@treeseed/sdk 0.12.59 → 0.12.61

package/dist/operations/services/railway-cli.d.ts

@@ -0,0 +1,47 @@
+type RailwayCliInput = {
+    args: string[];
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
+    cwd?: string;
+    stdin?: string;
+    timeoutMs?: number;
+};
+export declare function runRailwayCliJson<T = unknown>({ args, env, cwd, stdin, timeoutMs }: RailwayCliInput): Promise<T>;
+export declare function deleteRailwayVolumeWithCli(input: {
+    projectId: string;
+    environmentId: string;
+    volumeId: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<unknown>;
+export declare function detachRailwayVolumeWithCli(input: {
+    projectId: string;
+    environmentId: string;
+    serviceId: string;
+    volumeId: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<unknown>;
+export declare function attachRailwayVolumeWithCli(input: {
+    projectId: string;
+    environmentId: string;
+    serviceId: string;
+    volumeId: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<unknown>;
+export declare function updateRailwayVolumeWithCli(input: {
+    projectId: string;
+    environmentId: string;
+    serviceId: string;
+    volumeId: string;
+    name: string;
+    mountPath: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<unknown>;
+export declare function connectRailwayServiceSourceWithCli(input: {
+    projectId?: string | null;
+    environmentId: string;
+    serviceId: string;
+    repo?: string | null;
+    branch?: string | null;
+    image?: string | null;
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
+}): Promise<unknown>;
+export {};

package/dist/operations/services/railway-cli.js

@@ -0,0 +1,142 @@
+import { spawn } from "node:child_process";
+import { resolveTreeseedToolCommand } from "../../managed-dependencies.js";
+import { withTreeseedServiceCredentialEnv } from "../../service-credentials.js";
+async function runRailwayCliJson({ args, env = process.env, cwd = process.cwd(), stdin, timeoutMs = 6e4 }) {
+  const effectiveEnv = withTreeseedServiceCredentialEnv(env);
+  const command = resolveTreeseedToolCommand("railway", { env: effectiveEnv });
+  if (!command) {
+    throw new Error("The managed Railway CLI is unavailable. Run `npx trsd install --json` before retrying reconciliation.");
+  }
+  return await new Promise((resolve, reject) => {
+    const detached = process.platform !== "win32";
+    const child = spawn(command.command, [...command.argsPrefix, ...args], {
+      cwd,
+      env: effectiveEnv,
+      stdio: ["pipe", "pipe", "pipe"],
+      detached
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    let forceKill = null;
+    const killProcessTree = (signal) => {
+      if (child.pid && detached) {
+        try {
+          process.kill(-child.pid, signal);
+          return;
+        } catch {
+        }
+      }
+      child.kill(signal);
+    };
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      killProcessTree("SIGTERM");
+      forceKill = setTimeout(() => killProcessTree("SIGKILL"), 2e3);
+    }, timeoutMs);
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      if (forceKill) clearTimeout(forceKill);
+      callback();
+    };
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", (error) => finish(() => reject(error)));
+    child.on("close", (code) => {
+      finish(() => {
+        if (timedOut) {
+          reject(new Error(`Railway CLI timed out after ${timeoutMs}ms: railway ${args.join(" ")}`));
+          return;
+        }
+        if (code !== 0) {
+          reject(new Error(`Railway CLI failed (${code ?? "signal"}): ${stderr.trim() || stdout.trim() || args[0]}`));
+          return;
+        }
+        try {
+          resolve(stdout.trim() ? JSON.parse(stdout) : {});
+        } catch (error) {
+          reject(new Error(`Railway CLI returned invalid JSON for ${args.join(" ")}: ${error instanceof Error ? error.message : String(error)}`));
+        }
+      });
+    });
+    if (stdin !== void 0) child.stdin.end(stdin);
+    else child.stdin.end();
+  });
+}
+function volumeScope(projectId, environmentId, serviceId) {
+  return ["volume", "--project", projectId, "--environment", environmentId, ...serviceId ? ["--service", serviceId] : []];
+}
+async function deleteRailwayVolumeWithCli(input) {
+  return runRailwayCliJson({
+    args: [...volumeScope(input.projectId, input.environmentId), "delete", "--volume", input.volumeId, "--yes", "--json"],
+    env: input.env
+  });
+}
+async function detachRailwayVolumeWithCli(input) {
+  return runRailwayCliJson({
+    args: [...volumeScope(input.projectId, input.environmentId, input.serviceId), "detach", "--volume", input.volumeId, "--yes", "--json"],
+    env: input.env
+  });
+}
+async function attachRailwayVolumeWithCli(input) {
+  return runRailwayCliJson({
+    args: [...volumeScope(input.projectId, input.environmentId, input.serviceId), "attach", "--volume", input.volumeId, "--yes", "--json"],
+    env: input.env
+  });
+}
+async function updateRailwayVolumeWithCli(input) {
+  return runRailwayCliJson({
+    args: [
+      ...volumeScope(input.projectId, input.environmentId, input.serviceId),
+      "update",
+      "--volume",
+      input.volumeId,
+      "--name",
+      input.name,
+      "--mount-path",
+      input.mountPath,
+      "--json"
+    ],
+    env: input.env
+  });
+}
+async function connectRailwayServiceSourceWithCli(input) {
+  const repo = String(input.repo ?? "").trim();
+  const image = String(input.image ?? "").trim();
+  if (Boolean(repo) === Boolean(image)) {
+    throw new Error("Railway service source connection requires exactly one GitHub repository or image reference.");
+  }
+  return runRailwayCliJson({
+    args: [
+      "service",
+      "source",
+      "connect",
+      ...String(input.projectId ?? "").trim() ? ["--project", String(input.projectId).trim()] : [],
+      "--environment",
+      input.environmentId,
+      "--service",
+      input.serviceId,
+      ...repo ? ["--repo", repo] : ["--image", image],
+      ...repo && String(input.branch ?? "").trim() ? ["--branch", String(input.branch).trim()] : [],
+      "--json"
+    ],
+    env: input.env
+  });
+}
+export {
+  attachRailwayVolumeWithCli,
+  connectRailwayServiceSourceWithCli,
+  deleteRailwayVolumeWithCli,
+  detachRailwayVolumeWithCli,
+  runRailwayCliJson,
+  updateRailwayVolumeWithCli
+};

