@infracraft/pulumi 1.6.0 → 1.6.2

package/dist/railway/deploy.cjs

@@ -20,26 +20,24 @@ const LOCK_DIR = "/tmp/.railway-upload-lock";
 * ```typescript
 * new RailwayDeploy("api-deploy", {
 *   directory: monorepoRoot,
-*   sourceHash,
-*   env: { DATABASE_URL: dbUrl },
-* }, { provider, project, environment, service });
+*   triggers: [sourceHash],
+* }, { provider, project, environment, service, projectToken: stagingToken.token });
 * ```
 */
 var RailwayDeploy = class extends _pulumi_pulumi.ComponentResource {
 	constructor(name, args, opts) {
-		const { provider, project, environment, service, ...pulumiOpts } = opts;
+		const { provider, project, environment, service, projectToken, ...pulumiOpts } = opts;
 		super("infracraft:railway:Deploy", name, {}, pulumiOpts);
 		const ignorePatterns = (args.excludePaths ?? []).map((dir) => {
 			if (dir.startsWith("apps/")) return `${dir}/**\\n!${dir}/package.json`;
 			return dir;
 		}).join("\\n");
 		const setupLines = [ignorePatterns ? `printf '${ignorePatterns}\\n' > .railwayignore` : "", args.railpackConfig ? `printf '${JSON.stringify(args.railpackConfig).replace(/'/g, "\\'")}' > railpack.json` : ""].filter(Boolean).join("; ");
-		const deployCmd = _pulumi_pulumi.interpolate`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ${setupLines}; { sleep 5; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; } & railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; wait; exit $EXIT`;
+		const deployCmd = _pulumi_pulumi.interpolate`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ${setupLines}; { sleep 5; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; } & RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; wait; exit $EXIT`;
 		new _pulumi_command.local.Command(`${name}-deploy`, {
 			create: deployCmd,
 			triggers: args.triggers,
-			dir: require_stable_dir.stableDir(args.directory),
-			environment: { RAILWAY_TOKEN: project.projectToken }
+			dir: require_stable_dir.stableDir(args.directory)
 		}, { parent: this });
 		this.registerOutputs({});
 	}

package/dist/railway/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["pulumi","command","stableDir"],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { stableDir } from \"../stable-dir\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\n/** Build and deploy configuration for a Railway service. */\nexport interface RailwayDeployConfig {\n\t/** Build system to use when building the service. */\n\tbuilder?: RailwayBuilder;\n\n\t/** Shell command executed to start the service at runtime. */\n\tstartCommand?: string;\n\n\t/** Shell command executed before the main deploy (e.g. migrations). */\n\tpreDeployCommand?: string;\n}\n\n/** Args for RailwayDeploy. */\nexport interface RailwayDeployArgs {\n\t/**\n\t * Absolute path to the monorepo root (working directory for `railway up`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tdirectory: string;\n\n\t/** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\n\t/** Directories to exclude via `.railwayignore`. */\n\texcludePaths?: string[];\n\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\n/** Options type for RailwayDeploy — replaces Pulumi's native `provider` field. */\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\t/** Railway authentication context. */\n\tprovider: RailwayProvider;\n\n\t/** Railway project context. */\n\tproject: RailwayProject;\n\n\t/** Railway environment context. */\n\tenvironment: RailwayEnvironment;\n\n\t/** Railway service context. */\n\tservice: RailwayService;\n};\n\nconst LOCK_DIR = \"/tmp/.railway-upload-lock\";\n\n/**\n * Deploys a Railway service and waits for the build to complete.\n *\n * Uses `railway up --ci` which blocks until the build finishes.\n * Multiple deploys run in parallel — a mkdir lock serializes only the\n * brief upload phase (~5s) when `.railwayignore` must be consistent,\n * then releases so builds stream concurrently.\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"api-deploy\", {\n *   directory: monorepoRoot,\n *   sourceHash,\n *   env: { DATABASE_URL: dbUrl },\n * }, { provider, project, environment, service });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst { provider, project, environment, service, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst ignorePatterns = (args.excludePaths ?? [])\n\t\t\t.map((dir) => {\n\t\t\t\tif (dir.startsWith(\"apps/\")) {\n\t\t\t\t\treturn `${dir}/**\\\\n!${dir}/package.json`;\n\t\t\t\t}\n\n\t\t\t\treturn dir;\n\t\t\t})\n\t\t\t.join(\"\\\\n\");\n\n\t\tconst writeIgnore = ignorePatterns\n\t\t\t? `printf '${ignorePatterns}\\\\n' > .railwayignore`\n\t\t\t: \"\";\n\n\t\tconst writeRailpack = args.railpackConfig\n\t\t\t? `printf '${JSON.stringify(args.railpackConfig).replace(/'/g, \"\\\\'\")}' > railpack.json`\n\t\t\t: \"\";\n\n\t\tconst setupLines = [writeIgnore, writeRailpack].filter(Boolean).join(\"; \");\n\n\t\tconst deployCmd = pulumi.interpolate`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ${setupLines}; { sleep 5; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; } & railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; wait; exit $EXIT`;\n\n\t\tnew command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: deployCmd,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\tdir: stableDir(args.directory),\n\t\t\t\tenvironment: {\n\t\t\t\t\tRAILWAY_TOKEN: project.projectToken,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;;;;AAyDA,MAAM,WAAW;;;;;;;;;;;;;;;;;;AAmBjB,IAAa,gBAAb,cAAmCA,eAAO,kBAAkB;CAC3D,YACC,MACA,MACA,MACC;EACD,MAAM,EAAE,UAAU,SAAS,aAAa,SAAS,GAAG,eAAe;EAEnE,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAEvD,MAAM,kBAAkB,KAAK,gBAAgB,CAAC,GAC5C,KAAK,QAAQ;GACb,IAAI,IAAI,WAAW,OAAO,GACzB,OAAO,GAAG,IAAI,SAAS,IAAI;GAG5B,OAAO;EACR,CAAC,EACA,KAAK,KAAK;EAUZ,MAAM,aAAa,CARC,iBACjB,WAAW,eAAe,yBAC1B,IAEmB,KAAK,iBACxB,WAAW,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,KAAK,EAAE,qBACpE,EAE2C,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;EAEzE,MAAM,YAAY,eAAO,WAAW,iBAAiB,SAAS,kCAAkC,WAAW,yDAAyD,SAAS,8CAA8C,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,uDAAuD,SAAS;EAE9V,IAAIC,gBAAQ,MAAM,QACjB,GAAG,KAAK,UACR;GACC,QAAQ;GACR,UAAU,KAAK;GACf,KAAKC,6BAAU,KAAK,SAAS;GAC7B,aAAa,EACZ,eAAe,QAAQ,aACxB;EACD,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}
+{"version":3,"file":"deploy.cjs","names":["pulumi","command","stableDir"],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { stableDir } from \"../stable-dir\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\n/** Build and deploy configuration for a Railway service. */\nexport interface RailwayDeployConfig {\n\t/** Build system to use when building the service. */\n\tbuilder?: RailwayBuilder;\n\n\t/** Shell command executed to start the service at runtime. */\n\tstartCommand?: string;\n\n\t/** Shell command executed before the main deploy (e.g. migrations). */\n\tpreDeployCommand?: string;\n}\n\n/** Args for RailwayDeploy. */\nexport interface RailwayDeployArgs {\n\t/**\n\t * Absolute path to the monorepo root (working directory for `railway up`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tdirectory: string;\n\n\t/** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\n\t/** Directories to exclude via `.railwayignore`. */\n\texcludePaths?: string[];\n\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\n/** Options type for RailwayDeploy — replaces Pulumi's native `provider` field. */\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\t/** Railway authentication context. */\n\tprovider: RailwayProvider;\n\n\t/** Railway project context. */\n\tproject: RailwayProject;\n\n\t/** Railway environment context. */\n\tenvironment: RailwayEnvironment;\n\n\t/** Railway service context. */\n\tservice: RailwayService;\n\n\t/** Environment-scoped Railway deploy token. Provision via {@link RailwayProjectToken}. */\n\tprojectToken: pulumi.Input<string>;\n};\n\nconst LOCK_DIR = \"/tmp/.railway-upload-lock\";\n\n/**\n * Deploys a Railway service and waits for the build to complete.\n *\n * Uses `railway up --ci` which blocks until the build finishes.\n * Multiple deploys run in parallel — a mkdir lock serializes only the\n * brief upload phase (~5s) when `.railwayignore` must be consistent,\n * then releases so builds stream concurrently.\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"api-deploy\", {\n *   directory: monorepoRoot,\n *   triggers: [sourceHash],\n * }, { provider, project, environment, service, projectToken: stagingToken.token });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst {\n\t\t\tprovider,\n\t\t\tproject,\n\t\t\tenvironment,\n\t\t\tservice,\n\t\t\tprojectToken,\n\t\t\t...pulumiOpts\n\t\t} = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst ignorePatterns = (args.excludePaths ?? [])\n\t\t\t.map((dir) => {\n\t\t\t\tif (dir.startsWith(\"apps/\")) {\n\t\t\t\t\treturn `${dir}/**\\\\n!${dir}/package.json`;\n\t\t\t\t}\n\n\t\t\t\treturn dir;\n\t\t\t})\n\t\t\t.join(\"\\\\n\");\n\n\t\tconst writeIgnore = ignorePatterns\n\t\t\t? `printf '${ignorePatterns}\\\\n' > .railwayignore`\n\t\t\t: \"\";\n\n\t\tconst writeRailpack = args.railpackConfig\n\t\t\t? `printf '${JSON.stringify(args.railpackConfig).replace(/'/g, \"\\\\'\")}' > railpack.json`\n\t\t\t: \"\";\n\n\t\tconst setupLines = [writeIgnore, writeRailpack].filter(Boolean).join(\"; \");\n\n\t\t// The deploy token is inlined into the create command (RAILWAY_TOKEN=… railway up) rather\n\t\t// than passed via command.local.Command's `environment` map. The token is auto-minted (a\n\t\t// RailwayProjectToken), so it is an UNKNOWN secret at preview time, and an unknown secret in\n\t\t// the `environment` map makes `pulumi preview` fail (\"malformed RPC secret: missing value\").\n\t\t// Inlining keeps the token secret in state while letting preview serialize cleanly.\n\t\tconst deployCmd = pulumi.interpolate`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ${setupLines}; { sleep 5; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; } & RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; wait; exit $EXIT`;\n\n\t\tnew command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: deployCmd,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\tdir: stableDir(args.directory),\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;;;;AA4DA,MAAM,WAAW;;;;;;;;;;;;;;;;;AAkBjB,IAAa,gBAAb,cAAmCA,eAAO,kBAAkB;CAC3D,YACC,MACA,MACA,MACC;EACD,MAAM,EACL,UACA,SACA,aACA,SACA,cACA,GAAG,eACA;EAEJ,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAEvD,MAAM,kBAAkB,KAAK,gBAAgB,CAAC,GAC5C,KAAK,QAAQ;GACb,IAAI,IAAI,WAAW,OAAO,GACzB,OAAO,GAAG,IAAI,SAAS,IAAI;GAG5B,OAAO;EACR,CAAC,EACA,KAAK,KAAK;EAUZ,MAAM,aAAa,CARC,iBACjB,WAAW,eAAe,yBAC1B,IAEmB,KAAK,iBACxB,WAAW,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,KAAK,EAAE,qBACpE,EAE2C,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;EAOzE,MAAM,YAAY,eAAO,WAAW,iBAAiB,SAAS,kCAAkC,WAAW,yDAAyD,SAAS,kCAAkC,aAAa,6BAA6B,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,uDAAuD,SAAS;EAE5X,IAAIC,gBAAQ,MAAM,QACjB,GAAG,KAAK,UACR;GACC,QAAQ;GACR,UAAU,KAAK;GACf,KAAKC,6BAAU,KAAK,SAAS;EAC9B,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}

