Deployment

The Admin CRM is not a Pages project. wrangler.jsonc deploys dist/ as a Cloudflare Worker with static assets plus the /rest/* proxy.

Environment	Script	Env file	Worker	Domain	Trigger
development	npm run deploy:develop	.env.development	emaw-admin-dev	admin-dev.everymanawarrior.cc	GitHub Action on push to develop (.github/workflows/deploy-develop.yml)
production	npm run deploy:production	.env.production	emaw-admin	admin.everymanawarrior.cc	Manual

scripts/deploy.mjs <mode>:

1. Loads .env.<mode> and requires VITE_API_BASE_URL.
2. tsc -b.
3. vite build --mode <mode> with NODE_ENV=production.
4. wrangler deploy --env <mode> --var API_ORIGIN:<VITE_API_BASE_URL>. Extra arguments pass through, e.g. npm run deploy:develop -- --dry-run.

The workflow is the standard one: Node 24, npm ci, npm run deploy:develop, secrets CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID on the develop environment, older runs cancelled.

Manual production deploy

npx wrangler login              # once per machine
npm test
npm run deploy:production

Custom domains on the Worker create their own DNS records in the everymanawarrior.cc zone.

Cloudflare Access

Both domains sit behind an Access application allowing Google Workspace accounts. The backend's CF_ACCESS_TEAM_DOMAIN and CF_ACCESS_AUD must match that application's team domain and audience tag, or every staff request is refused with 403 after login. When creating a new Access application (for example for a new hostname), update the backend .env with the new aud.

Checklist for a production release

• Backend changes it depends on are live; CRM_FRONTEND_GUIDE.md updated if the contract changed
• npm test and npm run lint pass
• .env.production points at https://app.emaw-app.com
• npm run deploy:production; open https://admin.everymanawarrior.cc, pass Access, sign in, load Contacts
• No dev banner visible

Known gaps

• No production workflow (add deploy-production.yml on push to main running npm run deploy:production).
• The develop workflow does not run npm test.