@treeseed/sdk 0.10.28 → 0.12.4

package/dist/operations/services/railway-deploy.js

@@ -1,16 +1,19 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, relative, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { relative, resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
 import { loadCliDeployConfig } from "./runtime-tools.js";
+import { resolveTreeseedMachineEnvironmentValues } from "./config-runtime.js";
 import { createPersistentDeployTarget, resolveTreeseedResourceIdentity } from "./deploy.js";
+import { classifyTreeseedGitMode, runTreeseedGitText } from "./git-runner.js";
+import { discoverTreeseedApplications } from "../../hosting/apps.js";
 import { runPrefixedCommand, sleep } from "./bootstrap-runner.js";
-import { resolveTreeseedToolCommand } from "../../managed-dependencies.js";
 import {
   ensureRailwayEnvironment,
   ensureRailwayProject,
   ensureRailwayService,
   ensureRailwayServiceInstanceConfiguration,
   ensureRailwayServiceVolume,
+  deployRailwayServiceInstance,
   getRailwayServiceInstance,
   listRailwayEnvironments,
   listRailwayProjects,
@@ -20,7 +23,6 @@ import {
   railwayGraphqlRequest,
   resolveRailwayApiToken,
   resolveRailwayApiUrl,
-  resolveRailwayWorkspace,
   resolveRailwayWorkspaceContext,
   upsertRailwayVariables
 } from "./railway-api.js";
@@ -31,37 +33,87 @@ function normalizeScope(scope) {
 function resolveRailwayEnvironmentForScope(scope, configuredEnvironment) {
   return normalizeRailwayEnvironmentName(configuredEnvironment || normalizeScope(scope));
 }
-const RAILWAY_SERVICE_KEYS = ["api", "marketOperationsRunner"];
+const RAILWAY_SERVICE_KEYS = ["api", "operationsRunner", "capacityProviderManager", "capacityProviderRunner"];
 const HOSTED_PROJECT_SERVICE_KEYS = ["api"];
 const WORKER_RUNNER_BOOTSTRAP_INDEX = 1;
 const WORKER_RUNNER_VOLUME_MOUNT_PATH = "/data";
-const MARKET_OPERATIONS_RUNNER_BOOTSTRAP_COUNT = 2;
+const OPERATIONS_RUNNER_BOOTSTRAP_COUNT = 2;
+const PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX = "public-treedx-node-";
+function isTreeseedOperationsRunnerResourceName(value) {
+  const normalized = String(value ?? "").trim().toLowerCase();
+  if (!normalized) {
+    return false;
+  }
+  if (normalized.startsWith("market-ops")) {
+    return true;
+  }
+  return normalized.includes("operations-runner");
+}
+function findStaleTreeseedOperationsRunnerResources(resources, desiredNames) {
+  const desired = new Set([...desiredNames].map((value) => String(value ?? "").trim()).filter(Boolean));
+  return resources.filter((resource) => {
+    const name = String(resource?.name ?? "").trim();
+    return name && isTreeseedOperationsRunnerResourceName(name) && !desired.has(name);
+  });
+}
 function shouldManageRailwaySchedules(scope, phase = "deploy") {
   const environment = normalizeRailwayEnvironmentName(scope);
   return phase === "deploy" && (environment === "staging" || environment === "production");
 }
 function railwayServiceNameSuffix(serviceKey) {
-  return serviceKey === "workdayManager" ? "workday-manager" : serviceKey === "workerRunner" ? "worker-runner" : serviceKey === "marketOperationsRunner" ? "market-operations-runner" : serviceKey;
+  return serviceKey === "capacityProviderManager" ? "capacity-provider-manager" : serviceKey === "capacityProviderRunner" ? "capacity-provider-runner" : serviceKey === "workdayManager" ? "workday-manager" : serviceKey === "workerRunner" ? "worker-runner" : serviceKey === "operationsRunner" ? "operations-runner" : serviceKey;
 }
 function deriveRailwayWorkerRunnerServiceName(projectSlug, index = WORKER_RUNNER_BOOTSTRAP_INDEX) {
   const normalizedIndex = Math.max(1, Number.parseInt(String(index), 10) || WORKER_RUNNER_BOOTSTRAP_INDEX);
   return `${projectSlug}-worker-runner-${String(normalizedIndex).padStart(2, "0")}`;
 }
-function deriveRailwayMarketOperationsRunnerServiceName(baseServiceName, index = WORKER_RUNNER_BOOTSTRAP_INDEX) {
+function deriveRailwayOperationsRunnerServiceName(baseServiceName, index = WORKER_RUNNER_BOOTSTRAP_INDEX) {
   const normalizedIndex = Math.max(1, Number.parseInt(String(index), 10) || WORKER_RUNNER_BOOTSTRAP_INDEX);
-  const base = String(baseServiceName ?? "").trim().replace(/-\d+$/u, "") || "treeseed-market-operations-runner";
+  const base = String(baseServiceName ?? "").trim().replace(/-\d+$/u, "").replace(/-\d{2}$/u, "") || "treeseed-api-operations-runner";
   return `${base}-${String(normalizedIndex).padStart(2, "0")}`;
 }
+function railwayImageRefEnvForService(serviceKey) {
+  if (serviceKey === "api") return "TREESEED_API_IMAGE_REF";
+  if (serviceKey === "operationsRunner") return "TREESEED_OPERATIONS_RUNNER_IMAGE_REF";
+  if (serviceKey === "capacityProviderManager") return "TREESEED_AGENT_MANAGER_IMAGE_REF";
+  if (serviceKey === "capacityProviderRunner") return "TREESEED_AGENT_RUNNER_IMAGE_REF";
+  if (isPublicTreeDxNodeServiceKey(serviceKey)) return "TREESEED_PUBLIC_TREEDX_IMAGE_REF";
+  return null;
+}
+function defaultRailwayImageRef(serviceKey, scope = "staging", env = process.env) {
+  if (serviceKey === "api") {
+    return envValue("TREESEED_API_IMAGE_REF", env) || null;
+  }
+  if (serviceKey === "operationsRunner") {
+    return envValue("TREESEED_OPERATIONS_RUNNER_IMAGE_REF", env) || null;
+  }
+  if (serviceKey === "capacityProviderManager") {
+    return envValue("TREESEED_AGENT_MANAGER_IMAGE_REF", env) || null;
+  }
+  if (serviceKey === "capacityProviderRunner") {
+    return envValue("TREESEED_AGENT_RUNNER_IMAGE_REF", env) || null;
+  }
+  if (isPublicTreeDxNodeServiceKey(serviceKey)) {
+    return envValue("TREESEED_PUBLIC_TREEDX_IMAGE_REF", env) || null;
+  }
+  return null;
+}
+function isPublicTreeDxNodeServiceKey(serviceKey) {
+  return String(serviceKey ?? "").startsWith(PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX);
+}
 function deriveRailwayWorkerRunnerVolumeName(serviceName, environmentName = "") {
-  const environment = normalizeRailwayEnvironmentName(environmentName);
-  const environmentSuffix = environment === "production" ? "-prod" : environment ? `-${environment}` : "";
-  return `${serviceName}${environmentSuffix}-data`;
+  return `${serviceName}-volume`;
+}
+function deriveRailwayOperationsRunnerVolumeName(serviceName, environmentName = "") {
+  return `${serviceName}-volume`;
 }
-function deriveRailwayMarketOperationsRunnerVolumeName(serviceName, environmentName = "") {
-  const environment = normalizeRailwayEnvironmentName(environmentName);
-  const environmentSuffix = environment === "production" ? "-prod" : environment ? `-${environment}` : "";
-  const index = String(serviceName ?? "").match(/-(\d+)$/u)?.[1] ?? "01";
-  return `market-ops-runner-${index}${environmentSuffix}-data`;
+function deriveRailwayCapacityProviderRunnerServiceName(baseServiceName, index = WORKER_RUNNER_BOOTSTRAP_INDEX) {
+  const normalizedIndex = Math.max(1, Number.parseInt(String(index), 10) || WORKER_RUNNER_BOOTSTRAP_INDEX);
+  const base = String(baseServiceName ?? "").trim().replace(/-\d+$/u, "").replace(/-\d{2}$/u, "") || "treeseed-capacity-provider-runner";
+  return `${base}-${String(normalizedIndex).padStart(2, "0")}`;
+}
+function deriveRailwayCapacityProviderRunnerVolumeName(serviceName, environmentName = "") {
+  return `${serviceName}-volume`;
 }
 function railwayServiceRuntimeStartCommand(service) {
   return service.startCommand;
@@ -75,8 +127,8 @@ function normalizeScheduleExpressions(value) {
   }
   return [];
 }
-function envValue(name) {
-  const value = process.env[name];
+function envValue(name, env = process.env) {
+  const value = env?.[name];
   return typeof value === "string" && value.trim() ? value.trim() : "";
 }
 function relativeRailwayRootDir(tenantRoot, serviceRoot) {
@@ -87,6 +139,10 @@ function configuredEnvValue(env, name) {
   const value = env?.[name];
   return typeof value === "string" && value.trim() ? value.trim() : "";
 }
+function railwayDeployTransport(env) {
+  const configured = configuredEnvValue(env, "TREESEED_RAILWAY_DEPLOY_TRANSPORT").toLowerCase();
+  return configured === "cli-fallback" ? "cli-fallback" : "api";
+}
 async function timedRailwayPhase(timings, name, run, metadata) {
   const startMs = performance.now();
   try {
@@ -149,6 +205,10 @@ function railwayStatusDeploymentSettled(status) {
   const normalized = String(status ?? "").trim().toUpperCase();
   return normalized === "SUCCESS" || normalized === "SLEEPING";
 }
+function railwayStatusDeploymentTerminalFailure(status) {
+  const normalized = String(status ?? "").trim().toUpperCase();
+  return ["FAILED", "CRASHED", "REMOVED"].includes(normalized);
+}
 function formatRailwayDeploymentStatusSummary(scope, checks) {
   const aliases = {
     api: "api",
@@ -219,12 +279,14 @@ function collectRailwayDeploymentStatusChecks(statusPayload, scope, services) {
     const status = String(deployment?.status ?? "").trim().toUpperCase();
     const instanceStatuses = Array.isArray(deployment?.instances) ? deployment.instances.map((entry) => String(entry?.status ?? "").trim()).filter(Boolean) : [];
     const ok = railwayStatusDeploymentSettled(status);
+    const terminalFailure = railwayStatusDeploymentTerminalFailure(status);
     return {
       type: "deployment-status",
       service: service.key,
       serviceName: service.serviceName,
       environment: normalizeRailwayEnvironmentName(environment.name),
       ok,
+      terminalFailure,
       status: status || "missing_deployment",
       observed: {
         status: status || null,
@@ -234,74 +296,10 @@ function collectRailwayDeploymentStatusChecks(statusPayload, scope, services) {
         instanceStatuses,
         volumeMounts: Array.isArray(deployment?.meta?.volumeMounts) ? deployment.meta.volumeMounts : []
       },
-      message: ok ? void 0 : `Railway deployment for ${service.serviceName} is not settled yet; observed ${status || "missing deployment status"}.`
+      message: ok ? void 0 : terminalFailure ? `Railway deployment for ${service.serviceName} failed with terminal status ${status}.` : `Railway deployment for ${service.serviceName} is not settled yet; observed ${status || "missing deployment status"}.`
     };
   });
 }
-function normalizeRailwayCliVolume(value, { serviceId, serviceName, environmentId, fallbackName, fallbackMountPath }) {
-  if (!value || typeof value !== "object") {
-    return null;
-  }
-  const record = value;
-  const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : "";
-  if (!id) {
-    return null;
-  }
-  const listedServiceName = typeof record.serviceName === "string" && record.serviceName.trim() ? record.serviceName.trim() : "";
-  if (listedServiceName && serviceName && listedServiceName !== serviceName) {
-    return null;
-  }
