@treeseed/sdk 0.11.0 → 0.12.5

package/dist/operations/services/railway-deploy.js

@@ -1,11 +1,12 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, relative, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { relative, resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
 import { loadCliDeployConfig } from "./runtime-tools.js";
+import { resolveTreeseedMachineEnvironmentValues } from "./config-runtime.js";
 import { createPersistentDeployTarget, resolveTreeseedResourceIdentity } from "./deploy.js";
+import { classifyTreeseedGitMode, runTreeseedGitText } from "./git-runner.js";
 import { discoverTreeseedApplications } from "../../hosting/apps.js";
 import { runPrefixedCommand, sleep } from "./bootstrap-runner.js";
-import { resolveTreeseedToolCommand } from "../../managed-dependencies.js";
 import {
   ensureRailwayEnvironment,
   ensureRailwayProject,
@@ -22,7 +23,6 @@ import {
   railwayGraphqlRequest,
   resolveRailwayApiToken,
   resolveRailwayApiUrl,
-  resolveRailwayWorkspace,
   resolveRailwayWorkspaceContext,
   upsertRailwayVariables
 } from "./railway-api.js";
@@ -33,11 +33,12 @@ function normalizeScope(scope) {
 function resolveRailwayEnvironmentForScope(scope, configuredEnvironment) {
   return normalizeRailwayEnvironmentName(configuredEnvironment || normalizeScope(scope));
 }
-const RAILWAY_SERVICE_KEYS = ["api", "operationsRunner"];
+const RAILWAY_SERVICE_KEYS = ["api", "operationsRunner", "capacityProviderManager", "capacityProviderRunner"];
 const HOSTED_PROJECT_SERVICE_KEYS = ["api"];
 const WORKER_RUNNER_BOOTSTRAP_INDEX = 1;
 const WORKER_RUNNER_VOLUME_MOUNT_PATH = "/data";
 const OPERATIONS_RUNNER_BOOTSTRAP_COUNT = 2;
+const PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX = "public-treedx-node-";
 function isTreeseedOperationsRunnerResourceName(value) {
   const normalized = String(value ?? "").trim().toLowerCase();
   if (!normalized) {
@@ -60,7 +61,7 @@ function shouldManageRailwaySchedules(scope, phase = "deploy") {
   return phase === "deploy" && (environment === "staging" || environment === "production");
 }
 function railwayServiceNameSuffix(serviceKey) {
-  return serviceKey === "workdayManager" ? "workday-manager" : serviceKey === "workerRunner" ? "worker-runner" : serviceKey === "operationsRunner" ? "operations-runner" : serviceKey;
+  return serviceKey === "capacityProviderManager" ? "capacity-provider-manager" : serviceKey === "capacityProviderRunner" ? "capacity-provider-runner" : serviceKey === "workdayManager" ? "workday-manager" : serviceKey === "workerRunner" ? "worker-runner" : serviceKey === "operationsRunner" ? "operations-runner" : serviceKey;
 }
 function deriveRailwayWorkerRunnerServiceName(projectSlug, index = WORKER_RUNNER_BOOTSTRAP_INDEX) {
   const normalizedIndex = Math.max(1, Number.parseInt(String(index), 10) || WORKER_RUNNER_BOOTSTRAP_INDEX);
@@ -71,12 +72,49 @@ function deriveRailwayOperationsRunnerServiceName(baseServiceName, index = WORKE
   const base = String(baseServiceName ?? "").trim().replace(/-\d+$/u, "").replace(/-\d{2}$/u, "") || "treeseed-api-operations-runner";
   return `${base}-${String(normalizedIndex).padStart(2, "0")}`;
 }
+function railwayImageRefEnvForService(serviceKey) {
+  if (serviceKey === "api") return "TREESEED_API_IMAGE_REF";
+  if (serviceKey === "operationsRunner") return "TREESEED_OPERATIONS_RUNNER_IMAGE_REF";
+  if (serviceKey === "capacityProviderManager") return "TREESEED_AGENT_MANAGER_IMAGE_REF";
+  if (serviceKey === "capacityProviderRunner") return "TREESEED_AGENT_RUNNER_IMAGE_REF";
+  if (isPublicTreeDxNodeServiceKey(serviceKey)) return "TREESEED_PUBLIC_TREEDX_IMAGE_REF";
+  return null;
+}
+function defaultRailwayImageRef(serviceKey, scope = "staging", env = process.env) {
+  if (serviceKey === "api") {
+    return envValue("TREESEED_API_IMAGE_REF", env) || null;
+  }
+  if (serviceKey === "operationsRunner") {
+    return envValue("TREESEED_OPERATIONS_RUNNER_IMAGE_REF", env) || null;
+  }
+  if (serviceKey === "capacityProviderManager") {
+    return envValue("TREESEED_AGENT_MANAGER_IMAGE_REF", env) || null;
+  }
+  if (serviceKey === "capacityProviderRunner") {
+    return envValue("TREESEED_AGENT_RUNNER_IMAGE_REF", env) || null;
+  }
+  if (isPublicTreeDxNodeServiceKey(serviceKey)) {
+    return envValue("TREESEED_PUBLIC_TREEDX_IMAGE_REF", env) || null;
+  }
+  return null;
+}
+function isPublicTreeDxNodeServiceKey(serviceKey) {
+  return String(serviceKey ?? "").startsWith(PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX);
+}
 function deriveRailwayWorkerRunnerVolumeName(serviceName, environmentName = "") {
   return `${serviceName}-volume`;
 }
 function deriveRailwayOperationsRunnerVolumeName(serviceName, environmentName = "") {
   return `${serviceName}-volume`;
 }
+function deriveRailwayCapacityProviderRunnerServiceName(baseServiceName, index = WORKER_RUNNER_BOOTSTRAP_INDEX) {
+  const normalizedIndex = Math.max(1, Number.parseInt(String(index), 10) || WORKER_RUNNER_BOOTSTRAP_INDEX);
+  const base = String(baseServiceName ?? "").trim().replace(/-\d+$/u, "").replace(/-\d{2}$/u, "") || "treeseed-capacity-provider-runner";
+  return `${base}-${String(normalizedIndex).padStart(2, "0")}`;
+}
+function deriveRailwayCapacityProviderRunnerVolumeName(serviceName, environmentName = "") {
+  return `${serviceName}-volume`;
+}
 function railwayServiceRuntimeStartCommand(service) {
   return service.startCommand;
 }
@@ -89,8 +127,8 @@ function normalizeScheduleExpressions(value) {
   }
   return [];
 }
-function envValue(name) {
-  const value = process.env[name];
+function envValue(name, env = process.env) {
+  const value = env?.[name];
   return typeof value === "string" && value.trim() ? value.trim() : "";
 }
 function relativeRailwayRootDir(tenantRoot, serviceRoot) {
@@ -271,7 +309,7 @@ function resolveRailwayAuthToken(env = process.env) {
 function buildRailwayCommandEnv(env = process.env) {
   const merged = { ...env };
   const token = resolveRailwayAuthToken(merged);
-  const projectToken = configuredEnvValue(merged, "RAILWAY_TOKEN");
+  const projectToken = configuredEnvValue(merged, "TREESEED_RAILWAY_TOKEN");
   if (token) {
     merged.RAILWAY_API_TOKEN = token;
   } else {
@@ -280,15 +318,6 @@ function buildRailwayCommandEnv(env = process.env) {
   merged.RAILWAY_TOKEN = projectToken || void 0;
   return merged;
 }
-function buildRailwayDeployCommandEnv(env = process.env) {
-  const merged = buildRailwayCommandEnv(env);
-  if (shouldAttachRailwayDeployLogs(merged)) {
-    merged.CI = "true";
-  } else {
-    merged.CI = void 0;
-  }
-  return merged;
-}
 function normalizeRailwaySchedule(schedule) {
   if (!schedule || typeof schedule !== "object") {
     return null;
@@ -338,47 +367,6 @@ function collectRailwaySchedules(value, seen = /* @__PURE__ */ new Set()) {
   visit(value);
   return matches;
 }
-function normalizeRailwayProjectList(payload) {
-  try {
-    const parsed = JSON.parse(payload);
-    if (!Array.isArray(parsed)) {
-      return [];
-    }
-    return parsed.map((entry) => {
-      if (!entry || typeof entry !== "object") {
-        return null;
-      }
-      const id = typeof entry.id === "string" ? entry.id.trim() : "";
-      const name = typeof entry.name === "string" ? entry.name.trim() : "";
-      if (!id && !name) {
-        return null;
-      }
-      return { id, name };
-    }).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-function railwayMessage(result) {
-  return `${result?.stderr ?? ""}
-${result?.stdout ?? ""}`.trim();
-}
-function isRailwayAlreadyExistsMessage(result) {
-  return /already exists|already taken|duplicate|has already been taken/iu.test(railwayMessage(result));
-}
-function isRailwayTransientFailure(result) {
-  const message = railwayMessage(result);
-  if (!message.trim() && result?.status === 1) {
-    return true;
-  }
-  return /timed out|failed to fetch|error decoding response body|expected value at line 1 column 1|temporarily unavailable|econnreset|etimedout|failed to stream build logs|failed to retrieve build log/iu.test(message);
-}
-function sleepSync(milliseconds) {
-  if (!Number.isFinite(milliseconds) || milliseconds <= 0) {
-    return;
-  }
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
-}
 function isRailwayScheduleCapabilityError(error) {
   const message = error instanceof Error ? error.message : String(error ?? "");
   return /cronTriggers|cronTriggerCreate|cronTriggerUpdate/iu.test(message);
@@ -451,42 +439,6 @@ mutation TreeseedScheduleUpdate($id: String!, $name: String!, $schedule: String!
