@clubedge/create-clubedge-app 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to `create-clubedge-app` are documented here.
 
+## 0.22.0
+
+- Add `deploy`: `pnpm clubedge deploy` does the first deploy of a project that uses `deploy railway`, with Railway's CLI and your Railway login (#55).
+  - It asks first, then creates or reuses the Railway project, Postgres (and Redis with `cache redis`), the app's service, and a `*.up.railway.app` domain.
+  - It sets the variables it can: the database references, `APP_URL` and `NEXT_PUBLIC_APP_URL`, `PORT`, and a generated `BETTER_AUTH_SECRET` that later runs keep. `--env-file .env.production` adds your provider keys; the ones still unset are listed.
+  - It follows the deployment until Railway's final status: the migrations run before the release and `/api/health` is checked. On a failure it names the logs commands. Running it again reuses everything.
+  - Railway only for now; `--dry-run` shows the plan.
+- Default to Starter `v0.16.1` (#57): both Dockerfiles install dependencies in the build stage, so `node_modules` is no longer copied between stages, which made builds slow and timed out a first build on Railway.
+- Release drafts list a Starter pin pull request once (#54).
+
+## 0.21.0
+
+- Default to Starter `v0.16.0` (#52), which adds:
+  - Starter upgrades as pull requests: every project gets `.github/workflows/clubedge-upgrade.yml`, which checks every Monday for a newer Starter release and opens a pull request with `pnpm clubedge upgrade`'s result, the release notes, and anything left to resolve, so the project's own CI tests the upgrade before it is merged.
+  - GitHub Actions on their Node 24 versions in `ci.yml` and `deploy.yml`, with Linux jobs on Ubuntu 24.04.
+  - Steadier tests: PGlite starts once per test file, with room for slow CI runners.
+- Release tooling for maintainers (#51): `pnpm release patch|minor|major` opens the release pull request with a drafted changelog, `pnpm release tag` publishes it, and the Starter pin workflow opens a pull request when the Starter publishes a release.
+- CI names the generated project's failing check, in an annotation and the job summary (#50).
+
 ## 0.20.0
 
 - Conflicts are easier to resolve after `add`, `remove`, and `upgrade`:

package/README.md

@@ -127,7 +127,7 @@ pnpm dlx @clubedge/create-clubedge-app my-app --yes --no-git --framework tanstac
 pnpm dlx @clubedge/create-clubedge-app my-app --ref main
 
 # Reproduce a specific Starter release or commit
-pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.15.0
+pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.16.1
 pnpm dlx @clubedge/create-clubedge-app my-app --ref <commit-sha>
 
 # Test local Starter changes before releasing them
@@ -146,7 +146,7 @@ pnpm clubedge add email resend payments stripe              # several modules as
 pnpm clubedge remove storage payments
 pnpm dlx @clubedge/create-clubedge-app add infra local --dry-run
 pnpm dlx @clubedge/create-clubedge-app@latest upgrade        # to the newest CLI's Starter release
-pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.15.0 # or a specific tag, branch, or commit
+pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.16.1 # or a specific tag, branch, or commit
 ```
 
 The CLI renders the project twice, from the Starter commit and modules recorded in your `package.json` and from the new state, and merges the difference into your project. The new state has other modules for `add` and `remove`, and the newer Starter with the same modules for `upgrade`. Modules a newer Starter introduces start as `none` where possible, so an upgrade never adds a service on its own.
@@ -189,32 +189,44 @@ Inside a project, `pnpm clubedge try` uploads that project instead, to share wor
 
 When the app is ready, the CLI opens the preview in your browser (`--no-open` turns that off) and asks whether to share it: claiming the VM, a free Railway sign-up, is what makes the URL work for anyone. `--claim` opens the claim page without asking. `try --status` shows the last VM's preview, time left, and claim link; it connects only while the VM is running, so it never creates a new one. To open the app from another network yourself, forward it: `ssh -i <key> -N -L 3000:127.0.0.1:3000 railway.new`, then http://localhost:3000 (the CLI prints the exact command). The CLI asks before creating anything (`--yes` agrees), keeps its own SSH key in your config directory (`~/.config/clubedge`, or `%APPDATA%\clubedge` on Windows) apart from `~/.ssh`, and connects only to Railway's known host key. Railway's [terms](https://railway.com/legal/terms) apply, and Railway can change or pause its free VM.
 
+## Deploy to Railway
+
+In a project created with `--deploy railway` (or switched with `pnpm clubedge add deploy railway`), one command does the first deploy:
+
+```sh
+pnpm clubedge deploy                              # asks before creating anything
+pnpm clubedge deploy --env-file .env.production   # with your production provider keys
+pnpm clubedge deploy --dry-run                    # show the plan, create nothing
+```
+
+With [Railway's CLI](https://docs.railway.com/cli) (the installed `railway`, or `npx @railway/cli`) and your Railway login, it creates or reuses a project named after the package, Postgres (and Redis with `cache redis`), the app's service, and a `*.up.railway.app` domain. It sets the variables it can: `DATABASE_URL` and `REDIS_URL` as references to those databases, `APP_URL` and `NEXT_PUBLIC_APP_URL`, `PORT`, and a generated `BETTER_AUTH_SECRET` that later runs keep. Values from `--env-file` come on top; the variables `.env.example` lists that nothing sets are reported, for the modules that need them (storage, email, payments). Then `railway up` builds the Dockerfile, Railway runs the migrations before the release and checks `/api/health`, and the URL is printed. Running `deploy` again reuses everything, so it also adds variables and ships a new release. Railway bills usage on your plan.
