@open-mercato/cli 0.6.5-develop.5116.1.f0af9e5080 → 0.6.5-develop.5155.1.148d10a46d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.6.5-develop.5116.1.f0af9e5080",
+  "version": "0.6.5-develop.5155.1.148d10a46d",
   "type": "module",
   "main": "./dist/index.js",
   "exports": {
@@ -55,25 +55,25 @@
     "node": "24.x"
   },
   "dependencies": {
-    "@mikro-orm/core": "^7.1.3",
-    "@mikro-orm/decorators": "^7.1.3",
-    "@mikro-orm/migrations": "^7.1.3",
-    "@mikro-orm/postgresql": "^7.1.3",
-    "@open-mercato/queue": "0.6.5-develop.5116.1.f0af9e5080",
-    "@open-mercato/shared": "0.6.5-develop.5116.1.f0af9e5080",
+    "@mikro-orm/core": "^7.1.4",
+    "@mikro-orm/decorators": "^7.1.4",
+    "@mikro-orm/migrations": "^7.1.4",
+    "@mikro-orm/postgresql": "^7.1.4",
+    "@open-mercato/queue": "0.6.5-develop.5155.1.148d10a46d",
+    "@open-mercato/shared": "0.6.5-develop.5155.1.148d10a46d",
     "cross-spawn": "^7.0.6",
     "pg": "8.21.0",
-    "semver": "^7.8.1",
+    "semver": "^7.8.2",
     "testcontainers": "^12.0.1",
     "ts-morph": "^28.0.0",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.5116.1.f0af9e5080"
+    "@open-mercato/shared": "0.6.5-develop.5155.1.148d10a46d"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.5116.1.f0af9e5080",
+    "@open-mercato/shared": "0.6.5-develop.5155.1.148d10a46d",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11"

package/src/bin.ts

@@ -14,6 +14,7 @@ import { run } from './mercato.js'
 const BOOTSTRAP_FREE_COMMANDS = [
   'generate',
   'module',
+  'deploy',
   'db',
   'init',
   'agentic:init',

package/src/lib/deploy/railway/__integration__/TC-CLI-RAILWAY-001.meta.ts

@@ -0,0 +1,3 @@
+export const integrationMeta = {
+  requiredEnvVars: ['RAILWAY_INTEGRATION_TOKEN', 'RAILWAY_INTEGRATION_APP_ROOT'],
+}

package/src/lib/deploy/railway/__integration__/TC-CLI-RAILWAY-001.spec.ts

@@ -0,0 +1,71 @@
+import { execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { expect, test } from '@playwright/test'
+
+const token = process.env.RAILWAY_INTEGRATION_TOKEN
+const appRoot = process.env.RAILWAY_INTEGRATION_APP_ROOT
+const cliBin = resolve(process.cwd(), 'packages/cli/dist/bin.js')
+
+function runCli(args: string[]): string {
+  if (!appRoot || !token) throw new Error('Railway integration environment is incomplete.')
+  return execFileSync(process.execPath, [cliBin, ...args], {
+    cwd: appRoot,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      RAILWAY_API_TOKEN: token,
+      CI: 'true',
+    },
+    timeout: 15 * 60 * 1000,
+  })
+}
+
+test.describe('mercato deploy railway live integration', () => {
+  test.skip(!token || !appRoot, 'RAILWAY_INTEGRATION_TOKEN and RAILWAY_INTEGRATION_APP_ROOT are required')
+
+  test('deploys, verifies health, resumes, and cleans up', async ({ request }) => {
+    expect(existsSync(cliBin)).toBe(true)
+    const projectName = `mercato-integration-${Date.now()}`
+
+    try {
+      const output = runCli([
+        'deploy',
+        'railway',
+        '--project',
+        projectName,
+        '--source',
+        'local',
+        '--no-worker',
+        '--non-interactive',
+      ])
+      const outputLines = output.trim().split(/\r?\n/)
+      const deployUrl = outputLines
+        .find((line) => line.startsWith('DEPLOY_URL='))
+        ?.slice('DEPLOY_URL='.length)
+      expect(deployUrl).toBeTruthy()
+      expect(outputLines.at(-1)).toBe(`DEPLOY_URL=${deployUrl}`)
+
+      const health = await request.get(`${deployUrl}/api/healthz`)
+      expect(health.status()).toBe(200)
+      expect(await health.json()).toEqual({
+        status: 'ok',
+        ts: expect.any(String),
+      })
+
+      const resumeOutput = runCli([
+        'deploy',
+        'railway',
+        '--source',
+        'local',
+        '--no-worker',
+        '--non-interactive',
+      ])
+      expect(resumeOutput).toContain(`Project:     https://railway.com/project/`)
+    } finally {
+      if (appRoot && existsSync(resolve(appRoot, '.mercato', 'railway.json'))) {
+        runCli(['deploy', 'railway', '--cleanup', '--non-interactive', '--yes'])
+      }
+    }
+  })
+})