package/dist/railway/deploy.d.cts

@@ -35,7 +35,8 @@ type RailwayDeployOptions = Omit<pulumi.ComponentResourceOptions, "provider"> &
   /** Railway authentication context. */provider: RailwayProvider; /** Railway project context. */
   project: RailwayProject; /** Railway environment context. */
   environment: RailwayEnvironment; /** Railway service context. */
-  service: RailwayService;
+  service: RailwayService; /** Environment-scoped Railway deploy token. Provision via {@link RailwayProjectToken}. */
+  projectToken: pulumi.Input<string>;
 };
 /**
  * Deploys a Railway service and waits for the build to complete.
@@ -49,9 +50,8 @@ type RailwayDeployOptions = Omit<pulumi.ComponentResourceOptions, "provider"> &
  * ```typescript
  * new RailwayDeploy("api-deploy", {
  *   directory: monorepoRoot,
- *   sourceHash,
- *   env: { DATABASE_URL: dbUrl },
- * }, { provider, project, environment, service });
+ *   triggers: [sourceHash],
+ * }, { provider, project, environment, service, projectToken: stagingToken.token });
  * ```
  */
 declare class RailwayDeploy extends pulumi.ComponentResource {

package/dist/railway/deploy.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;;UASiB,mBAAA;;EAEhB,OAAA,GAAU,cAAc;EAFW;EAKnC,YAAA;EAHwB;EAMxB,gBAAA;AAAA;;UAIgB,iBAAA;EAJA;AAAA;AAIjB;;;EAMC,SAAA;EAGU;EAAV,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAMP;EAHvB,YAAA;EANA;EASA,cAAA,GAAiB,MAAA;AAAA;;KAIb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAXuB,sCAe9B,QAAA,EAAU,eAAA,EATV;EAYA,OAAA,EAAS,cAAA,EAZc;EAevB,WAAA,EAAa,kBAAA,EAXT;EAcJ,OAAA,EAAS,cAAA;AAAA;;;;;;;;;;;;;;;;;;cAsBG,aAAA,SAAsB,MAAA,CAAO,iBAAA;cAExC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}
+{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;;UASiB,mBAAA;;EAEhB,OAAA,GAAU,cAAc;EAFW;EAKnC,YAAA;EAHwB;EAMxB,gBAAA;AAAA;;UAIgB,iBAAA;EAJA;AAAA;AAIjB;;;EAMC,SAAA;EAGU;EAAV,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAMP;EAHvB,YAAA;EANA;EASA,cAAA,GAAiB,MAAA;AAAA;;KAIb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAXuB,sCAe9B,QAAA,EAAU,eAAA,EATV;EAYA,OAAA,EAAS,cAAA,EAZc;EAevB,WAAA,EAAa,kBAAA,EAXT;EAcJ,OAAA,EAAS,cAAA;EAGT,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;;;;;;;;cAqBT,aAAA,SAAsB,MAAA,CAAO,iBAAA;cAExC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}

package/dist/railway/deploy.d.mts

@@ -35,7 +35,8 @@ type RailwayDeployOptions = Omit<pulumi.ComponentResourceOptions, "provider"> &
   /** Railway authentication context. */provider: RailwayProvider; /** Railway project context. */
   project: RailwayProject; /** Railway environment context. */
   environment: RailwayEnvironment; /** Railway service context. */
-  service: RailwayService;
+  service: RailwayService; /** Environment-scoped Railway deploy token. Provision via {@link RailwayProjectToken}. */
+  projectToken: pulumi.Input<string>;
 };
 /**
  * Deploys a Railway service and waits for the build to complete.
@@ -49,9 +50,8 @@ type RailwayDeployOptions = Omit<pulumi.ComponentResourceOptions, "provider"> &
  * ```typescript
  * new RailwayDeploy("api-deploy", {
  *   directory: monorepoRoot,
- *   sourceHash,
- *   env: { DATABASE_URL: dbUrl },
- * }, { provider, project, environment, service });
+ *   triggers: [sourceHash],
+ * }, { provider, project, environment, service, projectToken: stagingToken.token });
  * ```
  */
 declare class RailwayDeploy extends pulumi.ComponentResource {

