@treeseed/sdk 0.12.60 → 0.12.61

package/dist/managed-dependencies.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { createWriteStream, existsSync, mkdirSync, rmSync, renameSync, chmodSync, copyFileSync, readFileSync, readdirSync } from "node:fs";
+import { createWriteStream, existsSync, mkdirSync, mkdtempSync, rmSync, renameSync, chmodSync, copyFileSync, readFileSync, readdirSync } from "node:fs";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { platform as osPlatform, arch as osArch } from "node:os";
@@ -17,14 +17,40 @@ const GH_ASSETS = [
   { platform: "darwin", arch: "x64", assetName: `gh_${GH_VERSION}_macOS_amd64.zip`, archiveKind: "zip" },
   { platform: "darwin", arch: "arm64", assetName: `gh_${GH_VERSION}_macOS_arm64.zip`, archiveKind: "zip" }
 ];
-const NPM_TOOLS = [
-  { name: "wrangler", packageName: "wrangler", binName: "wrangler", version: "4.86.0" },
+const RAILWAY_VERSION = "5.23.2";
+const RAILWAY_RELEASE_BASE_URL = `https://github.com/railwayapp/cli/releases/download/v${RAILWAY_VERSION}`;
+const RAILWAY_ASSETS = [
   {
-    name: "railway",
-    packageName: "@railway/cli",
-    binName: "railway",
-    version: "5.23.2"
+    platform: "linux",
+    arch: "x64",
+    assetName: `railway-v${RAILWAY_VERSION}-x86_64-unknown-linux-gnu.tar.gz`,
+    archiveKind: "tar.gz",
+    sha256: "ced014a566bc273ce87463678a2d1e5d9ee02f165a832d5d2fd27c201855145b"
+  },
+  {
+    platform: "linux",
+    arch: "arm64",
+    assetName: `railway-v${RAILWAY_VERSION}-aarch64-unknown-linux-musl.tar.gz`,
+    archiveKind: "tar.gz",
+    sha256: "b6100a01d0bd5d349f39e796a907e77f45dadb42f99eee558a1aa7bb254b973e"
+  },
+  {
+    platform: "darwin",
+    arch: "x64",
+    assetName: `railway-v${RAILWAY_VERSION}-x86_64-apple-darwin.tar.gz`,
+    archiveKind: "tar.gz",
+    sha256: "403721baa47c2afd0391190310ae8aaf9d671d3ac3d7db123219686b2762bea3"
   },
+  {
+    platform: "darwin",
+    arch: "arm64",
+    assetName: `railway-v${RAILWAY_VERSION}-aarch64-apple-darwin.tar.gz`,
+    archiveKind: "tar.gz",
+    sha256: "83ddc35f9a5ec1a8adb4cf6a024f23227b109832b2d354633a9668c47acb02fa"
+  }
+];
+const NPM_TOOLS = [
+  { name: "wrangler", packageName: "wrangler", binName: "wrangler", version: "4.86.0" },
   { name: "copilot", packageName: "@github/copilot", binName: "copilot", version: "1.0.39" },
   { name: "copilot-language-server", packageName: "@github/copilot-language-server", binName: "copilot-language-server", version: "1.480.0" }
 ];
@@ -76,9 +102,19 @@ function currentPlatformAsset() {
   }
   return GH_ASSETS.find((asset) => asset.platform === platform && asset.arch === arch) ?? null;
 }
+function currentRailwayPlatformAsset() {
+  const platform = osPlatform();
+  const arch = osArch();
+  if (platform !== "linux" && platform !== "darwin") return null;
+  if (arch !== "x64" && arch !== "arm64") return null;
+  return RAILWAY_ASSETS.find((asset) => asset.platform === platform && asset.arch === arch) ?? null;
+}
 function managedGhBin(env = process.env) {
   return resolve(resolveToolsHome(env), "gh", GH_VERSION, platformKey(), "bin", "gh");
 }
+function managedRailwayBin(env = process.env) {
+  return resolve(resolveToolsHome(env), "railway", RAILWAY_VERSION, platformKey(), "bin", "railway");
+}
 function tokenEnv(env = process.env) {
   const translated = withTreeseedServiceCredentialEnv(env);
   const ghToken = translated.GH_TOKEN?.trim() || translated.GITHUB_TOKEN?.trim() || "";
@@ -247,28 +283,126 @@ function npmBackedDependenciesAvailable() {
   }
 }
 function resolveNpmInstallCommand(env = process.env) {
+  const installArgs = ["install", "--ignore-scripts", "--prefer-offline", "--workspaces=false", "--no-audit", "--no-fund"];
   const npmCommandOverride = env.TREESEED_NPM_INSTALL_COMMAND;
   if (npmCommandOverride?.trim()) {
     return {
       command: npmCommandOverride,
-      args: ["install", "--no-audit", "--no-fund"],
-      display: [npmCommandOverride, "install", "--no-audit", "--no-fund"]
+      args: installArgs,
