@infracraft/pulumi 1.16.8 → 1.17.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 André "Dezzy" Victor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,429 @@
+<p align="center">
+  <b>infracraft</b>
+  <br />
+  <i>Pulumi providers for platforms that don't have one.</i>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@infracraft/pulumi"><img src="https://img.shields.io/npm/v/@infracraft/pulumi?style=flat&colorA=18181b&colorB=18181b" alt="npm" /></a>
+  <a href="https://www.npmjs.com/package/@infracraft/pulumi"><img src="https://img.shields.io/npm/dm/@infracraft/pulumi?style=flat&colorA=18181b&colorB=18181b" alt="downloads" /></a>
+  <a href="https://github.com/andredezzy/infracraft/blob/main/LICENSE"><img src="https://img.shields.io/github/license/andredezzy/infracraft?style=flat&colorA=18181b&colorB=18181b" alt="license" /></a>
+</p>
+
+---
+
+Native Pulumi providers with adopt-or-create semantics and deploy orchestration. No Terraform bridge.
+
+## Providers
+
+| | Provider | Import | What it does |
+|---|---|---|---|
+| 🚂 | **Railway** | `@infracraft/pulumi/railway` | The only Pulumi provider for Railway. Projects, environments, services, variables, volumes, domains, deploys. |
+| 🐘 | **Neon** | `@infracraft/pulumi/neon` | Adopt-or-create layer for Neon Postgres. Projects, branches, endpoints, roles, databases. |
+| ▲ | **Vercel** | `@infracraft/pulumi/vercel` | Projects with adopt-or-create, deploy orchestration, marketplace resources, and sensitive env var drift detection. |
+| 🎯 | **Fly.io** | `@infracraft/pulumi/fly` | App, Secret, Volume, Certificate, IP, and Deploy resources via the Machines REST API and Fly GraphQL API. |
+| 🤖 | **Agents** | `@infracraft/pulumi/agents` | Emit operating hints for AI coding agents working on the stack. |
+| #️⃣ | **Hash** | `@infracraft/pulumi/hash` | Deterministic directory/env-var/app hashing for deploy triggers. |
+| 📦 | **Sandbox** | `@infracraft/pulumi/sandbox` | Isolated `/tmp` working copies for CLI deploys — opt in via `dependsOn`. |
+| 🔒 | **Git Guard** | `@infracraft/pulumi/git-guard` | Metadata-free `.git` stub for deploys — keeps commit SHAs and author emails off third-party platforms. |
+
+## Install
+
+```bash
+npm i @infracraft/pulumi
+# or
+bun add @infracraft/pulumi
+```
+
+Peer dependencies: `@pulumi/pulumi` ^3, `@pulumi/command` ^1 (optional)
+
+## Railway
+
+```typescript
+import {
+  RailwayProvider,
+  RailwayProject,
+  RailwayEnvironment,
+  RailwayService,
+  RailwayBuilder,
+  RailwayVariable,
+  RailwayProjectToken,
+  RailwayDeploy,
+} from "@infracraft/pulumi/railway"
+import { hash } from "@infracraft/pulumi/hash"
+
+const provider = new RailwayProvider("railway", {
+  token: config.requireSecret("railwayToken"),
+})
+
+const project = new RailwayProject("my-project", {
+  name: "my-app",
+}, { provider })
+
+const environment = new RailwayEnvironment("production", {
+  name: "production",
+}, { provider, project })
+
+const service = new RailwayService("api", {
+  name: "api",
+  builder: RailwayBuilder.RAILPACK,
+  startCommand: "node dist/index.js",
+}, { provider, project, environment })
+
+const env = { DATABASE_URL: dbUrl }
+
+new RailwayVariable("api-vars", {
+  variables: env,
+}, { provider, project, environment, service })
+
+const deployToken = new RailwayProjectToken("api-token", {
+  name: "api-deploy",
+}, { provider, project, environment })
+
+new RailwayDeploy("api-deploy", {
+  triggers: [hash("apps/api"), hash(env)],   // hash(env): a non-secret digest, not raw secret values
+}, { provider, project, environment, service, projectToken: deployToken.token })
+```
+
+### Railway API surface
+
+| Class | Key outputs | Notes |
+|---|---|---|
+| `RailwayProvider` | — | Pass as `provider` option to every Railway resource |
+| `RailwayProject` | `.id` (project UUID) | Adopt-or-create by name |
+| `RailwayEnvironment` | `.id` | Optional `source` env to fork from |
+| `RailwayService` | `.id` | Full instance config: builder, healthcheck, restart policy |
+| `RailwayDomain` | `.fqdn` | Omit `customDomain` for an auto-generated domain |
+| `RailwayVariable` | — | Batch upsert; uses `skipDeploys` to avoid snapshot errors |
+| `RailwayVolume` | `.id` | Persistent volume; `mountPath` must be absolute |
+| `RailwayProjectToken` | `.token` (secret) | Environment-scoped deploy token; feed into `RailwayDeploy` |
+| `RailwayDeploy` | — | Runs `railway up --detach`, then monitors the deployment via the Railway API |
+
+**Enums:** `RailwayBuilder` (`RAILPACK`, `NIXPACKS`, `DOCKERFILE`, `HEROKU`, `PAKETO`), `RailwayRestartPolicy` (`ON_FAILURE`, `ALWAYS`, `NEVER`)
+
+## Neon
+
+```typescript
+import {
+  NeonProvider,
+  NeonProject,
+  NeonBranch,
+  NeonRole,
+  NeonEndpoint,
+  NeonDatabase,
+} from "@infracraft/pulumi/neon"
+
+const provider = new NeonProvider("neon", {
+  apiKey: config.requireSecret("neonApiKey"),
+})
+
+const project = new NeonProject("db", { name: "my-app" }, { provider })
+
+// Copy-on-write branch from "main"
+const branch = new NeonBranch("prod", {
+  name: "production",
+  parent: "main",
+}, { provider, project })
+
+const role = new NeonRole("owner", {
+  name: "neondb_owner",
+  resetPassword: true,   // isolate COW branch from parent's password
+}, { provider, project, branch })
