diff --git a/packages/cli-v3/package.json b/packages/cli-v3/package.json
index 326104a624d..5967a175b1b 100644
--- a/packages/cli-v3/package.json
+++ b/packages/cli-v3/package.json
@@ -45,7 +45,8 @@
     ],
     "exports": {
       "./package.json": "./package.json",
-      ".": "./src/index.ts"
+      ".": "./src/index.ts",
+      "./internal": "./src/internal.ts"
     }
   },
   "devDependencies": {
@@ -159,6 +160,12 @@
         "types": "./dist/esm/index.d.ts",
         "default": "./dist/esm/index.js"
       }
+    },
+    "./internal": {
+      "import": {
+        "types": "./dist/esm/internal.d.ts",
+        "default": "./dist/esm/internal.js"
+      }
     }
   }
 }
diff --git a/packages/cli-v3/src/deploy/buildImage.ts b/packages/cli-v3/src/deploy/buildImage.ts
index aa8285a7c3e..391b5b1b1a0 100644
--- a/packages/cli-v3/src/deploy/buildImage.ts
+++ b/packages/cli-v3/src/deploy/buildImage.ts
@@ -708,7 +708,7 @@ export async function generateContainerfile(options: GenerateContainerfileOption
   }
 }
 
-const parseGenerateOptions = (options: GenerateContainerfileOptions) => {
+export const parseGenerateOptions = (options: GenerateContainerfileOptions) => {
   const buildArgs = Object.entries(options.build.env || {})
     .flatMap(([key]) => `ARG ${key}`)
     .join("\n");
diff --git a/packages/cli-v3/src/internal.ts b/packages/cli-v3/src/internal.ts
new file mode 100644
index 00000000000..da97c4cfef7
--- /dev/null
+++ b/packages/cli-v3/src/internal.ts
@@ -0,0 +1,33 @@
+// Public API surface for downstream tooling that wants to drive the
+// build / deploy pipeline programmatically without going through the
+// `trigger` CLI binary.
+//
+// Mirrors the pattern used by `@trigger.dev/build`'s `./internal` subpath:
+// the modules exported here are stable enough to be consumed by adjacent
+// packages, but they sit *below* the documented CLI command surface, so
+// consumers should pin to a specific version of this package.
+
+// Build / deploy primitives
+export { loadConfig } from "./config.js";
+export { buildWorker } from "./build/buildWorker.js";
+export { buildImage, parseGenerateOptions } from "./deploy/buildImage.js";
+
+// Auth + project-environment resolution. `login` reads TRIGGER_ACCESS_TOKEN
+// from the env when present (so it works in CI without a config file);
+// `getProjectClient` performs the two-step engine API URL discovery and
+// returns an engine-bound CliApiClient that callers use for all subsequent
+// deploy/register/finalize/fail API calls.
+export { login } from "./commands/login.js";
+export { getProjectClient } from "./utilities/session.js";
+
+// Deploy-time env var sync (deploy.sync.env / .parentEnv -> POST .../envvars/import).
+export { syncEnvVarsWithServer } from "./commands/deploy.js";
+
+// Build-host helpers used by the deploy flow:
+//   - resolveLocalEnvVars / loadDotEnvVars: read project-local .env files
+//   - createGitMeta: extract git metadata for the deployment record
+//   - getTmpDir: scoped temp directory with cleanup tracking
+export { resolveLocalEnvVars } from "./utilities/localEnvVars.js";
+export { loadDotEnvVars } from "./utilities/dotEnv.js";
+export { createGitMeta } from "./utilities/gitMeta.js";
+export { getTmpDir } from "./utilities/tempDirectories.js";