@treeseed/sdk 0.11.0 → 0.12.5

package/dist/hosting/graph.js

@@ -1,29 +1,11 @@
 import { loadTreeseedDeployConfig } from "../platform/deploy-config.js";
 import { loadTreeseedPlugins } from "../platform/plugins/runtime.js";
-import { randomBytes } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
 import { createPersistentDeployTarget } from "../operations/services/deploy.js";
-import { collectTreeseedConfigSeedValues } from "../operations/services/config-runtime.js";
-import {
-  configuredRailwayServices,
-  deployRailwayService
-} from "../operations/services/railway-deploy.js";
-import {
-  deployRailwayServiceInstance,
-  deleteRailwayService,
-  ensureRailwayEnvironment,
-  ensureRailwayGeneratedServiceDomain,
-  ensureRailwayProject,
-  ensureRailwayService,
-  ensureRailwayServiceInstanceConfiguration,
-  ensureRailwayServiceVolume,
-  listRailwayVariables,
-  listRailwayServices,
-  normalizeRailwayEnvironmentName,
-  resolveRailwayWorkspaceContext,
-  updateRailwayServiceName,
-  upsertRailwayVariables
-} from "../operations/services/railway-api.js";
+import { collectTreeseedConfigSeedValues, resolveTreeseedMachineEnvironmentValues } from "../operations/services/config-runtime.js";
+import { classifyTreeseedGitMode, runTreeseedGitText } from "../operations/services/git-runner.js";
 import { createTreeseedCanonicalReconcileReport } from "../reconcile/index.js";
 import { reconcileTreeseedTarget } from "../reconcile/index.js";
 import { discoverTreeseedApplications, findTreeseedApplication } from "./apps.js";
@@ -70,8 +52,41 @@ function publicTreeDxNodePool(config) {
   const maxNodes = Math.max(bootstrapCount, Number.parseInt(String(nodePool.maxNodes ?? 4), 10) || 4);
   return { bootstrapCount, maxNodes };
 }
-function treeDxSecretBase() {
-  return randomBytes(48).toString("base64url");
+function resolvePublicTreeDxRoot(input) {
+  const candidates = [
+    resolve(input.tenantRoot, "packages", "treedx"),
+    resolve(input.tenantRoot, "..", "treedx"),
+    input.configRoot ? resolve(input.configRoot, "packages", "treedx") : null
+  ].filter((candidate) => Boolean(candidate));
+  return candidates.find((candidate) => existsSync(resolve(candidate, "treeseed.package.yaml")) || existsSync(resolve(candidate, ".git"))) ?? candidates[0];
+}
+function publicTreeDxSourcePolicy(input, config) {
+  const railway = config.publicTreeDxFederation?.railway ?? {};
+  const configuredSource = railway.source && typeof railway.source === "object" && !Array.isArray(railway.source) ? railway.source : {};
+  const configuredMode = typeof railway.sourceMode === "string" ? railway.sourceMode : null;
+  const treeDxRoot = resolvePublicTreeDxRoot(input);
+  const repository = typeof railway.sourceRepo === "string" ? railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : readPackageRepository(treeDxRoot) ?? "treeseed-ai/treedx";
+  const sourceMode = configuredMode === "git" || configuredMode === "image" ? configuredMode : input.environment === "staging" ? "git" : "image";
+  if (sourceMode !== "git") {
+    return {
+      sourceMode: "image",
+      sourceRepo: null,
+      sourceBranch: null,
+      sourceCommit: null,
+      sourceRootDirectory: null,
+      image: "treeseed/treedx",
+      imageTagRef: "TREESEED_PUBLIC_TREEDX_IMAGE_REF"
+    };
+  }
+  return {
+    sourceMode: "git",
+    sourceRepo: repository,
+    sourceBranch: typeof railway.sourceBranch === "string" ? railway.sourceBranch : typeof configuredSource.branch === "string" ? configuredSource.branch : "staging",
+    sourceCommit: typeof railway.sourceCommit === "string" ? railway.sourceCommit : typeof configuredSource.commit === "string" ? configuredSource.commit : headCommitSafe(treeDxRoot) ?? headCommitSafe(input.tenantRoot),
+    sourceRootDirectory: typeof railway.sourceRootDirectory === "string" ? railway.sourceRootDirectory : typeof configuredSource.rootDirectory === "string" ? configuredSource.rootDirectory : ".",
+    image: null,
+    imageTagRef: null
+  };
 }
 function serviceKeyPlacement(serviceKey) {
   if (serviceKey === "api") return "api";
@@ -84,11 +99,87 @@ function serviceKeyPlacement(serviceKey) {
 }
 function serviceKeyType(serviceKey, service) {
   if (serviceKey === "treeseedDatabase" || service.railway?.resourceType === "postgres") return "relational-database";
+  if (String(serviceKey).startsWith("capacityProvider")) return "capacity-provider";
   if (serviceKey === "operationsRunner" || /runner/iu.test(serviceKey)) return "runner-pool";
   if (Array.isArray(service.railway?.schedule) || typeof service.railway?.schedule === "string") return "scheduled-job";
   if (serviceKey === "api") return "container-api";
