tapthat-server 0.1.1 → 0.2.0

package/dist/cli.js

@@ -1,8 +1,1236 @@
 #!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/install/sh.ts
+import { spawn as spawn3 } from "node:child_process";
+function run2(command, args, opts = {}) {
+  return new Promise((done) => {
+    const child = spawn3(command, args, {
+      cwd: opts.cwd,
+      env: { ...process.env, ...opts.env },
+      stdio: opts.interactive ? "inherit" : ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (d) => stdout += d);
+    child.stderr?.on("data", (d) => stderr += d);
+    child.on("error", (e) => done({ code: 127, stdout, stderr: stderr || String(e.message) }));
+    child.on("exit", (code) => done({ code: code ?? 1, stdout, stderr }));
+    if (!opts.interactive) child.stdin?.end(opts.input ?? "");
+  });
+}
+async function must(command, args, opts = {}) {
+  const result = await run2(command, args, opts);
+  if (result.code !== 0) throw new CommandError(`${command} ${args.filter((a) => !a.startsWith("-")).slice(0, 3).join(" ")}`, result);
+  return result.stdout;
+}
+function parseJson(text, what) {
+  const start = text.search(/[[{]/);
+  if (start < 0) throw new Error(`${what}: expected JSON, got ${JSON.stringify(text.slice(0, 200))}`);
+  try {
+    return JSON.parse(text.slice(start));
+  } catch {
+    throw new Error(`${what}: could not parse its JSON output`);
+  }
+}
+var CommandError, sleep;
+var init_sh = __esm({
+  "src/install/sh.ts"() {
+    "use strict";
+    CommandError = class extends Error {
+      constructor(command, result) {
+        const detail = (result.stderr || result.stdout).trim().split("\n").slice(-6).join("\n");
+        super(`${command} failed${detail ? `:
+${detail}` : ""}`);
+        this.command = command;
+        this.result = result;
+      }
+    };
+    sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+  }
+});
+
+// src/install/github.ts
+async function canPush(token2, repo) {
+  const base = process.env.TAPTHAT_GITHUB_URL ?? "https://github.com";
+  const res = await fetch(`${base}/${repo}.git/info/refs?service=git-receive-pack`, {
+    headers: { authorization: `Basic ${Buffer.from(`x-access-token:${token2}`).toString("base64")}`, "user-agent": "tapthat-installer" },
+    redirect: "manual"
+  });
+  await res.body?.cancel();
+  return res.status === 200;
+}
+var GitHub;
+var init_github = __esm({
+  "src/install/github.ts"() {
+    "use strict";
+    init_sh();
+    GitHub = class {
+      constructor(bin = process.env.TAPTHAT_GH_BIN ?? "gh") {
+        this.bin = bin;
+      }
+      async available() {
+        return (await run2(this.bin, ["--version"])).code === 0;
+      }
+      async loggedIn() {
+        return (await run2(this.bin, ["auth", "status"])).code === 0;
+      }
+      async login() {
+        return (await run2(this.bin, ["auth", "login"], { interactive: true })).code === 0;
+      }
+      async api(path, args = []) {
+        const r = await run2(this.bin, ["api", path, ...args]);
+        if (r.code !== 0) {
+          if (/HTTP 404|Not Found/.test(r.stderr + r.stdout)) return null;
+          throw new Error(`gh api ${path} failed: ${(r.stderr || r.stdout).trim().split("\n").slice(-3).join(" ")}`);
+        }
+        return parseJson(r.stdout, `gh api ${path}`);
+      }
+      async defaultBranch(repo) {
+        const r = await this.api(`repos/${repo}`);
+        if (!r) throw new Error(`GitHub repository ${repo} not found, or your gh login cannot see it`);
+        return r.default_branch;
+      }
+      async branchSha(repo, branch) {
+        const r = await this.api(`repos/${repo}/branches/${encodeURIComponent(branch)}`);
+        return r?.commit.sha ?? null;
+      }
+      async createBranch(repo, branch, from) {
+        const sha = await this.branchSha(repo, from);
+        if (!sha) throw new Error(`${repo} has no branch "${from}" to create "${branch}" from`);
+        await must(this.bin, ["api", "-X", "POST", `repos/${repo}/git/refs`, "-f", `ref=refs/heads/${branch}`, "-f", `sha=${sha}`]);
+      }
+      async file(repo, path, ref) {
+        const r = await this.api(`repos/${repo}/contents/${path}?ref=${encodeURIComponent(ref)}`);
+        if (!r?.content) return null;
+        return Buffer.from(r.content, "base64").toString("utf8");
+      }
+      async putFile(repo, path, branch, content, message) {
+        await must(this.bin, [
+          "api",
+          "-X",
+          "PUT",
+          `repos/${repo}/contents/${path}`,
+          "-f",
+          `message=${message}`,
+          "-f",
+          `branch=${branch}`,
+          "-f",
+          `content=${Buffer.from(content).toString("base64")}`
+        ]);
+      }
+      async repoFacts(repo, ref) {
+        const pkg = await this.file(repo, "package.json", ref);
+        let scripts = {};
+        try {
+          scripts = (pkg ? JSON.parse(pkg).scripts : null) ?? {};
+        } catch {
+        }
+        const has = async (p) => !!await this.api(`repos/${repo}/contents/${p}?ref=${encodeURIComponent(ref)}`);
+        const lockfile = await has("package-lock.json") ? "npm" : await has("pnpm-lock.yaml") ? "pnpm" : await has("yarn.lock") ? "yarn" : null;
+        return { scripts, lockfile };
+      }
+    };
+  }
+});
+
+// src/install/model.ts
+function referencesOf(s) {
+  const out = [];
+  for (const [key, value] of Object.entries(s.variables)) {
+    for (const m of value.matchAll(CROSS_REF)) out.push({ service: m[1], variable: m[2], key });
+  }
+  return out;
+}
+function environmentDeploying(envs, branch) {
+  let best = null;
+  for (const env of envs) {
+    const repos = env.services.filter(isRepoService);
+    if (!repos.length) continue;
+    const share = repos.filter((s) => s.source.branch === branch).length / repos.length;
+    if (share > 0.5 && (!best || share > best.share)) best = { name: env.name, share };
+  }
+  return best?.name ?? null;
+}
+function suggestSite(services, withDomains) {
+  const candidates = services.filter((s) => isRepoService(s) && withDomains.has(s.name));
+  const preferred = ["app", "web", "frontend", "site", "www", "client"];
+  for (const name of preferred) {
+    const hit = candidates.find((s) => s.name === name);
+    if (hit) return hit.name;
+  }
+  return candidates[0]?.name ?? null;
+}
+function topology(services, site) {
+  const byName = new Map(services.map((s) => [s.name, s]));
+  const siteSpec = byName.get(site);
+  if (!siteSpec) throw new Error(`No service named "${site}".`);
+  const included = [site];
+  for (const ref of referencesOf(siteSpec)) {
+    const target = byName.get(ref.service);
+    if (ref.variable === "RAILWAY_PRIVATE_DOMAIN" && target && isRepoService(target) && !included.includes(target.name)) {
+      included.push(target.name);
+    }
+  }
+  const kept = /* @__PURE__ */ new Set();
+  const queue = [...included];
+  while (queue.length) {
+    const spec = byName.get(queue.shift());
+    if (!spec) continue;
+    for (const ref of referencesOf(spec)) {
+      if (ref.variable === "RAILWAY_PUBLIC_DOMAIN") continue;
+      const target = byName.get(ref.service);
+      if (!target || included.includes(target.name) || kept.has(target.name)) continue;
+      kept.add(target.name);
+      queue.push(target.name);
+    }
+  }
+  const pgs = services.filter((s) => isDatabase(s, "postgres")).map((s) => s.name);
+  const redises = services.filter((s) => isDatabase(s, "redis")).map((s) => s.name);
+  const postgres = pgs.find((n) => kept.has(n)) ?? null;
+  const redis = redises.find((n) => kept.has(n)) ?? null;
+  return {
+    site,
+    included,
+    kept: [...kept].sort(),
+    dropped: services.map((s) => s.name).filter((n) => !included.includes(n) && !kept.has(n)).sort(),
+    postgres,
+    redis
+  };
+}
+function assignPorts(services, included) {
+  const ports = /* @__PURE__ */ new Map();
+  const taken = /* @__PURE__ */ new Set([SIDECAR_PORT]);
+  for (const name of included) {
+    const port = Number(services.find((s) => s.name === name)?.variables.PORT);
+    if (Number.isInteger(port) && port > 0 && !taken.has(port)) {
+      ports.set(name, port);
+      taken.add(port);
+    }
+  }
+  let next = 3e3;
+  for (const name of included) {
+    if (ports.has(name)) continue;
+    while (taken.has(next)) next++;
+    ports.set(name, next);
+    taken.add(next);
+  }
+  return ports;
+}
+function rewriteValue(value, owner, included, ports) {
+  const out = value.replace(
+    /(https?:\/\/)?\$\{\{\s*([A-Za-z0-9_-]+)\.RAILWAY_PRIVATE_DOMAIN\s*\}\}(:\d+)?/g,
+    (whole, scheme, service) => included.includes(service) ? `${scheme ?? ""}localhost:${ports.get(service)}` : whole
+  );
+  return out.replace(ANY_REF, (whole, service, variable) => {
+    if (service) {
