voidforge-build 23.9.1

package/dist/wizard/lib/provisioners/http-client.js

@@ -0,0 +1,79 @@
+/**
+ * Shared HTTPS client for provisioner API calls.
+ * Uses raw node:https — no dependencies.
+ *
+ * Security: All callers hardcode hostnames (api.cloudflare.com, etc.).
+ * Never pass user-controlled input as the hostname parameter.
+ */
+import { request as httpsRequest } from 'node:https';
+export function httpsGet(hostname, path, headers, timeout) {
+    return httpsCallWithRetry('GET', hostname, path, headers, undefined, timeout);
+}
+export function httpsPost(hostname, path, headers, body, timeout) {
+    return httpsCallWithRetry('POST', hostname, path, headers, body, timeout);
+}
+export function httpsPut(hostname, path, headers, body, timeout) {
+    return httpsCallWithRetry('PUT', hostname, path, headers, body, timeout);
+}
+export function httpsDelete(hostname, path, headers, timeout) {
+    return httpsCallWithRetry('DELETE', hostname, path, headers, undefined, timeout);
+}
+/** Slugify a name for use as a cloud resource identifier. Strips non-alphanumeric, trims hyphens. */
+export function slugify(name) {
+    const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/-+/g, '-').replace(/^-|-$/g, '').slice(0, 40);
+    return slug || 'voidforge-project';
+}
+/** Safely parse JSON — returns null on invalid input instead of throwing. */
+export function safeJsonParse(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+}
+const DEFAULT_TIMEOUT = 30000;
+const MAX_RETRIES = 1;
+const RETRY_DELAY_MS = 2000;
+const TRANSIENT_CODES = ['ECONNRESET', 'ETIMEDOUT', 'ENOTFOUND', 'EPIPE'];
+/**
+ * Wrapper around httpsCall that retries once on transient network errors.
+ * Transient errors: ECONNRESET, ETIMEDOUT, ENOTFOUND, EPIPE, socket hang up.
+ */
+async function httpsCallWithRetry(method, hostname, path, headers, body, timeout) {
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+        try {
+            return await httpsCall(method, hostname, path, headers, body, timeout);
+        }
+        catch (err) {
+            const code = err.code;
+            const isTransient = TRANSIENT_CODES.includes(code || '') ||
+                err.message.includes('socket hang up');
+            if (attempt < MAX_RETRIES && isTransient) {
+                await new Promise(r => setTimeout(r, RETRY_DELAY_MS));
+                continue;
+            }
+            throw err;
+        }
+    }
+    // Unreachable — the loop always returns or throws — but TypeScript needs this
+    throw new Error('Retry loop exited unexpectedly');
+}
+function httpsCall(method, hostname, path, headers, body, timeout) {
+    return new Promise((resolve, reject) => {
+        const opts = { hostname, path, method, headers, timeout: timeout ?? DEFAULT_TIMEOUT };
+        if (body) {
+            headers['Content-Length'] = String(Buffer.byteLength(body));
+        }
+        const req = httpsRequest(opts, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk.toString(); });
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, body: data }));
+        });
+        req.on('error', reject);
+        req.on('timeout', () => { req.destroy(); reject(new Error('Request timed out')); });
+        if (body)
+            req.write(body);
+        req.end();
+    });
+}

package/dist/wizard/lib/provisioners/railway-config.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Railway provisioner — configuration, GraphQL helpers, template deployment,
+ * config file generation, and cleanup.