package/dist/railway/deploy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;;UASiB,mBAAA;;EAEhB,OAAA,GAAU,cAAc;EAFW;EAKnC,YAAA;EAHwB;EAMxB,gBAAA;AAAA;;UAIgB,iBAAA;EAJA;AAAA;AAIjB;;;EAMC,SAAA;EAGU;EAAV,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAMP;EAHvB,YAAA;EANA;EASA,cAAA,GAAiB,MAAA;AAAA;;KAIb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAXuB,sCAe9B,QAAA,EAAU,eAAA,EATV;EAYA,OAAA,EAAS,cAAA,EAZc;EAevB,WAAA,EAAa,kBAAA,EAXT;EAcJ,OAAA,EAAS,cAAA;AAAA;;;;;;;;;;;;;;;;;;cAsBG,aAAA,SAAsB,MAAA,CAAO,iBAAA;cAExC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}
+{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/railway/deploy.ts"],"mappings":";;;;;;;;;UASiB,mBAAA;;EAEhB,OAAA,GAAU,cAAc;EAFW;EAKnC,YAAA;EAHwB;EAMxB,gBAAA;AAAA;;UAIgB,iBAAA;EAJA;AAAA;AAIjB;;;EAMC,SAAA;EAGU;EAAV,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAMP;EAHvB,YAAA;EANA;EASA,cAAA,GAAiB,MAAA;AAAA;;KAIb,oBAAA,GAAuB,IAAA,CAC3B,MAAA,CAAO,wBAAA;EAXuB,sCAe9B,QAAA,EAAU,eAAA,EATV;EAYA,OAAA,EAAS,cAAA,EAZc;EAevB,WAAA,EAAa,kBAAA,EAXT;EAcJ,OAAA,EAAS,cAAA;EAGT,YAAA,EAAc,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;;;;;;;;cAqBT,aAAA,SAAsB,MAAA,CAAO,iBAAA;cAExC,IAAA,UACA,IAAA,EAAM,iBAAA,EACN,IAAA,EAAM,oBAAA;AAAA"}

package/dist/railway/deploy.mjs

@@ -17,26 +17,24 @@ const LOCK_DIR = "/tmp/.railway-upload-lock";
 * ```typescript
 * new RailwayDeploy("api-deploy", {
 *   directory: monorepoRoot,
-*   sourceHash,
-*   env: { DATABASE_URL: dbUrl },
-* }, { provider, project, environment, service });
+*   triggers: [sourceHash],
+* }, { provider, project, environment, service, projectToken: stagingToken.token });
 * ```
 */
 var RailwayDeploy = class extends pulumi.ComponentResource {
 	constructor(name, args, opts) {
-		const { provider, project, environment, service, ...pulumiOpts } = opts;
+		const { provider, project, environment, service, projectToken, ...pulumiOpts } = opts;
 		super("infracraft:railway:Deploy", name, {}, pulumiOpts);
 		const ignorePatterns = (args.excludePaths ?? []).map((dir) => {
 			if (dir.startsWith("apps/")) return `${dir}/**\\n!${dir}/package.json`;
 			return dir;
 		}).join("\\n");
 		const setupLines = [ignorePatterns ? `printf '${ignorePatterns}\\n' > .railwayignore` : "", args.railpackConfig ? `printf '${JSON.stringify(args.railpackConfig).replace(/'/g, "\\'")}' > railpack.json` : ""].filter(Boolean).join("; ");
-		const deployCmd = pulumi.interpolate`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ${setupLines}; { sleep 5; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; } & railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; wait; exit $EXIT`;
+		const deployCmd = pulumi.interpolate`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ${setupLines}; { sleep 5; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; } & RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; wait; exit $EXIT`;
 		new command.local.Command(`${name}-deploy`, {
 			create: deployCmd,
 			triggers: args.triggers,
-			dir: stableDir(args.directory),
-			environment: { RAILWAY_TOKEN: project.projectToken }
+			dir: stableDir(args.directory)
 		}, { parent: this });
 		this.registerOutputs({});
 	}

