@open-mercato/cli 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/dist/lib/deploy/railway/index.js

@@ -0,0 +1,1115 @@
+import { createInterface } from "node:readline/promises";
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import { basename, resolve } from "node:path";
+import { stdin as input, stdout as output } from "node:process";
+import { satisfies } from "semver";
+import {
+  computeRailwayVariables,
+  formatVariablePlan,
+  generateProtectedSecrets,
+  parseEnvFile,
+  resolveEnvFile,
+  writeGeneratedSecrets
+} from "./env.js";
+import { createRailwayGraphqlClient, RailwayGraphqlError } from "./graphql-client.js";
+import { railwayOperations } from "./operations.js";
+import { parseRailwayDeployOptions, railwayDeployHelp } from "./options.js";
+import { collectSensitiveStructuredValues, redactText } from "./redaction.js";
+import { uploadLocalSource } from "./railway-cli.js";
+import {
+  assertLocalUploadSafe,
+  resolveRailwaySource
+} from "./source.js";
+import {
+  createRailwayState,
+  loadRailwayState,
+  railwayStatePath,
+  saveRailwayState
+} from "./state.js";
+import {
+  railwayTokenConfigPath,
+  resolveRailwayToken,
+  writeCachedRailwayToken
+} from "./token.js";
+const SUCCESS_STATUSES = /* @__PURE__ */ new Set(["SUCCESS", "COMPLETED"]);
+const FAILURE_STATUSES = /* @__PURE__ */ new Set(["FAILED", "CRASHED", "REMOVED"]);
+function isNotFoundError(error) {
+  return error instanceof RailwayGraphqlError && (error.status === 404 || error.code === "NOT_FOUND" || error.code?.endsWith("_NOT_FOUND") === true);
+}
+function isAmbiguousMutationError(error) {
+  if (!(error instanceof RailwayGraphqlError)) return true;
+  return error.status === void 0 || error.status >= 500 || error.code === "INTERNAL_ERROR";
+}
+function createPrompt() {
+  const readline = createInterface({ input, output });
+  return {
+    ask: (question) => readline.question(question),
+    close: () => readline.close()
+  };
+}
+function nodes(connection) {
+  return (connection?.edges ?? []).map((edge) => edge?.node).filter((node) => node !== null && node !== void 0);
+}
+function wait(milliseconds) {
+  return new Promise((resolveWait) => setTimeout(resolveWait, milliseconds));
+}
+function normalizeProjectName(value) {
+  const normalized = value.trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, 48).replace(/-+$/g, "");
+  if (!normalized) throw new Error("Unable to derive a valid Railway project name.");
+  return normalized;
+}
+function readAppPackage(cwd) {
+  const packagePath = resolve(cwd, "package.json");
+  if (!existsSync(packagePath)) throw new Error("Run this command from an Open Mercato app root.");
+  const parsed = JSON.parse(readFileSync(packagePath, "utf8"));
+  if (!parsed || typeof parsed !== "object") throw new Error("Invalid package.json.");
+  const record = parsed;
+  const dependencies = {
+    ...record.dependencies && typeof record.dependencies === "object" ? record.dependencies : {},
+    ...record.devDependencies && typeof record.devDependencies === "object" ? record.devDependencies : {}
+  };
+  if (!Object.keys(dependencies).some((key) => key.startsWith("@open-mercato/"))) {
+    throw new Error("The current package does not declare Open Mercato dependencies.");
+  }
+  return {
+    name: typeof record.name === "string" && record.name.trim() ? record.name : basename(cwd),
+    dependencies,
+    nodeEngine: record.engines && typeof record.engines === "object" && typeof record.engines.node === "string" ? record.engines.node : void 0
+  };
+}
+function assertSupportedNodeVersion(nodeEngine) {
+  if (!nodeEngine) return;
+  if (!satisfies(process.version, nodeEngine)) {
+    throw new Error(
+      `Node ${process.version} does not satisfy this app's required version "${nodeEngine}".`
+    );
+  }
+}
+function ensureEnvironmentState(state, name) {
+  state.environments[name] ??= {};
+  return state.environments[name];
+}
+function persistState(path, state) {
+  saveRailwayState(path, state);
+}
+async function resolveTokenInteractively(options, prompt) {
+  const configPath = railwayTokenConfigPath();
+  const resolved = resolveRailwayToken({ flagToken: options.token, configPath });
+  if (resolved.token) return { token: resolved.token, cached: resolved.source === "cache" };
+  if (options.nonInteractive || !prompt) {
+    const compatibilityHint = process.env.RAILWAY_TOKEN ? " RAILWAY_TOKEN is project-scoped; use RAILWAY_API_TOKEN for account/workspace operations." : "";
+    throw new Error(`Railway Account token is required.${compatibilityHint}`);
+  }
+  console.log("Create a token at https://railway.com/account/tokens (Account Settings -> Tokens).");
+  const token = (await prompt.ask("Railway Account token: ")).trim();
+  if (!token) throw new Error("Railway Account token is required.");
+  const persist = (await prompt.ask("Cache this token in ~/.config/open-mercato/railway.json? [y/N] ")).trim().toLowerCase();
+  if (persist === "y" || persist === "yes") {
+    writeCachedRailwayToken(configPath, token);
+    return { token, cached: true };
+  }
+  return { token, cached: false };
+}
+async function resolveWorkspace(client, preferredWorkspaceId) {
+  let data;
+  try {
+    data = await client.request(railwayOperations.me);
+  } catch (error) {
+    if (error instanceof RailwayGraphqlError && (error.status === 401 || error.status === 403 || error.code === "UNAUTHORIZED")) {
+      throw new Error(
+        "Token rejected. Generate a Railway Account token at https://railway.com/account/tokens."