package/dist/operations/services/railway-deploy.d.ts

@@ -60,6 +60,11 @@ export declare function waitForRailwayManagedDeploymentsSettled(tenantRoot: any,
     message: string;
 }>;
 export declare function configuredRailwayServices(tenantRoot: any, scope: any, envOverlay?: {}, options?: {}): unknown[];
+export declare function obsoleteUnqualifiedRailwayResourceNames(services: ReturnType<typeof configuredRailwayServices>): string[];
+export declare function railwayObsoleteAliasCleanupPolicy(scope: 'staging' | 'prod', services: ReturnType<typeof configuredRailwayServices>, liveProjectServiceNames?: Iterable<string>, activeEnvironmentServiceNames?: Iterable<string>): {
+    retainedResourceNames: string[];
+    allowedResourceDeletions: string[];
+};
 export declare function configuredRailwayScheduledJobs(tenantRoot: any, scope: any, { phase }?: {
     phase?: string | undefined;
 }): any[];

package/dist/operations/services/railway-deploy.js

@@ -6,7 +6,7 @@ import { resolveTreeseedMachineEnvironmentValues } from "./config-runtime.js";
 import { createPersistentDeployTarget, resolveTreeseedResourceIdentity } from "./deploy.js";
 import { classifyTreeseedGitMode, runTreeseedGitText } from "./git-runner.js";
 import { discoverTreeseedApplications } from "../../hosting/apps.js";
-import { apiRailwayDefaultDockerfilePath, apiRailwayDefaultSourceRepo, assertApiRailwaySourcePolicy, isApiRailwaySourcePolicyService } from "./railway-source-policy.js";
+import { apiRailwayDefaultDockerfilePath, apiRailwayDefaultSourceRepo, assertApiRailwaySourcePolicy, isApiRailwaySourcePolicyService, railwayEnvironmentQualifiedServiceName, railwayTreeDxServiceName } from "./railway-source-policy.js";
 import { runPrefixedCommand, sleep } from "./bootstrap-runner.js";
 import {
   ensureRailwayEnvironment,
@@ -384,74 +384,6 @@ function isRailwayScheduleCapabilityError(error) {
   const message = error instanceof Error ? error.message : String(error ?? "");
   return /cronTriggers|cronTriggerCreate|cronTriggerUpdate/iu.test(message);
 }
-function defaultRailwayScheduleQueries() {
-  return {
-    listQuery: envValue("TREESEED_RAILWAY_SCHEDULE_LIST_QUERY") || `
-query TreeseedScheduleList($serviceId: String!, $environmentId: String!, $projectId: String) {
-	service(id: $serviceId) {
-		id
-		name
-		cronTriggers {
-			edges {
-				node {
-					id
-					name
-					schedule
-					command
-					enabled
-					service { id name }
-					environment { id name }
-				}
-			}
-		}
-	}
-}
-`.trim(),
-    createMutation: envValue("TREESEED_RAILWAY_SCHEDULE_CREATE_MUTATION") || `
-mutation TreeseedScheduleCreate($serviceId: String!, $environmentId: String!, $name: String!, $schedule: String!, $command: String!, $enabled: Boolean!) {
-	cronTriggerCreate(
-		input: {
-			serviceId: $serviceId
-			environmentId: $environmentId
-			name: $name
-			schedule: $schedule
-			command: $command
-			enabled: $enabled
-		}
-	) {
-		id
-		name
-		schedule
-		command
-		enabled
-		service { id name }
-		environment { id name }
-	}
-}
-`.trim(),
-    updateMutation: envValue("TREESEED_RAILWAY_SCHEDULE_UPDATE_MUTATION") || `
-mutation TreeseedScheduleUpdate($id: String!, $name: String!, $schedule: String!, $command: String!, $enabled: Boolean!) {
-	cronTriggerUpdate(
-		id: $id
-		input: {
-			name: $name
-			schedule: $schedule
-			command: $command
-			enabled: $enabled
-		}
-	) {
-		id
-		name
-		schedule
-		command
-		enabled
-		service { id name }
-		environment { id name }
-	}
-}
-`.trim()
-  };
-}
 async function waitForRailwayManagedDeploymentsSettled(tenantRoot, scope, {
   services = configuredRailwayServices(tenantRoot, scope),
   env = process.env,
@@ -686,7 +618,7 @@ function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, app
     const publicBaseUrl = service.environments?.[normalizedScope]?.baseUrl ?? service.publicBaseUrl ?? (serviceKey === "api" ? configuredApiPublicBaseUrl(deployConfig, normalizedScope) : null);
     const environmentConfig = service.environments?.[normalizedScope];
     const baseServiceName = service.railway?.serviceName ?? (serviceKey === "workerRunner" ? deriveRailwayWorkerRunnerServiceName(identity.deploymentKey) : `${identity.deploymentKey}-${railwayServiceNameSuffix(serviceKey)}`);
-    const configuredServiceName = environmentConfig?.railwayServiceName ?? (normalizedScope === "prod" && ["api", "operationsRunner"].includes(serviceKey) ? `${serviceKey === "operationsRunner" ? String(baseServiceName).replace(/-\d+$/u, "") : baseServiceName}-production` : baseServiceName);
+    const configuredServiceName = typeof environmentConfig?.serviceName === "string" && environmentConfig.serviceName.trim() ? environmentConfig.serviceName.trim() : isApiRailwaySourcePolicyService({ key: serviceKey, serviceName: baseServiceName }) ? railwayEnvironmentQualifiedServiceName(baseServiceName, normalizedScope) : baseServiceName;
     const configuredRunnerPool = service.railway?.runnerPool && typeof service.railway.runnerPool === "object" ? service.railway.runnerPool : null;
     const runnerPool = serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? {