 `.trim()
   };
 }
-function runRailway(args, { cwd, capture = false, allowFailure = false, input, env, retryTransient = true, retryAttempts = 3, retryDelayMs = 2e3, timeoutMs = 12e4 } = {}) {
-  const effectiveEnv = buildRailwayCommandEnv({ ...process.env, ...env ?? {} });
-  const railway = resolveTreeseedToolCommand("railway", { env: effectiveEnv });
-  if (!railway) {
-    throw new Error("Railway CLI is unavailable.");
-  }
-  const runWithEnv = (spawnEnv) => spawnSync(railway.command, [...railway.argsPrefix, ...args], {
-    cwd,
-    stdio: input !== void 0 ? ["pipe", capture ? "pipe" : "inherit", capture ? "pipe" : "inherit"] : capture ? "pipe" : "inherit",
-    encoding: "utf8",
-    env: spawnEnv,
-    input,
-    timeout: Number.isFinite(timeoutMs) && Number(timeoutMs) > 0 ? Number(timeoutMs) : void 0
-  });
-  let result = null;
-  const maxAttempts = retryTransient && !allowFailure ? Math.max(1, Number(retryAttempts) || 1) : 1;
-  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-    result = runWithEnv(effectiveEnv);
-    if (result.status === 0 || allowFailure || !isRailwayTransientFailure(result) || attempt === maxAttempts) {
-      break;
-    }
-    sleepSync((Number(retryDelayMs) || 0) * attempt);
-  }
-  if (result?.error) {
-    const errorMessage = result.error instanceof Error ? result.error.message : String(result.error);
-    const timeoutMessage = /timed out|ETIMEDOUT/iu.test(errorMessage) ? `railway ${args.join(" ")} timed out after ${Math.round(Number(timeoutMs) / 1e3)}s` : errorMessage;
-    if (!allowFailure) {
-      throw new Error(timeoutMessage);
-    }
-    result.stderr = result.stderr || timeoutMessage;
-  }
-  if (result?.status !== 0 && !allowFailure) {
-    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `railway ${args.join(" ")} failed`);
-  }
-  return result;
-}
 async function waitForRailwayManagedDeploymentsSettled(tenantRoot, scope, {
   services = configuredRailwayServices(tenantRoot, scope),
   env = process.env,
@@ -659,263 +611,21 @@ query TreeseedRailwayDeploymentStatus($projectId: String!) {
   });
   return payload.data?.project ?? null;
 }
-function setRailwaySecretVariable({ cwd, service, environment, key, value, env = process.env, capture = false, allowFailure = false }) {
-  const effectiveEnv = buildRailwayCommandEnv({
-    ...process.env,
-    ...env ?? {}
-  });
-  let result = null;
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    const railway = resolveTreeseedToolCommand("railway", { env: effectiveEnv });
-    if (!railway) {
-      throw new Error("Railway CLI is unavailable.");
-    }
-    result = spawnSync(railway.command, [
-      ...railway.argsPrefix,
-      "variable",
-      "set",
-      "--service",
-      service,
-      "--environment",
-      environment,
-      "--stdin",
-      "--skip-deploys",
-      key
-    ], {
-      cwd,
-      stdio: ["pipe", capture ? "pipe" : "inherit", capture ? "pipe" : "inherit"],
-      encoding: "utf8",
-      env: effectiveEnv,
-      input: `${value}
-`
-    });
-    if (result.status === 0) {
-      return result;
-    }
-    if (!isRailwayTransientFailure(result)) {
-      break;
-    }
-  }
-  if (result?.status !== 0 && !allowFailure) {
-    throw new Error(result?.stderr?.trim() || result?.stdout?.trim() || `railway variable set --stdin ${key} failed`);
-  }
-  return result;
-}
-function ensureRailwayProjectExists(service, { env = process.env } = {}) {
-  const projectName = typeof service?.projectName === "string" ? service.projectName.trim() : "";
-  const projectId = typeof service?.projectId === "string" ? service.projectId.trim() : "";
-  const listed = runRailway(["list", "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (listed.status === 0) {
-    const match = normalizeRailwayProjectList(listed.stdout ?? "").find((entry) => entry.name === projectName || entry.id === projectName || entry.id === projectId);
-    if (match) {
-      return match;
-    }
-  }
-  if (!projectName) {
-    if (projectId) {
-      return { id: projectId, name: "" };
-    }
-    throw new Error(`Railway service ${service?.key ?? service?.serviceName ?? service?.serviceId ?? "(unknown)"} is missing a projectName.`);
-  }
-  const args = ["init", "--name", projectName, "--json"];
-  const workspace = resolveRailwayWorkspace(env);
-  if (workspace) {
-    args.push("--workspace", workspace);
-  }
-  const created = runRailway(args, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (created.status !== 0 && !isRailwayAlreadyExistsMessage(created)) {
-    throw new Error(railwayMessage(created) || `railway ${args.join(" ")} failed`);
-  }
-  return null;
-}
-function ensureRailwayEnvironmentExists(service, { env = process.env } = {}) {
-  const environmentName = normalizeRailwayEnvironmentName(service?.railwayEnvironment);
-  if (!environmentName) {
-    return null;
-  }
-  const linkResult = runRailway(["environment", "link", environmentName, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (linkResult.status === 0) {
-    return linkResult;
-  }
-  const createResult = runRailway(["environment", "new", environmentName, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (createResult.status !== 0 && !isRailwayAlreadyExistsMessage(createResult)) {
-    throw new Error(railwayMessage(createResult) || `railway environment new ${environmentName} failed`);
-  }
-  const relinkResult = runRailway(["environment", "link", environmentName, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (relinkResult.status !== 0) {
-    throw new Error(railwayMessage(relinkResult) || `railway environment link ${environmentName} failed`);
-  }
-  return relinkResult;
-}
-function ensureRailwayServiceExists(service, { env = process.env } = {}) {
-  const serviceSelector = typeof (service?.serviceName ?? service?.serviceId) === "string" ? String(service.serviceName ?? service.serviceId).trim() : "";
-  if (!serviceSelector) {
-    throw new Error(`Railway service ${service?.key ?? "(unknown)"} is missing a service selector.`);
-  }
-  const statusArgs = ["service", "status", "--service", serviceSelector, "--environment", service.railwayEnvironment, "--json"];
-  const statusResult = runRailway(statusArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (statusResult.status === 0) {
-    return statusResult;
-  }
-  const createResult = runRailway(["add", "--service", serviceSelector, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (createResult.status !== 0 && !isRailwayAlreadyExistsMessage(createResult)) {
-    throw new Error(railwayMessage(createResult) || `railway add --service ${serviceSelector} failed`);
-  }
-  const refreshed = runRailway(statusArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (refreshed.status !== 0) {
-    throw new Error(railwayMessage(refreshed) || `railway service status --service ${serviceSelector} failed`);
-  }
-  return refreshed;
-}
-function ensureRailwayDatabaseServiceExists(service, {
-  database = "postgres",
-  env = process.env
-} = {}) {
-  const serviceSelector = typeof (service?.serviceName ?? service?.serviceId) === "string" ? String(service.serviceName ?? service.serviceId).trim() : "";
-  if (!serviceSelector) {
-    throw new Error(`Railway database service ${service?.key ?? "(unknown)"} is missing a service selector.`);
-  }
-  const projectSelector = typeof service?.projectId === "string" && service.projectId.trim() ? service.projectId.trim() : typeof service?.projectName === "string" && service.projectName.trim() ? service.projectName.trim() : "";
-  if (!projectSelector) {
-    throw new Error(`Railway database service ${service?.key ?? serviceSelector} is missing a project selector.`);
-  }
-  const linkArgs = ["link", "--project", projectSelector];
-  const workspace = resolveRailwayWorkspace(env);
-  if (workspace) {
-    linkArgs.push("--workspace", workspace);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service?.railwayEnvironment);
-  if (environmentName) {
-    linkArgs.push("--environment", environmentName);
-  }
-  const linkResult = runRailway(linkArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if ((linkResult.status ?? 1) !== 0) {
-    throw new Error(railwayMessage(linkResult) || `railway ${linkArgs.join(" ")} failed`);
-  }
-  const statusArgs = ["service", "status", "--service", serviceSelector, "--environment", service.railwayEnvironment, "--json"];
-  const statusResult = runRailway(statusArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (statusResult.status === 0) {
-    return statusResult;
-  }
-  const addResult = runRailway(["add", "--database", database, "--service", serviceSelector, "--json"], {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (addResult.status !== 0 && !isRailwayAlreadyExistsMessage(addResult)) {
-    throw new Error(railwayMessage(addResult) || `railway add --database ${database} --service ${serviceSelector} failed`);
-  }
-  const refreshed = runRailway(statusArgs, {
-    cwd: service.rootDir,
-    capture: true,
-    allowFailure: true,
-    env
-  });
-  if (refreshed.status !== 0) {
-    throw new Error(railwayMessage(refreshed) || `railway service status --service ${serviceSelector} failed`);
-  }
-  return refreshed;
-}
