# Deployctl CLI Deployment (Server-Side Deno Deploy)

Use `deployctl` from the server to deploy to Deno Deploy without opening `dash.deno.com`.

## Prerequisites

```bash
# Install deployctl with required permissions
deno install -g --force --allow-sys --allow-env --allow-net --allow-read --allow-write \
  -n deployctl jsr:@deno/deployctl
```

## Deployment Flow

### 1. Prepare the project

```bash
mkdir -p /tmp/deno-deploy
cat > /tmp/deno-deploy/main.ts << 'EOF'
Deno.serve(async (req: Request) => {
  const url = new URL(req.url);
  const targetUrl = url.searchParams.get("url");
  if (!targetUrl) return new Response("Missing ?url=", { status: 400 });
  if (!targetUrl.includes("mp.weixin.qq.com")) return new Response("Denied", { status: 403 });
  const resp = await fetch(targetUrl, {
    headers: { "User-Agent": "Mozilla/5.0 ...", "Accept": "application/json" }
  });
  const body = await resp.text();
  return new Response(body, {
    status: resp.status,
    headers: { "Content-Type": "application/json; charset=utf-8" }
  });
});
EOF
```

### 2. Start deployment (generates auth URL)

```bash
export PATH="/home/ubuntu/.deno/bin:$PATH"
cd /tmp/deno-deploy
deployctl deploy --project=gdcjgk-proxy --entrypoint=main.ts
```

This outputs:
```
Authorization URL: https://dash.deno.com/signin/cli?claim_challenge=XXXX
```

### 3. User authorizes on phone

Send the URL to the user. They open it on their phone → click authorize.

⚠️ **The challenge expires within ~1 minute.** User must open immediately.

### 4. Deployment completes

After authorization, `deployctl` automatically deploys and prints the project URL.

## Pitfalls

- **`deployctl` needs reinstall with `--allow-sys`**: Default install crashes with `NotCapable: Requires sys access to "osRelease"`. Must use the install command above.
- **`deno` must be in PATH**: Use `export PATH="/home/ubuntu/.deno/bin:$PATH"` or `~/.deno/bin/deployctl` full path.
- **Auth URL is on `dash.deno.com`**: This domain is blocked in China even on mobile 4G (tested 2026-08-05). The CLI auth path `/signin/cli` may or may not work depending on network conditions. If user can't open it, fall back to alternative platforms.
- **Project name must be unique**: If `gdcjgk-proxy` already exists, use a different name.
- **Challenge is single-use and ephemeral**: If the user misses the window, kill the process and restart for a fresh URL.

## Alternative: Deploy via Tencent Cloud SCF (attempted, blocked by permissions)

Tencent SCF can be created via API using existing TAT credentials, but the account lacks:
- CAM role permissions for SCF (role `SCF_QcsRole` can be created, but the account can't attach the required policies)
- CLS (Cloud Log Service) permissions for function logging
- CMQ permissions for async invocation

The SCF attempt code and error traces are at the end of this file for reference. SCF is NOT a viable path with current credentials.