@open-mercato/cli 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/lib/deploy/railway/operations.ts

@@ -0,0 +1,248 @@
+import type { RailwayGraphqlOperation } from './types'
+
+export const railwayOperations = {
+  me: {
+    name: 'RailwayMe',
+    query: `query RailwayMe {
+  me { id name email workspaces { id name } }
+}`,
+  },
+  project: {
+    name: 'RailwayProject',
+    query: `query RailwayProject($id: String!) {
+  project(id: $id) { id name workspaceId }
+}`,
+  },
+  projects: {
+    name: 'RailwayProjects',
+    query: `query RailwayProjects($workspaceId: String!) {
+  projects(workspaceId: $workspaceId, first: 100, includeDeleted: false) {
+    edges { node { id name } }
+  }
+}`,
+  },
+  projectCreate: {
+    name: 'RailwayProjectCreate',
+    mutation: true,
+    query: `mutation RailwayProjectCreate($input: ProjectCreateInput!) {
+  projectCreate(input: $input) { id name }
+}`,
+  },
+  projectUpdate: {
+    name: 'RailwayProjectUpdate',
+    mutation: true,
+    query: `mutation RailwayProjectUpdate($id: String!, $input: ProjectUpdateInput!) {
+  projectUpdate(id: $id, input: $input) { id name }
+}`,
+  },
+  projectDelete: {
+    name: 'RailwayProjectDelete',
+    mutation: true,
+    query: `mutation RailwayProjectDelete($id: String!) {
+  projectDelete(id: $id)
+}`,
+  },
+  environments: {
+    name: 'RailwayEnvironments',
+    query: `query RailwayEnvironments($projectId: String!) {
+  environments(projectId: $projectId, first: 100) {
+    edges { node { id name } }
+  }
+}`,
+  },
+  environment: {
+    name: 'RailwayEnvironment',
+    query: `query RailwayEnvironment($id: String!, $projectId: String!) {
+  environment(id: $id, projectId: $projectId) { id name }
+}`,
+  },
+  environmentCreate: {
+    name: 'RailwayEnvironmentCreate',
+    mutation: true,
+    query: `mutation RailwayEnvironmentCreate($input: EnvironmentCreateInput!) {
+  environmentCreate(input: $input) { id name }
+}`,
+  },
+  regions: {
+    name: 'RailwayRegions',
+    query: `query RailwayRegions($projectId: String!) {
+  regions(projectId: $projectId) { id name region location }
+}`,
+  },
+  template: {
+    name: 'RailwayTemplate',
+    query: `query RailwayTemplate($code: String!) {
+  template(code: $code) { id code serializedConfig }
+}`,
+  },
+  templateDeploy: {
+    name: 'RailwayTemplateDeploy',
+    mutation: true,
+    query: `mutation RailwayTemplateDeploy($input: TemplateDeployV2Input!) {
+  templateDeployV2(input: $input) { workflowId }
+}`,
+  },
+  services: {
+    name: 'RailwayServices',
+    query: `query RailwayServices($projectId: String!) {
+  project(id: $projectId) { services { edges { node { id name } } } }
+}`,
+  },
+  volumes: {
+    name: 'RailwayVolumes',
+    query: `query RailwayVolumes($projectId: String!) {
+  project(id: $projectId) {
+    volumes {
+      edges {
+        node {
+          id
+          volumeInstances {
+            edges { node { environmentId serviceId mountPath } }
+          }
+        }
+      }
+    }
+  }
+}`,
+  },
+  service: {
+    name: 'RailwayService',
+    query: `query RailwayService($id: String!) {
+  service(id: $id) { id name projectId }
+}`,
+  },
+  serviceCreate: {
+    name: 'RailwayServiceCreate',
+    mutation: true,
+    query: `mutation RailwayServiceCreate($input: ServiceCreateInput!) {
+  serviceCreate(input: $input) { id name }
+}`,
+  },
+  serviceDelete: {
+    name: 'RailwayServiceDelete',
+    mutation: true,
+    query: `mutation RailwayServiceDelete($id: String!, $environmentId: String!) {
+  serviceDelete(id: $id, environmentId: $environmentId)
+}`,
+  },
+  serviceConnect: {
+    name: 'RailwayServiceConnect',
+    mutation: true,
+    query: `mutation RailwayServiceConnect($id: String!, $input: ServiceConnectInput!) {
+  serviceConnect(id: $id, input: $input) { id }
+}`,
+  },
+  serviceDisconnect: {
+    name: 'RailwayServiceDisconnect',
+    mutation: true,
+    query: `mutation RailwayServiceDisconnect($id: String!) {
+  serviceDisconnect(id: $id) { id }
+}`,
+  },
+  serviceInstanceUpdate: {
+    name: 'RailwayServiceInstanceUpdate',
+    mutation: true,
+    query: `mutation RailwayServiceInstanceUpdate(
+      $environmentId: String!,
+      $serviceId: String!,
+      $input: ServiceInstanceUpdateInput!
