Deploy & Test

Quick reference for shipping updates and running every test in the repo. All commands are run from the repo root unless noted.

Deploy all sites

There are three deploy targets. Run only the ones whose files changed.

Target	What it is	Auto-deploy?
Docs site	This MkDocs site (Cloudflare Pages, Git-connected)	Yes — on push to main
Portal	Customer portal (Cloudflare Pages)	No — manual
Admin console	Provider console (Cloudflare Pages)	No — manual
Status page	Public status page (Cloudflare Pages)	No — manual
Backend API	Cloudflare Worker + D1	No — manual

# 1. Docs — auto-rebuilds on push; also runs CI
git push origin main

# 2. Customer portal — Cloudflare Pages (deploy from repo root)
wrangler pages deploy portal --project-name totlprovision-portal

# 3. Provider console — Cloudflare Pages (separate project + host)
wrangler pages deploy admin --project-name totlprovision-admin

# 4. Public status page — Cloudflare Pages
wrangler pages deploy status --project-name totlprovision-status

# 5. Backend API — Cloudflare Worker
wrangler deploy --config backend/wrangler.toml

Database migrations

Backend features ship as SQL migrations in backend/migrations/ (0001…00NN). Apply any new ones against D1 before deploying the Worker, in order. Each uses CREATE TABLE IF NOT EXISTS / additive ALTER, so they're safe to re-run except a fresh ALTER … ADD COLUMN, which errors if the column already exists (harmless — it means it's applied). Run with wrangler d1 execute totlprovision --remote --config backend/wrangler.toml --command "<sql>".

Note

The provider console (admin/) is a separate Pages project served at admin.totlprovision.totlcom.com. It calls the same Worker same-origin (/api/* route added in backend/wrangler.toml). Protect that host with a Cloudflare Access policy limited to Totlcom staff — it exposes cross-tenant management, so it must never be public.

Note

wrangler deploy --config backend/wrangler.toml uses the global Wrangler. To use the backend's pinned version instead (still from root): npm --prefix backend run deploy. Both deploy the same Worker.

Warning

Deploys require wrangler login in the current shell. Check with wrangler whoami first.

Database schema changes

If you changed backend/migrations/, apply the migration to the live D1 database after deploying:

wrangler d1 execute totlprovision --remote --config backend/wrangler.toml --file backend/migrations/0001_init.sql

Run all tests

Four test suites cover the engine (PowerShell/Pester), backend (Node), portal (Node), and docs build.

Everything, one command

Run the whole suite from the repo root and get a single pass/fail summary:

pwsh -File .\Run-AllTests.ps1

It runs all four suites, prints a SUMMARY table, and exits non-zero if anything fails — the same thing to run before a commit or deploy.

Individual suites

If you want to run one at a time, all from the repo root (no cd):

# Engine — Pester 5. Covers Core, Crypto, Debloat, Enroll, Preflight, Report, Security, build manifest.
pwsh -c "Invoke-Pester -Path .\engine\tests"

# Backend API — Node built-in test runner (auth / token hashing)
node --test backend/test/auth.test.mjs

# Portal — Node built-in test runner (WebCrypto escrow round-trip)
node --test portal/test/crypto.test.mjs

# Docs — strict build; fails on broken links or missing nav entries
mkdocs build --strict

node --test only auto-discovers a folder when given no path, so the file paths above are explicit.

Note

Pester 5 is required (Windows ships 3.x). Install once, then run in a fresh session so the new version loads: powershell Install-Module Pester -MinimumVersion 5.0.0 -Force -SkipPublisherCheck -Scope CurrentUser

Run one suite or one file

# A single engine test file
pwsh -c "Invoke-Pester -Path .\engine\tests\Totl.Security.Tests.ps1"

# A single Node test file
node --test backend/test/auth.test.mjs