@clubedge/create-clubedge-app 0.24.0 → 0.24.1

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to `create-clubedge-app` are documented here.
 
+## 0.24.1
+
+- Default to Starter `v0.17.1` (#65), which fixes deployed Next.js apps sending sign-in email links and Stripe return URLs to `http://localhost:3000`: the Dockerfile now takes `NEXT_PUBLIC_APP_URL` as a build argument, which Railway and Render pass from the service's variables. `pnpm clubedge deploy` already sets it on Railway.
+- `deploy` lists the settings still unset before the build instead of after the release, and asks whether to deploy anyway (#64).
+- No more Node DEP0190 warning on Windows: commands that need the shell get one quoted command line (#64).
+- The showcase is re-recorded after each release (#63).
+
 ## 0.24.0
 
 - Default to Starter `v0.17.0` (#61), which adds:

package/README.md

@@ -127,7 +127,7 @@ pnpm dlx @clubedge/create-clubedge-app my-app --yes --no-git --framework tanstac
 pnpm dlx @clubedge/create-clubedge-app my-app --ref main
 
 # Reproduce a specific Starter release or commit
-pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.17.0
+pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.17.1
 pnpm dlx @clubedge/create-clubedge-app my-app --ref <commit-sha>
 
 # Test local Starter changes before releasing them
@@ -146,7 +146,7 @@ pnpm clubedge add email resend payments stripe              # several modules as
 pnpm clubedge remove storage payments
 pnpm dlx @clubedge/create-clubedge-app add infra local --dry-run
 pnpm dlx @clubedge/create-clubedge-app@latest upgrade        # to the newest CLI's Starter release
-pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.17.0 # or a specific tag, branch, or commit
+pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.17.1 # or a specific tag, branch, or commit
 ```
 
 The CLI renders the project twice, from the Starter commit and modules recorded in your `package.json` and from the new state, and merges the difference into your project. The new state has other modules for `add` and `remove`, and the newer Starter with the same modules for `upgrade`. Modules a newer Starter introduces start as `none` where possible, so an upgrade never adds a service on its own.
@@ -206,27 +206,27 @@ With [Railway's CLI](https://docs.railway.com/cli) (the installed `railway`, or
 Each CLI release is tested against one specific Starter release:
 