+    ) {
+      serviceInstanceUpdate(environmentId: $environmentId, serviceId: $serviceId, input: $input)
+    }`,
+  },
+  variables: {
+    name: 'RailwayVariables',
+    query: `query RailwayVariables($projectId: String!, $environmentId: String!, $serviceId: String!) {
+  variables(projectId: $projectId, environmentId: $environmentId, serviceId: $serviceId)
+}`,
+  },
+  variableUpsert: {
+    name: 'RailwayVariableCollectionUpsert',
+    mutation: true,
+    query: `mutation RailwayVariableCollectionUpsert($input: VariableCollectionUpsertInput!) {
+  variableCollectionUpsert(input: $input)
+}`,
+  },
+  deploy: {
+    name: 'RailwayServiceDeploy',
+    mutation: true,
+    query: `mutation RailwayServiceDeploy($environmentId: String!, $serviceId: String!, $commitSha: String) {
+  serviceInstanceDeployV2(environmentId: $environmentId, serviceId: $serviceId, commitSha: $commitSha)
+}`,
+  },
+  deployments: {
+    name: 'RailwayDeployments',
+    query: `query RailwayDeployments($projectId: String!, $environmentId: String!, $serviceId: String!) {
+  deployments(
+    input: { projectId: $projectId, environmentId: $environmentId, serviceId: $serviceId },
+    first: 10
+  ) {
+    edges { node { id status staticUrl url serviceId environmentId createdAt } }
+  }
+}`,
+  },
+  deployment: {
+    name: 'RailwayDeployment',
+    query: `query RailwayDeployment($id: String!) {
+  deployment(id: $id) { id status staticUrl url serviceId environmentId }
+}`,
+  },
+  buildLogs: {
+    name: 'RailwayBuildLogs',
+    query: `query RailwayBuildLogs($deploymentId: String!, $limit: Int!) {
+  buildLogs(deploymentId: $deploymentId, limit: $limit) { timestamp message severity }
+}`,
+  },
+  deploymentLogs: {
+    name: 'RailwayDeploymentLogs',
+    query: `query RailwayDeploymentLogs($deploymentId: String!, $limit: Int!) {
+  deploymentLogs(deploymentId: $deploymentId, limit: $limit) { timestamp message severity }
+}`,
+  },
+  domains: {
+    name: 'RailwayDomains',
+    query: `query RailwayDomains($projectId: String!, $environmentId: String!, $serviceId: String!) {
+  domains(projectId: $projectId, environmentId: $environmentId, serviceId: $serviceId) {
+    customDomains { id domain status { verified dnsRecords { hostlabel requiredValue recordType } } }
+    serviceDomains { id domain }
+  }
+}`,
+  },
+  customDomain: {
+    name: 'RailwayCustomDomain',
+    query: `query RailwayCustomDomain($id: String!, $projectId: String!) {
+  customDomain(id: $id, projectId: $projectId) {
+    id
+    domain
+    status { verified dnsRecords { hostlabel requiredValue recordType } }
+  }
+}`,
+  },
+  serviceDomainCreate: {
+    name: 'RailwayServiceDomainCreate',
+    mutation: true,
+    query: `mutation RailwayServiceDomainCreate($input: ServiceDomainCreateInput!) {
+  serviceDomainCreate(input: $input) { id domain }
+}`,
+  },
+  customDomainCreate: {
+    name: 'RailwayCustomDomainCreate',
+    mutation: true,
+    query: `mutation RailwayCustomDomainCreate($input: CustomDomainCreateInput!) {
+  customDomainCreate(input: $input) { id domain status { dnsRecords { hostlabel requiredValue recordType } } }
+}`,
+  },
+  volumeCreate: {
+    name: 'RailwayVolumeCreate',
+    mutation: true,
+    query: `mutation RailwayVolumeCreate($input: VolumeCreateInput!) {
+  volumeCreate(input: $input) { id name }
+}`,
+  },
+} satisfies Record<string, RailwayGraphqlOperation>
+
+export function railwaySchemaFingerprintSource(): string {
+  return Object.values(railwayOperations)
+    .map((operation) => `${operation.name}\n${operation.query.trim()}`)
+    .join('\n\n')
+}

package/src/lib/deploy/railway/options.ts

@@ -0,0 +1,167 @@
+import type { RailwayDeployOptions, RailwaySourceMode } from './types'
+
+const VALUE_FLAGS = new Set([
