@treeseed/sdk 0.5.3 → 0.6.0

package/dist/operations/services/railway-deploy.js

@@ -1,13 +1,37 @@
 import { existsSync } from "node:fs";
-import { resolve } from "node:path";
+import { relative, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { loadCliDeployConfig } from "./runtime-tools.js";
-const DEFAULT_RAILWAY_API_URL = "https://backboard.railway.com/graphql/v2";
+import { createPersistentDeployTarget, resolveTreeseedResourceIdentity } from "./deploy.js";
+import {
+  ensureRailwayEnvironment,
+  ensureRailwayProject,
+  ensureRailwayService,
+  ensureRailwayServiceInstanceConfiguration,
+  listRailwayEnvironments,
+  listRailwayProjects,
+  listRailwayServices,
+  normalizeRailwayEnvironmentName,
+  railwayGraphqlRequest,
+  resolveRailwayApiToken,
+  resolveRailwayApiUrl,
+  resolveRailwayWorkspace,
+  resolveRailwayWorkspaceContext
+} from "./railway-api.js";
 function normalizeScope(scope) {
   return scope === "prod" ? "prod" : scope === "staging" ? "staging" : "local";
 }
+function resolveRailwayEnvironmentForScope(scope, configuredEnvironment) {
+  return normalizeRailwayEnvironmentName(configuredEnvironment || normalizeScope(scope));
+}
 const RAILWAY_SERVICE_KEYS = ["api", "manager", "worker", "workdayStart", "workdayReport"];
 const HOSTED_PROJECT_SERVICE_KEYS = ["api", "manager", "worker"];
+function shouldManageRailwaySchedules(scope, phase = "deploy") {
+  return phase === "deploy" && normalizeRailwayEnvironmentName(scope) === "production";
+}
+function railwayServiceNameSuffix(serviceKey) {
+  return serviceKey === "workdayStart" ? "workday-start" : serviceKey === "workdayReport" ? "workday-report" : serviceKey;
+}
 function normalizeScheduleExpressions(value) {
   if (typeof value === "string" && value.trim()) {
     return [value.trim()];
@@ -21,6 +45,30 @@ function envValue(name) {
   const value = process.env[name];
   return typeof value === "string" && value.trim() ? value.trim() : "";
 }
+function relativeRailwayRootDir(tenantRoot, serviceRoot) {
+  const resolved = relative(tenantRoot, serviceRoot).replace(/\\/gu, "/");
+  return !resolved || resolved === "" ? "." : resolved;
+}
+function configuredEnvValue(env, name) {
+  const value = env?.[name];
+  return typeof value === "string" && value.trim() ? value.trim() : "";
+}
+function isUsableRailwayToken(value) {
+  return typeof value === "string" && value.trim().length >= 8;
+}
+function resolveRailwayAuthToken(env = process.env) {
+  return resolveRailwayApiToken(env);
+}
+function buildRailwayCommandEnv(env = process.env) {
+  const merged = { ...env };
+  const token = resolveRailwayAuthToken(merged);
+  if (token) {
+    merged.RAILWAY_API_TOKEN = token;
+  } else {
+    delete merged.RAILWAY_API_TOKEN;
+  }
+  return merged;
+}
 function normalizeRailwaySchedule(schedule) {
   if (!schedule || typeof schedule !== "object") {
     return null;
@@ -70,31 +118,46 @@ function collectRailwaySchedules(value, seen = /* @__PURE__ */ new Set()) {
   visit(value);
   return matches;
 }
-async function railwayGraphqlRequest({
-  query,
-  variables,
-  apiToken = envValue("RAILWAY_API_TOKEN") || envValue("RAILWAY_TOKEN"),
-  apiUrl = envValue("TREESEED_RAILWAY_API_URL") || DEFAULT_RAILWAY_API_URL,
-  fetchImpl = fetch
-}) {
-  if (!apiToken) {
-    throw new Error("Configure RAILWAY_API_TOKEN before invoking Railway GraphQL APIs.");
-  }
-  const response = await fetchImpl(apiUrl, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${apiToken}`,
-      "content-type": "application/json"
-    },
-    body: JSON.stringify({ query, variables })
-  });
-  const payload = await response.json().catch(() => ({}));
-  if (!response.ok || Array.isArray(payload?.errors) && payload.errors.length > 0) {
-    throw new Error(
-      payload?.errors?.[0]?.message ?? `Railway GraphQL request failed with ${response.status}.`
-    );
+function normalizeRailwayProjectList(payload) {
+  try {
+    const parsed = JSON.parse(payload);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed.map((entry) => {
+      if (!entry || typeof entry !== "object") {
+        return null;
+      }
+      const id = typeof entry.id === "string" ? entry.id.trim() : "";
+      const name = typeof entry.name === "string" ? entry.name.trim() : "";
+      if (!id && !name) {
+        return null;
+      }
+      return { id, name };
+    }).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function railwayMessage(result) {
+  return `${result?.stderr ?? ""}
+${result?.stdout ?? ""}`.trim();
+}
+function isRailwayAlreadyExistsMessage(result) {
+  return /already exists|already taken|duplicate|has already been taken/iu.test(railwayMessage(result));
+}
+function isRailwayTransientFailure(result) {
+  return /timed out|failed to fetch|temporarily unavailable|econnreset|etimedout/iu.test(railwayMessage(result));
+}
+function sleepSync(milliseconds) {
+  if (!Number.isFinite(milliseconds) || milliseconds <= 0) {
+    return;
   }
-  return payload;
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+function isRailwayScheduleCapabilityError(error) {
+  const message = error instanceof Error ? error.message : String(error ?? "");
+  return /cronTriggers|cronTriggerCreate|cronTriggerUpdate/iu.test(message);
 }
 function defaultRailwayScheduleQueries() {
   return {
@@ -164,27 +227,222 @@ mutation TreeseedScheduleUpdate($id: String!, $name: String!, $schedule: String!