+      display: [npmCommandOverride, ...installArgs]
     };
   }
   const npmExecPath = env.npm_execpath || env.NPM_EXEC_PATH;
   if (npmExecPath?.trim()) {
     return {
       command: process.execPath,
-      args: [npmExecPath, "install", "--no-audit", "--no-fund"],
-      display: [process.execPath, npmExecPath, "install", "--no-audit", "--no-fund"]
+      args: [npmExecPath, ...installArgs],
+      display: [process.execPath, npmExecPath, ...installArgs]
     };
   }
   return {
     command: "npm",
-    args: ["install", "--no-audit", "--no-fund"],
-    display: ["npm", "install", "--no-audit", "--no-fund"]
+    args: installArgs,
+    display: ["npm", ...installArgs]
   };
 }
+function esbuildPlatformPackage() {
+  const platform = osPlatform();
+  const arch = osArch();
+  if (platform === "linux" && ["x64", "arm64", "arm", "ia32", "ppc64", "riscv64", "s390x"].includes(arch)) return `@esbuild/linux-${arch}`;
+  if (platform === "darwin" && ["x64", "arm64"].includes(arch)) return `@esbuild/darwin-${arch}`;
+  if (platform === "win32" && ["x64", "arm64", "ia32"].includes(arch)) return `@esbuild/win32-${arch}`;
+  return null;
+}
+function collectInstalledNativeDependencyIssues(tenantRoot) {
+  return collectNativeDependencyRepairs(tenantRoot).map((repair) => repair.issue);
+}
+function collectNativeDependencyRepairs(tenantRoot) {
+  const binaryPackage = esbuildPlatformPackage();
+  if (!binaryPackage) return [];
+  try {
+    const lock = JSON.parse(readFileSync(resolve(tenantRoot, "package-lock.json"), "utf8"));
+    const packages = lock.packages ?? {};
+    const repairs = [];
+    for (const [packagePath, entry] of Object.entries(packages)) {
+      if (packagePath !== "node_modules/esbuild" && !packagePath.endsWith("/node_modules/esbuild")) continue;
+      if (!existsSync(resolve(tenantRoot, packagePath, "package.json"))) continue;
+      const binaryPath = `${packagePath.slice(0, -"esbuild".length)}${binaryPackage}`;
+      const expectedBinary = packages[binaryPath];
+      if (!expectedBinary?.version) continue;
+      const installedBinaryPath = resolve(tenantRoot, binaryPath, "package.json");
+      if (!existsSync(installedBinaryPath)) {
+        repairs.push({
+          packagePath: binaryPath,
+          packageName: binaryPackage,
+          version: expectedBinary.version,
+          integrity: expectedBinary.integrity,
+          issue: `${binaryPath}: missing native binary ${expectedBinary.version} for ${packagePath}`
+        });
+        continue;
+      }
+      const installedBinary = JSON.parse(readFileSync(installedBinaryPath, "utf8"));
+      if (installedBinary.version !== expectedBinary.version || installedBinary.version !== entry.version) {
+        repairs.push({
+          packagePath: binaryPath,
+          packageName: binaryPackage,
+          version: expectedBinary.version,
+          integrity: expectedBinary.integrity,
+          issue: `${binaryPath}: native binary ${installedBinary.version ?? "(missing version)"} does not match host ${entry.version ?? "(missing version)"}`
+        });
+      }
+    }
+    return repairs;
+  } catch {
+    return [];
+  }
+}
+function resolveNpmPackCommand(env, spec, destination) {
+  const args = ["pack", spec, "--json", "--ignore-scripts", "--pack-destination", destination];
+  const npmExecPath = env.npm_execpath || env.NPM_EXEC_PATH;
+  return npmExecPath?.trim() ? { command: process.execPath, args: [npmExecPath, ...args] } : { command: "npm", args };
+}
+function repairInstalledNativeDependencies(tenantRoot, options) {
+  const repairs = collectNativeDependencyRepairs(tenantRoot);
+  if (repairs.length === 0) return null;
+  const tempParent = resolve(tenantRoot, ".treeseed", "tmp");
+  mkdirSync(tempParent, { recursive: true });
+  const tempRoot = mkdtempSync(resolve(tempParent, "native-dependency-"));
+  try {
+    for (const repair of repairs) {
+      options.write?.(`Hydrating ${repair.packageName}@${repair.version} for ${repair.packagePath}.`);
