@treeseed/sdk 0.10.28 → 0.12.4

package/dist/operations/services/deploy.js

@@ -7,7 +7,6 @@ import { resolveTreeseedWebCachePolicy } from "../../platform/deploy-config.js";
 import {
   deleteRailwayCustomDomain,
   deleteRailwayEnvironment,
-  deleteRailwayProject,
   deleteRailwayVolume,
   getRailwayServiceInstance,
   listRailwayCustomDomains,
@@ -23,7 +22,7 @@ import { loadCliDeployConfig, resolveWranglerBin } from "./runtime-tools.js";
 import { sdkD1MigrationsRoot } from "./runtime-paths.js";
 const DEFAULT_COMPATIBILITY_DATE = "2026-04-05";
 const DEFAULT_COMPATIBILITY_FLAGS = ["nodejs_compat"];
-const DEFAULT_TREESEED_MARKET_BASE_URL = "https://api.treeseed.ai";
+const DEFAULT_TREESEED_MARKET_BASE_URL = "https://api.treeseed.dev";
 const GENERATED_ROOT = ".treeseed/generated";
 const STATE_ROOT = ".treeseed/state";
 const WORKTREE_METADATA_RELATIVE_PATH = ".treeseed/worktree.json";
@@ -146,6 +145,24 @@ function deriveApiDomainFromWebDomain(domain) {
   }
   return domain.startsWith("api.") ? domain : `api.${domain}`;
 }
+function configuredApiConnectionDomain(deployConfig, scope) {
+  const apiConnection = deployConfig.connections?.api?.environments?.[scope];
+  const domain = apiConnection?.domain?.trim();
+  if (domain) {
+    return domain;
+  }
+  const connectionBaseUrl = primaryHost(apiConnection?.baseUrl);
+  if (connectionBaseUrl) {
+    return connectionBaseUrl;
+  }
+  const serviceDomain = deployConfig.services?.api?.environments?.[scope]?.domain?.trim();
+  if (serviceDomain) {
+    return serviceDomain;
+  }
+  return primaryHost(
+    deployConfig.services?.api?.environments?.[scope]?.baseUrl ?? deployConfig.services?.api?.publicBaseUrl
+  );
+}
 function resolveConfiguredSurfaceDomain(deployConfig, target, surface) {
   if (target.kind !== "persistent") {
     return null;
@@ -155,6 +172,12 @@ function resolveConfiguredSurfaceDomain(deployConfig, target, surface) {
   if (configured) {
     return configured;
   }
+  if (surface === "api") {
+    const apiConnectionDomain = configuredApiConnectionDomain(deployConfig, scope);
+    if (apiConnectionDomain) {
+      return apiConnectionDomain;
+    }
+  }
   if (scope === "staging") {
     return deriveTreeseedStagingSurfaceDomain(
       deployConfig,
@@ -171,6 +194,14 @@ function resolveConfiguredSurfaceDomain(deployConfig, target, surface) {
   return deriveApiDomainFromWebDomain(resolveConfiguredSurfaceDomain(deployConfig, target, "web"));
 }
 function resolveConfiguredSurfaceBaseUrl(deployConfig, target, surface) {
+  if (surface === "api") {
+    const scope = scopeFromTarget(target);
+    const apiConnection = deployConfig.connections?.api?.environments?.[scope];
+    const connectionBaseUrl = apiConnection?.baseUrl ?? (apiConnection?.domain ? `https://${apiConnection.domain}` : null);
+    if (connectionBaseUrl) {
+      return connectionBaseUrl;
+    }
+  }
   const configuredDomain = resolveConfiguredSurfaceDomain(deployConfig, target, surface);
   if (configuredDomain) {
     return `https://${configuredDomain}`;
@@ -301,6 +332,7 @@ function resolveContentServingMode(deployConfig, options = {}) {
   return deployConfig.providers?.content?.serving ?? "local_collections";
 }
 function buildPublicVars(deployConfig, options = {}) {
+  const target = options.target ? normalizeTarget(options.target) : createPersistentDeployTarget("prod");
   const identity = resolveTreeseedResourceIdentity(deployConfig, createPersistentDeployTarget("prod"));
   const contentRuntimeProvider = deployConfig.providers?.content?.runtime ?? "team_scoped_r2_overlay";
   const contentPublishProvider = deployConfig.providers?.content?.publish ?? contentRuntimeProvider;
@@ -312,20 +344,23 @@ function buildPublicVars(deployConfig, options = {}) {
   const managedRuntime = deployConfig.runtime?.mode === "treeseed_managed";
   const workerRailway = deployConfig.services?.worker?.railway ?? {};
   const webCachePolicy = resolveTreeseedWebCachePolicy(deployConfig);
+  const projectDomain = target.kind === "persistent" ? resolveConfiguredSurfaceDomain(deployConfig, target, "web") : primaryHost(deployConfig.surfaces?.web?.publicBaseUrl ?? deployConfig.siteUrl);
   return {
     TREESEED_HOSTING_KIND: deployConfig.hosting?.kind ?? "self_hosted_project",
     TREESEED_HOSTING_REGISTRATION: deployConfig.hosting?.registration ?? "none",
     TREESEED_HUB_MODE: deployConfig.hub?.mode ?? "treeseed_hosted",
     TREESEED_RUNTIME_MODE: deployConfig.runtime?.mode ?? "none",
     TREESEED_RUNTIME_REGISTRATION: deployConfig.runtime?.registration ?? "none",
-    TREESEED_CENTRAL_MARKET_API_BASE_URL: envOrNull("TREESEED_CENTRAL_MARKET_API_BASE_URL") ?? DEFAULT_TREESEED_MARKET_BASE_URL,
-    TREESEED_MARKET_API_BASE_URL: resolveConfiguredMarketBaseUrl(deployConfig),
-    TREESEED_CATALOG_MARKET_API_BASE_URLS: envOrNull("TREESEED_CATALOG_MARKET_API_BASE_URLS") ?? resolveConfiguredMarketBaseUrl(deployConfig),
+    TREESEED_CENTRAL_MARKET_API_BASE_URL: resolveConfiguredCentralMarketBaseUrl(deployConfig, target),
+    TREESEED_MARKET_API_BASE_URL: resolveConfiguredMarketBaseUrl(deployConfig, target),
+    TREESEED_API_BASE_URL: resolveConfiguredMarketBaseUrl(deployConfig, target),
+    TREESEED_CATALOG_MARKET_API_BASE_URLS: resolveConfiguredMarketBaseUrl(deployConfig, target) ?? envOrNull("TREESEED_CATALOG_MARKET_API_BASE_URLS"),
     TREESEED_HOSTING_TEAM_ID: contentDefaultTeamId,
+    TREESEED_PROJECT_DOMAINS: projectDomain ?? "",
     TREESEED_PROJECT_ID: identity.projectId,
-    TREESEED_AGENT_EXECUTION_PROVIDER: deployConfig.providers?.agents?.execution ?? "stub",
-    TREESEED_AGENT_REPOSITORY_PROVIDER: deployConfig.providers?.agents?.repository ?? "stub",
-    TREESEED_AGENT_VERIFICATION_PROVIDER: deployConfig.providers?.agents?.verification ?? "stub",
+    TREESEED_AGENT_EXECUTION_PROVIDER: deployConfig.providers?.agents?.execution ?? "codex",
+    TREESEED_AGENT_REPOSITORY_PROVIDER: deployConfig.providers?.agents?.repository ?? "git",
+    TREESEED_AGENT_VERIFICATION_PROVIDER: deployConfig.providers?.agents?.verification ?? "local",
     TREESEED_CONTENT_RUNTIME_PROVIDER: contentRuntimeProvider,
     TREESEED_CONTENT_PUBLISH_PROVIDER: contentPublishProvider,
     TREESEED_CONTENT_SERVING_MODE: contentServingMode,
@@ -380,7 +415,7 @@ function envValue(env, key) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 const LOCAL_RUNTIME_AUTH_ENV_KEYS = [
-  "BETTER_AUTH_URL",
+  "TREESEED_BETTER_AUTH_URL",
   "TREESEED_SITE_URL",
   "TREESEED_AUTH_MODE",
   "TREESEED_AUTH_INTERNAL_SIGNUP",
@@ -478,15 +513,7 @@ function defaultStateFromConfig(deployConfig, target) {
         previewDatabaseId: `dryrun-${suffix}-site-data-preview`
       }
     },
-    queues: {
-      agentWork: {
-        name: environmentScopedIdentityName(identity, deployConfig.cloudflare.queueName ?? "agent-work", target),
-        dlqName: environmentScopedIdentityName(identity, deployConfig.cloudflare.dlqName ?? "agent-work-dlq", target),
-        binding: deployConfig.cloudflare.queueBinding ?? "AGENT_WORK_QUEUE",
-        queueId: null,
-        dlqId: null
-      }
-    },
+    queues: {},
     pages: {
       projectName: resolveConfiguredPagesProjectName(deployConfig),
       productionBranch: deployConfig.cloudflare.pages?.productionBranch ?? "main",
@@ -655,19 +682,7 @@ function loadDeployState(tenantRoot, deployConfig, options = {}) {
         binding: defaults.d1Databases.SITE_DATA_DB.binding
       }
     },
-    queues: {
-      ...defaults.queues ?? {},
-      ...persisted.queues ?? {},
-      agentWork: {
-        ...defaults.queues?.agentWork ?? {},
-        ...persisted.queues?.agentWork ?? {},
-        name: defaults.queues?.agentWork?.name ?? persisted.queues?.agentWork?.name ?? "agent-work",
-        dlqName: defaults.queues?.agentWork?.dlqName ?? persisted.queues?.agentWork?.dlqName ?? "agent-work-dlq",
-        binding: defaults.queues?.agentWork?.binding ?? persisted.queues?.agentWork?.binding ?? "AGENT_WORK_QUEUE",
-        queueId: persisted.queues?.agentWork?.queueId ?? defaults.queues?.agentWork?.queueId ?? null,
-        dlqId: persisted.queues?.agentWork?.dlqId ?? defaults.queues?.agentWork?.dlqId ?? null
-      }
-    },
+    queues: {},
     generatedSecrets: {
       ...defaults.generatedSecrets ?? {},
       ...persisted.generatedSecrets ?? {}
@@ -906,7 +921,7 @@ function runWrangler(args, { cwd, allowFailure = false, json = false, capture =
         output || `Wrangler command failed: ${args.join(" ")}`,
         "",
         "Treeseed Cloudflare authentication failed. Check that CLOUDFLARE_API_TOKEN is an account-level token scoped to the target account and domain.",
-        "Required Cloudflare permissions: Account Cloudflare Pages edit, Account Workers Scripts edit, Account Workers KV Storage edit, Account D1 edit, Account Queues edit, Zone DNS edit."
+        "Required Cloudflare permissions: account Pages Write, Workers Scripts Write, Workers KV Storage Write, Workers R2 Storage Write, D1 Write, Queues Write, Turnstile Sites Write, Account Rulesets Write, and Account Rule Lists Write; target zone Zone Read, DNS Write, Cache Settings Write, and SSL and Certificates Write."
