@infracraft/pulumi 1.16.7 → 1.17.0

package/dist/railway/bin/monitor-deployment.cjs

@@ -0,0 +1,38 @@
+const require_chunk = require('../../chunk-BVYJZCqc.cjs');
+const require_railway_deployment_monitor = require('../deployment-monitor.cjs');
+
+//#region src/railway/bin/monitor-deployment.ts
+/**
+* Runnable entry for the Railway deploy monitor — invoked by `RailwayDeploy` as
+* `node <dist>/railway/bin/monitor-deployment.mjs` after `railway up --detach`.
+*
+* Reads the deploy context from `IC_*` env vars, wires the real `fetch`/`setTimeout`/stderr
+* collaborators, and exits non-zero iff the Railway API reports a failed (or never-resolved-
+* after-failed-upload) deployment. All decision logic lives in the unit-tested
+* `deployment-monitor` module; this file is only IO + process glue.
+*/
+async function main() {
+	const result = await require_railway_deployment_monitor.monitorRailwayDeployment({
+		apiUrl: process.env.IC_API_URL || void 0,
+		projectToken: process.env.IC_TOK ?? "",
+		projectId: process.env.IC_PROJ ?? "",
+		environmentId: process.env.IC_ENV ?? "",
+		serviceId: process.env.IC_SVC ?? "",
+		deploymentId: process.env.IC_DEPLOY_ID || void 0,
+		uploadOutput: process.env.IC_UP_OUT,
+		uploadExitCode: Number(process.env.IC_UP_EXIT ?? "0"),
+		since: Number(process.env.IC_SINCE ?? "0")
+	}, {
+		fetch: globalThis.fetch,
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+		log: (line) => process.stderr.write(`${line}\n`)
+	});
+	process.exit(result.failed ? 1 : 0);
+}
+main().catch((error) => {
+	process.stderr.write(`[infracraft] deploy monitor crashed: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exit(1);
+});
+
+//#endregion
+//# sourceMappingURL=monitor-deployment.cjs.map

package/dist/railway/bin/monitor-deployment.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor-deployment.cjs","names":["monitorRailwayDeployment"],"sources":["../../../src/railway/bin/monitor-deployment.ts"],"sourcesContent":["/**\n * Runnable entry for the Railway deploy monitor — invoked by `RailwayDeploy` as\n * `node <dist>/railway/bin/monitor-deployment.mjs` after `railway up --detach`.\n *\n * Reads the deploy context from `IC_*` env vars, wires the real `fetch`/`setTimeout`/stderr\n * collaborators, and exits non-zero iff the Railway API reports a failed (or never-resolved-\n * after-failed-upload) deployment. All decision logic lives in the unit-tested\n * `deployment-monitor` module; this file is only IO + process glue.\n */\nimport { monitorRailwayDeployment } from \"../deployment-monitor\";\n\nasync function main(): Promise<void> {\n\tconst result = await monitorRailwayDeployment(\n\t\t{\n\t\t\t// Defaults to Railway's public API; override only to point at a proxy or a test server.\n\t\t\tapiUrl: process.env.IC_API_URL || undefined,\n\t\t\tprojectToken: process.env.IC_TOK ?? \"\",\n\t\t\tprojectId: process.env.IC_PROJ ?? \"\",\n\t\t\tenvironmentId: process.env.IC_ENV ?? \"\",\n\t\t\tserviceId: process.env.IC_SVC ?? \"\",\n\t\t\tdeploymentId: process.env.IC_DEPLOY_ID || undefined,\n\t\t\tuploadOutput: process.env.IC_UP_OUT,\n\t\t\tuploadExitCode: Number(process.env.IC_UP_EXIT ?? \"0\"),\n\t\t\tsince: Number(process.env.IC_SINCE ?? \"0\"),\n\t\t},\n\t\t{\n\t\t\tfetch: globalThis.fetch,\n\t\t\tsleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n\t\t\tlog: (line) => process.stderr.write(`${line}\\n`),\n\t\t},\n\t);\n\n\tprocess.exit(result.failed ? 1 : 0);\n}\n\nmain().catch((error) => {\n\tprocess.stderr.write(\n\t\t`[infracraft] deploy monitor crashed: ${error instanceof Error ? error.message : String(error)}\\n`,\n\t);\n\n\tprocess.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;AAWA,eAAe,OAAsB;CACpC,MAAM,SAAS,MAAMA,4DACpB;EAEC,QAAQ,QAAQ,IAAI,cAAc;EAClC,cAAc,QAAQ,IAAI,UAAU;EACpC,WAAW,QAAQ,IAAI,WAAW;EAClC,eAAe,QAAQ,IAAI,UAAU;EACrC,WAAW,QAAQ,IAAI,UAAU;EACjC,cAAc,QAAQ,IAAI,gBAAgB;EAC1C,cAAc,QAAQ,IAAI;EAC1B,gBAAgB,OAAO,QAAQ,IAAI,cAAc,GAAG;EACpD,OAAO,OAAO,QAAQ,IAAI,YAAY,GAAG;CAC1C,GACA;EACC,OAAO,WAAW;EAClB,QAAQ,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;EAC/D,MAAM,SAAS,QAAQ,OAAO,MAAM,GAAG,KAAK,GAAG;CAChD,CACD;CAEA,QAAQ,KAAK,OAAO,SAAS,IAAI,CAAC;AACnC;AAEA,KAAK,EAAE,OAAO,UAAU;CACvB,QAAQ,OAAO,MACd,wCAAwC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAChG;CAEA,QAAQ,KAAK,CAAC;AACf,CAAC"}

package/dist/railway/bin/monitor-deployment.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/railway/bin/monitor-deployment.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/railway/bin/monitor-deployment.mjs

@@ -0,0 +1,39 @@
+import { t as __name } from "../../chunk-OPjESj5l.mjs";
+import { monitorRailwayDeployment } from "../deployment-monitor.mjs";
+
+//#region src/railway/bin/monitor-deployment.ts
+/**
+* Runnable entry for the Railway deploy monitor — invoked by `RailwayDeploy` as
+* `node <dist>/railway/bin/monitor-deployment.mjs` after `railway up --detach`.
+*
+* Reads the deploy context from `IC_*` env vars, wires the real `fetch`/`setTimeout`/stderr
+* collaborators, and exits non-zero iff the Railway API reports a failed (or never-resolved-
+* after-failed-upload) deployment. All decision logic lives in the unit-tested
+* `deployment-monitor` module; this file is only IO + process glue.
+*/
+async function main() {
+	const result = await monitorRailwayDeployment({
+		apiUrl: process.env.IC_API_URL || void 0,
+		projectToken: process.env.IC_TOK ?? "",
+		projectId: process.env.IC_PROJ ?? "",
+		environmentId: process.env.IC_ENV ?? "",
+		serviceId: process.env.IC_SVC ?? "",
+		deploymentId: process.env.IC_DEPLOY_ID || void 0,
+		uploadOutput: process.env.IC_UP_OUT,
+		uploadExitCode: Number(process.env.IC_UP_EXIT ?? "0"),
+		since: Number(process.env.IC_SINCE ?? "0")
+	}, {
+		fetch: globalThis.fetch,
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+		log: (line) => process.stderr.write(`${line}\n`)
+	});
+	process.exit(result.failed ? 1 : 0);
+}
+main().catch((error) => {
+	process.stderr.write(`[infracraft] deploy monitor crashed: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exit(1);
+});
+
+//#endregion
+export {  };
+//# sourceMappingURL=monitor-deployment.mjs.map

package/dist/railway/bin/monitor-deployment.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor-deployment.mjs","names":[],"sources":["../../../src/railway/bin/monitor-deployment.ts"],"sourcesContent":["/**\n * Runnable entry for the Railway deploy monitor — invoked by `RailwayDeploy` as\n * `node <dist>/railway/bin/monitor-deployment.mjs` after `railway up --detach`.\n *\n * Reads the deploy context from `IC_*` env vars, wires the real `fetch`/`setTimeout`/stderr\n * collaborators, and exits non-zero iff the Railway API reports a failed (or never-resolved-\n * after-failed-upload) deployment. All decision logic lives in the unit-tested\n * `deployment-monitor` module; this file is only IO + process glue.\n */\nimport { monitorRailwayDeployment } from \"../deployment-monitor\";\n\nasync function main(): Promise<void> {\n\tconst result = await monitorRailwayDeployment(\n\t\t{\n\t\t\t// Defaults to Railway's public API; override only to point at a proxy or a test server.\n\t\t\tapiUrl: process.env.IC_API_URL || undefined,\n\t\t\tprojectToken: process.env.IC_TOK ?? \"\",\n\t\t\tprojectId: process.env.IC_PROJ ?? \"\",\n\t\t\tenvironmentId: process.env.IC_ENV ?? \"\",\n\t\t\tserviceId: process.env.IC_SVC ?? \"\",\n\t\t\tdeploymentId: process.env.IC_DEPLOY_ID || undefined,\n\t\t\tuploadOutput: process.env.IC_UP_OUT,\n\t\t\tuploadExitCode: Number(process.env.IC_UP_EXIT ?? \"0\"),\n\t\t\tsince: Number(process.env.IC_SINCE ?? \"0\"),\n\t\t},\n\t\t{\n\t\t\tfetch: globalThis.fetch,\n\t\t\tsleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n\t\t\tlog: (line) => process.stderr.write(`${line}\\n`),\n\t\t},\n\t);\n\n\tprocess.exit(result.failed ? 1 : 0);\n}\n\nmain().catch((error) => {\n\tprocess.stderr.write(\n\t\t`[infracraft] deploy monitor crashed: ${error instanceof Error ? error.message : String(error)}\\n`,\n\t);\n\n\tprocess.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;AAWA,eAAe,OAAsB;CACpC,MAAM,SAAS,MAAM,yBACpB;EAEC,QAAQ,QAAQ,IAAI,cAAc;EAClC,cAAc,QAAQ,IAAI,UAAU;EACpC,WAAW,QAAQ,IAAI,WAAW;EAClC,eAAe,QAAQ,IAAI,UAAU;EACrC,WAAW,QAAQ,IAAI,UAAU;EACjC,cAAc,QAAQ,IAAI,gBAAgB;EAC1C,cAAc,QAAQ,IAAI;EAC1B,gBAAgB,OAAO,QAAQ,IAAI,cAAc,GAAG;EACpD,OAAO,OAAO,QAAQ,IAAI,YAAY,GAAG;CAC1C,GACA;EACC,OAAO,WAAW;EAClB,QAAQ,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;EAC/D,MAAM,SAAS,QAAQ,OAAO,MAAM,GAAG,KAAK,GAAG;CAChD,CACD;CAEA,QAAQ,KAAK,OAAO,SAAS,IAAI,CAAC;AACnC;AAEA,KAAK,EAAE,OAAO,UAAU;CACvB,QAAQ,OAAO,MACd,wCAAwC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAChG;CAEA,QAAQ,KAAK,CAAC;AACf,CAAC"}

package/dist/railway/deploy.cjs

@@ -3,23 +3,16 @@ const require_chunk = require('../chunk-BVYJZCqc.cjs');
 const require_commands_deploy = require('../commands/deploy.cjs');
 let _pulumi_pulumi = require("@pulumi/pulumi");
 _pulumi_pulumi = require_chunk.__toESM(_pulumi_pulumi, 1);
+let node_url = require("node:url");
 