+      const pack = resolveNpmPackCommand(options.env, `${repair.packageName}@${repair.version}`, tempRoot);
+      const packed = options.spawn(pack.command, pack.args, {
+        cwd: tenantRoot,
+        env: { ...options.env, TREESEED_MANAGED_NPM_INSTALL: "1" },
+        stdio: "pipe",
+        encoding: "utf8"
+      });
+      if (packed.status !== 0 || packed.error) return null;
+      let metadata;
+      try {
+        metadata = JSON.parse(String(packed.stdout ?? ""));
+      } catch {
+        return null;
+      }
+      const artifact = metadata[0];
+      if (!artifact?.filename || repair.integrity && artifact.integrity !== repair.integrity) return null;
+      const target = resolve(tenantRoot, repair.packagePath);
+      rmSync(target, { recursive: true, force: true });
+      mkdirSync(target, { recursive: true });
+      const extracted = options.spawn("tar", ["-xzf", resolve(tempRoot, artifact.filename), "-C", target, "--strip-components=1"], {
+        cwd: tenantRoot,
+        env: options.env,
+        stdio: "pipe",
+        encoding: "utf8"
+      });
+      if (extracted.status !== 0 || extracted.error) return null;
+    }
+    return collectNativeDependencyRepairs(tenantRoot).length === 0 ? repairs.length : null;
+  } finally {
+    rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
 function resolveNpmRebuildCommand(env = process.env, packageNames) {
   const npmExecPath = env.npm_execpath || env.NPM_EXEC_PATH;
   if (npmExecPath?.trim()) {
@@ -284,6 +418,15 @@ function resolveNpmRebuildCommand(env = process.env, packageNames) {
     display: ["npm", "rebuild", ...packageNames]
   };
 }
+function staleNpmGitClonePath(detail) {
+  const match = /destination path '([^']+\/_cacache\/tmp\/git-clone[^/]+\/\.git)' already exists/u.exec(detail);
+  if (!match?.[1]) return null;
+  const gitPath = resolve(match[1]);
+  const cloneRoot = dirname(gitPath);
+  if (basename(gitPath) !== ".git" || !basename(cloneRoot).startsWith("git-clone")) return null;
+  if (basename(dirname(cloneRoot)) !== "tmp" || basename(dirname(dirname(cloneRoot))) !== "_cacache") return null;
+  return cloneRoot;
+}
 function runNpmBootstrap(options) {
   const tenantRoot = options.tenantRoot ? resolve(options.tenantRoot) : null;
   const npmCommand = resolveNpmInstallCommand(options.env);
@@ -308,7 +451,20 @@ function runNpmBootstrap(options) {
   const nodeModulesMissing = !existsSync(resolve(tenantRoot, "node_modules"));
   const npmDepsMissing = !npmBackedDependenciesAvailable();
   const missingRuntimeTools = npmToolsMissingRuntime();
-  if (!options.force && !nodeModulesMissing && npmDepsMissing && missingRuntimeTools.length > 0) {
+  const nativeDependencyIssues = nodeModulesMissing ? [] : collectInstalledNativeDependencyIssues(tenantRoot);
+  if (nativeDependencyIssues.length > 0) {
+    const repaired = repairInstalledNativeDependencies(tenantRoot, options);
+    if (repaired !== null) {
+      return [{
+        root: tenantRoot,
+        command: ["npm", "pack", "<lockfile-pinned-native-dependencies>"],
+        status: "installed",
+        exitCode: 0,
+        detail: `Hydrated ${repaired} lockfile-pinned native package artifact${repaired === 1 ? "" : "s"} without resolving the workspace dependency graph.`
+      }];
+    }
+  }
+  if (!nodeModulesMissing && npmDepsMissing && missingRuntimeTools.length > 0) {
     return [{
       root: tenantRoot,
       command: npmCommand.display,
@@ -317,16 +473,16 @@ function runNpmBootstrap(options) {
       detail: `npm dependencies are installed; rebuilding missing runtime tools: ${missingRuntimeTools.map((tool) => tool.packageName).join(", ")}.`
     }];
   }
-  if (!options.force && !nodeModulesMissing && !npmDepsMissing) {
+  if (!nodeModulesMissing && !npmDepsMissing && nativeDependencyIssues.length === 0) {
     return [{
       root: tenantRoot,
       command: npmCommand.display,
       status: "already-present",
       exitCode: 0,
-      detail: "npm dependencies are already installed."
