@treeseed/sdk 0.11.0 → 0.12.5

package/dist/operations/services/deploy.js

@@ -7,7 +7,6 @@ import { resolveTreeseedWebCachePolicy } from "../../platform/deploy-config.js";
 import {
   deleteRailwayCustomDomain,
   deleteRailwayEnvironment,
-  deleteRailwayProject,
   deleteRailwayVolume,
   getRailwayServiceInstance,
   listRailwayCustomDomains,
@@ -23,7 +22,7 @@ import { loadCliDeployConfig, resolveWranglerBin } from "./runtime-tools.js";
 import { sdkD1MigrationsRoot } from "./runtime-paths.js";
 const DEFAULT_COMPATIBILITY_DATE = "2026-04-05";
 const DEFAULT_COMPATIBILITY_FLAGS = ["nodejs_compat"];
-const DEFAULT_TREESEED_MARKET_BASE_URL = "https://api.treeseed.ai";
+const DEFAULT_TREESEED_MARKET_BASE_URL = "https://api.treeseed.dev";
 const GENERATED_ROOT = ".treeseed/generated";
 const STATE_ROOT = ".treeseed/state";
 const WORKTREE_METADATA_RELATIVE_PATH = ".treeseed/worktree.json";
@@ -146,6 +145,24 @@ function deriveApiDomainFromWebDomain(domain) {
   }
   return domain.startsWith("api.") ? domain : `api.${domain}`;
 }
+function configuredApiConnectionDomain(deployConfig, scope) {
+  const apiConnection = deployConfig.connections?.api?.environments?.[scope];
+  const domain = apiConnection?.domain?.trim();
+  if (domain) {
+    return domain;
+  }
+  const connectionBaseUrl = primaryHost(apiConnection?.baseUrl);
+  if (connectionBaseUrl) {
+    return connectionBaseUrl;
+  }
+  const serviceDomain = deployConfig.services?.api?.environments?.[scope]?.domain?.trim();
+  if (serviceDomain) {
+    return serviceDomain;
+  }
+  return primaryHost(
+    deployConfig.services?.api?.environments?.[scope]?.baseUrl ?? deployConfig.services?.api?.publicBaseUrl
+  );
+}
 function resolveConfiguredSurfaceDomain(deployConfig, target, surface) {
   if (target.kind !== "persistent") {
     return null;
@@ -155,6 +172,12 @@ function resolveConfiguredSurfaceDomain(deployConfig, target, surface) {
   if (configured) {
     return configured;
   }
+  if (surface === "api") {
+    const apiConnectionDomain = configuredApiConnectionDomain(deployConfig, scope);
+    if (apiConnectionDomain) {
+      return apiConnectionDomain;
+    }
+  }
   if (scope === "staging") {
     return deriveTreeseedStagingSurfaceDomain(
       deployConfig,
@@ -171,6 +194,14 @@ function resolveConfiguredSurfaceDomain(deployConfig, target, surface) {
   return deriveApiDomainFromWebDomain(resolveConfiguredSurfaceDomain(deployConfig, target, "web"));
 }
 function resolveConfiguredSurfaceBaseUrl(deployConfig, target, surface) {
+  if (surface === "api") {
+    const scope = scopeFromTarget(target);
+    const apiConnection = deployConfig.connections?.api?.environments?.[scope];
+    const connectionBaseUrl = apiConnection?.baseUrl ?? (apiConnection?.domain ? `https://${apiConnection.domain}` : null);
+    if (connectionBaseUrl) {
+      return connectionBaseUrl;
+    }
+  }
   const configuredDomain = resolveConfiguredSurfaceDomain(deployConfig, target, surface);
   if (configuredDomain) {
     return `https://${configuredDomain}`;
@@ -301,6 +332,7 @@ function resolveContentServingMode(deployConfig, options = {}) {
   return deployConfig.providers?.content?.serving ?? "local_collections";
 }
 function buildPublicVars(deployConfig, options = {}) {
+  const target = options.target ? normalizeTarget(options.target) : createPersistentDeployTarget("prod");
   const identity = resolveTreeseedResourceIdentity(deployConfig, createPersistentDeployTarget("prod"));
   const contentRuntimeProvider = deployConfig.providers?.content?.runtime ?? "team_scoped_r2_overlay";
   const contentPublishProvider = deployConfig.providers?.content?.publish ?? contentRuntimeProvider;
@@ -312,20 +344,23 @@ function buildPublicVars(deployConfig, options = {}) {
   const managedRuntime = deployConfig.runtime?.mode === "treeseed_managed";
   const workerRailway = deployConfig.services?.worker?.railway ?? {};
   const webCachePolicy = resolveTreeseedWebCachePolicy(deployConfig);
+  const projectDomain = target.kind === "persistent" ? resolveConfiguredSurfaceDomain(deployConfig, target, "web") : primaryHost(deployConfig.surfaces?.web?.publicBaseUrl ?? deployConfig.siteUrl);
   return {
     TREESEED_HOSTING_KIND: deployConfig.hosting?.kind ?? "self_hosted_project",
     TREESEED_HOSTING_REGISTRATION: deployConfig.hosting?.registration ?? "none",
     TREESEED_HUB_MODE: deployConfig.hub?.mode ?? "treeseed_hosted",
     TREESEED_RUNTIME_MODE: deployConfig.runtime?.mode ?? "none",
     TREESEED_RUNTIME_REGISTRATION: deployConfig.runtime?.registration ?? "none",
-    TREESEED_CENTRAL_MARKET_API_BASE_URL: envOrNull("TREESEED_CENTRAL_MARKET_API_BASE_URL") ?? DEFAULT_TREESEED_MARKET_BASE_URL,
-    TREESEED_API_BASE_URL: resolveConfiguredMarketBaseUrl(deployConfig),
-    TREESEED_CATALOG_MARKET_API_BASE_URLS: envOrNull("TREESEED_CATALOG_MARKET_API_BASE_URLS") ?? resolveConfiguredMarketBaseUrl(deployConfig),
+    TREESEED_CENTRAL_MARKET_API_BASE_URL: resolveConfiguredCentralMarketBaseUrl(deployConfig, target),
+    TREESEED_MARKET_API_BASE_URL: resolveConfiguredMarketBaseUrl(deployConfig, target),
+    TREESEED_API_BASE_URL: resolveConfiguredMarketBaseUrl(deployConfig, target),
+    TREESEED_CATALOG_MARKET_API_BASE_URLS: resolveConfiguredMarketBaseUrl(deployConfig, target) ?? envOrNull("TREESEED_CATALOG_MARKET_API_BASE_URLS"),
     TREESEED_HOSTING_TEAM_ID: contentDefaultTeamId,
+    TREESEED_PROJECT_DOMAINS: projectDomain ?? "",
     TREESEED_PROJECT_ID: identity.projectId,
-    TREESEED_AGENT_EXECUTION_PROVIDER: deployConfig.providers?.agents?.execution ?? "stub",
-    TREESEED_AGENT_REPOSITORY_PROVIDER: deployConfig.providers?.agents?.repository ?? "stub",