 //#region src/railway/deploy.ts
 /**
-* The deploy-wait poller. `railway up --ci` only blocks until upload; this polls
-* the Railway GraphQL API to a terminal status and fails the resource on
-* FAILED/CRASHED/REMOVED. Runs under `node -e`, single-quoted in the shell, so it
-* uses ONLY double quotes and reads inputs from IC_* env vars.
-*
-* Deployment-id resolution filters by `createdAt >= IC_SINCE` (the epoch captured
-* just before `railway up`, minus a clock-skew buffer) and picks the newest such
-* deployment. This prevents latching onto the PREVIOUS deployment when Railway's
-* API has not yet registered the new one (a plain `first:1` race). SLEEPING (the
-* service deployed then scaled to zero) is treated as success; SKIPPED (the
-* deploy was superseded) is non-blocking; an unresolvable id (upload already
-* succeeded) does not block the release.
+* Absolute path to the runnable deploy monitor, resolved next to this module in `dist`.
+* `railway up` only uploads + triggers; this bin makes the Railway GraphQL API — not the
+* CLI's exit code — the source of truth for pass/fail, and dumps build + deploy logs on
+* failure. Its logic lives in the unit-tested `deployment-monitor` module.
 */
-const DEPLOY_WAIT_SCRIPT = `const t=process.env.IC_TOK,p=process.env.IC_PROJ,e=process.env.IC_ENV,s=process.env.IC_SVC;const since=Number(process.env.IC_SINCE||0)-120000;const u="https://backboard.railway.app/graphql/v2";const q=(query,variables)=>fetch(u,{method:"POST",headers:{"Project-Access-Token":t,"Content-Type":"application/json"},body:JSON.stringify({query,variables})}).then(r=>r.json()).catch(()=>({}));const sl=ms=>new Promise(r=>setTimeout(r,ms));const ok={SUCCESS:1,SLEEPING:1};const bad={FAILED:1,CRASHED:1,REMOVED:1};(async()=>{let id;for(let i=0;i<12&&!id;i++){const d=await q("query($p:String!,$e:String!,$s:String!){deployments(first:10,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}",{p,e,s});const g=(d&&d.data&&d.data.deployments&&d.data.deployments.edges)||[];const fresh=g.map(x=>x.node).filter(n=>n&&n.createdAt&&Date.parse(n.createdAt)>=since).sort((a,b)=>Date.parse(b.createdAt)-Date.parse(a.createdAt));if(fresh[0])id=fresh[0].id;if(!id)await sl(5000);}if(!id){console.error("[infracraft] could not resolve a Railway deployment newer than this run; upload succeeded, not blocking");process.exit(0);}for(let i=0;i<120;i++){const r=await q("query($d:String!){deployment(id:$d){status}}",{d:id});const st=r&&r.data&&r.data.deployment&&r.data.deployment.status;if(st)console.error("[infracraft] railway deployment "+id+" status="+st);if(st&&ok[st])process.exit(0);if(st==="SKIPPED"){console.error("[infracraft] railway deployment "+id+" SKIPPED (superseded) — not blocking");process.exit(0);}if(st&&bad[st]){const l=await q("query($d:String!){deploymentLogs(deploymentId:$d,limit:60){message}}",{d:id});const lg=(l&&l.data&&l.data.deploymentLogs)||[];for(const x of lg)console.error("    "+(x.message||""));console.error("[infracraft] railway deployment "+id+" "+st+" — failing the Pulumi resource");process.exit(1);}await sl(10000);}console.error("[infracraft] timed out waiting for Railway deployment "+id);process.exit(1);})();`;
+const MONITOR_BIN = (0, node_url.fileURLToPath)(new URL("./bin/monitor-deployment.mjs", require("url").pathToFileURL(__filename).href));
 /**
 * Deploys a Railway service and waits for a terminal status. Isolation/git are the
 * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).
@@ -34,7 +27,7 @@ var RailwayDeploy = class extends _pulumi_pulumi.ComponentResource {
 	constructor(name, args, opts) {
 		const { provider, project, environment, service, projectToken, ...pulumiOpts } = opts;
 		super("infracraft:railway:Deploy", name, {}, pulumiOpts);
-		const cli = _pulumi_pulumi.interpolate`IC_SINCE=$(node -e "process.stdout.write(String(Date.now()))"); RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; if [ "$EXIT" -ne 0 ]; then exit "$EXIT"; fi; if [ -n "$INFRACRAFT_SKIP_DEPLOY_WAIT" ]; then exit 0; fi; IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node -e '${DEPLOY_WAIT_SCRIPT}'`;
+		const cli = _pulumi_pulumi.interpolate`IC_SINCE=$(node -e "process.stdout.write(String(Date.now()))"); IC_UP_OUT=$(RAILWAY_TOKEN=${projectToken} railway up --detach --json --project ${project.id} --service ${service.id} --environment ${environment.id} 2>&1); IC_UP_EXIT=$?; printf '%s\\n' "$IC_UP_OUT"; if [ -n "$INFRACRAFT_SKIP_DEPLOY_WAIT" ]; then exit "$IC_UP_EXIT"; fi; IC_UP_OUT="$IC_UP_OUT" IC_UP_EXIT=$IC_UP_EXIT IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node "${MONITOR_BIN}"`;
 		const setup = args.railpackConfig ? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, "'\\''")}' > railpack.json` : void 0;
 		const { deploymentUrl } = require_commands_deploy.createDeployCommand({
 			name,