+      if (variable === "RAILWAY_PUBLIC_DOMAIN") return "${{RAILWAY_PUBLIC_DOMAIN}}";
+      return included.includes(service) ? `\${{${prefixOf(service)}_${variable}}}` : whole;
+    }
+    if (variable === "PORT") return String(ports.get(owner));
+    if (variable.startsWith("RAILWAY_")) return whole;
+    return `\${{${prefixOf(owner)}_${variable}}}`;
+  });
+}
+function planWorkspace(input) {
+  const { services, site, branch } = input;
+  const topo = topology(services, site);
+  const ports = assignPorts(services, topo.included);
+  const byName = new Map(services.map((s) => [s.name, s]));
+  const warnings = [];
+  const variables = {};
+  const secretKeys = /* @__PURE__ */ new Set();
+  const repos = topo.included.map((name) => {
+    const spec = byName.get(name);
+    const facts = input.repoFacts.get(name) ?? { scripts: {}, lockfile: "npm" };
+    const env = {};
+    for (const [key, raw] of Object.entries(spec.variables)) {
+      if (SKIPPED.test(key)) continue;
+      const rewritten = rewriteValue(raw, name, topo.included, ports);
+      if (/^https?:\/\/localhost:\d+[^$]*$/.test(rewritten)) {
+        env[key] = rewritten;
+        continue;
+      }
+      const wsKey = `${prefixOf(name)}_${key}`;
+      variables[wsKey] = rewritten;
+      if (!rewritten.includes("${{")) secretKeys.add(wsKey);
+      env[key] = `\${${wsKey}}`;
+    }
+    const command = facts.scripts.dev ? "npm run dev" : facts.scripts.start ? "npm start" : null;
+    if (!command) warnings.push(`${name}: package.json has no "dev" or "start" script; set devServer.command by hand`);
+    if (facts.lockfile && facts.lockfile !== "npm") {
+      warnings.push(`${name}: uses ${facts.lockfile}; the image has npm only, so install with npm or adjust devServer.install`);
+    }
+    const pre = spec.deploy?.preDeployCommand;
+    const prepare = facts.scripts["migrate:deploy"] ? "npm run migrate:deploy" : (Array.isArray(pre) ? pre.join(" && ") : pre) || null;
+    return {
+      name,
+      ...name === site ? { primary: true } : { url: `https://github.com/${spec.source.repo}.git` },
+      description: `The ${name} service (${spec.source.repo}).`,
+      ...facts.scripts.typecheck ? { verifyCommand: "npm run typecheck" } : {},
+      devServer: {
+        command: command ?? "npm run dev",
+        url: `http://localhost:${ports.get(name)}`,
+        install: facts.lockfile === "npm" || !facts.lockfile ? "npm ci --no-audit --no-fund" : "npm install --no-audit --no-fund",
+        ...prepare ? { prepare } : {},
+        env
+      }
+    };
+  });
+  const deployOrder = [...topo.included.filter((n) => n !== site), site];
+  const session = {};
+  if (topo.postgres) {
+    const pg = topo.postgres;
+    variables.TAPTHAT_PLAYGROUND_DATABASE_URL = `postgresql://\${{${pg}.PGUSER}}:\${{${pg}.PGPASSWORD}}@\${{${pg}.PGHOST}}:\${{${pg}.PGPORT}}/postgres`;
+    const redisKey = Object.keys(variables).find((k) => k.endsWith("_REDIS_URL"));
+    session.snapshot = {
+      source: "${TAPTHAT_DEV_DATABASE_URL}",
+      target: "${TAPTHAT_PLAYGROUND_DATABASE_URL}",
+      ...redisKey ? { redis: `\${${redisKey}}` } : {},
+      // Dev servers that talk to the database are stopped while it is replaced.
+      stopServers: topo.included.filter((n) => referencesOf(byName.get(n)).some((r) => r.service === pg))
+    };
+  } else {
+    warnings.push("No Postgres service found among the dependencies: Start session will copy code but no data.");
+  }
+  const migrates = repos.some((r) => "prepare" in r.devServer);
+  const config = {
+    branch,
+    git: { mode: "session", deployOrder },
+    ...migrates ? {
+      agent: {
+        rules: [
+          "Do not change database schemas or migrations. If a request needs a database change, stop and say exactly what is needed."
+        ]
+      }
+    } : {},
+    repos,
+    ...Object.keys(session).length ? { session } : {}
+  };
+  return { topology: topo, ports, variables, secretKeys, config, warnings };
+}
+function rewriteForKept(value, topo, ports) {
+  const present = new Set(topo.kept);
+  const withPrivate = value.replace(
+    /\$\{\{\s*([A-Za-z0-9_-]+)\.RAILWAY_PRIVATE_DOMAIN\s*\}\}(:\d+)?/g,
+    (whole, service) => topo.included.includes(service) ? `\${{${WORKSPACE}.RAILWAY_PRIVATE_DOMAIN}}:${ports.get(service)}` : whole
+  );
+  return withPrivate.replace(CROSS_REF, (whole, service, variable) => {
+    if (present.has(service) || service === WORKSPACE) return whole;
+    if (variable === "RAILWAY_PUBLIC_DOMAIN") return `\${{${WORKSPACE}.RAILWAY_PUBLIC_DOMAIN}}`;
+    if (topo.included.includes(service)) return `\${{${WORKSPACE}.${prefixOf(service)}_${variable}}}`;
+    return whole;
+  });
+}
+function keptRewrites(playground, topo, ports) {
+  const out = /* @__PURE__ */ new Map();
+  for (const s of playground) {
+    if (!topo.kept.includes(s.name)) continue;
+    const changed = {};
+    for (const [k, v] of Object.entries(s.variables)) {
+      const next = rewriteForKept(v, topo, ports);
+      if (next !== v) changed[k] = next;
+    }
+    if (Object.keys(changed).length) out.set(s.name, changed);
+  }
+  return out;
+}
+function danglingReferences(playground) {
+  const names = new Set(playground.map((s) => s.name));
+  const out = [];
+  for (const s of playground) {
+    for (const ref of referencesOf(s)) {
+      if (!names.has(ref.service)) out.push(`${s.name}.${ref.key} \u2192 ${ref.service}`);
+    }
+  }
+  return out;
+}
+function baseVariables(siteRepo, site) {
+  return {
+    NODE_ENV: "development",
+    PORT: String(SIDECAR_PORT),
+    TAPTHAT_ENABLE: "1",
+    TAPTHAT_PROXY: "1",
+    TAPTHAT_START_DEV_SERVER: "1",
+    TAPTHAT_WORKSPACE_ROOT: "/workspace/repos",
+    TAPTHAT_REPO_ROOT: `/workspace/repos/${site}`,
+    TAPTHAT_REPO_URL: `https://github.com/${siteRepo}.git`,
+    TAPTHAT_ALLOWED_ORIGINS: "https://${{RAILWAY_PUBLIC_DOMAIN}}"
+  };
+}
+function configPlaceholders(config) {
+  const names = /* @__PURE__ */ new Set();
+  for (const m of JSON.stringify(config).matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)) names.add(m[1]);
+  return [...names].sort();
+}
+function missingVariables(placeholders, base, planned, current) {
+  const set = {};
+  const unknown = [];
+  const handled = /* @__PURE__ */ new Set(["TAPTHAT_TOKEN", "TAPTHAT_ENCRYPTION_KEY", "TAPTHAT_GIT_TOKEN", "TAPTHAT_DEV_DATABASE_URL"]);
+  const seen = /* @__PURE__ */ new Set();
+  const queue = [...Object.keys(base), ...placeholders, ...Object.keys(planned).filter((k) => k.startsWith("TAPTHAT_"))];
+  while (queue.length) {
+    const name = queue.shift();
+    if (seen.has(name) || handled.has(name)) continue;
+    seen.add(name);
+    const value = current[name] ?? base[name] ?? planned[name];
+    if (value === void 0) {
+      unknown.push(name);
+      continue;
+    }
+    if (!(name in current)) set[name] = value;
+    for (const m of value.matchAll(ANY_REF)) {
+      if (!m[1] && !m[2].startsWith("RAILWAY_")) queue.push(m[2]);
+    }
+  }
+  return { set, unknown: unknown.sort() };
+}
+function devDatabaseUrl(v) {
+  const { PGUSER, PGPASSWORD, RAILWAY_TCP_PROXY_DOMAIN: host, RAILWAY_TCP_PROXY_PORT: port } = v;
+  if (!PGUSER || !PGPASSWORD || !host || !port) return null;
+  return `postgresql://${encodeURIComponent(PGUSER)}:${encodeURIComponent(PGPASSWORD)}@${host}:${port}/postgres`;
+}
+var WORKSPACE, IMAGE, SIDECAR_PORT, CROSS_REF, ANY_REF, isDatabase, isRepoService, prefixOf, SKIPPED, isLiteralTemplate, REDIS_TEMPLATE_VARIABLES;
+var init_model = __esm({
+  "src/install/model.ts"() {
+    "use strict";
+    WORKSPACE = "workspace";
+    IMAGE = "ghcr.io/ljellevo/tapthat-server:latest";
+    SIDECAR_PORT = 8080;
+    CROSS_REF = /\$\{\{\s*([A-Za-z0-9_-]+)\.([A-Za-z0-9_]+)\s*\}\}/g;
+    ANY_REF = /\$\{\{\s*(?:([A-Za-z0-9_-]+)\.)?([A-Za-z0-9_]+)\s*\}\}/g;
+    isDatabase = (s, kind) => {
+      const image = s.source.image ?? "";
+      if (kind === "postgres") return /postgres/i.test(image);
+      if (kind === "redis") return /redis/i.test(image);
+      return /postgres|redis|mysql|mongo/i.test(image);
+    };
+    isRepoService = (s) => !!s.source.repo;
+    prefixOf = (name) => name.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+    SKIPPED = /^(PORT|HOSTNAME|NODE_ENV|RAILWAY_[A-Z_]+)$/;
+    isLiteralTemplate = (value) => !!value && /^secret\(/.test(value.trim());
+    REDIS_TEMPLATE_VARIABLES = {
+      REDISUSER: "default",
+      REDISPORT: "6379",
+      REDISHOST: "${{RAILWAY_PRIVATE_DOMAIN}}",
+      REDISPASSWORD: "${{REDIS_PASSWORD}}",
+      REDIS_URL: "redis://${{REDISUSER}}:${{REDIS_PASSWORD}}@${{REDISHOST}}:${{REDISPORT}}",
+      // Railway mounts volumes owned by root; Railway's redis image runs as a non-root user.
