> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cryptocheckout.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploying

> How code reaches production, and the guardrails around each surface.

## Branching

`main` is the single source of truth and the production line. Pushing to `main` auto-deploys production through the GitHub–Vercel integration.

<Danger>
  **Never push directly to `main`.** Every change lands via a pull request. The PR is the deploy gate.
</Danger>

Short-lived branches: `feat/<name>`, `fix/<name>`, `docs/<name>`, one per unit of work, deleted on merge. Use git worktrees for isolation, branching from `main`. `.worktrees/` is gitignored.

There is no integration branch. The old integration-to-main promotion model was retired in the 2026-05-21 cleanup. Vercel preview deploys on each PR cover the staging need.

Link the PR to its Linear issue with a magic word — `Fixes CRY-7` — in the title or body. Linear auto-links and moves the issue to Done on merge.

## Frontend

Normally nothing to do: merging to `main` triggers the deploy.

```bash theme={null}
vercel --prod --yes                  # manual production deploy
vercel --prod --yes --archive=tgz    # past the 5000 file-upload/day free-tier cap
```

<Warning>
  `vercel --yes` alone deploys to **Preview**. Production needs `--prod`.
</Warning>

Verify a deploy actually fired by checking that the main alias deployment's `githubCommitSha` matches the merged HEAD. If the GitHub integration silently did not fire, fall back to a manual `vercel --prod --yes --archive=tgz`.

## Edge functions

Prefer the Supabase CLI. A personal access token lives in `.env` as `SUPABASE_ACCESS_TOKEN`.

```bash theme={null}
export SUPABASE_ACCESS_TOKEN=$(grep '^SUPABASE_ACCESS_TOKEN=' .env | cut -d= -f2-)
npx --yes supabase@latest functions deploy <name> \
  --project-ref pocyrcfbpfvthtyvupqk --no-verify-jwt
```

All functions are `verify_jwt: false` because they use custom `cc_session` or bearer authentication.

<Warning>
  Use the MCP `deploy_edge_function` **only for tiny single-file functions.** It cannot follow out-of-tree imports such as `../../../contracts/deployments.json`, and it truncates string literals over 8KB — which silently corrupts contract bytecode and produces wrong CREATE2 predictions.
</Warning>

The CLI bundles real on-disk source with eszip: byte-exact, follows JSON and ABI imports natively, no truncation. Proven deploying \~66KB bundles dominated by contract bytecode, where the MCP path could not ship reliably.

The token can be re-minted at `supabase.com/dashboard/account/tokens`.

## Contracts

<Danger>
  **Mainnet deploys require explicit human GO, per chain.** Guardrail number one. No agent or automation may broadcast to a mainnet.
</Danger>

Before any broadcast:

<Steps>
  <Step title="Reset deployments.json">
    `git checkout -- contracts/deployments.json`. A `forge test` run pollutes it with fixtures.
  </Step>

  <Step title="Confirm the factory path">
    Deployment goes through the canonical CREATE2 factory, not the EOA. Predict with the factory address.
  </Step>

  <Step title="For TRON, re-prove 0x41">
    Any new init code needs its `0x41` CREATE2 derivation re-proven on Nile before an address is shown as a QR. A mismatch strands funds permanently.
  </Step>

  <Step title="Plan the drain window">
    Any init-code change moves every address. In-flight invoices quoted under the old scheme must drain, or use a versioned predictor.
  </Step>
</Steps>

## CSP changes

<Warning>
  CSP lives in **two** places — the `vercel.json` header and the `<meta http-equiv>` tag in `index.html`. The more restrictive wins. **Patch both or it silently breaks.**
</Warning>

Also confirm the SPA fallback rewrite still excludes `/api/`, or API routes get rewritten to `index.html`.

## After changing the SDK

<Danger>
  Regenerate the SRI pin. A stale pin makes browsers refuse to execute the SDK on every merchant site.

  ```bash theme={null}
  openssl dgst -sha384 -binary public/sdk.js | openssl base64 -A
  ```

  Then update `SDK_SRI` in `src/lib/sdk/embedSnippet.ts`.
</Danger>

## Migrations

<Warning>
  Local migration tooling is broken and production tracks 86 migrations that the repository cannot reproduce. Treat production schema changes as manual and verified, not as a `db reset` away. See [Known issues](/operations/known-issues).
</Warning>

## Post-deploy checks

* Live site console clean on `/`, `/verify`, and the demo widget panel.
* `/verify` renders the chain list from `deployments.json`, not a hardcoded list.
* An RLS-gated read with a freshly minted JWT returns rows.
* Bundle budget still passes; the entry chunk has not regained `wallet-vendor`.