+
+const endpoint = new NeonEndpoint("prod", {
+  minCu: 0.25,
+  maxCu: 1,
+  suspendTimeout: 300,
+}, { provider, project, branch })
+
+const db = new NeonDatabase("app-db", {
+  name: "app",
+  ownerName: "neondb_owner",
+}, { provider, project, branch })
+
+const roleName = "neondb_owner"
+const dbName = "app"
+const connectionString = pulumi.interpolate`postgresql://${roleName}:${role.password}@${endpoint.host}/${dbName}`
+```
+
+### Neon API surface
+
+| Class | Key outputs | Notes |
+|---|---|---|
+| `NeonProvider` | — | `apiKey` + optional `orgId` |
+| `NeonProject` | `.id` | Adopt-or-create by name |
+| `NeonBranch` | `.id` | Optional `parent` for copy-on-write branching |
+| `NeonEndpoint` | `.host` | Read-write compute endpoint; use `.host` in connection strings |
+| `NeonRole` | `.password` (secret) | `resetPassword: true` isolates COW branch passwords from parent |
+| `NeonDatabase` | — | `name` + `ownerName` |
+
+## Vercel
+
+```typescript
+import {
+  VercelProvider,
+  VercelProject,
+  VercelVariable,
+  VercelDeploy,
+  VercelIntegration,
+  VercelMarketplaceResource,
+  VercelResourceConnection,
+} from "@infracraft/pulumi/vercel"
+import { hash } from "@infracraft/pulumi/hash"
+
+const provider = new VercelProvider("vercel", {
+  token: config.requireSecret("vercelToken"),
+  teamId: "team_xxx",
+})
+
+const project = new VercelProject("web", {
+  name: "my-web-app",
+  framework: "nextjs",
+  rootDirectory: "apps/web",
+}, { provider })
+
+// project.url resolves to the custom domain or <name>.vercel.app
+export const url = project.url
+
+const vars = new VercelVariable("web-vars", {
+  variables: { NEXT_PUBLIC_API_URL: apiUrl },
+}, { provider, project })
+
+new VercelDeploy("web-deploy", {
+  triggers: [hash("apps/web"), vars.contentHash],
+}, { provider, project })
+
+// Marketplace example: provision an Upstash KV store
+const integration = new VercelIntegration("upstash", {
+  slug: "upstash",
+}, { provider })
+
+const store = new VercelMarketplaceResource("kv", {
+  integrationConfigurationId: integration.configurationId,
+  name: "my-kv",
+  type: "kv",
+  externalId: "my-kv",
+}, { provider })
+
+new VercelResourceConnection("kv-conn", {
+  storeId: store.id,
+  projectId: project.id,
+  targets: ["production", "preview"],
+}, { provider })
+```
+
+### Vercel API surface
+
+| Class | Key outputs | Notes |
+|---|---|---|
+| `VercelProvider` | — | `token` + `teamId` |
+| `VercelProject` | `.id`, `.url` | `.url` prefers custom domain over `*.vercel.app` |
+| `VercelVariable` | `.contentHash` | Use as a deploy trigger to redeploy on env var changes |
+| `VercelDeploy` | — | Runs `vercel deploy --prod --yes` |
+| `VercelIntegration` | `.configurationId` (`icfg_…`) | Resolves an installed marketplace integration by slug |
+| `VercelMarketplaceResource` | `.id`, `.externalResourceId`, `.status` | Provisions a marketplace store |
+| `VercelResourceConnection` | — | Wires a store to a project; injects env vars into target environments |
+
+**Helpers:** `VERCEL_FRAMEWORKS` (const array), `VercelFramework` (derived union type)
+
+## Fly.io
+
+```typescript
+import {
+  FlyProvider,
+  FlyApp,
+  FlySecret,
+  FlyVolume,
+  FlyCertificate,
+  FlyIp,
+  FlyIpType,
+  FlyDeploy,
+  FlyDeployStrategy,
+} from "@infracraft/pulumi/fly"
+import { hash } from "@infracraft/pulumi/hash"
+
+// Provider — auth context (token + optional default org)
+const provider = new FlyProvider("fly", {
+  token: config.requireSecret("flyToken"),
+  organization: "personal",
+})
+
+// App — adopt-or-create; `.id` is the app name
+const app = new FlyApp("api", { name: "rby-api" }, { provider })
+
+// Secrets — managed via the Machines REST secrets API.
+// `.version` changes only when the secret set changes.
+const secrets = new FlySecret("api-secrets", {
+  secrets: { JWT_SECRET: jwt, DATABASE_URL: dbUrl },
+}, { provider, app })
+
+// Volume — persistent storage (grow-only)
+new FlyVolume("api-data", {
+  name: "data",
+  region: "iad",
+  sizeGb: 10,
+}, { provider, app })
+
+// Certificate — ACME cert for a custom hostname
+new FlyCertificate("api-cert", {
+  hostname: "api.example.com",
+}, { provider, app })
+
+// Dedicated/shared IP (Fly GraphQL API)
+new FlyIp("api-ip", { type: FlyIpType.SHARED_V4 }, { provider, app })
+
+// Deploy — `fly deploy --remote-only` with consumer-controlled triggers.
+// The generated fly.toml content is included in the triggers automatically.
+new FlyDeploy("api-deploy", {
+  config: {
+    app: "rby-api",
+    primaryRegion: "iad",
+    build: { dockerfile: "apps/api/Dockerfile" },
+    httpService: {
+      internalPort: 3333,
+      forceHttps: true,
+      minMachinesRunning: 1,
+      checks: [{ method: "GET", path: "/health", interval: "30s", timeout: "10s" }],
+    },
+    deploy: { strategy: FlyDeployStrategy.ROLLING },
+    vm: [{ size: "shared-cpu-1x", memory: "512mb", cpus: 1 }],
+  },
+  triggers: [hash("apps/api"), secrets.version],
+}, { provider, app, dependsOn: [secrets] })
+```
+
+**Requirements:** `flyctl` must be installed on the machine running `pulumi up` (used by `FlyDeploy`). Generate a token with `fly tokens create deploy`. Dedicated IP allocation uses the Fly GraphQL API; everything else uses the Machines REST API.