       ].join("\n"));
     }
     throw new Error(output || `Wrangler command failed: ${args.join(" ")}`);
@@ -925,7 +940,7 @@ function isWranglerAlreadyExistsError(error, matchers) {
   return matchers.some((matcher) => matcher.test(message));
 }
 function listKvNamespaces(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -936,7 +951,7 @@ function listKvNamespaces(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listD1Databases(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -947,7 +962,7 @@ function listD1Databases(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listQueues(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -958,7 +973,7 @@ function listQueues(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listR2Buckets(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -969,7 +984,7 @@ function listR2Buckets(tenantRoot, env) {
   return Array.isArray(payload?.result?.buckets) ? payload.result.buckets : [];
 }
 function listPagesProjects(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -980,7 +995,7 @@ function listPagesProjects(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listTurnstileWidgets(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -990,8 +1005,50 @@ function listTurnstileWidgets(tenantRoot, env) {
   });
   return Array.isArray(payload?.result) ? payload.result : [];
 }
+function listWorkers(tenantRoot, env) {
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
+  if (!accountId) {
+    return [];
+  }
+  const payload = cloudflareApiRequest(`/accounts/${encodeURIComponent(accountId)}/workers/services?per_page=100`, {
+    env,
+    allowFailure: true
+  });
+  return Array.isArray(payload?.result) ? payload.result : [];
+}
+function listDnsZones(env) {
+  const payload = cloudflareApiRequest("/zones?per_page=100", {
+    env,
+    allowFailure: true
+  });
+  return Array.isArray(payload?.result) ? payload.result : [];
+}
+function listDnsRecords(zoneId, env) {
+  if (!zoneId) {
+    return [];
+  }
+  const records = [];
+  let page = 1;
+  let totalPages = 1;
+  while (page <= totalPages && page <= 50) {
+    const payload = cloudflareApiRequest(
+      `/zones/${encodeURIComponent(zoneId)}/dns_records?per_page=100&page=${page}`,
+      { env, allowFailure: true }
+    );
+    if (payload?.success === false) {
+      break;
+    }
+    if (Array.isArray(payload?.result)) {
+      records.push(...payload.result);
+    }
+    const reportedTotal = Number(payload?.result_info?.total_pages);
+    totalPages = Number.isFinite(reportedTotal) && reportedTotal > 0 ? reportedTotal : page;
+    page += 1;
+  }
+  return records;
+}
 function getTurnstileWidget(env, sitekey) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId || !sitekey) {
     return null;
   }
@@ -1002,7 +1059,7 @@ function getTurnstileWidget(env, sitekey) {
   return payload?.result ?? null;
 }
 function createTurnstileWidget(env, input) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     throw new Error("Configure CLOUDFLARE_ACCOUNT_ID before creating Turnstile widgets.");
   }
@@ -1022,7 +1079,7 @@ function createTurnstileWidget(env, input) {
   }
 }
 function updateTurnstileWidget(env, sitekey, input) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId || !sitekey) {
     throw new Error("Configure CLOUDFLARE_ACCOUNT_ID and sitekey before updating Turnstile widgets.");
   }
@@ -1125,13 +1182,10 @@ function buildProvisioningSummary(deployConfig, state, target) {
     formGuardKv: state.kvNamespaces.FORM_GUARD_KV,
     sessionKv: state.kvNamespaces.SESSION ?? null,
     siteDataDb: state.d1Databases.SITE_DATA_DB,
-    queue: state.queues?.agentWork ?? null,
     content: state.content ?? null,
     resources: {
       pagesProject: state.pages?.projectName ?? null,
       contentBucket: state.content?.bucketName ?? null,
-      queue: state.queues?.agentWork?.name ?? null,
-      dlq: state.queues?.agentWork?.dlqName ?? null,
       database: state.d1Databases?.SITE_DATA_DB?.databaseName ?? null,
       turnstileWidget: state.turnstileWidgets?.formGuard?.name ?? null,
       formGuardKv: state.kvNamespaces?.FORM_GUARD_KV?.name ?? null,
@@ -1199,6 +1253,13 @@ function shouldManageCloudflareWebCacheRules(deployConfig, target) {
   return Boolean(webTarget?.host && !webTarget.host.endsWith(".workers.dev") && !webTarget.host.endsWith(".pages.dev"));
 }
 function cloudflareApiRequest(path, { method = "GET", body, env, allowFailure = false } = {}) {
+  const token = env?.TREESEED_CLOUDFLARE_API_TOKEN ?? env?.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? "";
+  if (!token) {
+    if (allowFailure) {
+      return null;
+    }
+    throw new Error(`Cloudflare API token is required: ${method} ${path}`);
+  }
   const requestScript = `import { readFileSync } from 'node:fs';
 import { request } from 'node:https';
 const input = JSON.parse(readFileSync(0, 'utf8') || '{}');
@@ -1262,9 +1323,13 @@ try {
     method,
     body,
     timeoutMs: 12e3,
-    token: env?.CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? ""
+    token
   });
-  const isTransient = (text) => /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|aborted/iu.test(text || "");
+  const isTransient = (text) => /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|aborted|rate limit|too many requests|throttl|please wait/iu.test(text || "");
+  const retryDelay = (text, currentAttempt) => {
+    const base = /rate limit|too many requests|throttl|please wait/iu.test(text || "") ? 2500 : 500;
+    return base * (currentAttempt + 1);
+  };
   const formatPayloadErrors = (payload) => Array.isArray(payload?.errors) ? payload.errors.map((entry) => entry?.message ?? JSON.stringify(entry)).join("; ") : "";
   const summarizeChildError = (text) => {
     const lines = String(text || "").split("\n").map((line) => line.trim()).filter(Boolean);
@@ -1288,9 +1353,9 @@ try {
       }
     );
     if (response.error?.code === "ETIMEDOUT") {
-      if (attempt < 4) {
+      if (attempt < 7) {
         attempt += 1;
-        sleepSync(500 * attempt);
+        sleepSync(retryDelay("timed out", attempt));
         continue;
       }
       if (!allowFailure) {
@@ -1300,9 +1365,9 @@ try {
     }
     const stderr = response.stderr?.trim() || "";
     if (response.status !== 0) {
-      if (attempt < 4 && isTransient(stderr)) {
+      if (attempt < 7 && isTransient(stderr)) {
         attempt += 1;
-        sleepSync(500 * attempt);
+        sleepSync(retryDelay(stderr, attempt));
         continue;
       }
       if (!allowFailure) {
@@ -1323,9 +1388,9 @@ try {
       };
     }
     const details = formatPayloadErrors(parsed.payload);
-    if (!parsed.ok && parsed.transient && attempt < 4 && isTransient(details)) {
+    if (!parsed.ok && isTransient(details) && attempt < 7) {
       attempt += 1;
-      sleepSync(500 * attempt);
+      sleepSync(retryDelay(details, attempt));
       continue;
     }
     if (!parsed.ok && !allowFailure) {
@@ -1352,6 +1417,13 @@ function listCloudflareZoneRulesets(zoneId, env) {
   const result = cloudflareApiRequest(`/zones/${zoneId}/rulesets`, { env, allowFailure: true });
   return Array.isArray(result?.result) ? result.result : [];
 }
+function joinCloudflareAndExpression(clauses) {
+  const parts = clauses.map((clause) => typeof clause === "string" ? clause.trim() : "").filter((clause) => clause.length > 0).map((clause) => clause.startsWith("(") && clause.endsWith(")") ? clause : `(${clause})`);
+  if (parts.length === 0) {
+    throw new Error("Cannot build a Cloudflare expression without predicates.");
+  }
+  return `(${parts.join(" and ")})`;
+}
 function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kind) {
   if (!cacheTarget?.host) {
     return [];
@@ -1359,12 +1431,16 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
   const policy = resolveTreeseedWebCachePolicy(deployConfig);
   const cachePolicy = kind === "web" ? policy.contentPages : policy.r2PublishedObjects;
   const hostExpression = `(http.host eq "${cacheTarget.host}")`;
-  const pathExpression = cacheTarget.pathPrefix ? `(starts_with(http.request.uri.path, "${cacheTarget.pathPrefix}/") or (http.request.uri.path eq "${cacheTarget.pathPrefix}"))` : "true";
+  const pathExpression = cacheTarget.pathPrefix ? `(starts_with(http.request.uri.path, "${cacheTarget.pathPrefix}/") or (http.request.uri.path eq "${cacheTarget.pathPrefix}"))` : null;
   if (kind === "content") {
     return [
       {
         description: "treeseed-managed: cache public r2 objects",
-        expression: `((${hostExpression}) and (${pathExpression}) and (http.request.method in {"GET" "HEAD"}))`,
+        expression: joinCloudflareAndExpression([
+          hostExpression,
+          pathExpression,
+          '(http.request.method in {"GET" "HEAD"})'
+        ]),
         action: "set_cache_settings",
         action_parameters: {
           cache: true,
@@ -1382,21 +1458,31 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
     ];
   }
   const sourcePaths = policy.sourcePages.paths.map((path) => path === "/" ? "/" : path.replace(/\/+$/u, ""));
-  const sourcePathExpression = sourcePaths.length > 0 ? `(${sourcePaths.map((path) => `(http.request.uri.path eq "${path}")`).join(" or ")})` : "false";
-  const notSourcePathExpression = sourcePaths.length > 0 ? `not ${sourcePathExpression}` : "true";
-  return [
+  const sourcePathExpression = sourcePaths.length > 0 ? `(${sourcePaths.map((path) => `(http.request.uri.path eq "${path}")`).join(" or ")})` : null;
+  const notSourcePathExpression = sourcePaths.length > 0 ? `not ${sourcePathExpression}` : null;
+  const rules = [
     {
       description: "treeseed-managed: bypass preview and dynamic routes",
-      expression: `((${hostExpression}) and ((starts_with(http.request.uri.path, "/api/")) or (http.request.uri.path eq "/api") or (starts_with(http.request.uri.path, "/auth")) or (starts_with(http.request.uri.path, "/admin")) or (starts_with(http.request.uri.path, "/app")) or (starts_with(http.request.uri.path, "/internal")) or (http.request.uri.query contains "preview=") or (http.cookie contains "treeseed-content-preview=")))`,
+      expression: joinCloudflareAndExpression([
+        hostExpression,
+        '((starts_with(http.request.uri.path, "/api/")) or (http.request.uri.path eq "/api") or (starts_with(http.request.uri.path, "/auth")) or (starts_with(http.request.uri.path, "/admin")) or (starts_with(http.request.uri.path, "/app")) or (starts_with(http.request.uri.path, "/internal")) or (http.request.uri.query contains "preview=") or (http.cookie contains "treeseed-content-preview="))'