+
 ## Version relationship
 
 Each CLI release is tested against one specific Starter release:
 
 ```text
-create-clubedge-app v0.20.0
+create-clubedge-app v0.22.0
         |
         v
-Clubedge Starter v0.15.0
-commit 239f9e9fd575165d72f70a91592cafbd43bb7574
+Clubedge Starter v0.16.1
+commit 72ff89e53a55a4e4a6262b364ce73be3b1c7a6b9
 ```
 
 The current relationship is:
 
 | CLI release | Default Starter release | Meaning |
 | --- | --- | --- |
-| `create-clubedge-app@0.20.0` | `clubedge-starter@v0.15.0` | The CLI's required, tested default |
+| `create-clubedge-app@0.22.0` | `clubedge-starter@v0.16.1` | The CLI's required, tested default |
 
 This means the same CLI version always scaffolds the same Starter revision by default. The CLI does not silently follow Starter `main`.
 
-The `v0.15.0` tag is expected to resolve to commit
-`239f9e9fd575165d72f70a91592cafbd43bb7574`. The CLI verifies this before
+The `v0.16.1` tag is expected to resolve to commit
+`72ff89e53a55a4e4a6262b364ce73be3b1c7a6b9`. The CLI verifies this before
 scaffolding with the default reference and fails rather than silently using a
 moved tag.
 
-When the Starter changes, its maintainers first publish a new versioned release, such as `v0.15.0`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
+When the Starter changes, its maintainers first publish a new versioned release, such as `v0.16.1`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
 
 Every generated project records its CLI version, Starter repository, Starter ref, Starter commit, framework, and modules in `package.json` and `README.md`.
 
@@ -269,15 +281,15 @@ CI packs the CLI with `npm pack`, scaffolds clean projects from the packed tarba
 1. Make and validate changes in `clubedge-starter`.
 2. Run lint, typecheck, unit tests, browser tests, and production build.
 3. Update the Starter package versions.
-4. Commit `main`, create a release tag such as `v0.15.0`, and publish the Starter release.
+4. Commit `main`, create a release tag such as `v0.16.1`, and publish the Starter release.
 
 ### CLI maintainers
 
-1. Set `clubedge.starterRef` and `clubedge.starterCommit` in [`package.json`](package.json) to the new tested Starter tag, and bump `version`.
-2. Update the version relationship table and changelog.
-3. Generate a clean project from that exact tag.
-4. Run install, lint, typecheck, unit tests, browser tests, production build, and runtime smoke checks.
-5. Publish a new CLI version only after the generated-project verification passes.
+1. When the Starter publishes a release, the [Starter pin](.github/workflows/starter-pin.yml) workflow opens a pull request that moves `clubedge.starterRef` and `clubedge.starterCommit` in [`package.json`](package.json), and the docs that name them, to the new tag (daily, or run it by hand; locally: `pnpm release pin vX.Y.Z`). Its CI generates clean projects from that exact tag and runs install, lint, typecheck, unit tests, browser tests, production build, and runtime smoke checks. Merge it once they pass.
+2. `pnpm release patch|minor|major` (from an up-to-date `main`; add `--dry-run` to preview) opens the release pull request: it bumps `version`, updates the version relationship here and in CONTRIBUTING, adds the release table rows for a minor or major release, and drafts the changelog entry from the pull requests merged since the last tag. Edit the draft in that pull request: it becomes the GitHub Release page.
+3. After it is merged, `pnpm release tag` tags `main`. The Release workflow checks and publishes it to npm, creates the GitHub Release page from the changelog entry, and smoke-tests the published package.
+
+The pin workflow needs **Settings → Actions → General → Allow GitHub Actions to create and approve pull requests**, or a `STARTER_PIN_TOKEN` secret (a fine-grained token with contents and pull requests write), which also lets its pull request start CI by itself.
 
 The required CI job always tests the pinned default. The scheduled compatibility job tests Starter `main` early, but unreleased Starter changes must not change the stable CLI default.
 
@@ -299,6 +311,8 @@ Each phase ends with a Starter release and a CLI release pinned to it. The full
 | 0.18.0 | v0.15.0 | `try`: a new project on a free, temporary Railway VM, with a preview URL and a claim link (experimental) |
 | 0.19.0 | v0.15.0 | `pnpm clubedge try` uploads an existing project to the VM; the preview opens in the browser |
 | 0.20.0 | v0.15.0 | The Starter's version of each conflicted file in `.clubedge/incoming/`, several modules at once, sharing a `try` preview by claiming the VM, `try --status` |
+| 0.21.0 | v0.16.0 | Starter v0.16.0: upgrades delivered as pull requests, Node 24 actions; release tooling for maintainers |
+| 0.22.0 | v0.16.1 | `pnpm clubedge deploy`: a guided first deploy to Railway; faster Docker builds |
 | next | | Show the Starter's version of a conflicted file next to yours |
 
 ## Community

package/dist/cli/args.js

@@ -16,6 +16,7 @@ const OPTIONS = {
     open: { type: "boolean", default: true },
     claim: { type: "boolean", default: false },
     status: { type: "boolean", default: false },
+    "env-file": { type: "string" },
     help: { type: "boolean", short: "h", default: false },
     version: { type: "boolean", short: "v", default: false },
 };
@@ -89,6 +90,9 @@ export function parseCliArgs(argv) {
     if (!creates && command.name !== "upgrade" && values.ref !== undefined) {
         throw new UsageError("--ref only applies when creating or upgrading a project.");
     }
+    if (command.name !== "deploy" && values["env-file"] !== undefined) {
+        throw new UsageError("--env-file only applies to deploy.");
+    }
     if (command.name !== "try" && (values.claim || values.status)) {
         throw new UsageError("--claim and --status only apply to try.");
     }
@@ -120,6 +124,7 @@ export function parseCliArgs(argv) {
         open: values.open,
         claim: values.claim,
         status: values.status,
+        envFile: values["env-file"],
         help: values.help,
         version: values.version,
     };
@@ -156,6 +161,11 @@ function parseCommand(positionals) {
             throw new UsageError(`Usage: ${name}, run inside a project.`);
         return { name };
     }
+    if (name === "deploy") {
+        if (module !== undefined)
+            throw new UsageError("Usage: deploy [--env-file <path>], run inside a project.");
+        return { name };
+    }
     if (name === "try") {
         if (module !== undefined) {
             throw new UsageError("Usage: try [--framework <id>] [module flags] (a new project), or try inside a project to upload it.");

package/dist/cli/ui.js

@@ -92,9 +92,10 @@ Usage:
   pnpm dlx @clubedge/create-clubedge-app status                  (inside a project)
   pnpm dlx @clubedge/create-clubedge-app doctor                  (inside a project)
   pnpm dlx @clubedge/create-clubedge-app try [options]           (experimental)
+  pnpm dlx @clubedge/create-clubedge-app deploy [options]        (inside a project)
 
   Inside a project with the clubedge script, use pnpm clubedge add, remove,
-  upgrade, status, doctor, or try. Without a module or option, add and remove ask
+  upgrade, status, doctor, try, or deploy. Without a module or option, add and remove ask
   for them.