       bootstrapCount: Math.max(1, Number.parseInt(String(configuredRunnerPool?.bootstrapCount ?? (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)), 10) || (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)),
@@ -797,9 +729,10 @@ function configuredPublicTreeDxRailwayServices({ tenantRoot, scope, deployConfig
   const baseImageRef = envValue("TREESEED_PUBLIC_TREEDX_IMAGE_REF", imageRefEnv) || "treeseed/treedx";
   return Array.from({ length: bootstrapCount }, (_, offset) => {
     const index = offset + 1;
-    const serviceName = scope === "prod" ? `public-treedx-node-production-${String(index).padStart(2, "0")}` : `${PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX}${String(index).padStart(2, "0")}`;
+    const baseServiceName = `${PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX}${String(index).padStart(2, "0")}`;
+    const serviceName = railwayTreeDxServiceName(index, scope);
     const service = {
-      key: serviceName,
+      key: baseServiceName,
       serviceName,
       sourceMode,
       sourceRepo: sourceMode === "git" ? repository : null,
@@ -985,6 +918,42 @@ function configuredRailwayServices(tenantRoot, scope, envOverlay = {}, options =
   ));
   return [...direct, ...nested];
 }
+function obsoleteUnqualifiedRailwayResourceNames(services) {
+  const aliases = /* @__PURE__ */ new Set();
+  for (const service of services) {
+    const alias = service.serviceName.replace(/-(?:staging|production)(?=-\d+$|$)/u, "");
+    if (!alias || alias === service.serviceName) continue;
+    aliases.add(alias);
+    if (service.volumeMountPath) aliases.add(`${alias}-volume`);
+    const index = /-(\d+)$/u.exec(service.serviceName)?.[1] ?? "01";
+    const environmentSuffix = service.railwayEnvironment === "production" ? "production" : "staging";
+    const formerNames = service.key === "operationsRunner" ? [
+      `treeseed-api-operations-runner-${index}`,
+      `treeseed-api-operations-runner-${environmentSuffix}-${index}`
+    ] : service.key.startsWith("public-treedx-node-") ? [
+      `public-treedx-node-${index}`,
+      `public-treedx-node-${environmentSuffix}-${index}`
+    ] : [];
+    for (const formerName of formerNames) {
+      if (formerName === service.serviceName) continue;
+      aliases.add(formerName);
+      if (service.volumeMountPath) aliases.add(`${formerName}-volume`);
+    }
+  }
+  return [...aliases];
+}
+function railwayObsoleteAliasCleanupPolicy(scope, services, liveProjectServiceNames = [], activeEnvironmentServiceNames = []) {
+  const aliases = obsoleteUnqualifiedRailwayResourceNames(services);
+  const liveNames = new Set(liveProjectServiceNames);
+  void scope;
+  void activeEnvironmentServiceNames;
+  const qualifiedServices = services.filter((service) => service.serviceName !== service.serviceName.replace(/-(?:staging|production)(?=-\d+$|$)/u, "")).map((service) => service.serviceName);
+  const qualifiedResourcesExist = aliases.length > 0 && qualifiedServices.every((name) => liveNames.has(name));
+  return {
+    retainedResourceNames: qualifiedResourcesExist ? [] : aliases,
+    allowedResourceDeletions: qualifiedResourcesExist ? aliases : []
+  };
+}
 function configuredRailwayScheduledJobs(tenantRoot, scope, { phase = "deploy" } = {}) {
   if (!shouldManageRailwaySchedules(scope, phase)) {
     return [];
@@ -1709,7 +1678,7 @@ async function deployRailwayService(tenantRoot, service, {
     return {
       service: service.key,
       status: "planned",
-      command: "railway-api serviceInstanceDeployV2",
+      command: "railway-cli service redeploy",
       cwd: service.rootDir,
       publicBaseUrl: service.publicBaseUrl,
       timings,
@@ -1771,9 +1740,10 @@ async function deployRailwayService(tenantRoot, service, {
     }
   }
   if (deployTransport !== "cli-fallback") {
-    writePhase("deploy", `Deploying Railway service ${cliDeployService.serviceName ?? cliDeployService.serviceId ?? cliDeployService.key} through the Railway API.`);
+    writePhase("deploy", `Deploying Railway service ${cliDeployService.serviceName ?? cliDeployService.serviceId ?? cliDeployService.key} through the managed Railway CLI.`);
     const apiDeploy = await timedRailwayPhase(timings, "railway:api-deploy", () => withRailwayPhaseTimeout(
       () => deployRailwayServiceInstance({
+        projectId: cliDeployService.projectId,
         serviceId: cliDeployService.serviceId,
         environmentId: cliDeployService.environmentId,
         env: commandEnv,
@@ -1785,7 +1755,7 @@ async function deployRailwayService(tenantRoot, service, {
     return {
       service: deployService.key,
       status: "deployed",
-      command: "railway-api serviceInstanceDeployV2",
+      command: "railway-cli service redeploy",
       cwd: deployService.rootDir,
       publicBaseUrl: deployService.publicBaseUrl,
       timings,
@@ -1823,7 +1793,9 @@ export {
   findStaleTreeseedOperationsRunnerResources,
   isTreeseedOperationsRunnerResourceName,
   isUsableRailwayToken,
+  obsoleteUnqualifiedRailwayResourceNames,
   parseRailwayJsonOutput,
+  railwayObsoleteAliasCleanupPolicy,
   railwayServiceRuntimeStartCommand,
   resolveRailwayAuthToken,
   resolveRailwayDeploymentProfile,