   return service.railway?.volumeMountPath ? "stateful-container" : "container-api";
 }
+function railwayImageRefEnvForService(serviceKey) {
+  if (serviceKey === "api") return "TREESEED_API_IMAGE_REF";
+  if (serviceKey === "operationsRunner") return "TREESEED_OPERATIONS_RUNNER_IMAGE_REF";
+  if (serviceKey === "capacityProviderManager") return "TREESEED_AGENT_MANAGER_IMAGE_REF";
+  if (serviceKey === "capacityProviderRunner") return "TREESEED_AGENT_RUNNER_IMAGE_REF";
+  return null;
+}
+function defaultRailwayImageRefForService(serviceKey, environment) {
+  return null;
+}
+function readPackageRepository(root) {
+  const manifestPath = resolve(root, "treeseed.package.yaml");
+  if (!existsSync(manifestPath)) return null;
+  try {
+    const parsed = parseYaml(readFileSync(manifestPath, "utf8"));
+    const repository = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.repository : null;
+    return typeof repository === "string" && /^[^/\s]+\/[^/\s]+$/u.test(repository.trim()) ? repository.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function headCommitSafe(root) {
+  try {
+    return runTreeseedGitText(["rev-parse", "HEAD"], {
+      cwd: root,
+      mode: classifyTreeseedGitMode(["rev-parse", "HEAD"])
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function resolveRailwayServiceSourceRoot(input, serviceKey, service) {
+  if (String(serviceKey).startsWith("capacityProvider")) {
+    if (service.railway?.rootDir) {
+      return resolve(input.tenantRoot, service.railway.rootDir);
+    }
+    const workspaceRoot = input.configRoot ?? input.tenantRoot;
+    const candidates = [
+      resolve(input.tenantRoot, "..", "agent"),
+      resolve(workspaceRoot, "packages", "agent"),
+      resolve(input.tenantRoot, "..", "..", "packages", "agent")
+    ];
+    const found = candidates.find(
+      (candidate) => existsSync(resolve(candidate, "treeseed.package.yaml")) || existsSync(resolve(candidate, "package.json"))
+    );
+    return found ?? resolve(workspaceRoot, "packages", "agent");
+  }
+  const rootDir = service.railway?.rootDir ?? service.rootDir ?? ".";
+  return resolve(input.tenantRoot, rootDir);
+}
+function railwaySourcePolicy(input, serviceKey, service, imageRef) {
+  const configuredSource = service.railway?.source && typeof service.railway.source === "object" && !Array.isArray(service.railway.source) ? service.railway.source : {};
+  const configuredMode = typeof service.railway?.sourceMode === "string" ? service.railway.sourceMode : null;
+  const repository = typeof service.railway?.sourceRepo === "string" ? service.railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : readPackageRepository(resolveRailwayServiceSourceRoot(input, serviceKey, service)) ?? readPackageRepository(input.tenantRoot);
+  const sourceEligible = ["api", "operationsRunner", "capacityProviderManager", "capacityProviderRunner"].includes(serviceKey);
+  const mode = input.environment === "prod" ? "image" : configuredMode === "git" || configuredMode === "image" ? configuredMode : imageRef ? "image" : input.environment === "staging" && sourceEligible && repository ? "git" : "git";
+  if (mode !== "git") {
+    return {
+      sourceMode: "image",
+      sourceRepo: null,
+      sourceBranch: null,
+      sourceCommit: null,
+      sourceRootDirectory: null,
+      imageRef
+    };
+  }
+  return {
+    sourceMode: "git",
+    sourceRepo: repository,
+    sourceBranch: typeof service.railway?.sourceBranch === "string" ? service.railway.sourceBranch : typeof configuredSource.branch === "string" ? configuredSource.branch : input.environment === "staging" ? "staging" : null,
+    sourceCommit: headCommitSafe(resolveRailwayServiceSourceRoot(input, serviceKey, service)) ?? headCommitSafe(input.tenantRoot),
+    sourceRootDirectory: typeof service.railway?.sourceRootDirectory === "string" ? service.railway.sourceRootDirectory : typeof configuredSource.rootDirectory === "string" ? configuredSource.rootDirectory : ".",
+    imageRef: null
+  };
+}
 function collectPluginHostingContributions(input) {
   const plugins = loadTreeseedPlugins(input.deployConfig);
   const context = {
@@ -117,7 +208,8 @@ function collectPluginHostingContributions(input) {
   };
 }
 function marketProjectGroup(environment, config) {
-  const railwayProjectName = Object.values(config.services ?? {}).map((service) => service && typeof service === "object" ? service.railway?.projectName : null).find((value) => typeof value === "string" && value.trim());
+  const apiService = config.services?.api && typeof config.services.api === "object" ? config.services.api : null;
+  const railwayProjectName = typeof apiService?.railway?.projectName === "string" && apiService.railway.projectName.trim() ? apiService.railway.projectName.trim() : void 0;