-    TREESEED_AGENT_VERIFICATION_PROVIDER: deployConfig.providers?.agents?.verification ?? "stub",
+    TREESEED_AGENT_EXECUTION_PROVIDER: deployConfig.providers?.agents?.execution ?? "codex",
+    TREESEED_AGENT_REPOSITORY_PROVIDER: deployConfig.providers?.agents?.repository ?? "git",
+    TREESEED_AGENT_VERIFICATION_PROVIDER: deployConfig.providers?.agents?.verification ?? "local",
     TREESEED_CONTENT_RUNTIME_PROVIDER: contentRuntimeProvider,
     TREESEED_CONTENT_PUBLISH_PROVIDER: contentPublishProvider,
     TREESEED_CONTENT_SERVING_MODE: contentServingMode,
@@ -380,7 +415,7 @@ function envValue(env, key) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 const LOCAL_RUNTIME_AUTH_ENV_KEYS = [
-  "BETTER_AUTH_URL",
+  "TREESEED_BETTER_AUTH_URL",
   "TREESEED_SITE_URL",
   "TREESEED_AUTH_MODE",
   "TREESEED_AUTH_INTERNAL_SIGNUP",
@@ -478,15 +513,7 @@ function defaultStateFromConfig(deployConfig, target) {
         previewDatabaseId: `dryrun-${suffix}-site-data-preview`
       }
     },
-    queues: {
-      agentWork: {
-        name: environmentScopedIdentityName(identity, deployConfig.cloudflare.queueName ?? "agent-work", target),
-        dlqName: environmentScopedIdentityName(identity, deployConfig.cloudflare.dlqName ?? "agent-work-dlq", target),
-        binding: deployConfig.cloudflare.queueBinding ?? "AGENT_WORK_QUEUE",
-        queueId: null,
-        dlqId: null
-      }
-    },
+    queues: {},
     pages: {
       projectName: resolveConfiguredPagesProjectName(deployConfig),
       productionBranch: deployConfig.cloudflare.pages?.productionBranch ?? "main",
@@ -655,19 +682,7 @@ function loadDeployState(tenantRoot, deployConfig, options = {}) {
         binding: defaults.d1Databases.SITE_DATA_DB.binding
       }
     },
-    queues: {
-      ...defaults.queues ?? {},
-      ...persisted.queues ?? {},
-      agentWork: {
-        ...defaults.queues?.agentWork ?? {},
-        ...persisted.queues?.agentWork ?? {},
-        name: defaults.queues?.agentWork?.name ?? persisted.queues?.agentWork?.name ?? "agent-work",
-        dlqName: defaults.queues?.agentWork?.dlqName ?? persisted.queues?.agentWork?.dlqName ?? "agent-work-dlq",
-        binding: defaults.queues?.agentWork?.binding ?? persisted.queues?.agentWork?.binding ?? "AGENT_WORK_QUEUE",
-        queueId: persisted.queues?.agentWork?.queueId ?? defaults.queues?.agentWork?.queueId ?? null,
-        dlqId: persisted.queues?.agentWork?.dlqId ?? defaults.queues?.agentWork?.dlqId ?? null
-      }
-    },
+    queues: {},
     generatedSecrets: {
       ...defaults.generatedSecrets ?? {},
       ...persisted.generatedSecrets ?? {}
@@ -925,7 +940,7 @@ function isWranglerAlreadyExistsError(error, matchers) {
   return matchers.some((matcher) => matcher.test(message));
 }
 function listKvNamespaces(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -936,7 +951,7 @@ function listKvNamespaces(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listD1Databases(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -947,7 +962,7 @@ function listD1Databases(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listQueues(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -958,7 +973,7 @@ function listQueues(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listR2Buckets(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -969,7 +984,7 @@ function listR2Buckets(tenantRoot, env) {
   return Array.isArray(payload?.result?.buckets) ? payload.result.buckets : [];
 }
 function listPagesProjects(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -980,7 +995,7 @@ function listPagesProjects(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listTurnstileWidgets(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -991,7 +1006,7 @@ function listTurnstileWidgets(tenantRoot, env) {
   return Array.isArray(payload?.result) ? payload.result : [];
 }
 function listWorkers(tenantRoot, env) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return [];
   }
@@ -1033,7 +1048,7 @@ function listDnsRecords(zoneId, env) {
   return records;
 }
 function getTurnstileWidget(env, sitekey) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId || !sitekey) {
     return null;
   }
@@ -1044,7 +1059,7 @@ function getTurnstileWidget(env, sitekey) {
   return payload?.result ?? null;
 }
 function createTurnstileWidget(env, input) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     throw new Error("Configure CLOUDFLARE_ACCOUNT_ID before creating Turnstile widgets.");
   }
@@ -1064,7 +1079,7 @@ function createTurnstileWidget(env, input) {
   }
 }
 function updateTurnstileWidget(env, sitekey, input) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId || !sitekey) {
     throw new Error("Configure CLOUDFLARE_ACCOUNT_ID and sitekey before updating Turnstile widgets.");
   }
@@ -1167,13 +1182,10 @@ function buildProvisioningSummary(deployConfig, state, target) {
     formGuardKv: state.kvNamespaces.FORM_GUARD_KV,
     sessionKv: state.kvNamespaces.SESSION ?? null,
     siteDataDb: state.d1Databases.SITE_DATA_DB,
-    queue: state.queues?.agentWork ?? null,
     content: state.content ?? null,
     resources: {
       pagesProject: state.pages?.projectName ?? null,
       contentBucket: state.content?.bucketName ?? null,
-      queue: state.queues?.agentWork?.name ?? null,
-      dlq: state.queues?.agentWork?.dlqName ?? null,
       database: state.d1Databases?.SITE_DATA_DB?.databaseName ?? null,
       turnstileWidget: state.turnstileWidgets?.formGuard?.name ?? null,
       formGuardKv: state.kvNamespaces?.FORM_GUARD_KV?.name ?? null,
@@ -1241,7 +1253,7 @@ function shouldManageCloudflareWebCacheRules(deployConfig, target) {