+      RAILWAY_RUN_UID: "0"
+    };
+  }
+});
+
+// src/install/railway.ts
+var Railway;
+var init_railway = __esm({
+  "src/install/railway.ts"() {
+    "use strict";
+    init_sh();
+    Railway = class {
+      constructor(cwd, bin = process.env.TAPTHAT_RAILWAY_BIN ?? "railway") {
+        this.cwd = cwd;
+        this.bin = bin;
+      }
+      cli(args, input) {
+        return must(this.bin, args, { cwd: this.cwd, input });
+      }
+      async version() {
+        const r = await run2(this.bin, ["--version"], { cwd: this.cwd });
+        return r.code === 0 ? /(\d+\.\d+\.\d+)/.exec(r.stdout)?.[1] ?? null : null;
+      }
+      async loggedIn() {
+        return (await run2(this.bin, ["whoami"], { cwd: this.cwd })).code === 0;
+      }
+      async login() {
+        return (await run2(this.bin, ["login"], { cwd: this.cwd, interactive: true })).code === 0;
+      }
+      /** Lets the person pick a project in Railway's own picker. */
+      async link() {
+        return (await run2(this.bin, ["link"], { cwd: this.cwd, interactive: true })).code === 0;
+      }
+      async project() {
+        const r = await run2(this.bin, ["status", "--json"], { cwd: this.cwd });
+        if (r.code !== 0) return null;
+        const s = parseJson(r.stdout, "railway status");
+        return {
+          id: s.id,
+          name: s.name,
+          environments: s.environments.edges.map((e) => e.node),
+          services: s.services.edges.map((e) => e.node)
+        };
+      }
+      /** Every service in an environment with its raw (unresolved) variables. */
+      async services(project, env) {
+        const cfg = parseJson(await this.cli(["environment", "config", "-e", env, "--json"]), "railway environment config");
+        const names = new Map(project.services.map((s) => [s.id, s.name]));
+        return Object.entries(cfg.services ?? {}).map(([id, s]) => ({
+          id,
+          name: names.get(id) ?? id,
+          source: { repo: s.source?.repo ?? null, branch: s.source?.branch ?? null, image: s.source?.image ?? null },
+          deploy: {
+            preDeployCommand: s.deploy?.preDeployCommand ?? null,
+            healthcheckPath: s.deploy?.healthcheckPath ?? null,
+            healthcheckTimeout: s.deploy?.healthcheckTimeout ?? null
+          },
+          variables: Object.fromEntries(
+            Object.entries(s.variables ?? {}).flatMap(([k, v]) => v && typeof v.value === "string" ? [[k, v.value]] : [])
+          ),
+          domains: [...Object.keys(s.networking?.serviceDomains ?? {}), ...Object.keys(s.networking?.customDomains ?? {})]
+        })).sort((a, b) => a.name.localeCompare(b.name));
+      }
+      /** Variables as the service sees them, references resolved (includes RAILWAY_*). */
+      async rendered(service, env) {
+        const text = await this.cli(["variable", "list", "-s", service, "-e", env, "--json"]);
+        const listed = parseJson(text, "railway variable list");
+        if (!Array.isArray(listed)) return listed;
+        return Object.fromEntries(listed.map((v) => [v.name ?? v.key ?? "", v.value]));
+      }
+      /** Values without secrets: references and plain settings, several at once. */
+      async setPlain(service, env, vars) {
+        const pairs = Object.entries(vars).map(([k, v]) => `${k}=${v}`);
+        if (pairs.length) await this.cli(["variable", "set", ...pairs, "-s", service, "-e", env, "--skip-deploys"]);
+      }
+      async setSecret(service, env, key, value) {
+        await this.cli(["variable", "set", key, "--stdin", "-s", service, "-e", env, "--skip-deploys"], value);
+      }
+      async createEnvironment(name, duplicate) {
+        await this.cli(["environment", "new", name, "--duplicate", duplicate]);
+      }
+      async editServices(env, changes, message) {
+        if (!changes.length) return;
+        await this.cli(["environment", "edit", "-e", env, ...changes.flatMap((c) => ["--service-config", ...c]), "-m", message]);
+      }
+      async deleteService(service, env) {
+        await this.cli(["service", "delete", "-s", service, "-e", env, "--yes"]);
+      }
+      /** `railway add` and `volume add` act on the linked environment and service. */
+      async linkTo(project, env, service) {
+        await this.cli(["link", "-p", project.id, "-e", env, ...service ? ["-s", service] : []]);
+      }
+      async addImageService(name, image) {
+        await this.cli(["add", "-s", name, "-i", image]);
+      }
+      async addVolume(mountPath) {
+        await this.cli(["volume", "add", "-m", mountPath]);
+      }
+      async createDomain(service, env, port) {
+        const out = await this.cli(["domain", "-s", service, "-e", env, "--port", String(port)]);
+        return /https:\/\/\S+/.exec(out)?.[0] ?? null;
+      }
+      async createTcpProxy(service, env, port) {
+        await this.cli(["tcp-proxy", "create", "--port", String(port), "-s", service, "-e", env]);
+      }
+      async tcpProxyIds(service, env) {
+        const out = await this.cli(["tcp-proxy", "list", "-s", service, "-e", env, "--json"]);
+        const d = parseJson(out, "railway tcp-proxy list");
+        return (Array.isArray(d) ? d : d.proxies ?? []).map((p) => p.id);
+      }
+      async deleteTcpProxy(id, service, env) {
+        await this.cli(["tcp-proxy", "delete", id, "--yes", "-s", service, "-e", env]);
+      }
+      /** Whether this CLI has the commands the installer relies on. */
+      async capable() {
+        return (await run2(this.bin, ["environment", "config", "--help"], { cwd: this.cwd })).code === 0;
+      }
+      async redeploy(service, env, fromSource = false) {
+        await this.cli(["redeploy", "-s", service, "-e", env, "--yes", ...fromSource ? ["--from-source"] : []]);
+      }
+    };
+  }
+});
+
+// src/install/ui.ts
+import { createInterface } from "node:readline";
+async function readAllStdin() {
+  let text = "";
+  for await (const chunk of process.stdin) text += chunk;
+  return text.trim();
+}
+async function waitFor(label, poll, timeoutMs, everyMs = 5e3) {
+  const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+  const started = Date.now();
+  let i = 0;
+  for (; ; ) {
+    const value = await poll().catch(() => null);
+    if (value !== null) {
+      if (tty) process.stdout.write("\r\x1B[2K");
+      return value;
+    }
+    const elapsed = Math.round((Date.now() - started) / 1e3);
+    if (Date.now() - started > timeoutMs * PACE) {
+      if (tty) process.stdout.write("\r\x1B[2K");
+      return null;
+    }
+    if (tty) process.stdout.write(`\r\x1B[2K  ${cyan(frames[i++ % frames.length])} ${label} ${dim(`${elapsed}s`)}`);
+    await new Promise((r) => setTimeout(r, everyMs * PACE));
+  }
+}
+var tty, paint, bold, dim, green, yellow, red, cyan, say, heading, ok, todo, warn, fail, Prompter, PACE;
+var init_ui = __esm({
+  "src/install/ui.ts"() {
+    "use strict";
+    tty = process.stdout.isTTY && !process.env.NO_COLOR;
+    paint = (code) => (s) => tty ? `\x1B[${code}m${s}\x1B[0m` : s;
+    bold = paint(1);
+    dim = paint(2);
+    green = paint(32);
+    yellow = paint(33);
+    red = paint(31);
+    cyan = paint(36);
+    say = (s = "") => console.log(s);
+    heading = (s) => say(`
+${bold(s)}`);
+    ok = (s) => say(`  ${green("\u2713")} ${s}`);
+    todo = (s) => say(`  ${yellow("\u2022")} ${s}`);
+    warn = (s) => say(`  ${yellow("!")} ${s}`);
+    fail = (s) => say(`  ${red("\u2717")} ${s}`);
+    Prompter = class {
+      constructor(assumeYes) {
+        this.assumeYes = assumeYes;
+      }
+      get interactive() {
+        return !!process.stdin.isTTY && !this.assumeYes;
+      }
+      ask(question) {
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        return new Promise((done) => rl.question(question, (a) => (rl.close(), done(a.trim()))));
+      }
+      noTerminal(what, fallback) {
+        if (this.assumeYes && fallback !== void 0) return fallback;
+        throw new Error(`${what}: needs an answer. Run in a terminal, or pass the flag for it (see --help) and --yes.`);