+      );
+    }
+    throw error;
+  }
+  const workspaces = data.me.workspaces ?? [];
+  const workspace = preferredWorkspaceId ? workspaces.find((candidate) => candidate.id === preferredWorkspaceId) : workspaces[0];
+  if (preferredWorkspaceId && !workspace) {
+    throw new Error("The recorded Railway workspace is no longer accessible to this Account token.");
+  }
+  if (!workspace) throw new Error("The Railway account has no accessible workspace.");
+  return { userId: data.me.id, workspaceId: workspace.id };
+}
+async function findProjectByName(client, workspaceId, projectName) {
+  const data = await client.request(railwayOperations.projects, { workspaceId });
+  return nodes(data.projects).find((project) => project.name === projectName) ?? null;
+}
+async function ensureProject(input2) {
+  if (input2.state.projectId) {
+    try {
+      const data = await input2.client.request(
+        railwayOperations.project,
+        { id: input2.state.projectId }
+      );
+      if (data.project.workspaceId && data.project.workspaceId !== input2.workspaceId) {
+        throw new Error("Recorded Railway project belongs to a different workspace.");
+      }
+      if (data.project.name !== input2.state.projectName) {
+        if (!input2.options.forceRename) {
+          throw new Error(
+            `Recorded Railway project is named "${data.project.name}". Use --force-rename to rename it.`
+          );
+        }
+        await input2.client.request(railwayOperations.projectUpdate, {
+          id: data.project.id,
+          input: { name: input2.state.projectName }
+        });
+      }
+      return data.project.id;
+    } catch (error) {
+      if (!isNotFoundError(error)) throw error;
+      input2.state.projectId = void 0;
+    }
+  }
+  const existing = await findProjectByName(
+    input2.client,
+    input2.workspaceId,
+    input2.state.projectName
+  );
+  if (existing) {
+    input2.state.projectId = existing.id;
+    persistState(input2.statePath, input2.state);
+    return existing.id;
+  }
+  try {
+    const data = await input2.client.request(railwayOperations.projectCreate, {
+      input: {
+        name: input2.state.projectName,
+        description: "Open Mercato deployment managed by mercato deploy railway",
+        workspaceId: input2.workspaceId
+      }
+    });
+    input2.state.projectId = data.projectCreate.id;
+  } catch (error) {
+    const discovered = await findProjectByName(
+      input2.client,
+      input2.workspaceId,
+      input2.state.projectName
+    );
+    if (!discovered) throw error;
+    input2.state.projectId = discovered.id;
+  }
+  persistState(input2.statePath, input2.state);
+  return input2.state.projectId;
+}
+async function ensureEnvironment(input2) {
+  if (input2.environmentState.environmentId) {
+    try {
+      const data2 = await input2.client.request(
+        railwayOperations.environment,
+        { id: input2.environmentState.environmentId, projectId: input2.projectId }
+      );
+      return data2.environment.id;
+    } catch (error) {
+      if (!isNotFoundError(error)) throw error;
+      input2.environmentState.environmentId = void 0;
+    }
+  }
+  const data = await input2.client.request(railwayOperations.environments, { projectId: input2.projectId });
+  const existing = nodes(data.environments).find((environment) => environment.name === input2.name);
+  if (existing) {
+    input2.environmentState.environmentId = existing.id;
+    input2.persist();
+    return existing.id;
+  }
+  try {
+    const created = await input2.client.request(
+      railwayOperations.environmentCreate,
+      { input: { projectId: input2.projectId, name: input2.name } }
+    );
+    input2.environmentState.environmentId = created.environmentCreate.id;
+  } catch (error) {
+    const retryLookup = await input2.client.request(railwayOperations.environments, { projectId: input2.projectId });
+    const discovered = nodes(retryLookup.environments).find((environment) => environment.name === input2.name);
+    if (!discovered) throw error;
+    input2.environmentState.environmentId = discovered.id;
+  }
+  input2.persist();
+  return input2.environmentState.environmentId;
+}
+async function listServices(client, projectId) {
+  const data = await client.request(railwayOperations.services, { projectId });
+  return nodes(data.project.services);
+}
+async function waitForService(client, projectId, name, timeoutMs = 18e4) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const service = (await listServices(client, projectId)).find((candidate) => candidate.name === name);
+    if (service) return service;
+    await wait(5e3);
+  }
+  throw new Error(`Timed out waiting for Railway service "${name}". Re-run the command to resume.`);
+}
+async function ensureDatabaseReady(input2) {
+  const previous = await latestDeployment(
+    input2.client,
+    input2.projectId,
+    input2.environmentId,
+    input2.serviceId
+  );
+  if (previous && SUCCESS_STATUSES.has(previous.status)) return;
+  if (previous && !FAILURE_STATUSES.has(previous.status)) {
+    await waitForDeployment({
+      client: input2.client,
+      deploymentId: previous.id,
+      timeoutSeconds: 180,
+      prefix: input2.name,
+      secrets: []
+    });
+    return;
+  }
+  let triggerError;
+  try {
+    await input2.client.request(railwayOperations.deploy, {
+      environmentId: input2.environmentId,
+      serviceId: input2.serviceId,
