From 661569c8fb716081b056fd6fd8dff2c61ff9a2a9 Mon Sep 17 00:00:00 2001
From: Tim Disney <tim@disnetdev.com>
Date: Thu, 30 Jul 2026 10:12:27 -0700
Subject: [PATCH] move wrangler to npm deps

---
 .tangled/workflows/deploy.yml | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/.tangled/workflows/deploy.yml b/.tangled/workflows/deploy.yml
index e96df6e..1d418c5 100644
--- a/.tangled/workflows/deploy.yml
+++ b/.tangled/workflows/deploy.yml
@@ -11,16 +11,18 @@ when:
 engine: microvm
 image: nixos
 
-# Pinned for the same reason ci.yml is: unstable no longer carries `nodejs_24`. 25.11 has all four
-# — node 24.14, pnpm 10.28, wrangler 4.61.
+# Pinned for the same reason ci.yml is: unstable no longer carries `nodejs_24`. 25.11 has node
+# 24.14 and pnpm 10.28.
 registry:
   nixpkgs: github:nixos/nixpkgs/nixos-25.11
 
+# Wrangler is deliberately NOT here. nixpkgs builds it from source (`wrangler-pnpm-deps`), which is
+# not in the cache for this pin, and building it took the guest down. The deploy step fetches the
+# published npm binary instead — see WRANGLER_VERSION below.
 dependencies:
   - nodejs_24
   - pnpm
   - git
-  - wrangler
 
 environment:
   # The origin the bundle will be served from. A static bundle cannot discover this, and an atproto
@@ -30,6 +32,8 @@ environment:
   # authorization server, not a cosmetic wrong value.
   PUBLIC_RADIAL_ORIGIN: "https://radl.app"
   CLOUDFLARE_PROJECT: "radial"
+  # Pinned rather than `wrangler@4`, so a deploy that worked yesterday is the same deploy today.
+  WRANGLER_VERSION: "4.69.0"
 
 steps:
   - name: "Install"
@@ -55,6 +59,11 @@ steps:
       : "${CLOUDFLARE_API_TOKEN:?set CLOUDFLARE_API_TOKEN as a spindle secret}"
       : "${CLOUDFLARE_ACCOUNT_ID:?set CLOUDFLARE_ACCOUNT_ID as a spindle secret}"
       # `--branch main` is what makes this the production deployment rather than a preview.
-      wrangler pages deploy packages/ui/build \
-        --project-name "$CLOUDFLARE_PROJECT" \
+      # `--commit-dirty` because a built workspace is not a clean checkout, and wrangler otherwise
+      # refuses; the sha it should record is the one spindle checked out, present on push only.
+      args=(pages deploy packages/ui/build
+        --project-name "$CLOUDFLARE_PROJECT"
         --branch main
+        --commit-dirty=true)
+      if [ -n "${TANGLED_SHA:-}" ]; then args+=(--commit-hash "$TANGLED_SHA"); fi
+      pnpm dlx "wrangler@$WRANGLER_VERSION" "${args[@]}"
-- 
2.51.2