Distillation

Date: Aug 3, 2026

• 🔴 (21:09) User stated CLOUDFLARE_API_TOKEN must always be passed via environment variables, never CLI arguments or logs.
• 🔴 (21:09) User requires adversarial, thorough code review for deploy-target changes, including investigation of actual tool/API behavior, dry-run side-effect safety, secret leakage, configuration-validation edge cases, and behavior-specific test coverage.
• 🔴 (21:09) User requires compatibility dates for Cloudflare Pages Functions and Workers deploys to always be bumped to the latest available date rather than pinned to an older date.
• 🔴 (21:09) User requires exact file paths, line numbers, function names, and quoted code/comments when reporting review or research findings.
• 🔴 (21:09) User requires technical and design claims to be verified against actual primary sources—installed tool source, --help output, and official vendor documentation—before answering; user does not want guesses.
• 🟡 (21:09) .lore.md records that Craft’s Cloudflare target changed the default deployType from pages to worker; Pages remains supported explicitly via deployType: pages.
• 🟡 (21:09) .lore.md records that CLOUDFLARE_ACCOUNT_ID is optional and non-secret: Wrangler can auto-discover it for single-account tokens, while non-interactive multi-account cases may fail while listing account IDs; CLOUDFLARE_API_TOKEN remains the only required secret.
• 🟡 (21:09) .lore.md records that no Cloudflare SDK was added; the implementation uses raw global fetch with a Node 24.18.0 baseline.
• 🟡 (21:09) .lore.md records that Wrangler v4 has no built-in OIDC/keyless authentication; supported authentication paths are API token, deprecated legacy Global API Key, or wrangler login OAuth.
• 🟡 (21:09) .lore.md records that the Cloudflare target work was introduced as a PR #843 follow-up and received an adversarial-review verdict of solid with no CRITICAL or MAJOR issues.
• 🟡 (21:09) Cloudflare Pages API responses contain both top-level result.production_branch and nested result.source.config.production_branch; the top-level field is authoritative, while the nested field describes the linked Git repository setting.
• 🟡 (21:09) Wrangler deploy2() compares the top-level production branch with --branch to compute isProduction; a mismatch silently creates a preview deployment rather than returning an error.
• 🟡 (21:09) resolveProductionBranch() resolution order is: configured productionBranch; otherwise a raw fetch of the Cloudflare Pages project API; otherwise omit --branch, allowing a bare deploy from a non-git temporary directory to default to production.
• 🟡 (21:09) Cloudflare Pages production-branch lookup requires no token scope beyond Account → Cloudflare Pages → Edit, because Wrangler performs the same GET internally.
• 🟡 (21:09) Cloudflare production-branch lookup treats a 404 project-not-found response as a hard failure via reportError; transient 5xx or network errors soft-fail by warning and omitting --branch.
• 🟡 (21:09) The documented adversarial-review protocol forbids modifying files during review or rubber-stamping; it requires prioritized CRITICAL/MAJOR/MINOR findings with file:line references, concrete fixes, and verification through commands such as tsc, test runs, and git diff.