   const projectName = railwayProjectName ?? config.slug ?? "treeseed-api";
   return {
     id: "treeseed-control-plane",
@@ -131,6 +223,38 @@ function marketProjectGroup(environment, config) {
     metadata: { stableProjectName: projectName }
   };
 }
+function railwayProjectGroupIdForProjectName(prefix, projectName) {
+  const slug = projectName.toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "") || "railway-project";
+  return `${prefix}:${slug}`;
+}
+function capacityProviderProjectGroupId(projectName) {
+  return railwayProjectGroupIdForProjectName("capacity-provider", projectName);
+}
+function capacityProviderProjectGroups(environment, config) {
+  const projectNames = /* @__PURE__ */ new Set();
+  for (const [serviceKey, service] of Object.entries(config.services ?? {})) {
+    if (!String(serviceKey).startsWith("capacityProvider")) continue;
+    if (!service || typeof service !== "object") continue;
+    const projectName = service.railway?.projectName;
+    if (typeof projectName === "string" && projectName.trim()) {
+      projectNames.add(projectName.trim());
+    }
+  }
+  return [...projectNames].map((projectName) => ({
+    id: capacityProviderProjectGroupId(projectName),
+    label: "Capacity provider",
+    hostId: environment === "local" ? "local-docker" : "railway",
+    environments: {
+      local: { projectName: `${projectName}-local`, environmentName: "local" },
+      staging: { projectName, environmentName: "staging" },
+      prod: { projectName, environmentName: "production" }
+    },
+    metadata: {
+      stableProjectName: projectName,
+      isolation: "capacity-provider"
+    }
+  }));
+}
 function publicTreeDxProjectGroup(environment, config) {
   const apiProjectName = marketProjectGroup(environment, config).environments.staging?.projectName ?? config.slug ?? "treeseed-api";
   return {
@@ -167,9 +291,17 @@ function buildProfileFromDeployConfig(input) {
   const services = [];
   const projectGroups = [
     marketProjectGroup(environment, config),
+    ...capacityProviderProjectGroups(environment, config),
     publicTreeDxProjectGroup(environment, config),
     privateTreeDxProjectGroup()
   ];
+  const railwayImageRefEnvKeys = [...new Set(Object.keys(config.services ?? {}).map((serviceKey) => railwayImageRefEnvForService(serviceKey)).filter((value) => Boolean(value)))];
+  let railwayImageRefEnv = {};
+  try {
+    railwayImageRefEnv = resolveTreeseedMachineEnvironmentValues(input.configRoot ?? input.tenantRoot, environment, railwayImageRefEnvKeys);
+  } catch {
+    railwayImageRefEnv = {};
+  }
   if (config.surfaces?.web && config.surfaces.web.enabled !== false) {
     services.push({
       id: "web",
@@ -199,7 +331,11 @@ function buildProfileFromDeployConfig(input) {
     if (!service || service.enabled === false) continue;
     const serviceType = serviceKeyType(serviceKey, service);
     const placement = serviceKeyPlacement(serviceKey);
-    const defaultProjectGroup = service.provider === "railway" || service.railway ? "treeseed-control-plane" : void 0;
+    const configuredRailwayProjectName = typeof service.railway?.projectName === "string" && service.railway.projectName.trim() ? service.railway.projectName.trim() : null;
+    const defaultProjectGroup = service.provider === "railway" || service.railway ? String(serviceKey).startsWith("capacityProvider") && configuredRailwayProjectName ? capacityProviderProjectGroupId(configuredRailwayProjectName) : "treeseed-control-plane" : void 0;
+    const imageRefEnv = railwayImageRefEnvForService(serviceKey);
+    const imageRef = service.railway?.imageRef ?? (imageRefEnv ? railwayImageRefEnv[imageRefEnv] ?? process.env[imageRefEnv] : null) ?? defaultRailwayImageRefForService(serviceKey, input.environment) ?? null;
+    const sourcePolicy = railwaySourcePolicy(input, serviceKey, service, imageRef);
     services.push({
       id: serviceKey,
       label: placement === "runner-capacity" ? "Runner Capacity" : serviceKey === "api" ? "API Runtime" : serviceKey,
@@ -208,8 +344,16 @@ function buildProfileFromDeployConfig(input) {
       projectGroupId: defaultProjectGroup,
       config: {
         rootDir: service.railway?.rootDir ?? service.rootDir ?? ".",
-        buildCommand: service.railway?.buildCommand ?? null,
-        startCommand: service.railway?.startCommand ?? null,
+        imageRef: sourcePolicy.imageRef,
+        imageRefEnv: sourcePolicy.sourceMode === "image" ? imageRefEnv : null,
+        sourceMode: sourcePolicy.sourceMode,
+        sourceRepo: sourcePolicy.sourceRepo,
+        sourceBranch: sourcePolicy.sourceBranch,
+        sourceCommit: sourcePolicy.sourceCommit,