+      ]),
       action: "set_cache_settings",
       action_parameters: {
         cache: false
       },
       enabled: true
-    },
-    {
+    }
+  ];
+  if (sourcePathExpression) {
+    rules.push({
       description: "treeseed-managed: cache source html routes",
-      expression: `((${hostExpression}) and (${pathExpression}) and (${sourcePathExpression}) and (http.request.method in {"GET" "HEAD"}))`,
+      expression: joinCloudflareAndExpression([
+        hostExpression,
+        pathExpression,
+        sourcePathExpression,
+        '(http.request.method in {"GET" "HEAD"})'
+      ]),
       action: "set_cache_settings",
       action_parameters: {
         cache: true,
@@ -1410,10 +1496,26 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
         }
       },
       enabled: true
-    },
+    });
+  }
+  rules.push(
     {
       description: "treeseed-managed: cache content html routes",
-      expression: `((${hostExpression}) and (${pathExpression}) and (${notSourcePathExpression}) and (http.request.method in {"GET" "HEAD"}) and (http.request.uri.path.extension eq "") and not (starts_with(http.request.uri.path, "/api/")) and not (http.request.uri.path eq "/api") and not (starts_with(http.request.uri.path, "/auth")) and not (starts_with(http.request.uri.path, "/admin")) and not (starts_with(http.request.uri.path, "/app")) and not (starts_with(http.request.uri.path, "/internal")) and not (http.request.uri.query contains "preview=") and not (http.cookie contains "treeseed-content-preview="))`,
+      expression: joinCloudflareAndExpression([
+        hostExpression,
+        pathExpression,
+        notSourcePathExpression,
+        '(http.request.method in {"GET" "HEAD"})',
+        '(http.request.uri.path.extension eq "")',
+        'not (starts_with(http.request.uri.path, "/api/"))',
+        'not (http.request.uri.path eq "/api")',
+        'not (starts_with(http.request.uri.path, "/auth"))',
+        'not (starts_with(http.request.uri.path, "/admin"))',
+        'not (starts_with(http.request.uri.path, "/app"))',
+        'not (starts_with(http.request.uri.path, "/internal"))',
+        'not (http.request.uri.query contains "preview=")',
+        'not (http.cookie contains "treeseed-content-preview=")'
+      ]),
       action: "set_cache_settings",
       action_parameters: {
         cache: true,
@@ -1428,7 +1530,8 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
       },
       enabled: true
     }
-  ];
+  );
+  return rules;
 }
 function reconcileCloudflareCacheRulesForTarget(role, deployConfig, state, cacheTarget, env, { dryRun = false } = {}) {
   const roleKey = role === "web" ? "Web" : "Content";
@@ -1482,7 +1585,7 @@ function reconcileCloudflareWebCacheRules(tenantRoot, deployConfig, state, targe
     return { managed: false, skipped: true, reason: "unsupported_target_or_host" };
   }
   const env = {
-    CLOUDFLARE_API_TOKEN: providedEnv?.CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? ""
+    CLOUDFLARE_API_TOKEN: providedEnv?.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? ""
   };
   if (!env.CLOUDFLARE_API_TOKEN) {
     state.webCache.webHost = resolvePublicWebCacheTarget(deployConfig)?.host ?? null;
@@ -1555,7 +1658,7 @@ function queueId(entry) {
 }
 function hasProvisionedCloudflareResources(state) {
   return Boolean(
-    state?.pages?.projectName && state?.pages?.url && state?.d1Databases?.SITE_DATA_DB?.databaseId && state?.kvNamespaces?.FORM_GUARD_KV?.id && state?.queues?.agentWork?.name && state?.content?.bucketName
+    state?.pages?.projectName && state?.pages?.url && state?.d1Databases?.SITE_DATA_DB?.databaseId && state?.kvNamespaces?.FORM_GUARD_KV?.id && state?.content?.bucketName
   );
 }
 function absoluteUrlForPath(baseUrl, path) {
@@ -1585,14 +1688,14 @@ function purgeSourcePageCaches(tenantRoot, options = {}) {
   const deployConfig = loadTenantDeployConfig(tenantRoot);
   const state = loadDeployState(tenantRoot, deployConfig, { target });
   const urls = resolveSourcePagePurgeUrls(deployConfig);
-  if ((options.dryRun ?? false) || urls.length === 0 || !process.env.CLOUDFLARE_API_TOKEN) {
+  if ((options.dryRun ?? false) || urls.length === 0 || !process.env.TREESEED_CLOUDFLARE_API_TOKEN) {
     recordCachePurgeResult(state.webCache.deployPurge, urls.map((url) => ({ count: url ? 1 : 0 })));
     writeDeployState(tenantRoot, state, { target });
     return { skipped: options.dryRun ?? false, urls, results: [] };
   }
   try {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
-      env: { CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN }
+      env: { CLOUDFLARE_API_TOKEN: process.env.TREESEED_CLOUDFLARE_API_TOKEN }
     });
     recordCachePurgeResult(state.webCache.deployPurge, results);
     writeDeployState(tenantRoot, state, { target });
@@ -1607,14 +1710,14 @@ function purgePublishedContentCaches(tenantRoot, urls, options = {}) {
   const target = normalizeTarget(options.scope ?? options.target ?? "prod");
   const deployConfig = loadTenantDeployConfig(tenantRoot);
   const state = loadDeployState(tenantRoot, deployConfig, { target });
-  if ((options.dryRun ?? false) || !urls?.length || !process.env.CLOUDFLARE_API_TOKEN) {
+  if ((options.dryRun ?? false) || !urls?.length || !process.env.TREESEED_CLOUDFLARE_API_TOKEN) {
     recordCachePurgeResult(state.webCache.contentPurge, (urls ?? []).map((url) => ({ count: url ? 1 : 0 })));
     writeDeployState(tenantRoot, state, { target });
     return { skipped: options.dryRun ?? false, urls: urls ?? [], results: [] };
   }
   try {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
-      env: { CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN }
+      env: { CLOUDFLARE_API_TOKEN: process.env.TREESEED_CLOUDFLARE_API_TOKEN }
     });
     recordCachePurgeResult(state.webCache.contentPurge, results);
     writeDeployState(tenantRoot, state, { target });
@@ -1634,8 +1737,41 @@ function isPlaceholderAccountId(value) {
 function resolveConfiguredCloudflareAccountId(deployConfig) {
   return envOrNull("CLOUDFLARE_ACCOUNT_ID") ?? deployConfig.cloudflare.accountId;
 }
-function resolveConfiguredMarketBaseUrl(deployConfig) {
-  return envOrNull("TREESEED_MARKET_API_BASE_URL") ?? envOrNull("TREESEED_CENTRAL_MARKET_API_BASE_URL") ?? deployConfig.runtime?.marketBaseUrl ?? deployConfig.hosting?.marketBaseUrl ?? DEFAULT_TREESEED_MARKET_BASE_URL;
+function normalizeConfiguredBaseUrl(value) {
+  const raw = typeof value === "string" ? value.trim() : "";
+  if (!raw) {
+    return null;
+  }
+  return raw.replace(/\/+$/u, "");
+}
+function domainBaseUrl(domain) {
+  const raw = typeof domain === "string" ? domain.trim() : "";
+  if (!raw) {
+    return null;
+  }
+  if (/^https?:\/\//iu.test(raw)) {
+    return normalizeConfiguredBaseUrl(raw);
+  }
+  return `https://${raw.replace(/^\/+|\/+$/gu, "")}`;
+}
+function targetEnvironmentKey(target) {
+  if (target?.kind === "persistent") {
+    return target.scope;
+  }
+  return "staging";
+}
+function resolveConfiguredApiConnectionBaseUrl(deployConfig, target) {
+  const scope = targetEnvironmentKey(target);
+  if (scope === "local") {
+    return normalizeConfiguredBaseUrl(deployConfig.connections?.api?.localBaseUrl) ?? normalizeConfiguredBaseUrl(deployConfig.connections?.api?.environments?.local?.baseUrl) ?? domainBaseUrl(deployConfig.connections?.api?.environments?.local?.domain);
+  }
+  return normalizeConfiguredBaseUrl(deployConfig.connections?.api?.environments?.[scope]?.baseUrl) ?? domainBaseUrl(deployConfig.connections?.api?.environments?.[scope]?.domain);
+}
+function resolveConfiguredMarketBaseUrl(deployConfig, target) {
+  return resolveConfiguredApiConnectionBaseUrl(deployConfig, target) ?? envOrNull("TREESEED_API_BASE_URL") ?? deployConfig.runtime?.marketBaseUrl ?? deployConfig.hosting?.marketBaseUrl ?? envOrNull("TREESEED_CENTRAL_MARKET_API_BASE_URL") ?? DEFAULT_TREESEED_MARKET_BASE_URL;
+}
+function resolveConfiguredCentralMarketBaseUrl(deployConfig, target) {
+  return resolveConfiguredApiConnectionBaseUrl(deployConfig, target) ?? envOrNull("TREESEED_CENTRAL_MARKET_API_BASE_URL") ?? DEFAULT_TREESEED_MARKET_BASE_URL;
 }
 function resolveConfiguredPagesProjectName(deployConfig) {
   return sharedDeploymentName(resolveTreeseedResourceIdentity(deployConfig, createPersistentDeployTarget("prod")));
@@ -1803,7 +1939,7 @@ function resolveExistingD1ByName(d1Databases, expectedName, current) {
   };
 }
 function looksLikeMissingResource(output) {
-  return /not found|does not exist|could(?: not|n't) find|couldnt find/i.test(output);
+  return /not found|does not exist|could(?: not|n't) find|couldnt find|already deleted|deleted widget|access a deleted/i.test(output);
 }
 function deleteKvNamespace(tenantRoot, namespaceId, { env, dryRun, preview = false }) {
   if (!namespaceId || isPlaceholderResourceId(namespaceId)) {
@@ -1812,7 +1948,7 @@ function deleteKvNamespace(tenantRoot, namespaceId, { env, dryRun, preview = fal
   if (dryRun) {
     return { status: "planned", id: namespaceId, preview };
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces/${encodeURIComponent(namespaceId)}` : null;
   const deleted = deleteCloudflareApiResource(path, { env, dryRun: false, name: namespaceId, type: "kv-namespace" });
   return { status: deleted.status, id: namespaceId, preview };
@@ -1824,7 +1960,7 @@ function deleteTurnstileWidget(sitekey, { env, dryRun, name = null }) {
   if (dryRun) {
     return { status: "planned", sitekey, name };
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/challenges/widgets/${encodeURIComponent(sitekey)}` : null;
   let deleted;
   try {
@@ -1842,7 +1978,7 @@ function deleteD1Database(tenantRoot, databaseName, { env, dryRun }) {
   if (dryRun) {
     return { status: "planned", name: databaseName };
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const database = accountId ? listD1Databases(tenantRoot, env).find((entry) => entry?.name === databaseName) : null;
   const databaseId = database?.uuid ?? database?.id ?? null;
   const path = accountId && databaseId ? `/accounts/${encodeURIComponent(accountId)}/d1/database/${encodeURIComponent(databaseId)}` : null;
@@ -1856,7 +1992,7 @@ function deleteWorker(tenantRoot, workerName, { env, dryRun, force = false }) {
   if (dryRun) {
     return { status: "planned", name: workerName };
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/workers/services/${encodeURIComponent(workerName)}` : null;
   const deleted = deleteCloudflareApiResource(path, { env, dryRun: false, name: workerName, type: "worker" });
   return { status: deleted.status, name: workerName };