package/src/lib/deploy/railway/__tests__/dry-run.test.ts

@@ -0,0 +1,61 @@
+import { existsSync, mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runRailwayDeploy } from '../index'
+
+describe('mercato deploy railway --dry-run', () => {
+  it('prints a deterministic local-source plan without a token or state mutation', async () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-dry-run-'))
+    mkdirSync(join(cwd, 'node_modules'), { recursive: true })
+    writeFileSync(join(cwd, 'package.json'), JSON.stringify({
+      name: 'My Shop',
+      dependencies: { '@open-mercato/core': '0.6.4' },
+    }))
+    writeFileSync(join(cwd, '.env'), 'CUSTOM_SETTING=enabled\n')
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '.env*\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json*\n',
+    )
+    const log = jest.spyOn(console, 'log').mockImplementation(() => undefined)
+
+    await runRailwayDeploy(['--dry-run', '--source', 'local'], {
+      cwd,
+      resolveSource: () => ({ mode: 'local', reason: 'test local source' }),
+    })
+
+    const output = log.mock.calls.map((call) => call.join(' ')).join('\n')
+    expect(output).toContain('Railway deployment plan (dry run)')
+    expect(output).toContain('Project: my-shop')
+    expect(output).toContain('Source: local')
+    expect(output).toContain('AUTH_SECRET=<redacted>')
+    expect(output).not.toContain('generated-at-deploy')
+    log.mockRestore()
+  })
+
+  it('prints a cleanup plan without deleting tracked state', async () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-cleanup-dry-run-'))
+    mkdirSync(join(cwd, '.mercato'), { recursive: true })
+    writeFileSync(join(cwd, 'package.json'), JSON.stringify({
+      name: 'My Shop',
+      dependencies: { '@open-mercato/core': '0.6.4' },
+    }))
+    const statePath = join(cwd, '.mercato', 'railway.json')
+    writeFileSync(statePath, JSON.stringify({
+      schemaVersion: 1,
+      provider: 'railway',
+      projectId: 'project-1',
+      projectName: 'my-shop',
+      environments: {},
+      writtenBy: { cliVersion: 'test' },
+    }))
+    const log = jest.spyOn(console, 'log').mockImplementation(() => undefined)
+
+    await runRailwayDeploy(['--cleanup', '--dry-run'], { cwd })
+
+    const output = log.mock.calls.map((call) => call.join(' ')).join('\n')
+    expect(output).toContain('Railway cleanup plan (dry run)')
+    expect(output).toContain('projectDelete')
+    expect(existsSync(statePath)).toBe(true)
+    log.mockRestore()
+  })
+})

