Distillation

["c60a0f3622bd883e470b955f242b0720","a4ed2287ab1d778d4ea74d27f1d2044f"]

<observations> Date: Jul 21, 2026 * 🔴 (09:02) User requested research on Cloudflare `wrangler` CLI v4.x behavior, specifically `wrangler pages deploy` and `wrangler deploy`, requiring answers grounded in official Cloudflare docs with citations/URLs where possible, explicitly stating not to guess. * 🔴 (09:02) User instructed to install wrangler locally for testing via: `cd /tmp/opencode && mkdir -p wr && cd wr && npm init -y && npm install wrangler@4.111.0`, then run `npx wrangler pages deploy --help`, `npx wrangler deploy --help`, `npx wrangler whoami --help` to inspect flags/behavior. * 🟡 (09:02) User asked Question 1: for `wrangler pages deploy`, what does Cloudflare use as the "production branch" (default `main` vs `production`)? What is the default production branch set by `wrangler pages project create`? Does `--branch <X>` deploy to production only if `<X>` exactly matches the project's configured production branch, otherwise preview? Context given: current docs say default is `main`; reviewer asked why not `production`. * 🟡 (09:02) User asked Question 2: Does wrangler auto-discover `CLOUDFLARE_ACCOUNT_ID` if unset — (a) auto-use if token has access to exactly one account, (b) behavior if token has access to multiple accounts (error/list/prompt), (c) can account_id be set in `wrangler.toml`/`wrangler.jsonc` instead of env var, (d) is `CLOUDFLARE_ACCOUNT_ID` strictly required or optional-with-fallback. * 🟡 (09:02) User asked Question 3: Is `CLOUDFLARE_API_TOKEN` the only auth mechanism, or does wrangler also support `CLOUDFLARE_API_KEY`+`CLOUDFLARE_EMAIL` (global API key) and OAuth via `wrangler login`? What auth is expected in CI/non-interactive context, and is there an OIDC/keyless option for Cloudflare in GitHub Actions? Is API token a secret (yes) — is ACCOUNT_ID considered a secret (reviewer notes it doesn't seem like one)? * 🟡 (09:02) User asked Question 4: If running `wrangler pages deploy <dir> --project-name <name>` without `--branch` from a directory that is NOT a git repo, what happens (error/preview/production)? Context: current implementation always passes `--branch <productionBranch>` to force production because deploy runs from an extracted temp dir with no git. User asked if there's a cleaner way to force production deploy than passing the production branch name, e.g. a `--production` flag or environment selector in wrangler v4. * 🔴 (09:02) User stated current implementation details to be reviewed for possible improvement: ACCOUNT_ID is env-var-required, default productionBranch=main, and