package/dist/operations/services/railway-source-policy.d.ts

@@ -12,6 +12,12 @@ export type TreeseedRailwaySourcePolicyService = {
     buildCommand?: string | null;
     startCommand?: string | null;
 };
+export type TreeseedRailwaySourceIdentity = TreeseedRailwaySourcePolicyService & {
+    environment?: string | null;
+};
+export declare function railwayEnvironmentQualifiedServiceName(serviceName: string, scope: TreeseedRailwaySourcePolicyScope | string): string;
+export declare function railwayTreeDxServiceName(index: number, scope: string): string;
+export declare function assertNoRailwaySourceIdentityCollisions(services: TreeseedRailwaySourceIdentity[]): void;
 export declare function isApiRailwaySourcePolicyService(service: TreeseedRailwaySourcePolicyService): boolean;
 export declare function isImmutableRailwayImageRef(value: unknown): boolean;
 export declare function apiRailwayDefaultSourceRepo(service: TreeseedRailwaySourcePolicyService): "treeseed-ai/treedx" | "treeseed-ai/api" | null;

package/dist/operations/services/railway-source-policy.js

@@ -1,7 +1,45 @@
+const SOURCE_DIVERGENT_ENVIRONMENT_SUFFIX = /-(?:staging|production)(?=-\d+$|$)/u;
+function railwayEnvironmentQualifiedServiceName(serviceName, scope) {
+  const normalizedName = String(serviceName ?? "").trim();
+  const suffix = scope === "prod" || scope === "production" ? "production" : scope === "staging" ? "staging" : null;
+  if (!normalizedName || !suffix) return normalizedName;
+  const unqualifiedName = normalizedName.replace(SOURCE_DIVERGENT_ENVIRONMENT_SUFFIX, "");
+  const indexedName = /^(.*?)(-\d+)$/u.exec(unqualifiedName);
+  return indexedName ? `${indexedName[1]}-${suffix}${indexedName[2]}` : `${unqualifiedName}-${suffix}`;
+}
+function railwayTreeDxServiceName(index, scope) {
+  const normalizedIndex = String(Math.max(1, Math.trunc(index))).padStart(2, "0");
+  return railwayEnvironmentQualifiedServiceName(`treeseed-treedx-${normalizedIndex}`, scope);
+}
+function railwaySourceSignature(service) {
+  return JSON.stringify({
+    sourceMode: service.sourceMode ?? null,
+    sourceRepo: service.sourceRepo ?? null,
+    sourceBranch: service.sourceBranch ?? null,
+    sourceRootDirectory: service.sourceRootDirectory ?? null,
+    imageRef: service.imageRef ?? null,
+    dockerfilePath: service.dockerfilePath ?? null,
+    buildCommand: service.buildCommand ?? null
+  });
+}
+function assertNoRailwaySourceIdentityCollisions(services) {
+  const identities = /* @__PURE__ */ new Map();
+  for (const service of services) {
+    const serviceName = String(service.serviceName ?? "").trim();
+    if (!serviceName) continue;
+    const existing = identities.get(serviceName);
+    if (existing && railwaySourceSignature(existing) !== railwaySourceSignature(service)) {
+      throw new Error(
+        `${serviceName}: Railway service identity is shared by ${existing.environment ?? "one environment"} and ${service.environment ?? "another environment"} with different source/build configurations. Use environment-qualified service names.`
+      );
+    }
+    identities.set(serviceName, service);
+  }
+}
 function isApiRailwaySourcePolicyService(service) {
   const key = String(service.key ?? "").trim();
   const serviceName = String(service.serviceName ?? "").trim();
-  return key.startsWith("public-treedx-node-") || /^treeseed-api(?:-production)?$/u.test(serviceName) || /^treeseed-api-operations-runner(?:-production)?-\d+$/u.test(serviceName) || /^public-treedx-node(?:-production)?-\d+$/u.test(serviceName);
+  return key.startsWith("public-treedx-node-") || /^treeseed-api(?:-(?:staging|production))?$/u.test(serviceName) || /^treeseed-api-operations-runner(?:-(?:staging|production))?(?:-\d+)?$/u.test(serviceName) || /^treeseed-ops(?:-(?:staging|production))?-\d+$/u.test(serviceName) || /^public-treedx-node(?:-(?:staging|production))?-\d+$/u.test(serviceName) || /^treeseed-treedx(?:-(?:staging|production))?-\d+$/u.test(serviceName);
 }
 function isImmutableRailwayImageRef(value) {
   const imageRef = typeof value === "string" ? value.trim() : "";