-function ensureRailwayProjectContext(service, { env = process.env, allowFailure = false, capture = false } = {}) {
-  ensureRailwayProjectExists(service, { env });
-  let projectSelector = service?.projectId ?? "";
-  if ((!projectSelector || !String(projectSelector).trim()) && service?.projectName) {
-    const listed = runRailway(["list", "--json"], {
-      cwd: service.rootDir,
-      capture: true,
-      allowFailure: true,
-      env
-    });
-    if (listed.status === 0) {
-      const match = normalizeRailwayProjectList(listed.stdout ?? "").find((entry) => entry.name === service.projectName || entry.id === service.projectName);
-      projectSelector = match?.id || match?.name || service.projectName;
-    } else {
-      projectSelector = service.projectName;
-    }
-  }
-  projectSelector = typeof projectSelector === "string" ? projectSelector.trim() : "";
-  if (typeof projectSelector !== "string" || projectSelector.trim().length === 0) {
-    throw new Error(`Railway service ${service?.key ?? service?.serviceName ?? service?.serviceId ?? "(unknown)"} is missing a project selector.`);
-  }
-  const args = ["link", "--project", projectSelector];
-  const workspace = resolveRailwayWorkspace(env);
-  if (workspace) {
-    args.push("--workspace", workspace);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service?.railwayEnvironment);
-  if (environmentName) {
-    args.push("--environment", environmentName);
-  }
-  runRailway(args, {
-    cwd: service.rootDir,
-    capture,
-    allowFailure,
-    env
-  });
-  if (environmentName) {
-    ensureRailwayEnvironmentExists(service, { env });
-    return runRailway(["environment", "link", environmentName, "--json"], {
-      cwd: service.rootDir,
-      capture,
-      allowFailure,
-      env
-    });
-  }
-  return null;
-}
-function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, application = null) {
+function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, application = null, machineConfigRoot = tenantRoot) {
   const normalizedScope = normalizeScope(scope);
+  const imageRefKeys = [
+    "TREESEED_API_IMAGE_REF",
+    "TREESEED_OPERATIONS_RUNNER_IMAGE_REF",
+    "TREESEED_AGENT_MANAGER_IMAGE_REF",
+    "TREESEED_AGENT_RUNNER_IMAGE_REF"
+  ];
+  let machineEnv = {};
+  try {
+    machineEnv = resolveTreeseedMachineEnvironmentValues(machineConfigRoot, normalizedScope, imageRefKeys);
+  } catch {
+    machineEnv = {};
+  }
+  const imageRefEnv = { ...process.env, ...machineEnv };
   let identity;
   try {
     identity = resolveTreeseedResourceIdentity(deployConfig, createPersistentDeployTarget(normalizedScope));
@@ -929,13 +639,14 @@ function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, app
   }
   const configuredOptionalServiceKeys = Object.keys(deployConfig.services ?? {}).filter((serviceKey) => RAILWAY_SERVICE_KEYS.includes(serviceKey));
   const serviceKeys = hostingKind === "hosted_project" ? [.../* @__PURE__ */ new Set([...HOSTED_PROJECT_SERVICE_KEYS, ...configuredOptionalServiceKeys])] : RAILWAY_SERVICE_KEYS;
-  return serviceKeys.flatMap((serviceKey) => {
+  const configuredServices = serviceKeys.flatMap((serviceKey) => {
     const service = deployConfig.services?.[serviceKey];
     if (!service || service.enabled === false || (service.provider ?? "railway") !== "railway") {
       return [];
     }
-    const defaultRootDir = ["api", "operationsRunner"].includes(serviceKey) ? "." : "packages/core";
-    const serviceRoot = resolve(tenantRoot, service.railway?.rootDir ?? service.rootDir ?? defaultRootDir);
+    const isCapacityProviderService = String(serviceKey).startsWith("capacityProvider");
+    const defaultRootDir = ["api", "operationsRunner"].includes(serviceKey) ? "." : isCapacityProviderService ? "packages/agent" : "packages/core";
+    const serviceRoot = isCapacityProviderService ? resolveRailwayCapacityProviderRoot(tenantRoot, service) : resolve(tenantRoot, service.railway?.rootDir ?? service.rootDir ?? defaultRootDir);
     const railwayEnvironment = resolveRailwayEnvironmentForScope(
       normalizedScope,
       service.environments?.[normalizedScope]?.railwayEnvironment
@@ -943,47 +654,233 @@ function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, app
     const publicBaseUrl = service.environments?.[normalizedScope]?.baseUrl ?? service.publicBaseUrl ?? null;
     const configuredServiceName = service.railway?.serviceName ?? (serviceKey === "workerRunner" ? deriveRailwayWorkerRunnerServiceName(identity.deploymentKey) : `${identity.deploymentKey}-${railwayServiceNameSuffix(serviceKey)}`);
     const configuredRunnerPool = service.railway?.runnerPool && typeof service.railway.runnerPool === "object" ? service.railway.runnerPool : null;
-    const runnerPool = serviceKey === "operationsRunner" ? {
-      bootstrapCount: Math.max(1, Number.parseInt(String(configuredRunnerPool?.bootstrapCount ?? OPERATIONS_RUNNER_BOOTSTRAP_COUNT), 10) || OPERATIONS_RUNNER_BOOTSTRAP_COUNT),
-      maxRunners: Math.max(1, Number.parseInt(String(configuredRunnerPool?.maxRunners ?? configuredRunnerPool?.bootstrapCount ?? OPERATIONS_RUNNER_BOOTSTRAP_COUNT), 10) || OPERATIONS_RUNNER_BOOTSTRAP_COUNT),
+    const runnerPool = serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? {
+      bootstrapCount: Math.max(1, Number.parseInt(String(configuredRunnerPool?.bootstrapCount ?? (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)), 10) || (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)),
+      maxRunners: Math.max(1, Number.parseInt(String(configuredRunnerPool?.maxRunners ?? configuredRunnerPool?.bootstrapCount ?? (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)), 10) || (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)),
       volumeMountPath: service.railway?.volumeMountPath ?? configuredRunnerPool?.volumeMountPath ?? WORKER_RUNNER_VOLUME_MOUNT_PATH
     } : serviceKey === "workerRunner" ? {
       bootstrapIndex: WORKER_RUNNER_BOOTSTRAP_INDEX,
       volumeMountPath: WORKER_RUNNER_VOLUME_MOUNT_PATH
     } : null;
-    const instanceCount = serviceKey === "operationsRunner" ? runnerPool.bootstrapCount : 1;
+    const instanceCount = serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? runnerPool.bootstrapCount : 1;
     return Array.from({ length: instanceCount }, (_, offset) => {
       const runnerIndex = offset + 1;
-      const serviceName = serviceKey === "operationsRunner" ? deriveRailwayOperationsRunnerServiceName(configuredServiceName, runnerIndex) : configuredServiceName;
+      const serviceName = serviceKey === "operationsRunner" ? deriveRailwayOperationsRunnerServiceName(configuredServiceName, runnerIndex) : serviceKey === "capacityProviderRunner" ? deriveRailwayCapacityProviderRunnerServiceName(configuredServiceName, runnerIndex) : configuredServiceName;
+      const configuredImageRefEnv = service.railway?.imageRefEnv ?? railwayImageRefEnvForService(serviceKey);
+      const imageRef = service.railway?.imageRef ?? (configuredImageRefEnv ? envValue(configuredImageRefEnv, imageRefEnv) || null : null) ?? defaultRailwayImageRef(serviceKey, normalizedScope, imageRefEnv);
+      const sourcePolicy = resolveRailwayServiceSourcePolicy({
+        tenantRoot,
+        scope: normalizedScope,
+        serviceKey,
+        service,
+        serviceRoot,
+        imageRef
+      });
+      const resolvedImageRef = sourcePolicy.sourceMode === "image" ? imageRef : null;
       return {
         key: serviceKey,
-        instanceKey: serviceKey === "operationsRunner" ? `${serviceKey}:${runnerIndex}` : serviceKey,
-        runnerIndex: serviceKey === "operationsRunner" ? runnerIndex : null,
+        instanceKey: serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? `${serviceKey}:${runnerIndex}` : serviceKey,
+        runnerIndex: serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? runnerIndex : null,
         serviceConfig: service,
         scope: normalizedScope,
         projectId: service.railway?.projectId ?? null,
         projectName: service.railway?.projectName ?? identity.deploymentKey,
         serviceId: service.railway?.serviceId ?? null,
         serviceName,
-        runnerId: serviceKey === "operationsRunner" ? serviceName : null,
+        runnerId: serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? serviceName : null,
         rootDir: serviceRoot,
         publicBaseUrl,
         railwayEnvironment,
-        buildCommand: service.railway?.buildCommand ?? null,
-        startCommand: service.railway?.startCommand ?? null,
+        buildCommand: resolvedImageRef ? null : service.railway?.buildCommand ?? null,
+        startCommand: isCapacityProviderService ? null : resolvedImageRef ? null : service.railway?.startCommand ?? null,
+        imageRef: resolvedImageRef,
+        sourceMode: sourcePolicy.sourceMode,
+        sourceRepo: sourcePolicy.sourceRepo,
+        sourceBranch: sourcePolicy.sourceBranch,
+        sourceCommit: sourcePolicy.sourceCommit,
+        sourceRootDirectory: sourcePolicy.sourceRootDirectory,
+        dockerfilePath: sourcePolicy.sourceMode === "git" ? service.railway?.dockerfilePath ?? null : null,
         healthcheckPath: service.railway?.healthcheckPath ?? null,
