@open-mercato/cli 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.6.4-develop.4382.1.6b4f656b77",
+  "version": "0.6.4",
   "type": "module",
   "main": "./dist/index.js",
   "exports": {
@@ -55,25 +55,25 @@
     "node": "24.x"
   },
   "dependencies": {
-    "@mikro-orm/core": "^7.1.3",
-    "@mikro-orm/decorators": "^7.1.3",
-    "@mikro-orm/migrations": "^7.1.3",
-    "@mikro-orm/postgresql": "^7.1.3",
-    "@open-mercato/queue": "0.6.4-develop.4382.1.6b4f656b77",
-    "@open-mercato/shared": "0.6.4-develop.4382.1.6b4f656b77",
+    "@mikro-orm/core": "^7.1.4",
+    "@mikro-orm/decorators": "^7.1.4",
+    "@mikro-orm/migrations": "^7.1.4",
+    "@mikro-orm/postgresql": "^7.1.4",
+    "@open-mercato/queue": "0.6.4",
+    "@open-mercato/shared": "0.6.4",
     "cross-spawn": "^7.0.6",
     "pg": "8.21.0",
-    "semver": "^7.8.1",
+    "semver": "^7.8.2",
     "testcontainers": "^12.0.1",
     "ts-morph": "^28.0.0",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.4-develop.4382.1.6b4f656b77"
+    "@open-mercato/shared": "0.6.4"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.4-develop.4382.1.6b4f656b77",
+    "@open-mercato/shared": "0.6.4",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11"
@@ -85,6 +85,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/cli"
-  },
-  "stableVersion": "0.6.3"
+  }
 }

package/src/bin.ts

@@ -14,6 +14,7 @@ import { run } from './mercato.js'
 const BOOTSTRAP_FREE_COMMANDS = [
   'generate',
   'module',
+  'deploy',
   'db',
   'init',
   'agentic:init',

package/src/lib/__integration__/TC-INT-008.spec.ts

@@ -237,7 +237,7 @@ test.describe('TC-INT-008: CLI agentic init mirrors standalone scaffolding asset
       expect(cursorRulesSource).toContain('sample-store')
 
       const specWritingSkillSource = fs.readFileSync(
-        path.join(appDir, '.ai', 'skills', 'spec-writing', 'SKILL.md'),
+        path.join(appDir, '.ai', 'skills', 'om-spec-writing', 'SKILL.md'),
         'utf8',
       )
       expect(specWritingSkillSource).toContain('sample-store')

package/src/lib/agentic-setup.ts

@@ -69,127 +69,128 @@ function generateShared(config: AgenticConfig): void {
   // .ai/skills/
   writeTemplate(
     srcDir,
-    'ai/skills/spec-writing/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'spec-writing', 'SKILL.md'),
+    'ai/skills/om-spec-writing/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-spec-writing', 'SKILL.md'),
     config,
   )
   copyFile(
     srcDir,
-    'ai/skills/spec-writing/references/spec-template.md',
-    join(targetDir, '.ai', 'skills', 'spec-writing', 'references', 'spec-template.md'),
+    'ai/skills/om-spec-writing/references/spec-template.md',
+    join(targetDir, '.ai', 'skills', 'om-spec-writing', 'references', 'spec-template.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/spec-writing/references/spec-checklist.md',
-    join(targetDir, '.ai', 'skills', 'spec-writing', 'references', 'spec-checklist.md'),
+    'ai/skills/om-spec-writing/references/spec-checklist.md',
+    join(targetDir, '.ai', 'skills', 'om-spec-writing', 'references', 'spec-checklist.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/backend-ui-design/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'backend-ui-design', 'SKILL.md'),
+    'ai/skills/om-backend-ui-design/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-backend-ui-design', 'SKILL.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/backend-ui-design/references/ui-components.md',
-    join(targetDir, '.ai', 'skills', 'backend-ui-design', 'references', 'ui-components.md'),
+    'ai/skills/om-backend-ui-design/references/ui-components.md',
+    join(targetDir, '.ai', 'skills', 'om-backend-ui-design', 'references', 'ui-components.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/code-review/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'code-review', 'SKILL.md'),
+    'ai/skills/om-code-review/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-code-review', 'SKILL.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/code-review/references/review-checklist.md',
-    join(targetDir, '.ai', 'skills', 'code-review', 'references', 'review-checklist.md'),
+    'ai/skills/om-code-review/references/review-checklist.md',
+    join(targetDir, '.ai', 'skills', 'om-code-review', 'references', 'review-checklist.md'),
   )
-  copyFile(srcDir, 'ai/skills/integration-builder/SKILL.md', join(targetDir, '.ai', 'skills', 'integration-builder', 'SKILL.md'))
+  copyFile(srcDir, 'ai/skills/om-integration-builder/SKILL.md', join(targetDir, '.ai', 'skills', 'om-integration-builder', 'SKILL.md'))
   copyFile(
     srcDir,
-    'ai/skills/integration-builder/references/adapter-contracts.md',
-    join(targetDir, '.ai', 'skills', 'integration-builder', 'references', 'adapter-contracts.md'),
+    'ai/skills/om-integration-builder/references/adapter-contracts.md',
+    join(targetDir, '.ai', 'skills', 'om-integration-builder', 'references', 'adapter-contracts.md'),
   )
 