 
   add and remove change modules of an existing project, several at once as one
@@ -126,6 +127,7 @@ ${selectionHelp(manifest)}
   --no-open               try: do not open the preview in the browser
   --claim                 try: open the page that claims the VM, to share the preview
   --status                try: the last VM's preview, time left, and claim link
+  --env-file <path>       deploy: production values for the service, such as .env.production
   -y, --yes               Accept defaults and never prompt (default directory: my-app)
   --no-install            Skip dependency installation
   --no-git                Skip Git repository initialization

package/dist/core/deploy.js

@@ -0,0 +1,131 @@
+// What `deploy` sets up on Railway for a project, as pure functions: the service name, the
+// production variables, and reading the Railway CLI's output. src/deploy.ts runs the CLI.
+/** The port the production image listens on (the Starter's Dockerfile sets PORT=3000). */
+export const appPort = 3000;
+/** Railway's names for the databases `railway add --database` creates, used in references. */
+export const railwayDatabases = { postgres: "Postgres", redis: "Redis" };
+/** A Railway service name from the package name: lowercase letters, digits, and dashes. */
+export function serviceName(packageName) {
+    const name = packageName.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+    return name || "web";
+}
+/** The databases a project needs on Railway: Postgres always (Drizzle), Redis with the redis cache. */
+export function databasesFor(modules) {
+    return modules.cache === "redis" ? ["postgres", "redis"] : ["postgres"];
+}
+/** The variable names a project's .env.example lists, in order. */
+export function exampleKeys(example) {
+    const keys = example
+        .split(/\r?\n/)
+        .map((line) => /^([A-Z][A-Z0-9_]*)=/.exec(line.trim())?.[1])
+        .filter((key) => Boolean(key));
+    return [...new Set(keys)];
+}
+/** KEY=value lines of an env file; quotes around a value are removed, comments skipped. */
+export function parseEnvFile(text) {
+    const values = {};
+    for (const line of text.split(/\r?\n/)) {
+        const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+        if (!match)
+            continue;
+        const raw = match[2].trim();
+        // A quoted value keeps everything inside the quotes, and may still have a comment after them.
+        const quoted = /^(["'])(.*?)\1\s*(?:#.*)?$/.exec(raw);
+        values[match[1]] = quoted ? quoted[2] : raw.replace(/\s+#.*$/, "");
+    }
+    return values;
+}
+/**
+ * The service's production variables. The CLI provides what it can: references to Railway's
+ * databases, a generated Better Auth secret (unless the service already has one), the public URL,
+ * and the port. Values from --env-file come next and win over those, except the database
+ * references, which must point at Railway's databases. Everything else the example lists is
+ * reported as unset; values the service already has count as set.
+ */
+export function planVariables(input) {
+    const { modules, keys, url, existing, envFile, secret } = input;
+    const reference = (database, variable) => `\${{${database}.${variable}}}`;
+    const provided = {
+        NODE_ENV: "production",
+        PORT: String(appPort),
+        DATABASE_URL: reference(railwayDatabases.postgres, "DATABASE_URL"),
+        ...(modules.cache === "redis" ? { REDIS_URL: reference(railwayDatabases.redis, "REDIS_URL") } : {}),
+    };
+    // The public URL under both names: TanStack Start reads APP_URL, Next.js NEXT_PUBLIC_APP_URL.
+    const set = { ...provided, APP_URL: url, NEXT_PUBLIC_APP_URL: url };
+    if (modules.auth === "better-auth" && !existing.BETTER_AUTH_SECRET)
+        set.BETTER_AUTH_SECRET = secret();
+    for (const [key, value] of Object.entries(envFile)) {
+        if (key === "DATABASE_URL" || key === "REDIS_URL" || value === "")
+            continue;
+        set[key] = value;
+    }
+    const unset = keys.filter((key) => set[key] === undefined && !existing[key]);
+    return { set, unset };
+}
+/** The public domain in `railway domain` output (JSON or text). */
+export function parseRailwayDomain(output) {
+    const domain = /([a-z0-9-]+(?:\.[a-z0-9-]+)*\.up\.railway\.app)/i.exec(output)?.[1];
+    return domain ? domain.toLowerCase() : null;
+}
+/** The service names in `railway status --json`, wherever the CLI puts them. */
+export function serviceNames(status) {
+    const names = new Set();
+    const visit = (value, inServices) => {
+        if (Array.isArray(value))
+            return value.forEach((item) => visit(item, inServices));
+        if (!value || typeof value !== "object")
+            return;
+        for (const [key, child] of Object.entries(value)) {
+            if (inServices && key === "name" && typeof child === "string")
+                names.add(child);
+            visit(child, inServices || key === "services");
+        }
+    };
+    visit(status, false);
+    return [...names];
+}
+/** `railway variable list --json`: a KEY -> value object, or an array of { name, value }. */
+export function parseVariables(output) {
+    try {
+        const value = JSON.parse(output);
+        if (Array.isArray(value)) {
+            return Object.fromEntries(value
+                .filter((item) => typeof item?.name === "string")
+                .map((item) => [item.name, String(item.value ?? "")]));
+        }
+        if (value && typeof value === "object") {
+            return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, String(child ?? "")]));
+        }
+    }
+    catch {
+        // Not JSON: no variables known.