@@ -1895,7 +2031,7 @@ function deleteQueueByName(tenantRoot, queue, { env, dryRun }) {
   if (dryRun) {
     return resourceOperation("cloudflare", "queue", name, "planned", { id });
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!id && accountId) {
     const live = listQueues(tenantRoot, env).find((entry) => queueName(entry) === name);
     id = queueId(live);
@@ -1912,25 +2048,6 @@ function deleteQueueByName(tenantRoot, queue, { env, dryRun }) {
   }
   throw new Error(`Failed to delete queue ${name}: CLOUDFLARE_ACCOUNT_ID is not configured.`);
 }
-function isLegacyTreeseedQueueName(name, scope) {
-  if (!name || !scope) {
-    return false;
-  }
-  const environmentNames = scope === "prod" ? ["prod", "production"] : [scope];
-  return environmentNames.some(
-    (environmentName) => name === `agent-work-${environmentName}` || name === `agent-work-dlq-${environmentName}`
-  );
-}
-function legacyQueueDestroyOperations(tenantRoot, queues, target, knownNames, { env, dryRun }) {
-  const scope = target.kind === "persistent" ? target.scope : target.branchName;
-  return queues.filter((queue) => {
-    const name = queueName(queue);
-    return name && !knownNames.has(name) && isLegacyTreeseedQueueName(name, scope);
-  }).map((queue) => {
-    const deleted = deleteQueueByName(tenantRoot, queue, { env, dryRun });
-    return { ...deleted, legacy: true };
-  });
-}
 function deleteR2Bucket(tenantRoot, bucketName, { env, dryRun, deleteData }) {
   if (!bucketName) {
     return resourceOperation("cloudflare", "r2-bucket", bucketName, "missing");
@@ -1942,7 +2059,7 @@ function deleteR2Bucket(tenantRoot, bucketName, { env, dryRun, deleteData }) {
     return resourceOperation("cloudflare", "r2-bucket", bucketName, "planned");
   }
   const drained = drainR2Bucket(bucketName, { env });
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}` : null;
   const deleted = deleteCloudflareApiResource(path, { env, dryRun: false, name: bucketName, type: "r2-bucket" });
   return resourceOperation("cloudflare", "r2-bucket", bucketName, deleted.status, drained);
@@ -1951,15 +2068,15 @@ function r2ObjectKey(entry) {
   return typeof entry?.key === "string" ? entry.key : typeof entry?.name === "string" ? entry.name : "";
 }
 function listR2Objects(bucketName, { env }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId || !bucketName) {
     return [];
   }
   const objects = [];
   let cursor = "";
-  for (let page = 0; page < 100; page += 1) {
+  for (let page = 0; page < 20; page += 1) {
     const payload = cloudflareApiRequest(
-      `/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}/objects?per_page=1000${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`,
+      `/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}/objects?per_page=200${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`,
       { env, allowFailure: true }
     );
     if (payload?.success === false) {
@@ -1972,45 +2089,156 @@ function listR2Objects(bucketName, { env }) {
       break;
     }
     cursor = nextCursor;
+    if (objects.length >= 200) {
+      break;
+    }
   }
   return objects;
 }
 function drainR2Bucket(bucketName, { env }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId || !bucketName) {
-    return { objectsDeleted: 0 };
+    return { objectsDeleted: 0, objectsMissing: 0, objectsDeferred: 0 };
   }
   let objectsDeleted = 0;
+  let objectsMissing = 0;
+  let objectsDeferred = 0;
   for (let batch = 0; batch < 100; batch += 1) {
     const objects = listR2Objects(bucketName, { env });
     if (objects.length === 0) {
       break;
     }
-    let batchDeleted = 0;
-    for (const object of objects) {
-      const key = r2ObjectKey(object);
-      if (!key) {
+    const keys = objects.map((object) => r2ObjectKey(object)).filter(Boolean);
+    const deleted = deleteR2ObjectsBatch(bucketName, keys, { env });
+    objectsDeleted += deleted.objectsDeleted;
+    objectsMissing += deleted.objectsMissing;
+    objectsDeferred += deleted.objectsDeferred;
+    const batchDeleted = deleted.objectsDeleted + deleted.objectsMissing;
+    if (batchDeleted === 0) {
+      if (deleted.objectsDeferred > 0) {
+        sleepSync(3e3);
         continue;
       }
-      const result = cloudflareApiRequest(
-        `/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}/objects/${encodeURIComponent(key)}`,
-        { method: "DELETE", env, allowFailure: true }
-      );
-      if (result?.success === false) {
-        const message = formatCloudflareErrors(result);
-        if (looksLikeMissingResource(message)) {
-          continue;
-        }
-        throw new Error(message || `Failed to delete R2 object ${key}.`);
-      }
-      objectsDeleted += 1;
-      batchDeleted += 1;
-    }
-    if (batchDeleted === 0) {
       break;
     }
+    if (deleted.objectsDeferred > 0) {
+      sleepSync(1500);
+    }
+  }
+  return { objectsDeleted, objectsMissing, objectsDeferred };
+}
+function deleteR2ObjectsBatch(bucketName, keys, { env }) {
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
+  const token = env?.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? "";
+  const uniqueKeys = [...new Set((keys ?? []).filter(Boolean))];
+  if (!accountId || !bucketName || uniqueKeys.length === 0) {
+    return { objectsDeleted: 0, objectsMissing: 0, objectsDeferred: 0 };
+  }
+  const script = `
+const input = JSON.parse(await new Promise((resolve) => {
+	let body = '';
+	process.stdin.setEncoding('utf8');
+	process.stdin.on('data', (chunk) => { body += chunk; });
+	process.stdin.on('end', () => resolve(body || '{}'));
+}));
+let index = 0;
+let deleted = 0;
+let missing = 0;
+let deferred = 0;
+const failed = [];
+async function removeKey(key) {
+	function encodeObjectKey(value) {
+		return String(value).split('/').map((part) => encodeURIComponent(part)).join('/');
+	}
+	const url = 'https://api.cloudflare.com/client/v4/accounts/'
+		+ encodeURIComponent(input.accountId)
+		+ '/r2/buckets/'
+		+ encodeURIComponent(input.bucketName)
+		+ '/objects/'
+		+ encodeObjectKey(key);
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), input.timeoutMs || 15000);
+		try {
+			const response = await fetch(url, {
+				method: 'DELETE',
+				headers: { authorization: 'Bearer ' + input.token },
+				signal: controller.signal,
+			});
+			const text = await response.text();
+			let payload = {};
+			try { payload = text ? JSON.parse(text) : {}; } catch { payload = { errors: [{ message: text }] }; }
+			if (response.ok && payload.success !== false) {
+				deleted += 1;
+				return;
+			}
+			const message = Array.isArray(payload.errors) ? payload.errors.map((entry) => entry?.message || JSON.stringify(entry)).join('; ') : text;
+			if (/not found|does not exist|deleted|missing/i.test(message || '')) {
+				missing += 1;
+				return;
+			}
+			if (response.status === 429 || /rate limit|too many requests/i.test(message || '')) {
+				await new Promise((resolve) => setTimeout(resolve, 750 * (attempt + 1)));
+				continue;
+			}
+			failed.push({ key, message: message || \`delete failed with status \${response.status}\` });
+			return;
+		} catch (error) {
+			if (attempt < 5 && /aborted|timed out|fetch failed|econnreset/i.test(error instanceof Error ? error.message : String(error))) {
+				await new Promise((resolve) => setTimeout(resolve, 750 * (attempt + 1)));
+				continue;
+			}
+			failed.push({ key, message: error instanceof Error ? error.message : String(error) });
+			return;
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+	deferred += 1;
+}
+async function worker() {
+	for (;;) {
+		const current = index;
+		index += 1;
+		if (current >= input.keys.length) return;
+		await removeKey(input.keys[current]);
+	}
+}
+await Promise.all(Array.from({ length: Math.min(input.concurrency || 4, input.keys.length) }, () => worker()));
+process.stdout.write(JSON.stringify({ deleted, missing, deferred, failed }));
+`.trim();
+  const result = spawnSync(process.execPath, ["--input-type=module", "-e", script], {
+    stdio: ["pipe", "pipe", "pipe"],
+    encoding: "utf8",
+    env: { ...process.env, ...env ?? {} },
+    input: JSON.stringify({
+      accountId,
+      bucketName,
+      keys: uniqueKeys,
+      token,
+      concurrency: 4,
+      timeoutMs: 12e3
+    }),
+    timeout: 12e4
+  });
+  if (result.status !== 0 || result.error) {
+    throw new Error(result.stderr?.trim() || result.error?.message || `Failed to delete R2 object batch for ${bucketName}.`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(result.stdout || "{}");
+  } catch {
+    throw new Error(`R2 object batch delete returned invalid JSON for ${bucketName}.`);
   }
-  return { objectsDeleted };
+  if (Array.isArray(parsed.failed) && parsed.failed.length > 0) {
+    const first = parsed.failed[0];
+    throw new Error(`Failed to delete ${parsed.failed.length} R2 objects from ${bucketName}: ${first?.message ?? first?.key ?? "unknown error"}`);
+  }
+  return {
+    objectsDeleted: Number(parsed.deleted) || 0,
+    objectsMissing: Number(parsed.missing) || 0,
+    objectsDeferred: Number(parsed.deferred) || 0
+  };
 }
 function deleteD1DatabaseForDestroy(tenantRoot, databaseName, { env, dryRun, deleteData }) {
   if (!deleteData) {
@@ -2023,7 +2251,7 @@ function pagesDomainName(domain) {
   return typeof domain?.name === "string" ? domain.name : typeof domain?.domain === "string" ? domain.domain : typeof domain?.hostname === "string" ? domain.hostname : "";
 }
 function listPagesCustomDomains(projectName, { env }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!projectName || !accountId) {
     return [];
   }
@@ -2066,20 +2294,20 @@ function listPagesCustomDomainsWithWrangler(tenantRoot, projectName, { env }) {
     return [];
   }
 }
-function deletePagesCustomDomains(tenantRoot, projectName, knownNames, { env, dryRun }) {
+function deletePagesCustomDomains(tenantRoot, projectName, knownNames, { env, dryRun, knownOnly = false }) {
   if (!projectName) {
     return [resourceOperation("cloudflare", "pages-custom-domain", projectName, "missing")];
   }
   const desiredNames = [...new Set((knownNames ?? []).filter(Boolean))];
   if (dryRun) {
-    return desiredNames.length > 0 ? desiredNames.map((name) => resourceOperation("cloudflare", "pages-custom-domain", name, "planned", { projectName })) : [resourceOperation("cloudflare", "pages-custom-domain", projectName, "planned", { reason: "project_delete_prerequisite" })];