 `.trim()
   };
 }
-function runRailway(args, { cwd, capture = false, allowFailure = false } = {}) {
-  const result = spawnSync("railway", args, {
+function runRailway(args, { cwd, capture = false, allowFailure = false, input, env } = {}) {
+  const effectiveEnv = buildRailwayCommandEnv({ ...process.env, ...env ?? {} });
+  const runWithEnv = (spawnEnv) => spawnSync("railway", args, {
     cwd,
-    stdio: capture ? "pipe" : "inherit",
+    stdio: input !== void 0 ? ["pipe", capture ? "pipe" : "inherit", capture ? "pipe" : "inherit"] : capture ? "pipe" : "inherit",
     encoding: "utf8",
-    env: { ...process.env }
+    env: spawnEnv,
+    input
   });
+  const result = runWithEnv(effectiveEnv);
   if (result.status !== 0 && !allowFailure) {
     throw new Error(result.stderr?.trim() || result.stdout?.trim() || `railway ${args.join(" ")} failed`);
   }
   return result;
 }
+function shellEscape(value) {
+  return `'${String(value).replace(/'/gu, `'\\''`)}'`;
+}
+function setRailwaySecretVariable({ cwd, service, environment, key, value, env = process.env, capture = false, allowFailure = false }) {
+  const effectiveEnv = buildRailwayCommandEnv({
+    ...process.env,
+    ...env ?? {},
+    TREESEED_RAILWAY_SECRET_VALUE: value
+  });
+  const command = [
+    'printf %s\\\\n "$TREESEED_RAILWAY_SECRET_VALUE"',
+    "|",
+    "railway variable set",
+    "--service",
+    shellEscape(service),
+    "--environment",
+    shellEscape(environment),
+    "--stdin",
+    "--skip-deploys",
+    shellEscape(key)
+  ].join(" ");
+  let result = null;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    result = spawnSync("bash", ["-lc", command], {
+      cwd,
+      stdio: capture ? "pipe" : "inherit",
+      encoding: "utf8",
+      env: effectiveEnv
+    });
+    if (result.status === 0) {
+      return result;
+    }
+    if (!isRailwayTransientFailure(result)) {
+      break;
+    }
+  }
+  if (result?.status !== 0 && !allowFailure) {
+    throw new Error(result?.stderr?.trim() || result?.stdout?.trim() || `railway variable set --stdin ${key} failed`);
+  }
+  return result;
+}
+function ensureRailwayProjectExists(service, { env = process.env } = {}) {
+  const projectName = typeof service?.projectName === "string" ? service.projectName.trim() : "";
+  if (!projectName) {
+    throw new Error(`Railway service ${service?.key ?? service?.serviceName ?? service?.serviceId ?? "(unknown)"} is missing a projectName.`);
+  }
+  const listed = runRailway(["list", "--json"], {
+    cwd: service.rootDir,
+    capture: true,
+    allowFailure: true,
+    env
+  });
+  if (listed.status === 0) {
+    const match = normalizeRailwayProjectList(listed.stdout ?? "").find((entry) => entry.name === projectName || entry.id === projectName);
+    if (match) {
+      return match;
+    }
+  }
+  const args = ["init", "--name", projectName, "--json"];
+  const workspace = resolveRailwayWorkspace(env);
+  if (workspace) {
+    args.push("--workspace", workspace);
+  }
+  const created = runRailway(args, {
+    cwd: service.rootDir,
+    capture: true,
+    allowFailure: true,
+    env
+  });
+  if (created.status !== 0 && !isRailwayAlreadyExistsMessage(created)) {
+    throw new Error(railwayMessage(created) || `railway ${args.join(" ")} failed`);
+  }
+  return null;
+}
+function ensureRailwayEnvironmentExists(service, { env = process.env } = {}) {
+  const environmentName = normalizeRailwayEnvironmentName(service?.railwayEnvironment);
+  if (!environmentName) {
+    return null;
+  }
+  const linkResult = runRailway(["environment", "link", environmentName, "--json"], {
+    cwd: service.rootDir,
+    capture: true,
+    allowFailure: true,
+    env
+  });
+  if (linkResult.status === 0) {
+    return linkResult;
+  }
+  const createResult = runRailway(["environment", "new", environmentName, "--json"], {
+    cwd: service.rootDir,
+    capture: true,
+    allowFailure: true,
+    env
+  });
+  if (createResult.status !== 0 && !isRailwayAlreadyExistsMessage(createResult)) {
+    throw new Error(railwayMessage(createResult) || `railway environment new ${environmentName} failed`);
+  }
+  const relinkResult = runRailway(["environment", "link", environmentName, "--json"], {
+    cwd: service.rootDir,
+    capture: true,
+    allowFailure: true,
+    env
+  });
+  if (relinkResult.status !== 0) {
+    throw new Error(railwayMessage(relinkResult) || `railway environment link ${environmentName} failed`);
+  }
+  return relinkResult;
+}
+function ensureRailwayServiceExists(service, { env = process.env } = {}) {
+  const serviceSelector = typeof (service?.serviceName ?? service?.serviceId) === "string" ? String(service.serviceName ?? service.serviceId).trim() : "";
+  if (!serviceSelector) {
+    throw new Error(`Railway service ${service?.key ?? "(unknown)"} is missing a service selector.`);
+  }
+  const statusArgs = ["service", "status", "--service", serviceSelector, "--environment", service.railwayEnvironment, "--json"];