+      }
+      async input(question, fallback) {
+        if (!this.interactive) return this.noTerminal(question, fallback);
+        for (; ; ) {
+          const a = await this.ask(`${cyan("?")} ${question}${fallback ? dim(` (${fallback})`) : ""} `);
+          if (a || fallback) return a || fallback;
+        }
+      }
+      async confirm(question, fallback = true) {
+        if (!this.interactive) return this.assumeYes ? fallback : !!this.noTerminal(question, void 0);
+        const a = (await this.ask(`${cyan("?")} ${question} ${dim(fallback ? "(Y/n)" : "(y/N)")} `)).toLowerCase();
+        return a ? a.startsWith("y") : fallback;
+      }
+      async select(question, options, fallback) {
+        if (!options.length) throw new Error(`${question}: nothing to choose from`);
+        const def = options.find((o) => o.value === fallback) ?? options[0];
+        if (!this.interactive) return this.noTerminal(question, def.value);
+        say(`${cyan("?")} ${question}`);
+        options.forEach((o, i) => say(`  ${dim(`${i + 1})`)} ${o.label}${o === def ? dim("  \u2190 default") : ""}`));
+        for (; ; ) {
+          const a = await this.ask(`  ${dim(`1-${options.length}, Enter for default:`)} `);
+          if (!a) return def.value;
+          const hit = options[Number(a) - 1] ?? options.find((o) => o.value === a);
+          if (hit) return hit.value;
+        }
+      }
+      /** Reads a secret without echoing it. */
+      async secret(question) {
+        if (!process.stdin.isTTY) throw new Error(`${question}: needs a terminal (or pass it on stdin with --git-token-stdin)`);
+        process.stdout.write(`${cyan("?")} ${question} ${dim("(hidden)")} `);
+        const stdin = process.stdin;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        return new Promise((done, reject) => {
+          let value = "";
+          const onData = (chunk) => {
+            for (const ch of chunk) {
+              if (ch === "\r" || ch === "\n") {
+                finish();
+                process.stdout.write("\n");
+                return done(value.trim());
+              }
+              if (ch === "") {
+                finish();
+                process.stdout.write("\n");
+                return reject(new Error("Cancelled."));
+              }
+              if (ch === "\x7F" || ch === "\b") value = value.slice(0, -1);
+              else value += ch;
+            }
+          };
+          const finish = () => {
+            stdin.off("data", onData);
+            stdin.setRawMode(false);
+            stdin.pause();
+          };
+          stdin.on("data", onData);
+        });
+      }
+    };
+    PACE = Number(process.env.TAPTHAT_INSTALL_PACE ?? 1);
+  }
+});
+
+// src/install/index.ts
+var install_exports = {};
+__export(install_exports, {
+  INSTALL_USAGE: () => INSTALL_USAGE,
+  install: () => install,
+  parseInstallArgs: () => parseInstallArgs
+});
+import { randomBytes as randomBytes3 } from "node:crypto";
+function parseInstallArgs(args, cwd) {
+  const opts = { cwd, playground: "tapthat", dryRun: false, yes: false, gitTokenStdin: false };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    const [flag, inline] = a.includes("=") ? [a.slice(0, a.indexOf("=")), a.slice(a.indexOf("=") + 1)] : [a, void 0];
+    const value = () => {
+      const v = inline ?? args[++i];
+      if (!v || v.startsWith("--")) throw new Error(`${flag} needs a value`);
+      return v;
+    };
+    try {
+      if (flag === "--platform") opts.platform = value();
+      else if (flag === "--branch") opts.branch = value();
+      else if (flag === "--site") opts.site = value();
+      else if (flag === "--playground") opts.playground = value();
+      else if (flag === "--dry-run") opts.dryRun = true;
+      else if (flag === "--yes" || flag === "-y") opts.yes = true;
+      else if (flag === "--git-token-stdin") opts.gitTokenStdin = true;
+      else return `Unknown option: ${a}`;
+    } catch (e) {
+      return e.message;
+    }
+  }
+  return opts;
+}
+async function install(opts) {
+  try {
+    return await installInner(opts);
+  } catch (e) {
+    say();
+    fail(e.message);
+    say(dim("  Nothing is half-done in a way that matters: fix the above and run the installer again."));
+    return 1;
+  }
+}
+async function installInner(opts) {
+  const p = new Prompter(opts.yes);
+  const rw = new Railway(opts.cwd);
+  const gh = new GitHub();
+  say(bold("TapThat installer") + (opts.dryRun ? yellow("  (dry run: nothing will change)") : ""));
+  const platform = opts.platform ?? await p.select("Where do your environments run?", [{ value: "railway", label: "Railway" }], "railway");
+  if (platform.toLowerCase() !== "railway") throw new Error(`Only Railway is supported for now (got "${platform}").`);
+  heading("Tools");
+  if (!await rw.version()) throw new Error("The Railway CLI is not installed: https://docs.railway.com/cli (brew install railway)");
+  if (!await rw.capable()) throw new Error("This Railway CLI is too old for the installer. Update it: railway upgrade");
+  if (!await rw.loggedIn()) {
+    if (opts.dryRun || !process.stdin.isTTY) throw new Error("Not logged in to Railway. Run: railway login");
+    if (!await rw.login()) throw new Error("Railway login did not complete.");
+  }
+  ok(`Railway CLI ${await rw.version()}, logged in`);
+  if (!await gh.available()) throw new Error("The GitHub CLI is not installed: https://cli.github.com (brew install gh)");
+  if (!await gh.loggedIn()) {
+    if (opts.dryRun || !process.stdin.isTTY) throw new Error("Not logged in to GitHub. Run: gh auth login");
+    if (!await gh.login()) throw new Error("GitHub login did not complete.");
+  }
+  ok("GitHub CLI, logged in");
+  let project = await rw.project();
+  if (!project) {
+    if (opts.dryRun || !process.stdin.isTTY) throw new Error("This folder is not linked to a Railway project. Run: railway link");
+    say("  This folder is not linked to a Railway project; pick it:");
+    await rw.link();
+    project = await rw.project();
+    if (!project) throw new Error("No Railway project linked.");
+  }
+  ok(`Railway project ${bold(project.name)}`);
+  const envNames = project.environments.map((e) => e.name);
+  const load = async (env) => rw.services(await rw.project() ?? project, env);
+  const envs = await Promise.all(envNames.map(async (name) => ({ name, services: await load(name) })));
+  const repoServices = /* @__PURE__ */ new Map();
+  for (const env of envs) for (const s of env.services.filter(isRepoService)) if (!repoServices.has(s.source.repo)) repoServices.set(s.source.repo, s);
+  if (!repoServices.size) throw new Error(`No service in ${project.name} deploys from a GitHub repository.`);
+  heading("Dev branch");
+  const branch = opts.branch ?? await p.input("Which branch should reviewed changes go to?", "dev");
+  const repos = [...repoServices.keys()].sort();
+  const defaults2 = /* @__PURE__ */ new Map();
+  const missingBranch = [];
+  for (const repo of repos) {
+    defaults2.set(repo, await gh.defaultBranch(repo));
+    if (!await gh.branchSha(repo, branch)) missingBranch.push(repo);
+  }
+  if (!missingBranch.length) ok(`every repository has ${bold(branch)} (${repos.join(", ")})`);
+  else {
+    todo(`no ${bold(branch)} branch in ${missingBranch.join(", ")}`);
+    if (opts.dryRun) say(dim(`  would offer to create it from each default branch`));
+    else if (await p.confirm(`Create ${branch} in ${missingBranch.length === 1 ? missingBranch[0] : `these ${missingBranch.length} repositories`}, from ${missingBranch.length === 1 ? defaults2.get(missingBranch[0]) : "each default branch"}?`)) {
+      for (const repo of missingBranch) {
+        await gh.createBranch(repo, branch, defaults2.get(repo));
+        ok(`${repo}: created ${branch} from ${defaults2.get(repo)}`);
+      }
+    } else throw new Error(`TapThat commits to ${branch}; it has to exist in every repository first.`);
+  }
+  heading("Environments");