   return Boolean(webTarget?.host && !webTarget.host.endsWith(".workers.dev") && !webTarget.host.endsWith(".pages.dev"));
 }
 function cloudflareApiRequest(path, { method = "GET", body, env, allowFailure = false } = {}) {
-  const token = env?.CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? "";
+  const token = env?.TREESEED_CLOUDFLARE_API_TOKEN ?? env?.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? "";
   if (!token) {
     if (allowFailure) {
       return null;
@@ -1405,6 +1417,13 @@ function listCloudflareZoneRulesets(zoneId, env) {
   const result = cloudflareApiRequest(`/zones/${zoneId}/rulesets`, { env, allowFailure: true });
   return Array.isArray(result?.result) ? result.result : [];
 }
+function joinCloudflareAndExpression(clauses) {
+  const parts = clauses.map((clause) => typeof clause === "string" ? clause.trim() : "").filter((clause) => clause.length > 0).map((clause) => clause.startsWith("(") && clause.endsWith(")") ? clause : `(${clause})`);
+  if (parts.length === 0) {
+    throw new Error("Cannot build a Cloudflare expression without predicates.");
+  }
+  return `(${parts.join(" and ")})`;
+}
 function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kind) {
   if (!cacheTarget?.host) {
     return [];
@@ -1412,12 +1431,16 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
   const policy = resolveTreeseedWebCachePolicy(deployConfig);
   const cachePolicy = kind === "web" ? policy.contentPages : policy.r2PublishedObjects;
   const hostExpression = `(http.host eq "${cacheTarget.host}")`;
-  const pathExpression = cacheTarget.pathPrefix ? `(starts_with(http.request.uri.path, "${cacheTarget.pathPrefix}/") or (http.request.uri.path eq "${cacheTarget.pathPrefix}"))` : "true";
+  const pathExpression = cacheTarget.pathPrefix ? `(starts_with(http.request.uri.path, "${cacheTarget.pathPrefix}/") or (http.request.uri.path eq "${cacheTarget.pathPrefix}"))` : null;
   if (kind === "content") {
     return [
       {
         description: "treeseed-managed: cache public r2 objects",
-        expression: `((${hostExpression}) and (${pathExpression}) and (http.request.method in {"GET" "HEAD"}))`,
+        expression: joinCloudflareAndExpression([
+          hostExpression,
+          pathExpression,
+          '(http.request.method in {"GET" "HEAD"})'
+        ]),
         action: "set_cache_settings",
         action_parameters: {
           cache: true,
@@ -1435,21 +1458,31 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
     ];
   }
   const sourcePaths = policy.sourcePages.paths.map((path) => path === "/" ? "/" : path.replace(/\/+$/u, ""));
-  const sourcePathExpression = sourcePaths.length > 0 ? `(${sourcePaths.map((path) => `(http.request.uri.path eq "${path}")`).join(" or ")})` : "false";
-  const notSourcePathExpression = sourcePaths.length > 0 ? `not ${sourcePathExpression}` : "true";
-  return [
+  const sourcePathExpression = sourcePaths.length > 0 ? `(${sourcePaths.map((path) => `(http.request.uri.path eq "${path}")`).join(" or ")})` : null;
+  const notSourcePathExpression = sourcePaths.length > 0 ? `not ${sourcePathExpression}` : null;
+  const rules = [
     {
       description: "treeseed-managed: bypass preview and dynamic routes",
-      expression: `((${hostExpression}) and ((starts_with(http.request.uri.path, "/api/")) or (http.request.uri.path eq "/api") or (starts_with(http.request.uri.path, "/auth")) or (starts_with(http.request.uri.path, "/admin")) or (starts_with(http.request.uri.path, "/app")) or (starts_with(http.request.uri.path, "/internal")) or (http.request.uri.query contains "preview=") or (http.cookie contains "treeseed-content-preview=")))`,
+      expression: joinCloudflareAndExpression([
+        hostExpression,
+        '((starts_with(http.request.uri.path, "/api/")) or (http.request.uri.path eq "/api") or (starts_with(http.request.uri.path, "/auth")) or (starts_with(http.request.uri.path, "/admin")) or (starts_with(http.request.uri.path, "/app")) or (starts_with(http.request.uri.path, "/internal")) or (http.request.uri.query contains "preview=") or (http.cookie contains "treeseed-content-preview="))'
+      ]),
       action: "set_cache_settings",
       action_parameters: {
         cache: false
       },
       enabled: true
-    },
-    {
+    }
+  ];
+  if (sourcePathExpression) {
+    rules.push({
       description: "treeseed-managed: cache source html routes",
-      expression: `((${hostExpression}) and (${pathExpression}) and (${sourcePathExpression}) and (http.request.method in {"GET" "HEAD"}))`,
+      expression: joinCloudflareAndExpression([
+        hostExpression,
+        pathExpression,
+        sourcePathExpression,
+        '(http.request.method in {"GET" "HEAD"})'
+      ]),
       action: "set_cache_settings",
       action_parameters: {
         cache: true,
@@ -1463,10 +1496,26 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
         }
       },
       enabled: true
-    },
+    });
+  }
+  rules.push(
     {
       description: "treeseed-managed: cache content html routes",
-      expression: `((${hostExpression}) and (${pathExpression}) and (${notSourcePathExpression}) and (http.request.method in {"GET" "HEAD"}) and (http.request.uri.path.extension eq "") and not (starts_with(http.request.uri.path, "/api/")) and not (http.request.uri.path eq "/api") and not (starts_with(http.request.uri.path, "/auth")) and not (starts_with(http.request.uri.path, "/admin")) and not (starts_with(http.request.uri.path, "/app")) and not (starts_with(http.request.uri.path, "/internal")) and not (http.request.uri.query contains "preview=") and not (http.cookie contains "treeseed-content-preview="))`,
+      expression: joinCloudflareAndExpression([
