@open-mercato/cli 0.6.5-develop.5116.1.f0af9e5080 → 0.6.5-develop.5155.1.148d10a46d

package/dist/lib/deploy/railway/railway-cli.js

@@ -0,0 +1,61 @@
+import { spawnSync } from "node:child_process";
+import { redactText } from "./redaction.js";
+function runRailway(args, cwd, token, secrets) {
+  const result = spawnSync("railway", args, {
+    cwd,
+    encoding: "utf8",
+    env: { ...process.env, RAILWAY_API_TOKEN: token },
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const output = `${result.stdout ?? ""}
+${result.stderr ?? ""}`.trim();
+  if (result.status !== 0) {
+    throw new Error(redactText(output || `railway ${args[0] ?? ""} failed`, secrets));
+  }
+  return output;
+}
+function uploadLocalSource(input) {
+  runRailway(
+    [
+      "link",
+      "--project",
+      input.projectId,
+      "--environment",
+      input.environmentId,
+      "--service",
+      input.serviceId
+    ],
+    input.cwd,
+    input.token,
+    [input.token]
+  );
+  const output = runRailway(
+    [
+      "up",
+      "--environment",
+      input.environmentId,
+      "--service",
+      input.serviceName,
+      "--detach",
+      "--json"
+    ],
+    input.cwd,
+    input.token,
+    [input.token]
+  );
+  try {
+    const parsed = JSON.parse(output);
+    if (parsed && typeof parsed === "object") {
+      const record = parsed;
+      const deploymentId = record.deploymentId ?? record.deployment_id ?? record.id;
+      return typeof deploymentId === "string" ? deploymentId : null;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+export {
+  uploadLocalSource
+};
+//# sourceMappingURL=railway-cli.js.map

package/dist/lib/deploy/railway/railway-cli.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/lib/deploy/railway/railway-cli.ts"],
+  "sourcesContent": ["import { spawnSync } from 'node:child_process'\nimport { redactText } from './redaction'\n\nfunction runRailway(args: string[], cwd: string, token: string, secrets: string[]): string {\n  const result = spawnSync('railway', args, {\n    cwd,\n    encoding: 'utf8',\n    env: { ...process.env, RAILWAY_API_TOKEN: token },\n    stdio: ['ignore', 'pipe', 'pipe'],\n  })\n  const output = `${result.stdout ?? ''}\\n${result.stderr ?? ''}`.trim()\n  if (result.status !== 0) {\n    throw new Error(redactText(output || `railway ${args[0] ?? ''} failed`, secrets))\n  }\n  return output\n}\n\nexport function uploadLocalSource(input: {\n  cwd: string\n  projectId: string\n  environmentId: string\n  serviceId: string\n  serviceName: string\n  token: string\n}): string | null {\n  runRailway(\n    [\n      'link',\n      '--project',\n      input.projectId,\n      '--environment',\n      input.environmentId,\n      '--service',\n      input.serviceId,\n    ],\n    input.cwd,\n    input.token,\n    [input.token],\n  )\n  const output = runRailway(\n    [\n      'up',\n      '--environment',\n      input.environmentId,\n      '--service',\n      input.serviceName,\n      '--detach',\n      '--json',\n    ],\n    input.cwd,\n    input.token,\n    [input.token],\n  )\n  try {\n    const parsed: unknown = JSON.parse(output)\n    if (parsed && typeof parsed === 'object') {\n      const record = parsed as Record<string, unknown>\n      const deploymentId = record.deploymentId ?? record.deployment_id ?? record.id\n      return typeof deploymentId === 'string' ? deploymentId : null\n    }\n  } catch {\n    return null\n  }\n  return null\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAE3B,SAAS,WAAW,MAAgB,KAAa,OAAe,SAA2B;AACzF,QAAM,SAAS,UAAU,WAAW,MAAM;AAAA,IACxC;AAAA,IACA,UAAU;AAAA,IACV,KAAK,EAAE,GAAG,QAAQ,KAAK,mBAAmB,MAAM;AAAA,IAChD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,EAClC,CAAC;AACD,QAAM,SAAS,GAAG,OAAO,UAAU,EAAE;AAAA,EAAK,OAAO,UAAU,EAAE,GAAG,KAAK;AACrE,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,WAAW,UAAU,WAAW,KAAK,CAAC,KAAK,EAAE,WAAW,OAAO,CAAC;AAAA,EAClF;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,OAOhB;AAChB;AAAA,IACE;AAAA,MACE;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,IACR;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,CAAC,MAAM,KAAK;AAAA,EACd;AACA,QAAM,SAAS;AAAA,IACb;AAAA,MACE;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,CAAC,MAAM,KAAK;AAAA,EACd;AACA,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,MAAM;AACzC,QAAI,UAAU,OAAO,WAAW,UAAU;AACxC,YAAM,SAAS;AACf,YAAM,eAAe,OAAO,gBAAgB,OAAO,iBAAiB,OAAO;AAC3E,aAAO,OAAO,iBAAiB,WAAW,eAAe;AAAA,IAC3D;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/lib/deploy/railway/redaction.js