+    return desiredNames.length > 0 ? desiredNames.map((name) => resourceOperation("cloudflare", "pages-custom-domain", name, "planned", { projectName, knownOnly })) : [resourceOperation("cloudflare", "pages-custom-domain", projectName, knownOnly ? "skipped" : "planned", { reason: knownOnly ? "no_target_scoped_domain" : "project_delete_prerequisite" })];
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return desiredNames.length > 0 ? desiredNames.map((name) => resourceOperation("cloudflare", "pages-custom-domain", name, "blocked", { projectName, reason: "missing_cloudflare_account_id" })) : [resourceOperation("cloudflare", "pages-custom-domain", projectName, "blocked", { reason: "missing_cloudflare_account_id" })];
   }
-  const listedNames = listPagesCustomDomains(projectName, { env }).map(pagesDomainName).filter(Boolean);
-  const wranglerNames = listPagesCustomDomainsWithWrangler(tenantRoot, projectName, { env });
+  const listedNames = knownOnly ? [] : listPagesCustomDomains(projectName, { env }).map(pagesDomainName).filter(Boolean);
+  const wranglerNames = knownOnly ? [] : listPagesCustomDomainsWithWrangler(tenantRoot, projectName, { env });
   const domainNames = [.../* @__PURE__ */ new Set([...desiredNames, ...listedNames, ...wranglerNames])];
   if (domainNames.length === 0) {
     return [resourceOperation("cloudflare", "pages-custom-domain", projectName, "missing", { projectName })];
@@ -2095,13 +2323,16 @@ function normalizePagesDeploymentId(deployment) {
 function normalizePagesDeployments(value) {
   return (Array.isArray(value) ? value : Array.isArray(value?.result) ? value.result : []).filter((entry) => normalizePagesDeploymentId(entry));
 }
-function listPagesDeploymentsWithApi(projectName, { env }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+function pagesDeploymentEnvironments(environment = "all") {
+  return environment === "preview" ? ["preview"] : environment === "production" ? ["production"] : ["preview", "production"];
+}
+function listPagesDeploymentsWithApi(projectName, { env, environment = "all" }) {
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!projectName || !accountId) {
     return [];
   }
   const deployments = [];
-  for (const pagesEnvironment of ["preview", "production"]) {
+  for (const pagesEnvironment of pagesDeploymentEnvironments(environment)) {
     let page = 1;
     let totalPages = 1;
     while (page <= totalPages && page <= 50) {
@@ -2120,9 +2351,9 @@ function listPagesDeploymentsWithApi(projectName, { env }) {
   }
   return deployments;
 }
-function listPagesDeployments(tenantRoot, projectName, { env }) {
+function listPagesDeployments(tenantRoot, projectName, { env, environment = "all" }) {
   const deployments = [];
-  for (const pagesEnvironment of ["preview", "production"]) {
+  for (const pagesEnvironment of pagesDeploymentEnvironments(environment)) {
     const result = runWrangler(["pages", "deployment", "list", "--project-name", projectName, "--environment", pagesEnvironment, "--json"], {
       cwd: tenantRoot,
       allowFailure: true,
@@ -2141,16 +2372,16 @@ function listPagesDeployments(tenantRoot, projectName, { env }) {
     const byId = new Map(deployments.map((deployment) => [normalizePagesDeploymentId(deployment), deployment]));
     return [...byId.values()];
   }
-  return listPagesDeploymentsWithApi(projectName, { env });
+  return listPagesDeploymentsWithApi(projectName, { env, environment });
 }
-function deletePagesDeployments(tenantRoot, projectName, { env, dryRun }) {
+function deletePagesDeployments(tenantRoot, projectName, { env, dryRun, environment = "all" }) {
   if (!projectName) {
     return resourceOperation("cloudflare", "pages-deployments", projectName, "missing");
   }
   if (dryRun) {
-    return resourceOperation("cloudflare", "pages-deployments", projectName, "planned", { reason: "project_delete_prerequisite" });
+    return resourceOperation("cloudflare", "pages-deployments", projectName, "planned", { reason: "project_delete_prerequisite", environment });
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return resourceOperation("cloudflare", "pages-deployments", projectName, "blocked", { reason: "missing_cloudflare_account_id" });
   }
@@ -2158,7 +2389,7 @@ function deletePagesDeployments(tenantRoot, projectName, { env, dryRun }) {
   let skipped = 0;
   let total = 0;
   for (let batch = 0; batch < 100; batch += 1) {
-    const deployments = listPagesDeployments(tenantRoot, projectName, { env });
+    const deployments = listPagesDeployments(tenantRoot, projectName, { env, environment });
     if (deployments.length === 0) {
       return resourceOperation("cloudflare", "pages-deployments", projectName, deleted > 0 ? "deleted" : "missing", {
         deleted,
@@ -2204,7 +2435,7 @@ function deletePagesDeployments(tenantRoot, projectName, { env, dryRun }) {
   });
 }
 function deletePagesProject(projectName, { env, dryRun }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!projectName || !accountId) {
     return resourceOperation("cloudflare", "pages-project", projectName, "missing");
   }
@@ -2286,31 +2517,31 @@ function configuredRailwayDestroyTargets(tenantRoot, deployConfig, scope) {
     identity = { deploymentKey: deployConfig.slug ?? deployConfig.name ?? "treeseed" };
   }
   const services = [];
-  for (const serviceKey of ["api", "marketOperationsRunner"]) {
+  for (const serviceKey of ["api", "operationsRunner"]) {
     const service = deployConfig.services?.[serviceKey];
     if (!service || service.enabled === false || (service.provider ?? "railway") !== "railway") {
       continue;
     }
-    const baseServiceName = service.railway?.serviceName ?? `${identity.deploymentKey}-${serviceKey === "marketOperationsRunner" ? "market-operations-runner" : serviceKey}`;
-    const runnerPool = serviceKey === "marketOperationsRunner" && service.railway?.runnerPool && typeof service.railway.runnerPool === "object" ? service.railway.runnerPool : null;
-    const count = serviceKey === "marketOperationsRunner" ? Math.max(1, Number.parseInt(String(runnerPool?.bootstrapCount ?? 1), 10) || 1) : 1;
+    const baseServiceName = service.railway?.serviceName ?? `${identity.deploymentKey}-${serviceKey === "operationsRunner" ? "operations-runner" : serviceKey}`;
+    const runnerPool = serviceKey === "operationsRunner" && service.railway?.runnerPool && typeof service.railway.runnerPool === "object" ? service.railway.runnerPool : null;
+    const count = serviceKey === "operationsRunner" ? Math.max(1, Number.parseInt(String(runnerPool?.bootstrapCount ?? 1), 10) || 1) : 1;
     for (let index = 1; index <= count; index += 1) {
-      const serviceName = serviceKey === "marketOperationsRunner" ? `${String(baseServiceName).replace(/-\d+$/u, "")}-${String(index).padStart(2, "0")}` : baseServiceName;
+      const serviceName = serviceKey === "operationsRunner" ? `${String(baseServiceName).replace(/-\d+$/u, "").replace(/-\d{2}$/u, "")}-${String(index).padStart(2, "0")}` : baseServiceName;
       services.push({
         key: serviceKey,
         projectName: service.railway?.projectName ?? identity.deploymentKey,
         serviceName,
         railwayEnvironment: normalizeRailwayEnvironmentName(service.environments?.[normalizedScope]?.railwayEnvironment ?? normalizedScope),
         domain: service.environments?.[normalizedScope]?.domain ?? null,
-        volumeMountPath: serviceKey === "marketOperationsRunner" ? service.railway?.volumeMountPath ?? runnerPool?.volumeMountPath ?? "/data" : null
+        volumeMountPath: serviceKey === "operationsRunner" ? service.railway?.volumeMountPath ?? runnerPool?.volumeMountPath ?? "/data" : null
       });
     }
   }
-  const marketDatabase = deployConfig.services?.marketDatabase;
-  if (marketDatabase?.enabled !== false && marketDatabase?.provider === "railway" && marketDatabase?.railway?.resourceType === "postgres") {
-    const baseName = typeof marketDatabase.railway?.serviceName === "string" && marketDatabase.railway.serviceName.trim() ? marketDatabase.railway.serviceName.trim() : `${deployConfig.slug ?? "treeseed-market"}-postgres`;
+  const treeseedDatabase = deployConfig.services?.treeseedDatabase;
+  if (treeseedDatabase?.enabled !== false && treeseedDatabase?.provider === "railway" && treeseedDatabase?.railway?.resourceType === "postgres") {
+    const baseName = typeof treeseedDatabase.railway?.serviceName === "string" && treeseedDatabase.railway.serviceName.trim() ? treeseedDatabase.railway.serviceName.trim() : `${deployConfig.slug ?? "treeseed-market"}-postgres`;
     services.push({
-      key: "marketDatabase",
+      key: "treeseedDatabase",
       projectName: deployConfig.services?.api?.railway?.projectName ?? identity.deploymentKey,
       serviceName: `${baseName.replace(/-(staging|prod|production)$/u, "")}-${normalizedScope === "prod" ? "prod" : normalizedScope}`,
       railwayEnvironment: normalizeRailwayEnvironmentName(normalizedScope),
@@ -2396,17 +2627,19 @@ async function destroyRailwayResources(tenantRoot, deployConfig, target, { dryRu
         }
       }
     }
-    const volumes = await listRailwayVolumes({ projectId: project.id, env });
-    for (const volume of volumes) {
-      const matchingInstance = volume.instances.find((instance) => instance.environmentId === environment?.id);
-      if (!matchingInstance) {
-        continue;
-      }
-      if (dryRun) {
-        operations.push(resourceOperation("railway", "volume", volume.name, "planned", { id: volume.id, projectId: project.id }));
-      } else {
-        const result = await deleteRailwayVolume({ volumeId: volume.id, env });
-        operations.push(resourceOperation("railway", "volume", volume.name, result.status, { id: volume.id, projectId: project.id }));
+    if (deleteData) {
+      const volumes = await listRailwayVolumes({ projectId: project.id, env });
+      for (const volume of volumes) {
+        const matchingInstance = volume.instances.find((instance) => instance.environmentId === environment?.id);
+        if (!matchingInstance) {
+          continue;
+        }
+        if (dryRun) {
+          operations.push(resourceOperation("railway", "volume", volume.name, "planned", { id: volume.id, projectId: project.id }));
+        } else {
+          const result = await deleteRailwayVolume({ volumeId: volume.id, env });
+          operations.push(resourceOperation("railway", "volume", volume.name, result.status, { id: volume.id, projectId: project.id }));
+        }
       }
     }
     const shouldDeleteProject = shouldDeleteRailwayProjectAfterEnvironmentDestroy(project, scope, deleteData, environment?.id ?? null);
@@ -2417,11 +2650,7 @@ async function destroyRailwayResources(tenantRoot, deployConfig, target, { dryRu
