Deploy native Golf with Alchemy

Choose an account and domain

Use an explicitly selected Cloudflare account with Artifacts and Containers eligibility and an owned zone. Decide the control hostname, protected preview hostname and an already approved Access identity. Native Golf and the older origin bridge cannot both own one hostname.

The retained Alchemy recipe is the command authority. It provisions real account resources and records their ownership. Read its prerequisites and current beta limits before running it.

Prepare, inspect, deploy

1. Install the product checkout's pinned dependencies and native cf CLI; authenticate the intended profile/account without copying tokens into Git or command arguments.
2. Run the documented Alchemy preparation into a fresh private directory. Inspect resource names, zone/account identities, hostnames, feature selections and token expiry, without publishing private input or state.
3. Run the documented deploy. Alchemy provisions Workers, D1, R2, Durable Objects, Queues/Workflows, Access, dispatch and approved registry image; optional bindings require their own enable step.
4. Verify Worker and already-running Durable Object convergence, the schema, actual Access sign-in, current grants and the runtime capability view. An upload acknowledgment is not functional acceptance.
5. Seed only the documented fixtures and deliberately publish each public repository/profile. Private is the retained default.

Optional services and lifecycle

Alchemy operator action	Purpose	Boundary
enable-ai with optional --agent-path	Private AI Gateway, Clef advice and proposal profile	Account/model eligibility; proposals edit only the approved path
enable-email	Onboard sender subdomain and bind Email Service	User consent, subscription and grant checks; acceptance differs from inbox delivery
enable-webhooks	Bind encrypted subscriptions and approved receiver origins	Stable event IDs, signed deliveries, bounded retries
enable-secrets / enable-workflow	Encrypt values and approve the exact workflow path	Values reach only explicitly approved native PR jobs
enable-dead-letter	Retain exhausted evidence messages	Redrive must recheck current authority
enable-operations	Service probes and separate analytics-read token	Bound/configured does not establish successful collection
enable-rate-limit	Optional anonymous public-read limiter	Approximate per-network/location counts; limiter failure allows requests
migrate	Apply reviewed additive migrations	Back up and follow documented schema/source gates
renew-credentials / renew-deploy	Renew owned authority and deployment permissions	Old grants are not silently widened; tokens expire

Use the full service map when reviewing configuration. Cron delivery has failed on the retained account; the Workspace Durable Object alarm provides maintenance fallback. Do not assume fresh installs inherit a healthy schedule.

Stop and cleanup

Use the recipe's owned-resource teardown and inspect each absence result. Preserve shared Secrets Store resources and unrelated account infrastructure. Artifacts repositories, app resources, registry artifacts and custom domains need their own ownership-aware cleanup; deleting a Worker alone is insufficient.

Do not copy .cloudflare/, .tmp/, Alchemy input/state, keys or environment files into the documentation or public website. The static marketing/docs deployment is independent of the product runtime.