@@ -0,0 +1,88 @@
+import { createHash } from "node:crypto";
+const SENSITIVE_KEY_PATTERN = /(secret|token|password|private|credential|encryption|fallback|api[_-]?key|database_url|redis_url)/i;
+const CREDENTIAL_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  /\bsk-[A-Za-z0-9_-]{12,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/,
+  /\bAKIA[0-9A-Z]{16}\b/
+];
+function fingerprintSecret(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex").slice(0, 8)}`;
+}
+function isSensitiveKey(key) {
+  return SENSITIVE_KEY_PATTERN.test(key);
+}
+function detectCredentialValue(value, railwayToken) {
+  if (railwayToken && value.includes(railwayToken)) return true;
+  return CREDENTIAL_PATTERNS.some((pattern) => pattern.test(value));
+}
+function assertSafeVariables(variables, options = {}) {
+  const allowedKeys = new Set(options.allowedKeys ?? []);
+  for (const [key, value] of Object.entries(variables)) {
+    if (!allowedKeys.has(key) && detectCredentialValue(value, options.railwayToken)) {
+      throw new Error(
+        `Refusing to upload credential-like value from ${key}. Pass --allow-secret-passthrough ${key} to allow this exact key.`
+      );
+    }
+  }
+}
+function formatVariableValue(key, value, railwayToken) {
+  if (isSensitiveKey(key) || detectCredentialValue(value, railwayToken)) {
+    return `<redacted> (${fingerprintSecret(value)})`;
+  }
+  return value;
+}
+function redactText(value, secrets = []) {
+  let redacted = value;
+  for (const secret of secrets.filter(Boolean).sort((left, right) => right.length - left.length)) {
+    redacted = redacted.split(secret).join("****");
+  }
+  for (const pattern of CREDENTIAL_PATTERNS) {
+    redacted = redacted.replace(new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`), "****");
+  }
+  return redacted.replace(/Bearer\s+[A-Za-z0-9._~+/-]+/gi, "Bearer ****");
+}
+function redactStructuredValue(value, secrets = []) {
+  if (typeof value === "string") return redactText(value, secrets);
+  if (Array.isArray(value)) {
+    return value.map((item) => redactStructuredValue(item, secrets));
+  }
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, nestedValue]) => [
+      key,
+      isSensitiveKey(key) ? "<redacted>" : redactStructuredValue(nestedValue, secrets)
+    ])
+  );
+}
+function collectSensitiveStructuredValues(value) {
+  const collected = /* @__PURE__ */ new Set();
+  function visit(current) {
+    if (Array.isArray(current)) {
+      current.forEach(visit);
+      return;
+    }
+    if (!current || typeof current !== "object") return;
+    for (const [key, nestedValue] of Object.entries(current)) {
+      if (isSensitiveKey(key) && typeof nestedValue === "string" && nestedValue.length > 0) {
+        collected.add(nestedValue);
+      } else {
+        visit(nestedValue);
+      }
+    }
+  }
+  visit(value);
+  return Array.from(collected);
+}
+export {
+  assertSafeVariables,
+  collectSensitiveStructuredValues,
+  detectCredentialValue,
+  fingerprintSecret,
+  formatVariableValue,
+  isSensitiveKey,
+  redactStructuredValue,
+  redactText
+};
+//# sourceMappingURL=redaction.js.map

package/dist/lib/deploy/railway/redaction.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/lib/deploy/railway/redaction.ts"],
+  "sourcesContent": ["import { createHash } from 'node:crypto'\n\nconst SENSITIVE_KEY_PATTERN = /(secret|token|password|private|credential|encryption|fallback|api[_-]?key|database_url|redis_url)/i\nconst CREDENTIAL_PATTERNS = [\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,\n  /\\bsk-[A-Za-z0-9_-]{12,}\\b/,\n  /\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b/,\n  /\\bgh[pousr]_[A-Za-z0-9]{20,}\\b/,\n  /\\bAKIA[0-9A-Z]{16}\\b/,\n]\n\nexport function fingerprintSecret(value: string): string {\n  return `sha256:${createHash('sha256').update(value).digest('hex').slice(0, 8)}`\n}\n\nexport function isSensitiveKey(key: string): boolean {\n  return SENSITIVE_KEY_PATTERN.test(key)\n}\n\nexport function detectCredentialValue(value: string, railwayToken?: string): boolean {\n  if (railwayToken && value.includes(railwayToken)) return true\n  return CREDENTIAL_PATTERNS.some((pattern) => pattern.test(value))\n}\n\nexport function assertSafeVariables(\n  variables: Record<string, string>,\n  options: { railwayToken?: string; allowedKeys?: string[] } = {},\n): void {\n  const allowedKeys = new Set(options.allowedKeys ?? [])\n  for (const [key, value] of Object.entries(variables)) {\n    if (!allowedKeys.has(key) && detectCredentialValue(value, options.railwayToken)) {\n      throw new Error(\n        `Refusing to upload credential-like value from ${key}. Pass --allow-secret-passthrough ${key} to allow this exact key.`,\n      )\n    }\n  }\n}\n\nexport function formatVariableValue(key: string, value: string, railwayToken?: string): string {\n  if (isSensitiveKey(key) || detectCredentialValue(value, railwayToken)) {\n    return `<redacted> (${fingerprintSecret(value)})`\n  }\n  return value\n}\n\nexport function redactText(value: string, secrets: string[] = []): string {\n  let redacted = value\n  for (const secret of secrets.filter(Boolean).sort((left, right) => right.length - left.length)) {\n    redacted = redacted.split(secret).join('****')\n  }\n  for (const pattern of CREDENTIAL_PATTERNS) {\n    redacted = redacted.replace(new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`), '****')\n  }\n  return redacted.replace(/Bearer\\s+[A-Za-z0-9._~+/-]+/gi, 'Bearer ****')\n}\n\nexport function redactStructuredValue(value: unknown, secrets: string[] = []): unknown {\n  if (typeof value === 'string') return redactText(value, secrets)\n  if (Array.isArray(value)) {\n    return value.map((item) => redactStructuredValue(item, secrets))\n  }\n  if (!value || typeof value !== 'object') return value\n  return Object.fromEntries(\n    Object.entries(value as Record<string, unknown>).map(([key, nestedValue]) => [\n      key,\n      isSensitiveKey(key) ? '<redacted>' : redactStructuredValue(nestedValue, secrets),\n    ]),\n  )\n}\n\nexport function collectSensitiveStructuredValues(value: unknown): string[] {\n  const collected = new Set<string>()\n\n  function visit(current: unknown): void {\n    if (Array.isArray(current)) {\n      current.forEach(visit)\n      return\n    }\n    if (!current || typeof current !== 'object') return\n    for (const [key, nestedValue] of Object.entries(current as Record<string, unknown>)) {\n      if (isSensitiveKey(key) && typeof nestedValue === 'string' && nestedValue.length > 0) {\n        collected.add(nestedValue)\n      } else {\n        visit(nestedValue)\n      }\n    }\n  }\n\n  visit(value)\n  return Array.from(collected)\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,MAAM,wBAAwB;AAC9B,MAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,kBAAkB,OAAuB;AACvD,SAAO,UAAU,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;AAC/E;AAEO,SAAS,eAAe,KAAsB;AACnD,SAAO,sBAAsB,KAAK,GAAG;AACvC;AAEO,SAAS,sBAAsB,OAAe,cAAgC;AACnF,MAAI,gBAAgB,MAAM,SAAS,YAAY,EAAG,QAAO;AACzD,SAAO,oBAAoB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClE;AAEO,SAAS,oBACd,WACA,UAA6D,CAAC,GACxD;AACN,QAAM,cAAc,IAAI,IAAI,QAAQ,eAAe,CAAC,CAAC;AACrD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,SAAS,GAAG;AACpD,QAAI,CAAC,YAAY,IAAI,GAAG,KAAK,sBAAsB,OAAO,QAAQ,YAAY,GAAG;AAC/E,YAAM,IAAI;AAAA,QACR,iDAAiD,GAAG,qCAAqC,GAAG;AAAA,MAC9F;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,oBAAoB,KAAa,OAAe,cAA+B;AAC7F,MAAI,eAAe,GAAG,KAAK,sBAAsB,OAAO,YAAY,GAAG;AACrE,WAAO,eAAe,kBAAkB,KAAK,CAAC;AAAA,EAChD;AACA,SAAO;AACT;AAEO,SAAS,WAAW,OAAe,UAAoB,CAAC,GAAW;AACxE,MAAI,WAAW;AACf,aAAW,UAAU,QAAQ,OAAO,OAAO,EAAE,KAAK,CAAC,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM,GAAG;AAC9F,eAAW,SAAS,MAAM,MAAM,EAAE,KAAK,MAAM;AAAA,EAC/C;AACA,aAAW,WAAW,qBAAqB;AACzC,eAAW,SAAS,QAAQ,IAAI,OAAO,QAAQ,QAAQ,QAAQ,MAAM,SAAS,GAAG,IAAI,QAAQ,QAAQ,GAAG,QAAQ,KAAK,GAAG,GAAG,MAAM;AAAA,EACnI;AACA,SAAO,SAAS,QAAQ,iCAAiC,aAAa;AACxE;AAEO,SAAS,sBAAsB,OAAgB,UAAoB,CAAC,GAAY;AACrF,MAAI,OAAO,UAAU,SAAU,QAAO,WAAW,OAAO,OAAO;AAC/D,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,SAAS,sBAAsB,MAAM,OAAO,CAAC;AAAA,EACjE;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAgC,EAAE,IAAI,CAAC,CAAC,KAAK,WAAW,MAAM;AAAA,MAC3E;AAAA,MACA,eAAe,GAAG,IAAI,eAAe,sBAAsB,aAAa,OAAO;AAAA,IACjF,CAAC;AAAA,EACH;AACF;AAEO,SAAS,iCAAiC,OAA0B;AACzE,QAAM,YAAY,oBAAI,IAAY;AAElC,WAAS,MAAM,SAAwB;AACrC,QAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,cAAQ,QAAQ,KAAK;AACrB;AAAA,IACF;AACA,QAAI,CAAC,WAAW,OAAO,YAAY,SAAU;AAC7C,eAAW,CAAC,KAAK,WAAW,KAAK,OAAO,QAAQ,OAAkC,GAAG;AACnF,UAAI,eAAe,GAAG,KAAK,OAAO,gBAAgB,YAAY,YAAY,SAAS,GAAG;AACpF,kBAAU,IAAI,WAAW;AAAA,MAC3B,OAAO;AACL,cAAM,WAAW;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK;AACX,SAAO,MAAM,KAAK,SAAS;AAC7B;",
+  "names": []
+}