+
+### Fly.io API surface
+
+| Class | Key outputs | Notes |
+|---|---|---|
+| `FlyApp` | `.id` (app name) | Adopt-or-create |
+| `FlySecret` | `.version` | Feed into `FlyDeploy` triggers to redeploy on secret changes |
+| `FlyVolume` | `.id` (`vol_…`) | `sizeGb` can only grow |
+| `FlyCertificate` | `.id` (hostname), `.configured`, `.dnsRequirements` | `.dnsRequirements` contains ACME validation records |
+| `FlyIp` | `.id` (IP address) | `type`: `FlyIpType.V4`, `V6`, `SHARED_V4`, `PRIVATE_V6` |
+| `FlyDeploy` | — | Writes fly.toml at deploy time; triggers on config + source hash |
+
+**Enums:** `FlyIpType`, `FlyDeployStrategy` (`ROLLING`, `IMMEDIATE`, `CANARY`, `BLUEGREEN`), `FlyRestartPolicy` (`ALWAYS`, `ON_FAILURE`, `NEVER`), `FlyAutoStopMachines` (`OFF`, `STOP`, `SUSPEND`), `FlyConcurrencyType` (`CONNECTIONS`, `REQUESTS`), `FlyServiceProtocol` (`TCP`, `UDP`), `FlyPortHandler` (`HTTP`, `TLS`, `PG_TLS`, `PROXY_PROTO`, `EDGE_HTTP`), `FlyCpuKind` (`SHARED`, `PERFORMANCE`), `FlyCheckType` (`HTTP`, `TCP`)
+
+**Constants:** `FLY_REGIONS` (IATA codes array), `FlyRegion` (derived type), `FLY_VM_SIZES` (size preset array), `FlyVmSize` (derived type)
+
+**fly.toml types:** `FlyTomlConfig`, `FlyBuildConfig`, `FlyHttpService`, `FlyService`, `FlyServicePort`, `FlyMount`, `FlyVm`, `FlyDeployConfig`, `FlyRestartConfig`, `FlyCheck`, `FlyConcurrency`
+
+**Helper:** `generateFlyToml(config)` serializes a `FlyTomlConfig` to fly.toml text (camelCase to snake_case, deterministic output).
+
+## Agents
+
+Emit operating reminders for AI coding agents (Claude Code, Copilot, etc.) working on the stack. Auto-detects an agent via `CLAUDECODE` / `AI_AGENT` env vars — a no-op for humans unless `enabled` is forced.
+
+```typescript
+import * as agents from "@infracraft/pulumi/agents"
+
+agents.hint({
+  project: [
+    "Production branch is `main` — never destroy it.",
+    "All Railway services share one project; only environments are per-feature.",
+  ],
+  // channel: "stderr" (default) | "pulumi-log"
+})
+```
+
+Hints are emitted inside a `<infracraft-hint>` block with infracraft defaults (adopt-or-create, no-op deletes for shared resources, protect-for-shared) plus caller-supplied `project` reminders.
+
+### Agents API surface
+
+| Export | Kind | Notes |
+|---|---|---|
+| `hint(options?)` | function | Emits the hint block; no-op outside agent context |
+| `AgentHintOptions` | type | `project?` (string[]), `enabled?` (boolean), `channel?` (`"stderr"` or `"pulumi-log"`) |
+
+## Hash
+
+Produce a stable digest to use as a deploy trigger element. Accepts a source directory path (synchronous, returns `string`), a key-value env var map (returns `Output<string>`), or — via `hashApp` — an app directory plus its transitive workspace dependencies.
+
+```typescript
+import { hash, hashApp } from "@infracraft/pulumi/hash"
+
+// Hash a source directory
+const sourceHash = hash("apps/api")
+
+// Hash an app + every workspace package it depends on (transitively) —
+// a change to a shared packages/* the app uses retriggers its deploy
+const appHash = hashApp(monorepoRoot, "apps/api")
+
+// Hash an env var map into a single non-secret digest (Output<string>)
+const envHash = hash({ DATABASE_URL: dbUrl, JWT_SECRET: jwt })
+
+new RailwayDeploy("api-deploy", {
+  triggers: [appHash, envHash],
+}, { provider, project, environment, service, projectToken: deployToken.token })
+```
+
+### Hash API surface
+
+| Export | Kind | Notes |
+|---|---|---|
+| `hash(directory, options?)` | function | Recursive file name + content digest; skips build/VCS directories |
+| `hash(env)` | function | Sorted-key digest of resolved values; returned `Output<string>` is non-secret |
+| `hashApp(monorepoRoot, appDirectory, options?)` | function | Hashes the app and its transitive `apps/*`/`packages/*` workspace dependencies |
+
+## Sandbox & Git Guard
+
+Deploy isolation as `dependsOn` markers. Listing a `DeploySandbox` in a deploy's `dependsOn` runs that deploy's CLI from an isolated copy of the repo's tracked files under `/tmp/infracraft` (stale sandboxes are garbage-collected automatically). Adding a `GitGuard` swaps the copy's `.git` for a metadata-free stub (`git init` + `git add -A`, unborn HEAD) — so no commit SHA or author email is sent to the platform.
+
+```typescript
+import { DeploySandbox } from "@infracraft/pulumi/sandbox"
+import { GitGuard } from "@infracraft/pulumi/git-guard"
+import { hash } from "@infracraft/pulumi/hash"
+
+const sandbox = new DeploySandbox("sandbox")
+const guard = new GitGuard("git-guard")
+
+// Runs `vercel deploy` from an isolated copy with a stub `.git`
+new VercelDeploy("web-deploy", {
+  triggers: [hash("apps/web")],
+  excludePaths: ["apps/docs"],   // drop other apps from the upload (stub mode only)
+}, { provider, project, dependsOn: [sandbox, guard] })
+```
+
+| `dependsOn` markers | Working copy | `.git` sent to the platform |
+|---|---|---|
+| none | Live repo tree | The real one — whatever the platform CLI picks up |
+| `DeploySandbox` | Isolated `/tmp/infracraft` copy | Real `.git` (copy-on-write copy) |
+| `DeploySandbox` + `GitGuard` | Isolated copy, `excludePaths` applied | Metadata-free stub — no commit SHA, no author |
+| `GitGuard` alone | — | Throws: the guard needs a sandbox to act on |
+
+### Sandbox & Git Guard API surface
+
+| Export | Kind | Notes |
+|---|---|---|
+| `DeploySandbox` | ComponentResource | Isolation marker + workspace lifecycle; GCs sandboxes older than 3h |
+| `GitGuard` | ComponentResource | Metadata-protection marker; requires a `DeploySandbox` alongside it |
+| `SandboxMode` | enum | `NONE`, `ORIGINAL`, `STUB` — derived from the markers by the deploy seam |
+| `buildSandboxScript(options)` | function | Builds the sandboxed shell a deploy command runs (used by the deploy resources) |
+| `buildSandboxFileFilter(excludePaths)` | function | Portable awk filter applied to `git ls-files` before the copy |
+| `isDeploySandbox(value)` / `isGitGuard(value)` | functions | Bundle-safe marker checks |
+
+## Design
+
+**Context-based**: Resources inherit auth, project, and environment from their options — no manual ID passing.
+
+**Adopt-or-create**: Existing infrastructure is discovered by name and adopted into Pulumi state. Run `pulumi up` against a pre-existing project and it just works.