package/dist/railway/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { stableDir } from \"../stable-dir\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\n/** Build and deploy configuration for a Railway service. */\nexport interface RailwayDeployConfig {\n\t/** Build system to use when building the service. */\n\tbuilder?: RailwayBuilder;\n\n\t/** Shell command executed to start the service at runtime. */\n\tstartCommand?: string;\n\n\t/** Shell command executed before the main deploy (e.g. migrations). */\n\tpreDeployCommand?: string;\n}\n\n/** Args for RailwayDeploy. */\nexport interface RailwayDeployArgs {\n\t/**\n\t * Absolute path to the monorepo root (working directory for `railway up`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tdirectory: string;\n\n\t/** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\n\t/** Directories to exclude via `.railwayignore`. */\n\texcludePaths?: string[];\n\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\n/** Options type for RailwayDeploy — replaces Pulumi's native `provider` field. */\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\t/** Railway authentication context. */\n\tprovider: RailwayProvider;\n\n\t/** Railway project context. */\n\tproject: RailwayProject;\n\n\t/** Railway environment context. */\n\tenvironment: RailwayEnvironment;\n\n\t/** Railway service context. */\n\tservice: RailwayService;\n};\n\nconst LOCK_DIR = \"/tmp/.railway-upload-lock\";\n\n/**\n * Deploys a Railway service and waits for the build to complete.\n *\n * Uses `railway up --ci` which blocks until the build finishes.\n * Multiple deploys run in parallel — a mkdir lock serializes only the\n * brief upload phase (~5s) when `.railwayignore` must be consistent,\n * then releases so builds stream concurrently.\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"api-deploy\", {\n *   directory: monorepoRoot,\n *   sourceHash,\n *   env: { DATABASE_URL: dbUrl },\n * }, { provider, project, environment, service });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst { provider, project, environment, service, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst ignorePatterns = (args.excludePaths ?? [])\n\t\t\t.map((dir) => {\n\t\t\t\tif (dir.startsWith(\"apps/\")) {\n\t\t\t\t\treturn `${dir}/**\\\\n!${dir}/package.json`;\n\t\t\t\t}\n\n\t\t\t\treturn dir;\n\t\t\t})\n\t\t\t.join(\"\\\\n\");\n\n\t\tconst writeIgnore = ignorePatterns\n\t\t\t? `printf '${ignorePatterns}\\\\n' > .railwayignore`\n\t\t\t: \"\";\n\n\t\tconst writeRailpack = args.railpackConfig\n\t\t\t? `printf '${JSON.stringify(args.railpackConfig).replace(/'/g, \"\\\\'\")}' > railpack.json`\n\t\t\t: \"\";\n\n\t\tconst setupLines = [writeIgnore, writeRailpack].filter(Boolean).join(\"; \");\n\n\t\tconst deployCmd = pulumi.interpolate`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ${setupLines}; { sleep 5; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; } & railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; wait; exit $EXIT`;\n\n\t\tnew command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: deployCmd,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\tdir: stableDir(args.directory),\n\t\t\t\tenvironment: {\n\t\t\t\t\tRAILWAY_TOKEN: project.projectToken,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;AAyDA,MAAM,WAAW;;;;;;;;;;;;;;;;;;AAmBjB,IAAa,gBAAb,cAAmC,OAAO,kBAAkB;CAC3D,YACC,MACA,MACA,MACC;EACD,MAAM,EAAE,UAAU,SAAS,aAAa,SAAS,GAAG,eAAe;EAEnE,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAEvD,MAAM,kBAAkB,KAAK,gBAAgB,CAAC,GAC5C,KAAK,QAAQ;GACb,IAAI,IAAI,WAAW,OAAO,GACzB,OAAO,GAAG,IAAI,SAAS,IAAI;GAG5B,OAAO;EACR,CAAC,EACA,KAAK,KAAK;EAUZ,MAAM,aAAa,CARC,iBACjB,WAAW,eAAe,yBAC1B,IAEmB,KAAK,iBACxB,WAAW,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,KAAK,EAAE,qBACpE,EAE2C,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;EAEzE,MAAM,YAAY,OAAO,WAAW,iBAAiB,SAAS,kCAAkC,WAAW,yDAAyD,SAAS,8CAA8C,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,uDAAuD,SAAS;EAE9V,IAAI,QAAQ,MAAM,QACjB,GAAG,KAAK,UACR;GACC,QAAQ;GACR,UAAU,KAAK;GACf,KAAK,UAAU,KAAK,SAAS;GAC7B,aAAa,EACZ,eAAe,QAAQ,aACxB;EACD,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/railway/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { stableDir } from \"../stable-dir\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\nimport { RailwayBuilder, type RailwayService } from \"./service\";\n\n/** Build and deploy configuration for a Railway service. */\nexport interface RailwayDeployConfig {\n\t/** Build system to use when building the service. */\n\tbuilder?: RailwayBuilder;\n\n\t/** Shell command executed to start the service at runtime. */\n\tstartCommand?: string;\n\n\t/** Shell command executed before the main deploy (e.g. migrations). */\n\tpreDeployCommand?: string;\n}\n\n/** Args for RailwayDeploy. */\nexport interface RailwayDeployArgs {\n\t/**\n\t * Absolute path to the monorepo root (working directory for `railway up`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tdirectory: string;\n\n\t/** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\n\t/** Directories to exclude via `.railwayignore`. */\n\texcludePaths?: string[];\n\n\t/** Railpack configuration written to `railpack.json` before deploy. */\n\trailpackConfig?: Record<string, unknown>;\n}\n\n/** Options type for RailwayDeploy — replaces Pulumi's native `provider` field. */\ntype RailwayDeployOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\t/** Railway authentication context. */\n\tprovider: RailwayProvider;\n\n\t/** Railway project context. */\n\tproject: RailwayProject;\n\n\t/** Railway environment context. */\n\tenvironment: RailwayEnvironment;\n\n\t/** Railway service context. */\n\tservice: RailwayService;\n\n\t/** Environment-scoped Railway deploy token. Provision via {@link RailwayProjectToken}. */\n\tprojectToken: pulumi.Input<string>;\n};\n\nconst LOCK_DIR = \"/tmp/.railway-upload-lock\";\n\n/**\n * Deploys a Railway service and waits for the build to complete.\n *\n * Uses `railway up --ci` which blocks until the build finishes.\n * Multiple deploys run in parallel — a mkdir lock serializes only the\n * brief upload phase (~5s) when `.railwayignore` must be consistent,\n * then releases so builds stream concurrently.\n *\n * @example\n * ```typescript\n * new RailwayDeploy(\"api-deploy\", {\n *   directory: monorepoRoot,\n *   triggers: [sourceHash],\n * }, { provider, project, environment, service, projectToken: stagingToken.token });\n * ```\n */\nexport class RailwayDeploy extends pulumi.ComponentResource {\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayDeployArgs,\n\t\topts: RailwayDeployOptions,\n\t) {\n\t\tconst {\n\t\t\tprovider,\n\t\t\tproject,\n\t\t\tenvironment,\n\t\t\tservice,\n\t\t\tprojectToken,\n\t\t\t...pulumiOpts\n\t\t} = opts;\n\n\t\tsuper(\"infracraft:railway:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst ignorePatterns = (args.excludePaths ?? [])\n\t\t\t.map((dir) => {\n\t\t\t\tif (dir.startsWith(\"apps/\")) {\n\t\t\t\t\treturn `${dir}/**\\\\n!${dir}/package.json`;\n\t\t\t\t}\n\n\t\t\t\treturn dir;\n\t\t\t})\n\t\t\t.join(\"\\\\n\");\n\n\t\tconst writeIgnore = ignorePatterns\n\t\t\t? `printf '${ignorePatterns}\\\\n' > .railwayignore`\n\t\t\t: \"\";\n\n\t\tconst writeRailpack = args.railpackConfig\n\t\t\t? `printf '${JSON.stringify(args.railpackConfig).replace(/'/g, \"\\\\'\")}' > railpack.json`\n\t\t\t: \"\";\n\n\t\tconst setupLines = [writeIgnore, writeRailpack].filter(Boolean).join(\"; \");\n\n\t\t// The deploy token is inlined into the create command (RAILWAY_TOKEN=… railway up) rather\n\t\t// than passed via command.local.Command's `environment` map. The token is auto-minted (a\n\t\t// RailwayProjectToken), so it is an UNKNOWN secret at preview time, and an unknown secret in\n\t\t// the `environment` map makes `pulumi preview` fail (\"malformed RPC secret: missing value\").\n\t\t// Inlining keeps the token secret in state while letting preview serialize cleanly.\n\t\tconst deployCmd = pulumi.interpolate`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ${setupLines}; { sleep 5; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; } & RAILWAY_TOKEN=${projectToken} railway up --ci --project ${project.id} --service ${service.id} --environment ${environment.id}; EXIT=$?; rm -f .railwayignore railpack.json; rmdir ${LOCK_DIR} 2>/dev/null; wait; exit $EXIT`;\n\n\t\tnew command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: deployCmd,\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\tdir: stableDir(args.directory),\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.registerOutputs({});\n\t}\n}\n"],"mappings":";;;;;;AA4DA,MAAM,WAAW;;;;;;;;;;;;;;;;;AAkBjB,IAAa,gBAAb,cAAmC,OAAO,kBAAkB;CAC3D,YACC,MACA,MACA,MACC;EACD,MAAM,EACL,UACA,SACA,aACA,SACA,cACA,GAAG,eACA;EAEJ,MAAM,6BAA6B,MAAM,CAAC,GAAG,UAAU;EAEvD,MAAM,kBAAkB,KAAK,gBAAgB,CAAC,GAC5C,KAAK,QAAQ;GACb,IAAI,IAAI,WAAW,OAAO,GACzB,OAAO,GAAG,IAAI,SAAS,IAAI;GAG5B,OAAO;EACR,CAAC,EACA,KAAK,KAAK;EAUZ,MAAM,aAAa,CARC,iBACjB,WAAW,eAAe,yBAC1B,IAEmB,KAAK,iBACxB,WAAW,KAAK,UAAU,KAAK,cAAc,EAAE,QAAQ,MAAM,KAAK,EAAE,qBACpE,EAE2C,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;EAOzE,MAAM,YAAY,OAAO,WAAW,iBAAiB,SAAS,kCAAkC,WAAW,yDAAyD,SAAS,kCAAkC,aAAa,6BAA6B,QAAQ,GAAG,aAAa,QAAQ,GAAG,iBAAiB,YAAY,GAAG,uDAAuD,SAAS;EAE5X,IAAI,QAAQ,MAAM,QACjB,GAAG,KAAK,UACR;GACC,QAAQ;GACR,UAAU,KAAK;GACf,KAAK,UAAU,KAAK,SAAS;EAC9B,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,gBAAgB,CAAC,CAAC;CACxB;AACD"}

package/dist/railway/index.cjs

@@ -4,6 +4,7 @@ const require_railway_deploy = require('./deploy.cjs');
 const require_railway_domain = require('./domain.cjs');
 const require_railway_environment = require('./environment.cjs');
 const require_railway_project = require('./project.cjs');
+const require_railway_project_token = require('./project-token.cjs');
 const require_railway_provider = require('./provider.cjs');
 const require_railway_service = require('./service.cjs');
 const require_railway_variable = require('./variable.cjs');
@@ -15,6 +16,7 @@ exports.RailwayDeploy = require_railway_deploy.RailwayDeploy;
 exports.RailwayDomain = require_railway_domain.RailwayDomain;
 exports.RailwayEnvironment = require_railway_environment.RailwayEnvironment;
 exports.RailwayProject = require_railway_project.RailwayProject;
+exports.RailwayProjectToken = require_railway_project_token.RailwayProjectToken;
 exports.RailwayProvider = require_railway_provider.RailwayProvider;
 exports.RailwayRestartPolicy = require_railway_service.RailwayRestartPolicy;
 exports.RailwayService = require_railway_service.RailwayService;