           reason: scope === "prod" ? "prod_delete_data_cleanup" : "no_managed_persistent_environments"
         }));
       } else {
-        const result = await deleteRailwayProject({ projectId: project.id, env });
-        operations.push(resourceOperation("railway", "project", project.name, result.status, {
-          id: project.id,
-          reason: scope === "prod" ? "prod_delete_data_cleanup" : "no_managed_persistent_environments"
-        }));
+        throw new Error("Railway project deletion is reconciler-owned. Use trsd reconcile destroy or live acceptance cleanup for project-scoped deletion.");
       }
     } else if (environment) {
       if (dryRun) {
@@ -2465,6 +2694,87 @@ function killPidFromFile(filePath, { dryRun }) {
   }
   return resourceOperation("local", "dev-process", String(pid), "deleted", { pidFile: filePath });
 }
+const LOCAL_DOCKER_RESOURCE_PATTERN = /(?:^|[-_.])(?:treeseed|treedx|treedb)(?:[-_.]|$)|(?:treeseed|treedx|treedb)/iu;
+let destroyDockerRunnerForTests = null;
+function setDestroyDockerRunnerForTests(runner) {
+  destroyDockerRunnerForTests = runner;
+}
+function runDestroyDocker(args) {
+  if (destroyDockerRunnerForTests) {
+    return destroyDockerRunnerForTests(args);
+  }
+  return spawnSync("docker", args, { encoding: "utf8", stdio: "pipe" });
+}
+function dockerAvailable() {
+  const result = runDestroyDocker(["info"]);
+  return result.status === 0;
+}
+function dockerList(formatArgs) {
+  const result = runDestroyDocker(formatArgs);
+  if (result.status !== 0) {
+    return [];
+  }
+  return result.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+}
+function matchingDockerEntries(lines, parser) {
+  return lines.map(parser).filter((entry) => entry && LOCAL_DOCKER_RESOURCE_PATTERN.test(`${entry.name} ${entry.image ?? ""}`));
+}
+function removeDockerResource(kind, id, name) {
+  const args = kind === "container" ? ["rm", "-f", id] : kind === "volume" ? ["volume", "rm", "-f", id] : ["network", "rm", id];
+  const result = runDestroyDocker(args);
+  if (result.status === 0) {
+    return resourceOperation("local", `docker-${kind}`, name, "deleted", { id });
+  }
+  return resourceOperation("local", `docker-${kind}`, name, "blocked", {
+    id,
+    reason: result.stderr?.trim() || result.stdout?.trim() || "docker_remove_failed"
+  });
+}
+function dockerLocalRuntimeResourceOperations({ dryRun = false } = {}) {
+  if (!dockerAvailable()) {
+    return [resourceOperation("local", "docker-cleanup", "docker", "skipped", { reason: "docker_unavailable" })];
+  }
+  const containers = matchingDockerEntries(
+    dockerList(["ps", "-a", "--format", "{{.ID}}	{{.Names}}	{{.Image}}"]),
+    (line) => {
+      const [id, name, image] = line.split("	");
+      return id && name ? { id, name, image } : null;
+    }
+  );
+  const volumes = matchingDockerEntries(
+    dockerList(["volume", "ls", "--format", "{{.Name}}"]),
+    (line) => ({ id: line, name: line })
+  );
+  const networks = matchingDockerEntries(
+    dockerList(["network", "ls", "--format", "{{.ID}}	{{.Name}}"]),
+    (line) => {
+      const [id, name] = line.split("	");
+      return id && name ? { id, name } : null;
+    }
+  ).filter((entry) => !["bridge", "host", "none"].includes(entry.name));
+  if (dryRun) {
+    return [
+      ...containers.map((entry) => resourceOperation("local", "docker-container", entry.name, "planned", { id: entry.id })),
+      ...volumes.map((entry) => resourceOperation("local", "docker-volume", entry.name, "planned", { id: entry.id })),
+      ...networks.map((entry) => resourceOperation("local", "docker-network", entry.name, "planned", { id: entry.id })),
+      ...containers.length || volumes.length || networks.length ? [] : [resourceOperation("local", "docker-cleanup", "docker", "missing", { reason: "no_matching_resources" })]
+    ];
+  }
+  const operations = [];
+  for (const entry of containers) {
+    operations.push(removeDockerResource("container", entry.id, entry.name));
+  }
+  for (const entry of volumes) {
+    operations.push(removeDockerResource("volume", entry.id, entry.name));
+  }
+  for (const entry of networks) {
+    operations.push(removeDockerResource("network", entry.id, entry.name));
+  }
+  if (!operations.length) {
+    operations.push(resourceOperation("local", "docker-cleanup", "docker", "missing", { reason: "no_matching_resources" }));
+  }
+  return operations;
+}
 function destroyLocalRuntimeResources(tenantRoot, { dryRun = false, deleteData = false } = {}) {
   const operations = [];
   const pidDir = resolve(tenantRoot, ".treeseed/dev-pids");
@@ -2481,7 +2791,7 @@ function destroyLocalRuntimeResources(tenantRoot, { dryRun = false, deleteData =
     for (const relativePath of [
       ".treeseed/generated/environments/local",
       ".treeseed/generated/dev",
-      ".treeseed/market-operations-runner",
+      ".treeseed/operations-runner",
       ".treeseed/local-capacity-provider/data"
     ]) {
       const absolutePath = resolve(tenantRoot, relativePath);
@@ -2496,11 +2806,243 @@ function destroyLocalRuntimeResources(tenantRoot, { dryRun = false, deleteData =
       rmSync(absolutePath, { recursive: true, force: true });
       operations.push(resourceOperation("local", "data-path", relativePath, "deleted"));
     }
+    operations.push(...dockerLocalRuntimeResourceOperations({ dryRun }));
   } else {
     operations.push(resourceOperation("local", "data-path", ".treeseed/generated/environments/local", "skipped", { reason: "data_preserved" }));
   }
   return { operations };
 }
+function treeSeedSweepTokens(deployConfig, state) {
+  const configuredHosts = [
+    deployConfig.siteUrl,
+    deployConfig.surfaces?.web?.publicBaseUrl,
+    deployConfig.surfaces?.web?.environments?.staging?.domain,
+    deployConfig.surfaces?.web?.environments?.prod?.domain,
+    deployConfig.surfaces?.api?.environments?.staging?.domain,
+    deployConfig.surfaces?.api?.environments?.prod?.domain,
+    deployConfig.services?.api?.environments?.staging?.domain,
+    deployConfig.services?.api?.environments?.prod?.domain
+  ].map((value) => primaryHost(value) ?? value);
+  return [...new Set([
+    "treeseed",
+    deployConfig.slug,
+    deployConfig.name,
+    state.identity?.deploymentKey,
+    state.identity?.environmentKey,
+    state.pages?.projectName,
+    state.workerName,
+    state.content?.bucketName,
+    state.kvNamespaces?.FORM_GUARD_KV?.name,
+    state.kvNamespaces?.SESSION?.name,
+    state.d1Databases?.SITE_DATA_DB?.databaseName,
+    ...configuredHosts
+  ].map((value) => String(value ?? "").trim().toLowerCase()).filter((value) => value.length >= 4))];
+}
+function isProtectedAiIntegrationResource(value) {
+  return /(?:^|[-_.])(?:ai-gateway|workers-ai|ai-integration|openai|anthropic)(?:[-_.]|$)/iu.test(String(value ?? ""));
+}
+function matchesTreeSeedSweep(value, tokens) {
+  const normalized = String(value ?? "").trim().toLowerCase();
+  if (!normalized || isProtectedAiIntegrationResource(normalized)) {
+    return false;
+  }
+  return tokens.some((token) => normalized === token || normalized.includes(token));
+}
+function cloudflareNameCandidates(entry) {
+  return [
+    entry?.name,
+    entry?.title,
+    entry?.id,
+    entry?.queue_name,
+    entry?.script,
+    entry?.domain,
+    entry?.hostname,
+    entry?.content,
+    entry?.comment,
+    ...Array.isArray(entry?.domains) ? entry.domains : [],
+    ...Array.isArray(entry?.tags) ? entry.tags : []
+  ].filter(Boolean);
+}
+function cloudflareEntryMatchesTreeSeed(entry, tokens) {
+  return cloudflareNameCandidates(entry).some((candidate) => matchesTreeSeedSweep(candidate, tokens));
+}
+function deleteDnsRecord(zoneId, record, { env, dryRun }) {
+  const name = record?.name ?? record?.content ?? record?.id ?? null;
+  if (!zoneId || !record?.id) {
+    return resourceOperation("cloudflare", "dns-record", name, "missing", { zoneId });
+  }
+  if (dryRun) {
+    return resourceOperation("cloudflare", "dns-record", name, "planned", {
+      zoneId,
+      id: record.id,
+      content: record.content ?? null,
+      recordType: record.type ?? null
+    });
+  }
+  return deleteCloudflareApiResource(
+    `/zones/${encodeURIComponent(zoneId)}/dns_records/${encodeURIComponent(record.id)}`,
+    { env, dryRun: false, name, type: "dns-record" }
+  );
+}
+function sweepTreeSeedCloudflareResources(tenantRoot, deployConfig, state, { env, dryRun, deleteData }) {
+  const tokens = treeSeedSweepTokens(deployConfig, state);
+  const operations = [];
+  const pagesProjects = listPagesProjects(tenantRoot, env).filter((entry) => cloudflareEntryMatchesTreeSeed(entry, tokens));
+  for (const project of pagesProjects) {
+    const projectName = project?.name ?? project?.id ?? null;
+    operations.push(...deletePagesCustomDomains(tenantRoot, projectName, [], { env, dryRun, knownOnly: false }));
+    operations.push(deletePagesDeployments(tenantRoot, projectName, { env, dryRun, environment: "all" }));
+    operations.push(deletePagesProject(projectName, { env, dryRun }));
+  }
+  for (const worker of listWorkers(tenantRoot, env).filter((entry) => cloudflareEntryMatchesTreeSeed(entry, tokens))) {
+    const name = worker?.id ?? worker?.name ?? worker?.script ?? null;
+    const deleted = deleteWorker(tenantRoot, name, { env, dryRun, force: true });
+    operations.push(resourceOperation("cloudflare", "worker", name, deleted.status, { ...deleted, sweep: true }));
+  }
+  for (const namespace of listKvNamespaces(tenantRoot, env).filter((entry) => cloudflareEntryMatchesTreeSeed(entry, tokens))) {
+    const deleted = deleteKvNamespace(tenantRoot, namespace.id, { env, dryRun });
+    operations.push(resourceOperation("cloudflare", "kv-namespace", namespace.title ?? namespace.id, deleted.status, { ...deleted, sweep: true }));
+  }
+  for (const queue of listQueues(tenantRoot, env).filter((entry) => cloudflareEntryMatchesTreeSeed(entry, tokens))) {
+    operations.push({ ...deleteQueueByName(tenantRoot, queue, { env, dryRun }), sweep: true });
+  }
+  for (const database of listD1Databases(tenantRoot, env).filter((entry) => cloudflareEntryMatchesTreeSeed(entry, tokens))) {
+    const name = database?.name ?? database?.uuid ?? database?.id ?? null;
+    const deleted = deleteData ? deleteD1Database(tenantRoot, name, { env, dryRun }) : null;
+    operations.push(resourceOperation("cloudflare", "d1-database", name, deleteData ? deleted?.status : "skipped", {
+      ...deleteData ? deleted : { reason: "data_preserved" },
+      sweep: true
+    }));
+  }