@@ -11,24 +49,26 @@ function isImmutableRailwayImageRef(value) {
 }
 function apiRailwayDefaultSourceRepo(service) {
   const serviceName = String(service.serviceName ?? "").trim();
-  if (String(service.key ?? "") === "api" || String(service.key ?? "") === "operationsRunner" || /^treeseed-api(?:-production)?$/u.test(serviceName) || /^treeseed-api-operations-runner(?:-production)?-\d+$/u.test(serviceName)) return "treeseed-ai/api";
-  if (/^public-treedx-node(?:-production)?-\d+$/u.test(serviceName) || String(service.key ?? "").startsWith("public-treedx-node-")) return "treeseed-ai/treedx";
+  if (String(service.key ?? "") === "api" || String(service.key ?? "") === "operationsRunner" || /^treeseed-api(?:-(?:staging|production))?$/u.test(serviceName) || /^treeseed-api-operations-runner(?:-(?:staging|production))?(?:-\d+)?$/u.test(serviceName)) return "treeseed-ai/api";
+  if (/^public-treedx-node(?:-(?:staging|production))?-\d+$/u.test(serviceName) || String(service.key ?? "").startsWith("public-treedx-node-")) return "treeseed-ai/treedx";
   return null;
 }
 function apiRailwayDefaultDockerfilePath(service) {
   const serviceName = String(service.serviceName ?? "").trim();
-  if (String(service.key ?? "") === "api" || /^treeseed-api(?:-production)?$/u.test(serviceName)) return "/Dockerfile.api";
-  if (String(service.key ?? "") === "operationsRunner" || /^treeseed-api-operations-runner(?:-production)?-\d+$/u.test(serviceName)) return "/Dockerfile.operations-runner";
-  if (/^public-treedx-node(?:-production)?-\d+$/u.test(serviceName) || String(service.key ?? "").startsWith("public-treedx-node-")) return "/Dockerfile";
+  if (String(service.key ?? "") === "api" || /^treeseed-api(?:-(?:staging|production))?$/u.test(serviceName)) return "/Dockerfile.api";
+  if (String(service.key ?? "") === "operationsRunner" || /^treeseed-api-operations-runner(?:-(?:staging|production))?(?:-\d+)?$/u.test(serviceName)) return "/Dockerfile.operations-runner";
+  if (/^public-treedx-node(?:-(?:staging|production))?-\d+$/u.test(serviceName) || String(service.key ?? "").startsWith("public-treedx-node-")) return "/Dockerfile";
   return null;
 }
 function assertApiRailwaySourcePolicy(scope, service) {
   if (!isApiRailwaySourcePolicyService(service)) return;
   const normalizedScope = scope === "prod" ? "prod" : scope === "staging" ? "staging" : "local";
   const label = service.serviceName ?? service.key ?? "Railway service";
+  const serviceName = String(service.serviceName ?? "").trim();
+  const expectedServiceName = railwayEnvironmentQualifiedServiceName(serviceName, normalizedScope);
   if (normalizedScope === "staging") {
     const issues = [
-      /-production(?:-|$)/u.test(String(service.serviceName ?? "")) ? "serviceName must use the staging-only identity" : null,
+      serviceName === expectedServiceName && /-staging(?:-|$)/u.test(serviceName) ? null : `serviceName must be ${expectedServiceName}`,
       service.sourceMode === "git" ? null : "sourceMode must be git",
       service.imageRef ? "imageRef must be empty" : null,
       service.sourceRepo ? null : "sourceRepo must be set",
@@ -43,7 +83,7 @@ function assertApiRailwaySourcePolicy(scope, service) {
   }
   if (normalizedScope === "prod") {
     const issues = [
-      /-production(?:-|$)/u.test(String(service.serviceName ?? "")) ? null : "serviceName must use a production-only identity",
+      serviceName === expectedServiceName && /-production(?:-|$)/u.test(serviceName) ? null : `serviceName must be ${expectedServiceName}`,
       service.sourceMode === "image" ? null : "sourceMode must be image",
       isImmutableRailwayImageRef(service.imageRef) ? null : "imageRef must be an immutable released image tag",
       service.sourceRepo ? "sourceRepo must be empty" : null,
@@ -63,6 +103,9 @@ export {
   apiRailwayDefaultDockerfilePath,
   apiRailwayDefaultSourceRepo,
   assertApiRailwaySourcePolicy,
+  assertNoRailwaySourceIdentityCollisions,
   isApiRailwaySourcePolicyService,
-  isImmutableRailwayImageRef
+  isImmutableRailwayImageRef,
+  railwayEnvironmentQualifiedServiceName,
+  railwayTreeDxServiceName
 };