 ```text
-create-clubedge-app v0.24.0
+create-clubedge-app v0.24.1
         |
         v
-Clubedge Starter v0.17.0
-commit 91be4541de5833527b52a8871a08578f63b89735
+Clubedge Starter v0.17.1
+commit d9d787b6750e862b9de81a3f8f36b7aa07757f7a
 ```
 
 The current relationship is:
 
 | CLI release | Default Starter release | Meaning |
 | --- | --- | --- |
-| `create-clubedge-app@0.24.0` | `clubedge-starter@v0.17.0` | The CLI's required, tested default |
+| `create-clubedge-app@0.24.1` | `clubedge-starter@v0.17.1` | The CLI's required, tested default |
 
 This means the same CLI version always scaffolds the same Starter revision by default. The CLI does not silently follow Starter `main`.
 
-The `v0.17.0` tag is expected to resolve to commit
-`91be4541de5833527b52a8871a08578f63b89735`. The CLI verifies this before
+The `v0.17.1` tag is expected to resolve to commit
+`d9d787b6750e862b9de81a3f8f36b7aa07757f7a`. The CLI verifies this before
 scaffolding with the default reference and fails rather than silently using a
 moved tag.
 
-When the Starter changes, its maintainers first publish a new versioned release, such as `v0.17.0`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
+When the Starter changes, its maintainers first publish a new versioned release, such as `v0.17.1`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
 
 Every generated project records its CLI version, Starter repository, Starter ref, Starter commit, framework, and modules in `package.json` and `README.md`.
 
@@ -281,7 +281,7 @@ CI packs the CLI with `npm pack`, scaffolds clean projects from the packed tarba
 1. Make and validate changes in `clubedge-starter`.
 2. Run lint, typecheck, unit tests, browser tests, and production build.
 3. Update the Starter package versions.
-4. Commit `main`, create a release tag such as `v0.17.0`, and publish the Starter release.
+4. Commit `main`, create a release tag such as `v0.17.1`, and publish the Starter release.
 
 ### CLI maintainers
 

package/dist/deploy.js

@@ -15,7 +15,7 @@ import { readProject } from "./core/project.js";
 import { cliCommand } from "./modify.js";
 import { resolvePnpm } from "./steps/install.js";
 import { pathExists } from "./utils/fs.js";
-import { run } from "./utils/process.js";
+import { run, spawnCommand } from "./utils/process.js";
 const railwayTermsUrl = "https://railway.com/legal/terms";
 const deployDocsUrl = "https://starter.clubedge.live/docs/starter/deploy";
 const windows = process.platform === "win32";
@@ -23,7 +23,7 @@ const binaryName = windows ? "railway.exe" : "railway";
 async function cliVersion(command, shell) {
     return await new Promise((resolveVersion) => {
         const [file, ...args] = command;
-        const child = spawn(file, [...args, "--version"], { shell, stdio: ["ignore", "pipe", "ignore"] });
+        const child = spawnCommand(file, [...args, "--version"], { stdio: ["ignore", "pipe", "ignore"] }, shell);
         let out = "";
         child.stdout?.on("data", (chunk) => (out += chunk.toString()));
         child.once("error", () => resolveVersion(null));
@@ -89,11 +89,7 @@ async function railwayCli() {
 async function railway(cli, args, options = {}) {
     const [command, ...prefix] = cli.command;
     return await new Promise((resolvePromise, reject) => {
-        const child = spawn(command, [...prefix, ...args], {
-            shell: cli.shell,
-            env: { ...process.env, _: cli.executable },
-            stdio: options.inherit ? "inherit" : ["pipe", "pipe", "pipe"],
-        });
+        const child = spawnCommand(command, [...prefix, ...args], { env: { ...process.env, _: cli.executable }, stdio: options.inherit ? "inherit" : ["pipe", "pipe", "pipe"] }, cli.shell);
         let stdout = "";
         let stderr = "";
         child.stdout?.on("data", (chunk) => (stdout += chunk.toString()));
@@ -243,6 +239,18 @@ export async function deployProject(args) {
     if (changed.length) {
         log.info(`Commit ${changed.join(", ")}: Railway reads the service's settings from ${railwayIacPath} now. railway.json is no longer needed (Railway stops reading it on 2026-12-01).`);
     }
+    // Before the build, not after it: the app starts without these, but the features that use them
+    // fail until they are set, and a build takes minutes.
+    if (plan.unset.length) {
+        log.warn(`Not set on the service: ${plan.unset.join(", ")}. The app starts without them, but the features that use them fail until they are set: pass --env-file, or run railway variable set KEY --stdin --service ${service}.`);
+        if (process.stdin.isTTY && !args.yes) {
+            const proceed = await confirm({ message: "Deploy anyway?", initialValue: true });
+            if (isCancel(proceed) || !proceed) {
+                cancel("Nothing was deployed. Set them, then run deploy again: it reuses everything.");
+                return;
+            }
+        }
+    }
     // Start the deploy detached, then follow its status: `railway up` can return before the build
     // ends, and only Railway's final status says whether the release went live.
     const deploying = spinner();

package/dist/utils/process.js

@@ -2,10 +2,23 @@ import { spawn } from "node:child_process";
 import process from "node:process";
 // Package manager shims on Windows are .cmd files, which need a shell to start.
 const useShell = process.platform === "win32";
+/** An argument as one word for cmd.exe: plain words as they are, anything else in double quotes. */
+export function quoteForCmd(argument) {
+    return /^[\w@+=:,./\\-]+$/.test(argument) ? argument : `"${argument.replaceAll('"', '""')}"`;
+}
+/**
+ * Starts a command, through the shell on Windows. There it passes one quoted command line, not an
+ * argument list: Node warns (DEP0190) when arguments are only concatenated for a shell.