+    }
+    return {};
+}
+/** Deployment statuses Railway does not move on from. */
+export const finalStatuses = ["SUCCESS", "FAILED", "CRASHED", "REMOVED", "SKIPPED"];
+/** The deployment `railway up` started, from the dashboard link it prints (`...?id=<uuid>`). */
+export function parseDeploymentId(output) {
+    return /[?&]id=([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i.exec(output)?.[1] ?? null;
+}
+/**
+ * A deployment's status from `railway deployment list --json` (newest first): the one with `id`,
+ * or else the newest created at or after `since`. Null while Railway does not list it yet.
+ */
+export function deploymentStatus(output, id, since) {
+    let list;
+    try {
+        list = JSON.parse(output);
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(list))
+        return null;
+    const deployments = list.filter((item) => typeof item?.id === "string" && typeof item?.status === "string");
+    const found = id
+        ? deployments.find((deployment) => deployment.id === id)
+        : deployments.find((deployment) => deployment.createdAt && new Date(deployment.createdAt).getTime() >= since.getTime() - 5_000);
+    return found ? { id: found.id, status: found.status } : null;
+}

package/dist/deploy.js

@@ -0,0 +1,186 @@
+// `deploy`: a guided first deploy to Railway, with Railway's own CLI. It creates (or reuses) the
+// project, its databases, the app's service and domain, sets the production variables, and runs
+// `railway up`; Railway then builds the image, runs the migrations, and checks /api/health.
+import { cancel, confirm, isCancel, log, note, outro, spinner } from "@clack/prompts";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import process from "node:process";
+import { UsageError } from "./cli/args.js";
+import { bold, dim } from "./cli/ui.js";
+import { appPort, databasesFor, deploymentStatus, exampleKeys, finalStatuses, parseDeploymentId, parseEnvFile, parseRailwayDomain, parseVariables, planVariables, railwayDatabases, serviceName, serviceNames, } from "./core/deploy.js";
+import { readProject } from "./core/project.js";
+import { cliCommand } from "./modify.js";
+import { commandSucceeds } from "./utils/process.js";
+const railwayTermsUrl = "https://railway.com/legal/terms";
+const deployDocsUrl = "https://starter.clubedge.live/docs/starter/deploy";
+// Package manager shims (npx.cmd, railway.cmd) need a shell on Windows. Every argument passed
+// here is a plain word; values go through stdin, so the shell never sees them.
+const useShell = process.platform === "win32";
+/** The Railway CLI: the installed `railway`, or the npm package through npx. */
+async function railwayCli() {
+    if (await commandSucceeds("railway", ["--version"]))
+        return ["railway"];
+    return ["npx", "--yes", "@railway/cli"];
+}
+async function railway(cli, args, options = {}) {
+    const [command, ...prefix] = cli;
+    return await new Promise((resolvePromise, reject) => {
+        const child = spawn(command, [...prefix, ...args], {
+            shell: useShell,
+            stdio: options.inherit ? "inherit" : ["pipe", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (chunk) => (stdout += chunk.toString()));
+        child.stderr?.on("data", (chunk) => (stderr += chunk.toString()));
+        child.once("error", reject);
+        // close, not exit: it fires once stdout and stderr are fully read, so JSON output is never cut off.
+        child.once("close", (code) => {
+            if (code === 0)
+                resolvePromise(stdout.trim());
+            else
+                reject(new Error(`railway ${args[0]} failed${stderr.trim() ? `: ${stderr.trim().split("\n").slice(-3).join(" ")}` : "."}`));
+        });
+        if (child.stdin) {
+            // A command that exits before reading its input must not crash the CLI with EPIPE.
+            child.stdin.on("error", () => { });
+            child.stdin.end(options.input ?? "");
+        }
+    });
+}
+const attempt = async (run) => run().catch(() => null);
+async function agree(args, service, databases) {
+    note([
+        "This deploys the project to Railway, in your Railway account:",
+        "",
+        `• A project with ${databases.map((db) => railwayDatabases[db]).join(" and ")}, and a service "${service}" with a public *.up.railway.app domain.`,
+        "• The production variables Railway can provide; your provider keys come from --env-file.",
+        "• Railway builds the Dockerfile, runs the migrations before the release, and checks /api/health; the first build takes several minutes.",
+        "",
+        `Railway bills usage on your plan. Running deploy again reuses all of it. Railway's terms: ${railwayTermsUrl}`,
+    ].join("\n"), "Deploy to Railway");
+    if (args.yes)
+        return true;
+    if (!process.stdin.isTTY)
+        throw new UsageError("deploy creates resources in your Railway account. Run it in a terminal to confirm, or pass --yes.");
+    const answer = await confirm({ message: "Deploy?", initialValue: true });
+    return !isCancel(answer) && answer;
+}
+export async function deployProject(args) {
+    const project = await readProject(process.cwd());
+    const cli = await cliCommand(project);
+    const platform = project.modules.deploy ?? "docker";
+    if (platform !== "railway") {
+        throw new UsageError(`deploy sets up Railway for now, and this project deploys with "${platform}". Switch with \`${cli} add deploy railway\`, or follow ${deployDocsUrl} for ${platform}.`);
+    }
+    const service = serviceName(project.identity.packageName);
+    const databases = databasesFor(project.modules);
+    const keys = exampleKeys(await readFile(join(project.root, ".env.example"), "utf8").catch(() => ""));
+    const envFile = args.envFile ? parseEnvFile(await readFile(resolve(process.cwd(), args.envFile), "utf8")) : {};
+    const secret = () => randomBytes(32).toString("hex");
+    if (args.dryRun) {
+        const preview = planVariables({ modules: project.modules, keys, url: "https://<service>.up.railway.app", existing: {}, envFile, secret: () => "<generated>" });
+        log.message([
+            `• Railway project "${service}" with ${databases.join(" and ")}, and the service "${service}"`,
+            `• A *.up.railway.app domain for port ${appPort}`,
+            `• Variables: ${Object.keys(preview.set).join(", ")}`,
+            ...(preview.unset.length ? [`• Not set: ${preview.unset.join(", ")}`] : []),
+            `• railway up: build, migrations, health check`,
+        ].join("\n"));
+        outro("Dry run: nothing was created. Run again without --dry-run to deploy.");
+        return;
+    }
+    if (!(await agree(args, service, databases))) {
+        cancel("Nothing was deployed.");
+        return;
+    }
+    const progress = spinner();
+    progress.start("Preparing the Railway CLI");
+    const rw = await railwayCli();
+    // The project's directory, so Railway links it there.