package/src/lib/deploy/railway/__tests__/env.test.ts

@@ -0,0 +1,55 @@
+import {
+  computeRailwayVariables,
+  generateProtectedSecrets,
+  parseEnvFile,
+} from '../env'
+
+describe('Railway environment variables', () => {
+  it('parses common dotenv syntax', () => {
+    expect(parseEnvFile(`
+# comment
+PLAIN=value
+export QUOTED="hello world"
+SINGLE='x'
+`)).toEqual({
+      PLAIN: 'value',
+      QUOTED: 'hello world',
+      SINGLE: 'x',
+    })
+  })
+
+  it('generates missing protected secrets and preserves existing ones', () => {
+    const secrets = generateProtectedSecrets({ AUTH_SECRET: 'existing' })
+    expect(secrets.AUTH_SECRET).toBe('existing')
+    expect(secrets.JWT_SECRET).toHaveLength(128)
+    expect(secrets.TENANT_DATA_ENCRYPTION_FALLBACK_KEY.length).toBeGreaterThan(30)
+  })
+
+  it('computes app and worker settings without leaking Railway tokens', () => {
+    const variables = computeRailwayVariables({
+      env: {
+        RAILWAY_API_TOKEN: 'never-upload',
+        CUSTOM_SETTING: 'enabled',
+      },
+      role: 'app',
+      workerEnabled: true,
+      appUrl: 'https://example.up.railway.app',
+      protectedSecrets: {
+        AUTH_SECRET: 'auth',
+        JWT_SECRET: 'jwt',
+        TENANT_DATA_ENCRYPTION_FALLBACK_KEY: 'encryption',
+      },
+    })
+    expect(variables).toMatchObject({
+      DATABASE_URL: '${{Postgres.DATABASE_URL}}',
+      REDIS_URL: '${{Redis.REDIS_URL}}',
+      CACHE_STRATEGY: 'redis',
+      QUEUE_STRATEGY: 'async',
+      AUTO_SPAWN_WORKERS: 'false',
+      PORT: '3000',
+      APP_URL: 'https://example.up.railway.app',
+      CUSTOM_SETTING: 'enabled',
+    })
+    expect(variables.RAILWAY_API_TOKEN).toBeUndefined()
+  })
+})

package/src/lib/deploy/railway/__tests__/graphql-client.test.ts

@@ -0,0 +1,80 @@
+import {
+  createRailwayGraphqlClient,
+  RailwayGraphqlError,
+} from '../graphql-client'
+
+const query = { name: 'TestQuery', query: 'query TestQuery { me { id } }' }
+const mutation = { ...query, name: 'TestMutation', mutation: true }
+
+function response(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status })
+}
+
+describe('Railway GraphQL client', () => {
+  it('sends operationName, query, variables, and bearer auth', async () => {
+    const fetchImpl = jest.fn(async () => response({ data: { me: { id: 'user' } } }))
+    const client = createRailwayGraphqlClient({
+      token: 'account-token',
+      fetchImpl: fetchImpl as typeof fetch,
+    })
+
+    await expect(client.request(query, { input: 'value' })).resolves.toEqual({ me: { id: 'user' } })
+    expect(fetchImpl).toHaveBeenCalledWith(
+      'https://backboard.railway.com/graphql/v2',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({ Authorization: 'Bearer account-token' }),
+        body: JSON.stringify({
+          operationName: 'TestQuery',
+          query: query.query,
+          variables: { input: 'value' },
+        }),
+      }),
+    )
+  })
+
+  it('retries idempotent reads once on a server error', async () => {
+    const fetchImpl = jest.fn()
+      .mockResolvedValueOnce(response({ errors: [{ message: 'temporary' }] }, 500))
+      .mockResolvedValueOnce(response({ data: { ok: true } }))
+    const client = createRailwayGraphqlClient({
+      token: 'token',
+      fetchImpl: fetchImpl as typeof fetch,
+    })
+    await expect(client.request(query)).resolves.toEqual({ ok: true })
+    expect(fetchImpl).toHaveBeenCalledTimes(2)
+  })
+
+  it('never blindly retries mutations', async () => {
+    const fetchImpl = jest.fn(async () => response({ errors: [{ message: 'ambiguous' }] }, 500))
+    const client = createRailwayGraphqlClient({
+      token: 'token',
+      fetchImpl: fetchImpl as typeof fetch,
+    })
+    await expect(client.request(mutation)).rejects.toBeInstanceOf(RailwayGraphqlError)
+    expect(fetchImpl).toHaveBeenCalledTimes(1)
+  })
+
+  it('redacts sensitive request and response fields in verbose logs', async () => {
+    const logger = { log: jest.fn() }
+    const fetchImpl = jest.fn(async () => response({
+      data: { variables: { AUTH_SECRET: 'response-secret', SAFE_VALUE: 'visible' } },
+    }))
+    const client = createRailwayGraphqlClient({
+      token: 'account-token',
+      verbose: true,
+      fetchImpl: fetchImpl as typeof fetch,
+      logger,
+    })
+
+    await client.request(query, {
+      input: { JWT_SECRET: 'request-secret', SAFE_VALUE: 'visible' },
+    })
+
+    const output = logger.log.mock.calls.flat().join('\n')
+    expect(output).not.toContain('request-secret')
+    expect(output).not.toContain('response-secret')
+    expect(output).toContain('<redacted>')
+    expect(output).toContain('visible')
+  })
+})