   copyFile(
     srcDir,
-    'ai/skills/system-extension/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'system-extension', 'SKILL.md'),
+    'ai/skills/om-system-extension/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-system-extension', 'SKILL.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/system-extension/references/extension-contracts.md',
-    join(targetDir, '.ai', 'skills', 'system-extension', 'references', 'extension-contracts.md'),
+    'ai/skills/om-system-extension/references/extension-contracts.md',
+    join(targetDir, '.ai', 'skills', 'om-system-extension', 'references', 'extension-contracts.md'),
   )
 
   copyFile(
     srcDir,
-    'ai/skills/module-scaffold/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'module-scaffold', 'SKILL.md'),
+    'ai/skills/om-module-scaffold/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-module-scaffold', 'SKILL.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/module-scaffold/references/naming-conventions.md',
-    join(targetDir, '.ai', 'skills', 'module-scaffold', 'references', 'naming-conventions.md'),
+    'ai/skills/om-module-scaffold/references/naming-conventions.md',
+    join(targetDir, '.ai', 'skills', 'om-module-scaffold', 'references', 'naming-conventions.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/module-scaffold/references/navigation-patterns.md',
-    join(targetDir, '.ai', 'skills', 'module-scaffold', 'references', 'navigation-patterns.md'),
+    'ai/skills/om-module-scaffold/references/navigation-patterns.md',
+    join(targetDir, '.ai', 'skills', 'om-module-scaffold', 'references', 'navigation-patterns.md'),
   )
 
   copyFile(
     srcDir,
-    'ai/skills/troubleshooter/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'troubleshooter', 'SKILL.md'),
+    'ai/skills/om-troubleshooter/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-troubleshooter', 'SKILL.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/troubleshooter/references/diagnostic-commands.md',
-    join(targetDir, '.ai', 'skills', 'troubleshooter', 'references', 'diagnostic-commands.md'),
+    'ai/skills/om-troubleshooter/references/diagnostic-commands.md',
+    join(targetDir, '.ai', 'skills', 'om-troubleshooter', 'references', 'diagnostic-commands.md'),
   )
 
   copyFile(
     srcDir,
-    'ai/skills/eject-and-customize/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'eject-and-customize', 'SKILL.md'),
+    'ai/skills/om-eject-and-customize/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-eject-and-customize', 'SKILL.md'),
   )
 
   copyFile(
     srcDir,
-    'ai/skills/data-model-design/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'data-model-design', 'SKILL.md'),
+    'ai/skills/om-data-model-design/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-data-model-design', 'SKILL.md'),
   )
   copyFile(
     srcDir,
-    'ai/skills/data-model-design/references/mikro-orm-cheatsheet.md',
-    join(targetDir, '.ai', 'skills', 'data-model-design', 'references', 'mikro-orm-cheatsheet.md'),
+    'ai/skills/om-data-model-design/references/mikro-orm-cheatsheet.md',
+    join(targetDir, '.ai', 'skills', 'om-data-model-design', 'references', 'mikro-orm-cheatsheet.md'),
   )
 