+ */
+import type { ProvisionContext, ProvisionEmitter, CreatedResource } from './types.js';
+/** Execute a Railway GraphQL query. */
+export declare function gql(token: string, query: string, variables?: Record<string, unknown>): Promise<{
+    status: number;
+    body: string;
+}>;
+export declare const DEPLOY_POLL_INTERVAL_MS = 5000;
+export declare const DEPLOY_POLL_TIMEOUT_MS = 300000;
+/** Validate Railway provisioner context. */
+export declare function validateRailwayContext(ctx: ProvisionContext): string[];
+/** Deploy a database/redis template or fall back to serviceCreate. */
+export declare function deployTemplate(token: string, projectId: string, environmentId: string, ctx: ProvisionContext, resources: CreatedResource[], templateName: string, resourceLabel: string, displayName: string, emit: ProvisionEmitter): Promise<void>;
+/** Generate railway.toml configuration file. */
+export declare function generateRailwayConfig(ctx: ProvisionContext, projectId: string, files: string[], emit: ProvisionEmitter): Promise<void>;
+/** Write Railway environment details to .env. */
+export declare function writeRailwayEnv(ctx: ProvisionContext, projectId: string, outputs: Record<string, string>, ghOwner: string | undefined, emit: ProvisionEmitter): Promise<void>;
+/** Step 7: Poll for Railway deployment completion. */
+export declare function pollDeployment(ctx: ProvisionContext, token: string, serviceId: string, environmentId: string, outputs: Record<string, string>, ghOwner: string | undefined, emit: ProvisionEmitter): Promise<void>;
+/** Delete Railway project (services are deleted with it). */
+export declare function cleanupRailway(resources: CreatedResource[], credentials: Record<string, string>): Promise<void>;

package/dist/wizard/lib/provisioners/railway-config.js

@@ -0,0 +1,220 @@
+/**
+ * Railway provisioner — configuration, GraphQL helpers, template deployment,
+ * config file generation, and cleanup.
+ */
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { httpsPost, safeJsonParse } from './http-client.js';
+import { recordResourcePending, recordResourceCreated } from '../provision-manifest.js';
+import { appendEnvSection } from '../env-writer.js';
+/** Execute a Railway GraphQL query. */
+export function gql(token, query, variables) {
+    const body = JSON.stringify({ query, variables });
+    return httpsPost('backboard.railway.com', '/graphql/v2', {
+        'Authorization': `Bearer ${token}`,
+        'Content-Type': 'application/json',
+    }, body);
+}
+export const DEPLOY_POLL_INTERVAL_MS = 5000;
+export const DEPLOY_POLL_TIMEOUT_MS = 300_000;
+/** Validate Railway provisioner context. */
+export function validateRailwayContext(ctx) {
+    const errors = [];
+    if (!ctx.projectDir)
+        errors.push('Project directory is required');
+    if (!ctx.credentials['railway-token'])
+        errors.push('Railway API token is required');
+    return errors;
+}
+/** Deploy a database/redis template or fall back to serviceCreate. */
+export async function deployTemplate(token, projectId, environmentId, ctx, resources, templateName, resourceLabel, displayName, emit) {
+    await recordResourcePending(ctx.runId, 'railway-service', `${projectId}-${resourceLabel}`, 'global');
+    // Only attempt templateDeploy if we have a valid environment ID
+    if (environmentId) {
+        try {
+            const res = await gql(token, `
+        mutation($projectId: String!, $environmentId: String!, $template: String!) {
+          templateDeploy(input: {
+            projectId: $projectId,
+            environmentId: $environmentId,
+            services: [{ template: $template, hasDomain: false }]
+          }) {
+            projectId
+            workflowId
+          }
+        }
+      `, { projectId, environmentId, template: templateName });
+            if (res.status === 200) {
+                const data = safeJsonParse(res.body);
+                if (!data?.errors || data.errors.length === 0) {
+                    resources.push({ type: 'railway-service', id: `${projectId}-${resourceLabel}`, region: 'global' });