-  const name = typeof record.name === "string" && record.name.trim() ? record.name.trim() : fallbackName;
-  const mountPath = typeof record.mountPath === "string" && record.mountPath.trim() ? record.mountPath.trim() : fallbackMountPath;
-  const sizeMb = typeof record.sizeMB === "number" ? record.sizeMB : null;
-  const currentSizeMb = typeof record.currentSizeMB === "number" ? record.currentSizeMB : null;
-  return {
-    id,
-    name,
-    projectId: null,
-    instances: [{
-      id,
-      serviceId,
-      environmentId,
-      mountPath,
-      state: "READY",
-      sizeGb: sizeMb === null ? null : sizeMb / 1e3,
-      usedGb: currentSizeMb === null ? null : currentSizeMb / 1e3
-    }]
-  };
-}
-function normalizeRailwayCliVolumeList(value, options) {
-  if (!value || typeof value !== "object" || !Array.isArray(value.volumes)) {
-    return [];
-  }
-  return value.volumes.map((entry) => normalizeRailwayCliVolume(entry, options)).filter(Boolean);
-}
-function listRailwayServiceVolumesWithCli({
-  cwd,
-  serviceId,
-  serviceName,
-  environmentId,
-  name,
-  mountPath,
-  env = process.env
-}) {
-  const listResult = runRailway(["volume", "--service", serviceId, "--environment", environmentId, "list", "--json"], {
-    cwd,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if ((listResult.status ?? 1) !== 0) {
-    return [];
-  }
-  return normalizeRailwayCliVolumeList(parseRailwayJsonOutput(listResult.stdout ?? ""), {
-    serviceId,
-    serviceName,
-    environmentId,
-    fallbackName: name,
-    fallbackMountPath: mountPath
-  });
-}
 function isUsableRailwayToken(value) {
   return typeof value === "string" && value.trim().length >= 8;
 }
@@ -311,7 +309,7 @@ function resolveRailwayAuthToken(env = process.env) {
 function buildRailwayCommandEnv(env = process.env) {
   const merged = { ...env };
   const token = resolveRailwayAuthToken(merged);
-  const projectToken = configuredEnvValue(merged, "RAILWAY_TOKEN");
+  const projectToken = configuredEnvValue(merged, "TREESEED_RAILWAY_TOKEN");
   if (token) {
     merged.RAILWAY_API_TOKEN = token;
   } else {
@@ -320,13 +318,6 @@ function buildRailwayCommandEnv(env = process.env) {
   merged.RAILWAY_TOKEN = projectToken || void 0;
   return merged;
 }
-function buildRailwayDeployCommandEnv(env = process.env) {
-  const merged = buildRailwayCommandEnv(env);
-  if (shouldAttachRailwayDeployLogs(merged)) {
-    merged.CI = "true";
-  }
-  return merged;
-}
 function normalizeRailwaySchedule(schedule) {
   if (!schedule || typeof schedule !== "object") {
     return null;
@@ -376,47 +367,6 @@ function collectRailwaySchedules(value, seen = /* @__PURE__ */ new Set()) {
   visit(value);
   return matches;
 }
-function normalizeRailwayProjectList(payload) {
-  try {
-    const parsed = JSON.parse(payload);
-    if (!Array.isArray(parsed)) {
-      return [];
-    }
-    return parsed.map((entry) => {
-      if (!entry || typeof entry !== "object") {
-        return null;
-      }
-      const id = typeof entry.id === "string" ? entry.id.trim() : "";
-      const name = typeof entry.name === "string" ? entry.name.trim() : "";
-      if (!id && !name) {
-        return null;
-      }
-      return { id, name };
-    }).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-function railwayMessage(result) {
-  return `${result?.stderr ?? ""}
-${result?.stdout ?? ""}`.trim();
-}
-function isRailwayAlreadyExistsMessage(result) {
-  return /already exists|already taken|duplicate|has already been taken/iu.test(railwayMessage(result));
-}
-function isRailwayTransientFailure(result) {
-  const message = railwayMessage(result);
-  if (!message.trim() && result?.status === 1) {
-    return true;
-  }
-  return /timed out|failed to fetch|error decoding response body|expected value at line 1 column 1|temporarily unavailable|econnreset|etimedout|failed to stream build logs|failed to retrieve build log/iu.test(message);
-}
-function sleepSync(milliseconds) {
-  if (!Number.isFinite(milliseconds) || milliseconds <= 0) {
-    return;
-  }
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
-}
 function isRailwayScheduleCapabilityError(error) {
   const message = error instanceof Error ? error.message : String(error ?? "");
   return /cronTriggers|cronTriggerCreate|cronTriggerUpdate/iu.test(message);
@@ -489,33 +439,6 @@ mutation TreeseedScheduleUpdate($id: String!, $name: String!, $schedule: String!
 `.trim()
   };
 }
-function runRailway(args, { cwd, capture = false, allowFailure = false, input, env, retryTransient = true, retryAttempts = 3, retryDelayMs = 2e3 } = {}) {
-  const effectiveEnv = buildRailwayCommandEnv({ ...process.env, ...env ?? {} });
-  const railway = resolveTreeseedToolCommand("railway", { env: effectiveEnv });
-  if (!railway) {
-    throw new Error("Railway CLI is unavailable.");
-  }
-  const runWithEnv = (spawnEnv) => spawnSync(railway.command, [...railway.argsPrefix, ...args], {
-    cwd,
-    stdio: input !== void 0 ? ["pipe", capture ? "pipe" : "inherit", capture ? "pipe" : "inherit"] : capture ? "pipe" : "inherit",
-    encoding: "utf8",
-    env: spawnEnv,
-    input
-  });
-  let result = null;
-  const maxAttempts = retryTransient && !allowFailure ? Math.max(1, Number(retryAttempts) || 1) : 1;
-  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-    result = runWithEnv(effectiveEnv);
-    if (result.status === 0 || allowFailure || !isRailwayTransientFailure(result) || attempt === maxAttempts) {
-      break;
-    }
-    sleepSync((Number(retryDelayMs) || 0) * attempt);
-  }
-  if (result?.status !== 0 && !allowFailure) {
-    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `railway ${args.join(" ")} failed`);
-  }
-  return result;
-}
 async function waitForRailwayManagedDeploymentsSettled(tenantRoot, scope, {
   services = configuredRailwayServices(tenantRoot, scope),
   env = process.env,
@@ -602,6 +525,26 @@ async function waitForRailwayManagedDeploymentsSettled(tenantRoot, scope, {
         }
       };
     }
+    if (checks.some((entry) => entry.terminalFailure === true)) {
+      return {
+        ok: false,
+        checks: checks.map((check) => ({
+          ...check,
+          settle: {
+            durationMs: elapsedMs(startMs),
+            pollCount,
+            finalStatus: check.status,
+            terminalFailure: check.terminalFailure === true
+          }
+        })),
+        settle: {
+          durationMs: elapsedMs(startMs),
+          pollCount,
+          status: "failed"
+        },
+        message: "Railway deployment reached a terminal failed state."
+      };
+    }
     if (Date.now() >= deadline) {
       return {
         ok: false,
@@ -668,264 +611,21 @@ query TreeseedRailwayDeploymentStatus($projectId: String!) {
   });
   return payload.data?.project ?? null;
 }
-function setRailwaySecretVariable({ cwd, service, environment, key, value, env = process.env, capture = false, allowFailure = false }) {
-  const effectiveEnv = buildRailwayCommandEnv({
-    ...process.env,
-    ...env ?? {}
-  });
-  let result = null;
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    const railway = resolveTreeseedToolCommand("railway", { env: effectiveEnv });
-    if (!railway) {
-      throw new Error("Railway CLI is unavailable.");
-    }
-    result = spawnSync(railway.command, [
-      ...railway.argsPrefix,
-      "variable",
-      "set",
-      "--service",
-      service,
-      "--environment",
-      environment,
-      "--stdin",
-      "--skip-deploys",
-      key
-    ], {
-      cwd,
-      stdio: ["pipe", capture ? "pipe" : "inherit", capture ? "pipe" : "inherit"],
-      encoding: "utf8",
-      env: effectiveEnv,
-      input: `${value}
-`
-    });
-    if (result.status === 0) {
-      return result;
-    }
-    if (!isRailwayTransientFailure(result)) {
-      break;
-    }
-  }
-  if (result?.status !== 0 && !allowFailure) {
-    throw new Error(result?.stderr?.trim() || result?.stdout?.trim() || `railway variable set --stdin ${key} failed`);
-  }
-  return result;
-}
-function ensureRailwayProjectExists(service, { env = process.env } = {}) {
-  const projectName = typeof service?.projectName === "string" ? service.projectName.trim() : "";
-  const projectId = typeof service?.projectId === "string" ? service.projectId.trim() : "";
-  const listed = runRailway(["list", "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (listed.status === 0) {
-    const match = normalizeRailwayProjectList(listed.stdout ?? "").find((entry) => entry.name === projectName || entry.id === projectName || entry.id === projectId);
-    if (match) {
-      return match;
-    }
-  }
-  if (!projectName) {
-    if (projectId) {
-      return { id: projectId, name: "" };
-    }
-    throw new Error(`Railway service ${service?.key ?? service?.serviceName ?? service?.serviceId ?? "(unknown)"} is missing a projectName.`);
-  }
-  const args = ["init", "--name", projectName, "--json"];
-  const workspace = resolveRailwayWorkspace(env);
-  if (workspace) {
-    args.push("--workspace", workspace);
-  }
-  const created = runRailway(args, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (created.status !== 0 && !isRailwayAlreadyExistsMessage(created)) {
-    throw new Error(railwayMessage(created) || `railway ${args.join(" ")} failed`);
-  }
-  return null;
-}
-function ensureRailwayEnvironmentExists(service, { env = process.env } = {}) {
-  const environmentName = normalizeRailwayEnvironmentName(service?.railwayEnvironment);
-  if (!environmentName) {
-    return null;
-  }
-  const linkResult = runRailway(["environment", "link", environmentName, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (linkResult.status === 0) {
-    return linkResult;
-  }
-  const createResult = runRailway(["environment", "new", environmentName, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (createResult.status !== 0 && !isRailwayAlreadyExistsMessage(createResult)) {
-    throw new Error(railwayMessage(createResult) || `railway environment new ${environmentName} failed`);
-  }
-  const relinkResult = runRailway(["environment", "link", environmentName, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (relinkResult.status !== 0) {
-    throw new Error(railwayMessage(relinkResult) || `railway environment link ${environmentName} failed`);
-  }
-  return relinkResult;
-}
-function ensureRailwayServiceExists(service, { env = process.env } = {}) {
-  const serviceSelector = typeof (service?.serviceName ?? service?.serviceId) === "string" ? String(service.serviceName ?? service.serviceId).trim() : "";
-  if (!serviceSelector) {
-    throw new Error(`Railway service ${service?.key ?? "(unknown)"} is missing a service selector.`);
-  }
-  const statusArgs = ["service", "status", "--service", serviceSelector, "--environment", service.railwayEnvironment, "--json"];