         healthcheckTimeoutSeconds: service.railway?.healthcheckTimeoutSeconds ?? null,
         healthcheckIntervalSeconds: service.railway?.healthcheckIntervalSeconds ?? null,
         restartPolicy: service.railway?.restartPolicy ?? null,
         runtimeMode: service.railway?.runtimeMode ?? null,
-        volumeMountPath: serviceKey === "operationsRunner" ? runnerPool.volumeMountPath : service.railway?.volumeMountPath ?? null,
+        volumeMountPath: serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? runnerPool.volumeMountPath : service.railway?.volumeMountPath ?? null,
         schedule: normalizeScheduleExpressions(service.railway?.schedule),
         hostingKind,
         runnerPool,
-        application
+        application,
+        secretRefs: Array.isArray(service.secretRefs) ? service.secretRefs : [],
+        variableRefs: Array.isArray(service.variableRefs) ? service.variableRefs : []
       };
     });
   }).filter(Boolean);
+  return [
+    ...configuredServices,
+    ...configuredPublicTreeDxRailwayServices({
+      tenantRoot,
+      scope: normalizedScope,
+      deployConfig,
+      identity,
+      hostingKind,
+      application,
+      imageRefEnv,
+      workspaceRoot: machineConfigRoot
+    })
+  ];
+}
+function configuredPublicTreeDxRailwayServices({ tenantRoot, scope, deployConfig, identity, hostingKind, application, imageRefEnv, workspaceRoot }) {
+  if (deployConfig.hosting?.kind !== "treeseed_control_plane") {
+    return [];
+  }
+  const railway = deployConfig.publicTreeDxFederation?.railway ?? {};
+  const nodePool = railway.nodePool && typeof railway.nodePool === "object" && !Array.isArray(railway.nodePool) ? railway.nodePool : {};
+  const bootstrapCount = Math.max(0, Number.parseInt(String(nodePool.bootstrapCount ?? 1), 10) || 0);
+  if (bootstrapCount <= 0) {
+    return [];
+  }
+  const configuredSource = railway.source && typeof railway.source === "object" && !Array.isArray(railway.source) ? railway.source : {};
+  const treeDxRoot = resolve(workspaceRoot ?? tenantRoot, "packages", "treedx");
+  const configuredMode = typeof railway.sourceMode === "string" ? railway.sourceMode : null;
+  const sourceMode = scope === "prod" ? "image" : configuredMode === "git" || configuredMode === "image" ? configuredMode : "git";
+  const repository = typeof railway.sourceRepo === "string" ? railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : readTreeseedPackageRepository(treeDxRoot) ?? "treeseed-ai/treedx";
+  const sourceBranch = typeof railway.sourceBranch === "string" ? railway.sourceBranch : typeof configuredSource.branch === "string" ? configuredSource.branch : scope === "staging" ? "staging" : null;
+  const sourceRootDirectory = typeof railway.sourceRootDirectory === "string" ? railway.sourceRootDirectory : typeof configuredSource.rootDirectory === "string" ? configuredSource.rootDirectory : ".";
+  const projectName = typeof railway.projectName === "string" && railway.projectName.trim() ? railway.projectName.trim() : typeof imageRefEnv.TREESEED_PUBLIC_TREEDX_RAILWAY_PROJECT_NAME === "string" && imageRefEnv.TREESEED_PUBLIC_TREEDX_RAILWAY_PROJECT_NAME.trim() ? imageRefEnv.TREESEED_PUBLIC_TREEDX_RAILWAY_PROJECT_NAME.trim() : identity.deploymentKey;
+  const railwayEnvironment = resolveRailwayEnvironmentForScope(scope, railway.environmentName);
+  const baseImageRef = envValue("TREESEED_PUBLIC_TREEDX_IMAGE_REF", imageRefEnv) || "treeseed/treedx";
+  return Array.from({ length: bootstrapCount }, (_, offset) => {
+    const index = offset + 1;
+    const serviceName = `${PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX}${String(index).padStart(2, "0")}`;
+    return {
+      key: serviceName,
+      instanceKey: serviceName,
+      runnerIndex: null,
+      serviceConfig: null,
+      scope,
+      projectId: typeof railway.projectId === "string" ? railway.projectId : null,
+      projectName,
+      serviceId: typeof railway.serviceId === "string" && bootstrapCount === 1 ? railway.serviceId : null,
+      serviceName,
+      runnerId: null,
+      rootDir: treeDxRoot,
+      publicBaseUrl: null,
+      railwayEnvironment,
+      buildCommand: sourceMode === "git" ? railway.buildCommand ?? null : null,
+      startCommand: sourceMode === "git" ? railway.startCommand ?? null : null,
+      imageRef: sourceMode === "image" ? baseImageRef : null,
+      sourceMode,
+      sourceRepo: sourceMode === "git" ? repository : null,
+      sourceBranch: sourceMode === "git" ? sourceBranch : null,
+      sourceCommit: sourceMode === "git" ? headCommitSafe(treeDxRoot) ?? headCommitSafe(tenantRoot) : null,
+      sourceRootDirectory: sourceMode === "git" ? sourceRootDirectory : null,
+      dockerfilePath: sourceMode === "git" ? railway.dockerfilePath ?? "/Dockerfile" : null,
+      healthcheckPath: railway.healthcheckPath ?? null,
+      healthcheckTimeoutSeconds: railway.healthcheckTimeoutSeconds ?? null,
+      healthcheckIntervalSeconds: railway.healthcheckIntervalSeconds ?? null,
+      restartPolicy: railway.restartPolicy ?? null,
+      runtimeMode: railway.runtimeMode ?? "replicated",
+      volumeMountPath: railway.volumeMountPath ?? "/data",
+      schedule: [],
+      hostingKind,
+      runnerPool: null,
+      application,
+      environmentVariables: {
+        PORT: "4000",
+        TREEDX_DATA_DIR: railway.volumeMountPath ?? "/data",
+        TREEDX_AUTH_MODE: "connected",
+        TREEDX_AUTH_VERIFIER: "hs256_dev",
+        TREEDX_ALLOW_DEV_VERIFIER_IN_PROD: "true",
+        TREEDX_EXEC_BACKEND: "container_sandbox",
+        TREEDX_FEDERATION_MODE: "connected_library",
+        TREEDX_JWT_AUDIENCE: "treedx-public-federation",
+        TREEDX_JWT_ISSUER: "https://api.treeseed.local/treedx",
+        TREEDX_BOOTSTRAP_TRUST_ACTOR_ID: "treeseed-api",
+        TREEDX_BOOTSTRAP_TRUST_TENANT_ID: "treeseed-control-plane",
+        TREEDX_BOOTSTRAP_TRUST_REPO_IDS: "*",
+        TREEDX_BOOTSTRAP_TRUST_REFS: "*",
+        TREEDX_BOOTSTRAP_TRUST_PATHS: "**",
+        TREEDX_SCOPE: "public_federation"
+      },
+      secretRefs: ["TREEDX_SECRET_KEY_BASE", "TREEDX_ADMIN_TOKEN", "TREEDX_JWT_HS256_SECRET"],
+      variableRefs: [
+        "PORT",
+        "TREEDX_DATA_DIR",
+        "TREEDX_AUTH_MODE",
+        "TREEDX_AUTH_VERIFIER",
+        "TREEDX_ALLOW_DEV_VERIFIER_IN_PROD",
+        "TREEDX_EXEC_BACKEND",
+        "TREEDX_FEDERATION_MODE",
+        "TREEDX_JWT_AUDIENCE",
+        "TREEDX_JWT_ISSUER",
+        "TREEDX_BOOTSTRAP_TRUST_ACTOR_ID",
+        "TREEDX_BOOTSTRAP_TRUST_TENANT_ID",
+        "TREEDX_BOOTSTRAP_TRUST_REPO_IDS",
+        "TREEDX_BOOTSTRAP_TRUST_REFS",
+        "TREEDX_BOOTSTRAP_TRUST_PATHS",
+        "TREEDX_SCOPE"
+      ]
+    };
+  });
+}
+function readTreeseedPackageRepository(packageRoot) {
+  const manifestPath = resolve(packageRoot, "treeseed.package.yaml");
+  if (!existsSync(manifestPath)) return null;
+  try {
+    const manifest = parseYaml(readFileSync(manifestPath, "utf8"));
+    const repository = manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest.repository : null;
+    return typeof repository === "string" && /^[^/\s]+\/[^/\s]+$/u.test(repository.trim()) ? repository.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function headCommitSafe(cwd) {
+  try {
+    return runTreeseedGitText(["rev-parse", "HEAD"], {
+      cwd,
+      mode: classifyTreeseedGitMode(["rev-parse", "HEAD"])
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function resolveRailwayServiceSourcePolicy({ tenantRoot, scope, serviceKey, service, serviceRoot, imageRef }) {
+  const configuredMode = typeof service.railway?.sourceMode === "string" ? service.railway.sourceMode : null;
+  const configuredSource = service.railway?.source && typeof service.railway.source === "object" && !Array.isArray(service.railway.source) ? service.railway.source : {};
+  const configuredRepo = typeof service.railway?.sourceRepo === "string" ? service.railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : null;
+  const packageRepository = configuredRepo ?? readTreeseedPackageRepository(serviceRoot) ?? readTreeseedPackageRepository(tenantRoot);
+  const sourceEligible = ["api", "operationsRunner", "capacityProviderManager", "capacityProviderRunner"].includes(serviceKey);
+  const sourceMode = scope === "prod" ? "image" : configuredMode === "git" || configuredMode === "image" ? configuredMode : imageRef ? "image" : scope === "staging" && sourceEligible && packageRepository ? "git" : "git";
+  if (sourceMode !== "git") {
+    return {
+      sourceMode: "image",
+      sourceRepo: null,
+      sourceBranch: null,
+      sourceCommit: null,
+      sourceRootDirectory: null
+    };
+  }
+  return {
+    sourceMode: "git",
+    sourceRepo: packageRepository,
+    sourceBranch: typeof service.railway?.sourceBranch === "string" ? service.railway.sourceBranch : typeof configuredSource.branch === "string" ? configuredSource.branch : scope === "staging" ? "staging" : null,
+    sourceCommit: headCommitSafe(serviceRoot),
+    sourceRootDirectory: typeof service.railway?.sourceRootDirectory === "string" ? service.railway.sourceRootDirectory : typeof configuredSource.rootDirectory === "string" ? configuredSource.rootDirectory : "."