+                    await recordResourceCreated(ctx.runId, 'railway-service', `${projectId}-${resourceLabel}`, 'global');
+                    emit({ step: `railway-${resourceLabel}`, status: 'done', message: `${displayName} deployed via template — connection string available in Railway dashboard` });
+                    return;
+                }
+            }
+        }
+        catch {
+            // Fall through to serviceCreate fallback
+        }
+    }
+    // Fallback: create a bare service (user configures the database image in dashboard)
+    const svcRes = await gql(token, `
+    mutation($projectId: String!, $name: String!) {
+      serviceCreate(input: { projectId: $projectId, name: $name }) {
+        id
+        name
+      }
+    }
+  `, { projectId, name: `${ctx.projectName}-${templateName}` });
+    if (svcRes.status === 200) {
+        const svcData = safeJsonParse(svcRes.body);
+        const svcId = svcData?.data?.serviceCreate?.id;
+        if (svcId) {
+            resources.push({ type: 'railway-service', id: svcId, region: 'global' });
+            await recordResourceCreated(ctx.runId, 'railway-service', svcId, 'global');
+            emit({ step: `railway-${resourceLabel}`, status: 'done', message: `${displayName} service created — configure database image in Railway dashboard` });
+        }
+        else {
+            emit({ step: `railway-${resourceLabel}`, status: 'error', message: `${displayName} service creation returned no ID`, detail: 'Create the database manually in the Railway dashboard' });
+        }
+    }
+    else {
+        emit({ step: `railway-${resourceLabel}`, status: 'error', message: `Failed to create ${displayName} service (API returned ${svcRes.status})`, detail: 'Create the database manually in the Railway dashboard' });
+    }
+}
+/** Generate railway.toml configuration file. */
+export async function generateRailwayConfig(ctx, projectId, files, emit) {
+    emit({ step: 'railway-config', status: 'started', message: 'Generating railway.toml' });
+    try {
+        const framework = ctx.framework || 'express';
+        const startCommand = framework === 'next.js'
+            ? 'npm run start'
+            : framework === 'django'
+                ? 'gunicorn config.wsgi:application --bind 0.0.0.0:$PORT'
+                : 'node dist/index.js';
+        const buildCommand = framework === 'django'
+            ? 'pip install -r requirements.txt && python manage.py collectstatic --noinput'
+            : 'npm ci && npm run build';
+        const config = `# railway.toml — Railway deployment configuration
+# Generated by VoidForge
+# Deploy with: railway link ${projectId} && railway up
+
+[build]
+builder = "nixpacks"
+buildCommand = "${buildCommand}"
+
+[deploy]
+startCommand = "${startCommand}"
+healthcheckPath = "/"
+restartPolicyType = "on_failure"
+restartPolicyMaxRetries = 3
+`;
+        await writeFile(join(ctx.projectDir, 'railway.toml'), config, 'utf-8');
+        files.push('railway.toml');
+        emit({ step: 'railway-config', status: 'done', message: 'Generated railway.toml' });
+    }
+    catch (err) {
+        emit({ step: 'railway-config', status: 'error', message: 'Failed to write railway.toml', detail: err.message });
+    }
+}
+/** Write Railway environment details to .env. */
+export async function writeRailwayEnv(ctx, projectId, outputs, ghOwner, emit) {
+    emit({ step: 'railway-env', status: 'started', message: 'Writing Railway config to .env' });
+    try {
+        const envLines = [
+            `# VoidForge Railway — generated ${new Date().toISOString()}`,
+            `RAILWAY_PROJECT_ID=${projectId}`,
+            `RAILWAY_PROJECT_NAME=${outputs['RAILWAY_PROJECT_NAME'] || ctx.projectName}`,
+        ];
+        if (outputs['DEPLOY_URL'])
+            envLines.push(`DEPLOY_URL=${outputs['DEPLOY_URL']}`);
+        envLines.push(ghOwner ? '# Auto-deploys on push to main' : `# Deploy with: railway link ${projectId} && railway up`);
+        await appendEnvSection(ctx.projectDir, envLines);