-  const statusResult = runRailway(statusArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (statusResult.status === 0) {
-    return statusResult;
-  }
-  const createResult = runRailway(["add", "--service", serviceSelector, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (createResult.status !== 0 && !isRailwayAlreadyExistsMessage(createResult)) {
-    throw new Error(railwayMessage(createResult) || `railway add --service ${serviceSelector} failed`);
-  }
-  const refreshed = runRailway(statusArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (refreshed.status !== 0) {
-    throw new Error(railwayMessage(refreshed) || `railway service status --service ${serviceSelector} failed`);
-  }
-  return refreshed;
-}
-function ensureRailwayDatabaseServiceExists(service, {
-  database = "postgres",
-  env = process.env
-} = {}) {
-  const serviceSelector = typeof (service?.serviceName ?? service?.serviceId) === "string" ? String(service.serviceName ?? service.serviceId).trim() : "";
-  if (!serviceSelector) {
-    throw new Error(`Railway database service ${service?.key ?? "(unknown)"} is missing a service selector.`);
-  }
-  const projectSelector = typeof service?.projectId === "string" && service.projectId.trim() ? service.projectId.trim() : typeof service?.projectName === "string" && service.projectName.trim() ? service.projectName.trim() : "";
-  if (!projectSelector) {
-    throw new Error(`Railway database service ${service?.key ?? serviceSelector} is missing a project selector.`);
-  }
-  const linkArgs = ["link", "--project", projectSelector];
-  const workspace = resolveRailwayWorkspace(env);
-  if (workspace) {
-    linkArgs.push("--workspace", workspace);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service?.railwayEnvironment);
-  if (environmentName) {
-    linkArgs.push("--environment", environmentName);
-  }
-  const linkResult = runRailway(linkArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if ((linkResult.status ?? 1) !== 0) {
-    throw new Error(railwayMessage(linkResult) || `railway ${linkArgs.join(" ")} failed`);
-  }
-  const statusArgs = ["service", "status", "--service", serviceSelector, "--environment", service.railwayEnvironment, "--json"];
-  const statusResult = runRailway(statusArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (statusResult.status === 0) {
-    return statusResult;
-  }
-  const addResult = runRailway(["add", "--database", database, "--service", serviceSelector, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (addResult.status !== 0 && !isRailwayAlreadyExistsMessage(addResult)) {
-    throw new Error(railwayMessage(addResult) || `railway add --database ${database} --service ${serviceSelector} failed`);
-  }
-  const refreshed = runRailway(statusArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (refreshed.status !== 0) {
-    throw new Error(railwayMessage(refreshed) || `railway service status --service ${serviceSelector} failed`);
-  }
-  return refreshed;
-}
-function ensureRailwayProjectContext(service, { env = process.env, allowFailure = false, capture = false } = {}) {
-  ensureRailwayProjectExists(service, { env });
-  let projectSelector = service?.projectId ?? "";
-  if ((!projectSelector || !String(projectSelector).trim()) && service?.projectName) {
-    const listed = runRailway(["list", "--json"], {
-      cwd: service.rootDir,
-      capture: true,
-      allowFailure: true,
-      env
-    });
-    if (listed.status === 0) {
-      const match = normalizeRailwayProjectList(listed.stdout ?? "").find((entry) => entry.name === service.projectName || entry.id === service.projectName);
-      projectSelector = match?.id || match?.name || service.projectName;
-    } else {
-      projectSelector = service.projectName;
-    }
-  }
-  projectSelector = typeof projectSelector === "string" ? projectSelector.trim() : "";
-  if (typeof projectSelector !== "string" || projectSelector.trim().length === 0) {
-    throw new Error(`Railway service ${service?.key ?? service?.serviceName ?? service?.serviceId ?? "(unknown)"} is missing a project selector.`);
-  }
-  const args = ["link", "--project", projectSelector];
-  const workspace = resolveRailwayWorkspace(env);
-  if (workspace) {
-    args.push("--workspace", workspace);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service?.railwayEnvironment);
-  if (environmentName) {
-    args.push("--environment", environmentName);
-  }
-  runRailway(args, {
-    cwd: service.rootDir,
-    capture,
-    allowFailure,
-    env
-  });
-  if (environmentName) {
-    ensureRailwayEnvironmentExists(service, { env });
-    return runRailway(["environment", "link", environmentName, "--json"], {
-      cwd: service.rootDir,
-      capture,
-      allowFailure,
-      env
-    });
-  }
-  return null;
-}
-function configuredRailwayServices(tenantRoot, scope) {
-  const deployConfig = loadCliDeployConfig(tenantRoot);
+function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, application = null, machineConfigRoot = tenantRoot) {
   const normalizedScope = normalizeScope(scope);
+  const imageRefKeys = [
+    "TREESEED_API_IMAGE_REF",
+    "TREESEED_OPERATIONS_RUNNER_IMAGE_REF",
+    "TREESEED_AGENT_MANAGER_IMAGE_REF",
+    "TREESEED_AGENT_RUNNER_IMAGE_REF"
+  ];
+  let machineEnv = {};
+  try {
+    machineEnv = resolveTreeseedMachineEnvironmentValues(machineConfigRoot, normalizedScope, imageRefKeys);
+  } catch {
+    machineEnv = {};
+  }
+  const imageRefEnv = { ...process.env, ...machineEnv };
   let identity;
   try {
     identity = resolveTreeseedResourceIdentity(deployConfig, createPersistentDeployTarget(normalizedScope));
@@ -939,13 +639,14 @@ function configuredRailwayServices(tenantRoot, scope) {
   }
   const configuredOptionalServiceKeys = Object.keys(deployConfig.services ?? {}).filter((serviceKey) => RAILWAY_SERVICE_KEYS.includes(serviceKey));
   const serviceKeys = hostingKind === "hosted_project" ? [.../* @__PURE__ */ new Set([...HOSTED_PROJECT_SERVICE_KEYS, ...configuredOptionalServiceKeys])] : RAILWAY_SERVICE_KEYS;
-  return serviceKeys.flatMap((serviceKey) => {
+  const configuredServices = serviceKeys.flatMap((serviceKey) => {
     const service = deployConfig.services?.[serviceKey];
     if (!service || service.enabled === false || (service.provider ?? "railway") !== "railway") {
       return [];
     }
-    const defaultRootDir = ["api", "marketOperationsRunner"].includes(serviceKey) ? "." : "packages/core";
-    const serviceRoot = resolve(tenantRoot, service.railway?.rootDir ?? service.rootDir ?? defaultRootDir);
+    const isCapacityProviderService = String(serviceKey).startsWith("capacityProvider");
+    const defaultRootDir = ["api", "operationsRunner"].includes(serviceKey) ? "." : isCapacityProviderService ? "packages/agent" : "packages/core";
+    const serviceRoot = isCapacityProviderService ? resolveRailwayCapacityProviderRoot(tenantRoot, service) : resolve(tenantRoot, service.railway?.rootDir ?? service.rootDir ?? defaultRootDir);
     const railwayEnvironment = resolveRailwayEnvironmentForScope(
       normalizedScope,
       service.environments?.[normalizedScope]?.railwayEnvironment
@@ -953,45 +654,249 @@ function configuredRailwayServices(tenantRoot, scope) {
     const publicBaseUrl = service.environments?.[normalizedScope]?.baseUrl ?? service.publicBaseUrl ?? null;
     const configuredServiceName = service.railway?.serviceName ?? (serviceKey === "workerRunner" ? deriveRailwayWorkerRunnerServiceName(identity.deploymentKey) : `${identity.deploymentKey}-${railwayServiceNameSuffix(serviceKey)}`);
     const configuredRunnerPool = service.railway?.runnerPool && typeof service.railway.runnerPool === "object" ? service.railway.runnerPool : null;
-    const runnerPool = serviceKey === "marketOperationsRunner" ? {
-      bootstrapCount: Math.max(1, Number.parseInt(String(configuredRunnerPool?.bootstrapCount ?? MARKET_OPERATIONS_RUNNER_BOOTSTRAP_COUNT), 10) || MARKET_OPERATIONS_RUNNER_BOOTSTRAP_COUNT),
-      maxRunners: Math.max(1, Number.parseInt(String(configuredRunnerPool?.maxRunners ?? configuredRunnerPool?.bootstrapCount ?? MARKET_OPERATIONS_RUNNER_BOOTSTRAP_COUNT), 10) || MARKET_OPERATIONS_RUNNER_BOOTSTRAP_COUNT),
+    const runnerPool = serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? {
+      bootstrapCount: Math.max(1, Number.parseInt(String(configuredRunnerPool?.bootstrapCount ?? (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)), 10) || (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)),
+      maxRunners: Math.max(1, Number.parseInt(String(configuredRunnerPool?.maxRunners ?? configuredRunnerPool?.bootstrapCount ?? (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)), 10) || (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)),
       volumeMountPath: service.railway?.volumeMountPath ?? configuredRunnerPool?.volumeMountPath ?? WORKER_RUNNER_VOLUME_MOUNT_PATH
     } : serviceKey === "workerRunner" ? {
       bootstrapIndex: WORKER_RUNNER_BOOTSTRAP_INDEX,
       volumeMountPath: WORKER_RUNNER_VOLUME_MOUNT_PATH
     } : null;
-    const instanceCount = serviceKey === "marketOperationsRunner" ? runnerPool.bootstrapCount : 1;
+    const instanceCount = serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? runnerPool.bootstrapCount : 1;
     return Array.from({ length: instanceCount }, (_, offset) => {
       const runnerIndex = offset + 1;
-      const serviceName = serviceKey === "marketOperationsRunner" ? deriveRailwayMarketOperationsRunnerServiceName(configuredServiceName, runnerIndex) : configuredServiceName;
+      const serviceName = serviceKey === "operationsRunner" ? deriveRailwayOperationsRunnerServiceName(configuredServiceName, runnerIndex) : serviceKey === "capacityProviderRunner" ? deriveRailwayCapacityProviderRunnerServiceName(configuredServiceName, runnerIndex) : configuredServiceName;
+      const configuredImageRefEnv = service.railway?.imageRefEnv ?? railwayImageRefEnvForService(serviceKey);
+      const imageRef = service.railway?.imageRef ?? (configuredImageRefEnv ? envValue(configuredImageRefEnv, imageRefEnv) || null : null) ?? defaultRailwayImageRef(serviceKey, normalizedScope, imageRefEnv);
+      const sourcePolicy = resolveRailwayServiceSourcePolicy({
+        tenantRoot,
+        scope: normalizedScope,
+        serviceKey,
+        service,
+        serviceRoot,
+        imageRef
+      });
+      const resolvedImageRef = sourcePolicy.sourceMode === "image" ? imageRef : null;
       return {
         key: serviceKey,
-        instanceKey: serviceKey === "marketOperationsRunner" ? `${serviceKey}:${runnerIndex}` : serviceKey,
-        runnerIndex: serviceKey === "marketOperationsRunner" ? runnerIndex : null,