package/dist/railway/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["pulumi","createDeployCommand"],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["// src/railway/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\nexport interface RailwayDeployConfig {\n\tbuilder?: RailwayBuilder;\n\tstartCommand?: string;\n\tpreDeployCommand?: string;\n}\n\nexport interface RailwayDeployArgs {\n\t/** Redeploy triggers (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\tprovider: RailwayProvider;\n\tproject: RailwayProject;\n\tenvironment: RailwayEnvironment;\n\tservice: RailwayService;\n\t/** Environment-scoped Railway deploy token (provision via RailwayProjectToken). */\n\tprojectToken: pulumi.Input<string>;\n};\n\n/**\n * The deploy-wait poller. `railway up --ci` only blocks until upload; this polls\n * the Railway GraphQL API to a terminal status and fails the resource on\n * FAILED/CRASHED/REMOVED. Runs under `node -e`, single-quoted in the shell, so it\n * uses ONLY double quotes and reads inputs from IC_* env vars.\n *\n * Deployment-id resolution filters by `createdAt >= IC_SINCE` (the epoch captured\n * just before `railway up`, minus a clock-skew buffer) and picks the newest such\n * deployment. This prevents latching onto the PREVIOUS deployment when Railway's\n * API has not yet registered the new one (a plain `first:1` race). SLEEPING (the\n * service deployed then scaled to zero) is treated as success; SKIPPED (the\n * deploy was superseded) is non-blocking; an unresolvable id (upload already\n * succeeded) does not block the release.\n */\nconst DEPLOY_WAIT_SCRIPT = `const t=process.env.IC_TOK,p=process.env.IC_PROJ,e=process.env.IC_ENV,s=process.env.IC_SVC;const since=Number(process.env.IC_SINCE||0)-120000;const u=\"https://backboard.railway.app/graphql/v2\";const q=(query,variables)=>fetch(u,{method:\"POST\",headers:{\"Project-Access-Token\":t,\"Content-Type\":\"application/json\"},body:JSON.stringify({query,variables})}).then(r=>r.json()).catch(()=>({}));const sl=ms=>new Promise(r=>setTimeout(r,ms));const ok={SUCCESS:1,SLEEPING:1};const bad={FAILED:1,CRASHED:1,REMOVED:1};(async()=>{let id;for(let i=0;i<12&&!id;i++){const d=await q(\"query($p:String!,$e:String!,$s:String!){deployments(first:10,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}\",{p,e,s});const g=(d&&d.data&&d.data.deployments&&d.data.deployments.edges)||[];const fresh=g.map(x=>x.node).filter(n=>n&&n.createdAt&&Date.parse(n.createdAt)>=since).sort((a,b)=>Date.parse(b.createdAt)-Date.parse(a.createdAt));if(fresh[0])id=fresh[0].id;if(!id)await sl(5000);}if(!id){console.error(\"[infracraft] could not resolve a Railway deployment newer than this run; upload succeeded, not blocking\");process.exit(0);}for(let i=0;i<120;i++){const r=await q(\"query($d:String!){deployment(id:$d){status}}\",{d:id});const st=r&&r.data&&r.data.deployment&&r.data.deployment.status;if(st)console.error(\"[infracraft] railway deployment \"+id+\" status=\"+st);if(st&&ok[st])process.exit(0);if(st===\"SKIPPED\"){console.error(\"[infracraft] railway deployment \"+id+\" SKIPPED (superseded) — not blocking\");process.exit(0);}if(st&&bad[st]){const l=await q(\"query($d:String!){deploymentLogs(deploymentId:$d,limit:60){message}}\",{d:id});const lg=(l&&l.data&&l.data.deploymentLogs)||[];for(const x of lg)console.error(\"    \"+(x.message||\"\"));console.error(\"[infracraft] railway deployment \"+id+\" \"+st+\" — failing the Pulumi resource\");process.exit(1);}await sl(10000);}console.error(\"[infracraft] timed out waiting for Railway deployment \"+id);process.exit(1);})();`;\n\n/**\n * Deploys a Railway service and waits for a terminal status. Isolation/git are the\n * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"mesh\", { triggers: [sourceHash], railpackConfig: { apt: [\"libatomic1\"] } },\n *   { provider, project, environment, service, projectToken: token.token, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\t/** The deploy CLI's final stdout line (Railway service URL when emitted). */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst {\n\t\t\tprovider,\n\t\t\tproject,\n\t\t\tenvironment,\n\t\t\tservice,\n\t\t\tprojectToken,\n\t\t\t...pulumiOpts\n\t\t} = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\t// Token is inlined (not via the env map): it is an unknown secret at preview,\n\t\t// and an unknown secret in `environment` makes `pulumi preview` fail.\n\t\t// IC_SINCE is captured just before `railway up` so the poller can tell the\n\t\t// new deployment apart from the previous one by createdAt.\n\t\tconst cli = pulumi.interpolate`IC_SINCE=$(node -e \"process.stdout.write(String(Date.now()))\"); RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; if [ \"$EXIT\" -ne 0 ]; then exit \"$EXIT\"; fi; if [ -n \"$INFRACRAFT_SKIP_DEPLOY_WAIT\" ]; then exit 0; fi; IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node -e '${DEPLOY_WAIT_SCRIPT}'`;\n\n\t\t// `printf '%s'` (not a bare format string) so railpack values containing %\n\t\t// are literal; the JSON is single-quote-escaped the POSIX way (' -> '\\'').\n\t\tconst setup = args.railpackConfig\n\t\t\t? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, \"'\\\\''\")}' > railpack.json`\n\t\t\t: undefined;\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tsetup,\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkDA,MAAM,qBAAqB;;;;;;;;;;;AAY3B,IAAa,gBAAb,cAAmCA,eAAO,kBAAkB;CAI3D,YACC,MACA,MACA,MACC;EACD,MAAM,EACL,UACA,SACA,aACA,SACA,cACA,GAAG,eACA;EAEJ,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAMvD,MAAM,MAAM,eAAO,WAAW,iFAAiF,aAAa,6BAA6B,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,4HAA4H,aAAa,WAAW,QAAQ,GAAG,UAAU,YAAY,GAAG,UAAU,QAAQ,GAAG,+BAA+B,mBAAmB;EAI3d,MAAM,QAAQ,KAAK,iBAChB,gBAAgB,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,OAAO,EAAE,qBAC3E;EAEH,MAAM,EAAE,kBAAkBC,4CACzB;GACC;GACA;GACA,UAAU,KAAK;GACf,cAAc,KAAK;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}
+{"version":3,"file":"deploy.cjs","names":["pulumi","createDeployCommand"],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["// src/railway/deploy.ts  (replace entire file)\nimport { fileURLToPath } from \"node:url\";\n\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\nexport interface RailwayDeployConfig {\n\tbuilder?: RailwayBuilder;\n\tstartCommand?: string;\n\tpreDeployCommand?: string;\n}\n\nexport interface RailwayDeployArgs {\n\t/** Redeploy triggers (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\tprovider: RailwayProvider;\n\tproject: RailwayProject;\n\tenvironment: RailwayEnvironment;\n\tservice: RailwayService;\n\t/** Environment-scoped Railway deploy token (provision via RailwayProjectToken). */\n\tprojectToken: pulumi.Input<string>;\n};\n\n/**\n * Absolute path to the runnable deploy monitor, resolved next to this module in `dist`.\n * `railway up` only uploads + triggers; this bin makes the Railway GraphQL API — not the\n * CLI's exit code — the source of truth for pass/fail, and dumps build + deploy logs on\n * failure. Its logic lives in the unit-tested `deployment-monitor` module.\n */\nconst MONITOR_BIN = fileURLToPath(\n\tnew URL(\"./bin/monitor-deployment.mjs\", import.meta.url),\n);\n\n/**\n * Deploys a Railway service and waits for a terminal status. Isolation/git are the\n * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"mesh\", { triggers: [sourceHash], railpackConfig: { apt: [\"libatomic1\"] } },\n *   { provider, project, environment, service, projectToken: token.token, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\t/** The deploy CLI's final stdout line (Railway service URL when emitted). */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst {\n\t\t\tprovider,\n\t\t\tproject,\n\t\t\tenvironment,\n\t\t\tservice,\n\t\t\tprojectToken,\n\t\t\t...pulumiOpts\n\t\t} = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\t// `railway up --detach` uploads + triggers WITHOUT attaching to the build-log\n\t\t// stream — that long-lived stream is what intermittently times out and makes the\n\t\t// CLI exit non-zero even when the deploy actually succeeds. We capture its `--json`\n\t\t// output (for the exact deployment id) and exit code, re-emit it for visibility,\n\t\t// then hand off to the monitor bin which polls the Railway API to a terminal status.\n\t\t// The API — not the CLI exit code — decides pass/fail. Token is inlined (not via the\n\t\t// env map): an unknown secret in `environment` makes `pulumi preview` fail. IC_SINCE\n\t\t// is captured just before `railway up` as a createdAt fallback for id resolution.\n\t\tconst cli = pulumi.interpolate`IC_SINCE=$(node -e \"process.stdout.write(String(Date.now()))\"); IC_UP_OUT=$(RAILWAY_TOKEN=${projectToken} railway up --detach --json --project ${project.id} --service ${service.id} --environment ${environment.id} 2>&1); IC_UP_EXIT=$?; printf '%s\\\\n' \"$IC_UP_OUT\"; if [ -n \"$INFRACRAFT_SKIP_DEPLOY_WAIT\" ]; then exit \"$IC_UP_EXIT\"; fi; IC_UP_OUT=\"$IC_UP_OUT\" IC_UP_EXIT=$IC_UP_EXIT IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node \"${MONITOR_BIN}\"`;\n\n\t\t// `printf '%s'` (not a bare format string) so railpack values containing %\n\t\t// are literal; the JSON is single-quote-escaped the POSIX way (' -> '\\'').\n\t\tconst setup = args.railpackConfig\n\t\t\t? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, \"'\\\\''\")}' > railpack.json`\n\t\t\t: undefined;\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tsetup,\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;AA4CA,MAAM,0CACL,IAAI,IAAI,6EAA+C,CACxD;;;;;;;;;;;AAYA,IAAa,gBAAb,cAAmCA,eAAO,kBAAkB;CAI3D,YACC,MACA,MACA,MACC;EACD,MAAM,EACL,UACA,SACA,aACA,SACA,cACA,GAAG,eACA;EAEJ,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAUvD,MAAM,MAAM,eAAO,WAAW,6FAA6F,aAAa,wCAAwC,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,kLAAkL,aAAa,WAAW,QAAQ,GAAG,UAAU,YAAY,GAAG,UAAU,QAAQ,GAAG,4BAA4B,YAAY;EAI9hB,MAAM,QAAQ,KAAK,iBAChB,gBAAgB,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,OAAO,EAAE,qBAC3E;EAEH,MAAM,EAAE,kBAAkBC,4CACzB;GACC;GACA;GACA,UAAU,KAAK;GACf,cAAc,KAAK;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/dist/railway/deploy.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;UASiB,mBAAA;EAChB,OAAA,GAAU,cAAc;EACxB,YAAA;EACA,gBAAA;AAAA;AAAA,UAGgB,iBAAA;EALQ;EAOxB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPpB;EASV,YAAA;EAPA;EASA,cAAA,GAAiB,MAAA;AAAA;AAAA,KAGb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAGP,QAAA,EAAU,eAAA;EACV,OAAA,EAAS,cAAA;EACT,WAAA,EAAa,kBAAA;EACb,OAAA,EAAS,cAAA,EAVQ;EAYjB,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;AAZE;cAyCX,aAAA,SAAsB,MAAA,CAAO,iBAAA;EAtCjB;EAAA,SAwCR,aAAA,EAAe,MAAA,CAAO,MAAA;cAGrC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}
+{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;UAWiB,mBAAA;EAChB,OAAA,GAAU,cAAc;EACxB,YAAA;EACA,gBAAA;AAAA;AAAA,UAGgB,iBAAA;EALQ;EAOxB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPpB;EASV,YAAA;EAPA;EASA,cAAA,GAAiB,MAAA;AAAA;AAAA,KAGb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAGP,QAAA,EAAU,eAAA;EACV,OAAA,EAAS,cAAA;EACT,WAAA,EAAa,kBAAA;EACb,OAAA,EAAS,cAAA,EAVQ;EAYjB,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;AAZE;cAmCX,aAAA,SAAsB,MAAA,CAAO,iBAAA;EAhCjB;EAAA,SAkCR,aAAA,EAAe,MAAA,CAAO,MAAA;cAGrC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}

package/dist/railway/deploy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;UASiB,mBAAA;EAChB,OAAA,GAAU,cAAc;EACxB,YAAA;EACA,gBAAA;AAAA;AAAA,UAGgB,iBAAA;EALQ;EAOxB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPpB;EASV,YAAA;EAPA;EASA,cAAA,GAAiB,MAAA;AAAA;AAAA,KAGb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAGP,QAAA,EAAU,eAAA;EACV,OAAA,EAAS,cAAA;EACT,WAAA,EAAa,kBAAA;EACb,OAAA,EAAS,cAAA,EAVQ;EAYjB,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;AAZE;cAyCX,aAAA,SAAsB,MAAA,CAAO,iBAAA;EAtCjB;EAAA,SAwCR,aAAA,EAAe,MAAA,CAAO,MAAA;cAGrC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}
+{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;UAWiB,mBAAA;EAChB,OAAA,GAAU,cAAc;EACxB,YAAA;EACA,gBAAA;AAAA;AAAA,UAGgB,iBAAA;EALQ;EAOxB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPpB;EASV,YAAA;EAPA;EASA,cAAA,GAAiB,MAAA;AAAA;AAAA,KAGb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAGP,QAAA,EAAU,eAAA;EACV,OAAA,EAAS,cAAA;EACT,WAAA,EAAa,kBAAA;EACb,OAAA,EAAS,cAAA,EAVQ;EAYjB,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;AAZE;cAmCX,aAAA,SAAsB,MAAA,CAAO,iBAAA;EAhCjB;EAAA,SAkCR,aAAA,EAAe,MAAA,CAAO,MAAA;cAGrC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}

package/dist/railway/deploy.mjs

@@ -1,23 +1,16 @@
 import { t as __name } from "../chunk-OPjESj5l.mjs";
 import { createDeployCommand } from "../commands/deploy.mjs";
 import * as pulumi from "@pulumi/pulumi";
+import { fileURLToPath } from "node:url";
 