+    process.chdir(project.root);
+    if (!(await attempt(() => railway(rw, ["whoami"])))) {
+        progress.stop("Signing in to Railway");
+        if (!process.stdin.isTTY)
+            throw new UsageError("Sign in to Railway first with `railway login`, or set RAILWAY_API_TOKEN.");
+        await railway(rw, ["login"], { inherit: true });
+        progress.start("Signed in");
+    }
+    progress.message("Finding or creating the Railway project");
+    let status = await attempt(() => railway(rw, ["status", "--json"]));
+    if (!status) {
+        await railway(rw, ["init", "--name", service, "--json"]);
+        status = await attempt(() => railway(rw, ["status", "--json"]));
+    }
+    let existing = [];
+    try {
+        existing = serviceNames(JSON.parse(status ?? "{}"));
+    }
+    catch {
+        // Unknown status format: create what is missing, as for a new project.
+    }
+    for (const database of databases) {
+        if (existing.includes(railwayDatabases[database]))
+            continue;
+        progress.message(`Adding ${railwayDatabases[database]}`);
+        await railway(rw, ["add", "--database", database]);
+    }
+    if (!existing.includes(service)) {
+        progress.message(`Adding the service "${service}"`);
+        await railway(rw, ["add", "--service", service]);
+    }
+    progress.message("Creating the public domain");
+    const listed = await attempt(() => railway(rw, ["domain", "list", "--service", service]));
+    const domain = parseRailwayDomain(listed ?? "") ??
+        parseRailwayDomain(await railway(rw, ["domain", "--service", service, "--port", String(appPort), "--json"]));
+    if (!domain)
+        throw new Error("Railway created no *.up.railway.app domain. Create one in the service's settings, then run deploy again.");
+    const url = `https://${domain}`;
+    progress.message("Setting the production variables");
+    const current = parseVariables((await attempt(() => railway(rw, ["variable", "list", "--service", service, "--json"]))) ?? "");
+    const plan = planVariables({ modules: project.modules, keys, url, existing: current, envFile, secret });
+    for (const [key, value] of Object.entries(plan.set)) {
+        if (current[key] === value)
+            continue;
+        await railway(rw, ["variable", "set", key, "--stdin", "--service", service, "--skip-deploys"], { input: value });
+    }
+    progress.stop(`Railway is ready: ${url}`);
+    // Start the deploy detached, then follow its status: `railway up` can return before the build
+    // ends, and only Railway's final status says whether the release went live.
+    const deploying = spinner();
+    deploying.start("Uploading the project");
+    const started = new Date();
+    const upload = await railway(rw, ["up", "--service", service, "--detach"]);
+    const id = parseDeploymentId(upload);
+    let deployment = "QUEUED";
+    const deadline = Date.now() + 45 * 60_000;
+    while (!finalStatuses.includes(deployment)) {
+        if (Date.now() > deadline)
+            break;
+        const elapsed = Math.round((Date.now() - started.getTime()) / 1000);
+        deploying.message(`Railway: ${deployment.toLowerCase()} (${Math.floor(elapsed / 60)}m ${elapsed % 60}s; the first build takes several minutes)`);
+        await new Promise((wait) => setTimeout(wait, 10_000));
+        const list = await attempt(() => railway(rw, ["deployment", "list", "--service", service, "--json"]));
+        deployment = deploymentStatus(list ?? "", id, started)?.status ?? deployment;
+    }
+    if (deployment !== "SUCCESS") {
+        deploying.stop(`The deploy ended as ${deployment}`);
+        throw new Error([
+            `Railway's deploy ended as ${deployment}. Read why with \`railway logs --build --service ${service}\` (the build) or \`railway logs --service ${service}\` (the app and its health check).`,
+            "A build that ran out of time (DeadlineExceeded) usually passes on a second try. Otherwise fix the cause and run deploy again: it reuses what exists.",
+        ].join("\n"));
+    }
+    deploying.stop("Deployed: the migrations ran and /api/health answered");
+    note([
+        `${bold("URL")}      ${url}`,
+        `${bold("Service")}  ${service}`,
+        ...(plan.unset.length ? ["", `${bold("Not set")}  ${plan.unset.join(", ")}`, dim("Set the ones your modules use: railway variable set KEY --stdin, or the dashboard.")] : []),
+    ].join("\n"), "Deployed to Railway");
+    outro([
+        `${dim("Logs")}      railway logs --service ${service}`,
+        `${dim("Dashboard")} railway open`,
+        `${dim("Again")}     ${cli} deploy   ${dim("(reuses the project; --env-file to add variables)")}`,
+    ].join("\n"));
+}

package/dist/index.js

@@ -11,6 +11,7 @@ import { readBundledTemplate, resolveTemplateSource } from "./core/source.js";
 import { cliUrl, cliVersion, siteUrl, starterPin } from "./package-info.js";
 import { runDoctor, showStatus } from "./inspect.js";
 import { changeProject } from "./modify.js";
+import { deployProject } from "./deploy.js";
 import { tryOnRailway } from "./try.js";
 import { initializeGit } from "./steps/git.js";
 import { detectLauncher, installDependencies, resolvePnpm } from "./steps/install.js";
@@ -235,6 +236,10 @@ export async function main(argv = process.argv.slice(2)) {
             intro("Check this project's setup");
             await runDoctor(args);
         }
+        else if (args.command.name === "deploy") {
+            intro("Deploy this project to Railway");
+            await deployProject(args);
+        }
         else if (args.command.name === "try") {
             intro("Try a project on a free Railway VM");