+  const statusResult = runRailway(statusArgs, {
+    cwd: service.rootDir,
+    capture: true,
+    allowFailure: true,
+    env
+  });
+  if (statusResult.status === 0) {
+    return statusResult;
+  }
+  const createResult = runRailway(["add", "--service", serviceSelector, "--json"], {
+    cwd: service.rootDir,
+    capture: true,
+    allowFailure: true,
+    env
+  });
+  if (createResult.status !== 0 && !isRailwayAlreadyExistsMessage(createResult)) {
+    throw new Error(railwayMessage(createResult) || `railway add --service ${serviceSelector} failed`);
+  }
+  const refreshed = runRailway(statusArgs, {
+    cwd: service.rootDir,
+    capture: true,
+    allowFailure: true,
+    env
+  });
+  if (refreshed.status !== 0) {
+    throw new Error(railwayMessage(refreshed) || `railway service status --service ${serviceSelector} failed`);
+  }
+  return refreshed;
+}
+function ensureRailwayProjectContext(service, { env = process.env, allowFailure = false, capture = false } = {}) {
+  ensureRailwayProjectExists(service, { env });
+  let projectSelector = service?.projectId ?? "";
+  if ((!projectSelector || !String(projectSelector).trim()) && service?.projectName) {
+    const listed = runRailway(["list", "--json"], {
+      cwd: service.rootDir,
+      capture: true,
+      allowFailure: true,
+      env
+    });
+    if (listed.status === 0) {
+      const match = normalizeRailwayProjectList(listed.stdout ?? "").find((entry) => entry.name === service.projectName || entry.id === service.projectName);
+      projectSelector = match?.id || match?.name || service.projectName;
+    } else {
+      projectSelector = service.projectName;
+    }
+  }
+  projectSelector = typeof projectSelector === "string" ? projectSelector.trim() : "";
+  if (typeof projectSelector !== "string" || projectSelector.trim().length === 0) {
+    throw new Error(`Railway service ${service?.key ?? service?.serviceName ?? service?.serviceId ?? "(unknown)"} is missing a project selector.`);
+  }
+  const args = ["link", "--project", projectSelector];
+  const workspace = resolveRailwayWorkspace(env);
+  if (workspace) {
+    args.push("--workspace", workspace);
+  }
+  const environmentName = normalizeRailwayEnvironmentName(service?.railwayEnvironment);
+  if (environmentName) {
+    args.push("--environment", environmentName);
+  }
+  runRailway(args, {
+    cwd: service.rootDir,
+    capture,
+    allowFailure,
+    env
+  });
+  if (environmentName) {
+    ensureRailwayEnvironmentExists(service, { env });
+    return runRailway(["environment", "link", environmentName, "--json"], {
+      cwd: service.rootDir,
+      capture,
+      allowFailure,
+      env
+    });
+  }
+  return null;
+}
 function configuredRailwayServices(tenantRoot, scope) {
   const deployConfig = loadCliDeployConfig(tenantRoot);
   const normalizedScope = normalizeScope(scope);
+  const identity = resolveTreeseedResourceIdentity(deployConfig, createPersistentDeployTarget(normalizedScope));
   const managedRuntime = deployConfig.runtime?.mode === "treeseed_managed";
   const hostingKind = deployConfig.hosting?.kind ?? (managedRuntime ? "hosted_project" : "self_hosted_project");
   if (!managedRuntime) {
     return [];
   }
-  const serviceKeys = hostingKind === "hosted_project" ? HOSTED_PROJECT_SERVICE_KEYS : RAILWAY_SERVICE_KEYS;
+  const configuredOptionalServiceKeys = Object.keys(deployConfig.services ?? {}).filter((serviceKey) => RAILWAY_SERVICE_KEYS.includes(serviceKey));
+  const serviceKeys = hostingKind === "hosted_project" ? [.../* @__PURE__ */ new Set([...HOSTED_PROJECT_SERVICE_KEYS, ...configuredOptionalServiceKeys])] : RAILWAY_SERVICE_KEYS;
   return serviceKeys.map((serviceKey) => {
     const service = deployConfig.services?.[serviceKey];
     if (!service || service.enabled === false || (service.provider ?? "railway") !== "railway") {
@@ -192,26 +450,37 @@ function configuredRailwayServices(tenantRoot, scope) {
     }
     const defaultRootDir = ["api", "manager", "worker", "workdayStart", "workdayReport"].includes(serviceKey) ? "." : "packages/core";
     const serviceRoot = resolve(tenantRoot, service.railway?.rootDir ?? service.rootDir ?? defaultRootDir);
-    const railwayEnvironment = service.environments?.[normalizedScope]?.railwayEnvironment ?? normalizedScope;
+    const railwayEnvironment = resolveRailwayEnvironmentForScope(
+      normalizedScope,
+      service.environments?.[normalizedScope]?.railwayEnvironment
+    );
     const publicBaseUrl = service.environments?.[normalizedScope]?.baseUrl ?? service.publicBaseUrl ?? null;
     return {
       key: serviceKey,
       scope: normalizedScope,
       projectId: service.railway?.projectId ?? null,
-      projectName: service.railway?.projectName ?? null,
+      projectName: service.railway?.projectName ?? identity.deploymentKey,
       serviceId: service.railway?.serviceId ?? null,
-      serviceName: service.railway?.serviceName ?? null,
