Deployment
Release Checklist
Verify environments, migrations, auth, billing, and storage before real traffic.
Shared Gates
pnpm type-check
pnpm check:error
pnpm lint:ws
pnpm test:unit
pnpm apps:parity
pnpm buildThese do not prove external services work. Confirm .source/ is generated by install/dev/build, not hand-edited. Record whether SCENARIOS.md changed or already covers the journey and report unrun checks.
Deployment Differences
| Node: Vercel/Docker | Workers |
|---|---|
apps/web, Node 22.x; Vercel Root Directory = apps/web | apps/web-cloudflare, OpenNext + Wrangler |
Back up production Postgres; pnpm db:status / pnpm db:migrate | pnpm db:migrate:d1:remote / pnpm db:migrate:d1:status --strict |
| S3 credentials, bucket CORS, public read prefix | DB / R2_BUCKET, pnpm cf:typegen |
| Real Resend or Cloudflare mail, no console | Cloudflare Email Sending credentials and sending domain |
| Docker builds from root; public variables are build args | Public variables set at Worker build time; server secrets injected on Worker |
Manual and Automated Acceptance
- Bilingual home/docs/blog/legal, navigation, sitemap/robots; no dangling removed-page links.
- Actual production origin, OAuth callbacks, trusted origins; login, OTP, logout, expiry, onboarding, 2FA.
- Unauthenticated denial, user/admin boundaries, session-service errors distinct from login redirects; visible and escapable impersonation.
- Sandbox checkout, signed webhooks, renewals/cancellation/refunds, access and customer portals; bad gateways/products never falsely succeed.
- Own avatar/assets upload/download/delete, cross-user denial, missing storage, and empty lists.
- Contact, newsletter, and signed unsubscribe; no credentials/personal data leaked into clients or logs.
Run Node pnpm test:api and relevant pnpm test:e2e. Use Workers pnpm cf:preview for actual bindings. Current test:e2e:cf does not replace Wrangler verification; see Testing.
Do not seed development accounts in production, enable Better Auth testUtils, or bypass environment validation to hide missing config. Rehearse existing-database incremental upgrades on clones and keep build rollback/database restore plans.