+
+**Consumer-controlled protection**: Use `protect: true` on shared/production resources to prevent accidental deletion. Deploy resources accept a `triggers` array — you decide what causes a redeploy.
+
+**Consumer-controlled triggers**: Hash source directories, env values, or anything else. Pass results into `triggers` arrays.
+
+## Why
+
+| Provider | Existing options | Gap |
+|---|---|---|
+| Railway | Nothing. Zero Pulumi providers exist. | **We are the Railway Pulumi provider.** |
+| Neon | Bridged TF provider — fails on pre-existing resources | Adopt-or-create without manual `import` blocks |
+| Vercel | `@pulumiverse/vercel` — no adopt-or-create, no CLI deploys | Adopt-or-create projects + consumer-controlled deploy triggers |
+| Fly.io | `@ediri/pulumi-fly` — bridges a Terraform provider Fly archived March 2024; no secrets support | Hand-rolled `dynamic` resources matching every other provider — secrets, adopt-or-create, consumer-controlled deploys; no unmaintained upstream |
+
+## License
+
+MIT

package/dist/railway/bin/monitor-deployment.cjs

@@ -0,0 +1,38 @@
+const require_chunk = require('../../chunk-BVYJZCqc.cjs');
+const require_railway_deployment_monitor = require('../deployment-monitor.cjs');
+
+//#region src/railway/bin/monitor-deployment.ts
+/**
+* Runnable entry for the Railway deploy monitor — invoked by `RailwayDeploy` as
+* `node <dist>/railway/bin/monitor-deployment.mjs` after `railway up --detach`.
+*
+* Reads the deploy context from `IC_*` env vars, wires the real `fetch`/`setTimeout`/stderr
+* collaborators, and exits non-zero iff the Railway API reports a failed (or never-resolved-
+* after-failed-upload) deployment. All decision logic lives in the unit-tested
+* `deployment-monitor` module; this file is only IO + process glue.
+*/
+async function main() {
+	const result = await require_railway_deployment_monitor.monitorRailwayDeployment({
+		apiUrl: process.env.IC_API_URL || void 0,
+		projectToken: process.env.IC_TOK ?? "",
+		projectId: process.env.IC_PROJ ?? "",
+		environmentId: process.env.IC_ENV ?? "",
+		serviceId: process.env.IC_SVC ?? "",
+		deploymentId: process.env.IC_DEPLOY_ID || void 0,
+		uploadOutput: process.env.IC_UP_OUT,
+		uploadExitCode: Number(process.env.IC_UP_EXIT ?? "0"),
+		since: Number(process.env.IC_SINCE ?? "0")
+	}, {
+		fetch: globalThis.fetch,
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+		log: (line) => process.stderr.write(`${line}\n`)
+	});
+	process.exit(result.failed ? 1 : 0);
+}
+main().catch((error) => {
+	process.stderr.write(`[infracraft] deploy monitor crashed: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exit(1);
+});
+
+//#endregion
+//# sourceMappingURL=monitor-deployment.cjs.map

package/dist/railway/bin/monitor-deployment.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor-deployment.cjs","names":["monitorRailwayDeployment"],"sources":["../../../src/railway/bin/monitor-deployment.ts"],"sourcesContent":["/**\n * Runnable entry for the Railway deploy monitor — invoked by `RailwayDeploy` as\n * `node <dist>/railway/bin/monitor-deployment.mjs` after `railway up --detach`.\n *\n * Reads the deploy context from `IC_*` env vars, wires the real `fetch`/`setTimeout`/stderr\n * collaborators, and exits non-zero iff the Railway API reports a failed (or never-resolved-\n * after-failed-upload) deployment. All decision logic lives in the unit-tested\n * `deployment-monitor` module; this file is only IO + process glue.\n */\nimport { monitorRailwayDeployment } from \"../deployment-monitor\";\n\nasync function main(): Promise<void> {\n\tconst result = await monitorRailwayDeployment(\n\t\t{\n\t\t\t// Defaults to Railway's public API; override only to point at a proxy or a test server.\n\t\t\tapiUrl: process.env.IC_API_URL || undefined,\n\t\t\tprojectToken: process.env.IC_TOK ?? \"\",\n\t\t\tprojectId: process.env.IC_PROJ ?? \"\",\n\t\t\tenvironmentId: process.env.IC_ENV ?? \"\",\n\t\t\tserviceId: process.env.IC_SVC ?? \"\",\n\t\t\tdeploymentId: process.env.IC_DEPLOY_ID || undefined,\n\t\t\tuploadOutput: process.env.IC_UP_OUT,\n\t\t\tuploadExitCode: Number(process.env.IC_UP_EXIT ?? \"0\"),\n\t\t\tsince: Number(process.env.IC_SINCE ?? \"0\"),\n\t\t},\n\t\t{\n\t\t\tfetch: globalThis.fetch,\n\t\t\tsleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n\t\t\tlog: (line) => process.stderr.write(`${line}\\n`),\n\t\t},\n\t);\n\n\tprocess.exit(result.failed ? 1 : 0);\n}\n\nmain().catch((error) => {\n\tprocess.stderr.write(\n\t\t`[infracraft] deploy monitor crashed: ${error instanceof Error ? error.message : String(error)}\\n`,\n\t);\n\n\tprocess.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;AAWA,eAAe,OAAsB;CACpC,MAAM,SAAS,MAAMA,4DACpB;EAEC,QAAQ,QAAQ,IAAI,cAAc;EAClC,cAAc,QAAQ,IAAI,UAAU;EACpC,WAAW,QAAQ,IAAI,WAAW;EAClC,eAAe,QAAQ,IAAI,UAAU;EACrC,WAAW,QAAQ,IAAI,UAAU;EACjC,cAAc,QAAQ,IAAI,gBAAgB;EAC1C,cAAc,QAAQ,IAAI;EAC1B,gBAAgB,OAAO,QAAQ,IAAI,cAAc,GAAG;EACpD,OAAO,OAAO,QAAQ,IAAI,YAAY,GAAG;CAC1C,GACA;EACC,OAAO,WAAW;EAClB,QAAQ,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;EAC/D,MAAM,SAAS,QAAQ,OAAO,MAAM,GAAG,KAAK,GAAG;CAChD,CACD;CAEA,QAAQ,KAAK,OAAO,SAAS,IAAI,CAAC;AACnC;AAEA,KAAK,EAAE,OAAO,UAAU;CACvB,QAAQ,OAAO,MACd,wCAAwC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAChG;CAEA,QAAQ,KAAK,CAAC;AACf,CAAC"}

package/dist/railway/bin/monitor-deployment.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/railway/bin/monitor-deployment.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/railway/bin/monitor-deployment.mjs

@@ -0,0 +1,39 @@
+import { t as __name } from "../../chunk-OPjESj5l.mjs";
+import { monitorRailwayDeployment } from "../deployment-monitor.mjs";
+
+//#region src/railway/bin/monitor-deployment.ts
+/**
+* Runnable entry for the Railway deploy monitor — invoked by `RailwayDeploy` as
+* `node <dist>/railway/bin/monitor-deployment.mjs` after `railway up --detach`.