package/dist/lib/deploy/railway/source.js

@@ -0,0 +1,128 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+const defaultRunner = (command, args, cwd) => execFileSync(command, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+function tryRun(runner, command, args, cwd) {
+  try {
+    return runner(command, args, cwd);
+  } catch {
+    return null;
+  }
+}
+function normalizeGitRepository(remoteUrl) {
+  const trimmed = remoteUrl.trim().replace(/\.git$/, "");
+  const sshMatch = trimmed.match(/^git@github\.com:([^/]+\/[^/]+)$/);
+  if (sshMatch) return sshMatch[1] ?? null;
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.hostname !== "github.com") return null;
+    return parsed.pathname.replace(/^\/+/, "") || null;
+  } catch {
+    return null;
+  }
+}
+function inspectGitSource(cwd, runner = defaultRunner) {
+  const branch = tryRun(runner, "git", ["branch", "--show-current"], cwd);
+  const remoteUrl = tryRun(runner, "git", ["remote", "get-url", "origin"], cwd);
+  if (!branch || !remoteUrl) return null;
+  const repo = normalizeGitRepository(remoteUrl);
+  if (!repo) return null;
+  const commitSha = tryRun(runner, "git", ["rev-parse", "HEAD"], cwd) ?? void 0;
+  return {
+    mode: "git",
+    reason: `GitHub remote origin and branch ${branch} detected`,
+    repo,
+    branch,
+    commitSha
+  };
+}
+function assertGitDeployReady(cwd, runner = defaultRunner) {
+  const status = tryRun(runner, "git", ["status", "--porcelain"], cwd);
+  if (status === null) throw new Error("Git is required for --source git.");
+  if (status.length > 0) throw new Error("Git-backed deploy requires a clean working tree.");
+  const upstream = tryRun(runner, "git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], cwd);
+  if (!upstream) throw new Error("The current branch has no upstream. Push it before a Git-backed deploy.");
+  const ahead = tryRun(runner, "git", ["rev-list", "--count", "@{u}..HEAD"], cwd);
+  if (ahead === null || Number.parseInt(ahead, 10) > 0) {
+    throw new Error("The current branch has local commits that are not pushed to its upstream.");
+  }
+  const behind = tryRun(runner, "git", ["rev-list", "--count", "HEAD..@{u}"], cwd);
+  if (behind === null || Number.parseInt(behind, 10) > 0) {
+    throw new Error("The current branch is behind its upstream. Pull the latest commits before a Git-backed deploy.");
+  }
+}
+function isRailwayCliAvailable(cwd, runner = defaultRunner) {
+  return tryRun(runner, "railway", ["--version"], cwd) !== null;
+}
+function resolveRailwaySource(mode, cwd, runner = defaultRunner) {
+  const gitSource = inspectGitSource(cwd, runner);
+  if (mode === "git") {
+    if (!gitSource) {
+      throw new Error("--source git requires a GitHub origin remote and a current branch.");
+    }
+    assertGitDeployReady(cwd, runner);
+    return gitSource;
+  }
+  if (mode === "local") {
+    if (!isRailwayCliAvailable(cwd, runner)) {
+      throw new Error("--source local requires the Railway CLI. Install it from https://docs.railway.com/reference/cli-api.");
+    }
+    return { mode: "local", reason: "Local upload explicitly requested" };
+  }
+  if (gitSource) {
+    try {
+      assertGitDeployReady(cwd, runner);
+      return gitSource;
+    } catch (error) {
+      if (!isRailwayCliAvailable(cwd, runner)) throw error;
+      const reason = error instanceof Error ? error.message : "Git source is not deployable";
+      return {
+        mode: "local",
+        reason: `${reason} Falling back to railway up.`
+      };
+    }
+  }
+  if (!isRailwayCliAvailable(cwd, runner)) {
+    throw new Error("No usable GitHub remote found and the Railway CLI is unavailable for local upload.");
+  }
+  return { mode: "local", reason: "No usable GitHub remote found; falling back to railway up" };
+}
+const REQUIRED_IGNORE_ENTRIES = [
+  { label: ".env", matches: (line) => line === ".env" || line === ".env*" },
+  { label: ".env.*", matches: (line) => line === ".env.*" || line === ".env*" },
+  { label: "*.pem", matches: (line) => line === "*.pem" },
+  { label: "*.key", matches: (line) => line === "*.key" },
+  { label: "id_rsa", matches: (line) => line === "id_*" || line === "id_rsa" },
+  { label: "id_ed25519", matches: (line) => line === "id_*" || line === "id_ed25519" },
+  { label: ".git", matches: (line) => line === ".git" },
+  { label: ".railway", matches: (line) => line === ".railway" },
+  { label: "node_modules", matches: (line) => line === "node_modules" },
+  { label: ".yarn/cache", matches: (line) => line === ".yarn/cache" },
+  { label: ".next", matches: (line) => line === ".next" },
+  { label: ".turbo", matches: (line) => line === ".turbo" },
+  { label: "*.db", matches: (line) => line === "*.db" },
+  { label: "*.sqlite", matches: (line) => line === "*.sqlite" || line === "*.sqlite*" },
+  { label: "*.sqlite3", matches: (line) => line === "*.sqlite3" || line === "*.sqlite*" },
+  { label: ".mercato/railway.json", matches: (line) => line === ".mercato/railway.json" || line === ".mercato/railway.json*" },
+  { label: ".mercato/railway.json.local", matches: (line) => line === ".mercato/railway.json.local" || line === ".mercato/railway.json*" }
+];
+function assertLocalUploadSafe(cwd) {
+  const ignorePath = resolve(cwd, ".railwayignore");
+  if (!existsSync(ignorePath)) {
+    throw new Error("Local Railway upload requires a .railwayignore file.");
+  }
+  const entries = readFileSync(ignorePath, "utf8").split(/\r?\n/).map((line) => line.trim().replace(/^\/+|\/+$/g, "")).filter((line) => line.length > 0 && !line.startsWith("#") && !line.startsWith("!"));
+  const missing = REQUIRED_IGNORE_ENTRIES.filter((requirement) => !entries.some(requirement.matches)).map((requirement) => requirement.label);
+  if (missing.length > 0) {
+    throw new Error(`.railwayignore is missing required safety entries: ${missing.join(", ")}`);
+  }
+}
+export {
+  assertGitDeployReady,
+  assertLocalUploadSafe,
+  inspectGitSource,
+  isRailwayCliAvailable,
+  normalizeGitRepository,
+  resolveRailwaySource
+};
+//# sourceMappingURL=source.js.map