+        instanceKey: serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? `${serviceKey}:${runnerIndex}` : serviceKey,
+        runnerIndex: serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? runnerIndex : null,
+        serviceConfig: service,
         scope: normalizedScope,
         projectId: service.railway?.projectId ?? null,
         projectName: service.railway?.projectName ?? identity.deploymentKey,
         serviceId: service.railway?.serviceId ?? null,
         serviceName,
-        runnerId: serviceKey === "marketOperationsRunner" ? serviceName : null,
+        runnerId: serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? serviceName : null,
         rootDir: serviceRoot,
         publicBaseUrl,
         railwayEnvironment,
-        buildCommand: service.railway?.buildCommand ?? null,
-        startCommand: service.railway?.startCommand ?? null,
+        buildCommand: resolvedImageRef ? null : service.railway?.buildCommand ?? null,
+        startCommand: isCapacityProviderService ? null : resolvedImageRef ? null : service.railway?.startCommand ?? null,
+        imageRef: resolvedImageRef,
+        sourceMode: sourcePolicy.sourceMode,
+        sourceRepo: sourcePolicy.sourceRepo,
+        sourceBranch: sourcePolicy.sourceBranch,
+        sourceCommit: sourcePolicy.sourceCommit,
+        sourceRootDirectory: sourcePolicy.sourceRootDirectory,
+        dockerfilePath: sourcePolicy.sourceMode === "git" ? service.railway?.dockerfilePath ?? null : null,
         healthcheckPath: service.railway?.healthcheckPath ?? null,
         healthcheckTimeoutSeconds: service.railway?.healthcheckTimeoutSeconds ?? null,
         healthcheckIntervalSeconds: service.railway?.healthcheckIntervalSeconds ?? null,
         restartPolicy: service.railway?.restartPolicy ?? null,
         runtimeMode: service.railway?.runtimeMode ?? null,
-        volumeMountPath: serviceKey === "marketOperationsRunner" ? runnerPool.volumeMountPath : service.railway?.volumeMountPath ?? null,
+        volumeMountPath: serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? runnerPool.volumeMountPath : service.railway?.volumeMountPath ?? null,
         schedule: normalizeScheduleExpressions(service.railway?.schedule),
         hostingKind,
-        runnerPool
+        runnerPool,
+        application,
+        secretRefs: Array.isArray(service.secretRefs) ? service.secretRefs : [],
+        variableRefs: Array.isArray(service.variableRefs) ? service.variableRefs : []
       };
     });
   }).filter(Boolean);
+  return [
+    ...configuredServices,
+    ...configuredPublicTreeDxRailwayServices({
+      tenantRoot,
+      scope: normalizedScope,
+      deployConfig,
+      identity,
+      hostingKind,
+      application,
+      imageRefEnv,
+      workspaceRoot: machineConfigRoot
+    })
+  ];
+}
+function configuredPublicTreeDxRailwayServices({ tenantRoot, scope, deployConfig, identity, hostingKind, application, imageRefEnv, workspaceRoot }) {
+  if (deployConfig.hosting?.kind !== "treeseed_control_plane") {
+    return [];
+  }
+  const railway = deployConfig.publicTreeDxFederation?.railway ?? {};
+  const nodePool = railway.nodePool && typeof railway.nodePool === "object" && !Array.isArray(railway.nodePool) ? railway.nodePool : {};
+  const bootstrapCount = Math.max(0, Number.parseInt(String(nodePool.bootstrapCount ?? 1), 10) || 0);
+  if (bootstrapCount <= 0) {
+    return [];
+  }
+  const configuredSource = railway.source && typeof railway.source === "object" && !Array.isArray(railway.source) ? railway.source : {};
+  const treeDxRoot = resolve(workspaceRoot ?? tenantRoot, "packages", "treedx");
+  const configuredMode = typeof railway.sourceMode === "string" ? railway.sourceMode : null;
+  const sourceMode = scope === "prod" ? "image" : configuredMode === "git" || configuredMode === "image" ? configuredMode : "git";
+  const repository = typeof railway.sourceRepo === "string" ? railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : readTreeseedPackageRepository(treeDxRoot) ?? "treeseed-ai/treedx";
+  const sourceBranch = typeof railway.sourceBranch === "string" ? railway.sourceBranch : typeof configuredSource.branch === "string" ? configuredSource.branch : scope === "staging" ? "staging" : null;
+  const sourceRootDirectory = typeof railway.sourceRootDirectory === "string" ? railway.sourceRootDirectory : typeof configuredSource.rootDirectory === "string" ? configuredSource.rootDirectory : ".";
+  const projectName = typeof railway.projectName === "string" && railway.projectName.trim() ? railway.projectName.trim() : typeof imageRefEnv.TREESEED_PUBLIC_TREEDX_RAILWAY_PROJECT_NAME === "string" && imageRefEnv.TREESEED_PUBLIC_TREEDX_RAILWAY_PROJECT_NAME.trim() ? imageRefEnv.TREESEED_PUBLIC_TREEDX_RAILWAY_PROJECT_NAME.trim() : identity.deploymentKey;
+  const railwayEnvironment = resolveRailwayEnvironmentForScope(scope, railway.environmentName);
+  const baseImageRef = envValue("TREESEED_PUBLIC_TREEDX_IMAGE_REF", imageRefEnv) || "treeseed/treedx";
+  return Array.from({ length: bootstrapCount }, (_, offset) => {
+    const index = offset + 1;
+    const serviceName = `${PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX}${String(index).padStart(2, "0")}`;
+    return {
+      key: serviceName,
+      instanceKey: serviceName,
+      runnerIndex: null,
+      serviceConfig: null,
+      scope,
+      projectId: typeof railway.projectId === "string" ? railway.projectId : null,
+      projectName,
+      serviceId: typeof railway.serviceId === "string" && bootstrapCount === 1 ? railway.serviceId : null,
+      serviceName,
+      runnerId: null,
+      rootDir: treeDxRoot,
+      publicBaseUrl: null,
+      railwayEnvironment,
+      buildCommand: sourceMode === "git" ? railway.buildCommand ?? null : null,
+      startCommand: sourceMode === "git" ? railway.startCommand ?? null : null,
+      imageRef: sourceMode === "image" ? baseImageRef : null,
+      sourceMode,
+      sourceRepo: sourceMode === "git" ? repository : null,
+      sourceBranch: sourceMode === "git" ? sourceBranch : null,
+      sourceCommit: sourceMode === "git" ? headCommitSafe(treeDxRoot) ?? headCommitSafe(tenantRoot) : null,
+      sourceRootDirectory: sourceMode === "git" ? sourceRootDirectory : null,
+      dockerfilePath: sourceMode === "git" ? railway.dockerfilePath ?? "/Dockerfile" : null,
+      healthcheckPath: railway.healthcheckPath ?? null,
+      healthcheckTimeoutSeconds: railway.healthcheckTimeoutSeconds ?? null,
+      healthcheckIntervalSeconds: railway.healthcheckIntervalSeconds ?? null,
+      restartPolicy: railway.restartPolicy ?? null,
+      runtimeMode: railway.runtimeMode ?? "replicated",
+      volumeMountPath: railway.volumeMountPath ?? "/data",
+      schedule: [],
+      hostingKind,
+      runnerPool: null,
+      application,
+      environmentVariables: {
+        PORT: "4000",
+        TREEDX_DATA_DIR: railway.volumeMountPath ?? "/data",
+        TREEDX_AUTH_MODE: "connected",
+        TREEDX_AUTH_VERIFIER: "hs256_dev",
+        TREEDX_ALLOW_DEV_VERIFIER_IN_PROD: "true",
+        TREEDX_EXEC_BACKEND: "container_sandbox",
+        TREEDX_FEDERATION_MODE: "connected_library",
+        TREEDX_JWT_AUDIENCE: "treedx-public-federation",
+        TREEDX_JWT_ISSUER: "https://api.treeseed.local/treedx",
+        TREEDX_BOOTSTRAP_TRUST_ACTOR_ID: "treeseed-api",
+        TREEDX_BOOTSTRAP_TRUST_TENANT_ID: "treeseed-control-plane",
+        TREEDX_BOOTSTRAP_TRUST_REPO_IDS: "*",
+        TREEDX_BOOTSTRAP_TRUST_REFS: "*",
+        TREEDX_BOOTSTRAP_TRUST_PATHS: "**",
+        TREEDX_SCOPE: "public_federation"
+      },
+      secretRefs: ["TREEDX_SECRET_KEY_BASE", "TREEDX_ADMIN_TOKEN", "TREEDX_JWT_HS256_SECRET"],
+      variableRefs: [
+        "PORT",
+        "TREEDX_DATA_DIR",
+        "TREEDX_AUTH_MODE",
+        "TREEDX_AUTH_VERIFIER",
+        "TREEDX_ALLOW_DEV_VERIFIER_IN_PROD",
+        "TREEDX_EXEC_BACKEND",
+        "TREEDX_FEDERATION_MODE",
+        "TREEDX_JWT_AUDIENCE",
+        "TREEDX_JWT_ISSUER",
+        "TREEDX_BOOTSTRAP_TRUST_ACTOR_ID",
+        "TREEDX_BOOTSTRAP_TRUST_TENANT_ID",
+        "TREEDX_BOOTSTRAP_TRUST_REPO_IDS",
+        "TREEDX_BOOTSTRAP_TRUST_REFS",
+        "TREEDX_BOOTSTRAP_TRUST_PATHS",
+        "TREEDX_SCOPE"
+      ]
+    };
+  });
+}
+function readTreeseedPackageRepository(packageRoot) {
+  const manifestPath = resolve(packageRoot, "treeseed.package.yaml");
+  if (!existsSync(manifestPath)) return null;
+  try {
+    const manifest = parseYaml(readFileSync(manifestPath, "utf8"));
+    const repository = manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest.repository : null;
+    return typeof repository === "string" && /^[^/\s]+\/[^/\s]+$/u.test(repository.trim()) ? repository.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function headCommitSafe(cwd) {
+  try {
+    return runTreeseedGitText(["rev-parse", "HEAD"], {
+      cwd,
+      mode: classifyTreeseedGitMode(["rev-parse", "HEAD"])
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function resolveRailwayServiceSourcePolicy({ tenantRoot, scope, serviceKey, service, serviceRoot, imageRef }) {
+  const configuredMode = typeof service.railway?.sourceMode === "string" ? service.railway.sourceMode : null;
+  const configuredSource = service.railway?.source && typeof service.railway.source === "object" && !Array.isArray(service.railway.source) ? service.railway.source : {};
+  const configuredRepo = typeof service.railway?.sourceRepo === "string" ? service.railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : null;
+  const packageRepository = configuredRepo ?? readTreeseedPackageRepository(serviceRoot) ?? readTreeseedPackageRepository(tenantRoot);
+  const sourceEligible = ["api", "operationsRunner", "capacityProviderManager", "capacityProviderRunner"].includes(serviceKey);
+  const sourceMode = scope === "prod" ? "image" : configuredMode === "git" || configuredMode === "image" ? configuredMode : imageRef ? "image" : scope === "staging" && sourceEligible && packageRepository ? "git" : "git";
+  if (sourceMode !== "git") {
+    return {
+      sourceMode: "image",
+      sourceRepo: null,
+      sourceBranch: null,
+      sourceCommit: null,
+      sourceRootDirectory: null
+    };
+  }
+  return {
+    sourceMode: "git",
+    sourceRepo: packageRepository,
+    sourceBranch: typeof service.railway?.sourceBranch === "string" ? service.railway.sourceBranch : typeof configuredSource.branch === "string" ? configuredSource.branch : scope === "staging" ? "staging" : null,
+    sourceCommit: headCommitSafe(serviceRoot),
+    sourceRootDirectory: typeof service.railway?.sourceRootDirectory === "string" ? service.railway.sourceRootDirectory : typeof configuredSource.rootDirectory === "string" ? configuredSource.rootDirectory : "."