+        hostExpression,
+        pathExpression,
+        notSourcePathExpression,
+        '(http.request.method in {"GET" "HEAD"})',
+        '(http.request.uri.path.extension eq "")',
+        'not (starts_with(http.request.uri.path, "/api/"))',
+        'not (http.request.uri.path eq "/api")',
+        'not (starts_with(http.request.uri.path, "/auth"))',
+        'not (starts_with(http.request.uri.path, "/admin"))',
+        'not (starts_with(http.request.uri.path, "/app"))',
+        'not (starts_with(http.request.uri.path, "/internal"))',
+        'not (http.request.uri.query contains "preview=")',
+        'not (http.cookie contains "treeseed-content-preview=")'
+      ]),
       action: "set_cache_settings",
       action_parameters: {
         cache: true,
@@ -1481,7 +1530,8 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
       },
       enabled: true
     }
-  ];
+  );
+  return rules;
 }
 function reconcileCloudflareCacheRulesForTarget(role, deployConfig, state, cacheTarget, env, { dryRun = false } = {}) {
   const roleKey = role === "web" ? "Web" : "Content";
@@ -1535,7 +1585,7 @@ function reconcileCloudflareWebCacheRules(tenantRoot, deployConfig, state, targe
     return { managed: false, skipped: true, reason: "unsupported_target_or_host" };
   }
   const env = {
-    CLOUDFLARE_API_TOKEN: providedEnv?.CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? ""
+    CLOUDFLARE_API_TOKEN: providedEnv?.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? ""
   };
   if (!env.CLOUDFLARE_API_TOKEN) {
     state.webCache.webHost = resolvePublicWebCacheTarget(deployConfig)?.host ?? null;
@@ -1608,7 +1658,7 @@ function queueId(entry) {
 }
 function hasProvisionedCloudflareResources(state) {
   return Boolean(
-    state?.pages?.projectName && state?.pages?.url && state?.d1Databases?.SITE_DATA_DB?.databaseId && state?.kvNamespaces?.FORM_GUARD_KV?.id && state?.queues?.agentWork?.name && state?.content?.bucketName
+    state?.pages?.projectName && state?.pages?.url && state?.d1Databases?.SITE_DATA_DB?.databaseId && state?.kvNamespaces?.FORM_GUARD_KV?.id && state?.content?.bucketName
   );
 }
 function absoluteUrlForPath(baseUrl, path) {
@@ -1638,14 +1688,14 @@ function purgeSourcePageCaches(tenantRoot, options = {}) {
   const deployConfig = loadTenantDeployConfig(tenantRoot);
   const state = loadDeployState(tenantRoot, deployConfig, { target });
   const urls = resolveSourcePagePurgeUrls(deployConfig);
-  if ((options.dryRun ?? false) || urls.length === 0 || !process.env.CLOUDFLARE_API_TOKEN) {
+  if ((options.dryRun ?? false) || urls.length === 0 || !process.env.TREESEED_CLOUDFLARE_API_TOKEN) {
     recordCachePurgeResult(state.webCache.deployPurge, urls.map((url) => ({ count: url ? 1 : 0 })));
     writeDeployState(tenantRoot, state, { target });
     return { skipped: options.dryRun ?? false, urls, results: [] };
   }
   try {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
-      env: { CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN }
+      env: { CLOUDFLARE_API_TOKEN: process.env.TREESEED_CLOUDFLARE_API_TOKEN }
     });
     recordCachePurgeResult(state.webCache.deployPurge, results);
     writeDeployState(tenantRoot, state, { target });
@@ -1660,14 +1710,14 @@ function purgePublishedContentCaches(tenantRoot, urls, options = {}) {
   const target = normalizeTarget(options.scope ?? options.target ?? "prod");
   const deployConfig = loadTenantDeployConfig(tenantRoot);
   const state = loadDeployState(tenantRoot, deployConfig, { target });
-  if ((options.dryRun ?? false) || !urls?.length || !process.env.CLOUDFLARE_API_TOKEN) {
+  if ((options.dryRun ?? false) || !urls?.length || !process.env.TREESEED_CLOUDFLARE_API_TOKEN) {
     recordCachePurgeResult(state.webCache.contentPurge, (urls ?? []).map((url) => ({ count: url ? 1 : 0 })));
     writeDeployState(tenantRoot, state, { target });
     return { skipped: options.dryRun ?? false, urls: urls ?? [], results: [] };
   }
   try {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
-      env: { CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN }
+      env: { CLOUDFLARE_API_TOKEN: process.env.TREESEED_CLOUDFLARE_API_TOKEN }
     });
     recordCachePurgeResult(state.webCache.contentPurge, results);
     writeDeployState(tenantRoot, state, { target });
@@ -1687,8 +1737,41 @@ function isPlaceholderAccountId(value) {
 function resolveConfiguredCloudflareAccountId(deployConfig) {
   return envOrNull("CLOUDFLARE_ACCOUNT_ID") ?? deployConfig.cloudflare.accountId;
 }
-function resolveConfiguredMarketBaseUrl(deployConfig) {
-  return envOrNull("TREESEED_API_BASE_URL") ?? envOrNull("TREESEED_CENTRAL_MARKET_API_BASE_URL") ?? deployConfig.runtime?.marketBaseUrl ?? deployConfig.hosting?.marketBaseUrl ?? DEFAULT_TREESEED_MARKET_BASE_URL;
+function normalizeConfiguredBaseUrl(value) {
+  const raw = typeof value === "string" ? value.trim() : "";
+  if (!raw) {
+    return null;
+  }
+  return raw.replace(/\/+$/u, "");
+}
+function domainBaseUrl(domain) {
+  const raw = typeof domain === "string" ? domain.trim() : "";
+  if (!raw) {
+    return null;
+  }
+  if (/^https?:\/\//iu.test(raw)) {
+    return normalizeConfiguredBaseUrl(raw);
+  }
+  return `https://${raw.replace(/^\/+|\/+$/gu, "")}`;
+}
+function targetEnvironmentKey(target) {
+  if (target?.kind === "persistent") {
+    return target.scope;
+  }
+  return "staging";
+}
+function resolveConfiguredApiConnectionBaseUrl(deployConfig, target) {
+  const scope = targetEnvironmentKey(target);
+  if (scope === "local") {