+  const mostCommonDefault = mode([...defaults2.values()]) ?? "main";
+  const sourceEnv = environmentDeploying(envs, mostCommonDefault) ?? (envNames.includes("production") ? "production" : envs.find((e) => e.name !== opts.playground)?.name);
+  if (!sourceEnv) throw new Error("No environment to start from.");
+  let devEnv = environmentDeploying(envs.filter((e) => e.name !== opts.playground), branch);
+  let devCreated = false;
+  if (devEnv) ok(`${bold(devEnv)} deploys ${branch}`);
+  else {
+    const existing = envNames.includes(branch) ? branch : null;
+    todo(existing ? `environment ${bold(existing)} does not deploy ${branch}` : `no environment deploys ${branch}`);
+    const question = existing ? `Point every service in ${existing} at ${branch}?` : `Create environment ${bold(branch)} as a copy of ${bold(sourceEnv)}, deploying ${branch}?`;
+    if (opts.dryRun) say(dim(`  would ask: ${question}`));
+    else if (await p.confirm(question)) {
+      const name = existing ?? branch;
+      if (!existing) {
+        await rw.createEnvironment(name, sourceEnv);
+        await waitForServices(rw, project, name, envs.find((e) => e.name === sourceEnv).services.length);
+        devCreated = true;
+        ok(`created ${name} from ${sourceEnv}`);
+      }
+      const services = await load(name);
+      await rw.editServices(name, services.filter(isRepoService).map((s) => [s.name, "source.branch", branch]), `Deploy ${branch}`);
+      ok(`${name}'s services deploy ${branch}`);
+      devEnv = name;
+    } else throw new Error(`The playground copies from the environment that deploys ${branch}; there has to be one.`);
+  }
+  const devName = devEnv ?? sourceEnv;
+  let devServices = devEnv ? await load(devEnv) : envs.find((e) => e.name === sourceEnv).services;
+  if (devCreated) {
+    const source = envs.find((e) => e.name === sourceEnv).services;
+    for (const s of devServices) {
+      const had = source.find((x) => x.name === s.name)?.domains.length;
+      if (had && !s.domains.length) {
+        const url2 = await rw.createDomain(s.name, devName, Number(s.variables.PORT) || 8080);
+        ok(`${s.name}: domain ${url2 ?? "created"}`);
+      }
+    }
+    devServices = await load(devName);
+    warn(`${devName} starts with empty databases. Run your project's own database setup there (roles, migrations) before the first Start session.`);
+  }
+  heading("Site");
+  const withDomains = new Set(devServices.filter((s) => s.domains.length).map((s) => s.name));
+  const candidates = devServices.filter((s) => isRepoService(s) && withDomains.has(s.name));
+  if (!candidates.length) throw new Error(`No service in ${devName} has a public domain to review.`);
+  const site = opts.site ?? await p.select(
+    "Which site do reviewers comment on?",
+    candidates.map((s) => ({ value: s.name, label: `${s.name}  ${dim(s.domains[0] ?? "")}` })),
+    suggestSite(devServices, withDomains) ?? void 0
+  );
+  const siteSpec = devServices.find((s) => s.name === site);
+  if (siteSpec) ok(`${bold(site)} ${dim(siteSpec.domains[0] ?? "")}`);
+  if (!siteSpec?.source.repo) throw new Error(`${site} is not a service built from a GitHub repository in ${devName}.`);
+  heading("Plan");
+  const facts = /* @__PURE__ */ new Map();
+  const planTopology = planWorkspace({ services: devServices, site, branch, repoFacts: /* @__PURE__ */ new Map() }).topology;
+  for (const name of planTopology.included) {
+    facts.set(name, await gh.repoFacts(devServices.find((s) => s.name === name).source.repo, branch));
+  }
+  const plan = planWorkspace({ services: devServices, site, branch, repoFacts: facts });
+  const topo = plan.topology;
+  say(`  The ${bold(opts.playground)} environment runs:`);
+  say(`    ${cyan(WORKSPACE)}  ${topo.included.map((n) => `${n} ${dim(`:${plan.ports.get(n)}`)}`).join(", ")} as live dev servers, and the agent`);
+  if (topo.kept.length) say(`    ${topo.kept.join(", ")}  ${dim("as they run in " + devName)}`);
+  if (topo.dropped.length) say(`    ${dim(`not needed: ${topo.dropped.join(", ")}`)}`);
+  for (const w of plan.warnings) warn(w);
+  const actions = [];
+  const pgName = topo.postgres;
+  const redisName = topo.redis;
+  let devPasswordChanges = false;
+  if (pgName) {
+    const raw = devServices.find((s) => s.name === pgName).variables;
+    const rendered = await rw.rendered(pgName, devName);
+    if (isLiteralTemplate(raw.POSTGRES_PASSWORD)) {
+      devPasswordChanges = true;
+      actions.push({
+        label: `${devName}/${pgName}: replace the guessable superuser password (Railway stored its secret() template as text)`,
+        run: () => rotatePostgres(rw, devName, pgName),
+        outside: true
+      });
+    }
+    if (!rendered.RAILWAY_TCP_PROXY_DOMAIN) {
+      actions.push({
+        label: `${devName}/${pgName}: open a TCP proxy, so the playground can copy from it (strong password; the copy logs in as the superuser)`,
+        run: async () => {
+          await rw.createTcpProxy(pgName, devName, 5432);
+          const up2 = await waitFor("waiting for the proxy", async () => (await rw.rendered(pgName, devName)).RAILWAY_TCP_PROXY_DOMAIN ? true : null, 12e4, 3e3);
+          if (!up2) throw new Error(`The TCP proxy on ${devName}/${pgName} did not appear. Run the installer again in a minute.`);
+        },
+        outside: true
+      });
+    }
+  }
+  if (redisName) pushRedisFix(actions, rw, devName, devServices.find((s) => s.name === redisName), true);
+  const siteRepo = siteSpec.source.repo;
+  const existingText = await gh.file(siteRepo, "tapthat.config.json", branch);
+  let config = plan.config;
+  if (existingText) {
+    try {
+      config = JSON.parse(existingText);
+    } catch {
+      throw new Error(`${siteRepo}/tapthat.config.json on ${branch} is not valid JSON. Fix it, or delete it to have one generated.`);
+    }
+    ok(`${siteRepo} has tapthat.config.json on ${branch} ${dim("(kept as it is)")}`);
+  } else {
+    actions.push({
+      label: `commit a generated tapthat.config.json to ${siteRepo} on ${branch}`,
+      run: () => gh.putFile(siteRepo, "tapthat.config.json", branch, `${JSON.stringify(plan.config, null, 2)}
+`, "Add tapthat.config.json (TapThat playground)")
+    });
+  }
+  const playgroundEnv = envs.find((e) => e.name === opts.playground);
+  let playground = playgroundEnv?.services ?? null;
+  const playgroundCreated = !playground;
+  if (!playground) {
+    actions.push({
+      label: `create environment ${bold(opts.playground)} as a copy of ${devName}, keeping ${[...topo.kept].join(", ") || "nothing else"}`,
+      run: async () => {
+        await rw.createEnvironment(opts.playground, devName);
+        playground = await waitForServices(rw, project, opts.playground, devServices.length);
+        for (const s of playground.filter((s2) => !topo.kept.includes(s2.name))) {
+          await rw.deleteService(s.name, opts.playground);
+        }
+        playground = await load(opts.playground);
+      }
+    });
+  } else {
+    ok(`environment ${bold(opts.playground)} exists`);
+    for (const name of topo.kept.filter((n) => !playground.some((s) => s.name === n))) {
+      const used = usesOf(config, devServices, topo.included, name);
+      if (used.length) warn(`${opts.playground} has no ${name}, but the config passes on ${used.join(", ")}, which ${used.length === 1 ? "uses" : "use"} it. Add ${name} to ${opts.playground}, or change the config.`);
+    }
+    const pg = pgName && playground.find((s) => s.name === pgName);
+    if (pg && isLiteralTemplate(pg.variables.POSTGRES_PASSWORD)) {
+      actions.push({
+        label: `${opts.playground}/${pgName}: replace the guessable superuser password`,
+        run: () => rotatePostgres(rw, opts.playground, pgName)
+      });
+    }
+    const redis = redisName && playground.find((s) => s.name === redisName);
+    if (redis) pushRedisFix(actions, rw, opts.playground, redis);
+  }
+  const rewriteKept = async () => {
+    for (const [service, vars] of keptRewrites(playground, topo, plan.ports)) {