+  };
+}
+function resolveRailwayCapacityProviderRoot(tenantRoot, service) {
+  if (service.railway?.rootDir) {
+    return resolve(tenantRoot, service.railway.rootDir);
+  }
+  const candidates = [
+    resolve(tenantRoot, "..", "agent"),
+    resolve(tenantRoot, "packages", "agent"),
+    resolve(tenantRoot, "..", "..", "packages", "agent")
+  ];
+  const found = candidates.find(
+    (candidate) => existsSync(resolve(candidate, "treeseed.package.yaml")) || existsSync(resolve(candidate, "package.json"))
+  );
+  return found ?? resolve(tenantRoot, "packages", "agent");
+}
+function configuredRailwayServices(tenantRoot, scope) {
+  const deployConfig = loadCliDeployConfig(tenantRoot);
+  const direct = configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig);
+  const nested = discoverTreeseedApplications(tenantRoot).filter((application) => application.root !== resolve(tenantRoot)).flatMap((application) => configuredRailwayServicesForConfig(
+    application.root,
+    scope,
+    application.config,
+    {
+      id: application.id,
+      root: application.root,
+      relativeRoot: application.relativeRoot
+    },
+    tenantRoot
+  ));
+  return [...direct, ...nested];
 }
 function configuredRailwayScheduledJobs(tenantRoot, scope, { phase = "deploy" } = {}) {
   if (!shouldManageRailwaySchedules(scope, phase)) {
@@ -1087,7 +992,11 @@ function validateRailwayServiceConfiguration(tenantRoot, scope) {
     if (!service.projectName && !service.projectId) {
       issues.push(`${service.key}: set railway.projectName or railway.projectId in treeseed.site.yaml.`);
     }
-    if (!existsSync(service.rootDir)) {
+    if (service.sourceMode === "git" && !service.sourceRepo) {
+      issues.push(`${service.key}: staging source builds require railway.source.repository or package repository metadata.`);
+    }
+    const usesExternalGitSource = service.sourceMode === "git" && Boolean(service.sourceRepo);
+    if (!service.imageRef && !usesExternalGitSource && !existsSync(service.rootDir)) {
       issues.push(`${service.key}: service root ${service.rootDir} does not exist.`);
     }
     if (service.schedule?.length && !service.startCommand) {
@@ -1109,7 +1018,7 @@ function validateRailwayDeployPrerequisites(tenantRoot, scope, { env = process.e
   const validation = validateRailwayServiceConfiguration(tenantRoot, scope);
   const token = resolveRailwayAuthToken(env);
   if (typeof token !== "string" || token.trim().length === 0) {
-    throw new Error("Configure RAILWAY_API_TOKEN before deploying Railway-managed services.");
+    throw new Error("Configure TREESEED_RAILWAY_API_TOKEN before deploying Railway-managed services.");
   }
   return validation;
 }
@@ -1121,7 +1030,7 @@ async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, f
   const effectiveApiToken = apiToken || resolveRailwayAuthToken(env);
   const effectiveApiUrl = apiUrl || resolveRailwayApiUrl(env);
   if (typeof effectiveApiToken !== "string" || effectiveApiToken.trim().length === 0) {
-    throw new Error("Configure RAILWAY_API_TOKEN before deploying Railway-managed services.");
+    throw new Error("Configure TREESEED_RAILWAY_API_TOKEN before deploying Railway-managed services.");
   }
   const results = [];
   try {
@@ -1147,7 +1056,7 @@ async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, f
       const current = await getRailwayServiceInstance({
         serviceId: target.service.id,
         environmentId: target.environment.id,
-        env: { ...env, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
+        env: { ...env, TREESEED_RAILWAY_API_TOKEN: effectiveApiToken, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
         fetchImpl
       });
       const desired = {
@@ -1177,7 +1086,7 @@ async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, f
         environmentId: target.environment.id,
         startCommand: desired.command,
         cronSchedule: desired.schedule,
-        env: { ...env, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
+        env: { ...env, TREESEED_RAILWAY_API_TOKEN: effectiveApiToken, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
         fetchImpl
       });
       results.push({
@@ -1207,7 +1116,7 @@ async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, f
   return results;
 }
 async function verifyRailwayScheduledJobs(tenantRoot, scope, { fetchImpl = fetch, apiToken, apiUrl, env = process.env } = {}) {
-  const effectiveApiToken = apiToken || env?.RAILWAY_API_TOKEN;
+  const effectiveApiToken = apiToken || resolveRailwayAuthToken(env);
   const effectiveApiUrl = apiUrl || resolveRailwayApiUrl(env);
   const configured = configuredRailwayScheduledJobs(tenantRoot, scope);
   const checks = [];
@@ -1231,7 +1140,7 @@ async function verifyRailwayScheduledJobs(tenantRoot, scope, { fetchImpl = fetch
       const existing = await getRailwayServiceInstance({
         serviceId: target.service.id,
         environmentId: target.environment.id,
-        env: { ...env, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
+        env: { ...env, TREESEED_RAILWAY_API_TOKEN: effectiveApiToken, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
         fetchImpl
       });
       checks.push({
@@ -1286,7 +1195,7 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
 } = {}) {
   const effectiveApiToken = apiToken || resolveRailwayAuthToken(env);
   const effectiveApiUrl = apiUrl || resolveRailwayApiUrl(env);
-  const effectiveEnv = { ...env, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl };
+  const effectiveEnv = { ...env, TREESEED_RAILWAY_API_TOKEN: effectiveApiToken, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl };
   const services = configuredRailwayServices(tenantRoot, scope);
   const checks = [];
   const deploymentStatusServices = [];
@@ -1346,18 +1255,19 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
       } : null,
       message: instance.id ? void 0 : `Railway service instance for ${target.service.name} is missing in ${target.environment.name}.`
     });
-    if (service.key === "workerRunner") {
-      const expectedVolumeName = deriveRailwayWorkerRunnerVolumeName(target.service.name, target.environment.name);
+    const expectedVolumeMountPath = service.volumeMountPath ?? service.runnerPool?.volumeMountPath ?? null;
+    if (expectedVolumeMountPath) {
+      const expectedVolumeName = service.key === "operationsRunner" ? deriveRailwayOperationsRunnerVolumeName(target.service.name, target.environment.name) : service.key === "capacityProviderRunner" ? deriveRailwayCapacityProviderRunnerVolumeName(target.service.name, target.environment.name) : deriveRailwayWorkerRunnerVolumeName(target.service.name, target.environment.name);
       const volumes = await listRailwayVolumes({
         projectId: target.project.id,
         env: effectiveEnv,
         fetchImpl
       });
       const volume = volumes.find(
-        (candidate) => candidate.name === expectedVolumeName && candidate.instances.some((entry) => entry.serviceId === target.service.id && entry.environmentId === target.environment.id && entry.mountPath === WORKER_RUNNER_VOLUME_MOUNT_PATH)
+        (candidate) => candidate.name === expectedVolumeName && candidate.instances.some((entry) => entry.serviceId === target.service.id && entry.environmentId === target.environment.id && entry.mountPath === expectedVolumeMountPath)
       ) ?? null;
       checks.push({
-        type: "worker-runner-volume",
+        type: "service-volume",
         service: service.key,
         serviceName: target.service.name,
         serviceId: target.service.id,
@@ -1365,7 +1275,7 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
         environment: target.environment.name,
         environmentId: target.environment.id,
         volumeName: expectedVolumeName,
-        mountPath: WORKER_RUNNER_VOLUME_MOUNT_PATH,
+        mountPath: expectedVolumeMountPath,
         ok: Boolean(volume),
         status: volume ? "checked" : "missing",
         observed: volume ? {
@@ -1373,7 +1283,7 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
           name: volume.name,
           instances: volume.instances
         } : null,
-        message: volume ? void 0 : `Railway worker-runner volume ${expectedVolumeName} is missing or is not mounted at ${WORKER_RUNNER_VOLUME_MOUNT_PATH}.`
+        message: volume ? void 0 : `Railway volume ${expectedVolumeName} is missing or is not mounted on ${target.service.name} at ${expectedVolumeMountPath}.`
       });
     }
   }
@@ -1407,29 +1317,34 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
     checks
   };
 }
-function shouldAttachRailwayDeployLogs(env = process.env) {
-  const configured = configuredEnvValue(env, "TREESEED_RAILWAY_DEPLOY_ATTACH_LOGS");
-  if (configured === "1" || configured === "true") {
-    return true;
-  }
-  if (configured === "0" || configured === "false") {
-    return false;
+function railwayPhaseTimeoutMs(env = process.env, phase = "default") {
+  const configured = Number.parseInt(configuredEnvValue(env, `TREESEED_RAILWAY_${String(phase).toUpperCase().replace(/[^A-Z0-9]+/gu, "_")}_TIMEOUT_MS`), 10);
+  if (Number.isFinite(configured) && configured > 0) {
+    return configured;
   }
-  return false;
-}
-function shouldUseVerboseRailwayDeploy(env = process.env) {
-  const configured = configuredEnvValue(env, "TREESEED_RAILWAY_DEPLOY_VERBOSE");
-  if (configured === "1" || configured === "true") {
-    return true;
+  const defaultConfigured = Number.parseInt(configuredEnvValue(env, "TREESEED_RAILWAY_PHASE_TIMEOUT_MS"), 10);
+  if (Number.isFinite(defaultConfigured) && defaultConfigured > 0) {
+    return defaultConfigured;
   }
-  if (configured === "0" || configured === "false") {
-    return false;
+  if (phase === "sync_runtime_config") {
+    return 6e5;
   }
-  return shouldAttachRailwayDeployLogs(env);
+  return phase === "deploy" ? 3e5 : 18e4;
 }
-function shouldIncludeRailwayIgnoredFiles(env = process.env) {
-  const configured = configuredEnvValue(env, "TREESEED_RAILWAY_DEPLOY_INCLUDE_IGNORED");
-  return configured === "1" || configured === "true";
+async function withRailwayPhaseTimeout(run, timeoutMs, message) {
+  let timer = null;
+  try {
+    return await Promise.race([
+      Promise.resolve().then(run),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(message)), timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
 }
 function shouldRunRailwayPredeployBuild(env = process.env) {
   const configured = configuredEnvValue(env, "TREESEED_RAILWAY_PREDEPLOY_BUILD");
@@ -1441,56 +1356,6 @@ function shouldRunRailwayPredeployBuild(env = process.env) {
   }
   return configuredEnvValue(env, "CI") !== "true";
 }
-function planRailwayServiceDeploy(service, { env = process.env, projectTokenMode = false } = {}) {
-  const serviceSelector = service.serviceName ?? service.serviceId;
-  const args = ["up"];
-  if (serviceSelector) {
-    args.push("--service", serviceSelector);
-  }
-  if (shouldIncludeRailwayIgnoredFiles(env)) {
-    args.push("--no-gitignore");
-  }
-  args.push(shouldAttachRailwayDeployLogs(env) ? "--ci" : "--detach");
-  if (shouldUseVerboseRailwayDeploy(env)) {
-    args.push("--verbose");
-  }
-  if (!projectTokenMode && service.projectId) {
-    args.push("--project", service.projectId);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
-  if (!projectTokenMode && environmentName) {
-    args.push("--environment", environmentName);
-  }
-  return {
-    command: "railway",
-    args,
-    cwd: service.rootDir
-  };
-}
-function planRailwayProjectEnvironmentLink(service) {
-  const args = ["link"];
-  if (service.projectId) {