+  };
+}
+function resolveRailwayCapacityProviderRoot(tenantRoot, service) {
+  if (service.railway?.rootDir) {
+    return resolve(tenantRoot, service.railway.rootDir);
+  }
+  const candidates = [
+    resolve(tenantRoot, "..", "agent"),
+    resolve(tenantRoot, "packages", "agent"),
+    resolve(tenantRoot, "..", "..", "packages", "agent")
+  ];
+  const found = candidates.find(
+    (candidate) => existsSync(resolve(candidate, "treeseed.package.yaml")) || existsSync(resolve(candidate, "package.json"))
+  );
+  return found ?? resolve(tenantRoot, "packages", "agent");
 }
 function configuredRailwayServices(tenantRoot, scope) {
   const deployConfig = loadCliDeployConfig(tenantRoot);
@@ -996,7 +893,8 @@ function configuredRailwayServices(tenantRoot, scope) {
       id: application.id,
       root: application.root,
       relativeRoot: application.relativeRoot
-    }
+    },
+    tenantRoot
   ));
   return [...direct, ...nested];
 }
@@ -1094,7 +992,11 @@ function validateRailwayServiceConfiguration(tenantRoot, scope) {
     if (!service.projectName && !service.projectId) {
       issues.push(`${service.key}: set railway.projectName or railway.projectId in treeseed.site.yaml.`);
     }
-    if (!existsSync(service.rootDir)) {
+    if (service.sourceMode === "git" && !service.sourceRepo) {
+      issues.push(`${service.key}: staging source builds require railway.source.repository or package repository metadata.`);
+    }
+    const usesExternalGitSource = service.sourceMode === "git" && Boolean(service.sourceRepo);
+    if (!service.imageRef && !usesExternalGitSource && !existsSync(service.rootDir)) {
       issues.push(`${service.key}: service root ${service.rootDir} does not exist.`);
     }
     if (service.schedule?.length && !service.startCommand) {
@@ -1116,7 +1018,7 @@ function validateRailwayDeployPrerequisites(tenantRoot, scope, { env = process.e
   const validation = validateRailwayServiceConfiguration(tenantRoot, scope);
   const token = resolveRailwayAuthToken(env);
   if (typeof token !== "string" || token.trim().length === 0) {
-    throw new Error("Configure RAILWAY_API_TOKEN before deploying Railway-managed services.");
+    throw new Error("Configure TREESEED_RAILWAY_API_TOKEN before deploying Railway-managed services.");
   }
   return validation;
 }
@@ -1128,7 +1030,7 @@ async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, f
   const effectiveApiToken = apiToken || resolveRailwayAuthToken(env);
   const effectiveApiUrl = apiUrl || resolveRailwayApiUrl(env);
   if (typeof effectiveApiToken !== "string" || effectiveApiToken.trim().length === 0) {
-    throw new Error("Configure RAILWAY_API_TOKEN before deploying Railway-managed services.");
+    throw new Error("Configure TREESEED_RAILWAY_API_TOKEN before deploying Railway-managed services.");
   }
   const results = [];
   try {
@@ -1154,7 +1056,7 @@ async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, f
       const current = await getRailwayServiceInstance({
         serviceId: target.service.id,
         environmentId: target.environment.id,
-        env: { ...env, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
+        env: { ...env, TREESEED_RAILWAY_API_TOKEN: effectiveApiToken, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
         fetchImpl
       });
       const desired = {
@@ -1184,7 +1086,7 @@ async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, f
         environmentId: target.environment.id,
         startCommand: desired.command,
         cronSchedule: desired.schedule,
-        env: { ...env, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
+        env: { ...env, TREESEED_RAILWAY_API_TOKEN: effectiveApiToken, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
         fetchImpl
       });
       results.push({
@@ -1214,7 +1116,7 @@ async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, f
   return results;
 }
 async function verifyRailwayScheduledJobs(tenantRoot, scope, { fetchImpl = fetch, apiToken, apiUrl, env = process.env } = {}) {
-  const effectiveApiToken = apiToken || env?.RAILWAY_API_TOKEN;
+  const effectiveApiToken = apiToken || resolveRailwayAuthToken(env);
   const effectiveApiUrl = apiUrl || resolveRailwayApiUrl(env);
   const configured = configuredRailwayScheduledJobs(tenantRoot, scope);
   const checks = [];
@@ -1238,7 +1140,7 @@ async function verifyRailwayScheduledJobs(tenantRoot, scope, { fetchImpl = fetch
       const existing = await getRailwayServiceInstance({
         serviceId: target.service.id,
         environmentId: target.environment.id,
-        env: { ...env, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
+        env: { ...env, TREESEED_RAILWAY_API_TOKEN: effectiveApiToken, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl },
         fetchImpl
       });
       checks.push({
@@ -1293,7 +1195,7 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
 } = {}) {
   const effectiveApiToken = apiToken || resolveRailwayAuthToken(env);
   const effectiveApiUrl = apiUrl || resolveRailwayApiUrl(env);
-  const effectiveEnv = { ...env, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl };
+  const effectiveEnv = { ...env, TREESEED_RAILWAY_API_TOKEN: effectiveApiToken, RAILWAY_API_TOKEN: effectiveApiToken, TREESEED_RAILWAY_API_URL: effectiveApiUrl };
   const services = configuredRailwayServices(tenantRoot, scope);
   const checks = [];
   const deploymentStatusServices = [];
@@ -1353,18 +1255,19 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
       } : null,
       message: instance.id ? void 0 : `Railway service instance for ${target.service.name} is missing in ${target.environment.name}.`
     });
-    if (service.key === "workerRunner") {
-      const expectedVolumeName = deriveRailwayWorkerRunnerVolumeName(target.service.name, target.environment.name);
+    const expectedVolumeMountPath = service.volumeMountPath ?? service.runnerPool?.volumeMountPath ?? null;
+    if (expectedVolumeMountPath) {
+      const expectedVolumeName = service.key === "operationsRunner" ? deriveRailwayOperationsRunnerVolumeName(target.service.name, target.environment.name) : service.key === "capacityProviderRunner" ? deriveRailwayCapacityProviderRunnerVolumeName(target.service.name, target.environment.name) : deriveRailwayWorkerRunnerVolumeName(target.service.name, target.environment.name);
       const volumes = await listRailwayVolumes({
         projectId: target.project.id,
         env: effectiveEnv,
         fetchImpl
       });
       const volume = volumes.find(
-        (candidate) => candidate.name === expectedVolumeName && candidate.instances.some((entry) => entry.serviceId === target.service.id && entry.environmentId === target.environment.id && entry.mountPath === WORKER_RUNNER_VOLUME_MOUNT_PATH)
+        (candidate) => candidate.name === expectedVolumeName && candidate.instances.some((entry) => entry.serviceId === target.service.id && entry.environmentId === target.environment.id && entry.mountPath === expectedVolumeMountPath)
       ) ?? null;
       checks.push({
-        type: "worker-runner-volume",
+        type: "service-volume",
         service: service.key,
         serviceName: target.service.name,
         serviceId: target.service.id,
@@ -1372,7 +1275,7 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
         environment: target.environment.name,
         environmentId: target.environment.id,
         volumeName: expectedVolumeName,
-        mountPath: WORKER_RUNNER_VOLUME_MOUNT_PATH,
+        mountPath: expectedVolumeMountPath,
         ok: Boolean(volume),
         status: volume ? "checked" : "missing",
         observed: volume ? {
@@ -1380,7 +1283,7 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
           name: volume.name,
           instances: volume.instances
         } : null,
-        message: volume ? void 0 : `Railway worker-runner volume ${expectedVolumeName} is missing or is not mounted at ${WORKER_RUNNER_VOLUME_MOUNT_PATH}.`
+        message: volume ? void 0 : `Railway volume ${expectedVolumeName} is missing or is not mounted on ${target.service.name} at ${expectedVolumeMountPath}.`
       });
     }
   }
@@ -1414,30 +1317,6 @@ async function verifyRailwayManagedResources(tenantRoot, scope, {
     checks
   };
 }
-function shouldAttachRailwayDeployLogs(env = process.env) {
-  const configured = configuredEnvValue(env, "TREESEED_RAILWAY_DEPLOY_ATTACH_LOGS");
-  if (configured === "1" || configured === "true") {