+        emit({ step: 'railway-env', status: 'done', message: 'Railway config written to .env' });
+    }
+    catch (err) {
+        emit({ step: 'railway-env', status: 'error', message: 'Failed to write .env', detail: err.message });
+    }
+}
+/** Step 7: Poll for Railway deployment completion. */
+export async function pollDeployment(ctx, token, serviceId, environmentId, outputs, ghOwner, emit) {
+    if (!serviceId || !environmentId) {
+        if (!ghOwner) {
+            emit({ step: 'railway-deploy', status: 'skipped', message: 'No GitHub repo linked — deploy manually with: railway link && railway up' });
+        }
+        return;
+    }
+    emit({ step: 'railway-deploy', status: 'started', message: 'Waiting for Railway deployment...' });
+    try {
+        const start = Date.now();
+        let deployUrl = '';
+        while (Date.now() - start < DEPLOY_POLL_TIMEOUT_MS) {
+            await new Promise(r => setTimeout(r, DEPLOY_POLL_INTERVAL_MS));
+            if (ctx.abortSignal?.aborted)
+                break;
+            const depRes = await gql(token, `
+        query($serviceId: String!) {
+          service(id: $serviceId) {
+            serviceInstances { edges { node {
+              domains { serviceDomains { domain } }
+              latestDeployment { status }
+            } } }
+          }
+        }
+      `, { serviceId });
+            if (depRes.status === 200) {
+                const depData = safeJsonParse(depRes.body);
+                const instance = depData?.data?.service?.serviceInstances?.edges?.[0]?.node;
+                const deployStatus = instance?.latestDeployment?.status;
+                const domain = instance?.domains?.serviceDomains?.[0]?.domain;
+                if (deployStatus === 'SUCCESS' && domain) {
+                    deployUrl = `https://${domain}`;
+                    break;
+                }
+                if (deployStatus === 'FAILED' || deployStatus === 'CRASHED') {
+                    emit({ step: 'railway-deploy', status: 'error', message: `Deployment ${deployStatus.toLowerCase()} — check Railway dashboard` });
+                    break;
+                }
+            }
+            const elapsed = Math.round((Date.now() - start) / 1000);
+            if (elapsed % 15 === 0) {
+                emit({ step: 'railway-deploy', status: 'started', message: `Waiting for deployment... (${elapsed}s)` });
+            }
+        }
+        if (deployUrl) {
+            outputs['DEPLOY_URL'] = deployUrl;
+            if (!outputs['RAILWAY_CUSTOM_DOMAIN']) {
+                outputs['RAILWAY_DOMAIN'] = deployUrl.replace('https://', '');
+            }
+            emit({ step: 'railway-deploy', status: 'done', message: `Live at ${deployUrl}` });
+        }
+        else if (!ctx.abortSignal?.aborted) {
+            emit({ step: 'railway-deploy', status: 'error', message: 'Deployment polling timed out — check Railway dashboard' });
+        }
+    }
+    catch (err) {
+        emit({ step: 'railway-deploy', status: 'error', message: 'Failed to poll deployment', detail: err.message });
+    }
+}
+/** Delete Railway project (services are deleted with it). */
+export async function cleanupRailway(resources, credentials) {
+    const token = credentials['railway-token'];
+    if (!token)
+        return;
+    for (const resource of resources) {
+        if (resource.type === 'railway-project') {
+            try {
+                await gql(token, `
+          mutation($id: String!) {
+            projectDelete(id: $id)
+          }
+        `, { id: resource.id });
+            }
+            catch (err) {
+                console.error(`Failed to delete Railway project ${resource.id}:`, err.message);
+            }
+        }
+        // Plugins are deleted with the project — no need to delete separately
+    }
+}

package/dist/wizard/lib/provisioners/railway-deploy.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Railway provisioner — deployment logic: project creation, service management,
+ * GitHub linking, custom domains, environment variables, and deploy polling.