-    args.push("--project", service.projectId);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
-  if (environmentName) {
-    args.push("--environment", environmentName);
-  }
-  args.push("--json");
-  return {
-    command: "railway",
-    args,
-    cwd: service.rootDir
-  };
-}
-function buildRailwayCliContextEnv(env, service) {
-  return {
-    ...env,
-    RAILWAY_PROJECT_ID: configuredEnvValue(service, "projectId") || configuredEnvValue(env, "RAILWAY_PROJECT_ID") || void 0,
-    RAILWAY_ENVIRONMENT_ID: configuredEnvValue(service, "environmentId") || configuredEnvValue(env, "RAILWAY_ENVIRONMENT_ID") || void 0,
-    RAILWAY_SERVICE_ID: configuredEnvValue(service, "serviceId") || configuredEnvValue(env, "RAILWAY_SERVICE_ID") || void 0
-  };
-}
 async function syncRailwayApiDeviceLoginVariables(service, env, write, prefix) {
   if (service.key !== "api") {
     return null;
@@ -1505,7 +1370,7 @@ async function syncRailwayApiDeviceLoginVariables(service, env, write, prefix) {
     [
       "TREESEED_API_AUTH_APPROVAL_BASE_URL",
       "TREESEED_SITE_URL",
-      "BETTER_AUTH_URL"
+      "TREESEED_BETTER_AUTH_URL"
     ].map((key) => [key, configuredEnvValue(env, key)]).filter(([, value]) => value)
   );
   if (Object.keys(variables).length === 0) {
@@ -1521,166 +1386,6 @@ async function syncRailwayApiDeviceLoginVariables(service, env, write, prefix) {
   write ? write(`[${prefix.scope}][${prefix.system}][${prefix.task}][vars] Synced device login approval URL variables for ${service.serviceName ?? serviceId}.`, "stdout") : null;
   return { variables: Object.keys(variables) };
 }
-function buildRailwayLinkCommandEnv(env = process.env, service = {}) {
-  return buildRailwayCliContextEnv({
-    ...buildRailwayDeployCommandEnv({ ...env, RAILWAY_TOKEN: void 0 }),
-    RAILWAY_TOKEN: void 0
-  }, service);
-}
-function railwayCliConfigPath(env = process.env) {
-  const railwayHome = configuredEnvValue(env, "RAILWAY_HOME");
-  if (railwayHome) {
-    return resolve(railwayHome, "config.json");
-  }
-  const home = configuredEnvValue(env, "HOME");
-  if (!home) {
-    return "";
-  }
-  return resolve(home, ".railway", "config.json");
-}
-function readRailwayCliConfig(configPath) {
-  if (!configPath || !existsSync(configPath)) {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(readFileSync(configPath, "utf8"));
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function writeRailwayCliProjectConfig(service, { env = process.env, cwd = service.rootDir } = {}) {
-  const projectId = configuredEnvValue(service, "projectId");
-  const environmentId = configuredEnvValue(service, "environmentId");
-  const serviceId = configuredEnvValue(service, "serviceId");
-  const projectPath = cwd ? resolve(cwd) : "";
-  const configPath = railwayCliConfigPath(env);
-  if (!configPath || !projectPath || !projectId || !environmentId || !serviceId) {
-    return null;
-  }
-  const existing = readRailwayCliConfig(configPath);
-  const projects = existing.projects && typeof existing.projects === "object" ? existing.projects : {};
-  const next = {
-    ...existing,
-    projects: {
-      ...projects,
-      [projectPath]: {
-        projectPath,
-        name: configuredEnvValue(service, "projectName") || configuredEnvValue(service, "serviceName") || projectId,
-        project: projectId,
-        environment: environmentId,
-        environmentName: normalizeRailwayEnvironmentName(service.railwayEnvironment) || configuredEnvValue(service, "environmentName") || environmentId,
-        service: serviceId
-      }
-    },
-    user: existing.user && typeof existing.user === "object" ? existing.user : {
-      token: null,
-      accessToken: null,
-      refreshToken: null,
-      tokenExpiresAt: null
-    },
-    linkedFunctions: existing.linkedFunctions ?? null
-  };
-  mkdirSync(dirname(configPath), { recursive: true });
-  writeFileSync(configPath, `${JSON.stringify(next, null, 2)}
-`, "utf8");
-  return {
-    configPath,
-    projectPath,
-    projectId,
-    environmentId,
-    serviceId
-  };
-}
-function planRailwayServiceLink(service, { env = process.env } = {}) {
-  const args = ["link"];
-  if (service.projectId) {
-    args.push("--project", service.projectId);
-  }
-  const workspace = resolveRailwayWorkspace(env);
-  if (workspace) {
-    args.push("--workspace", workspace);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
-  if (environmentName) {
-    args.push("--environment", environmentName);
-  }
-  const serviceSelector = service.serviceName ?? service.serviceId;
-  if (serviceSelector) {
-    args.push("--service", serviceSelector);
-  }
-  args.push("--json");
-  return {
-    command: "railway",
-    args,
-    cwd: service.rootDir
-  };
-}
-function railwayProjectTokenName(service) {
-  const environment = normalizeRailwayEnvironmentName(service.railwayEnvironment) || "environment";
-  const serviceName = String(service.serviceName ?? service.serviceId ?? service.key ?? "service").toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 48) || "service";
-  return `treeseed-ci-${environment}-${serviceName}`;
-}
-async function createRailwayCliProjectToken(service, { env = process.env } = {}) {
-  const projectId = configuredEnvValue(service, "projectId");
-  const environmentId = configuredEnvValue(service, "environmentId");
-  if (!projectId || !environmentId) {
-    return "";
-  }
-  const name = railwayProjectTokenName(service);
-  try {
-    const existingPayload = await railwayGraphqlRequest({
-      query: `
-query TreeseedProjectTokens($projectId: String!) {
-	projectTokens(projectId: $projectId, first: 100) {
-		edges {
-			node {
-				id
-				name
-				projectId
-				environmentId
-			}
-		}
-	}
-}
-`.trim(),
-      variables: { projectId },
-      env
-    });
-    const existingTokens = railwayEdgeNodes(existingPayload.data?.projectTokens);
-    for (const token2 of existingTokens) {
-      if (token2?.name === name && token2?.projectId === projectId && token2?.environmentId === environmentId && token2?.id) {
-        await railwayGraphqlRequest({
-          query: `
-mutation TreeseedProjectTokenDelete($id: String!) {
-	projectTokenDelete(id: $id)
-}
-`.trim(),
-          variables: { id: token2.id },
-          env
-        });
-      }
-    }
-  } catch {
-  }
-  const payload = await railwayGraphqlRequest({
-    query: `
-mutation TreeseedProjectTokenCreate($input: ProjectTokenCreateInput!) {
-	projectTokenCreate(input: $input)
-}
-`.trim(),
-    variables: {
-      input: {
-        projectId,
-        environmentId,
-        name
-      }
-    },
-    env
-  });
-  const token = payload.data?.projectTokenCreate;
-  return typeof token === "string" && token.trim() ? token.trim() : "";
-}
 async function resolveRailwayDeployProjectContext(service, { env = process.env } = {}) {
   if (service.projectId) {
     return service;
@@ -1699,15 +1404,23 @@ async function resolveRailwayDeployProjectContext(service, { env = process.env }
     projectName: project.name ?? service.projectName
   };
 }
-async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, service, { env = process.env } = {}) {
-  const wantsInstanceConfig = service.buildCommand || service.startCommand || service.rootDir || service.healthcheckPath || service.healthcheckTimeoutSeconds !== null || service.healthcheckTimeoutSeconds !== void 0 || service.healthcheckIntervalSeconds !== null || service.healthcheckIntervalSeconds !== void 0 || service.restartPolicy || service.runtimeMode;
-  const wantsRunnerVolume = service.key === "workerRunner" || Boolean(service.volumeMountPath);
+async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, service, { env = process.env, writePhase = null } = {}) {
+  const writeSyncPhase = (stage, message) => {
+    if (typeof writePhase === "function") {
+      writePhase(`sync-runtime-config:${stage}`, message);
+    }
+  };
+  const wantsInstanceConfig = service.buildCommand || service.startCommand || !(service.imageRef || service.sourceMode === "image") && service.rootDir || service.healthcheckPath || service.healthcheckTimeoutSeconds !== null || service.healthcheckTimeoutSeconds !== void 0 || service.healthcheckIntervalSeconds !== null || service.healthcheckIntervalSeconds !== void 0 || service.restartPolicy || service.runtimeMode;
+  const wantsRunnerVolume = service.key === "workerRunner" || service.key === "operationsRunner" || service.key === "capacityProviderRunner";
   if (!wantsInstanceConfig && !wantsRunnerVolume) {
+    writeSyncPhase("skip", "No runtime configuration changes requested.");
     return null;
   }
+  writeSyncPhase("workspace", "Resolving Railway workspace.");
   const workspace = await resolveRailwayWorkspaceContext({ env });
   let project = null;
   if (service.projectId) {
+    writeSyncPhase("project", `Resolving Railway project ${service.projectName ?? service.projectId}.`);
     project = await ensureRailwayProject({
       projectId: service.projectId,
       projectName: service.projectName,
@@ -1716,9 +1429,11 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
       workspace: workspace.id
     }).then((result) => result.project);
   } else {
+    writeSyncPhase("project", `Looking up Railway project ${service.projectName}.`);
     const projects = await listRailwayProjects({ env, workspaceId: workspace.id });
     project = projects.find((entry) => entry.name === service.projectName) ?? null;
     if (!project) {
+      writeSyncPhase("project", `Creating Railway project ${service.projectName}.`);
       project = await ensureRailwayProject({
         projectName: service.projectName,
         defaultEnvironmentName: service.railwayEnvironment,
@@ -1730,6 +1445,7 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
   const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
   let environment = project.environments.find((entry) => entry.name === environmentName || entry.id === environmentName) ?? null;
   if (!environment) {
+    writeSyncPhase("environment", `Creating Railway environment ${environmentName}.`);
     environment = await ensureRailwayEnvironment({
       projectId: project.id,
       environmentName,
@@ -1738,63 +1454,107 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
   }
   let railwayService = project.services.find((entry) => entry.id === service.serviceId || entry.name === service.serviceName) ?? null;
   if (!railwayService) {
+    writeSyncPhase("service", `Creating Railway service ${service.serviceName ?? service.key}.`);
     railwayService = await ensureRailwayService({
       projectId: project.id,
       serviceId: service.serviceId,
       serviceName: service.serviceName,
+      environmentId: environment.id,
+      imageRef: service.imageRef,
+      sourceRepo: service.sourceRepo,
+      sourceBranch: service.sourceBranch,
+      env
+    }).then((result) => result.service);
+  } else if (service.imageRef) {
+    railwayService = await ensureRailwayService({
+      projectId: project.id,
+      serviceId: service.serviceId,
+      serviceName: service.serviceName,
+      environmentId: environment.id,
+      imageRef: service.imageRef,
+      sourceRepo: service.sourceRepo,
+      sourceBranch: service.sourceBranch,
       env
     }).then((result) => result.service);
   }
+  if (wantsInstanceConfig) {
+    writeSyncPhase("instance", "Ensuring Railway service instance configuration.");
+  }
   const runtimeConfiguration = wantsInstanceConfig ? await ensureRailwayServiceInstanceConfiguration({
     serviceId: railwayService.id,
     environmentId: environment.id,
     buildCommand: service.buildCommand,
     startCommand: railwayServiceRuntimeStartCommand(service),
     cronSchedule: service.schedule?.[0] ?? null,
