Deploy Workers
Build and publish Worker scripts directly to Cloudflare
Resolves hostname → storefront via KV (D1 fallback), decrypts the Storefront Access Token inline
using AES-256-GCM envelope encryption, then forwards GraphQL to Shopify. Writes audit rows to D1.
Requires bindings D1_SHOPIFY, KV_SHOPIFY, and KEK_SHOPIFY_TOKEN
from the Secrets Store.
Admin provisioning worker — currently disabled. Returns
503 worker-admin is not active for all requests.
Deploy this to push the disabled stub to Cloudflare and block the route
until the worker is fully implemented.
Envelope encryption worker. Exposes /wrap, /unwrap,
/rotate, and /rotate-kek via service binding only —
not reachable over public HTTPS. KEK_<kid> worker secrets
must be set separately via wrangler or the Cloudflare dashboard after deployment.