+      detail: options.force ? "npm dependencies are already installed; force is limited to Treeseed-managed tool repair." : "npm dependencies are already installed."
     }];
   }
-  options.write?.(`Installing npm dependencies in ${tenantRoot}...`);
+  options.write?.(nativeDependencyIssues.length > 0 ? `Repairing npm dependency integrity in ${tenantRoot}: ${nativeDependencyIssues.join("; ")}` : `Installing npm dependencies in ${tenantRoot}...`);
   const testNpmInstallStatus = options.env.NODE_ENV === "test" ? options.env.TREESEED_TEST_NPM_INSTALL_STATUS : void 0;
   if (testNpmInstallStatus === "installed" || testNpmInstallStatus === "failed") {
     const ok2 = testNpmInstallStatus === "installed";
@@ -338,7 +494,7 @@ function runNpmBootstrap(options) {
       detail: ok2 ? "npm install completed successfully." : "npm install failed."
     }];
   }
-  const result = options.spawn(npmCommand.command, npmCommand.args, {
+  const spawnInstall = () => options.spawn(npmCommand.command, npmCommand.args, {
     cwd: tenantRoot,
     env: {
       ...options.env,
@@ -347,8 +503,17 @@ function runNpmBootstrap(options) {
     stdio: "pipe",
     encoding: "utf8"
   });
-  const detail = `${result.stderr ?? ""}
+  let result = spawnInstall();
+  let detail = `${result.stderr ?? ""}
 ${result.stdout ?? ""}`.trim() || result.error?.message || "";
+  const staleClone = result.status !== 0 ? staleNpmGitClonePath(detail) : null;
+  if (staleClone) {
+    options.write?.(`Removing interrupted npm Git clone ${staleClone} and retrying dependency repair once.`);
+    rmSync(staleClone, { recursive: true, force: true });
+    result = spawnInstall();
+    detail = `${result.stderr ?? ""}
+${result.stdout ?? ""}`.trim() || result.error?.message || "";
+  }
   const ok = result.status === 0 && !result.error;
   return [{
     root: tenantRoot,
@@ -429,6 +594,10 @@ function resolveTreeseedToolBinary(toolName, options = {}) {
     }
     return locateSystemBinary("gh", spawnSync, options.env ?? process.env);
   }
+  if (toolName === "railway") {
+    const managed = managedRailwayBin(options.env);
+    return existsSync(managed) ? managed : null;
+  }
   const npmTool = findNpmTool(toolName);
   if (npmTool) {
     return resolveNpmToolRuntimeBinary(npmTool);
@@ -664,6 +833,95 @@ async function installGh(options) {
     rmSync(stagingRoot, { recursive: true, force: true });
   }
 }
+async function installRailway(options) {
+  const asset = currentRailwayPlatformAsset();
+  if (!asset) {
+    return report({
+      name: "railway",
+      kind: "download",
+      version: RAILWAY_VERSION,
+      source: "not-applicable",
+      status: "unsupported",
+      required: true,
+      detail: "Managed Railway CLI installation supports Linux and macOS on x64 or arm64."