 //#region src/railway/deploy.ts
 /**
-* The deploy-wait poller. `railway up --ci` only blocks until upload; this polls
-* the Railway GraphQL API to a terminal status and fails the resource on
-* FAILED/CRASHED/REMOVED. Runs under `node -e`, single-quoted in the shell, so it
-* uses ONLY double quotes and reads inputs from IC_* env vars.
-*
-* Deployment-id resolution filters by `createdAt >= IC_SINCE` (the epoch captured
-* just before `railway up`, minus a clock-skew buffer) and picks the newest such
-* deployment. This prevents latching onto the PREVIOUS deployment when Railway's
-* API has not yet registered the new one (a plain `first:1` race). SLEEPING (the
-* service deployed then scaled to zero) is treated as success; SKIPPED (the
-* deploy was superseded) is non-blocking; an unresolvable id (upload already
-* succeeded) does not block the release.
+* Absolute path to the runnable deploy monitor, resolved next to this module in `dist`.
+* `railway up` only uploads + triggers; this bin makes the Railway GraphQL API — not the
+* CLI's exit code — the source of truth for pass/fail, and dumps build + deploy logs on
+* failure. Its logic lives in the unit-tested `deployment-monitor` module.
 */
-const DEPLOY_WAIT_SCRIPT = `const t=process.env.IC_TOK,p=process.env.IC_PROJ,e=process.env.IC_ENV,s=process.env.IC_SVC;const since=Number(process.env.IC_SINCE||0)-120000;const u="https://backboard.railway.app/graphql/v2";const q=(query,variables)=>fetch(u,{method:"POST",headers:{"Project-Access-Token":t,"Content-Type":"application/json"},body:JSON.stringify({query,variables})}).then(r=>r.json()).catch(()=>({}));const sl=ms=>new Promise(r=>setTimeout(r,ms));const ok={SUCCESS:1,SLEEPING:1};const bad={FAILED:1,CRASHED:1,REMOVED:1};(async()=>{let id;for(let i=0;i<12&&!id;i++){const d=await q("query($p:String!,$e:String!,$s:String!){deployments(first:10,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}",{p,e,s});const g=(d&&d.data&&d.data.deployments&&d.data.deployments.edges)||[];const fresh=g.map(x=>x.node).filter(n=>n&&n.createdAt&&Date.parse(n.createdAt)>=since).sort((a,b)=>Date.parse(b.createdAt)-Date.parse(a.createdAt));if(fresh[0])id=fresh[0].id;if(!id)await sl(5000);}if(!id){console.error("[infracraft] could not resolve a Railway deployment newer than this run; upload succeeded, not blocking");process.exit(0);}for(let i=0;i<120;i++){const r=await q("query($d:String!){deployment(id:$d){status}}",{d:id});const st=r&&r.data&&r.data.deployment&&r.data.deployment.status;if(st)console.error("[infracraft] railway deployment "+id+" status="+st);if(st&&ok[st])process.exit(0);if(st==="SKIPPED"){console.error("[infracraft] railway deployment "+id+" SKIPPED (superseded) — not blocking");process.exit(0);}if(st&&bad[st]){const l=await q("query($d:String!){deploymentLogs(deploymentId:$d,limit:60){message}}",{d:id});const lg=(l&&l.data&&l.data.deploymentLogs)||[];for(const x of lg)console.error("    "+(x.message||""));console.error("[infracraft] railway deployment "+id+" "+st+" — failing the Pulumi resource");process.exit(1);}await sl(10000);}console.error("[infracraft] timed out waiting for Railway deployment "+id);process.exit(1);})();`;
+const MONITOR_BIN = fileURLToPath(new URL("./bin/monitor-deployment.mjs", import.meta.url));
 /**
 * Deploys a Railway service and waits for a terminal status. Isolation/git are the
 * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).
@@ -32,7 +25,7 @@ var RailwayDeploy = class extends pulumi.ComponentResource {
 	constructor(name, args, opts) {
 		const { provider, project, environment, service, projectToken, ...pulumiOpts } = opts;
 		super("infracraft:railway:Deploy", name, {}, pulumiOpts);
-		const cli = pulumi.interpolate`IC_SINCE=$(node -e "process.stdout.write(String(Date.now()))"); RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; if [ "$EXIT" -ne 0 ]; then exit "$EXIT"; fi; if [ -n "$INFRACRAFT_SKIP_DEPLOY_WAIT" ]; then exit 0; fi; IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node -e '${DEPLOY_WAIT_SCRIPT}'`;
+		const cli = pulumi.interpolate`IC_SINCE=$(node -e "process.stdout.write(String(Date.now()))"); IC_UP_OUT=$(RAILWAY_TOKEN=${projectToken} railway up --detach --json --project ${project.id} --service ${service.id} --environment ${environment.id} 2>&1); IC_UP_EXIT=$?; printf '%s\\n' "$IC_UP_OUT"; if [ -n "$INFRACRAFT_SKIP_DEPLOY_WAIT" ]; then exit "$IC_UP_EXIT"; fi; IC_UP_OUT="$IC_UP_OUT" IC_UP_EXIT=$IC_UP_EXIT IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node "${MONITOR_BIN}"`;
 		const setup = args.railpackConfig ? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, "'\\''")}' > railpack.json` : void 0;
 		const { deploymentUrl } = createDeployCommand({
 			name,