package/dist/railway/index.d.cts

@@ -5,6 +5,7 @@ import { RailwayEnvironment, RailwayEnvironmentArgs } from "./environment.cjs";
 import { RailwayBuilder, RailwayRestartPolicy, RailwayService, RailwayServiceArgs } from "./service.cjs";
 import { RailwayDeploy, RailwayDeployArgs, RailwayDeployConfig } from "./deploy.cjs";
 import { RailwayDomain, RailwayDomainArgs } from "./domain.cjs";
+import { RailwayProjectToken, RailwayProjectTokenArgs } from "./project-token.cjs";
 import { RailwayVariable, RailwayVariableArgs } from "./variable.cjs";
 import { RailwayVolume, RailwayVolumeArgs } from "./volume.cjs";
-export { RailwayBuilder, RailwayClient, RailwayDeploy, type RailwayDeployArgs, type RailwayDeployConfig, RailwayDomain, type RailwayDomainArgs, RailwayEnvironment, type RailwayEnvironmentArgs, RailwayProject, type RailwayProjectArgs, RailwayProvider, type RailwayProviderArgs, RailwayRestartPolicy, RailwayService, type RailwayServiceArgs, RailwayVariable, type RailwayVariableArgs, RailwayVolume, type RailwayVolumeArgs };
+export { RailwayBuilder, RailwayClient, RailwayDeploy, type RailwayDeployArgs, type RailwayDeployConfig, RailwayDomain, type RailwayDomainArgs, RailwayEnvironment, type RailwayEnvironmentArgs, RailwayProject, type RailwayProjectArgs, RailwayProjectToken, type RailwayProjectTokenArgs, RailwayProvider, type RailwayProviderArgs, RailwayRestartPolicy, RailwayService, type RailwayServiceArgs, RailwayVariable, type RailwayVariableArgs, RailwayVolume, type RailwayVolumeArgs };

package/dist/railway/index.d.mts

@@ -5,6 +5,7 @@ import { RailwayEnvironment, RailwayEnvironmentArgs } from "./environment.mjs";
 import { RailwayBuilder, RailwayRestartPolicy, RailwayService, RailwayServiceArgs } from "./service.mjs";
 import { RailwayDeploy, RailwayDeployArgs, RailwayDeployConfig } from "./deploy.mjs";
 import { RailwayDomain, RailwayDomainArgs } from "./domain.mjs";
+import { RailwayProjectToken, RailwayProjectTokenArgs } from "./project-token.mjs";
 import { RailwayVariable, RailwayVariableArgs } from "./variable.mjs";
 import { RailwayVolume, RailwayVolumeArgs } from "./volume.mjs";
-export { RailwayBuilder, RailwayClient, RailwayDeploy, type RailwayDeployArgs, type RailwayDeployConfig, RailwayDomain, type RailwayDomainArgs, RailwayEnvironment, type RailwayEnvironmentArgs, RailwayProject, type RailwayProjectArgs, RailwayProvider, type RailwayProviderArgs, RailwayRestartPolicy, RailwayService, type RailwayServiceArgs, RailwayVariable, type RailwayVariableArgs, RailwayVolume, type RailwayVolumeArgs };
+export { RailwayBuilder, RailwayClient, RailwayDeploy, type RailwayDeployArgs, type RailwayDeployConfig, RailwayDomain, type RailwayDomainArgs, RailwayEnvironment, type RailwayEnvironmentArgs, RailwayProject, type RailwayProjectArgs, RailwayProjectToken, type RailwayProjectTokenArgs, RailwayProvider, type RailwayProviderArgs, RailwayRestartPolicy, RailwayService, type RailwayServiceArgs, RailwayVariable, type RailwayVariableArgs, RailwayVolume, type RailwayVolumeArgs };

package/dist/railway/index.mjs

@@ -3,9 +3,10 @@ import { RailwayDeploy } from "./deploy.mjs";
 import { RailwayDomain } from "./domain.mjs";
 import { RailwayEnvironment } from "./environment.mjs";
 import { RailwayProject } from "./project.mjs";
+import { RailwayProjectToken } from "./project-token.mjs";
 import { RailwayProvider } from "./provider.mjs";
 import { RailwayBuilder, RailwayRestartPolicy, RailwayService } from "./service.mjs";
 import { RailwayVariable } from "./variable.mjs";
 import { RailwayVolume } from "./volume.mjs";
 
-export { RailwayBuilder, RailwayClient, RailwayDeploy, RailwayDomain, RailwayEnvironment, RailwayProject, RailwayProvider, RailwayRestartPolicy, RailwayService, RailwayVariable, RailwayVolume };
+export { RailwayBuilder, RailwayClient, RailwayDeploy, RailwayDomain, RailwayEnvironment, RailwayProject, RailwayProjectToken, RailwayProvider, RailwayRestartPolicy, RailwayService, RailwayVariable, RailwayVolume };

package/dist/railway/project-token.cjs

@@ -0,0 +1,153 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../chunk-BVYJZCqc.cjs');
+const require_railway_client = require('./client.cjs');
+let _pulumi_pulumi = require("@pulumi/pulumi");
+_pulumi_pulumi = require_chunk.__toESM(_pulumi_pulumi, 1);
+
+//#region src/railway/project-token.ts
+const PROJECT_TOKENS_QUERY = `
+  query($projectId: String!) {
+    projectTokens(projectId: $projectId) {
+      edges { node { id name } }
+    }
+  }
+`;
+const PROJECT_TOKEN_CREATE = `
+  mutation($input: ProjectTokenCreateInput!) {
+    projectTokenCreate(input: $input)
+  }
+`;
+const PROJECT_TOKEN_DELETE = `
+  mutation($id: String!) { projectTokenDelete(id: $id) }
+`;
+/**
+* Dynamic provider that mints a Railway environment-scoped deploy token.
+*
+* On create, it deletes any existing tokens with the same name (stale tokens
+* from previous runs), mints a fresh one scoped to the target environment, then
+* re-lists tokens to capture the Railway-assigned ID for later teardown.
+*
+* @internal Exported only for unit testing; not part of the public API surface.
+*/
+var RailwayProjectTokenResourceProvider = class {
+	/**
+	* Deletes stale same-named tokens, mints a new environment-scoped token,
+	* and captures its ID via a follow-up list query.
+	*
+	* @param inputs Resolved provider inputs.
+	* @returns Pulumi dynamic create result with `value` (secret) and `tokenId`.
+	*/
+	async create(inputs) {
+		const client = new require_railway_client.RailwayClient(inputs.token);
+		const stale = (await client.query(PROJECT_TOKENS_QUERY, { projectId: inputs.projectId })).projectTokens.edges.filter((edge) => edge.node.name === inputs.name);
+		for (const entry of stale) await client.query(PROJECT_TOKEN_DELETE, { id: entry.node.id });
+		const value = (await client.query(PROJECT_TOKEN_CREATE, { input: {
+			projectId: inputs.projectId,
+			environmentId: inputs.environmentId,
+			name: inputs.name
+		} })).projectTokenCreate;
+		const found = (await client.query(PROJECT_TOKENS_QUERY, { projectId: inputs.projectId })).projectTokens.edges.find((edge) => edge.node.name === inputs.name);
+		if (!found) throw new Error(`Could not resolve token id for newly created token "${inputs.name}" in project ${inputs.projectId}`);
+		const tokenId = found.node.id;
+		const outs = {
+			...inputs,
+			value,
+			tokenId
+		};
+		return {
+			id: `${inputs.projectId}:${inputs.name}`,
+			outs
+		};
+	}
+	/**
+	* Pass-through read — the token value is a write-once secret that Railway
+	* never re-exposes via API, so the stored state is the only source of truth.
+	*
+	* @param id Resource ID.
+	* @param props Currently stored outputs.
+	*/
+	async read(id, props) {
+		return {
+			id,
+			props
+		};
+	}
+	/**
+	* Deletes the Railway token by its stored UUID for clean teardown.
+	*
+	* @param _id Resource ID (unused).
+	* @param props Currently stored outputs containing the tokenId.
+	*/
+	async delete(_id, props) {
+		if (props.tokenId) await new require_railway_client.RailwayClient(props.token).query(PROJECT_TOKEN_DELETE, { id: props.tokenId });
+	}
+	/**
+	* Triggers replacement when the project, environment, or token name changes.
+	*
+	* @param _id Resource ID (unused).
+	* @param olds Previously stored outputs.
+	* @param news Newly resolved inputs.
+	*/
+	async diff(_id, olds, news) {
+		const replaces = [];
+		if (olds.projectId !== news.projectId) replaces.push("projectId");
+		if (olds.environmentId !== news.environmentId) replaces.push("environmentId");
+		if (olds.name !== news.name) replaces.push("name");
+		return {
+			changes: replaces.length > 0,
+			replaces,
+			deleteBeforeReplace: true
+		};
+	}
+};
+/** Internal dynamic resource — not part of the public API. */
+var RailwayProjectTokenResource = class extends _pulumi_pulumi.dynamic.Resource {
+	constructor(name, args, opts) {
+		super(new RailwayProjectTokenResourceProvider(), name, {
+			...args,
+			value: _pulumi_pulumi.secret(void 0),
+			tokenId: void 0
+		}, opts);
+	}
+};
+/**
+* Provisions an environment-scoped Railway deploy token.
+*
+* Each environment gets its own correctly-scoped token with a distinct name,
+* so multiple stacks sharing the same Railway project never collide.
+* The token value is exposed as a secret output for use in {@link RailwayDeploy}.
+*
+* @example
+* ```typescript
+* const project = new RailwayProject("my-project", { name: "my-app" }, { provider });
+* const staging = new RailwayEnvironment("staging", { name: "staging" }, { provider, project });
+*
+* const stagingToken = new RailwayProjectToken("staging-token", {
+*   name: "pulumi-staging",
+* }, { provider, project, environment: staging });
+*
+* new RailwayDeploy("api-deploy", {
+*   directory: monorepoRoot,
+*   triggers: [sourceHash],
+* }, { provider, project, environment: staging, service, projectToken: stagingToken.token });
+* ```
+*/
+var RailwayProjectToken = class extends _pulumi_pulumi.ComponentResource {
+	constructor(name, args, opts) {
+		const { provider, project, environment, ...pulumiOpts } = opts;
+		super("infracraft:railway:ProjectToken", name, {}, pulumiOpts);
+		const resource = new RailwayProjectTokenResource(`${name}-resource`, {
+			token: provider.token,
+			projectId: project.id,
+			environmentId: environment.id,
+			name: args.name
+		}, { parent: this });
+		this.token = resource.value;
+		this.registerOutputs({ token: this.token });
+	}
+};
+
+//#endregion
+exports.RailwayProjectToken = RailwayProjectToken;
+exports.RailwayProjectTokenResourceProvider = RailwayProjectTokenResourceProvider;
+//# sourceMappingURL=project-token.cjs.map