+      commitSha: null
+    });
+  } catch (error) {
+    if (!isAmbiguousMutationError(error)) throw error;
+    triggerError = error;
+  }
+  const deadline = Date.now() + 3e4;
+  while (Date.now() < deadline) {
+    const current = await latestDeployment(
+      input2.client,
+      input2.projectId,
+      input2.environmentId,
+      input2.serviceId
+    );
+    if (current && current.id !== previous?.id) {
+      await waitForDeployment({
+        client: input2.client,
+        deploymentId: current.id,
+        timeoutSeconds: 180,
+        prefix: input2.name,
+        secrets: []
+      });
+      return;
+    }
+    await wait(2e3);
+  }
+  if (triggerError) throw triggerError;
+  throw new Error(`Railway did not expose a ${input2.name} deployment in this environment.`);
+}
+async function ensureDatabase(input2) {
+  if (input2.currentId) {
+    try {
+      const data = await input2.client.request(
+        railwayOperations.service,
+        { id: input2.currentId }
+      );
+      if (data.service.projectId !== input2.projectId) {
+        throw new Error(`Recorded ${input2.name} service belongs to a different Railway project.`);
+      }
+      await ensureDatabaseReady({
+        client: input2.client,
+        projectId: input2.projectId,
+        environmentId: input2.environmentId,
+        serviceId: data.service.id,
+        name: input2.name
+      });
+      return data.service.id;
+    } catch (error) {
+      if (!isNotFoundError(error)) throw error;
+    }
+  }
+  const existing = (await listServices(input2.client, input2.projectId)).find((service) => service.name === input2.name);
+  if (existing) {
+    await ensureDatabaseReady({
+      client: input2.client,
+      projectId: input2.projectId,
+      environmentId: input2.environmentId,
+      serviceId: existing.id,
+      name: input2.name
+    });
+    input2.onResolved(existing.id);
+    return existing.id;
+  }
+  const templateData = await input2.client.request(railwayOperations.template, { code: input2.code });
+  if (!templateData.template.serializedConfig) {
+    throw new Error(`Railway template "${input2.code}" does not expose a deployable configuration.`);
+  }
+  try {
+    await input2.client.request(railwayOperations.templateDeploy, {
+      input: {
+        projectId: input2.projectId,
+        environmentId: input2.environmentId,
+        workspaceId: input2.workspaceId,
+        templateId: templateData.template.id,
+        serializedConfig: templateData.template.serializedConfig
+      }
+    });
+  } catch (error) {
+    const discovered = (await listServices(input2.client, input2.projectId)).find((service) => service.name === input2.name);
+    if (!discovered) throw error;
+  }
+  const created = await waitForService(input2.client, input2.projectId, input2.name);
+  const readinessDeadline = Date.now() + 18e4;
+  let ready = false;
+  while (Date.now() < readinessDeadline) {
+    const deployment = await latestDeployment(
+      input2.client,
+      input2.projectId,
+      input2.environmentId,
+      created.id
+    );
+    if (deployment && SUCCESS_STATUSES.has(deployment.status)) {
+      ready = true;
+      break;
+    }
+    if (deployment && FAILURE_STATUSES.has(deployment.status)) {
+      throw new Error(`${input2.name} provisioning failed with status ${deployment.status}.`);
+    }
+    await wait(5e3);
+  }
+  if (!ready) {
+    throw new Error(`Timed out waiting for ${input2.name} to become ready. Re-run the command to resume.`);
+  }
+  input2.onResolved(created.id);
+  return created.id;
+}
+async function ensureService(input2) {
+  let serviceId;
+  let createdService = false;
+  if (input2.currentId) {
+    try {
+      const data = await input2.client.request(
+        railwayOperations.service,
+        { id: input2.currentId }
+      );
+      if (data.service.projectId !== input2.projectId) {
+        throw new Error(`Recorded ${input2.name} service belongs to a different Railway project.`);
+      }
+      serviceId = data.service.id;
+    } catch (error) {
+      if (!isNotFoundError(error)) throw error;
+    }
+  }
+  if (!serviceId) {
+    const existing = (await listServices(input2.client, input2.projectId)).find((service) => service.name === input2.name);
+    serviceId = existing?.id;
+  }
+  if (!serviceId) {
+    const serviceInput = {
+      projectId: input2.projectId,
+      name: input2.name
+    };
+    if (input2.source.mode === "git") {
+      serviceInput.source = { repo: input2.source.repo };
+      serviceInput.branch = input2.source.branch;
+    }
+    try {
+      const created = await input2.client.request(
+        railwayOperations.serviceCreate,
+        { input: serviceInput }
+      );
+      serviceId = created.serviceCreate.id;
+      createdService = true;
+    } catch (error) {
+      const discovered = (await listServices(input2.client, input2.projectId)).find((service) => service.name === input2.name);
+      if (!discovered) throw error;
+      serviceId = discovered.id;
+    }
+  }
+  if (input2.source.mode === "git" && !createdService) {
+    await input2.client.request(railwayOperations.serviceConnect, {
+      id: serviceId,
+      input: {
+        repo: input2.source.repo,
+        branch: input2.source.branch
+      }
+    });
+  } else if (input2.source.mode === "local" && input2.previousSource?.mode === "git") {