+      serviceName: service.railway?.serviceName ?? `${identity.deploymentKey}-${railwayServiceNameSuffix(serviceKey)}`,
       rootDir: serviceRoot,
       publicBaseUrl,
       railwayEnvironment,
       buildCommand: service.railway?.buildCommand ?? null,
       startCommand: service.railway?.startCommand ?? null,
+      healthcheckPath: service.railway?.healthcheckPath ?? null,
+      healthcheckTimeoutSeconds: service.railway?.healthcheckTimeoutSeconds ?? null,
+      healthcheckIntervalSeconds: service.railway?.healthcheckIntervalSeconds ?? null,
+      restartPolicy: service.railway?.restartPolicy ?? null,
+      runtimeMode: service.railway?.runtimeMode ?? null,
       schedule: normalizeScheduleExpressions(service.railway?.schedule),
       hostingKind
     };
   }).filter(Boolean);
 }
-function configuredRailwayScheduledJobs(tenantRoot, scope) {
+function configuredRailwayScheduledJobs(tenantRoot, scope, { phase = "deploy" } = {}) {
+  if (!shouldManageRailwaySchedules(scope, phase)) {
+    return [];
+  }
   return configuredRailwayServices(tenantRoot, scope).filter((service) => Array.isArray(service.schedule) && service.schedule.length > 0).flatMap(
     (service) => service.schedule.map((expression, index) => ({
       service: service.key,
@@ -219,7 +488,7 @@ function configuredRailwayScheduledJobs(tenantRoot, scope) {
       projectName: service.projectName,
       serviceId: service.serviceId,
       serviceName: service.serviceName,
-      environment: service.railwayEnvironment,
+      environment: normalizeRailwayEnvironmentName(service.railwayEnvironment),
       environmentId: envValue("TREESEED_RAILWAY_ENVIRONMENT_ID") || null,
       expression,
       command: service.startCommand,
@@ -228,12 +497,59 @@ function configuredRailwayScheduledJobs(tenantRoot, scope) {
     }))
   );
 }
+async function resolveRailwayScheduleTarget(schedule, {
+  env = process.env,
+  fetchImpl = fetch,
+  ensure = false
+} = {}) {
+  const workspace = await resolveRailwayWorkspaceContext({ env, fetchImpl });
+  const projects = await listRailwayProjects({
+    env,
+    workspaceId: workspace.id,
+    fetchImpl
+  });
+  let project = projects.find((entry) => entry.id === schedule.projectId || entry.name === schedule.projectName) ?? null;
+  if (!project && ensure) {
+    project = (await ensureRailwayProject({
+      projectId: schedule.projectId,
+      projectName: schedule.projectName,
+      defaultEnvironmentName: schedule.environment,
+      env,
+      workspace: workspace.name,
+      fetchImpl
+    })).project;
+  }
+  if (!project) {
+    return { workspace, project: null, environment: null, service: null };
+  }
+  let environment = project.environments.find((entry) => entry.id === schedule.environmentId || entry.name === schedule.environment) ?? null;
+  if (!environment) {
+    environment = ensure ? (await ensureRailwayEnvironment({
+      projectId: project.id,
+      environmentName: schedule.environment,
+      env,
+      fetchImpl
+    })).environment : (await listRailwayEnvironments({ projectId: project.id, env, fetchImpl })).find((entry) => entry.id === schedule.environmentId || entry.name === schedule.environment) ?? null;
+  }
+  let service = project.services.find((entry) => entry.id === schedule.serviceId || entry.name === schedule.serviceName) ?? null;
+  if (!service) {
+    service = ensure ? (await ensureRailwayService({
+      projectId: project.id,
+      serviceId: schedule.serviceId,
+      serviceName: schedule.serviceName,
+      env,
+      fetchImpl
+    })).service : (await listRailwayServices({ projectId: project.id, env, fetchImpl })).find((entry) => entry.id === schedule.serviceId || entry.name === schedule.serviceName) ?? null;
+  }
+  return { workspace, project, environment, service };
+}
 function resolveRailwayDeploymentProfile(tenantRoot) {
   const deployConfig = loadCliDeployConfig(tenantRoot);
   const hostingKind = deployConfig.hosting?.kind ?? (deployConfig.runtime?.mode === "treeseed_managed" ? "hosted_project" : "self_hosted_project");
+  const configuredOptionalServiceKeys = Object.keys(deployConfig.services ?? {}).filter((serviceKey) => RAILWAY_SERVICE_KEYS.includes(serviceKey));
   return {
     hostingKind,
-    managedTopology: deployConfig.runtime?.mode === "treeseed_managed" ? hostingKind === "hosted_project" ? [...HOSTED_PROJECT_SERVICE_KEYS] : [...RAILWAY_SERVICE_KEYS] : []
+    managedTopology: deployConfig.runtime?.mode === "treeseed_managed" ? hostingKind === "hosted_project" ? [.../* @__PURE__ */ new Set([...HOSTED_PROJECT_SERVICE_KEYS, ...configuredOptionalServiceKeys])] : [...RAILWAY_SERVICE_KEYS] : []
   };
 }
 function validateRailwayServiceConfiguration(tenantRoot, scope) {
@@ -268,168 +584,245 @@ function validateRailwayServiceConfiguration(tenantRoot, scope) {
   }
   return {
     services,
-    schedules: configuredRailwayScheduledJobs(tenantRoot, scope),
+    schedules: configuredRailwayScheduledJobs(tenantRoot, scope, { phase: "deploy" }),
     hostingKind,