-    return true;
-  }
-  if (configured === "0" || configured === "false") {
-    return false;
-  }
-  return false;
-}
-function shouldUseVerboseRailwayDeploy(env = process.env) {
-  const configured = configuredEnvValue(env, "TREESEED_RAILWAY_DEPLOY_VERBOSE");
-  if (configured === "1" || configured === "true") {
-    return true;
-  }
-  if (configured === "0" || configured === "false") {
-    return false;
-  }
-  return shouldAttachRailwayDeployLogs(env);
-}
-function railwayDeployCommandTimeoutMs(env = process.env) {
-  const configured = Number.parseInt(configuredEnvValue(env, "TREESEED_RAILWAY_DEPLOY_COMMAND_TIMEOUT_MS"), 10);
-  return Number.isFinite(configured) && configured > 0 ? configured : 3e5;
-}
 function railwayPhaseTimeoutMs(env = process.env, phase = "default") {
   const configured = Number.parseInt(configuredEnvValue(env, `TREESEED_RAILWAY_${String(phase).toUpperCase().replace(/[^A-Z0-9]+/gu, "_")}_TIMEOUT_MS`), 10);
   if (Number.isFinite(configured) && configured > 0) {
@@ -1467,10 +1346,6 @@ async function withRailwayPhaseTimeout(run, timeoutMs, message) {
     }
   }
 }
-function shouldIncludeRailwayIgnoredFiles(env = process.env) {
-  const configured = configuredEnvValue(env, "TREESEED_RAILWAY_DEPLOY_INCLUDE_IGNORED");
-  return configured === "1" || configured === "true";
-}
 function shouldRunRailwayPredeployBuild(env = process.env) {
   const configured = configuredEnvValue(env, "TREESEED_RAILWAY_PREDEPLOY_BUILD");
   if (configured === "1" || configured === "true") {
@@ -1481,56 +1356,6 @@ function shouldRunRailwayPredeployBuild(env = process.env) {
   }
   return configuredEnvValue(env, "CI") !== "true";
 }
-function planRailwayServiceDeploy(service, { env = process.env, projectTokenMode = false } = {}) {
-  const serviceSelector = service.serviceName ?? service.serviceId;
-  const args = ["up"];
-  if (serviceSelector) {
-    args.push("--service", serviceSelector);
-  }
-  if (shouldIncludeRailwayIgnoredFiles(env)) {
-    args.push("--no-gitignore");
-  }
-  args.push(shouldAttachRailwayDeployLogs(env) ? "--ci" : "--detach");
-  if (shouldUseVerboseRailwayDeploy(env)) {
-    args.push("--verbose");
-  }
-  if (!projectTokenMode && service.projectId) {
-    args.push("--project", service.projectId);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
-  if (!projectTokenMode && environmentName) {
-    args.push("--environment", environmentName);
-  }
-  return {
-    command: "railway",
-    args,
-    cwd: service.rootDir
-  };
-}
-function planRailwayProjectEnvironmentLink(service) {
-  const args = ["link"];
-  if (service.projectId) {
-    args.push("--project", service.projectId);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
-  if (environmentName) {
-    args.push("--environment", environmentName);
-  }
-  args.push("--json");
-  return {
-    command: "railway",
-    args,
-    cwd: service.rootDir
-  };
-}
-function buildRailwayCliContextEnv(env, service) {
-  return {
-    ...env,
-    RAILWAY_PROJECT_ID: configuredEnvValue(service, "projectId") || configuredEnvValue(env, "RAILWAY_PROJECT_ID") || void 0,
-    RAILWAY_ENVIRONMENT_ID: configuredEnvValue(service, "environmentId") || configuredEnvValue(env, "RAILWAY_ENVIRONMENT_ID") || void 0,
-    RAILWAY_SERVICE_ID: configuredEnvValue(service, "serviceId") || configuredEnvValue(env, "RAILWAY_SERVICE_ID") || void 0
-  };
-}
 async function syncRailwayApiDeviceLoginVariables(service, env, write, prefix) {
   if (service.key !== "api") {
     return null;
@@ -1545,7 +1370,7 @@ async function syncRailwayApiDeviceLoginVariables(service, env, write, prefix) {
     [
       "TREESEED_API_AUTH_APPROVAL_BASE_URL",
       "TREESEED_SITE_URL",
-      "BETTER_AUTH_URL"
+      "TREESEED_BETTER_AUTH_URL"
     ].map((key) => [key, configuredEnvValue(env, key)]).filter(([, value]) => value)
   );
   if (Object.keys(variables).length === 0) {
@@ -1561,166 +1386,6 @@ async function syncRailwayApiDeviceLoginVariables(service, env, write, prefix) {
   write ? write(`[${prefix.scope}][${prefix.system}][${prefix.task}][vars] Synced device login approval URL variables for ${service.serviceName ?? serviceId}.`, "stdout") : null;
   return { variables: Object.keys(variables) };
 }
-function buildRailwayLinkCommandEnv(env = process.env, service = {}) {
-  return buildRailwayCliContextEnv({
-    ...buildRailwayDeployCommandEnv({ ...env, RAILWAY_TOKEN: void 0 }),
-    RAILWAY_TOKEN: void 0
-  }, service);
-}
-function railwayCliConfigPath(env = process.env) {
-  const railwayHome = configuredEnvValue(env, "RAILWAY_HOME");
-  if (railwayHome) {
-    return resolve(railwayHome, "config.json");
-  }
-  const home = configuredEnvValue(env, "HOME");
-  if (!home) {
-    return "";
-  }
-  return resolve(home, ".railway", "config.json");
-}
-function readRailwayCliConfig(configPath) {
-  if (!configPath || !existsSync(configPath)) {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(readFileSync(configPath, "utf8"));
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function writeRailwayCliProjectConfig(service, { env = process.env, cwd = service.rootDir } = {}) {
-  const projectId = configuredEnvValue(service, "projectId");
-  const environmentId = configuredEnvValue(service, "environmentId");
-  const serviceId = configuredEnvValue(service, "serviceId");
-  const projectPath = cwd ? resolve(cwd) : "";
-  const configPath = railwayCliConfigPath(env);
-  if (!configPath || !projectPath || !projectId || !environmentId || !serviceId) {
-    return null;
-  }
-  const existing = readRailwayCliConfig(configPath);
-  const projects = existing.projects && typeof existing.projects === "object" ? existing.projects : {};
-  const next = {
-    ...existing,
-    projects: {
-      ...projects,
-      [projectPath]: {
-        projectPath,
-        name: configuredEnvValue(service, "projectName") || configuredEnvValue(service, "serviceName") || projectId,
-        project: projectId,
-        environment: environmentId,
-        environmentName: normalizeRailwayEnvironmentName(service.railwayEnvironment) || configuredEnvValue(service, "environmentName") || environmentId,
-        service: serviceId
-      }
-    },
-    user: existing.user && typeof existing.user === "object" ? existing.user : {
-      token: null,
-      accessToken: null,
-      refreshToken: null,
-      tokenExpiresAt: null
-    },
-    linkedFunctions: existing.linkedFunctions ?? null
-  };
-  mkdirSync(dirname(configPath), { recursive: true });
-  writeFileSync(configPath, `${JSON.stringify(next, null, 2)}
-`, "utf8");
-  return {
-    configPath,
-    projectPath,
-    projectId,
-    environmentId,
-    serviceId
-  };
-}
-function planRailwayServiceLink(service, { env = process.env } = {}) {
-  const args = ["link"];
-  if (service.projectId) {
-    args.push("--project", service.projectId);
-  }
-  const workspace = resolveRailwayWorkspace(env);
-  if (workspace) {
-    args.push("--workspace", workspace);
-  }
-  const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
-  if (environmentName) {
-    args.push("--environment", environmentName);
-  }
-  const serviceSelector = service.serviceName ?? service.serviceId;
-  if (serviceSelector) {
-    args.push("--service", serviceSelector);
-  }
-  args.push("--json");
-  return {
-    command: "railway",
-    args,
-    cwd: service.rootDir
-  };
-}
-function railwayProjectTokenName(service) {
-  const environment = normalizeRailwayEnvironmentName(service.railwayEnvironment) || "environment";
-  const serviceName = String(service.serviceName ?? service.serviceId ?? service.key ?? "service").toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 48) || "service";
-  return `treeseed-ci-${environment}-${serviceName}`;
-}
-async function createRailwayCliProjectToken(service, { env = process.env } = {}) {
-  const projectId = configuredEnvValue(service, "projectId");
-  const environmentId = configuredEnvValue(service, "environmentId");
-  if (!projectId || !environmentId) {
-    return "";
-  }
-  const name = railwayProjectTokenName(service);
-  try {
-    const existingPayload = await railwayGraphqlRequest({
-      query: `
-query TreeseedProjectTokens($projectId: String!) {
-	projectTokens(projectId: $projectId, first: 100) {
-		edges {
-			node {
-				id
-				name
-				projectId
-				environmentId
-			}
-		}
-	}
-}
-`.trim(),
-      variables: { projectId },
-      env
-    });
-    const existingTokens = railwayEdgeNodes(existingPayload.data?.projectTokens);