package/dist/lib/deploy/railway/source.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/lib/deploy/railway/source.ts"],
+  "sourcesContent": ["import { execFileSync } from 'node:child_process'\nimport { existsSync, readFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\nimport type { RailwaySource, RailwaySourceMode } from './types'\n\ntype CommandRunner = (command: string, args: string[], cwd: string) => string\n\nconst defaultRunner: CommandRunner = (command, args, cwd) =>\n  execFileSync(command, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim()\n\nfunction tryRun(runner: CommandRunner, command: string, args: string[], cwd: string): string | null {\n  try {\n    return runner(command, args, cwd)\n  } catch {\n    return null\n  }\n}\n\nexport function normalizeGitRepository(remoteUrl: string): string | null {\n  const trimmed = remoteUrl.trim().replace(/\\.git$/, '')\n  const sshMatch = trimmed.match(/^git@github\\.com:([^/]+\\/[^/]+)$/)\n  if (sshMatch) return sshMatch[1] ?? null\n  try {\n    const parsed = new URL(trimmed)\n    if (parsed.hostname !== 'github.com') return null\n    return parsed.pathname.replace(/^\\/+/, '') || null\n  } catch {\n    return null\n  }\n}\n\nexport function inspectGitSource(cwd: string, runner: CommandRunner = defaultRunner): RailwaySource | null {\n  const branch = tryRun(runner, 'git', ['branch', '--show-current'], cwd)\n  const remoteUrl = tryRun(runner, 'git', ['remote', 'get-url', 'origin'], cwd)\n  if (!branch || !remoteUrl) return null\n  const repo = normalizeGitRepository(remoteUrl)\n  if (!repo) return null\n  const commitSha = tryRun(runner, 'git', ['rev-parse', 'HEAD'], cwd) ?? undefined\n  return {\n    mode: 'git',\n    reason: `GitHub remote origin and branch ${branch} detected`,\n    repo,\n    branch,\n    commitSha,\n  }\n}\n\nexport function assertGitDeployReady(cwd: string, runner: CommandRunner = defaultRunner): void {\n  const status = tryRun(runner, 'git', ['status', '--porcelain'], cwd)\n  if (status === null) throw new Error('Git is required for --source git.')\n  if (status.length > 0) throw new Error('Git-backed deploy requires a clean working tree.')\n  const upstream = tryRun(runner, 'git', ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}'], cwd)\n  if (!upstream) throw new Error('The current branch has no upstream. Push it before a Git-backed deploy.')\n  const ahead = tryRun(runner, 'git', ['rev-list', '--count', '@{u}..HEAD'], cwd)\n  if (ahead === null || Number.parseInt(ahead, 10) > 0) {\n    throw new Error('The current branch has local commits that are not pushed to its upstream.')\n  }\n  const behind = tryRun(runner, 'git', ['rev-list', '--count', 'HEAD..@{u}'], cwd)\n  if (behind === null || Number.parseInt(behind, 10) > 0) {\n    throw new Error('The current branch is behind its upstream. Pull the latest commits before a Git-backed deploy.')\n  }\n}\n\nexport function isRailwayCliAvailable(cwd: string, runner: CommandRunner = defaultRunner): boolean {\n  return tryRun(runner, 'railway', ['--version'], cwd) !== null\n}\n\nexport function resolveRailwaySource(\n  mode: RailwaySourceMode,\n  cwd: string,\n  runner: CommandRunner = defaultRunner,\n): RailwaySource {\n  const gitSource = inspectGitSource(cwd, runner)\n  if (mode === 'git') {\n    if (!gitSource) {\n      throw new Error('--source git requires a GitHub origin remote and a current branch.')\n    }\n    assertGitDeployReady(cwd, runner)\n    return gitSource\n  }\n  if (mode === 'local') {\n    if (!isRailwayCliAvailable(cwd, runner)) {\n      throw new Error('--source local requires the Railway CLI. Install it from https://docs.railway.com/reference/cli-api.')\n    }\n    return { mode: 'local', reason: 'Local upload explicitly requested' }\n  }\n  if (gitSource) {\n    try {\n      assertGitDeployReady(cwd, runner)\n      return gitSource\n    } catch (error) {\n      if (!isRailwayCliAvailable(cwd, runner)) throw error\n      const reason = error instanceof Error ? error.message : 'Git source is not deployable'\n      return {\n        mode: 'local',\n        reason: `${reason} Falling back to railway up.`,\n      }\n    }\n  }\n  if (!isRailwayCliAvailable(cwd, runner)) {\n    throw new Error('No usable GitHub remote found and the Railway CLI is unavailable for local upload.')\n  }\n  return { mode: 'local', reason: 'No usable GitHub remote found; falling back to railway up' }\n}\n\nconst REQUIRED_IGNORE_ENTRIES = [\n  { label: '.env', matches: (line: string) => line === '.env' || line === '.env*' },\n  { label: '.env.*', matches: (line: string) => line === '.env.*' || line === '.env*' },\n  { label: '*.pem', matches: (line: string) => line === '*.pem' },\n  { label: '*.key', matches: (line: string) => line === '*.key' },\n  { label: 'id_rsa', matches: (line: string) => line === 'id_*' || line === 'id_rsa' },\n  { label: 'id_ed25519', matches: (line: string) => line === 'id_*' || line === 'id_ed25519' },\n  { label: '.git', matches: (line: string) => line === '.git' },\n  { label: '.railway', matches: (line: string) => line === '.railway' },\n  { label: 'node_modules', matches: (line: string) => line === 'node_modules' },\n  { label: '.yarn/cache', matches: (line: string) => line === '.yarn/cache' },\n  { label: '.next', matches: (line: string) => line === '.next' },\n  { label: '.turbo', matches: (line: string) => line === '.turbo' },\n  { label: '*.db', matches: (line: string) => line === '*.db' },\n  { label: '*.sqlite', matches: (line: string) => line === '*.sqlite' || line === '*.sqlite*' },\n  { label: '*.sqlite3', matches: (line: string) => line === '*.sqlite3' || line === '*.sqlite*' },\n  { label: '.mercato/railway.json', matches: (line: string) =>\n    line === '.mercato/railway.json' || line === '.mercato/railway.json*' },\n  { label: '.mercato/railway.json.local', matches: (line: string) =>\n    line === '.mercato/railway.json.local' || line === '.mercato/railway.json*' },\n]\n\nexport function assertLocalUploadSafe(cwd: string): void {\n  const ignorePath = resolve(cwd, '.railwayignore')\n  if (!existsSync(ignorePath)) {\n    throw new Error('Local Railway upload requires a .railwayignore file.')