     managedTopology
   };
 }
-function validateRailwayDeployPrerequisites(tenantRoot, scope) {
+function validateRailwayDeployPrerequisites(tenantRoot, scope, { env = process.env } = {}) {
   const validation = validateRailwayServiceConfiguration(tenantRoot, scope);
-  const token = process.env.RAILWAY_API_TOKEN;
+  const token = resolveRailwayAuthToken(env);
   if (typeof token !== "string" || token.trim().length === 0) {
     throw new Error("Configure RAILWAY_API_TOKEN before deploying Railway-managed services.");
   }
   return validation;
 }
-async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, fetchImpl = fetch, apiToken, apiUrl } = {}) {
-  const { schedules } = validateRailwayDeployPrerequisites(tenantRoot, scope);
+async function ensureRailwayScheduledJobs(tenantRoot, scope, { dryRun = false, fetchImpl = fetch, apiToken, apiUrl, env = process.env } = {}) {
+  const { schedules } = validateRailwayServiceConfiguration(tenantRoot, scope);
+  if (schedules.length === 0) {
+    return [];
+  }
+  const effectiveApiToken = apiToken || resolveRailwayAuthToken(env);
+  const effectiveApiUrl = apiUrl || resolveRailwayApiUrl(env);
+  if (typeof effectiveApiToken !== "string" || effectiveApiToken.trim().length === 0) {
+    throw new Error("Configure RAILWAY_API_TOKEN before deploying Railway-managed services.");
+  }
   const queries = defaultRailwayScheduleQueries();
   const results = [];
-  for (const schedule of schedules) {
-    if (!schedule.serviceId || !schedule.environmentId) {
-      results.push({
-        ...schedule,
-        id: null,
-        status: "skipped_missing_identifiers",
-        enabled: schedule.enabled !== false,
-        command: schedule.command
+  try {
+    for (const schedule of schedules) {
+      const target = await resolveRailwayScheduleTarget(schedule, {
+        env,
+        fetchImpl,
+        ensure: !dryRun
       });
-      continue;
-    }
-    const variables = {
-      projectId: schedule.projectId,
-      serviceId: schedule.serviceId,
-      environmentId: schedule.environmentId
-    };
-    const listed = await railwayGraphqlRequest({
-      query: queries.listQuery,
-      variables,
-      apiToken,
-      apiUrl,
-      fetchImpl
-    });
-    const existing = collectRailwaySchedules(listed?.data).find(
-      (entry) => entry.id && entry.id === schedule.id || entry.name && entry.name === schedule.logicalName || entry.expression === schedule.expression && entry.serviceId === schedule.serviceId && (!schedule.environmentId || entry.environmentId === schedule.environmentId)
-    );
-    const desired = {
-      name: schedule.logicalName,
-      schedule: schedule.expression,
-      command: schedule.command,
-      enabled: schedule.enabled !== false
-    };
-    const drifted = Boolean(
-      existing && (existing.expression !== desired.schedule || (existing.command ?? null) !== (desired.command ?? null) || existing.enabled !== desired.enabled)
-    );
-    if (dryRun) {
-      results.push({
-        ...schedule,
-        id: existing?.id ?? null,
-        status: existing ? drifted ? "planned_update" : "planned_noop" : "planned_create",
-        enabled: desired.enabled,
-        command: desired.command
-      });
-      continue;
-    }
-    if (!existing) {
-      const created = await railwayGraphqlRequest({
-        query: queries.createMutation,
-        variables: {
-          ...variables,
-          name: desired.name,
-          schedule: desired.schedule,
-          command: desired.command,
-          enabled: desired.enabled
-        },
-        apiToken,
-        apiUrl,
-        fetchImpl
-      });
-      const createdSchedule = collectRailwaySchedules(created?.data)[0];
-      if (!createdSchedule?.id) {
-        throw new Error(`Railway schedule create did not return an id for ${schedule.logicalName}.`);
+      if (!target.project || !target.environment || !target.service) {
+        results.push({
+          ...schedule,
+          id: null,
+          projectId: target.project?.id ?? null,
+          serviceId: target.service?.id ?? null,
+          environmentId: target.environment?.id ?? null,
+          status: "skipped_missing_identifiers",
+          enabled: schedule.enabled !== false,
+          command: schedule.command
+        });
+        continue;
       }
-      results.push({
-        ...schedule,
-        id: createdSchedule.id,
-        status: "created",
-        enabled: createdSchedule.enabled,
-        command: createdSchedule.command ?? desired.command
-      });
-      continue;
-    }
-    if (drifted) {
-      const updated = await railwayGraphqlRequest({
-        query: queries.updateMutation,
-        variables: {
-          id: existing.id,
-          name: desired.name,
-          schedule: desired.schedule,
-          command: desired.command,
-          enabled: desired.enabled
-        },
-        apiToken,
-        apiUrl,
+      const variables = {
+        projectId: target.project.id,