   copyFile(
     srcDir,
-    'ai/skills/implement-spec/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'implement-spec', 'SKILL.md'),
+    'ai/skills/om-implement-spec/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-implement-spec', 'SKILL.md'),
   )
 
   copyFile(
     srcDir,
-    'ai/skills/integration-tests/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'integration-tests', 'SKILL.md'),
+    'ai/skills/om-integration-tests/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-integration-tests', 'SKILL.md'),
   )
 
   copyFile(
     srcDir,
-    'ai/skills/auto-upgrade-0.4.10-to-0.5.0/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'auto-upgrade-0.4.10-to-0.5.0', 'SKILL.md'),
+    'ai/skills/om-auto-upgrade-0.4.10-to-0.5.0/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-auto-upgrade-0.4.10-to-0.5.0', 'SKILL.md'),
   )
 
   for (const autoSkill of [
-    'auto-create-pr',
-    'auto-continue-pr',
-    'auto-create-pr-loop',
-    'auto-continue-pr-loop',
-    'auto-review-pr',
-    'auto-fix-github',
+    'om-auto-create-pr',
+    'om-auto-continue-pr',
+    'om-auto-create-pr-loop',
+    'om-auto-continue-pr-loop',
+    'om-auto-review-pr',
+    'om-auto-fix-github',
+    'om-prepare-issue',
   ]) {
     copyFile(
       srcDir,
@@ -207,8 +208,8 @@ function generateShared(config: AgenticConfig): void {
 
   copyFile(
     srcDir,
-    'ai/skills/trim-unused-modules/SKILL.md',
-    join(targetDir, '.ai', 'skills', 'trim-unused-modules', 'SKILL.md'),
+    'ai/skills/om-trim-unused-modules/SKILL.md',
+    join(targetDir, '.ai', 'skills', 'om-trim-unused-modules', 'SKILL.md'),
   )
 
   copyFile(srcDir, 'ai/qa/tests/playwright.config.ts', join(targetDir, '.ai', 'qa', 'tests', 'playwright.config.ts'))

package/src/lib/deploy/railway/__integration__/TC-CLI-RAILWAY-001.meta.ts

@@ -0,0 +1,3 @@
+export const integrationMeta = {
+  requiredEnvVars: ['RAILWAY_INTEGRATION_TOKEN', 'RAILWAY_INTEGRATION_APP_ROOT'],
+}

package/src/lib/deploy/railway/__integration__/TC-CLI-RAILWAY-001.spec.ts

@@ -0,0 +1,71 @@
+import { execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { expect, test } from '@playwright/test'
+
+const token = process.env.RAILWAY_INTEGRATION_TOKEN
+const appRoot = process.env.RAILWAY_INTEGRATION_APP_ROOT
+const cliBin = resolve(process.cwd(), 'packages/cli/dist/bin.js')
+
+function runCli(args: string[]): string {
+  if (!appRoot || !token) throw new Error('Railway integration environment is incomplete.')
+  return execFileSync(process.execPath, [cliBin, ...args], {
+    cwd: appRoot,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      RAILWAY_API_TOKEN: token,
+      CI: 'true',
+    },
+    timeout: 15 * 60 * 1000,
+  })
+}
+
+test.describe('mercato deploy railway live integration', () => {
+  test.skip(!token || !appRoot, 'RAILWAY_INTEGRATION_TOKEN and RAILWAY_INTEGRATION_APP_ROOT are required')
+
+  test('deploys, verifies health, resumes, and cleans up', async ({ request }) => {
+    expect(existsSync(cliBin)).toBe(true)
+    const projectName = `mercato-integration-${Date.now()}`
+
+    try {
+      const output = runCli([
+        'deploy',
+        'railway',
+        '--project',
+        projectName,
+        '--source',
+        'local',
+        '--no-worker',
+        '--non-interactive',
+      ])
+      const outputLines = output.trim().split(/\r?\n/)
+      const deployUrl = outputLines
+        .find((line) => line.startsWith('DEPLOY_URL='))
+        ?.slice('DEPLOY_URL='.length)
+      expect(deployUrl).toBeTruthy()
+      expect(outputLines.at(-1)).toBe(`DEPLOY_URL=${deployUrl}`)
+
+      const health = await request.get(`${deployUrl}/api/healthz`)
+      expect(health.status()).toBe(200)
+      expect(await health.json()).toEqual({
+        status: 'ok',
+        ts: expect.any(String),
+      })
+
+      const resumeOutput = runCli([
+        'deploy',
+        'railway',
+        '--source',
+        'local',
+        '--no-worker',
+        '--non-interactive',
+      ])
+      expect(resumeOutput).toContain(`Project:     https://railway.com/project/`)
+    } finally {
+      if (appRoot && existsSync(resolve(appRoot, '.mercato', 'railway.json'))) {
+        runCli(['deploy', 'railway', '--cleanup', '--non-interactive', '--yes'])
+      }
+    }
+  })
+})

