Upgrades
Apply new schema patches and redeploy an existing environment while preserving secrets.
Use the upgrade path when the environment already exists and you want to preserve current secrets by default. From the repository root:
npm run upgrade:remoteThis automates the upgrade flow:
- exports Terraform outputs
- renders
wrangler.generated.jsonc - validates upgrade prerequisites
- provisions only missing secrets by default
- applies versioned remote D1 patches via
db:migrate:remote - builds and deploys the auth Worker
Only rotate when you mean to
Add --force-rotate-secrets only when intentionally rotating AUTH_SECRET / HMAC_KEY / JWT
material:
npm run upgrade:remote -- --force-rotate-secretsPulling upstream template changes
If you are running a fork of the template, pull upstream first, then upgrade:
git remote add upstream https://github.com/eetr-ai/eetr-auth.git
git fetch upstream
git merge upstream/main
npm run upgrade:remoteupgrade:remote applies any new versioned schema patches from db/patches/ via db:migrate:remote.
Not every release changes the schema — when none is needed, no patch is added and the schema version
simply stays put. See Database for the patch/migration model.
After upgrading
npm run verify:remoteConfirm the signing key, published JWKS, seeded scopes, and secrets are still consistent.