+*
+* Reads the deploy context from `IC_*` env vars, wires the real `fetch`/`setTimeout`/stderr
+* collaborators, and exits non-zero iff the Railway API reports a failed (or never-resolved-
+* after-failed-upload) deployment. All decision logic lives in the unit-tested
+* `deployment-monitor` module; this file is only IO + process glue.
+*/
+async function main() {
+	const result = await monitorRailwayDeployment({
+		apiUrl: process.env.IC_API_URL || void 0,
+		projectToken: process.env.IC_TOK ?? "",
+		projectId: process.env.IC_PROJ ?? "",
+		environmentId: process.env.IC_ENV ?? "",
+		serviceId: process.env.IC_SVC ?? "",
+		deploymentId: process.env.IC_DEPLOY_ID || void 0,
+		uploadOutput: process.env.IC_UP_OUT,
+		uploadExitCode: Number(process.env.IC_UP_EXIT ?? "0"),
+		since: Number(process.env.IC_SINCE ?? "0")
+	}, {
+		fetch: globalThis.fetch,
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+		log: (line) => process.stderr.write(`${line}\n`)
+	});
+	process.exit(result.failed ? 1 : 0);
+}
+main().catch((error) => {
+	process.stderr.write(`[infracraft] deploy monitor crashed: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exit(1);
+});
+
+//#endregion
+export {  };
+//# sourceMappingURL=monitor-deployment.mjs.map

package/dist/railway/bin/monitor-deployment.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor-deployment.mjs","names":[],"sources":["../../../src/railway/bin/monitor-deployment.ts"],"sourcesContent":["/**\n * Runnable entry for the Railway deploy monitor — invoked by `RailwayDeploy` as\n * `node <dist>/railway/bin/monitor-deployment.mjs` after `railway up --detach`.\n *\n * Reads the deploy context from `IC_*` env vars, wires the real `fetch`/`setTimeout`/stderr\n * collaborators, and exits non-zero iff the Railway API reports a failed (or never-resolved-\n * after-failed-upload) deployment. All decision logic lives in the unit-tested\n * `deployment-monitor` module; this file is only IO + process glue.\n */\nimport { monitorRailwayDeployment } from \"../deployment-monitor\";\n\nasync function main(): Promise<void> {\n\tconst result = await monitorRailwayDeployment(\n\t\t{\n\t\t\t// Defaults to Railway's public API; override only to point at a proxy or a test server.\n\t\t\tapiUrl: process.env.IC_API_URL || undefined,\n\t\t\tprojectToken: process.env.IC_TOK ?? \"\",\n\t\t\tprojectId: process.env.IC_PROJ ?? \"\",\n\t\t\tenvironmentId: process.env.IC_ENV ?? \"\",\n\t\t\tserviceId: process.env.IC_SVC ?? \"\",\n\t\t\tdeploymentId: process.env.IC_DEPLOY_ID || undefined,\n\t\t\tuploadOutput: process.env.IC_UP_OUT,\n\t\t\tuploadExitCode: Number(process.env.IC_UP_EXIT ?? \"0\"),\n\t\t\tsince: Number(process.env.IC_SINCE ?? \"0\"),\n\t\t},\n\t\t{\n\t\t\tfetch: globalThis.fetch,\n\t\t\tsleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n\t\t\tlog: (line) => process.stderr.write(`${line}\\n`),\n\t\t},\n\t);\n\n\tprocess.exit(result.failed ? 1 : 0);\n}\n\nmain().catch((error) => {\n\tprocess.stderr.write(\n\t\t`[infracraft] deploy monitor crashed: ${error instanceof Error ? error.message : String(error)}\\n`,\n\t);\n\n\tprocess.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;AAWA,eAAe,OAAsB;CACpC,MAAM,SAAS,MAAM,yBACpB;EAEC,QAAQ,QAAQ,IAAI,cAAc;EAClC,cAAc,QAAQ,IAAI,UAAU;EACpC,WAAW,QAAQ,IAAI,WAAW;EAClC,eAAe,QAAQ,IAAI,UAAU;EACrC,WAAW,QAAQ,IAAI,UAAU;EACjC,cAAc,QAAQ,IAAI,gBAAgB;EAC1C,cAAc,QAAQ,IAAI;EAC1B,gBAAgB,OAAO,QAAQ,IAAI,cAAc,GAAG;EACpD,OAAO,OAAO,QAAQ,IAAI,YAAY,GAAG;CAC1C,GACA;EACC,OAAO,WAAW;EAClB,QAAQ,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;EAC/D,MAAM,SAAS,QAAQ,OAAO,MAAM,GAAG,KAAK,GAAG;CAChD,CACD;CAEA,QAAQ,KAAK,OAAO,SAAS,IAAI,CAAC;AACnC;AAEA,KAAK,EAAE,OAAO,UAAU;CACvB,QAAQ,OAAO,MACd,wCAAwC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAChG;CAEA,QAAQ,KAAK,CAAC;AACf,CAAC"}

package/dist/railway/deploy.cjs

@@ -3,23 +3,16 @@ const require_chunk = require('../chunk-BVYJZCqc.cjs');
 const require_commands_deploy = require('../commands/deploy.cjs');
 let _pulumi_pulumi = require("@pulumi/pulumi");
 _pulumi_pulumi = require_chunk.__toESM(_pulumi_pulumi, 1);
+let node_url = require("node:url");
 
 //#region src/railway/deploy.ts
 /**
-* The deploy-wait poller. `railway up --ci` only blocks until upload; this polls
-* the Railway GraphQL API to a terminal status and fails the resource on
-* FAILED/CRASHED/REMOVED. Runs under `node -e`, single-quoted in the shell, so it
-* uses ONLY double quotes and reads inputs from IC_* env vars.