package/src/lib/deploy/railway/__tests__/dry-run.test.ts

@@ -0,0 +1,61 @@
+import { existsSync, mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runRailwayDeploy } from '../index'
+
+describe('mercato deploy railway --dry-run', () => {
+  it('prints a deterministic local-source plan without a token or state mutation', async () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-dry-run-'))
+    mkdirSync(join(cwd, 'node_modules'), { recursive: true })
+    writeFileSync(join(cwd, 'package.json'), JSON.stringify({
+      name: 'My Shop',
+      dependencies: { '@open-mercato/core': '0.6.4' },
+    }))
+    writeFileSync(join(cwd, '.env'), 'CUSTOM_SETTING=enabled\n')
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '.env*\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json*\n',
+    )
+    const log = jest.spyOn(console, 'log').mockImplementation(() => undefined)
+
+    await runRailwayDeploy(['--dry-run', '--source', 'local'], {
+      cwd,
+      resolveSource: () => ({ mode: 'local', reason: 'test local source' }),
+    })
+
+    const output = log.mock.calls.map((call) => call.join(' ')).join('\n')
+    expect(output).toContain('Railway deployment plan (dry run)')
+    expect(output).toContain('Project: my-shop')
+    expect(output).toContain('Source: local')
+    expect(output).toContain('AUTH_SECRET=<redacted>')
+    expect(output).not.toContain('generated-at-deploy')
+    log.mockRestore()
+  })
+
+  it('prints a cleanup plan without deleting tracked state', async () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-cleanup-dry-run-'))
+    mkdirSync(join(cwd, '.mercato'), { recursive: true })
+    writeFileSync(join(cwd, 'package.json'), JSON.stringify({
+      name: 'My Shop',
+      dependencies: { '@open-mercato/core': '0.6.4' },
+    }))
+    const statePath = join(cwd, '.mercato', 'railway.json')
+    writeFileSync(statePath, JSON.stringify({
+      schemaVersion: 1,
+      provider: 'railway',
+      projectId: 'project-1',
+      projectName: 'my-shop',
+      environments: {},
+      writtenBy: { cliVersion: 'test' },
+    }))
+    const log = jest.spyOn(console, 'log').mockImplementation(() => undefined)
+
+    await runRailwayDeploy(['--cleanup', '--dry-run'], { cwd })
+
+    const output = log.mock.calls.map((call) => call.join(' ')).join('\n')
+    expect(output).toContain('Railway cleanup plan (dry run)')
+    expect(output).toContain('projectDelete')
+    expect(existsSync(statePath)).toBe(true)
+    log.mockRestore()
+  })
+})