             await tryOnRailway(args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/create-clubedge-app",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Create a Next.js or TanStack Start application from the Clubedge Starter reference implementation.",
   "type": "module",
   "packageManager": "pnpm@10.9.0",
@@ -22,8 +22,8 @@
   },
   "clubedge": {
     "starterRepository": "Clubedge/clubedge-starter",
-    "starterRef": "v0.15.0",
-    "starterCommit": "239f9e9fd575165d72f70a91592cafbd43bb7574"
+    "starterRef": "v0.16.1",
+    "starterCommit": "72ff89e53a55a4e4a6262b364ce73be3b1c7a6b9"
   },
   "license": "Apache-2.0",
   "repository": {
@@ -48,7 +48,8 @@
     "test": "vitest run",
     "bundle-template": "node scripts/bundle-template.mjs",
     "start": "pnpm build && node ./bin/create.mjs",
-    "prepack": "pnpm build"
+    "prepack": "pnpm build",
+    "release": "node scripts/release.mjs"
   },
   "dependencies": {
     "@clack/prompts": "^1.8.1",

package/template/.github/workflows/ci.yml

@@ -8,13 +8,13 @@ permissions:
   contents: read
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/postgres
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
@@ -44,11 +44,11 @@ jobs:
       - run: pnpm audit --audit-level high
 
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
@@ -57,7 +57,7 @@ jobs:
       - run: pnpm test:e2e
 
   docker:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     services:
       postgres:
         image: postgres:17
@@ -70,7 +70,7 @@ jobs:
         options: >-
           --health-cmd pg_isready --health-interval 5s --health-timeout 5s --health-retries 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Build the production image
         run: docker build --tag app:ci .
       - name: Run the image's migrations twice; the second run changes nothing

package/template/.github/workflows/clubedge-upgrade.yml

@@ -0,0 +1,134 @@
+name: Starter upgrade
+
+# Checks every Monday for a newer Clubedge Starter release. When there is one, it runs
+# `pnpm clubedge upgrade` and opens a pull request with the release notes and anything left for
+# you to resolve, so your CI tests the upgrade before you merge it. Run it by hand from the
+# Actions tab, or delete this file to turn it off.
+#
+# It needs Settings -> Actions -> General -> "Allow GitHub Actions to create and approve pull
+# requests", or a CLUBEDGE_UPGRADE_TOKEN secret (a fine-grained token with contents and pull
+# requests write), which also lets the pull request start your CI by itself.
+on:
+  schedule:
+    - cron: "17 7 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+
+concurrency:
+  group: clubedge-upgrade
+  cancel-in-progress: false
+
+jobs:
+  upgrade:
+    # The Starter's own repository is the template every project comes from, not a project.
+    if: github.repository != 'Clubedge/clubedge-starter'
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Upgrade to the newest Starter release
+        id: upgrade
+        shell: bash
+        run: |
+          before=$(node -p "require('./package.json').clubedge?.starterRef ?? ''")
+          if [ -z "$before" ]; then
+            echo "package.json records no Starter release: this project was not created by create-clubedge-app."
+            exit 1
+          fi
+          # The newest CLI upgrades to the Starter release it is pinned to.
+          pnpm dlx @clubedge/create-clubedge-app@latest upgrade --no-install 2>&1 | tee "$RUNNER_TEMP/upgrade.log"
+          after=$(node -p "require('./package.json').clubedge.starterRef")
+          if [ "$after" = "$before" ] && [ -z "$(git status --porcelain)" ]; then
+            echo "Already on the newest Starter release, $before."
+            exit 0
+          fi
+          branch="clubedge/upgrade-$after"
+          if git ls-remote --exit-code --heads origin "$branch" >/dev/null; then
+            echo "$branch already exists: its pull request is open, or was closed on purpose."
+            exit 0
+          fi
+          # The lockfile follows the upgraded package.json files; a conflict there can stop it.
+          install="updated"
+          pnpm install --no-frozen-lockfile >"$RUNNER_TEMP/install.log" 2>&1 || install="failed"
+          {
+            echo "before=$before"
+            echo "after=$after"
+            echo "branch=$branch"
+            echo "install=$install"
+            if [ -d .clubedge/incoming ]; then echo "incoming=true"; fi
+          } >>"$GITHUB_OUTPUT"
+      - name: Keep the Starter's versions of conflicted files
+        if: steps.upgrade.outputs.incoming == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: starter-versions
+          path: .clubedge/incoming/
+          include-hidden-files: true
+      - name: Open the pull request
+        if: steps.upgrade.outputs.branch != ''
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.CLUBEDGE_UPGRADE_TOKEN || github.token }}
+          OWN_TOKEN: ${{ secrets.CLUBEDGE_UPGRADE_TOKEN != '' }}
+          BEFORE: ${{ steps.upgrade.outputs.before }}
+          AFTER: ${{ steps.upgrade.outputs.after }}
+          BRANCH: ${{ steps.upgrade.outputs.branch }}
+          INSTALL: ${{ steps.upgrade.outputs.install }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch --create "$BRANCH"
+          git add --all
+          git commit --quiet --message "chore: upgrade to Clubedge Starter $AFTER"
+          git push --quiet --set-upstream origin "$BRANCH"
+
+          repository=$(node -p "require('./package.json').clubedge.starterRepository ?? 'Clubedge/clubedge-starter'")
+          conflicts=$(git grep -l '^<<<<<<< yours' -- . || true)
+          {
+            echo "Upgrades this project from Clubedge Starter \`$BEFORE\` to [\`$AFTER\`](https://github.com/$repository/releases/tag/$AFTER), with \`pnpm clubedge upgrade\`. Your own edits are merged in; files you never changed take the new version."