+ */
+export function spawnCommand(command, args, options, shell = useShell) {
+    if (!shell)
+        return spawn(command, args, options);
+    return spawn([command, ...args].map(quoteForCmd).join(" "), { ...options, shell: true });
+}
 /** Runs a command with inherited output. Rejects on a non-zero exit. */
 export async function run(command, args, cwd) {
     await new Promise((resolve, reject) => {
-        const child = spawn(command, args, { cwd, stdio: "inherit", shell: useShell });
+        const child = spawnCommand(command, args, { cwd, stdio: "inherit" });
         child.once("error", reject);
         child.once("exit", (code, signal) => {
             if (code === 0)
@@ -18,17 +31,14 @@ export async function run(command, args, cwd) {
 /** Runs a command and returns trimmed stdout. Rejects with stderr on a non-zero exit. */
 export async function runCapture(command, args, cwd) {
     return await new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
-            cwd,
-            shell: useShell,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
+        const child = spawnCommand(command, args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
         let stdout = "";
         let stderr = "";
-        child.stdout.on("data", (chunk) => (stdout += chunk.toString()));
-        child.stderr.on("data", (chunk) => (stderr += chunk.toString()));
+        child.stdout?.on("data", (chunk) => (stdout += chunk.toString()));
+        child.stderr?.on("data", (chunk) => (stderr += chunk.toString()));
         child.once("error", reject);
-        child.once("exit", (code, signal) => {
+        // close, not exit: it fires once stdout and stderr are fully read.
+        child.once("close", (code, signal) => {
             if (code === 0) {
                 resolve(stdout.trim());
                 return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/create-clubedge-app",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "Create a Next.js or TanStack Start application from the Clubedge Starter reference implementation.",
   "type": "module",
   "packageManager": "pnpm@10.9.0",
@@ -22,8 +22,8 @@
   },
   "clubedge": {
     "starterRepository": "Clubedge/clubedge-starter",
-    "starterRef": "v0.17.0",
-    "starterCommit": "91be4541de5833527b52a8871a08578f63b89735"
+    "starterRef": "v0.17.1",
+    "starterCommit": "d9d787b6750e862b9de81a3f8f36b7aa07757f7a"
   },
   "license": "Apache-2.0",
   "repository": {

package/template/.github/workflows/ci.yml

@@ -72,7 +72,14 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Build the production image
-        run: docker build --tag app:ci .
+        # A public URL of its own, to check that it reaches the build.
+        run: docker build --build-arg NEXT_PUBLIC_APP_URL=https://app.ci.invalid --tag app:ci .
+      # clubedge:if framework=next
+      - name: Check that the public URL is compiled into the build
+        # Next.js inlines NEXT_PUBLIC_* at build time, server code included; without the build
+        # argument, sign-in links and Stripe return URLs would point at localhost.
+        run: docker run --rm --entrypoint sh app:ci -c 'grep -rlq "https://app.ci.invalid" /app/apps/web/.next/server'
+      # clubedge:end
       - name: Run the image's migrations twice; the second run changes nothing
         run: |
           set -euo pipefail

package/template/.github/workflows/deploy.yml

@@ -37,6 +37,8 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          # Compiled into the Next.js build: set the repository variable to your public URL.
+          build-args: NEXT_PUBLIC_APP_URL=${{ vars.NEXT_PUBLIC_APP_URL }}
   # clubedge:end
   # clubedge:if deploy=fly
   fly:

package/template/Dockerfile

@@ -17,6 +17,12 @@ COPY --from=pruner /app/out/json/ .
 RUN pnpm install --frozen-lockfile
 COPY --from=pruner /app/out/full/ .
 COPY tsconfig.base.json ./
+# Next.js compiles NEXT_PUBLIC_* values into the build, server code included (sign-in email links,
+# Stripe return URLs), so the public URL is a build argument. Railway and Render pass it from the
+# service's variables; elsewhere, --build-arg NEXT_PUBLIC_APP_URL=https://your.domain. Unset, the
+# app falls back to http://localhost:3000.
+ARG NEXT_PUBLIC_APP_URL
+ENV NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
 RUN pnpm build
 # The production migrator (node /app/migrate.mjs): one bundled file plus every package's
 # migrations, so release commands can migrate before a new version starts.

package/template/SETUP.md

@@ -438,7 +438,7 @@ Netlify runs no worker for [background jobs](#background-jobs). Set `JOBS_WORKER
 Production needs these variables:
 
 - `DATABASE_URL`, pointing at a managed PostgreSQL database.
-- `NEXT_PUBLIC_APP_URL`, the deployed origin. <!-- clubedge:only framework=next -->
+- `NEXT_PUBLIC_APP_URL`, the deployed origin. Next.js compiles it into the build, server code included (sign-in links, Stripe return URLs), so it must be set when the image is built: Railway and Render pass the service's variable to the Docker build; on Fly.io set it under `[build.args]` in `fly.toml`; with the Docker workflow, set the repository variable `NEXT_PUBLIC_APP_URL`. <!-- clubedge:only framework=next -->
 - `APP_URL`, the deployed origin. <!-- clubedge:only framework=tanstack-start -->
 - `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY`, from the Supabase project. <!-- clubedge:only framework=next && auth=supabase -->
 - `SUPABASE_URL` and `SUPABASE_PUBLISHABLE_KEY`, from the Supabase project. <!-- clubedge:only framework=tanstack-start && auth=supabase -->

package/template/apps/start/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/start",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/web",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "scripts": {