package/dist/operations/services/repository-save-orchestrator.d.ts

@@ -174,6 +174,8 @@ export declare function discoverRepositorySaveNodes(root: string, gitRoot?: stri
     stablePackageRelease?: boolean;
 }): RepositorySaveNode[];
 export declare function repositorySaveWaves(nodes: RepositorySaveNode[]): RepositorySaveNode[][];
+export declare function validateStandaloneGitDependencyLockfile(node: RepositorySaveNode, options: Pick<RepositorySaveOptions, 'onProgress'>): boolean;
+export declare function applyPackageVersion(node: RepositorySaveNode, version: string): boolean;
 export declare function planRepositorySave(options: RepositorySaveOptions): RepositorySavePlan;
 export declare function refreshAndValidateRootWorkspaceLockfileForSave(options: {
     root: string;

package/dist/operations/services/repository-save-orchestrator.js

@@ -779,6 +779,8 @@ function syncDirectGitDependencyLockfileEntries(node, options, references) {
 function validateStandaloneGitDependencyLockfile(node, options) {
   const lockfilePath = resolve(node.path, "package-lock.json");
   const lockfileExists = existsSync(lockfilePath);
+  const previousLockfile = lockfileExists ? readFileSync(lockfilePath, "utf8") : null;
+  const isolatedRoot = mkdtempSync(resolve(tmpdir(), "treeseed-lockfile-"));
   const validateArgs = [
     "ci",
     "--package-lock-only",
@@ -789,11 +791,16 @@ function validateStandaloneGitDependencyLockfile(node, options) {
   ];
   try {
     if (!lockfileExists) throw new Error("standalone lockfile missing");
-    runCapturedCommand(node, options, "lockfile", "npm", validateArgs, { timeoutMs: 5 * 6e4 });
+    copyFileSync(resolve(node.path, "package.json"), resolve(isolatedRoot, "package.json"));
+    copyFileSync(lockfilePath, resolve(isolatedRoot, "package-lock.json"));
+    runCapturedCommand(node, options, "lockfile", "npm", validateArgs, {
+      cwd: isolatedRoot,
+      timeoutMs: 5 * 6e4
+    });
   } catch (validationError) {
-    const previousLockfile = lockfileExists ? readFileSync(lockfilePath, "utf8") : null;
-    const isolatedRoot = mkdtempSync(resolve(tmpdir(), "treeseed-lockfile-"));
     try {
+      rmSync(isolatedRoot, { recursive: true, force: true });
+      mkdirSync(isolatedRoot, { recursive: true });
       copyFileSync(resolve(node.path, "package.json"), resolve(isolatedRoot, "package.json"));
       runCapturedCommand(node, options, "lockfile", "npm", [
         "install",
@@ -814,9 +821,9 @@ function validateStandaloneGitDependencyLockfile(node, options) {
     } catch (regenerationError) {
       if (previousLockfile !== null) writeFileSync(lockfilePath, previousLockfile, "utf8");
       throw regenerationError instanceof Error ? regenerationError : validationError;
-    } finally {
-      rmSync(isolatedRoot, { recursive: true, force: true });
     }
+  } finally {
+    rmSync(isolatedRoot, { recursive: true, force: true });
   }
   emitProgress(options, node, "lockfile", "Validated the standalone lockfile against the committed package manifest.");
   return true;
@@ -828,10 +835,30 @@ function planPackageVersion(node, options) {
 }
 function applyPackageVersion(node, version) {
   if (!node.packageJson || !node.packageJsonPath) return false;
-  if (node.packageJson.version === version) return false;
-  node.packageJson.version = version;
-  writeJson(node.packageJsonPath, node.packageJson);
-  return true;
+  let changed = false;
+  if (node.packageJson.version !== version) {