+        serviceId: target.service.id,
+        environmentId: target.environment.id
+      };
+      const listed = await railwayGraphqlRequest({
+        query: queries.listQuery,
+        variables,
+        apiToken: effectiveApiToken,
+        apiUrl: effectiveApiUrl,
         fetchImpl
       });
-      const updatedSchedule = collectRailwaySchedules(updated?.data)[0];
-      if (!updatedSchedule?.id) {
-        throw new Error(`Railway schedule update did not return an id for ${schedule.logicalName}.`);
+      const existing = collectRailwaySchedules(listed?.data).find(
+        (entry) => entry.id && entry.id === schedule.id || entry.name && entry.name === schedule.logicalName || entry.expression === schedule.expression && entry.serviceId === schedule.serviceId && (!schedule.environmentId || entry.environmentId === schedule.environmentId)
+      );
+      const desired = {
+        name: schedule.logicalName,
+        schedule: schedule.expression,
+        command: schedule.command,
+        enabled: schedule.enabled !== false
+      };
+      const drifted = Boolean(
+        existing && (existing.expression !== desired.schedule || (existing.command ?? null) !== (desired.command ?? null) || existing.enabled !== desired.enabled)
+      );
+      if (dryRun) {
+        results.push({
+          ...schedule,
+          projectId: variables.projectId,
+          id: existing?.id ?? null,
+          status: existing ? drifted ? "planned_update" : "planned_noop" : "planned_create",
+          enabled: desired.enabled,
+          command: desired.command,
+          serviceId: variables.serviceId,
+          environmentId: variables.environmentId
+        });
+        continue;
+      }
+      if (!existing) {
+        const created = await railwayGraphqlRequest({
+          query: queries.createMutation,
+          variables: {
+            ...variables,
+            name: desired.name,
+            schedule: desired.schedule,
+            command: desired.command,
+            enabled: desired.enabled
+          },
+          apiToken: effectiveApiToken,
+          apiUrl: effectiveApiUrl,
+          fetchImpl
+        });
+        const createdSchedule = collectRailwaySchedules(created?.data)[0];
+        if (!createdSchedule?.id) {
+          throw new Error(`Railway schedule create did not return an id for ${schedule.logicalName}.`);
+        }
+        results.push({
+          ...schedule,
+          projectId: variables.projectId,
+          id: createdSchedule.id,
+          status: "created",
+          enabled: createdSchedule.enabled,
+          command: createdSchedule.command ?? desired.command,
+          serviceId: variables.serviceId,
+          environmentId: variables.environmentId
+        });
+        continue;
+      }
+      if (drifted) {
+        const updated = await railwayGraphqlRequest({
+          query: queries.updateMutation,
+          variables: {
+            id: existing.id,
+            name: desired.name,
+            schedule: desired.schedule,
+            command: desired.command,
+            enabled: desired.enabled
+          },
+          apiToken: effectiveApiToken,
+          apiUrl: effectiveApiUrl,
+          fetchImpl
+        });
+        const updatedSchedule = collectRailwaySchedules(updated?.data)[0];
+        if (!updatedSchedule?.id) {
+          throw new Error(`Railway schedule update did not return an id for ${schedule.logicalName}.`);
+        }
+        results.push({
+          ...schedule,
+          projectId: variables.projectId,
+          id: updatedSchedule.id,
+          status: "updated",
+          enabled: updatedSchedule.enabled,
+          command: updatedSchedule.command ?? desired.command,
+          serviceId: variables.serviceId,
+          environmentId: variables.environmentId
+        });
+        continue;
       }
       results.push({
         ...schedule,
-        id: updatedSchedule.id,
-        status: "updated",
-        enabled: updatedSchedule.enabled,
-        command: updatedSchedule.command ?? desired.command
+        projectId: variables.projectId,
+        id: existing.id,
+        status: "noop",
+        enabled: existing.enabled,
+        command: existing.command ?? desired.command,
+        serviceId: variables.serviceId,
+        environmentId: variables.environmentId
       });
-      continue;
     }
-    results.push({
+  } catch (error) {
+    if (!isRailwayScheduleCapabilityError(error)) {
+      throw error;
+    }
+    return schedules.map((schedule) => ({
       ...schedule,
-      id: existing.id,
-      status: "noop",
-      enabled: existing.enabled,
-      command: existing.command ?? desired.command
-    });
+      id: null,
+      status: "unsupported",
+      enabled: schedule.enabled !== false,
+      command: schedule.command,
+      message: "Railway GraphQL no longer exposes cron trigger resources for this account. Schedule reconciliation is not currently supported."