+    await input2.client.request(railwayOperations.serviceDisconnect, { id: serviceId });
+  }
+  if (input2.startCommand || input2.region || input2.railwayConfigFile) {
+    await input2.client.request(railwayOperations.serviceInstanceUpdate, {
+      environmentId: input2.environmentId,
+      serviceId,
+      input: {
+        ...input2.startCommand ? { startCommand: input2.startCommand } : {},
+        ...input2.region ? { region: input2.region } : {},
+        ...input2.railwayConfigFile ? { railwayConfigFile: input2.railwayConfigFile } : {}
+      }
+    });
+  }
+  input2.onResolved(serviceId);
+  return serviceId;
+}
+async function removeDisabledWorker(input2) {
+  if (!input2.workerServiceId) return;
+  try {
+    const data = await input2.client.request(railwayOperations.service, { id: input2.workerServiceId });
+    if (data.service.projectId !== input2.projectId || data.service.name !== "mercato-worker") {
+      throw new Error("Recorded worker service does not match the managed Railway project.");
+    }
+  } catch (error) {
+    if (isNotFoundError(error)) return;
+    throw error;
+  }
+  try {
+    await input2.client.request(railwayOperations.serviceDelete, {
+      id: input2.workerServiceId,
+      environmentId: input2.environmentId
+    });
+  } catch (error) {
+    try {
+      await input2.client.request(railwayOperations.service, { id: input2.workerServiceId });
+    } catch (lookupError) {
+      if (isNotFoundError(lookupError)) return;
+      throw lookupError;
+    }
+    throw error;
+  }
+}
+async function upsertVariables(input2) {
+  await input2.client.request(railwayOperations.variableUpsert, {
+    input: {
+      projectId: input2.projectId,
+      environmentId: input2.environmentId,
+      serviceId: input2.serviceId,
+      variables: input2.variables,
+      replace: false,
+      skipDeploys: true
+    }
+  });
+}
+async function loadVariables(input2) {
+  const data = await input2.client.request(
+    railwayOperations.variables,
+    {
+      projectId: input2.projectId,
+      environmentId: input2.environmentId,
+      serviceId: input2.serviceId
+    }
+  );
+  if (!data.variables || typeof data.variables !== "object" || Array.isArray(data.variables)) return {};
+  return Object.fromEntries(
+    Object.entries(data.variables).filter((entry) => typeof entry[1] === "string")
+  );
+}
+async function latestDeployment(client, projectId, environmentId, serviceId) {
+  const data = await client.request(railwayOperations.deployments, { projectId, environmentId, serviceId });
+  return nodes(data.deployments)[0] ?? null;
+}
+async function printDeploymentLogs(client, deploymentId, prefix, secrets) {
+  for (const operation of [railwayOperations.buildLogs, railwayOperations.deploymentLogs]) {
+    try {
+      const data = await client.request(
+        operation,
+        { deploymentId, limit: 100 }
+      );
+      const logKey = operation === railwayOperations.buildLogs ? "buildLogs" : "deploymentLogs";
+      for (const entry of data[logKey] ?? []) {
+        if (entry.message) console.log(`[${prefix}] ${redactText(entry.message, secrets)}`);
+      }
+    } catch {
+    }
+  }
+}
+async function waitForDeployment(input2) {
+  const deadline = Date.now() + input2.timeoutSeconds * 1e3;
+  let lastStatus = "UNKNOWN";
+  while (Date.now() < deadline) {
+    const data = await input2.client.request(
+      railwayOperations.deployment,
+      { id: input2.deploymentId }
+    );
+    lastStatus = data.deployment.status;
+    if (SUCCESS_STATUSES.has(lastStatus)) return data.deployment;
+    if (FAILURE_STATUSES.has(lastStatus)) {
+      await printDeploymentLogs(
+        input2.client,
+        input2.deploymentId,
+        input2.prefix,
+        input2.secrets
+      );
+      throw new Error(`${input2.prefix} deployment failed with status ${lastStatus}.`);
+    }
+    await wait(5e3);
+  }
+  throw new Error(
+    `Timed out waiting for ${input2.prefix} deployment. Last status: ${lastStatus}. Re-run the command to resume.`
+  );
+}
+async function deployService(input2) {
+  const previous = await latestDeployment(
+    input2.client,
+    input2.projectId,
+    input2.environmentId,
+    input2.serviceId
+  );
+  let deploymentId = null;
+  let triggerError;
+  try {
+    if (input2.source.mode === "git") {
+      await input2.client.request(railwayOperations.deploy, {
+        environmentId: input2.environmentId,
+        serviceId: input2.serviceId,
+        commitSha: input2.source.commitSha
+      });
+    } else {
+      deploymentId = uploadLocalSource({
+        cwd: input2.cwd,
+        projectId: input2.projectId,
+        environmentId: input2.environmentId,
+        serviceId: input2.serviceId,
+        serviceName: input2.serviceName,
+        token: input2.token
+      });
+    }
+  } catch (error) {
+    if (!isAmbiguousMutationError(error)) throw error;
+    triggerError = error;
+  }
+  if (!deploymentId) {
+    const deadline = Date.now() + 3e4;
+    while (Date.now() < deadline) {
+      const current = await latestDeployment(
+        input2.client,
+        input2.projectId,
+        input2.environmentId,
+        input2.serviceId
+      );
+      if (current && current.id !== previous?.id) {
+        deploymentId = current.id;
+        break;
+      }
+      await wait(2e3);
+    }
+  }
+  if (!deploymentId) {
+    if (triggerError) throw triggerError;
+    throw new Error(`Railway did not expose a new deployment for ${input2.serviceName}.`);