+    node.packageJson.version = version;
+    writeJson(node.packageJsonPath, node.packageJson);
+    changed = true;
+  }
+  const lockfilePath = resolve(node.path, "package-lock.json");
+  if (existsSync(lockfilePath)) {
+    const lockfile = readJson(lockfilePath);
+    const rootEntry = lockfile.packages && typeof lockfile.packages === "object" && !Array.isArray(lockfile.packages) ? lockfile.packages[""] : null;
+    const lockfileMatches = lockfile.version === version && rootEntry?.version === version && (typeof node.packageJson.name !== "string" || rootEntry?.name === node.packageJson.name);
+    if (lockfileMatches) return changed;
+    lockfile.version = version;
+    const packages = lockfile.packages && typeof lockfile.packages === "object" && !Array.isArray(lockfile.packages) ? lockfile.packages : {};
+    packages[""] = {
+      ...packages[""] ?? {},
+      ...typeof node.packageJson.name === "string" ? { name: node.packageJson.name } : {},
+      version
+    };
+    lockfile.packages = packages;
+    writeJson(lockfilePath, lockfile);
+    changed = true;
+  }
+  return changed;
 }
 function shouldSkipNetworkInstall() {
   return process.env.TREESEED_SAVE_NPM_INSTALL_MODE !== "allow";
@@ -952,6 +979,10 @@ async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs =
   let lastError = null;
   const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
   const rootWorkspaceInstall = node.path === options.root && Array.isArray(packageJson?.workspaces);
+  if (!rootWorkspaceInstall && node.branchMode !== "project-save") {
+    validateStandaloneGitDependencyLockfile(node, options);
+    return { status: "completed", attempts: 1, reason: "isolated-lockfile-validation" };
+  }
   const installFlags = rootWorkspaceInstall ? ["--package-lock-only", "--ignore-scripts"] : node.branchMode === "project-save" ? ["--ignore-scripts"] : ["--package-lock-only", "--ignore-scripts"];
   const args = rootWorkspaceInstall ? gitDependencyRefreshSpecs.length > 0 ? ["install", ...gitDependencyRefreshSpecs, ...installFlags, "--force"] : ["install", ...installFlags] : gitDependencyRefreshSpecs.length > 0 ? ["install", ...gitDependencyRefreshSpecs, ...installFlags, "--force", "--workspaces=false"] : ["install", ...installFlags, "--workspaces=false"];
   for (let attempt = 1; attempt <= 5; attempt += 1) {
@@ -1795,13 +1826,11 @@ async function saveOneRepository(node, options, state) {
     if (selection.reused) {
       emitProgress(options, node, "version", `Reusing existing interrupted save version ${plannedVersion}.`);
     } else {
-      applyPackageVersion(node, plannedVersion);
+      emitProgress(options, node, "version", `Planned ${plannedVersion}.`);
     }
+    applyPackageVersion(node, plannedVersion);
     node.plannedVersion = plannedVersion;
     report.version = plannedVersion;
-    if (!selection.reused) {
-      emitProgress(options, node, "version", `Planned ${plannedVersion}.`);
-    }
     const reference = finalizePackageReference(node, plannedVersion, options);
     node.plannedTag = reference.tagName;
     report.tagName = reference.tagName;
@@ -2068,6 +2097,7 @@ function repositorySaveErrorDetails(error) {
   };
 }
 export {
+  applyPackageVersion,
   discoverRepositorySaveNodes,
   nextDevVersion,
   planRepositorySave,
@@ -2075,5 +2105,6 @@ export {
   repositorySaveErrorDetails,
   repositorySaveWaves,
   runRepositorySaveOrchestrator,
-  runStreamingCommand
+  runStreamingCommand,
+  validateStandaloneGitDependencyLockfile
 };

