Walkthrough 2: generate and deliver
Part 2 of 4. Previous: edit and publish. Next: the second deployment.
Generate on your machine
Section titled “Generate on your machine”The CMS cannot compile source code. Attempting hosted generation in Settings → Source & delivery returns source_build_runtime_unavailable. Generate locally from a copy of the CMS database:
npm run backend:generate -- --site <site-id> --source <cms.sqlite> --dest <output-directory> --db <scratch.sqlite>This writes and verifies the project. It pushes nothing and deploys nothing. npm run backend:deliver does the same generation, then pushes to your repository and starts the first deployment (detachment runbook).
Before you generate, open Settings → Source & delivery → Advanced — build webhook and deployment → Standalone backend. It lists model configurations that generation cannot support, such as relation selection limits that no list of linked items can satisfy.
What you now own
Section titled “What you now own”| Kind | Examples | On regeneration |
|---|---|---|
| Generated | prisma/schema.prisma, src/app.ts, scripts/*.mjs, data/published-snapshot.json, .github/workflows/dee-wan-build.yml |
Rewritten. If you edited one, the next regeneration refuses by name and changes nothing. |
| Owned | src/owned/, apps/site/src/owned/, apps/site/src/pages/owned/ |
Never overwritten during regeneration. |
| Shared | package.json, wrangler.jsonc, README.md, your own workflows |
Written once. package.json gains missing required keys. Your values stay. |
| CMS-owned rows | Rows in generated content tables | Replaced from the published snapshot whenever it changes. A row the snapshot does not hold is deleted, whoever wrote it. |
| Your tables and rows | Tables your own migrations create | Kept. Put your data here, never in generated tables. |
The full zone rule is in extending your backend.
Deliver an existing commit
Section titled “Deliver an existing commit”To push a project you already generated and deploy exactly that commit, use managed delivery:
npm run wire:github -- --repo owner/site-source --project ./generated/site --managed --operation delivery-1The CLI verifies the remote commit before it seals secrets or dispatches. Credentials are named in GitHub authentication. CLI success means GitHub accepted the run, not that deployment finished.
Credentials by name
Section titled “Credentials by name”Secret values are not included in repository source or stored in the CMS.
| Name | Holder | Used for |
|---|---|---|
CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID |
Your repository secrets | Creating and deploying the Worker, database and site |
API_BEARER_TOKEN |
Your repository secrets and your environment | The generated API’s writer token. verify:deployment uses it. |
DEE_WAN_URL, BUILD_TOKEN |
The managed workflow uses both values. The CMS mints BUILD_TOKEN per build. |
Pulling definitions while connected |
ARTIFACT_* |
Your repository secrets | Optional sign-in for the generated backend |
Next: the second deployment.
Unreleased / pre-MVP; no stable version
Source revision: fe23db481c422b40e317b92fc98116b4c0c26a87 (modified checkout)
Build date (UTC): 2026-10-18T09:22:34.630Z
Upgrade target: unavailable: modified checkout. Release notes