Dev Deployment Checklist

Local pnpm dev is development-only. This checklist covers deploying to a development/staging environment (including app.neemias.app / api.neemias.app when those are in dev mode, e.g. with ENVIRONMENT=dev).

---

1. Local Development (pnpm dev)

No checklist needed — just run pnpm dev for the frontend and pnpm dev:worker for the API.

• Frontend: http://localhost:5173
• Worker: http://localhost:8788

---

2. Dev Environment Deployment Checklist

Use this when deploying to a dev/staging instance. Production has a separate, stricter checklist in production-checklist.md.

2.1 Build & Tests

• pnpm -r test passes (all unit + integration suites)
• pnpm build:app succeeds (production build compiles)
• pnpm docs:check passes (markdownlint + VitePress build)
• pnpm docs:lint passes (no new markdown errors)

2.2 CSP & Security (dev mode)

• CSP is nonce-based (contains 'nonce-...' in style-src) — this is intentional for dev
• 'unsafe-inline' is present in style-src (required alongside nonce for dev)
• Browser console shows no CSP errors on login page load
• scripts/validate-csp.sh passes (all required origins in connect-src)

2.3 Environment Variables (Cloudflare Dashboard)

These must be set in Cloudflare Dashboard → Workers & Pages.

Variable	Service	Required	Dev value
AUTH_MODE	Worker	Yes	dev (accepts dev tokens)
AUTH_DEV_ADMIN_TOKEN	Worker	Optional	Set for local API testing
ENVIRONMENT	Worker	No (leave unset)	Defaults to dev — seed endpoint works
DEPLOY_ENV	Pages	No (leave unset)	Defaults to dev — frontend seed runs

Zero as any constraint: No as any in production code (app/src/, workers/src/, packages/). Only test files (__tests__/) may use casts. Pre-commit hook checks with scripts/count-as-any.sh.

2.4 Deploy Steps

# 1. Build frontend (generates _headers with dev-mode CSP)
pnpm build:app

# 2. Commit and push (Pages auto-deploys from git)
git add -A && git commit -m "deploy: ..."
git push

# 3. Deploy Worker separately
pnpm deploy:worker

# 4. Apply D1 migrations (if any)
pnpm db:migrate:remote

2.5 Post-Deploy Verification

• Login page loads without console errors
• Dev seed populates demo data (POST /api/v1/_seed)
• Login works with dev admin credentials
• Attendance marking works (online mode)
• Service Worker registers (check Application → Service Workers in DevTools)
• Offline mode: disconnect network, verify SQLite WASM fallback loads
• All E2E smoke specs pass (pnpm exec playwright test --config=playwright.smoke.config.ts)

2.6 Known Dev-Only Behaviors

Behavior	Why	Impact
VITE_BACKEND_URL must be set	Worker runs on different port	API calls fail silently
CSP uses nonce + unsafe-inline	Vite HMR injects inline styles	Same as production but less strict
Seed runs automatically	DEPLOY_ENV=dev (default)	Demo users created on first visit