-    rootDirectory: relativeRailwayRootDir(tenantRoot, service.rootDir),
+    rootDirectory: service.imageRef || service.sourceMode === "image" ? null : service.sourceRootDirectory ?? ".",
     healthcheckPath: service.healthcheckPath,
     healthcheckTimeoutSeconds: service.healthcheckTimeoutSeconds,
     healthcheckIntervalSeconds: service.healthcheckIntervalSeconds,
     restartPolicy: service.restartPolicy,
     runtimeMode: service.runtimeMode,
+    deploymentRegion: wantsRunnerVolume ? configuredEnvValue(env, "TREESEED_RAILWAY_STATEFUL_REGION") || "us-west2" : null,
     env
   }) : null;
+  writeSyncPhase("variables", "Upserting Railway runtime variables.");
   await upsertRailwayVariables({
     projectId: project.id,
     environmentId: environment.id,
     serviceId: railwayService.id,
     variables: {
       TREESEED_SKIP_PACKAGE_PREPARE: "1",
-      ...service.key === "marketOperationsRunner" ? {
+      ...service.sourceMode === "git" ? {
+        TREESEED_DEPLOY_SOURCE_MODE: "git",
+        ...service.sourceRepo ? { TREESEED_DEPLOY_SOURCE_REPOSITORY: service.sourceRepo } : {},
+        ...service.sourceBranch ? { TREESEED_DEPLOY_SOURCE_BRANCH: service.sourceBranch } : {},
+        ...service.sourceCommit ? { TREESEED_DEPLOY_SOURCE_COMMIT: service.sourceCommit } : {}
+      } : {
+        TREESEED_DEPLOY_SOURCE_MODE: "image"
+      },
+      ...service.key === "operationsRunner" ? {
         NIXPACKS_APT_PKGS: "git",
         NIXPACKS_PKGS: "git",
         TREESEED_PLATFORM_RUNNER_ID: service.runnerId ?? railwayService.name,
         TREESEED_PLATFORM_RUNNER_DATA_DIR: service.volumeMountPath ?? WORKER_RUNNER_VOLUME_MOUNT_PATH,
         TREESEED_PLATFORM_RUNNER_ENVIRONMENT: normalizeScope(service.scope) === "prod" ? "production" : normalizeScope(service.scope),
-        TREESEED_MARKET_ID: normalizeScope(service.scope),
+        TREESEED_MANAGER_ID: normalizeScope(service.scope),
+        ...configuredEnvValue(env, "TREESEED_RAILWAY_API_TOKEN") ? { TREESEED_RAILWAY_API_TOKEN: configuredEnvValue(env, "TREESEED_RAILWAY_API_TOKEN") } : {},
+        ...configuredEnvValue(env, "TREESEED_RAILWAY_WORKSPACE") ? { TREESEED_RAILWAY_WORKSPACE: configuredEnvValue(env, "TREESEED_RAILWAY_WORKSPACE") } : {},
         ...configuredEnvValue(env, "TREESEED_PLATFORM_RUNNER_SECRET") ? { TREESEED_PLATFORM_RUNNER_SECRET: configuredEnvValue(env, "TREESEED_PLATFORM_RUNNER_SECRET") } : {},
-        ...configuredEnvValue(env, "TREESEED_MARKET_API_BASE_URL") || configuredEnvValue(env, "TREESEED_MARKET_URL") ? {
-          TREESEED_MARKET_API_BASE_URL: configuredEnvValue(env, "TREESEED_MARKET_API_BASE_URL") || configuredEnvValue(env, "TREESEED_MARKET_URL")
+        ...configuredEnvValue(env, "TREESEED_API_BASE_URL") || configuredEnvValue(env, "TREESEED_URL") ? {
+          TREESEED_API_BASE_URL: configuredEnvValue(env, "TREESEED_API_BASE_URL") || configuredEnvValue(env, "TREESEED_URL")
         } : {}
+      } : {},
+      ...String(service.key).startsWith("capacityProvider") ? {
+        TREESEED_PROVIDER_ENVIRONMENT: normalizeScope(service.scope) === "prod" ? "production" : normalizeScope(service.scope),
+        TREESEED_MANAGER_ID: normalizeScope(service.scope),
+        TREESEED_MARKET_ID: normalizeScope(service.scope),
+        TREESEED_PROVIDER_ROLE: service.key === "capacityProviderManager" ? "manager" : "runner",
+        ...service.key === "capacityProviderRunner" ? {
+          TREESEED_PROVIDER_DATA_DIR: service.volumeMountPath ?? WORKER_RUNNER_VOLUME_MOUNT_PATH,
+          TREESEED_PROVIDER_RUNNER_ID: service.runnerId ?? railwayService.name
+        } : {},
+        ...configuredEnvValue(env, "TREESEED_MARKET_URL") ? { TREESEED_MARKET_URL: configuredEnvValue(env, "TREESEED_MARKET_URL") } : {},
+        ...configuredEnvValue(env, "TREESEED_CAPACITY_PROVIDER_API_KEY") ? { TREESEED_CAPACITY_PROVIDER_API_KEY: configuredEnvValue(env, "TREESEED_CAPACITY_PROVIDER_API_KEY") } : {},
+        ...configuredEnvValue(env, "TREESEED_CODEX_AUTH_JSON_B64") ? { TREESEED_CODEX_AUTH_JSON_B64: configuredEnvValue(env, "TREESEED_CODEX_AUTH_JSON_B64") } : {}
       } : {}
     },
     env
   });
   const volumeMountPath = service.volumeMountPath ?? service.runnerPool?.volumeMountPath ?? WORKER_RUNNER_VOLUME_MOUNT_PATH;
-  const volumeConfiguration = wantsRunnerVolume ? await ensureRailwayServiceVolumeWithCliFallback({
-    tenantRoot,
+  if (wantsRunnerVolume) {
+    writeSyncPhase("volume", `Ensuring Railway volume mounted at ${volumeMountPath}.`);
+  }
+  const volumeConfiguration = wantsRunnerVolume ? await ensureRailwayServiceVolume({
     projectId: project.id,
     environmentId: environment.id,
-    environmentName: environment.name,
     serviceId: railwayService.id,
-    serviceName: railwayService.name,
-    name: service.key === "marketOperationsRunner" ? deriveRailwayMarketOperationsRunnerVolumeName(railwayService.name, environment.name) : deriveRailwayWorkerRunnerVolumeName(railwayService.name, environment.name),
+    name: service.key === "operationsRunner" ? deriveRailwayOperationsRunnerVolumeName(railwayService.name, environment.name) : service.key === "capacityProviderRunner" ? deriveRailwayCapacityProviderRunnerVolumeName(railwayService.name, environment.name) : deriveRailwayWorkerRunnerVolumeName(railwayService.name, environment.name),
     mountPath: volumeMountPath,
-    preferCli: service.key === "marketOperationsRunner",
     env
   }) : null;
   if (wantsRunnerVolume) {
     if (service.key === "workerRunner") {
+      writeSyncPhase("volume-vars", "Upserting Railway worker volume variables.");
       await upsertRailwayVariables({
         projectId: project.id,
         environmentId: environment.id,
@@ -1810,6 +1570,7 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
       });
     }
   }
+  writeSyncPhase("done", "Runtime configuration is synchronized.");
   return {
     projectId: project.id,
     projectName: project.name ?? service.projectName ?? null,
@@ -1828,163 +1589,6 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
     } : null
   };
 }
-async function ensureRailwayServiceVolumeWithCliFallback({
-  tenantRoot,
-  projectId,
-  environmentId,
-  environmentName,
-  serviceId,
-  serviceName,
-  name,
-  mountPath,
-  preferCli = false,
-  env = process.env
-}) {
-  if (!preferCli) {
-    try {
-      return await ensureRailwayServiceVolume({
-        projectId,
-        environmentId,
-        serviceId,
-        name,
-        mountPath,
-        env
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (!message.includes("Problem processing request")) {
-        throw error;
-      }
-    }
-  }
-  const cliOptions = {
-    cwd: tenantRoot,
-    capture: true,
-    env
-  };
-  ensureRailwayProjectContext({
-    key: serviceName,
-    projectId,
-    serviceName,
-    rootDir: tenantRoot,
-    railwayEnvironment: environmentName
-  }, {
-    env,
-    capture: true
-  });
-  const volumeArgs = ["volume", "--service", serviceId, "--environment", environmentId];
-  const listResult = runRailway([...volumeArgs, "list", "--json"], cliOptions);
-  const existingVolumes = normalizeRailwayCliVolumeList(parseRailwayJsonOutput(listResult.stdout ?? ""), {
-    serviceId,
-    serviceName,
-    environmentId,
-    fallbackName: name,
-    fallbackMountPath: mountPath
-  });
-  let volume = existingVolumes.find((entry) => entry.name === name) ?? existingVolumes.find((entry) => entry.instances.some((instance2) => instance2.mountPath === mountPath)) ?? existingVolumes[0] ?? null;
-  let created = false;
-  let updated = false;
-  if (!volume) {
-    const createResult = runRailway([...volumeArgs, "add", "--mount-path", mountPath, "--json"], cliOptions);
-    volume = normalizeRailwayCliVolume(parseRailwayJsonOutput(createResult.stdout ?? ""), {
-      serviceId,
-      serviceName,
-      environmentId,
-      fallbackName: name,
-      fallbackMountPath: mountPath
-    });
-    if (!volume) {
-      throw new Error(`Railway CLI volume add did not return a usable volume for ${serviceName} in ${environmentName}.`);
-    }
-    created = true;
-  }
-  let instance = volume.instances.find((entry) => entry.serviceId === serviceId && entry.environmentId === environmentId) ?? volume.instances[0] ?? null;
-  if (!instance || instance.mountPath !== mountPath) {
-    const attachResult = runRailway([...volumeArgs, "attach", "--volume", volume.id, "--yes", "--json"], {
-      ...cliOptions,
-      allowFailure: true
-    });
-    if ((attachResult.status ?? 1) !== 0) {
-      const attachMessage = attachResult.stderr?.trim() || attachResult.stdout?.trim() || "";
-      if (!/already mounted/iu.test(attachMessage)) {
-        throw new Error(attachMessage || `Railway volume attach failed for ${serviceName} in ${environmentName}.`);
-      }
-    }
-    const attachedVolume = (attachResult.status ?? 1) === 0 ? normalizeRailwayCliVolume(parseRailwayJsonOutput(attachResult.stdout ?? ""), {
-      serviceId,
-      serviceName,
-      environmentId,
-      fallbackName: name,
-      fallbackMountPath: mountPath
-    }) : null;
-    volume = attachedVolume ?? {
-      ...volume,
-      instances: [{
-        ...instance ?? {
-          id: volume.id,
-          serviceId,
-          environmentId,
-          state: "READY",
-          sizeGb: null,
-          usedGb: null
-        },
-        serviceId,
-        environmentId,
-        mountPath
-      }]
-    };
-    instance = volume.instances.find((entry) => entry.serviceId === serviceId && entry.environmentId === environmentId) ?? volume.instances[0] ?? null;
-    updated = true;
-  }
-  const apiVolume = await waitForRailwayServiceVolumeMount({
-    projectId,
-    volumeId: volume.id,
-    volumeName: name,
-    serviceId,
-    environmentId,
-    mountPath,
-    env
-  });
-  if (apiVolume) {
-    volume = apiVolume;
-  } else {
-    throw new Error(`Railway volume ${name} was not attached to ${serviceName} at ${mountPath}.`);
-  }
-  return {
-    volume,
-    instance: volume.instances.find((entry) => entry.serviceId === serviceId && entry.environmentId === environmentId) ?? volume.instances[0] ?? null,
-    created,
-    updated
-  };
-}
-async function waitForRailwayServiceVolumeMount({
-  projectId,
-  volumeId,
-  volumeName,
-  serviceId,
-  environmentId,
-  mountPath,
-  env
-}) {
-  for (let attempt = 0; attempt <= 24; attempt += 1) {
-    const volumes = await listRailwayVolumes({ projectId, env });
-    const mounted = volumes.find(
-      (entry) => entry.instances.some(
-        (instance) => instance.serviceId === serviceId && instance.environmentId === environmentId && instance.mountPath === mountPath
-      )
-    ) ?? null;
-    const match = mounted ?? volumes.find((entry) => entry.id === volumeId) ?? volumes.find((entry) => entry.name === volumeName) ?? null;
-    if (match?.instances.some(
-      (instance) => instance.serviceId === serviceId && instance.environmentId === environmentId && instance.mountPath === mountPath
-    )) {
-      return match;
-    }
-    if (attempt < 24) {
-      await sleep(5e3);
-    }
-  }
-  return null;
-}
 async function deployRailwayService(tenantRoot, service, {
   dryRun = false,
   write,
@@ -1993,34 +1597,42 @@ async function deployRailwayService(tenantRoot, service, {
 } = {}) {
   const timings = [];
   if (dryRun) {
-    const plan2 = planRailwayServiceDeploy(service, { env });
     return {
       service: service.key,
       status: "planned",
-      command: [plan2.command, ...plan2.args].join(" "),
-      cwd: plan2.cwd,
+      command: "railway-api serviceInstanceDeployV2",
+      cwd: service.rootDir,
       publicBaseUrl: service.publicBaseUrl,
-      timings
+      timings,
+      transport: {