\n  }\n  const entries = readFileSync(ignorePath, 'utf8')\n    .split(/\\r?\\n/)\n    .map((line) => line.trim().replace(/^\\/+|\\/+$/g, ''))\n    .filter((line) => line.length > 0 && !line.startsWith('#') && !line.startsWith('!'))\n  const missing = REQUIRED_IGNORE_ENTRIES\n    .filter((requirement) => !entries.some(requirement.matches))\n    .map((requirement) => requirement.label)\n  if (missing.length > 0) {\n    throw new Error(`.railwayignore is missing required safety entries: ${missing.join(', ')}`)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AAKxB,MAAM,gBAA+B,CAAC,SAAS,MAAM,QACnD,aAAa,SAAS,MAAM,EAAE,KAAK,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC,EAAE,KAAK;AAEjG,SAAS,OAAO,QAAuB,SAAiB,MAAgB,KAA4B;AAClG,MAAI;AACF,WAAO,OAAO,SAAS,MAAM,GAAG;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBAAuB,WAAkC;AACvE,QAAM,UAAU,UAAU,KAAK,EAAE,QAAQ,UAAU,EAAE;AACrD,QAAM,WAAW,QAAQ,MAAM,kCAAkC;AACjE,MAAI,SAAU,QAAO,SAAS,CAAC,KAAK;AACpC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO;AAC9B,QAAI,OAAO,aAAa,aAAc,QAAO;AAC7C,WAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE,KAAK;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iBAAiB,KAAa,SAAwB,eAAqC;AACzG,QAAM,SAAS,OAAO,QAAQ,OAAO,CAAC,UAAU,gBAAgB,GAAG,GAAG;AACtE,QAAM,YAAY,OAAO,QAAQ,OAAO,CAAC,UAAU,WAAW,QAAQ,GAAG,GAAG;AAC5E,MAAI,CAAC,UAAU,CAAC,UAAW,QAAO;AAClC,QAAM,OAAO,uBAAuB,SAAS;AAC7C,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,YAAY,OAAO,QAAQ,OAAO,CAAC,aAAa,MAAM,GAAG,GAAG,KAAK;AACvE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,mCAAmC,MAAM;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,KAAa,SAAwB,eAAqB;AAC7F,QAAM,SAAS,OAAO,QAAQ,OAAO,CAAC,UAAU,aAAa,GAAG,GAAG;AACnE,MAAI,WAAW,KAAM,OAAM,IAAI,MAAM,mCAAmC;AACxE,MAAI,OAAO,SAAS,EAAG,OAAM,IAAI,MAAM,kDAAkD;AACzF,QAAM,WAAW,OAAO,QAAQ,OAAO,CAAC,aAAa,gBAAgB,wBAAwB,MAAM,GAAG,GAAG;AACzG,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,yEAAyE;AACxG,QAAM,QAAQ,OAAO,QAAQ,OAAO,CAAC,YAAY,WAAW,YAAY,GAAG,GAAG;AAC9E,MAAI,UAAU,QAAQ,OAAO,SAAS,OAAO,EAAE,IAAI,GAAG;AACpD,UAAM,IAAI,MAAM,2EAA2E;AAAA,EAC7F;AACA,QAAM,SAAS,OAAO,QAAQ,OAAO,CAAC,YAAY,WAAW,YAAY,GAAG,GAAG;AAC/E,MAAI,WAAW,QAAQ,OAAO,SAAS,QAAQ,EAAE,IAAI,GAAG;AACtD,UAAM,IAAI,MAAM,gGAAgG;AAAA,EAClH;AACF;AAEO,SAAS,sBAAsB,KAAa,SAAwB,eAAwB;AACjG,SAAO,OAAO,QAAQ,WAAW,CAAC,WAAW,GAAG,GAAG,MAAM;AAC3D;AAEO,SAAS,qBACd,MACA,KACA,SAAwB,eACT;AACf,QAAM,YAAY,iBAAiB,KAAK,MAAM;AAC9C,MAAI,SAAS,OAAO;AAClB,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AACA,yBAAqB,KAAK,MAAM;AAChC,WAAO;AAAA,EACT;AACA,MAAI,SAAS,SAAS;AACpB,QAAI,CAAC,sBAAsB,KAAK,MAAM,GAAG;AACvC,YAAM,IAAI,MAAM,sGAAsG;AAAA,IACxH;AACA,WAAO,EAAE,MAAM,SAAS,QAAQ,oCAAoC;AAAA,EACtE;AACA,MAAI,WAAW;AACb,QAAI;AACF,2BAAqB,KAAK,MAAM;AAChC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,CAAC,sBAAsB,KAAK,MAAM,EAAG,OAAM;AAC/C,YAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AACxD,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ,GAAG,MAAM;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,sBAAsB,KAAK,MAAM,GAAG;AACvC,UAAM,IAAI,MAAM,oFAAoF;AAAA,EACtG;AACA,SAAO,EAAE,MAAM,SAAS,QAAQ,4DAA4D;AAC9F;AAEA,MAAM,0BAA0B;AAAA,EAC9B,EAAE,OAAO,QAAQ,SAAS,CAAC,SAAiB,SAAS,UAAU,SAAS,QAAQ;AAAA,EAChF,EAAE,OAAO,UAAU,SAAS,CAAC,SAAiB,SAAS,YAAY,SAAS,QAAQ;AAAA,EACpF,EAAE,OAAO,SAAS,SAAS,CAAC,SAAiB,SAAS,QAAQ;AAAA,EAC9D,EAAE,OAAO,SAAS,SAAS,CAAC,SAAiB,SAAS,QAAQ;AAAA,EAC9D,EAAE,OAAO,UAAU,SAAS,CAAC,SAAiB,SAAS,UAAU,SAAS,SAAS;AAAA,EACnF,EAAE,OAAO,cAAc,SAAS,CAAC,SAAiB,SAAS,UAAU,SAAS,aAAa;AAAA,EAC3F,EAAE,OAAO,QAAQ,SAAS,CAAC,SAAiB,SAAS,OAAO;AAAA,EAC5D,EAAE,OAAO,YAAY,SAAS,CAAC,SAAiB,SAAS,WAAW;AAAA,EACpE,EAAE,OAAO,gBAAgB,SAAS,CAAC,SAAiB,SAAS,eAAe;AAAA,EAC5E,EAAE,OAAO,eAAe,SAAS,CAAC,SAAiB,SAAS,cAAc;AAAA,EAC1E,EAAE,OAAO,SAAS,SAAS,CAAC,SAAiB,SAAS,QAAQ;AAAA,EAC9D,EAAE,OAAO,UAAU,SAAS,CAAC,SAAiB,SAAS,SAAS;AAAA,EAChE,EAAE,OAAO,QAAQ,SAAS,CAAC,SAAiB,SAAS,OAAO;AAAA,EAC5D,EAAE,OAAO,YAAY,SAAS,CAAC,SAAiB,SAAS,cAAc,SAAS,YAAY;AAAA,EAC5F,EAAE,OAAO,aAAa,SAAS,CAAC,SAAiB,SAAS,eAAe,SAAS,YAAY;AAAA,EAC9F,EAAE,OAAO,yBAAyB,SAAS,CAAC,SAC1C,SAAS,2BAA2B,SAAS,yBAAyB;AAAA,EACxE,EAAE,OAAO,+BAA+B,SAAS,CAAC,SAChD,SAAS,iCAAiC,SAAS,yBAAyB;AAChF;AAEO,SAAS,sBAAsB,KAAmB;AACvD,QAAM,aAAa,QAAQ,KAAK,gBAAgB;AAChD,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,UAAU,aAAa,YAAY,MAAM,EAC5C,MAAM,OAAO,EACb,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,cAAc,EAAE,CAAC,EACnD,OAAO,CAAC,SAAS,KAAK,SAAS,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,CAAC;AACrF,QAAM,UAAU,wBACb,OAAO,CAAC,gBAAgB,CAAC,QAAQ,KAAK,YAAY,OAAO,CAAC,EAC1D,IAAI,CAAC,gBAAgB,YAAY,KAAK;AACzC,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,MAAM,sDAAsD,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EAC5F;AACF;",
+  "names": []
+}