+    }));
   }
   return results;
 }
-async function verifyRailwayScheduledJobs(tenantRoot, scope, { fetchImpl = fetch, apiToken, apiUrl } = {}) {
+async function verifyRailwayScheduledJobs(tenantRoot, scope, { fetchImpl = fetch, apiToken, apiUrl, env = process.env } = {}) {
+  const effectiveApiToken = apiToken || env?.RAILWAY_API_TOKEN;
+  const effectiveApiUrl = apiUrl || resolveRailwayApiUrl(env);
   const configured = configuredRailwayScheduledJobs(tenantRoot, scope);
   const queries = defaultRailwayScheduleQueries();
   const checks = [];
-  for (const schedule of configured) {
-    if (!schedule.serviceId || !schedule.environmentId) {
+  try {
+    for (const schedule of configured) {
+      const target = await resolveRailwayScheduleTarget(schedule, {
+        env,
+        fetchImpl,
+        ensure: false
+      });
+      if (!target.project || !target.environment || !target.service) {
+        checks.push({
+          ...schedule,
+          id: null,
+          ok: false,
+          status: "skipped_missing_identifiers",
+          message: `Railway schedule target is missing in workspace ${target.workspace.name}.`
+        });
+        continue;
+      }
+      const listed = await railwayGraphqlRequest({
+        query: queries.listQuery,
+        variables: {
+          projectId: target.project.id,
+          serviceId: target.service.id,
+          environmentId: target.environment.id
+        },
+        apiToken: effectiveApiToken,
+        apiUrl: effectiveApiUrl,
+        fetchImpl
+      });
+      const existing = collectRailwaySchedules(listed?.data).find(
+        (entry) => entry.name && entry.name === schedule.logicalName || entry.expression === schedule.expression && entry.serviceId === schedule.serviceId && (!schedule.environmentId || entry.environmentId === schedule.environmentId)
+      );
       checks.push({
         ...schedule,
-        id: null,
-        ok: false,
-        status: "skipped_missing_identifiers"
+        id: existing?.id ?? null,
+        projectId: target.project.id,
+        serviceId: target.service.id,
+        environmentId: target.environment.id,
+        ok: Boolean(
+          existing && existing.expression === schedule.expression && (existing.command ?? null) === (schedule.command ?? null) && existing.enabled !== false
+        ),
+        status: existing ? "checked" : "missing",
+        observed: existing ? {
+          expression: existing.expression,
+          command: existing.command ?? null,
+          enabled: existing.enabled
+        } : null,
+        message: existing ? void 0 : `Railway schedule ${schedule.logicalName} is missing for ${target.service.name} in ${target.environment.name}.`
       });
-      continue;
     }
-    const listed = await railwayGraphqlRequest({
-      query: queries.listQuery,
-      variables: {
-        projectId: schedule.projectId,
-        serviceId: schedule.serviceId,
-        environmentId: schedule.environmentId
-      },
-      apiToken,
-      apiUrl,
-      fetchImpl
-    });
-    const existing = collectRailwaySchedules(listed?.data).find(
-      (entry) => entry.name && entry.name === schedule.logicalName || entry.expression === schedule.expression && entry.serviceId === schedule.serviceId && (!schedule.environmentId || entry.environmentId === schedule.environmentId)
-    );
-    checks.push({
-      ...schedule,
-      id: existing?.id ?? null,
-      ok: Boolean(
-        existing && existing.expression === schedule.expression && (existing.command ?? null) === (schedule.command ?? null) && existing.enabled !== false
-      ),
-      status: existing ? "checked" : "missing"
-    });
+  } catch (error) {
+    if (!isRailwayScheduleCapabilityError(error)) {
+      throw error;
+    }
+    return {
+      ok: true,
+      unsupported: true,
+      message: "Railway GraphQL no longer exposes cron trigger resources for this account. Schedule verification is skipped.",
+      checks: configured.map((schedule) => ({
+        ...schedule,
+        id: null,
+        ok: true,
+        status: "unsupported",
+        message: "Railway GraphQL no longer exposes cron trigger resources for this account. Schedule verification is skipped."