package/src/lib/deploy/railway/__tests__/operations.test.ts

@@ -0,0 +1,21 @@
+import { createHash } from 'node:crypto'
+import {
+  railwayOperations,
+  railwaySchemaFingerprintSource,
+} from '../operations'
+
+describe('Railway GraphQL operation contract', () => {
+  it('matches the verified operation fingerprint', () => {
+    const fingerprint = createHash('sha256')
+      .update(railwaySchemaFingerprintSource())
+      .digest('hex')
+    expect(fingerprint).toBe('01e3c5feaa163ebe626a1cb9ae5f22b5e7ea316162fed9353375f34c25ebc522')
+  })
+
+  it('uses template-backed databases and singular service variable upserts', () => {
+    const source = railwaySchemaFingerprintSource()
+    expect(source).toContain('templateDeployV2')
+    expect(source).not.toContain('pluginCreate')
+    expect(railwayOperations.variableUpsert.query).toContain('VariableCollectionUpsertInput')
+  })
+})

package/src/lib/deploy/railway/__tests__/options.test.ts

@@ -0,0 +1,78 @@
+import { parseRailwayDeployOptions, redactRailwayCliArgs } from '../options'
+
+describe('parseRailwayDeployOptions', () => {
+  it('parses the complete command surface', () => {
+    expect(parseRailwayDeployOptions([
+      '--project=my-shop',
+      '--env', 'staging',
+      '--service', 'web',
+      '--no-worker',
+      '--source', 'local',
+      '--region', 'europe-west4',
+      '--env-file', '.env.railway',
+      '--domain', 'shop.example.com',
+      '--no-wait-domain',
+      '--volume', '/app/storage',
+      '--token', 'token',
+      '--non-interactive',
+      '--dry-run',
+      '--yes',
+      '--write-env',
+      '--no-track',
+      '--force-rename',
+      '--timeout', '120',
+      '--allow-secret-passthrough', 'OPENAI_API_KEY',
+      '--allow-secret-passthrough=RESEND_API_KEY',
+      '--verbose',
+    ], {})).toMatchObject({
+      project: 'my-shop',
+      environment: 'staging',
+      service: 'web',
+      worker: false,
+      source: 'local',
+      region: 'europe-west4',
+      envFile: '.env.railway',
+      domain: 'shop.example.com',
+      waitDomain: false,
+      volume: '/app/storage',
+      token: 'token',
+      nonInteractive: true,
+      dryRun: true,
+      yes: true,
+      writeEnv: true,
+      track: false,
+      forceRename: true,
+      timeoutSeconds: 120,
+      allowedSecretKeys: ['OPENAI_API_KEY', 'RESEND_API_KEY'],
+      verbose: true,
+    })
+  })
+
+  it('enables non-interactive mode in CI', () => {
+    expect(parseRailwayDeployOptions([], { CI: 'true' }).nonInteractive).toBe(true)
+  })
+
+  it('allows cleanup dry-runs in non-interactive environments without --yes', () => {
+    expect(parseRailwayDeployOptions(['--cleanup', '--dry-run'], { CI: 'true' }))
+      .toMatchObject({
+        cleanup: true,
+        dryRun: true,
+        nonInteractive: true,
+        yes: false,
+      })
+  })
+
+  it.each([
+    [['--source', 'invalid'], 'Invalid --source'],
+    [['--timeout', '0'], '--timeout must be'],
+    [['--unknown'], 'Unknown Railway deploy option'],
+    [['--cleanup', '--non-interactive'], 'requires --yes'],
+  ])('rejects invalid arguments', (args, expectedMessage) => {
+    expect(() => parseRailwayDeployOptions(args, {})).toThrow(expectedMessage)
+  })
+
+  it('redacts both token flag syntaxes in dispatcher output', () => {
+    expect(redactRailwayCliArgs(['--token', 'secret', '--token=other', '--dry-run']))
+      .toEqual(['--token', '****', '--token=****', '--dry-run'])
+  })
+})