+    return normalizeConfiguredBaseUrl(deployConfig.connections?.api?.localBaseUrl) ?? normalizeConfiguredBaseUrl(deployConfig.connections?.api?.environments?.local?.baseUrl) ?? domainBaseUrl(deployConfig.connections?.api?.environments?.local?.domain);
+  }
+  return normalizeConfiguredBaseUrl(deployConfig.connections?.api?.environments?.[scope]?.baseUrl) ?? domainBaseUrl(deployConfig.connections?.api?.environments?.[scope]?.domain);
+}
+function resolveConfiguredMarketBaseUrl(deployConfig, target) {
+  return resolveConfiguredApiConnectionBaseUrl(deployConfig, target) ?? envOrNull("TREESEED_API_BASE_URL") ?? deployConfig.runtime?.marketBaseUrl ?? deployConfig.hosting?.marketBaseUrl ?? envOrNull("TREESEED_CENTRAL_MARKET_API_BASE_URL") ?? DEFAULT_TREESEED_MARKET_BASE_URL;
+}
+function resolveConfiguredCentralMarketBaseUrl(deployConfig, target) {
+  return resolveConfiguredApiConnectionBaseUrl(deployConfig, target) ?? envOrNull("TREESEED_CENTRAL_MARKET_API_BASE_URL") ?? DEFAULT_TREESEED_MARKET_BASE_URL;
 }
 function resolveConfiguredPagesProjectName(deployConfig) {
   return sharedDeploymentName(resolveTreeseedResourceIdentity(deployConfig, createPersistentDeployTarget("prod")));
@@ -1865,7 +1948,7 @@ function deleteKvNamespace(tenantRoot, namespaceId, { env, dryRun, preview = fal
   if (dryRun) {
     return { status: "planned", id: namespaceId, preview };
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/storage/kv/namespaces/${encodeURIComponent(namespaceId)}` : null;
   const deleted = deleteCloudflareApiResource(path, { env, dryRun: false, name: namespaceId, type: "kv-namespace" });
   return { status: deleted.status, id: namespaceId, preview };
@@ -1877,7 +1960,7 @@ function deleteTurnstileWidget(sitekey, { env, dryRun, name = null }) {
   if (dryRun) {
     return { status: "planned", sitekey, name };
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/challenges/widgets/${encodeURIComponent(sitekey)}` : null;
   let deleted;
   try {
@@ -1895,7 +1978,7 @@ function deleteD1Database(tenantRoot, databaseName, { env, dryRun }) {
   if (dryRun) {
     return { status: "planned", name: databaseName };
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const database = accountId ? listD1Databases(tenantRoot, env).find((entry) => entry?.name === databaseName) : null;
   const databaseId = database?.uuid ?? database?.id ?? null;
   const path = accountId && databaseId ? `/accounts/${encodeURIComponent(accountId)}/d1/database/${encodeURIComponent(databaseId)}` : null;
@@ -1909,7 +1992,7 @@ function deleteWorker(tenantRoot, workerName, { env, dryRun, force = false }) {
   if (dryRun) {
     return { status: "planned", name: workerName };
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/workers/services/${encodeURIComponent(workerName)}` : null;
   const deleted = deleteCloudflareApiResource(path, { env, dryRun: false, name: workerName, type: "worker" });
   return { status: deleted.status, name: workerName };
@@ -1948,7 +2031,7 @@ function deleteQueueByName(tenantRoot, queue, { env, dryRun }) {
   if (dryRun) {
     return resourceOperation("cloudflare", "queue", name, "planned", { id });
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!id && accountId) {
     const live = listQueues(tenantRoot, env).find((entry) => queueName(entry) === name);
     id = queueId(live);
@@ -1965,25 +2048,6 @@ function deleteQueueByName(tenantRoot, queue, { env, dryRun }) {
   }
   throw new Error(`Failed to delete queue ${name}: CLOUDFLARE_ACCOUNT_ID is not configured.`);
 }
-function isLegacyTreeseedQueueName(name, scope) {
-  if (!name || !scope) {
-    return false;
-  }
-  const environmentNames = scope === "prod" ? ["prod", "production"] : [scope];
-  return environmentNames.some(
-    (environmentName) => name === `agent-work-${environmentName}` || name === `agent-work-dlq-${environmentName}`
-  );
-}
-function legacyQueueDestroyOperations(tenantRoot, queues, target, knownNames, { env, dryRun }) {
-  const scope = target.kind === "persistent" ? target.scope : target.branchName;
-  return queues.filter((queue) => {
-    const name = queueName(queue);
-    return name && !knownNames.has(name) && isLegacyTreeseedQueueName(name, scope);
-  }).map((queue) => {
-    const deleted = deleteQueueByName(tenantRoot, queue, { env, dryRun });
-    return { ...deleted, legacy: true };
-  });
-}
 function deleteR2Bucket(tenantRoot, bucketName, { env, dryRun, deleteData }) {
   if (!bucketName) {
     return resourceOperation("cloudflare", "r2-bucket", bucketName, "missing");
@@ -1995,7 +2059,7 @@ function deleteR2Bucket(tenantRoot, bucketName, { env, dryRun, deleteData }) {
     return resourceOperation("cloudflare", "r2-bucket", bucketName, "planned");
   }
   const drained = drainR2Bucket(bucketName, { env });
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/r2/buckets/${encodeURIComponent(bucketName)}` : null;
   const deleted = deleteCloudflareApiResource(path, { env, dryRun: false, name: bucketName, type: "r2-bucket" });
   return resourceOperation("cloudflare", "r2-bucket", bucketName, deleted.status, drained);
@@ -2004,7 +2068,7 @@ function r2ObjectKey(entry) {
   return typeof entry?.key === "string" ? entry.key : typeof entry?.name === "string" ? entry.name : "";
 }
 function listR2Objects(bucketName, { env }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId || !bucketName) {
     return [];
   }
@@ -2032,7 +2096,7 @@ function listR2Objects(bucketName, { env }) {
   return objects;
 }
 function drainR2Bucket(bucketName, { env }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId || !bucketName) {
     return { objectsDeleted: 0, objectsMissing: 0, objectsDeferred: 0 };
   }
@@ -2064,8 +2128,8 @@ function drainR2Bucket(bucketName, { env }) {
   return { objectsDeleted, objectsMissing, objectsDeferred };