+  '--project',
+  '--env',
+  '--service',
+  '--source',
+  '--region',
+  '--env-file',
+  '--domain',
+  '--volume',
+  '--token',
+  '--timeout',
+  '--allow-secret-passthrough',
+])
+
+const BOOLEAN_FLAGS = new Set([
+  '--worker',
+  '--no-worker',
+  '--no-wait-domain',
+  '--non-interactive',
+  '--dry-run',
+  '--cleanup',
+  '--yes',
+  '--write-env',
+  '--no-track',
+  '--force-rename',
+  '--verbose',
+  '--help',
+  '-h',
+])
+
+function readFlagValue(args: string[], index: number): { flag: string; value: string; consumed: number } {
+  const argument = args[index] ?? ''
+  const equalsIndex = argument.indexOf('=')
+  if (equalsIndex > 0) {
+    const flag = argument.slice(0, equalsIndex)
+    const value = argument.slice(equalsIndex + 1)
+    if (!value) throw new Error(`Missing value for ${flag}.`)
+    return { flag, value, consumed: 1 }
+  }
+
+  const value = args[index + 1]
+  if (!value || value.startsWith('-')) {
+    throw new Error(`Missing value for ${argument}.`)
+  }
+  return { flag: argument, value, consumed: 2 }
+}
+
+function parseSourceMode(value: string): RailwaySourceMode {
+  if (value === 'auto' || value === 'git' || value === 'local') return value
+  throw new Error(`Invalid --source value "${value}". Expected auto, git, or local.`)
+}
+
+function parseTimeout(value: string): number {
+  const timeout = Number.parseInt(value, 10)
+  if (!Number.isFinite(timeout) || timeout <= 0) {
+    throw new Error('--timeout must be a positive number of seconds.')
+  }
+  return timeout
+}
+
+export function parseRailwayDeployOptions(
+  args: string[],
+  environment: NodeJS.ProcessEnv = process.env,
+): RailwayDeployOptions {
+  const options: RailwayDeployOptions = {
+    environment: 'production',
+    service: 'mercato-app',
+    worker: true,
+    source: 'auto',
+    waitDomain: true,
+    nonInteractive: environment.CI === 'true',
+    dryRun: false,
+    cleanup: false,
+    yes: false,
+    writeEnv: false,
+    track: true,
+    forceRename: false,
+    timeoutSeconds: 900,
+    allowedSecretKeys: [],
+    verbose: false,
+    help: false,
+  }
+
+  for (let index = 0; index < args.length;) {
+    const argument = args[index] ?? ''
+    const normalizedFlag = argument.includes('=') ? argument.slice(0, argument.indexOf('=')) : argument
+
+    if (VALUE_FLAGS.has(normalizedFlag)) {
+      const { flag, value, consumed } = readFlagValue(args, index)
+      if (flag === '--project') options.project = value
+      else if (flag === '--env') options.environment = value
+      else if (flag === '--service') options.service = value
+      else if (flag === '--source') options.source = parseSourceMode(value)
+      else if (flag === '--region') options.region = value
+      else if (flag === '--env-file') options.envFile = value
+      else if (flag === '--domain') options.domain = value
+      else if (flag === '--volume') options.volume = value
+      else if (flag === '--token') options.token = value
+      else if (flag === '--timeout') options.timeoutSeconds = parseTimeout(value)
+      else if (flag === '--allow-secret-passthrough') options.allowedSecretKeys.push(value)
+      index += consumed
+      continue
+    }
+
+    if (!BOOLEAN_FLAGS.has(argument)) {
+      throw new Error(`Unknown Railway deploy option "${argument}".`)
+    }
+
+    if (argument === '--worker') options.worker = true
+    else if (argument === '--no-worker') options.worker = false
+    else if (argument === '--no-wait-domain') options.waitDomain = false
+    else if (argument === '--non-interactive') options.nonInteractive = true
+    else if (argument === '--dry-run') options.dryRun = true
+    else if (argument === '--cleanup') options.cleanup = true
+    else if (argument === '--yes') options.yes = true