package/src/lib/deploy/railway/__tests__/env.test.ts

@@ -0,0 +1,55 @@
+import {
+  computeRailwayVariables,
+  generateProtectedSecrets,
+  parseEnvFile,
+} from '../env'
+
+describe('Railway environment variables', () => {
+  it('parses common dotenv syntax', () => {
+    expect(parseEnvFile(`
+# comment
+PLAIN=value
+export QUOTED="hello world"
+SINGLE='x'
+`)).toEqual({
+      PLAIN: 'value',
+      QUOTED: 'hello world',
+      SINGLE: 'x',
+    })
+  })
+
+  it('generates missing protected secrets and preserves existing ones', () => {
+    const secrets = generateProtectedSecrets({ AUTH_SECRET: 'existing' })
+    expect(secrets.AUTH_SECRET).toBe('existing')
+    expect(secrets.JWT_SECRET).toHaveLength(128)
+    expect(secrets.TENANT_DATA_ENCRYPTION_FALLBACK_KEY.length).toBeGreaterThan(30)
+  })
+
+  it('computes app and worker settings without leaking Railway tokens', () => {
+    const variables = computeRailwayVariables({
+      env: {
+        RAILWAY_API_TOKEN: 'never-upload',
+        CUSTOM_SETTING: 'enabled',
+      },
+      role: 'app',
+      workerEnabled: true,
+      appUrl: 'https://example.up.railway.app',
+      protectedSecrets: {
+        AUTH_SECRET: 'auth',
+        JWT_SECRET: 'jwt',
+        TENANT_DATA_ENCRYPTION_FALLBACK_KEY: 'encryption',
+      },
+    })
+    expect(variables).toMatchObject({
+      DATABASE_URL: '${{Postgres.DATABASE_URL}}',
+      REDIS_URL: '${{Redis.REDIS_URL}}',
+      CACHE_STRATEGY: 'redis',
+      QUEUE_STRATEGY: 'async',
+      AUTO_SPAWN_WORKERS: 'false',
+      PORT: '3000',
+      APP_URL: 'https://example.up.railway.app',
+      CUSTOM_SETTING: 'enabled',
+    })
+    expect(variables.RAILWAY_API_TOKEN).toBeUndefined()
+  })
+})

package/src/lib/deploy/railway/__tests__/graphql-client.test.ts

@@ -0,0 +1,80 @@
+import {
+  createRailwayGraphqlClient,
+  RailwayGraphqlError,
+} from '../graphql-client'
+
+const query = { name: 'TestQuery', query: 'query TestQuery { me { id } }' }
+const mutation = { ...query, name: 'TestMutation', mutation: true }
+
+function response(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status })
+}
+
+describe('Railway GraphQL client', () => {
+  it('sends operationName, query, variables, and bearer auth', async () => {
+    const fetchImpl = jest.fn(async () => response({ data: { me: { id: 'user' } } }))
+    const client = createRailwayGraphqlClient({
+      token: 'account-token',
+      fetchImpl: fetchImpl as typeof fetch,
+    })
+
+    await expect(client.request(query, { input: 'value' })).resolves.toEqual({ me: { id: 'user' } })
+    expect(fetchImpl).toHaveBeenCalledWith(
+      'https://backboard.railway.com/graphql/v2',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({ Authorization: 'Bearer account-token' }),
+        body: JSON.stringify({
+          operationName: 'TestQuery',
+          query: query.query,
+          variables: { input: 'value' },
+        }),
+      }),
+    )
+  })
+
+  it('retries idempotent reads once on a server error', async () => {
+    const fetchImpl = jest.fn()
+      .mockResolvedValueOnce(response({ errors: [{ message: 'temporary' }] }, 500))
+      .mockResolvedValueOnce(response({ data: { ok: true } }))
+    const client = createRailwayGraphqlClient({
+      token: 'token',
+      fetchImpl: fetchImpl as typeof fetch,
+    })
+    await expect(client.request(query)).resolves.toEqual({ ok: true })
+    expect(fetchImpl).toHaveBeenCalledTimes(2)
+  })
+
+  it('never blindly retries mutations', async () => {
+    const fetchImpl = jest.fn(async () => response({ errors: [{ message: 'ambiguous' }] }, 500))
+    const client = createRailwayGraphqlClient({
+      token: 'token',
+      fetchImpl: fetchImpl as typeof fetch,
+    })
+    await expect(client.request(mutation)).rejects.toBeInstanceOf(RailwayGraphqlError)
+    expect(fetchImpl).toHaveBeenCalledTimes(1)
+  })
+
+  it('redacts sensitive request and response fields in verbose logs', async () => {
+    const logger = { log: jest.fn() }
+    const fetchImpl = jest.fn(async () => response({
+      data: { variables: { AUTH_SECRET: 'response-secret', SAFE_VALUE: 'visible' } },
+    }))
+    const client = createRailwayGraphqlClient({
+      token: 'account-token',
+      verbose: true,
+      fetchImpl: fetchImpl as typeof fetch,
+      logger,
+    })
+
+    await client.request(query, {
+      input: { JWT_SECRET: 'request-secret', SAFE_VALUE: 'visible' },
+    })
+
+    const output = logger.log.mock.calls.flat().join('\n')
+    expect(output).not.toContain('request-secret')
+    expect(output).not.toContain('response-secret')
+    expect(output).toContain('<redacted>')
+    expect(output).toContain('visible')
+  })
+})

