{
  "name": "wordis-bond",
  "compatibility_date": "2024-11-01",
  
  // ← Non-secret config (public in source)
  "vars": {
    "ENVIRONMENT": "production",
    "WORKER_NAME": "wordis-bond"
  },
  
  // ← Per-app unique Hyperdrive binding
  "hyperdrive": [{ "binding": "DB", "id": "96d8e7a2-..." }],
  
  // ← Per-app unique rate limiter namespace
  "rate_limiters": [{
    "binding": "AUTH_RATE_LIMITER",
    "namespace_id": "1002",  // wordis-bond only
    "simple": { "limit": 60, "period": 60 }
  }],
  
  // ← Staging override (different WORKER_NAME → different URL)
  "env": {
    "staging": {
      "name": "wordis-bond-staging",
      "vars": {
        "ENVIRONMENT": "staging",
        "WORKER_NAME": "wordis-bond-staging"
      }
    }
  }
}

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main, staging]

jobs:
  deploy:
    name: Deploy to ${{ matrix.environment }}
    environment: ${{ matrix.environment }}  # ← Separate secrets per env
    strategy:
      matrix:
        include:
          - environment: staging
            branch: staging
          - environment: production
            branch: main
    
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ matrix.branch }}
      
      - name: Deploy
        env:
          # These come from GitHub Environment Secrets
          # Can only access after approval
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          POSTHOG_KEY: ${{ secrets.POSTHOG_KEY }}
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
        run: wrangler deploy --env ${{ matrix.environment }}

// src/env.ts — All fields REQUIRED (no optionals)
export interface Env {
  DB: Hyperdrive;
  AUTH_RATE_LIMITER: RateLimit;
  SENTRY_DSN: string;        // ← Missing? Compile error
  POSTHOG_KEY: string;
  JWT_SECRET: string;
  ENVIRONMENT: 'staging' | 'production';  // ← Literal type, enum-like
  WORKER_NAME: string;
}

// src/index.ts — Type safety in middleware
import type { Env } from './env';

const app = new Hono<{ Bindings: Env }>();

app.use('*', (c, next) => {
  // TS error if c.env.ENVIRONMENT is missing or wrong type
  const env = c.env.ENVIRONMENT as 'staging' | 'production';
  
  return sentryMiddleware({
    dsn: c.env.SENTRY_DSN,      // ← TS error if missing
    environment: env,
    workerName: c.env.WORKER_NAME  // ← TS error if missing
  })(c, next);
});

// Health endpoint (runtime verification)
app.get('/health', (c) => {
  return c.json({
    status: 'ok',
    worker: c.env.WORKER_NAME,        // Shows actual worker name
    environment: c.env.ENVIRONMENT,   // Shows actual environment
    timestamp: new Date().toISOString()
  });
});

# Verify production deployment
curl https://wordis-bond.adrper79.workers.dev/health | jq .
# Expected:
# {"status":"ok","worker":"wordis-bond","environment":"production"}

# Verify staging deployment
curl https://wordis-bond-staging.adrper79.workers.dev/health | jq .
# Expected:
# {"status":"ok","worker":"wordis-bond-staging","environment":"staging"}

# If you see this — WRONG ENVIRONMENT DEPLOYED
# {"status":"ok","worker":"wordis-bond-staging","environment":"production"}
# → Staging code deployed to production URL!

cd apps/wordis-bond

# Check which environment you're about to deploy
wrangler deploy --dry-run --env staging 2>&1 | grep "Worker name"

# Should show: "wordis-bond-staging"
# If it shows "wordis-bond" → You're about to deploy to PRODUCTION!

- name: Verify Environment
  run: |
    ENV=${{ matrix.environment }}
    EXPECTED_WORKER=$([ "$ENV" = "production" ] && echo "wordis-bond" || echo "wordis-bond-staging")
    ACTUAL_WORKER=$(grep '"name"' wrangler.jsonc | head -1 | sed 's/.*"\([^"]*\)".*/\1/')
    
    echo "Expected worker: $EXPECTED_WORKER"
    echo "Actual worker: $ACTUAL_WORKER"
    
    if [ "$ENV" = "staging" ] && [ "$ACTUAL_WORKER" = "wordis-bond" ]; then
      echo "ERROR: Staging branch pointing to production worker!"
      exit 1
    fi

// WRONG — Modifiable at deploy time, no isolation
{
  "vars": {
    "DATABASE_URL": "postgres://...",  // If hardcoded, which environment?
    "ENVIRONMENT": "production"        // Easy to typo
  }
}

// WRONG — TypeScript allows missing secrets
export interface Env {
  SENTRY_DSN?: string;  // Optional — code won't error if missing
  JWT_SECRET?: string;
}

// WRONG — Not available on Cloudflare Workers
const env = process.env.ENVIRONMENT;  // undefined on Workers!

// WRONG — Secrets in source code!
{
  "vars": {
    "SENTRY_DSN": "https://xxx@xxx.ingest.sentry.io/1234"
  }
}

{
  "scripts": {
    "verify:env:local": "node scripts/verify-env.js local",
    "verify:env:staging": "node scripts/verify-env.js staging",
    "verify:env:production": "node scripts/verify-env.js production"
  }
}

#!/usr/bin/env node

const fs = require('fs');
const path = require('path');

const targetEnv = process.argv[2] || 'production';

console.log(`\n🔍 Verifying ${targetEnv} environment...\n`);

// Read wrangler.jsonc (simplified JSONC parser)
const wranglerPath = path.join(__dirname, '../wrangler.jsonc');
const wranglerContent = fs.readFileSync(wranglerPath, 'utf-8');

const checks = [
  {
    name: 'wrangler.jsonc exists',
    check: () => fs.existsSync(wranglerPath)
  },
  {
    name: `.dev.vars${targetEnv === 'local' ? '' : ' (not needed)'} exists`,
    check: () => targetEnv === 'production' || fs.existsSync(path.join(__dirname, '../.dev.vars'))
  },
  {
    name: 'src/env.ts has required fields',
    check: () => {
      const envPath = path.join(__dirname, '../src/env.ts');
      const envContent = fs.readFileSync(envPath, 'utf-8');
      return envContent.includes('SENTRY_DSN') && envContent.includes('JWT_SECRET');
    }
  },
  {
    name: 'src/index.ts has /health endpoint',
    check: () => {
      const indexPath = path.join(__dirname, '../src/index.ts');
      const indexContent = fs.readFileSync(indexPath, 'utf-8');
      return indexContent.includes("'/health'") || indexContent.includes('"/health"');
    }
  },
  {
    name: targetEnv === 'production' ? 'Production worker name is not "-staging"' : 'Staging worker name is "-staging"',
    check: () => {
      if (targetEnv === 'production') {
        return !wranglerContent.includes('"-staging"') && !wranglerContent.includes("'-staging'");
      } else {
        return wranglerContent.includes('-staging') || wranglerContent.includes('env.staging');
      }
    }
  }
];

let passed = 0;
let failed = 0;

checks.forEach(({ name, check }) => {
  try {
    if (check()) {
      console.log(`  ✅ ${name}`);
      passed++;
    } else {
      console.log(`  ❌ ${name}`);
      failed++;
    }
  } catch (e) {
    console.log(`  ⚠️  ${name} (error: ${e.message})`);
    failed++;
  }
});

console.log(`\n${passed} passed, ${failed} failed\n`);

if (failed > 0) {
  process.exit(1);
}

npm run verify:env:production   # Check before deploying to prod
npm run verify:env:staging     # Check before deploying to staging