+  for (const bucket of listR2Buckets(tenantRoot, env).filter((entry) => cloudflareEntryMatchesTreeSeed(entry, tokens))) {
+    operations.push({ ...deleteR2Bucket(tenantRoot, bucket.name, { env, dryRun, deleteData }), sweep: true });
+  }
+  for (const widget of listTurnstileWidgets(tenantRoot, env).filter((entry) => cloudflareEntryMatchesTreeSeed(entry, tokens))) {
+    const deleted = deleteTurnstileWidget(widget.sitekey, { env, dryRun, name: widget.name });
+    operations.push(resourceOperation("cloudflare", "turnstile-widget", widget.name ?? widget.sitekey, deleted.status, { ...deleted, sweep: true }));
+  }
+  for (const zone of listDnsZones(env)) {
+    const zoneId = zone?.id ?? null;
+    for (const record of listDnsRecords(zoneId, env)) {
+      if (record?.type === "SOA" || record?.type === "NS") {
+        continue;
+      }
+      if (!cloudflareEntryMatchesTreeSeed(record, tokens)) {
+        continue;
+      }
+      operations.push({ ...deleteDnsRecord(zoneId, record, { env, dryRun }), zoneName: zone?.name ?? null, sweep: true });
+    }
+  }
+  return operations.length > 0 ? operations : [resourceOperation("cloudflare", "treeseed-sweep", "cloudflare", "missing", { reason: "no_matching_resources" })];
+}
+function countMatchingCloudflareEntries(entries, tokens) {
+  return entries.filter((entry) => cloudflareEntryMatchesTreeSeed(entry, tokens)).length;
+}
+function cloudflareDestroyVerification(tenantRoot, deployConfig, state, env) {
+  const tokens = treeSeedSweepTokens(deployConfig, state);
+  const zoneIds = /* @__PURE__ */ new Set([
+    deployConfig.cloudflare?.zoneId,
+    state.webCache?.webZoneId,
+    state.webCache?.contentZoneId
+  ]);
+  for (const zone of listDnsZones(env)) {
+    if (zone?.id) {
+      zoneIds.add(zone.id);
+    }
+  }
+  const dnsRecords = [];
+  for (const zoneId of [...zoneIds].filter(Boolean)) {
+    dnsRecords.push(...listDnsRecords(zoneId, env));
+  }
+  const remaining = {
+    pages: countMatchingCloudflareEntries(listPagesProjects(tenantRoot, env), tokens),
+    workers: countMatchingCloudflareEntries(listWorkers(tenantRoot, env), tokens),
+    kvNamespaces: countMatchingCloudflareEntries(listKvNamespaces(tenantRoot, env), tokens),
+    queues: countMatchingCloudflareEntries(listQueues(tenantRoot, env), tokens),
+    d1Databases: countMatchingCloudflareEntries(listD1Databases(tenantRoot, env), tokens),
+    r2Buckets: countMatchingCloudflareEntries(listR2Buckets(tenantRoot, env), tokens),
+    turnstileWidgets: countMatchingCloudflareEntries(listTurnstileWidgets(tenantRoot, env), tokens),
+    dnsRecords: countMatchingCloudflareEntries(
+      dnsRecords.filter((record) => record?.type !== "SOA" && record?.type !== "NS"),
+      tokens
+    )
+  };
+  const totalRemaining = Object.values(remaining).reduce((sum, value) => sum + value, 0);
+  return {
+    provider: "cloudflare",
+    method: "cloudflare-api",
+    status: totalRemaining === 0 ? "clean" : "remaining",
+    remaining,
+    totalRemaining
+  };
+}
+function localDockerDestroyVerification() {
+  if (!dockerAvailable()) {
+    return {
+      provider: "local-docker",
+      method: "docker-cli",
+      status: "skipped",
+      reason: "docker_unavailable",
+      remaining: {
+        containers: 0,
+        volumes: 0,
+        networks: 0
+      },
+      totalRemaining: 0
+    };
+  }
+  const containers = matchingDockerEntries(
+    dockerList(["ps", "-a", "--format", "{{.ID}}	{{.Names}}	{{.Image}}"]),
+    (line) => {
+      const [id, name, image] = line.split("	");
+      return id && name ? { id, name, image } : null;
+    }
+  ).length;
+  const volumes = matchingDockerEntries(
+    dockerList(["volume", "ls", "--format", "{{.Name}}"]),
+    (line) => ({ id: line, name: line })
+  ).length;
+  const networks = matchingDockerEntries(
+    dockerList(["network", "ls", "--format", "{{.ID}}	{{.Name}}"]),
+    (line) => {
+      const [id, name] = line.split("	");
+      return id && name ? { id, name } : null;
+    }
+  ).filter((entry) => !["bridge", "host", "none"].includes(entry.name)).length;
+  const remaining = { containers, volumes, networks };
+  const totalRemaining = containers + volumes + networks;
+  return {
+    provider: "local-docker",
+    method: "docker-cli",
+    status: totalRemaining === 0 ? "clean" : "remaining",
+    remaining,
+    totalRemaining
+  };
+}
+async function sweepTreeSeedRailwayResources(deployConfig, state, { env, dryRun }) {
+  if (!resolveRailwayApiToken(env)) {
+    return [resourceOperation("railway", "treeseed-sweep", "railway", "blocked", { reason: "missing_railway_api_token" })];
+  }
+  const tokens = treeSeedSweepTokens(deployConfig, state);
+  const workspace = await resolveRailwayWorkspaceContext({ env, workspace: resolveRailwayWorkspace(env) });
+  const projects = await listRailwayProjects({ env, workspaceId: workspace.id });
+  const operations = [];
+  for (const project of projects) {
+    if (project.deletedAt || !matchesTreeSeedSweep(project.name, tokens)) {
+      continue;
+    }
+    if (dryRun) {
+      operations.push(resourceOperation("railway", "project", project.name, "planned", {
+        id: project.id,
+        workspaceId: workspace.id,
+        sweep: true
+      }));
+    } else {
+      throw new Error("Railway project sweep deletion is reconciler-owned. Use trsd reconcile test-live --mode cleanup for isolated cleanup.");
+    }
+  }
+  return operations.length > 0 ? operations : [resourceOperation("railway", "treeseed-sweep", "railway", "missing", { reason: "no_matching_projects" })];
+}
 async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
   const target = normalizeTarget(options.scope ?? options.target ?? "prod");
   const deployConfig = loadTenantDeployConfig(tenantRoot);
@@ -2512,6 +3054,8 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
   const dryRun = options.dryRun ?? false;
   const deleteData = options.deleteData === true;
   const force = options.force ?? false;
+  const sweepTreeseed = options.sweepTreeseed === true;
+  const destroysSharedWebSurface = target.kind === "persistent" && target.scope === "prod" && deleteData;
   const kvNamespaces = dryRun ? [] : listKvNamespaces(tenantRoot, env);
   const d1Databases = dryRun ? [] : listD1Databases(tenantRoot, env);
   const queues = dryRun ? [] : listQueues(tenantRoot, env);
@@ -2538,8 +3082,6 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
   state.turnstileWidgets.formGuard = resolveExistingTurnstileWidget(turnstileWidgets, state.turnstileWidgets?.formGuard);
   const pagesProject = pagesProjects.find((entry) => entry?.name === state.pages?.projectName);
   const bucket = buckets.find((entry) => entry?.name === state.content?.bucketName);
-  const queue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
-  const dlq = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.dlqName);
   const workerResult = deleteWorker(tenantRoot, state.workerName, { env, dryRun, force });
   const turnstileWidget = deleteTurnstileWidget(state.turnstileWidgets?.formGuard?.sitekey, {
     env,
@@ -2566,13 +3108,6 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
     return resourceOperation("cloudflare", "kv-namespace", namespace.title, result.status, { ...result, legacy: true });
   });
   const database = deleteD1DatabaseForDestroy(tenantRoot, state.d1Databases.SITE_DATA_DB.databaseName, { env, dryRun, deleteData });
-  const deletedQueue = deleteQueueByName(tenantRoot, queue ?? { name: state.queues?.agentWork?.name }, { env, dryRun });
-  const deletedDlq = state.queues?.agentWork?.dlqName ? deleteQueueByName(tenantRoot, dlq ?? { name: state.queues.agentWork.dlqName }, { env, dryRun }) : null;
-  const knownQueueNames = new Set([
-    state.queues?.agentWork?.name,
-    state.queues?.agentWork?.dlqName
-  ].filter(Boolean));
-  const legacyQueues = legacyQueueDestroyOperations(tenantRoot, queues, target, knownQueueNames, { env, dryRun });
   const r2Bucket = bucket || dryRun ? deleteR2Bucket(tenantRoot, state.content?.bucketName, { env, dryRun, deleteData }) : resourceOperation("cloudflare", "r2-bucket", state.content?.bucketName, "missing");
   const pageDnsNames = [
     state.pages?.customDomain,
@@ -2585,11 +3120,21 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
   ].filter(Boolean);
   const dnsRecords = [.../* @__PURE__ */ new Set([...pageDnsNames, ...apiDnsNames])].flatMap((name) => deleteDnsRecordsForName(deployConfig, name, { env, dryRun }));
   const cacheRules = deleteTreeseedCacheRules(deployConfig, state, { env, dryRun });
-  const pageCustomDomains = pagesProject || dryRun ? deletePagesCustomDomains(tenantRoot, state.pages?.projectName, pageDnsNames, { env, dryRun }) : [resourceOperation("cloudflare", "pages-custom-domain", state.pages?.projectName, "missing")];
-  const pageDeployments = pagesProject || dryRun ? deletePagesDeployments(tenantRoot, state.pages?.projectName, { env, dryRun }) : resourceOperation("cloudflare", "pages-deployments", state.pages?.projectName, "missing");
-  const pages = pagesProject || dryRun ? deletePagesProject(state.pages?.projectName, { env, dryRun }) : resourceOperation("cloudflare", "pages-project", state.pages?.projectName, "missing");
+  const pageCustomDomains = pagesProject || dryRun ? deletePagesCustomDomains(tenantRoot, state.pages?.projectName, pageDnsNames, { env, dryRun, knownOnly: !destroysSharedWebSurface }) : [resourceOperation("cloudflare", "pages-custom-domain", state.pages?.projectName, "missing")];
+  const pageDeployments = pagesProject || dryRun ? deletePagesDeployments(tenantRoot, state.pages?.projectName, {
+    env,
+    dryRun,
+    environment: destroysSharedWebSurface ? "all" : "preview"
+  }) : resourceOperation("cloudflare", "pages-deployments", state.pages?.projectName, "missing");
+  const pages = destroysSharedWebSurface && (pagesProject || dryRun) ? deletePagesProject(state.pages?.projectName, { env, dryRun }) : resourceOperation("cloudflare", "pages-project", state.pages?.projectName, "skipped", {
+    reason: target.scope === "prod" ? "delete_data_required" : "shared_web_surface"
+  });
   const local = target.kind === "persistent" && target.scope === "local" ? destroyLocalRuntimeResources(tenantRoot, { dryRun, deleteData }) : { operations: [] };
   const railway = await destroyRailwayResources(tenantRoot, deployConfig, target, { dryRun, deleteData, env: process.env });
+  const sweep = sweepTreeseed ? {
+    cloudflare: sweepTreeSeedCloudflareResources(tenantRoot, deployConfig, state, { env, dryRun, deleteData }),
+    railway: await sweepTreeSeedRailwayResources(deployConfig, state, { env: process.env, dryRun })