package/dist/lib/deploy/railway/state.js

@@ -0,0 +1,41 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+function railwayStatePath(cwd, track) {
+  return resolve(cwd, ".mercato", track ? "railway.json" : "railway.json.local");
+}
+function isRailwayState(value) {
+  if (!value || typeof value !== "object") return false;
+  const record = value;
+  return record.schemaVersion === 1 && record.provider === "railway" && typeof record.projectName === "string" && typeof record.environments === "object" && record.environments !== null;
+}
+function loadRailwayState(path) {
+  if (!existsSync(path)) return null;
+  const parsed = JSON.parse(readFileSync(path, "utf8"));
+  if (!isRailwayState(parsed)) {
+    throw new Error(`Unsupported or invalid Railway state file: ${path}`);
+  }
+  return parsed;
+}
+function createRailwayState(projectName, cliVersion) {
+  return {
+    schemaVersion: 1,
+    provider: "railway",
+    projectName,
+    environments: {},
+    writtenBy: { cliVersion }
+  };
+}
+function saveRailwayState(path, state) {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporaryPath = `${path}.tmp`;
+  writeFileSync(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+  renameSync(temporaryPath, path);
+}
+export {
+  createRailwayState,
+  loadRailwayState,
+  railwayStatePath,
+  saveRailwayState
+};
+//# sourceMappingURL=state.js.map