+        sourceRootDirectory: sourcePolicy.sourceRootDirectory,
+        dockerfilePath: sourcePolicy.sourceMode === "git" ? service.railway?.dockerfilePath ?? null : null,
+        buildCommand: sourcePolicy.imageRef ? null : service.railway?.buildCommand ?? null,
+        startCommand: sourcePolicy.imageRef ? null : service.railway?.startCommand ?? null,
         healthcheckPath: service.railway?.healthcheckPath ?? null,
         runtimeMode: service.railway?.runtimeMode ?? null,
         volumeMountPath: service.railway?.volumeMountPath ?? null,
@@ -220,6 +364,7 @@ function buildProfileFromDeployConfig(input) {
       },
       secretRefs: serviceKey === "treeseedDatabase" ? ["TREESEED_DATABASE_URL"] : [],
       variableRefs: serviceKey === "operationsRunner" ? ["TREESEED_PLATFORM_RUNNER_ID", "TREESEED_PLATFORM_RUNNER_DATA_DIR", "TREESEED_PLATFORM_RUNNER_ENVIRONMENT"] : [],
+      metadata: String(serviceKey).startsWith("capacityProvider") ? { capacityProvider: true, deployByDefault: false } : {},
       environments: {
         local: {
           hostId: serviceType === "relational-database" || serviceType === "runner-pool" || service.railway?.volumeMountPath ? "local-docker" : "local-process",
@@ -273,6 +418,7 @@ function buildProfileFromDeployConfig(input) {
   }
   if (config.hosting?.kind === "treeseed_control_plane") {
     const treeDxNodePool = publicTreeDxNodePool(config);
+    const treeDxSourcePolicy = publicTreeDxSourcePolicy(input, config);
     const treeDxNodeUnits = Array.from({ length: treeDxNodePool.bootstrapCount }, (_, offset) => {
       const nodeIndex = offset + 1;
       const serviceName = indexedName("public-treedx-node", nodeIndex);
@@ -283,14 +429,18 @@ function buildProfileFromDeployConfig(input) {
         placement: "knowledge-library",
         projectGroupId: "public-treedx-federation",
         config: {
-          image: "treeseed/treedx",
-          imageTagRef: "TREESEED_PUBLIC_TREEDX_IMAGE_REF",
+          ...treeDxSourcePolicy.image ? { image: treeDxSourcePolicy.image } : {},
+          ...treeDxSourcePolicy.imageTagRef ? { imageTagRef: treeDxSourcePolicy.imageTagRef } : {},
+          sourceMode: treeDxSourcePolicy.sourceMode,
+          ...treeDxSourcePolicy.sourceRepo ? { sourceRepo: treeDxSourcePolicy.sourceRepo } : {},
+          ...treeDxSourcePolicy.sourceBranch ? { sourceBranch: treeDxSourcePolicy.sourceBranch } : {},
+          ...treeDxSourcePolicy.sourceCommit ? { sourceCommit: treeDxSourcePolicy.sourceCommit } : {},
+          ...treeDxSourcePolicy.sourceRootDirectory ? { sourceRootDirectory: treeDxSourcePolicy.sourceRootDirectory } : {},
           serviceName,
           volumeName: `${serviceName}-volume`,
           volumeMountPath: "/data",
           runtimeMode: "replicated",
           environmentVariables: {
-            PHX_SERVER: "true",
             PORT: "4000",
             TREEDX_DATA_DIR: "/data",
             TREEDX_AUTH_MODE: "connected",
@@ -300,13 +450,15 @@ function buildProfileFromDeployConfig(input) {
             TREEDX_FEDERATION_MODE: "connected_library",
             TREEDX_JWT_AUDIENCE: "treedx-public-federation",
             TREEDX_JWT_ISSUER: "https://api.treeseed.local/treedx",
-            TREESEED_TREEDX_SCOPE: "public_federation"
+            TREEDX_BOOTSTRAP_TRUST_ACTOR_ID: "treeseed-api",
+            TREEDX_BOOTSTRAP_TRUST_TENANT_ID: "treeseed-control-plane",
+            TREEDX_BOOTSTRAP_TRUST_REPO_IDS: "*",
+            TREEDX_BOOTSTRAP_TRUST_REFS: "*",
+            TREEDX_BOOTSTRAP_TRUST_PATHS: "**",
+            TREEDX_SCOPE: "public_federation"
           }
         },
         variableRefs: [
-          "TREESEED_PUBLIC_TREEDX_IMAGE_REF",
-          "PHX_HOST",
-          "PHX_SERVER",
           "PORT",
           "TREEDX_DATA_DIR",
           "TREEDX_AUTH_MODE",
@@ -316,9 +468,14 @@ function buildProfileFromDeployConfig(input) {
           "TREEDX_FEDERATION_MODE",
           "TREEDX_JWT_AUDIENCE",
           "TREEDX_JWT_ISSUER",
-          "TREESEED_TREEDX_SCOPE"
+          "TREEDX_BOOTSTRAP_TRUST_ACTOR_ID",
+          "TREEDX_BOOTSTRAP_TRUST_TENANT_ID",
+          "TREEDX_BOOTSTRAP_TRUST_REPO_IDS",
+          "TREEDX_BOOTSTRAP_TRUST_REFS",
+          "TREEDX_BOOTSTRAP_TRUST_PATHS",
+          "TREEDX_SCOPE"
         ],
-        secretRefs: ["SECRET_KEY_BASE", "TREESEED_TREEDX_ADMIN_TOKEN", "TREEDX_JWT_HS256_SECRET"],
+        secretRefs: ["TREEDX_SECRET_KEY_BASE", "TREEDX_ADMIN_TOKEN", "TREEDX_JWT_HS256_SECRET"],
         environments: {
           local: { hostId: "local-docker", projectGroupId: "public-treedx-federation" },
           staging: { hostId: "railway", projectGroupId: "public-treedx-federation" },