 }
 function deleteR2ObjectsBatch(bucketName, keys, { env }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
-  const token = env?.CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
+  const token = env?.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? "";
   const uniqueKeys = [...new Set((keys ?? []).filter(Boolean))];
   if (!accountId || !bucketName || uniqueKeys.length === 0) {
     return { objectsDeleted: 0, objectsMissing: 0, objectsDeferred: 0 };
@@ -2187,7 +2251,7 @@ function pagesDomainName(domain) {
   return typeof domain?.name === "string" ? domain.name : typeof domain?.domain === "string" ? domain.domain : typeof domain?.hostname === "string" ? domain.hostname : "";
 }
 function listPagesCustomDomains(projectName, { env }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!projectName || !accountId) {
     return [];
   }
@@ -2238,7 +2302,7 @@ function deletePagesCustomDomains(tenantRoot, projectName, knownNames, { env, dr
   if (dryRun) {
     return desiredNames.length > 0 ? desiredNames.map((name) => resourceOperation("cloudflare", "pages-custom-domain", name, "planned", { projectName, knownOnly })) : [resourceOperation("cloudflare", "pages-custom-domain", projectName, knownOnly ? "skipped" : "planned", { reason: knownOnly ? "no_target_scoped_domain" : "project_delete_prerequisite" })];
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return desiredNames.length > 0 ? desiredNames.map((name) => resourceOperation("cloudflare", "pages-custom-domain", name, "blocked", { projectName, reason: "missing_cloudflare_account_id" })) : [resourceOperation("cloudflare", "pages-custom-domain", projectName, "blocked", { reason: "missing_cloudflare_account_id" })];
   }
@@ -2263,7 +2327,7 @@ function pagesDeploymentEnvironments(environment = "all") {
   return environment === "preview" ? ["preview"] : environment === "production" ? ["production"] : ["preview", "production"];
 }
 function listPagesDeploymentsWithApi(projectName, { env, environment = "all" }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!projectName || !accountId) {
     return [];
   }
@@ -2317,7 +2381,7 @@ function deletePagesDeployments(tenantRoot, projectName, { env, dryRun, environm
   if (dryRun) {
     return resourceOperation("cloudflare", "pages-deployments", projectName, "planned", { reason: "project_delete_prerequisite", environment });
   }
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!accountId) {
     return resourceOperation("cloudflare", "pages-deployments", projectName, "blocked", { reason: "missing_cloudflare_account_id" });
   }
@@ -2371,7 +2435,7 @@ function deletePagesDeployments(tenantRoot, projectName, { env, dryRun, environm
   });
 }
 function deletePagesProject(projectName, { env, dryRun }) {
-  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "";
   if (!projectName || !accountId) {
     return resourceOperation("cloudflare", "pages-project", projectName, "missing");
   }
@@ -2563,17 +2627,19 @@ async function destroyRailwayResources(tenantRoot, deployConfig, target, { dryRu
         }
       }
     }
-    const volumes = await listRailwayVolumes({ projectId: project.id, env });
-    for (const volume of volumes) {
-      const matchingInstance = volume.instances.find((instance) => instance.environmentId === environment?.id);
-      if (!matchingInstance) {
-        continue;
-      }
-      if (dryRun) {
-        operations.push(resourceOperation("railway", "volume", volume.name, "planned", { id: volume.id, projectId: project.id }));
-      } else {
-        const result = await deleteRailwayVolume({ volumeId: volume.id, env });
-        operations.push(resourceOperation("railway", "volume", volume.name, result.status, { id: volume.id, projectId: project.id }));
+    if (deleteData) {
+      const volumes = await listRailwayVolumes({ projectId: project.id, env });
+      for (const volume of volumes) {
+        const matchingInstance = volume.instances.find((instance) => instance.environmentId === environment?.id);
+        if (!matchingInstance) {
+          continue;
+        }
+        if (dryRun) {
+          operations.push(resourceOperation("railway", "volume", volume.name, "planned", { id: volume.id, projectId: project.id }));
+        } else {
+          const result = await deleteRailwayVolume({ volumeId: volume.id, env });
+          operations.push(resourceOperation("railway", "volume", volume.name, result.status, { id: volume.id, projectId: project.id }));
+        }
       }
     }
     const shouldDeleteProject = shouldDeleteRailwayProjectAfterEnvironmentDestroy(project, scope, deleteData, environment?.id ?? null);
@@ -2584,11 +2650,7 @@ async function destroyRailwayResources(tenantRoot, deployConfig, target, { dryRu
           reason: scope === "prod" ? "prod_delete_data_cleanup" : "no_managed_persistent_environments"
         }));
       } else {
-        const result = await deleteRailwayProject({ projectId: project.id, env });
-        operations.push(resourceOperation("railway", "project", project.name, result.status, {
-          id: project.id,
-          reason: scope === "prod" ? "prod_delete_data_cleanup" : "no_managed_persistent_environments"
-        }));
+        throw new Error("Railway project deletion is reconciler-owned. Use trsd reconcile destroy or live acceptance cleanup for project-scoped deletion.");
       }
     } else if (environment) {
       if (dryRun) {
@@ -2770,8 +2832,6 @@ function treeSeedSweepTokens(deployConfig, state) {
     state.pages?.projectName,
     state.workerName,
     state.content?.bucketName,
-    state.queues?.agentWork?.name,
-    state.queues?.agentWork?.dlqName,