+ */
+import type { ProvisionContext, ProvisionEmitter, CreatedResource } from './types.js';
+/** Step 1: Create Railway project. Returns projectId or null on failure. */
+export declare function createProject(ctx: ProvisionContext, token: string, resources: CreatedResource[], outputs: Record<string, string>, emit: ProvisionEmitter): Promise<string | null>;
+/** Fetch the default environment ID for a Railway project. */
+export declare function fetchEnvironmentId(token: string, projectId: string, emit: ProvisionEmitter): Promise<string>;
+/** Step 2: Add database service if requested (ADR-019: template services). */
+export declare function addDatabaseService(ctx: ProvisionContext, token: string, projectId: string, environmentId: string, resources: CreatedResource[], outputs: Record<string, string>, emit: ProvisionEmitter): Promise<void>;
+/** Step 3: Add Redis service if cache requested (ADR-019: template services). */
+export declare function addRedisService(ctx: ProvisionContext, token: string, projectId: string, environmentId: string, resources: CreatedResource[], emit: ProvisionEmitter): Promise<void>;
+/** Step 4: Create service with GitHub source (ADR-015). Returns serviceId. */
+export declare function createGitHubService(ctx: ProvisionContext, token: string, projectId: string, resources: CreatedResource[], emit: ProvisionEmitter): Promise<string>;
+/** Step 5: Add custom domain to Railway service. */
+export declare function addCustomDomain(ctx: ProvisionContext, token: string, projectId: string, serviceId: string, environmentId: string, outputs: Record<string, string>, emit: ProvisionEmitter): Promise<void>;
+/** Step 6: Set environment variables on the service. */
+export declare function setEnvironmentVariables(ctx: ProvisionContext, token: string, projectId: string, serviceId: string, environmentId: string, emit: ProvisionEmitter): Promise<void>;

package/dist/wizard/lib/provisioners/railway-deploy.js

@@ -0,0 +1,205 @@
+/**
+ * Railway provisioner — deployment logic: project creation, service management,
+ * GitHub linking, custom domains, environment variables, and deploy polling.
+ */
+import { safeJsonParse } from './http-client.js';
+import { recordResourcePending, recordResourceCreated } from '../provision-manifest.js';
+import { gql, deployTemplate } from './railway-config.js';
+/** Step 1: Create Railway project. Returns projectId or null on failure. */
+export async function createProject(ctx, token, resources, outputs, emit) {
+    emit({ step: 'railway-project', status: 'started', message: 'Creating Railway project' });
+    try {
+        await recordResourcePending(ctx.runId, 'railway-project', ctx.projectName, 'global');
+        const res = await gql(token, `
+      mutation($name: String!) {
+        projectCreate(input: { name: $name }) {
+          id
+          name
+        }
+      }
+    `, { name: ctx.projectName });
+        if (res.status !== 200) {
+            throw new Error(`Railway API returned ${res.status}`);
+        }
+        const data = safeJsonParse(res.body);
+        if (data.errors && data.errors.length > 0) {
+            throw new Error(data.errors[0].message);
+        }
+        const projectId = data.data?.projectCreate?.id ?? '';
+        if (!projectId)
+            throw new Error('No project ID returned');
+        resources.push({ type: 'railway-project', id: projectId, region: 'global' });
+        await recordResourceCreated(ctx.runId, 'railway-project', projectId, 'global');
+        outputs['RAILWAY_PROJECT_ID'] = projectId;
+        outputs['RAILWAY_PROJECT_NAME'] = data.data?.projectCreate?.name ?? ctx.projectName;
+        emit({ step: 'railway-project', status: 'done', message: `Project "${outputs['RAILWAY_PROJECT_NAME']}" created on Railway` });
+        return projectId;
+    }
+    catch (err) {
+        emit({ step: 'railway-project', status: 'error', message: 'Failed to create Railway project', detail: err.message });
+        return null;
+    }
+}
+/** Fetch the default environment ID for a Railway project. */
+export async function fetchEnvironmentId(token, projectId, emit) {