-    for (const token2 of existingTokens) {
-      if (token2?.name === name && token2?.projectId === projectId && token2?.environmentId === environmentId && token2?.id) {
-        await railwayGraphqlRequest({
-          query: `
-mutation TreeseedProjectTokenDelete($id: String!) {
-	projectTokenDelete(id: $id)
-}
-`.trim(),
-          variables: { id: token2.id },
-          env
-        });
-      }
-    }
-  } catch {
-  }
-  const payload = await railwayGraphqlRequest({
-    query: `
-mutation TreeseedProjectTokenCreate($input: ProjectTokenCreateInput!) {
-	projectTokenCreate(input: $input)
-}
-`.trim(),
-    variables: {
-      input: {
-        projectId,
-        environmentId,
-        name
-      }
-    },
-    env
-  });
-  const token = payload.data?.projectTokenCreate;
-  return typeof token === "string" && token.trim() ? token.trim() : "";
-}
 async function resolveRailwayDeployProjectContext(service, { env = process.env } = {}) {
   if (service.projectId) {
     return service;
@@ -1745,8 +1410,8 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
       writePhase(`sync-runtime-config:${stage}`, message);
     }
   };
-  const wantsInstanceConfig = service.buildCommand || service.startCommand || service.rootDir || service.healthcheckPath || service.healthcheckTimeoutSeconds !== null || service.healthcheckTimeoutSeconds !== void 0 || service.healthcheckIntervalSeconds !== null || service.healthcheckIntervalSeconds !== void 0 || service.restartPolicy || service.runtimeMode;
-  const wantsRunnerVolume = service.key === "workerRunner" || Boolean(service.volumeMountPath);
+  const wantsInstanceConfig = service.buildCommand || service.startCommand || !(service.imageRef || service.sourceMode === "image") && service.rootDir || service.healthcheckPath || service.healthcheckTimeoutSeconds !== null || service.healthcheckTimeoutSeconds !== void 0 || service.healthcheckIntervalSeconds !== null || service.healthcheckIntervalSeconds !== void 0 || service.restartPolicy || service.runtimeMode;
+  const wantsRunnerVolume = service.key === "workerRunner" || service.key === "operationsRunner" || service.key === "capacityProviderRunner";
   if (!wantsInstanceConfig && !wantsRunnerVolume) {
     writeSyncPhase("skip", "No runtime configuration changes requested.");
     return null;
@@ -1794,6 +1459,21 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
       projectId: project.id,
       serviceId: service.serviceId,
       serviceName: service.serviceName,
+      environmentId: environment.id,
+      imageRef: service.imageRef,
+      sourceRepo: service.sourceRepo,
+      sourceBranch: service.sourceBranch,
+      env
+    }).then((result) => result.service);
+  } else if (service.imageRef) {
+    railwayService = await ensureRailwayService({
+      projectId: project.id,
+      serviceId: service.serviceId,
+      serviceName: service.serviceName,
+      environmentId: environment.id,
+      imageRef: service.imageRef,
+      sourceRepo: service.sourceRepo,
+      sourceBranch: service.sourceBranch,
       env
     }).then((result) => result.service);
   }
@@ -1806,7 +1486,7 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
     buildCommand: service.buildCommand,
     startCommand: railwayServiceRuntimeStartCommand(service),
     cronSchedule: service.schedule?.[0] ?? null,
-    rootDirectory: ".",
+    rootDirectory: service.imageRef || service.sourceMode === "image" ? null : service.sourceRootDirectory ?? ".",
     healthcheckPath: service.healthcheckPath,
     healthcheckTimeoutSeconds: service.healthcheckTimeoutSeconds,
     healthcheckIntervalSeconds: service.healthcheckIntervalSeconds,
@@ -1822,6 +1502,14 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
     serviceId: railwayService.id,
     variables: {
       TREESEED_SKIP_PACKAGE_PREPARE: "1",
+      ...service.sourceMode === "git" ? {
+        TREESEED_DEPLOY_SOURCE_MODE: "git",
+        ...service.sourceRepo ? { TREESEED_DEPLOY_SOURCE_REPOSITORY: service.sourceRepo } : {},
+        ...service.sourceBranch ? { TREESEED_DEPLOY_SOURCE_BRANCH: service.sourceBranch } : {},
+        ...service.sourceCommit ? { TREESEED_DEPLOY_SOURCE_COMMIT: service.sourceCommit } : {}
+      } : {
+        TREESEED_DEPLOY_SOURCE_MODE: "image"
+      },
       ...service.key === "operationsRunner" ? {
         NIXPACKS_APT_PKGS: "git",
         NIXPACKS_PKGS: "git",
@@ -1829,12 +1517,25 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
         TREESEED_PLATFORM_RUNNER_DATA_DIR: service.volumeMountPath ?? WORKER_RUNNER_VOLUME_MOUNT_PATH,
         TREESEED_PLATFORM_RUNNER_ENVIRONMENT: normalizeScope(service.scope) === "prod" ? "production" : normalizeScope(service.scope),
         TREESEED_MANAGER_ID: normalizeScope(service.scope),
-        ...configuredEnvValue(env, "RAILWAY_API_TOKEN") ? { RAILWAY_API_TOKEN: configuredEnvValue(env, "RAILWAY_API_TOKEN") } : {},
+        ...configuredEnvValue(env, "TREESEED_RAILWAY_API_TOKEN") ? { TREESEED_RAILWAY_API_TOKEN: configuredEnvValue(env, "TREESEED_RAILWAY_API_TOKEN") } : {},
         ...configuredEnvValue(env, "TREESEED_RAILWAY_WORKSPACE") ? { TREESEED_RAILWAY_WORKSPACE: configuredEnvValue(env, "TREESEED_RAILWAY_WORKSPACE") } : {},
         ...configuredEnvValue(env, "TREESEED_PLATFORM_RUNNER_SECRET") ? { TREESEED_PLATFORM_RUNNER_SECRET: configuredEnvValue(env, "TREESEED_PLATFORM_RUNNER_SECRET") } : {},
         ...configuredEnvValue(env, "TREESEED_API_BASE_URL") || configuredEnvValue(env, "TREESEED_URL") ? {
           TREESEED_API_BASE_URL: configuredEnvValue(env, "TREESEED_API_BASE_URL") || configuredEnvValue(env, "TREESEED_URL")
         } : {}
+      } : {},
+      ...String(service.key).startsWith("capacityProvider") ? {
+        TREESEED_PROVIDER_ENVIRONMENT: normalizeScope(service.scope) === "prod" ? "production" : normalizeScope(service.scope),
+        TREESEED_MANAGER_ID: normalizeScope(service.scope),
+        TREESEED_MARKET_ID: normalizeScope(service.scope),
+        TREESEED_PROVIDER_ROLE: service.key === "capacityProviderManager" ? "manager" : "runner",
+        ...service.key === "capacityProviderRunner" ? {
+          TREESEED_PROVIDER_DATA_DIR: service.volumeMountPath ?? WORKER_RUNNER_VOLUME_MOUNT_PATH,
+          TREESEED_PROVIDER_RUNNER_ID: service.runnerId ?? railwayService.name
+        } : {},
+        ...configuredEnvValue(env, "TREESEED_MARKET_URL") ? { TREESEED_MARKET_URL: configuredEnvValue(env, "TREESEED_MARKET_URL") } : {},
+        ...configuredEnvValue(env, "TREESEED_CAPACITY_PROVIDER_API_KEY") ? { TREESEED_CAPACITY_PROVIDER_API_KEY: configuredEnvValue(env, "TREESEED_CAPACITY_PROVIDER_API_KEY") } : {},
+        ...configuredEnvValue(env, "TREESEED_CODEX_AUTH_JSON_B64") ? { TREESEED_CODEX_AUTH_JSON_B64: configuredEnvValue(env, "TREESEED_CODEX_AUTH_JSON_B64") } : {}
       } : {}
     },
     env
@@ -1847,7 +1548,7 @@ async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, ser
     projectId: project.id,
     environmentId: environment.id,
     serviceId: railwayService.id,
-    name: service.key === "operationsRunner" ? deriveRailwayOperationsRunnerVolumeName(railwayService.name, environment.name) : deriveRailwayWorkerRunnerVolumeName(railwayService.name, environment.name),
+    name: service.key === "operationsRunner" ? deriveRailwayOperationsRunnerVolumeName(railwayService.name, environment.name) : service.key === "capacityProviderRunner" ? deriveRailwayCapacityProviderRunnerVolumeName(railwayService.name, environment.name) : deriveRailwayWorkerRunnerVolumeName(railwayService.name, environment.name),
     mountPath: volumeMountPath,
     env
   }) : null;
@@ -1896,12 +1597,11 @@ async function deployRailwayService(tenantRoot, service, {
 } = {}) {
   const timings = [];
   if (dryRun) {
-    const plan2 = planRailwayServiceDeploy(service, { env });
     return {
       service: service.key,
       status: "planned",
-      command: [plan2.command, ...plan2.args].join(" "),
-      cwd: plan2.cwd,
+      command: "railway-api serviceInstanceDeployV2",
+      cwd: service.rootDir,
       publicBaseUrl: service.publicBaseUrl,
       timings,
       transport: {
@@ -1916,7 +1616,6 @@ async function deployRailwayService(tenantRoot, service, {
     service: service.key
   });
   const commandEnv = buildRailwayCommandEnv({ ...process.env, ...env });
-  let railwayDeployEnv = buildRailwayDeployCommandEnv(commandEnv);
   const deployTransport = railwayDeployTransport(commandEnv);
