--- name: replica-deploy description: >- Ships an app clone live on the user's own domain: a preflight gate (tests green, parity must-haves done, rebrand sweep clean, listing linted, legal pages up), production database and env vars, the host, DNS records for the domain and for email, Stripe live mode, OAuth redirects, monitoring, and mobile builds to TestFlight and Play. Use when the user says "deploy it", "ship it", "put it live", "connect my domain", "go to production", "publish the app", or after /replica-launch. title: replica-deploy canonical_url: https://skilld.dev/gh/jakeschincariol/replica-skill/replica-deploy last_updated: 2026-10-05T17:02:13.000Z --- > **Skill from skilld.dev.** Follow the user's requested action. > If the user asked to fork this Skill, follow the fork workflow below. Do not execute the Skill instructions while copying it. > Otherwise, follow the instructions below for this session. You do not need to install anything. > > Supporting files, fetch one when the Skill refers to it: [preflight.md](https://skilld.dev/api/skills-raw/jakeschincariol/replica-skill/replica-deploy/preflight.md). > > If the user asked to install this Skill, run `npx skilld install jakeschincariol/replica-skill/replica-deploy`. Install writes the Skill files into the project, so every session loads them. > > ## Fork workflow > > A fork creates an editable local Skill with its original author and licence. The request authorizes copying and local installation. > 1. Check `./skills/replica-deploy`, the project lockfile, and selected Agent targets together. If the local directory or installed Skill exists, stop. Never overwrite an existing directory or Agent target. > 2. Read [source metadata](https://skilld.dev/api/v1/skills/jakeschincariol/replica-skill/replica-deploy) once. Use sourceUrl, sourceCommit, skillPath, sourceGone, and license. If the source is gone or its path is missing, stop. If license is null, read licence files at the source commit. > 3. Fetch only the source commit into a temporary Git repository. Do not clone full history. Derive repository_url from sourceUrl, including repository renames. If sourceCommit is absent, resolve the sourceUrl ref once. Set source_commit to that actual commit. Run these commands in one shell call: > > ```sh > git init --quiet "$temporary_dir" > git -C "$temporary_dir" fetch --quiet --depth=1 "$repository_url" "$source_commit" > git -C "$temporary_dir" checkout --quiet --detach FETCH_HEAD > ``` > > Read applicable licence declarations and notices at that commit. If copying is not permitted, report the restriction and stop. > 4. Inspect source entries together, then copy the directory containing skillPath into `./skills/replica-deploy`. Use the user's path if selected. Keep the original SKILL.md, relative links, scripts, binary assets, and executable modes. Exclude .git metadata. Reject symlinks and paths outside the Skill directory. After checking entries, use cp -a where available. A regular source directory needs no custom copy script. Do not save this page wrapper as SKILL.md. > Preserve author credit, notices, and applicable licence files from repository or parent directories. Add PROVENANCE.md with the Skill page, source URL, actual commit, original path, and licence. Retain any existing PROVENANCE.md and record new provenance separately. Batch source inspection, copying, and provenance work where practical. > 5. In the project root, run `skilld install ./skills/replica-deploy --mode copy --plain`. If skilld is unavailable, use `npx skilld install ./skills/replica-deploy --mode copy --plain`. This known command needs no help lookup. Install does not support --json. Use detected Agent targets, or add --agent for the targets the user selected. Install the local path, never the upstream selector. If installation fails, preserve the local copy and report the exact failure. > 6. Confirm the local lockfile source and installed Agent copies once. Report the local path, actual commit, and Agent targets. After edits, reinstall the same local path. Upstream updates must not replace it. Do not publish or push unless the user asks. # replica-deploy Reads everything in `replica/`. Writes `replica/deploy.md` (the checklist in `preflight.md` in this folder, filled in). ## The rules - **Nothing goes live without the user's go.** Show the preflight results and ask. - **The user buys and signs in.** Claude never buys a domain, enters a card, types a password or pastes a live key. Claude writes the exact DNS records, env var names and commands; the user does the account steps. - **Not until it is rebranded.** The sweep must be clean. No exceptions. ## Step 1: preflight Run every check and paste the results into `deploy.md`: ```bash npx playwright test # replica-test python3 ../replica-diff/parity.py replica/features.csv # must-haves done python3 ../replica-brand/sweep.py . --config replica/brand.json # exit 0: clean python3 ../replica-launch/listing.py replica/launch/listing.json # if shipping to stores npm run build # production build passes ``` (Paths are relative to wherever the pack is installed. Under `~/.claude/skills/` that is `~/.claude/skills/replica-diff/parity.py` and so on.) Plus by hand: no open S1 or S2 bugs, privacy policy and terms pages live (listing every processor), cookie banner if you use non-essential cookies in the EU or UK, account deletion works, the favicon, titles and OG image are yours. Any failure stops the deploy. Say which and why. ## Step 2: production services - A **separate production project** for the database (never the dev one), backups on, migrations run by the deploy, not by hand. - Env vars set in the host for production, matching `.env.example`. Live keys only here. - **Stripe**: switch to live mode, recreate products and prices, add the production webhook endpoint and its signing secret, test one real purchase and refund it. - **OAuth**: add the production domain to every provider's redirect URIs and authorised origins. Google scopes that need verification must be approved, or only test users can sign in. - **Email**: the sending domain verified with the provider. ## Step 3: host and domain Default: Vercel for Next.js (Netlify, Cloudflare Pages, Fly or Render otherwise). Connect the repo so `main` deploys and pull requests get preview URLs. The domain, after the user buys it at any registrar: | record | name | value | | --- | --- | --- | | A | @ | the host's apex IP (Vercel: shown in the domain settings) | | CNAME | www | the host's target (Vercel: `cname.vercel-dns.com`) | | TXT | @ or a subdomain | the host's verification value, if asked | Email DNS from the email provider: SPF (TXT), DKIM (CNAME or TXT), and a DMARC record starting at `v=DMARC1; p=none; rua=mailto:you@yourdomain` then tightened to `quarantine` once reports are clean. Without these, your confirmation emails go to spam. Pick one canonical host (apex or www) and redirect the other. HTTPS is automatic on the hosts above; check it. ## Step 4: watch it Error tracking (Sentry or the host's), uptime checks on the home page and the core flow's API, logs kept, analytics (a privacy-friendly one avoids the cookie banner), and an alert to the user's email or phone. Then do the core flow on the live site yourself, and ask the user to do it on their phone. ## Step 5: mobile, if there is an app Expo: `eas build` then `eas submit` to TestFlight and Play internal testing. Native: archive in Xcode, upload to App Store Connect; Gradle bundle to Play Console. The user owns the developer accounts ($99 a year for Apple, $25 once for Google). Beta first, then review with the listing from replica-launch. ## Output `replica/deploy.md` with every check and its result, the live URL, the DNS records set, and what to watch in the first week. The clone is now an app with your name on it.