package/dist/railway/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["// src/railway/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\nexport interface RailwayDeployConfig {\n\tbuilder?: RailwayBuilder;\n\tstartCommand?: string;\n\tpreDeployCommand?: string;\n}\n\nexport interface RailwayDeployArgs {\n\t/** Redeploy triggers (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\tprovider: RailwayProvider;\n\tproject: RailwayProject;\n\tenvironment: RailwayEnvironment;\n\tservice: RailwayService;\n\t/** Environment-scoped Railway deploy token (provision via RailwayProjectToken). */\n\tprojectToken: pulumi.Input<string>;\n};\n\n/**\n * The deploy-wait poller. `railway up --ci` only blocks until upload; this polls\n * the Railway GraphQL API to a terminal status and fails the resource on\n * FAILED/CRASHED/REMOVED. Runs under `node -e`, single-quoted in the shell, so it\n * uses ONLY double quotes and reads inputs from IC_* env vars.\n *\n * Deployment-id resolution filters by `createdAt >= IC_SINCE` (the epoch captured\n * just before `railway up`, minus a clock-skew buffer) and picks the newest such\n * deployment. This prevents latching onto the PREVIOUS deployment when Railway's\n * API has not yet registered the new one (a plain `first:1` race). SLEEPING (the\n * service deployed then scaled to zero) is treated as success; SKIPPED (the\n * deploy was superseded) is non-blocking; an unresolvable id (upload already\n * succeeded) does not block the release.\n */\nconst DEPLOY_WAIT_SCRIPT = `const t=process.env.IC_TOK,p=process.env.IC_PROJ,e=process.env.IC_ENV,s=process.env.IC_SVC;const since=Number(process.env.IC_SINCE||0)-120000;const u=\"https://backboard.railway.app/graphql/v2\";const q=(query,variables)=>fetch(u,{method:\"POST\",headers:{\"Project-Access-Token\":t,\"Content-Type\":\"application/json\"},body:JSON.stringify({query,variables})}).then(r=>r.json()).catch(()=>({}));const sl=ms=>new Promise(r=>setTimeout(r,ms));const ok={SUCCESS:1,SLEEPING:1};const bad={FAILED:1,CRASHED:1,REMOVED:1};(async()=>{let id;for(let i=0;i<12&&!id;i++){const d=await q(\"query($p:String!,$e:String!,$s:String!){deployments(first:10,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}\",{p,e,s});const g=(d&&d.data&&d.data.deployments&&d.data.deployments.edges)||[];const fresh=g.map(x=>x.node).filter(n=>n&&n.createdAt&&Date.parse(n.createdAt)>=since).sort((a,b)=>Date.parse(b.createdAt)-Date.parse(a.createdAt));if(fresh[0])id=fresh[0].id;if(!id)await sl(5000);}if(!id){console.error(\"[infracraft] could not resolve a Railway deployment newer than this run; upload succeeded, not blocking\");process.exit(0);}for(let i=0;i<120;i++){const r=await q(\"query($d:String!){deployment(id:$d){status}}\",{d:id});const st=r&&r.data&&r.data.deployment&&r.data.deployment.status;if(st)console.error(\"[infracraft] railway deployment \"+id+\" status=\"+st);if(st&&ok[st])process.exit(0);if(st===\"SKIPPED\"){console.error(\"[infracraft] railway deployment \"+id+\" SKIPPED (superseded) — not blocking\");process.exit(0);}if(st&&bad[st]){const l=await q(\"query($d:String!){deploymentLogs(deploymentId:$d,limit:60){message}}\",{d:id});const lg=(l&&l.data&&l.data.deploymentLogs)||[];for(const x of lg)console.error(\"    \"+(x.message||\"\"));console.error(\"[infracraft] railway deployment \"+id+\" \"+st+\" — failing the Pulumi resource\");process.exit(1);}await sl(10000);}console.error(\"[infracraft] timed out waiting for Railway deployment \"+id);process.exit(1);})();`;\n\n/**\n * Deploys a Railway service and waits for a terminal status. Isolation/git are the\n * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"mesh\", { triggers: [sourceHash], railpackConfig: { apt: [\"libatomic1\"] } },\n *   { provider, project, environment, service, projectToken: token.token, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\t/** The deploy CLI's final stdout line (Railway service URL when emitted). */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst {\n\t\t\tprovider,\n\t\t\tproject,\n\t\t\tenvironment,\n\t\t\tservice,\n\t\t\tprojectToken,\n\t\t\t...pulumiOpts\n\t\t} = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\t// Token is inlined (not via the env map): it is an unknown secret at preview,\n\t\t// and an unknown secret in `environment` makes `pulumi preview` fail.\n\t\t// IC_SINCE is captured just before `railway up` so the poller can tell the\n\t\t// new deployment apart from the previous one by createdAt.\n\t\tconst cli = pulumi.interpolate`IC_SINCE=$(node -e \"process.stdout.write(String(Date.now()))\"); RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; if [ \"$EXIT\" -ne 0 ]; then exit \"$EXIT\"; fi; if [ -n \"$INFRACRAFT_SKIP_DEPLOY_WAIT\" ]; then exit 0; fi; IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node -e '${DEPLOY_WAIT_SCRIPT}'`;\n\n\t\t// `printf '%s'` (not a bare format string) so railpack values containing %\n\t\t// are literal; the JSON is single-quote-escaped the POSIX way (' -> '\\'').\n\t\tconst setup = args.railpackConfig\n\t\t\t? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, \"'\\\\''\")}' > railpack.json`\n\t\t\t: undefined;\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tsetup,\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkDA,MAAM,qBAAqB;;;;;;;;;;;AAY3B,IAAa,gBAAb,cAAmC,OAAO,kBAAkB;CAI3D,YACC,MACA,MACA,MACC;EACD,MAAM,EACL,UACA,SACA,aACA,SACA,cACA,GAAG,eACA;EAEJ,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAMvD,MAAM,MAAM,OAAO,WAAW,iFAAiF,aAAa,6BAA6B,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,4HAA4H,aAAa,WAAW,QAAQ,GAAG,UAAU,YAAY,GAAG,UAAU,QAAQ,GAAG,+BAA+B,mBAAmB;EAI3d,MAAM,QAAQ,KAAK,iBAChB,gBAAgB,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,OAAO,EAAE,qBAC3E;EAEH,MAAM,EAAE,kBAAkB,oBACzB;GACC;GACA;GACA,UAAU,KAAK;GACf,cAAc,KAAK;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["// src/railway/deploy.ts  (replace entire file)\nimport { fileURLToPath } from \"node:url\";\n\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\nexport interface RailwayDeployConfig {\n\tbuilder?: RailwayBuilder;\n\tstartCommand?: string;\n\tpreDeployCommand?: string;\n}\n\nexport interface RailwayDeployArgs {\n\t/** Redeploy triggers (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\tprovider: RailwayProvider;\n\tproject: RailwayProject;\n\tenvironment: RailwayEnvironment;\n\tservice: RailwayService;\n\t/** Environment-scoped Railway deploy token (provision via RailwayProjectToken). */\n\tprojectToken: pulumi.Input<string>;\n};\n\n/**\n * Absolute path to the runnable deploy monitor, resolved next to this module in `dist`.\n * `railway up` only uploads + triggers; this bin makes the Railway GraphQL API — not the\n * CLI's exit code — the source of truth for pass/fail, and dumps build + deploy logs on\n * failure. Its logic lives in the unit-tested `deployment-monitor` module.\n */\nconst MONITOR_BIN = fileURLToPath(\n\tnew URL(\"./bin/monitor-deployment.mjs\", import.meta.url),\n);\n\n/**\n * Deploys a Railway service and waits for a terminal status. Isolation/git are the\n * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"mesh\", { triggers: [sourceHash], railpackConfig: { apt: [\"libatomic1\"] } },\n *   { provider, project, environment, service, projectToken: token.token, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\t/** The deploy CLI's final stdout line (Railway service URL when emitted). */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst {\n\t\t\tprovider,\n\t\t\tproject,\n\t\t\tenvironment,\n\t\t\tservice,\n\t\t\tprojectToken,\n\t\t\t...pulumiOpts\n\t\t} = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\t// `railway up --detach` uploads + triggers WITHOUT attaching to the build-log\n\t\t// stream — that long-lived stream is what intermittently times out and makes the\n\t\t// CLI exit non-zero even when the deploy actually succeeds. We capture its `--json`\n\t\t// output (for the exact deployment id) and exit code, re-emit it for visibility,\n\t\t// then hand off to the monitor bin which polls the Railway API to a terminal status.\n\t\t// The API — not the CLI exit code — decides pass/fail. Token is inlined (not via the\n\t\t// env map): an unknown secret in `environment` makes `pulumi preview` fail. IC_SINCE\n\t\t// is captured just before `railway up` as a createdAt fallback for id resolution.\n\t\tconst cli = pulumi.interpolate`IC_SINCE=$(node -e \"process.stdout.write(String(Date.now()))\"); IC_UP_OUT=$(RAILWAY_TOKEN=${projectToken} railway up --detach --json --project ${project.id} --service ${service.id} --environment ${environment.id} 2>&1); IC_UP_EXIT=$?; printf '%s\\\\n' \"$IC_UP_OUT\"; if [ -n \"$INFRACRAFT_SKIP_DEPLOY_WAIT\" ]; then exit \"$IC_UP_EXIT\"; fi; IC_UP_OUT=\"$IC_UP_OUT\" IC_UP_EXIT=$IC_UP_EXIT IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node \"${MONITOR_BIN}\"`;\n\n\t\t// `printf '%s'` (not a bare format string) so railpack values containing %\n\t\t// are literal; the JSON is single-quote-escaped the POSIX way (' -> '\\'').\n\t\tconst setup = args.railpackConfig\n\t\t\t? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, \"'\\\\''\")}' > railpack.json`\n\t\t\t: undefined;\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tsetup,\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;AA4CA,MAAM,cAAc,cACnB,IAAI,IAAI,gCAAgC,OAAO,KAAK,GAAG,CACxD;;;;;;;;;;;AAYA,IAAa,gBAAb,cAAmC,OAAO,kBAAkB;CAI3D,YACC,MACA,MACA,MACC;EACD,MAAM,EACL,UACA,SACA,aACA,SACA,cACA,GAAG,eACA;EAEJ,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAUvD,MAAM,MAAM,OAAO,WAAW,6FAA6F,aAAa,wCAAwC,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,kLAAkL,aAAa,WAAW,QAAQ,GAAG,UAAU,YAAY,GAAG,UAAU,QAAQ,GAAG,4BAA4B,YAAY;EAI9hB,MAAM,QAAQ,KAAK,iBAChB,gBAAgB,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,OAAO,EAAE,qBAC3E;EAEH,MAAM,EAAE,kBAAkB,oBACzB;GACC;GACA;GACA,UAAU,KAAK;GACf,cAAc,KAAK;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/dist/railway/deployment-monitor.cjs