+    else if (argument === '--write-env') options.writeEnv = true
+    else if (argument === '--no-track') options.track = false
+    else if (argument === '--force-rename') options.forceRename = true
+    else if (argument === '--verbose') options.verbose = true
+    else if (argument === '--help' || argument === '-h') options.help = true
+    index += 1
+  }
+
+  if (options.cleanup && !options.dryRun && options.nonInteractive && !options.yes) {
+    throw new Error('--cleanup --non-interactive requires --yes.')
+  }
+  if (options.environment.trim().length === 0) throw new Error('--env cannot be empty.')
+  if (options.service.trim().length === 0) throw new Error('--service cannot be empty.')
+  return options
+}
+
+export function railwayDeployHelp(): string {
+  return `Usage: mercato deploy railway [options]
+
+Deploy an Open Mercato standalone app to Railway.
+
+  --project <name>                 Railway project name
+  --env <name>                     Environment name (default: production)
+  --service <name>                 App service name (default: mercato-app)
+  --worker / --no-worker           Enable or disable the dedicated worker
+  --source <auto|git|local>        Source strategy (default: auto)
+  --region <id>                    Railway region
+  --env-file <path>                Environment file
+  --domain <fqdn>                  Custom domain
+  --no-wait-domain                 Do not wait for DNS verification
+  --volume <mountPath>             Create an attachments volume
+  --token <value>                  Railway Account token
+  --non-interactive                Disable prompts
+  --dry-run                        Print the plan without mutations
+  --cleanup --yes                  Delete the recorded Railway project
+  --write-env                      Persist generated secrets locally
+  --no-track                       Use .mercato/railway.json.local
+  --force-rename                   Allow renaming a recorded project
+  --timeout <seconds>              Deployment timeout (default: 900)
+  --allow-secret-passthrough <key> Allow one credential-like env value
+  --verbose                        Print redacted GraphQL diagnostics`
+}
+
+export function redactRailwayCliArgs(args: string[]): string[] {
+  return args.map((argument, index) => {
+    if (argument.startsWith('--token=')) return '--token=****'
+    if (args[index - 1] === '--token') return '****'
+    return argument
+  })
+}

package/src/lib/deploy/railway/railway-cli.ts

@@ -0,0 +1,65 @@
+import { spawnSync } from 'node:child_process'
+import { redactText } from './redaction'
+
+function runRailway(args: string[], cwd: string, token: string, secrets: string[]): string {
+  const result = spawnSync('railway', args, {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, RAILWAY_API_TOKEN: token },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  const output = `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim()
+  if (result.status !== 0) {
+    throw new Error(redactText(output || `railway ${args[0] ?? ''} failed`, secrets))
+  }
+  return output
+}
+
+export function uploadLocalSource(input: {
+  cwd: string
+  projectId: string
+  environmentId: string
+  serviceId: string
+  serviceName: string
+  token: string
+}): string | null {
+  runRailway(
+    [
+      'link',
+      '--project',
+      input.projectId,
+      '--environment',
+      input.environmentId,
+      '--service',
+      input.serviceId,
+    ],
+    input.cwd,
+    input.token,
+    [input.token],
+  )
+  const output = runRailway(
+    [
+      'up',
+      '--environment',
+      input.environmentId,
+      '--service',
+      input.serviceName,
+      '--detach',
+      '--json',
+    ],
+    input.cwd,