+            echo
+            if [ -n "$conflicts" ]; then
+              echo "### Conflicts to resolve"
+              echo
+              echo "These files have lines both you and the Starter changed, marked \`<<<<<<< yours\` ... \`>>>>>>> clubedge\`. Keep your lines, the Starter's, or a mix, then delete the markers:"
+              echo
+              printf -- '- `%s`\n' $conflicts
+              echo
+              echo "The Starter's whole new version of each is in the **starter-versions** artifact of [the run]($RUN_URL), to compare with yours."
+              echo
+            fi
+            if [ "$INSTALL" = "failed" ]; then
+              echo "### pnpm install"
+              echo
+              echo "\`pnpm install\` did not complete on the upgraded project, usually because of a conflict in a \`package.json\`. Resolve it, then run \`pnpm install\` and commit \`pnpm-lock.yaml\`."
+              echo
+            fi
+            echo "### Before merging"
+            echo
+            echo "- Read the [release notes](https://github.com/$repository/releases/tag/$AFTER) for anything to do by hand."
+            echo "- Run \`pnpm db:migrate\` for new migrations, and your tests."
+            echo
+            echo "<details><summary>Upgrade output</summary>"
+            echo
+            echo '```'
+            tail -n 80 "$RUNNER_TEMP/upgrade.log"
+            echo '```'
+            echo
+            echo "</details>"
+            echo
+            echo "Opened by the Starter upgrade workflow (\`.github/workflows/clubedge-upgrade.yml\`)."
+          } >"$RUNNER_TEMP/body.md"
+          gh pr create --base "${{ github.event.repository.default_branch }}" --head "$BRANCH" \
+            --title "chore: upgrade to Clubedge Starter $AFTER" --body-file "$RUNNER_TEMP/body.md"
+          # Pull requests opened with the default token start no workflows: start CI on the branch.
+          if [ "$OWN_TOKEN" != "true" ] && [ -f .github/workflows/ci.yml ]; then
+            gh workflow run ci.yml --ref "$BRANCH" || echo "Start CI on $BRANCH by hand."
+          fi

package/template/.github/workflows/deploy.yml

@@ -12,26 +12,26 @@ jobs:
   # Builds the production image and publishes it to this repository's GitHub Container Registry
   # as ghcr.io/<owner>/<repository>, tagged with the commit and latest. No secret is needed.
   image:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
             type=sha
             type=raw,value=latest
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v7
         with:
           context: .
           push: true
@@ -40,9 +40,9 @@ jobs:
   # clubedge:end
   # clubedge:if deploy=fly
   fly:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: superfly/flyctl-actions/setup-flyctl@master
       # Builds on Fly's builders and runs the release command (migrations) before switching.
       - run: flyctl deploy --remote-only
@@ -51,9 +51,9 @@ jobs:
   # clubedge:end
   # clubedge:if deploy=railway
   railway:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Uploads this checkout; Railway builds the image and runs the pre-deploy migrations.
       - run: npx --yes @railway/cli@4 up --ci --service "$RAILWAY_SERVICE"
         env:
@@ -62,7 +62,7 @@ jobs:
   # clubedge:end
   # clubedge:if deploy=render
   render:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       # The service's deploy hook starts a deploy of its branch, with its pre-deploy migrations.
       - run: curl --fail --silent --show-error --request POST "$RENDER_DEPLOY_HOOK_URL"
@@ -71,15 +71,15 @@ jobs:
   # clubedge:end
   # clubedge:if deploy=vercel
   vercel:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
       VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
       VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
@@ -91,14 +91,14 @@ jobs:
   # clubedge:end
   # clubedge:if deploy=netlify
   netlify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
       NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm

package/template/Dockerfile

@@ -8,13 +8,13 @@ FROM base AS pruner
 COPY . .
 RUN pnpm dlx turbo@^2.5.0 prune @clubedge/web --docker
 
-FROM base AS deps
-COPY --from=pruner /app/out/json/ .
-RUN pnpm install --frozen-lockfile
-
+# Install in the stage that builds: copying node_modules from a separate install stage (many
+# small files) took minutes on some builders, and timed out a Railway build. The manifests come
+# first, so the install layer is still cached until a dependency changes.
 FROM base AS builder
 ENV NEXT_TELEMETRY_DISABLED=1
-COPY --from=deps /app/ .
+COPY --from=pruner /app/out/json/ .
+RUN pnpm install --frozen-lockfile
 COPY --from=pruner /app/out/full/ .
 COPY tsconfig.base.json ./
 RUN pnpm build

package/template/apps/start/Dockerfile

@@ -16,12 +16,12 @@ ARG APP_PACKAGE
 COPY . .
 RUN pnpm dlx turbo@^2.5.0 prune ${APP_PACKAGE} --docker
 
-FROM base AS deps
+# Install in the stage that builds: copying node_modules from a separate install stage (many
+# small files) took minutes on some builders, and timed out a Railway build. The manifests come
+# first, so the install layer is still cached until a dependency changes.
+FROM base AS builder
 COPY --from=pruner /app/out/json/ .
 RUN pnpm install --frozen-lockfile
-
-FROM base AS builder
-COPY --from=deps /app/ .
 COPY --from=pruner /app/out/full/ .