+    });
+  }
+  const binaryPath = managedRailwayBin(options.env);
+  if (existsSync(binaryPath)) {
+    const check = checkCommand(binaryPath, ["--version"], {
+      cwd: options.tenantRoot,
+      env: options.env,
+      spawn: options.spawn
+    });
+    if (check.ok && check.stdout.includes(RAILWAY_VERSION)) {
+      return report({
+        name: "railway",
+        kind: "download",
+        version: RAILWAY_VERSION,
+        source: "managed-cache",
+        binaryPath,
+        status: options.force ? "repaired" : "already-present",
+        required: true,
+        detail: check.stdout.split("\n")[0] ?? `Railway CLI ${RAILWAY_VERSION} is installed.`
+      });
+    }
+  }
+  const toolsHome = resolveToolsHome(options.env);
+  const tmpRoot = resolve(toolsHome, ".tmp", `railway-${process.pid}-${Date.now()}`);
+  const archivePath = resolve(tmpRoot, asset.assetName);
+  const extractRoot = resolve(tmpRoot, "extract");
+  const installRoot = dirname(dirname(binaryPath));
+  const stagingRoot = `${installRoot}.staging-${process.pid}-${Date.now()}`;
+  try {
+    options.write?.(`Installing Railway CLI ${RAILWAY_VERSION}...`);
+    rmSync(tmpRoot, { recursive: true, force: true });
+    mkdirSync(extractRoot, { recursive: true });
+    await options.downloadFile(`${RAILWAY_RELEASE_BASE_URL}/${asset.assetName}`, archivePath);
+    const assetHash = sha256File(archivePath);
+    if (assetHash !== asset.sha256) {
+      throw new Error(`Railway CLI archive hash mismatch for ${asset.assetName}: expected ${asset.sha256}, got ${assetHash}.`);
+    }
+    const tar = await import("tar");
+    await tar.x({ file: archivePath, cwd: extractRoot });
+    const extractedBinary = resolve(extractRoot, "railway");
+    if (!existsSync(extractedBinary)) throw new Error(`Unable to find railway binary in ${asset.assetName}.`);
+    rmSync(stagingRoot, { recursive: true, force: true });
+    mkdirSync(resolve(stagingRoot, "bin"), { recursive: true });
+    copyFileSync(extractedBinary, resolve(stagingRoot, "bin", "railway"));
+    chmodSync(resolve(stagingRoot, "bin", "railway"), 493);
+    rmSync(installRoot, { recursive: true, force: true });
+    mkdirSync(dirname(installRoot), { recursive: true });
+    renameSync(stagingRoot, installRoot);
+    const check = checkCommand(binaryPath, ["--version"], { cwd: options.tenantRoot, env: options.env, spawn: options.spawn });
+    if (!check.ok || !check.stdout.includes(RAILWAY_VERSION)) {
+      throw new Error(check.detail || `Railway CLI ${RAILWAY_VERSION} failed after installation.`);
+    }
+    return report({
+      name: "railway",
+      kind: "download",
+      version: RAILWAY_VERSION,
+      source: "managed-cache",
+      binaryPath,
+      status: options.force ? "repaired" : "installed",
+      required: true,
+      detail: check.stdout.split("\n")[0] ?? `Railway CLI ${RAILWAY_VERSION} installed.`
+    });
+  } catch (error) {
+    return report({
+      name: "railway",
+      kind: "download",
+      version: RAILWAY_VERSION,
+      source: "managed-cache",
+      binaryPath,
+      status: "failed",
+      required: true,
+      detail: error instanceof Error ? error.message : String(error)
+    });
+  } finally {
+    rmSync(tmpRoot, { recursive: true, force: true });
+    rmSync(stagingRoot, { recursive: true, force: true });
+  }
+}
 function statusForNpmTool(tool, options) {
   try {
     const binaryPath = resolveNpmToolRuntimeBinary(tool);
@@ -808,6 +1066,7 @@ async function installTreeseedDependencies(options = {}) {
   const reports = [
     systemStatus("git", true, effectiveOptions),
     await installGh(effectiveOptions),
+    await installRailway(effectiveOptions),
     ...NPM_TOOLS.map((tool) => statusForNpmTool(tool, effectiveOptions)),
     ...NPM_PACKAGES.map((pkg) => statusForNpmPackage(pkg)),
     systemStatus("docker", false, effectiveOptions),
@@ -844,9 +1103,21 @@ function collectTreeseedDependencyStatus(options = {}) {
     required: true,
     detail: `GitHub CLI ${GH_VERSION} is not installed in the Treeseed tool cache.`
   });
+  const railwayBinary = managedRailwayBin(env);
+  const railwayStatus = report({
+    name: "railway",
+    kind: "download",
+    version: RAILWAY_VERSION,
+    source: "managed-cache",
+    binaryPath: railwayBinary,
+    status: existsSync(railwayBinary) ? "already-present" : "missing",
+    required: true,