@@ -451,12 +608,14 @@ function filterHostingUnits(units, filter) {
   const serviceIds = normalizeFilterValues(filter?.serviceIds);
   const placements = normalizeFilterValues(filter?.placements);
   const hosts = normalizeFilterValues(filter?.hosts);
-  if (serviceIds.size === 0 && placements.size === 0 && hosts.size === 0) return units;
   const allServiceIds = new Set(units.map((unit) => unit.id));
   const missingServices = [...serviceIds].filter((serviceId) => !allServiceIds.has(serviceId));
   if (missingServices.length > 0) {
     throw new Error(`Unknown hosting service id${missingServices.length === 1 ? "" : "s"}: ${missingServices.join(", ")}.`);
   }
+  if (serviceIds.size === 0 && placements.size === 0 && hosts.size === 0) {
+    return units.filter((unit) => unit.metadata.deployByDefault !== false);
+  }
   return units.filter((unit) => (serviceIds.size === 0 || serviceIds.has(unit.id)) && (placements.size === 0 || placements.has(unit.placement)) && (hosts.size === 0 || hosts.has(unit.host.id)));
 }
 function compileSingleTreeseedHostingGraph(input, application) {
@@ -503,6 +662,7 @@ function mergeTreeseedHostingGraphs(input, applications) {
   const graphs = applications.map((application) => compileSingleTreeseedHostingGraph({
     ...input,
     tenantRoot: application.root,
+    configRoot: resolve(input.tenantRoot),
     deployConfig: application.config,
     filter: void 0
   }, application));
@@ -539,6 +699,7 @@ function compileTreeseedHostingGraph(input) {
     return compileSingleTreeseedHostingGraph({
       ...input,
       tenantRoot: application.root,
+      configRoot: tenantRoot,
       deployConfig: application.config
     }, application);
   }
@@ -569,10 +730,14 @@ function railwayReconcileSystemsForUnits(units) {
   const systems = /* @__PURE__ */ new Set();
   for (const unit of units) {
     if (unit.host.id !== "railway") continue;
-    if (unit.placement === "api" || unit.id === "api" || unit.serviceType.id === "container-api") {
+    if (unit.id === "operationsRunner") {
+      systems.add("api");
+      continue;
+    }
+    if (unit.placement === "api" || unit.placement === "knowledge-library" || unit.id === "api" || unit.serviceType.id === "container-api" || unit.serviceType.id === "treedx-node") {
       systems.add("api");
     }
-    if (unit.placement === "runner-capacity" || unit.id === "operationsRunner" || unit.serviceType.id === "runner-pool") {
+    if (unit.placement === "runner-capacity" || unit.serviceType.id === "runner-pool") {
       systems.add("agents");
     }
     if (unit.placement === "database" && units.some((candidate) => candidate.id === "api" || candidate.placement === "api")) {
@@ -581,18 +746,8 @@ function railwayReconcileSystemsForUnits(units) {
   }
   return [...systems];
 }
-function railwayDeployServiceKeysForUnits(units) {
-  const keys = /* @__PURE__ */ new Set();
-  for (const unit of units) {
-    if (unit.host.id !== "railway") continue;
-    if (unit.id === "api" || unit.placement === "api" || unit.serviceType.id === "container-api") {
-      keys.add("api");
-    }
-    if (unit.id === "operationsRunner" || unit.placement === "runner-capacity" || unit.serviceType.id === "runner-pool") {
-      keys.add("operationsRunner");
-    }
-  }
-  return keys;
+function isInfrastructureHostedUnit(unit) {
+  return ["railway", "cloudflare", "cloudflare-dns", "local-docker"].includes(unit.host.id);
 }
 function railwayEnvForHostingApply(input, graph) {
   const seedValues = collectTreeseedConfigSeedValues(input.tenantRoot, graph.environment);
@@ -601,254 +756,85 @@ function railwayEnvForHostingApply(input, graph) {
     ...seedValues
   };
 }
-async function deploySelectedRailwayServices(input, graph) {
-  const selectedKeys = railwayDeployServiceKeysForUnits(graph.units);
-  if (selectedKeys.size === 0 || graph.environment === "local") {
-    return [];
-  }
-  const env = railwayEnvForHostingApply(input, graph);
-  const services = configuredRailwayServices(graph.tenantRoot, graph.environment).filter((service) => selectedKeys.has(service.key));
-  const results = [];
-  for (const service of services) {
-    results.push(await deployRailwayService(graph.tenantRoot, service, {
-      env,
-      prefix: {
-        scope: graph.environment,
-        system: service.key === "api" ? "api" : "agents",
-        task: `${service.key}-railway-deploy`,
-        stage: "deploy"
-      }
-    }));
-  }
-  return results;
-}
-function valueFromUnitConfig(unit, key) {
-  const config = unit.config && typeof unit.config === "object" ? unit.config : {};
-  const value = config[key];
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-function traceHostingRailway(env, stage, message) {