+  }
+  return waitForDeployment({
+    client: input2.client,
+    deploymentId,
+    timeoutSeconds: input2.timeoutSeconds,
+    prefix: input2.serviceName,
+    secrets: [input2.token, ...input2.secrets]
+  });
+}
+function collectSensitiveValues(variables) {
+  return collectSensitiveStructuredValues(variables);
+}
+async function ensureDomain(input2) {
+  const existingData = await input2.client.request(railwayOperations.domains, {
+    projectId: input2.projectId,
+    environmentId: input2.environmentId,
+    serviceId: input2.serviceId
+  });
+  if (!input2.customDomain && input2.currentDomainId) {
+    const existingCustomDomain = existingData.domains.customDomains?.find(
+      (candidate) => candidate.id === input2.currentDomainId
+    );
+    if (existingCustomDomain) {
+      return {
+        id: existingCustomDomain.id,
+        url: `https://${existingCustomDomain.domain}`
+      };
+    }
+    const existingRecordedServiceDomain = existingData.domains.serviceDomains?.find(
+      (candidate) => candidate.id === input2.currentDomainId
+    );
+    if (existingRecordedServiceDomain) {
+      return {
+        id: existingRecordedServiceDomain.id,
+        url: `https://${existingRecordedServiceDomain.domain}`
+      };
+    }
+  }
+  if (input2.customDomain) {
+    const existingDomain = existingData.domains.customDomains?.find(
+      (candidate) => candidate.domain === input2.customDomain
+    );
+    let domain;
+    if (existingDomain) {
+      domain = existingDomain;
+    } else {
+      try {
+        const data = await input2.client.request(
+          railwayOperations.customDomainCreate,
+          {
+            input: {
+              projectId: input2.projectId,
+              environmentId: input2.environmentId,
+              serviceId: input2.serviceId,
+              domain: input2.customDomain,
+              targetPort: 3e3
+            }
+          }
+        );
+        domain = data.customDomainCreate;
+      } catch (error) {
+        const discovered = await input2.client.request(railwayOperations.domains, {
+          projectId: input2.projectId,
+          environmentId: input2.environmentId,
+          serviceId: input2.serviceId
+        });
+        const created = discovered.domains.customDomains?.find(
+          (candidate) => candidate.domain === input2.customDomain
+        );
+        if (!created) throw error;
+        domain = created;
+      }
+    }
+    const records = domain.status?.dnsRecords ?? [];
+    if (records.length > 0) {
+      console.log("Configure these DNS records:");
+      for (const record of records) {
+        console.log(`  ${record.recordType ?? "DNS"} ${record.hostlabel ?? "@"} -> ${record.requiredValue ?? ""}`);
+      }
+    }
+    if (input2.waitForVerification && !domain.status?.verified) {
+      const deadline = Date.now() + 3e5;
+      while (Date.now() < deadline) {
+        await wait(1e4);
+        const refreshed = await input2.client.request(
+          railwayOperations.customDomain,
+          { id: domain.id, projectId: input2.projectId }
+        );
+        domain = refreshed.customDomain;
+        if (domain.status?.verified) break;
+      }
+      if (!domain.status?.verified) {
+        console.warn("DNS not yet propagated. The deployment succeeded; re-run later to verify the domain.");
+      }
+    }
+    return {
+      id: domain.id,
+      url: `https://${domain.domain}`
+    };
+  }
+  const existingServiceDomain = existingData.domains.serviceDomains?.[0];
+  if (existingServiceDomain) {
+    return {
+      id: existingServiceDomain.id,
+      url: `https://${existingServiceDomain.domain}`
+    };
+  }
+  let createdDomain;
+  try {
+    const data = await input2.client.request(railwayOperations.serviceDomainCreate, {
+      input: {
+        environmentId: input2.environmentId,
+        serviceId: input2.serviceId,
+        targetPort: 3e3
+      }
+    });
+    createdDomain = data.serviceDomainCreate;
+  } catch (error) {
+    const discovered = await input2.client.request(railwayOperations.domains, {
+      projectId: input2.projectId,
+      environmentId: input2.environmentId,
+      serviceId: input2.serviceId
+    });
+    const created = discovered.domains.serviceDomains?.[0];
+    if (!created) throw error;
+    createdDomain = created;
+  }
+  return {
+    id: createdDomain.id,
+    url: `https://${createdDomain.domain}`
+  };
+}
+async function cleanupProject(input2) {
+  if (!input2.state.projectId) throw new Error("The Railway state file does not contain a project ID.");
+  if (input2.state.workspaceId && input2.state.workspaceId !== input2.workspaceId) {
+    throw new Error("Recorded Railway project belongs to a different workspace.");
+  }
+  const projectData = await input2.client.request(railwayOperations.project, { id: input2.state.projectId });
+  if (projectData.project.name !== input2.state.projectName || projectData.project.workspaceId && projectData.project.workspaceId !== input2.workspaceId) {
+    throw new Error("Recorded Railway project identity does not match the cleanup target.");
+  }
+  if (!input2.options.yes) {
+    if (input2.options.nonInteractive || !input2.prompt) {
+      throw new Error("--cleanup requires --yes in non-interactive mode.");
+    }
+    console.log(`Project: ${input2.state.projectName} (${input2.state.projectId})`);