+    detail: existsSync(railwayBinary) ? `Railway CLI ${RAILWAY_VERSION} is installed in the Treeseed tool cache.` : `Railway CLI ${RAILWAY_VERSION} is not installed in the Treeseed tool cache.`
+  });
   const reports = [
     systemStatus("git", true, options),
     ghStatus,
+    railwayStatus,
     ...NPM_TOOLS.map((tool) => statusForNpmTool(tool, options)),
     ...NPM_PACKAGES.map((pkg) => statusForNpmPackage(pkg)),
     systemStatus("docker", false, options),
@@ -901,12 +1172,15 @@ function formatTreeseedDependencyReport(result) {
   ].join("\n");
 }
 export {
+  collectInstalledNativeDependencyIssues,
   collectTreeseedDependencyStatus,
   collectTreeseedToolStatus,
   createTreeseedManagedToolEnv,
   formatTreeseedDependencyFailureDetails,
   formatTreeseedDependencyReport,
   installTreeseedDependencies,
+  repairInstalledNativeDependencies,
   resolveTreeseedToolBinary,
-  resolveTreeseedToolCommand
+  resolveTreeseedToolCommand,
+  staleNpmGitClonePath
 };

package/dist/operations/services/deploy.js

@@ -616,7 +616,7 @@ function defaultStateFromConfig(deployConfig, target) {
             projectId: serviceConfig?.railway?.projectId ?? null,
             projectName: serviceConfig?.railway?.projectName ?? sharedDeploymentName(identity),
             serviceId: serviceConfig?.railway?.serviceId ?? null,
-            serviceName: serviceConfig?.railway?.serviceName ?? sharedDeploymentName(identity, serviceKey),
+            serviceName: serviceConfig?.environments?.[scope]?.serviceName ?? serviceConfig?.railway?.serviceName ?? sharedDeploymentName(identity, serviceKey),
             workerName: serviceConfig?.cloudflare?.workerName ?? null,
             rootDir: serviceConfig?.railway?.rootDir ?? serviceConfig?.rootDir ?? null,
             environment: normalizeRailwayEnvironmentName(serviceConfig?.environments?.[scope]?.railwayEnvironment ?? scope),
@@ -2563,7 +2563,7 @@ function configuredRailwayDestroyTargets(tenantRoot, deployConfig, scope) {
     if (!service || service.enabled === false || (service.provider ?? "railway") !== "railway") {
       continue;
     }
-    const baseServiceName = service.railway?.serviceName ?? `${identity.deploymentKey}-${serviceKey === "operationsRunner" ? "operations-runner" : serviceKey}`;
+    const baseServiceName = service.environments?.[normalizedScope]?.serviceName ?? service.railway?.serviceName ?? `${identity.deploymentKey}-${serviceKey === "operationsRunner" ? "operations-runner" : serviceKey}`;
     const runnerPool = serviceKey === "operationsRunner" && service.railway?.runnerPool && typeof service.railway.runnerPool === "object" ? service.railway.runnerPool : null;
     const count = serviceKey === "operationsRunner" ? Math.max(1, Number.parseInt(String(runnerPool?.bootstrapCount ?? 1), 10) || 1) : 1;
     for (let index = 1; index <= count; index += 1) {
@@ -2662,7 +2662,7 @@ async function destroyRailwayResources(tenantRoot, deployConfig, target, { planO
           if (planOnly) {
             operations.push(resourceOperation("railway", "custom-domain", domain.domain, "planned", { id: domain.id }));
           } else {
-            const result = await deleteRailwayCustomDomain({ domainId: domain.id, env });
+            const result = await deleteRailwayCustomDomain({ projectId: project.id, environmentId: environment.id, serviceId: railwayService.id, domainId: domain.id, env });
             operations.push(resourceOperation("railway", "custom-domain", domain.domain, result.status, { id: domain.id }));
           }
         }
@@ -2678,7 +2678,7 @@ async function destroyRailwayResources(tenantRoot, deployConfig, target, { planO
         if (planOnly) {
           operations.push(resourceOperation("railway", "volume", volume.name, "planned", { id: volume.id, projectId: project.id }));
         } else {
-          const result = await deleteRailwayVolume({ volumeId: volume.id, env });
+          const result = await deleteRailwayVolume({ projectId: project.id, environmentId: environment.id, volumeId: volume.id, env });
           operations.push(resourceOperation("railway", "volume", volume.name, result.status, { id: volume.id, projectId: project.id }));
         }
       }
@@ -2697,7 +2697,7 @@ async function destroyRailwayResources(tenantRoot, deployConfig, target, { planO
       if (planOnly) {
         operations.push(resourceOperation("railway", "environment", environment.name, "planned", { id: environment.id, projectId: project.id }));
       } else {
