Deployment

Build and deploy the web and jobs Workers with isolated bindings.

Provision bindings

Preview and production need isolated D1 databases, public/private R2 buckets, Queue and DLQ resources, and Durable Object namespaces for realtime and auth rate limiting.

Secrets

Store Better Auth, Stripe, OpenAI, Resend, Unkey, and Cloudflare cache credentials as Worker secrets. Never place them in client loader data, versioned vars, logs, or Queue payloads.

Release order

1. Run pnpm verify and pnpm test:integration.
2. Apply forward migrations.
3. Deploy the web Worker.
4. Deploy the jobs Worker.
5. Exercise auth, billing webhooks, email, and public/private media.

Operational guarantees

• External side effects carry stable idempotency keys.
• Queue messages are versioned, small, and secret-free.
• Expired leases recover through the scheduled sweeper.
• Retry exhaustion is visible in D1 and the dead-letter queue.
• Logs and traces include request or job correlation identifiers.