package/dist/lib/deploy/railway/state.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/lib/deploy/railway/state.ts"],
+  "sourcesContent": ["import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport type { RailwayState } from './types'\n\nexport function railwayStatePath(cwd: string, track: boolean): string {\n  return resolve(cwd, '.mercato', track ? 'railway.json' : 'railway.json.local')\n}\n\nfunction isRailwayState(value: unknown): value is RailwayState {\n  if (!value || typeof value !== 'object') return false\n  const record = value as Record<string, unknown>\n  return (\n    record.schemaVersion === 1 &&\n    record.provider === 'railway' &&\n    typeof record.projectName === 'string' &&\n    typeof record.environments === 'object' &&\n    record.environments !== null\n  )\n}\n\nexport function loadRailwayState(path: string): RailwayState | null {\n  if (!existsSync(path)) return null\n  const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'))\n  if (!isRailwayState(parsed)) {\n    throw new Error(`Unsupported or invalid Railway state file: ${path}`)\n  }\n  return parsed\n}\n\nexport function createRailwayState(projectName: string, cliVersion: string): RailwayState {\n  return {\n    schemaVersion: 1,\n    provider: 'railway',\n    projectName,\n    environments: {},\n    writtenBy: { cliVersion },\n  }\n}\n\nexport function saveRailwayState(path: string, state: RailwayState): void {\n  mkdirSync(dirname(path), { recursive: true })\n  const temporaryPath = `${path}.tmp`\n  writeFileSync(temporaryPath, `${JSON.stringify(state, null, 2)}\\n`, { mode: 0o600 })\n  renameSync(temporaryPath, path)\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,WAAW,cAAc,YAAY,qBAAqB;AAC/E,SAAS,SAAS,eAAe;AAG1B,SAAS,iBAAiB,KAAa,OAAwB;AACpE,SAAO,QAAQ,KAAK,YAAY,QAAQ,iBAAiB,oBAAoB;AAC/E;AAEA,SAAS,eAAe,OAAuC;AAC7D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AACf,SACE,OAAO,kBAAkB,KACzB,OAAO,aAAa,aACpB,OAAO,OAAO,gBAAgB,YAC9B,OAAO,OAAO,iBAAiB,YAC/B,OAAO,iBAAiB;AAE5B;AAEO,SAAS,iBAAiB,MAAmC;AAClE,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,QAAM,SAAkB,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAC7D,MAAI,CAAC,eAAe,MAAM,GAAG;AAC3B,UAAM,IAAI,MAAM,8CAA8C,IAAI,EAAE;AAAA,EACtE;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,aAAqB,YAAkC;AACxF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,UAAU;AAAA,IACV;AAAA,IACA,cAAc,CAAC;AAAA,IACf,WAAW,EAAE,WAAW;AAAA,EAC1B;AACF;AAEO,SAAS,iBAAiB,MAAc,OAA2B;AACxE,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,gBAAgB,GAAG,IAAI;AAC7B,gBAAc,eAAe,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AACnF,aAAW,eAAe,IAAI;AAChC;",
+  "names": []
+}

package/dist/lib/deploy/railway/token.js

@@ -0,0 +1,46 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function railwayTokenConfigPath(environment = process.env, platform = process.platform) {
+  if (platform === "win32") {
+    return join(environment.APPDATA || join(homedir(), "AppData", "Roaming"), "open-mercato", "railway.json");
+  }
+  return join(environment.XDG_CONFIG_HOME || join(homedir(), ".config"), "open-mercato", "railway.json");
+}
+function readCachedRailwayToken(path, platform = process.platform) {
+  if (!existsSync(path)) return null;
+  if (platform !== "win32") {
+    const mode = statSync(path).mode & 511;
+    if ((mode & 63) !== 0) {
+      throw new Error(`Refusing to read ${path}: permissions must be 0600.`);
+    }
+  }
+  const parsed = JSON.parse(readFileSync(path, "utf8"));
+  if (!parsed || typeof parsed !== "object") return null;
+  const token = parsed.token;
+  return typeof token === "string" && token.trim() ? token.trim() : null;
+}
+function writeCachedRailwayToken(path, token) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify({ token }, null, 2)}
+`, { mode: 384 });
+  if (process.platform !== "win32") chmodSync(path, 384);
+}
+function resolveRailwayToken(input) {
+  const environment = input.environment ?? process.env;
+  if (input.flagToken?.trim()) return { token: input.flagToken.trim(), source: "flag" };
+  if (environment.RAILWAY_API_TOKEN?.trim()) {
+    return { token: environment.RAILWAY_API_TOKEN.trim(), source: "environment" };
+  }
+  const configPath = input.configPath ?? railwayTokenConfigPath(environment);
+  const cached = readCachedRailwayToken(configPath);
+  if (cached) return { token: cached, source: "cache" };
+  return { token: null, source: null };
+}
+export {
+  railwayTokenConfigPath,
+  readCachedRailwayToken,
+  resolveRailwayToken,
+  writeCachedRailwayToken
+};
+//# sourceMappingURL=token.js.map