     state.kvNamespaces?.FORM_GUARD_KV?.name,
     state.kvNamespaces?.SESSION?.name,
     state.d1Databases?.SITE_DATA_DB?.databaseName,
@@ -2978,12 +3038,7 @@ async function sweepTreeSeedRailwayResources(deployConfig, state, { env, dryRun
         sweep: true
       }));
     } else {
-      const deleted = await deleteRailwayProject({ projectId: project.id, env });
-      operations.push(resourceOperation("railway", "project", project.name, deleted.status, {
-        id: project.id,
-        workspaceId: workspace.id,
-        sweep: true
-      }));
+      throw new Error("Railway project sweep deletion is reconciler-owned. Use trsd reconcile test-live --mode cleanup for isolated cleanup.");
     }
   }
   return operations.length > 0 ? operations : [resourceOperation("railway", "treeseed-sweep", "railway", "missing", { reason: "no_matching_projects" })];
@@ -3027,8 +3082,6 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
   state.turnstileWidgets.formGuard = resolveExistingTurnstileWidget(turnstileWidgets, state.turnstileWidgets?.formGuard);
   const pagesProject = pagesProjects.find((entry) => entry?.name === state.pages?.projectName);
   const bucket = buckets.find((entry) => entry?.name === state.content?.bucketName);
-  const queue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
-  const dlq = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.dlqName);
   const workerResult = deleteWorker(tenantRoot, state.workerName, { env, dryRun, force });
   const turnstileWidget = deleteTurnstileWidget(state.turnstileWidgets?.formGuard?.sitekey, {
     env,
@@ -3055,13 +3108,6 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
     return resourceOperation("cloudflare", "kv-namespace", namespace.title, result.status, { ...result, legacy: true });
   });
   const database = deleteD1DatabaseForDestroy(tenantRoot, state.d1Databases.SITE_DATA_DB.databaseName, { env, dryRun, deleteData });
-  const deletedQueue = deleteQueueByName(tenantRoot, queue ?? { name: state.queues?.agentWork?.name }, { env, dryRun });
-  const deletedDlq = state.queues?.agentWork?.dlqName ? deleteQueueByName(tenantRoot, dlq ?? { name: state.queues.agentWork.dlqName }, { env, dryRun }) : null;
-  const knownQueueNames = new Set([
-    state.queues?.agentWork?.name,
-    state.queues?.agentWork?.dlqName
-  ].filter(Boolean));
-  const legacyQueues = legacyQueueDestroyOperations(tenantRoot, queues, target, knownQueueNames, { env, dryRun });
   const r2Bucket = bucket || dryRun ? deleteR2Bucket(tenantRoot, state.content?.bucketName, { env, dryRun, deleteData }) : resourceOperation("cloudflare", "r2-bucket", state.content?.bucketName, "missing");
   const pageDnsNames = [
     state.pages?.customDomain,
@@ -3099,9 +3145,6 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
       ...sessionPreview ? [resourceOperation("cloudflare", "kv-namespace-preview", state.kvNamespaces.SESSION.name, sessionPreview.status, sessionPreview)] : [],
       ...legacyKvNamespaces,
       database,
-      deletedQueue,
-      ...deletedDlq ? [deletedDlq] : [],
-      ...legacyQueues,
       r2Bucket,
       ...pageCustomDomains,
       pageDeployments,
@@ -3157,8 +3200,6 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
     state.d1Databases.SITE_DATA_DB
   );
   state.turnstileWidgets.formGuard = resolveExistingTurnstileWidget(turnstileWidgets, state.turnstileWidgets?.formGuard);
-  const queue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
-  const dlq = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.dlqName);
   const bucket = buckets.find((entry) => entry?.name === state.content?.bucketName);
   const pagesProject = pagesProjects.find((entry) => entry?.name === state.pages?.projectName);
   const worker = deleteWorker(tenantRoot, state.workerName, { env, dryRun, force });
@@ -3169,13 +3210,6 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
   });
   const formGuard = deleteKvNamespace(tenantRoot, state.kvNamespaces.FORM_GUARD_KV.id, { env, dryRun });
   const database = deleteD1DatabaseForDestroy(tenantRoot, state.d1Databases.SITE_DATA_DB.databaseName, { env, dryRun, deleteData });
-  const deletedQueue = deleteQueueByName(tenantRoot, queue ?? { name: state.queues?.agentWork?.name }, { env, dryRun });
-  const deletedDlq = state.queues?.agentWork?.dlqName ? deleteQueueByName(tenantRoot, dlq ?? { name: state.queues.agentWork.dlqName }, { env, dryRun }) : null;
-  const knownQueueNames = new Set([
-    state.queues?.agentWork?.name,
-    state.queues?.agentWork?.dlqName
-  ].filter(Boolean));
-  const legacyQueues = legacyQueueDestroyOperations(tenantRoot, queues, target, knownQueueNames, { env, dryRun });
   const r2Bucket = bucket || dryRun ? deleteR2Bucket(tenantRoot, state.content?.bucketName, { env, dryRun, deleteData }) : resourceOperation("cloudflare", "r2-bucket", state.content?.bucketName, "missing");
   const pages = pagesProject || dryRun ? deletePagesProject(state.pages?.projectName, { env, dryRun }) : resourceOperation("cloudflare", "pages-project", state.pages?.projectName, "missing");
   const operations = {
@@ -3183,9 +3217,6 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
     turnstileWidget,
     formGuard,
     database,
-    queue: deletedQueue,
-    dlq: deletedDlq,
-    legacyQueues,
     r2Bucket,
     pages
   };
@@ -3282,61 +3313,6 @@ function provisionCloudflareResources(tenantRoot, options = {}) {
     current.databaseId = created.uuid;
     current.previewDatabaseId = created.previewDatabaseUuid ?? created.uuid;
   };
-  const ensureQueue = () => {
-    const current = state.queues?.agentWork;
-    if (!current?.name) {
-      return;
-    }
-    let refreshedQueues = queues;
