Operations — Deployment

Quick summary

Operations documentation is for authorized maintainers, not a one-command production deployment. Identify the environment and approval boundary before touching Worker, D1, or secrets.

Start with the deployment checklist. Keep local, staging, and production configuration separate; do not use a green build as deployment authorization.

Current deployment shape from be-cloudflare/wrangler.toml:

Worker (be-cloudflare)

Setting	Value
name	nougat-devpay-api (prod) / nougat-devpay-api-staging (env.staging)
main	build/worker/shim.mjs — local build artifacts only (no build.command; wrangler does not rebuild)
compatibility_date	2025-10-30
Routes	api.devpay.chu.plus (prod custom domain) · api.staging.devpay.chu.plus (staging)
Cron	*/5 * * * * — dispatch_outbox always; prune_expired (nonces+capabilities) only when LICENSE_SECURITY_ENABLED
D1	nougat-devpay-d1 (prod) · nougat-devpay-d1-staging (staging)

Staging [vars] currently set: CORS_ALLOWED_ORIGINS (explicit list), PAYMENT_MODE="staging", PAYMENT_PROVIDER="mock", PAYMENT_LIVE_ENABLED="false". Toss TEST config (TOSS_CLIENT_KEY, TOSS_API_BASE, TOSS_SUCCESS_URL/FAIL_URL) is commented; TOSS_SECRET_KEY goes through wrangler secret put (test keys only).

Environment variables (Worker)

Var	Purpose
PAYMENT_PROVIDER	mock (default) | toss | portone (unimplemented → 503)
PAYMENT_LIVE_ENABLED	false in all current environments; live+mock → 402
PAYMENT_MODE	environment label (staging)
LICENSE_SECURITY_ENABLED	exact true enables the PoP plane — absent today → PoP routes 404
LICENSE_SIGNING_JWK	entitlement signing key (secret)
CORS_ALLOWED_ORIGINS	comma-separated allowlist
TOSS_*	Toss TEST provider config + TOSS webhook secret
OUTBOX_SINK_URL	outbox delivery sink — unset in tests (dead-letters to consumer:none); end-to-end delivery NOT_VERIFIED
NOUGAT_RATE_LIMIT_RPM	global rate limit
DEV_AUTH, ALLOW_ACT_AS_SELLER	dev-auth escapes — never in production

Deploy posture (charter)

• Staging first — wrangler deploy --env staging is the only self-serve target; production deploy, D1 migration/reset, seed, rollback, and secret/DNS changes require explicit authorization.
• Migrations 001–017 verified on local miniflare SQLite only — remote D1 apply is NOT_VERIFIED and charter-gated.
• Full procedure: deployment-runbook.

MCP gateway (mcp/gateway)

cd mcp/gateway && npx wrangler deploy --config wrangler.toml

Vars: YETDAPAY_API_BASE, YETDAPAY_SITE_ORIGIN, YETDAPAY_REQUEST_TIMEOUT_MS, YETDAPAY_CORS_ORIGINS — see Remote Setup.

Frontend (fe/)

Nuxt 3 deployed to Cloudflare Pages (nougat-devpay.pages.dev + devpay.chu.plus domains appear in the staging CORS list). Local: pnpm install && pnpm dev in fe/.