 COPY tsconfig.base.json ./
 RUN pnpm build

package/template/apps/start/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/start",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/web",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "scripts": {

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clubedge-starter-v1",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.9.0",

package/template/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/auth",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/auth-better-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/auth-better-auth",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Better Auth adapter for @clubedge/auth, storing users and sessions in your own PostgreSQL.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/auth-supabase/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/auth-supabase",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Supabase Auth adapter for @clubedge/auth.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/cache",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/cache-redis/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/cache-redis",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Redis rate limiter and cache for @clubedge/cache.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/core",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/db/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/db",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/email/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/email",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Email interface, console and in-memory providers, and message templates.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/email-resend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/email-resend",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Resend provider for @clubedge/email, through Resend's HTTP API.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/email-smtp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/email-smtp",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "SMTP provider for @clubedge/email, for any SMTP server.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/jobs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/jobs",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Background jobs interface: job definitions, a queue contract, and an in-memory queue.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/jobs-pg-boss/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/jobs-pg-boss",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "pg-boss provider for @clubedge/jobs: a job queue stored in the project's PostgreSQL.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/local-db/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/local-db",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "PostgreSQL for development without Docker: PGlite served over the PostgreSQL protocol.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/local-db/src/server.test.ts

@@ -8,11 +8,12 @@ describe("serveLocalPostgres", () => {
   let server: LocalPostgresServer;
   let url: string;
 
+  // Starting PGlite takes seconds on a busy CI runner.
   beforeAll(async () => {
     db = await PGlite.create();
     server = await serveLocalPostgres(db, { port: 0 });
     url = `postgresql://postgres:postgres@127.0.0.1:${server.port}/postgres`;
-  });
+  }, 30_000);
 
   afterAll(async () => {
     await server.close();
@@ -115,5 +116,5 @@ describe("LocalPostgresServer.close", () => {
       await client.end({ timeout: 0 });
       await db.close();
     }
-  });
+  }, 30_000);
 });

package/template/packages/observability/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/observability",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Observability interface: error reports and spans for @clubedge/core's telemetry hooks, and an in-memory provider for tests.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/observability-otel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/observability-otel",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "OpenTelemetry provider for @clubedge/observability: traces and error logs exported over OTLP to any collector.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/observability-sentry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/observability-sentry",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Sentry provider for @clubedge/observability: server and browser errors, traces, and source map uploads.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/payments/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/payments",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Provider-neutral payments: the PaymentProvider interface, billing logic, and subscription tables.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/payments/src/billing.test.ts

@@ -2,7 +2,7 @@ import { PGlite } from "@electric-sql/pglite";
 import { drizzle } from "drizzle-orm/pglite";
 import { migrate } from "drizzle-orm/pglite/migrator";
 import { fileURLToPath } from "node:url";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import { users, type Database } from "@clubedge/db";
 import { createBilling, findSubscription, isEntitled, NoBillingAccountError } from "./billing";
 import { subscriptions } from "./schema";
@@ -10,7 +10,7 @@ import type { PaymentEvent, PaymentProvider, SubscriptionSnapshot } from "./type
 
 const folder = (path: string) => fileURLToPath(new URL(path, import.meta.url));
 
-/** A fresh PostgreSQL (PGlite) with the app's and the payment migrations applied. */
+/** A PostgreSQL (PGlite) with the app's and the payment migrations applied. */
 async function database() {
   const client = await PGlite.create();
   const db = drizzle({ client });
@@ -20,7 +20,19 @@ async function database() {
     migrationsTable: "__drizzle_migrations_payments",
   });
   // The query builder is the same as the postgres.js driver's that the app uses.
-  return db as unknown as Database;
+  return { client, db: db as unknown as Database };
+}
+
+/** Empties the app's tables; the migration records live in the drizzle schema and stay. */
+async function emptyTables(client: PGlite) {
+  const { rows } = await client.query<{ name: string }>(
+    "select tablename as name from pg_tables where schemaname = 'public'",
+  );
+  if (rows.length) {
+    await client.exec(
+      `truncate ${rows.map(({ name }) => `"${name}"`).join(", ")} restart identity cascade`,
+    );
+  }
 }
 
 /** A provider whose next webhook event the test chooses. */
@@ -53,11 +65,22 @@ const snapshot = (
 const request = { body: "{}", headers: new Headers() };
 
 describe("createBilling", () => {
+  let client: PGlite;
   let db: Database;
   let userId: string;
 
+  // One database for the file: starting PGlite and migrating takes seconds on a busy CI runner,
+  // so each test starts from empty tables instead of a new database.
+  beforeAll(async () => {
+    ({ client, db } = await database());
+  }, 60_000);
+
+  afterAll(async () => {
+    await client.close();
+  });
+
   beforeEach(async () => {
-    db = await database();
+    await emptyTables(client);
     const [user] = await db
       .insert(users)
       .values({ email: "ada@example.com" })

package/template/packages/payments-stripe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/payments-stripe",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Stripe provider for @clubedge/payments: Checkout, the customer portal, and verified webhooks.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/storage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/storage",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/storage-s3/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/storage-s3",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "S3-compatible adapter for @clubedge/storage.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/storage-supabase/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/storage-supabase",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Supabase Storage adapter for @clubedge/storage.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/ui",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template.lock.json

@@ -1,7 +1,7 @@
 {
   "repository": "Clubedge/clubedge-starter",
-  "ref": "v0.15.0",
-  "commit": "239f9e9fd575165d72f70a91592cafbd43bb7574",
+  "ref": "v0.16.1",
+  "commit": "72ff89e53a55a4e4a6262b364ce73be3b1c7a6b9",
   "files": [
     ".dockerignore",
     ".env.example",
@@ -11,6 +11,7 @@
     ".github/ISSUE_TEMPLATE/feature_request.yml",
     ".github/pull_request_template.md",
     ".github/workflows/ci.yml",
+    ".github/workflows/clubedge-upgrade.yml",
     ".github/workflows/deploy.yml",
     "_gitignore",
     ".prettierignore",