+    try {
+        const envRes = await gql(token, `
+      query($projectId: String!) {
+        project(id: $projectId) {
+          environments { edges { node { id name } } }
+        }
+      }
+    `, { projectId });
+        if (envRes.status === 200) {
+            const envData = safeJsonParse(envRes.body);
+            const edges = envData?.data?.project?.environments?.edges ?? [];
+            const prodEnv = edges.find(e => e.node.name === 'production') || edges[0];
+            return prodEnv?.node.id ?? '';
+        }
+    }
+    catch {
+        emit({ step: 'railway-env', status: 'error', message: 'Could not fetch project environment — database/redis services will use fallback creation', detail: 'Environment query failed' });
+    }
+    return '';
+}
+/** Step 2: Add database service if requested (ADR-019: template services). */
+export async function addDatabaseService(ctx, token, projectId, environmentId, resources, outputs, emit) {
+    if (ctx.database === 'postgres' || ctx.database === 'mysql') {
+        const dbType = ctx.database === 'postgres' ? 'Postgres' : 'MySQL';
+        const templateName = ctx.database === 'postgres' ? 'postgres' : 'mysql';
+        emit({ step: 'railway-db', status: 'started', message: `Adding ${dbType} service to Railway project` });
+        try {
+            await deployTemplate(token, projectId, environmentId, ctx, resources, templateName, 'db', dbType, emit);
+            outputs['RAILWAY_DB_TYPE'] = dbType;
+        }
+        catch (err) {
+            emit({ step: 'railway-db', status: 'error', message: `Failed to add ${dbType} service`, detail: err.message });
+        }
+    }
+    else {
+        emit({ step: 'railway-db', status: 'skipped', message: ctx.database === 'sqlite' ? 'SQLite — no remote database service needed' : 'No database requested' });
+    }
+}
+/** Step 3: Add Redis service if cache requested (ADR-019: template services). */
+export async function addRedisService(ctx, token, projectId, environmentId, resources, emit) {
+    if (ctx.cache === 'redis') {
+        emit({ step: 'railway-redis', status: 'started', message: 'Adding Redis service to Railway project' });
+        try {
+            await deployTemplate(token, projectId, environmentId, ctx, resources, 'redis', 'redis', 'Redis', emit);
+        }
+        catch (err) {
+            emit({ step: 'railway-redis', status: 'error', message: 'Failed to add Redis service', detail: err.message });
+        }
+    }
+    else {
+        emit({ step: 'railway-redis', status: 'skipped', message: 'No cache requested' });
+    }
+}
+/** Step 4: Create service with GitHub source (ADR-015). Returns serviceId. */
+export async function createGitHubService(ctx, token, projectId, resources, emit) {
+    const ghOwner = ctx.credentials['_github-owner'];
+    const ghRepo = ctx.credentials['_github-repo-name'];
+    if (!projectId || !ghOwner || !ghRepo)
+        return '';
+    emit({ step: 'railway-service', status: 'started', message: `Creating service linked to ${ghOwner}/${ghRepo}` });
+    try {
+        const svcRes = await gql(token, `
+      mutation($projectId: String!, $repo: String!) {
+        serviceCreate(input: {
+          projectId: $projectId,
+          source: { repo: $repo }
+        }) {
+          id
+          name
+        }
+      }
+    `, { projectId, repo: `${ghOwner}/${ghRepo}` });
+        if (svcRes.status === 200) {
+            const svcData = safeJsonParse(svcRes.body);
+            if (svcData?.errors?.length) {
+                emit({ step: 'railway-service', status: 'error', message: 'Failed to create service', detail: svcData.errors[0].message });
+                return '';
+            }
+            const serviceId = svcData?.data?.serviceCreate?.id ?? '';
+            if (serviceId) {
+                resources.push({ type: 'railway-service', id: serviceId, region: 'global' });
+                await recordResourceCreated(ctx.runId, 'railway-service', serviceId, 'global');
+            }
+            emit({ step: 'railway-service', status: 'done', message: 'Service created — linked to GitHub repo' });