package/dist/railway/project-token.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-token.cjs","names":["RailwayClient","pulumi"],"sources":["../../src/railway/project-token.ts"],"sourcesContent":["import * as pulumi from \"@pulumi/pulumi\";\nimport { RailwayClient } from \"./client\";\nimport type { RailwayEnvironment } from \"./environment\";\nimport type { RailwayProject } from \"./project\";\nimport type { RailwayProvider } from \"./provider\";\n\n/** Resolved inputs for the Railway project token dynamic provider. */\ninterface RailwayProjectTokenInputs {\n\t/** Railway API bearer token (account-scoped, used for API calls). */\n\ttoken: string;\n\n\t/** Railway project UUID. */\n\tprojectId: string;\n\n\t/** Railway environment UUID this deploy token is scoped to. */\n\tenvironmentId: string;\n\n\t/** Distinct token name, e.g. `\"pulumi-staging\"`. Must be unique per environment. */\n\tname: string;\n}\n\n/** Persisted state for the Railway project token. */\ninterface RailwayProjectTokenOutputs extends RailwayProjectTokenInputs {\n\t/** Minted deploy token secret value. */\n\tvalue: string;\n\n\t/** Railway-assigned token UUID (used for clean teardown on delete). */\n\ttokenId: string;\n}\n\nconst PROJECT_TOKENS_QUERY = `\n  query($projectId: String!) {\n    projectTokens(projectId: $projectId) {\n      edges { node { id name } }\n    }\n  }\n`;\n\nconst PROJECT_TOKEN_CREATE = `\n  mutation($input: ProjectTokenCreateInput!) {\n    projectTokenCreate(input: $input)\n  }\n`;\n\nconst PROJECT_TOKEN_DELETE = `\n  mutation($id: String!) { projectTokenDelete(id: $id) }\n`;\n\n/**\n * Dynamic provider that mints a Railway environment-scoped deploy token.\n *\n * On create, it deletes any existing tokens with the same name (stale tokens\n * from previous runs), mints a fresh one scoped to the target environment, then\n * re-lists tokens to capture the Railway-assigned ID for later teardown.\n *\n * @internal Exported only for unit testing; not part of the public API surface.\n */\nexport class RailwayProjectTokenResourceProvider\n\timplements pulumi.dynamic.ResourceProvider\n{\n\t/**\n\t * Deletes stale same-named tokens, mints a new environment-scoped token,\n\t * and captures its ID via a follow-up list query.\n\t *\n\t * @param inputs Resolved provider inputs.\n\t * @returns Pulumi dynamic create result with `value` (secret) and `tokenId`.\n\t */\n\tasync create(\n\t\tinputs: RailwayProjectTokenInputs,\n\t): Promise<pulumi.dynamic.CreateResult> {\n\t\tconst client = new RailwayClient(inputs.token);\n\n\t\tconst tokensResult = await client.query<{\n\t\t\tprojectTokens: {\n\t\t\t\tedges: Array<{ node: { id: string; name: string } }>;\n\t\t\t};\n\t\t}>(PROJECT_TOKENS_QUERY, { projectId: inputs.projectId });\n\n\t\tconst stale = tokensResult.projectTokens.edges.filter(\n\t\t\t(edge) => edge.node.name === inputs.name,\n\t\t);\n\n\t\tfor (const entry of stale) {\n\t\t\tawait client.query(PROJECT_TOKEN_DELETE, { id: entry.node.id });\n\t\t}\n\n\t\tconst createResult = await client.query<{ projectTokenCreate: string }>(\n\t\t\tPROJECT_TOKEN_CREATE,\n\t\t\t{\n\t\t\t\tinput: {\n\t\t\t\t\tprojectId: inputs.projectId,\n\t\t\t\t\tenvironmentId: inputs.environmentId,\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\n\t\tconst value = createResult.projectTokenCreate;\n\n\t\t// Re-list tokens to capture the Railway-assigned ID: the create mutation\n\t\t// returns only the token value, not its UUID.\n\t\tconst refreshResult = await client.query<{\n\t\t\tprojectTokens: {\n\t\t\t\tedges: Array<{ node: { id: string; name: string } }>;\n\t\t\t};\n\t\t}>(PROJECT_TOKENS_QUERY, { projectId: inputs.projectId });\n\n\t\t// After the delete sweep above, exactly one token with this name exists (the one we just\n\t\t// created). Resolve its id from the re-list so delete() can revoke it later.\n\t\tconst found = refreshResult.projectTokens.edges.find(\n\t\t\t(edge) => edge.node.name === inputs.name,\n\t\t);\n\n\t\tif (!found) {\n\t\t\tthrow new Error(\n\t\t\t\t`Could not resolve token id for newly created token \"${inputs.name}\" in project ${inputs.projectId}`,\n\t\t\t);\n\t\t}\n\n\t\tconst tokenId = found.node.id;\n\n\t\tconst outs: RailwayProjectTokenOutputs = {\n\t\t\t...inputs,\n\t\t\tvalue,\n\t\t\ttokenId,\n\t\t};\n\n\t\treturn { id: `${inputs.projectId}:${inputs.name}`, outs };\n\t}\n\n\t/**\n\t * Pass-through read — the token value is a write-once secret that Railway\n\t * never re-exposes via API, so the stored state is the only source of truth.\n\t *\n\t * @param id Resource ID.\n\t * @param props Currently stored outputs.\n\t */\n\tasync read(\n\t\tid: string,\n\t\tprops: RailwayProjectTokenOutputs,\n\t): Promise<pulumi.dynamic.ReadResult> {\n\t\treturn { id, props };\n\t}\n\n\t/**\n\t * Deletes the Railway token by its stored UUID for clean teardown.\n\t *\n\t * @param _id Resource ID (unused).\n\t * @param props Currently stored outputs containing the tokenId.\n\t */\n\tasync delete(_id: string, props: RailwayProjectTokenOutputs): Promise<void> {\n\t\tif (props.tokenId) {\n\t\t\tconst client = new RailwayClient(props.token);\n\n\t\t\tawait client.query(PROJECT_TOKEN_DELETE, { id: props.tokenId });\n\t\t}\n\t}\n\n\t/**\n\t * Triggers replacement when the project, environment, or token name changes.\n\t *\n\t * @param _id Resource ID (unused).\n\t * @param olds Previously stored outputs.\n\t * @param news Newly resolved inputs.\n\t */\n\tasync diff(\n\t\t_id: string,\n\t\tolds: RailwayProjectTokenOutputs,\n\t\tnews: RailwayProjectTokenInputs,\n\t): Promise<pulumi.dynamic.DiffResult> {\n\t\tconst replaces: string[] = [];\n\n\t\tif (olds.projectId !