+      await rw.setPlain(service, opts.playground, vars);
+      await rw.redeploy(service, opts.playground);
+    }
+  };
+  if (!playground) {
+    actions.push({ label: `point the kept services at the workspace where they referred to ${[...topo.included, ...topo.dropped].join("/")}`, run: rewriteKept });
+  } else {
+    const pending = keptRewrites(playground, topo, plan.ports);
+    if (pending.size) {
+      const what = [...pending].map(([svc, vars]) => `${svc} (${Object.keys(vars).join(", ")})`).join("; ");
+      actions.push({ label: `point ${what} at the workspace instead of services the playground leaves out`, run: rewriteKept });
+    }
+  }
+  const workspace = playground?.find((s) => s.source.image?.includes("tapthat-server")) ?? playground?.find((s) => s.name === WORKSPACE);
+  const wsName = workspace?.name ?? WORKSPACE;
+  if (!workspace) {
+    actions.push({
+      label: `add the ${bold(WORKSPACE)} service (${IMAGE}) with a volume at /workspace`,
+      run: async () => {
+        const linkedEnv = await linkedEnvironment(rw);
+        const others = (await rw.project() ?? project).environments.map((e) => e.name).filter((e) => e !== opts.playground);
+        const hadIt = /* @__PURE__ */ new Set();
+        for (const e of others) if ((await load(e)).some((s) => s.name === WORKSPACE)) hadIt.add(e);
+        await rw.linkTo(project, opts.playground);
+        try {
+          await rw.addImageService(WORKSPACE, IMAGE);
+          await waitForServices(rw, project, opts.playground, 1, (s) => s.some((x) => x.name === WORKSPACE));
+          await rw.linkTo(project, opts.playground, WORKSPACE);
+          await rw.addVolume("/workspace");
+        } finally {
+          if (linkedEnv) await rw.linkTo(project, linkedEnv).catch(() => void 0);
+        }
+        for (const e of others) {
+          if (!hadIt.has(e) && (await load(e)).some((s) => s.name === WORKSPACE)) {
+            await rw.deleteService(WORKSPACE, e);
+            ok(`removed the ${WORKSPACE} copy Railway also created in ${e}`);
+          }
+        }
+      }
+    });
+  } else ok(`${opts.playground} has the ${wsName} service`);
+  if (workspace?.deploy?.healthcheckPath !== "/__tapthat/healthz" || !workspace || Number(workspace.deploy?.healthcheckTimeout) < 900) {
+    actions.push({
+      label: `${wsName}: health check /__tapthat/healthz with 15 minutes to boot (the first boot installs every repo)`,
+      run: () => rw.editServices(
+        opts.playground,
+        [
+          [wsName, "deploy.healthcheckPath", "/__tapthat/healthz"],
+          [wsName, "deploy.healthcheckTimeout", "900"]
+        ],
+        "TapThat workspace health check"
+      )
+    });
+  }
+  const current = workspace?.variables ?? {};
+  const base = baseVariables(siteRepo, site);
+  const { set: missing, unknown } = missingVariables(configPlaceholders(config), base, plan.variables, current);
+  for (const name of unknown) warn(`the config reads ${name}, which the installer cannot work out: set it on ${wsName} by hand`);
+  const generated = {};
+  if (!current.TAPTHAT_TOKEN) generated.TAPTHAT_TOKEN = token;
+  if (!current.TAPTHAT_ENCRYPTION_KEY) generated.TAPTHAT_ENCRYPTION_KEY = key32;
+  const devPg = pgName ? await rw.rendered(pgName, devName) : {};
+  const devUrlNow = devDatabaseUrl(devPg);
+  const devUrlStale = !!pgName && (devPasswordChanges || !devUrlNow || current.TAPTHAT_DEV_DATABASE_URL !== devUrlNow);
+  const needsGitToken = !current.TAPTHAT_GIT_TOKEN;
+  const varCount = Object.keys(missing).length + Object.keys(generated).length + (devUrlStale ? 1 : 0);
+  if (varCount) {
+    actions.push({
+      label: `${wsName}: set ${varCount} variable${varCount === 1 ? "" : "s"} ${dim(`(${[...Object.keys(missing), ...Object.keys(generated), ...devUrlStale ? ["TAPTHAT_DEV_DATABASE_URL"] : []].slice(0, 6).join(", ")}${varCount > 6 ? ", \u2026" : ""})`)}`,
+      run: async () => {
+        const plain = {};
+        for (const [k, v] of Object.entries(missing)) {
+          if (plan.secretKeys.has(k)) await rw.setSecret(wsName, opts.playground, k, v);
+          else plain[k] = v;
+        }
+        await rw.setPlain(wsName, opts.playground, plain);
+        for (const [k, make] of Object.entries(generated)) await rw.setSecret(wsName, opts.playground, k, make());
+        if (devUrlStale) {
+          const url2 = devDatabaseUrl(await rw.rendered(pgName, devName));
+          if (!url2) throw new Error(`${devName}/${pgName} has no TCP proxy yet; run the installer again in a minute.`);
+          await rw.setSecret(wsName, opts.playground, "TAPTHAT_DEV_DATABASE_URL", url2);
+        }
+      }
+    });
+  }
+  let gitToken = null;
+  const includedRepos = topo.included.map((n) => devServices.find((s) => s.name === n).source.repo);
+  if (needsGitToken) {
+    todo(`${wsName} needs a GitHub token that can push to ${includedRepos.join(", ")}`);
+    if (opts.dryRun) say(dim("  would ask for it"));
+    else {
+      say(dim(`  Create a fine-grained token: https://github.com/settings/personal-access-tokens/new`));
+      say(dim(`  Resource owner: ${includedRepos[0].split("/")[0]} \xB7 Repositories: ${includedRepos.map((r) => r.split("/")[1]).join(", ")} \xB7 Contents: Read and write`));
+      for (let attempt = 0; ; attempt++) {
+        gitToken = opts.gitTokenStdin ? await readAllStdin() : await p.secret("Paste the token");
+        const denied = [];
+        for (const repo of includedRepos) if (!await canPush(gitToken, repo)) denied.push(repo);
+        if (!denied.length) {
+          ok(`the token can push to ${includedRepos.join(", ")}`);
+          break;
+        }
+        fail(`the token cannot push to ${denied.join(", ")}`);
+        if (opts.gitTokenStdin || attempt >= 2) throw new Error("No working GitHub token.");
+      }
+      const t = gitToken;
+      actions.push({ label: `${wsName}: store the GitHub token`, run: () => rw.setSecret(wsName, opts.playground, "TAPTHAT_GIT_TOKEN", t) });
+    }
+  }
+  if (!workspace?.domains.length) {
+    actions.push({
+      label: `${wsName}: a public domain`,
+      run: async () => {
+        await rw.createDomain(wsName, opts.playground, SIDECAR_PORT);
+      }
+    });
+  }
+  heading(actions.length ? "Changes" : "Everything is in place");
+  actions.forEach((a, i) => say(`  ${dim(`${i + 1}.`)} ${a.label}`));
+  if (opts.dryRun) {
+    say(`
+${dim("Dry run: nothing was changed.")}`);
+    return 0;
+  }
+  if (actions.length) {
+    if (!await p.confirm(`Make these ${actions.length} change${actions.length === 1 ? "" : "s"}?`)) {
+      say("Nothing was changed.");
+      return 1;
+    }
+    for (const a of actions) {
+      await a.run();
+      ok(a.label);
+    }
+  }
+  heading("Workspace");
+  const finalServices = await load(opts.playground);
+  const ws = finalServices.find((s) => s.name === wsName);
+  if (!ws) throw new Error(`${opts.playground} has no ${wsName} service after setup.`);
+  const url = ws.domains[0] ? `${/^(localhost|127\.0\.0\.1)[:/]/.test(ws.domains[0]) ? "http" : "https"}://${ws.domains[0]}` : null;
+  if (!url) throw new Error(`${wsName} has no public domain.`);
+  const wsVars = await rw.rendered(wsName, opts.playground);
+  const healthy = async () => await getJson(`${url}/__tapthat/healthz`) !== null;
+  if (actions.some((a) => !a.outside) || !await healthy()) {
+    await rw.redeploy(wsName, opts.playground);
+    say(dim(`  deploying ${wsName}; the first boot clones and installs every repo`));
+    await sleep(15e3 * PACE);
+  }
+  const up = await waitFor(`waiting for ${url}`, async () => await healthy() ? true : null, 20 * 6e4, 1e4);
+  if (!up) throw new Error(`${wsName} did not become healthy in 20 minutes. Its deploy logs say why: railway logs -s ${wsName} -e ${opts.playground}`);
+  ok(`${url} is up`);
+  const auth = { authorization: `Bearer ${wsVars.TAPTHAT_TOKEN}` };
+  const session = await getJson(`${url}/__tapthat/api/session`, auth);
+  if (session && !session.session && !session.last && pgName && devCreated) {