-    const exists = refreshedQueues.find((entry) => queueName(entry) === current.name);
-    if (exists) {
-      current.queueId = queueId(exists);
-      const currentDlq = current.dlqName ? refreshedQueues.find((entry) => queueName(entry) === current.dlqName) : null;
-      current.dlqId = queueId(currentDlq);
-      return;
-    }
-    if (dryRun) {
-      current.queueId = `dryrun-${current.name}`;
-      current.dlqId = current.dlqName ? `dryrun-${current.dlqName}` : null;
-      return;
-    }
-    try {
-      runWrangler(["queues", "create", current.name], {
-        cwd: tenantRoot,
-        capture: true,
-        env
-      });
-    } catch (error) {
-      if (!isWranglerAlreadyExistsError(error, [/Queue name .* is already taken/i, /\[code:\s*11009\]/i])) {
-        throw error;
-      }
-    }
-    refreshedQueues = listQueues(tenantRoot, env);
-    if (current.dlqName && !refreshedQueues.find((entry) => queueName(entry) === current.dlqName)) {
-      try {
-        runWrangler(["queues", "create", current.dlqName], {
-          cwd: tenantRoot,
-          capture: true,
-          env
-        });
-      } catch (error) {
-        if (!isWranglerAlreadyExistsError(error, [/Queue name .* is already taken/i, /\[code:\s*11009\]/i])) {
-          throw error;
-        }
-      }
-    }
-    refreshedQueues = listQueues(tenantRoot, env);
-    const created = refreshedQueues.find((entry) => queueName(entry) === current.name);
-    if (!created) {
-      throw new Error(`Unable to resolve Cloudflare queue ${current.name} after reconciliation.`);
-    }
-    current.queueId = queueId(created);
-    const createdDlq = current.dlqName ? refreshedQueues.find((entry) => queueName(entry) === current.dlqName) : null;
-    if (current.dlqName && !createdDlq) {
-      throw new Error(`Unable to resolve Cloudflare dead-letter queue ${current.dlqName} after reconciliation.`);
-    }
-    current.dlqId = queueId(createdDlq);
-  };
   const ensureR2Bucket = () => {
     const bucketName = state.content?.bucketName;
     if (!bucketName) {
@@ -3374,7 +3350,7 @@ function provisionCloudflareResources(tenantRoot, options = {}) {
     const exists = pagesProjects.find((entry) => entry?.name === current.projectName);
     if (exists) {
       current.url = exists.subdomain ? `https://${exists.subdomain}` : current.url ?? `https://${current.projectName}.pages.dev`;
-      ensurePagesProjectCompatibility(env.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "", current.projectName, env, exists, { state, target });
+      ensurePagesProjectCompatibility(env.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "", current.projectName, env, exists, { state, target });
       return;
     }
     if (dryRun) {
@@ -3393,12 +3369,11 @@ function provisionCloudflareResources(tenantRoot, options = {}) {
       capture: true,
       env
     });
-    ensurePagesProjectCompatibility(env.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "", current.projectName, env, null, { state, target });
+    ensurePagesProjectCompatibility(env.CLOUDFLARE_ACCOUNT_ID ?? process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? "", current.projectName, env, null, { state, target });
     current.url = `https://${current.projectName}.pages.dev`;
   };
   ensureKv("FORM_GUARD_KV");
   ensureD1();
-  ensureQueue();
   ensureR2Bucket();
   ensurePagesProject();
   reconcileCloudflareWebCacheRules(tenantRoot, deployConfig, state, target, { dryRun });
@@ -3488,8 +3463,6 @@ function verifyProvisionedCloudflareResources(tenantRoot, options = {}) {
     pages: Boolean(state.pages?.projectName && (livePages || pagesProject?.name === state.pages.projectName)),
     formGuardKv: Boolean(state.kvNamespaces?.FORM_GUARD_KV?.name && kvNamespaces.find((entry) => entry?.title === state.kvNamespaces.FORM_GUARD_KV.name)),
     d1: Boolean(state.d1Databases?.SITE_DATA_DB?.databaseName && d1Databases.find((entry) => entry?.name === state.d1Databases.SITE_DATA_DB.databaseName)),
-    queue: Boolean(state.queues?.agentWork?.name && queues.find((entry) => queueName(entry) === state.queues.agentWork.name)),
-    dlq: !state.queues?.agentWork?.dlqName || Boolean(queues.find((entry) => queueName(entry) === state.queues.agentWork.dlqName)),
     r2: Boolean(state.content?.bucketName && buckets.find((entry) => entry?.name === state.content.bucketName)),
     pagesFormGuardKvBinding: !pagesBindings.kv_namespaces?.FORM_GUARD_KV || pageBindingConfigured("kv_namespaces", "FORM_GUARD_KV", pagesBindings.kv_namespaces.FORM_GUARD_KV),
     pagesD1Binding: !pagesBindings.d1_databases?.SITE_DATA_DB || pageBindingConfigured("d1_databases", "SITE_DATA_DB", pagesBindings.d1_databases.SITE_DATA_DB),
@@ -3505,12 +3478,6 @@ function verifyProvisionedCloudflareResources(tenantRoot, options = {}) {
   state.readiness.blockers = [];
   state.readiness.warnings = [];
   state.readiness.lastValidationSummary = checks;
-  const liveQueue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
-  if (state.queues?.agentWork) {
-    state.queues.agentWork.queueId = queueId(liveQueue) ?? state.queues.agentWork.queueId ?? null;
-    const liveDlq = queues.find((entry) => queueName(entry) === state.queues.agentWork.dlqName);
-    state.queues.agentWork.dlqId = queueId(liveDlq) ?? state.queues.agentWork.dlqId ?? null;
-  }
   if (state.pages) {
     const configuredWebUrl = resolveConfiguredSurfaceBaseUrl(deployConfig, target, "web");
     if (configuredWebUrl) {
@@ -3749,6 +3716,7 @@ export {
   buildProvisioningSummary,
   buildPublicVars,
   buildSecretMap,
+  buildTreeseedManagedCloudflareCacheRules,
   buildWranglerConfigContents,
   cleanupDestroyedState,
   cloudflareApiRequest,