-*
-* Deployment-id resolution filters by `createdAt >= IC_SINCE` (the epoch captured
-* just before `railway up`, minus a clock-skew buffer) and picks the newest such
-* deployment. This prevents latching onto the PREVIOUS deployment when Railway's
-* API has not yet registered the new one (a plain `first:1` race). SLEEPING (the
-* service deployed then scaled to zero) is treated as success; SKIPPED (the
-* deploy was superseded) is non-blocking; an unresolvable id (upload already
-* succeeded) does not block the release.
+* Absolute path to the runnable deploy monitor, resolved next to this module in `dist`.
+* `railway up` only uploads + triggers; this bin makes the Railway GraphQL API — not the
+* CLI's exit code — the source of truth for pass/fail, and dumps build + deploy logs on
+* failure. Its logic lives in the unit-tested `deployment-monitor` module.
 */
-const DEPLOY_WAIT_SCRIPT = `const t=process.env.IC_TOK,p=process.env.IC_PROJ,e=process.env.IC_ENV,s=process.env.IC_SVC;const since=Number(process.env.IC_SINCE||0)-120000;const u="https://backboard.railway.app/graphql/v2";const q=(query,variables)=>fetch(u,{method:"POST",headers:{"Project-Access-Token":t,"Content-Type":"application/json"},body:JSON.stringify({query,variables})}).then(r=>r.json()).catch(()=>({}));const sl=ms=>new Promise(r=>setTimeout(r,ms));const ok={SUCCESS:1,SLEEPING:1};const bad={FAILED:1,CRASHED:1,REMOVED:1};(async()=>{let id;for(let i=0;i<12&&!id;i++){const d=await q("query($p:String!,$e:String!,$s:String!){deployments(first:10,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}",{p,e,s});const g=(d&&d.data&&d.data.deployments&&d.data.deployments.edges)||[];const fresh=g.map(x=>x.node).filter(n=>n&&n.createdAt&&Date.parse(n.createdAt)>=since).sort((a,b)=>Date.parse(b.createdAt)-Date.parse(a.createdAt));if(fresh[0])id=fresh[0].id;if(!id)await sl(5000);}if(!id){console.error("[infracraft] could not resolve a Railway deployment newer than this run; upload succeeded, not blocking");process.exit(0);}for(let i=0;i<120;i++){const r=await q("query($d:String!){deployment(id:$d){status}}",{d:id});const st=r&&r.data&&r.data.deployment&&r.data.deployment.status;if(st)console.error("[infracraft] railway deployment "+id+" status="+st);if(st&&ok[st])process.exit(0);if(st==="SKIPPED"){console.error("[infracraft] railway deployment "+id+" SKIPPED (superseded) — not blocking");process.exit(0);}if(st&&bad[st]){const l=await q("query($d:String!){deploymentLogs(deploymentId:$d,limit:60){message}}",{d:id});const lg=(l&&l.data&&l.data.deploymentLogs)||[];for(const x of lg)console.error("    "+(x.message||""));console.error("[infracraft] railway deployment "+id+" "+st+" — failing the Pulumi resource");process.exit(1);}await sl(10000);}console.error("[infracraft] timed out waiting for Railway deployment "+id);process.exit(1);})();`;
+const MONITOR_BIN = (0, node_url.fileURLToPath)(new URL("./bin/monitor-deployment.mjs", require("url").pathToFileURL(__filename).href));
 /**
 * Deploys a Railway service and waits for a terminal status. Isolation/git are the
 * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).
@@ -34,7 +27,7 @@ var RailwayDeploy = class extends _pulumi_pulumi.ComponentResource {
 	constructor(name, args, opts) {
 		const { provider, project, environment, service, projectToken, ...pulumiOpts } = opts;
 		super("infracraft:railway:Deploy", name, {}, pulumiOpts);
-		const cli = _pulumi_pulumi.interpolate`IC_SINCE=$(node -e "process.stdout.write(String(Date.now()))"); RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; if [ "$EXIT" -ne 0 ]; then exit "$EXIT"; fi; if [ -n "$INFRACRAFT_SKIP_DEPLOY_WAIT" ]; then exit 0; fi; IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node -e '${DEPLOY_WAIT_SCRIPT}'`;
+		const cli = _pulumi_pulumi.interpolate`IC_SINCE=$(node -e "process.stdout.write(String(Date.now()))"); IC_UP_OUT=$(RAILWAY_TOKEN=${projectToken} railway up --detach --json --project ${project.id} --service ${service.id} --environment ${environment.id} 2>&1); IC_UP_EXIT=$?; printf '%s\\n' "$IC_UP_OUT"; if [ -n "$INFRACRAFT_SKIP_DEPLOY_WAIT" ]; then exit "$IC_UP_EXIT"; fi; IC_UP_OUT="$IC_UP_OUT" IC_UP_EXIT=$IC_UP_EXIT IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node "${MONITOR_BIN}"`;
 		const setup = args.railpackConfig ? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, "'\\''")}' > railpack.json` : void 0;
 		const { deploymentUrl } = require_commands_deploy.createDeployCommand({
 			name,

package/dist/railway/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["pulumi","createDeployCommand"],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["// src/railway/deploy.ts  (replace entire file)\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\nexport interface RailwayDeployConfig {\n\tbuilder?: RailwayBuilder;\n\tstartCommand?: string;\n\tpreDeployCommand?: string;\n}\n\nexport interface RailwayDeployArgs {\n\t/** Redeploy triggers (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\tprovider: RailwayProvider;\n\tproject: RailwayProject;\n\tenvironment: RailwayEnvironment;\n\tservice: RailwayService;\n\t/** Environment-scoped Railway deploy token (provision via RailwayProjectToken). */\n\tprojectToken: pulumi.Input<string>;\n};\n\n/**\n * The deploy-wait poller. `railway up --ci` only blocks until upload; this polls\n * the Railway GraphQL API to a terminal status and fails the resource on\n * FAILED/CRASHED/REMOVED. Runs under `node -e`, single-quoted in the shell, so it\n * uses ONLY double quotes and reads inputs from IC_* env vars.