+    say(dim(`  ${devName} is new and has no data yet: set its databases up, then press Start session to copy them`));
+  } else if (session && !session.session && !session.last && pgName) {
+    say(dim(`  first data copy from ${devName}`));
+    const started = await fetch(`${url}/__tapthat/api/session/start`, { method: "POST", headers: { ...auth, "content-type": "application/json" }, body: '{"reviewer":"installer"}' });
+    if (started.status !== 202) throw new Error(`Start session answered ${started.status}: ${await started.text()}`);
+    const done = await waitFor(
+      `copying ${devName}'s data`,
+      async () => {
+        const s = await getJson(`${url}/__tapthat/api/session`, auth);
+        return s?.session && (s.session.state === "active" || s.session.state === "failed") ? s.session : null;
+      },
+      20 * 6e4
+    );
+    if (!done) throw new Error("The first data copy did not finish in 20 minutes; check the workspace log.");
+    if (done.state === "failed") throw new Error(`The first data copy failed: ${done.error}`);
+    await fetch(`${url}/__tapthat/api/session/discard`, { method: "POST", headers: { ...auth, "content-type": "application/json" }, body: '{"reviewer":"installer"}' });
+    ok(`${opts.playground} has ${devName}'s data`);
+    if (playgroundCreated) {
+      for (const s of finalServices.filter((s2) => topo.kept.includes(s2.name) && isRepoService(s2))) await rw.redeploy(s.name, opts.playground);
+      ok(`redeployed ${topo.kept.filter((n) => finalServices.find((s) => s.name === n && isRepoService(s))).join(", ")}`);
+    }
+  }
+  const dangling = danglingReferences(finalServices);
+  if (dangling.length) warn(`references to services ${opts.playground} does not have: ${dangling.join("; ")}`);
+  heading("Done. In the TapThat extension, open Settings and fill in");
+  say(`  Server URL   ${bold(url)}`);
+  if (process.platform === "darwin" && process.stdout.isTTY && (await run2("pbcopy", [], { input: wsVars.TAPTHAT_TOKEN ?? "" })).code === 0) {
+    say(`  Token        ${green("on your clipboard")} ${dim(`(also: railway variable list -s ${wsName} -e ${opts.playground} --kv | grep TAPTHAT_TOKEN)`)}`);
+  } else {
+    say(`  Token        ${dim(`railway variable list -s ${wsName} -e ${opts.playground} --kv | grep TAPTHAT_TOKEN`)}`);
+  }
+  say(`  Sites        ${url}`);
+  say(`
+  Then open ${url}, press ${bold("Start session")} and comment away. ${dim("Run this installer again any time; it only fixes what is missing.")}`);
+  return 0;
+}
+function usesOf(config, devServices, included, service) {
+  const repos = config.repos ?? [];
+  const out = [];
+  for (const name of included) {
+    const spec = devServices.find((s) => s.name === name);
+    const env = repos.find((r) => r.name === name)?.devServer?.env ?? {};
+    for (const [key, value] of Object.entries(spec?.variables ?? {})) {
+      if (key in env && value.includes(`\${{${service}.`)) out.push(`${name}.${key}`);
+    }
+  }
+  return out;
+}
+function mode(values) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const v of values) counts.set(v, (counts.get(v) ?? 0) + 1);
+  return [...counts].sort((a, b) => b[1] - a[1])[0]?.[0] ?? null;
+}
+async function linkedEnvironment(rw) {
+  const r = await run2(process.env.TAPTHAT_RAILWAY_BIN ?? "railway", ["status"], { cwd: rw.cwd });
+  return /Environment:\s+(\S+)/.exec(r.stdout)?.[1] ?? null;
+}
+async function waitForServices(rw, project, env, expected, ready = (s) => s.length >= expected) {
+  const fresh = await rw.project() ?? project;
+  const got = await waitFor(`waiting for ${env}'s services`, async () => {
+    const s = await rw.services(fresh, env).catch(() => null);
+    return s && ready(s) ? s : null;
+  }, 18e4, 5e3);
+  if (!got) {
+    throw new Error(
+      `Railway created ${env} without the services it should have. Delete ${env} in the dashboard (or duplicate it there: environment settings \u2192 Duplicate) and run the installer again.`
+    );
+  }
+  return got;
+}
+function pushRedisFix(actions, rw, env, redis, outside = false) {
+  const missing = Object.entries(REDIS_TEMPLATE_VARIABLES).filter(([k, v]) => redis.variables[k] !== v && !(k !== "RAILWAY_RUN_UID" && redis.variables[k]));
+  const noPassword = !redis.variables.REDIS_PASSWORD;
+  if (!missing.length && !noPassword) return;
+  actions.push({
+    label: `${env}/${redis.name}: ${[noPassword && "a password", missing.length && `the template's variables (${missing.map(([k]) => k).join(", ")})`].filter(Boolean).join(" and ")}`,
+    run: async () => {
+      if (noPassword) await rw.setSecret(redis.name, env, "REDIS_PASSWORD", token());
+      await rw.setPlain(redis.name, env, Object.fromEntries(missing));
+      await rw.redeploy(redis.name, env);
+    },
+    outside
+  });
+}
+async function rotatePostgres(rw, env, service) {
+  const psql2 = await psqlRunner();
+  let vars = await rw.rendered(service, env);
+  let temporary = false;
+  if (!vars.RAILWAY_TCP_PROXY_DOMAIN) {
+    await rw.createTcpProxy(service, env, 5432);
+    temporary = true;
+    const up = await waitFor("waiting for a temporary TCP proxy", async () => {
+      const v = await rw.rendered(service, env);
+      return v.RAILWAY_TCP_PROXY_DOMAIN ? v : null;
+    }, 12e4, 3e3);
+    if (!up) throw new Error(`The temporary TCP proxy on ${env}/${service} did not appear.`);
+    vars = up;
+  }
+  const conn = { PGHOST: vars.RAILWAY_TCP_PROXY_DOMAIN, PGPORT: vars.RAILWAY_TCP_PROXY_PORT, PGUSER: vars.PGUSER, PGDATABASE: "postgres" };
+  const old = vars.PGPASSWORD;
+  const fresh = token();
+  const reachable = await waitFor("waiting for Postgres", async () => await psql2({ ...conn, PGPASSWORD: old }, "select 1") === 0 ? true : null, 9e4, 3e3);
+  if (!reachable) throw new Error(`Could not log in to ${env}/${service} with its stored password.`);
+  const sql = `\\set ON_ERROR_STOP on
+\\getenv new_pw NEW_PW
+ALTER ROLE ${quoteIdent2(conn.PGUSER)} PASSWORD :'new_pw';
+`;
+  if (await psql2({ ...conn, PGPASSWORD: old, NEW_PW: fresh }, sql) !== 0) throw new Error(`Changing the password inside ${env}/${service} failed.`);
+  await rw.setSecret(service, env, "POSTGRES_PASSWORD", fresh);
+  if (await psql2({ ...conn, PGPASSWORD: fresh }, "select 1") !== 0) throw new Error(`${env}/${service}: the new password does not log in.`);
+  if (await psql2({ ...conn, PGPASSWORD: old }, "select 1") === 0) throw new Error(`${env}/${service}: the old password still logs in.`);
+  if (temporary) for (const id of await rw.tcpProxyIds(service, env)) await rw.deleteTcpProxy(id, service, env);
+}
+async function psqlRunner() {
+  const local = await run2("psql", ["--version"]);
+  const major = Number(/(\d+)\./.exec(local.stdout)?.[1] ?? 0);
+  if (local.code === 0 && major >= 15) {
+    return async (env, sql) => (await run2("psql", ["-qAt", "--file", "-"], { env, input: sql })).code;
+  }
+  if ((await run2("docker", ["info"])).code !== 0) {
+    throw new Error("Changing the Postgres password needs psql 15+ or Docker running. Install one and run the installer again.");
+  }
+  return async (env, sql) => (await run2("docker", ["run", "--rm", "-i", ...Object.keys(env).flatMap((k) => ["-e", k]), "postgres:18-alpine", "psql", "-qAt", "--file", "-"], { env, input: sql })).code;
+}
+async function getJson(url, headers = {}) {
+  try {
+    const res = await fetch(url, { headers, signal: AbortSignal.timeout(1e4) });
+    return res.ok ? await res.json() : null;
+  } catch {
+    return null;
+  }
+}
+var INSTALL_USAGE, token, key32, quoteIdent2;
+var init_install = __esm({
+  "src/install/index.ts"() {
+    "use strict";
+    init_github();
+    init_model();
+    init_railway();
+    init_sh();
+    init_ui();
+    INSTALL_USAGE = `tapthat-server install \u2014 set up a TapThat playground environment
+
+  Run it in a folder linked to your Railway project (or it links one).
+  Asks for the platform, your dev branch and the site reviewers comment on;
+  finds and fixes everything else, after one confirmation.