   const taskPrefix = prefix ?? {
     scope: normalizeScope(deployService.scope ?? deployService.railwayEnvironment ?? "railway"),
@@ -1951,7 +1650,7 @@ async function deployRailwayService(tenantRoot, service, {
   ), {
     service: cliDeployService.key
   });
-  if (deployService.buildCommand && shouldRunRailwayPredeployBuild(commandEnv)) {
+  if (deployService.buildCommand && !deployService.imageRef && shouldRunRailwayPredeployBuild(commandEnv)) {
     const buildResult = await timedRailwayPhase(timings, "railway:predeploy-build", () => runPrefixedCommand("bash", ["-lc", deployService.buildCommand], {
       cwd: deployService.rootDir,
       env: commandEnv,
@@ -1996,139 +1695,32 @@ async function deployRailwayService(tenantRoot, service, {
       } : null
     };
   }
-  const railway = resolveTreeseedToolCommand("railway", { env: commandEnv });
-  if (!railway) {
-    throw new Error("Railway CLI deploy fallback requested, but Railway CLI is unavailable.");
-  }
-  railwayDeployEnv = buildRailwayCliContextEnv(railwayDeployEnv, cliDeployService);
-  const hasCommandApiToken = Boolean(configuredEnvValue(commandEnv, "RAILWAY_API_TOKEN"));
-  let usesProjectToken = Boolean(configuredEnvValue(railwayDeployEnv, "RAILWAY_TOKEN"));
-  if (usesProjectToken) {
-    railwayDeployEnv = { ...railwayDeployEnv, RAILWAY_API_TOKEN: void 0 };
-  }
-  writePhase("project-token", usesProjectToken || hasCommandApiToken ? "Using configured Railway authentication." : "Creating Railway project token.");
-  await timedRailwayPhase(timings, "railway:project-token", () => withRailwayPhaseTimeout(async () => {
-    if (usesProjectToken || hasCommandApiToken) {
-      return null;
-    }
-    const projectToken = await createRailwayCliProjectToken(cliDeployService, { env: commandEnv });
-    if (projectToken) {
-      railwayDeployEnv = buildRailwayCliContextEnv({ ...railwayDeployEnv, RAILWAY_API_TOKEN: void 0, RAILWAY_TOKEN: projectToken }, cliDeployService);
-      usesProjectToken = true;
-    } else if (configuredEnvValue(commandEnv, "CI") === "true") {
-      throw new Error(`Railway CI deploy requires a project token for ${cliDeployService.serviceName ?? cliDeployService.key}. Automatic project token creation did not return a token.`);
-    }
-    return null;
-  }, railwayPhaseTimeoutMs(commandEnv, "project_token"), `Railway project-token phase timed out for ${cliDeployService.serviceName ?? cliDeployService.key}.`), { service: cliDeployService.key });
-  const linkPlan = planRailwayServiceLink(cliDeployService, { env: commandEnv });
-  const plan = planRailwayServiceDeploy(cliDeployService, { env, projectTokenMode: usesProjectToken });
-  const hasRailwayApiToken = Boolean(configuredEnvValue(commandEnv, "RAILWAY_API_TOKEN"));
-  const cliConfig = configuredEnvValue(commandEnv, "CI") === "true" ? writeRailwayCliProjectConfig(cliDeployService, { env: railwayDeployEnv, cwd: plan.cwd }) : null;
-  const effectiveLinkPlan = hasRailwayApiToken ? linkPlan : usesProjectToken ? planRailwayProjectEnvironmentLink(cliDeployService) : linkPlan;
-  const railwayLinkEnv = hasRailwayApiToken ? buildRailwayLinkCommandEnv(commandEnv, cliDeployService) : railwayDeployEnv;
-  writePhase("link", `Linking Railway project context for ${cliDeployService.serviceName ?? cliDeployService.serviceId ?? cliDeployService.key}.`);
-  await timedRailwayPhase(timings, "railway:link", () => withRailwayPhaseTimeout(async () => {
-    if (cliConfig) {
-      write ? write(`[${taskPrefix.scope}][${taskPrefix.system}][${taskPrefix.task}][link] Wrote Railway CLI project context for ${cliConfig.projectPath}.`, "stdout") : null;
-      return;
-    }
-    const linkResult = await runPrefixedCommand(railway.command, [...railway.argsPrefix, ...effectiveLinkPlan.args], {
-      cwd: effectiveLinkPlan.cwd,
-      env: railwayLinkEnv,
-      write,
-      prefix: { ...taskPrefix, stage: "link" }
-    });
-    if (linkResult.status !== 0) {
-      throw new Error(linkResult.stderr?.trim() || linkResult.stdout?.trim() || `railway ${effectiveLinkPlan.args.join(" ")} failed with exit code ${linkResult.status ?? "unknown"} in ${effectiveLinkPlan.cwd}`);
-    }
-  }, railwayPhaseTimeoutMs(commandEnv, "link"), `Railway link phase timed out for ${cliDeployService.serviceName ?? cliDeployService.key}.`), { service: cliDeployService.key });
-  await timedRailwayPhase(timings, "railway:deploy", () => withRailwayPhaseTimeout(async () => {
-    let lastFailure = null;
-    for (let attempt = 1; attempt <= 5; attempt += 1) {
-      if (write && attempt === 1) {
-        write(`[${taskPrefix.scope}][${taskPrefix.system}][${taskPrefix.task}][deploy] $ railway ${plan.args.join(" ")}`, "stdout");
-      }
-      const result = await runPrefixedCommand(railway.command, [...railway.argsPrefix, ...plan.args], {
-        cwd: plan.cwd,
-        env: railwayDeployEnv,
-        write,
-        prefix: taskPrefix,
-        timeoutMs: railwayDeployCommandTimeoutMs(commandEnv)
-      });
-      if (result.status === 0) {
-        lastFailure = null;
-        break;
-      }
-      lastFailure = result;
-      if (!isRailwayTransientFailure(result) || attempt === 5) {
-        throw new Error(result.stderr?.trim() || result.stdout?.trim() || `railway ${plan.args.join(" ")} failed with exit code ${result.status ?? "unknown"} in ${plan.cwd}`);
-      }
-      const backoffMs = 5e3 * attempt;
-      const warning = `Railway deploy for ${deployService.serviceName ?? deployService.serviceId ?? deployService.key} hit a transient failure; retrying in ${Math.round(backoffMs / 1e3)}s...`;
-      write ? write(`[${taskPrefix.scope}][${taskPrefix.system}][${taskPrefix.task}][retry] ${warning}`, "stderr") : console.warn(warning);
-      await sleep(backoffMs);
-    }
-    if (lastFailure) {
-      throw new Error(lastFailure.stderr?.trim() || lastFailure.stdout?.trim() || `railway ${plan.args.join(" ")} failed`);
-    }
-  }, railwayPhaseTimeoutMs(commandEnv, "deploy"), `Railway deploy phase timed out for ${cliDeployService.serviceName ?? cliDeployService.key}.`), { service: cliDeployService.key });
-  return {
-    service: deployService.key,
-    status: "deployed",
-    command: [plan.command, ...plan.args].join(" "),
-    cwd: plan.cwd,
-    publicBaseUrl: deployService.publicBaseUrl,
-    timings,
-    transport: {
-      railway: {
-        reconcile: "api",
-        deploy: "cli-fallback"
-      }
-    },
-    runtimeConfiguration: runtimeConfiguration ? {
-      updated: runtimeConfiguration.updated,
-      healthcheckPath: runtimeConfiguration.instance?.healthcheckPath ?? null,
-      healthcheckTimeoutSeconds: runtimeConfiguration.instance?.healthcheckTimeoutSeconds ?? null,
-      runtimeMode: runtimeConfiguration.instance?.runtimeMode ?? null,
-      volume: runtimeConfiguration.volume ?? null
-    } : null
-  };
+  throw new Error(`Railway deployment for ${cliDeployService.serviceName ?? cliDeployService.serviceId ?? cliDeployService.key} requires Railway API deployment support. CLI deploy fallback has been removed.`);
 }
 export {
   buildRailwayCommandEnv,
-  buildRailwayDeployCommandEnv,
-  buildRailwayLinkCommandEnv,
   collectRailwayDeploymentStatusChecks,
   configuredRailwayScheduledJobs,
   configuredRailwayServices,
   deployRailwayService,
+  deriveRailwayCapacityProviderRunnerServiceName,
+  deriveRailwayCapacityProviderRunnerVolumeName,
   deriveRailwayOperationsRunnerServiceName,
   deriveRailwayOperationsRunnerVolumeName,
   deriveRailwayWorkerRunnerServiceName,
   deriveRailwayWorkerRunnerVolumeName,
-  ensureRailwayDatabaseServiceExists,
-  ensureRailwayEnvironmentExists,
-  ensureRailwayProjectContext,
-  ensureRailwayProjectExists,
   ensureRailwayScheduledJobs,
-  ensureRailwayServiceExists,
   findStaleTreeseedOperationsRunnerResources,
-  isRailwayTransientFailure,
   isTreeseedOperationsRunnerResourceName,
   isUsableRailwayToken,
   parseRailwayJsonOutput,
-  planRailwayServiceDeploy,
-  planRailwayServiceLink,
   railwayServiceRuntimeStartCommand,
   resolveRailwayAuthToken,
   resolveRailwayDeploymentProfile,
-  runRailway,
-  setRailwaySecretVariable,
   shouldRunRailwayPredeployBuild,
   validateRailwayDeployPrerequisites,
   validateRailwayServiceConfiguration,
   verifyRailwayManagedResources,
   verifyRailwayScheduledJobs,
-  waitForRailwayManagedDeploymentsSettled,
-  writeRailwayCliProjectConfig
+  waitForRailwayManagedDeploymentsSettled
 };