-  if (env.TREESEED_RECONCILE_TRACE === "1" || process.env.TREESEED_RECONCILE_TRACE === "1") {
-    console.error(`[trsd][hosting][railway][${stage}] ${message}`);
-  }
-}
-async function treeDxStage(env, stage, task) {
-  traceHostingRailway(env, `treedx:${stage}:start`, stage);
-  try {
-    const result = await task();
-    traceHostingRailway(env, `treedx:${stage}:done`, stage);
-    return result;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error ?? "");
-    throw new Error(`Public TreeDX Railway reconcile failed during ${stage}: ${message}`);
-  }
-}
-async function reconcilePublicTreeDxUnits(input, graph) {
-  if (graph.environment === "local") {
-    return [];
-  }
-  const nodeUnits = graph.units.filter((unit) => unit.id.startsWith("public-treedx-node-") && unit.host.id === "railway");
-  if (nodeUnits.length === 0) {
-    return [];
-  }
-  const env = railwayEnvForHostingApply(input, graph);
-  const workspace = await resolveRailwayWorkspaceContext({ env });
-  const results = [];
-  for (const unit of nodeUnits) {
-    const projectName2 = unit.projectGroup?.environments?.[graph.environment]?.projectName || String(env.TREESEED_PUBLIC_TREEDX_RAILWAY_PROJECT_NAME ?? "").trim() || "treeseed-api";
-    const environmentName2 = normalizeRailwayEnvironmentName(unit.projectGroup?.environments?.[graph.environment]?.environmentName) || ENVIRONMENT_NAMES[graph.environment];
-    const configuredImage = valueFromUnitConfig(unit, "image") ?? "treeseed/treedx";
-    const imageRef = String(env.TREESEED_PUBLIC_TREEDX_IMAGE_REF ?? "").trim() || (configuredImage.includes(":") ? configuredImage : `${configuredImage}:latest`);
-    const serviceName = valueFromUnitConfig(unit, "serviceName") ?? unit.id;
-    const volumeName = valueFromUnitConfig(unit, "volumeName") ?? `${serviceName}-volume`;
-    const mountPath = valueFromUnitConfig(unit, "volumeMountPath") ?? "/data";
-    const deploymentRegion = String(env.TREESEED_PUBLIC_TREEDX_RAILWAY_REGION ?? env.TREESEED_RAILWAY_STATEFUL_REGION ?? "us-west2").trim();
-    const ensuredProject2 = await treeDxStage(env, "project", () => ensureRailwayProject({
-      projectName: projectName2,
-      defaultEnvironmentName: environmentName2,
-      workspace: workspace.name,
-      env
-    }));
-    const ensuredEnvironment = await treeDxStage(env, "environment", () => ensureRailwayEnvironment({
-      projectId: ensuredProject2.project.id,
-      environmentName: environmentName2,
-      env
-    }));
-    const ensuredService = await treeDxStage(env, "service", async () => {
-      const services2 = await listRailwayServices({ projectId: ensuredProject2.project.id, env });
-      const existing = services2.find((service) => service.name === serviceName) ?? null;
-      const legacy = unit.metadata.nodeIndex === 1 ? services2.find((service) => service.name === "public-treedx-node") ?? null : null;
-      if (!existing && legacy) {
-        const renamed = await updateRailwayServiceName({ serviceId: legacy.id, name: serviceName, env });
-        return { service: renamed, created: false, adopted: true };
-      }
-      return ensureRailwayService({
-        projectId: ensuredProject2.project.id,
-        environmentId: ensuredEnvironment.environment.id,
-        serviceName,
-        imageRef,
-        env
-      });
-    });
-    const instance = await treeDxStage(env, "instance", () => ensureRailwayServiceInstanceConfiguration({
-      serviceId: ensuredService.service.id,
-      environmentId: ensuredEnvironment.environment.id,
-      healthcheckPath: "/api/v1/health",
-      healthcheckTimeoutSeconds: 120,
-      runtimeMode: "replicated",
-      deploymentRegion,
-      env
-    }));
-    const currentVariables = await treeDxStage(env, "variables:observe", () => listRailwayVariables({
-      projectId: ensuredProject2.project.id,
-      environmentId: ensuredEnvironment.environment.id,
-      serviceId: ensuredService.service.id,
-      env
-    }).catch(() => ({})));
-    await treeDxStage(env, "variables", () => upsertRailwayVariables({
-      projectId: ensuredProject2.project.id,
-      environmentId: ensuredEnvironment.environment.id,
-      serviceId: ensuredService.service.id,
-      variables: {
-        TREESEED_PUBLIC_TREEDX_IMAGE_REF: imageRef,
-        PHX_HOST: `${serviceName}.railway.app`,
-        PHX_SERVER: "true",
-        PORT: "4000",
-        TREEDX_DATA_DIR: mountPath,
-        TREEDX_AUTH_MODE: "connected",
-        TREEDX_AUTH_VERIFIER: "hs256_dev",
-        TREEDX_ALLOW_DEV_VERIFIER_IN_PROD: "true",
-        TREEDX_EXEC_BACKEND: "container_sandbox",
-        TREEDX_FEDERATION_MODE: "connected_library",