package/src/lib/deploy/railway/__tests__/operations.test.ts

@@ -0,0 +1,21 @@
+import { createHash } from 'node:crypto'
+import {
+  railwayOperations,
+  railwaySchemaFingerprintSource,
+} from '../operations'
+
+describe('Railway GraphQL operation contract', () => {
+  it('matches the verified operation fingerprint', () => {
+    const fingerprint = createHash('sha256')
+      .update(railwaySchemaFingerprintSource())
+      .digest('hex')
+    expect(fingerprint).toBe('01e3c5feaa163ebe626a1cb9ae5f22b5e7ea316162fed9353375f34c25ebc522')
+  })
+
+  it('uses template-backed databases and singular service variable upserts', () => {
+    const source = railwaySchemaFingerprintSource()
+    expect(source).toContain('templateDeployV2')
+    expect(source).not.toContain('pluginCreate')
+    expect(railwayOperations.variableUpsert.query).toContain('VariableCollectionUpsertInput')
+  })
+})

package/src/lib/deploy/railway/__tests__/options.test.ts

@@ -0,0 +1,78 @@
+import { parseRailwayDeployOptions, redactRailwayCliArgs } from '../options'
+
+describe('parseRailwayDeployOptions', () => {
+  it('parses the complete command surface', () => {
+    expect(parseRailwayDeployOptions([
+      '--project=my-shop',
+      '--env', 'staging',
+      '--service', 'web',
+      '--no-worker',
+      '--source', 'local',
+      '--region', 'europe-west4',
+      '--env-file', '.env.railway',
+      '--domain', 'shop.example.com',
+      '--no-wait-domain',
+      '--volume', '/app/storage',
+      '--token', 'token',
+      '--non-interactive',
+      '--dry-run',
+      '--yes',
+      '--write-env',
+      '--no-track',
+      '--force-rename',
+      '--timeout', '120',
+      '--allow-secret-passthrough', 'OPENAI_API_KEY',
+      '--allow-secret-passthrough=RESEND_API_KEY',
+      '--verbose',
+    ], {})).toMatchObject({
+      project: 'my-shop',
+      environment: 'staging',
+      service: 'web',
+      worker: false,
+      source: 'local',
+      region: 'europe-west4',
+      envFile: '.env.railway',
+      domain: 'shop.example.com',
+      waitDomain: false,
+      volume: '/app/storage',
+      token: 'token',
+      nonInteractive: true,
+      dryRun: true,
+      yes: true,
+      writeEnv: true,
+      track: false,
+      forceRename: true,
+      timeoutSeconds: 120,
+      allowedSecretKeys: ['OPENAI_API_KEY', 'RESEND_API_KEY'],
+      verbose: true,
+    })
+  })
+
+  it('enables non-interactive mode in CI', () => {
+    expect(parseRailwayDeployOptions([], { CI: 'true' }).nonInteractive).toBe(true)
+  })
+
+  it('allows cleanup dry-runs in non-interactive environments without --yes', () => {
+    expect(parseRailwayDeployOptions(['--cleanup', '--dry-run'], { CI: 'true' }))
+      .toMatchObject({
+        cleanup: true,
+        dryRun: true,
+        nonInteractive: true,
+        yes: false,
+      })
+  })
+
+  it.each([
+    [['--source', 'invalid'], 'Invalid --source'],
+    [['--timeout', '0'], '--timeout must be'],
+    [['--unknown'], 'Unknown Railway deploy option'],
+    [['--cleanup', '--non-interactive'], 'requires --yes'],
+  ])('rejects invalid arguments', (args, expectedMessage) => {
+    expect(() => parseRailwayDeployOptions(args, {})).toThrow(expectedMessage)
+  })
+
+  it('redacts both token flag syntaxes in dispatcher output', () => {
+    expect(redactRailwayCliArgs(['--token', 'secret', '--token=other', '--dry-run']))
+      .toEqual(['--token', '****', '--token=****', '--dry-run'])
+  })
+})