/deploy

name: blueprint-cloudflare-deploy
description: "With approval, create the D1 database, apply the migrations, and publish with wrangler deploy."

Publish to Cloudflare

This step's gates are **deploy-production** and **credential**: the user has approved publishing, and signing in to their Cloudflare account.

1. `yarn wrangler whoami`. If not signed in, ask the person, through the blueprint question tool, to run `yarn wrangler login` in this folder themselves and tell you when it is done. Never handle an API token. 2. Create the database once: `yarn wrangler d1 create <name>` and put the `database_id` it prints into `wrangler.jsonc`. Apply the migrations to it: `yarn wrangler d1 migrations apply DB --remote`. If `wrangler.jsonc` binds R2 buckets, create each once too (`yarn wrangler r2 bucket create <bucket_name>`): the deploy fails on a binding to a bucket that does not exist. 3. Secrets the app needs: ask the person to run `yarn wrangler secret put <NAME>` themselves. 4. `yarn build`, then give this build an id and ship it with the site: `node -e 'console.log(require("crypto").randomUUID())' > .blueprint/build-id && cp .blueprint/build-id dist/client/blueprint-build.txt`, then `yarn wrangler deploy`. 5. Write the URL it published to (`https://…workers.dev`, or the custom domain the spec names) to `.blueprint/deploy-url`, and tell the person the URL.

Done when the check passes: the URL in `.blueprint/deploy-url` serves the id this deploy wrote, answers `/api/health`, sends a Content-Security-Policy, and its page renders text in headless Chrome.

Always

• Read `.blueprint/spec.md` first. It is the agreed specification; do not widen it.
• When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
• Never enable billing, deploy to production, delete data or handle a credential unless this step's gates say the

user approved exactly that.

• Say you are done by stopping; the executor runs the check. Do not claim success yourself.