+            return serviceId;
+        }
+    }
+    catch (err) {
+        emit({ step: 'railway-service', status: 'error', message: 'Failed to create service', detail: err.message });
+    }
+    return '';
+}
+/** Step 5: Add custom domain to Railway service. */
+export async function addCustomDomain(ctx, token, projectId, serviceId, environmentId, outputs, emit) {
+    if (ctx.hostname && projectId && serviceId && environmentId) {
+        emit({ step: 'railway-domain', status: 'started', message: `Adding domain ${ctx.hostname} to Railway service` });
+        try {
+            const domRes = await gql(token, `
+        mutation($projectId: String!, $environmentId: String!, $serviceId: String!, $domain: String!) {
+          customDomainCreate(input: { projectId: $projectId, environmentId: $environmentId, serviceId: $serviceId, domain: $domain }) {
+            id
+            domain
+          }
+        }
+      `, { projectId, environmentId, serviceId, domain: ctx.hostname });
+            if (domRes.status !== 200)
+                throw new Error(`Railway API returned ${domRes.status}`);
+            const domData = safeJsonParse(domRes.body);
+            if (domData?.errors && domData.errors.length > 0) {
+                throw new Error(domData.errors[0].message);
+            }
+            const domain = domData?.data?.customDomainCreate?.domain ?? ctx.hostname;
+            outputs['RAILWAY_CUSTOM_DOMAIN'] = domain;
+            emit({ step: 'railway-domain', status: 'done', message: `Domain "${domain}" added to Railway service` });
+        }
+        catch (err) {
+            emit({ step: 'railway-domain', status: 'error', message: 'Failed to add domain to Railway', detail: err.message });
+        }
+    }
+    else if (ctx.hostname && projectId && (!serviceId || !environmentId)) {
+        emit({ step: 'railway-domain', status: 'skipped', message: 'Cannot add domain — service or environment not available. Add domain manually in Railway dashboard.' });
+    }
+}
+/** Step 6: Set environment variables on the service. */
+export async function setEnvironmentVariables(ctx, token, projectId, serviceId, environmentId, emit) {
+    if (!serviceId || !environmentId)
+        return;
+    emit({ step: 'railway-envvars', status: 'started', message: 'Setting environment variables' });
+    try {
+        const variables = {};
+        if (ctx.database === 'postgres' || ctx.database === 'mysql') {
+            variables['DATABASE_URL'] = ctx.database === 'postgres'
+                ? '${{Postgres.DATABASE_URL}}'
+                : '${{MySQL.DATABASE_URL}}';
+        }
+        if (ctx.cache === 'redis') {
+            variables['REDIS_URL'] = '${{Redis.REDIS_URL}}';
+        }
+        if (Object.keys(variables).length > 0) {
+            await gql(token, `
+        mutation($input: VariableCollectionUpsertInput!) {
+          variableCollectionUpsert(input: $input)
+        }
+      `, {
+                input: {
+                    projectId,
+                    serviceId,
+                    environmentId,
+                    variables,
+                },
+            });
+            emit({ step: 'railway-envvars', status: 'done', message: `Set ${Object.keys(variables).length} environment variables` });
+        }
+        else {
+            emit({ step: 'railway-envvars', status: 'done', message: 'No environment variables to set' });
+        }
+    }
+    catch (err) {
+        emit({ step: 'railway-envvars', status: 'error', message: 'Failed to set env vars', detail: err.message });
+    }
+}

package/dist/wizard/lib/provisioners/railway.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Railway provisioner — orchestrator that coordinates project creation,
+ * service deployment, config generation, and cleanup.
+ */
+import type { Provisioner } from './types.js';
+export declare const railwayProvisioner: Provisioner;

package/dist/wizard/lib/provisioners/railway.js

@@ -0,0 +1,45 @@
+/**
+ * Railway provisioner — orchestrator that coordinates project creation,
+ * service deployment, config generation, and cleanup.