+    input.token,
+    [input.token],
+  )
+  try {
+    const parsed: unknown = JSON.parse(output)
+    if (parsed && typeof parsed === 'object') {
+      const record = parsed as Record<string, unknown>
+      const deploymentId = record.deploymentId ?? record.deployment_id ?? record.id
+      return typeof deploymentId === 'string' ? deploymentId : null
+    }
+  } catch {
+    return null
+  }
+  return null
+}

package/src/lib/deploy/railway/redaction.ts

@@ -0,0 +1,91 @@
+import { createHash } from 'node:crypto'
+
+const SENSITIVE_KEY_PATTERN = /(secret|token|password|private|credential|encryption|fallback|api[_-]?key|database_url|redis_url)/i
+const CREDENTIAL_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  /\bsk-[A-Za-z0-9_-]{12,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+]
+
+export function fingerprintSecret(value: string): string {
+  return `sha256:${createHash('sha256').update(value).digest('hex').slice(0, 8)}`
+}
+
+export function isSensitiveKey(key: string): boolean {
+  return SENSITIVE_KEY_PATTERN.test(key)
+}
+
+export function detectCredentialValue(value: string, railwayToken?: string): boolean {
+  if (railwayToken && value.includes(railwayToken)) return true
+  return CREDENTIAL_PATTERNS.some((pattern) => pattern.test(value))
+}
+
+export function assertSafeVariables(
+  variables: Record<string, string>,
+  options: { railwayToken?: string; allowedKeys?: string[] } = {},
+): void {
+  const allowedKeys = new Set(options.allowedKeys ?? [])
+  for (const [key, value] of Object.entries(variables)) {
+    if (!allowedKeys.has(key) && detectCredentialValue(value, options.railwayToken)) {
+      throw new Error(
+        `Refusing to upload credential-like value from ${key}. Pass --allow-secret-passthrough ${key} to allow this exact key.`,
+      )
+    }
+  }
+}
+
+export function formatVariableValue(key: string, value: string, railwayToken?: string): string {
+  if (isSensitiveKey(key) || detectCredentialValue(value, railwayToken)) {
+    return `<redacted> (${fingerprintSecret(value)})`
+  }
+  return value
+}
+
+export function redactText(value: string, secrets: string[] = []): string {
+  let redacted = value
+  for (const secret of secrets.filter(Boolean).sort((left, right) => right.length - left.length)) {
+    redacted = redacted.split(secret).join('****')
+  }
+  for (const pattern of CREDENTIAL_PATTERNS) {
+    redacted = redacted.replace(new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`), '****')
+  }
+  return redacted.replace(/Bearer\s+[A-Za-z0-9._~+/-]+/gi, 'Bearer ****')
+}
+
+export function redactStructuredValue(value: unknown, secrets: string[] = []): unknown {
+  if (typeof value === 'string') return redactText(value, secrets)
+  if (Array.isArray(value)) {
+    return value.map((item) => redactStructuredValue(item, secrets))
+  }
+  if (!value || typeof value !== 'object') return value
+  return Object.fromEntries(
+    Object.entries(value as Record<string, unknown>).map(([key, nestedValue]) => [
+      key,
+      isSensitiveKey(key) ? '<redacted>' : redactStructuredValue(nestedValue, secrets),
+    ]),
+  )
+}
+
+export function collectSensitiveStructuredValues(value: unknown): string[] {
+  const collected = new Set<string>()
+
+  function visit(current: unknown): void {
+    if (Array.isArray(current)) {
+      current.forEach(visit)
+      return
+    }
+    if (!current || typeof current !== 'object') return
+    for (const [key, nestedValue] of Object.entries(current as Record<string, unknown>)) {
+      if (isSensitiveKey(key) && typeof nestedValue === 'string' && nestedValue.length > 0) {
+        collected.add(nestedValue)
+      } else {
+        visit(nestedValue)
+      }
+    }
+  }
+
+  visit(value)
+  return Array.from(collected)
+}