@@ -0,0 +1,240 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../chunk-BVYJZCqc.cjs');
+
+//#region src/railway/deployment-monitor.ts
+/**
+* API-authoritative Railway deploy monitor.
+*
+* `railway up` is used ONLY to upload + trigger (run it `--detach` so it never holds the
+* flaky build-log stream). This module then treats the Railway GraphQL API — not the CLI's
+* exit code — as the source of truth: it polls the deployment to a terminal status, fails on
+* FAILED/CRASHED/REMOVED, and on failure pulls the full build + deploy logs so the operator
+* sees exactly why it broke.
+*
+* Pure and dependency-injected (`fetch`/`sleep`/`log`) so every decision is unit-tested. The
+* runnable wrapper that wires real IO lives in `./bin/monitor-deployment.ts`.
+*/
+/** Tunable knobs, named here so the timing/limits are discoverable in one place. */
+const DEFAULTS = {
+	apiUrl: "https://backboard.railway.app/graphql/v2",
+	/** Attempts × interval to resolve the deployment id before giving up. */
+	resolveAttempts: 12,
+	resolveIntervalMs: 5e3,
+	/** Attempts × interval to poll a resolved deployment to a terminal status. */
+	pollAttempts: 120,
+	pollIntervalMs: 1e4,
+	/** Per-request abort timeout so a hung connection can't stall the loop. */
+	requestTimeoutMs: 15e3,
+	/** Build + deploy log lines surfaced on failure. */
+	failureLogLimit: 250,
+	/** Clock-skew buffer so the createdAt filter never drops the just-created deployment. */
+	skewMs: 12e4
+};
+/** Railway GraphQL operations, named so each query is readable at its call site. */
+const QUERIES = {
+	resolveDeployments: "query($p:String!,$e:String!,$s:String!){deployments(first:10,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}",
+	deploymentStatus: "query($d:String!){deployment(id:$d){status}}",
+	buildLogs: "query($d:String!,$n:Int!){buildLogs(deploymentId:$d,limit:$n){message severity timestamp}}",
+	deploymentLogs: "query($d:String!,$n:Int!){deploymentLogs(deploymentId:$d,limit:$n){message severity timestamp}}"
+};
+const UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+/** Status → disposition; index directly, defaulting unknown/in-flight statuses to PENDING. */
+const DISPOSITION_BY_STATUS = {
+	SUCCESS: "LIVE",
+	SLEEPING: "LIVE",
+	FAILED: "FAILED",
+	CRASHED: "FAILED",
+	REMOVED: "FAILED",
+	SKIPPED: "SUPERSEDED"
+};
+/** The terminal classification of a monitor run. */
+let MonitorOutcome = /* @__PURE__ */ function(MonitorOutcome) {
+	MonitorOutcome["SUCCESS"] = "SUCCESS";
+	MonitorOutcome["SKIPPED"] = "SKIPPED";
+	MonitorOutcome["FAILED"] = "FAILED";
+	MonitorOutcome["TIMED_OUT"] = "TIMED_OUT";
+	MonitorOutcome["NO_DEPLOYMENT"] = "NO_DEPLOYMENT";
+	return MonitorOutcome;
+}({});
+/**
+* Best-effort extraction of a deployment id from `railway up`'s output. Tries, in order:
+* the JSON trigger payload (whole or per-line), a `?id=<uuid>` Build-Logs URL, then any bare
+* UUID. Returns undefined so the caller can fall back to createdAt resolution.
+*/
+function parseDeploymentId(output) {
+	if (!output) return;
+	const fromObject = (value) => {
+		if (!value || typeof value !== "object") return;
+		const record = value;
+		if (typeof record.deploymentId === "string") return record.deploymentId;
+		if (typeof record.id === "string" && UUID.test(record.id)) return record.id;
+		const nested = record.deployment;
+		return nested && typeof nested.id === "string" ? nested.id : void 0;
+	};
+	const tryJson = (text) => {
+		try {
+			return fromObject(JSON.parse(text));
+		} catch {
+			return;
+		}
+	};
+	const whole = tryJson(output);
+	if (whole) return whole;
+	for (const line of output.split("\n")) {
+		const fromLine = tryJson(line.trim());
+		if (fromLine) return fromLine;
+	}
+	const fromUrl = output.match(new RegExp(`[?&]id=(${UUID.source})`, "i"));
+	if (fromUrl) return fromUrl[1];
+	const bare = output.match(UUID);
+	return bare ? bare[0] : void 0;
+}
+/**
+* A fault-tolerant Railway GraphQL caller bound to one deployment context. Every method
+* swallows transient transport/timeout errors (returning undefined/empty) so the monitor's
+* loops own the retry cadence — the network blips that broke the old CLI path are absorbed here.
+*/
+function createRailwayApi(deps, config) {
+	const call = async (query, variables) => {
+		try {
+			const signal = config.requestTimeoutMs > 0 && typeof AbortSignal?.timeout === "function" ? AbortSignal.timeout(config.requestTimeoutMs) : void 0;
+			const response = await deps.fetch(config.apiUrl, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					"Project-Access-Token": config.projectToken
+				},
+				body: JSON.stringify({
+					query,
+					variables
+				}),
+				signal
+			});
+			if (!response.ok) return;
+			return (await response.json()).data;
+		} catch {
+			return;
+		}
+	};
+	return {
+		/** Newest deployment created at/after `since` (skew-buffered), or undefined. */
+		async resolveLatestDeployment(since) {
+			const [newest] = ((await call(QUERIES.resolveDeployments, {
+				p: config.projectId,
+				e: config.environmentId,
+				s: config.serviceId
+			}))?.deployments?.edges ?? []).map((edge) => edge.node).filter((node) => node?.createdAt && Date.parse(node.createdAt) >= since).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+			return newest?.id;
+		},
+		async deploymentStatus(id) {
+			return (await call(QUERIES.deploymentStatus, { d: id }))?.deployment?.status;
+		},
+		async failureLogs(id, limit) {
+			const read = async (query, field) => {
+				return ((await call(query, {
+					d: id,
+					n: limit
+				}))?.[field] ?? []).map((line) => line.message ?? "");
+			};
+			return {
+				build: await read(QUERIES.buildLogs, "buildLogs"),
+				deploy: await read(QUERIES.deploymentLogs, "deploymentLogs")
+			};
+		}
+	};
+}
+/**
+* Watches a Railway deployment to a terminal state. The Railway API is authoritative: the
+* CLI's exit code only matters when NO deployment was ever created.
+*/
+async function monitorRailwayDeployment(input, deps) {
+	const resolveAttempts = input.resolveAttempts ?? DEFAULTS.resolveAttempts;
+	const resolveIntervalMs = input.resolveIntervalMs ?? DEFAULTS.resolveIntervalMs;
+	const pollAttempts = input.pollAttempts ?? DEFAULTS.pollAttempts;
+	const pollIntervalMs = input.pollIntervalMs ?? DEFAULTS.pollIntervalMs;
+	const failureLogLimit = input.failureLogLimit ?? DEFAULTS.failureLogLimit;
+	const api = createRailwayApi(deps, {
+		apiUrl: input.apiUrl ?? DEFAULTS.apiUrl,
+		projectToken: input.projectToken,
+		projectId: input.projectId,
+		environmentId: input.environmentId,
+		serviceId: input.serviceId,
+		requestTimeoutMs: input.requestTimeoutMs ?? DEFAULTS.requestTimeoutMs
+	});
+	const dumpFailureLogs = async (id) => {
+		const logs = await api.failureLogs(id, failureLogLimit);
+		for (const [label, lines] of [["build logs", logs.build], ["deploy logs", logs.deploy]]) {
+			deps.log(`[infracraft] ───── railway ${label} (deployment ${id}) ─────`);
+			if (lines.length === 0) {
+				deps.log("    (no log lines returned)");
+				continue;
+			}
+			for (const line of lines) deps.log(`    ${line}`);
+		}
+	};
+	let deploymentId = input.deploymentId ?? parseDeploymentId(input.uploadOutput);
+	if (!deploymentId) {
+		const threshold = input.since - DEFAULTS.skewMs;
+		for (let attempt = 0; attempt < resolveAttempts && !deploymentId; attempt++) {
+			deploymentId = await api.resolveLatestDeployment(threshold);
+			if (!deploymentId) await deps.sleep(resolveIntervalMs);
+		}
+	}
+	if (!deploymentId) {
+		const failed = input.uploadExitCode !== 0;
+		deps.log(failed ? "[infracraft] railway up failed and no deployment was created — failing the resource" : "[infracraft] no deployment resolved but railway up succeeded — not blocking the release");
+		return {
+			outcome: "NO_DEPLOYMENT",
+			failed
+		};
+	}
+	deps.log(`[infracraft] monitoring railway deployment ${deploymentId}`);
+	let lastStatus;
+	for (let attempt = 0; attempt < pollAttempts; attempt++) {
+		const status = await api.deploymentStatus(deploymentId);
+		if (status) {
+			lastStatus = status;
+			deps.log(`[infracraft] railway deployment ${deploymentId} status=${status}`);
+			const disposition = DISPOSITION_BY_STATUS[status] ?? "PENDING";
+			if (disposition === "LIVE") return {
+				outcome: "SUCCESS",
+				failed: false,
+				deploymentId,
+				status
+			};
+			if (disposition === "SUPERSEDED") {
+				deps.log(`[infracraft] railway deployment ${deploymentId} SKIPPED (superseded) — not blocking`);
+				return {
+					outcome: "SKIPPED",
+					failed: false,
+					deploymentId,
+					status
+				};
+			}
+			if (disposition === "FAILED") {
+				await dumpFailureLogs(deploymentId);
+				return {
+					outcome: "FAILED",
+					failed: true,
+					deploymentId,
+					status
+				};
+			}
+		}
+		await deps.sleep(pollIntervalMs);
+	}
+	deps.log(`[infracraft] timed out waiting for railway deployment ${deploymentId} (last status=${lastStatus ?? "unknown"})`);
+	await dumpFailureLogs(deploymentId);
+	return {
+		outcome: "TIMED_OUT",
+		failed: true,
+		deploymentId,
+		status: lastStatus
+	};
+}
+
+//#endregion
+exports.MonitorOutcome = MonitorOutcome;
+exports.monitorRailwayDeployment = monitorRailwayDeployment;
+exports.parseDeploymentId = parseDeploymentId;
+//# sourceMappingURL=deployment-monitor.cjs.map