+      }))
+    };
   }
   return {
     ok: checks.every((entry) => entry.ok === true),
@@ -438,8 +831,9 @@ async function verifyRailwayScheduledJobs(tenantRoot, scope, { fetchImpl = fetch
 }
 function planRailwayServiceDeploy(service) {
   const args = ["up", "--service", service.serviceName ?? service.serviceId, "--ci"];
-  if (service.railwayEnvironment) {
-    args.push("--environment", service.railwayEnvironment);
+  const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
+  if (environmentName) {
+    args.push("--environment", environmentName);
   }
   return {
     command: "railway",
@@ -447,7 +841,66 @@ function planRailwayServiceDeploy(service) {
     cwd: service.rootDir
   };
 }
-function deployRailwayService(tenantRoot, service, { dryRun = false } = {}) {
+async function syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, service, { env = process.env } = {}) {
+  const wantsInstanceConfig = service.buildCommand || service.startCommand || service.rootDir || service.healthcheckPath || service.healthcheckTimeoutSeconds !== null || service.healthcheckTimeoutSeconds !== void 0 || service.healthcheckIntervalSeconds !== null || service.healthcheckIntervalSeconds !== void 0 || service.restartPolicy || service.runtimeMode;
+  if (!wantsInstanceConfig) {
+    return null;
+  }
+  const workspace = await resolveRailwayWorkspaceContext({ env });
+  let project = null;
+  if (service.projectId) {
+    project = await ensureRailwayProject({
+      projectId: service.projectId,
+      projectName: service.projectName,
+      defaultEnvironmentName: service.railwayEnvironment,
+      env,
+      workspace: workspace.id
+    }).then((result) => result.project);
+  } else {
+    const projects = await listRailwayProjects({ env, workspaceId: workspace.id });
+    project = projects.find((entry) => entry.name === service.projectName) ?? null;
+    if (!project) {
+      project = await ensureRailwayProject({
+        projectName: service.projectName,
+        defaultEnvironmentName: service.railwayEnvironment,
+        env,
+        workspace: workspace.id
+      }).then((result) => result.project);
+    }
+  }
+  const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment);
+  let environment = project.environments.find((entry) => entry.name === environmentName || entry.id === environmentName) ?? null;
+  if (!environment) {
+    environment = await ensureRailwayEnvironment({
+      projectId: project.id,
+      environmentName,
+      env
+    }).then((result) => result.environment);
+  }
+  let railwayService = project.services.find((entry) => entry.id === service.serviceId || entry.name === service.serviceName) ?? null;
+  if (!railwayService) {
+    railwayService = await ensureRailwayService({
+      projectId: project.id,
+      serviceId: service.serviceId,
+      serviceName: service.serviceName,
+      env
+    }).then((result) => result.service);
+  }
+  return await ensureRailwayServiceInstanceConfiguration({
+    serviceId: railwayService.id,
+    environmentId: environment.id,
+    buildCommand: service.buildCommand,
+    startCommand: service.startCommand,
+    rootDirectory: relativeRailwayRootDir(tenantRoot, service.rootDir),
+    healthcheckPath: service.healthcheckPath,
+    healthcheckTimeoutSeconds: service.healthcheckTimeoutSeconds,
+    healthcheckIntervalSeconds: service.healthcheckIntervalSeconds,
+    restartPolicy: service.restartPolicy,
+    runtimeMode: service.runtimeMode,
+    env
+  });
+}
+async function deployRailwayService(tenantRoot, service, { dryRun = false } = {}) {
   const plan = planRailwayServiceDeploy(service);
   if (dryRun) {
     return {
@@ -468,22 +921,69 @@ function deployRailwayService(tenantRoot, service, { dryRun = false } = {}) {
       throw new Error(`Railway ${service.key} build command failed.`);
     }
   }
-  runRailway(plan.args, { cwd: service.rootDir });
+  let lastFailure = null;
+  for (let attempt = 1; attempt <= 5; attempt += 1) {
+    const result = runRailway(plan.args, {
+      cwd: service.rootDir,
+      capture: true,
+      allowFailure: true
+    });
+    if (result.stdout) {
+      process.stdout.write(result.stdout);
+    }
+    if (result.stderr) {
+      process.stderr.write(result.stderr);
+    }
+    if (result.status === 0) {
+      lastFailure = null;
+      break;
+    }
+    lastFailure = result;
+    if (!isRailwayTransientFailure(result) || attempt === 5) {
+      throw new Error(result.stderr?.trim() || result.stdout?.trim() || `railway ${plan.args.join(" ")} failed`);
+    }
+    const backoffMs = 5e3 * attempt;
+    console.warn(
+      `Railway deploy for ${service.serviceName ?? service.serviceId ?? service.key} hit a transient failure; retrying in ${Math.round(backoffMs / 1e3)}s...`
+    );
+    sleepSync(backoffMs);
+  }
+  if (lastFailure) {
+    throw new Error(lastFailure.stderr?.trim() || lastFailure.stdout?.trim() || `railway ${plan.args.join(" ")} failed`);
+  }
+  const runtimeConfiguration = await syncRailwayServiceRuntimeConfigurationAfterDeploy(tenantRoot, service, {
+    env: buildRailwayCommandEnv(process.env)
+  });
   return {
     service: service.key,
     status: "deployed",
     command: [plan.command, ...plan.args].join(" "),
     cwd: plan.cwd,
-    publicBaseUrl: service.publicBaseUrl
+    publicBaseUrl: service.publicBaseUrl,
+    runtimeConfiguration: runtimeConfiguration ? {
+      updated: runtimeConfiguration.updated,
+      healthcheckPath: runtimeConfiguration.instance.healthcheckPath,
+      healthcheckTimeoutSeconds: runtimeConfiguration.instance.healthcheckTimeoutSeconds,
+      runtimeMode: runtimeConfiguration.instance.runtimeMode
+    } : null
   };
 }
 export {
+  buildRailwayCommandEnv,
   configuredRailwayScheduledJobs,
   configuredRailwayServices,
   deployRailwayService,
+  ensureRailwayEnvironmentExists,
+  ensureRailwayProjectContext,
+  ensureRailwayProjectExists,
   ensureRailwayScheduledJobs,
+  ensureRailwayServiceExists,
+  isUsableRailwayToken,
   planRailwayServiceDeploy,
+  resolveRailwayAuthToken,
   resolveRailwayDeploymentProfile,
+  runRailway,
+  setRailwaySecretVariable,
   validateRailwayDeployPrerequisites,
   validateRailwayServiceConfiguration,
   verifyRailwayScheduledJobs