+    for (const [name, environment] of Object.entries(input2.state.environments)) {
+      console.log(`  ${name}: ${environment.appUrl ?? "no recorded URL"}`);
+    }
+    const confirmation = await input2.prompt.ask(`Type "${input2.state.projectName}" to delete this project: `);
+    if (confirmation.trim() !== input2.state.projectName) throw new Error("Cleanup cancelled.");
+  }
+  await input2.client.request(railwayOperations.projectDelete, { id: input2.state.projectId });
+  if (existsSync(input2.statePath)) unlinkSync(input2.statePath);
+  console.log(`Deleted Railway project ${input2.state.projectName}.`);
+}
+function printDryRun(input2) {
+  console.log("Railway deployment plan (dry run)");
+  console.log(`  Project: ${input2.state.projectName}`);
+  console.log(`  Environment: ${input2.options.environment}`);
+  console.log(`  Source: ${input2.source.mode} (${input2.source.reason})`);
+  console.log(`  Env file: ${input2.envFile}`);
+  console.log("  Operations:");
+  console.log("    - validate Railway account and workspace");
+  console.log("    - create or reuse project and environment");
+  console.log("    - provision Postgres and Redis from Railway templates");
+  console.log(`    - create or reuse ${input2.options.service}`);
+  if (input2.options.worker) console.log("    - create or reuse mercato-worker");
+  if (!input2.options.worker && input2.state.environments[input2.options.environment]?.workerServiceId) {
+    console.log("    - delete the recorded managed mercato-worker service");
+  }
+  console.log("    - upsert service variables");
+  console.log(`    - deploy via ${input2.source.mode === "git" ? "Railway Git source" : "railway up"}`);
+  console.log("    - create a Railway or custom domain and redeploy the app");
+  if (input2.options.volume) console.log(`    - create volume mounted at ${input2.options.volume}`);
+  console.log("  App variables:");
+  for (const line of formatVariablePlan(input2.appVariables, input2.options.token)) console.log(`    ${line}`);
+  if (input2.workerVariables) {
+    console.log("  Worker variables:");
+    for (const line of formatVariablePlan(input2.workerVariables, input2.options.token)) console.log(`    ${line}`);
+  }
+}
+async function runRailwayDeploy(args, dependencies = {}) {
+  const options = parseRailwayDeployOptions(args);
+  if (options.help) {
+    console.log(railwayDeployHelp());
+    return;
+  }
+  const cwd = dependencies.cwd ?? process.cwd();
+  const appPackage = readAppPackage(cwd);
+  assertSupportedNodeVersion(appPackage.nodeEngine);
+  const statePath = railwayStatePath(cwd, options.track);
+  const loadedState = loadRailwayState(statePath);
+  const requestedName = normalizeProjectName(options.project || appPackage.name);
+  const state = loadedState ?? createRailwayState(requestedName, process.env.npm_package_version || "unknown");
+  if (options.cleanup && !state.projectId) {
+    throw new Error("The Railway state file does not contain a project ID.");
+  }
+  if (loadedState && options.project && requestedName !== loadedState.projectName) {
+    if (!options.forceRename) {
+      throw new Error(
+        `State records project "${loadedState.projectName}". Pass --force-rename to use "${requestedName}".`
+      );
+    }
+    state.projectName = requestedName;
+  }
+  const environmentState = ensureEnvironmentState(state, options.environment);
+  const source = options.cleanup ? { mode: "local", reason: "cleanup does not deploy source" } : (dependencies.resolveSource ?? resolveRailwaySource)(options.source, cwd);
+  if (options.cleanup && options.dryRun) {
+    console.log("Railway cleanup plan (dry run)");
+    console.log(`  Project: ${state.projectName} (${state.projectId})`);
+    console.log(`  State: ${statePath}`);
+    console.log("  Operation: projectDelete");
+    return;
+  }
+  if (!options.cleanup && !options.dryRun) {
+    console.log(`Source: ${source.mode} (${source.reason})`);
+  }
+  if (!options.cleanup && source.mode === "local") assertLocalUploadSafe(cwd);
+  const envFile = options.cleanup ? "" : resolveEnvFile(cwd, options.envFile);
+  const localEnv = options.cleanup ? {} : parseEnvFile(readFileSync(envFile, "utf8"));
+  let protectedSecrets = options.dryRun ? {
+    AUTH_SECRET: "generated-at-deploy",
+    JWT_SECRET: "generated-at-deploy",
+    TENANT_DATA_ENCRYPTION_FALLBACK_KEY: "generated-at-deploy"
+  } : generateProtectedSecrets(localEnv);
+  let appVariables = computeRailwayVariables({
+    env: localEnv,
+    role: "app",
+    workerEnabled: options.worker,
+    protectedSecrets,
+    railwayToken: options.token || process.env.RAILWAY_API_TOKEN,
+    allowedSecretKeys: options.allowedSecretKeys
+  });
+  let workerVariables = options.worker ? computeRailwayVariables({
+    env: localEnv,
+    role: "worker",
+    workerEnabled: true,
+    protectedSecrets,
+    railwayToken: options.token || process.env.RAILWAY_API_TOKEN,
+    allowedSecretKeys: options.allowedSecretKeys
+  }) : void 0;
+  if (options.dryRun) {
+    printDryRun({ state, options, source, envFile, appVariables, workerVariables });
+    return;
+  }
+  const ownsPrompt = dependencies.prompt === void 0;
+  const prompt = dependencies.prompt === void 0 ? !options.nonInteractive && process.stdin.isTTY ? createPrompt() : null : dependencies.prompt;
+  try {
+    const tokenResult = await resolveTokenInteractively(options, prompt);
+    const client = createRailwayGraphqlClient({