package/template/fly.toml

@@ -2,6 +2,10 @@
 # and adds its name and region here; set secrets with `fly secrets set`, then run `fly deploy`.
 [build]
   dockerfile = "Dockerfile"
+  # Next.js compiles NEXT_PUBLIC_APP_URL into the build (sign-in links, Stripe return URLs), so a
+  # Next.js app sets it here rather than as a secret:
+  # [build.args]
+  #   NEXT_PUBLIC_APP_URL = "https://<app>.fly.dev"
 
 # Runs in a temporary machine with the new image before it replaces the running one.
 [deploy]

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clubedge-starter-v1",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.9.0",

package/template/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/auth",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/auth-better-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/auth-better-auth",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Better Auth adapter for @clubedge/auth, storing users and sessions in your own PostgreSQL.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/auth-supabase/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/auth-supabase",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Supabase Auth adapter for @clubedge/auth.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/cache",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/cache-redis/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/cache-redis",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Redis rate limiter and cache for @clubedge/cache.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/core",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/db/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/db",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/email/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/email",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Email interface, console and in-memory providers, and message templates.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/email-resend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/email-resend",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Resend provider for @clubedge/email, through Resend's HTTP API.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/email-smtp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/email-smtp",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "SMTP provider for @clubedge/email, for any SMTP server.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/jobs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/jobs",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Background jobs interface: job definitions, a queue contract, and an in-memory queue.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/jobs-pg-boss/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/jobs-pg-boss",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "pg-boss provider for @clubedge/jobs: a job queue stored in the project's PostgreSQL.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/local-db/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/local-db",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "PostgreSQL for development without Docker: PGlite served over the PostgreSQL protocol.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/observability/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/observability",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Observability interface: error reports and spans for @clubedge/core's telemetry hooks, and an in-memory provider for tests.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/observability-otel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/observability-otel",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "OpenTelemetry provider for @clubedge/observability: traces and error logs exported over OTLP to any collector.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/observability-sentry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/observability-sentry",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Sentry provider for @clubedge/observability: server and browser errors, traces, and source map uploads.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/payments/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/payments",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Provider-neutral payments: the PaymentProvider interface, billing logic, and subscription tables.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/payments-stripe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/payments-stripe",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Stripe provider for @clubedge/payments: Checkout, the customer portal, and verified webhooks.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/storage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/storage",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/packages/storage-s3/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/storage-s3",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "S3-compatible adapter for @clubedge/storage.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/storage-supabase/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/storage-supabase",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Supabase Storage adapter for @clubedge/storage.",
   "private": true,
   "license": "Apache-2.0",

package/template/packages/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clubedge/ui",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template.lock.json

@@ -1,7 +1,7 @@
 {
   "repository": "Clubedge/clubedge-starter",
-  "ref": "v0.17.0",
-  "commit": "91be4541de5833527b52a8871a08578f63b89735",
+  "ref": "v0.17.1",
+  "commit": "d9d787b6750e862b9de81a3f8f36b7aa07757f7a",
   "files": [
     ".dockerignore",
     ".env.example",