+  } : { cloudflare: [], railway: [] };
   const operations = {
     cloudflare: [
       resourceOperation("cloudflare", "worker", state.workerName, workerResult.status, workerResult),
@@ -2600,24 +3145,31 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
       ...sessionPreview ? [resourceOperation("cloudflare", "kv-namespace-preview", state.kvNamespaces.SESSION.name, sessionPreview.status, sessionPreview)] : [],
       ...legacyKvNamespaces,
       database,
-      deletedQueue,
-      ...deletedDlq ? [deletedDlq] : [],
-      ...legacyQueues,
       r2Bucket,
       ...pageCustomDomains,
       pageDeployments,
       pages,
       ...dnsRecords,
-      ...cacheRules
+      ...cacheRules,
+      ...sweep.cloudflare
+    ],
+    railway: [
+      ...railway.operations,
+      ...sweep.railway
     ],
-    railway: railway.operations,
     local: local.operations
   };
+  const verification = dryRun ? null : {
+    cloudflare: cloudflareDestroyVerification(tenantRoot, deployConfig, state, env),
+    ...target.kind === "persistent" && target.scope === "local" ? { localDocker: localDockerDestroyVerification() } : {}
+  };
   return {
     target,
     deleteData,
+    sweepTreeseed,
     summary: buildDestroySummary(deployConfig, state, target),
-    operations
+    operations,
+    verification
   };
 }
 function destroyCloudflareResources(tenantRoot, options = {}) {
@@ -2648,8 +3200,6 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
     state.d1Databases.SITE_DATA_DB
   );
   state.turnstileWidgets.formGuard = resolveExistingTurnstileWidget(turnstileWidgets, state.turnstileWidgets?.formGuard);
-  const queue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
-  const dlq = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.dlqName);
   const bucket = buckets.find((entry) => entry?.name === state.content?.bucketName);
   const pagesProject = pagesProjects.find((entry) => entry?.name === state.pages?.projectName);
   const worker = deleteWorker(tenantRoot, state.workerName, { env, dryRun, force });
@@ -2660,13 +3210,6 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
   });
   const formGuard = deleteKvNamespace(tenantRoot, state.kvNamespaces.FORM_GUARD_KV.id, { env, dryRun });
   const database = deleteD1DatabaseForDestroy(tenantRoot, state.d1Databases.SITE_DATA_DB.databaseName, { env, dryRun, deleteData });
-  const deletedQueue = deleteQueueByName(tenantRoot, queue ?? { name: state.queues?.agentWork?.name }, { env, dryRun });
-  const deletedDlq = state.queues?.agentWork?.dlqName ? deleteQueueByName(tenantRoot, dlq ?? { name: state.queues.agentWork.dlqName }, { env, dryRun }) : null;
-  const knownQueueNames = new Set([
-    state.queues?.agentWork?.name,
-    state.queues?.agentWork?.dlqName
-  ].filter(Boolean));
-  const legacyQueues = legacyQueueDestroyOperations(tenantRoot, queues, target, knownQueueNames, { env, dryRun });
   const r2Bucket = bucket || dryRun ? deleteR2Bucket(tenantRoot, state.content?.bucketName, { env, dryRun, deleteData }) : resourceOperation("cloudflare", "r2-bucket", state.content?.bucketName, "missing");
   const pages = pagesProject || dryRun ? deletePagesProject(state.pages?.projectName, { env, dryRun }) : resourceOperation("cloudflare", "pages-project", state.pages?.projectName, "missing");
   const operations = {
@@ -2674,9 +3217,6 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
     turnstileWidget,
     formGuard,
     database,
-    queue: deletedQueue,
-    dlq: deletedDlq,
-    legacyQueues,
     r2Bucket,
     pages
   };
@@ -2773,61 +3313,6 @@ function provisionCloudflareResources(tenantRoot, options = {}) {
     current.databaseId = created.uuid;
     current.previewDatabaseId = created.previewDatabaseUuid ?? created.uuid;
   };
-  const ensureQueue = () => {
-    const current = state.queues?.agentWork;
-    if (!current?.name) {
-      return;
-    }
-    let refreshedQueues = queues;
-    const exists = refreshedQueues.find((entry) => queueName(entry) === current.name);
-    if (exists) {
-      current.queueId = queueId(exists);
-      const currentDlq = current.dlqName ? refreshedQueues.find((entry) => queueName(entry) === current.dlqName) : null;
-      current.dlqId = queueId(currentDlq);
-      return;
-    }
-    if (dryRun) {
-      current.queueId = `dryrun-${current.name}`;
-      current.dlqId = current.dlqName ? `dryrun-${current.dlqName}` : null;
-      return;
-    }
-    try {
-      runWrangler(["queues", "create", current.name], {
-        cwd: tenantRoot,
-        capture: true,
-        env
-      });
-    } catch (error) {
-      if (!isWranglerAlreadyExistsError(error, [/Queue name .* is already taken/i, /\[code:\s*11009\]/i])) {
-        throw error;
-      }
-    }
-    refreshedQueues = listQueues(tenantRoot, env);
-    if (current.dlqName && !refreshedQueues.find((entry) => queueName(entry) === current.dlqName)) {
-      try {
-        runWrangler(["queues", "create", current.dlqName], {
-          cwd: tenantRoot,
-          capture: true,
-          env
-        });
-      } catch (error) {
-        if (!isWranglerAlreadyExistsError(error, [/Queue name .* is already taken/i, /\[code:\s*11009\]/i])) {
-          throw error;
-        }
-      }
-    }
-    refreshedQueues = listQueues(tenantRoot, env);
-    const created = refreshedQueues.find((entry) => queueName(entry) === current.name);
-    if (!created) {
-      throw new Error(`Unable to resolve Cloudflare queue ${current.name} after reconciliation.`);
-    }
-    current.queueId = queueId(created);
-    const createdDlq = current.dlqName ? refreshedQueues.find((entry) => queueName(entry) === current.dlqName) : null;
-    if (current.dlqName && !createdDlq) {
-      throw new Error(`Unable to resolve Cloudflare dead-letter queue ${current.dlqName} after reconciliation.`);
-    }
-    current.dlqId = queueId(createdDlq);
-  };
   const ensureR2Bucket = () => {
     const bucketName = state.content?.bucketName;
     if (!bucketName) {
@@ -2865,7 +3350,7 @@ function provisionCloudflareResources(tenantRoot, options = {}) {
     const exists = pagesProjects.find((entry) => entry?.name === current.projectName);
     if (exists) {
       current.url = exists.subdomain ? `https://${exists.subdomain}` : current.url ?? `https://${current.projectName}.pages.dev`;
-      ensurePagesProjectCompatibility(env.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "", current.projectName, env, exists, { state, target });
+      ensurePagesProjectCompatibility(env.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "", current.projectName, env, exists, { state, target });
       return;
     }
     if (dryRun) {
@@ -2884,12 +3369,11 @@ function provisionCloudflareResources(tenantRoot, options = {}) {
       capture: true,
       env
     });
-    ensurePagesProjectCompatibility(env.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "", current.projectName, env, null, { state, target });
+    ensurePagesProjectCompatibility(env.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "", current.projectName, env, null, { state, target });
     current.url = `https://${current.projectName}.pages.dev`;
   };
   ensureKv("FORM_GUARD_KV");
   ensureD1();
-  ensureQueue();
   ensureR2Bucket();
   ensurePagesProject();
   reconcileCloudflareWebCacheRules(tenantRoot, deployConfig, state, target, { dryRun });
@@ -2979,8 +3463,6 @@ function verifyProvisionedCloudflareResources(tenantRoot, options = {}) {
     pages: Boolean(state.pages?.projectName && (livePages || pagesProject?.name === state.pages.projectName)),
     formGuardKv: Boolean(state.kvNamespaces?.FORM_GUARD_KV?.name && kvNamespaces.find((entry) => entry?.title === state.kvNamespaces.FORM_GUARD_KV.name)),
     d1: Boolean(state.d1Databases?.SITE_DATA_DB?.databaseName && d1Databases.find((entry) => entry?.name === state.d1Databases.SITE_DATA_DB.databaseName)),
-    queue: Boolean(state.queues?.agentWork?.name && queues.find((entry) => queueName(entry) === state.queues.agentWork.name)),
-    dlq: !state.queues?.agentWork?.dlqName || Boolean(queues.find((entry) => queueName(entry) === state.queues.agentWork.dlqName)),
     r2: Boolean(state.content?.bucketName && buckets.find((entry) => entry?.name === state.content.bucketName)),
     pagesFormGuardKvBinding: !pagesBindings.kv_namespaces?.FORM_GUARD_KV || pageBindingConfigured("kv_namespaces", "FORM_GUARD_KV", pagesBindings.kv_namespaces.FORM_GUARD_KV),
     pagesD1Binding: !pagesBindings.d1_databases?.SITE_DATA_DB || pageBindingConfigured("d1_databases", "SITE_DATA_DB", pagesBindings.d1_databases.SITE_DATA_DB),
@@ -2996,12 +3478,6 @@ function verifyProvisionedCloudflareResources(tenantRoot, options = {}) {
   state.readiness.blockers = [];
   state.readiness.warnings = [];
   state.readiness.lastValidationSummary = checks;
-  const liveQueue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
-  if (state.queues?.agentWork) {
-    state.queues.agentWork.queueId = queueId(liveQueue) ?? state.queues.agentWork.queueId ?? null;
-    const liveDlq = queues.find((entry) => queueName(entry) === state.queues.agentWork.dlqName);
-    state.queues.agentWork.dlqId = queueId(liveDlq) ?? state.queues.agentWork.dlqId ?? null;
-  }
   if (state.pages) {
     const configuredWebUrl = resolveConfiguredSurfaceBaseUrl(deployConfig, target, "web");
     if (configuredWebUrl) {
@@ -3240,9 +3716,11 @@ export {
   buildProvisioningSummary,
   buildPublicVars,
   buildSecretMap,
+  buildTreeseedManagedCloudflareCacheRules,
   buildWranglerConfigContents,
   cleanupDestroyedState,
   cloudflareApiRequest,
+  cloudflareDestroyVerification,
   collectMissingDeployInputs,
   createBranchPreviewDeployTarget,
   createPersistentDeployTarget,
@@ -3251,17 +3729,21 @@ export {
   deriveTreeseedStagingSurfaceDomain,
   destroyCloudflareResources,
   destroyTreeseedEnvironmentResources,
+  dockerLocalRuntimeResourceOperations,
   ensureGeneratedWranglerConfig,
   finalizeDeploymentState,
   getTurnstileWidget,
   hasProvisionedCloudflareResources,
   isWranglerAlreadyExistsError,
   listD1Databases,
+  listDnsRecords,
+  listDnsZones,
   listKvNamespaces,
   listPagesProjects,
   listQueues,
   listR2Buckets,
   listTurnstileWidgets,
+  listWorkers,
   loadDeployState,
   markDeploymentInitialized,
   markManagedServicesInitialized,
@@ -3286,6 +3768,7 @@ export {
   runRemoteD1Migrations,
   runWrangler,
   scopeFromTarget,
+  setDestroyDockerRunnerForTests,
   shouldDeleteRailwayProjectAfterEnvironmentDestroy,
   syncCloudflareSecrets,
   updateTurnstileWidget,