+      token: tokenResult.token,
+      verbose: options.verbose
+    });
+    console.log("Step 1: Authenticate with Railway");
+    const { workspaceId } = await resolveWorkspace(client, state.workspaceId);
+    if (options.cleanup) {
+      await cleanupProject({ client, state, statePath, options, prompt, workspaceId });
+      return;
+    }
+    state.workspaceId = workspaceId;
+    persistState(statePath, state);
+    console.log("Step 2: Resolve workspace");
+    console.log(`Step 3: Create or look up project "${state.projectName}"`);
+    const projectId = await ensureProject({ client, state, statePath, workspaceId, options });
+    console.log(`Step 4: Create or look up environment "${options.environment}"`);
+    const environmentId = await ensureEnvironment({
+      client,
+      projectId,
+      name: options.environment,
+      environmentState,
+      persist: () => persistState(statePath, state)
+    });
+    if (options.region) {
+      const regionData = await client.request(
+        railwayOperations.regions,
+        { projectId }
+      );
+      if (!regionData.regions.some(
+        (region) => region.id === options.region || region.region === options.region
+      )) {
+        throw new Error(`Unknown Railway region "${options.region}".`);
+      }
+    }
+    console.log("Step 5: Provision managed Postgres and Redis");
+    await ensureDatabase({
+      client,
+      projectId,
+      environmentId,
+      workspaceId,
+      name: "Postgres",
+      code: "postgres",
+      currentId: environmentState.postgresServiceId,
+      onResolved: (id) => {
+        environmentState.postgresServiceId = id;
+        persistState(statePath, state);
+      }
+    });
+    await ensureDatabase({
+      client,
+      projectId,
+      environmentId,
+      workspaceId,
+      name: "Redis",
+      code: "redis",
+      currentId: environmentState.redisServiceId,
+      onResolved: (id) => {
+        environmentState.redisServiceId = id;
+        persistState(statePath, state);
+      }
+    });
+    console.log("Step 6: Create app and worker services");
+    const previousSource = environmentState.source;
+    const appServiceId = await ensureService({
+      client,
+      projectId,
+      environmentId,
+      name: options.service,
+      source,
+      currentId: environmentState.appServiceId,
+      previousSource,
+      startCommand: "sh ./scripts/railway-start.sh",
+      region: options.region,
+      railwayConfigFile: "railway.toml",
+      onResolved: (id) => {
+        environmentState.appServiceId = id;
+        environmentState.source = source;
+        persistState(statePath, state);
+      }
+    });
+    const workerServiceId = options.worker ? await ensureService({
+      client,
+      projectId,
+      environmentId,
+      name: "mercato-worker",
+      source,
+      currentId: environmentState.workerServiceId,
+      previousSource,
+      startCommand: "sh ./scripts/railway-worker.sh",
+      region: options.region,
+      railwayConfigFile: "railway.worker.toml",
+      onResolved: (id) => {
+        environmentState.workerServiceId = id;
+        persistState(statePath, state);
+      }
+    }) : void 0;
+    if (!options.worker && environmentState.workerServiceId) {
+      await removeDisabledWorker({
+        client,
+        projectId,
+        environmentId,
+        workerServiceId: environmentState.workerServiceId
+      });
+      environmentState.workerServiceId = void 0;
+      if (environmentState.lastDeployIds) {
+        delete environmentState.lastDeployIds.worker;
+      }
+      persistState(statePath, state);
+    }
+    if (options.volume) {
+      if (environmentState.volumeId) {
+        const volumeData = await client.request(railwayOperations.volumes, { projectId });
+        const recordedVolume = nodes(volumeData.project.volumes).find(
+          (volume) => volume.id === environmentState.volumeId && nodes(volume.volumeInstances).some(
+            (instance) => instance.environmentId === environmentId && instance.serviceId === appServiceId && instance.mountPath === options.volume
+          )
+        );
+        if (!recordedVolume) environmentState.volumeId = void 0;
+      }
+    }
+    if (options.volume && !environmentState.volumeId) {
+      try {
+        const volumeData = await client.request(
+          railwayOperations.volumeCreate,
+          {
+            input: {
+              projectId,
+              environmentId,
+              serviceId: appServiceId,
+              mountPath: options.volume
+            }
+          }
+        );
+        environmentState.volumeId = volumeData.volumeCreate.id;
+      } catch (error) {
+        const volumeData = await client.request(railwayOperations.volumes, { projectId });
+        const discovered = nodes(volumeData.project.volumes).find(
+          (volume) => nodes(volume.volumeInstances).some(
+            (instance) => instance.environmentId === environmentId && instance.serviceId === appServiceId && instance.mountPath === options.volume
+          )
+        );
+        if (!discovered) throw error;
+        environmentState.volumeId = discovered.id;
+      }
+      persistState(statePath, state);
+    }
+    if (!options.volume) {
+      console.warn(
+        "Attachments uploaded to this deployment will be lost on redeploy. Re-run with --volume /app/storage to enable persistent storage."