package/dist/railway/deployment-monitor.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-monitor.cjs","names":[],"sources":["../../src/railway/deployment-monitor.ts"],"sourcesContent":["/**\n * API-authoritative Railway deploy monitor.\n *\n * `railway up` is used ONLY to upload + trigger (run it `--detach` so it never holds the\n * flaky build-log stream). This module then treats the Railway GraphQL API — not the CLI's\n * exit code — as the source of truth: it polls the deployment to a terminal status, fails on\n * FAILED/CRASHED/REMOVED, and on failure pulls the full build + deploy logs so the operator\n * sees exactly why it broke.\n *\n * Pure and dependency-injected (`fetch`/`sleep`/`log`) so every decision is unit-tested. The\n * runnable wrapper that wires real IO lives in `./bin/monitor-deployment.ts`.\n */\n\n/** Tunable knobs, named here so the timing/limits are discoverable in one place. */\nconst DEFAULTS = {\n\tapiUrl: \"https://backboard.railway.app/graphql/v2\",\n\t/** Attempts × interval to resolve the deployment id before giving up. */\n\tresolveAttempts: 12,\n\tresolveIntervalMs: 5_000,\n\t/** Attempts × interval to poll a resolved deployment to a terminal status. */\n\tpollAttempts: 120,\n\tpollIntervalMs: 10_000,\n\t/** Per-request abort timeout so a hung connection can't stall the loop. */\n\trequestTimeoutMs: 15_000,\n\t/** Build + deploy log lines surfaced on failure. */\n\tfailureLogLimit: 250,\n\t/** Clock-skew buffer so the createdAt filter never drops the just-created deployment. */\n\tskewMs: 120_000,\n} as const;\n\n/** Railway GraphQL operations, named so each query is readable at its call site. */\nconst QUERIES = {\n\tresolveDeployments:\n\t\t\"query($p:String!,$e:String!,$s:String!){deployments(first:10,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}\",\n\tdeploymentStatus: \"query($d:String!){deployment(id:$d){status}}\",\n\tbuildLogs:\n\t\t\"query($d:String!,$n:Int!){buildLogs(deploymentId:$d,limit:$n){message severity timestamp}}\",\n\tdeploymentLogs:\n\t\t\"query($d:String!,$n:Int!){deploymentLogs(deploymentId:$d,limit:$n){message severity timestamp}}\",\n} as const;\n\nconst UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;\n\n/** What a Railway deployment status means for the monitor's control flow. */\nenum DeploymentDisposition {\n\t/** Live release — SUCCESS, or SLEEPING (deployed then scaled to zero). */\n\tLIVE = \"LIVE\",\n\t/** Terminal failure that must fail the Pulumi resource. */\n\tFAILED = \"FAILED\",\n\t/** Superseded by a newer deployment — non-blocking. */\n\tSUPERSEDED = \"SUPERSEDED\",\n\t/** Still in flight (BUILDING, DEPLOYING, …) — keep polling. */\n\tPENDING = \"PENDING\",\n}\n\n/** Status → disposition; index directly, defaulting unknown/in-flight statuses to PENDING. */\nconst DISPOSITION_BY_STATUS: Readonly<Record<string, DeploymentDisposition>> = {\n\tSUCCESS: DeploymentDisposition.LIVE,\n\tSLEEPING: DeploymentDisposition.LIVE,\n\tFAILED: DeploymentDisposition.FAILED,\n\tCRASHED: DeploymentDisposition.FAILED,\n\tREMOVED: DeploymentDisposition.FAILED,\n\tSKIPPED: DeploymentDisposition.SUPERSEDED,\n};\n\n/** The terminal classification of a monitor run. */\nexport enum MonitorOutcome {\n\tSUCCESS = \"SUCCESS\",\n\tSKIPPED = \"SKIPPED\",\n\tFAILED = \"FAILED\",\n\tTIMED_OUT = \"TIMED_OUT\",\n\tNO_DEPLOYMENT = \"NO_DEPLOYMENT\",\n}\n\n/** What the monitor observed and whether the Pulumi resource should fail. */\nexport interface MonitorResult {\n\toutcome: MonitorOutcome;\n\t/** True iff the deploy command should exit non-zero (fail the Pulumi resource). */\n\tfailed: boolean;\n\tdeploymentId?: string;\n\tstatus?: string;\n}\n\n/** Everything the monitor needs to identify and watch one deployment. */\nexport interface MonitorInput {\n\t/** Railway GraphQL endpoint (override in tests). */\n\tapiUrl?: string;\n\t/** Project-scoped access token (sent as the `Project-Access-Token` header). */\n\tprojectToken: string;\n\tprojectId: string;\n\tenvironmentId: string;\n\tserviceId: string;\n\t/** Deployment id captured from `railway up --detach --json` (preferred, exact). */\n\tdeploymentId?: string;\n\t/** Raw `railway up` output, parsed for the id when `deploymentId` is absent. */\n\tuploadOutput?: string;\n\t/** `railway up` exit code: decides pass/fail only when no deployment can be resolved. */\n\tuploadExitCode: number;\n\t/** Epoch ms captured just before `railway up` (createdAt fallback for id resolution). */\n\tsince: number;\n\tresolveAttempts?: number;\n\tresolveIntervalMs?: number;\n\tpollAttempts?: number;\n\tpollIntervalMs?: number;\n\trequestTimeoutMs?: number;\n\tfailureLogLimit?: number;\n}\n\n/** Injected side-effecting collaborators (real impls in the bin, fakes in tests). */\nexport interface MonitorDeps {\n\tfetch: typeof fetch;\n\tsleep: (ms: number) => Promise<void>;\n\tlog: (line: string) => void;\n}\n\n/**\n * Best-effort extraction of a deployment id from `railway up`'s output. Tries, in order:\n * the JSON trigger payload (whole or per-line), a `?id=<uuid>` Build-Logs URL, then any bare\n * UUID. Returns undefined so the caller can fall back to createdAt resolution.\n */\nexport function parseDeploymentId(\n\toutput: string | undefined,\n): string | undefined {\n\tif (!output) {\n\t\treturn undefined;\n\t}\n\n\tconst fromObject = (value: unknown): string | undefined => {\n\t\tif (!value || typeof value !== \"object\") {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst record = value as Record<string, unknown>;\n\n\t\tif (typeof record.deploymentId === \"string\") {\n\t\t\treturn record.deploymentId;\n\t\t}\n\n\t\tif (typeof record.id === \"string\" && UUID.test(record.id)) {\n\t\t\treturn record.id;\n\t\t}\n\n\t\tconst nested = record.deployment as Record<string, unknown> | undefined;\n\n\t\treturn nested && typeof nested.id === \"string\" ? nested.id : undefined;\n\t};\n\n\tconst tryJson = (text: string): string | undefined => {\n\t\ttry {\n\t\t\treturn fromObject(JSON.parse(text));\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t};\n\n\tconst whole = tryJson(output);\n\n\tif (whole) {\n\t\treturn whole;\n\t}\n\n\tfor (const line of output.split(\"\\n\")) {\n\t\tconst fromLine = tryJson(line.trim());\n\n\t\tif (fromLine) {\n\t\t\treturn fromLine;\n\t\t}\n\t}\n\n\tconst fromUrl = output.match(new RegExp(`[?&]id=(${UUID.source})`, \"i\"));\n\n\tif (fromUrl) {\n\t\treturn fromUrl[1];\n\t}\n\n\tconst bare = output.match(UUID);\n\n\treturn bare ? bare[0] : undefined;\n}\n\ninterface DeploymentNode {\n\tid: string;\n\tstatus: string;\n\tcreatedAt: string;\n}\n\ninterface LogLine {\n\tmessage: string;\n\tseverity?: string;\n}\n\n/**\n * A fault-tolerant Railway GraphQL caller bound to one deployment context. Every method\n * swallows transient transport/timeout errors (returning undefined/empty) so the monitor's\n * loops own the retry cadence — the network blips that broke the old CLI path are absorbed here.\n */\nfunction createRailwayApi(\n\tdeps: MonitorDeps,\n\tconfig: {\n\t\tapiUrl: string;\n\t\tprojectToken: string;\n\t\tprojectId: string;\n\t\tenvironmentId: string;\n\t\tserviceId: string;\n\t\trequestTimeoutMs: number;\n\t},\n) {\n\tconst call = async <T>(\n\t\tquery: string,\n\t\tvariables: Record<string, unknown>,\n\t): Promise<T | undefined> => {\n\t\ttry {\n\t\t\tconst signal =\n\t\t\t\tconfig.requestTimeoutMs > 0 &&\n\t\t\t\ttypeof AbortSignal?.timeout === \"function\"\n\t\t\t\t\t? AbortSignal.timeout(config.requestTimeoutMs)\n\t\t\t\t\t: undefined;\n\n\t\t\tconst response = await deps.fetch(config.apiUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"Project-Access-Token\": config.projectToken,\n\t\t\t\t},\n\t\t\t\tbody: JSON.stringify({ query, variables }),\n\t\t\t\tsignal,\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn ((await response.json()) as { data?: T }).data;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t};\n\n\treturn {\n\t\t/** Newest deployment created at/after `since` (skew-buffered), or undefined. */\n\t\tasync resolveLatestDeployment(since: number): Promise<string | undefined> {\n\t\t\tconst data = await call<{\n\t\t\t\tdeployments: { edges: { node: DeploymentNode }[] };\n\t\t\t}>(QUERIES.resolveDeployments, {\n\t\t\t\tp: config.projectId,\n\t\t\t\te: config.environmentId,\n\t\t\t\ts: config.serviceId,\n\t\t\t});\n\n\t\t\tconst [newest] = (data?.deployments?.edges ?? [])\n\t\t\t\t.map((edge) => edge.node)\n\t\t\t\t.filter(\n\t\t\t\t\t(node) => node?.createdAt && Date.parse(node.createdAt) >= since,\n\t\t\t\t)\n\t\t\t\t.sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));\n\n\t\t\treturn newest?.id;\n\t\t},\n\n\t\tasync deploymentStatus(id: string): Promise<string | undefined> {\n\t\t\tconst data = await call<{ deployment: { status: string } | null }>(\n\t\t\t\tQUERIES.deploymentStatus,\n\t\t\t\t{ d: id },\n\t\t\t);\n\n\t\t\treturn data?.deployment?.status;\n\t\t},\n\n\t\tasync failureLogs(\n\t\t\tid: string,\n\t\t\tlimit: number,\n\t\t): Promise<{ build: string[]; deploy: string[] }> {\n\t\t\tconst read = async (query: string, field: string): Promise<string[]> => {\n\t\t\t\tconst data = await call<Record<string, LogLine[]>>(query, {\n\t\t\t\t\td: id,\n\t\t\t\t\tn: limit,\n\t\t\t\t});\n\n\t\t\t\treturn (data?.