-        const result = await deleteRailwayEnvironment({ environmentId: environment.id, env });
+        const result = await deleteRailwayEnvironment({ projectId: project.id, environmentId: environment.id, env });
         operations.push(resourceOperation("railway", "environment", environment.name, result.status, { id: environment.id, projectId: project.id }));
       }
     }

package/dist/operations/services/deployment-readiness.js

@@ -2,6 +2,7 @@ import { relative, resolve } from "node:path";
 import { compileTreeseedHostingGraph, serializeHostingUnit } from "../../hosting/index.js";
 import { discoverTreeseedPackageAdapters } from "./package-adapters.js";
 import { configuredRailwayServices } from "./railway-deploy.js";
+import { railwayEnvironmentQualifiedServiceName } from "./railway-source-policy.js";
 function relRoot(tenantRoot, path) {
   const value = relative(tenantRoot, path).split("\\").join("/");
   return value || ".";
@@ -143,8 +144,8 @@ function collectTreeseedDeploymentReadiness(options) {
     checks.push(check("hosting:api:healthcheckPath", api.config?.healthcheckPath, "/healthz", "API healthcheck path is /healthz.", "Set services.api.railway.healthcheckPath to /healthz.", "healthcheckPath"));
   }
   if (railwayApi) {
-    const expectedServiceName = "treeseed-api";
-    checks.push(check("railway-config:api:serviceName", railwayApi.serviceName, expectedServiceName, "Railway API service uses the project-wide canonical name.", `Set the API service identity to ${expectedServiceName} for every environment.`, "serviceName"));
+    const expectedServiceName = railwayEnvironmentQualifiedServiceName("treeseed-api", environment);
+    checks.push(check("railway-config:api:serviceName", railwayApi.serviceName, expectedServiceName, "Railway API service uses its environment-qualified identity.", `Set services.api.environments.${environment}.serviceName to ${expectedServiceName}.`, "serviceName"));
     checks.push(check("railway-config:api:rootDirectory", relRoot(tenantRoot, railwayApi.rootDir), expectedApiRailwayRoot, "Railway API effective rootDirectory points at the API app.", "Set services.api.railway.rootDir relative to the owning API manifest.", "rootDirectory"));
   }
   if (!runner) {
@@ -177,8 +178,8 @@ function collectTreeseedDeploymentReadiness(options) {
     checks.push(check("hosting:operationsRunner:volumeMountPath", runner.config?.volumeMountPath, "/data", "Runner volume mount path is stable.", "Set services.operationsRunner.railway.volumeMountPath to /data.", "volumeMountPath"));
   }
   if (railwayRunner) {
-    const expectedServiceName = "treeseed-api-operations-runner-01";
-    checks.push(check("railway-config:operationsRunner:serviceName", railwayRunner.serviceName, expectedServiceName, "Railway runner uses the project-wide canonical service name.", `Set the runner service identity to ${expectedServiceName} for every environment.`, "serviceName"));
+    const expectedServiceName = railwayEnvironmentQualifiedServiceName("treeseed-ops-01", environment);
+    checks.push(check("railway-config:operationsRunner:serviceName", railwayRunner.serviceName, expectedServiceName, "Railway runner uses its environment-qualified identity.", `Set services.operationsRunner.environments.${environment}.serviceName to ${expectedServiceName}.`, "serviceName"));
     checks.push(check("railway-config:operationsRunner:rootDirectory", relRoot(tenantRoot, railwayRunner.rootDir), expectedRunnerRailwayRoot, "Railway runner effective rootDirectory points at the API app.", "Set services.operationsRunner.railway.rootDir relative to the owning API manifest.", "rootDirectory"));
   }
   if (!database) {

package/dist/operations/services/git-runner.d.ts

@@ -49,6 +49,8 @@ type RunOptions = {
 export type TreeseedGitBatchOperation = RunOptions & {
     args: string[];
 };
+export declare function treeseedGitCommandUsesRemote(args: string[]): boolean;
+export declare function resolveTreeseedGitCommandTimeoutMs(args: string[], timeoutMs?: number): number | undefined;
 export declare function classifyTreeseedGitMode(args: string[]): TreeseedGitRunnerMode;
 export declare function inspectTreeseedGitLocks(cwd: string): TreeseedGitLockDiagnostic;
 export declare function inspectTreeseedGitLockSet(cwd: string): TreeseedGitLockDiagnostic[];

package/dist/operations/services/git-runner.js

@@ -1,6 +1,14 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
+const DEFAULT_REMOTE_GIT_TIMEOUT_MS = 6e4;