-        TREEDX_JWT_AUDIENCE: "treedx-public-federation",
-        TREEDX_JWT_ISSUER: `https://${serviceName}.railway.app/treedx`,
-        TREESEED_TREEDX_SCOPE: "public_federation",
-        ...typeof currentVariables.SECRET_KEY_BASE === "string" && currentVariables.SECRET_KEY_BASE.trim() ? {} : { SECRET_KEY_BASE: treeDxSecretBase() },
-        ...typeof currentVariables.TREEDX_JWT_HS256_SECRET === "string" && currentVariables.TREEDX_JWT_HS256_SECRET.trim() ? {} : { TREEDX_JWT_HS256_SECRET: treeDxSecretBase() },
-        ...typeof env.TREESEED_TREEDX_ADMIN_TOKEN === "string" && env.TREESEED_TREEDX_ADMIN_TOKEN.trim() ? { TREESEED_TREEDX_ADMIN_TOKEN: env.TREESEED_TREEDX_ADMIN_TOKEN } : {}
-      },
-      env
-    }));
-    const volume = await treeDxStage(env, "volume", () => ensureRailwayServiceVolume({
-      projectId: ensuredProject2.project.id,
-      environmentId: ensuredEnvironment.environment.id,
-      serviceId: ensuredService.service.id,
-      name: volumeName,
-      mountPath,
-      env
-    }));
-    const domain = await treeDxStage(env, "domain", () => ensureRailwayGeneratedServiceDomain({
-      projectId: ensuredProject2.project.id,
-      environmentId: ensuredEnvironment.environment.id,
-      serviceId: ensuredService.service.id,
-      env
-    }));
-    await treeDxStage(env, "variables:domain", () => upsertRailwayVariables({
-      projectId: ensuredProject2.project.id,
-      environmentId: ensuredEnvironment.environment.id,
-      serviceId: ensuredService.service.id,
-      variables: {
-        PHX_HOST: domain.domain.domain,
-        TREEDX_JWT_ISSUER: `https://${domain.domain.domain}/treedx`
-      },
-      env
-    }));
-    const deployment = await treeDxStage(env, "deploy", () => deployRailwayServiceInstance({
-      serviceId: ensuredService.service.id,
-      environmentId: ensuredEnvironment.environment.id,
-      env
-    }));
-    results.push({
-      status: "ready",
-      locators: {
-        hostId: "railway",
-        projectGroupId: unit.projectGroup?.id ?? null,
-        projectName: projectName2,
-        serviceName,
-        domain: domain.domain.domain
-      },
-      state: {
-        unitId: unit.id,
-        serviceType: unit.serviceType.id,
-        placement: unit.placement,
-        projectId: ensuredProject2.project.id,
-        environmentId: ensuredEnvironment.environment.id,
-        serviceId: ensuredService.service.id,
-        imageRef,
-        volumeMountPath: volume.instance?.mountPath ?? mountPath,
-        healthcheckPath: instance.instance.healthcheckPath,
-        deploymentId: deployment.deploymentId
-      },
-      warnings: []
-    });
-  }
-  const firstUnit = nodeUnits[0];
-  const desiredIndexes = new Set(nodeUnits.map((unit) => Number(unit.metadata.nodeIndex ?? 1)).filter((index) => Number.isFinite(index) && index > 0));
-  const projectName = firstUnit.projectGroup?.environments?.[graph.environment]?.projectName || String(env.TREESEED_PUBLIC_TREEDX_RAILWAY_PROJECT_NAME ?? "").trim() || "treeseed-api";
-  const environmentName = normalizeRailwayEnvironmentName(firstUnit.projectGroup?.environments?.[graph.environment]?.environmentName) || ENVIRONMENT_NAMES[graph.environment];
-  const ensuredProject = await treeDxStage(env, "scale-down-project", () => ensureRailwayProject({
-    projectName,
-    defaultEnvironmentName: environmentName,
-    workspace: workspace.name,
-    env
-  }));
-  await treeDxStage(env, "scale-down-environment", () => ensureRailwayEnvironment({
-    projectId: ensuredProject.project.id,
-    environmentName,
-    env
-  }));
-  const services = await treeDxStage(env, "scale-down-services", () => listRailwayServices({ projectId: ensuredProject.project.id, env }));
-  for (const service of services) {
-    const match = /^public-treedx-node-(\d{2,})$/u.exec(service.name);
-    const index = match ? Number.parseInt(match[1], 10) : null;
-    const staleSingleton = service.name === "public-treedx-node" && desiredIndexes.has(1);
-    if (index !== null && !desiredIndexes.has(index) || staleSingleton) {
-      await treeDxStage(env, `scale-down-service:${service.name}`, () => deleteRailwayService({ serviceId: service.id, env }));
-      results.push({
-        status: "ready",
-        locators: {
-          hostId: "railway",
-          projectGroupId: firstUnit.projectGroup?.id ?? null,
-          projectName,
-          serviceName: service.name
-        },
-        state: {
-          unitId: service.name,
-          action: "delete",
-          retainedResources: [{
-            kind: "volume",
-            name: `${service.name}-volume`,
-            reason: "Stateful TreeDX volumes are retained across scale-down for later reclaim."