[field] ?? []).map((line) => line.message ?? \"\");\n\t\t\t};\n\n\t\t\treturn {\n\t\t\t\tbuild: await read(QUERIES.buildLogs, \"buildLogs\"),\n\t\t\t\tdeploy: await read(QUERIES.deploymentLogs, \"deploymentLogs\"),\n\t\t\t};\n\t\t},\n\t};\n}\n\n/**\n * Watches a Railway deployment to a terminal state. The Railway API is authoritative: the\n * CLI's exit code only matters when NO deployment was ever created.\n */\nexport async function monitorRailwayDeployment(\n\tinput: MonitorInput,\n\tdeps: MonitorDeps,\n): Promise<MonitorResult> {\n\tconst resolveAttempts = input.resolveAttempts ?? DEFAULTS.resolveAttempts;\n\tconst resolveIntervalMs =\n\t\tinput.resolveIntervalMs ?? DEFAULTS.resolveIntervalMs;\n\tconst pollAttempts = input.pollAttempts ?? DEFAULTS.pollAttempts;\n\tconst pollIntervalMs = input.pollIntervalMs ?? DEFAULTS.pollIntervalMs;\n\tconst failureLogLimit = input.failureLogLimit ?? DEFAULTS.failureLogLimit;\n\n\tconst api = createRailwayApi(deps, {\n\t\tapiUrl: input.apiUrl ?? DEFAULTS.apiUrl,\n\t\tprojectToken: input.projectToken,\n\t\tprojectId: input.projectId,\n\t\tenvironmentId: input.environmentId,\n\t\tserviceId: input.serviceId,\n\t\trequestTimeoutMs: input.requestTimeoutMs ?? DEFAULTS.requestTimeoutMs,\n\t});\n\n\tconst dumpFailureLogs = async (id: string): Promise<void> => {\n\t\tconst logs = await api.failureLogs(id, failureLogLimit);\n\n\t\tfor (const [label, lines] of [\n\t\t\t[\"build logs\", logs.build],\n\t\t\t[\"deploy logs\", logs.deploy],\n\t\t] as const) {\n\t\t\tdeps.log(`[infracraft] ───── railway ${label} (deployment ${id}) ─────`);\n\n\t\t\tif (lines.length === 0) {\n\t\t\t\tdeps.log(\"    (no log lines returned)\");\n\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tfor (const line of lines) {\n\t\t\t\tdeps.log(`    ${line}`);\n\t\t\t}\n\t\t}\n\t};\n\n\t// 1. Identify the deployment: prefer the captured id, then parse the upload output,\n\t//    then resolve the newest deployment created after this run started.\n\tlet deploymentId =\n\t\tinput.deploymentId ?? parseDeploymentId(input.uploadOutput);\n\n\tif (!deploymentId) {\n\t\tconst threshold = input.since - DEFAULTS.skewMs;\n\n\t\tfor (\n\t\t\tlet attempt = 0;\n\t\t\tattempt < resolveAttempts && !deploymentId;\n\t\t\tattempt++\n\t\t) {\n\t\t\tdeploymentId = await api.resolveLatestDeployment(threshold);\n\n\t\t\tif (!deploymentId) {\n\t\t\t\tawait deps.sleep(resolveIntervalMs);\n\t\t\t}\n\t\t}\n\t}\n\n\tif (!deploymentId) {\n\t\tconst failed = input.uploadExitCode !== 0;\n\n\t\tdeps.log(\n\t\t\tfailed\n\t\t\t\t? \"[infracraft] railway up failed and no deployment was created — failing the resource\"\n\t\t\t\t: \"[infracraft] no deployment resolved but railway up succeeded — not blocking the release\",\n\t\t);\n\n\t\treturn { outcome: MonitorOutcome.NO_DEPLOYMENT, failed };\n\t}\n\n\tdeps.log(`[infracraft] monitoring railway deployment ${deploymentId}`);\n\n\t// 2. Poll the API to a terminal status — this, not the CLI, decides pass/fail.\n\tlet lastStatus: string | undefined;\n\n\tfor (let attempt = 0; attempt < pollAttempts; attempt++) {\n\t\tconst status = await api.deploymentStatus(deploymentId);\n\n\t\tif (status) {\n\t\t\tlastStatus = status;\n\n\t\t\tdeps.log(\n\t\t\t\t`[infracraft] railway deployment ${deploymentId} status=${status}`,\n\t\t\t);\n\n\t\t\tconst disposition =\n\t\t\t\tDISPOSITION_BY_STATUS[status] ?? DeploymentDisposition.PENDING;\n\n\t\t\tif (disposition === DeploymentDisposition.LIVE) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: MonitorOutcome.SUCCESS,\n\t\t\t\t\tfailed: false,\n\t\t\t\t\tdeploymentId,\n\t\t\t\t\tstatus,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (disposition === DeploymentDisposition.SUPERSEDED) {\n\t\t\t\tdeps.log(\n\t\t\t\t\t`[infracraft] railway deployment ${deploymentId} SKIPPED (superseded) — not blocking`,\n\t\t\t\t);\n\n\t\t\t\treturn {\n\t\t\t\t\toutcome: MonitorOutcome.SKIPPED,\n\t\t\t\t\tfailed: false,\n\t\t\t\t\tdeploymentId,\n\t\t\t\t\tstatus,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (disposition === DeploymentDisposition.FAILED) {\n\t\t\t\tawait dumpFailureLogs(deploymentId);\n\n\t\t\t\treturn {\n\t\t\t\t\toutcome: MonitorOutcome.FAILED,\n\t\t\t\t\tfailed: true,\n\t\t\t\t\tdeploymentId,\n\t\t\t\t\tstatus,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tawait deps.sleep(pollIntervalMs);\n\t}\n\n\tdeps.log(\n\t\t`[infracraft] timed out waiting for railway deployment ${deploymentId} (last status=${lastStatus ?? \"unknown\"})`,\n\t);\n\n\tawait dumpFailureLogs(deploymentId);\n\n\treturn {\n\t\toutcome: MonitorOutcome.TIMED_OUT,\n\t\tfailed: true,\n\t\tdeploymentId,\n\t\tstatus: lastStatus,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,MAAM,WAAW;CAChB,QAAQ;;CAER,iBAAiB;CACjB,mBAAmB;;CAEnB,cAAc;CACd,gBAAgB;;CAEhB,kBAAkB;;CAElB,iBAAiB;;CAEjB,QAAQ;AACT;;AAGA,MAAM,UAAU;CACf,oBACC;CACD,kBAAkB;CAClB,WACC;CACD,gBACC;AACF;AAEA,MAAM,OAAO;;AAeb,MAAM,wBAAyE;CAC9E;CACA;CACA;CACA;CACA;CACA;AACD;;AAGA,IAAY,iBAAL;CACN;CACA;CACA;CACA;CACA;;AACD;;;;;;AAgDA,SAAgB,kBACf,QACqB;CACrB,IAAI,CAAC,QACJ;CAGD,MAAM,cAAc,UAAuC;EAC1D,IAAI,CAAC,SAAS,OAAO,UAAU,UAC9B;EAGD,MAAM,SAAS;EAEf,IAAI,OAAO,OAAO,iBAAiB,UAClC,OAAO,OAAO;EAGf,IAAI,OAAO,OAAO,OAAO,YAAY,KAAK,KAAK,OAAO,EAAE,GACvD,OAAO,OAAO;EAGf,MAAM,SAAS,OAAO;EAEtB,OAAO,UAAU,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;CAC9D;CAEA,MAAM,WAAW,SAAqC;EACrD,IAAI;GACH,OAAO,WAAW,KAAK,MAAM,IAAI,CAAC;EACnC,QAAQ;GACP;EACD;CACD;CAEA,MAAM,QAAQ,QAAQ,MAAM;CAE5B,IAAI,OACH,OAAO;CAGR,KAAK,MAAM,QAAQ,OAAO,MAAM,IAAI,GAAG;EACtC,MAAM,WAAW,QAAQ,KAAK,KAAK,CAAC;EAEpC,IAAI,UACH,OAAO;CAET;CAEA,MAAM,UAAU,OAAO,MAAM,IAAI,OAAO,WAAW,KAAK,OAAO,IAAI,GAAG,CAAC;CAEvE,IAAI,SACH,OAAO,QAAQ;CAGhB,MAAM,OAAO,OAAO,MAAM,IAAI;CAE9B,OAAO,OAAO,KAAK,KAAK;AACzB;;;;;;AAkBA,SAAS,iBACR,MACA,QAQC;CACD,MAAM,OAAO,OACZ,OACA,cAC4B;EAC5B,IAAI;GACH,MAAM,SACL,OAAO,mBAAmB,KAC1B,OAAO,aAAa,YAAY,aAC7B,YAAY,QAAQ,OAAO,gBAAgB,IAC3C;GAEJ,MAAM,WAAW,MAAM,KAAK,MAAM,OAAO,QAAQ;IAChD,QAAQ;IACR,SAAS;KACR,gBAAgB;KAChB,wBAAwB,OAAO;IAChC;IACA,MAAM,KAAK,UAAU;KAAE;KAAO;IAAU,CAAC;IACzC;GACD,CAAC;GAED,IAAI,CAAC,SAAS,IACb;GAGD,QAAS,MAAM,SAAS,KAAK,GAAoB;EAClD,QAAQ;GACP;EACD;CACD;CAEA,OAAO;;EAEN,MAAM,wBAAwB,OAA4C;GASzE,MAAM,CAAC,YAAW,MARC,KAEhB,QAAQ,oBAAoB;IAC9B,GAAG,OAAO;IACV,GAAG,OAAO;IACV,GAAG,OAAO;GACX,CAAC,IAEuB,aAAa,SAAS,CAAC,GAC7C,KAAK,SAAS,KAAK,IAAI,EACvB,QACC,SAAS,MAAM,aAAa,KAAK,MAAM,KAAK,SAAS,KAAK,KAC5D,EACC,MAAM,GAAG,MAAM,KAAK,MAAM,EAAE,SAAS,IAAI,KAAK,MAAM,EAAE,SAAS,CAAC;GAElE,OAAO,QAAQ;EAChB;EAEA,MAAM,iBAAiB,IAAyC;GAM/D,QAAO,MALY,KAClB,QAAQ,kBACR,EAAE,GAAG,GAAG,CACT,IAEa,YAAY;EAC1B;EAEA,MAAM,YACL,IACA,OACiD;GACjD,MAAM,OAAO,OAAO,OAAe,UAAqC;IAMvE,SAAQ,MALW,KAAgC,OAAO;KACzD,GAAG;KACH,GAAG;IACJ,CAAC,KAEc,UAAU,CAAC,GAAG,KAAK,SAAS,KAAK,WAAW,EAAE;GAC9D;GAEA,OAAO;IACN,OAAO,MAAM,KAAK,QAAQ,WAAW,WAAW;IAChD,QAAQ,MAAM,KAAK,QAAQ,gBAAgB,gBAAgB;GAC5D;EACD;CACD;AACD;;;;;AAMA,eAAsB,yBACrB,OACA,MACyB;CACzB,MAAM,kBAAkB,MAAM,mBAAmB,SAAS;CAC1D,MAAM,oBACL,MAAM,qBAAqB,SAAS;CACrC,MAAM,eAAe,MAAM,gBAAgB,SAAS;CACpD,MAAM,iBAAiB,MAAM,kBAAkB,SAAS;CACxD,MAAM,kBAAkB,MAAM,mBAAmB,SAAS;CAE1D,MAAM,MAAM,iBAAiB,MAAM;EAClC,QAAQ,MAAM,UAAU,SAAS;EACjC,cAAc,MAAM;EACpB,WAAW,MAAM;EACjB,eAAe,MAAM;EACrB,WAAW,MAAM;EACjB,kBAAkB,MAAM,oBAAoB,SAAS;CACtD,CAAC;CAED,MAAM,kBAAkB,OAAO,OAA8B;EAC5D,MAAM,OAAO,MAAM,IAAI,YAAY,IAAI,eAAe;EAEtD,KAAK,MAAM,CAAC,OAAO,UAAU,CAC5B,CAAC,cAAc,KAAK,KAAK,GACzB,CAAC,eAAe,KAAK,MAAM,CAC5B,GAAY;GACX,KAAK,IAAI,8BAA8B,MAAM,eAAe,GAAG,QAAQ;GAEvE,IAAI,MAAM,WAAW,GAAG;IACvB,KAAK,IAAI,6BAA6B;IAEtC;GACD;GAEA,KAAK,MAAM,QAAQ,OAClB,KAAK,IAAI,OAAO,MAAM;EAExB;CACD;CAIA,IAAI,eACH,MAAM,gBAAgB,kBAAkB,MAAM,YAAY;CAE3D,IAAI,CAAC,cAAc;EAClB,MAAM,YAAY,MAAM,QAAQ,SAAS;EAEzC,KACC,IAAI,UAAU,GACd,UAAU,mBAAmB,CAAC,cAC9B,WACC;GACD,eAAe,MAAM,IAAI,wBAAwB,SAAS;GAE1D,IAAI,CAAC,cACJ,MAAM,KAAK,MAAM,iBAAiB;EAEpC;CACD;CAEA,IAAI,CAAC,cAAc;EAClB,MAAM,SAAS,MAAM,mBAAmB;EAExC,KAAK,IACJ,SACG,wFACA,yFACJ;EAEA,OAAO;GAAE;GAAuC;EAAO;CACxD;CAEA,KAAK,IAAI,8CAA8C,cAAc;CAGrE,IAAI;CAEJ,KAAK,IAAI,UAAU,GAAG,UAAU,cAAc,WAAW;EACxD,MAAM,SAAS,MAAM,IAAI,iBAAiB,YAAY;EAEtD,IAAI,QAAQ;GACX,aAAa;GAEb,KAAK,IACJ,mCAAmC,aAAa,UAAU,QAC3D;GAEA,MAAM,cACL,sBAAsB;GAEvB,IAAI,wBACH,OAAO;IACN;IACA,QAAQ;IACR;IACA;GACD;GAGD,IAAI,8BAAkD;IACrD,KAAK,IACJ,mCAAmC,aAAa,qCACjD;IAEA,OAAO;KACN;KACA,QAAQ;KACR;KACA;IACD;GACD;GAEA,IAAI,0BAA8C;IACjD,MAAM,gBAAgB,YAAY;IAElC,OAAO;KACN;KACA,QAAQ;KACR;KACA;IACD;GACD;EACD;EAEA,MAAM,KAAK,MAAM,cAAc;CAChC;CAEA,KAAK,IACJ,yDAAyD,aAAa,gBAAgB,cAAc,UAAU,EAC/G;CAEA,MAAM,gBAAgB,YAAY;CAElC,OAAO;EACN;EACA,QAAQ;EACR;EACA,QAAQ;CACT;AACD"}