+const REMOTE_GIT_COMMANDS = /* @__PURE__ */ new Set(["clone", "fetch", "ls-remote", "pull", "push"]);
+function treeseedGitCommandUsesRemote(args) {
+  return REMOTE_GIT_COMMANDS.has(args[0] ?? "");
+}
+function resolveTreeseedGitCommandTimeoutMs(args, timeoutMs) {
+  return timeoutMs ?? (treeseedGitCommandUsesRemote(args) ? DEFAULT_REMOTE_GIT_TIMEOUT_MS : void 0);
+}
 function pidAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -26,15 +34,26 @@ function gitSync(args, options) {
       }
     }
   }
+  if (treeseedGitCommandUsesRemote(args) && !env.GIT_SSH_COMMAND) {
+    env.GIT_SSH_COMMAND = "ssh -o ConnectTimeout=15 -o ServerAliveInterval=15 -o ServerAliveCountMax=2";
+  }
+  const timeoutMs = resolveTreeseedGitCommandTimeoutMs(args, options.timeoutMs);
   const spawnOptions = {
     cwd: options.cwd,
     env,
     encoding: "utf8",
     stdio: "pipe",
-    timeout: options.timeoutMs,
+    timeout: timeoutMs,
     maxBuffer: options.maxBuffer ?? 1024 * 1024 * 32
   };
   const result = spawnSync("git", args, spawnOptions);
+  if (result.error) {
+    const code = result.error.code;
+    if (code === "ETIMEDOUT") {
+      throw new Error(`Git remote command timed out after ${timeoutMs}ms: git ${args.join(" ")} in ${options.cwd}. Check network and repository access, then rerun the Treeseed command.`);
+    }
+    throw new Error(`Unable to run git ${args.join(" ")} in ${options.cwd}: ${result.error.message}`);
+  }
   const output = {
     status: result.status,
     stdout: result.stdout ?? "",
@@ -472,8 +491,10 @@ export {
   inspectTreeseedGitLocks,
   inspectTreeseedWorkspaceGitLocks,
   recoverTreeseedGitLocks,
+  resolveTreeseedGitCommandTimeoutMs,
   runTreeseedGit,
   runTreeseedGitBatch,
   runTreeseedGitOk,
-  runTreeseedGitText
+  runTreeseedGitText,
+  treeseedGitCommandUsesRemote
 };

package/dist/operations/services/hosted-service-checks.js

@@ -236,6 +236,19 @@ function collectTreeseedHostedServiceChecks(options) {
         status: isImmutableRailwayImageRef(service.imageRef) ? "passed" : "failed",
         issues: isImmutableRailwayImageRef(service.imageRef) ? [] : [`Production API Railway service ${service.serviceName} is missing an immutable image ref.`]
       }));
+      const observedGitSource = Boolean(observed?.deploymentRepo || observed?.deploymentBranch);
+      checks.push(check({
+        id: `railway:${service.instanceKey}:production-source-isolation`,
+        provider: "railway",
+        serviceKey: service.key,
+        serviceType,
+        target,
+        description: `Railway ${service.serviceName} production deployment has no Git source.`,
+        expected: { repo: null, branch: null },
+        observed: observed ? { repo: observed.deploymentRepo ?? null, branch: observed.deploymentBranch ?? null } : { skipped: true },
+        status: observed ? observedGitSource ? "failed" : "passed" : "skipped",
+        issues: observed && observedGitSource ? [`Production API Railway service ${service.serviceName} still reports Git source metadata.`] : []
+      }));
     }
     checks.push(check({
       id: `railway:${service.instanceKey}:service`,
@@ -304,6 +317,21 @@ function collectTreeseedHostedServiceChecks(options) {
           issues: !observed || sourceUploadDeployment || actualBranch === service.sourceBranch ? [] : [`Expected deployment branch=${service.sourceBranch}, observed ${actualBranch ?? "(unset)"}.`]
         }));
       }
+      if (service.sourceCommit) {
+        const actualCommit = observed?.deploymentCommitHash ?? null;
+        checks.push(check({
+          id: `railway:${service.instanceKey}:deployment-commit`,
+          provider: "railway",
+          serviceKey: service.key,
+          serviceType,
+          target,
+          description: `Railway ${service.serviceName} latest deployment uses the exact promoted commit.`,
+          expected: { commitHash: service.sourceCommit },
+          observed: observed ? { commitHash: actualCommit } : { skipped: true },
+          status: observed ? statusForMatch(actualCommit, service.sourceCommit) : "skipped",
+          issues: !observed || actualCommit === service.sourceCommit ? [] : [`Expected deployment commitHash=${service.sourceCommit}, observed ${actualCommit ?? "(unset)"}.`]
+        }));
+      }
       if (expectedRootDirectory) {
         checks.push(check({
           id: `railway:${service.instanceKey}:deployment-root-directory`,