const started = Date.now();
+        const { code } = await exec(connection, `bash ${remoteScriptPath}`, {
+            onLine: (line) => {
+                if (line.startsWith("@@step "))
+                    progress.message(fit(`${line.slice(7)} (${Math.round((Date.now() - started) / 1000)}s)`));
+                else if (line.startsWith("@@log "))
+                    tail.push(line.slice(6));
+                else if (line.startsWith("@@fail "))
+                    failure = line.slice(7);
+                else if (line.startsWith("@@ready"))
+                    directory = line.slice(8).trim() || directory;
+            },
+        });
+        if (code !== 0 || failure) {
+            spinning = null;
+            progress.stop(failure || "Setup on the VM failed");
+            if (tail.length)
+                log.message(dim(tail.join("\n")));
+            throw new Error(`Setup on the VM failed. Its log is ${remoteLog}; read it with: ssh -i "${keyPath}" ${railwayHost} cat ${remoteLog}`);
+        }
+        spinning = null;
+        progress.stop(`The app is running in /app/${directory}`);
+        note([
+            `${bold("Preview")}  ${vm.previewUrl}`,
+            `${bold("Time")}     ${minutesLeft(vm.expiresAt)} minutes left (until ${vm.expiresAt.toLocaleTimeString()})`,
+            `${bold("Claim")}    ${vm.claimUrl}`,
+        ].join("\n"), "Your app on Railway");
+        log.warn("Keep the claim link private: whoever opens it takes over the VM, its files, and its URL.");
+        outro([
+            "The preview opens only from your network until you claim the VM. Claiming moves it to your Railway account.",
+            "",
+            `${dim("Shell")}  ssh -i "${keyPath}" ${railwayHost}`,
+            `${dim("Logs")}   ssh -i "${keyPath}" ${railwayHost} tail -f ${remoteDevLog}`,
+        ].join("\n"));
+    }
+    catch (error) {
+        if (spinning)
+            progress.stop(spinning === "connect" ? "Could not start a VM on Railway" : "Setup on the VM failed");
+        throw error;
+    }
+    finally {
+        connection?.end();
+    }
+}