+      );
+    }
+    console.log("Step 7: Compute and upload environment variables");
+    const existingVariables = await loadVariables({
+      client,
+      projectId,
+      environmentId,
+      serviceId: appServiceId
+    });
+    protectedSecrets = generateProtectedSecrets({ ...localEnv, ...existingVariables });
+    appVariables = computeRailwayVariables({
+      env: localEnv,
+      role: "app",
+      workerEnabled: options.worker,
+      protectedSecrets,
+      railwayToken: tokenResult.token,
+      allowedSecretKeys: options.allowedSecretKeys
+    });
+    workerVariables = options.worker ? computeRailwayVariables({
+      env: localEnv,
+      role: "worker",
+      workerEnabled: true,
+      protectedSecrets,
+      railwayToken: tokenResult.token,
+      allowedSecretKeys: options.allowedSecretKeys
+    }) : void 0;
+    await upsertVariables({ client, projectId, environmentId, serviceId: appServiceId, variables: appVariables });
+    if (workerServiceId && workerVariables) {
+      await upsertVariables({
+        client,
+        projectId,
+        environmentId,
+        serviceId: workerServiceId,
+        variables: workerVariables
+      });
+    }
+    if (options.writeEnv) writeGeneratedSecrets(envFile, protectedSecrets);
+    console.log("Step 8: Trigger deployment and monitor status");
+    const appDeployment = await deployService({
+      client,
+      cwd,
+      source,
+      projectId,
+      environmentId,
+      serviceId: appServiceId,
+      serviceName: options.service,
+      timeoutSeconds: options.timeoutSeconds,
+      token: tokenResult.token,
+      secrets: collectSensitiveValues(appVariables)
+    });
+    environmentState.lastDeployIds ??= {};
+    environmentState.lastDeployIds.app = appDeployment.id;
+    persistState(statePath, state);
+    if (workerServiceId) {
+      const workerDeployment = await deployService({
+        client,
+        cwd,
+        source,
+        projectId,
+        environmentId,
+        serviceId: workerServiceId,
+        serviceName: "mercato-worker",
+        timeoutSeconds: options.timeoutSeconds,
+        token: tokenResult.token,
+        secrets: collectSensitiveValues(workerVariables ?? {})
+      });
+      environmentState.lastDeployIds.worker = workerDeployment.id;
+      persistState(statePath, state);
+    }
+    console.log("Step 9: Provision public domain");
+    const domain = await ensureDomain({
+      client,
+      projectId,
+      environmentId,
+      serviceId: appServiceId,
+      customDomain: options.domain,
+      waitForVerification: options.waitDomain,
+      currentDomainId: environmentState.domainId
+    });
+    environmentState.domainId = domain.id;
+    environmentState.appUrl = domain.url;
+    persistState(statePath, state);
+    const finalAppVariables = { ...appVariables, APP_URL: domain.url, NEXT_PUBLIC_APP_URL: domain.url };
+    await upsertVariables({
+      client,
+      projectId,
+      environmentId,
+      serviceId: appServiceId,
+      variables: finalAppVariables
+    });
+    const finalDeployment = await deployService({
+      client,
+      cwd,
+      source,
+      projectId,
+      environmentId,
+      serviceId: appServiceId,
+      serviceName: options.service,
+      timeoutSeconds: options.timeoutSeconds,
+      token: tokenResult.token,
+      secrets: collectSensitiveValues(finalAppVariables)
+    });
+    environmentState.lastDeployIds.app = finalDeployment.id;
+    persistState(statePath, state);
+    console.log("Step 10: Deployment complete");
+    console.log("");
+    console.log("Open Mercato deployed to Railway");
+    console.log(`  Project:     https://railway.com/project/${projectId}`);
+    console.log(`  Environment: ${options.environment}`);
+    console.log(`  Source:      ${source.mode}`);
+    console.log(`  App URL:     ${domain.url}`);
+    console.log(`  Health:      ${domain.url}/api/healthz`);
+    if (workerServiceId) console.log("  Worker:      mercato-worker (running)");
+    console.log(`  State:       ${statePath}`);
+    if (tokenResult.cached) console.log(`  Token cache: ${railwayTokenConfigPath()}`);
+    console.log("");
+    console.log(`DEPLOY_URL=${domain.url}`);
+  } finally {
+    if (ownsPrompt) prompt?.close();
+  }
+}
+export {
+  computeRailwayVariables,
+  formatVariablePlan,
+  generateProtectedSecrets,
+  parseEnvFile,
+  parseRailwayDeployOptions,
+  railwayDeployHelp,
+  resolveEnvFile,
+  runRailwayDeploy
+};
+//# sourceMappingURL=index.js.map