Deploying

Pipeline

Every push to master or staging runs .github/workflows/deploy.yml:

1. Verify credentials and secrets for the target environment.
2. Typecheck.
3. Ensure the D1 database exists and apply pending migrations.
4. Seed fixture accounts (dev and staging only).
5. Build with OpenNext and deploy the Worker with --keep-vars.
6. Push runtime secrets.
7. Smoke test /api/auth/ok and /api/auth/jwks.

Run it by hand from the Actions tab (choose the environment) or:

gh workflow run deploy.yml --repo dyloginc/accounts --ref master -f environment=production

Moving production to accounts.dylog.ai

1. Add the dylog.ai zone to Cloudflare (or confirm it is already there) and switch nameservers.
2. In wrangler.jsonc production, add routes: [{ "pattern": "accounts.dylog.ai", "custom_domain": true }]. Cloudflare creates the DNS record and certificate on deploy.
3. In the same commit set BETTER_AUTH_URL=https://accounts.dylog.ai, COOKIE_DOMAIN=.dylog.ai, and point RETURN_TO_ORIGINS at each sub-app's dylog.ai origin.
4. Before deploying, make backends accept the new issuer alongside the old one.
5. After deploying: everyone signs in once more (new cookie domain), passkeys must be re-registered (new relying party), and the old issuer can be retired from backends once tokens have expired.

Observability

Worker logs (with query strings redacted) are in the Cloudflare dashboard under the Worker's Logs tab, or live with wrangler tail accounts. Emails that could not be sent are logged there too.