+        railway: {
+          reconcile: "api",
+          deploy: railwayDeployTransport(env)
+        }
+      }
     };
   }
   const deployService = await timedRailwayPhase(timings, "railway:resolve-context", () => resolveRailwayDeployProjectContext(service, { env }), {
     service: service.key
   });
   const commandEnv = buildRailwayCommandEnv({ ...process.env, ...env });
-  let railwayDeployEnv = buildRailwayDeployCommandEnv(commandEnv);
-  const railway = resolveTreeseedToolCommand("railway", { env: commandEnv });
-  if (!railway) {
-    throw new Error("Railway CLI is unavailable.");
-  }
+  const deployTransport = railwayDeployTransport(commandEnv);
   const taskPrefix = prefix ?? {
     scope: normalizeScope(deployService.scope ?? deployService.railwayEnvironment ?? "railway"),
     system: deployService.key === "api" ? "api" : "agents",
     task: `${deployService.key}-railway-deploy`,
     stage: "deploy"
   };
-  const runtimeConfiguration = await timedRailwayPhase(timings, "railway:sync-runtime-config", () => syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, deployService, {
-    env: commandEnv
-  }), { service: deployService.key });
+  const writePhase = (stage, message) => {
+    write ? write(`[${taskPrefix.scope}][${taskPrefix.system}][${taskPrefix.task}][${stage}] ${message}`, "stdout") : null;
+  };
+  writePhase("resolve-context", `Resolved Railway service ${deployService.serviceName ?? deployService.serviceId ?? deployService.key}.`);
+  writePhase("sync-runtime-config", "Syncing Railway runtime configuration.");
+  const runtimeConfiguration = await timedRailwayPhase(timings, "railway:sync-runtime-config", () => withRailwayPhaseTimeout(
+    () => syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, deployService, { env: commandEnv, writePhase }),
+    railwayPhaseTimeoutMs(commandEnv, "sync_runtime_config"),
+    `Railway runtime configuration sync timed out for ${deployService.serviceName ?? deployService.key}.`
+  ), { service: deployService.key });
   const cliDeployService = {
     ...deployService,
     projectId: runtimeConfiguration?.projectId ?? deployService.projectId,
@@ -2030,31 +1642,15 @@ async function deployRailwayService(tenantRoot, service, {
     serviceName: runtimeConfiguration?.serviceName ?? deployService.serviceName,
     railwayEnvironment: runtimeConfiguration?.environmentName ?? runtimeConfiguration?.environmentId ?? deployService.railwayEnvironment
   };
-  await timedRailwayPhase(timings, "railway:device-login-vars", () => syncRailwayApiDeviceLoginVariables(cliDeployService, commandEnv, write, taskPrefix), {
+  writePhase("device-login-vars", "Syncing Railway device-login variables.");
+  await timedRailwayPhase(timings, "railway:device-login-vars", () => withRailwayPhaseTimeout(
+    () => syncRailwayApiDeviceLoginVariables(cliDeployService, commandEnv, write, taskPrefix),
+    railwayPhaseTimeoutMs(commandEnv, "device_login_vars"),
+    `Railway device-login variable sync timed out for ${cliDeployService.serviceName ?? cliDeployService.key}.`
+  ), {
     service: cliDeployService.key
   });
-  railwayDeployEnv = buildRailwayCliContextEnv(railwayDeployEnv, cliDeployService);
-  const hasCommandApiToken = Boolean(configuredEnvValue(commandEnv, "RAILWAY_API_TOKEN"));
-  let usesProjectToken = Boolean(configuredEnvValue(railwayDeployEnv, "RAILWAY_TOKEN"));
-  if (usesProjectToken) {
-    railwayDeployEnv = { ...railwayDeployEnv, RAILWAY_API_TOKEN: void 0 };
-  }
-  await timedRailwayPhase(timings, "railway:project-token", async () => {
-    if (usesProjectToken || hasCommandApiToken) {
-      return null;
-    }
-    const projectToken = await createRailwayCliProjectToken(cliDeployService, { env: commandEnv });
-    if (projectToken) {
-      railwayDeployEnv = buildRailwayCliContextEnv({ ...railwayDeployEnv, RAILWAY_API_TOKEN: void 0, RAILWAY_TOKEN: projectToken }, cliDeployService);
-      usesProjectToken = true;
-    } else if (configuredEnvValue(commandEnv, "CI") === "true") {
-      throw new Error(`Railway CI deploy requires a project token for ${cliDeployService.serviceName ?? cliDeployService.key}. Automatic project token creation did not return a token.`);
-    }
-    return null;
-  }, { service: cliDeployService.key });
-  const linkPlan = planRailwayServiceLink(cliDeployService, { env: commandEnv });
-  const plan = planRailwayServiceDeploy(cliDeployService, { env, projectTokenMode: usesProjectToken });
-  if (deployService.buildCommand && shouldRunRailwayPredeployBuild(commandEnv)) {
+  if (deployService.buildCommand && !deployService.imageRef && shouldRunRailwayPredeployBuild(commandEnv)) {
     const buildResult = await timedRailwayPhase(timings, "railway:predeploy-build", () => runPrefixedCommand("bash", ["-lc", deployService.buildCommand], {
       cwd: deployService.rootDir,
       env: commandEnv,
@@ -2065,102 +1661,66 @@ async function deployRailwayService(tenantRoot, service, {
       throw new Error(`Railway ${deployService.key} build command failed.`);
     }
   }
-  const hasRailwayApiToken = Boolean(configuredEnvValue(commandEnv, "RAILWAY_API_TOKEN"));
-  const cliConfig = configuredEnvValue(commandEnv, "CI") === "true" ? writeRailwayCliProjectConfig(cliDeployService, { env: railwayDeployEnv, cwd: plan.cwd }) : null;
-  const effectiveLinkPlan = hasRailwayApiToken ? linkPlan : usesProjectToken ? planRailwayProjectEnvironmentLink(cliDeployService) : linkPlan;
-  const railwayLinkEnv = hasRailwayApiToken ? buildRailwayLinkCommandEnv(commandEnv, cliDeployService) : railwayDeployEnv;
-  await timedRailwayPhase(timings, "railway:link", async () => {
-    if (cliConfig) {
-      write ? write(`[${taskPrefix.scope}][${taskPrefix.system}][${taskPrefix.task}][link] Wrote Railway CLI project context for ${cliConfig.projectPath}.`, "stdout") : null;
-      return;
-    }
-    const linkResult = await runPrefixedCommand(railway.command, [...railway.argsPrefix, ...effectiveLinkPlan.args], {
-      cwd: effectiveLinkPlan.cwd,
-      env: railwayLinkEnv,
-      write,
-      prefix: { ...taskPrefix, stage: "link" }
-    });
-    if (linkResult.status !== 0) {
-      throw new Error(linkResult.stderr?.trim() || linkResult.stdout?.trim() || `railway ${effectiveLinkPlan.args.join(" ")} failed with exit code ${linkResult.status ?? "unknown"} in ${effectiveLinkPlan.cwd}`);
-    }
-  }, { service: cliDeployService.key });
-  await timedRailwayPhase(timings, "railway:deploy", async () => {
-    let lastFailure = null;
-    for (let attempt = 1; attempt <= 5; attempt += 1) {
-      const result = await runPrefixedCommand(railway.command, [...railway.argsPrefix, ...plan.args], {
-        cwd: plan.cwd,
-        env: railwayDeployEnv,
-        write,
-        prefix: taskPrefix
-      });
-      if (result.status === 0) {
-        lastFailure = null;
-        break;
-      }
-      lastFailure = result;
-      if (!isRailwayTransientFailure(result) || attempt === 5) {
-        throw new Error(result.stderr?.trim() || result.stdout?.trim() || `railway ${plan.args.join(" ")} failed with exit code ${result.status ?? "unknown"} in ${plan.cwd}`);
-      }
-      const backoffMs = 5e3 * attempt;
-      const warning = `Railway deploy for ${deployService.serviceName ?? deployService.serviceId ?? deployService.key} hit a transient failure; retrying in ${Math.round(backoffMs / 1e3)}s...`;
-      write ? write(`[${taskPrefix.scope}][${taskPrefix.system}][${taskPrefix.task}][retry] ${warning}`, "stderr") : console.warn(warning);
-      await sleep(backoffMs);
-    }
-    if (lastFailure) {
-      throw new Error(lastFailure.stderr?.trim() || lastFailure.stdout?.trim() || `railway ${plan.args.join(" ")} failed`);
-    }
-  }, { service: cliDeployService.key });
-  return {
-    service: deployService.key,
-    status: "deployed",
-    command: [plan.command, ...plan.args].join(" "),
-    cwd: plan.cwd,
-    publicBaseUrl: deployService.publicBaseUrl,
-    timings,
-    runtimeConfiguration: runtimeConfiguration ? {
-      updated: runtimeConfiguration.updated,
-      healthcheckPath: runtimeConfiguration.instance?.healthcheckPath ?? null,
-      healthcheckTimeoutSeconds: runtimeConfiguration.instance?.healthcheckTimeoutSeconds ?? null,
-      runtimeMode: runtimeConfiguration.instance?.runtimeMode ?? null,
-      volume: runtimeConfiguration.volume ?? null
-    } : null
-  };
+  if (deployTransport !== "cli-fallback") {
+    writePhase("deploy", `Deploying Railway service ${cliDeployService.serviceName ?? cliDeployService.serviceId ?? cliDeployService.key} through the Railway API.`);
+    const apiDeploy = await timedRailwayPhase(timings, "railway:api-deploy", () => withRailwayPhaseTimeout(
+      () => deployRailwayServiceInstance({
+        serviceId: cliDeployService.serviceId,
+        environmentId: cliDeployService.environmentId,
+        env: commandEnv
+      }),
+      railwayPhaseTimeoutMs(commandEnv, "deploy"),
+      `Railway API deploy phase timed out for ${cliDeployService.serviceName ?? cliDeployService.key}.`
+    ), { service: cliDeployService.key });
+    return {
+      service: deployService.key,
+      status: "deployed",
+      command: "railway-api serviceInstanceDeployV2",
+      cwd: deployService.rootDir,
+      publicBaseUrl: deployService.publicBaseUrl,
+      timings,
+      deploymentId: apiDeploy.deploymentId,
+      transport: {
+        railway: {
+          reconcile: "api",
+          deploy: "api"
+        }
+      },
+      runtimeConfiguration: runtimeConfiguration ? {
+        updated: runtimeConfiguration.updated,
+        healthcheckPath: runtimeConfiguration.instance?.healthcheckPath ?? null,
+        healthcheckTimeoutSeconds: runtimeConfiguration.instance?.healthcheckTimeoutSeconds ?? null,
+        runtimeMode: runtimeConfiguration.instance?.runtimeMode ?? null,
+        volume: runtimeConfiguration.volume ?? null
+      } : null
+    };
+  }
+  throw new Error(`Railway deployment for ${cliDeployService.serviceName ?? cliDeployService.serviceId ?? cliDeployService.key} requires Railway API deployment support. CLI deploy fallback has been removed.`);
 }
 export {
   buildRailwayCommandEnv,
-  buildRailwayDeployCommandEnv,
-  buildRailwayLinkCommandEnv,
   collectRailwayDeploymentStatusChecks,
   configuredRailwayScheduledJobs,
   configuredRailwayServices,
   deployRailwayService,
-  deriveRailwayMarketOperationsRunnerServiceName,
-  deriveRailwayMarketOperationsRunnerVolumeName,
+  deriveRailwayCapacityProviderRunnerServiceName,
+  deriveRailwayCapacityProviderRunnerVolumeName,
+  deriveRailwayOperationsRunnerServiceName,
+  deriveRailwayOperationsRunnerVolumeName,
   deriveRailwayWorkerRunnerServiceName,
   deriveRailwayWorkerRunnerVolumeName,
-  ensureRailwayDatabaseServiceExists,
-  ensureRailwayEnvironmentExists,
-  ensureRailwayProjectContext,
-  ensureRailwayProjectExists,
   ensureRailwayScheduledJobs,
-  ensureRailwayServiceExists,
-  ensureRailwayServiceVolumeWithCliFallback,
-  isRailwayTransientFailure,
+  findStaleTreeseedOperationsRunnerResources,
+  isTreeseedOperationsRunnerResourceName,
   isUsableRailwayToken,
-  listRailwayServiceVolumesWithCli,
   parseRailwayJsonOutput,
-  planRailwayServiceDeploy,
-  planRailwayServiceLink,
   railwayServiceRuntimeStartCommand,
   resolveRailwayAuthToken,
   resolveRailwayDeploymentProfile,
-  runRailway,
-  setRailwaySecretVariable,
   shouldRunRailwayPredeployBuild,
   validateRailwayDeployPrerequisites,
   validateRailwayServiceConfiguration,
   verifyRailwayManagedResources,
   verifyRailwayScheduledJobs,
-  waitForRailwayManagedDeploymentsSettled,
-  writeRailwayCliProjectConfig
+  waitForRailwayManagedDeploymentsSettled
 };