\n *\n * Deployment-id resolution filters by `createdAt >= IC_SINCE` (the epoch captured\n * just before `railway up`, minus a clock-skew buffer) and picks the newest such\n * deployment. This prevents latching onto the PREVIOUS deployment when Railway's\n * API has not yet registered the new one (a plain `first:1` race). SLEEPING (the\n * service deployed then scaled to zero) is treated as success; SKIPPED (the\n * deploy was superseded) is non-blocking; an unresolvable id (upload already\n * succeeded) does not block the release.\n */\nconst DEPLOY_WAIT_SCRIPT = `const t=process.env.IC_TOK,p=process.env.IC_PROJ,e=process.env.IC_ENV,s=process.env.IC_SVC;const since=Number(process.env.IC_SINCE||0)-120000;const u=\"https://backboard.railway.app/graphql/v2\";const q=(query,variables)=>fetch(u,{method:\"POST\",headers:{\"Project-Access-Token\":t,\"Content-Type\":\"application/json\"},body:JSON.stringify({query,variables})}).then(r=>r.json()).catch(()=>({}));const sl=ms=>new Promise(r=>setTimeout(r,ms));const ok={SUCCESS:1,SLEEPING:1};const bad={FAILED:1,CRASHED:1,REMOVED:1};(async()=>{let id;for(let i=0;i<12&&!id;i++){const d=await q(\"query($p:String!,$e:String!,$s:String!){deployments(first:10,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}\",{p,e,s});const g=(d&&d.data&&d.data.deployments&&d.data.deployments.edges)||[];const fresh=g.map(x=>x.node).filter(n=>n&&n.createdAt&&Date.parse(n.createdAt)>=since).sort((a,b)=>Date.parse(b.createdAt)-Date.parse(a.createdAt));if(fresh[0])id=fresh[0].id;if(!id)await sl(5000);}if(!id){console.error(\"[infracraft] could not resolve a Railway deployment newer than this run; upload succeeded, not blocking\");process.exit(0);}for(let i=0;i<120;i++){const r=await q(\"query($d:String!){deployment(id:$d){status}}\",{d:id});const st=r&&r.data&&r.data.deployment&&r.data.deployment.status;if(st)console.error(\"[infracraft] railway deployment \"+id+\" status=\"+st);if(st&&ok[st])process.exit(0);if(st===\"SKIPPED\"){console.error(\"[infracraft] railway deployment \"+id+\" SKIPPED (superseded) — not blocking\");process.exit(0);}if(st&&bad[st]){const l=await q(\"query($d:String!){deploymentLogs(deploymentId:$d,limit:60){message}}\",{d:id});const lg=(l&&l.data&&l.data.deploymentLogs)||[];for(const x of lg)console.error(\"    \"+(x.message||\"\"));console.error(\"[infracraft] railway deployment \"+id+\" \"+st+\" — failing the Pulumi resource\");process.exit(1);}await sl(10000);}console.error(\"[infracraft] timed out waiting for Railway deployment \"+id);process.exit(1);})();`;\n\n/**\n * Deploys a Railway service and waits for a terminal status. Isolation/git are the\n * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"mesh\", { triggers: [sourceHash], railpackConfig: { apt: [\"libatomic1\"] } },\n *   { provider, project, environment, service, projectToken: token.token, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\t/** The deploy CLI's final stdout line (Railway service URL when emitted). */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst {\n\t\t\tprovider,\n\t\t\tproject,\n\t\t\tenvironment,\n\t\t\tservice,\n\t\t\tprojectToken,\n\t\t\t...pulumiOpts\n\t\t} = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\t// Token is inlined (not via the env map): it is an unknown secret at preview,\n\t\t// and an unknown secret in `environment` makes `pulumi preview` fail.\n\t\t// IC_SINCE is captured just before `railway up` so the poller can tell the\n\t\t// new deployment apart from the previous one by createdAt.\n\t\tconst cli = pulumi.interpolate`IC_SINCE=$(node -e \"process.stdout.write(String(Date.now()))\"); RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; if [ \"$EXIT\" -ne 0 ]; then exit \"$EXIT\"; fi; if [ -n \"$INFRACRAFT_SKIP_DEPLOY_WAIT\" ]; then exit 0; fi; IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node -e '${DEPLOY_WAIT_SCRIPT}'`;\n\n\t\t// `printf '%s'` (not a bare format string) so railpack values containing %\n\t\t// are literal; the JSON is single-quote-escaped the POSIX way (' -> '\\'').\n\t\tconst setup = args.railpackConfig\n\t\t\t? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, \"'\\\\''\")}' > railpack.json`\n\t\t\t: undefined;\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tsetup,\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkDA,MAAM,qBAAqB;;;;;;;;;;;AAY3B,IAAa,gBAAb,cAAmCA,eAAO,kBAAkB;CAI3D,YACC,MACA,MACA,MACC;EACD,MAAM,EACL,UACA,SACA,aACA,SACA,cACA,GAAG,eACA;EAEJ,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAMvD,MAAM,MAAM,eAAO,WAAW,iFAAiF,aAAa,6BAA6B,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,4HAA4H,aAAa,WAAW,QAAQ,GAAG,UAAU,YAAY,GAAG,UAAU,QAAQ,GAAG,+BAA+B,mBAAmB;EAI3d,MAAM,QAAQ,KAAK,iBAChB,gBAAgB,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,OAAO,EAAE,qBAC3E;EAEH,MAAM,EAAE,kBAAkBC,4CACzB;GACC;GACA;GACA,UAAU,KAAK;GACf,cAAc,KAAK;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}
+{"version":3,"file":"deploy.cjs","names":["pulumi","createDeployCommand"],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["// src/railway/deploy.ts  (replace entire file)\nimport { fileURLToPath } from \"node:url\";\n\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\nexport interface RailwayDeployConfig {\n\tbuilder?: RailwayBuilder;\n\tstartCommand?: string;\n\tpreDeployCommand?: string;\n}\n\nexport interface RailwayDeployArgs {\n\t/** Redeploy triggers (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\tprovider: RailwayProvider;\n\tproject: RailwayProject;\n\tenvironment: RailwayEnvironment;\n\tservice: RailwayService;\n\t/** Environment-scoped Railway deploy token (provision via RailwayProjectToken). */\n\tprojectToken: pulumi.Input<string>;\n};\n\n/**\n * Absolute path to the runnable deploy monitor, resolved next to this module in `dist`.