== news.projectId) {\n\t\t\treplaces.push(\"projectId\");\n\t\t}\n\n\t\tif (olds.environmentId !== news.environmentId) {\n\t\t\treplaces.push(\"environmentId\");\n\t\t}\n\n\t\tif (olds.name !== news.name) {\n\t\t\treplaces.push(\"name\");\n\t\t}\n\n\t\treturn {\n\t\t\tchanges: replaces.length > 0,\n\t\t\treplaces,\n\t\t\tdeleteBeforeReplace: true,\n\t\t};\n\t}\n}\n\n/** Internal dynamic resource — not part of the public API. */\nclass RailwayProjectTokenResource extends pulumi.dynamic.Resource {\n\tpublic declare readonly value: pulumi.Output<string>;\n\tpublic declare readonly tokenId: pulumi.Output<string>;\n\n\tconstructor(\n\t\tname: string,\n\t\targs: {\n\t\t\ttoken: pulumi.Input<string>;\n\t\t\tprojectId: pulumi.Input<string>;\n\t\t\tenvironmentId: pulumi.Input<string>;\n\t\t\tname: pulumi.Input<string>;\n\t\t},\n\t\topts?: pulumi.CustomResourceOptions,\n\t) {\n\t\tsuper(\n\t\t\tnew RailwayProjectTokenResourceProvider(),\n\t\t\tname,\n\t\t\t{\n\t\t\t\t...args,\n\t\t\t\tvalue: pulumi.secret(undefined as unknown as string),\n\t\t\t\ttokenId: undefined,\n\t\t\t},\n\t\t\topts,\n\t\t);\n\t}\n}\n\n/** Options type for RailwayProjectToken — replaces Pulumi's native `provider` field. */\ntype RailwayProjectTokenOptions = Omit<\n\tpulumi.ComponentResourceOptions,\n\t\"provider\"\n> & {\n\t/** Railway authentication context. */\n\tprovider: RailwayProvider;\n\n\t/** Railway project this token belongs to. */\n\tproject: RailwayProject;\n\n\t/** Railway environment this deploy token is scoped to. */\n\tenvironment: RailwayEnvironment;\n};\n\n/** Args for RailwayProjectToken. */\nexport interface RailwayProjectTokenArgs {\n\t/**\n\t * Distinct token name, e.g. `\"pulumi-staging\"`.\n\t * Each environment should use a unique name so multiple stacks sharing\n\t * a project never collide on token ownership.\n\t */\n\tname: pulumi.Input<string>;\n}\n\n/**\n * Provisions an environment-scoped Railway deploy token.\n *\n * Each environment gets its own correctly-scoped token with a distinct name,\n * so multiple stacks sharing the same Railway project never collide.\n * The token value is exposed as a secret output for use in {@link RailwayDeploy}.\n *\n * @example\n * ```typescript\n * const project = new RailwayProject(\"my-project\", { name: \"my-app\" }, { provider });\n * const staging = new RailwayEnvironment(\"staging\", { name: \"staging\" }, { provider, project });\n *\n * const stagingToken = new RailwayProjectToken(\"staging-token\", {\n *   name: \"pulumi-staging\",\n * }, { provider, project, environment: staging });\n *\n * new RailwayDeploy(\"api-deploy\", {\n *   directory: monorepoRoot,\n *   triggers: [sourceHash],\n * }, { provider, project, environment: staging, service, projectToken: stagingToken.token });\n * ```\n */\nexport class RailwayProjectToken extends pulumi.ComponentResource {\n\t/**\n\t * Environment-scoped Railway deploy token value (secret).\n\t * Pass this to `RailwayDeployOptions.projectToken`.\n\t */\n\tpublic readonly token: pulumi.Output<string>;\n\n\tconstructor(\n\t\tname: string,\n\t\targs: RailwayProjectTokenArgs,\n\t\topts: RailwayProjectTokenOptions,\n\t) {\n\t\tconst { provider, project, environment, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:railway:ProjectToken\", name, {}, pulumiOpts);\n\n\t\tconst resource = new RailwayProjectTokenResource(\n\t\t\t`${name}-resource`,\n\t\t\t{\n\t\t\t\ttoken: provider.token,\n\t\t\t\tprojectId: project.id,\n\t\t\t\tenvironmentId: environment.id,\n\t\t\t\tname: args.name,\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.token = resource.value;\n\n\t\tthis.registerOutputs({ token: this.token });\n\t}\n}\n"],"mappings":";;;;;;;AA8BA,MAAM,uBAAuB;;;;;;;AAQ7B,MAAM,uBAAuB;;;;;AAM7B,MAAM,uBAAuB;;;;;;;;;;;;AAa7B,IAAa,sCAAb,MAEA;;;;;;;;CAQC,MAAM,OACL,QACuC;EACvC,MAAM,SAAS,IAAIA,qCAAc,OAAO,KAAK;EAQ7C,MAAM,SAAQ,MANa,OAAO,MAI/B,sBAAsB,EAAE,WAAW,OAAO,UAAU,CAAC,GAE7B,cAAc,MAAM,QAC7C,SAAS,KAAK,KAAK,SAAS,OAAO,IACrC;EAEA,KAAK,MAAM,SAAS,OACnB,MAAM,OAAO,MAAM,sBAAsB,EAAE,IAAI,MAAM,KAAK,GAAG,CAAC;EAc/D,MAAM,SAAQ,MAXa,OAAO,MACjC,sBACA,EACC,OAAO;GACN,WAAW,OAAO;GAClB,eAAe,OAAO;GACtB,MAAM,OAAO;EACd,EACD,CACD,GAE2B;EAY3B,MAAM,SAAQ,MARc,OAAO,MAIhC,sBAAsB,EAAE,WAAW,OAAO,UAAU,CAAC,GAI5B,cAAc,MAAM,MAC9C,SAAS,KAAK,KAAK,SAAS,OAAO,IACrC;EAEA,IAAI,CAAC,OACJ,MAAM,IAAI,MACT,uDAAuD,OAAO,KAAK,eAAe,OAAO,WAC1F;EAGD,MAAM,UAAU,MAAM,KAAK;EAE3B,MAAM,OAAmC;GACxC,GAAG;GACH;GACA;EACD;EAEA,OAAO;GAAE,IAAI,GAAG,OAAO,UAAU,GAAG,OAAO;GAAQ;EAAK;CACzD;;;;;;;;CASA,MAAM,KACL,IACA,OACqC;EACrC,OAAO;GAAE;GAAI;EAAM;CACpB;;;;;;;CAQA,MAAM,OAAO,KAAa,OAAkD;EAC3E,IAAI,MAAM,SAGT,MAAM,IAFaA,qCAAc,MAAM,KAE5B,EAAE,MAAM,sBAAsB,EAAE,IAAI,MAAM,QAAQ,CAAC;CAEhE;;;;;;;;CASA,MAAM,KACL,KACA,MACA,MACqC;EACrC,MAAM,WAAqB,CAAC;EAE5B,IAAI,KAAK,cAAc,KAAK,WAC3B,SAAS,KAAK,WAAW;EAG1B,IAAI,KAAK,kBAAkB,KAAK,eAC/B,SAAS,KAAK,eAAe;EAG9B,IAAI,KAAK,SAAS,KAAK,MACtB,SAAS,KAAK,MAAM;EAGrB,OAAO;GACN,SAAS,SAAS,SAAS;GAC3B;GACA,qBAAqB;EACtB;CACD;AACD;;AAGA,IAAM,8BAAN,cAA0CC,eAAO,QAAQ,SAAS;CAIjE,YACC,MACA,MAMA,MACC;EACD,MACC,IAAI,oCAAoC,GACxC,MACA;GACC,GAAG;GACH,OAAOA,eAAO,OAAO,MAA8B;GACnD,SAAS;EACV,GACA,IACD;CACD;AACD;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa,sBAAb,cAAyCA,eAAO,kBAAkB;CAOjE,YACC,MACA,MACA,MACC;EACD,MAAM,EAAE,UAAU,SAAS,aAAa,GAAG,eAAe;EAE1D,MAAM,mCAAmC,MAAM,CAAC,GAAG,UAAU;EAE7D,MAAM,WAAW,IAAI,4BACpB,GAAG,KAAK,YACR;GACC,OAAO,SAAS;GAChB,WAAW,QAAQ;GACnB,eAAe,YAAY;GAC3B,MAAM,KAAK;EACZ,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,QAAQ,SAAS;EAEtB,KAAK,gBAAgB,EAAE,OAAO,KAAK,MAAM,CAAC;CAC3C;AACD"}