+
+  --platform <name>     railway (the only one for now)
+  --branch <name>       the dev branch Commit pushes to (asks; default dev)
+  --site <service>      the service reviewers comment on (asks; suggests one)
+  --playground <name>   the playground environment (default tapthat)
+  --dry-run             show what would change, change nothing
+  --yes                 accept defaults and the plan without asking
+  --git-token-stdin     read the workspace's GitHub token from stdin
+
+  Needs the Railway CLI (logged in) and the GitHub CLI (gh, logged in).`;
+    token = () => randomBytes3(24).toString("base64url");
+    key32 = () => randomBytes3(32).toString("base64");
+    quoteIdent2 = (s) => `"${s.replace(/"/g, '""')}"`;
+  }
+});
 
 // src/cli.ts
-import { execFile as execFile3, spawn as spawn3 } from "node:child_process";
-import { createHash as createHash2, randomBytes as randomBytes3 } from "node:crypto";
+import { execFile as execFile3, spawn as spawn4 } from "node:child_process";
+import { createHash as createHash2, randomBytes as randomBytes4 } from "node:crypto";
 import { existsSync } from "node:fs";
 import { appendFile as appendFile2, chmod, mkdir as mkdir5, readdir as readdir2, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join7, relative as relative2, resolve as resolve3 } from "node:path";
@@ -853,9 +2081,9 @@ import { rm } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { promisify } from "node:util";
 var exec = promisify(execFile);
-function gitAuthArgs(token) {
-  if (!token) return [];
-  const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
+function gitAuthArgs(token2) {
+  if (!token2) return [];
+  const basic = Buffer.from(`x-access-token:${token2}`).toString("base64");
   return ["-c", `http.extraHeader=Authorization: Basic ${basic}`];
 }
 var Repo = class _Repo {
@@ -1067,11 +2295,11 @@ var Repo = class _Repo {
   async deleteBranch(branch) {
     await this.git("branch", "-D", branch);
   }
-  static async clone(url, branch, dest, token) {
-    await exec("git", [...gitAuthArgs(token), "clone", "--branch", branch, url, dest], {
+  static async clone(url, branch, dest, token2) {
+    await exec("git", [...gitAuthArgs(token2), "clone", "--branch", branch, url, dest], {
       maxBuffer: 16 * 1024 * 1024
     });
-    return new _Repo(dest, token);
+    return new _Repo(dest, token2);
   }
   /**
    * The first half of an all-or-nothing undo across repositories: the revert is
@@ -1632,14 +2860,14 @@ var Sessions = class {
     const s = this.current();
     if (!s) return;
     if (BUSY.has(s.state)) {
-      this.fail(s, `The sidecar restarted while the session was ${s.state}. Discard it and start again.`);
+      this.fail(s, `The sidecar restarted while the session was ${s.state}. Cancel the session and start again.`);
       return;
     }
     if (s.state === "active") {
       for (const e of this.deps.workspace.entries) {
         const on = await e.repo.branch().catch(() => null);
         if (on !== s.branch) {
-          this.fail(s, `${e.name} is no longer on the session branch (${on ?? "unknown"}). Discard the session and start again.`);
+          this.fail(s, `${e.name} is no longer on the session branch (${on ?? "unknown"}). Cancel the session and start again.`);
           return;
         }
       }
@@ -1696,7 +2924,7 @@ var Sessions = class {
       );
     }
     if (existing?.state === "failed") {
-      throw new SessionError(409, "session_failed", "The last session failed. Discard it first, which also resets the data.");
+      throw new SessionError(409, "session_failed", "The last session failed. Cancel it first, which also resets the data.");
     }
     const id = sessionId();
     const session = {
@@ -2562,13 +3790,13 @@ ${p}\r
     ...db ? [cmd("SELECT", String(db))] : [],
     cmd("FLUSHDB")
   ];
-  await new Promise((done, fail) => {
+  await new Promise((done, fail2) => {
     const socket = tls ? tlsConnect({ host, port, servername: host }) : netConnect({ host, port });
     let replies = 0;
     let buffer = "";
     socket.setTimeout(1e4, () => {
       socket.destroy();
-      fail(new Error("Redis did not answer in time"));
+      fail2(new Error("Redis did not answer in time"));
     });
     socket.on("connect", () => socket.write(commands.join("")));
     socket.on("secureConnect", () => socket.write(commands.join("")));
@@ -2579,7 +3807,7 @@ ${p}\r
       for (const line of lines) {
         if (line.startsWith("-")) {
           socket.destroy();
-          fail(new Error(`Redis refused: ${line.slice(1)}`));
+          fail2(new Error(`Redis refused: ${line.slice(1)}`));
           return;
         }
         if (line.startsWith("+")) replies++;
@@ -2589,7 +3817,7 @@ ${p}\r
         done();
       }
     });
-    socket.on("error", fail);
+    socket.on("error", fail2);
   });
 }
 function makeSnapshotHooks(deps) {
@@ -2757,6 +3985,7 @@ var Store = class _Store {
 // src/cli.ts
 var USAGE = `tapthat-server \u2014 apply TapThat comments to this repo with a coding agent
 
+  tapthat-server install                 set up a playground environment on Railway (see install --help)
   tapthat-server init                    write tapthat.config.json and generate secrets
   tapthat-server serve                   start the HTTP API (default)
   tapthat-server run-file <batch.json>   run one batch from a file (no HTTP)
@@ -2764,7 +3993,7 @@ var USAGE = `tapthat-server \u2014 apply TapThat comments to this repo with a co
   tapthat-server audit-prod              fail if the sidecar is in a production dependency tree
 
 Development tool only. serve and run-file require TAPTHAT_ENABLE=1.`;
-var VERSION = "0.1.1";
+var VERSION = "0.2.0";
 var SECRETS_FILE = join7(".tapthat", "secrets.env");
 var execFileP = promisify3(execFile3);
 function credentialFromEnv() {
@@ -2906,7 +4135,7 @@ async function prepareAll(config) {
 }
 function runShell(command, cwd, env = {}) {
   return new Promise((done) => {
-    const child = spawn3(command, { cwd, shell: true, stdio: "inherit", env: { ...process.env, ...env } });
+    const child = spawn4(command, { cwd, shell: true, stdio: "inherit", env: { ...process.env, ...env } });
     child.on("exit", (code) => done(code ?? 1));
     child.on("error", () => done(1));
   });
@@ -2956,8 +4185,8 @@ state: ${result.state}`);
 async function cmdServe() {
   let config = await readConfig(process.cwd(), true);
   if (!config) return 78;
-  const token = process.env.TAPTHAT_TOKEN ?? null;
-  if (config.auth.mode === "token" && !token) {
+  const token2 = process.env.TAPTHAT_TOKEN ?? null;
+  if (config.auth.mode === "token" && !token2) {
     console.error(
       'TAPTHAT_TOKEN is not set.\n\nThis endpoint accepts instructions that modify your repository, so it will not\nstart unauthenticated. Run `npx tapthat-server init` to generate one, or set\nauth.mode to "none" (permitted only when bound to loopback).'
     );
@@ -3012,7 +4241,10 @@ async function cmdServe() {
       return 1;
     }
   }
-  if (!await prepareAll(config)) return 1;
+  if (!await prepareAll(config)) {
+    if (!config.session.snapshot) return 1;
+    console.error("[tapthat] continuing without it: Start session copies the data and prepares again");
+  }
   const servers = new DevServers(
     config.devServer.start ? config.repos.filter((r) => r.devServer?.command).map((r) => ({ name: r.name, command: r.devServer.command, cwd: r.root, url: r.devServer.url, env: r.devServer.env })) : []
   );
@@ -3037,7 +4269,7 @@ async function cmdServe() {
     sessionHooks,
     store,
     encryptionKey,
-    token,
+    token: token2,
     envCredential: credentialFromEnv(),
     version: VERSION,
     agentVersion,
@@ -3070,7 +4302,7 @@ async function cmdServe() {
   console.log("");
   console.log("  Paste into the extension options page:");
   console.log(`    Sidecar URL  ${sidecarUrl}`);
-  console.log(`    Token        ${token ? `${token.slice(0, 4)}\u2026 (TAPTHAT_TOKEN)` : "(auth disabled)"}`);
+  console.log(`    Token        ${token2 ? `${token2.slice(0, 4)}\u2026 (TAPTHAT_TOKEN)` : "(auth disabled)"}`);
   if (platform && config.git.push && config.git.mode === "commit") {
     console.log("");
     console.log(`  \u26A0 ${platform} redeploys on push. git.push is enabled, so if this service`);
@@ -3151,21 +4383,21 @@ Run init in the root of the repository you want the agent to edit.`);
     console.log(`  wrote    ${CONFIG_FILENAME} (branch "${branch}", dev server ${dev.url})`);
   }
   const secretsPath = join7(cwd, SECRETS_FILE);
-  let token;
+  let token2;
   if (existsSync(secretsPath)) {
     await loadSecretsFile(cwd);
-    token = process.env.TAPTHAT_TOKEN ?? "(see .tapthat/secrets.env)";
+    token2 = process.env.TAPTHAT_TOKEN ?? "(see .tapthat/secrets.env)";
     console.log(`  kept     ${SECRETS_FILE} (already exists)`);
   } else {
-    token = randomBytes3(24).toString("base64url");
-    const key = randomBytes3(32).toString("base64");
+    token2 = randomBytes4(24).toString("base64url");
+    const key = randomBytes4(32).toString("base64");
     await mkdir5(join7(cwd, ".tapthat"), { recursive: true });
     await writeFile3(
       secretsPath,
       [
         "# Generated by `tapthat-server init`. Never commit this file.",
         "# The bearer token the extension sends, and the key that seals stored credentials.",
-        `TAPTHAT_TOKEN=${token}`,
+        `TAPTHAT_TOKEN=${token2}`,
         `TAPTHAT_ENCRYPTION_KEY=${key}`,
         ""
       ].join("\n")
@@ -3187,7 +4419,7 @@ Run init in the root of the repository you want the agent to edit.`);
   console.log("       TAPTHAT_ENABLE=1 npx tapthat-server");
   console.log("  3. In the TapThat extension's options page, paste:");
   console.log("       Sidecar URL   http://localhost:7420");
-  console.log(`       Token         ${token}`);
+  console.log(`       Token         ${token2}`);
   console.log(`       Allowed sites ${new URL(dev.url).origin}`);
   console.log("");
   console.log(`Branch "${branch}" is what the agent will commit to. Check out a dev branch first if`);
@@ -3242,6 +4474,21 @@ async function main() {
     console.log(VERSION);
     return 0;
   }
+  if (command === "install") {
+    const { install: install2, INSTALL_USAGE: INSTALL_USAGE2, parseInstallArgs: parseInstallArgs2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+    if (rest.includes("--help") || rest.includes("-h")) {
+      console.log(INSTALL_USAGE2);
+      return 0;
+    }
+    const opts = parseInstallArgs2(rest, process.cwd());
+    if (typeof opts === "string") {
+      console.error(`${opts}
+
+${INSTALL_USAGE2}`);
+      return 1;
+    }
+    return install2(opts);
+  }
   if (command === "init") return cmdInit();
   if (command === "audit-prod") return cmdAuditProd();
   await loadSecretsFile(process.cwd());