package/dist/operations-types.d.ts

@@ -36,7 +36,9 @@ export type TreeseedOperationConfirm = (message: string, expected: string) => Pr
 export type TreeseedOperationSpawn = (command: string, args: string[], options: {
     cwd: string;
     env: NodeJS.ProcessEnv;
-    stdio?: 'inherit';
+    stdio?: 'inherit' | 'pipe';
+    timeout?: number;
+    killSignal?: NodeJS.Signals;
 }) => {
     status?: number | null;
 };

package/dist/platform/contracts.d.ts

@@ -213,6 +213,7 @@ export interface TreeseedManagedServiceEnvironmentConfig {
     domain?: string;
     railwayEnvironment?: string;
     railwayProjectName?: string;
+    serviceName?: string;
     railwayServiceName?: string;
 }
 export type TreeseedLocalRuntimeMode = 'auto' | 'provider' | 'local';

package/dist/platform/deploy-config.js

@@ -334,7 +334,8 @@ function parseServiceEnvironmentConfig(value, label) {
     domain: optionalString(record.domain),
     railwayEnvironment: optionalString(record.railwayEnvironment),
     railwayProjectName: optionalString(record.railwayProjectName),
-    railwayServiceName: optionalString(record.railwayServiceName)
+    serviceName: optionalString(record.serviceName ?? record.railwayServiceName),
+    railwayServiceName: optionalString(record.railwayServiceName ?? record.serviceName)
   };
 }
 function parseLocalRuntimeConfig(value, label) {