package/dist/railway/project-token.d.cts

@@ -0,0 +1,115 @@
+import { t as __name } from "../chunk-OPjESj5l.cjs";
+import { RailwayProvider } from "./provider.cjs";
+import { RailwayProject } from "./project.cjs";
+import { RailwayEnvironment } from "./environment.cjs";
+import * as pulumi from "@pulumi/pulumi";
+
+//#region src/railway/project-token.d.ts
+/** Resolved inputs for the Railway project token dynamic provider. */
+interface RailwayProjectTokenInputs {
+  /** Railway API bearer token (account-scoped, used for API calls). */
+  token: string;
+  /** Railway project UUID. */
+  projectId: string;
+  /** Railway environment UUID this deploy token is scoped to. */
+  environmentId: string;
+  /** Distinct token name, e.g. `"pulumi-staging"`. Must be unique per environment. */
+  name: string;
+}
+/** Persisted state for the Railway project token. */
+interface RailwayProjectTokenOutputs extends RailwayProjectTokenInputs {
+  /** Minted deploy token secret value. */
+  value: string;
+  /** Railway-assigned token UUID (used for clean teardown on delete). */
+  tokenId: string;
+}
+/**
+ * Dynamic provider that mints a Railway environment-scoped deploy token.
+ *
+ * On create, it deletes any existing tokens with the same name (stale tokens
+ * from previous runs), mints a fresh one scoped to the target environment, then
+ * re-lists tokens to capture the Railway-assigned ID for later teardown.
+ *
+ * @internal Exported only for unit testing; not part of the public API surface.
+ */
+declare class RailwayProjectTokenResourceProvider implements pulumi.dynamic.ResourceProvider {
+  /**
+   * Deletes stale same-named tokens, mints a new environment-scoped token,
+   * and captures its ID via a follow-up list query.
+   *
+   * @param inputs Resolved provider inputs.
+   * @returns Pulumi dynamic create result with `value` (secret) and `tokenId`.
+   */
+  create(inputs: RailwayProjectTokenInputs): Promise<pulumi.dynamic.CreateResult>;
+  /**
+   * Pass-through read — the token value is a write-once secret that Railway
+   * never re-exposes via API, so the stored state is the only source of truth.
+   *
+   * @param id Resource ID.
+   * @param props Currently stored outputs.
+   */
+  read(id: string, props: RailwayProjectTokenOutputs): Promise<pulumi.dynamic.ReadResult>;
+  /**
+   * Deletes the Railway token by its stored UUID for clean teardown.
+   *
+   * @param _id Resource ID (unused).
+   * @param props Currently stored outputs containing the tokenId.
+   */
+  delete(_id: string, props: RailwayProjectTokenOutputs): Promise<void>;
+  /**
+   * Triggers replacement when the project, environment, or token name changes.
+   *
+   * @param _id Resource ID (unused).
+   * @param olds Previously stored outputs.
+   * @param news Newly resolved inputs.
+   */
+  diff(_id: string, olds: RailwayProjectTokenOutputs, news: RailwayProjectTokenInputs): Promise<pulumi.dynamic.DiffResult>;
+}
+/** Options type for RailwayProjectToken — replaces Pulumi's native `provider` field. */
+type RailwayProjectTokenOptions = Omit<pulumi.ComponentResourceOptions, "provider"> & {
+  /** Railway authentication context. */provider: RailwayProvider; /** Railway project this token belongs to. */
+  project: RailwayProject; /** Railway environment this deploy token is scoped to. */
+  environment: RailwayEnvironment;
+};
+/** Args for RailwayProjectToken. */
+interface RailwayProjectTokenArgs {
+  /**
+   * Distinct token name, e.g. `"pulumi-staging"`.
+   * Each environment should use a unique name so multiple stacks sharing
+   * a project never collide on token ownership.
+   */
+  name: pulumi.Input<string>;
+}
+/**
+ * Provisions an environment-scoped Railway deploy token.
+ *
+ * Each environment gets its own correctly-scoped token with a distinct name,
+ * so multiple stacks sharing the same Railway project never collide.
+ * The token value is exposed as a secret output for use in {@link RailwayDeploy}.
+ *
+ * @example
+ * ```typescript
+ * const project = new RailwayProject("my-project", { name: "my-app" }, { provider });
+ * const staging = new RailwayEnvironment("staging", { name: "staging" }, { provider, project });
+ *
+ * const stagingToken = new RailwayProjectToken("staging-token", {
+ *   name: "pulumi-staging",
+ * }, { provider, project, environment: staging });
+ *
+ * new RailwayDeploy("api-deploy", {
+ *   directory: monorepoRoot,
+ *   triggers: [sourceHash],
+ * }, { provider, project, environment: staging, service, projectToken: stagingToken.token });
+ * ```
+ */
+declare class RailwayProjectToken extends pulumi.ComponentResource {
+  /**
+   * Environment-scoped Railway deploy token value (secret).
+   * Pass this to `RailwayDeployOptions.projectToken`.
+   */
+  readonly token: pulumi.Output<string>;
+  constructor(name: string, args: RailwayProjectTokenArgs, opts: RailwayProjectTokenOptions);
+}
+//#endregion
+export { RailwayProjectToken, RailwayProjectTokenArgs, RailwayProjectTokenResourceProvider };
+//# sourceMappingURL=project-token.d.cts.map

package/dist/railway/project-token.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-token.d.cts","names":[],"sources":["../../src/railway/project-token.ts"],"mappings":";;;;;;;;UAOU,yBAAA;;EAET,KAAA;EAFkC;EAKlC,SAAA;EALkC;EAQlC,aAAA;EAHA;EAMA,IAAA;AAAA;;UAIS,0BAAA,SAAmC,yBAAyB;EAA5D;EAET,KAAA;;EAGA,OAAA;AAAA;;;;AAAO;AA8BR;;;;;cAAa,mCAAA,YACD,MAAA,CAAO,OAAA,CAAQ,gBAAA;EAiFlB;;;;;;;EAxEF,MAAA,CACL,MAAA,EAAQ,yBAAA,GACN,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,YAAA;EAoGvB;;;;;;;EAhCG,IAAA,CACL,EAAA,UACA,KAAA,EAAO,0BAAA,GACL,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,UAAA;EAxEjB;;;;;;EAkFH,MAAA,CAAO,GAAA,UAAa,KAAA,EAAO,0BAAA,GAA6B,OAAA;EAZ7D;;;;;;;EA2BK,IAAA,CACL,GAAA,UACA,IAAA,EAAM,0BAAA,EACN,IAAA,EAAM,yBAAA,GACJ,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,UAAA;AAAA;;KAoDtB,0BAAA,GAA6B,IAAA,CACjC,MAAA,CAAO,wBAAA;EAxEuD,sCA4E9D,QAAA,EAAU,eAAA,EA5DT;EA+DD,OAAA,EAAS,cAAA,EA9DR;EAiED,WAAA,EAAa,kBAAA;AAAA;;UAIG,uBAAA;EAnEE;;;AAAkB;AAqBpC;EAoDA,IAAA,EAAM,MAAA,CAAO,KAAK;AAAA;;;;;;;;;;;;;;;;;;AAVa;AAIhC;;;;cA+Ba,mBAAA,SAA4B,MAAA,CAAO,iBAAA;EAzBzC;;;AAAY;EAAZ,SA8BU,KAAA,EAAO,MAAA,CAAO,MAAA;cAG7B,IAAA,UACA,IAAA,EAAM,uBAAA,EACN,IAAA,EAAM,0BAAA;AAAA"}