The purge step only knew CLOUDFLARE_API_TOKEN (Bearer), which is invalid in our env files, so every deploy skipped the CDN purge and served stale .mjs until the TTL. Now it prefers the Global API Key (CLOUDFLARE_EMAIL + CLOUDFLARE_API_KEY, X-Auth headers), resolved across the vault env files, and falls back to a Bearer token. Verified it resolves creds and the zone id. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>