\n * `railway up` only uploads + triggers; this bin makes the Railway GraphQL API — not the\n * CLI's exit code — the source of truth for pass/fail, and dumps build + deploy logs on\n * failure. Its logic lives in the unit-tested `deployment-monitor` module.\n */\nconst MONITOR_BIN = fileURLToPath(\n\tnew URL(\"./bin/monitor-deployment.mjs\", import.meta.url),\n);\n\n/**\n * Deploys a Railway service and waits for a terminal status. Isolation/git are the\n * seam's job (list a `DeploySandbox` and optionally a `GitGuard` in `dependsOn`).\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"mesh\", { triggers: [sourceHash], railpackConfig: { apt: [\"libatomic1\"] } },\n *   { provider, project, environment, service, projectToken: token.token, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\t/** The deploy CLI's final stdout line (Railway service URL when emitted). */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst {\n\t\t\tprovider,\n\t\t\tproject,\n\t\t\tenvironment,\n\t\t\tservice,\n\t\t\tprojectToken,\n\t\t\t...pulumiOpts\n\t\t} = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\t// `railway up --detach` uploads + triggers WITHOUT attaching to the build-log\n\t\t// stream — that long-lived stream is what intermittently times out and makes the\n\t\t// CLI exit non-zero even when the deploy actually succeeds. We capture its `--json`\n\t\t// output (for the exact deployment id) and exit code, re-emit it for visibility,\n\t\t// then hand off to the monitor bin which polls the Railway API to a terminal status.\n\t\t// The API — not the CLI exit code — decides pass/fail. Token is inlined (not via the\n\t\t// env map): an unknown secret in `environment` makes `pulumi preview` fail. IC_SINCE\n\t\t// is captured just before `railway up` as a createdAt fallback for id resolution.\n\t\tconst cli = pulumi.interpolate`IC_SINCE=$(node -e \"process.stdout.write(String(Date.now()))\"); IC_UP_OUT=$(RAILWAY_TOKEN=${projectToken} railway up --detach --json --project ${project.id} --service ${service.id} --environment ${environment.id} 2>&1); IC_UP_EXIT=$?; printf '%s\\\\n' \"$IC_UP_OUT\"; if [ -n \"$INFRACRAFT_SKIP_DEPLOY_WAIT\" ]; then exit \"$IC_UP_EXIT\"; fi; IC_UP_OUT=\"$IC_UP_OUT\" IC_UP_EXIT=$IC_UP_EXIT IC_TOK=${projectToken} IC_PROJ=${project.id} IC_ENV=${environment.id} IC_SVC=${service.id} IC_SINCE=$IC_SINCE node \"${MONITOR_BIN}\"`;\n\n\t\t// `printf '%s'` (not a bare format string) so railpack values containing %\n\t\t// are literal; the JSON is single-quote-escaped the POSIX way (' -> '\\'').\n\t\tconst setup = args.railpackConfig\n\t\t\t? `printf '%s' '${JSON.stringify(args.railpackConfig).replace(/'/g, \"'\\\\''\")}' > railpack.json`\n\t\t\t: undefined;\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tsetup,\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;AA4CA,MAAM,0CACL,IAAI,IAAI,6EAA+C,CACxD;;;;;;;;;;;AAYA,IAAa,gBAAb,cAAmCA,eAAO,kBAAkB;CAI3D,YACC,MACA,MACA,MACC;EACD,MAAM,EACL,UACA,SACA,aACA,SACA,cACA,GAAG,eACA;EAEJ,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAUvD,MAAM,MAAM,eAAO,WAAW,6FAA6F,aAAa,wCAAwC,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,kLAAkL,aAAa,WAAW,QAAQ,GAAG,UAAU,YAAY,GAAG,UAAU,QAAQ,GAAG,4BAA4B,YAAY;EAI9hB,MAAM,QAAQ,KAAK,iBAChB,gBAAgB,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,OAAO,EAAE,qBAC3E;EAEH,MAAM,EAAE,kBAAkBC,4CACzB;GACC;GACA;GACA,UAAU,KAAK;GACf,cAAc,KAAK;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/dist/railway/deploy.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;UASiB,mBAAA;EAChB,OAAA,GAAU,cAAc;EACxB,YAAA;EACA,gBAAA;AAAA;AAAA,UAGgB,iBAAA;EALQ;EAOxB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPpB;EASV,YAAA;EAPA;EASA,cAAA,GAAiB,MAAA;AAAA;AAAA,KAGb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAGP,QAAA,EAAU,eAAA;EACV,OAAA,EAAS,cAAA;EACT,WAAA,EAAa,kBAAA;EACb,OAAA,EAAS,cAAA,EAVQ;EAYjB,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;AAZE;cAyCX,aAAA,SAAsB,MAAA,CAAO,iBAAA;EAtCjB;EAAA,SAwCR,aAAA,EAAe,MAAA,CAAO,MAAA;cAGrC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}
+{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;UAWiB,mBAAA;EAChB,OAAA,GAAU,cAAc;EACxB,YAAA;EACA,gBAAA;AAAA;AAAA,UAGgB,iBAAA;EALQ;EAOxB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPpB;EASV,YAAA;EAPA;EASA,cAAA,GAAiB,MAAA;AAAA;AAAA,KAGb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAGP,QAAA,EAAU,eAAA;EACV,OAAA,EAAS,cAAA;EACT,WAAA,EAAa,kBAAA;EACb,OAAA,EAAS,cAAA,EAVQ;EAYjB,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;AAZE;cAmCX,aAAA,SAAsB,MAAA,CAAO,iBAAA;EAhCjB;EAAA,SAkCR,aAAA,EAAe,MAAA,CAAO,MAAA;cAGrC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}

package/dist/railway/deploy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;UASiB,mBAAA;EAChB,OAAA,GAAU,cAAc;EACxB,YAAA;EACA,gBAAA;AAAA;AAAA,UAGgB,iBAAA;EALQ;EAOxB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPpB;EASV,YAAA;EAPA;EASA,cAAA,GAAiB,MAAA;AAAA;AAAA,KAGb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAGP,QAAA,EAAU,eAAA;EACV,OAAA,EAAS,cAAA;EACT,WAAA,EAAa,kBAAA;EACb,OAAA,EAAS,cAAA,EAVQ;EAYjB,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;AAZE;cAyCX,aAAA,SAAsB,MAAA,CAAO,iBAAA;EAtCjB;EAAA,SAwCR,aAAA,EAAe,MAAA,CAAO,MAAA;cAGrC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}
+{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;UAWiB,mBAAA;EAChB,OAAA,GAAU,cAAc;EACxB,YAAA;EACA,gBAAA;AAAA;AAAA,UAGgB,iBAAA;EALQ;EAOxB,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPpB;EASV,YAAA;EAPA;EASA,cAAA,GAAiB,MAAA;AAAA;AAAA,KAGb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAGP,QAAA,EAAU,eAAA;EACV,OAAA,EAAS,cAAA;EACT,WAAA,EAAa,kBAAA;EACb,OAAA,EAAS,cAAA,EAVQ;EAYjB,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;AAZE;cAmCX,aAAA,SAAsB,MAAA,CAAO,iBAAA;EAhCjB;EAAA,SAkCR,aAAA,EAAe,MAAA,CAAO,MAAA;cAGrC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}