+ */
+import { validateRailwayContext, generateRailwayConfig, writeRailwayEnv, cleanupRailway, pollDeployment } from './railway-config.js';
+import { createProject, fetchEnvironmentId, addDatabaseService, addRedisService, createGitHubService, addCustomDomain, setEnvironmentVariables, } from './railway-deploy.js';
+export const railwayProvisioner = {
+    async validate(ctx) {
+        return validateRailwayContext(ctx);
+    },
+    async provision(ctx, emit) {
+        const files = [];
+        const resources = [];
+        const outputs = {};
+        const token = ctx.credentials['railway-token'];
+        const ghOwner = ctx.credentials['_github-owner'];
+        // Step 1: Create Railway project
+        const projectId = await createProject(ctx, token, resources, outputs, emit);
+        if (!projectId) {
+            return { success: false, resources, outputs, files, error: outputs['error'] || 'Failed to create Railway project' };
+        }
+        // Fetch the default environment ID — shared by all subsequent steps
+        const environmentId = await fetchEnvironmentId(token, projectId, emit);
+        // Step 2: Add database service if requested
+        await addDatabaseService(ctx, token, projectId, environmentId, resources, outputs, emit);
+        // Step 3: Add Redis service if cache requested
+        await addRedisService(ctx, token, projectId, environmentId, resources, emit);
+        // Step 4: Create service with GitHub source
+        const serviceId = await createGitHubService(ctx, token, projectId, resources, emit);
+        // Step 5: Add custom domain
+        await addCustomDomain(ctx, token, projectId, serviceId, environmentId, outputs, emit);
+        // Step 6: Set environment variables
+        await setEnvironmentVariables(ctx, token, projectId, serviceId, environmentId, emit);
+        // Step 7: Poll for deployment
+        await pollDeployment(ctx, token, serviceId, environmentId, outputs, ghOwner, emit);
+        // Step 8: Generate railway.toml
+        await generateRailwayConfig(ctx, projectId, files, emit);
+        // Step 9: Write .env
+        await writeRailwayEnv(ctx, projectId, outputs, ghOwner, emit);
+        return { success: true, resources, outputs, files };
+    },
+    async cleanup(resources, credentials) {
+        await cleanupRailway(resources, credentials);
+    },
+};

package/dist/wizard/lib/provisioners/scripts/caddyfile.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Template: Caddyfile — reverse proxy + automatic HTTPS + security headers.
+ * Written to projectDir/infra/Caddyfile
+ */
+interface CaddyfileOptions {
+    framework: string;
+    hostname?: string;
+}
+export declare function generateCaddyfile(opts: CaddyfileOptions): string;
+export {};

package/dist/wizard/lib/provisioners/scripts/caddyfile.js

@@ -0,0 +1,54 @@
+/**
+ * Template: Caddyfile — reverse proxy + automatic HTTPS + security headers.
+ * Written to projectDir/infra/Caddyfile
+ */
+export function generateCaddyfile(opts) {
+    const port = opts.framework === 'django' ? '8000' : '3000';
+    const siteAddress = opts.hostname || ':80';
+    const comment = opts.hostname
+        ? `# Caddyfile — Reverse proxy for ${opts.hostname}
+# Generated by VoidForge
+#
+# Caddy will auto-provision HTTPS via Let's Encrypt.
+# If using Cloudflare proxy (orange cloud), set SSL mode to "Full" in Cloudflare dashboard.
+#
+# Usage:
+#   1. Copy to server: scp Caddyfile user@host:/etc/caddy/Caddyfile
+#   2. Reload: sudo systemctl reload caddy`
+        : `# Caddyfile — Reverse proxy with automatic HTTPS
+# Generated by VoidForge
+#
+# Usage:
+#   1. Replace :80 with your domain (e.g. example.com)
+#   2. Copy to server: scp Caddyfile user@host:/etc/caddy/Caddyfile
+#   3. Reload: sudo systemctl reload caddy
+#
+# Caddy auto-provisions HTTPS certificates via Let's Encrypt
+# when you replace :80 with a real domain name.`;
+    return `${comment}
+
+${siteAddress} {
+    reverse_proxy localhost:${port}
+
+    # Security headers
+    header {
+        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+        X-Content-Type-Options nosniff
+        X-Frame-Options DENY
+        Referrer-Policy strict-origin-when-cross-origin
+        Permissions-Policy "camera=(), microphone=(), geolocation=()"
+        Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'"
+        -Server
+    }
+
+    # Gzip compression
+    encode gzip
+
+    # Access logs
+    log {
+        output file /var/log/caddy/access.log
+        format json
+    }
+}
+`;
+}