package/dist/lib/deploy/railway/token.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/lib/deploy/railway/token.ts"],
+  "sourcesContent": ["import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { dirname, join } from 'node:path'\n\nexport function railwayTokenConfigPath(\n  environment: NodeJS.ProcessEnv = process.env,\n  platform: NodeJS.Platform = process.platform,\n): string {\n  if (platform === 'win32') {\n    return join(environment.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'open-mercato', 'railway.json')\n  }\n  return join(environment.XDG_CONFIG_HOME || join(homedir(), '.config'), 'open-mercato', 'railway.json')\n}\n\nexport function readCachedRailwayToken(path: string, platform: NodeJS.Platform = process.platform): string | null {\n  if (!existsSync(path)) return null\n  if (platform !== 'win32') {\n    const mode = statSync(path).mode & 0o777\n    if ((mode & 0o077) !== 0) {\n      throw new Error(`Refusing to read ${path}: permissions must be 0600.`)\n    }\n  }\n  const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'))\n  if (!parsed || typeof parsed !== 'object') return null\n  const token = (parsed as Record<string, unknown>).token\n  return typeof token === 'string' && token.trim() ? token.trim() : null\n}\n\nexport function writeCachedRailwayToken(path: string, token: string): void {\n  mkdirSync(dirname(path), { recursive: true })\n  writeFileSync(path, `${JSON.stringify({ token }, null, 2)}\\n`, { mode: 0o600 })\n  if (process.platform !== 'win32') chmodSync(path, 0o600)\n}\n\nexport function resolveRailwayToken(input: {\n  flagToken?: string\n  environment?: NodeJS.ProcessEnv\n  configPath?: string\n}): { token: string | null; source: 'flag' | 'environment' | 'cache' | null } {\n  const environment = input.environment ?? process.env\n  if (input.flagToken?.trim()) return { token: input.flagToken.trim(), source: 'flag' }\n  if (environment.RAILWAY_API_TOKEN?.trim()) {\n    return { token: environment.RAILWAY_API_TOKEN.trim(), source: 'environment' }\n  }\n  const configPath = input.configPath ?? railwayTokenConfigPath(environment)\n  const cached = readCachedRailwayToken(configPath)\n  if (cached) return { token: cached, source: 'cache' }\n  return { token: null, source: null }\n}\n"],
+  "mappings": "AAAA,SAAS,WAAW,YAAY,WAAW,cAAc,UAAU,qBAAqB;AACxF,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AAEvB,SAAS,uBACd,cAAiC,QAAQ,KACzC,WAA4B,QAAQ,UAC5B;AACR,MAAI,aAAa,SAAS;AACxB,WAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,GAAG,WAAW,SAAS,GAAG,gBAAgB,cAAc;AAAA,EAC1G;AACA,SAAO,KAAK,YAAY,mBAAmB,KAAK,QAAQ,GAAG,SAAS,GAAG,gBAAgB,cAAc;AACvG;AAEO,SAAS,uBAAuB,MAAc,WAA4B,QAAQ,UAAyB;AAChH,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI,aAAa,SAAS;AACxB,UAAM,OAAO,SAAS,IAAI,EAAE,OAAO;AACnC,SAAK,OAAO,QAAW,GAAG;AACxB,YAAM,IAAI,MAAM,oBAAoB,IAAI,6BAA6B;AAAA,IACvE;AAAA,EACF;AACA,QAAM,SAAkB,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAC7D,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,QAAS,OAAmC;AAClD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,IAAI,MAAM,KAAK,IAAI;AACpE;AAEO,SAAS,wBAAwB,MAAc,OAAqB;AACzE,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,gBAAc,MAAM,GAAG,KAAK,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E,MAAI,QAAQ,aAAa,QAAS,WAAU,MAAM,GAAK;AACzD;AAEO,SAAS,oBAAoB,OAI0C;AAC5E,QAAM,cAAc,MAAM,eAAe,QAAQ;AACjD,MAAI,MAAM,WAAW,KAAK,EAAG,QAAO,EAAE,OAAO,MAAM,UAAU,KAAK,GAAG,QAAQ,OAAO;AACpF,MAAI,YAAY,mBAAmB,KAAK,GAAG;AACzC,WAAO,EAAE,OAAO,YAAY,kBAAkB,KAAK,GAAG,QAAQ,cAAc;AAAA,EAC9E;AACA,QAAM,aAAa,MAAM,cAAc,uBAAuB,WAAW;AACzE,QAAM,SAAS,uBAAuB,UAAU;AAChD,MAAI,OAAQ,QAAO,EAAE,OAAO,QAAQ,QAAQ,QAAQ;AACpD,SAAO,EAAE,OAAO,MAAM,QAAQ,KAAK;AACrC;",
+  "names": []
+}

package/dist/lib/deploy/railway/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/dist/lib/deploy/railway/types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/mercato.js

@@ -60,7 +60,7 @@ const TURBOPACK_CORRUPTION_PATTERNS = [
   "Unable to open static sorted file",
   "TurbopackInternalError"
 ];
-const BUILTIN_CLI_MODULE_IDS = /* @__PURE__ */ new Set(["queue", "generate", "db", "server", "test"]);
+const BUILTIN_CLI_MODULE_IDS = /* @__PURE__ */ new Set(["queue", "generate", "deploy", "db", "server", "test"]);
 function collectNestedErrors(error, seen = /* @__PURE__ */ new Set()) {
   if (!error || seen.has(error)) {
     return [];
@@ -192,16 +192,16 @@ function isTurbopackCacheCorruption(output) {
 function removeTurbopackDevCache(appDir) {
   fs.rmSync(path.join(appDir, ".mercato", "next", "dev"), { recursive: true, force: true });
 }
-async function ensureEnvLoaded() {
+async function ensureEnvLoaded(options = {}) {
   if (envLoaded) return;
   envLoaded = true;
-  const quietDotenv = process.env.DOTENV_CONFIG_QUIET === "1" || process.env.DOTENV_CONFIG_QUIET === "true";
+  const quietDotenv = options.quiet === true || process.env.DOTENV_CONFIG_QUIET === "1" || process.env.DOTENV_CONFIG_QUIET === "true";
   try {
     const { createResolver } = await import("./lib/resolver.js");
     const resolver = createResolver();
     const appDir = resolver.getAppDir();
     const envPath = path.join(appDir, ".env");
-    if (!fs.existsSync(envPath) && process.env.NODE_ENV !== "production") {
+    if (options.createIfMissing !== false && !fs.existsSync(envPath) && process.env.NODE_ENV !== "production") {
       const examplePath = path.join(appDir, ".env.example");
       if (fs.existsSync(examplePath)) {
         fs.copyFileSync(examplePath, envPath);
@@ -568,9 +568,9 @@ async function buildAllModules() {
   return all;
 }
 async function run(argv = process.argv) {
-  await ensureEnvLoaded();
   const [, , ...parts] = argv;
   const [first, second, ...remaining] = parts;
+  await ensureEnvLoaded({ createIfMissing: first !== "deploy", quiet: first === "deploy" });
   if (first === "init") {
     const { execSync } = await import("child_process");
     console.log("\u{1F680} Initializing Open Mercato app...\n");
@@ -1184,6 +1184,18 @@ async function run(argv = process.argv) {
     }
   }
   const all = modules.slice();
+  all.push({
+    id: "deploy",
+    cli: [
+      {
+        command: "railway",
+        run: async (args) => {
+          const { runRailwayDeploy } = await import("./lib/deploy/railway/index.js");
+          await runRailwayDeploy(args);
+        }
+      }
+    ]
+  });
   all.push({
     id: "queue",
     cli: [
@@ -1976,11 +1988,14 @@ async function run(argv = process.argv) {
   }
   console.log("");
   const started = Date.now();
-  console.log(`\u{1F680} Running ${modName}:${cmdName} ${rest.join(" ")}`);
+  const loggedArgs = modName === "deploy" && cmdName === "railway" ? (await import("./lib/deploy/railway/options.js")).redactRailwayCliArgs(rest) : rest;
+  console.log(`\u{1F680} Running ${modName}:${cmdName} ${loggedArgs.join(" ")}`);
   try {
     await cmd.run(rest);
-    const ms = Date.now() - started;
-    console.log(`\u23F1\uFE0F Done in ${ms}ms`);
+    if (modName !== "deploy" || cmdName !== "railway") {
+      const ms = Date.now() - started;
+      console.log(`\u23F1\uFE0F Done in ${ms}ms`);
+    }
     return 0;
   } catch (e) {
     console.error(`\u{1F4A5} Failed: ${formatCliFailureMessage(modName, cmdName, e)}`);