-          }]
-        },
-        warnings: [`Destroyed scaled-down TreeDX service ${service.name}; retained ${service.name}-volume.`]
-      });
-    }
-  }
-  return results;
-}
 async function applyTreeseedHostingGraph(input) {
   const plan = await planTreeseedHostingGraph(input);
   const graph = compileTreeseedHostingGraph(input);
   const selectedSystems = railwayReconcileSystemsForUnits(graph.units);
-  const usesDefaultRailwayAdapter = !input.hostAdapters?.railway && !(Array.isArray(input.profiles) && input.profiles.length > 0);
-  if (!plan.dryRun && selectedSystems.length > 0 && usesDefaultRailwayAdapter) {
-    await reconcileTreeseedTarget({
-      tenantRoot: graph.tenantRoot,
-      target: createPersistentDeployTarget(graph.environment),
-      systems: selectedSystems,
-      env: railwayEnvForHostingApply(input, graph)
-    });
-    await reconcilePublicTreeDxUnits(input, graph);
-    await deploySelectedRailwayServices(input, graph);
+  const infrastructureUnits = graph.units.filter(isInfrastructureHostedUnit);
+  if (plan.dryRun) {
+    return {
+      environment: plan.environment,
+      dryRun: true,
+      selectedApps: [...new Set(graph.units.map((unit) => unit.application?.id).filter((value) => Boolean(value)))],
+      selectedSystems,
+      skippedSystems: ["web", "data", "github"].filter((system) => !selectedSystems.includes(system)).map((system) => ({ system, reason: selectedSystems.length > 0 ? "Not selected by hosting app filter." : "No Railway reconciliation selected." })),
+      results: plan.units.map((entry) => ({
+        unit: entry.unit,
+        plan: entry.plan,
+        result: entry.observed,
+        verification: entry.verification
+      })),
+      placements: plan.placements,
+      warnings: plan.warnings
+    };
   }
-  const results = [];
-  for (const entry of plan.units) {
-    const unit = graph.units.find((candidate) => candidate.id === entry.unit.id) ?? entry.unit;
-    const result = await unit.host.apply({ environment: graph.environment, unit, graph, plan: entry.plan, dryRun: plan.dryRun });
-    const verification = await unit.host.verify({ environment: graph.environment, unit, graph, observed: result, dryRun: plan.dryRun });
-    results.push({ unit, plan: entry.plan, result, verification });
+  if (infrastructureUnits.length > 0 && selectedSystems.length === 0) {
+    throw new Error(`Hosting apply selected infrastructure resources but no provider reconciliation system was selected: ${infrastructureUnits.map((unit) => `${unit.id} (${unit.host.id})`).join(", ")}.`);
   }
+  const reconcile = await reconcileTreeseedTarget({
+    tenantRoot: graph.tenantRoot,
+    target: createPersistentDeployTarget(graph.environment),
+    systems: selectedSystems.length > 0 ? selectedSystems : void 0,
+    env: railwayEnvForHostingApply(input, graph),
+    dryRun: plan.dryRun
+  });
+  const resultByUnit = /* @__PURE__ */ new Map();
+  for (const entry of reconcile.results) {
+    resultByUnit.set(entry.unit.unitId, entry);
+    resultByUnit.set(entry.unit.logicalName, entry);
+  }
+  const results = plan.units.map((entry) => {
+    const unit = graph.units.find((candidate) => candidate.id === entry.unit.id) ?? entry.unit;
+    const reconcileResult = resultByUnit.get(entry.unit.id) ?? resultByUnit.get(unit.id) ?? resultByUnit.get(unit.logicalName) ?? null;
+    return {
+      unit,
+      plan: entry.plan,
+      result: {
+        status: reconcileResult?.verification?.ready || plan.dryRun ? "ready" : "blocked",
+        locators: reconcileResult?.resourceLocators ?? {},
+        state: reconcileResult?.state ?? {
+          unitId: unit.id,
+          action: plan.dryRun ? "plan" : "unmatched"
+        },
+        warnings: reconcileResult?.warnings ?? []
+      },
+      verification: reconcileResult?.verification ? {
+        unitId: unit.id,
+        status: reconcileResult.verification.verified ? "ready" : "blocked",
+        verified: reconcileResult.verification.verified,
+        checks: reconcileResult.verification.checks.map((check) => ({
+          key: check.key,
+          label: check.description,
+          ok: check.verified,
+          expected: check.expected,
+          observed: check.observed,
+          issues: check.issues
+        })),
+        warnings: reconcileResult.verification.warnings
+      } : {
+        unitId: unit.id,
+        status: plan.dryRun ? "ready" : "blocked",
+        verified: plan.dryRun,
+        checks: plan.dryRun ? [] : [{
+          key: "reconcile-result",
+          label: "Hosting unit matched a reconcile result",
+          ok: false,
+          issues: [`No reconcile result matched hosting unit ${unit.id}.`]
+        }],
+        warnings: []
+      }
+    };
+  });
   return {
     environment: plan.environment,
     dryRun: plan.dryRun,