Deployment and ownership
Use managed static hosting now and understand the customer-owned Cloudflare path.
Shiplet-managed hosting is the default. Publish and review without a Cloudflare account, then consider customer-owned infrastructure only when you want direct runtime ownership.
Choose where it runs
Start here — Shiplet-managed
Shiplet hosts static artifacts and review URLs. No Cloudflare account or API token is required. Review identity, access, feedback, and revision history stay attached to one stable Shiplet.
Graduate later — Your Cloudflare
Connect one Cloudflare account with browser OAuth when you want a validated revision in infrastructure you own. Shiplet keeps review identity, permissions, feedback, audit history, secrets, and deployment authority inside its trusted kernel rather than package code.
Graduation is optional. The managed review keeps working when an external prerequisite is unavailable, access is denied, or a connection is revoked.
What Shiplet requests—and does not
What Shiplet requests: permission to read and write Worker scripts in the one selected account through workers.scripts.read and workers.scripts.write. offline_access is added only when the OAuth client uses refresh tokens.
What Shiplet does not request: DNS changes, account membership, reviewer identity, Shiplet credentials, organization-wide grants, shared platform bindings, or another Shiplet's state. No API token is pasted into Shiplet.
Revoking access blocks future updates; the last customer-owned deployment keeps running in your account. Reconnect only when you want Shiplet to manage another update.
Immutable revision flow
Fork an isolated draft, edit its artifact or extensions, validate it, and promote it explicitly. Deployments always install an immutable revision. A failed validation, stale promotion, or failed deployment leaves the prior active revision unchanged. Rollback creates a new audited operation and does not rewind namespaced state.
Availability at a glance
| Path | Status | Requirement |
|---|---|---|
| Managed static | Available by default | No Cloudflare connection |
| Managed external URL | Available by default | Public HTTP(S) origin; read-only proxy |
| Managed arbitrary Worker | Unavailable without isolation prerequisites | Attested Workers for Platforms gateway, limits, credential stripping, mediated egress |
| Managed custom MCP handlers | Fail closed until attested | Workers Paid with Dynamic Workers through the shipped Worker Loader binding |
| Customer-owned static | External prerequisite | Configured public OAuth client and control-plane bindings |
| Temporary claim | External prerequisite | Temporary-account broker, claim vault, policy acknowledgement |
External readiness is deployment-specific, so this static page never claims a mutable production capability is on or off. The authenticated Ownership & deployment view and deployment-status API are authoritative for the current Shiplet and user. Unavailable, denied, and revoked states fail closed while managed static review remains available.
Understand the ownership objects
A Deployment target is the destination and ownership boundary. A deployment is one revision installed on one target. A revision may deploy to several targets without changing its immutable bytes.
Customer-owned Cloudflare: connect, revoke, and recover
When configured, the owner connects through scoped OAuth, chooses an account, and creates a target. A customer Worker gets no WorkOS credential, OAuth vault entry, shared platform binding, organization-wide grant, or sibling state.
OAuth security ceremony
The browser flow uses a public Authorization Code client with S256 PKCE, an exact HTTPS redirect, and one-time signed state bound to the trusted user, browser session, Shiplet, selected account, and expiry. Wrong-session, wrong-user, replayed, expired, redirect-mismatched, multi-account, or extra-scope responses fail closed. Refresh material stays inside the credential control plane; package code and the main Worker receive no provider credential.
Advanced paths and limitations
Customer-owned arbitrary Worker modules are unavailable today without their enforceable runtime and egress prerequisites. The shared customer contract is static-only where the OAuth/provider control plane is configured. Managed arbitrary execution requires the revision-aware gateway, stripped platform authority, enforced limits, and mediated egress; missing prerequisites fail closed.
Platform operator setup
Platform operators should use External Cloudflare setup for the executable support-service and production-proof journey. That guide explains why this release uses no separate WFP deployment credential. Only when an owner connects does OAuth request account-level Workers Scripts Write for one selected account. Ordinary Shiplet owners do not run that setup.
OAuth and temporary readiness begin disabled. An exact-user operator_smoke deployment permits only the real provider check; a separate confirmed deploy enables the path after that check passes. Skip or failure restores disabled.
Custom hostname
A custom hostname is an explicit routing attachment, not package authority. The owner must control and verify it; Shiplet does not change DNS ownership automatically. Pending, failed, or revoked hostnames remain detached while the canonical review URL and last known-good deployment continue under their existing access policy.
Temporary claim
A static-only temporary preview can be claimed through a trusted backend redirect after current policy acknowledgement. If the browser loses the first redirect response, the same authenticated owner and exact opaque handle receive the same redirect until expiry; wrong-owner, altered, missing, or expired handoffs fail closed. Claim material stays in the support-service vault and scheduled expiry removes it. Future Shiplet updates require a separate OAuth connection.
Failure and recovery
- Validation failure: the prior active revision remains unchanged; fix the draft and validate again.
- Promotion conflict: refresh and compare; never overwrite the winner.
- Deployment failure: the prior active revision remains unchanged and the known-good deployment stays selected.
- Denied, expired, or revoked OAuth: no new provider effect; reconnect only when another update is needed.
- Rollback: reactivate known-good code through a new audited operation; state is not rewound.
From an existing URL
Use external_url for an existing public preview such as https://preview.example.com. Shiplet wraps it with the trusted review host. Review URLs still use the chosen tenant, such as https://campaign-prototype.shiplet.cc.
Next: prepare a managed static review, inspect the app's Ownership & deployment view, and read the security boundary. Repository operators should use External Cloudflare setup.