package/src/lib/deploy/railway/__tests__/redaction.test.ts

@@ -0,0 +1,62 @@
+import {
+  assertSafeVariables,
+  collectSensitiveStructuredValues,
+  detectCredentialValue,
+  formatVariableValue,
+  redactStructuredValue,
+  redactText,
+} from '../redaction'
+
+describe('Railway secret redaction', () => {
+  it.each([
+    ['sk-testcredential0123456789'],
+    ['xoxb-1234567890-abcdefghij'],
+    ['ghp_abcdefghijklmnopqrstuvwxyz'],
+    ['-----BEGIN PRIVATE KEY-----\nsecret'],
+  ])('detects credential-like values', (value) => {
+    expect(detectCredentialValue(value)).toBe(true)
+  })
+
+  it('requires an exact per-key passthrough', () => {
+    expect(() => assertSafeVariables({ OPENAI_API_KEY: 'sk-testcredential0123456789' }))
+      .toThrow('--allow-secret-passthrough OPENAI_API_KEY')
+    expect(() => assertSafeVariables(
+      { OPENAI_API_KEY: 'sk-testcredential0123456789' },
+      { allowedKeys: ['OPENAI_API_KEY'] },
+    )).not.toThrow()
+  })
+
+  it('redacts authorization headers and known secrets', () => {
+    expect(redactText('Authorization: Bearer token-value secret-value', ['secret-value']))
+      .toBe('Authorization: Bearer **** ****')
+  })
+
+  it('prints only a fingerprint for sensitive variables', () => {
+    const formatted = formatVariableValue('AUTH_SECRET', 'top-secret')
+    expect(formatted).toMatch(/^<redacted> \(sha256:[a-f0-9]{8}\)$/)
+    expect(formatted).not.toContain('top-secret')
+  })
+
+  it('redacts structured values by sensitive field name', () => {
+    expect(redactStructuredValue({
+      variables: {
+        AUTH_SECRET: 'random-hex-without-a-credential-prefix',
+        SAFE_VALUE: 'visible',
+      },
+    })).toEqual({
+      variables: {
+        AUTH_SECRET: '<redacted>',
+        SAFE_VALUE: 'visible',
+      },
+    })
+  })
+
+  it('collects sensitive values for downstream log redaction', () => {
+    expect(collectSensitiveStructuredValues({
+      variables: {
+        AUTH_SECRET: 'auth-secret',
+        nested: { API_KEY: 'api-key', SAFE_VALUE: 'visible' },
+      },
+    })).toEqual(expect.arrayContaining(['auth-secret', 'api-key']))
+  })
+})

package/src/lib/deploy/railway/__tests__/source.test.ts

@@ -0,0 +1,130 @@
+import {
+  assertGitDeployReady,
+  assertLocalUploadSafe,
+  normalizeGitRepository,
+  resolveRailwaySource,
+} from '../source'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+function runner(responses: Record<string, string | Error>) {
+  return (command: string, args: string[]) => {
+    const key = `${command} ${args.join(' ')}`
+    const response = responses[key]
+    if (response instanceof Error || response === undefined) throw response ?? new Error(key)
+    return response
+  }
+}
+
+describe('Railway source strategy', () => {
+  it.each([
+    ['git@github.com:open-mercato/example.git', 'open-mercato/example'],
+    ['https://github.com/open-mercato/example.git', 'open-mercato/example'],
+    ['https://gitlab.com/open-mercato/example.git', null],
+  ])('normalizes supported remotes', (remote, expected) => {
+    expect(normalizeGitRepository(remote)).toBe(expected)
+  })
+
+  it('prefers a synchronized GitHub remote in auto mode', () => {
+    const run = runner({
+      'git branch --show-current': 'main',
+      'git remote get-url origin': 'git@github.com:open-mercato/example.git',
+      'git rev-parse HEAD': 'abc123',
+      'git status --porcelain': '',
+      'git rev-parse --abbrev-ref --symbolic-full-name @{u}': 'origin/main',
+      'git rev-list --count @{u}..HEAD': '0',
+      'git rev-list --count HEAD..@{u}': '0',
+    })
+
+    expect(resolveRailwaySource('auto', '/tmp/app', run)).toMatchObject({
+      mode: 'git',
+      repo: 'open-mercato/example',
+      branch: 'main',
+      commitSha: 'abc123',
+    })
+  })
+
+  it('falls back to local upload when no supported remote exists', () => {
+    const run = runner({
+      'railway --version': 'railway 4.66.1',
+    })
+    expect(resolveRailwaySource('auto', '/tmp/app', run)).toEqual({
+      mode: 'local',
+      reason: 'No usable GitHub remote found; falling back to railway up',
+    })
+  })
+
+  it('falls back to local upload when Git exists but is not ready for remote deploy', () => {
+    const run = runner({
+      'git branch --show-current': 'main',
+      'git remote get-url origin': 'git@github.com:open-mercato/example.git',
+      'git rev-parse HEAD': 'abc123',
+      'git status --porcelain': ' M package.json',
+      'railway --version': 'railway 5.1.0',
+    })
+    expect(resolveRailwaySource('auto', '/tmp/app', run)).toMatchObject({
+      mode: 'local',
+      reason: expect.stringContaining('clean working tree'),
+    })
+  })
+
+  it('rejects dirty Git-backed deploys', () => {
+    const run = runner({
+      'git status --porcelain': ' M package.json',
+    })
+    expect(() => assertGitDeployReady('/tmp/app', run)).toThrow('clean working tree')
+  })
+
+  it('rejects a Git branch that is behind its upstream', () => {
+    const run = runner({
+      'git status --porcelain': '',
+      'git rev-parse --abbrev-ref --symbolic-full-name @{u}': 'origin/main',
+      'git rev-list --count @{u}..HEAD': '0',
+      'git rev-list --count HEAD..@{u}': '2',
+    })
+    expect(() => assertGitDeployReady('/tmp/app', run)).toThrow('behind its upstream')
+  })
+
+  it('rejects a local upload ignore file without state protection', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(join(cwd, '.railwayignore'), '.env\n*.pem\n*.key\n.git\nnode_modules\n')
+    expect(() => assertLocalUploadSafe(cwd)).toThrow('.mercato/railway.json')
+  })
+
+  it('accepts the scaffold local upload safety contract', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '.env*\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json*\n',
+    )
+    expect(() => assertLocalUploadSafe(cwd)).not.toThrow()
+  })
+
+  it('does not accept required safety entries from comments', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '# .env*\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json*\n',
+    )
+    expect(() => assertLocalUploadSafe(cwd)).toThrow('.env')
+  })
+
+  it('does not treat a single env filename as protection for every env file', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '.env\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json*\n',
+    )
+    expect(() => assertLocalUploadSafe(cwd)).toThrow('.env.*')
+  })
+
+  it('does not accept an unrelated Railway state filename prefix', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-ignore-'))
+    writeFileSync(
+      join(cwd, '.railwayignore'),
+      '.env*\n*.pem\n*.key\nid_*\n.git\n.railway\nnode_modules\n.yarn/cache\n.next\n.turbo\n*.db\n*.sqlite\n*.sqlite3\n.mercato/railway.json.example\n',
+    )
+    expect(() => assertLocalUploadSafe(cwd)).toThrow('.mercato/railway.json')
+  })
+})

package/src/lib/deploy/railway/__tests__/state.test.ts

@@ -0,0 +1,24 @@
+import { mkdtempSync, readFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  createRailwayState,
+  loadRailwayState,
+  railwayStatePath,
+  saveRailwayState,
+} from '../state'
+
+describe('Railway deployment state', () => {
+  it('round-trips schema version 1 without secrets', () => {
+    const cwd = mkdtempSync(join(tmpdir(), 'mercato-railway-state-'))
+    const path = railwayStatePath(cwd, true)
+    const state = createRailwayState('my-shop', '0.6.4')
+    state.projectId = 'project-id'
+    state.environments.production = { environmentId: 'environment-id' }
+    saveRailwayState(path, state)
+
+    expect(loadRailwayState(path)).toEqual(state)
+    expect(readFileSync(path, 'utf8')).not.toMatch(/token|password/i)
+    expect(railwayStatePath(cwd, false).endsWith('.mercato/railway.json.local')).toBe(true)
+  })
+})